Merge branch 'x86/asm' into x86/atomic

Merge reason:
	Conflict between LOCK_PREFIX_HERE and relative alternatives
	pointers

Resolved Conflicts:
	arch/x86/include/asm/alternative.h
	arch/x86/kernel/alternative.c

Signed-off-by: H. Peter Anvin <hpa@zytor.com>

779 files changed, 54723 insertions, 14504 deletions

diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index e777961939f3..0dbe0d139ac2 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -22,6 +22,7 @@
 
 #include <linux/jiffies.h>
 #include <linux/file.h>
+#include <linux/slab.h>
 #include <linux/stat.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 14d944204571..7317b39b2815 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -24,6 +24,7 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/idr.h>
 #include <net/9p/9p.h>
@@ -110,7 +111,7 @@ struct p9_fid *v9fs_fid_lookup(struct dentry *dentry)
 {
         int i, n, l, clone, any, access;
         u32 uid;
-        struct p9_fid *fid;
+        struct p9_fid *fid, *old_fid = NULL;
         struct dentry *d, *ds;
         struct v9fs_session_info *v9ses;
         char **wnames, *uname;
@@ -151,7 +152,7 @@ struct p9_fid *v9fs_fid_lookup(struct dentry *dentry)
                         if (access == V9FS_ACCESS_SINGLE)
                                 return ERR_PTR(-EPERM);
 
-                        if (v9fs_extended(v9ses))
+                        if (v9fs_proto_dotu(v9ses))
                                 uname = NULL;
                         else
                                 uname = v9ses->uname;
@@ -183,10 +184,18 @@ struct p9_fid *v9fs_fid_lookup(struct dentry *dentry)
                 l = min(n - i, P9_MAXWELEM);
                 fid = p9_client_walk(fid, l, &wnames[i], clone);
                 if (IS_ERR(fid)) {
+                        if (old_fid) {
+                                /*
+                                 * If we fail, clunk fid which are mapping
+                                 * to path component and not the last component
+                                 * of the path.
+                                 */
+                                p9_client_clunk(old_fid);
+                        }
                         kfree(wnames);
                         return fid;
                 }
-
+                old_fid = fid;
                 i += l;
                 clone = 0;
         }
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index cf62b05e296a..f8b86e92cd66 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -29,6 +29,7 @@
 #include <linux/sched.h>
 #include <linux/parser.h>
 #include <linux/idr.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
@@ -84,7 +85,7 @@ static const match_table_t tokens = {
 
 static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
 {
-        char *options;
+        char *options, *tmp_options;
         substring_t args[MAX_OPT_ARGS];
         char *p;
         int option = 0;
@@ -102,9 +103,12 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
         if (!opts)
                 return 0;
 
-        options = kstrdup(opts, GFP_KERNEL);
-        if (!options)
+        tmp_options = kstrdup(opts, GFP_KERNEL);
+        if (!tmp_options) {
+                ret = -ENOMEM;
                 goto fail_option_alloc;
+        }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -159,8 +163,12 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                         break;
                 case Opt_cache:
                         s = match_strdup(&args[0]);
-                        if (!s)
-                                goto fail_option_alloc;
+                        if (!s) {
+                                ret = -ENOMEM;
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                  "problem allocating copy of cache arg\n");
+                                goto free_and_return;
+                        }
 
                         if (strcmp(s, "loose") == 0)
                                 v9ses->cache = CACHE_LOOSE;
@@ -173,8 +181,12 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
 
                 case Opt_access:
                         s = match_strdup(&args[0]);
-                        if (!s)
-                                goto fail_option_alloc;
+                        if (!s) {
+                                ret = -ENOMEM;
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                  "problem allocating copy of access arg\n");
+                                goto free_and_return;
+                        }
 
                         v9ses->flags &= ~V9FS_ACCESS_MASK;
                         if (strcmp(s, "user") == 0)
@@ -194,13 +206,11 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                         continue;
                 }
         }
-        kfree(options);
-        return ret;
 
+free_and_return:
+        kfree(tmp_options);
 fail_option_alloc:
-        P9_DPRINTK(P9_DEBUG_ERROR,
-                   "failed to allocate copy of option argument\n");
-        return -ENOMEM;
+        return ret;
 }
 
 /**
@@ -228,11 +238,18 @@ struct p9_fid *v9fs_session_init(struct v9fs_session_info *v9ses,
                 return ERR_PTR(-ENOMEM);
         }
 
+        rc = bdi_setup_and_register(&v9ses->bdi, "9p", BDI_CAP_MAP_COPY);
+        if (rc) {
+                __putname(v9ses->aname);
+                __putname(v9ses->uname);
+                return ERR_PTR(rc);
+        }
+
         spin_lock(&v9fs_sessionlist_lock);
         list_add(&v9ses->slist, &v9fs_sessionlist);
         spin_unlock(&v9fs_sessionlist_lock);
 
-        v9ses->flags = V9FS_EXTENDED | V9FS_ACCESS_USER;
+        v9ses->flags = V9FS_ACCESS_USER;
         strcpy(v9ses->uname, V9FS_DEFUSER);
         strcpy(v9ses->aname, V9FS_DEFANAME);
         v9ses->uid = ~0;
@@ -253,13 +270,15 @@ struct p9_fid *v9fs_session_init(struct v9fs_session_info *v9ses,
                 goto error;
         }
 
-        if (!v9ses->clnt->dotu)
-                v9ses->flags &= ~V9FS_EXTENDED;
+        if (p9_is_proto_dotl(v9ses->clnt))
+                v9ses->flags |= V9FS_PROTO_2000L;
+        else if (p9_is_proto_dotu(v9ses->clnt))
+                v9ses->flags |= V9FS_PROTO_2000U;
 
         v9ses->maxdata = v9ses->clnt->msize - P9_IOHDRSZ;
 
         /* for legacy mode, fall back to V9FS_ACCESS_ANY */
-        if (!v9fs_extended(v9ses) &&
+        if (!v9fs_proto_dotu(v9ses) &&
                 ((v9ses->flags&V9FS_ACCESS_MASK) == V9FS_ACCESS_USER)) {
 
                 v9ses->flags &= ~V9FS_ACCESS_MASK;
@@ -289,6 +308,7 @@ struct p9_fid *v9fs_session_init(struct v9fs_session_info *v9ses,
         return fid;
 
 error:
+        bdi_destroy(&v9ses->bdi);
         return ERR_PTR(retval);
 }
 
@@ -314,6 +334,8 @@ void v9fs_session_close(struct v9fs_session_info *v9ses)
         __putname(v9ses->uname);
         __putname(v9ses->aname);
 
+        bdi_destroy(&v9ses->bdi);
+
         spin_lock(&v9fs_sessionlist_lock);
         list_del(&v9ses->slist);
         spin_unlock(&v9fs_sessionlist_lock);
@@ -331,6 +353,19 @@ void v9fs_session_cancel(struct v9fs_session_info *v9ses) {
         p9_client_disconnect(v9ses->clnt);
 }
 
+/**
+ * v9fs_session_begin_cancel - Begin terminate of a session
+ * @v9ses: session to terminate
+ *
+ * After this call we don't allow any request other than clunk.
+ */
+
+void v9fs_session_begin_cancel(struct v9fs_session_info *v9ses)
+{
+        P9_DPRINTK(P9_DEBUG_ERROR, "begin cancel session %p\n", v9ses);
+        p9_client_begin_disconnect(v9ses->clnt);
+}
+
 extern int v9fs_error_init(void);
 
 static struct kobject *v9fs_kobj;
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index 019f4ccb70c1..bec4d0bcb458 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -20,10 +20,12 @@
  *  Boston, MA  02111-1301  USA
  *
  */
+#include <linux/backing-dev.h>
 
 /**
  * enum p9_session_flags - option flags for each 9P session
- * @V9FS_EXTENDED: whether or not to use 9P2000.u extensions
+ * @V9FS_PROTO_2000U: whether or not to use 9P2000.u extensions
+ * @V9FS_PROTO_2000L: whether or not to use 9P2000.l extensions
  * @V9FS_ACCESS_SINGLE: only the mounting user can access the hierarchy
  * @V9FS_ACCESS_USER: a new attach will be issued for every user (default)
  * @V9FS_ACCESS_ANY: use a single attach for all users
@@ -32,11 +34,12 @@
  * Session flags reflect options selected by users at mount time
  */
 enum p9_session_flags {
-        V9FS_EXTENDED           = 0x01,
-        V9FS_ACCESS_SINGLE      = 0x02,
-        V9FS_ACCESS_USER        = 0x04,
-        V9FS_ACCESS_ANY         = 0x06,
-        V9FS_ACCESS_MASK        = 0x06,
+        V9FS_PROTO_2000U        = 0x01,
+        V9FS_PROTO_2000L        = 0x02,
+        V9FS_ACCESS_SINGLE      = 0x04,
+        V9FS_ACCESS_USER        = 0x08,
+        V9FS_ACCESS_ANY         = 0x0C,
+        V9FS_ACCESS_MASK        = 0x0C,
 };
 
 /* possible values of ->cache */
@@ -100,12 +103,14 @@ struct v9fs_session_info {
         u32 uid;                /* if ACCESS_SINGLE, the uid that has access */
         struct p9_client *clnt; /* 9p client */
         struct list_head slist; /* list of sessions registered with v9fs */
+        struct backing_dev_info bdi;
 };
 
 struct p9_fid *v9fs_session_init(struct v9fs_session_info *, const char *,
                                                                         char *);
 void v9fs_session_close(struct v9fs_session_info *v9ses);
 void v9fs_session_cancel(struct v9fs_session_info *v9ses);
+void v9fs_session_begin_cancel(struct v9fs_session_info *v9ses);
 
 #define V9FS_MAGIC 0x01021997
 
@@ -121,7 +126,12 @@ static inline struct v9fs_session_info *v9fs_inode2v9ses(struct inode *inode)
         return (inode->i_sb->s_fs_info);
 }
 
-static inline int v9fs_extended(struct v9fs_session_info *v9ses)
+static inline int v9fs_proto_dotu(struct v9fs_session_info *v9ses)
 {
-        return v9ses->flags & V9FS_EXTENDED;
+        return v9ses->flags & V9FS_PROTO_2000U;
+}
+
+static inline int v9fs_proto_dotl(struct v9fs_session_info *v9ses)
+{
+        return v9ses->flags & V9FS_PROTO_2000L;
 }
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 3a7560e35865..ed835836e0dc 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -60,3 +60,4 @@ void v9fs_dentry_release(struct dentry *);
 int v9fs_uflags2omode(int uflags, int extended);
 
 ssize_t v9fs_file_readn(struct file *, char *, char __user *, u32, u64);
+void v9fs_blank_wstat(struct p9_wstat *wstat);
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index d74325295b1e..cbf4e50f3933 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -34,6 +34,7 @@
 #include <linux/namei.h>
 #include <linux/idr.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 15cce53bf61e..0adfd64dfcee 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -32,6 +32,7 @@
 #include <linux/sched.h>
 #include <linux/inet.h>
 #include <linux/idr.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 
@@ -76,6 +77,15 @@ static inline int dt_type(struct p9_wstat *mistat)
         return rettype;
 }
 
+static void p9stat_init(struct p9_wstat *stbuf)
+{
+        stbuf->name  = NULL;
+        stbuf->uid   = NULL;
+        stbuf->gid   = NULL;
+        stbuf->muid  = NULL;
+        stbuf->extension = NULL;
+}
+
 /**
  * v9fs_dir_readdir - read a directory
  * @filp: opened file structure
@@ -121,6 +131,8 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
         rdir = (struct p9_rdir *) fid->rdir;
 
         err = mutex_lock_interruptible(&rdir->mutex);
+        if (err)
+                return err;
         while (err == 0) {
                 if (rdir->tail == rdir->head) {
                         err = v9fs_file_readn(filp, rdir->buf, NULL,
@@ -131,11 +143,11 @@ static int v9fs_dir_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         rdir->head = 0;
                         rdir->tail = err;
                 }
-
                 while (rdir->head < rdir->tail) {
+                        p9stat_init(&st);
                         err = p9stat_read(rdir->buf + rdir->head,
                                                 buflen - rdir->head, &st,
-                                                fid->clnt->dotu);
+                                                fid->clnt->proto_version);
                         if (err) {
                                 P9_DPRINTK(P9_DEBUG_VFS, "returned %d\n", err);
                                 err = -EIO;
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 3902bf43a088..df52d488d2a6 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -61,7 +61,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
 
         P9_DPRINTK(P9_DEBUG_VFS, "inode: %p file: %p \n", inode, file);
         v9ses = v9fs_inode2v9ses(inode);
-        omode = v9fs_uflags2omode(file->f_flags, v9fs_extended(v9ses));
+        omode = v9fs_uflags2omode(file->f_flags, v9fs_proto_dotu(v9ses));
         fid = file->private_data;
         if (!fid) {
                 fid = v9fs_fid_clone(file->f_path.dentry);
@@ -77,7 +77,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                         i_size_write(inode, 0);
                         inode->i_blocks = 0;
                 }
-                if ((file->f_flags & O_APPEND) && (!v9fs_extended(v9ses)))
+                if ((file->f_flags & O_APPEND) && (!v9fs_proto_dotu(v9ses)))
                         generic_file_llseek(file, 0, SEEK_END);
         }
 
@@ -114,7 +114,7 @@ static int v9fs_file_lock(struct file *filp, int cmd, struct file_lock *fl)
         P9_DPRINTK(P9_DEBUG_VFS, "filp: %p lock: %p\n", filp, fl);
 
         /* No mandatory locks */
-        if (__mandatory_lock(inode))
+        if (__mandatory_lock(inode) && fl->fl_type != F_UNLCK)
                 return -ENOLCK;
 
         if ((IS_SETLK(cmd) || IS_SETLKW(cmd)) && fl->fl_type != F_UNLCK) {
@@ -215,7 +215,7 @@ v9fs_file_write(struct file *filp, const char __user * data,
         struct p9_fid *fid;
         struct p9_client *clnt;
         struct inode *inode = filp->f_path.dentry->d_inode;
-        int origin = *offset;
+        loff_t origin = *offset;
         unsigned long pg_start, pg_end;
 
         P9_DPRINTK(P9_DEBUG_VFS, "data %p count %d offset %x\n", data,
@@ -257,6 +257,23 @@ v9fs_file_write(struct file *filp, const char __user * data,
         return total;
 }
 
+static int v9fs_file_fsync(struct file *filp, struct dentry *dentry,
+                                        int datasync)
+{
+        struct p9_fid *fid;
+        struct p9_wstat wstat;
+        int retval;
+
+        P9_DPRINTK(P9_DEBUG_VFS, "filp %p dentry %p datasync %x\n", filp,
+                                                dentry, datasync);
+
+        fid = filp->private_data;
+        v9fs_blank_wstat(&wstat);
+
+        retval = p9_client_wstat(fid, &wstat);
+        return retval;
+}
+
 static const struct file_operations v9fs_cached_file_operations = {
         .llseek = generic_file_llseek,
         .read = do_sync_read,
@@ -266,6 +283,7 @@ static const struct file_operations v9fs_cached_file_operations = {
         .release = v9fs_dir_release,
         .lock = v9fs_file_lock,
         .mmap = generic_file_readonly_mmap,
+        .fsync = v9fs_file_fsync,
 };
 
 const struct file_operations v9fs_file_operations = {
@@ -276,4 +294,5 @@ const struct file_operations v9fs_file_operations = {
         .release = v9fs_dir_release,
         .lock = v9fs_file_lock,
         .mmap = generic_file_readonly_mmap,
+        .fsync = v9fs_file_fsync,
 };
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 18f74ec4dce9..f2434fc9d2c4 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -34,6 +34,7 @@
 #include <linux/namei.h>
 #include <linux/idr.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 
@@ -60,7 +61,7 @@ static int unixmode2p9mode(struct v9fs_session_info *v9ses, int mode)
         res = mode & 0777;
         if (S_ISDIR(mode))
                 res |= P9_DMDIR;
-        if (v9fs_extended(v9ses)) {
+        if (v9fs_proto_dotu(v9ses)) {
                 if (S_ISLNK(mode))
                         res |= P9_DMSYMLINK;
                 if (v9ses->nodev == 0) {
@@ -102,21 +103,21 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
 
         if ((mode & P9_DMDIR) == P9_DMDIR)
                 res |= S_IFDIR;
-        else if ((mode & P9_DMSYMLINK) && (v9fs_extended(v9ses)))
+        else if ((mode & P9_DMSYMLINK) && (v9fs_proto_dotu(v9ses)))
                 res |= S_IFLNK;
-        else if ((mode & P9_DMSOCKET) && (v9fs_extended(v9ses))
+        else if ((mode & P9_DMSOCKET) && (v9fs_proto_dotu(v9ses))
                  && (v9ses->nodev == 0))
                 res |= S_IFSOCK;
-        else if ((mode & P9_DMNAMEDPIPE) && (v9fs_extended(v9ses))
+        else if ((mode & P9_DMNAMEDPIPE) && (v9fs_proto_dotu(v9ses))
                  && (v9ses->nodev == 0))
                 res |= S_IFIFO;
-        else if ((mode & P9_DMDEVICE) && (v9fs_extended(v9ses))
+        else if ((mode & P9_DMDEVICE) && (v9fs_proto_dotu(v9ses))
                  && (v9ses->nodev == 0))
                 res |= S_IFBLK;
         else
                 res |= S_IFREG;
 
-        if (v9fs_extended(v9ses)) {
+        if (v9fs_proto_dotu(v9ses)) {
                 if ((mode & P9_DMSETUID) == P9_DMSETUID)
                         res |= S_ISUID;
 
@@ -176,7 +177,7 @@ int v9fs_uflags2omode(int uflags, int extended)
  *
  */
 
-static void
+void
 v9fs_blank_wstat(struct p9_wstat *wstat)
 {
         wstat->type = ~0;
@@ -265,7 +266,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, int mode)
         case S_IFBLK:
         case S_IFCHR:
         case S_IFSOCK:
-                if (!v9fs_extended(v9ses)) {
+                if (!v9fs_proto_dotu(v9ses)) {
                         P9_DPRINTK(P9_DEBUG_ERROR,
                                    "special files without extended mode\n");
                         err = -EINVAL;
@@ -278,7 +279,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, int mode)
                 inode->i_fop = &v9fs_file_operations;
                 break;
         case S_IFLNK:
-                if (!v9fs_extended(v9ses)) {
+                if (!v9fs_proto_dotu(v9ses)) {
                         P9_DPRINTK(P9_DEBUG_ERROR,
                                    "extended modes used w/o 9P2000.u\n");
                         err = -EINVAL;
@@ -288,7 +289,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, int mode)
                 break;
         case S_IFDIR:
                 inc_nlink(inode);
-                if (v9fs_extended(v9ses))
+                if (v9fs_proto_dotu(v9ses))
                         inode->i_op = &v9fs_dir_inode_operations_ext;
                 else
                         inode->i_op = &v9fs_dir_inode_operations;
@@ -431,6 +432,7 @@ error:
 
 static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
 {
+        int retval;
         struct inode *file_inode;
         struct v9fs_session_info *v9ses;
         struct p9_fid *v9fid;
@@ -444,7 +446,10 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         if (IS_ERR(v9fid))
                 return PTR_ERR(v9fid);
 
-        return p9_client_remove(v9fid);
+        retval = p9_client_remove(v9fid);
+        if (!retval)
+                drop_nlink(file_inode);
+        return retval;
 }
 
 static int
@@ -575,7 +580,8 @@ v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                 flags = O_RDWR;
 
         fid = v9fs_create(v9ses, dir, dentry, NULL, perm,
-                                v9fs_uflags2omode(flags, v9fs_extended(v9ses)));
+                                v9fs_uflags2omode(flags,
+                                                v9fs_proto_dotu(v9ses)));
         if (IS_ERR(fid)) {
                 err = PTR_ERR(fid);
                 fid = NULL;
@@ -655,6 +661,9 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
         P9_DPRINTK(P9_DEBUG_VFS, "dir: %p dentry: (%s) %p nameidata: %p\n",
                 dir, dentry->d_name.name, dentry, nameidata);
 
+        if (dentry->d_name.len > NAME_MAX)
+                return ERR_PTR(-ENAMETOOLONG);
+
         sb = dir->i_sb;
         v9ses = v9fs_inode2v9ses(dir);
         dfid = v9fs_fid_lookup(dentry->d_parent);
@@ -858,7 +867,7 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
         if (iattr->ia_valid & ATTR_SIZE)
                 wstat.length = iattr->ia_size;
 
-        if (v9fs_extended(v9ses)) {
+        if (v9fs_proto_dotu(v9ses)) {
                 if (iattr->ia_valid & ATTR_UID)
                         wstat.n_uid = iattr->ia_uid;
 
@@ -886,6 +895,8 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
         struct super_block *sb)
 {
         char ext[32];
+        char tag_name[14];
+        unsigned int i_nlink;
         struct v9fs_session_info *v9ses = sb->s_fs_info;
 
         inode->i_nlink = 1;
@@ -897,11 +908,26 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
         inode->i_uid = v9ses->dfltuid;
         inode->i_gid = v9ses->dfltgid;
 
-        if (v9fs_extended(v9ses)) {
+        if (v9fs_proto_dotu(v9ses)) {
                 inode->i_uid = stat->n_uid;
                 inode->i_gid = stat->n_gid;
         }
-
+        if ((S_ISREG(inode->i_mode)) || (S_ISDIR(inode->i_mode))) {
+                if (v9fs_proto_dotu(v9ses) && (stat->extension[0] != '\0')) {
+                        /*
+                         * Hadlink support got added later to
+                         * to the .u extension. So there can be
+                         * server out there that doesn't support
+                         * this even with .u extension. So check
+                         * for non NULL stat->extension
+                         */
+                        strncpy(ext, stat->extension, sizeof(ext));
+                        /* HARDLINKCOUNT %u */
+                        sscanf(ext, "%13s %u", tag_name, &i_nlink);
+                        if (!strncmp(tag_name, "HARDLINKCOUNT", 13))
+                                inode->i_nlink = i_nlink;
+                }
+        }
         inode->i_mode = p9mode2unixmode(v9ses, stat->mode);
         if ((S_ISBLK(inode->i_mode)) || (S_ISCHR(inode->i_mode))) {
                 char type = 0;
@@ -976,7 +1002,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
         if (IS_ERR(fid))
                 return PTR_ERR(fid);
 
-        if (!v9fs_extended(v9ses))
+        if (!v9fs_proto_dotu(v9ses))
                 return -EBADF;
 
         st = p9_client_stat(fid);
@@ -1001,44 +1027,6 @@ done:
 }
 
 /**
- * v9fs_vfs_readlink - read a symlink's location
- * @dentry: dentry for symlink
- * @buffer: buffer to load symlink location into
- * @buflen: length of buffer
- *
- */
-
-static int v9fs_vfs_readlink(struct dentry *dentry, char __user * buffer,
-                             int buflen)
-{
-        int retval;
-        int ret;
-        char *link = __getname();
-
-        if (unlikely(!link))
-                return -ENOMEM;
-
-        if (buflen > PATH_MAX)
-                buflen = PATH_MAX;
-
-        P9_DPRINTK(P9_DEBUG_VFS, " dentry: %s (%p)\n", dentry->d_name.name,
-                                                                        dentry);
-
-        retval = v9fs_readlink(dentry, link, buflen);
-
-        if (retval > 0) {
-                if ((ret = copy_to_user(buffer, link, retval)) != 0) {
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                                        "problem copying to user: %d\n", ret);
-                        retval = ret;
-                }
-        }
-
-        __putname(link);
-        return retval;
-}
-
-/**
  * v9fs_vfs_follow_link - follow a symlink path
  * @dentry: dentry for symlink
  * @nd: nameidata
@@ -1104,7 +1092,7 @@ static int v9fs_vfs_mkspecial(struct inode *dir, struct dentry *dentry,
         struct p9_fid *fid;
 
         v9ses = v9fs_inode2v9ses(dir);
-        if (!v9fs_extended(v9ses)) {
+        if (!v9fs_proto_dotu(v9ses)) {
                 P9_DPRINTK(P9_DEBUG_ERROR, "not extended\n");
                 return -EPERM;
         }
@@ -1230,7 +1218,6 @@ static const struct inode_operations v9fs_dir_inode_operations_ext = {
         .rmdir = v9fs_vfs_rmdir,
         .mknod = v9fs_vfs_mknod,
         .rename = v9fs_vfs_rename,
-        .readlink = v9fs_vfs_readlink,
         .getattr = v9fs_vfs_getattr,
         .setattr = v9fs_vfs_setattr,
 };
@@ -1253,7 +1240,7 @@ static const struct inode_operations v9fs_file_inode_operations = {
 };
 
 static const struct inode_operations v9fs_symlink_inode_operations = {
-        .readlink = v9fs_vfs_readlink,
+        .readlink = generic_readlink,
         .follow_link = v9fs_vfs_follow_link,
         .put_link = v9fs_vfs_put_link,
         .getattr = v9fs_vfs_getattr,
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index 14a86448572c..806da5d3b3a0 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -37,6 +37,7 @@
 #include <linux/mount.h>
 #include <linux/idr.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 
@@ -76,6 +77,7 @@ v9fs_fill_super(struct super_block *sb, struct v9fs_session_info *v9ses,
         sb->s_blocksize = 1 << sb->s_blocksize_bits;
         sb->s_magic = V9FS_MAGIC;
         sb->s_op = &v9fs_super_ops;
+        sb->s_bdi = &v9ses->bdi;
 
         sb->s_flags = flags | MS_ACTIVE | MS_SYNCHRONOUS | MS_DIRSYNC |
             MS_NOATIME;
@@ -188,10 +190,12 @@ static void v9fs_kill_super(struct super_block *s)
 
         P9_DPRINTK(P9_DEBUG_VFS, " %p\n", s);
 
-        v9fs_dentry_release(s->s_root); /* clunk root */
+        if (s->s_root)
+                v9fs_dentry_release(s->s_root); /* clunk root */
 
         kill_anon_super(s);
 
+        v9fs_session_cancel(v9ses);
         v9fs_session_close(v9ses);
         kfree(v9ses);
         s->s_fs_info = NULL;
@@ -204,7 +208,7 @@ v9fs_umount_begin(struct super_block *sb)
         struct v9fs_session_info *v9ses;
 
         v9ses = sb->s_fs_info;
-        v9fs_session_cancel(v9ses);
+        v9fs_session_begin_cancel(v9ses);
 }
 
 static const struct super_operations v9fs_super_ops = {
diff --git a/fs/Kconfig b/fs/Kconfig
index 64d44efad7a5..5f85b5947613 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -177,6 +177,7 @@ source "fs/efs/Kconfig"
 source "fs/jffs2/Kconfig"
 # UBIFS File system configuration
 source "fs/ubifs/Kconfig"
+source "fs/logfs/Kconfig"
 source "fs/cramfs/Kconfig"
 source "fs/squashfs/Kconfig"
 source "fs/freevxfs/Kconfig"
@@ -234,6 +235,7 @@ config NFS_COMMON
 
 source "net/sunrpc/Kconfig"
 source "fs/smbfs/Kconfig"
+source "fs/ceph/Kconfig"
 source "fs/cifs/Kconfig"
 source "fs/ncpfs/Kconfig"
 source "fs/coda/Kconfig"
diff --git a/fs/Makefile b/fs/Makefile
index af6d04700d9c..97f340f14ba2 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -99,6 +99,7 @@ obj-$(CONFIG_NTFS_FS)		+= ntfs/
 obj-$(CONFIG_UFS_FS)            += ufs/
 obj-$(CONFIG_EFS_FS)            += efs/
 obj-$(CONFIG_JFFS2_FS)          += jffs2/
+obj-$(CONFIG_LOGFS)             += logfs/
 obj-$(CONFIG_UBIFS_FS)          += ubifs/
 obj-$(CONFIG_AFFS_FS)           += affs/
 obj-$(CONFIG_ROMFS_FS)          += romfs/
@@ -124,3 +125,4 @@ obj-$(CONFIG_OCFS2_FS)		+= ocfs2/
 obj-$(CONFIG_BTRFS_FS)          += btrfs/
 obj-$(CONFIG_GFS2_FS)           += gfs2/
 obj-$(CONFIG_EXOFS_FS)          += exofs/
+obj-$(CONFIG_CEPH_FS)           += ceph/
diff --git a/fs/adfs/adfs.h b/fs/adfs/adfs.h
index 9cc18775b832..2ff622f6f547 100644
--- a/fs/adfs/adfs.h
+++ b/fs/adfs/adfs.h
@@ -121,7 +121,7 @@ struct adfs_discmap {
 
 /* Inode stuff */
 struct inode *adfs_iget(struct super_block *sb, struct object_info *obj);
-int adfs_write_inode(struct inode *inode,int unused);
+int adfs_write_inode(struct inode *inode, struct writeback_control *wbc);
 int adfs_notify_change(struct dentry *dentry, struct iattr *attr);
 
 /* map.c */
diff --git a/fs/adfs/inode.c b/fs/adfs/inode.c
index 3f57ce4bee5d..0f5e30978135 100644
--- a/fs/adfs/inode.c
+++ b/fs/adfs/inode.c
@@ -9,6 +9,7 @@
  */
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
 #include "adfs.h"
 
 /*
@@ -360,7 +361,7 @@ out:
  * The adfs-specific inode data has already been updated by
  * adfs_notify_change()
  */
-int adfs_write_inode(struct inode *inode, int wait)
+int adfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct super_block *sb = inode->i_sb;
         struct object_info obj;
@@ -375,7 +376,7 @@ int adfs_write_inode(struct inode *inode, int wait)
         obj.attr        = ADFS_I(inode)->attr;
         obj.size        = inode->i_size;
 
-        ret = adfs_dir_update(sb, &obj, wait);
+        ret = adfs_dir_update(sb, &obj, wbc->sync_mode == WB_SYNC_ALL);
         unlock_kernel();
         return ret;
 }
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index 6910a98bd73c..4a3af7075c1d 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -13,6 +13,7 @@
 #include <linux/parser.h>
 #include <linux/mount.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/statfs.h>
 #include "adfs.h"
diff --git a/fs/affs/affs.h b/fs/affs/affs.h
index e511dc621a2e..861dae68ac12 100644
--- a/fs/affs/affs.h
+++ b/fs/affs/affs.h
@@ -106,8 +106,8 @@ struct affs_sb_info {
         u32 s_last_bmap;
         struct buffer_head *s_bmap_bh;
         char *s_prefix;                 /* Prefix for volumes and assigns. */
-        int s_prefix_len;               /* Length of prefix. */
         char s_volume[32];              /* Volume prefix for absolute symlinks. */
+        spinlock_t symlink_lock;        /* protects the previous two */
 };
 
 #define SF_INTL         0x0001          /* International filesystem. */
@@ -175,7 +175,8 @@ extern void			 affs_delete_inode(struct inode *inode);
 extern void                      affs_clear_inode(struct inode *inode);
 extern struct inode             *affs_iget(struct super_block *sb,
                                         unsigned long ino);
-extern int                       affs_write_inode(struct inode *inode, int);
+extern int                       affs_write_inode(struct inode *inode,
+                                        struct writeback_control *wbc);
 extern int                       affs_add_entry(struct inode *dir, struct inode *inode, struct dentry *dentry, s32 type);
 
 /* file.c */
diff --git a/fs/affs/bitmap.c b/fs/affs/bitmap.c
index dc5ef14bdc1c..3e262711ae06 100644
--- a/fs/affs/bitmap.c
+++ b/fs/affs/bitmap.c
@@ -7,6 +7,7 @@
  *  block allocation, deallocation, calculation of free space.
  */
 
+#include <linux/slab.h>
 #include "affs.h"
 
 /* This is, of course, shamelessly stolen from fs/minix */
@@ -128,7 +129,7 @@ err_range:
 /*
  * Allocate a block in the given allocation zone.
  * Since we have to byte-swap the bitmap on little-endian
- * machines, this is rather expensive. Therefor we will
+ * machines, this is rather expensive. Therefore we will
  * preallocate up to 16 blocks from the same word, if
  * possible. We are not doing preallocations in the
  * header zone, though.
diff --git a/fs/affs/inode.c b/fs/affs/inode.c
index 3c4ec7d864c4..f4b2a4ee4f91 100644
--- a/fs/affs/inode.c
+++ b/fs/affs/inode.c
@@ -10,6 +10,7 @@
  *  (C) 1991  Linus Torvalds - minix filesystem
  */
 #include <linux/sched.h>
+#include <linux/gfp.h>
 #include "affs.h"
 
 extern const struct inode_operations affs_symlink_inode_operations;
@@ -166,7 +167,7 @@ bad_inode:
 }
 
 int
-affs_write_inode(struct inode *inode, int unused)
+affs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct super_block      *sb = inode->i_sb;
         struct buffer_head      *bh;
diff --git a/fs/affs/namei.c b/fs/affs/namei.c
index 960d336ec694..d70bbbac6b7b 100644
--- a/fs/affs/namei.c
+++ b/fs/affs/namei.c
@@ -341,10 +341,13 @@ affs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
         p  = (char *)AFFS_HEAD(bh)->table;
         lc = '/';
         if (*symname == '/') {
+                struct affs_sb_info *sbi = AFFS_SB(sb);
                 while (*symname == '/')
                         symname++;
-                while (AFFS_SB(sb)->s_volume[i])        /* Cannot overflow */
-                        *p++ = AFFS_SB(sb)->s_volume[i++];
+                spin_lock(&sbi->symlink_lock);
+                while (sbi->s_volume[i])        /* Cannot overflow */
+                        *p++ = sbi->s_volume[i++];
+                spin_unlock(&sbi->symlink_lock);
         }
         while (i < maxlen && (c = *symname++)) {
                 if (c == '.' && lc == '/' && *symname == '.' && symname[1] == '/') {
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 104fdcb3a7fc..16a3e4765f68 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -17,6 +17,7 @@
 #include <linux/magic.h>
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include "affs.h"
 
 extern struct timezone sys_tz;
@@ -203,7 +204,7 @@ parse_options(char *options, uid_t *uid, gid_t *gid, int *mode, int *reserved, s
                 switch (token) {
                 case Opt_bs:
                         if (match_int(&args[0], &n))
-                                return -EINVAL;
+                                return 0;
                         if (n != 512 && n != 1024 && n != 2048
                             && n != 4096) {
                                 printk ("AFFS: Invalid blocksize (512, 1024, 2048, 4096 allowed)\n");
@@ -213,7 +214,7 @@ parse_options(char *options, uid_t *uid, gid_t *gid, int *mode, int *reserved, s
                         break;
                 case Opt_mode:
                         if (match_octal(&args[0], &option))
-                                return 1;
+                                return 0;
                         *mode = option & 0777;
                         *mount_opts |= SF_SETMODE;
                         break;
@@ -221,8 +222,6 @@ parse_options(char *options, uid_t *uid, gid_t *gid, int *mode, int *reserved, s
                         *mount_opts |= SF_MUFS;
                         break;
                 case Opt_prefix:
-                        /* Free any previous prefix */
-                        kfree(*prefix);
                         *prefix = match_strdup(&args[0]);
                         if (!*prefix)
                                 return 0;
@@ -233,21 +232,21 @@ parse_options(char *options, uid_t *uid, gid_t *gid, int *mode, int *reserved, s
                         break;
                 case Opt_reserved:
                         if (match_int(&args[0], reserved))
-                                return 1;
+                                return 0;
                         break;
                 case Opt_root:
                         if (match_int(&args[0], root))
-                                return 1;
+                                return 0;
                         break;
                 case Opt_setgid:
                         if (match_int(&args[0], &option))
-                                return 1;
+                                return 0;
                         *gid = option;
                         *mount_opts |= SF_SETGID;
                         break;
                 case Opt_setuid:
                         if (match_int(&args[0], &option))
-                                return -EINVAL;
+                                return 0;
                         *uid = option;
                         *mount_opts |= SF_SETUID;
                         break;
@@ -311,11 +310,14 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)
                 return -ENOMEM;
         sb->s_fs_info = sbi;
         mutex_init(&sbi->s_bmlock);
+        spin_lock_init(&sbi->symlink_lock);
 
         if (!parse_options(data,&uid,&gid,&i,&reserved,&root_block,
                                 &blocksize,&sbi->s_prefix,
                                 sbi->s_volume, &mount_flags)) {
                 printk(KERN_ERR "AFFS: Error parsing options\n");
+                kfree(sbi->s_prefix);
+                kfree(sbi);
                 return -EINVAL;
         }
         /* N.B. after this point s_prefix must be released */
@@ -516,14 +518,18 @@ affs_remount(struct super_block *sb, int *flags, char *data)
         unsigned long            mount_flags;
         int                      res = 0;
         char                    *new_opts = kstrdup(data, GFP_KERNEL);
+        char                     volume[32];
+        char                    *prefix = NULL;
 
         pr_debug("AFFS: remount(flags=0x%x,opts=\"%s\")\n",*flags,data);
 
         *flags |= MS_NODIRATIME;
 
+        memcpy(volume, sbi->s_volume, 32);
         if (!parse_options(data, &uid, &gid, &mode, &reserved, &root_block,
-                           &blocksize, &sbi->s_prefix, sbi->s_volume,
+                           &blocksize, &prefix, volume,
                            &mount_flags)) {
+                kfree(prefix);
                 kfree(new_opts);
                 return -EINVAL;
         }
@@ -534,6 +540,14 @@ affs_remount(struct super_block *sb, int *flags, char *data)
         sbi->s_mode  = mode;
         sbi->s_uid   = uid;
         sbi->s_gid   = gid;
+        /* protect against readers */
+        spin_lock(&sbi->symlink_lock);
+        if (prefix) {
+                kfree(sbi->s_prefix);
+                sbi->s_prefix = prefix;
+        }
+        memcpy(sbi->s_volume, volume, 32);
+        spin_unlock(&sbi->symlink_lock);
 
         if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) {
                 unlock_kernel();
diff --git a/fs/affs/symlink.c b/fs/affs/symlink.c
index 41782539c907..ee00f08c4f53 100644
--- a/fs/affs/symlink.c
+++ b/fs/affs/symlink.c
@@ -20,7 +20,6 @@ static int affs_symlink_readpage(struct file *file, struct page *page)
         int                      i, j;
         char                     c;
         char                     lc;
-        char                    *pf;
 
         pr_debug("AFFS: follow_link(ino=%lu)\n",inode->i_ino);
 
@@ -32,11 +31,15 @@ static int affs_symlink_readpage(struct file *file, struct page *page)
         j  = 0;
         lf = (struct slink_front *)bh->b_data;
         lc = 0;
-        pf = AFFS_SB(inode->i_sb)->s_prefix ? AFFS_SB(inode->i_sb)->s_prefix : "/";
 
         if (strchr(lf->symname,':')) {  /* Handle assign or volume name */
+                struct affs_sb_info *sbi = AFFS_SB(inode->i_sb);
+                char *pf;
+                spin_lock(&sbi->symlink_lock);
+                pf = sbi->s_prefix ? sbi->s_prefix : "/";
                 while (i < 1023 && (c = pf[i]))
                         link[i++] = c;
+                spin_unlock(&sbi->symlink_lock);
                 while (i < 1023 && lf->symname[j] != ':')
                         link[i++] = lf->symname[j++];
                 if (i < 1023)
diff --git a/fs/afs/cache.c b/fs/afs/cache.c
index e2b1d3f16519..0fb315dd4d2a 100644
--- a/fs/afs/cache.c
+++ b/fs/afs/cache.c
@@ -9,7 +9,6 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#include <linux/slab.h>
 #include <linux/sched.h>
 #include "internal.h"
 
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index eb765489164f..a3bcec75c54a 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -11,6 +11,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/ip.h>
 #include "internal.h"
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 88067f36e5e7..adc1cb771b57 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/ctype.h>
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 39b301662f22..0df9bc2b724d 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -12,10 +12,10 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/writeback.h>
+#include <linux/gfp.h>
 #include "internal.h"
 
 static int afs_readpage(struct file *file, struct page *page);
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index 023b95b0d9d7..4bd0218473a9 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/circ_buf.h>
 #include "internal.h"
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index c048f0658751..d00b312e3110 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -16,7 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/sched.h>
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 6ece2a13bf71..a10f2582844f 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -19,6 +19,7 @@
 #include <linux/workqueue.h>
 #include <linux/sched.h>
 #include <linux/fscache.h>
+#include <linux/backing-dev.h>
 
 #include "afs.h"
 #include "afs_vl.h"
@@ -313,6 +314,7 @@ struct afs_volume {
         unsigned short          rjservers;      /* number of servers discarded due to -ENOMEDIUM */
         struct afs_server       *servers[8];    /* servers on which volume resides (ordered) */
         struct rw_semaphore     server_sem;     /* lock for accessing current server */
+        struct backing_dev_info bdi;
 };
 
 /*
@@ -733,7 +735,6 @@ extern int afs_write_end(struct file *file, struct address_space *mapping,
                         struct page *page, void *fsdata);
 extern int afs_writepage(struct page *, struct writeback_control *);
 extern int afs_writepages(struct address_space *, struct writeback_control *);
-extern int afs_write_inode(struct inode *, int);
 extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *);
 extern ssize_t afs_file_write(struct kiocb *, const struct iovec *,
                               unsigned long, loff_t);
diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
index 5ffb570cd3a8..b3feddc4f7d6 100644
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -12,11 +12,11 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/gfp.h>
 #include "internal.h"
 
 
@@ -138,9 +138,9 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
 {
         struct afs_super_info *super;
         struct vfsmount *mnt;
-        struct page *page = NULL;
+        struct page *page;
         size_t size;
-        char *buf, *devname = NULL, *options = NULL;
+        char *buf, *devname, *options;
         int ret;
 
         _enter("{%s}", mntpt->d_name.name);
@@ -150,22 +150,22 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
         ret = -EINVAL;
         size = mntpt->d_inode->i_size;
         if (size > PAGE_SIZE - 1)
-                goto error;
+                goto error_no_devname;
 
         ret = -ENOMEM;
         devname = (char *) get_zeroed_page(GFP_KERNEL);
         if (!devname)
-                goto error;
+                goto error_no_devname;
 
         options = (char *) get_zeroed_page(GFP_KERNEL);
         if (!options)
-                goto error;
+                goto error_no_options;
 
         /* read the contents of the AFS special symlink */
         page = read_mapping_page(mntpt->d_inode->i_mapping, 0, NULL);
         if (IS_ERR(page)) {
                 ret = PTR_ERR(page);
-                goto error;
+                goto error_no_page;
         }
 
         ret = -EIO;
@@ -196,12 +196,12 @@ static struct vfsmount *afs_mntpt_do_automount(struct dentry *mntpt)
         return mnt;
 
 error:
-        if (page)
-                page_cache_release(page);
-        if (devname)
-                free_page((unsigned long) devname);
-        if (options)
-                free_page((unsigned long) options);
+        page_cache_release(page);
+error_no_page:
+        free_page((unsigned long) options);
+error_no_options:
+        free_page((unsigned long) devname);
+error_no_devname:
         _leave(" = %d", ret);
         return ERR_PTR(ret);
 }
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index bde3f19c0995..67cf810e0fd6 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -9,6 +9,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/af_rxrpc.h>
 #include <rxrpc/packet.h>
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 3ef504370034..bb4ed144d0e4 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -189,8 +189,9 @@ void afs_cache_permit(struct afs_vnode *vnode, struct key *key, long acl_order)
         if (!permits)
                 goto out_unlock;
 
-        memcpy(permits->permits, xpermits->permits,
-               count * sizeof(struct afs_permit));
+        if (xpermits)
+                memcpy(permits->permits, xpermits->permits,
+                        count * sizeof(struct afs_permit));
 
         _debug("key %x access %x",
                key_serial(key), vnode->status.caller_access);
diff --git a/fs/afs/super.c b/fs/afs/super.c
index e1ea1c240b6a..e932e5a3a0c1 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -48,7 +48,6 @@ struct file_system_type afs_fs_type = {
 static const struct super_operations afs_super_ops = {
         .statfs         = afs_statfs,
         .alloc_inode    = afs_alloc_inode,
-        .write_inode    = afs_write_inode,
         .destroy_inode  = afs_destroy_inode,
         .clear_inode    = afs_clear_inode,
         .put_super      = afs_put_super,
@@ -312,6 +311,7 @@ static int afs_fill_super(struct super_block *sb, void *data)
         sb->s_magic             = AFS_FS_MAGIC;
         sb->s_op                = &afs_super_ops;
         sb->s_fs_info           = as;
+        sb->s_bdi               = &as->volume->bdi;
 
         /* allocate the root inode and dentry */
         fid.vid         = as->volume->vid;
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index 36c1306e09e0..340afd0cd182 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -9,6 +9,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include "internal.h"
diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c
index 6e689208def2..9ac260d1361d 100644
--- a/fs/afs/vlocation.c
+++ b/fs/afs/vlocation.c
@@ -11,6 +11,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include "internal.h"
diff --git a/fs/afs/vnode.c b/fs/afs/vnode.c
index 2f05c4fc2a70..25cf4c3f4ff7 100644
--- a/fs/afs/vnode.c
+++ b/fs/afs/vnode.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include "internal.h"
diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index a353e69e2391..401eeb21869f 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -106,6 +106,10 @@ struct afs_volume *afs_volume_lookup(struct afs_mount_params *params)
         volume->cell            = params->cell;
         volume->vid             = vlocation->vldb.vid[params->type];
 
+        ret = bdi_setup_and_register(&volume->bdi, "afs", BDI_CAP_MAP_COPY);
+        if (ret)
+                goto error_bdi;
+
         init_rwsem(&volume->server_sem);
 
         /* look up all the applicable server records */
@@ -151,6 +155,8 @@ error:
         return ERR_PTR(ret);
 
 error_discard:
+        bdi_destroy(&volume->bdi);
+error_bdi:
         up_write(&params->cell->vl_sem);
 
         for (loop = volume->nservers - 1; loop >= 0; loop--)
@@ -200,6 +206,7 @@ void afs_put_volume(struct afs_volume *volume)
         for (loop = volume->nservers - 1; loop >= 0; loop--)
                 afs_put_server(volume->servers[loop]);
 
+        bdi_destroy(&volume->bdi);
         kfree(volume);
 
         _leave(" [destroyed]");
diff --git a/fs/afs/write.c b/fs/afs/write.c
index 5e15a21dbf9f..3bed54a294d4 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -585,27 +585,6 @@ int afs_writepages(struct address_space *mapping,
 }
 
 /*
- * write an inode back
- */
-int afs_write_inode(struct inode *inode, int sync)
-{
-        struct afs_vnode *vnode = AFS_FS_I(inode);
-        int ret;
-
-        _enter("{%x:%u},", vnode->fid.vid, vnode->fid.vnode);
-
-        ret = 0;
-        if (sync) {
-                ret = filemap_fdatawait(inode->i_mapping);
-                if (ret < 0)
-                        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        }
-
-        _leave(" = %d", ret);
-        return ret;
-}
-
-/*
  * completion of write to server
  */
 void afs_pages_written_back(struct afs_vnode *vnode, struct afs_call *call)
diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
index 9f0bf13291e5..e4b75d6eda83 100644
--- a/fs/anon_inodes.c
+++ b/fs/anon_inodes.c
@@ -12,7 +12,6 @@
 #include <linux/file.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
@@ -209,6 +208,7 @@ static struct inode *anon_inode_mkinode(void)
         inode->i_mode = S_IRUSR | S_IWUSR;
         inode->i_uid = current_fsuid();
         inode->i_gid = current_fsgid();
+        inode->i_flags |= S_PRIVATE;
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         return inode;
 }
diff --git a/fs/attr.c b/fs/attr.c
index 96d394bdaddf..0815e93bb487 100644
--- a/fs/attr.c
+++ b/fs/attr.c
@@ -12,7 +12,6 @@
 #include <linux/capability.h>
 #include <linux/fsnotify.h>
 #include <linux/fcntl.h>
-#include <linux/quotaops.h>
 #include <linux/security.h>
 
 /* Taken over from the old code... */
@@ -82,7 +81,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
         if (inode->i_size < offset) {
                 unsigned long limit;
 
-                limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+                limit = rlimit(RLIMIT_FSIZE);
                 if (limit != RLIM_INFINITY && offset > limit)
                         goto out_sig;
                 if (offset > inode->i_sb->s_maxbytes)
@@ -212,14 +211,8 @@ int notify_change(struct dentry * dentry, struct iattr * attr)
                 error = inode->i_op->setattr(dentry, attr);
         } else {
                 error = inode_change_ok(inode, attr);
-                if (!error) {
-                        if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
-                            (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid))
-                                error = vfs_dq_transfer(inode, attr) ?
-                                        -EDQUOT : 0;
-                        if (!error)
-                                error = inode_setattr(inode, attr);
-                }
+                if (!error)
+                        error = inode_setattr(inode, attr);
         }
 
         if (ia_valid & ATTR_SIZE)
diff --git a/fs/autofs/root.c b/fs/autofs/root.c
index 4a1401cea0a1..8713c7cfbc79 100644
--- a/fs/autofs/root.c
+++ b/fs/autofs/root.c
@@ -13,6 +13,7 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/smp_lock.h>
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 0118d67221b2..3d283abf67d7 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -60,11 +60,6 @@ do {							\
                 current->pid, __func__, ##args);        \
 } while (0)
 
-struct rehash_entry {
-        struct task_struct *task;
-        struct list_head list;
-};
-
 /* Unified info structure.  This is pointed to by both the dentry and
    inode structures.  Each file in the filesystem has an instance of this
    structure.  It holds a reference to the dentry, so dentries are never
@@ -81,7 +76,6 @@ struct autofs_info {
 
         struct list_head active;
         int active_count;
-        struct list_head rehash_list;
 
         struct list_head expiring;
 
@@ -104,7 +98,6 @@ struct autofs_info {
 #define AUTOFS_INF_EXPIRING     (1<<0) /* dentry is in the process of expiring */
 #define AUTOFS_INF_MOUNTPOINT   (1<<1) /* mountpoint status for direct expire */
 #define AUTOFS_INF_PENDING      (1<<2) /* dentry pending mount */
-#define AUTOFS_INF_REHASH       (1<<3) /* dentry in transit to ->lookup() */
 
 struct autofs_wait_queue {
         wait_queue_head_t queue;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 00bf8fcb245f..d29b7f6df862 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -22,6 +22,7 @@
 #include <linux/magic.h>
 #include <linux/dcache.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 
 #include "autofs_i.h"
 
@@ -544,10 +545,9 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp,
                         goto out;
                 devid = new_encode_dev(path.mnt->mnt_sb->s_dev);
                 err = 0;
-                if (path.dentry->d_inode &&
-                    path.mnt->mnt_root == path.dentry) {
+                if (path.mnt->mnt_root == path.dentry) {
                         err = 1;
-                        magic = path.dentry->d_inode->i_sb->s_magic;
+                        magic = path.mnt->mnt_sb->s_magic;
                 }
         } else {
                 dev_t dev = sbi->sb->s_dev;
@@ -560,10 +560,8 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp,
 
                 err = have_submounts(path.dentry);
 
-                if (path.mnt->mnt_mountpoint != path.mnt->mnt_root) {
-                        if (follow_down(&path))
-                                magic = path.mnt->mnt_sb->s_magic;
-                }
+                if (follow_down(&path))
+                        magic = path.mnt->mnt_sb->s_magic;
         }
 
         param->ismountpoint.out.devid = devid;
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 74bc9aa6df31..a796c9417fb1 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -279,7 +279,6 @@ struct dentry *autofs4_expire_direct(struct super_block *sb,
                         root->d_mounted--;
                 }
                 ino->flags |= AUTOFS_INF_EXPIRING;
-                autofs4_add_expiring(root);
                 init_completion(&ino->expire_complete);
                 spin_unlock(&sbi->fs_lock);
                 return root;
@@ -407,7 +406,6 @@ found:
                 expired, (int)expired->d_name.len, expired->d_name.name);
         ino = autofs4_dentry_ino(expired);
         ino->flags |= AUTOFS_INF_EXPIRING;
-        autofs4_add_expiring(expired);
         init_completion(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
         spin_lock(&dcache_lock);
@@ -435,7 +433,7 @@ int autofs4_expire_wait(struct dentry *dentry)
 
                 DPRINTK("expire done status=%d", status);
 
-                if (d_unhashed(dentry) && IS_DEADDIR(dentry->d_inode))
+                if (d_unhashed(dentry))
                         return -EAGAIN;
 
                 return status;
@@ -475,7 +473,6 @@ int autofs4_expire_run(struct super_block *sb,
         spin_lock(&sbi->fs_lock);
         ino = autofs4_dentry_ino(dentry);
         ino->flags &= ~AUTOFS_INF_EXPIRING;
-        autofs4_del_expiring(dentry);
         complete_all(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
 
@@ -506,7 +503,6 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                         ino->flags &= ~AUTOFS_INF_MOUNTPOINT;
                 }
                 ino->flags &= ~AUTOFS_INF_EXPIRING;
-                autofs4_del_expiring(dentry);
                 complete_all(&ino->expire_complete);
                 spin_unlock(&sbi->fs_lock);
                 dput(dentry);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index d0a3de247458..821b2b955dac 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -49,7 +49,6 @@ struct autofs_info *autofs4_init_ino(struct autofs_info *ino,
                 ino->dentry = NULL;
                 ino->size = 0;
                 INIT_LIST_HEAD(&ino->active);
-                INIT_LIST_HEAD(&ino->rehash_list);
                 ino->active_count = 0;
                 INIT_LIST_HEAD(&ino->expiring);
                 atomic_set(&ino->count, 0);
@@ -97,63 +96,6 @@ void autofs4_free_ino(struct autofs_info *ino)
         kfree(ino);
 }
 
-/*
- * Deal with the infamous "Busy inodes after umount ..." message.
- *
- * Clean up the dentry tree. This happens with autofs if the user
- * space program goes away due to a SIGKILL, SIGSEGV etc.
- */
-static void autofs4_force_release(struct autofs_sb_info *sbi)
-{
-        struct dentry *this_parent = sbi->sb->s_root;
-        struct list_head *next;
-
-        if (!sbi->sb->s_root)
-                return;
-
-        spin_lock(&dcache_lock);
-repeat:
-        next = this_parent->d_subdirs.next;
-resume:
-        while (next != &this_parent->d_subdirs) {
-                struct dentry *dentry = list_entry(next, struct dentry, d_u.d_child);
-
-                /* Negative dentry - don`t care */
-                if (!simple_positive(dentry)) {
-                        next = next->next;
-                        continue;
-                }
-
-                if (!list_empty(&dentry->d_subdirs)) {
-                        this_parent = dentry;
-                        goto repeat;
-                }
-
-                next = next->next;
-                spin_unlock(&dcache_lock);
-
-                DPRINTK("dentry %p %.*s",
-                        dentry, (int)dentry->d_name.len, dentry->d_name.name);
-
-                dput(dentry);
-                spin_lock(&dcache_lock);
-        }
-
-        if (this_parent != sbi->sb->s_root) {
-                struct dentry *dentry = this_parent;
-
-                next = this_parent->d_u.d_child.next;
-                this_parent = this_parent->d_parent;
-                spin_unlock(&dcache_lock);
-                DPRINTK("parent dentry %p %.*s",
-                        dentry, (int)dentry->d_name.len, dentry->d_name.name);
-                dput(dentry);
-                spin_lock(&dcache_lock);
-                goto resume;
-        }
-        spin_unlock(&dcache_lock);
-}
-
 void autofs4_kill_sb(struct super_block *sb)
 {
         struct autofs_sb_info *sbi = autofs4_sbi(sb);
@@ -170,15 +112,12 @@ void autofs4_kill_sb(struct super_block *sb)
         /* Free wait queues, close pipe */
         autofs4_catatonic_mode(sbi);
 
-        /* Clean up and release dangling references */
-        autofs4_force_release(sbi);
-
         sb->s_fs_info = NULL;
         kfree(sbi);
 
 out_kill_sb:
         DPRINTK("shutting down");
-        kill_anon_super(sb);
+        kill_litter_super(sb);
 }
 
 static int autofs4_show_options(struct seq_file *m, struct vfsmount *mnt)
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 30cc9ddf4b70..109a6c606d92 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -15,6 +15,7 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/param.h>
 #include <linux/time.h>
 #include "autofs_i.h"
@@ -104,99 +105,6 @@ static void autofs4_del_active(struct dentry *dentry)
         return;
 }
 
-static void autofs4_add_rehash_entry(struct autofs_info *ino,
-                                     struct rehash_entry *entry)
-{
-        entry->task = current;
-        INIT_LIST_HEAD(&entry->list);
-        list_add(&entry->list, &ino->rehash_list);
-        return;
-}
-
-static void autofs4_remove_rehash_entry(struct autofs_info *ino)
-{
-        struct list_head *head = &ino->rehash_list;
-        struct rehash_entry *entry;
-        list_for_each_entry(entry, head, list) {
-                if (entry->task == current) {
-                        list_del(&entry->list);
-                        kfree(entry);
-                        break;
-                }
-        }
-        return;
-}
-
-static void autofs4_remove_rehash_entrys(struct autofs_info *ino)
-{
-        struct autofs_sb_info *sbi = ino->sbi;
-        struct rehash_entry *entry, *next;
-        struct list_head *head;
-
-        spin_lock(&sbi->fs_lock);
-        spin_lock(&sbi->lookup_lock);
-        if (!(ino->flags & AUTOFS_INF_REHASH)) {
-                spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&sbi->fs_lock);
-                return;
-        }
-        ino->flags &= ~AUTOFS_INF_REHASH;
-        head = &ino->rehash_list;
-        list_for_each_entry_safe(entry, next, head, list) {
-                list_del(&entry->list);
-                kfree(entry);
-        }
-        spin_unlock(&sbi->lookup_lock);
-        spin_unlock(&sbi->fs_lock);
-        dput(ino->dentry);
-
-        return;
-}
-
-static void autofs4_revalidate_drop(struct dentry *dentry,
-                                    struct rehash_entry *entry)
-{
-        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        /*
-         * Add to the active list so we can pick this up in
-         * ->lookup(). Also add an entry to a rehash list so
-         * we know when there are no dentrys in flight so we
-         * know when we can rehash the dentry.
-         */
-        spin_lock(&sbi->lookup_lock);
-        if (list_empty(&ino->active))
-                list_add(&ino->active, &sbi->active_list);
-        autofs4_add_rehash_entry(ino, entry);
-        spin_unlock(&sbi->lookup_lock);
-        if (!(ino->flags & AUTOFS_INF_REHASH)) {
-                ino->flags |= AUTOFS_INF_REHASH;
-                dget(dentry);
-                spin_lock(&dentry->d_lock);
-                __d_drop(dentry);
-                spin_unlock(&dentry->d_lock);
-        }
-        return;
-}
-
-static void autofs4_revalidate_rehash(struct dentry *dentry)
-{
-        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        if (ino->flags & AUTOFS_INF_REHASH) {
-                spin_lock(&sbi->lookup_lock);
-                autofs4_remove_rehash_entry(ino);
-                if (list_empty(&ino->rehash_list)) {
-                        spin_unlock(&sbi->lookup_lock);
-                        ino->flags &= ~AUTOFS_INF_REHASH;
-                        d_rehash(dentry);
-                        dput(ino->dentry);
-                } else
-                        spin_unlock(&sbi->lookup_lock);
-        }
-        return;
-}
-
 static unsigned int autofs4_need_mount(unsigned int flags)
 {
         unsigned int res = 0;
@@ -236,7 +144,7 @@ out:
         return dcache_dir_open(inode, file);
 }
 
-static int try_to_fill_dentry(struct dentry *dentry)
+static int try_to_fill_dentry(struct dentry *dentry, int flags)
 {
         struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
         struct autofs_info *ino = autofs4_dentry_ino(dentry);
@@ -249,17 +157,55 @@ static int try_to_fill_dentry(struct dentry *dentry)
          * Wait for a pending mount, triggering one if there
          * isn't one already
          */
-        DPRINTK("waiting for mount name=%.*s",
-                 dentry->d_name.len, dentry->d_name.name);
+        if (dentry->d_inode == NULL) {
+                DPRINTK("waiting for mount name=%.*s",
+                         dentry->d_name.len, dentry->d_name.name);
 
-        status = autofs4_wait(sbi, dentry, NFY_MOUNT);
+                status = autofs4_wait(sbi, dentry, NFY_MOUNT);
 
-        DPRINTK("mount done status=%d", status);
+                DPRINTK("mount done status=%d", status);
 
-        /* Update expiry counter */
-        ino->last_used = jiffies;
+                /* Turn this into a real negative dentry? */
+                if (status == -ENOENT) {
+                        spin_lock(&sbi->fs_lock);
+                        ino->flags &= ~AUTOFS_INF_PENDING;
+                        spin_unlock(&sbi->fs_lock);
+                        return status;
+                } else if (status) {
+                        /* Return a negative dentry, but leave it "pending" */
+                        return status;
+                }
+        /* Trigger mount for path component or follow link */
+        } else if (ino->flags & AUTOFS_INF_PENDING ||
+                        autofs4_need_mount(flags) ||
+                        current->link_count) {
+                DPRINTK("waiting for mount name=%.*s",
+                        dentry->d_name.len, dentry->d_name.name);
 
-        return status;
+                spin_lock(&sbi->fs_lock);
+                ino->flags |= AUTOFS_INF_PENDING;
+                spin_unlock(&sbi->fs_lock);
+                status = autofs4_wait(sbi, dentry, NFY_MOUNT);
+
+                DPRINTK("mount done status=%d", status);
+
+                if (status) {
+                        spin_lock(&sbi->fs_lock);
+                        ino->flags &= ~AUTOFS_INF_PENDING;
+                        spin_unlock(&sbi->fs_lock);
+                        return status;
+                }
+        }
+
+        /* Initialize expiry counter after successful mount */
+        if (ino)
+                ino->last_used = jiffies;
+
+        spin_lock(&sbi->fs_lock);
+        ino->flags &= ~AUTOFS_INF_PENDING;
+        spin_unlock(&sbi->fs_lock);
+
+        return 0;
 }
 
 /* For autofs direct mounts the follow link triggers the mount */
@@ -313,16 +259,10 @@ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
          */
         if (ino->flags & AUTOFS_INF_PENDING ||
             (!d_mountpoint(dentry) && list_empty(&dentry->d_subdirs))) {
-                ino->flags |= AUTOFS_INF_PENDING;
                 spin_unlock(&dcache_lock);
                 spin_unlock(&sbi->fs_lock);
 
-                status = try_to_fill_dentry(dentry);
-
-                spin_lock(&sbi->fs_lock);
-                ino->flags &= ~AUTOFS_INF_PENDING;
-                spin_unlock(&sbi->fs_lock);
-
+                status = try_to_fill_dentry(dentry, 0);
                 if (status)
                         goto out_error;
 
@@ -361,47 +301,18 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *dir = dentry->d_parent->d_inode;
         struct autofs_sb_info *sbi = autofs4_sbi(dir->i_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        struct rehash_entry *entry;
+        int oz_mode = autofs4_oz_mode(sbi);
         int flags = nd ? nd->flags : 0;
-        unsigned int mutex_aquired;
+        int status = 1;
 
-        DPRINTK("name = %.*s oz_mode = %d",
-                dentry->d_name.len, dentry->d_name.name, oz_mode);
-
-        /* Daemon never causes a mount to trigger */
-        if (autofs4_oz_mode(sbi))
-                return 1;
-
-        entry = kmalloc(sizeof(struct rehash_entry), GFP_KERNEL);
-        if (!entry)
-                return -ENOMEM;
-
-        mutex_aquired = mutex_trylock(&dir->i_mutex);
-
-        spin_lock(&sbi->fs_lock);
-        spin_lock(&dcache_lock);
         /* Pending dentry */
+        spin_lock(&sbi->fs_lock);
         if (autofs4_ispending(dentry)) {
-                int status;
-
-                /*
-                 * We can only unhash and send this to ->lookup() if
-                 * the directory mutex is held over d_revalidate() and
-                 * ->lookup(). This prevents the VFS from incorrectly
-                 * seeing the dentry as non-existent.
-                 */
-                ino->flags |= AUTOFS_INF_PENDING;
-                if (!mutex_aquired) {
-                        autofs4_revalidate_drop(dentry, entry);
-                        spin_unlock(&dcache_lock);
-                        spin_unlock(&sbi->fs_lock);
-                        return 0;
-                }
-                spin_unlock(&dcache_lock);
+                /* The daemon never causes a mount to trigger */
                 spin_unlock(&sbi->fs_lock);
-                mutex_unlock(&dir->i_mutex);
-                kfree(entry);
+
+                if (oz_mode)
+                        return 1;
 
                 /*
                  * If the directory has gone away due to an expire
@@ -415,82 +326,45 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd)
                  * A zero status is success otherwise we have a
                  * negative error code.
                  */
-                status = try_to_fill_dentry(dentry);
-
-                spin_lock(&sbi->fs_lock);
-                ino->flags &= ~AUTOFS_INF_PENDING;
-                spin_unlock(&sbi->fs_lock);
-
+                status = try_to_fill_dentry(dentry, flags);
                 if (status == 0)
                         return 1;
 
                 return status;
         }
+        spin_unlock(&sbi->fs_lock);
+
+        /* Negative dentry.. invalidate if "old" */
+        if (dentry->d_inode == NULL)
+                return 0;
 
         /* Check for a non-mountpoint directory with no contents */
+        spin_lock(&dcache_lock);
         if (S_ISDIR(dentry->d_inode->i_mode) &&
             !d_mountpoint(dentry) && list_empty(&dentry->d_subdirs)) {
                 DPRINTK("dentry=%p %.*s, emptydir",
                          dentry, dentry->d_name.len, dentry->d_name.name);
+                spin_unlock(&dcache_lock);
 
-                if (autofs4_need_mount(flags) || current->link_count) {
-                        int status;
-
-                        /*
-                         * We can only unhash and send this to ->lookup() if
-                         * the directory mutex is held over d_revalidate() and
-                         * ->lookup(). This prevents the VFS from incorrectly
-                         * seeing the dentry as non-existent.
-                         */
-                        ino->flags |= AUTOFS_INF_PENDING;
-                        if (!mutex_aquired) {
-                                autofs4_revalidate_drop(dentry, entry);
-                                spin_unlock(&dcache_lock);
-                                spin_unlock(&sbi->fs_lock);
-                                return 0;
-                        }
-                        spin_unlock(&dcache_lock);
-                        spin_unlock(&sbi->fs_lock);
-                        mutex_unlock(&dir->i_mutex);
-                        kfree(entry);
-
-                        /*
-                         * A zero status is success otherwise we have a
-                         * negative error code.
-                         */
-                        status = try_to_fill_dentry(dentry);
-
-                        spin_lock(&sbi->fs_lock);
-                        ino->flags &= ~AUTOFS_INF_PENDING;
-                        spin_unlock(&sbi->fs_lock);
+                /* The daemon never causes a mount to trigger */
+                if (oz_mode)
+                        return 1;
 
-                        if (status == 0)
-                                return 1;
+                /*
+                 * A zero status is success otherwise we have a
+                 * negative error code.
+                 */
+                status = try_to_fill_dentry(dentry, flags);
+                if (status == 0)
+                        return 1;
 
-                        return status;
-                }
+                return status;
         }
         spin_unlock(&dcache_lock);
-        spin_unlock(&sbi->fs_lock);
-
-        if (mutex_aquired)
-                mutex_unlock(&dir->i_mutex);
-
-        kfree(entry);
 
         return 1;
 }
 
-static void autofs4_free_rehash_entrys(struct autofs_info *inf)
-{
-        struct list_head *head = &inf->rehash_list;
-        struct rehash_entry *entry, *next;
-        list_for_each_entry_safe(entry, next, head, list) {
-                list_del(&entry->list);
-                kfree(entry);
-        }
-}
-
 void autofs4_dentry_release(struct dentry *de)
 {
         struct autofs_info *inf;
@@ -509,8 +383,6 @@ void autofs4_dentry_release(struct dentry *de)
                                 list_del(&inf->active);
                         if (!list_empty(&inf->expiring))
                                 list_del(&inf->expiring);
-                        if (!list_empty(&inf->rehash_list))
-                                autofs4_free_rehash_entrys(inf);
                         spin_unlock(&sbi->lookup_lock);
                 }
 
@@ -543,7 +415,6 @@ static struct dentry *autofs4_lookup_active(struct dentry *dentry)
         const unsigned char *str = name->name;
         struct list_head *p, *head;
 
-restart:
         spin_lock(&dcache_lock);
         spin_lock(&sbi->lookup_lock);
         head = &sbi->active_list;
@@ -561,19 +432,6 @@ restart:
                 if (atomic_read(&active->d_count) == 0)
                         goto next;
 
-                if (active->d_inode && IS_DEADDIR(active->d_inode)) {
-                        if (!list_empty(&ino->rehash_list)) {
-                                dget(active);
-                                spin_unlock(&active->d_lock);
-                                spin_unlock(&sbi->lookup_lock);
-                                spin_unlock(&dcache_lock);
-                                autofs4_remove_rehash_entrys(ino);
-                                dput(active);
-                                goto restart;
-                        }
-                        goto next;
-                }
-
                 qstr = &active->d_name;
 
                 if (active->d_name.hash != hash)
@@ -586,11 +444,13 @@ restart:
                 if (memcmp(qstr->name, str, len))
                         goto next;
 
-                dget(active);
-                spin_unlock(&active->d_lock);
-                spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&dcache_lock);
-                return active;
+                if (d_unhashed(active)) {
+                        dget(active);
+                        spin_unlock(&active->d_lock);
+                        spin_unlock(&sbi->lookup_lock);
+                        spin_unlock(&dcache_lock);
+                        return active;
+                }
 next:
                 spin_unlock(&active->d_lock);
         }
@@ -639,11 +499,13 @@ static struct dentry *autofs4_lookup_expiring(struct dentry *dentry)
                 if (memcmp(qstr->name, str, len))
                         goto next;
 
-                dget(expiring);
-                spin_unlock(&expiring->d_lock);
-                spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&dcache_lock);
-                return expiring;
+                if (d_unhashed(expiring)) {
+                        dget(expiring);
+                        spin_unlock(&expiring->d_lock);
+                        spin_unlock(&sbi->lookup_lock);
+                        spin_unlock(&dcache_lock);
+                        return expiring;
+                }
 next:
                 spin_unlock(&expiring->d_lock);
         }
@@ -653,48 +515,6 @@ next:
         return NULL;
 }
 
-static struct autofs_info *init_new_dentry(struct autofs_sb_info *sbi,
-                                           struct dentry *dentry, int oz_mode)
-{
-        struct autofs_info *ino;
-
-        /*
-         * Mark the dentry incomplete but don't hash it. We do this
-         * to serialize our inode creation operations (symlink and
-         * mkdir) which prevents deadlock during the callback to
-         * the daemon. Subsequent user space lookups for the same
-         * dentry are placed on the wait queue while the daemon
-         * itself is allowed passage unresticted so the create
-         * operation itself can then hash the dentry. Finally,
-         * we check for the hashed dentry and return the newly
-         * hashed dentry.
-         */
-        dentry->d_op = &autofs4_root_dentry_operations;
-
-        /*
-         * And we need to ensure that the same dentry is used for
-         * all following lookup calls until it is hashed so that
-         * the dentry flags are persistent throughout the request.
-         */
-        ino = autofs4_init_ino(NULL, sbi, 0555);
-        if (!ino)
-                return ERR_PTR(-ENOMEM);
-
-        dentry->d_fsdata = ino;
-        ino->dentry = dentry;
-
-        /*
-         * Only set the mount pending flag for new dentrys not created
-         * by the daemon.
-         */
-        if (!oz_mode)
-                ino->flags |= AUTOFS_INF_PENDING;
-
-        d_instantiate(dentry, NULL);
-
-        return ino;
-}
-
 /* Lookups in the root directory */
 static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
@@ -702,7 +522,6 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
         struct autofs_info *ino;
         struct dentry *expiring, *active;
         int oz_mode;
-        int status = 0;
 
         DPRINTK("name = %.*s",
                 dentry->d_name.len, dentry->d_name.name);
@@ -717,26 +536,44 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
         DPRINTK("pid = %u, pgrp = %u, catatonic = %d, oz_mode = %d",
                  current->pid, task_pgrp_nr(current), sbi->catatonic, oz_mode);
 
-        spin_lock(&sbi->fs_lock);
         active = autofs4_lookup_active(dentry);
         if (active) {
                 dentry = active;
                 ino = autofs4_dentry_ino(dentry);
-                /* If this came from revalidate, rehash it */
-                autofs4_revalidate_rehash(dentry);
-                spin_unlock(&sbi->fs_lock);
         } else {
-                spin_unlock(&sbi->fs_lock);
-                ino = init_new_dentry(sbi, dentry, oz_mode);
-                if (IS_ERR(ino))
-                        return (struct dentry *) ino;
-        }
+                /*
+                 * Mark the dentry incomplete but don't hash it. We do this
+                 * to serialize our inode creation operations (symlink and
+                 * mkdir) which prevents deadlock during the callback to
+                 * the daemon. Subsequent user space lookups for the same
+                 * dentry are placed on the wait queue while the daemon
+                 * itself is allowed passage unresticted so the create
+                 * operation itself can then hash the dentry. Finally,
+                 * we check for the hashed dentry and return the newly
+                 * hashed dentry.
+                 */
+                dentry->d_op = &autofs4_root_dentry_operations;
+
+                /*
+                 * And we need to ensure that the same dentry is used for
+                 * all following lookup calls until it is hashed so that
+                 * the dentry flags are persistent throughout the request.
+                 */
+                ino = autofs4_init_ino(NULL, sbi, 0555);
+                if (!ino)
+                        return ERR_PTR(-ENOMEM);
 
-        autofs4_add_active(dentry);
+                dentry->d_fsdata = ino;
+                ino->dentry = dentry;
+
+                autofs4_add_active(dentry);
+
+                d_instantiate(dentry, NULL);
+        }
 
         if (!oz_mode) {
-                expiring = autofs4_lookup_expiring(dentry);
                 mutex_unlock(&dir->i_mutex);
+                expiring = autofs4_lookup_expiring(dentry);
                 if (expiring) {
                         /*
                          * If we are racing with expire the request might not
@@ -744,22 +581,23 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
                          * so it must have been successful, so just wait for it.
                          */
                         autofs4_expire_wait(expiring);
+                        autofs4_del_expiring(expiring);
                         dput(expiring);
                 }
-                status = try_to_fill_dentry(dentry);
-                mutex_lock(&dir->i_mutex);
+
                 spin_lock(&sbi->fs_lock);
-                ino->flags &= ~AUTOFS_INF_PENDING;
+                ino->flags |= AUTOFS_INF_PENDING;
                 spin_unlock(&sbi->fs_lock);
+                if (dentry->d_op && dentry->d_op->d_revalidate)
+                        (dentry->d_op->d_revalidate)(dentry, nd);
+                mutex_lock(&dir->i_mutex);
         }
 
-        autofs4_del_active(dentry);
-
         /*
-         * If we had a mount fail, check if we had to handle
+         * If we are still pending, check if we had to handle
          * a signal. If so we can force a restart..
          */
-        if (status) {
+        if (ino->flags & AUTOFS_INF_PENDING) {
                 /* See if we were interrupted */
                 if (signal_pending(current)) {
                         sigset_t *sigset = &current->pending.signal;
@@ -771,46 +609,43 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
                             return ERR_PTR(-ERESTARTNOINTR);
                         }
                 }
-        }
-
-        /*
-         * User space can (and has done in the past) remove and re-create
-         * this directory during the callback. This can leave us with an
-         * unhashed dentry, but a successful mount!  So we need to
-         * perform another cached lookup in case the dentry now exists.
-         */
-        if (!oz_mode && !have_submounts(dentry)) {
-                struct dentry *new;
-                new = d_lookup(dentry->d_parent, &dentry->d_name);
-                if (new) {
-                        if (active)
-                                dput(active);
-                        return new;
-                } else {
-                        if (!status)
-                                status = -ENOENT;
+                if (!oz_mode) {
+                        spin_lock(&sbi->fs_lock);
+                        ino->flags &= ~AUTOFS_INF_PENDING;
+                        spin_unlock(&sbi->fs_lock);
                 }
         }
 
         /*
-         * If we had a mount failure, return status to user space.
-         * If the mount succeeded and we used a dentry from the active queue
-         * return it.
+         * If this dentry is unhashed, then we shouldn't honour this
+         * lookup.  Returning ENOENT here doesn't do the right thing
+         * for all system calls, but it should be OK for the operations
+         * we permit from an autofs.
          */
-        if (status) {
-                dentry = ERR_PTR(status);
-                if (active)
-                        dput(active);
-                return dentry;
-        } else {
+        if (!oz_mode && d_unhashed(dentry)) {
                 /*
-                 * Valid successful mount, return active dentry or NULL
-                 * for a new dentry.
+                 * A user space application can (and has done in the past)
+                 * remove and re-create this directory during the callback.
+                 * This can leave us with an unhashed dentry, but a
+                 * successful mount!  So we need to perform another
+                 * cached lookup in case the dentry now exists.
                  */
+                struct dentry *parent = dentry->d_parent;
+                struct dentry *new = d_lookup(parent, &dentry->d_name);
+                if (new != NULL)
+                        dentry = new;
+                else
+                        dentry = ERR_PTR(-ENOENT);
+
                 if (active)
-                        return active;
+                        dput(active);
+
+                return dentry;
         }
 
+        if (active)
+                return active;
+
         return NULL;
 }
 
@@ -834,6 +669,8 @@ static int autofs4_dir_symlink(struct inode *dir,
         if (!ino)
                 return -ENOMEM;
 
+        autofs4_del_active(dentry);
+
         ino->size = strlen(symname);
         cp = kmalloc(ino->size + 1, GFP_KERNEL);
         if (!cp) {
@@ -910,6 +747,7 @@ static int autofs4_dir_unlink(struct inode *dir, struct dentry *dentry)
         dir->i_mtime = CURRENT_TIME;
 
         spin_lock(&dcache_lock);
+        autofs4_add_expiring(dentry);
         spin_lock(&dentry->d_lock);
         __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
@@ -935,6 +773,7 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
                 spin_unlock(&dcache_lock);
                 return -ENOTEMPTY;
         }
+        autofs4_add_expiring(dentry);
         spin_lock(&dentry->d_lock);
         __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
@@ -972,6 +811,8 @@ static int autofs4_dir_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         if (!ino)
                 return -ENOMEM;
 
+        autofs4_del_active(dentry);
+
         inode = autofs4_get_inode(dir->i_sb, ino);
         if (!inode) {
                 if (!dentry->d_fsdata)
diff --git a/fs/befs/datastream.c b/fs/befs/datastream.c
index e3287d0d1a58..59096b5e0fc7 100644
--- a/fs/befs/datastream.c
+++ b/fs/befs/datastream.c
@@ -11,7 +11,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/buffer_head.h>
 #include <linux/string.h>
 
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 33baf27fac78..34ddda888e63 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -873,6 +873,7 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
         brelse(bh);
 
       unacquire_priv_sbp:
+        kfree(befs_sb->mount_opts.iocharset);
         kfree(sb->s_fs_info);
 
       unacquire_none:
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index 6f60336c6628..f22a7d3dc362 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -15,6 +15,7 @@
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <linux/vfs.h>
+#include <linux/writeback.h>
 #include <asm/uaccess.h>
 #include "bfs.h"
 
@@ -98,7 +99,7 @@ error:
         return ERR_PTR(-EIO);
 }
 
-static int bfs_write_inode(struct inode *inode, int wait)
+static int bfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct bfs_sb_info *info = BFS_SB(inode->i_sb);
         unsigned int ino = (u16)inode->i_ino;
@@ -147,7 +148,7 @@ static int bfs_write_inode(struct inode *inode, int wait)
         di->i_eoffset = cpu_to_le32(i_sblock * BFS_BSIZE + inode->i_size - 1);
 
         mark_buffer_dirty(bh);
-        if (wait) {
+        if (wbc->sync_mode == WB_SYNC_ALL) {
                 sync_dirty_buffer(bh);
                 if (buffer_req(bh) && !buffer_uptodate(bh))
                         err = -EIO;
@@ -353,35 +354,35 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
         struct inode *inode;
         unsigned i, imap_len;
         struct bfs_sb_info *info;
-        long ret = -EINVAL;
+        int ret = -EINVAL;
         unsigned long i_sblock, i_eblock, i_eoff, s_size;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
+        mutex_init(&info->bfs_lock);
         s->s_fs_info = info;
 
         sb_set_blocksize(s, BFS_BSIZE);
 
-        bh = sb_bread(s, 0);
-        if(!bh)
+        info->si_sbh = sb_bread(s, 0);
+        if (!info->si_sbh)
                 goto out;
-        bfs_sb = (struct bfs_super_block *)bh->b_data;
+        bfs_sb = (struct bfs_super_block *)info->si_sbh->b_data;
         if (le32_to_cpu(bfs_sb->s_magic) != BFS_MAGIC) {
                 if (!silent)
                         printf("No BFS filesystem on %s (magic=%08x)\n", 
                                 s->s_id,  le32_to_cpu(bfs_sb->s_magic));
-                goto out;
+                goto out1;
         }
         if (BFS_UNCLEAN(bfs_sb, s) && !silent)
                 printf("%s is unclean, continuing\n", s->s_id);
 
         s->s_magic = BFS_MAGIC;
-        info->si_sbh = bh;
 
         if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) {
                 printf("Superblock is corrupted\n");
-                goto out;
+                goto out1;
         }
 
         info->si_lasti = (le32_to_cpu(bfs_sb->s_start) - BFS_BSIZE) /
@@ -390,7 +391,7 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
         imap_len = (info->si_lasti / 8) + 1;
         info->si_imap = kzalloc(imap_len, GFP_KERNEL);
         if (!info->si_imap)
-                goto out;
+                goto out1;
         for (i = 0; i < BFS_ROOT_INO; i++)
                 set_bit(i, info->si_imap);
 
@@ -398,15 +399,13 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
         inode = bfs_iget(s, BFS_ROOT_INO);
         if (IS_ERR(inode)) {
                 ret = PTR_ERR(inode);
-                kfree(info->si_imap);
-                goto out;
+                goto out2;
         }
         s->s_root = d_alloc_root(inode);
         if (!s->s_root) {
                 iput(inode);
                 ret = -ENOMEM;
-                kfree(info->si_imap);
-                goto out;
+                goto out2;
         }
 
         info->si_blocks = (le32_to_cpu(bfs_sb->s_end) + 1) >> BFS_BSIZE_BITS;
@@ -419,10 +418,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
         bh = sb_bread(s, info->si_blocks - 1);
         if (!bh) {
                 printf("Last block not available: %lu\n", info->si_blocks - 1);
-                iput(inode);
                 ret = -EIO;
-                kfree(info->si_imap);
-                goto out;
+                goto out3;
         }
         brelse(bh);
 
@@ -459,11 +456,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
                         printf("Inode 0x%08x corrupted\n", i);
 
                         brelse(bh);
-                        s->s_root = NULL;
-                        kfree(info->si_imap);
-                        kfree(info);
-                        s->s_fs_info = NULL;
-                        return -EIO;
+                        ret = -EIO;
+                        goto out3;
                 }
 
                 if (!di->i_ino) {
@@ -483,11 +477,17 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
                 s->s_dirt = 1;
         } 
         dump_imap("read_super", s);
-        mutex_init(&info->bfs_lock);
         return 0;
 
+out3:
+        dput(s->s_root);
+        s->s_root = NULL;
+out2:
+        kfree(info->si_imap);
+out1:
+        brelse(info->si_sbh);
 out:
-        brelse(bh);
+        mutex_destroy(&info->bfs_lock);
         kfree(info);
         s->s_fs_info = NULL;
         return ret;
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index 346b69405363..f96eff04e11a 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -20,10 +20,11 @@
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
-#include <linux/slab.h>
 #include <linux/binfmts.h>
 #include <linux/personality.h>
 #include <linux/init.h>
+#include <linux/coredump.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -60,26 +61,6 @@ static int set_brk(unsigned long start, unsigned long end)
 }
 
 /*
- * These are the only things you should do on a core-file: use only these
- * macros to write out all the necessary info.
- */
-
-static int dump_write(struct file *file, const void *addr, int nr)
-{
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
-
-#define DUMP_WRITE(addr, nr)    \
-        if (!dump_write(file, (void *)(addr), (nr))) \
-                goto end_coredump;
-
-#define DUMP_SEEK(offset) \
-if (file->f_op->llseek) { \
-        if (file->f_op->llseek(file,(offset),0) != (offset)) \
-                goto end_coredump; \
-} else file->f_pos = (offset)
-
-/*
  * Routine writes a core dump image in the current directory.
  * Currently only a stub-function.
  *
@@ -94,14 +75,16 @@ static int aout_core_dump(struct coredump_params *cprm)
         struct file *file = cprm->file;
         mm_segment_t fs;
         int has_dumped = 0;
-        unsigned long dump_start, dump_size;
+        void __user *dump_start;
+        int dump_size;
         struct user dump;
 #ifdef __alpha__
-#       define START_DATA(u)    (u.start_data)
+#       define START_DATA(u)    ((void __user *)u.start_data)
 #else
-#       define START_DATA(u)    ((u.u_tsize << PAGE_SHIFT) + u.start_code)
+#       define START_DATA(u)    ((void __user *)((u.u_tsize << PAGE_SHIFT) + \
+                                 u.start_code))
 #endif
-#       define START_STACK(u)   (u.start_stack)
+#       define START_STACK(u)   ((void __user *)u.start_stack)
 
         fs = get_fs();
         set_fs(KERNEL_DS);
@@ -123,33 +106,38 @@ static int aout_core_dump(struct coredump_params *cprm)
 
 /* make sure we actually have a data and stack area to dump */
         set_fs(USER_DS);
-        if (!access_ok(VERIFY_READ, (void __user *)START_DATA(dump), dump.u_dsize << PAGE_SHIFT))
+        if (!access_ok(VERIFY_READ, START_DATA(dump), dump.u_dsize << PAGE_SHIFT))
                 dump.u_dsize = 0;
-        if (!access_ok(VERIFY_READ, (void __user *)START_STACK(dump), dump.u_ssize << PAGE_SHIFT))
+        if (!access_ok(VERIFY_READ, START_STACK(dump), dump.u_ssize << PAGE_SHIFT))
                 dump.u_ssize = 0;
 
         set_fs(KERNEL_DS);
 /* struct user */
-        DUMP_WRITE(&dump,sizeof(dump));
+        if (!dump_write(file, &dump, sizeof(dump)))
+                goto end_coredump;
 /* Now dump all of the user data.  Include malloced stuff as well */
-        DUMP_SEEK(PAGE_SIZE);
+        if (!dump_seek(cprm->file, PAGE_SIZE - sizeof(dump)))
+                goto end_coredump;
 /* now we start writing out the user space info */
         set_fs(USER_DS);
 /* Dump the data area */
         if (dump.u_dsize != 0) {
                 dump_start = START_DATA(dump);
                 dump_size = dump.u_dsize << PAGE_SHIFT;
-                DUMP_WRITE(dump_start,dump_size);
+                if (!dump_write(file, dump_start, dump_size))
+                        goto end_coredump;
         }
 /* Now prepare to dump the stack area */
         if (dump.u_ssize != 0) {
                 dump_start = START_STACK(dump);
                 dump_size = dump.u_ssize << PAGE_SHIFT;
-                DUMP_WRITE(dump_start,dump_size);
+                if (!dump_write(file, dump_start, dump_size))
+                        goto end_coredump;
         }
 /* Finally dump the task struct.  Not be used by gdb, but could be useful */
         set_fs(KERNEL_DS);
-        DUMP_WRITE(current,sizeof(*current));
+        if (!dump_write(file, current, sizeof(*current)))
+                goto end_coredump;
 end_coredump:
         set_fs(fs);
         return has_dumped;
@@ -247,7 +235,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
          * size limits imposed on them by creating programs with large
          * arrays in the data or bss.
          */
-        rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+        rlim = rlimit(RLIMIT_DATA);
         if (rlim >= RLIM_INFINITY)
                 rlim = ~0;
         if (ex.a_data + ex.a_bss > rlim)
@@ -264,6 +252,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 #else
         set_personality(PER_LINUX);
 #endif
+        setup_new_exec(bprm);
 
         current->mm->end_code = ex.a_text +
                 (current->mm->start_code = N_TXTADDR(ex));
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index edd90c49003c..535e763ab1a6 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -31,6 +31,7 @@
 #include <linux/random.h>
 #include <linux/elf.h>
 #include <linux/utsname.h>
+#include <linux/coredump.h>
 #include <asm/uaccess.h>
 #include <asm/param.h>
 #include <asm/page.h>
@@ -662,27 +663,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
                                 goto out_free_interp;
 
-                        /*
-                         * The early SET_PERSONALITY here is so that the lookup
-                         * for the interpreter happens in the namespace of the 
-                         * to-be-execed image.  SET_PERSONALITY can select an
-                         * alternate root.
-                         *
-                         * However, SET_PERSONALITY is NOT allowed to switch
-                         * this task into the new images's memory mapping
-                         * policy - that is, TASK_SIZE must still evaluate to
-                         * that which is appropriate to the execing application.
-                         * This is because exit_mmap() needs to have TASK_SIZE
-                         * evaluate to the size of the old image.
-                         *
-                         * So if (say) a 64-bit application is execing a 32-bit
-                         * application it is the architecture's responsibility
-                         * to defer changing the value of TASK_SIZE until the
-                         * switch really is going to happen - do this in
-                         * flush_thread().      - akpm
-                         */
-                        SET_PERSONALITY(loc->elf_ex);
-
                         interpreter = open_exec(elf_interpreter);
                         retval = PTR_ERR(interpreter);
                         if (IS_ERR(interpreter))
@@ -730,9 +710,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                 /* Verify the interpreter has a valid arch */
                 if (!elf_check_arch(&loc->interp_elf_ex))
                         goto out_free_dentry;
-        } else {
-                /* Executables without an interpreter also need a personality  */
-                SET_PERSONALITY(loc->elf_ex);
         }
 
         /* Flush all traces of the currently running executable */
@@ -752,7 +729,8 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 
         if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
                 current->flags |= PF_RANDOMIZE;
-        arch_pick_mmap_layout(current->mm);
+
+        setup_new_exec(bprm);
 
         /* Do this so that we can load the interpreter, if need be.  We will
            change some of these later */
@@ -1108,36 +1086,6 @@ out:
  * Modelled on fs/exec.c:aout_core_dump()
  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
  */
-/*
- * These are the only things you should do on a core-file: use only these
- * functions to write out all the necessary info.
- */
-static int dump_write(struct file *file, const void *addr, int nr)
-{
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
-
-static int dump_seek(struct file *file, loff_t off)
-{
-        if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
-                if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
-                        return 0;
-        } else {
-                char *buf = (char *)get_zeroed_page(GFP_KERNEL);
-                if (!buf)
-                        return 0;
-                while (off > 0) {
-                        unsigned long n = off;
-                        if (n > PAGE_SIZE)
-                                n = PAGE_SIZE;
-                        if (!dump_write(file, buf, n))
-                                return 0;
-                        off -= n;
-                }
-                free_page((unsigned long)buf);
-        }
-        return 1;
-}
 
 /*
  * Decide what to dump of a segment, part, all or none.
@@ -1272,11 +1220,6 @@ static int writenote(struct memelfnote *men, struct file *file,
 }
 #undef DUMP_WRITE
 
-#define DUMP_WRITE(addr, nr)                            \
-        if ((size += (nr)) > cprm->limit ||             \
-            !dump_write(cprm->file, (addr), (nr)))      \
-                goto end_coredump;
-
 static void fill_elf_header(struct elfhdr *elf, int segs,
                             u16 machine, u32 flags, u8 osabi)
 {
@@ -1895,6 +1838,34 @@ static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
         return gate_vma;
 }
 
+static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+                             elf_addr_t e_shoff, int segs)
+{
+        elf->e_shoff = e_shoff;
+        elf->e_shentsize = sizeof(*shdr4extnum);
+        elf->e_shnum = 1;
+        elf->e_shstrndx = SHN_UNDEF;
+
+        memset(shdr4extnum, 0, sizeof(*shdr4extnum));
+
+        shdr4extnum->sh_type = SHT_NULL;
+        shdr4extnum->sh_size = elf->e_shnum;
+        shdr4extnum->sh_link = elf->e_shstrndx;
+        shdr4extnum->sh_info = segs;
+}
+
+static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
+                                     unsigned long mm_flags)
+{
+        struct vm_area_struct *vma;
+        size_t size = 0;
+
+        for (vma = first_vma(current, gate_vma); vma != NULL;
+             vma = next_vma(vma, gate_vma))
+                size += vma_dump_size(vma, mm_flags);
+        return size;
+}
+
 /*
  * Actual dumper
  *
@@ -1911,8 +1882,11 @@ static int elf_core_dump(struct coredump_params *cprm)
         struct vm_area_struct *vma, *gate_vma;
         struct elfhdr *elf = NULL;
         loff_t offset = 0, dataoff, foffset;
-        unsigned long mm_flags;
         struct elf_note_info info;
+        struct elf_phdr *phdr4note = NULL;
+        struct elf_shdr *shdr4extnum = NULL;
+        Elf_Half e_phnum;
+        elf_addr_t e_shoff;
 
         /*
          * We no longer stop all VM operations.
@@ -1935,20 +1909,25 @@ static int elf_core_dump(struct coredump_params *cprm)
          * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
          */
         segs = current->mm->map_count;
-#ifdef ELF_CORE_EXTRA_PHDRS
-        segs += ELF_CORE_EXTRA_PHDRS;
-#endif
+        segs += elf_core_extra_phdrs();
 
         gate_vma = get_gate_vma(current);
         if (gate_vma != NULL)
                 segs++;
 
+        /* for notes section */
+        segs++;
+
+        /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
+         * this, kernel supports extended numbering. Have a look at
+         * include/linux/elf.h for further information. */
+        e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
+
         /*
          * Collect all the non-memory information about the process for the
          * notes.  This also sets up the file header.
          */
-        if (!fill_note_info(elf, segs + 1, /* including notes section */
-                            &info, cprm->signr, cprm->regs))
+        if (!fill_note_info(elf, e_phnum, &info, cprm->signr, cprm->regs))
                 goto cleanup;
 
         has_dumped = 1;
@@ -1957,31 +1936,47 @@ static int elf_core_dump(struct coredump_params *cprm)
         fs = get_fs();
         set_fs(KERNEL_DS);
 
-        DUMP_WRITE(elf, sizeof(*elf));
         offset += sizeof(*elf);                         /* Elf header */
-        offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
+        offset += segs * sizeof(struct elf_phdr);       /* Program headers */
         foffset = offset;
 
         /* Write notes phdr entry */
         {
-                struct elf_phdr phdr;
                 size_t sz = get_note_info_size(&info);
 
                 sz += elf_coredump_extra_notes_size();
 
-                fill_elf_note_phdr(&phdr, sz, offset);
+                phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
+                if (!phdr4note)
+                        goto end_coredump;
+
+                fill_elf_note_phdr(phdr4note, sz, offset);
                 offset += sz;
-                DUMP_WRITE(&phdr, sizeof(phdr));
         }
 
         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
 
-        /*
-         * We must use the same mm->flags while dumping core to avoid
-         * inconsistency between the program headers and bodies, otherwise an
-         * unusable core file can be generated.
-         */
-        mm_flags = current->mm->flags;
+        offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
+        offset += elf_core_extra_data_size();
+        e_shoff = offset;
+
+        if (e_phnum == PN_XNUM) {
+                shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
+                if (!shdr4extnum)
+                        goto end_coredump;
+                fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
+        }
+
+        offset = dataoff;
+
+        size += sizeof(*elf);
+        if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
+                goto end_coredump;
+
+        size += sizeof(*phdr4note);
+        if (size > cprm->limit
+            || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
+                goto end_coredump;
 
         /* Write program headers for segments dump */
         for (vma = first_vma(current, gate_vma); vma != NULL;
@@ -1992,7 +1987,7 @@ static int elf_core_dump(struct coredump_params *cprm)
                 phdr.p_offset = offset;
                 phdr.p_vaddr = vma->vm_start;
                 phdr.p_paddr = 0;
-                phdr.p_filesz = vma_dump_size(vma, mm_flags);
+                phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
                 phdr.p_memsz = vma->vm_end - vma->vm_start;
                 offset += phdr.p_filesz;
                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
@@ -2002,12 +1997,14 @@ static int elf_core_dump(struct coredump_params *cprm)
                         phdr.p_flags |= PF_X;
                 phdr.p_align = ELF_EXEC_PAGESIZE;
 
-                DUMP_WRITE(&phdr, sizeof(phdr));
+                size += sizeof(phdr);
+                if (size > cprm->limit
+                    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
+                        goto end_coredump;
         }
 
-#ifdef ELF_CORE_WRITE_EXTRA_PHDRS
-        ELF_CORE_WRITE_EXTRA_PHDRS;
-#endif
+        if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
+                goto end_coredump;
 
         /* write out the notes section */
         if (!write_note_info(&info, cprm->file, &foffset))
@@ -2025,7 +2022,7 @@ static int elf_core_dump(struct coredump_params *cprm)
                 unsigned long addr;
                 unsigned long end;
 
-                end = vma->vm_start + vma_dump_size(vma, mm_flags);
+                end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
 
                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
                         struct page *page;
@@ -2046,15 +2043,24 @@ static int elf_core_dump(struct coredump_params *cprm)
                 }
         }
 
-#ifdef ELF_CORE_WRITE_EXTRA_DATA
-        ELF_CORE_WRITE_EXTRA_DATA;
-#endif
+        if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
+                goto end_coredump;
+
+        if (e_phnum == PN_XNUM) {
+                size += sizeof(*shdr4extnum);
+                if (size > cprm->limit
+                    || !dump_write(cprm->file, shdr4extnum,
+                                   sizeof(*shdr4extnum)))
+                        goto end_coredump;
+        }
 
 end_coredump:
         set_fs(fs);
 
 cleanup:
         free_note_info(&info);
+        kfree(shdr4extnum);
+        kfree(phdr4note);
         kfree(elf);
 out:
         return has_dumped;
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index c25256a5c5b0..2c5f9a0e5d72 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -34,6 +34,7 @@
 #include <linux/elf.h>
 #include <linux/elf-fdpic.h>
 #include <linux/elfcore.h>
+#include <linux/coredump.h>
 
 #include <asm/uaccess.h>
 #include <asm/param.h>
@@ -171,6 +172,9 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
 #ifdef ELF_FDPIC_PLAT_INIT
         unsigned long dynaddr;
 #endif
+#ifndef CONFIG_MMU
+        unsigned long stack_prot;
+#endif
         struct file *interpreter = NULL; /* to shut gcc up */
         char *interpreter_name = NULL;
         int executable_stack;
@@ -316,6 +320,11 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
          * defunct, deceased, etc. after this point we have to exit via
          * error_kill */
         set_personality(PER_LINUX_FDPIC);
+        if (elf_read_implies_exec(&exec_params.hdr, executable_stack))
+                current->personality |= READ_IMPLIES_EXEC;
+
+        setup_new_exec(bprm);
+
         set_binfmt(&elf_fdpic_format);
 
         current->mm->start_code = 0;
@@ -377,9 +386,13 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
         if (stack_size < PAGE_SIZE * 2)
                 stack_size = PAGE_SIZE * 2;
 
+        stack_prot = PROT_READ | PROT_WRITE;
+        if (executable_stack == EXSTACK_ENABLE_X ||
+            (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC))
+                stack_prot |= PROT_EXEC;
+
         down_write(&current->mm->mmap_sem);
-        current->mm->start_brk = do_mmap(NULL, 0, stack_size,
-                                         PROT_READ | PROT_WRITE | PROT_EXEC,
+        current->mm->start_brk = do_mmap(NULL, 0, stack_size, stack_prot,
                                          MAP_PRIVATE | MAP_ANONYMOUS |
                                          MAP_UNINITIALIZED | MAP_GROWSDOWN,
                                          0);
@@ -992,15 +1005,8 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
                                 }
                         } else if (!mm->start_data) {
                                 mm->start_data = seg->addr;
-#ifndef CONFIG_MMU
                                 mm->end_data = seg->addr + phdr->p_memsz;
-#endif
                         }
-
-#ifdef CONFIG_MMU
-                        if (seg->addr + phdr->p_memsz > mm->end_data)
-                                mm->end_data = seg->addr + phdr->p_memsz;
-#endif
                 }
 
                 seg++;
@@ -1204,26 +1210,6 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
 #ifdef CONFIG_ELF_CORE
 
 /*
- * These are the only things you should do on a core-file: use only these
- * functions to write out all the necessary info.
- */
-static int dump_write(struct file *file, const void *addr, int nr)
-{
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
-
-static int dump_seek(struct file *file, loff_t off)
-{
-        if (file->f_op->llseek) {
-                if (file->f_op->llseek(file, off, SEEK_SET) != off)
-                        return 0;
-        } else {
-                file->f_pos = off;
-        }
-        return 1;
-}
-
-/*
  * Decide whether a segment is worth dumping; default is yes to be
  * sure (missing info is worse than too much; etc).
  * Personally I'd include everything, and use the coredump limit...
@@ -1301,35 +1287,35 @@ static int notesize(struct memelfnote *en)
 
 /* #define DEBUG */
 
-#define DUMP_WRITE(addr, nr)    \
-        do { if (!dump_write(file, (addr), (nr))) return 0; } while(0)
-#define DUMP_SEEK(off)  \
-        do { if (!dump_seek(file, (off))) return 0; } while(0)
+#define DUMP_WRITE(addr, nr, foffset)   \
+        do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
 
-static int writenote(struct memelfnote *men, struct file *file)
+static int alignfile(struct file *file, loff_t *foffset)
 {
-        struct elf_note en;
+        static const char buf[4] = { 0, };
+        DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
+        return 1;
+}
 
+static int writenote(struct memelfnote *men, struct file *file,
+                        loff_t *foffset)
+{
+        struct elf_note en;
         en.n_namesz = strlen(men->name) + 1;
         en.n_descsz = men->datasz;
         en.n_type = men->type;
 
-        DUMP_WRITE(&en, sizeof(en));
-        DUMP_WRITE(men->name, en.n_namesz);
-        /* XXX - cast from long long to long to avoid need for libgcc.a */
-        DUMP_SEEK(roundup((unsigned long)file->f_pos, 4));      /* XXX */
-        DUMP_WRITE(men->data, men->datasz);
-        DUMP_SEEK(roundup((unsigned long)file->f_pos, 4));      /* XXX */
+        DUMP_WRITE(&en, sizeof(en), foffset);
+        DUMP_WRITE(men->name, en.n_namesz, foffset);
+        if (!alignfile(file, foffset))
+                return 0;
+        DUMP_WRITE(men->data, men->datasz, foffset);
+        if (!alignfile(file, foffset))
+                return 0;
 
         return 1;
 }
 #undef DUMP_WRITE
-#undef DUMP_SEEK
-
-#define DUMP_WRITE(addr, nr)                            \
-        if ((size += (nr)) > cprm->limit ||             \
-            !dump_write(cprm->file, (addr), (nr)))      \
-                goto end_coredump;
 
 static inline void fill_elf_fdpic_header(struct elfhdr *elf, int segs)
 {
@@ -1381,7 +1367,7 @@ static inline void fill_note(struct memelfnote *note, const char *name, int type
 
 /*
  * fill up all the fields in prstatus from the given task struct, except
- * registers which need to be filled up seperately.
+ * registers which need to be filled up separately.
  */
 static void fill_prstatus(struct elf_prstatus *prstatus,
                           struct task_struct *p, long signr)
@@ -1512,6 +1498,22 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
         return sz;
 }
 
+static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+                             elf_addr_t e_shoff, int segs)
+{
+        elf->e_shoff = e_shoff;
+        elf->e_shentsize = sizeof(*shdr4extnum);
+        elf->e_shnum = 1;
+        elf->e_shstrndx = SHN_UNDEF;
+
+        memset(shdr4extnum, 0, sizeof(*shdr4extnum));
+
+        shdr4extnum->sh_type = SHT_NULL;
+        shdr4extnum->sh_size = elf->e_shnum;
+        shdr4extnum->sh_link = elf->e_shstrndx;
+        shdr4extnum->sh_info = segs;
+}
+
 /*
  * dump the segments for an MMU process
  */
@@ -1540,7 +1542,7 @@ static int elf_fdpic_dump_segments(struct file *file, size_t *size,
                                         err = -EIO;
                                 kunmap(page);
                                 page_cache_release(page);
-                        } else if (!dump_seek(file, file->f_pos + PAGE_SIZE))
+                        } else if (!dump_seek(file, PAGE_SIZE))
                                 err = -EFBIG;
                         if (err)
                                 goto out;
@@ -1576,6 +1578,17 @@ static int elf_fdpic_dump_segments(struct file *file, size_t *size,
 }
 #endif
 
+static size_t elf_core_vma_data_size(unsigned long mm_flags)
+{
+        struct vm_area_struct *vma;
+        size_t size = 0;
+
+        for (vma = current->mm->mmap; vma; vma = vma->vm_next)
+                if (maydump(vma, mm_flags))
+                        size += vma->vm_end - vma->vm_start;
+        return size;
+}
+
 /*
  * Actual dumper
  *
@@ -1593,7 +1606,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         int i;
         struct vm_area_struct *vma;
         struct elfhdr *elf = NULL;
-        loff_t offset = 0, dataoff;
+        loff_t offset = 0, dataoff, foffset;
         int numnote;
         struct memelfnote *notes = NULL;
         struct elf_prstatus *prstatus = NULL;   /* NT_PRSTATUS */
@@ -1606,7 +1619,10 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
 #endif
         int thread_status_size = 0;
         elf_addr_t *auxv;
-        unsigned long mm_flags;
+        struct elf_phdr *phdr4note = NULL;
+        struct elf_shdr *shdr4extnum = NULL;
+        Elf_Half e_phnum;
+        elf_addr_t e_shoff;
 
         /*
          * We no longer stop all VM operations.
@@ -1671,12 +1687,18 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         elf_core_copy_regs(&prstatus->pr_reg, cprm->regs);
 
         segs = current->mm->map_count;
-#ifdef ELF_CORE_EXTRA_PHDRS
-        segs += ELF_CORE_EXTRA_PHDRS;
-#endif
+        segs += elf_core_extra_phdrs();
+
+        /* for notes section */
+        segs++;
+
+        /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
+         * this, kernel supports extended numbering. Have a look at
+         * include/linux/elf.h for further information. */
+        e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
 
         /* Set up header */
-        fill_elf_fdpic_header(elf, segs + 1);   /* including notes section */
+        fill_elf_fdpic_header(elf, e_phnum);
 
         has_dumped = 1;
         current->flags |= PF_DUMPCORE;
@@ -1715,13 +1737,12 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         fs = get_fs();
         set_fs(KERNEL_DS);
 
-        DUMP_WRITE(elf, sizeof(*elf));
         offset += sizeof(*elf);                         /* Elf header */
-        offset += (segs+1) * sizeof(struct elf_phdr);   /* Program headers */
+        offset += segs * sizeof(struct elf_phdr);       /* Program headers */
+        foffset = offset;
 
         /* Write notes phdr entry */
         {
-                struct elf_phdr phdr;
                 int sz = 0;
 
                 for (i = 0; i < numnote; i++)
@@ -1729,20 +1750,38 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
 
                 sz += thread_status_size;
 
-                fill_elf_note_phdr(&phdr, sz, offset);
+                phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
+                if (!phdr4note)
+                        goto end_coredump;
+
+                fill_elf_note_phdr(phdr4note, sz, offset);
                 offset += sz;
-                DUMP_WRITE(&phdr, sizeof(phdr));
         }
 
         /* Page-align dumped data */
         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
 
-        /*
-         * We must use the same mm->flags while dumping core to avoid
-         * inconsistency between the program headers and bodies, otherwise an
-         * unusable core file can be generated.
-         */
-        mm_flags = current->mm->flags;
+        offset += elf_core_vma_data_size(cprm->mm_flags);
+        offset += elf_core_extra_data_size();
+        e_shoff = offset;
+
+        if (e_phnum == PN_XNUM) {
+                shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
+                if (!shdr4extnum)
+                        goto end_coredump;
+                fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
+        }
+
+        offset = dataoff;
+
+        size += sizeof(*elf);
+        if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
+                goto end_coredump;
+
+        size += sizeof(*phdr4note);
+        if (size > cprm->limit
+            || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
+                goto end_coredump;
 
         /* write program headers for segments dump */
         for (vma = current->mm->mmap; vma; vma = vma->vm_next) {
@@ -1755,7 +1794,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                 phdr.p_offset = offset;
                 phdr.p_vaddr = vma->vm_start;
                 phdr.p_paddr = 0;
-                phdr.p_filesz = maydump(vma, mm_flags) ? sz : 0;
+                phdr.p_filesz = maydump(vma, cprm->mm_flags) ? sz : 0;
                 phdr.p_memsz = sz;
                 offset += phdr.p_filesz;
                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
@@ -1765,16 +1804,18 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                         phdr.p_flags |= PF_X;
                 phdr.p_align = ELF_EXEC_PAGESIZE;
 
-                DUMP_WRITE(&phdr, sizeof(phdr));
+                size += sizeof(phdr);
+                if (size > cprm->limit
+                    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
+                        goto end_coredump;
         }
 
-#ifdef ELF_CORE_WRITE_EXTRA_PHDRS
-        ELF_CORE_WRITE_EXTRA_PHDRS;
-#endif
+        if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
+                goto end_coredump;
 
         /* write out the notes section */
         for (i = 0; i < numnote; i++)
-                if (!writenote(notes + i, cprm->file))
+                if (!writenote(notes + i, cprm->file, &foffset))
                         goto end_coredump;
 
         /* write out the thread status notes section */
@@ -1783,26 +1824,33 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                                 list_entry(t, struct elf_thread_status, list);
 
                 for (i = 0; i < tmp->num_notes; i++)
-                        if (!writenote(&tmp->notes[i], cprm->file))
+                        if (!writenote(&tmp->notes[i], cprm->file, &foffset))
                                 goto end_coredump;
         }
 
-        if (!dump_seek(cprm->file, dataoff))
+        if (!dump_seek(cprm->file, dataoff - foffset))
                 goto end_coredump;
 
         if (elf_fdpic_dump_segments(cprm->file, &size, &cprm->limit,
-                                    mm_flags) < 0)
+                                    cprm->mm_flags) < 0)
                 goto end_coredump;
 
-#ifdef ELF_CORE_WRITE_EXTRA_DATA
-        ELF_CORE_WRITE_EXTRA_DATA;
-#endif
+        if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
+                goto end_coredump;
 
-        if (file->f_pos != offset) {
+        if (e_phnum == PN_XNUM) {
+                size += sizeof(*shdr4extnum);
+                if (size > cprm->limit
+                    || !dump_write(cprm->file, shdr4extnum,
+                                   sizeof(*shdr4extnum)))
+                        goto end_coredump;
+        }
+
+        if (cprm->file->f_pos != offset) {
                 /* Sanity check */
                 printk(KERN_WARNING
                        "elf_core_dump: file->f_pos (%lld) != offset (%lld)\n",
-                       file->f_pos, offset);
+                       cprm->file->f_pos, offset);
         }
 
 end_coredump:
@@ -1814,7 +1862,7 @@ cleanup:
                 list_del(tmp);
                 kfree(list_entry(tmp, struct elf_thread_status, list));
         }
-
+        kfree(phdr4note);
         kfree(elf);
         kfree(prstatus);
         kfree(psinfo);
diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
index 32fb00b52cd0..b8e8b0acf9bd 100644
--- a/fs/binfmt_em86.c
+++ b/fs/binfmt_em86.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/stat.h>
-#include <linux/slab.h>
 #include <linux/binfmts.h>
 #include <linux/elf.h>
 #include <linux/init.h>
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index d4a00ea1054c..49566c1687d8 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -355,7 +355,7 @@ calc_reloc(unsigned long r, struct lib_info *p, int curid, int internalp)
 
         if (!flat_reloc_valid(r, start_brk - start_data + text_len)) {
                 printk("BINFMT_FLAT: reloc outside program 0x%x (0 - 0x%x/0x%x)",
-                       (int) r,(int)(start_brk-start_code),(int)text_len);
+                       (int) r,(int)(start_brk-start_data+text_len),(int)text_len);
                 goto failed;
         }
 
@@ -501,7 +501,7 @@ static int load_flat_file(struct linux_binprm * bprm,
          * size limits imposed on them by creating programs with large
          * arrays in the data or bss.
          */
-        rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+        rlim = rlimit(RLIMIT_DATA);
         if (rlim >= RLIM_INFINITY)
                 rlim = ~0;
         if (data_len + bss_len > rlim) {
@@ -519,6 +519,7 @@ static int load_flat_file(struct linux_binprm * bprm,
 
                 /* OK, This is the point of no return */
                 set_personality(PER_LINUX_32BIT);
+                setup_new_exec(bprm);
         }
 
         /*
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 08343505e184..aca9d55afb22 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -8,7 +8,6 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/stat.h>
-#include <linux/slab.h>
 #include <linux/binfmts.h>
 #include <linux/init.h>
 #include <linux/file.h>
diff --git a/fs/binfmt_som.c b/fs/binfmt_som.c
index 2a9b5330cc5e..cc8560f6c9b0 100644
--- a/fs/binfmt_som.c
+++ b/fs/binfmt_som.c
@@ -227,6 +227,7 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         /* OK, This is the point of no return */
         current->flags &= ~PF_FORKNOEXEC;
         current->personality = PER_HPUX;
+        setup_new_exec(bprm);
 
         /* Set the task size for HP-UX processes such that
          * the gateway page is outside the address space.
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 49a34e7f7306..612a5c38d3c1 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -24,6 +24,7 @@
 #include <linux/mempool.h>
 #include <linux/bio.h>
 #include <linux/workqueue.h>
+#include <linux/slab.h>
 
 struct integrity_slab {
         struct kmem_cache *slab;
@@ -61,7 +62,7 @@ static inline unsigned int vecs_to_idx(unsigned int nr)
 
 static inline int use_bip_pool(unsigned int idx)
 {
-        if (idx == BIOVEC_NR_POOLS)
+        if (idx == BIOVEC_MAX_IDX)
                 return 1;
 
         return 0;
@@ -95,6 +96,7 @@ struct bio_integrity_payload *bio_integrity_alloc_bioset(struct bio *bio,
 
         /* Use mempool if lower order alloc failed or max vecs were requested */
         if (bip == NULL) {
+                idx = BIOVEC_MAX_IDX;  /* so we free the payload properly later */
                 bip = mempool_alloc(bs->bio_integrity_pool, gfp_mask);
 
                 if (unlikely(bip == NULL)) {
diff --git a/fs/bio.c b/fs/bio.c
index 76e6713abf94..e7bf6ca64dcf 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
 
         i = 0;
         while (i < bio_slab_nr) {
-                struct bio_slab *bslab = &bio_slabs[i];
+                bslab = &bio_slabs[i];
 
                 if (!bslab->slab && entry == -1)
                         entry = i;
@@ -264,13 +264,12 @@ EXPORT_SYMBOL(bio_init);
  * bio_alloc_bioset - allocate a bio for I/O
  * @gfp_mask:   the GFP_ mask given to the slab allocator
  * @nr_iovecs:  number of iovecs to pre-allocate
- * @bs:         the bio_set to allocate from. If %NULL, just use kmalloc
+ * @bs:         the bio_set to allocate from.
  *
  * Description:
- *   bio_alloc_bioset will first try its own mempool to satisfy the allocation.
+ *   bio_alloc_bioset will try its own mempool to satisfy the allocation.
  *   If %__GFP_WAIT is set then we will block on the internal pool waiting
- *   for a &struct bio to become free. If a %NULL @bs is passed in, we will
- *   fall back to just using @kmalloc to allocate the required memory.
+ *   for a &struct bio to become free.
  *
  *   Note that the caller must set ->bi_destructor on successful return
  *   of a bio, to do the appropriate freeing of the bio once the reference
@@ -507,10 +506,8 @@ int bio_get_nr_vecs(struct block_device *bdev)
         int nr_pages;
 
         nr_pages = ((queue_max_sectors(q) << 9) + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        if (nr_pages > queue_max_phys_segments(q))
-                nr_pages = queue_max_phys_segments(q);
-        if (nr_pages > queue_max_hw_segments(q))
-                nr_pages = queue_max_hw_segments(q);
+        if (nr_pages > queue_max_segments(q))
+                nr_pages = queue_max_segments(q);
 
         return nr_pages;
 }
@@ -542,17 +539,22 @@ static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
 
                 if (page == prev->bv_page &&
                     offset == prev->bv_offset + prev->bv_len) {
+                        unsigned int prev_bv_len = prev->bv_len;
                         prev->bv_len += len;
 
                         if (q->merge_bvec_fn) {
                                 struct bvec_merge_data bvm = {
+                                        /* prev_bvec is already charged in
+                                           bi_size, discharge it in order to
+                                           simulate merging updated prev_bvec
+                                           as new bvec. */
                                         .bi_bdev = bio->bi_bdev,
                                         .bi_sector = bio->bi_sector,
-                                        .bi_size = bio->bi_size,
+                                        .bi_size = bio->bi_size - prev_bv_len,
                                         .bi_rw = bio->bi_rw,
                                 };
 
-                                if (q->merge_bvec_fn(q, &bvm, prev) < len) {
+                                if (q->merge_bvec_fn(q, &bvm, prev) < prev->bv_len) {
                                         prev->bv_len -= len;
                                         return 0;
                                 }
@@ -570,8 +572,7 @@ static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
          * make this too complex.
          */
 
-        while (bio->bi_phys_segments >= queue_max_phys_segments(q)
-               || bio->bi_phys_segments >= queue_max_hw_segments(q)) {
+        while (bio->bi_phys_segments >= queue_max_segments(q)) {
 
                 if (retried_segments)
                         return 0;
@@ -606,7 +607,7 @@ static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
                  * merge_bvec_fn() returns number of bytes it can accept
                  * at this offset
                  */
-                if (q->merge_bvec_fn(q, &bvm, bvec) < len) {
+                if (q->merge_bvec_fn(q, &bvm, bvec) < bvec->bv_len) {
                         bvec->bv_page = NULL;
                         bvec->bv_len = 0;
                         bvec->bv_offset = 0;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 73d6a735b8f3..6dcee88c2e5d 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -246,7 +246,8 @@ struct super_block *freeze_bdev(struct block_device *bdev)
         if (!sb)
                 goto out;
         if (sb->s_flags & MS_RDONLY) {
-                deactivate_locked_super(sb);
+                sb->s_frozen = SB_FREEZE_TRANS;
+                up_write(&sb->s_umount);
                 mutex_unlock(&bdev->bd_fsfreeze_mutex);
                 return sb;
         }
@@ -307,7 +308,7 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
         BUG_ON(sb->s_bdev != bdev);
         down_write(&sb->s_umount);
         if (sb->s_flags & MS_RDONLY)
-                goto out_deactivate;
+                goto out_unfrozen;
 
         if (sb->s_op->unfreeze_fs) {
                 error = sb->s_op->unfreeze_fs(sb);
@@ -321,11 +322,11 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
                 }
         }
 
+out_unfrozen:
         sb->s_frozen = SB_UNFROZEN;
         smp_wmb();
         wake_up(&sb->s_wait_unfrozen);
 
-out_deactivate:
         if (sb)
                 deactivate_locked_super(sb);
 out_unlock:
@@ -403,20 +404,28 @@ static loff_t block_llseek(struct file *file, loff_t offset, int origin)
  *      NULL first argument is nfsd_sync_dir() and that's not a directory.
  */
  
-static int block_fsync(struct file *filp, struct dentry *dentry, int datasync)
+int blkdev_fsync(struct file *filp, struct dentry *dentry, int datasync)
 {
-        struct block_device *bdev = I_BDEV(filp->f_mapping->host);
+        struct inode *bd_inode = filp->f_mapping->host;
+        struct block_device *bdev = I_BDEV(bd_inode);
         int error;
 
-        error = sync_blockdev(bdev);
-        if (error)
-                return error;
-        
+        /*
+         * There is no need to serialise calls to blkdev_issue_flush with
+         * i_mutex and doing so causes performance issues with concurrent
+         * O_SYNC writers to a block device.
+         */
+        mutex_unlock(&bd_inode->i_mutex);
+
         error = blkdev_issue_flush(bdev, NULL);
         if (error == -EOPNOTSUPP)
                 error = 0;
+
+        mutex_lock(&bd_inode->i_mutex);
+
         return error;
 }
+EXPORT_SYMBOL(blkdev_fsync);
 
 /*
  * pseudo-fs
@@ -1480,7 +1489,7 @@ const struct file_operations def_blk_fops = {
         .aio_read       = generic_file_aio_read,
         .aio_write      = blkdev_aio_write,
         .mmap           = generic_file_mmap,
-        .fsync          = block_fsync,
+        .fsync          = blkdev_fsync,
         .unlocked_ioctl = block_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = compat_blkdev_ioctl,
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 2e9e69987a82..6ef7b26724ec 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -22,6 +22,7 @@
 #include <linux/posix_acl_xattr.h>
 #include <linux/posix_acl.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include "ctree.h"
 #include "btrfs_inode.h"
@@ -112,12 +113,14 @@ static int btrfs_set_acl(struct btrfs_trans_handle *trans,
         switch (type) {
         case ACL_TYPE_ACCESS:
                 mode = inode->i_mode;
-                ret = posix_acl_equiv_mode(acl, &mode);
-                if (ret < 0)
-                        return ret;
-                ret = 0;
-                inode->i_mode = mode;
                 name = POSIX_ACL_XATTR_ACCESS;
+                if (acl) {
+                        ret = posix_acl_equiv_mode(acl, &mode);
+                        if (ret < 0)
+                                return ret;
+                        inode->i_mode = mode;
+                }
+                ret = 0;
                 break;
         case ACL_TYPE_DEFAULT:
                 if (!S_ISDIR(inode->i_mode))
@@ -242,6 +245,7 @@ int btrfs_init_acl(struct btrfs_trans_handle *trans,
                                                     ACL_TYPE_ACCESS);
                         }
                 }
+                posix_acl_release(clone);
         }
 failed:
         posix_acl_release(acl);
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index c0861e781cdb..462859a30141 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/freezer.h>
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 3f1f50d9d916..7a4dee199832 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -153,6 +153,11 @@ struct btrfs_inode {
         unsigned ordered_data_close:1;
         unsigned dummy_inode:1;
 
+        /*
+         * always compress this one file
+         */
+        unsigned force_compress:1;
+
         struct inode vfs_inode;
 };
 
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index a11a32058b50..396039b3a8a2 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -31,7 +31,7 @@
 #include <linux/swap.h>
 #include <linux/writeback.h>
 #include <linux/bit_spinlock.h>
-#include <linux/pagevec.h>
+#include <linux/slab.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -445,7 +445,6 @@ static noinline int add_ra_bio_pages(struct inode *inode,
         unsigned long nr_pages = 0;
         struct extent_map *em;
         struct address_space *mapping = inode->i_mapping;
-        struct pagevec pvec;
         struct extent_map_tree *em_tree;
         struct extent_io_tree *tree;
         u64 end;
@@ -461,7 +460,6 @@ static noinline int add_ra_bio_pages(struct inode *inode,
 
         end_index = (i_size_read(inode) - 1) >> PAGE_CACHE_SHIFT;
 
-        pagevec_init(&pvec, 0);
         while (last_offset < compressed_end) {
                 page_index = last_offset >> PAGE_CACHE_SHIFT;
 
@@ -478,26 +476,17 @@ static noinline int add_ra_bio_pages(struct inode *inode,
                         goto next;
                 }
 
-                page = alloc_page(mapping_gfp_mask(mapping) | GFP_NOFS);
+                page = __page_cache_alloc(mapping_gfp_mask(mapping) &
+                                                                ~__GFP_FS);
                 if (!page)
                         break;
 
-                page->index = page_index;
-                /*
-                 * what we want to do here is call add_to_page_cache_lru,
-                 * but that isn't exported, so we reproduce it here
-                 */
-                if (add_to_page_cache(page, mapping,
-                                      page->index, GFP_NOFS)) {
+                if (add_to_page_cache_lru(page, mapping, page_index,
+                                                                GFP_NOFS)) {
                         page_cache_release(page);
                         goto next;
                 }
 
-                /* open coding of lru_cache_add, also not exported */
-                page_cache_get(page);
-                if (!pagevec_add(&pvec, page))
-                        __pagevec_lru_add_file(&pvec);
-
                 end = last_offset + PAGE_CACHE_SIZE - 1;
                 /*
                  * at this point, we have a locked page in the page cache
@@ -551,8 +540,6 @@ static noinline int add_ra_bio_pages(struct inode *inode,
 next:
                 last_offset += PAGE_CACHE_SIZE;
         }
-        if (pagevec_count(&pvec))
-                __pagevec_lru_add_file(&pvec);
         return 0;
 }
 
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index c4bc570a396e..6795a713b205 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "transaction.h"
@@ -3040,6 +3041,10 @@ static noinline int setup_leaf_for_split(struct btrfs_trans_handle *trans,
         if (ret > 0 || item_size != btrfs_item_size_nr(leaf, path->slots[0]))
                 goto err;
 
+        /* the leaf has  changed, it now has room.  return now */
+        if (btrfs_leaf_free_space(root, path->nodes[0]) >= ins_len)
+                goto err;
+
         if (key.type == BTRFS_EXTENT_DATA_KEY) {
                 fi = btrfs_item_ptr(leaf, path->slots[0],
                                     struct btrfs_file_extent_item);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 9f806dd04c27..746a7248678e 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -26,6 +26,7 @@
 #include <linux/completion.h>
 #include <linux/backing-dev.h>
 #include <linux/wait.h>
+#include <linux/slab.h>
 #include <asm/kmap_types.h>
 #include "extent_io.h"
 #include "extent_map.h"
@@ -373,11 +374,13 @@ struct btrfs_super_block {
  * ones specified below then we will fail to mount
  */
 #define BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF    (1ULL << 0)
+#define BTRFS_FEATURE_INCOMPAT_DEFAULT_SUBVOL   (2ULL << 0)
 
 #define BTRFS_FEATURE_COMPAT_SUPP               0ULL
 #define BTRFS_FEATURE_COMPAT_RO_SUPP            0ULL
 #define BTRFS_FEATURE_INCOMPAT_SUPP             \
-        BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF
+        (BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF | \
+         BTRFS_FEATURE_INCOMPAT_DEFAULT_SUBVOL)
 
 /*
  * A leaf is full of items. offset and size tell us where to find
@@ -832,7 +835,6 @@ struct btrfs_fs_info {
         u64 last_trans_log_full_commit;
         u64 open_ioctl_trans;
         unsigned long mount_opt;
-        u64 max_extent;
         u64 max_inline;
         u64 alloc_start;
         struct btrfs_transaction *running_transaction;
@@ -1161,6 +1163,7 @@ struct btrfs_root {
 #define BTRFS_MOUNT_SSD_SPREAD          (1 << 8)
 #define BTRFS_MOUNT_NOSSD               (1 << 9)
 #define BTRFS_MOUNT_DISCARD             (1 << 10)
+#define BTRFS_MOUNT_FORCE_COMPRESS      (1 << 11)
 
 #define btrfs_clear_opt(o, opt)         ((o) &= ~BTRFS_MOUNT_##opt)
 #define btrfs_set_opt(o, opt)           ((o) |= BTRFS_MOUNT_##opt)
@@ -1181,7 +1184,6 @@ struct btrfs_root {
 #define BTRFS_INODE_NOATIME             (1 << 9)
 #define BTRFS_INODE_DIRSYNC             (1 << 10)
 
-
 /* some macros to generate set/get funcs for the struct fields.  This
  * assumes there is a lefoo_to_cpu for every type, so lets make a simple
  * one for u8:
@@ -1841,7 +1843,7 @@ BTRFS_SETGET_STACK_FUNCS(super_num_devices, struct btrfs_super_block,
 BTRFS_SETGET_STACK_FUNCS(super_compat_flags, struct btrfs_super_block,
                          compat_flags, 64);
 BTRFS_SETGET_STACK_FUNCS(super_compat_ro_flags, struct btrfs_super_block,
-                         compat_flags, 64);
+                         compat_ro_flags, 64);
 BTRFS_SETGET_STACK_FUNCS(super_incompat_flags, struct btrfs_super_block,
                          incompat_flags, 64);
 BTRFS_SETGET_STACK_FUNCS(super_csum_type, struct btrfs_super_block,
@@ -2309,7 +2311,8 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
                                u32 min_type);
 
 int btrfs_start_delalloc_inodes(struct btrfs_root *root, int delay_iput);
-int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end);
+int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
+                              struct extent_state **cached_state);
 int btrfs_writepages(struct address_space *mapping,
                      struct writeback_control *wbc);
 int btrfs_create_subvol_root(struct btrfs_trans_handle *trans,
@@ -2325,7 +2328,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
 int btrfs_readpage(struct file *file, struct page *page);
 void btrfs_delete_inode(struct inode *inode);
 void btrfs_put_inode(struct inode *inode);
-int btrfs_write_inode(struct inode *inode, int wait);
+int btrfs_write_inode(struct inode *inode, struct writeback_control *wbc);
 void btrfs_dirty_inode(struct inode *inode);
 struct inode *btrfs_alloc_inode(struct super_block *sb);
 void btrfs_destroy_inode(struct inode *inode);
@@ -2334,7 +2337,7 @@ int btrfs_init_cachep(void);
 void btrfs_destroy_cachep(void);
 long btrfs_ioctl_trans_end(struct file *file);
 struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
-                         struct btrfs_root *root);
+                         struct btrfs_root *root, int *was_new);
 int btrfs_commit_write(struct file *file, struct page *page,
                        unsigned from, unsigned to);
 struct extent_map *btrfs_get_extent(struct inode *inode, struct page *page,
@@ -2385,7 +2388,6 @@ void btrfs_sysfs_del_super(struct btrfs_fs_info *root);
 ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size);
 
 /* super.c */
-u64 btrfs_parse_size(char *str);
 int btrfs_parse_options(struct btrfs_root *root, char *options);
 int btrfs_sync_fs(struct super_block *sb, int wait);
 
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index 84e6781413b1..902ce507c4e3 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/sort.h>
 #include "ctree.h"
 #include "delayed-ref.h"
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 009e3bd18f23..feca04197d02 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -27,6 +27,7 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 #include <linux/crc32c.h>
+#include <linux/slab.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -43,8 +44,6 @@ static struct extent_io_ops btree_extent_io_ops;
 static void end_workqueue_fn(struct btrfs_work *work);
 static void free_fs_root(struct btrfs_root *root);
 
-static atomic_t btrfs_bdi_num = ATOMIC_INIT(0);
-
 /*
  * end_io_wq structs are used to do processing in task context when an IO is
  * complete.  This is used during reads to verify checksums, and it is used
@@ -263,13 +262,15 @@ static int csum_tree_block(struct btrfs_root *root, struct extent_buffer *buf,
 static int verify_parent_transid(struct extent_io_tree *io_tree,
                                  struct extent_buffer *eb, u64 parent_transid)
 {
+        struct extent_state *cached_state = NULL;
         int ret;
 
         if (!parent_transid || btrfs_header_generation(eb) == parent_transid)
                 return 0;
 
-        lock_extent(io_tree, eb->start, eb->start + eb->len - 1, GFP_NOFS);
-        if (extent_buffer_uptodate(io_tree, eb) &&
+        lock_extent_bits(io_tree, eb->start, eb->start + eb->len - 1,
+                         0, &cached_state, GFP_NOFS);
+        if (extent_buffer_uptodate(io_tree, eb, cached_state) &&
             btrfs_header_generation(eb) == parent_transid) {
                 ret = 0;
                 goto out;
@@ -282,10 +283,10 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
                        (unsigned long long)btrfs_header_generation(eb));
         }
         ret = 1;
-        clear_extent_buffer_uptodate(io_tree, eb);
+        clear_extent_buffer_uptodate(io_tree, eb, &cached_state);
 out:
-        unlock_extent(io_tree, eb->start, eb->start + eb->len - 1,
-                      GFP_NOFS);
+        unlock_extent_cached(io_tree, eb->start, eb->start + eb->len - 1,
+                             &cached_state, GFP_NOFS);
         return ret;
 }
 
@@ -901,7 +902,7 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         root->highest_objectid = 0;
         root->name = NULL;
         root->in_sysfs = 0;
-        root->inode_tree.rb_node = NULL;
+        root->inode_tree = RB_ROOT;
 
         INIT_LIST_HEAD(&root->dirty_list);
         INIT_LIST_HEAD(&root->orphan_list);
@@ -1372,19 +1373,11 @@ static int setup_bdi(struct btrfs_fs_info *info, struct backing_dev_info *bdi)
 {
         int err;
 
-        bdi->name = "btrfs";
         bdi->capabilities = BDI_CAP_MAP_COPY;
-        err = bdi_init(bdi);
+        err = bdi_setup_and_register(bdi, "btrfs", BDI_CAP_MAP_COPY);
         if (err)
                 return err;
 
-        err = bdi_register(bdi, NULL, "btrfs-%d",
-                                atomic_inc_return(&btrfs_bdi_num));
-        if (err) {
-                bdi_destroy(bdi);
-                return err;
-        }
-
         bdi->ra_pages   = default_backing_dev_info.ra_pages;
         bdi->unplug_io_fn       = btrfs_unplug_io_fn;
         bdi->unplug_io_data     = info;
@@ -1632,7 +1625,6 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         atomic_set(&fs_info->async_submit_draining, 0);
         atomic_set(&fs_info->nr_async_bios, 0);
         fs_info->sb = sb;
-        fs_info->max_extent = (u64)-1;
         fs_info->max_inline = 8192 * 1024;
         fs_info->metadata_ratio = 0;
 
@@ -1673,7 +1665,7 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         insert_inode_hash(fs_info->btree_inode);
 
         spin_lock_init(&fs_info->block_group_cache_lock);
-        fs_info->block_group_cache_tree.rb_node = NULL;
+        fs_info->block_group_cache_tree = RB_ROOT;
 
         extent_io_tree_init(&fs_info->freed_extents[0],
                              fs_info->btree_inode->i_mapping, GFP_NOFS);
@@ -1920,7 +1912,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
 
         csum_root->track_dirty = 1;
 
-        btrfs_read_block_groups(extent_root);
+        ret = btrfs_read_block_groups(extent_root);
+        if (ret) {
+                printk(KERN_ERR "Failed to read block groups: %d\n", ret);
+                goto fail_block_groups;
+        }
 
         fs_info->generation = generation;
         fs_info->last_trans_committed = generation;
@@ -1930,7 +1926,7 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         fs_info->cleaner_kthread = kthread_run(cleaner_kthread, tree_root,
                                                "btrfs-cleaner");
         if (IS_ERR(fs_info->cleaner_kthread))
-                goto fail_csum_root;
+                goto fail_block_groups;
 
         fs_info->transaction_kthread = kthread_run(transaction_kthread,
                                                    tree_root,
@@ -1982,7 +1978,12 @@ struct btrfs_root *open_ctree(struct super_block *sb,
 
         if (!(sb->s_flags & MS_RDONLY)) {
                 ret = btrfs_recover_relocation(tree_root);
-                BUG_ON(ret);
+                if (ret < 0) {
+                        printk(KERN_WARNING
+                               "btrfs: failed to recover relocation\n");
+                        err = -EINVAL;
+                        goto fail_trans_kthread;
+                }
         }
 
         location.objectid = BTRFS_FS_TREE_OBJECTID;
@@ -1993,6 +1994,12 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         if (!fs_info->fs_root)
                 goto fail_trans_kthread;
 
+        if (!(sb->s_flags & MS_RDONLY)) {
+                down_read(&fs_info->cleanup_work_sem);
+                btrfs_orphan_cleanup(fs_info->fs_root);
+                up_read(&fs_info->cleanup_work_sem);
+        }
+
         return tree_root;
 
 fail_trans_kthread:
@@ -2007,7 +2014,8 @@ fail_cleaner:
         filemap_write_and_wait(fs_info->btree_inode->i_mapping);
         invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
 
-fail_csum_root:
+fail_block_groups:
+        btrfs_free_block_groups(fs_info);
         free_extent_buffer(csum_root->node);
         free_extent_buffer(csum_root->commit_root);
 fail_dev_root:
@@ -2486,7 +2494,8 @@ int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid)
         int ret;
         struct inode *btree_inode = buf->first_page->mapping->host;
 
-        ret = extent_buffer_uptodate(&BTRFS_I(btree_inode)->io_tree, buf);
+        ret = extent_buffer_uptodate(&BTRFS_I(btree_inode)->io_tree, buf,
+                                     NULL);
         if (!ret)
                 return ret;
 
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index ba5c3fd5ab8c..951ef09b82f4 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -95,7 +95,7 @@ static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid,
         btrfs_set_key_type(&key, BTRFS_INODE_ITEM_KEY);
         key.offset = 0;
 
-        inode = btrfs_iget(sb, &key, root);
+        inode = btrfs_iget(sb, &key, root, NULL);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 goto fail;
@@ -223,7 +223,7 @@ static struct dentry *btrfs_get_parent(struct dentry *child)
 
         key.type = BTRFS_INODE_ITEM_KEY;
         key.offset = 0;
-        dentry = d_obtain_alias(btrfs_iget(root->fs_info->sb, &key, root));
+        dentry = d_obtain_alias(btrfs_iget(root->fs_info->sb, &key, root, NULL));
         if (!IS_ERR(dentry))
                 dentry->d_op = &btrfs_dentry_operations;
         return dentry;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 56e50137d0e6..b34d32fdaaec 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -22,6 +22,7 @@
 #include <linux/sort.h>
 #include <linux/rcupdate.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include "compat.h"
 #include "hash.h"
 #include "ctree.h"
@@ -83,6 +84,17 @@ static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
         return (cache->flags & bits) == bits;
 }
 
+void btrfs_get_block_group(struct btrfs_block_group_cache *cache)
+{
+        atomic_inc(&cache->count);
+}
+
+void btrfs_put_block_group(struct btrfs_block_group_cache *cache)
+{
+        if (atomic_dec_and_test(&cache->count))
+                kfree(cache);
+}
+
 /*
  * this adds the block group to the fs_info rb tree for the block group
  * cache
@@ -156,7 +168,7 @@ block_group_cache_tree_search(struct btrfs_fs_info *info, u64 bytenr,
                 }
         }
         if (ret)
-                atomic_inc(&ret->count);
+                btrfs_get_block_group(ret);
         spin_unlock(&info->block_group_cache_lock);
 
         return ret;
@@ -407,6 +419,8 @@ err:
 
         put_caching_control(caching_ctl);
         atomic_dec(&block_group->space_info->caching_threads);
+        btrfs_put_block_group(block_group);
+
         return 0;
 }
 
@@ -447,6 +461,7 @@ static int cache_block_group(struct btrfs_block_group_cache *cache)
         up_write(&fs_info->extent_commit_sem);
 
         atomic_inc(&cache->space_info->caching_threads);
+        btrfs_get_block_group(cache);
 
         tsk = kthread_run(caching_kthread, cache, "btrfs-cache-%llu\n",
                           cache->key.objectid);
@@ -486,12 +501,6 @@ struct btrfs_block_group_cache *btrfs_lookup_block_group(
         return cache;
 }
 
-void btrfs_put_block_group(struct btrfs_block_group_cache *cache)
-{
-        if (atomic_dec_and_test(&cache->count))
-                kfree(cache);
-}
-
 static struct btrfs_space_info *__find_space_info(struct btrfs_fs_info *info,
                                                   u64 flags)
 {
@@ -2582,7 +2591,7 @@ next_block_group(struct btrfs_root *root,
         if (node) {
                 cache = rb_entry(node, struct btrfs_block_group_cache,
                                  cache_node);
-                atomic_inc(&cache->count);
+                btrfs_get_block_group(cache);
         } else
                 cache = NULL;
         spin_unlock(&root->fs_info->block_group_cache_lock);
@@ -2668,6 +2677,8 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
 
         INIT_LIST_HEAD(&found->block_groups);
         init_rwsem(&found->groups_sem);
+        init_waitqueue_head(&found->flush_wait);
+        init_waitqueue_head(&found->allocate_wait);
         spin_lock_init(&found->lock);
         found->flags = flags;
         found->total_bytes = total_bytes;
@@ -2838,7 +2849,7 @@ int btrfs_unreserve_metadata_for_delalloc(struct btrfs_root *root,
         }
         spin_unlock(&BTRFS_I(inode)->accounting_lock);
 
-        BTRFS_I(inode)->reserved_extents--;
+        BTRFS_I(inode)->reserved_extents -= num_items;
         BUG_ON(BTRFS_I(inode)->reserved_extents < 0);
 
         if (meta_sinfo->bytes_delalloc < num_bytes) {
@@ -2936,12 +2947,10 @@ static void flush_delalloc(struct btrfs_root *root,
 
         spin_lock(&info->lock);
 
-        if (!info->flushing) {
+        if (!info->flushing)
                 info->flushing = 1;
-                init_waitqueue_head(&info->flush_wait);
-        } else {
+        else
                 wait = true;
-        }
 
         spin_unlock(&info->lock);
 
@@ -3003,7 +3012,6 @@ static int maybe_allocate_chunk(struct btrfs_root *root,
         if (!info->allocating_chunk) {
                 info->force_alloc = 1;
                 info->allocating_chunk = 1;
-                init_waitqueue_head(&info->allocate_wait);
         } else {
                 wait = true;
         }
@@ -3103,7 +3111,7 @@ again:
                 return -ENOSPC;
         }
 
-        BTRFS_I(inode)->reserved_extents++;
+        BTRFS_I(inode)->reserved_extents += num_items;
         check_force_delalloc(meta_sinfo);
         spin_unlock(&meta_sinfo->lock);
 
@@ -3227,7 +3235,8 @@ int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
                                 u64 bytes)
 {
         struct btrfs_space_info *data_sinfo;
-        int ret = 0, committed = 0;
+        u64 used;
+        int ret = 0, committed = 0, flushed = 0;
 
         /* make sure bytes are sectorsize aligned */
         bytes = (bytes + root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
@@ -3239,12 +3248,21 @@ int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
 again:
         /* make sure we have enough space to handle the data first */
         spin_lock(&data_sinfo->lock);
-        if (data_sinfo->total_bytes - data_sinfo->bytes_used -
-            data_sinfo->bytes_delalloc - data_sinfo->bytes_reserved -
-            data_sinfo->bytes_pinned - data_sinfo->bytes_readonly -
-            data_sinfo->bytes_may_use - data_sinfo->bytes_super < bytes) {
+        used = data_sinfo->bytes_used + data_sinfo->bytes_delalloc +
+                data_sinfo->bytes_reserved + data_sinfo->bytes_pinned +
+                data_sinfo->bytes_readonly + data_sinfo->bytes_may_use +
+                data_sinfo->bytes_super;
+
+        if (used + bytes > data_sinfo->total_bytes) {
                 struct btrfs_trans_handle *trans;
 
+                if (!flushed) {
+                        spin_unlock(&data_sinfo->lock);
+                        flush_delalloc(root, data_sinfo);
+                        flushed = 1;
+                        goto again;
+                }
+
                 /*
                  * if we don't have enough free bytes in this space then we need
                  * to alloc a new chunk.
@@ -4162,6 +4180,10 @@ static noinline int find_free_extent(struct btrfs_trans_handle *trans,
         ins->offset = 0;
 
         space_info = __find_space_info(root->fs_info, data);
+        if (!space_info) {
+                printk(KERN_ERR "No space info for %d\n", data);
+                return -ENOSPC;
+        }
 
         if (orig_root->ref_cows || empty_size)
                 allowed_chunk_alloc = 1;
@@ -4227,7 +4249,7 @@ search:
                 u64 offset;
                 int cached;
 
-                atomic_inc(&block_group->count);
+                btrfs_get_block_group(block_group);
                 search_start = block_group->key.objectid;
 
 have_block_group:
@@ -4315,7 +4337,7 @@ have_block_group:
 
                                 btrfs_put_block_group(block_group);
                                 block_group = last_ptr->block_group;
-                                atomic_inc(&block_group->count);
+                                btrfs_get_block_group(block_group);
                                 spin_unlock(&last_ptr->lock);
                                 spin_unlock(&last_ptr->refill_lock);
 
@@ -5197,6 +5219,8 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
         next = btrfs_find_tree_block(root, bytenr, blocksize);
         if (!next) {
                 next = btrfs_find_create_tree_block(root, bytenr, blocksize);
+                if (!next)
+                        return -ENOMEM;
                 reada = 1;
         }
         btrfs_tree_lock(next);
@@ -5394,10 +5418,6 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
         int ret;
 
         while (level >= 0) {
-                if (path->slots[level] >=
-                    btrfs_header_nritems(path->nodes[level]))
-                        break;
-
                 ret = walk_down_proc(trans, root, path, wc, lookup_info);
                 if (ret > 0)
                         break;
@@ -5405,11 +5425,16 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                 if (level == 0)
                         break;
 
+                if (path->slots[level] >=
+                    btrfs_header_nritems(path->nodes[level]))
+                        break;
+
                 ret = do_walk_down(trans, root, path, wc, &lookup_info);
                 if (ret > 0) {
                         path->slots[level]++;
                         continue;
-                }
+                } else if (ret < 0)
+                        return ret;
                 level = wc->level;
         }
         return 0;
@@ -6553,6 +6578,7 @@ static noinline int invalidate_extent_cache(struct btrfs_root *root,
         struct btrfs_key key;
         struct inode *inode = NULL;
         struct btrfs_file_extent_item *fi;
+        struct extent_state *cached_state = NULL;
         u64 num_bytes;
         u64 skip_objectid = 0;
         u32 nritems;
@@ -6581,12 +6607,14 @@ static noinline int invalidate_extent_cache(struct btrfs_root *root,
                 }
                 num_bytes = btrfs_file_extent_num_bytes(leaf, fi);
 
-                lock_extent(&BTRFS_I(inode)->io_tree, key.offset,
-                            key.offset + num_bytes - 1, GFP_NOFS);
+                lock_extent_bits(&BTRFS_I(inode)->io_tree, key.offset,
+                                 key.offset + num_bytes - 1, 0, &cached_state,
+                                 GFP_NOFS);
                 btrfs_drop_extent_cache(inode, key.offset,
                                         key.offset + num_bytes - 1, 1);
-                unlock_extent(&BTRFS_I(inode)->io_tree, key.offset,
-                              key.offset + num_bytes - 1, GFP_NOFS);
+                unlock_extent_cached(&BTRFS_I(inode)->io_tree, key.offset,
+                                     key.offset + num_bytes - 1, &cached_state,
+                                     GFP_NOFS);
                 cond_resched();
         }
         iput(inode);
@@ -7358,7 +7386,6 @@ static int find_first_block_group(struct btrfs_root *root,
                 }
                 path->slots[0]++;
         }
-        ret = -ENOENT;
 out:
         return ret;
 }
@@ -7395,9 +7422,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                         wait_block_group_cache_done(block_group);
 
                 btrfs_remove_free_space_cache(block_group);
-
-                WARN_ON(atomic_read(&block_group->count) != 1);
-                kfree(block_group);
+                btrfs_put_block_group(block_group);
 
                 spin_lock(&info->block_group_cache_lock);
         }
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 96577e8bf9fd..d2d03684fab2 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2,7 +2,6 @@
 #include <linux/slab.h>
 #include <linux/bio.h>
 #include <linux/mm.h>
-#include <linux/gfp.h>
 #include <linux/pagemap.h>
 #include <linux/page-flags.h>
 #include <linux/module.h>
@@ -104,8 +103,8 @@ void extent_io_exit(void)
 void extent_io_tree_init(struct extent_io_tree *tree,
                           struct address_space *mapping, gfp_t mask)
 {
-        tree->state.rb_node = NULL;
-        tree->buffer.rb_node = NULL;
+        tree->state = RB_ROOT;
+        tree->buffer = RB_ROOT;
         tree->ops = NULL;
         tree->dirty_bytes = 0;
         spin_lock_init(&tree->lock);
@@ -513,7 +512,10 @@ int clear_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
         u64 last_end;
         int err;
         int set = 0;
+        int clear = 0;
 
+        if (bits & (EXTENT_IOBITS | EXTENT_BOUNDARY))
+                clear = 1;
 again:
         if (!prealloc && (mask & __GFP_WAIT)) {
                 prealloc = alloc_extent_state(mask);
@@ -524,14 +526,20 @@ again:
         spin_lock(&tree->lock);
         if (cached_state) {
                 cached = *cached_state;
-                *cached_state = NULL;
-                cached_state = NULL;
+
+                if (clear) {
+                        *cached_state = NULL;
+                        cached_state = NULL;
+                }
+
                 if (cached && cached->tree && cached->start == start) {
-                        atomic_dec(&cached->refs);
+                        if (clear)
+                                atomic_dec(&cached->refs);
                         state = cached;
                         goto hit_next;
                 }
-                free_extent_state(cached);
+                if (clear)
+                        free_extent_state(cached);
         }
         /*
          * this search will find the extents that end after
@@ -946,11 +954,11 @@ int clear_extent_bits(struct extent_io_tree *tree, u64 start, u64 end,
 }
 
 int set_extent_delalloc(struct extent_io_tree *tree, u64 start, u64 end,
-                     gfp_t mask)
+                        struct extent_state **cached_state, gfp_t mask)
 {
         return set_extent_bit(tree, start, end,
                               EXTENT_DELALLOC | EXTENT_DIRTY | EXTENT_UPTODATE,
-                              0, NULL, NULL, mask);
+                              0, NULL, cached_state, mask);
 }
 
 int clear_extent_dirty(struct extent_io_tree *tree, u64 start, u64 end,
@@ -984,10 +992,11 @@ int set_extent_uptodate(struct extent_io_tree *tree, u64 start, u64 end,
 }
 
 static int clear_extent_uptodate(struct extent_io_tree *tree, u64 start,
-                                 u64 end, gfp_t mask)
+                                 u64 end, struct extent_state **cached_state,
+                                 gfp_t mask)
 {
         return clear_extent_bit(tree, start, end, EXTENT_UPTODATE, 0, 0,
-                                NULL, mask);
+                                cached_state, mask);
 }
 
 int wait_on_extent_writeback(struct extent_io_tree *tree, u64 start, u64 end)
@@ -1171,7 +1180,8 @@ out:
  * 1 is returned if we find something, 0 if nothing was in the tree
  */
 static noinline u64 find_delalloc_range(struct extent_io_tree *tree,
-                                        u64 *start, u64 *end, u64 max_bytes)
+                                        u64 *start, u64 *end, u64 max_bytes,
+                                        struct extent_state **cached_state)
 {
         struct rb_node *node;
         struct extent_state *state;
@@ -1203,8 +1213,11 @@ static noinline u64 find_delalloc_range(struct extent_io_tree *tree,
                                 *end = state->end;
                         goto out;
                 }
-                if (!found)
+                if (!found) {
                         *start = state->start;
+                        *cached_state = state;
+                        atomic_inc(&state->refs);
+                }
                 found++;
                 *end = state->end;
                 cur_start = state->end + 1;
@@ -1336,10 +1349,11 @@ again:
         delalloc_start = *start;
         delalloc_end = 0;
         found = find_delalloc_range(tree, &delalloc_start, &delalloc_end,
-                                    max_bytes);
+                                    max_bytes, &cached_state);
         if (!found || delalloc_end <= *start) {
                 *start = delalloc_start;
                 *end = delalloc_end;
+                free_extent_state(cached_state);
                 return found;
         }
 
@@ -1722,7 +1736,7 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
                 }
 
                 if (!uptodate) {
-                        clear_extent_uptodate(tree, start, end, GFP_NOFS);
+                        clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
                         ClearPageUptodate(page);
                         SetPageError(page);
                 }
@@ -1750,7 +1764,8 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
 static void end_bio_extent_readpage(struct bio *bio, int err)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
+        struct bio_vec *bvec_end = bio->bi_io_vec + bio->bi_vcnt - 1;
+        struct bio_vec *bvec = bio->bi_io_vec;
         struct extent_io_tree *tree;
         u64 start;
         u64 end;
@@ -1773,7 +1788,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 else
                         whole_page = 0;
 
-                if (--bvec >= bio->bi_io_vec)
+                if (++bvec <= bvec_end)
                         prefetchw(&bvec->bv_page->flags);
 
                 if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
@@ -1818,7 +1833,7 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                         }
                         check_page_locked(tree, page);
                 }
-        } while (bvec >= bio->bi_io_vec);
+        } while (bvec <= bvec_end);
 
         bio_put(bio);
 }
@@ -2663,33 +2678,20 @@ int extent_readpages(struct extent_io_tree *tree,
 {
         struct bio *bio = NULL;
         unsigned page_idx;
-        struct pagevec pvec;
         unsigned long bio_flags = 0;
 
-        pagevec_init(&pvec, 0);
         for (page_idx = 0; page_idx < nr_pages; page_idx++) {
                 struct page *page = list_entry(pages->prev, struct page, lru);
 
                 prefetchw(&page->flags);
                 list_del(&page->lru);
-                /*
-                 * what we want to do here is call add_to_page_cache_lru,
-                 * but that isn't exported, so we reproduce it here
-                 */
-                if (!add_to_page_cache(page, mapping,
+                if (!add_to_page_cache_lru(page, mapping,
                                         page->index, GFP_KERNEL)) {
-
-                        /* open coding of lru_cache_add, also not exported */
-                        page_cache_get(page);
-                        if (!pagevec_add(&pvec, page))
-                                __pagevec_lru_add_file(&pvec);
                         __extent_read_full_page(tree, page, get_extent,
                                                 &bio, 0, &bio_flags);
                 }
                 page_cache_release(page);
         }
-        if (pagevec_count(&pvec))
-                __pagevec_lru_add_file(&pvec);
         BUG_ON(!list_empty(pages));
         if (bio)
                 submit_one_bio(READ, bio, 0, bio_flags);
@@ -2704,6 +2706,7 @@ int extent_readpages(struct extent_io_tree *tree,
 int extent_invalidatepage(struct extent_io_tree *tree,
                           struct page *page, unsigned long offset)
 {
+        struct extent_state *cached_state = NULL;
         u64 start = ((u64)page->index << PAGE_CACHE_SHIFT);
         u64 end = start + PAGE_CACHE_SIZE - 1;
         size_t blocksize = page->mapping->host->i_sb->s_blocksize;
@@ -2712,12 +2715,12 @@ int extent_invalidatepage(struct extent_io_tree *tree,
         if (start > end)
                 return 0;
 
-        lock_extent(tree, start, end, GFP_NOFS);
+        lock_extent_bits(tree, start, end, 0, &cached_state, GFP_NOFS);
         wait_on_page_writeback(page);
         clear_extent_bit(tree, start, end,
                          EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC |
                          EXTENT_DO_ACCOUNTING,
-                         1, 1, NULL, GFP_NOFS);
+                         1, 1, &cached_state, GFP_NOFS);
         return 0;
 }
 
@@ -2920,16 +2923,17 @@ sector_t extent_bmap(struct address_space *mapping, sector_t iblock,
                 get_extent_t *get_extent)
 {
         struct inode *inode = mapping->host;
+        struct extent_state *cached_state = NULL;
         u64 start = iblock << inode->i_blkbits;
         sector_t sector = 0;
         size_t blksize = (1 << inode->i_blkbits);
         struct extent_map *em;
 
-        lock_extent(&BTRFS_I(inode)->io_tree, start, start + blksize - 1,
-                    GFP_NOFS);
+        lock_extent_bits(&BTRFS_I(inode)->io_tree, start, start + blksize - 1,
+                         0, &cached_state, GFP_NOFS);
         em = get_extent(inode, NULL, 0, start, blksize, 0);
-        unlock_extent(&BTRFS_I(inode)->io_tree, start, start + blksize - 1,
-                      GFP_NOFS);
+        unlock_extent_cached(&BTRFS_I(inode)->io_tree, start,
+                             start + blksize - 1, &cached_state, GFP_NOFS);
         if (!em || IS_ERR(em))
                 return 0;
 
@@ -2951,6 +2955,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         u32 flags = 0;
         u64 disko = 0;
         struct extent_map *em = NULL;
+        struct extent_state *cached_state = NULL;
         int end = 0;
         u64 em_start = 0, em_len = 0;
         unsigned long emflags;
@@ -2959,8 +2964,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         if (len == 0)
                 return -EINVAL;
 
-        lock_extent(&BTRFS_I(inode)->io_tree, start, start + len,
-                GFP_NOFS);
+        lock_extent_bits(&BTRFS_I(inode)->io_tree, start, start + len, 0,
+                         &cached_state, GFP_NOFS);
         em = get_extent(inode, NULL, 0, off, max - off, 0);
         if (!em)
                 goto out;
@@ -3023,8 +3028,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 out_free:
         free_extent_map(em);
 out:
-        unlock_extent(&BTRFS_I(inode)->io_tree, start, start + len,
-                        GFP_NOFS);
+        unlock_extent_cached(&BTRFS_I(inode)->io_tree, start, start + len,
+                             &cached_state, GFP_NOFS);
         return ret;
 }
 
@@ -3165,10 +3170,9 @@ struct extent_buffer *alloc_extent_buffer(struct extent_io_tree *tree,
                 spin_unlock(&tree->buffer_lock);
                 goto free_eb;
         }
-        spin_unlock(&tree->buffer_lock);
-
         /* add one reference for the tree */
         atomic_inc(&eb->refs);
+        spin_unlock(&tree->buffer_lock);
         return eb;
 
 free_eb:
@@ -3265,7 +3269,8 @@ int set_extent_buffer_dirty(struct extent_io_tree *tree,
 }
 
 int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
-                                struct extent_buffer *eb)
+                                struct extent_buffer *eb,
+                                struct extent_state **cached_state)
 {
         unsigned long i;
         struct page *page;
@@ -3275,7 +3280,7 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
         clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
         clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-                              GFP_NOFS);
+                              cached_state, GFP_NOFS);
         for (i = 0; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
                 if (page)
@@ -3335,7 +3340,8 @@ int extent_range_uptodate(struct extent_io_tree *tree,
 }
 
 int extent_buffer_uptodate(struct extent_io_tree *tree,
-                           struct extent_buffer *eb)
+                           struct extent_buffer *eb,
+                           struct extent_state *cached_state)
 {
         int ret = 0;
         unsigned long num_pages;
@@ -3347,7 +3353,7 @@ int extent_buffer_uptodate(struct extent_io_tree *tree,
                 return 1;
 
         ret = test_range_bit(tree, eb->start, eb->start + eb->len - 1,
-                           EXTENT_UPTODATE, 1, NULL);
+                           EXTENT_UPTODATE, 1, cached_state);
         if (ret)
                 return ret;
 
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 36de250a7b2b..bbab4813646f 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -163,6 +163,8 @@ int lock_extent(struct extent_io_tree *tree, u64 start, u64 end, gfp_t mask);
 int lock_extent_bits(struct extent_io_tree *tree, u64 start, u64 end,
                      int bits, struct extent_state **cached, gfp_t mask);
 int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end, gfp_t mask);
+int unlock_extent_cached(struct extent_io_tree *tree, u64 start, u64 end,
+                         struct extent_state **cached, gfp_t mask);
 int try_lock_extent(struct extent_io_tree *tree, u64 start, u64 end,
                     gfp_t mask);
 int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
@@ -196,7 +198,7 @@ int clear_extent_ordered(struct extent_io_tree *tree, u64 start, u64 end,
 int clear_extent_ordered_metadata(struct extent_io_tree *tree, u64 start,
                                   u64 end, gfp_t mask);
 int set_extent_delalloc(struct extent_io_tree *tree, u64 start, u64 end,
-                     gfp_t mask);
+                        struct extent_state **cached_state, gfp_t mask);
 int set_extent_ordered(struct extent_io_tree *tree, u64 start, u64 end,
                      gfp_t mask);
 int find_first_extent_bit(struct extent_io_tree *tree, u64 start,
@@ -281,9 +283,11 @@ int test_extent_buffer_dirty(struct extent_io_tree *tree,
 int set_extent_buffer_uptodate(struct extent_io_tree *tree,
                                struct extent_buffer *eb);
 int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
-                                struct extent_buffer *eb);
+                                struct extent_buffer *eb,
+                                struct extent_state **cached_state);
 int extent_buffer_uptodate(struct extent_io_tree *tree,
-                           struct extent_buffer *eb);
+                           struct extent_buffer *eb,
+                           struct extent_state *cached_state);
 int map_extent_buffer(struct extent_buffer *eb, unsigned long offset,
                       unsigned long min_len, char **token, char **map,
                       unsigned long *map_start,
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 46bea0f4dc7b..454ca52d6451 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -1,5 +1,4 @@
 #include <linux/err.h>
-#include <linux/gfp.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
@@ -35,7 +34,7 @@ void extent_map_exit(void)
  */
 void extent_map_tree_init(struct extent_map_tree *tree, gfp_t mask)
 {
-        tree->map.rb_node = NULL;
+        tree->map = RB_ROOT;
         rwlock_init(&tree->lock);
 }
 
@@ -155,20 +154,6 @@ static struct rb_node *__tree_search(struct rb_root *root, u64 offset,
         return NULL;
 }
 
-/*
- * look for an offset in the tree, and if it can't be found, return
- * the first offset we can find smaller than 'offset'.
- */
-static inline struct rb_node *tree_search(struct rb_root *root, u64 offset)
-{
-        struct rb_node *prev;
-        struct rb_node *ret;
-        ret = __tree_search(root, offset, &prev, NULL);
-        if (!ret)
-                return prev;
-        return ret;
-}
-
 /* check to see if two extent_map structs are adjacent and safe to merge */
 static int mergable_maps(struct extent_map *prev, struct extent_map *next)
 {
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index 9b99886562d0..54a255065aa3 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/bio.h>
+#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
 #include "ctree.h"
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index feaa13b105d9..29ff749ff4ca 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -28,6 +28,7 @@
 #include <linux/writeback.h>
 #include <linux/statfs.h>
 #include <linux/compat.h>
+#include <linux/slab.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "transaction.h"
@@ -123,7 +124,8 @@ static noinline int dirty_and_release_pages(struct btrfs_trans_handle *trans,
                     root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
 
         end_of_last_block = start_pos + num_bytes - 1;
-        err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block);
+        err = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block,
+                                        NULL);
         if (err)
                 return err;
 
@@ -506,7 +508,8 @@ next_slot:
 }
 
 static int extent_mergeable(struct extent_buffer *leaf, int slot,
-                            u64 objectid, u64 bytenr, u64 *start, u64 *end)
+                            u64 objectid, u64 bytenr, u64 orig_offset,
+                            u64 *start, u64 *end)
 {
         struct btrfs_file_extent_item *fi;
         struct btrfs_key key;
@@ -522,6 +525,7 @@ static int extent_mergeable(struct extent_buffer *leaf, int slot,
         fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
         if (btrfs_file_extent_type(leaf, fi) != BTRFS_FILE_EXTENT_REG ||
             btrfs_file_extent_disk_bytenr(leaf, fi) != bytenr ||
+            btrfs_file_extent_offset(leaf, fi) != key.offset - orig_offset ||
             btrfs_file_extent_compression(leaf, fi) ||
             btrfs_file_extent_encryption(leaf, fi) ||
             btrfs_file_extent_other_encoding(leaf, fi))
@@ -561,6 +565,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
         u64 split;
         int del_nr = 0;
         int del_slot = 0;
+        int recow;
         int ret;
 
         btrfs_drop_extent_cache(inode, start, end - 1, 0);
@@ -568,6 +573,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         BUG_ON(!path);
 again:
+        recow = 0;
         split = start;
         key.objectid = inode->i_ino;
         key.type = BTRFS_EXTENT_DATA_KEY;
@@ -591,12 +597,60 @@ again:
         bytenr = btrfs_file_extent_disk_bytenr(leaf, fi);
         num_bytes = btrfs_file_extent_disk_num_bytes(leaf, fi);
         orig_offset = key.offset - btrfs_file_extent_offset(leaf, fi);
+        memcpy(&new_key, &key, sizeof(new_key));
+
+        if (start == key.offset && end < extent_end) {
+                other_start = 0;
+                other_end = start;
+                if (extent_mergeable(leaf, path->slots[0] - 1,
+                                     inode->i_ino, bytenr, orig_offset,
+                                     &other_start, &other_end)) {
+                        new_key.offset = end;
+                        btrfs_set_item_key_safe(trans, root, path, &new_key);
+                        fi = btrfs_item_ptr(leaf, path->slots[0],
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        extent_end - end);
+                        btrfs_set_file_extent_offset(leaf, fi,
+                                                     end - orig_offset);
+                        fi = btrfs_item_ptr(leaf, path->slots[0] - 1,
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        end - other_start);
+                        btrfs_mark_buffer_dirty(leaf);
+                        goto out;
+                }
+        }
+
+        if (start > key.offset && end == extent_end) {
+                other_start = end;
+                other_end = 0;
+                if (extent_mergeable(leaf, path->slots[0] + 1,
+                                     inode->i_ino, bytenr, orig_offset,
+                                     &other_start, &other_end)) {
+                        fi = btrfs_item_ptr(leaf, path->slots[0],
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        start - key.offset);
+                        path->slots[0]++;
+                        new_key.offset = start;
+                        btrfs_set_item_key_safe(trans, root, path, &new_key);
+
+                        fi = btrfs_item_ptr(leaf, path->slots[0],
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        other_end - start);
+                        btrfs_set_file_extent_offset(leaf, fi,
+                                                     start - orig_offset);
+                        btrfs_mark_buffer_dirty(leaf);
+                        goto out;
+                }
+        }
 
         while (start > key.offset || end < extent_end) {
                 if (key.offset == start)
                         split = end;
 
-                memcpy(&new_key, &key, sizeof(new_key));
                 new_key.offset = split;
                 ret = btrfs_duplicate_item(trans, root, path, &new_key);
                 if (ret == -EAGAIN) {
@@ -631,15 +685,18 @@ again:
                         path->slots[0]--;
                         extent_end = end;
                 }
+                recow = 1;
         }
 
-        fi = btrfs_item_ptr(leaf, path->slots[0],
-                            struct btrfs_file_extent_item);
-
         other_start = end;
         other_end = 0;
-        if (extent_mergeable(leaf, path->slots[0] + 1, inode->i_ino,
-                             bytenr, &other_start, &other_end)) {
+        if (extent_mergeable(leaf, path->slots[0] + 1,
+                             inode->i_ino, bytenr, orig_offset,
+                             &other_start, &other_end)) {
+                if (recow) {
+                        btrfs_release_path(root, path);
+                        goto again;
+                }
                 extent_end = other_end;
                 del_slot = path->slots[0] + 1;
                 del_nr++;
@@ -650,8 +707,13 @@ again:
         }
         other_start = 0;
         other_end = start;
-        if (extent_mergeable(leaf, path->slots[0] - 1, inode->i_ino,
-                             bytenr, &other_start, &other_end)) {
+        if (extent_mergeable(leaf, path->slots[0] - 1,
+                             inode->i_ino, bytenr, orig_offset,
+                             &other_start, &other_end)) {
+                if (recow) {
+                        btrfs_release_path(root, path);
+                        goto again;
+                }
                 key.offset = other_start;
                 del_slot = path->slots[0];
                 del_nr++;
@@ -661,21 +723,23 @@ again:
                 BUG_ON(ret);
         }
         if (del_nr == 0) {
+                fi = btrfs_item_ptr(leaf, path->slots[0],
+                           struct btrfs_file_extent_item);
                 btrfs_set_file_extent_type(leaf, fi,
                                            BTRFS_FILE_EXTENT_REG);
                 btrfs_mark_buffer_dirty(leaf);
-                goto out;
-        }
-
-        fi = btrfs_item_ptr(leaf, del_slot - 1,
-                            struct btrfs_file_extent_item);
-        btrfs_set_file_extent_type(leaf, fi, BTRFS_FILE_EXTENT_REG);
-        btrfs_set_file_extent_num_bytes(leaf, fi,
-                                        extent_end - key.offset);
-        btrfs_mark_buffer_dirty(leaf);
+        } else {
+                fi = btrfs_item_ptr(leaf, del_slot - 1,
+                           struct btrfs_file_extent_item);
+                btrfs_set_file_extent_type(leaf, fi,
+                                           BTRFS_FILE_EXTENT_REG);
+                btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                extent_end - key.offset);
+                btrfs_mark_buffer_dirty(leaf);
 
-        ret = btrfs_del_items(trans, root, path, del_slot, del_nr);
-        BUG_ON(ret);
+                ret = btrfs_del_items(trans, root, path, del_slot, del_nr);
+                BUG_ON(ret);
+        }
 out:
         btrfs_free_path(path);
         return 0;
@@ -691,6 +755,7 @@ static noinline int prepare_pages(struct btrfs_root *root, struct file *file,
                          loff_t pos, unsigned long first_index,
                          unsigned long last_index, size_t write_bytes)
 {
+        struct extent_state *cached_state = NULL;
         int i;
         unsigned long index = pos >> PAGE_CACHE_SHIFT;
         struct inode *inode = fdentry(file)->d_inode;
@@ -719,16 +784,18 @@ again:
         }
         if (start_pos < inode->i_size) {
                 struct btrfs_ordered_extent *ordered;
-                lock_extent(&BTRFS_I(inode)->io_tree,
-                            start_pos, last_pos - 1, GFP_NOFS);
+                lock_extent_bits(&BTRFS_I(inode)->io_tree,
+                                 start_pos, last_pos - 1, 0, &cached_state,
+                                 GFP_NOFS);
                 ordered = btrfs_lookup_first_ordered_extent(inode,
                                                             last_pos - 1);
                 if (ordered &&
                     ordered->file_offset + ordered->len > start_pos &&
                     ordered->file_offset < last_pos) {
                         btrfs_put_ordered_extent(ordered);
-                        unlock_extent(&BTRFS_I(inode)->io_tree,
-                                      start_pos, last_pos - 1, GFP_NOFS);
+                        unlock_extent_cached(&BTRFS_I(inode)->io_tree,
+                                             start_pos, last_pos - 1,
+                                             &cached_state, GFP_NOFS);
                         for (i = 0; i < num_pages; i++) {
                                 unlock_page(pages[i]);
                                 page_cache_release(pages[i]);
@@ -740,12 +807,13 @@ again:
                 if (ordered)
                         btrfs_put_ordered_extent(ordered);
 
-                clear_extent_bits(&BTRFS_I(inode)->io_tree, start_pos,
+                clear_extent_bit(&BTRFS_I(inode)->io_tree, start_pos,
                                   last_pos - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
-                                  EXTENT_DO_ACCOUNTING,
+                                  EXTENT_DO_ACCOUNTING, 0, 0, &cached_state,
                                   GFP_NOFS);
-                unlock_extent(&BTRFS_I(inode)->io_tree,
-                              start_pos, last_pos - 1, GFP_NOFS);
+                unlock_extent_cached(&BTRFS_I(inode)->io_tree,
+                                     start_pos, last_pos - 1, &cached_state,
+                                     GFP_NOFS);
         }
         for (i = 0; i < num_pages; i++) {
                 clear_page_dirty_for_io(pages[i]);
@@ -1073,7 +1141,7 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         }
         mutex_lock(&dentry->d_inode->i_mutex);
 out:
-        return ret > 0 ? EIO : ret;
+        return ret > 0 ? -EIO : ret;
 }
 
 static const struct vm_operations_struct btrfs_file_vm_ops = {
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index cb2849f03251..f488fac04d99 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -18,6 +18,7 @@
 
 #include <linux/pagemap.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/math64.h>
 #include "ctree.h"
 #include "free-space-cache.h"
@@ -870,7 +871,7 @@ __btrfs_return_cluster_to_free_space(
                 tree_insert_offset(&block_group->free_space_offset,
                                    entry->offset, &entry->offset_index, 0);
         }
-        cluster->root.rb_node = NULL;
+        cluster->root = RB_ROOT;
 
 out:
         spin_unlock(&cluster->lock);
@@ -1355,7 +1356,7 @@ void btrfs_init_free_cluster(struct btrfs_free_cluster *cluster)
 {
         spin_lock_init(&cluster->lock);
         spin_lock_init(&cluster->refill_lock);
-        cluster->root.rb_node = NULL;
+        cluster->root = RB_ROOT;
         cluster->max_size = 0;
         cluster->points_to_bitmap = false;
         INIT_LIST_HEAD(&cluster->block_group_list);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 5440bab23635..2bfdc641d4e3 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -36,6 +36,7 @@
 #include <linux/xattr.h>
 #include <linux/posix_acl.h>
 #include <linux/falloc.h>
+#include <linux/slab.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -379,7 +380,8 @@ again:
          * change at any time if we discover bad compression ratios.
          */
         if (!(BTRFS_I(inode)->flags & BTRFS_INODE_NOCOMPRESS) &&
-            btrfs_test_opt(root, COMPRESS)) {
+            (btrfs_test_opt(root, COMPRESS) ||
+             (BTRFS_I(inode)->force_compress))) {
                 WARN_ON(pages);
                 pages = kzalloc(sizeof(struct page *) * nr_pages, GFP_NOFS);
 
@@ -483,7 +485,10 @@ again:
                 nr_pages_ret = 0;
 
                 /* flag the file so we don't compress in the future */
-                BTRFS_I(inode)->flags |= BTRFS_INODE_NOCOMPRESS;
+                if (!btrfs_test_opt(root, FORCE_COMPRESS) &&
+                    !(BTRFS_I(inode)->force_compress)) {
+                        BTRFS_I(inode)->flags |= BTRFS_INODE_NOCOMPRESS;
+                }
         }
         if (will_compress) {
                 *num_added += 1;
@@ -569,8 +574,8 @@ retry:
                         unsigned long nr_written = 0;
 
                         lock_extent(io_tree, async_extent->start,
-                                    async_extent->start +
-                                    async_extent->ram_size - 1, GFP_NOFS);
+                                         async_extent->start +
+                                         async_extent->ram_size - 1, GFP_NOFS);
 
                         /* allocate blocks */
                         ret = cow_file_range(inode, async_cow->locked_page,
@@ -792,7 +797,7 @@ static noinline int cow_file_range(struct inode *inode,
         while (disk_num_bytes > 0) {
                 unsigned long op;
 
-                cur_alloc_size = min(disk_num_bytes, root->fs_info->max_extent);
+                cur_alloc_size = disk_num_bytes;
                 ret = btrfs_reserve_extent(trans, root, cur_alloc_size,
                                            root->sectorsize, 0, alloc_hint,
                                            (u64)-1, &ins, 1);
@@ -1210,7 +1215,8 @@ static int run_delalloc_range(struct inode *inode, struct page *locked_page,
         else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC)
                 ret = run_delalloc_nocow(inode, locked_page, start, end,
                                          page_started, 0, nr_written);
-        else if (!btrfs_test_opt(root, COMPRESS))
+        else if (!btrfs_test_opt(root, COMPRESS) &&
+                 !(BTRFS_I(inode)->force_compress))
                 ret = cow_file_range(inode, locked_page, start, end,
                                       page_started, nr_written, 1);
         else
@@ -1222,30 +1228,9 @@ static int run_delalloc_range(struct inode *inode, struct page *locked_page,
 static int btrfs_split_extent_hook(struct inode *inode,
                                     struct extent_state *orig, u64 split)
 {
-        struct btrfs_root *root = BTRFS_I(inode)->root;
-        u64 size;
-
         if (!(orig->state & EXTENT_DELALLOC))
                 return 0;
 
-        size = orig->end - orig->start + 1;
-        if (size > root->fs_info->max_extent) {
-                u64 num_extents;
-                u64 new_size;
-
-                new_size = orig->end - split + 1;
-                num_extents = div64_u64(size + root->fs_info->max_extent - 1,
-                                        root->fs_info->max_extent);
-
-                /*
-                 * if we break a large extent up then leave oustanding_extents
-                 * be, since we've already accounted for the large extent.
-                 */
-                if (div64_u64(new_size + root->fs_info->max_extent - 1,
-                              root->fs_info->max_extent) < num_extents)
-                        return 0;
-        }
-
         spin_lock(&BTRFS_I(inode)->accounting_lock);
         BTRFS_I(inode)->outstanding_extents++;
         spin_unlock(&BTRFS_I(inode)->accounting_lock);
@@ -1263,38 +1248,10 @@ static int btrfs_merge_extent_hook(struct inode *inode,
                                    struct extent_state *new,
                                    struct extent_state *other)
 {
-        struct btrfs_root *root = BTRFS_I(inode)->root;
-        u64 new_size, old_size;
-        u64 num_extents;
-
         /* not delalloc, ignore it */
         if (!(other->state & EXTENT_DELALLOC))
                 return 0;
 
-        old_size = other->end - other->start + 1;
-        if (new->start < other->start)
-                new_size = other->end - new->start + 1;
-        else
-                new_size = new->end - other->start + 1;
-
-        /* we're not bigger than the max, unreserve the space and go */
-        if (new_size <= root->fs_info->max_extent) {
-                spin_lock(&BTRFS_I(inode)->accounting_lock);
-                BTRFS_I(inode)->outstanding_extents--;
-                spin_unlock(&BTRFS_I(inode)->accounting_lock);
-                return 0;
-        }
-
-        /*
-         * If we grew by another max_extent, just return, we want to keep that
-         * reserved amount.
-         */
-        num_extents = div64_u64(old_size + root->fs_info->max_extent - 1,
-                                root->fs_info->max_extent);
-        if (div64_u64(new_size + root->fs_info->max_extent - 1,
-                      root->fs_info->max_extent) > num_extents)
-                return 0;
-
         spin_lock(&BTRFS_I(inode)->accounting_lock);
         BTRFS_I(inode)->outstanding_extents--;
         spin_unlock(&BTRFS_I(inode)->accounting_lock);
@@ -1323,6 +1280,7 @@ static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
                 BTRFS_I(inode)->outstanding_extents++;
                 spin_unlock(&BTRFS_I(inode)->accounting_lock);
                 btrfs_delalloc_reserve_space(root, inode, end - start + 1);
+
                 spin_lock(&root->fs_info->delalloc_lock);
                 BTRFS_I(inode)->delalloc_bytes += end - start + 1;
                 root->fs_info->delalloc_bytes += end - start + 1;
@@ -1351,6 +1309,7 @@ static int btrfs_clear_bit_hook(struct inode *inode,
 
                 if (bits & EXTENT_DO_ACCOUNTING) {
                         spin_lock(&BTRFS_I(inode)->accounting_lock);
+                        WARN_ON(!BTRFS_I(inode)->outstanding_extents);
                         BTRFS_I(inode)->outstanding_extents--;
                         spin_unlock(&BTRFS_I(inode)->accounting_lock);
                         btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
@@ -1507,12 +1466,13 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
         return 0;
 }
 
-int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end)
+int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
+                              struct extent_state **cached_state)
 {
         if ((end & (PAGE_CACHE_SIZE - 1)) == 0)
                 WARN_ON(1);
         return set_extent_delalloc(&BTRFS_I(inode)->io_tree, start, end,
-                                   GFP_NOFS);
+                                   cached_state, GFP_NOFS);
 }
 
 /* see btrfs_writepage_start_hook for details on why this is required */
@@ -1525,6 +1485,7 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
 {
         struct btrfs_writepage_fixup *fixup;
         struct btrfs_ordered_extent *ordered;
+        struct extent_state *cached_state = NULL;
         struct page *page;
         struct inode *inode;
         u64 page_start;
@@ -1543,7 +1504,8 @@ again:
         page_start = page_offset(page);
         page_end = page_offset(page) + PAGE_CACHE_SIZE - 1;
 
-        lock_extent(&BTRFS_I(inode)->io_tree, page_start, page_end, GFP_NOFS);
+        lock_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end, 0,
+                         &cached_state, GFP_NOFS);
 
         /* already ordered? We're done */
         if (PagePrivate2(page))
@@ -1551,17 +1513,18 @@ again:
 
         ordered = btrfs_lookup_ordered_extent(inode, page_start);
         if (ordered) {
-                unlock_extent(&BTRFS_I(inode)->io_tree, page_start,
-                              page_end, GFP_NOFS);
+                unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start,
+                                     page_end, &cached_state, GFP_NOFS);
                 unlock_page(page);
                 btrfs_start_ordered_extent(inode, ordered, 1);
                 goto again;
         }
 
-        btrfs_set_extent_delalloc(inode, page_start, page_end);
+        btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state);
         ClearPageChecked(page);
 out:
-        unlock_extent(&BTRFS_I(inode)->io_tree, page_start, page_end, GFP_NOFS);
+        unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+                             &cached_state, GFP_NOFS);
 out_page:
         unlock_page(page);
         page_cache_release(page);
@@ -1680,24 +1643,6 @@ static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
  * before we start the transaction.  It limits the amount of btree
  * reads required while inside the transaction.
  */
-static noinline void reada_csum(struct btrfs_root *root,
-                                struct btrfs_path *path,
-                                struct btrfs_ordered_extent *ordered_extent)
-{
-        struct btrfs_ordered_sum *sum;
-        u64 bytenr;
-
-        sum = list_entry(ordered_extent->list.next, struct btrfs_ordered_sum,
-                         list);
-        bytenr = sum->sums[0].bytenr;
-
-        /*
-         * we don't care about the results, the point of this search is
-         * just to get the btree leaves into ram
-         */
-        btrfs_lookup_csum(NULL, root->fs_info->csum_root, path, bytenr, 0);
-}
-
 /* as ordered data IO finishes, this gets called so we can finish
  * an ordered extent if the range of bytes in the file it covers are
  * fully written.
@@ -1708,40 +1653,16 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
         struct btrfs_trans_handle *trans;
         struct btrfs_ordered_extent *ordered_extent = NULL;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
-        struct btrfs_path *path;
+        struct extent_state *cached_state = NULL;
         int compressed = 0;
         int ret;
 
-        ret = btrfs_dec_test_ordered_pending(inode, start, end - start + 1);
+        ret = btrfs_dec_test_ordered_pending(inode, &ordered_extent, start,
+                                             end - start + 1);
         if (!ret)
                 return 0;
-
-        /*
-         * before we join the transaction, try to do some of our IO.
-         * This will limit the amount of IO that we have to do with
-         * the transaction running.  We're unlikely to need to do any
-         * IO if the file extents are new, the disk_i_size checks
-         * covers the most common case.
-         */
-        if (start < BTRFS_I(inode)->disk_i_size) {
-                path = btrfs_alloc_path();
-                if (path) {
-                        ret = btrfs_lookup_file_extent(NULL, root, path,
-                                                       inode->i_ino,
-                                                       start, 0);
-                        ordered_extent = btrfs_lookup_ordered_extent(inode,
-                                                                     start);
-                        if (!list_empty(&ordered_extent->list)) {
-                                btrfs_release_path(root, path);
-                                reada_csum(root, path, ordered_extent);
-                        }
-                        btrfs_free_path(path);
-                }
-        }
-
-        if (!ordered_extent)
-                ordered_extent = btrfs_lookup_ordered_extent(inode, start);
         BUG_ON(!ordered_extent);
+
         if (test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags)) {
                 BUG_ON(!list_empty(&ordered_extent->list));
                 ret = btrfs_ordered_update_i_size(inode, 0, ordered_extent);
@@ -1754,9 +1675,9 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                 goto out;
         }
 
-        lock_extent(io_tree, ordered_extent->file_offset,
-                    ordered_extent->file_offset + ordered_extent->len - 1,
-                    GFP_NOFS);
+        lock_extent_bits(io_tree, ordered_extent->file_offset,
+                         ordered_extent->file_offset + ordered_extent->len - 1,
+                         0, &cached_state, GFP_NOFS);
 
         trans = btrfs_join_transaction(root, 1);
 
@@ -1783,9 +1704,10 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                                    ordered_extent->len);
                 BUG_ON(ret);
         }
-        unlock_extent(io_tree, ordered_extent->file_offset,
-                    ordered_extent->file_offset + ordered_extent->len - 1,
-                    GFP_NOFS);
+        unlock_extent_cached(io_tree, ordered_extent->file_offset,
+                             ordered_extent->file_offset +
+                             ordered_extent->len - 1, &cached_state, GFP_NOFS);
+
         add_pending_csums(trans, inode, ordered_extent->file_offset,
                           &ordered_extent->list);
 
@@ -2194,7 +2116,7 @@ void btrfs_orphan_cleanup(struct btrfs_root *root)
                 found_key.objectid = found_key.offset;
                 found_key.type = BTRFS_INODE_ITEM_KEY;
                 found_key.offset = 0;
-                inode = btrfs_iget(root->fs_info->sb, &found_key, root);
+                inode = btrfs_iget(root->fs_info->sb, &found_key, root, NULL);
                 if (IS_ERR(inode))
                         break;
 
@@ -3122,6 +3044,7 @@ static int btrfs_truncate_page(struct address_space *mapping, loff_t from)
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
         struct btrfs_ordered_extent *ordered;
+        struct extent_state *cached_state = NULL;
         char *kaddr;
         u32 blocksize = root->sectorsize;
         pgoff_t index = from >> PAGE_CACHE_SHIFT;
@@ -3168,12 +3091,14 @@ again:
         }
         wait_on_page_writeback(page);
 
-        lock_extent(io_tree, page_start, page_end, GFP_NOFS);
+        lock_extent_bits(io_tree, page_start, page_end, 0, &cached_state,
+                         GFP_NOFS);
         set_page_extent_mapped(page);
 
         ordered = btrfs_lookup_ordered_extent(inode, page_start);
         if (ordered) {
-                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+                unlock_extent_cached(io_tree, page_start, page_end,
+                                     &cached_state, GFP_NOFS);
                 unlock_page(page);
                 page_cache_release(page);
                 btrfs_start_ordered_extent(inode, ordered, 1);
@@ -3181,13 +3106,15 @@ again:
                 goto again;
         }
 
-        clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+        clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start, page_end,
                           EXTENT_DIRTY | EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING,
-                          GFP_NOFS);
+                          0, 0, &cached_state, GFP_NOFS);
 
-        ret = btrfs_set_extent_delalloc(inode, page_start, page_end);
+        ret = btrfs_set_extent_delalloc(inode, page_start, page_end,
+                                        &cached_state);
         if (ret) {
-                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+                unlock_extent_cached(io_tree, page_start, page_end,
+                                     &cached_state, GFP_NOFS);
                 goto out_unlock;
         }
 
@@ -3200,7 +3127,8 @@ again:
         }
         ClearPageChecked(page);
         set_page_dirty(page);
-        unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+        unlock_extent_cached(io_tree, page_start, page_end, &cached_state,
+                             GFP_NOFS);
 
 out_unlock:
         if (ret)
@@ -3218,6 +3146,7 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
         struct extent_map *em;
+        struct extent_state *cached_state = NULL;
         u64 mask = root->sectorsize - 1;
         u64 hole_start = (inode->i_size + mask) & ~mask;
         u64 block_end = (size + mask) & ~mask;
@@ -3233,11 +3162,13 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
                 struct btrfs_ordered_extent *ordered;
                 btrfs_wait_ordered_range(inode, hole_start,
                                          block_end - hole_start);
-                lock_extent(io_tree, hole_start, block_end - 1, GFP_NOFS);
+                lock_extent_bits(io_tree, hole_start, block_end - 1, 0,
+                                 &cached_state, GFP_NOFS);
                 ordered = btrfs_lookup_ordered_extent(inode, hole_start);
                 if (!ordered)
                         break;
-                unlock_extent(io_tree, hole_start, block_end - 1, GFP_NOFS);
+                unlock_extent_cached(io_tree, hole_start, block_end - 1,
+                                     &cached_state, GFP_NOFS);
                 btrfs_put_ordered_extent(ordered);
         }
 
@@ -3282,7 +3213,8 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
                         break;
         }
 
-        unlock_extent(io_tree, hole_start, block_end - 1, GFP_NOFS);
+        unlock_extent_cached(io_tree, hole_start, block_end - 1, &cached_state,
+                             GFP_NOFS);
         return err;
 }
 
@@ -3680,6 +3612,7 @@ static noinline void init_btrfs_i(struct inode *inode)
         bi->index_cnt = (u64)-1;
         bi->last_unlink_trans = 0;
         bi->ordered_data_close = 0;
+        bi->force_compress = 0;
         extent_map_tree_init(&BTRFS_I(inode)->extent_tree, GFP_NOFS);
         extent_io_tree_init(&BTRFS_I(inode)->io_tree,
                              inode->i_mapping, GFP_NOFS);
@@ -3728,7 +3661,7 @@ static struct inode *btrfs_iget_locked(struct super_block *s,
  * Returns in *is_new if the inode was read from disk
  */
 struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
-                         struct btrfs_root *root)
+                         struct btrfs_root *root, int *new)
 {
         struct inode *inode;
 
@@ -3743,6 +3676,8 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
 
                 inode_tree_add(inode);
                 unlock_new_inode(inode);
+                if (new)
+                        *new = 1;
         }
 
         return inode;
@@ -3795,7 +3730,7 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
                 return NULL;
 
         if (location.type == BTRFS_INODE_ITEM_KEY) {
-                inode = btrfs_iget(dir->i_sb, &location, root);
+                inode = btrfs_iget(dir->i_sb, &location, root, NULL);
                 return inode;
         }
 
@@ -3810,7 +3745,7 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
                 else
                         inode = new_simple_dir(dir->i_sb, &location, sub_root);
         } else {
-                inode = btrfs_iget(dir->i_sb, &location, sub_root);
+                inode = btrfs_iget(dir->i_sb, &location, sub_root, NULL);
         }
         srcu_read_unlock(&root->fs_info->subvol_srcu, index);
 
@@ -3995,7 +3930,11 @@ skip:
 
         /* Reached end of directory/root. Bump pos past the last item. */
         if (key_type == BTRFS_DIR_INDEX_KEY)
-                filp->f_pos = INT_LIMIT(off_t);
+                /*
+                 * 32-bit glibc will use getdents64, but then strtol -
+                 * so the last number we can serve is this.
+                 */
+                filp->f_pos = 0x7fffffff;
         else
                 filp->f_pos++;
 nopos:
@@ -4005,7 +3944,7 @@ err:
         return ret;
 }
 
-int btrfs_write_inode(struct inode *inode, int wait)
+int btrfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_trans_handle *trans;
@@ -4014,7 +3953,7 @@ int btrfs_write_inode(struct inode *inode, int wait)
         if (root->fs_info->btree_inode == inode)
                 return 0;
 
-        if (wait) {
+        if (wbc->sync_mode == WB_SYNC_ALL) {
                 trans = btrfs_join_transaction(root, 1);
                 btrfs_set_trans_block_group(trans, inode);
                 ret = btrfs_commit_transaction(trans, root);
@@ -4538,7 +4477,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         err = btrfs_find_free_objectid(trans, root, dir->i_ino, &objectid);
         if (err) {
                 err = -ENOSPC;
-                goto out_unlock;
+                goto out_fail;
         }
 
         inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
@@ -5016,6 +4955,7 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
 {
         struct extent_io_tree *tree;
         struct btrfs_ordered_extent *ordered;
+        struct extent_state *cached_state = NULL;
         u64 page_start = page_offset(page);
         u64 page_end = page_start + PAGE_CACHE_SIZE - 1;
 
@@ -5034,7 +4974,8 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                 btrfs_releasepage(page, GFP_NOFS);
                 return;
         }
-        lock_extent(tree, page_start, page_end, GFP_NOFS);
+        lock_extent_bits(tree, page_start, page_end, 0, &cached_state,
+                         GFP_NOFS);
         ordered = btrfs_lookup_ordered_extent(page->mapping->host,
                                            page_offset(page));
         if (ordered) {
@@ -5045,7 +4986,7 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                 clear_extent_bit(tree, page_start, page_end,
                                  EXTENT_DIRTY | EXTENT_DELALLOC |
                                  EXTENT_LOCKED | EXTENT_DO_ACCOUNTING, 1, 0,
-                                 NULL, GFP_NOFS);
+                                 &cached_state, GFP_NOFS);
                 /*
                  * whoever cleared the private bit is responsible
                  * for the finish_ordered_io
@@ -5055,11 +4996,13 @@ static void btrfs_invalidatepage(struct page *page, unsigned long offset)
                                                 page_start, page_end);
                 }
                 btrfs_put_ordered_extent(ordered);
-                lock_extent(tree, page_start, page_end, GFP_NOFS);
+                cached_state = NULL;
+                lock_extent_bits(tree, page_start, page_end, 0, &cached_state,
+                                 GFP_NOFS);
         }
         clear_extent_bit(tree, page_start, page_end,
                  EXTENT_LOCKED | EXTENT_DIRTY | EXTENT_DELALLOC |
-                 EXTENT_DO_ACCOUNTING, 1, 1, NULL, GFP_NOFS);
+                 EXTENT_DO_ACCOUNTING, 1, 1, &cached_state, GFP_NOFS);
         __btrfs_releasepage(page, GFP_NOFS);
 
         ClearPageChecked(page);
@@ -5092,6 +5035,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
         struct btrfs_ordered_extent *ordered;
+        struct extent_state *cached_state = NULL;
         char *kaddr;
         unsigned long zero_start;
         loff_t size;
@@ -5130,7 +5074,8 @@ again:
         }
         wait_on_page_writeback(page);
 
-        lock_extent(io_tree, page_start, page_end, GFP_NOFS);
+        lock_extent_bits(io_tree, page_start, page_end, 0, &cached_state,
+                         GFP_NOFS);
         set_page_extent_mapped(page);
 
         /*
@@ -5139,7 +5084,8 @@ again:
          */
         ordered = btrfs_lookup_ordered_extent(inode, page_start);
         if (ordered) {
-                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+                unlock_extent_cached(io_tree, page_start, page_end,
+                                     &cached_state, GFP_NOFS);
                 unlock_page(page);
                 btrfs_start_ordered_extent(inode, ordered, 1);
                 btrfs_put_ordered_extent(ordered);
@@ -5153,13 +5099,15 @@ again:
          * is probably a better way to do this, but for now keep consistent with
          * prepare_pages in the normal write path.
          */
-        clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+        clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start, page_end,
                           EXTENT_DIRTY | EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING,
-                          GFP_NOFS);
+                          0, 0, &cached_state, GFP_NOFS);
 
-        ret = btrfs_set_extent_delalloc(inode, page_start, page_end);
+        ret = btrfs_set_extent_delalloc(inode, page_start, page_end,
+                                        &cached_state);
         if (ret) {
-                unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+                unlock_extent_cached(io_tree, page_start, page_end,
+                                     &cached_state, GFP_NOFS);
                 ret = VM_FAULT_SIGBUS;
                 btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
                 goto out_unlock;
@@ -5185,7 +5133,7 @@ again:
         BTRFS_I(inode)->last_trans = root->fs_info->generation;
         BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid;
 
-        unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+        unlock_extent_cached(io_tree, page_start, page_end, &cached_state, GFP_NOFS);
 
 out_unlock:
         btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
@@ -5390,7 +5338,6 @@ free:
 void btrfs_drop_inode(struct inode *inode)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
-
         if (inode->i_nlink > 0 && btrfs_root_refs(&root->root_item) == 0)
                 generic_delete_inode(inode);
         else
@@ -5789,22 +5736,20 @@ out_fail:
 }
 
 static int prealloc_file_range(struct inode *inode, u64 start, u64 end,
-                               u64 alloc_hint, int mode)
+                        u64 alloc_hint, int mode, loff_t actual_len)
 {
         struct btrfs_trans_handle *trans;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_key ins;
-        u64 alloc_size;
         u64 cur_offset = start;
         u64 num_bytes = end - start;
         int ret = 0;
+        u64 i_size;
 
         while (num_bytes > 0) {
-                alloc_size = min(num_bytes, root->fs_info->max_extent);
-
                 trans = btrfs_start_transaction(root, 1);
 
-                ret = btrfs_reserve_extent(trans, root, alloc_size,
+                ret = btrfs_reserve_extent(trans, root, num_bytes,
                                            root->sectorsize, 0, alloc_hint,
                                            (u64)-1, &ins, 1);
                 if (ret) {
@@ -5835,9 +5780,15 @@ static int prealloc_file_range(struct inode *inode, u64 start, u64 end,
                 inode->i_ctime = CURRENT_TIME;
                 BTRFS_I(inode)->flags |= BTRFS_INODE_PREALLOC;
                 if (!(mode & FALLOC_FL_KEEP_SIZE) &&
-                    cur_offset > inode->i_size) {
-                        i_size_write(inode, cur_offset);
-                        btrfs_ordered_update_i_size(inode, cur_offset, NULL);
+                        (actual_len > inode->i_size) &&
+                        (cur_offset > inode->i_size)) {
+
+                        if (cur_offset > actual_len)
+                                i_size  = actual_len;
+                        else
+                                i_size = cur_offset;
+                        i_size_write(inode, i_size);
+                        btrfs_ordered_update_i_size(inode, i_size, NULL);
                 }
 
                 ret = btrfs_update_inode(trans, root, inode);
@@ -5857,6 +5808,7 @@ stop_trans:
 static long btrfs_fallocate(struct inode *inode, int mode,
                             loff_t offset, loff_t len)
 {
+        struct extent_state *cached_state = NULL;
         u64 cur_offset;
         u64 last_byte;
         u64 alloc_start;
@@ -5895,16 +5847,17 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                 /* the extent lock is ordered inside the running
                  * transaction
                  */
-                lock_extent(&BTRFS_I(inode)->io_tree, alloc_start, locked_end,
-                            GFP_NOFS);
+                lock_extent_bits(&BTRFS_I(inode)->io_tree, alloc_start,
+                                 locked_end, 0, &cached_state, GFP_NOFS);
                 ordered = btrfs_lookup_first_ordered_extent(inode,
                                                             alloc_end - 1);
                 if (ordered &&
                     ordered->file_offset + ordered->len > alloc_start &&
                     ordered->file_offset < alloc_end) {
                         btrfs_put_ordered_extent(ordered);
-                        unlock_extent(&BTRFS_I(inode)->io_tree,
-                                      alloc_start, locked_end, GFP_NOFS);
+                        unlock_extent_cached(&BTRFS_I(inode)->io_tree,
+                                             alloc_start, locked_end,
+                                             &cached_state, GFP_NOFS);
                         /*
                          * we can't wait on the range with the transaction
                          * running or with the extent lock held
@@ -5930,7 +5883,7 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
                         ret = prealloc_file_range(inode,
                                                   cur_offset, last_byte,
-                                                  alloc_hint, mode);
+                                                alloc_hint, mode, offset+len);
                         if (ret < 0) {
                                 free_extent_map(em);
                                 break;
@@ -5946,8 +5899,8 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                         break;
                 }
         }
-        unlock_extent(&BTRFS_I(inode)->io_tree, alloc_start, locked_end,
-                      GFP_NOFS);
+        unlock_extent_cached(&BTRFS_I(inode)->io_tree, alloc_start, locked_end,
+                             &cached_state, GFP_NOFS);
 
         btrfs_free_reserved_data_space(BTRFS_I(inode)->root, inode,
                                        alloc_end - alloc_start);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 645a17927a8f..e84ef60ffe35 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -39,6 +39,7 @@
 #include <linux/security.h>
 #include <linux/xattr.h>
 #include <linux/vmalloc.h>
+#include <linux/slab.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -474,7 +475,79 @@ out_unlock:
         return error;
 }
 
-static int btrfs_defrag_file(struct file *file)
+static int should_defrag_range(struct inode *inode, u64 start, u64 len,
+                               int thresh, u64 *last_len, u64 *skip,
+                               u64 *defrag_end)
+{
+        struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
+        struct extent_map *em = NULL;
+        struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
+        int ret = 1;
+
+
+        if (thresh == 0)
+                thresh = 256 * 1024;
+
+        /*
+         * make sure that once we start defragging and extent, we keep on
+         * defragging it
+         */
+        if (start < *defrag_end)
+                return 1;
+
+        *skip = 0;
+
+        /*
+         * hopefully we have this extent in the tree already, try without
+         * the full extent lock
+         */
+        read_lock(&em_tree->lock);
+        em = lookup_extent_mapping(em_tree, start, len);
+        read_unlock(&em_tree->lock);
+
+        if (!em) {
+                /* get the big lock and read metadata off disk */
+                lock_extent(io_tree, start, start + len - 1, GFP_NOFS);
+                em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
+                unlock_extent(io_tree, start, start + len - 1, GFP_NOFS);
+
+                if (IS_ERR(em))
+                        return 0;
+        }
+
+        /* this will cover holes, and inline extents */
+        if (em->block_start >= EXTENT_MAP_LAST_BYTE)
+                ret = 0;
+
+        /*
+         * we hit a real extent, if it is big don't bother defragging it again
+         */
+        if ((*last_len == 0 || *last_len >= thresh) && em->len >= thresh)
+                ret = 0;
+
+        /*
+         * last_len ends up being a counter of how many bytes we've defragged.
+         * every time we choose not to defrag an extent, we reset *last_len
+         * so that the next tiny extent will force a defrag.
+         *
+         * The end result of this is that tiny extents before a single big
+         * extent will force at least part of that big extent to be defragged.
+         */
+        if (ret) {
+                *last_len += len;
+                *defrag_end = extent_map_end(em);
+        } else {
+                *last_len = 0;
+                *skip = extent_map_end(em);
+                *defrag_end = 0;
+        }
+
+        free_extent_map(em);
+        return ret;
+}
+
+static int btrfs_defrag_file(struct file *file,
+                             struct btrfs_ioctl_defrag_range_args *range)
 {
         struct inode *inode = fdentry(file)->d_inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
@@ -486,37 +559,96 @@ static int btrfs_defrag_file(struct file *file)
         unsigned long total_read = 0;
         u64 page_start;
         u64 page_end;
+        u64 last_len = 0;
+        u64 skip = 0;
+        u64 defrag_end = 0;
         unsigned long i;
         int ret;
 
-        ret = btrfs_check_data_free_space(root, inode, inode->i_size);
-        if (ret)
-                return -ENOSPC;
+        if (inode->i_size == 0)
+                return 0;
+
+        if (range->start + range->len > range->start) {
+                last_index = min_t(u64, inode->i_size - 1,
+                         range->start + range->len - 1) >> PAGE_CACHE_SHIFT;
+        } else {
+                last_index = (inode->i_size - 1) >> PAGE_CACHE_SHIFT;
+        }
+
+        i = range->start >> PAGE_CACHE_SHIFT;
+        while (i <= last_index) {
+                if (!should_defrag_range(inode, (u64)i << PAGE_CACHE_SHIFT,
+                                        PAGE_CACHE_SIZE,
+                                        range->extent_thresh,
+                                        &last_len, &skip,
+                                        &defrag_end)) {
+                        unsigned long next;
+                        /*
+                         * the should_defrag function tells us how much to skip
+                         * bump our counter by the suggested amount
+                         */
+                        next = (skip + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+                        i = max(i + 1, next);
+                        continue;
+                }
 
-        mutex_lock(&inode->i_mutex);
-        last_index = inode->i_size >> PAGE_CACHE_SHIFT;
-        for (i = 0; i <= last_index; i++) {
                 if (total_read % ra_pages == 0) {
                         btrfs_force_ra(inode->i_mapping, &file->f_ra, file, i,
                                        min(last_index, i + ra_pages - 1));
                 }
                 total_read++;
+                mutex_lock(&inode->i_mutex);
+                if (range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)
+                        BTRFS_I(inode)->force_compress = 1;
+
+                ret = btrfs_check_data_free_space(root, inode, PAGE_CACHE_SIZE);
+                if (ret) {
+                        ret = -ENOSPC;
+                        break;
+                }
+
+                ret = btrfs_reserve_metadata_for_delalloc(root, inode, 1);
+                if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       PAGE_CACHE_SIZE);
+                        ret = -ENOSPC;
+                        break;
+                }
 again:
+                if (inode->i_size == 0 ||
+                    i > ((inode->i_size - 1) >> PAGE_CACHE_SHIFT)) {
+                        ret = 0;
+                        goto err_reservations;
+                }
+
                 page = grab_cache_page(inode->i_mapping, i);
                 if (!page)
-                        goto out_unlock;
+                        goto err_reservations;
+
                 if (!PageUptodate(page)) {
                         btrfs_readpage(NULL, page);
                         lock_page(page);
                         if (!PageUptodate(page)) {
                                 unlock_page(page);
                                 page_cache_release(page);
-                                goto out_unlock;
+                                goto err_reservations;
                         }
                 }
 
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto again;
+                }
+
                 wait_on_page_writeback(page);
 
+                if (PageDirty(page)) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       PAGE_CACHE_SIZE);
+                        goto loop_unlock;
+                }
+
                 page_start = (u64)page->index << PAGE_CACHE_SHIFT;
                 page_end = page_start + PAGE_CACHE_SIZE - 1;
                 lock_extent(io_tree, page_start, page_end, GFP_NOFS);
@@ -537,18 +669,54 @@ again:
                  * page if it is dirtied again later
                  */
                 clear_page_dirty_for_io(page);
+                clear_extent_bits(&BTRFS_I(inode)->io_tree, page_start,
+                                  page_end, EXTENT_DIRTY | EXTENT_DELALLOC |
+                                  EXTENT_DO_ACCOUNTING, GFP_NOFS);
 
-                btrfs_set_extent_delalloc(inode, page_start, page_end);
+                btrfs_set_extent_delalloc(inode, page_start, page_end, NULL);
+                ClearPageChecked(page);
                 set_page_dirty(page);
                 unlock_extent(io_tree, page_start, page_end, GFP_NOFS);
+
+loop_unlock:
                 unlock_page(page);
                 page_cache_release(page);
+                mutex_unlock(&inode->i_mutex);
+
+                btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
                 balance_dirty_pages_ratelimited_nr(inode->i_mapping, 1);
+                i++;
+        }
+
+        if ((range->flags & BTRFS_DEFRAG_RANGE_START_IO))
+                filemap_flush(inode->i_mapping);
+
+        if ((range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
+                /* the filemap_flush will queue IO into the worker threads, but
+                 * we have to make sure the IO is actually started and that
+                 * ordered extents get created before we return
+                 */
+                atomic_inc(&root->fs_info->async_submit_draining);
+                while (atomic_read(&root->fs_info->nr_async_submits) ||
+                      atomic_read(&root->fs_info->async_delalloc_pages)) {
+                        wait_event(root->fs_info->async_submit_wait,
+                           (atomic_read(&root->fs_info->nr_async_submits) == 0 &&
+                            atomic_read(&root->fs_info->async_delalloc_pages) == 0));
+                }
+                atomic_dec(&root->fs_info->async_submit_draining);
+
+                mutex_lock(&inode->i_mutex);
+                BTRFS_I(inode)->force_compress = 0;
+                mutex_unlock(&inode->i_mutex);
         }
 
-out_unlock:
-        mutex_unlock(&inode->i_mutex);
         return 0;
+
+err_reservations:
+        mutex_unlock(&inode->i_mutex);
+        btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
+        btrfs_unreserve_metadata_for_delalloc(root, inode, 1);
+        return ret;
 }
 
 static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
@@ -608,7 +776,7 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                         mod = 1;
                         sizestr++;
                 }
-                new_size = btrfs_parse_size(sizestr);
+                new_size = memparse(sizestr, NULL);
                 if (new_size == 0) {
                         ret = -EINVAL;
                         goto out_unlock;
@@ -743,6 +911,330 @@ out:
         return ret;
 }
 
+static noinline int key_in_sk(struct btrfs_key *key,
+                              struct btrfs_ioctl_search_key *sk)
+{
+        struct btrfs_key test;
+        int ret;
+
+        test.objectid = sk->min_objectid;
+        test.type = sk->min_type;
+        test.offset = sk->min_offset;
+
+        ret = btrfs_comp_cpu_keys(key, &test);
+        if (ret < 0)
+                return 0;
+
+        test.objectid = sk->max_objectid;
+        test.type = sk->max_type;
+        test.offset = sk->max_offset;
+
+        ret = btrfs_comp_cpu_keys(key, &test);
+        if (ret > 0)
+                return 0;
+        return 1;
+}
+
+static noinline int copy_to_sk(struct btrfs_root *root,
+                               struct btrfs_path *path,
+                               struct btrfs_key *key,
+                               struct btrfs_ioctl_search_key *sk,
+                               char *buf,
+                               unsigned long *sk_offset,
+                               int *num_found)
+{
+        u64 found_transid;
+        struct extent_buffer *leaf;
+        struct btrfs_ioctl_search_header sh;
+        unsigned long item_off;
+        unsigned long item_len;
+        int nritems;
+        int i;
+        int slot;
+        int found = 0;
+        int ret = 0;
+
+        leaf = path->nodes[0];
+        slot = path->slots[0];
+        nritems = btrfs_header_nritems(leaf);
+
+        if (btrfs_header_generation(leaf) > sk->max_transid) {
+                i = nritems;
+                goto advance_key;
+        }
+        found_transid = btrfs_header_generation(leaf);
+
+        for (i = slot; i < nritems; i++) {
+                item_off = btrfs_item_ptr_offset(leaf, i);
+                item_len = btrfs_item_size_nr(leaf, i);
+
+                if (item_len > BTRFS_SEARCH_ARGS_BUFSIZE)
+                        item_len = 0;
+
+                if (sizeof(sh) + item_len + *sk_offset >
+                    BTRFS_SEARCH_ARGS_BUFSIZE) {
+                        ret = 1;
+                        goto overflow;
+                }
+
+                btrfs_item_key_to_cpu(leaf, key, i);
+                if (!key_in_sk(key, sk))
+                        continue;
+
+                sh.objectid = key->objectid;
+                sh.offset = key->offset;
+                sh.type = key->type;
+                sh.len = item_len;
+                sh.transid = found_transid;
+
+                /* copy search result header */
+                memcpy(buf + *sk_offset, &sh, sizeof(sh));
+                *sk_offset += sizeof(sh);
+
+                if (item_len) {
+                        char *p = buf + *sk_offset;
+                        /* copy the item */
+                        read_extent_buffer(leaf, p,
+                                           item_off, item_len);
+                        *sk_offset += item_len;
+                }
+                found++;
+
+                if (*num_found >= sk->nr_items)
+                        break;
+        }
+advance_key:
+        ret = 0;
+        if (key->offset < (u64)-1 && key->offset < sk->max_offset)
+                key->offset++;
+        else if (key->type < (u8)-1 && key->type < sk->max_type) {
+                key->offset = 0;
+                key->type++;
+        } else if (key->objectid < (u64)-1 && key->objectid < sk->max_objectid) {
+                key->offset = 0;
+                key->type = 0;
+                key->objectid++;
+        } else
+                ret = 1;
+overflow:
+        *num_found += found;
+        return ret;
+}
+
+static noinline int search_ioctl(struct inode *inode,
+                                 struct btrfs_ioctl_search_args *args)
+{
+        struct btrfs_root *root;
+        struct btrfs_key key;
+        struct btrfs_key max_key;
+        struct btrfs_path *path;
+        struct btrfs_ioctl_search_key *sk = &args->key;
+        struct btrfs_fs_info *info = BTRFS_I(inode)->root->fs_info;
+        int ret;
+        int num_found = 0;
+        unsigned long sk_offset = 0;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        if (sk->tree_id == 0) {
+                /* search the root of the inode that was passed */
+                root = BTRFS_I(inode)->root;
+        } else {
+                key.objectid = sk->tree_id;
+                key.type = BTRFS_ROOT_ITEM_KEY;
+                key.offset = (u64)-1;
+                root = btrfs_read_fs_root_no_name(info, &key);
+                if (IS_ERR(root)) {
+                        printk(KERN_ERR "could not find root %llu\n",
+                               sk->tree_id);
+                        btrfs_free_path(path);
+                        return -ENOENT;
+                }
+        }
+
+        key.objectid = sk->min_objectid;
+        key.type = sk->min_type;
+        key.offset = sk->min_offset;
+
+        max_key.objectid = sk->max_objectid;
+        max_key.type = sk->max_type;
+        max_key.offset = sk->max_offset;
+
+        path->keep_locks = 1;
+
+        while(1) {
+                ret = btrfs_search_forward(root, &key, &max_key, path, 0,
+                                           sk->min_transid);
+                if (ret != 0) {
+                        if (ret > 0)
+                                ret = 0;
+                        goto err;
+                }
+                ret = copy_to_sk(root, path, &key, sk, args->buf,
+                                 &sk_offset, &num_found);
+                btrfs_release_path(root, path);
+                if (ret || num_found >= sk->nr_items)
+                        break;
+
+        }
+        ret = 0;
+err:
+        sk->nr_items = num_found;
+        btrfs_free_path(path);
+        return ret;
+}
+
+static noinline int btrfs_ioctl_tree_search(struct file *file,
+                                           void __user *argp)
+{
+         struct btrfs_ioctl_search_args *args;
+         struct inode *inode;
+         int ret;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        args = kmalloc(sizeof(*args), GFP_KERNEL);
+        if (!args)
+                return -ENOMEM;
+
+        if (copy_from_user(args, argp, sizeof(*args))) {
+                kfree(args);
+                return -EFAULT;
+        }
+        inode = fdentry(file)->d_inode;
+        ret = search_ioctl(inode, args);
+        if (ret == 0 && copy_to_user(argp, args, sizeof(*args)))
+                ret = -EFAULT;
+        kfree(args);
+        return ret;
+}
+
+/*
+ * Search INODE_REFs to identify path name of 'dirid' directory
+ * in a 'tree_id' tree. and sets path name to 'name'.
+ */
+static noinline int btrfs_search_path_in_tree(struct btrfs_fs_info *info,
+                                u64 tree_id, u64 dirid, char *name)
+{
+        struct btrfs_root *root;
+        struct btrfs_key key;
+        char *ptr;
+        int ret = -1;
+        int slot;
+        int len;
+        int total_len = 0;
+        struct btrfs_inode_ref *iref;
+        struct extent_buffer *l;
+        struct btrfs_path *path;
+
+        if (dirid == BTRFS_FIRST_FREE_OBJECTID) {
+                name[0]='\0';
+                return 0;
+        }
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
+        ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX];
+
+        key.objectid = tree_id;
+        key.type = BTRFS_ROOT_ITEM_KEY;
+        key.offset = (u64)-1;
+        root = btrfs_read_fs_root_no_name(info, &key);
+        if (IS_ERR(root)) {
+                printk(KERN_ERR "could not find root %llu\n", tree_id);
+                ret = -ENOENT;
+                goto out;
+        }
+
+        key.objectid = dirid;
+        key.type = BTRFS_INODE_REF_KEY;
+        key.offset = (u64)-1;
+
+        while(1) {
+                ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+                if (ret < 0)
+                        goto out;
+
+                l = path->nodes[0];
+                slot = path->slots[0];
+                if (ret > 0 && slot > 0)
+                        slot--;
+                btrfs_item_key_to_cpu(l, &key, slot);
+
+                if (ret > 0 && (key.objectid != dirid ||
+                                key.type != BTRFS_INODE_REF_KEY)) {
+                        ret = -ENOENT;
+                        goto out;
+                }
+
+                iref = btrfs_item_ptr(l, slot, struct btrfs_inode_ref);
+                len = btrfs_inode_ref_name_len(l, iref);
+                ptr -= len + 1;
+                total_len += len + 1;
+                if (ptr < name)
+                        goto out;
+
+                *(ptr + len) = '/';
+                read_extent_buffer(l, ptr,(unsigned long)(iref + 1), len);
+
+                if (key.offset == BTRFS_FIRST_FREE_OBJECTID)
+                        break;
+
+                btrfs_release_path(root, path);
+                key.objectid = key.offset;
+                key.offset = (u64)-1;
+                dirid = key.objectid;
+
+        }
+        if (ptr < name)
+                goto out;
+        memcpy(name, ptr, total_len);
+        name[total_len]='\0';
+        ret = 0;
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
+static noinline int btrfs_ioctl_ino_lookup(struct file *file,
+                                           void __user *argp)
+{
+         struct btrfs_ioctl_ino_lookup_args *args;
+         struct inode *inode;
+         int ret;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        args = kmalloc(sizeof(*args), GFP_KERNEL);
+        if (!args)
+                return -ENOMEM;
+
+        if (copy_from_user(args, argp, sizeof(*args))) {
+                kfree(args);
+                return -EFAULT;
+        }
+        inode = fdentry(file)->d_inode;
+
+        if (args->treeid == 0)
+                args->treeid = BTRFS_I(inode)->root->root_key.objectid;
+
+        ret = btrfs_search_path_in_tree(BTRFS_I(inode)->root->fs_info,
+                                        args->treeid, args->objectid,
+                                        args->name);
+
+        if (ret == 0 && copy_to_user(argp, args, sizeof(*args)))
+                ret = -EFAULT;
+
+        kfree(args);
+        return ret;
+}
+
 static noinline int btrfs_ioctl_snap_destroy(struct file *file,
                                              void __user *arg)
 {
@@ -849,10 +1341,11 @@ out:
         return err;
 }
 
-static int btrfs_ioctl_defrag(struct file *file)
+static int btrfs_ioctl_defrag(struct file *file, void __user *argp)
 {
         struct inode *inode = fdentry(file)->d_inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct btrfs_ioctl_defrag_range_args *range;
         int ret;
 
         ret = mnt_want_write(file->f_path.mnt);
@@ -873,7 +1366,31 @@ static int btrfs_ioctl_defrag(struct file *file)
                         ret = -EINVAL;
                         goto out;
                 }
-                btrfs_defrag_file(file);
+
+                range = kzalloc(sizeof(*range), GFP_KERNEL);
+                if (!range) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+
+                if (argp) {
+                        if (copy_from_user(range, argp,
+                                           sizeof(*range))) {
+                                ret = -EFAULT;
+                                kfree(range);
+                                goto out;
+                        }
+                        /* compression requires us to start the IO */
+                        if ((range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
+                                range->flags |= BTRFS_DEFRAG_RANGE_START_IO;
+                                range->extent_thresh = (u32)-1;
+                        }
+                } else {
+                        /* the rest are all set to zero by kzalloc */
+                        range->len = (u64)-1;
+                }
+                btrfs_defrag_file(file, range);
+                kfree(range);
                 break;
         }
 out:
@@ -1274,6 +1791,157 @@ out:
         return ret;
 }
 
+static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
+{
+        struct inode *inode = fdentry(file)->d_inode;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct btrfs_root *new_root;
+        struct btrfs_dir_item *di;
+        struct btrfs_trans_handle *trans;
+        struct btrfs_path *path;
+        struct btrfs_key location;
+        struct btrfs_disk_key disk_key;
+        struct btrfs_super_block *disk_super;
+        u64 features;
+        u64 objectid = 0;
+        u64 dir_id;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        if (copy_from_user(&objectid, argp, sizeof(objectid)))
+                return -EFAULT;
+
+        if (!objectid)
+                objectid = root->root_key.objectid;
+
+        location.objectid = objectid;
+        location.type = BTRFS_ROOT_ITEM_KEY;
+        location.offset = (u64)-1;
+
+        new_root = btrfs_read_fs_root_no_name(root->fs_info, &location);
+        if (IS_ERR(new_root))
+                return PTR_ERR(new_root);
+
+        if (btrfs_root_refs(&new_root->root_item) == 0)
+                return -ENOENT;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+        path->leave_spinning = 1;
+
+        trans = btrfs_start_transaction(root, 1);
+        if (!trans) {
+                btrfs_free_path(path);
+                return -ENOMEM;
+        }
+
+        dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
+        di = btrfs_lookup_dir_item(trans, root->fs_info->tree_root, path,
+                                   dir_id, "default", 7, 1);
+        if (!di) {
+                btrfs_free_path(path);
+                btrfs_end_transaction(trans, root);
+                printk(KERN_ERR "Umm, you don't have the default dir item, "
+                       "this isn't going to work\n");
+                return -ENOENT;
+        }
+
+        btrfs_cpu_key_to_disk(&disk_key, &new_root->root_key);
+        btrfs_set_dir_item_key(path->nodes[0], di, &disk_key);
+        btrfs_mark_buffer_dirty(path->nodes[0]);
+        btrfs_free_path(path);
+
+        disk_super = &root->fs_info->super_copy;
+        features = btrfs_super_incompat_flags(disk_super);
+        if (!(features & BTRFS_FEATURE_INCOMPAT_DEFAULT_SUBVOL)) {
+                features |= BTRFS_FEATURE_INCOMPAT_DEFAULT_SUBVOL;
+                btrfs_set_super_incompat_flags(disk_super, features);
+        }
+        btrfs_end_transaction(trans, root);
+
+        return 0;
+}
+
+long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+{
+        struct btrfs_ioctl_space_args space_args;
+        struct btrfs_ioctl_space_info space;
+        struct btrfs_ioctl_space_info *dest;
+        struct btrfs_ioctl_space_info *dest_orig;
+        struct btrfs_ioctl_space_info *user_dest;
+        struct btrfs_space_info *info;
+        int alloc_size;
+        int ret = 0;
+        int slot_count = 0;
+
+        if (copy_from_user(&space_args,
+                           (struct btrfs_ioctl_space_args __user *)arg,
+                           sizeof(space_args)))
+                return -EFAULT;
+
+        /* first we count slots */
+        rcu_read_lock();
+        list_for_each_entry_rcu(info, &root->fs_info->space_info, list)
+                slot_count++;
+        rcu_read_unlock();
+
+        /* space_slots == 0 means they are asking for a count */
+        if (space_args.space_slots == 0) {
+                space_args.total_spaces = slot_count;
+                goto out;
+        }
+        alloc_size = sizeof(*dest) * slot_count;
+        /* we generally have at most 6 or so space infos, one for each raid
+         * level.  So, a whole page should be more than enough for everyone
+         */
+        if (alloc_size > PAGE_CACHE_SIZE)
+                return -ENOMEM;
+
+        space_args.total_spaces = 0;
+        dest = kmalloc(alloc_size, GFP_NOFS);
+        if (!dest)
+                return -ENOMEM;
+        dest_orig = dest;
+
+        /* now we have a buffer to copy into */
+        rcu_read_lock();
+        list_for_each_entry_rcu(info, &root->fs_info->space_info, list) {
+                /* make sure we don't copy more than we allocated
+                 * in our buffer
+                 */
+                if (slot_count == 0)
+                        break;
+                slot_count--;
+
+                /* make sure userland has enough room in their buffer */
+                if (space_args.total_spaces >= space_args.space_slots)
+                        break;
+
+                space.flags = info->flags;
+                space.total_bytes = info->total_bytes;
+                space.used_bytes = info->bytes_used;
+                memcpy(dest, &space, sizeof(space));
+                dest++;
+                space_args.total_spaces++;
+        }
+        rcu_read_unlock();
+
+        user_dest = (struct btrfs_ioctl_space_info *)
+                (arg + sizeof(struct btrfs_ioctl_space_args));
+
+        if (copy_to_user(user_dest, dest_orig, alloc_size))
+                ret = -EFAULT;
+
+        kfree(dest_orig);
+out:
+        if (ret == 0 && copy_to_user(arg, &space_args, sizeof(space_args)))
+                ret = -EFAULT;
+
+        return ret;
+}
+
 /*
  * there are many ways the trans_start and trans_end ioctls can lead
  * to deadlocks.  They should only be used by applications that
@@ -1320,8 +1988,12 @@ long btrfs_ioctl(struct file *file, unsigned int
                 return btrfs_ioctl_snap_create(file, argp, 1);
         case BTRFS_IOC_SNAP_DESTROY:
                 return btrfs_ioctl_snap_destroy(file, argp);
+        case BTRFS_IOC_DEFAULT_SUBVOL:
+                return btrfs_ioctl_default_subvol(file, argp);
         case BTRFS_IOC_DEFRAG:
-                return btrfs_ioctl_defrag(file);
+                return btrfs_ioctl_defrag(file, NULL);
+        case BTRFS_IOC_DEFRAG_RANGE:
+                return btrfs_ioctl_defrag(file, argp);
         case BTRFS_IOC_RESIZE:
                 return btrfs_ioctl_resize(root, argp);
         case BTRFS_IOC_ADD_DEV:
@@ -1338,6 +2010,12 @@ long btrfs_ioctl(struct file *file, unsigned int
                 return btrfs_ioctl_trans_start(file);
         case BTRFS_IOC_TRANS_END:
                 return btrfs_ioctl_trans_end(file);
+        case BTRFS_IOC_TREE_SEARCH:
+                return btrfs_ioctl_tree_search(file, argp);
+        case BTRFS_IOC_INO_LOOKUP:
+                return btrfs_ioctl_ino_lookup(file, argp);
+        case BTRFS_IOC_SPACE_INFO:
+                return btrfs_ioctl_space_info(root, argp);
         case BTRFS_IOC_SYNC:
                 btrfs_sync_fs(file->f_dentry->d_sb, 1);
                 return 0;
diff --git a/fs/btrfs/ioctl.h b/fs/btrfs/ioctl.h
index bc49914475eb..424694aa517f 100644
--- a/fs/btrfs/ioctl.h
+++ b/fs/btrfs/ioctl.h
@@ -30,12 +30,114 @@ struct btrfs_ioctl_vol_args {
         char name[BTRFS_PATH_NAME_MAX + 1];
 };
 
+#define BTRFS_INO_LOOKUP_PATH_MAX 4080
+struct btrfs_ioctl_ino_lookup_args {
+        __u64 treeid;
+        __u64 objectid;
+        char name[BTRFS_INO_LOOKUP_PATH_MAX];
+};
+
+struct btrfs_ioctl_search_key {
+        /* which root are we searching.  0 is the tree of tree roots */
+        __u64 tree_id;
+
+        /* keys returned will be >= min and <= max */
+        __u64 min_objectid;
+        __u64 max_objectid;
+
+        /* keys returned will be >= min and <= max */
+        __u64 min_offset;
+        __u64 max_offset;
+
+        /* max and min transids to search for */
+        __u64 min_transid;
+        __u64 max_transid;
+
+        /* keys returned will be >= min and <= max */
+        __u32 min_type;
+        __u32 max_type;
+
+        /*
+         * how many items did userland ask for, and how many are we
+         * returning
+         */
+        __u32 nr_items;
+
+        /* align to 64 bits */
+        __u32 unused;
+
+        /* some extra for later */
+        __u64 unused1;
+        __u64 unused2;
+        __u64 unused3;
+        __u64 unused4;
+};
+
+struct btrfs_ioctl_search_header {
+        __u64 transid;
+        __u64 objectid;
+        __u64 offset;
+        __u32 type;
+        __u32 len;
+};
+
+#define BTRFS_SEARCH_ARGS_BUFSIZE (4096 - sizeof(struct btrfs_ioctl_search_key))
+/*
+ * the buf is an array of search headers where
+ * each header is followed by the actual item
+ * the type field is expanded to 32 bits for alignment
+ */
+struct btrfs_ioctl_search_args {
+        struct btrfs_ioctl_search_key key;
+        char buf[BTRFS_SEARCH_ARGS_BUFSIZE];
+};
+
 struct btrfs_ioctl_clone_range_args {
   __s64 src_fd;
   __u64 src_offset, src_length;
   __u64 dest_offset;
 };
 
+/* flags for the defrag range ioctl */
+#define BTRFS_DEFRAG_RANGE_COMPRESS 1
+#define BTRFS_DEFRAG_RANGE_START_IO 2
+
+struct btrfs_ioctl_defrag_range_args {
+        /* start of the defrag operation */
+        __u64 start;
+
+        /* number of bytes to defrag, use (u64)-1 to say all */
+        __u64 len;
+
+        /*
+         * flags for the operation, which can include turning
+         * on compression for this one defrag
+         */
+        __u64 flags;
+
+        /*
+         * any extent bigger than this will be considered
+         * already defragged.  Use 0 to take the kernel default
+         * Use 1 to say every single extent must be rewritten
+         */
+        __u32 extent_thresh;
+
+        /* spare for later */
+        __u32 unused[5];
+};
+
+struct btrfs_ioctl_space_info {
+        __u64 flags;
+        __u64 total_bytes;
+        __u64 used_bytes;
+};
+
+struct btrfs_ioctl_space_args {
+        __u64 space_slots;
+        __u64 total_spaces;
+        struct btrfs_ioctl_space_info spaces[0];
+};
+
 #define BTRFS_IOC_SNAP_CREATE _IOW(BTRFS_IOCTL_MAGIC, 1, \
                                    struct btrfs_ioctl_vol_args)
 #define BTRFS_IOC_DEFRAG _IOW(BTRFS_IOCTL_MAGIC, 2, \
@@ -67,4 +169,13 @@ struct btrfs_ioctl_clone_range_args {
                                    struct btrfs_ioctl_vol_args)
 #define BTRFS_IOC_SNAP_DESTROY _IOW(BTRFS_IOCTL_MAGIC, 15, \
                                 struct btrfs_ioctl_vol_args)
+#define BTRFS_IOC_DEFRAG_RANGE _IOW(BTRFS_IOCTL_MAGIC, 16, \
+                                struct btrfs_ioctl_defrag_range_args)
+#define BTRFS_IOC_TREE_SEARCH _IOWR(BTRFS_IOCTL_MAGIC, 17, \
+                                   struct btrfs_ioctl_search_args)
+#define BTRFS_IOC_INO_LOOKUP _IOWR(BTRFS_IOCTL_MAGIC, 18, \
+                                   struct btrfs_ioctl_ino_lookup_args)
+#define BTRFS_IOC_DEFAULT_SUBVOL _IOW(BTRFS_IOCTL_MAGIC, 19, u64)
+#define BTRFS_IOC_SPACE_INFO _IOWR(BTRFS_IOCTL_MAGIC, 20, \
+                                    struct btrfs_ioctl_space_args)
 #endif
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 1c36e5cd8f55..6151f2ea38bb 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -16,7 +16,6 @@
  * Boston, MA 021110-1307, USA.
  */
 #include <linux/sched.h>
-#include <linux/gfp.h>
 #include <linux/pagemap.h>
 #include <linux/spinlock.h>
 #include <linux/page-flags.h>
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index b10a49d4bc6a..a127c0ebb2dc 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -16,7 +16,6 @@
  * Boston, MA 021110-1307, USA.
  */
 
-#include <linux/gfp.h>
 #include <linux/slab.h>
 #include <linux/blkdev.h>
 #include <linux/writeback.h>
@@ -174,7 +173,6 @@ int btrfs_add_ordered_extent(struct inode *inode, u64 file_offset,
         if (!entry)
                 return -ENOMEM;
 
-        mutex_lock(&tree->mutex);
         entry->file_offset = file_offset;
         entry->start = start;
         entry->len = len;
@@ -190,16 +188,17 @@ int btrfs_add_ordered_extent(struct inode *inode, u64 file_offset,
         INIT_LIST_HEAD(&entry->list);
         INIT_LIST_HEAD(&entry->root_extent_list);
 
+        spin_lock(&tree->lock);
         node = tree_insert(&tree->tree, file_offset,
                            &entry->rb_node);
         BUG_ON(node);
+        spin_unlock(&tree->lock);
 
         spin_lock(&BTRFS_I(inode)->root->fs_info->ordered_extent_lock);
         list_add_tail(&entry->root_extent_list,
                       &BTRFS_I(inode)->root->fs_info->ordered_extents);
         spin_unlock(&BTRFS_I(inode)->root->fs_info->ordered_extent_lock);
 
-        mutex_unlock(&tree->mutex);
         BUG_ON(node);
         return 0;
 }
@@ -216,9 +215,9 @@ int btrfs_add_ordered_sum(struct inode *inode,
         struct btrfs_ordered_inode_tree *tree;
 
         tree = &BTRFS_I(inode)->ordered_tree;
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         list_add_tail(&sum->list, &entry->list);
-        mutex_unlock(&tree->mutex);
+        spin_unlock(&tree->lock);
         return 0;
 }
 
@@ -232,15 +231,16 @@ int btrfs_add_ordered_sum(struct inode *inode,
  * to make sure this function only returns 1 once for a given ordered extent.
  */
 int btrfs_dec_test_ordered_pending(struct inode *inode,
+                                   struct btrfs_ordered_extent **cached,
                                    u64 file_offset, u64 io_size)
 {
         struct btrfs_ordered_inode_tree *tree;
         struct rb_node *node;
-        struct btrfs_ordered_extent *entry;
+        struct btrfs_ordered_extent *entry = NULL;
         int ret;
 
         tree = &BTRFS_I(inode)->ordered_tree;
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         node = tree_search(tree, file_offset);
         if (!node) {
                 ret = 1;
@@ -264,7 +264,11 @@ int btrfs_dec_test_ordered_pending(struct inode *inode,
         else
                 ret = 1;
 out:
-        mutex_unlock(&tree->mutex);
+        if (!ret && cached && entry) {
+                *cached = entry;
+                atomic_inc(&entry->refs);
+        }
+        spin_unlock(&tree->lock);
         return ret == 0;
 }
 
@@ -291,13 +295,14 @@ int btrfs_put_ordered_extent(struct btrfs_ordered_extent *entry)
 
 /*
  * remove an ordered extent from the tree.  No references are dropped
- * and you must wake_up entry->wait.  You must hold the tree mutex
+ * and you must wake_up entry->wait.  You must hold the tree lock
  * while you call this function.
  */
 static int __btrfs_remove_ordered_extent(struct inode *inode,
                                 struct btrfs_ordered_extent *entry)
 {
         struct btrfs_ordered_inode_tree *tree;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
         struct rb_node *node;
 
         tree = &BTRFS_I(inode)->ordered_tree;
@@ -307,12 +312,13 @@ static int __btrfs_remove_ordered_extent(struct inode *inode,
         set_bit(BTRFS_ORDERED_COMPLETE, &entry->flags);
 
         spin_lock(&BTRFS_I(inode)->accounting_lock);
+        WARN_ON(!BTRFS_I(inode)->outstanding_extents);
         BTRFS_I(inode)->outstanding_extents--;
         spin_unlock(&BTRFS_I(inode)->accounting_lock);
         btrfs_unreserve_metadata_for_delalloc(BTRFS_I(inode)->root,
                                               inode, 1);
 
-        spin_lock(&BTRFS_I(inode)->root->fs_info->ordered_extent_lock);
+        spin_lock(&root->fs_info->ordered_extent_lock);
         list_del_init(&entry->root_extent_list);
 
         /*
@@ -324,7 +330,7 @@ static int __btrfs_remove_ordered_extent(struct inode *inode,
             !mapping_tagged(inode->i_mapping, PAGECACHE_TAG_DIRTY)) {
                 list_del_init(&BTRFS_I(inode)->ordered_operations);
         }
-        spin_unlock(&BTRFS_I(inode)->root->fs_info->ordered_extent_lock);
+        spin_unlock(&root->fs_info->ordered_extent_lock);
 
         return 0;
 }
@@ -340,9 +346,9 @@ int btrfs_remove_ordered_extent(struct inode *inode,
         int ret;
 
         tree = &BTRFS_I(inode)->ordered_tree;
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         ret = __btrfs_remove_ordered_extent(inode, entry);
-        mutex_unlock(&tree->mutex);
+        spin_unlock(&tree->lock);
         wake_up(&entry->wait);
 
         return ret;
@@ -567,7 +573,7 @@ struct btrfs_ordered_extent *btrfs_lookup_ordered_extent(struct inode *inode,
         struct btrfs_ordered_extent *entry = NULL;
 
         tree = &BTRFS_I(inode)->ordered_tree;
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         node = tree_search(tree, file_offset);
         if (!node)
                 goto out;
@@ -578,7 +584,7 @@ struct btrfs_ordered_extent *btrfs_lookup_ordered_extent(struct inode *inode,
         if (entry)
                 atomic_inc(&entry->refs);
 out:
-        mutex_unlock(&tree->mutex);
+        spin_unlock(&tree->lock);
         return entry;
 }
 
@@ -594,7 +600,7 @@ btrfs_lookup_first_ordered_extent(struct inode *inode, u64 file_offset)
         struct btrfs_ordered_extent *entry = NULL;
 
         tree = &BTRFS_I(inode)->ordered_tree;
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         node = tree_search(tree, file_offset);
         if (!node)
                 goto out;
@@ -602,7 +608,7 @@ btrfs_lookup_first_ordered_extent(struct inode *inode, u64 file_offset)
         entry = rb_entry(node, struct btrfs_ordered_extent, rb_node);
         atomic_inc(&entry->refs);
 out:
-        mutex_unlock(&tree->mutex);
+        spin_unlock(&tree->lock);
         return entry;
 }
 
@@ -626,8 +632,10 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
 
         if (ordered)
                 offset = entry_end(ordered);
+        else
+                offset = ALIGN(offset, BTRFS_I(inode)->root->sectorsize);
 
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         disk_i_size = BTRFS_I(inode)->disk_i_size;
 
         /* truncate file */
@@ -733,7 +741,7 @@ out:
          */
         if (ordered)
                 __btrfs_remove_ordered_extent(inode, ordered);
-        mutex_unlock(&tree->mutex);
+        spin_unlock(&tree->lock);
         if (ordered)
                 wake_up(&ordered->wait);
         return ret;
@@ -760,7 +768,7 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
         if (!ordered)
                 return 1;
 
-        mutex_lock(&tree->mutex);
+        spin_lock(&tree->lock);
         list_for_each_entry_reverse(ordered_sum, &ordered->list, list) {
                 if (disk_bytenr >= ordered_sum->bytenr) {
                         num_sectors = ordered_sum->len / sectorsize;
@@ -775,7 +783,7 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
                 }
         }
 out:
-        mutex_unlock(&tree->mutex);
+        spin_unlock(&tree->lock);
         btrfs_put_ordered_extent(ordered);
         return ret;
 }
diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
index 1fe1282ef47c..c82f76a9f040 100644
--- a/fs/btrfs/ordered-data.h
+++ b/fs/btrfs/ordered-data.h
@@ -21,7 +21,7 @@
 
 /* one of these per inode */
 struct btrfs_ordered_inode_tree {
-        struct mutex mutex;
+        spinlock_t lock;
         struct rb_root tree;
         struct rb_node *last;
 };
@@ -128,8 +128,8 @@ static inline int btrfs_ordered_sum_size(struct btrfs_root *root,
 static inline void
 btrfs_ordered_inode_tree_init(struct btrfs_ordered_inode_tree *t)
 {
-        mutex_init(&t->mutex);
-        t->tree.rb_node = NULL;
+        spin_lock_init(&t->lock);
+        t->tree = RB_ROOT;
         t->last = NULL;
 }
 
@@ -137,7 +137,8 @@ int btrfs_put_ordered_extent(struct btrfs_ordered_extent *entry);
 int btrfs_remove_ordered_extent(struct inode *inode,
                                 struct btrfs_ordered_extent *entry);
 int btrfs_dec_test_ordered_pending(struct inode *inode,
-                                       u64 file_offset, u64 io_size);
+                                   struct btrfs_ordered_extent **cached,
+                                   u64 file_offset, u64 io_size);
 int btrfs_add_ordered_extent(struct inode *inode, u64 file_offset,
                              u64 start, u64 len, u64 disk_len, int tyep);
 int btrfs_add_ordered_sum(struct inode *inode,
diff --git a/fs/btrfs/ref-cache.c b/fs/btrfs/ref-cache.c
index d0cc62bccb94..a97314cf6bd6 100644
--- a/fs/btrfs/ref-cache.c
+++ b/fs/btrfs/ref-cache.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/sort.h>
 #include "ctree.h"
 #include "ref-cache.h"
diff --git a/fs/btrfs/ref-cache.h b/fs/btrfs/ref-cache.h
index bc283ad2db73..e2a55cb2072b 100644
--- a/fs/btrfs/ref-cache.h
+++ b/fs/btrfs/ref-cache.h
@@ -52,7 +52,7 @@ static inline size_t btrfs_leaf_ref_size(int nr_extents)
 
 static inline void btrfs_leaf_ref_tree_init(struct btrfs_leaf_ref_tree *tree)
 {
-        tree->root.rb_node = NULL;
+        tree->root = RB_ROOT;
         INIT_LIST_HEAD(&tree->list);
         spin_lock_init(&tree->lock);
 }
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index a9728680eca8..e558dd941ded 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -21,6 +21,7 @@
 #include <linux/writeback.h>
 #include <linux/blkdev.h>
 #include <linux/rbtree.h>
+#include <linux/slab.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "transaction.h"
@@ -170,14 +171,14 @@ struct async_merge {
 
 static void mapping_tree_init(struct mapping_tree *tree)
 {
-        tree->rb_root.rb_node = NULL;
+        tree->rb_root = RB_ROOT;
         spin_lock_init(&tree->lock);
 }
 
 static void backref_cache_init(struct backref_cache *cache)
 {
         int i;
-        cache->rb_root.rb_node = NULL;
+        cache->rb_root = RB_ROOT;
         for (i = 0; i < BTRFS_MAX_LEVEL; i++)
                 INIT_LIST_HEAD(&cache->pending[i]);
         spin_lock_init(&cache->lock);
@@ -2659,7 +2660,7 @@ static int relocate_file_extent_cluster(struct inode *inode,
                                         EXTENT_BOUNDARY, GFP_NOFS);
                         nr++;
                 }
-                btrfs_set_extent_delalloc(inode, page_start, page_end);
+                btrfs_set_extent_delalloc(inode, page_start, page_end, NULL);
 
                 set_page_dirty(page);
                 dirty_page++;
@@ -3281,8 +3282,10 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
                 return -ENOMEM;
 
         path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
+                kfree(cluster);
                 return -ENOMEM;
+        }
 
         rc->extents_found = 0;
         rc->extents_skipped = 0;
@@ -3485,7 +3488,7 @@ static struct inode *create_reloc_inode(struct btrfs_fs_info *fs_info,
         key.objectid = objectid;
         key.type = BTRFS_INODE_ITEM_KEY;
         key.offset = 0;
-        inode = btrfs_iget(root->fs_info->sb, &key, root);
+        inode = btrfs_iget(root->fs_info->sb, &key, root, NULL);
         BUG_ON(IS_ERR(inode) || is_bad_inode(inode));
         BTRFS_I(inode)->index_cnt = group->key.objectid;
 
@@ -3762,7 +3765,8 @@ out:
                                        BTRFS_DATA_RELOC_TREE_OBJECTID);
                 if (IS_ERR(fs_root))
                         err = PTR_ERR(fs_root);
-                btrfs_orphan_cleanup(fs_root);
+                else
+                        btrfs_orphan_cleanup(fs_root);
         }
         return err;
 }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 3f9b45704fcd..1866dff0538e 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -38,6 +38,7 @@
 #include <linux/namei.h>
 #include <linux/miscdevice.h>
 #include <linux/magic.h>
+#include <linux/slab.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -63,25 +64,26 @@ static void btrfs_put_super(struct super_block *sb)
 }
 
 enum {
-        Opt_degraded, Opt_subvol, Opt_device, Opt_nodatasum, Opt_nodatacow,
-        Opt_max_extent, Opt_max_inline, Opt_alloc_start, Opt_nobarrier,
-        Opt_ssd, Opt_nossd, Opt_ssd_spread, Opt_thread_pool, Opt_noacl,
-        Opt_compress, Opt_notreelog, Opt_ratio, Opt_flushoncommit,
+        Opt_degraded, Opt_subvol, Opt_subvolid, Opt_device, Opt_nodatasum,
+        Opt_nodatacow, Opt_max_inline, Opt_alloc_start, Opt_nobarrier, Opt_ssd,
+        Opt_nossd, Opt_ssd_spread, Opt_thread_pool, Opt_noacl, Opt_compress,
+        Opt_compress_force, Opt_notreelog, Opt_ratio, Opt_flushoncommit,
         Opt_discard, Opt_err,
 };
 
 static match_table_t tokens = {
         {Opt_degraded, "degraded"},
         {Opt_subvol, "subvol=%s"},
+        {Opt_subvolid, "subvolid=%d"},
         {Opt_device, "device=%s"},
         {Opt_nodatasum, "nodatasum"},
         {Opt_nodatacow, "nodatacow"},
         {Opt_nobarrier, "nobarrier"},
-        {Opt_max_extent, "max_extent=%s"},
         {Opt_max_inline, "max_inline=%s"},
         {Opt_alloc_start, "alloc_start=%s"},
         {Opt_thread_pool, "thread_pool=%d"},
         {Opt_compress, "compress"},
+        {Opt_compress_force, "compress-force"},
         {Opt_ssd, "ssd"},
         {Opt_ssd_spread, "ssd_spread"},
         {Opt_nossd, "nossd"},
@@ -93,31 +95,6 @@ static match_table_t tokens = {
         {Opt_err, NULL},
 };
 
-u64 btrfs_parse_size(char *str)
-{
-        u64 res;
-        int mult = 1;
-        char *end;
-        char last;
-
-        res = simple_strtoul(str, &end, 10);
-
-        last = end[0];
-        if (isalpha(last)) {
-                last = tolower(last);
-                switch (last) {
-                case 'g':
-                        mult *= 1024;
-                case 'm':
-                        mult *= 1024;
-                case 'k':
-                        mult *= 1024;
-                }
-                res = res * mult;
-        }
-        return res;
-}
-
 /*
  * Regular mount options parser.  Everything that is needed only when
  * reading in a new superblock is parsed here.
@@ -126,7 +103,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
 {
         struct btrfs_fs_info *info = root->fs_info;
         substring_t args[MAX_OPT_ARGS];
-        char *p, *num;
+        char *p, *num, *orig;
         int intarg;
         int ret = 0;
 
@@ -141,6 +118,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
         if (!options)
                 return -ENOMEM;
 
+        orig = options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -154,6 +132,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                         btrfs_set_opt(info->mount_opt, DEGRADED);
                         break;
                 case Opt_subvol:
+                case Opt_subvolid:
                 case Opt_device:
                         /*
                          * These are parsed by btrfs_parse_early_options
@@ -173,6 +152,11 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                         printk(KERN_INFO "btrfs: use compression\n");
                         btrfs_set_opt(info->mount_opt, COMPRESS);
                         break;
+                case Opt_compress_force:
+                        printk(KERN_INFO "btrfs: forcing compression\n");
+                        btrfs_set_opt(info->mount_opt, FORCE_COMPRESS);
+                        btrfs_set_opt(info->mount_opt, COMPRESS);
+                        break;
                 case Opt_ssd:
                         printk(KERN_INFO "btrfs: use ssd allocation scheme\n");
                         btrfs_set_opt(info->mount_opt, SSD);
@@ -203,22 +187,10 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                                        info->thread_pool_size);
                         }
                         break;
-                case Opt_max_extent:
-                        num = match_strdup(&args[0]);
-                        if (num) {
-                                info->max_extent = btrfs_parse_size(num);
-                                kfree(num);
-
-                                info->max_extent = max_t(u64,
-                                        info->max_extent, root->sectorsize);
-                                printk(KERN_INFO "btrfs: max_extent at %llu\n",
-                                       (unsigned long long)info->max_extent);
-                        }
-                        break;
                 case Opt_max_inline:
                         num = match_strdup(&args[0]);
                         if (num) {
-                                info->max_inline = btrfs_parse_size(num);
+                                info->max_inline = memparse(num, NULL);
                                 kfree(num);
 
                                 if (info->max_inline) {
@@ -233,7 +205,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                 case Opt_alloc_start:
                         num = match_strdup(&args[0]);
                         if (num) {
-                                info->alloc_start = btrfs_parse_size(num);
+                                info->alloc_start = memparse(num, NULL);
                                 kfree(num);
                                 printk(KERN_INFO
                                         "btrfs: allocations start at %llu\n",
@@ -273,7 +245,7 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                 }
         }
 out:
-        kfree(options);
+        kfree(orig);
         return ret;
 }
 
@@ -284,12 +256,13 @@ out:
  * only when we need to allocate a new super block.
  */
 static int btrfs_parse_early_options(const char *options, fmode_t flags,
-                void *holder, char **subvol_name,
+                void *holder, char **subvol_name, u64 *subvol_objectid,
                 struct btrfs_fs_devices **fs_devices)
 {
         substring_t args[MAX_OPT_ARGS];
         char *opts, *p;
         int error = 0;
+        int intarg;
 
         if (!options)
                 goto out;
@@ -312,6 +285,18 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
                 case Opt_subvol:
                         *subvol_name = match_strdup(&args[0]);
                         break;
+                case Opt_subvolid:
+                        intarg = 0;
+                        error = match_int(&args[0], &intarg);
+                        if (!error) {
+                                /* we want the original fs_tree */
+                                if (!intarg)
+                                        *subvol_objectid =
+                                                BTRFS_FS_TREE_OBJECTID;
+                                else
+                                        *subvol_objectid = intarg;
+                        }
+                        break;
                 case Opt_device:
                         error = btrfs_scan_one_device(match_strdup(&args[0]),
                                         flags, holder, fs_devices);
@@ -339,6 +324,110 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
         return error;
 }
 
+static struct dentry *get_default_root(struct super_block *sb,
+                                       u64 subvol_objectid)
+{
+        struct btrfs_root *root = sb->s_fs_info;
+        struct btrfs_root *new_root;
+        struct btrfs_dir_item *di;
+        struct btrfs_path *path;
+        struct btrfs_key location;
+        struct inode *inode;
+        struct dentry *dentry;
+        u64 dir_id;
+        int new = 0;
+
+        /*
+         * We have a specific subvol we want to mount, just setup location and
+         * go look up the root.
+         */
+        if (subvol_objectid) {
+                location.objectid = subvol_objectid;
+                location.type = BTRFS_ROOT_ITEM_KEY;
+                location.offset = (u64)-1;
+                goto find_root;
+        }
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return ERR_PTR(-ENOMEM);
+        path->leave_spinning = 1;
+
+        /*
+         * Find the "default" dir item which points to the root item that we
+         * will mount by default if we haven't been given a specific subvolume
+         * to mount.
+         */
+        dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
+        di = btrfs_lookup_dir_item(NULL, root, path, dir_id, "default", 7, 0);
+        if (!di) {
+                /*
+                 * Ok the default dir item isn't there.  This is weird since
+                 * it's always been there, but don't freak out, just try and
+                 * mount to root most subvolume.
+                 */
+                btrfs_free_path(path);
+                dir_id = BTRFS_FIRST_FREE_OBJECTID;
+                new_root = root->fs_info->fs_root;
+                goto setup_root;
+        }
+
+        btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
+        btrfs_free_path(path);
+
+find_root:
+        new_root = btrfs_read_fs_root_no_name(root->fs_info, &location);
+        if (IS_ERR(new_root))
+                return ERR_PTR(PTR_ERR(new_root));
+
+        if (btrfs_root_refs(&new_root->root_item) == 0)
+                return ERR_PTR(-ENOENT);
+
+        dir_id = btrfs_root_dirid(&new_root->root_item);
+setup_root:
+        location.objectid = dir_id;
+        location.type = BTRFS_INODE_ITEM_KEY;
+        location.offset = 0;
+
+        inode = btrfs_iget(sb, &location, new_root, &new);
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+
+        /*
+         * If we're just mounting the root most subvol put the inode and return
+         * a reference to the dentry.  We will have already gotten a reference
+         * to the inode in btrfs_fill_super so we're good to go.
+         */
+        if (!new && sb->s_root->d_inode == inode) {
+                iput(inode);
+                return dget(sb->s_root);
+        }
+
+        if (new) {
+                const struct qstr name = { .name = "/", .len = 1 };
+
+                /*
+                 * New inode, we need to make the dentry a sibling of s_root so
+                 * everything gets cleaned up properly on unmount.
+                 */
+                dentry = d_alloc(sb->s_root, &name);
+                if (!dentry) {
+                        iput(inode);
+                        return ERR_PTR(-ENOMEM);
+                }
+                d_splice_alias(inode, dentry);
+        } else {
+                /*
+                 * We found the inode in cache, just find a dentry for it and
+                 * put the reference to the inode we just got.
+                 */
+                dentry = d_find_alias(inode);
+                iput(inode);
+        }
+
+        return dentry;
+}
+
 static int btrfs_fill_super(struct super_block *sb,
                             struct btrfs_fs_devices *fs_devices,
                             void *data, int silent)
@@ -372,7 +461,7 @@ static int btrfs_fill_super(struct super_block *sb,
         key.objectid = BTRFS_FIRST_FREE_OBJECTID;
         key.type = BTRFS_INODE_ITEM_KEY;
         key.offset = 0;
-        inode = btrfs_iget(sb, &key, tree_root->fs_info->fs_root);
+        inode = btrfs_iget(sb, &key, tree_root->fs_info->fs_root, NULL);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 goto fail_close;
@@ -384,12 +473,6 @@ static int btrfs_fill_super(struct super_block *sb,
                 err = -ENOMEM;
                 goto fail_close;
         }
-#if 0
-        /* this does the super kobj at the same time */
-        err = btrfs_sysfs_add_super(tree_root->fs_info);
-        if (err)
-                goto fail_close;
-#endif
 
         sb->s_root = root_dentry;
 
@@ -433,9 +516,6 @@ static int btrfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_puts(seq, ",nodatacow");
         if (btrfs_test_opt(root, NOBARRIER))
                 seq_puts(seq, ",nobarrier");
-        if (info->max_extent != (u64)-1)
-                seq_printf(seq, ",max_extent=%llu",
-                           (unsigned long long)info->max_extent);
         if (info->max_inline != 8192 * 1024)
                 seq_printf(seq, ",max_inline=%llu",
                            (unsigned long long)info->max_inline);
@@ -481,19 +561,22 @@ static int btrfs_test_super(struct super_block *s, void *data)
 static int btrfs_get_sb(struct file_system_type *fs_type, int flags,
                 const char *dev_name, void *data, struct vfsmount *mnt)
 {
-        char *subvol_name = NULL;
         struct block_device *bdev = NULL;
         struct super_block *s;
         struct dentry *root;
         struct btrfs_fs_devices *fs_devices = NULL;
         fmode_t mode = FMODE_READ;
+        char *subvol_name = NULL;
+        u64 subvol_objectid = 0;
         int error = 0;
+        int found = 0;
 
         if (!(flags & MS_RDONLY))
                 mode |= FMODE_WRITE;
 
         error = btrfs_parse_early_options(data, mode, fs_type,
-                                          &subvol_name, &fs_devices);
+                                          &subvol_name, &subvol_objectid,
+                                          &fs_devices);
         if (error)
                 return error;
 
@@ -522,6 +605,7 @@ static int btrfs_get_sb(struct file_system_type *fs_type, int flags,
                         goto error_close_devices;
                 }
 
+                found = 1;
                 btrfs_close_devices(fs_devices);
         } else {
                 char b[BDEVNAME_SIZE];
@@ -539,25 +623,35 @@ static int btrfs_get_sb(struct file_system_type *fs_type, int flags,
                 s->s_flags |= MS_ACTIVE;
         }
 
-        if (!strcmp(subvol_name, "."))
-                root = dget(s->s_root);
-        else {
-                mutex_lock(&s->s_root->d_inode->i_mutex);
-                root = lookup_one_len(subvol_name, s->s_root,
+        root = get_default_root(s, subvol_objectid);
+        if (IS_ERR(root)) {
+                error = PTR_ERR(root);
+                deactivate_locked_super(s);
+                goto error;
+        }
+        /* if they gave us a subvolume name bind mount into that */
+        if (strcmp(subvol_name, ".")) {
+                struct dentry *new_root;
+                mutex_lock(&root->d_inode->i_mutex);
+                new_root = lookup_one_len(subvol_name, root,
                                       strlen(subvol_name));
-                mutex_unlock(&s->s_root->d_inode->i_mutex);
+                mutex_unlock(&root->d_inode->i_mutex);
 
-                if (IS_ERR(root)) {
+                if (IS_ERR(new_root)) {
                         deactivate_locked_super(s);
-                        error = PTR_ERR(root);
-                        goto error_free_subvol_name;
+                        error = PTR_ERR(new_root);
+                        dput(root);
+                        goto error_close_devices;
                 }
-                if (!root->d_inode) {
+                if (!new_root->d_inode) {
                         dput(root);
+                        dput(new_root);
                         deactivate_locked_super(s);
                         error = -ENXIO;
-                        goto error_free_subvol_name;
+                        goto error_close_devices;
                 }
+                dput(root);
+                root = new_root;
         }
 
         mnt->mnt_sb = s;
@@ -572,6 +666,7 @@ error_close_devices:
         btrfs_close_devices(fs_devices);
 error_free_subvol_name:
         kfree(subvol_name);
+error:
         return error;
 }
 
@@ -616,14 +711,37 @@ static int btrfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
         struct btrfs_root *root = btrfs_sb(dentry->d_sb);
         struct btrfs_super_block *disk_super = &root->fs_info->super_copy;
+        struct list_head *head = &root->fs_info->space_info;
+        struct btrfs_space_info *found;
+        u64 total_used = 0;
+        u64 data_used = 0;
         int bits = dentry->d_sb->s_blocksize_bits;
         __be32 *fsid = (__be32 *)root->fs_info->fsid;
 
+        rcu_read_lock();
+        list_for_each_entry_rcu(found, head, list) {
+                if (found->flags & (BTRFS_BLOCK_GROUP_DUP|
+                                    BTRFS_BLOCK_GROUP_RAID10|
+                                    BTRFS_BLOCK_GROUP_RAID1)) {
+                        total_used += found->bytes_used;
+                        if (found->flags & BTRFS_BLOCK_GROUP_DATA)
+                                data_used += found->bytes_used;
+                        else
+                                data_used += found->total_bytes;
+                }
+
+                total_used += found->bytes_used;
+                if (found->flags & BTRFS_BLOCK_GROUP_DATA)
+                        data_used += found->bytes_used;
+                else
+                        data_used += found->total_bytes;
+        }
+        rcu_read_unlock();
+
         buf->f_namelen = BTRFS_NAME_LEN;
         buf->f_blocks = btrfs_super_total_bytes(disk_super) >> bits;
-        buf->f_bfree = buf->f_blocks -
-                (btrfs_super_bytes_used(disk_super) >> bits);
-        buf->f_bavail = buf->f_bfree;
+        buf->f_bfree = buf->f_blocks - (total_used >> bits);
+        buf->f_bavail = buf->f_blocks - (data_used >> bits);
         buf->f_bsize = dentry->d_sb->s_blocksize;
         buf->f_type = BTRFS_SUPER_MAGIC;
 
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index a240b6fa81df..4ce16ef702a3 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -164,12 +164,12 @@ static void btrfs_root_release(struct kobject *kobj)
         complete(&root->kobj_unregister);
 }
 
-static struct sysfs_ops btrfs_super_attr_ops = {
+static const struct sysfs_ops btrfs_super_attr_ops = {
         .show   = btrfs_super_attr_show,
         .store  = btrfs_super_attr_store,
 };
 
-static struct sysfs_ops btrfs_root_attr_ops = {
+static const struct sysfs_ops btrfs_root_attr_ops = {
         .show   = btrfs_root_attr_show,
         .store  = btrfs_root_attr_store,
 };
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index b2acc79f1b34..2cb116099b90 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/writeback.h>
 #include <linux/pagemap.h>
@@ -69,7 +70,7 @@ static noinline int join_transaction(struct btrfs_root *root)
                 cur_trans->commit_done = 0;
                 cur_trans->start_time = get_seconds();
 
-                cur_trans->delayed_refs.root.rb_node = NULL;
+                cur_trans->delayed_refs.root = RB_ROOT;
                 cur_trans->delayed_refs.num_entries = 0;
                 cur_trans->delayed_refs.num_heads_ready = 0;
                 cur_trans->delayed_refs.num_heads = 0;
@@ -147,18 +148,13 @@ static void wait_current_trans(struct btrfs_root *root)
                 while (1) {
                         prepare_to_wait(&root->fs_info->transaction_wait, &wait,
                                         TASK_UNINTERRUPTIBLE);
-                        if (cur_trans->blocked) {
-                                mutex_unlock(&root->fs_info->trans_mutex);
-                                schedule();
-                                mutex_lock(&root->fs_info->trans_mutex);
-                                finish_wait(&root->fs_info->transaction_wait,
-                                            &wait);
-                        } else {
-                                finish_wait(&root->fs_info->transaction_wait,
-                                            &wait);
+                        if (!cur_trans->blocked)
                                 break;
-                        }
+                        mutex_unlock(&root->fs_info->trans_mutex);
+                        schedule();
+                        mutex_lock(&root->fs_info->trans_mutex);
                 }
+                finish_wait(&root->fs_info->transaction_wait, &wait);
                 put_transaction(cur_trans);
         }
 }
@@ -760,10 +756,17 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         struct btrfs_root_item *new_root_item;
         struct btrfs_root *tree_root = fs_info->tree_root;
         struct btrfs_root *root = pending->root;
+        struct btrfs_root *parent_root;
+        struct inode *parent_inode;
         struct extent_buffer *tmp;
         struct extent_buffer *old;
         int ret;
         u64 objectid;
+        int namelen;
+        u64 index = 0;
+
+        parent_inode = pending->dentry->d_parent->d_inode;
+        parent_root = BTRFS_I(parent_inode)->root;
 
         new_root_item = kmalloc(sizeof(*new_root_item), GFP_NOFS);
         if (!new_root_item) {
@@ -774,79 +777,59 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
         if (ret)
                 goto fail;
 
-        record_root_in_trans(trans, root);
-        btrfs_set_root_last_snapshot(&root->root_item, trans->transid);
-        memcpy(new_root_item, &root->root_item, sizeof(*new_root_item));
-
         key.objectid = objectid;
         /* record when the snapshot was created in key.offset */
         key.offset = trans->transid;
         btrfs_set_key_type(&key, BTRFS_ROOT_ITEM_KEY);
 
-        old = btrfs_lock_root_node(root);
-        btrfs_cow_block(trans, root, old, NULL, 0, &old);
-        btrfs_set_lock_blocking(old);
-
-        btrfs_copy_root(trans, root, old, &tmp, objectid);
-        btrfs_tree_unlock(old);
-        free_extent_buffer(old);
-
-        btrfs_set_root_node(new_root_item, tmp);
-        ret = btrfs_insert_root(trans, root->fs_info->tree_root, &key,
-                                new_root_item);
-        btrfs_tree_unlock(tmp);
-        free_extent_buffer(tmp);
-        if (ret)
-                goto fail;
-
-        key.offset = (u64)-1;
         memcpy(&pending->root_key, &key, sizeof(key));
-fail:
-        kfree(new_root_item);
-        return ret;
-}
-
-static noinline int finish_pending_snapshot(struct btrfs_fs_info *fs_info,
-                                   struct btrfs_pending_snapshot *pending)
-{
-        int ret;
-        int namelen;
-        u64 index = 0;
-        struct btrfs_trans_handle *trans;
-        struct inode *parent_inode;
-        struct btrfs_root *parent_root;
-
-        parent_inode = pending->dentry->d_parent->d_inode;
-        parent_root = BTRFS_I(parent_inode)->root;
-        trans = btrfs_join_transaction(parent_root, 1);
+        pending->root_key.offset = (u64)-1;
 
+        record_root_in_trans(trans, parent_root);
         /*
          * insert the directory item
          */
         namelen = strlen(pending->name);
         ret = btrfs_set_inode_index(parent_inode, &index);
+        BUG_ON(ret);
         ret = btrfs_insert_dir_item(trans, parent_root,
                             pending->name, namelen,
                             parent_inode->i_ino,
                             &pending->root_key, BTRFS_FT_DIR, index);
-
-        if (ret)
-                goto fail;
+        BUG_ON(ret);
 
         btrfs_i_size_write(parent_inode, parent_inode->i_size + namelen * 2);
         ret = btrfs_update_inode(trans, parent_root, parent_inode);
         BUG_ON(ret);
 
+        record_root_in_trans(trans, root);
+        btrfs_set_root_last_snapshot(&root->root_item, trans->transid);
+        memcpy(new_root_item, &root->root_item, sizeof(*new_root_item));
+
+        old = btrfs_lock_root_node(root);
+        btrfs_cow_block(trans, root, old, NULL, 0, &old);
+        btrfs_set_lock_blocking(old);
+
+        btrfs_copy_root(trans, root, old, &tmp, objectid);
+        btrfs_tree_unlock(old);
+        free_extent_buffer(old);
+
+        btrfs_set_root_node(new_root_item, tmp);
+        ret = btrfs_insert_root(trans, root->fs_info->tree_root, &key,
+                                new_root_item);
+        BUG_ON(ret);
+        btrfs_tree_unlock(tmp);
+        free_extent_buffer(tmp);
+
         ret = btrfs_add_root_ref(trans, parent_root->fs_info->tree_root,
                                  pending->root_key.objectid,
                                  parent_root->root_key.objectid,
                                  parent_inode->i_ino, index, pending->name,
                                  namelen);
-
         BUG_ON(ret);
 
 fail:
-        btrfs_end_transaction(trans, fs_info->fs_root);
+        kfree(new_root_item);
         return ret;
 }
 
@@ -867,25 +850,6 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
         return 0;
 }
 
-static noinline int finish_pending_snapshots(struct btrfs_trans_handle *trans,
-                                             struct btrfs_fs_info *fs_info)
-{
-        struct btrfs_pending_snapshot *pending;
-        struct list_head *head = &trans->transaction->pending_snapshots;
-        int ret;
-
-        while (!list_empty(head)) {
-                pending = list_entry(head->next,
-                                     struct btrfs_pending_snapshot, list);
-                ret = finish_pending_snapshot(fs_info, pending);
-                BUG_ON(ret);
-                list_del(&pending->list);
-                kfree(pending->name);
-                kfree(pending);
-        }
-        return 0;
-}
-
 static void update_super_roots(struct btrfs_root *root)
 {
         struct btrfs_root_item *root_item;
@@ -997,13 +961,10 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
                 mutex_unlock(&root->fs_info->trans_mutex);
 
-                if (flush_on_commit) {
+                if (flush_on_commit || snap_pending) {
                         btrfs_start_delalloc_inodes(root, 1);
                         ret = btrfs_wait_ordered_extents(root, 0, 1);
                         BUG_ON(ret);
-                } else if (snap_pending) {
-                        ret = btrfs_wait_ordered_extents(root, 0, 1);
-                        BUG_ON(ret);
                 }
 
                 /*
@@ -1100,9 +1061,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         btrfs_finish_extent_commit(trans, root);
 
-        /* do the directory inserts of any pending snapshot creations */
-        finish_pending_snapshots(trans, root->fs_info);
-
         mutex_lock(&root->fs_info->trans_mutex);
 
         cur_trans->commit_done = 1;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 4a9434b622ec..af57dd2b43d4 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "ctree.h"
 #include "transaction.h"
 #include "disk-io.h"
@@ -445,7 +446,7 @@ static noinline struct inode *read_one_inode(struct btrfs_root *root,
         key.objectid = objectid;
         key.type = BTRFS_INODE_ITEM_KEY;
         key.offset = 0;
-        inode = btrfs_iget(root->fs_info->sb, &key, root);
+        inode = btrfs_iget(root->fs_info->sb, &key, root, NULL);
         if (IS_ERR(inode)) {
                 inode = NULL;
         } else if (is_bad_inode(inode)) {
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 198cff28766d..8db7b14bbae8 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -17,6 +17,7 @@
  */
 #include <linux/sched.h>
 #include <linux/bio.h>
+#include <linux/slab.h>
 #include <linux/buffer_head.h>
 #include <linux/blkdev.h>
 #include <linux/random.h>
@@ -256,13 +257,13 @@ loop_lock:
                         wake_up(&fs_info->async_submit_wait);
 
                 BUG_ON(atomic_read(&cur->bi_cnt) == 0);
-                submit_bio(cur->bi_rw, cur);
-                num_run++;
-                batch_run++;
 
                 if (bio_rw_flagged(cur, BIO_RW_SYNCIO))
                         num_sync_run++;
 
+                submit_bio(cur->bi_rw, cur);
+                num_run++;
+                batch_run++;
                 if (need_resched()) {
                         if (num_sync_run) {
                                 blk_run_backing_dev(bdi, NULL);
@@ -325,16 +326,6 @@ loop_lock:
                 num_sync_run = 0;
                 blk_run_backing_dev(bdi, NULL);
         }
-
-        cond_resched();
-        if (again)
-                goto loop;
-
-        spin_lock(&device->io_lock);
-        if (device->pending_bios.head || device->pending_sync_bios.head)
-                goto loop_lock;
-        spin_unlock(&device->io_lock);
-
         /*
          * IO has already been through a long path to get here.  Checksumming,
          * async helper threads, perhaps compression.  We've done a pretty
@@ -346,6 +337,16 @@ loop_lock:
          * cared about found its way down here.
          */
         blk_run_backing_dev(bdi, NULL);
+
+        cond_resched();
+        if (again)
+                goto loop;
+
+        spin_lock(&device->io_lock);
+        if (device->pending_bios.head || device->pending_sync_bios.head)
+                goto loop_lock;
+        spin_unlock(&device->io_lock);
+
 done:
         return 0;
 }
@@ -365,6 +366,7 @@ static noinline int device_list_add(const char *path,
         struct btrfs_device *device;
         struct btrfs_fs_devices *fs_devices;
         u64 found_transid = btrfs_super_generation(disk_super);
+        char *name;
 
         fs_devices = find_fsid(disk_super->fsid);
         if (!fs_devices) {
@@ -411,6 +413,12 @@ static noinline int device_list_add(const char *path,
 
                 device->fs_devices = fs_devices;
                 fs_devices->num_devices++;
+        } else if (strcmp(device->name, path)) {
+                name = kstrdup(path, GFP_NOFS);
+                if (!name)
+                        return -ENOMEM;
+                kfree(device->name);
+                device->name = name;
         }
 
         if (found_transid > fs_devices->latest_trans) {
@@ -592,7 +600,7 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                         goto error_close;
 
                 disk_super = (struct btrfs_super_block *)bh->b_data;
-                devid = le64_to_cpu(disk_super->dev_item.devid);
+                devid = btrfs_stack_device_id(&disk_super->dev_item);
                 if (devid != device->devid)
                         goto error_brelse;
 
@@ -694,7 +702,7 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
                 goto error_close;
         }
         disk_super = (struct btrfs_super_block *)bh->b_data;
-        devid = le64_to_cpu(disk_super->dev_item.devid);
+        devid = btrfs_stack_device_id(&disk_super->dev_item);
         transid = btrfs_super_generation(disk_super);
         if (disk_super->label[0])
                 printk(KERN_INFO "device label %s ", disk_super->label);
@@ -1135,7 +1143,7 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
                 root->fs_info->avail_metadata_alloc_bits;
 
         if ((all_avail & BTRFS_BLOCK_GROUP_RAID10) &&
-            root->fs_info->fs_devices->rw_devices <= 4) {
+            root->fs_info->fs_devices->num_devices <= 4) {
                 printk(KERN_ERR "btrfs: unable to go below four devices "
                        "on raid10\n");
                 ret = -EINVAL;
@@ -1143,7 +1151,7 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         }
 
         if ((all_avail & BTRFS_BLOCK_GROUP_RAID1) &&
-            root->fs_info->fs_devices->rw_devices <= 2) {
+            root->fs_info->fs_devices->num_devices <= 2) {
                 printk(KERN_ERR "btrfs: unable to go below two "
                        "devices on raid1\n");
                 ret = -EINVAL;
@@ -1187,7 +1195,7 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
                         goto error_close;
                 }
                 disk_super = (struct btrfs_super_block *)bh->b_data;
-                devid = le64_to_cpu(disk_super->dev_item.devid);
+                devid = btrfs_stack_device_id(&disk_super->dev_item);
                 dev_uuid = disk_super->dev_item.uuid;
                 device = btrfs_find_device(root, devid, dev_uuid,
                                            disk_super->fsid);
@@ -1434,8 +1442,8 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                 return -EINVAL;
 
         bdev = open_bdev_exclusive(device_path, 0, root->fs_info->bdev_holder);
-        if (!bdev)
-                return -EIO;
+        if (IS_ERR(bdev))
+                return PTR_ERR(bdev);
 
         if (root->fs_info->fs_devices->seeding) {
                 seeding_dev = 1;
@@ -2191,9 +2199,9 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                 min_stripes = 2;
         }
         if (type & (BTRFS_BLOCK_GROUP_RAID1)) {
-                num_stripes = min_t(u64, 2, fs_devices->rw_devices);
-                if (num_stripes < 2)
+                if (fs_devices->rw_devices < 2)
                         return -ENOSPC;
+                num_stripes = 2;
                 min_stripes = 2;
         }
         if (type & (BTRFS_BLOCK_GROUP_RAID10)) {
@@ -2237,8 +2245,16 @@ again:
                 do_div(calc_size, stripe_len);
                 calc_size *= stripe_len;
         }
+
         /* we don't want tiny stripes */
-        calc_size = max_t(u64, min_stripe_size, calc_size);
+        if (!looped)
+                calc_size = max_t(u64, min_stripe_size, calc_size);
+
+        /*
+         * we're about to do_div by the stripe_len so lets make sure
+         * we end up with something bigger than a stripe
+         */
+        calc_size = max_t(u64, calc_size, stripe_len * 4);
 
         do_div(calc_size, stripe_len);
         calc_size *= stripe_len;
@@ -2538,6 +2554,11 @@ int btrfs_chunk_readonly(struct btrfs_root *root, u64 chunk_offset)
         if (!em)
                 return 1;
 
+        if (btrfs_test_opt(root, DEGRADED)) {
+                free_extent_map(em);
+                return 0;
+        }
+
         map = (struct map_lookup *)em->bdev;
         for (i = 0; i < map->num_stripes; i++) {
                 if (!map->stripes[i].dev->writeable) {
@@ -2649,8 +2670,10 @@ again:
         em = lookup_extent_mapping(em_tree, logical, *length);
         read_unlock(&em_tree->lock);
 
-        if (!em && unplug_page)
+        if (!em && unplug_page) {
+                kfree(multi);
                 return 0;
+        }
 
         if (!em) {
                 printk(KERN_CRIT "unable to find logical %llu len %llu\n",
@@ -3375,6 +3398,8 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
         key.type = 0;
 again:
         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        if (ret < 0)
+                goto error;
         while (1) {
                 leaf = path->nodes[0];
                 slot = path->slots[0];
diff --git a/fs/buffer.c b/fs/buffer.c
index 6fa530256bfd..c9c266db0624 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2893,7 +2893,7 @@ int block_write_full_page_endio(struct page *page, get_block_t *get_block,
 
         /*
          * The page straddles i_size.  It must be zeroed out on each and every
-         * writepage invokation because it may be mmapped.  "A file is mapped
+         * writepage invocation because it may be mmapped.  "A file is mapped
          * in multiples of the page size.  For a file that is not a multiple of
          * the  page size, the remaining memory is zeroed when mapped, and
          * writes to that region are not written out to the file."
@@ -3265,7 +3265,7 @@ static void recalc_bh_state(void)
         
 struct buffer_head *alloc_buffer_head(gfp_t gfp_flags)
 {
-        struct buffer_head *ret = kmem_cache_alloc(bh_cachep, gfp_flags);
+        struct buffer_head *ret = kmem_cache_zalloc(bh_cachep, gfp_flags);
         if (ret) {
                 INIT_LIST_HEAD(&ret->b_assoc_buffers);
                 get_cpu_var(bh_accounting).nr++;
@@ -3352,15 +3352,6 @@ int bh_submit_read(struct buffer_head *bh)
 }
 EXPORT_SYMBOL(bh_submit_read);
 
-static void
-init_buffer_head(void *data)
-{
-        struct buffer_head *bh = data;
-
-        memset(bh, 0, sizeof(*bh));
-        INIT_LIST_HEAD(&bh->b_assoc_buffers);
-}
-
 void __init buffer_init(void)
 {
         int nrpages;
@@ -3369,7 +3360,7 @@ void __init buffer_init(void)
                         sizeof(struct buffer_head), 0,
                                 (SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
                                 SLAB_MEM_SPREAD),
-                                init_buffer_head);
+                                NULL);
 
         /*
          * Limit the bh occupancy to 10% of ZONE_NORMAL
diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
index 27089311fbea..37fe101a4e0d 100644
--- a/fs/cachefiles/interface.c
+++ b/fs/cachefiles/interface.c
@@ -9,6 +9,7 @@
  * 2 of the Licence, or (at your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/buffer_head.h>
 #include "internal.h"
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 14ac4806e291..d5db84a1ee0d 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -19,6 +19,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/security.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 #define CACHEFILES_KEYBUF_SIZE 512
@@ -348,7 +349,17 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
         dir = dget_parent(object->dentry);
 
         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        ret = cachefiles_bury_object(cache, dir, object->dentry);
+
+        /* we need to check that our parent is _still_ our parent - it may have
+         * been renamed */
+        if (dir == object->dentry->d_parent) {
+                ret = cachefiles_bury_object(cache, dir, object->dentry);
+        } else {
+                /* it got moved, presumably by cachefilesd culling it, so it's
+                 * no longer in the key path and we can ignore it */
+                mutex_unlock(&dir->d_inode->i_mutex);
+                ret = 0;
+        }
 
         dput(dir);
         _leave(" = %d", ret);
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 1d8332563863..0f0d41fbb03f 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/mount.h>
+#include <linux/slab.h>
 #include <linux/file.h>
 #include "internal.h"
 
diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index f3e7a0bf068b..e18b183b47e1 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -16,6 +16,7 @@
 #include <linux/fsnotify.h>
 #include <linux/quotaops.h>
 #include <linux/xattr.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 static const char cachefiles_xattr_cache[] =
diff --git a/fs/ceph/Kconfig b/fs/ceph/Kconfig
new file mode 100644
index 000000000000..04b8280582a9
--- /dev/null
+++ b/fs/ceph/Kconfig
@@ -0,0 +1,27 @@
+config CEPH_FS
+        tristate "Ceph distributed file system (EXPERIMENTAL)"
+        depends on INET && EXPERIMENTAL
+        select LIBCRC32C
+        select CONFIG_CRYPTO_AES
+        help
+          Choose Y or M here to include support for mounting the
+          experimental Ceph distributed file system.  Ceph is an extremely
+          scalable file system designed to provide high performance,
+          reliable access to petabytes of storage.
+
+          More information at http://ceph.newdream.net/.
+
+          If unsure, say N.
+
+config CEPH_FS_PRETTYDEBUG
+        bool "Include file:line in ceph debug output"
+        depends on CEPH_FS
+        default n
+        help
+          If you say Y here, debug output will include a filename and
+          line to aid debugging.  This icnreases kernel size and slows
+          execution slightly when debug call sites are enabled (e.g.,
+          via CONFIG_DYNAMIC_DEBUG).
+
+          If unsure, say N.
+
diff --git a/fs/ceph/Makefile b/fs/ceph/Makefile
new file mode 100644
index 000000000000..6a660e610be8
--- /dev/null
+++ b/fs/ceph/Makefile
@@ -0,0 +1,39 @@
+#
+# Makefile for CEPH filesystem.
+#
+
+ifneq ($(KERNELRELEASE),)
+
+obj-$(CONFIG_CEPH_FS) += ceph.o
+
+ceph-objs := super.o inode.o dir.o file.o addr.o ioctl.o \
+        export.o caps.o snap.o xattr.o \
+        messenger.o msgpool.o buffer.o pagelist.o \
+        mds_client.o mdsmap.o \
+        mon_client.o \
+        osd_client.o osdmap.o crush/crush.o crush/mapper.o crush/hash.o \
+        debugfs.o \
+        auth.o auth_none.o \
+        crypto.o armor.o \
+        auth_x.o \
+        ceph_fs.o ceph_strings.o ceph_hash.o ceph_frag.o
+
+else
+#Otherwise we were called directly from the command
+# line; invoke the kernel build system.
+
+KERNELDIR ?= /lib/modules/$(shell uname -r)/build
+PWD := $(shell pwd)
+
+default: all
+
+all:
+        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_FS=m modules
+
+modules_install:
+        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_FS=m modules_install
+
+clean:
+        $(MAKE) -C $(KERNELDIR) M=$(PWD) clean
+
+endif
diff --git a/fs/ceph/README b/fs/ceph/README
new file mode 100644
index 000000000000..18352fab37c0
--- /dev/null
+++ b/fs/ceph/README
@@ -0,0 +1,20 @@
+#
+# The following files are shared by (and manually synchronized
+# between) the Ceph userland and kernel client.
+#
+# userland                  kernel
+src/include/ceph_fs.h       fs/ceph/ceph_fs.h
+src/include/ceph_fs.cc      fs/ceph/ceph_fs.c
+src/include/msgr.h          fs/ceph/msgr.h
+src/include/rados.h         fs/ceph/rados.h
+src/include/ceph_strings.cc fs/ceph/ceph_strings.c
+src/include/ceph_frag.h     fs/ceph/ceph_frag.h
+src/include/ceph_frag.cc    fs/ceph/ceph_frag.c
+src/include/ceph_hash.h     fs/ceph/ceph_hash.h
+src/include/ceph_hash.cc    fs/ceph/ceph_hash.c
+src/crush/crush.c           fs/ceph/crush/crush.c
+src/crush/crush.h           fs/ceph/crush/crush.h
+src/crush/mapper.c          fs/ceph/crush/mapper.c
+src/crush/mapper.h          fs/ceph/crush/mapper.h
+src/crush/hash.h            fs/ceph/crush/hash.h
+src/crush/hash.c            fs/ceph/crush/hash.c
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
new file mode 100644
index 000000000000..412593703d1e
--- /dev/null
+++ b/fs/ceph/addr.c
@@ -0,0 +1,1193 @@
+#include "ceph_debug.h"
+
+#include <linux/backing-dev.h>
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/writeback.h>    /* generic_writepages */
+#include <linux/slab.h>
+#include <linux/pagevec.h>
+#include <linux/task_io_accounting_ops.h>
+
+#include "super.h"
+#include "osd_client.h"
+
+/*
+ * Ceph address space ops.
+ *
+ * There are a few funny things going on here.
+ *
+ * The page->private field is used to reference a struct
+ * ceph_snap_context for _every_ dirty page.  This indicates which
+ * snapshot the page was logically dirtied in, and thus which snap
+ * context needs to be associated with the osd write during writeback.
+ *
+ * Similarly, struct ceph_inode_info maintains a set of counters to
+ * count dirty pages on the inode.  In the absense of snapshots,
+ * i_wrbuffer_ref == i_wrbuffer_ref_head == the dirty page count.
+ *
+ * When a snapshot is taken (that is, when the client receives
+ * notification that a snapshot was taken), each inode with caps and
+ * with dirty pages (dirty pages implies there is a cap) gets a new
+ * ceph_cap_snap in the i_cap_snaps list (which is sorted in ascending
+ * order, new snaps go to the tail).  The i_wrbuffer_ref_head count is
+ * moved to capsnap->dirty. (Unless a sync write is currently in
+ * progress.  In that case, the capsnap is said to be "pending", new
+ * writes cannot start, and the capsnap isn't "finalized" until the
+ * write completes (or fails) and a final size/mtime for the inode for
+ * that snap can be settled upon.)  i_wrbuffer_ref_head is reset to 0.
+ *
+ * On writeback, we must submit writes to the osd IN SNAP ORDER.  So,
+ * we look for the first capsnap in i_cap_snaps and write out pages in
+ * that snap context _only_.  Then we move on to the next capsnap,
+ * eventually reaching the "live" or "head" context (i.e., pages that
+ * are not yet snapped) and are writing the most recently dirtied
+ * pages.
+ *
+ * Invalidate and so forth must take care to ensure the dirty page
+ * accounting is preserved.
+ */
+
+#define CONGESTION_ON_THRESH(congestion_kb) (congestion_kb >> (PAGE_SHIFT-10))
+#define CONGESTION_OFF_THRESH(congestion_kb)                            \
+        (CONGESTION_ON_THRESH(congestion_kb) -                          \
+         (CONGESTION_ON_THRESH(congestion_kb) >> 2))
+
+
+
+/*
+ * Dirty a page.  Optimistically adjust accounting, on the assumption
+ * that we won't race with invalidate.  If we do, readjust.
+ */
+static int ceph_set_page_dirty(struct page *page)
+{
+        struct address_space *mapping = page->mapping;
+        struct inode *inode;
+        struct ceph_inode_info *ci;
+        int undo = 0;
+        struct ceph_snap_context *snapc;
+
+        if (unlikely(!mapping))
+                return !TestSetPageDirty(page);
+
+        if (TestSetPageDirty(page)) {
+                dout("%p set_page_dirty %p idx %lu -- already dirty\n",
+                     mapping->host, page, page->index);
+                return 0;
+        }
+
+        inode = mapping->host;
+        ci = ceph_inode(inode);
+
+        /*
+         * Note that we're grabbing a snapc ref here without holding
+         * any locks!
+         */
+        snapc = ceph_get_snap_context(ci->i_snap_realm->cached_context);
+
+        /* dirty the head */
+        spin_lock(&inode->i_lock);
+        if (ci->i_wrbuffer_ref_head == 0)
+                ci->i_head_snapc = ceph_get_snap_context(snapc);
+        ++ci->i_wrbuffer_ref_head;
+        if (ci->i_wrbuffer_ref == 0)
+                igrab(inode);
+        ++ci->i_wrbuffer_ref;
+        dout("%p set_page_dirty %p idx %lu head %d/%d -> %d/%d "
+             "snapc %p seq %lld (%d snaps)\n",
+             mapping->host, page, page->index,
+             ci->i_wrbuffer_ref-1, ci->i_wrbuffer_ref_head-1,
+             ci->i_wrbuffer_ref, ci->i_wrbuffer_ref_head,
+             snapc, snapc->seq, snapc->num_snaps);
+        spin_unlock(&inode->i_lock);
+
+        /* now adjust page */
+        spin_lock_irq(&mapping->tree_lock);
+        if (page->mapping) {    /* Race with truncate? */
+                WARN_ON_ONCE(!PageUptodate(page));
+
+                if (mapping_cap_account_dirty(mapping)) {
+                        __inc_zone_page_state(page, NR_FILE_DIRTY);
+                        __inc_bdi_stat(mapping->backing_dev_info,
+                                        BDI_RECLAIMABLE);
+                        task_io_account_write(PAGE_CACHE_SIZE);
+                }
+                radix_tree_tag_set(&mapping->page_tree,
+                                page_index(page), PAGECACHE_TAG_DIRTY);
+
+                /*
+                 * Reference snap context in page->private.  Also set
+                 * PagePrivate so that we get invalidatepage callback.
+                 */
+                page->private = (unsigned long)snapc;
+                SetPagePrivate(page);
+        } else {
+                dout("ANON set_page_dirty %p (raced truncate?)\n", page);
+                undo = 1;
+        }
+
+        spin_unlock_irq(&mapping->tree_lock);
+
+        if (undo)
+                /* whoops, we failed to dirty the page */
+                ceph_put_wrbuffer_cap_refs(ci, 1, snapc);
+
+        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+
+        BUG_ON(!PageDirty(page));
+        return 1;
+}
+
+/*
+ * If we are truncating the full page (i.e. offset == 0), adjust the
+ * dirty page counters appropriately.  Only called if there is private
+ * data on the page.
+ */
+static void ceph_invalidatepage(struct page *page, unsigned long offset)
+{
+        struct inode *inode;
+        struct ceph_inode_info *ci;
+        struct ceph_snap_context *snapc = (void *)page->private;
+
+        BUG_ON(!PageLocked(page));
+        BUG_ON(!page->private);
+        BUG_ON(!PagePrivate(page));
+        BUG_ON(!page->mapping);
+
+        inode = page->mapping->host;
+
+        /*
+         * We can get non-dirty pages here due to races between
+         * set_page_dirty and truncate_complete_page; just spit out a
+         * warning, in case we end up with accounting problems later.
+         */
+        if (!PageDirty(page))
+                pr_err("%p invalidatepage %p page not dirty\n", inode, page);
+
+        if (offset == 0)
+                ClearPageChecked(page);
+
+        ci = ceph_inode(inode);
+        if (offset == 0) {
+                dout("%p invalidatepage %p idx %lu full dirty page %lu\n",
+                     inode, page, page->index, offset);
+                ceph_put_wrbuffer_cap_refs(ci, 1, snapc);
+                ceph_put_snap_context(snapc);
+                page->private = 0;
+                ClearPagePrivate(page);
+        } else {
+                dout("%p invalidatepage %p idx %lu partial dirty page\n",
+                     inode, page, page->index);
+        }
+}
+
+/* just a sanity check */
+static int ceph_releasepage(struct page *page, gfp_t g)
+{
+        struct inode *inode = page->mapping ? page->mapping->host : NULL;
+        dout("%p releasepage %p idx %lu\n", inode, page, page->index);
+        WARN_ON(PageDirty(page));
+        WARN_ON(page->private);
+        WARN_ON(PagePrivate(page));
+        return 0;
+}
+
+/*
+ * read a single page, without unlocking it.
+ */
+static int readpage_nounlock(struct file *filp, struct page *page)
+{
+        struct inode *inode = filp->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_osd_client *osdc = &ceph_inode_to_client(inode)->osdc;
+        int err = 0;
+        u64 len = PAGE_CACHE_SIZE;
+
+        dout("readpage inode %p file %p page %p index %lu\n",
+             inode, filp, page, page->index);
+        err = ceph_osdc_readpages(osdc, ceph_vino(inode), &ci->i_layout,
+                                  page->index << PAGE_CACHE_SHIFT, &len,
+                                  ci->i_truncate_seq, ci->i_truncate_size,
+                                  &page, 1);
+        if (err == -ENOENT)
+                err = 0;
+        if (err < 0) {
+                SetPageError(page);
+                goto out;
+        } else if (err < PAGE_CACHE_SIZE) {
+                /* zero fill remainder of page */
+                zero_user_segment(page, err, PAGE_CACHE_SIZE);
+        }
+        SetPageUptodate(page);
+
+out:
+        return err < 0 ? err : 0;
+}
+
+static int ceph_readpage(struct file *filp, struct page *page)
+{
+        int r = readpage_nounlock(filp, page);
+        unlock_page(page);
+        return r;
+}
+
+/*
+ * Build a vector of contiguous pages from the provided page list.
+ */
+static struct page **page_vector_from_list(struct list_head *page_list,
+                                           unsigned *nr_pages)
+{
+        struct page **pages;
+        struct page *page;
+        int next_index, contig_pages = 0;
+
+        /* build page vector */
+        pages = kmalloc(sizeof(*pages) * *nr_pages, GFP_NOFS);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
+
+        BUG_ON(list_empty(page_list));
+        next_index = list_entry(page_list->prev, struct page, lru)->index;
+        list_for_each_entry_reverse(page, page_list, lru) {
+                if (page->index == next_index) {
+                        dout("readpages page %d %p\n", contig_pages, page);
+                        pages[contig_pages] = page;
+                        contig_pages++;
+                        next_index++;
+                } else {
+                        break;
+                }
+        }
+        *nr_pages = contig_pages;
+        return pages;
+}
+
+/*
+ * Read multiple pages.  Leave pages we don't read + unlock in page_list;
+ * the caller (VM) cleans them up.
+ */
+static int ceph_readpages(struct file *file, struct address_space *mapping,
+                          struct list_head *page_list, unsigned nr_pages)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_osd_client *osdc = &ceph_inode_to_client(inode)->osdc;
+        int rc = 0;
+        struct page **pages;
+        struct pagevec pvec;
+        loff_t offset;
+        u64 len;
+
+        dout("readpages %p file %p nr_pages %d\n",
+             inode, file, nr_pages);
+
+        pages = page_vector_from_list(page_list, &nr_pages);
+        if (IS_ERR(pages))
+                return PTR_ERR(pages);
+
+        /* guess read extent */
+        offset = pages[0]->index << PAGE_CACHE_SHIFT;
+        len = nr_pages << PAGE_CACHE_SHIFT;
+        rc = ceph_osdc_readpages(osdc, ceph_vino(inode), &ci->i_layout,
+                                 offset, &len,
+                                 ci->i_truncate_seq, ci->i_truncate_size,
+                                 pages, nr_pages);
+        if (rc == -ENOENT)
+                rc = 0;
+        if (rc < 0)
+                goto out;
+
+        /* set uptodate and add to lru in pagevec-sized chunks */
+        pagevec_init(&pvec, 0);
+        for (; !list_empty(page_list) && len > 0;
+             rc -= PAGE_CACHE_SIZE, len -= PAGE_CACHE_SIZE) {
+                struct page *page =
+                        list_entry(page_list->prev, struct page, lru);
+
+                list_del(&page->lru);
+
+                if (rc < (int)PAGE_CACHE_SIZE) {
+                        /* zero (remainder of) page */
+                        int s = rc < 0 ? 0 : rc;
+                        zero_user_segment(page, s, PAGE_CACHE_SIZE);
+                }
+
+                if (add_to_page_cache(page, mapping, page->index, GFP_NOFS)) {
+                        page_cache_release(page);
+                        dout("readpages %p add_to_page_cache failed %p\n",
+                             inode, page);
+                        continue;
+                }
+                dout("readpages %p adding %p idx %lu\n", inode, page,
+                     page->index);
+                flush_dcache_page(page);
+                SetPageUptodate(page);
+                unlock_page(page);
+                if (pagevec_add(&pvec, page) == 0)
+                        pagevec_lru_add_file(&pvec);   /* add to lru */
+        }
+        pagevec_lru_add_file(&pvec);
+        rc = 0;
+
+out:
+        kfree(pages);
+        return rc;
+}
+
+/*
+ * Get ref for the oldest snapc for an inode with dirty data... that is, the
+ * only snap context we are allowed to write back.
+ */
+static struct ceph_snap_context *get_oldest_context(struct inode *inode,
+                                                    u64 *snap_size)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_snap_context *snapc = NULL;
+        struct ceph_cap_snap *capsnap = NULL;
+
+        spin_lock(&inode->i_lock);
+        list_for_each_entry(capsnap, &ci->i_cap_snaps, ci_item) {
+                dout(" cap_snap %p snapc %p has %d dirty pages\n", capsnap,
+                     capsnap->context, capsnap->dirty_pages);
+                if (capsnap->dirty_pages) {
+                        snapc = ceph_get_snap_context(capsnap->context);
+                        if (snap_size)
+                                *snap_size = capsnap->size;
+                        break;
+                }
+        }
+        if (!snapc && ci->i_head_snapc) {
+                snapc = ceph_get_snap_context(ci->i_head_snapc);
+                dout(" head snapc %p has %d dirty pages\n",
+                     snapc, ci->i_wrbuffer_ref_head);
+        }
+        spin_unlock(&inode->i_lock);
+        return snapc;
+}
+
+/*
+ * Write a single page, but leave the page locked.
+ *
+ * If we get a write error, set the page error bit, but still adjust the
+ * dirty page accounting (i.e., page is no longer dirty).
+ */
+static int writepage_nounlock(struct page *page, struct writeback_control *wbc)
+{
+        struct inode *inode;
+        struct ceph_inode_info *ci;
+        struct ceph_client *client;
+        struct ceph_osd_client *osdc;
+        loff_t page_off = page->index << PAGE_CACHE_SHIFT;
+        int len = PAGE_CACHE_SIZE;
+        loff_t i_size;
+        int err = 0;
+        struct ceph_snap_context *snapc, *oldest;
+        u64 snap_size = 0;
+        long writeback_stat;
+
+        dout("writepage %p idx %lu\n", page, page->index);
+
+        if (!page->mapping || !page->mapping->host) {
+                dout("writepage %p - no mapping\n", page);
+                return -EFAULT;
+        }
+        inode = page->mapping->host;
+        ci = ceph_inode(inode);
+        client = ceph_inode_to_client(inode);
+        osdc = &client->osdc;
+
+        /* verify this is a writeable snap context */
+        snapc = (void *)page->private;
+        if (snapc == NULL) {
+                dout("writepage %p page %p not dirty?\n", inode, page);
+                goto out;
+        }
+        oldest = get_oldest_context(inode, &snap_size);
+        if (snapc->seq > oldest->seq) {
+                dout("writepage %p page %p snapc %p not writeable - noop\n",
+                     inode, page, (void *)page->private);
+                /* we should only noop if called by kswapd */
+                WARN_ON((current->flags & PF_MEMALLOC) == 0);
+                ceph_put_snap_context(oldest);
+                goto out;
+        }
+        ceph_put_snap_context(oldest);
+
+        /* is this a partial page at end of file? */
+        if (snap_size)
+                i_size = snap_size;
+        else
+                i_size = i_size_read(inode);
+        if (i_size < page_off + len)
+                len = i_size - page_off;
+
+        dout("writepage %p page %p index %lu on %llu~%u\n",
+             inode, page, page->index, page_off, len);
+
+        writeback_stat = atomic_long_inc_return(&client->writeback_count);
+        if (writeback_stat >
+            CONGESTION_ON_THRESH(client->mount_args->congestion_kb))
+                set_bdi_congested(&client->backing_dev_info, BLK_RW_ASYNC);
+
+        set_page_writeback(page);
+        err = ceph_osdc_writepages(osdc, ceph_vino(inode),
+                                   &ci->i_layout, snapc,
+                                   page_off, len,
+                                   ci->i_truncate_seq, ci->i_truncate_size,
+                                   &inode->i_mtime,
+                                   &page, 1, 0, 0, true);
+        if (err < 0) {
+                dout("writepage setting page/mapping error %d %p\n", err, page);
+                SetPageError(page);
+                mapping_set_error(&inode->i_data, err);
+                if (wbc)
+                        wbc->pages_skipped++;
+        } else {
+                dout("writepage cleaned page %p\n", page);
+                err = 0;  /* vfs expects us to return 0 */
+        }
+        page->private = 0;
+        ClearPagePrivate(page);
+        end_page_writeback(page);
+        ceph_put_wrbuffer_cap_refs(ci, 1, snapc);
+        ceph_put_snap_context(snapc);  /* page's reference */
+out:
+        return err;
+}
+
+static int ceph_writepage(struct page *page, struct writeback_control *wbc)
+{
+        int err;
+        struct inode *inode = page->mapping->host;
+        BUG_ON(!inode);
+        igrab(inode);
+        err = writepage_nounlock(page, wbc);
+        unlock_page(page);
+        iput(inode);
+        return err;
+}
+
+
+/*
+ * lame release_pages helper.  release_pages() isn't exported to
+ * modules.
+ */
+static void ceph_release_pages(struct page **pages, int num)
+{
+        struct pagevec pvec;
+        int i;
+
+        pagevec_init(&pvec, 0);
+        for (i = 0; i < num; i++) {
+                if (pagevec_add(&pvec, pages[i]) == 0)
+                        pagevec_release(&pvec);
+        }
+        pagevec_release(&pvec);
+}
+
+
+/*
+ * async writeback completion handler.
+ *
+ * If we get an error, set the mapping error bit, but not the individual
+ * page error bits.
+ */
+static void writepages_finish(struct ceph_osd_request *req,
+                              struct ceph_msg *msg)
+{
+        struct inode *inode = req->r_inode;
+        struct ceph_osd_reply_head *replyhead;
+        struct ceph_osd_op *op;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        unsigned wrote;
+        struct page *page;
+        int i;
+        struct ceph_snap_context *snapc = req->r_snapc;
+        struct address_space *mapping = inode->i_mapping;
+        struct writeback_control *wbc = req->r_wbc;
+        __s32 rc = -EIO;
+        u64 bytes = 0;
+        struct ceph_client *client = ceph_inode_to_client(inode);
+        long writeback_stat;
+        unsigned issued = __ceph_caps_issued(ci, NULL);
+
+        /* parse reply */
+        replyhead = msg->front.iov_base;
+        WARN_ON(le32_to_cpu(replyhead->num_ops) == 0);
+        op = (void *)(replyhead + 1);
+        rc = le32_to_cpu(replyhead->result);
+        bytes = le64_to_cpu(op->extent.length);
+
+        if (rc >= 0) {
+                /*
+                 * Assume we wrote the pages we originally sent.  The
+                 * osd might reply with fewer pages if our writeback
+                 * raced with a truncation and was adjusted at the osd,
+                 * so don't believe the reply.
+                 */
+                wrote = req->r_num_pages;
+        } else {
+                wrote = 0;
+                mapping_set_error(mapping, rc);
+        }
+        dout("writepages_finish %p rc %d bytes %llu wrote %d (pages)\n",
+             inode, rc, bytes, wrote);
+
+        /* clean all pages */
+        for (i = 0; i < req->r_num_pages; i++) {
+                page = req->r_pages[i];
+                BUG_ON(!page);
+                WARN_ON(!PageUptodate(page));
+
+                writeback_stat =
+                        atomic_long_dec_return(&client->writeback_count);
+                if (writeback_stat <
+                    CONGESTION_OFF_THRESH(client->mount_args->congestion_kb))
+                        clear_bdi_congested(&client->backing_dev_info,
+                                            BLK_RW_ASYNC);
+
+                if (i >= wrote) {
+                        dout("inode %p skipping page %p\n", inode, page);
+                        wbc->pages_skipped++;
+                }
+                ceph_put_snap_context((void *)page->private);
+                page->private = 0;
+                ClearPagePrivate(page);
+                dout("unlocking %d %p\n", i, page);
+                end_page_writeback(page);
+
+                /*
+                 * We lost the cache cap, need to truncate the page before
+                 * it is unlocked, otherwise we'd truncate it later in the
+                 * page truncation thread, possibly losing some data that
+                 * raced its way in
+                 */
+                if ((issued & CEPH_CAP_FILE_CACHE) == 0)
+                        generic_error_remove_page(inode->i_mapping, page);
+
+                unlock_page(page);
+        }
+        dout("%p wrote+cleaned %d pages\n", inode, wrote);
+        ceph_put_wrbuffer_cap_refs(ci, req->r_num_pages, snapc);
+
+        ceph_release_pages(req->r_pages, req->r_num_pages);
+        if (req->r_pages_from_pool)
+                mempool_free(req->r_pages,
+                             ceph_client(inode->i_sb)->wb_pagevec_pool);
+        else
+                kfree(req->r_pages);
+        ceph_osdc_put_request(req);
+}
+
+/*
+ * allocate a page vec, either directly, or if necessary, via a the
+ * mempool.  we avoid the mempool if we can because req->r_num_pages
+ * may be less than the maximum write size.
+ */
+static void alloc_page_vec(struct ceph_client *client,
+                           struct ceph_osd_request *req)
+{
+        req->r_pages = kmalloc(sizeof(struct page *) * req->r_num_pages,
+                               GFP_NOFS);
+        if (!req->r_pages) {
+                req->r_pages = mempool_alloc(client->wb_pagevec_pool, GFP_NOFS);
+                req->r_pages_from_pool = 1;
+                WARN_ON(!req->r_pages);
+        }
+}
+
+/*
+ * initiate async writeback
+ */
+static int ceph_writepages_start(struct address_space *mapping,
+                                 struct writeback_control *wbc)
+{
+        struct inode *inode = mapping->host;
+        struct backing_dev_info *bdi = mapping->backing_dev_info;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_client *client;
+        pgoff_t index, start, end;
+        int range_whole = 0;
+        int should_loop = 1;
+        pgoff_t max_pages = 0, max_pages_ever = 0;
+        struct ceph_snap_context *snapc = NULL, *last_snapc = NULL, *pgsnapc;
+        struct pagevec pvec;
+        int done = 0;
+        int rc = 0;
+        unsigned wsize = 1 << inode->i_blkbits;
+        struct ceph_osd_request *req = NULL;
+        int do_sync;
+        u64 snap_size = 0;
+
+        /*
+         * Include a 'sync' in the OSD request if this is a data
+         * integrity write (e.g., O_SYNC write or fsync()), or if our
+         * cap is being revoked.
+         */
+        do_sync = wbc->sync_mode == WB_SYNC_ALL;
+        if (ceph_caps_revoking(ci, CEPH_CAP_FILE_BUFFER))
+                do_sync = 1;
+        dout("writepages_start %p dosync=%d (mode=%s)\n",
+             inode, do_sync,
+             wbc->sync_mode == WB_SYNC_NONE ? "NONE" :
+             (wbc->sync_mode == WB_SYNC_ALL ? "ALL" : "HOLD"));
+
+        client = ceph_inode_to_client(inode);
+        if (client->mount_state == CEPH_MOUNT_SHUTDOWN) {
+                pr_warning("writepage_start %p on forced umount\n", inode);
+                return -EIO; /* we're in a forced umount, don't write! */
+        }
+        if (client->mount_args->wsize && client->mount_args->wsize < wsize)
+                wsize = client->mount_args->wsize;
+        if (wsize < PAGE_CACHE_SIZE)
+                wsize = PAGE_CACHE_SIZE;
+        max_pages_ever = wsize >> PAGE_CACHE_SHIFT;
+
+        pagevec_init(&pvec, 0);
+
+        /* ?? */
+        if (wbc->nonblocking && bdi_write_congested(bdi)) {
+                dout(" writepages congested\n");
+                wbc->encountered_congestion = 1;
+                goto out_final;
+        }
+
+        /* where to start/end? */
+        if (wbc->range_cyclic) {
+                start = mapping->writeback_index; /* Start from prev offset */
+                end = -1;
+                dout(" cyclic, start at %lu\n", start);
+        } else {
+                start = wbc->range_start >> PAGE_CACHE_SHIFT;
+                end = wbc->range_end >> PAGE_CACHE_SHIFT;
+                if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
+                        range_whole = 1;
+                should_loop = 0;
+                dout(" not cyclic, %lu to %lu\n", start, end);
+        }
+        index = start;
+
+retry:
+        /* find oldest snap context with dirty data */
+        ceph_put_snap_context(snapc);
+        snapc = get_oldest_context(inode, &snap_size);
+        if (!snapc) {
+                /* hmm, why does writepages get called when there
+                   is no dirty data? */
+                dout(" no snap context with dirty data?\n");
+                goto out;
+        }
+        dout(" oldest snapc is %p seq %lld (%d snaps)\n",
+             snapc, snapc->seq, snapc->num_snaps);
+        if (last_snapc && snapc != last_snapc) {
+                /* if we switched to a newer snapc, restart our scan at the
+                 * start of the original file range. */
+                dout("  snapc differs from last pass, restarting at %lu\n",
+                     index);
+                index = start;
+        }
+        last_snapc = snapc;
+
+        while (!done && index <= end) {
+                unsigned i;
+                int first;
+                pgoff_t next;
+                int pvec_pages, locked_pages;
+                struct page *page;
+                int want;
+                u64 offset, len;
+                struct ceph_osd_request_head *reqhead;
+                struct ceph_osd_op *op;
+                long writeback_stat;
+
+                next = 0;
+                locked_pages = 0;
+                max_pages = max_pages_ever;
+
+get_more_pages:
+                first = -1;
+                want = min(end - index,
+                           min((pgoff_t)PAGEVEC_SIZE,
+                               max_pages - (pgoff_t)locked_pages) - 1)
+                        + 1;
+                pvec_pages = pagevec_lookup_tag(&pvec, mapping, &index,
+                                                PAGECACHE_TAG_DIRTY,
+                                                want);
+                dout("pagevec_lookup_tag got %d\n", pvec_pages);
+                if (!pvec_pages && !locked_pages)
+                        break;
+                for (i = 0; i < pvec_pages && locked_pages < max_pages; i++) {
+                        page = pvec.pages[i];
+                        dout("? %p idx %lu\n", page, page->index);
+                        if (locked_pages == 0)
+                                lock_page(page);  /* first page */
+                        else if (!trylock_page(page))
+                                break;
+
+                        /* only dirty pages, or our accounting breaks */
+                        if (unlikely(!PageDirty(page)) ||
+                            unlikely(page->mapping != mapping)) {
+                                dout("!dirty or !mapping %p\n", page);
+                                unlock_page(page);
+                                break;
+                        }
+                        if (!wbc->range_cyclic && page->index > end) {
+                                dout("end of range %p\n", page);
+                                done = 1;
+                                unlock_page(page);
+                                break;
+                        }
+                        if (next && (page->index != next)) {
+                                dout("not consecutive %p\n", page);
+                                unlock_page(page);
+                                break;
+                        }
+                        if (wbc->sync_mode != WB_SYNC_NONE) {
+                                dout("waiting on writeback %p\n", page);
+                                wait_on_page_writeback(page);
+                        }
+                        if ((snap_size && page_offset(page) > snap_size) ||
+                            (!snap_size &&
+                             page_offset(page) > i_size_read(inode))) {
+                                dout("%p page eof %llu\n", page, snap_size ?
+                                     snap_size : i_size_read(inode));
+                                done = 1;
+                                unlock_page(page);
+                                break;
+                        }
+                        if (PageWriteback(page)) {
+                                dout("%p under writeback\n", page);
+                                unlock_page(page);
+                                break;
+                        }
+
+                        /* only if matching snap context */
+                        pgsnapc = (void *)page->private;
+                        if (pgsnapc->seq > snapc->seq) {
+                                dout("page snapc %p %lld > oldest %p %lld\n",
+                                     pgsnapc, pgsnapc->seq, snapc, snapc->seq);
+                                unlock_page(page);
+                                if (!locked_pages)
+                                        continue; /* keep looking for snap */
+                                break;
+                        }
+
+                        if (!clear_page_dirty_for_io(page)) {
+                                dout("%p !clear_page_dirty_for_io\n", page);
+                                unlock_page(page);
+                                break;
+                        }
+
+                        /* ok */
+                        if (locked_pages == 0) {
+                                /* prepare async write request */
+                                offset = page->index << PAGE_CACHE_SHIFT;
+                                len = wsize;
+                                req = ceph_osdc_new_request(&client->osdc,
+                                            &ci->i_layout,
+                                            ceph_vino(inode),
+                                            offset, &len,
+                                            CEPH_OSD_OP_WRITE,
+                                            CEPH_OSD_FLAG_WRITE |
+                                                    CEPH_OSD_FLAG_ONDISK,
+                                            snapc, do_sync,
+                                            ci->i_truncate_seq,
+                                            ci->i_truncate_size,
+                                            &inode->i_mtime, true, 1);
+                                max_pages = req->r_num_pages;
+
+                                alloc_page_vec(client, req);
+                                req->r_callback = writepages_finish;
+                                req->r_inode = inode;
+                                req->r_wbc = wbc;
+                        }
+
+                        /* note position of first page in pvec */
+                        if (first < 0)
+                                first = i;
+                        dout("%p will write page %p idx %lu\n",
+                             inode, page, page->index);
+
+                        writeback_stat = atomic_long_inc_return(&client->writeback_count);
+                        if (writeback_stat > CONGESTION_ON_THRESH(client->mount_args->congestion_kb)) {
+                                set_bdi_congested(&client->backing_dev_info, BLK_RW_ASYNC);
+                        }
+
+                        set_page_writeback(page);
+                        req->r_pages[locked_pages] = page;
+                        locked_pages++;
+                        next = page->index + 1;
+                }
+
+                /* did we get anything? */
+                if (!locked_pages)
+                        goto release_pvec_pages;
+                if (i) {
+                        int j;
+                        BUG_ON(!locked_pages || first < 0);
+
+                        if (pvec_pages && i == pvec_pages &&
+                            locked_pages < max_pages) {
+                                dout("reached end pvec, trying for more\n");
+                                pagevec_reinit(&pvec);
+                                goto get_more_pages;
+                        }
+
+                        /* shift unused pages over in the pvec...  we
+                         * will need to release them below. */
+                        for (j = i; j < pvec_pages; j++) {
+                                dout(" pvec leftover page %p\n",
+                                     pvec.pages[j]);
+                                pvec.pages[j-i+first] = pvec.pages[j];
+                        }
+                        pvec.nr -= i-first;
+                }
+
+                /* submit the write */
+                offset = req->r_pages[0]->index << PAGE_CACHE_SHIFT;
+                len = min((snap_size ? snap_size : i_size_read(inode)) - offset,
+                          (u64)locked_pages << PAGE_CACHE_SHIFT);
+                dout("writepages got %d pages at %llu~%llu\n",
+                     locked_pages, offset, len);
+
+                /* revise final length, page count */
+                req->r_num_pages = locked_pages;
+                reqhead = req->r_request->front.iov_base;
+                op = (void *)(reqhead + 1);
+                op->extent.length = cpu_to_le64(len);
+                op->payload_len = cpu_to_le32(len);
+                req->r_request->hdr.data_len = cpu_to_le32(len);
+
+                ceph_osdc_start_request(&client->osdc, req, true);
+                req = NULL;
+
+                /* continue? */
+                index = next;
+                wbc->nr_to_write -= locked_pages;
+                if (wbc->nr_to_write <= 0)
+                        done = 1;
+
+release_pvec_pages:
+                dout("pagevec_release on %d pages (%p)\n", (int)pvec.nr,
+                     pvec.nr ? pvec.pages[0] : NULL);
+                pagevec_release(&pvec);
+
+                if (locked_pages && !done)
+                        goto retry;
+        }
+
+        if (should_loop && !done) {
+                /* more to do; loop back to beginning of file */
+                dout("writepages looping back to beginning of file\n");
+                should_loop = 0;
+                index = 0;
+                goto retry;
+        }
+
+        if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+                mapping->writeback_index = index;
+
+out:
+        if (req)
+                ceph_osdc_put_request(req);
+        if (rc > 0)
+                rc = 0;  /* vfs expects us to return 0 */
+        ceph_put_snap_context(snapc);
+        dout("writepages done, rc = %d\n", rc);
+out_final:
+        return rc;
+}
+
+
+
+/*
+ * See if a given @snapc is either writeable, or already written.
+ */
+static int context_is_writeable_or_written(struct inode *inode,
+                                           struct ceph_snap_context *snapc)
+{
+        struct ceph_snap_context *oldest = get_oldest_context(inode, NULL);
+        int ret = !oldest || snapc->seq <= oldest->seq;
+
+        ceph_put_snap_context(oldest);
+        return ret;
+}
+
+/*
+ * We are only allowed to write into/dirty the page if the page is
+ * clean, or already dirty within the same snap context.
+ *
+ * called with page locked.
+ * return success with page locked,
+ * or any failure (incl -EAGAIN) with page unlocked.
+ */
+static int ceph_update_writeable_page(struct file *file,
+                            loff_t pos, unsigned len,
+                            struct page *page)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_mds_client *mdsc = &ceph_inode_to_client(inode)->mdsc;
+        loff_t page_off = pos & PAGE_CACHE_MASK;
+        int pos_in_page = pos & ~PAGE_CACHE_MASK;
+        int end_in_page = pos_in_page + len;
+        loff_t i_size;
+        int r;
+        struct ceph_snap_context *snapc, *oldest;
+
+retry_locked:
+        /* writepages currently holds page lock, but if we change that later, */
+        wait_on_page_writeback(page);
+
+        /* check snap context */
+        BUG_ON(!ci->i_snap_realm);
+        down_read(&mdsc->snap_rwsem);
+        BUG_ON(!ci->i_snap_realm->cached_context);
+        snapc = (void *)page->private;
+        if (snapc && snapc != ci->i_head_snapc) {
+                /*
+                 * this page is already dirty in another (older) snap
+                 * context!  is it writeable now?
+                 */
+                oldest = get_oldest_context(inode, NULL);
+                up_read(&mdsc->snap_rwsem);
+
+                if (snapc->seq > oldest->seq) {
+                        ceph_put_snap_context(oldest);
+                        dout(" page %p snapc %p not current or oldest\n",
+                             page, snapc);
+                        /*
+                         * queue for writeback, and wait for snapc to
+                         * be writeable or written
+                         */
+                        snapc = ceph_get_snap_context(snapc);
+                        unlock_page(page);
+                        ceph_queue_writeback(inode);
+                        r = wait_event_interruptible(ci->i_cap_wq,
+                               context_is_writeable_or_written(inode, snapc));
+                        ceph_put_snap_context(snapc);
+                        if (r == -ERESTARTSYS)
+                                return r;
+                        return -EAGAIN;
+                }
+                ceph_put_snap_context(oldest);
+
+                /* yay, writeable, do it now (without dropping page lock) */
+                dout(" page %p snapc %p not current, but oldest\n",
+                     page, snapc);
+                if (!clear_page_dirty_for_io(page))
+                        goto retry_locked;
+                r = writepage_nounlock(page, NULL);
+                if (r < 0)
+                        goto fail_nosnap;
+                goto retry_locked;
+        }
+
+        if (PageUptodate(page)) {
+                dout(" page %p already uptodate\n", page);
+                return 0;
+        }
+
+        /* full page? */
+        if (pos_in_page == 0 && len == PAGE_CACHE_SIZE)
+                return 0;
+
+        /* past end of file? */
+        i_size = inode->i_size;   /* caller holds i_mutex */
+
+        if (i_size + len > inode->i_sb->s_maxbytes) {
+                /* file is too big */
+                r = -EINVAL;
+                goto fail;
+        }
+
+        if (page_off >= i_size ||
+            (pos_in_page == 0 && (pos+len) >= i_size &&
+             end_in_page - pos_in_page != PAGE_CACHE_SIZE)) {
+                dout(" zeroing %p 0 - %d and %d - %d\n",
+                     page, pos_in_page, end_in_page, (int)PAGE_CACHE_SIZE);
+                zero_user_segments(page,
+                                   0, pos_in_page,
+                                   end_in_page, PAGE_CACHE_SIZE);
+                return 0;
+        }
+
+        /* we need to read it. */
+        up_read(&mdsc->snap_rwsem);
+        r = readpage_nounlock(file, page);
+        if (r < 0)
+                goto fail_nosnap;
+        goto retry_locked;
+
+fail:
+        up_read(&mdsc->snap_rwsem);
+fail_nosnap:
+        unlock_page(page);
+        return r;
+}
+
+/*
+ * We are only allowed to write into/dirty the page if the page is
+ * clean, or already dirty within the same snap context.
+ */
+static int ceph_write_begin(struct file *file, struct address_space *mapping,
+                            loff_t pos, unsigned len, unsigned flags,
+                            struct page **pagep, void **fsdata)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct page *page;
+        pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+        int r;
+
+        do {
+                /* get a page */
+                page = grab_cache_page_write_begin(mapping, index, 0);
+                if (!page)
+                        return -ENOMEM;
+                *pagep = page;
+
+                dout("write_begin file %p inode %p page %p %d~%d\n", file,
+                inode, page, (int)pos, (int)len);
+
+                r = ceph_update_writeable_page(file, pos, len, page);
+        } while (r == -EAGAIN);
+
+        return r;
+}
+
+/*
+ * we don't do anything in here that simple_write_end doesn't do
+ * except adjust dirty page accounting and drop read lock on
+ * mdsc->snap_rwsem.
+ */
+static int ceph_write_end(struct file *file, struct address_space *mapping,
+                          loff_t pos, unsigned len, unsigned copied,
+                          struct page *page, void *fsdata)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_client *client = ceph_inode_to_client(inode);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        unsigned from = pos & (PAGE_CACHE_SIZE - 1);
+        int check_cap = 0;
+
+        dout("write_end file %p inode %p page %p %d~%d (%d)\n", file,
+             inode, page, (int)pos, (int)copied, (int)len);
+
+        /* zero the stale part of the page if we did a short copy */
+        if (copied < len)
+                zero_user_segment(page, from+copied, len);
+
+        /* did file size increase? */
+        /* (no need for i_size_read(); we caller holds i_mutex */
+        if (pos+copied > inode->i_size)
+                check_cap = ceph_inode_set_size(inode, pos+copied);
+
+        if (!PageUptodate(page))
+                SetPageUptodate(page);
+
+        set_page_dirty(page);
+
+        unlock_page(page);
+        up_read(&mdsc->snap_rwsem);
+        page_cache_release(page);
+
+        if (check_cap)
+                ceph_check_caps(ceph_inode(inode), CHECK_CAPS_AUTHONLY, NULL);
+
+        return copied;
+}
+
+/*
+ * we set .direct_IO to indicate direct io is supported, but since we
+ * intercept O_DIRECT reads and writes early, this function should
+ * never get called.
+ */
+static ssize_t ceph_direct_io(int rw, struct kiocb *iocb,
+                              const struct iovec *iov,
+                              loff_t pos, unsigned long nr_segs)
+{
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+const struct address_space_operations ceph_aops = {
+        .readpage = ceph_readpage,
+        .readpages = ceph_readpages,
+        .writepage = ceph_writepage,
+        .writepages = ceph_writepages_start,
+        .write_begin = ceph_write_begin,
+        .write_end = ceph_write_end,
+        .set_page_dirty = ceph_set_page_dirty,
+        .invalidatepage = ceph_invalidatepage,
+        .releasepage = ceph_releasepage,
+        .direct_IO = ceph_direct_io,
+};
+
+
+/*
+ * vm ops
+ */
+
+/*
+ * Reuse write_begin here for simplicity.
+ */
+static int ceph_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct inode *inode = vma->vm_file->f_dentry->d_inode;
+        struct page *page = vmf->page;
+        struct ceph_mds_client *mdsc = &ceph_inode_to_client(inode)->mdsc;
+        loff_t off = page->index << PAGE_CACHE_SHIFT;
+        loff_t size, len;
+        int ret;
+
+        size = i_size_read(inode);
+        if (off + PAGE_CACHE_SIZE <= size)
+                len = PAGE_CACHE_SIZE;
+        else
+                len = size & ~PAGE_CACHE_MASK;
+
+        dout("page_mkwrite %p %llu~%llu page %p idx %lu\n", inode,
+             off, len, page, page->index);
+
+        lock_page(page);
+
+        ret = VM_FAULT_NOPAGE;
+        if ((off > size) ||
+            (page->mapping != inode->i_mapping))
+                goto out;
+
+        ret = ceph_update_writeable_page(vma->vm_file, off, len, page);
+        if (ret == 0) {
+                /* success.  we'll keep the page locked. */
+                set_page_dirty(page);
+                up_read(&mdsc->snap_rwsem);
+                ret = VM_FAULT_LOCKED;
+        } else {
+                if (ret == -ENOMEM)
+                        ret = VM_FAULT_OOM;
+                else
+                        ret = VM_FAULT_SIGBUS;
+        }
+out:
+        dout("page_mkwrite %p %llu~%llu = %d\n", inode, off, len, ret);
+        if (ret != VM_FAULT_LOCKED)
+                unlock_page(page);
+        return ret;
+}
+
+static struct vm_operations_struct ceph_vmops = {
+        .fault          = filemap_fault,
+        .page_mkwrite   = ceph_page_mkwrite,
+};
+
+int ceph_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct address_space *mapping = file->f_mapping;
+
+        if (!mapping->a_ops->readpage)
+                return -ENOEXEC;
+        file_accessed(file);
+        vma->vm_ops = &ceph_vmops;
+        vma->vm_flags |= VM_CAN_NONLINEAR;
+        return 0;
+}
diff --git a/fs/ceph/armor.c b/fs/ceph/armor.c
new file mode 100644
index 000000000000..67b2c030924b
--- /dev/null
+++ b/fs/ceph/armor.c
@@ -0,0 +1,99 @@
+
+#include <linux/errno.h>
+
+/*
+ * base64 encode/decode.
+ */
+
+const char *pem_key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static int encode_bits(int c)
+{
+        return pem_key[c];
+}
+
+static int decode_bits(char c)
+{
+        if (c >= 'A' && c <= 'Z')
+                return c - 'A';
+        if (c >= 'a' && c <= 'z')
+                return c - 'a' + 26;
+        if (c >= '0' && c <= '9')
+                return c - '0' + 52;
+        if (c == '+')
+                return 62;
+        if (c == '/')
+                return 63;
+        if (c == '=')
+                return 0; /* just non-negative, please */
+        return -EINVAL;
+}
+
+int ceph_armor(char *dst, const char *src, const char *end)
+{
+        int olen = 0;
+        int line = 0;
+
+        while (src < end) {
+                unsigned char a, b, c;
+
+                a = *src++;
+                *dst++ = encode_bits(a >> 2);
+                if (src < end) {
+                        b = *src++;
+                        *dst++ = encode_bits(((a & 3) << 4) | (b >> 4));
+                        if (src < end) {
+                                c = *src++;
+                                *dst++ = encode_bits(((b & 15) << 2) |
+                                                     (c >> 6));
+                                *dst++ = encode_bits(c & 63);
+                        } else {
+                                *dst++ = encode_bits((b & 15) << 2);
+                                *dst++ = '=';
+                        }
+                } else {
+                        *dst++ = encode_bits(((a & 3) << 4));
+                        *dst++ = '=';
+                        *dst++ = '=';
+                }
+                olen += 4;
+                line += 4;
+                if (line == 64) {
+                        line = 0;
+                        *(dst++) = '\n';
+                        olen++;
+                }
+        }
+        return olen;
+}
+
+int ceph_unarmor(char *dst, const char *src, const char *end)
+{
+        int olen = 0;
+
+        while (src < end) {
+                int a, b, c, d;
+
+                if (src < end && src[0] == '\n')
+                        src++;
+                if (src + 4 > end)
+                        return -EINVAL;
+                a = decode_bits(src[0]);
+                b = decode_bits(src[1]);
+                c = decode_bits(src[2]);
+                d = decode_bits(src[3]);
+                if (a < 0 || b < 0 || c < 0 || d < 0)
+                        return -EINVAL;
+
+                *dst++ = (a << 2) | (b >> 4);
+                if (src[2] == '=')
+                        return olen + 1;
+                *dst++ = ((b & 15) << 4) | (c >> 2);
+                if (src[3] == '=')
+                        return olen + 2;
+                *dst++ = ((c & 3) << 6) | d;
+                olen += 3;
+                src += 4;
+        }
+        return olen;
+}
diff --git a/fs/ceph/auth.c b/fs/ceph/auth.c
new file mode 100644
index 000000000000..f6394b94b866
--- /dev/null
+++ b/fs/ceph/auth.c
@@ -0,0 +1,258 @@
+#include "ceph_debug.h"
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/err.h>
+
+#include "types.h"
+#include "auth_none.h"
+#include "auth_x.h"
+#include "decode.h"
+#include "super.h"
+
+#include "messenger.h"
+
+/*
+ * get protocol handler
+ */
+static u32 supported_protocols[] = {
+        CEPH_AUTH_NONE,
+        CEPH_AUTH_CEPHX
+};
+
+int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
+{
+        switch (protocol) {
+        case CEPH_AUTH_NONE:
+                return ceph_auth_none_init(ac);
+        case CEPH_AUTH_CEPHX:
+                return ceph_x_init(ac);
+        default:
+                return -ENOENT;
+        }
+}
+
+/*
+ * setup, teardown.
+ */
+struct ceph_auth_client *ceph_auth_init(const char *name, const char *secret)
+{
+        struct ceph_auth_client *ac;
+        int ret;
+
+        dout("auth_init name '%s' secret '%s'\n", name, secret);
+
+        ret = -ENOMEM;
+        ac = kzalloc(sizeof(*ac), GFP_NOFS);
+        if (!ac)
+                goto out;
+
+        ac->negotiating = true;
+        if (name)
+                ac->name = name;
+        else
+                ac->name = CEPH_AUTH_NAME_DEFAULT;
+        dout("auth_init name %s secret %s\n", ac->name, secret);
+        ac->secret = secret;
+        return ac;
+
+out:
+        return ERR_PTR(ret);
+}
+
+void ceph_auth_destroy(struct ceph_auth_client *ac)
+{
+        dout("auth_destroy %p\n", ac);
+        if (ac->ops)
+                ac->ops->destroy(ac);
+        kfree(ac);
+}
+
+/*
+ * Reset occurs when reconnecting to the monitor.
+ */
+void ceph_auth_reset(struct ceph_auth_client *ac)
+{
+        dout("auth_reset %p\n", ac);
+        if (ac->ops && !ac->negotiating)
+                ac->ops->reset(ac);
+        ac->negotiating = true;
+}
+
+int ceph_entity_name_encode(const char *name, void **p, void *end)
+{
+        int len = strlen(name);
+
+        if (*p + 2*sizeof(u32) + len > end)
+                return -ERANGE;
+        ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
+        ceph_encode_32(p, len);
+        ceph_encode_copy(p, name, len);
+        return 0;
+}
+
+/*
+ * Initiate protocol negotiation with monitor.  Include entity name
+ * and list supported protocols.
+ */
+int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
+{
+        struct ceph_mon_request_header *monhdr = buf;
+        void *p = monhdr + 1, *end = buf + len, *lenp;
+        int i, num;
+        int ret;
+
+        dout("auth_build_hello\n");
+        monhdr->have_version = 0;
+        monhdr->session_mon = cpu_to_le16(-1);
+        monhdr->session_mon_tid = 0;
+
+        ceph_encode_32(&p, 0);  /* no protocol, yet */
+
+        lenp = p;
+        p += sizeof(u32);
+
+        ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+        ceph_encode_8(&p, 1);
+        num = ARRAY_SIZE(supported_protocols);
+        ceph_encode_32(&p, num);
+        ceph_decode_need(&p, end, num * sizeof(u32), bad);
+        for (i = 0; i < num; i++)
+                ceph_encode_32(&p, supported_protocols[i]);
+
+        ret = ceph_entity_name_encode(ac->name, &p, end);
+        if (ret < 0)
+                return ret;
+        ceph_decode_need(&p, end, sizeof(u64), bad);
+        ceph_encode_64(&p, ac->global_id);
+
+        ceph_encode_32(&lenp, p - lenp - sizeof(u32));
+        return p - buf;
+
+bad:
+        return -ERANGE;
+}
+
+int ceph_build_auth_request(struct ceph_auth_client *ac,
+                           void *msg_buf, size_t msg_len)
+{
+        struct ceph_mon_request_header *monhdr = msg_buf;
+        void *p = monhdr + 1;
+        void *end = msg_buf + msg_len;
+        int ret;
+
+        monhdr->have_version = 0;
+        monhdr->session_mon = cpu_to_le16(-1);
+        monhdr->session_mon_tid = 0;
+
+        ceph_encode_32(&p, ac->protocol);
+
+        ret = ac->ops->build_request(ac, p + sizeof(u32), end);
+        if (ret < 0) {
+                pr_err("error %d building request\n", ret);
+                return ret;
+        }
+        dout(" built request %d bytes\n", ret);
+        ceph_encode_32(&p, ret);
+        return p + ret - msg_buf;
+}
+
+/*
+ * Handle auth message from monitor.
+ */
+int ceph_handle_auth_reply(struct ceph_auth_client *ac,
+                           void *buf, size_t len,
+                           void *reply_buf, size_t reply_len)
+{
+        void *p = buf;
+        void *end = buf + len;
+        int protocol;
+        s32 result;
+        u64 global_id;
+        void *payload, *payload_end;
+        int payload_len;
+        char *result_msg;
+        int result_msg_len;
+        int ret = -EINVAL;
+
+        dout("handle_auth_reply %p %p\n", p, end);
+        ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
+        protocol = ceph_decode_32(&p);
+        result = ceph_decode_32(&p);
+        global_id = ceph_decode_64(&p);
+        payload_len = ceph_decode_32(&p);
+        payload = p;
+        p += payload_len;
+        ceph_decode_need(&p, end, sizeof(u32), bad);
+        result_msg_len = ceph_decode_32(&p);
+        result_msg = p;
+        p += result_msg_len;
+        if (p != end)
+                goto bad;
+
+        dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
+             result_msg, global_id, payload_len);
+
+        payload_end = payload + payload_len;
+
+        if (global_id && ac->global_id != global_id) {
+                dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
+                ac->global_id = global_id;
+        }
+
+        if (ac->negotiating) {
+                /* server does not support our protocols? */
+                if (!protocol && result < 0) {
+                        ret = result;
+                        goto out;
+                }
+                /* set up (new) protocol handler? */
+                if (ac->protocol && ac->protocol != protocol) {
+                        ac->ops->destroy(ac);
+                        ac->protocol = 0;
+                        ac->ops = NULL;
+                }
+                if (ac->protocol != protocol) {
+                        ret = ceph_auth_init_protocol(ac, protocol);
+                        if (ret) {
+                                pr_err("error %d on auth protocol %d init\n",
+                                       ret, protocol);
+                                goto out;
+                        }
+                }
+
+                ac->negotiating = false;
+        }
+
+        ret = ac->ops->handle_reply(ac, result, payload, payload_end);
+        if (ret == -EAGAIN) {
+                return ceph_build_auth_request(ac, reply_buf, reply_len);
+        } else if (ret) {
+                pr_err("authentication error %d\n", ret);
+                return ret;
+        }
+        return 0;
+
+bad:
+        pr_err("failed to decode auth msg\n");
+out:
+        return ret;
+}
+
+int ceph_build_auth(struct ceph_auth_client *ac,
+                    void *msg_buf, size_t msg_len)
+{
+        if (!ac->protocol)
+                return ceph_auth_build_hello(ac, msg_buf, msg_len);
+        BUG_ON(!ac->ops);
+        if (!ac->ops->is_authenticated(ac))
+                return ceph_build_auth_request(ac, msg_buf, msg_len);
+        return 0;
+}
+
+int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
+{
+        if (!ac->ops)
+                return 0;
+        return ac->ops->is_authenticated(ac);
+}
diff --git a/fs/ceph/auth.h b/fs/ceph/auth.h
new file mode 100644
index 000000000000..ca4f57cfb267
--- /dev/null
+++ b/fs/ceph/auth.h
@@ -0,0 +1,84 @@
+#ifndef _FS_CEPH_AUTH_H
+#define _FS_CEPH_AUTH_H
+
+#include "types.h"
+#include "buffer.h"
+
+/*
+ * Abstract interface for communicating with the authenticate module.
+ * There is some handshake that takes place between us and the monitor
+ * to acquire the necessary keys.  These are used to generate an
+ * 'authorizer' that we use when connecting to a service (mds, osd).
+ */
+
+struct ceph_auth_client;
+struct ceph_authorizer;
+
+struct ceph_auth_client_ops {
+        /*
+         * true if we are authenticated and can connect to
+         * services.
+         */
+        int (*is_authenticated)(struct ceph_auth_client *ac);
+
+        /*
+         * build requests and process replies during monitor
+         * handshake.  if handle_reply returns -EAGAIN, we build
+         * another request.
+         */
+        int (*build_request)(struct ceph_auth_client *ac, void *buf, void *end);
+        int (*handle_reply)(struct ceph_auth_client *ac, int result,
+                            void *buf, void *end);
+
+        /*
+         * Create authorizer for connecting to a service, and verify
+         * the response to authenticate the service.
+         */
+        int (*create_authorizer)(struct ceph_auth_client *ac, int peer_type,
+                                 struct ceph_authorizer **a,
+                                 void **buf, size_t *len,
+                                 void **reply_buf, size_t *reply_len);
+        int (*verify_authorizer_reply)(struct ceph_auth_client *ac,
+                                       struct ceph_authorizer *a, size_t len);
+        void (*destroy_authorizer)(struct ceph_auth_client *ac,
+                                   struct ceph_authorizer *a);
+        void (*invalidate_authorizer)(struct ceph_auth_client *ac,
+                                      int peer_type);
+
+        /* reset when we (re)connect to a monitor */
+        void (*reset)(struct ceph_auth_client *ac);
+
+        void (*destroy)(struct ceph_auth_client *ac);
+};
+
+struct ceph_auth_client {
+        u32 protocol;           /* CEPH_AUTH_* */
+        void *private;          /* for use by protocol implementation */
+        const struct ceph_auth_client_ops *ops;  /* null iff protocol==0 */
+
+        bool negotiating;       /* true if negotiating protocol */
+        const char *name;       /* entity name */
+        u64 global_id;          /* our unique id in system */
+        const char *secret;     /* our secret key */
+        unsigned want_keys;     /* which services we want */
+};
+
+extern struct ceph_auth_client *ceph_auth_init(const char *name,
+                                               const char *secret);
+extern void ceph_auth_destroy(struct ceph_auth_client *ac);
+
+extern void ceph_auth_reset(struct ceph_auth_client *ac);
+
+extern int ceph_auth_build_hello(struct ceph_auth_client *ac,
+                                 void *buf, size_t len);
+extern int ceph_handle_auth_reply(struct ceph_auth_client *ac,
+                                  void *buf, size_t len,
+                                  void *reply_buf, size_t reply_len);
+extern int ceph_entity_name_encode(const char *name, void **p, void *end);
+
+extern int ceph_build_auth(struct ceph_auth_client *ac,
+                    void *msg_buf, size_t msg_len);
+
+extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac);
+
+#endif
diff --git a/fs/ceph/auth_none.c b/fs/ceph/auth_none.c
new file mode 100644
index 000000000000..8cd9e3af07f7
--- /dev/null
+++ b/fs/ceph/auth_none.c
@@ -0,0 +1,122 @@
+
+#include "ceph_debug.h"
+
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+
+#include "auth_none.h"
+#include "auth.h"
+#include "decode.h"
+
+static void reset(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        xi->starting = true;
+        xi->built_authorizer = false;
+}
+
+static void destroy(struct ceph_auth_client *ac)
+{
+        kfree(ac->private);
+        ac->private = NULL;
+}
+
+static int is_authenticated(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        return !xi->starting;
+}
+
+/*
+ * the generic auth code decode the global_id, and we carry no actual
+ * authenticate state, so nothing happens here.
+ */
+static int handle_reply(struct ceph_auth_client *ac, int result,
+                        void *buf, void *end)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        xi->starting = false;
+        return result;
+}
+
+/*
+ * build an 'authorizer' with our entity_name and global_id.  we can
+ * reuse a single static copy since it is identical for all services
+ * we connect to.
+ */
+static int ceph_auth_none_create_authorizer(
+        struct ceph_auth_client *ac, int peer_type,
+        struct ceph_authorizer **a,
+        void **buf, size_t *len,
+        void **reply_buf, size_t *reply_len)
+{
+        struct ceph_auth_none_info *ai = ac->private;
+        struct ceph_none_authorizer *au = &ai->au;
+        void *p, *end;
+        int ret;
+
+        if (!ai->built_authorizer) {
+                p = au->buf;
+                end = p + sizeof(au->buf);
+                ceph_encode_8(&p, 1);
+                ret = ceph_entity_name_encode(ac->name, &p, end - 8);
+                if (ret < 0)
+                        goto bad;
+                ceph_decode_need(&p, end, sizeof(u64), bad2);
+                ceph_encode_64(&p, ac->global_id);
+                au->buf_len = p - (void *)au->buf;
+                ai->built_authorizer = true;
+                dout("built authorizer len %d\n", au->buf_len);
+        }
+
+        *a = (struct ceph_authorizer *)au;
+        *buf = au->buf;
+        *len = au->buf_len;
+        *reply_buf = au->reply_buf;
+        *reply_len = sizeof(au->reply_buf);
+        return 0;
+
+bad2:
+        ret = -ERANGE;
+bad:
+        return ret;
+}
+
+static void ceph_auth_none_destroy_authorizer(struct ceph_auth_client *ac,
+                                      struct ceph_authorizer *a)
+{
+        /* nothing to do */
+}
+
+static const struct ceph_auth_client_ops ceph_auth_none_ops = {
+        .reset = reset,
+        .destroy = destroy,
+        .is_authenticated = is_authenticated,
+        .handle_reply = handle_reply,
+        .create_authorizer = ceph_auth_none_create_authorizer,
+        .destroy_authorizer = ceph_auth_none_destroy_authorizer,
+};
+
+int ceph_auth_none_init(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi;
+
+        dout("ceph_auth_none_init %p\n", ac);
+        xi = kzalloc(sizeof(*xi), GFP_NOFS);
+        if (!xi)
+                return -ENOMEM;
+
+        xi->starting = true;
+        xi->built_authorizer = false;
+
+        ac->protocol = CEPH_AUTH_NONE;
+        ac->private = xi;
+        ac->ops = &ceph_auth_none_ops;
+        return 0;
+}
+
diff --git a/fs/ceph/auth_none.h b/fs/ceph/auth_none.h
new file mode 100644
index 000000000000..56c05533a31c
--- /dev/null
+++ b/fs/ceph/auth_none.h
@@ -0,0 +1,28 @@
+#ifndef _FS_CEPH_AUTH_NONE_H
+#define _FS_CEPH_AUTH_NONE_H
+
+#include "auth.h"
+
+/*
+ * null security mode.
+ *
+ * we use a single static authorizer that simply encodes our entity name
+ * and global id.
+ */
+
+struct ceph_none_authorizer {
+        char buf[128];
+        int buf_len;
+        char reply_buf[0];
+};
+
+struct ceph_auth_none_info {
+        bool starting;
+        bool built_authorizer;
+        struct ceph_none_authorizer au;   /* we only need one; it's static */
+};
+
+extern int ceph_auth_none_init(struct ceph_auth_client *ac);
+
+#endif
+
diff --git a/fs/ceph/auth_x.c b/fs/ceph/auth_x.c
new file mode 100644
index 000000000000..d9001a4dc8cc
--- /dev/null
+++ b/fs/ceph/auth_x.c
@@ -0,0 +1,680 @@
+
+#include "ceph_debug.h"
+
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+
+#include "auth_x.h"
+#include "auth_x_protocol.h"
+#include "crypto.h"
+#include "auth.h"
+#include "decode.h"
+
+struct kmem_cache *ceph_x_ticketbuf_cachep;
+
+#define TEMP_TICKET_BUF_LEN     256
+
+static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
+
+static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+        int need;
+
+        ceph_x_validate_tickets(ac, &need);
+        dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
+             ac->want_keys, need, xi->have_keys);
+        return (ac->want_keys & xi->have_keys) == ac->want_keys;
+}
+
+static int ceph_x_encrypt_buflen(int ilen)
+{
+        return sizeof(struct ceph_x_encrypt_header) + ilen + 16 +
+                sizeof(u32);
+}
+
+static int ceph_x_encrypt(struct ceph_crypto_key *secret,
+                          void *ibuf, int ilen, void *obuf, size_t olen)
+{
+        struct ceph_x_encrypt_header head = {
+                .struct_v = 1,
+                .magic = cpu_to_le64(CEPHX_ENC_MAGIC)
+        };
+        size_t len = olen - sizeof(u32);
+        int ret;
+
+        ret = ceph_encrypt2(secret, obuf + sizeof(u32), &len,
+                            &head, sizeof(head), ibuf, ilen);
+        if (ret)
+                return ret;
+        ceph_encode_32(&obuf, len);
+        return len + sizeof(u32);
+}
+
+static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+                          void **p, void *end, void *obuf, size_t olen)
+{
+        struct ceph_x_encrypt_header head;
+        size_t head_len = sizeof(head);
+        int len, ret;
+
+        len = ceph_decode_32(p);
+        if (*p + len > end)
+                return -EINVAL;
+
+        dout("ceph_x_decrypt len %d\n", len);
+        ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
+                            *p, len);
+        if (ret)
+                return ret;
+        if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
+                return -EPERM;
+        *p += len;
+        return olen;
+}
+
+/*
+ * get existing (or insert new) ticket handler
+ */
+struct ceph_x_ticket_handler *get_ticket_handler(struct ceph_auth_client *ac,
+                                                 int service)
+{
+        struct ceph_x_ticket_handler *th;
+        struct ceph_x_info *xi = ac->private;
+        struct rb_node *parent = NULL, **p = &xi->ticket_handlers.rb_node;
+
+        while (*p) {
+                parent = *p;
+                th = rb_entry(parent, struct ceph_x_ticket_handler, node);
+                if (service < th->service)
+                        p = &(*p)->rb_left;
+                else if (service > th->service)
+                        p = &(*p)->rb_right;
+                else
+                        return th;
+        }
+
+        /* add it */
+        th = kzalloc(sizeof(*th), GFP_NOFS);
+        if (!th)
+                return ERR_PTR(-ENOMEM);
+        th->service = service;
+        rb_link_node(&th->node, parent, p);
+        rb_insert_color(&th->node, &xi->ticket_handlers);
+        return th;
+}
+
+static void remove_ticket_handler(struct ceph_auth_client *ac,
+                                  struct ceph_x_ticket_handler *th)
+{
+        struct ceph_x_info *xi = ac->private;
+
+        dout("remove_ticket_handler %p %d\n", th, th->service);
+        rb_erase(&th->node, &xi->ticket_handlers);
+        ceph_crypto_key_destroy(&th->session_key);
+        if (th->ticket_blob)
+                ceph_buffer_put(th->ticket_blob);
+        kfree(th);
+}
+
+static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+                                    struct ceph_crypto_key *secret,
+                                    void *buf, void *end)
+{
+        struct ceph_x_info *xi = ac->private;
+        int num;
+        void *p = buf;
+        int ret;
+        char *dbuf;
+        char *ticket_buf;
+        u8 struct_v;
+
+        dbuf = kmem_cache_alloc(ceph_x_ticketbuf_cachep, GFP_NOFS | GFP_ATOMIC);
+        if (!dbuf)
+                return -ENOMEM;
+
+        ret = -ENOMEM;
+        ticket_buf = kmem_cache_alloc(ceph_x_ticketbuf_cachep,
+                                      GFP_NOFS | GFP_ATOMIC);
+        if (!ticket_buf)
+                goto out_dbuf;
+
+        ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+        struct_v = ceph_decode_8(&p);
+        if (struct_v != 1)
+                goto bad;
+        num = ceph_decode_32(&p);
+        dout("%d tickets\n", num);
+        while (num--) {
+                int type;
+                u8 struct_v;
+                struct ceph_x_ticket_handler *th;
+                void *dp, *dend;
+                int dlen;
+                char is_enc;
+                struct timespec validity;
+                struct ceph_crypto_key old_key;
+                void *tp, *tpend;
+                struct ceph_timespec new_validity;
+                struct ceph_crypto_key new_session_key;
+                struct ceph_buffer *new_ticket_blob;
+                unsigned long new_expires, new_renew_after;
+                u64 new_secret_id;
+
+                ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
+
+                type = ceph_decode_32(&p);
+                dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+
+                struct_v = ceph_decode_8(&p);
+                if (struct_v != 1)
+                        goto bad;
+
+                th = get_ticket_handler(ac, type);
+                if (IS_ERR(th)) {
+                        ret = PTR_ERR(th);
+                        goto out;
+                }
+
+                /* blob for me */
+                dlen = ceph_x_decrypt(secret, &p, end, dbuf,
+                                      TEMP_TICKET_BUF_LEN);
+                if (dlen <= 0) {
+                        ret = dlen;
+                        goto out;
+                }
+                dout(" decrypted %d bytes\n", dlen);
+                dend = dbuf + dlen;
+                dp = dbuf;
+
+                struct_v = ceph_decode_8(&dp);
+                if (struct_v != 1)
+                        goto bad;
+
+                memcpy(&old_key, &th->session_key, sizeof(old_key));
+                ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+                if (ret)
+                        goto out;
+
+                ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+                ceph_decode_timespec(&validity, &new_validity);
+                new_expires = get_seconds() + validity.tv_sec;
+                new_renew_after = new_expires - (validity.tv_sec / 4);
+                dout(" expires=%lu renew_after=%lu\n", new_expires,
+                     new_renew_after);
+
+                /* ticket blob for service */
+                ceph_decode_8_safe(&p, end, is_enc, bad);
+                tp = ticket_buf;
+                if (is_enc) {
+                        /* encrypted */
+                        dout(" encrypted ticket\n");
+                        dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
+                                              TEMP_TICKET_BUF_LEN);
+                        if (dlen < 0) {
+                                ret = dlen;
+                                goto out;
+                        }
+                        dlen = ceph_decode_32(&tp);
+                } else {
+                        /* unencrypted */
+                        ceph_decode_32_safe(&p, end, dlen, bad);
+                        ceph_decode_need(&p, end, dlen, bad);
+                        ceph_decode_copy(&p, ticket_buf, dlen);
+                }
+                tpend = tp + dlen;
+                dout(" ticket blob is %d bytes\n", dlen);
+                ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+                struct_v = ceph_decode_8(&tp);
+                new_secret_id = ceph_decode_64(&tp);
+                ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+                if (ret)
+                        goto out;
+
+                /* all is well, update our ticket */
+                ceph_crypto_key_destroy(&th->session_key);
+                if (th->ticket_blob)
+                        ceph_buffer_put(th->ticket_blob);
+                th->session_key = new_session_key;
+                th->ticket_blob = new_ticket_blob;
+                th->validity = new_validity;
+                th->secret_id = new_secret_id;
+                th->expires = new_expires;
+                th->renew_after = new_renew_after;
+                dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+                     type, ceph_entity_type_name(type), th->secret_id,
+                     (int)th->ticket_blob->vec.iov_len);
+                xi->have_keys |= th->service;
+        }
+
+        ret = 0;
+out:
+        kmem_cache_free(ceph_x_ticketbuf_cachep, ticket_buf);
+out_dbuf:
+        kmem_cache_free(ceph_x_ticketbuf_cachep, dbuf);
+        return ret;
+
+bad:
+        ret = -EINVAL;
+        goto out;
+}
+
+static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+                                   struct ceph_x_ticket_handler *th,
+                                   struct ceph_x_authorizer *au)
+{
+        int maxlen;
+        struct ceph_x_authorize_a *msg_a;
+        struct ceph_x_authorize_b msg_b;
+        void *p, *end;
+        int ret;
+        int ticket_blob_len =
+                (th->ticket_blob ? th->ticket_blob->vec.iov_len : 0);
+
+        dout("build_authorizer for %s %p\n",
+             ceph_entity_type_name(th->service), au);
+
+        maxlen = sizeof(*msg_a) + sizeof(msg_b) +
+                ceph_x_encrypt_buflen(ticket_blob_len);
+        dout("  need len %d\n", maxlen);
+        if (au->buf && au->buf->alloc_len < maxlen) {
+                ceph_buffer_put(au->buf);
+                au->buf = NULL;
+        }
+        if (!au->buf) {
+                au->buf = ceph_buffer_new(maxlen, GFP_NOFS);
+                if (!au->buf)
+                        return -ENOMEM;
+        }
+        au->service = th->service;
+
+        msg_a = au->buf->vec.iov_base;
+        msg_a->struct_v = 1;
+        msg_a->global_id = cpu_to_le64(ac->global_id);
+        msg_a->service_id = cpu_to_le32(th->service);
+        msg_a->ticket_blob.struct_v = 1;
+        msg_a->ticket_blob.secret_id = cpu_to_le64(th->secret_id);
+        msg_a->ticket_blob.blob_len = cpu_to_le32(ticket_blob_len);
+        if (ticket_blob_len) {
+                memcpy(msg_a->ticket_blob.blob, th->ticket_blob->vec.iov_base,
+                       th->ticket_blob->vec.iov_len);
+        }
+        dout(" th %p secret_id %lld %lld\n", th, th->secret_id,
+             le64_to_cpu(msg_a->ticket_blob.secret_id));
+
+        p = msg_a + 1;
+        p += ticket_blob_len;
+        end = au->buf->vec.iov_base + au->buf->vec.iov_len;
+
+        get_random_bytes(&au->nonce, sizeof(au->nonce));
+        msg_b.struct_v = 1;
+        msg_b.nonce = cpu_to_le64(au->nonce);
+        ret = ceph_x_encrypt(&th->session_key, &msg_b, sizeof(msg_b),
+                             p, end - p);
+        if (ret < 0)
+                goto out_buf;
+        p += ret;
+        au->buf->vec.iov_len = p - au->buf->vec.iov_base;
+        dout(" built authorizer nonce %llx len %d\n", au->nonce,
+             (int)au->buf->vec.iov_len);
+        BUG_ON(au->buf->vec.iov_len > maxlen);
+        return 0;
+
+out_buf:
+        ceph_buffer_put(au->buf);
+        au->buf = NULL;
+        return ret;
+}
+
+static int ceph_x_encode_ticket(struct ceph_x_ticket_handler *th,
+                                void **p, void *end)
+{
+        ceph_decode_need(p, end, 1 + sizeof(u64), bad);
+        ceph_encode_8(p, 1);
+        ceph_encode_64(p, th->secret_id);
+        if (th->ticket_blob) {
+                const char *buf = th->ticket_blob->vec.iov_base;
+                u32 len = th->ticket_blob->vec.iov_len;
+
+                ceph_encode_32_safe(p, end, len, bad);
+                ceph_encode_copy_safe(p, end, buf, len, bad);
+        } else {
+                ceph_encode_32_safe(p, end, 0, bad);
+        }
+
+        return 0;
+bad:
+        return -ERANGE;
+}
+
+static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed)
+{
+        int want = ac->want_keys;
+        struct ceph_x_info *xi = ac->private;
+        int service;
+
+        *pneed = ac->want_keys & ~(xi->have_keys);
+
+        for (service = 1; service <= want; service <<= 1) {
+                struct ceph_x_ticket_handler *th;
+
+                if (!(ac->want_keys & service))
+                        continue;
+
+                if (*pneed & service)
+                        continue;
+
+                th = get_ticket_handler(ac, service);
+
+                if (!th) {
+                        *pneed |= service;
+                        continue;
+                }
+
+                if (get_seconds() >= th->renew_after)
+                        *pneed |= service;
+                if (get_seconds() >= th->expires)
+                        xi->have_keys &= ~service;
+        }
+}
+
+
+static int ceph_x_build_request(struct ceph_auth_client *ac,
+                                void *buf, void *end)
+{
+        struct ceph_x_info *xi = ac->private;
+        int need;
+        struct ceph_x_request_header *head = buf;
+        int ret;
+        struct ceph_x_ticket_handler *th =
+                get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH);
+
+        ceph_x_validate_tickets(ac, &need);
+
+        dout("build_request want %x have %x need %x\n",
+             ac->want_keys, xi->have_keys, need);
+
+        if (need & CEPH_ENTITY_TYPE_AUTH) {
+                struct ceph_x_authenticate *auth = (void *)(head + 1);
+                void *p = auth + 1;
+                struct ceph_x_challenge_blob tmp;
+                char tmp_enc[40];
+                u64 *u;
+
+                if (p > end)
+                        return -ERANGE;
+
+                dout(" get_auth_session_key\n");
+                head->op = cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY);
+
+                /* encrypt and hash */
+                get_random_bytes(&auth->client_challenge, sizeof(u64));
+                tmp.client_challenge = auth->client_challenge;
+                tmp.server_challenge = cpu_to_le64(xi->server_challenge);
+                ret = ceph_x_encrypt(&xi->secret, &tmp, sizeof(tmp),
+                                     tmp_enc, sizeof(tmp_enc));
+                if (ret < 0)
+                        return ret;
+
+                auth->struct_v = 1;
+                auth->key = 0;
+                for (u = (u64 *)tmp_enc; u + 1 <= (u64 *)(tmp_enc + ret); u++)
+                        auth->key ^= *u;
+                dout(" server_challenge %llx client_challenge %llx key %llx\n",
+                     xi->server_challenge, le64_to_cpu(auth->client_challenge),
+                     le64_to_cpu(auth->key));
+
+                /* now encode the old ticket if exists */
+                ret = ceph_x_encode_ticket(th, &p, end);
+                if (ret < 0)
+                        return ret;
+
+                return p - buf;
+        }
+
+        if (need) {
+                void *p = head + 1;
+                struct ceph_x_service_ticket_request *req;
+
+                if (p > end)
+                        return -ERANGE;
+                head->op = cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY);
+
+                BUG_ON(!th);
+                ret = ceph_x_build_authorizer(ac, th, &xi->auth_authorizer);
+                if (ret)
+                        return ret;
+                ceph_encode_copy(&p, xi->auth_authorizer.buf->vec.iov_base,
+                                 xi->auth_authorizer.buf->vec.iov_len);
+
+                req = p;
+                req->keys = cpu_to_le32(need);
+                p += sizeof(*req);
+                return p - buf;
+        }
+
+        return 0;
+}
+
+static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result,
+                               void *buf, void *end)
+{
+        struct ceph_x_info *xi = ac->private;
+        struct ceph_x_reply_header *head = buf;
+        struct ceph_x_ticket_handler *th;
+        int len = end - buf;
+        int op;
+        int ret;
+
+        if (result)
+                return result;  /* XXX hmm? */
+
+        if (xi->starting) {
+                /* it's a hello */
+                struct ceph_x_server_challenge *sc = buf;
+
+                if (len != sizeof(*sc))
+                        return -EINVAL;
+                xi->server_challenge = le64_to_cpu(sc->server_challenge);
+                dout("handle_reply got server challenge %llx\n",
+                     xi->server_challenge);
+                xi->starting = false;
+                xi->have_keys &= ~CEPH_ENTITY_TYPE_AUTH;
+                return -EAGAIN;
+        }
+
+        op = le32_to_cpu(head->op);
+        result = le32_to_cpu(head->result);
+        dout("handle_reply op %d result %d\n", op, result);
+        switch (op) {
+        case CEPHX_GET_AUTH_SESSION_KEY:
+                /* verify auth key */
+                ret = ceph_x_proc_ticket_reply(ac, &xi->secret,
+                                               buf + sizeof(*head), end);
+                break;
+
+        case CEPHX_GET_PRINCIPAL_SESSION_KEY:
+                th = get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH);
+                BUG_ON(!th);
+                ret = ceph_x_proc_ticket_reply(ac, &th->session_key,
+                                               buf + sizeof(*head), end);
+                break;
+
+        default:
+                return -EINVAL;
+        }
+        if (ret)
+                return ret;
+        if (ac->want_keys == xi->have_keys)
+                return 0;
+        return -EAGAIN;
+}
+
+static int ceph_x_create_authorizer(
+        struct ceph_auth_client *ac, int peer_type,
+        struct ceph_authorizer **a,
+        void **buf, size_t *len,
+        void **reply_buf, size_t *reply_len)
+{
+        struct ceph_x_authorizer *au;
+        struct ceph_x_ticket_handler *th;
+        int ret;
+
+        th = get_ticket_handler(ac, peer_type);
+        if (IS_ERR(th))
+                return PTR_ERR(th);
+
+        au = kzalloc(sizeof(*au), GFP_NOFS);
+        if (!au)
+                return -ENOMEM;
+
+        ret = ceph_x_build_authorizer(ac, th, au);
+        if (ret) {
+                kfree(au);
+                return ret;
+        }
+
+        *a = (struct ceph_authorizer *)au;
+        *buf = au->buf->vec.iov_base;
+        *len = au->buf->vec.iov_len;
+        *reply_buf = au->reply_buf;
+        *reply_len = sizeof(au->reply_buf);
+        return 0;
+}
+
+static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+                                          struct ceph_authorizer *a, size_t len)
+{
+        struct ceph_x_authorizer *au = (void *)a;
+        struct ceph_x_ticket_handler *th;
+        int ret = 0;
+        struct ceph_x_authorize_reply reply;
+        void *p = au->reply_buf;
+        void *end = p + sizeof(au->reply_buf);
+
+        th = get_ticket_handler(ac, au->service);
+        if (!th)
+                return -EIO;  /* hrm! */
+        ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
+        if (ret < 0)
+                return ret;
+        if (ret != sizeof(reply))
+                return -EPERM;
+
+        if (au->nonce + 1 != le64_to_cpu(reply.nonce_plus_one))
+                ret = -EPERM;
+        else
+                ret = 0;
+        dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
+             au->nonce, le64_to_cpu(reply.nonce_plus_one), ret);
+        return ret;
+}
+
+static void ceph_x_destroy_authorizer(struct ceph_auth_client *ac,
+                                      struct ceph_authorizer *a)
+{
+        struct ceph_x_authorizer *au = (void *)a;
+
+        ceph_buffer_put(au->buf);
+        kfree(au);
+}
+
+
+static void ceph_x_reset(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+
+        dout("reset\n");
+        xi->starting = true;
+        xi->server_challenge = 0;
+}
+
+static void ceph_x_destroy(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+        struct rb_node *p;
+
+        dout("ceph_x_destroy %p\n", ac);
+        ceph_crypto_key_destroy(&xi->secret);
+
+        while ((p = rb_first(&xi->ticket_handlers)) != NULL) {
+                struct ceph_x_ticket_handler *th =
+                        rb_entry(p, struct ceph_x_ticket_handler, node);
+                remove_ticket_handler(ac, th);
+        }
+
+        kmem_cache_destroy(ceph_x_ticketbuf_cachep);
+
+        kfree(ac->private);
+        ac->private = NULL;
+}
+
+static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac,
+                                   int peer_type)
+{
+        struct ceph_x_ticket_handler *th;
+
+        th = get_ticket_handler(ac, peer_type);
+        if (th && !IS_ERR(th))
+                remove_ticket_handler(ac, th);
+}
+
+
+static const struct ceph_auth_client_ops ceph_x_ops = {
+        .is_authenticated = ceph_x_is_authenticated,
+        .build_request = ceph_x_build_request,
+        .handle_reply = ceph_x_handle_reply,
+        .create_authorizer = ceph_x_create_authorizer,
+        .verify_authorizer_reply = ceph_x_verify_authorizer_reply,
+        .destroy_authorizer = ceph_x_destroy_authorizer,
+        .invalidate_authorizer = ceph_x_invalidate_authorizer,
+        .reset =  ceph_x_reset,
+        .destroy = ceph_x_destroy,
+};
+
+
+int ceph_x_init(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi;
+        int ret;
+
+        dout("ceph_x_init %p\n", ac);
+        xi = kzalloc(sizeof(*xi), GFP_NOFS);
+        if (!xi)
+                return -ENOMEM;
+
+        ret = -ENOMEM;
+        ceph_x_ticketbuf_cachep = kmem_cache_create("ceph_x_ticketbuf",
+                                      TEMP_TICKET_BUF_LEN, 8,
+                                      (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD),
+                                      NULL);
+        if (!ceph_x_ticketbuf_cachep)
+                goto done_nomem;
+        ret = -EINVAL;
+        if (!ac->secret) {
+                pr_err("no secret set (for auth_x protocol)\n");
+                goto done_nomem;
+        }
+
+        ret = ceph_crypto_key_unarmor(&xi->secret, ac->secret);
+        if (ret)
+                goto done_nomem;
+
+        xi->starting = true;
+        xi->ticket_handlers = RB_ROOT;
+
+        ac->protocol = CEPH_AUTH_CEPHX;
+        ac->private = xi;
+        ac->ops = &ceph_x_ops;
+        return 0;
+
+done_nomem:
+        kfree(xi);
+        if (ceph_x_ticketbuf_cachep)
+                kmem_cache_destroy(ceph_x_ticketbuf_cachep);
+        return ret;
+}
+
+
diff --git a/fs/ceph/auth_x.h b/fs/ceph/auth_x.h
new file mode 100644
index 000000000000..ff6f8180e681
--- /dev/null
+++ b/fs/ceph/auth_x.h
@@ -0,0 +1,49 @@
+#ifndef _FS_CEPH_AUTH_X_H
+#define _FS_CEPH_AUTH_X_H
+
+#include <linux/rbtree.h>
+
+#include "crypto.h"
+#include "auth.h"
+#include "auth_x_protocol.h"
+
+/*
+ * Handle ticket for a single service.
+ */
+struct ceph_x_ticket_handler {
+        struct rb_node node;
+        unsigned service;
+
+        struct ceph_crypto_key session_key;
+        struct ceph_timespec validity;
+
+        u64 secret_id;
+        struct ceph_buffer *ticket_blob;
+
+        unsigned long renew_after, expires;
+};
+
+
+struct ceph_x_authorizer {
+        struct ceph_buffer *buf;
+        unsigned service;
+        u64 nonce;
+        char reply_buf[128];  /* big enough for encrypted blob */
+};
+
+struct ceph_x_info {
+        struct ceph_crypto_key secret;
+
+        bool starting;
+        u64 server_challenge;
+
+        unsigned have_keys;
+        struct rb_root ticket_handlers;
+
+        struct ceph_x_authorizer auth_authorizer;
+};
+
+extern int ceph_x_init(struct ceph_auth_client *ac);
+
+#endif
+
diff --git a/fs/ceph/auth_x_protocol.h b/fs/ceph/auth_x_protocol.h
new file mode 100644
index 000000000000..671d30576c4f
--- /dev/null
+++ b/fs/ceph/auth_x_protocol.h
@@ -0,0 +1,90 @@
+#ifndef __FS_CEPH_AUTH_X_PROTOCOL
+#define __FS_CEPH_AUTH_X_PROTOCOL
+
+#define CEPHX_GET_AUTH_SESSION_KEY      0x0100
+#define CEPHX_GET_PRINCIPAL_SESSION_KEY 0x0200
+#define CEPHX_GET_ROTATING_KEY          0x0400
+
+/* common bits */
+struct ceph_x_ticket_blob {
+        __u8 struct_v;
+        __le64 secret_id;
+        __le32 blob_len;
+        char blob[];
+} __attribute__ ((packed));
+
+
+/* common request/reply headers */
+struct ceph_x_request_header {
+        __le16 op;
+} __attribute__ ((packed));
+
+struct ceph_x_reply_header {
+        __le16 op;
+        __le32 result;
+} __attribute__ ((packed));
+
+
+/* authenticate handshake */
+
+/* initial hello (no reply header) */
+struct ceph_x_server_challenge {
+        __u8 struct_v;
+        __le64 server_challenge;
+} __attribute__ ((packed));
+
+struct ceph_x_authenticate {
+        __u8 struct_v;
+        __le64 client_challenge;
+        __le64 key;
+        /* ticket blob */
+} __attribute__ ((packed));
+
+struct ceph_x_service_ticket_request {
+        __u8 struct_v;
+        __le32 keys;
+} __attribute__ ((packed));
+
+struct ceph_x_challenge_blob {
+        __le64 server_challenge;
+        __le64 client_challenge;
+} __attribute__ ((packed));
+
+
+
+/* authorize handshake */
+
+/*
+ * The authorizer consists of two pieces:
+ *  a - service id, ticket blob
+ *  b - encrypted with session key
+ */
+struct ceph_x_authorize_a {
+        __u8 struct_v;
+        __le64 global_id;
+        __le32 service_id;
+        struct ceph_x_ticket_blob ticket_blob;
+} __attribute__ ((packed));
+
+struct ceph_x_authorize_b {
+        __u8 struct_v;
+        __le64 nonce;
+} __attribute__ ((packed));
+
+struct ceph_x_authorize_reply {
+        __u8 struct_v;
+        __le64 nonce_plus_one;
+} __attribute__ ((packed));
+
+
+/*
+ * encyption bundle
+ */
+#define CEPHX_ENC_MAGIC 0xff009cad8826aa55ull
+
+struct ceph_x_encrypt_header {
+        __u8 struct_v;
+        __le64 magic;
+} __attribute__ ((packed));
+
+#endif
diff --git a/fs/ceph/buffer.c b/fs/ceph/buffer.c
new file mode 100644
index 000000000000..c67535d70aa6
--- /dev/null
+++ b/fs/ceph/buffer.c
@@ -0,0 +1,81 @@
+
+#include "ceph_debug.h"
+
+#include <linux/slab.h>
+
+#include "buffer.h"
+#include "decode.h"
+
+struct ceph_buffer *ceph_buffer_new(size_t len, gfp_t gfp)
+{
+        struct ceph_buffer *b;
+
+        b = kmalloc(sizeof(*b), gfp);
+        if (!b)
+                return NULL;
+
+        b->vec.iov_base = kmalloc(len, gfp | __GFP_NOWARN);
+        if (b->vec.iov_base) {
+                b->is_vmalloc = false;
+        } else {
+                b->vec.iov_base = __vmalloc(len, gfp, PAGE_KERNEL);
+                if (!b->vec.iov_base) {
+                        kfree(b);
+                        return NULL;
+                }
+                b->is_vmalloc = true;
+        }
+
+        kref_init(&b->kref);
+        b->alloc_len = len;
+        b->vec.iov_len = len;
+        dout("buffer_new %p\n", b);
+        return b;
+}
+
+void ceph_buffer_release(struct kref *kref)
+{
+        struct ceph_buffer *b = container_of(kref, struct ceph_buffer, kref);
+
+        dout("buffer_release %p\n", b);
+        if (b->vec.iov_base) {
+                if (b->is_vmalloc)
+                        vfree(b->vec.iov_base);
+                else
+                        kfree(b->vec.iov_base);
+        }
+        kfree(b);
+}
+
+int ceph_buffer_alloc(struct ceph_buffer *b, int len, gfp_t gfp)
+{
+        b->vec.iov_base = kmalloc(len, gfp | __GFP_NOWARN);
+        if (b->vec.iov_base) {
+                b->is_vmalloc = false;
+        } else {
+                b->vec.iov_base = __vmalloc(len, gfp, PAGE_KERNEL);
+                b->is_vmalloc = true;
+        }
+        if (!b->vec.iov_base)
+                return -ENOMEM;
+        b->alloc_len = len;
+        b->vec.iov_len = len;
+        return 0;
+}
+
+int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end)
+{
+        size_t len;
+
+        ceph_decode_need(p, end, sizeof(u32), bad);
+        len = ceph_decode_32(p);
+        dout("decode_buffer len %d\n", (int)len);
+        ceph_decode_need(p, end, len, bad);
+        *b = ceph_buffer_new(len, GFP_NOFS);
+        if (!*b)
+                return -ENOMEM;
+        ceph_decode_copy(p, (*b)->vec.iov_base, len);
+        return 0;
+bad:
+        return -EINVAL;
+}
diff --git a/fs/ceph/buffer.h b/fs/ceph/buffer.h
new file mode 100644
index 000000000000..58d19014068f
--- /dev/null
+++ b/fs/ceph/buffer.h
@@ -0,0 +1,39 @@
+#ifndef __FS_CEPH_BUFFER_H
+#define __FS_CEPH_BUFFER_H
+
+#include <linux/kref.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
+#include <linux/types.h>
+#include <linux/uio.h>
+
+/*
+ * a simple reference counted buffer.
+ *
+ * use kmalloc for small sizes (<= one page), vmalloc for larger
+ * sizes.
+ */
+struct ceph_buffer {
+        struct kref kref;
+        struct kvec vec;
+        size_t alloc_len;
+        bool is_vmalloc;
+};
+
+extern struct ceph_buffer *ceph_buffer_new(size_t len, gfp_t gfp);
+extern void ceph_buffer_release(struct kref *kref);
+
+static inline struct ceph_buffer *ceph_buffer_get(struct ceph_buffer *b)
+{
+        kref_get(&b->kref);
+        return b;
+}
+
+static inline void ceph_buffer_put(struct ceph_buffer *b)
+{
+        kref_put(&b->kref, ceph_buffer_release);
+}
+
+extern int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end);
+
+#endif
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
new file mode 100644
index 000000000000..aa2239fa9a3b
--- /dev/null
+++ b/fs/ceph/caps.c
@@ -0,0 +1,2955 @@
+#include "ceph_debug.h"
+
+#include <linux/fs.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/wait.h>
+#include <linux/writeback.h>
+
+#include "super.h"
+#include "decode.h"
+#include "messenger.h"
+
+/*
+ * Capability management
+ *
+ * The Ceph metadata servers control client access to inode metadata
+ * and file data by issuing capabilities, granting clients permission
+ * to read and/or write both inode field and file data to OSDs
+ * (storage nodes).  Each capability consists of a set of bits
+ * indicating which operations are allowed.
+ *
+ * If the client holds a *_SHARED cap, the client has a coherent value
+ * that can be safely read from the cached inode.
+ *
+ * In the case of a *_EXCL (exclusive) or FILE_WR capabilities, the
+ * client is allowed to change inode attributes (e.g., file size,
+ * mtime), note its dirty state in the ceph_cap, and asynchronously
+ * flush that metadata change to the MDS.
+ *
+ * In the event of a conflicting operation (perhaps by another
+ * client), the MDS will revoke the conflicting client capabilities.
+ *
+ * In order for a client to cache an inode, it must hold a capability
+ * with at least one MDS server.  When inodes are released, release
+ * notifications are batched and periodically sent en masse to the MDS
+ * cluster to release server state.
+ */
+
+
+/*
+ * Generate readable cap strings for debugging output.
+ */
+#define MAX_CAP_STR 20
+static char cap_str[MAX_CAP_STR][40];
+static DEFINE_SPINLOCK(cap_str_lock);
+static int last_cap_str;
+
+static char *gcap_string(char *s, int c)
+{
+        if (c & CEPH_CAP_GSHARED)
+                *s++ = 's';
+        if (c & CEPH_CAP_GEXCL)
+                *s++ = 'x';
+        if (c & CEPH_CAP_GCACHE)
+                *s++ = 'c';
+        if (c & CEPH_CAP_GRD)
+                *s++ = 'r';
+        if (c & CEPH_CAP_GWR)
+                *s++ = 'w';
+        if (c & CEPH_CAP_GBUFFER)
+                *s++ = 'b';
+        if (c & CEPH_CAP_GLAZYIO)
+                *s++ = 'l';
+        return s;
+}
+
+const char *ceph_cap_string(int caps)
+{
+        int i;
+        char *s;
+        int c;
+
+        spin_lock(&cap_str_lock);
+        i = last_cap_str++;
+        if (last_cap_str == MAX_CAP_STR)
+                last_cap_str = 0;
+        spin_unlock(&cap_str_lock);
+
+        s = cap_str[i];
+
+        if (caps & CEPH_CAP_PIN)
+                *s++ = 'p';
+
+        c = (caps >> CEPH_CAP_SAUTH) & 3;
+        if (c) {
+                *s++ = 'A';
+                s = gcap_string(s, c);
+        }
+
+        c = (caps >> CEPH_CAP_SLINK) & 3;
+        if (c) {
+                *s++ = 'L';
+                s = gcap_string(s, c);
+        }
+
+        c = (caps >> CEPH_CAP_SXATTR) & 3;
+        if (c) {
+                *s++ = 'X';
+                s = gcap_string(s, c);
+        }
+
+        c = caps >> CEPH_CAP_SFILE;
+        if (c) {
+                *s++ = 'F';
+                s = gcap_string(s, c);
+        }
+
+        if (s == cap_str[i])
+                *s++ = '-';
+        *s = 0;
+        return cap_str[i];
+}
+
+/*
+ * Cap reservations
+ *
+ * Maintain a global pool of preallocated struct ceph_caps, referenced
+ * by struct ceph_caps_reservations.  This ensures that we preallocate
+ * memory needed to successfully process an MDS response.  (If an MDS
+ * sends us cap information and we fail to process it, we will have
+ * problems due to the client and MDS being out of sync.)
+ *
+ * Reservations are 'owned' by a ceph_cap_reservation context.
+ */
+static spinlock_t caps_list_lock;
+static struct list_head caps_list;  /* unused (reserved or unreserved) */
+static int caps_total_count;        /* total caps allocated */
+static int caps_use_count;          /* in use */
+static int caps_reserve_count;      /* unused, reserved */
+static int caps_avail_count;        /* unused, unreserved */
+static int caps_min_count;          /* keep at least this many (unreserved) */
+
+void __init ceph_caps_init(void)
+{
+        INIT_LIST_HEAD(&caps_list);
+        spin_lock_init(&caps_list_lock);
+}
+
+void ceph_caps_finalize(void)
+{
+        struct ceph_cap *cap;
+
+        spin_lock(&caps_list_lock);
+        while (!list_empty(&caps_list)) {
+                cap = list_first_entry(&caps_list, struct ceph_cap, caps_item);
+                list_del(&cap->caps_item);
+                kmem_cache_free(ceph_cap_cachep, cap);
+        }
+        caps_total_count = 0;
+        caps_avail_count = 0;
+        caps_use_count = 0;
+        caps_reserve_count = 0;
+        caps_min_count = 0;
+        spin_unlock(&caps_list_lock);
+}
+
+void ceph_adjust_min_caps(int delta)
+{
+        spin_lock(&caps_list_lock);
+        caps_min_count += delta;
+        BUG_ON(caps_min_count < 0);
+        spin_unlock(&caps_list_lock);
+}
+
+int ceph_reserve_caps(struct ceph_cap_reservation *ctx, int need)
+{
+        int i;
+        struct ceph_cap *cap;
+        int have;
+        int alloc = 0;
+        LIST_HEAD(newcaps);
+        int ret = 0;
+
+        dout("reserve caps ctx=%p need=%d\n", ctx, need);
+
+        /* first reserve any caps that are already allocated */
+        spin_lock(&caps_list_lock);
+        if (caps_avail_count >= need)
+                have = need;
+        else
+                have = caps_avail_count;
+        caps_avail_count -= have;
+        caps_reserve_count += have;
+        BUG_ON(caps_total_count != caps_use_count + caps_reserve_count +
+               caps_avail_count);
+        spin_unlock(&caps_list_lock);
+
+        for (i = have; i < need; i++) {
+                cap = kmem_cache_alloc(ceph_cap_cachep, GFP_NOFS);
+                if (!cap) {
+                        ret = -ENOMEM;
+                        goto out_alloc_count;
+                }
+                list_add(&cap->caps_item, &newcaps);
+                alloc++;
+        }
+        BUG_ON(have + alloc != need);
+
+        spin_lock(&caps_list_lock);
+        caps_total_count += alloc;
+        caps_reserve_count += alloc;
+        list_splice(&newcaps, &caps_list);
+
+        BUG_ON(caps_total_count != caps_use_count + caps_reserve_count +
+               caps_avail_count);
+        spin_unlock(&caps_list_lock);
+
+        ctx->count = need;
+        dout("reserve caps ctx=%p %d = %d used + %d resv + %d avail\n",
+             ctx, caps_total_count, caps_use_count, caps_reserve_count,
+             caps_avail_count);
+        return 0;
+
+out_alloc_count:
+        /* we didn't manage to reserve as much as we needed */
+        pr_warning("reserve caps ctx=%p ENOMEM need=%d got=%d\n",
+                   ctx, need, have);
+        return ret;
+}
+
+int ceph_unreserve_caps(struct ceph_cap_reservation *ctx)
+{
+        dout("unreserve caps ctx=%p count=%d\n", ctx, ctx->count);
+        if (ctx->count) {
+                spin_lock(&caps_list_lock);
+                BUG_ON(caps_reserve_count < ctx->count);
+                caps_reserve_count -= ctx->count;
+                caps_avail_count += ctx->count;
+                ctx->count = 0;
+                dout("unreserve caps %d = %d used + %d resv + %d avail\n",
+                     caps_total_count, caps_use_count, caps_reserve_count,
+                     caps_avail_count);
+                BUG_ON(caps_total_count != caps_use_count + caps_reserve_count +
+                       caps_avail_count);
+                spin_unlock(&caps_list_lock);
+        }
+        return 0;
+}
+
+static struct ceph_cap *get_cap(struct ceph_cap_reservation *ctx)
+{
+        struct ceph_cap *cap = NULL;
+
+        /* temporary, until we do something about cap import/export */
+        if (!ctx)
+                return kmem_cache_alloc(ceph_cap_cachep, GFP_NOFS);
+
+        spin_lock(&caps_list_lock);
+        dout("get_cap ctx=%p (%d) %d = %d used + %d resv + %d avail\n",
+             ctx, ctx->count, caps_total_count, caps_use_count,
+             caps_reserve_count, caps_avail_count);
+        BUG_ON(!ctx->count);
+        BUG_ON(ctx->count > caps_reserve_count);
+        BUG_ON(list_empty(&caps_list));
+
+        ctx->count--;
+        caps_reserve_count--;
+        caps_use_count++;
+
+        cap = list_first_entry(&caps_list, struct ceph_cap, caps_item);
+        list_del(&cap->caps_item);
+
+        BUG_ON(caps_total_count != caps_use_count + caps_reserve_count +
+               caps_avail_count);
+        spin_unlock(&caps_list_lock);
+        return cap;
+}
+
+void ceph_put_cap(struct ceph_cap *cap)
+{
+        spin_lock(&caps_list_lock);
+        dout("put_cap %p %d = %d used + %d resv + %d avail\n",
+             cap, caps_total_count, caps_use_count,
+             caps_reserve_count, caps_avail_count);
+        caps_use_count--;
+        /*
+         * Keep some preallocated caps around (ceph_min_count), to
+         * avoid lots of free/alloc churn.
+         */
+        if (caps_avail_count >= caps_reserve_count + caps_min_count) {
+                caps_total_count--;
+                kmem_cache_free(ceph_cap_cachep, cap);
+        } else {
+                caps_avail_count++;
+                list_add(&cap->caps_item, &caps_list);
+        }
+
+        BUG_ON(caps_total_count != caps_use_count + caps_reserve_count +
+               caps_avail_count);
+        spin_unlock(&caps_list_lock);
+}
+
+void ceph_reservation_status(struct ceph_client *client,
+                             int *total, int *avail, int *used, int *reserved,
+                             int *min)
+{
+        if (total)
+                *total = caps_total_count;
+        if (avail)
+                *avail = caps_avail_count;
+        if (used)
+                *used = caps_use_count;
+        if (reserved)
+                *reserved = caps_reserve_count;
+        if (min)
+                *min = caps_min_count;
+}
+
+/*
+ * Find ceph_cap for given mds, if any.
+ *
+ * Called with i_lock held.
+ */
+static struct ceph_cap *__get_cap_for_mds(struct ceph_inode_info *ci, int mds)
+{
+        struct ceph_cap *cap;
+        struct rb_node *n = ci->i_caps.rb_node;
+
+        while (n) {
+                cap = rb_entry(n, struct ceph_cap, ci_node);
+                if (mds < cap->mds)
+                        n = n->rb_left;
+                else if (mds > cap->mds)
+                        n = n->rb_right;
+                else
+                        return cap;
+        }
+        return NULL;
+}
+
+/*
+ * Return id of any MDS with a cap, preferably FILE_WR|WRBUFFER|EXCL, else
+ * -1.
+ */
+static int __ceph_get_cap_mds(struct ceph_inode_info *ci, u32 *mseq)
+{
+        struct ceph_cap *cap;
+        int mds = -1;
+        struct rb_node *p;
+
+        /* prefer mds with WR|WRBUFFER|EXCL caps */
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                mds = cap->mds;
+                if (mseq)
+                        *mseq = cap->mseq;
+                if (cap->issued & (CEPH_CAP_FILE_WR |
+                                   CEPH_CAP_FILE_BUFFER |
+                                   CEPH_CAP_FILE_EXCL))
+                        break;
+        }
+        return mds;
+}
+
+int ceph_get_cap_mds(struct inode *inode)
+{
+        int mds;
+        spin_lock(&inode->i_lock);
+        mds = __ceph_get_cap_mds(ceph_inode(inode), NULL);
+        spin_unlock(&inode->i_lock);
+        return mds;
+}
+
+/*
+ * Called under i_lock.
+ */
+static void __insert_cap_node(struct ceph_inode_info *ci,
+                              struct ceph_cap *new)
+{
+        struct rb_node **p = &ci->i_caps.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_cap *cap = NULL;
+
+        while (*p) {
+                parent = *p;
+                cap = rb_entry(parent, struct ceph_cap, ci_node);
+                if (new->mds < cap->mds)
+                        p = &(*p)->rb_left;
+                else if (new->mds > cap->mds)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->ci_node, parent, p);
+        rb_insert_color(&new->ci_node, &ci->i_caps);
+}
+
+/*
+ * (re)set cap hold timeouts, which control the delayed release
+ * of unused caps back to the MDS.  Should be called on cap use.
+ */
+static void __cap_set_timeouts(struct ceph_mds_client *mdsc,
+                               struct ceph_inode_info *ci)
+{
+        struct ceph_mount_args *ma = mdsc->client->mount_args;
+
+        ci->i_hold_caps_min = round_jiffies(jiffies +
+                                            ma->caps_wanted_delay_min * HZ);
+        ci->i_hold_caps_max = round_jiffies(jiffies +
+                                            ma->caps_wanted_delay_max * HZ);
+        dout("__cap_set_timeouts %p min %lu max %lu\n", &ci->vfs_inode,
+             ci->i_hold_caps_min - jiffies, ci->i_hold_caps_max - jiffies);
+}
+
+/*
+ * (Re)queue cap at the end of the delayed cap release list.
+ *
+ * If I_FLUSH is set, leave the inode at the front of the list.
+ *
+ * Caller holds i_lock
+ *    -> we take mdsc->cap_delay_lock
+ */
+static void __cap_delay_requeue(struct ceph_mds_client *mdsc,
+                                struct ceph_inode_info *ci)
+{
+        __cap_set_timeouts(mdsc, ci);
+        dout("__cap_delay_requeue %p flags %d at %lu\n", &ci->vfs_inode,
+             ci->i_ceph_flags, ci->i_hold_caps_max);
+        if (!mdsc->stopping) {
+                spin_lock(&mdsc->cap_delay_lock);
+                if (!list_empty(&ci->i_cap_delay_list)) {
+                        if (ci->i_ceph_flags & CEPH_I_FLUSH)
+                                goto no_change;
+                        list_del_init(&ci->i_cap_delay_list);
+                }
+                list_add_tail(&ci->i_cap_delay_list, &mdsc->cap_delay_list);
+no_change:
+                spin_unlock(&mdsc->cap_delay_lock);
+        }
+}
+
+/*
+ * Queue an inode for immediate writeback.  Mark inode with I_FLUSH,
+ * indicating we should send a cap message to flush dirty metadata
+ * asap, and move to the front of the delayed cap list.
+ */
+static void __cap_delay_requeue_front(struct ceph_mds_client *mdsc,
+                                      struct ceph_inode_info *ci)
+{
+        dout("__cap_delay_requeue_front %p\n", &ci->vfs_inode);
+        spin_lock(&mdsc->cap_delay_lock);
+        ci->i_ceph_flags |= CEPH_I_FLUSH;
+        if (!list_empty(&ci->i_cap_delay_list))
+                list_del_init(&ci->i_cap_delay_list);
+        list_add(&ci->i_cap_delay_list, &mdsc->cap_delay_list);
+        spin_unlock(&mdsc->cap_delay_lock);
+}
+
+/*
+ * Cancel delayed work on cap.
+ *
+ * Caller must hold i_lock.
+ */
+static void __cap_delay_cancel(struct ceph_mds_client *mdsc,
+                               struct ceph_inode_info *ci)
+{
+        dout("__cap_delay_cancel %p\n", &ci->vfs_inode);
+        if (list_empty(&ci->i_cap_delay_list))
+                return;
+        spin_lock(&mdsc->cap_delay_lock);
+        list_del_init(&ci->i_cap_delay_list);
+        spin_unlock(&mdsc->cap_delay_lock);
+}
+
+/*
+ * Common issue checks for add_cap, handle_cap_grant.
+ */
+static void __check_cap_issue(struct ceph_inode_info *ci, struct ceph_cap *cap,
+                              unsigned issued)
+{
+        unsigned had = __ceph_caps_issued(ci, NULL);
+
+        /*
+         * Each time we receive FILE_CACHE anew, we increment
+         * i_rdcache_gen.
+         */
+        if ((issued & CEPH_CAP_FILE_CACHE) &&
+            (had & CEPH_CAP_FILE_CACHE) == 0)
+                ci->i_rdcache_gen++;
+
+        /*
+         * if we are newly issued FILE_SHARED, clear I_COMPLETE; we
+         * don't know what happened to this directory while we didn't
+         * have the cap.
+         */
+        if ((issued & CEPH_CAP_FILE_SHARED) &&
+            (had & CEPH_CAP_FILE_SHARED) == 0) {
+                ci->i_shared_gen++;
+                if (S_ISDIR(ci->vfs_inode.i_mode)) {
+                        dout(" marking %p NOT complete\n", &ci->vfs_inode);
+                        ci->i_ceph_flags &= ~CEPH_I_COMPLETE;
+                }
+        }
+}
+
+/*
+ * Add a capability under the given MDS session.
+ *
+ * Caller should hold session snap_rwsem (read) and s_mutex.
+ *
+ * @fmode is the open file mode, if we are opening a file, otherwise
+ * it is < 0.  (This is so we can atomically add the cap and add an
+ * open file reference to it.)
+ */
+int ceph_add_cap(struct inode *inode,
+                 struct ceph_mds_session *session, u64 cap_id,
+                 int fmode, unsigned issued, unsigned wanted,
+                 unsigned seq, unsigned mseq, u64 realmino, int flags,
+                 struct ceph_cap_reservation *caps_reservation)
+{
+        struct ceph_mds_client *mdsc = &ceph_inode_to_client(inode)->mdsc;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_cap *new_cap = NULL;
+        struct ceph_cap *cap;
+        int mds = session->s_mds;
+        int actual_wanted;
+
+        dout("add_cap %p mds%d cap %llx %s seq %d\n", inode,
+             session->s_mds, cap_id, ceph_cap_string(issued), seq);
+
+        /*
+         * If we are opening the file, include file mode wanted bits
+         * in wanted.
+         */
+        if (fmode >= 0)
+                wanted |= ceph_caps_for_mode(fmode);
+
+retry:
+        spin_lock(&inode->i_lock);
+        cap = __get_cap_for_mds(ci, mds);
+        if (!cap) {
+                if (new_cap) {
+                        cap = new_cap;
+                        new_cap = NULL;
+                } else {
+                        spin_unlock(&inode->i_lock);
+                        new_cap = get_cap(caps_reservation);
+                        if (new_cap == NULL)
+                                return -ENOMEM;
+                        goto retry;
+                }
+
+                cap->issued = 0;
+                cap->implemented = 0;
+                cap->mds = mds;
+                cap->mds_wanted = 0;
+
+                cap->ci = ci;
+                __insert_cap_node(ci, cap);
+
+                /* clear out old exporting info?  (i.e. on cap import) */
+                if (ci->i_cap_exporting_mds == mds) {
+                        ci->i_cap_exporting_issued = 0;
+                        ci->i_cap_exporting_mseq = 0;
+                        ci->i_cap_exporting_mds = -1;
+                }
+
+                /* add to session cap list */
+                cap->session = session;
+                spin_lock(&session->s_cap_lock);
+                list_add_tail(&cap->session_caps, &session->s_caps);
+                session->s_nr_caps++;
+                spin_unlock(&session->s_cap_lock);
+        }
+
+        if (!ci->i_snap_realm) {
+                /*
+                 * add this inode to the appropriate snap realm
+                 */
+                struct ceph_snap_realm *realm = ceph_lookup_snap_realm(mdsc,
+                                                               realmino);
+                if (realm) {
+                        ceph_get_snap_realm(mdsc, realm);
+                        spin_lock(&realm->inodes_with_caps_lock);
+                        ci->i_snap_realm = realm;
+                        list_add(&ci->i_snap_realm_item,
+                                 &realm->inodes_with_caps);
+                        spin_unlock(&realm->inodes_with_caps_lock);
+                } else {
+                        pr_err("ceph_add_cap: couldn't find snap realm %llx\n",
+                               realmino);
+                }
+        }
+
+        __check_cap_issue(ci, cap, issued);
+
+        /*
+         * If we are issued caps we don't want, or the mds' wanted
+         * value appears to be off, queue a check so we'll release
+         * later and/or update the mds wanted value.
+         */
+        actual_wanted = __ceph_caps_wanted(ci);
+        if ((wanted & ~actual_wanted) ||
+            (issued & ~actual_wanted & CEPH_CAP_ANY_WR)) {
+                dout(" issued %s, mds wanted %s, actual %s, queueing\n",
+                     ceph_cap_string(issued), ceph_cap_string(wanted),
+                     ceph_cap_string(actual_wanted));
+                __cap_delay_requeue(mdsc, ci);
+        }
+
+        if (flags & CEPH_CAP_FLAG_AUTH)
+                ci->i_auth_cap = cap;
+        else if (ci->i_auth_cap == cap)
+                ci->i_auth_cap = NULL;
+
+        dout("add_cap inode %p (%llx.%llx) cap %p %s now %s seq %d mds%d\n",
+             inode, ceph_vinop(inode), cap, ceph_cap_string(issued),
+             ceph_cap_string(issued|cap->issued), seq, mds);
+        cap->cap_id = cap_id;
+        cap->issued = issued;
+        cap->implemented |= issued;
+        cap->mds_wanted |= wanted;
+        cap->seq = seq;
+        cap->issue_seq = seq;
+        cap->mseq = mseq;
+        cap->cap_gen = session->s_cap_gen;
+
+        if (fmode >= 0)
+                __ceph_get_fmode(ci, fmode);
+        spin_unlock(&inode->i_lock);
+        wake_up(&ci->i_cap_wq);
+        return 0;
+}
+
+/*
+ * Return true if cap has not timed out and belongs to the current
+ * generation of the MDS session (i.e. has not gone 'stale' due to
+ * us losing touch with the mds).
+ */
+static int __cap_is_valid(struct ceph_cap *cap)
+{
+        unsigned long ttl;
+        u32 gen;
+
+        spin_lock(&cap->session->s_cap_lock);
+        gen = cap->session->s_cap_gen;
+        ttl = cap->session->s_cap_ttl;
+        spin_unlock(&cap->session->s_cap_lock);
+
+        if (cap->cap_gen < gen || time_after_eq(jiffies, ttl)) {
+                dout("__cap_is_valid %p cap %p issued %s "
+                     "but STALE (gen %u vs %u)\n", &cap->ci->vfs_inode,
+                     cap, ceph_cap_string(cap->issued), cap->cap_gen, gen);
+                return 0;
+        }
+
+        return 1;
+}
+
+/*
+ * Return set of valid cap bits issued to us.  Note that caps time
+ * out, and may be invalidated in bulk if the client session times out
+ * and session->s_cap_gen is bumped.
+ */
+int __ceph_caps_issued(struct ceph_inode_info *ci, int *implemented)
+{
+        int have = ci->i_snap_caps | ci->i_cap_exporting_issued;
+        struct ceph_cap *cap;
+        struct rb_node *p;
+
+        if (implemented)
+                *implemented = 0;
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                if (!__cap_is_valid(cap))
+                        continue;
+                dout("__ceph_caps_issued %p cap %p issued %s\n",
+                     &ci->vfs_inode, cap, ceph_cap_string(cap->issued));
+                have |= cap->issued;
+                if (implemented)
+                        *implemented |= cap->implemented;
+        }
+        return have;
+}
+
+/*
+ * Get cap bits issued by caps other than @ocap
+ */
+int __ceph_caps_issued_other(struct ceph_inode_info *ci, struct ceph_cap *ocap)
+{
+        int have = ci->i_snap_caps;
+        struct ceph_cap *cap;
+        struct rb_node *p;
+
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                if (cap == ocap)
+                        continue;
+                if (!__cap_is_valid(cap))
+                        continue;
+                have |= cap->issued;
+        }
+        return have;
+}
+
+/*
+ * Move a cap to the end of the LRU (oldest caps at list head, newest
+ * at list tail).
+ */
+static void __touch_cap(struct ceph_cap *cap)
+{
+        struct ceph_mds_session *s = cap->session;
+
+        spin_lock(&s->s_cap_lock);
+        if (s->s_cap_iterator == NULL) {
+                dout("__touch_cap %p cap %p mds%d\n", &cap->ci->vfs_inode, cap,
+                     s->s_mds);
+                list_move_tail(&cap->session_caps, &s->s_caps);
+        } else {
+                dout("__touch_cap %p cap %p mds%d NOP, iterating over caps\n",
+                     &cap->ci->vfs_inode, cap, s->s_mds);
+        }
+        spin_unlock(&s->s_cap_lock);
+}
+
+/*
+ * Check if we hold the given mask.  If so, move the cap(s) to the
+ * front of their respective LRUs.  (This is the preferred way for
+ * callers to check for caps they want.)
+ */
+int __ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask, int touch)
+{
+        struct ceph_cap *cap;
+        struct rb_node *p;
+        int have = ci->i_snap_caps;
+
+        if ((have & mask) == mask) {
+                dout("__ceph_caps_issued_mask %p snap issued %s"
+                     " (mask %s)\n", &ci->vfs_inode,
+                     ceph_cap_string(have),
+                     ceph_cap_string(mask));
+                return 1;
+        }
+
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                if (!__cap_is_valid(cap))
+                        continue;
+                if ((cap->issued & mask) == mask) {
+                        dout("__ceph_caps_issued_mask %p cap %p issued %s"
+                             " (mask %s)\n", &ci->vfs_inode, cap,
+                             ceph_cap_string(cap->issued),
+                             ceph_cap_string(mask));
+                        if (touch)
+                                __touch_cap(cap);
+                        return 1;
+                }
+
+                /* does a combination of caps satisfy mask? */
+                have |= cap->issued;
+                if ((have & mask) == mask) {
+                        dout("__ceph_caps_issued_mask %p combo issued %s"
+                             " (mask %s)\n", &ci->vfs_inode,
+                             ceph_cap_string(cap->issued),
+                             ceph_cap_string(mask));
+                        if (touch) {
+                                struct rb_node *q;
+
+                                /* touch this + preceeding caps */
+                                __touch_cap(cap);
+                                for (q = rb_first(&ci->i_caps); q != p;
+                                     q = rb_next(q)) {
+                                        cap = rb_entry(q, struct ceph_cap,
+                                                       ci_node);
+                                        if (!__cap_is_valid(cap))
+                                                continue;
+                                        __touch_cap(cap);
+                                }
+                        }
+                        return 1;
+                }
+        }
+
+        return 0;
+}
+
+/*
+ * Return true if mask caps are currently being revoked by an MDS.
+ */
+int ceph_caps_revoking(struct ceph_inode_info *ci, int mask)
+{
+        struct inode *inode = &ci->vfs_inode;
+        struct ceph_cap *cap;
+        struct rb_node *p;
+        int ret = 0;
+
+        spin_lock(&inode->i_lock);
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                if (__cap_is_valid(cap) &&
+                    (cap->implemented & ~cap->issued & mask)) {
+                        ret = 1;
+                        break;
+                }
+        }
+        spin_unlock(&inode->i_lock);
+        dout("ceph_caps_revoking %p %s = %d\n", inode,
+             ceph_cap_string(mask), ret);
+        return ret;
+}
+
+int __ceph_caps_used(struct ceph_inode_info *ci)
+{
+        int used = 0;
+        if (ci->i_pin_ref)
+                used |= CEPH_CAP_PIN;
+        if (ci->i_rd_ref)
+                used |= CEPH_CAP_FILE_RD;
+        if (ci->i_rdcache_ref || ci->i_rdcache_gen)
+                used |= CEPH_CAP_FILE_CACHE;
+        if (ci->i_wr_ref)
+                used |= CEPH_CAP_FILE_WR;
+        if (ci->i_wrbuffer_ref)
+                used |= CEPH_CAP_FILE_BUFFER;
+        return used;
+}
+
+/*
+ * wanted, by virtue of open file modes
+ */
+int __ceph_caps_file_wanted(struct ceph_inode_info *ci)
+{
+        int want = 0;
+        int mode;
+        for (mode = 0; mode < 4; mode++)
+                if (ci->i_nr_by_mode[mode])
+                        want |= ceph_caps_for_mode(mode);
+        return want;
+}
+
+/*
+ * Return caps we have registered with the MDS(s) as 'wanted'.
+ */
+int __ceph_caps_mds_wanted(struct ceph_inode_info *ci)
+{
+        struct ceph_cap *cap;
+        struct rb_node *p;
+        int mds_wanted = 0;
+
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                if (!__cap_is_valid(cap))
+                        continue;
+                mds_wanted |= cap->mds_wanted;
+        }
+        return mds_wanted;
+}
+
+/*
+ * called under i_lock
+ */
+static int __ceph_is_any_caps(struct ceph_inode_info *ci)
+{
+        return !RB_EMPTY_ROOT(&ci->i_caps) || ci->i_cap_exporting_mds >= 0;
+}
+
+/*
+ * caller should hold i_lock.
+ * caller will not hold session s_mutex if called from destroy_inode.
+ */
+void __ceph_remove_cap(struct ceph_cap *cap)
+{
+        struct ceph_mds_session *session = cap->session;
+        struct ceph_inode_info *ci = cap->ci;
+        struct ceph_mds_client *mdsc = &ceph_client(ci->vfs_inode.i_sb)->mdsc;
+
+        dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
+
+        /* remove from inode list */
+        rb_erase(&cap->ci_node, &ci->i_caps);
+        cap->ci = NULL;
+        if (ci->i_auth_cap == cap)
+                ci->i_auth_cap = NULL;
+
+        /* remove from session list */
+        spin_lock(&session->s_cap_lock);
+        if (session->s_cap_iterator == cap) {
+                /* not yet, we are iterating over this very cap */
+                dout("__ceph_remove_cap  delaying %p removal from session %p\n",
+                     cap, cap->session);
+        } else {
+                list_del_init(&cap->session_caps);
+                session->s_nr_caps--;
+                cap->session = NULL;
+        }
+        spin_unlock(&session->s_cap_lock);
+
+        if (cap->session == NULL)
+                ceph_put_cap(cap);
+
+        if (!__ceph_is_any_caps(ci) && ci->i_snap_realm) {
+                struct ceph_snap_realm *realm = ci->i_snap_realm;
+                spin_lock(&realm->inodes_with_caps_lock);
+                list_del_init(&ci->i_snap_realm_item);
+                ci->i_snap_realm_counter++;
+                ci->i_snap_realm = NULL;
+                spin_unlock(&realm->inodes_with_caps_lock);
+                ceph_put_snap_realm(mdsc, realm);
+        }
+        if (!__ceph_is_any_real_caps(ci))
+                __cap_delay_cancel(mdsc, ci);
+}
+
+/*
+ * Build and send a cap message to the given MDS.
+ *
+ * Caller should be holding s_mutex.
+ */
+static int send_cap_msg(struct ceph_mds_session *session,
+                        u64 ino, u64 cid, int op,
+                        int caps, int wanted, int dirty,
+                        u32 seq, u64 flush_tid, u32 issue_seq, u32 mseq,
+                        u64 size, u64 max_size,
+                        struct timespec *mtime, struct timespec *atime,
+                        u64 time_warp_seq,
+                        uid_t uid, gid_t gid, mode_t mode,
+                        u64 xattr_version,
+                        struct ceph_buffer *xattrs_buf,
+                        u64 follows)
+{
+        struct ceph_mds_caps *fc;
+        struct ceph_msg *msg;
+
+        dout("send_cap_msg %s %llx %llx caps %s wanted %s dirty %s"
+             " seq %u/%u mseq %u follows %lld size %llu/%llu"
+             " xattr_ver %llu xattr_len %d\n", ceph_cap_op_name(op),
+             cid, ino, ceph_cap_string(caps), ceph_cap_string(wanted),
+             ceph_cap_string(dirty),
+             seq, issue_seq, mseq, follows, size, max_size,
+             xattr_version, xattrs_buf ? (int)xattrs_buf->vec.iov_len : 0);
+
+        msg = ceph_msg_new(CEPH_MSG_CLIENT_CAPS, sizeof(*fc), 0, 0, NULL);
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
+
+        msg->hdr.tid = cpu_to_le64(flush_tid);
+
+        fc = msg->front.iov_base;
+        memset(fc, 0, sizeof(*fc));
+
+        fc->cap_id = cpu_to_le64(cid);
+        fc->op = cpu_to_le32(op);
+        fc->seq = cpu_to_le32(seq);
+        fc->issue_seq = cpu_to_le32(issue_seq);
+        fc->migrate_seq = cpu_to_le32(mseq);
+        fc->caps = cpu_to_le32(caps);
+        fc->wanted = cpu_to_le32(wanted);
+        fc->dirty = cpu_to_le32(dirty);
+        fc->ino = cpu_to_le64(ino);
+        fc->snap_follows = cpu_to_le64(follows);
+
+        fc->size = cpu_to_le64(size);
+        fc->max_size = cpu_to_le64(max_size);
+        if (mtime)
+                ceph_encode_timespec(&fc->mtime, mtime);
+        if (atime)
+                ceph_encode_timespec(&fc->atime, atime);
+        fc->time_warp_seq = cpu_to_le32(time_warp_seq);
+
+        fc->uid = cpu_to_le32(uid);
+        fc->gid = cpu_to_le32(gid);
+        fc->mode = cpu_to_le32(mode);
+
+        fc->xattr_version = cpu_to_le64(xattr_version);
+        if (xattrs_buf) {
+                msg->middle = ceph_buffer_get(xattrs_buf);
+                fc->xattr_len = cpu_to_le32(xattrs_buf->vec.iov_len);
+                msg->hdr.middle_len = cpu_to_le32(xattrs_buf->vec.iov_len);
+        }
+
+        ceph_con_send(&session->s_con, msg);
+        return 0;
+}
+
+/*
+ * Queue cap releases when an inode is dropped from our cache.  Since
+ * inode is about to be destroyed, there is no need for i_lock.
+ */
+void ceph_queue_caps_release(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct rb_node *p;
+
+        p = rb_first(&ci->i_caps);
+        while (p) {
+                struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
+                struct ceph_mds_session *session = cap->session;
+                struct ceph_msg *msg;
+                struct ceph_mds_cap_release *head;
+                struct ceph_mds_cap_item *item;
+
+                spin_lock(&session->s_cap_lock);
+                BUG_ON(!session->s_num_cap_releases);
+                msg = list_first_entry(&session->s_cap_releases,
+                                       struct ceph_msg, list_head);
+
+                dout(" adding %p release to mds%d msg %p (%d left)\n",
+                     inode, session->s_mds, msg, session->s_num_cap_releases);
+
+                BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
+                head = msg->front.iov_base;
+                head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
+                item = msg->front.iov_base + msg->front.iov_len;
+                item->ino = cpu_to_le64(ceph_ino(inode));
+                item->cap_id = cpu_to_le64(cap->cap_id);
+                item->migrate_seq = cpu_to_le32(cap->mseq);
+                item->seq = cpu_to_le32(cap->issue_seq);
+
+                session->s_num_cap_releases--;
+
+                msg->front.iov_len += sizeof(*item);
+                if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
+                        dout(" release msg %p full\n", msg);
+                        list_move_tail(&msg->list_head,
+                                       &session->s_cap_releases_done);
+                } else {
+                        dout(" release msg %p at %d/%d (%d)\n", msg,
+                             (int)le32_to_cpu(head->num),
+                             (int)CEPH_CAPS_PER_RELEASE,
+                             (int)msg->front.iov_len);
+                }
+                spin_unlock(&session->s_cap_lock);
+                p = rb_next(p);
+                __ceph_remove_cap(cap);
+        }
+}
+
+/*
+ * Send a cap msg on the given inode.  Update our caps state, then
+ * drop i_lock and send the message.
+ *
+ * Make note of max_size reported/requested from mds, revoked caps
+ * that have now been implemented.
+ *
+ * Make half-hearted attempt ot to invalidate page cache if we are
+ * dropping RDCACHE.  Note that this will leave behind locked pages
+ * that we'll then need to deal with elsewhere.
+ *
+ * Return non-zero if delayed release, or we experienced an error
+ * such that the caller should requeue + retry later.
+ *
+ * called with i_lock, then drops it.
+ * caller should hold snap_rwsem (read), s_mutex.
+ */
+static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
+                      int op, int used, int want, int retain, int flushing,
+                      unsigned *pflush_tid)
+        __releases(cap->ci->vfs_inode->i_lock)
+{
+        struct ceph_inode_info *ci = cap->ci;
+        struct inode *inode = &ci->vfs_inode;
+        u64 cap_id = cap->cap_id;
+        int held, revoking, dropping, keep;
+        u64 seq, issue_seq, mseq, time_warp_seq, follows;
+        u64 size, max_size;
+        struct timespec mtime, atime;
+        int wake = 0;
+        mode_t mode;
+        uid_t uid;
+        gid_t gid;
+        struct ceph_mds_session *session;
+        u64 xattr_version = 0;
+        int delayed = 0;
+        u64 flush_tid = 0;
+        int i;
+        int ret;
+
+        held = cap->issued | cap->implemented;
+        revoking = cap->implemented & ~cap->issued;
+        retain &= ~revoking;
+        dropping = cap->issued & ~retain;
+
+        dout("__send_cap %p cap %p session %p %s -> %s (revoking %s)\n",
+             inode, cap, cap->session,
+             ceph_cap_string(held), ceph_cap_string(held & retain),
+             ceph_cap_string(revoking));
+        BUG_ON((retain & CEPH_CAP_PIN) == 0);
+
+        session = cap->session;
+
+        /* don't release wanted unless we've waited a bit. */
+        if ((ci->i_ceph_flags & CEPH_I_NODELAY) == 0 &&
+            time_before(jiffies, ci->i_hold_caps_min)) {
+                dout(" delaying issued %s -> %s, wanted %s -> %s on send\n",
+                     ceph_cap_string(cap->issued),
+                     ceph_cap_string(cap->issued & retain),
+                     ceph_cap_string(cap->mds_wanted),
+                     ceph_cap_string(want));
+                want |= cap->mds_wanted;
+                retain |= cap->issued;
+                delayed = 1;
+        }
+        ci->i_ceph_flags &= ~(CEPH_I_NODELAY | CEPH_I_FLUSH);
+
+        cap->issued &= retain;  /* drop bits we don't want */
+        if (cap->implemented & ~cap->issued) {
+                /*
+                 * Wake up any waiters on wanted -> needed transition.
+                 * This is due to the weird transition from buffered
+                 * to sync IO... we need to flush dirty pages _before_
+                 * allowing sync writes to avoid reordering.
+                 */
+                wake = 1;
+        }
+        cap->implemented &= cap->issued | used;
+        cap->mds_wanted = want;
+
+        if (flushing) {
+                /*
+                 * assign a tid for flush operations so we can avoid
+                 * flush1 -> dirty1 -> flush2 -> flushack1 -> mark
+                 * clean type races.  track latest tid for every bit
+                 * so we can handle flush AxFw, flush Fw, and have the
+                 * first ack clean Ax.
+                 */
+                flush_tid = ++ci->i_cap_flush_last_tid;
+                if (pflush_tid)
+                        *pflush_tid = flush_tid;
+                dout(" cap_flush_tid %d\n", (int)flush_tid);
+                for (i = 0; i < CEPH_CAP_BITS; i++)
+                        if (flushing & (1 << i))
+                                ci->i_cap_flush_tid[i] = flush_tid;
+        }
+
+        keep = cap->implemented;
+        seq = cap->seq;
+        issue_seq = cap->issue_seq;
+        mseq = cap->mseq;
+        size = inode->i_size;
+        ci->i_reported_size = size;
+        max_size = ci->i_wanted_max_size;
+        ci->i_requested_max_size = max_size;
+        mtime = inode->i_mtime;
+        atime = inode->i_atime;
+        time_warp_seq = ci->i_time_warp_seq;
+        follows = ci->i_snap_realm->cached_context->seq;
+        uid = inode->i_uid;
+        gid = inode->i_gid;
+        mode = inode->i_mode;
+
+        if (dropping & CEPH_CAP_XATTR_EXCL) {
+                __ceph_build_xattrs_blob(ci);
+                xattr_version = ci->i_xattrs.version + 1;
+        }
+
+        spin_unlock(&inode->i_lock);
+
+        ret = send_cap_msg(session, ceph_vino(inode).ino, cap_id,
+                op, keep, want, flushing, seq, flush_tid, issue_seq, mseq,
+                size, max_size, &mtime, &atime, time_warp_seq,
+                uid, gid, mode,
+                xattr_version,
+                (flushing & CEPH_CAP_XATTR_EXCL) ? ci->i_xattrs.blob : NULL,
+                follows);
+        if (ret < 0) {
+                dout("error sending cap msg, must requeue %p\n", inode);
+                delayed = 1;
+        }
+
+        if (wake)
+                wake_up(&ci->i_cap_wq);
+
+        return delayed;
+}
+
+/*
+ * When a snapshot is taken, clients accumulate dirty metadata on
+ * inodes with capabilities in ceph_cap_snaps to describe the file
+ * state at the time the snapshot was taken.  This must be flushed
+ * asynchronously back to the MDS once sync writes complete and dirty
+ * data is written out.
+ *
+ * Called under i_lock.  Takes s_mutex as needed.
+ */
+void __ceph_flush_snaps(struct ceph_inode_info *ci,
+                        struct ceph_mds_session **psession)
+{
+        struct inode *inode = &ci->vfs_inode;
+        int mds;
+        struct ceph_cap_snap *capsnap;
+        u32 mseq;
+        struct ceph_mds_client *mdsc = &ceph_inode_to_client(inode)->mdsc;
+        struct ceph_mds_session *session = NULL; /* if session != NULL, we hold
+                                                    session->s_mutex */
+        u64 next_follows = 0;  /* keep track of how far we've gotten through the
+                             i_cap_snaps list, and skip these entries next time
+                             around to avoid an infinite loop */
+
+        if (psession)
+                session = *psession;
+
+        dout("__flush_snaps %p\n", inode);
+retry:
+        list_for_each_entry(capsnap, &ci->i_cap_snaps, ci_item) {
+                /* avoid an infiniute loop after retry */
+                if (capsnap->follows < next_follows)
+                        continue;
+                /*
+                 * we need to wait for sync writes to complete and for dirty
+                 * pages to be written out.
+                 */
+                if (capsnap->dirty_pages || capsnap->writing)
+                        continue;
+
+                /*
+                 * if cap writeback already occurred, we should have dropped
+                 * the capsnap in ceph_put_wrbuffer_cap_refs.
+                 */
+                BUG_ON(capsnap->dirty == 0);
+
+                /* pick mds, take s_mutex */
+                mds = __ceph_get_cap_mds(ci, &mseq);
+                if (session && session->s_mds != mds) {
+                        dout("oops, wrong session %p mutex\n", session);
+                        mutex_unlock(&session->s_mutex);
+                        ceph_put_mds_session(session);
+                        session = NULL;
+                }
+                if (!session) {
+                        spin_unlock(&inode->i_lock);
+                        mutex_lock(&mdsc->mutex);
+                        session = __ceph_lookup_mds_session(mdsc, mds);
+                        mutex_unlock(&mdsc->mutex);
+                        if (session) {
+                                dout("inverting session/ino locks on %p\n",
+                                     session);
+                                mutex_lock(&session->s_mutex);
+                        }
+                        /*
+                         * if session == NULL, we raced against a cap
+                         * deletion.  retry, and we'll get a better
+                         * @mds value next time.
+                         */
+                        spin_lock(&inode->i_lock);
+                        goto retry;
+                }
+
+                capsnap->flush_tid = ++ci->i_cap_flush_last_tid;
+                atomic_inc(&capsnap->nref);
+                if (!list_empty(&capsnap->flushing_item))
+                        list_del_init(&capsnap->flushing_item);
+                list_add_tail(&capsnap->flushing_item,
+                              &session->s_cap_snaps_flushing);
+                spin_unlock(&inode->i_lock);
+
+                dout("flush_snaps %p cap_snap %p follows %lld size %llu\n",
+                     inode, capsnap, next_follows, capsnap->size);
+                send_cap_msg(session, ceph_vino(inode).ino, 0,
+                             CEPH_CAP_OP_FLUSHSNAP, capsnap->issued, 0,
+                             capsnap->dirty, 0, capsnap->flush_tid, 0, mseq,
+                             capsnap->size, 0,
+                             &capsnap->mtime, &capsnap->atime,
+                             capsnap->time_warp_seq,
+                             capsnap->uid, capsnap->gid, capsnap->mode,
+                             0, NULL,
+                             capsnap->follows);
+
+                next_follows = capsnap->follows + 1;
+                ceph_put_cap_snap(capsnap);
+
+                spin_lock(&inode->i_lock);
+                goto retry;
+        }
+
+        /* we flushed them all; remove this inode from the queue */
+        spin_lock(&mdsc->snap_flush_lock);
+        list_del_init(&ci->i_snap_flush_item);
+        spin_unlock(&mdsc->snap_flush_lock);
+
+        if (psession)
+                *psession = session;
+        else if (session) {
+                mutex_unlock(&session->s_mutex);
+                ceph_put_mds_session(session);
+        }
+}
+
+static void ceph_flush_snaps(struct ceph_inode_info *ci)
+{
+        struct inode *inode = &ci->vfs_inode;
+
+        spin_lock(&inode->i_lock);
+        __ceph_flush_snaps(ci, NULL);
+        spin_unlock(&inode->i_lock);
+}
+
+/*
+ * Mark caps dirty.  If inode is newly dirty, add to the global dirty
+ * list.
+ */
+void __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask)
+{
+        struct ceph_mds_client *mdsc = &ceph_client(ci->vfs_inode.i_sb)->mdsc;
+        struct inode *inode = &ci->vfs_inode;
+        int was = ci->i_dirty_caps;
+        int dirty = 0;
+
+        dout("__mark_dirty_caps %p %s dirty %s -> %s\n", &ci->vfs_inode,
+             ceph_cap_string(mask), ceph_cap_string(was),
+             ceph_cap_string(was | mask));
+        ci->i_dirty_caps |= mask;
+        if (was == 0) {
+                dout(" inode %p now dirty\n", &ci->vfs_inode);
+                BUG_ON(!list_empty(&ci->i_dirty_item));
+                spin_lock(&mdsc->cap_dirty_lock);
+                list_add(&ci->i_dirty_item, &mdsc->cap_dirty);
+                spin_unlock(&mdsc->cap_dirty_lock);
+                if (ci->i_flushing_caps == 0) {
+                        igrab(inode);
+                        dirty |= I_DIRTY_SYNC;
+                }
+        }
+        BUG_ON(list_empty(&ci->i_dirty_item));
+        if (((was | ci->i_flushing_caps) & CEPH_CAP_FILE_BUFFER) &&
+            (mask & CEPH_CAP_FILE_BUFFER))
+                dirty |= I_DIRTY_DATASYNC;
+        if (dirty)
+                __mark_inode_dirty(inode, dirty);
+        __cap_delay_requeue(mdsc, ci);
+}
+
+/*
+ * Add dirty inode to the flushing list.  Assigned a seq number so we
+ * can wait for caps to flush without starving.
+ *
+ * Called under i_lock.
+ */
+static int __mark_caps_flushing(struct inode *inode,
+                                 struct ceph_mds_session *session)
+{
+        struct ceph_mds_client *mdsc = &ceph_client(inode->i_sb)->mdsc;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int flushing;
+
+        BUG_ON(ci->i_dirty_caps == 0);
+        BUG_ON(list_empty(&ci->i_dirty_item));
+
+        flushing = ci->i_dirty_caps;
+        dout("__mark_caps_flushing flushing %s, flushing_caps %s -> %s\n",
+             ceph_cap_string(flushing),
+             ceph_cap_string(ci->i_flushing_caps),
+             ceph_cap_string(ci->i_flushing_caps | flushing));
+        ci->i_flushing_caps |= flushing;
+        ci->i_dirty_caps = 0;
+        dout(" inode %p now !dirty\n", inode);
+
+        spin_lock(&mdsc->cap_dirty_lock);
+        list_del_init(&ci->i_dirty_item);
+
+        ci->i_cap_flush_seq = ++mdsc->cap_flush_seq;
+        if (list_empty(&ci->i_flushing_item)) {
+                list_add_tail(&ci->i_flushing_item, &session->s_cap_flushing);
+                mdsc->num_cap_flushing++;
+                dout(" inode %p now flushing seq %lld\n", inode,
+                     ci->i_cap_flush_seq);
+        } else {
+                list_move_tail(&ci->i_flushing_item, &session->s_cap_flushing);
+                dout(" inode %p now flushing (more) seq %lld\n", inode,
+                     ci->i_cap_flush_seq);
+        }
+        spin_unlock(&mdsc->cap_dirty_lock);
+
+        return flushing;
+}
+
+/*
+ * try to invalidate mapping pages without blocking.
+ */
+static int mapping_is_empty(struct address_space *mapping)
+{
+        struct page *page = find_get_page(mapping, 0);
+
+        if (!page)
+                return 1;
+
+        put_page(page);
+        return 0;
+}
+
+static int try_nonblocking_invalidate(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        u32 invalidating_gen = ci->i_rdcache_gen;
+
+        spin_unlock(&inode->i_lock);
+        invalidate_mapping_pages(&inode->i_data, 0, -1);
+        spin_lock(&inode->i_lock);
+
+        if (mapping_is_empty(&inode->i_data) &&
+            invalidating_gen == ci->i_rdcache_gen) {
+                /* success. */
+                dout("try_nonblocking_invalidate %p success\n", inode);
+                ci->i_rdcache_gen = 0;
+                ci->i_rdcache_revoking = 0;
+                return 0;
+        }
+        dout("try_nonblocking_invalidate %p failed\n", inode);
+        return -1;
+}
+
+/*
+ * Swiss army knife function to examine currently used and wanted
+ * versus held caps.  Release, flush, ack revoked caps to mds as
+ * appropriate.
+ *
+ *  CHECK_CAPS_NODELAY - caller is delayed work and we should not delay
+ *    cap release further.
+ *  CHECK_CAPS_AUTHONLY - we should only check the auth cap
+ *  CHECK_CAPS_FLUSH - we should flush any dirty caps immediately, without
+ *    further delay.
+ */
+void ceph_check_caps(struct ceph_inode_info *ci, int flags,
+                     struct ceph_mds_session *session)
+        __releases(session->s_mutex)
+{
+        struct ceph_client *client = ceph_inode_to_client(&ci->vfs_inode);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct inode *inode = &ci->vfs_inode;
+        struct ceph_cap *cap;
+        int file_wanted, used;
+        int took_snap_rwsem = 0;             /* true if mdsc->snap_rwsem held */
+        int issued, implemented, want, retain, revoking, flushing = 0;
+        int mds = -1;   /* keep track of how far we've gone through i_caps list
+                           to avoid an infinite loop on retry */
+        struct rb_node *p;
+        int tried_invalidate = 0;
+        int delayed = 0, sent = 0, force_requeue = 0, num;
+        int queue_invalidate = 0;
+        int is_delayed = flags & CHECK_CAPS_NODELAY;
+
+        /* if we are unmounting, flush any unused caps immediately. */
+        if (mdsc->stopping)
+                is_delayed = 1;
+
+        spin_lock(&inode->i_lock);
+
+        if (ci->i_ceph_flags & CEPH_I_FLUSH)
+                flags |= CHECK_CAPS_FLUSH;
+
+        /* flush snaps first time around only */
+        if (!list_empty(&ci->i_cap_snaps))
+                __ceph_flush_snaps(ci, &session);
+        goto retry_locked;
+retry:
+        spin_lock(&inode->i_lock);
+retry_locked:
+        file_wanted = __ceph_caps_file_wanted(ci);
+        used = __ceph_caps_used(ci);
+        want = file_wanted | used;
+        issued = __ceph_caps_issued(ci, &implemented);
+        revoking = implemented & ~issued;
+
+        retain = want | CEPH_CAP_PIN;
+        if (!mdsc->stopping && inode->i_nlink > 0) {
+                if (want) {
+                        retain |= CEPH_CAP_ANY;       /* be greedy */
+                } else {
+                        retain |= CEPH_CAP_ANY_SHARED;
+                        /*
+                         * keep RD only if we didn't have the file open RW,
+                         * because then the mds would revoke it anyway to
+                         * journal max_size=0.
+                         */
+                        if (ci->i_max_size == 0)
+                                retain |= CEPH_CAP_ANY_RD;
+                }
+        }
+
+        dout("check_caps %p file_want %s used %s dirty %s flushing %s"
+             " issued %s revoking %s retain %s %s%s%s\n", inode,
+             ceph_cap_string(file_wanted),
+             ceph_cap_string(used), ceph_cap_string(ci->i_dirty_caps),
+             ceph_cap_string(ci->i_flushing_caps),
+             ceph_cap_string(issued), ceph_cap_string(revoking),
+             ceph_cap_string(retain),
+             (flags & CHECK_CAPS_AUTHONLY) ? " AUTHONLY" : "",
+             (flags & CHECK_CAPS_NODELAY) ? " NODELAY" : "",
+             (flags & CHECK_CAPS_FLUSH) ? " FLUSH" : "");
+
+        /*
+         * If we no longer need to hold onto old our caps, and we may
+         * have cached pages, but don't want them, then try to invalidate.
+         * If we fail, it's because pages are locked.... try again later.
+         */
+        if ((!is_delayed || mdsc->stopping) &&
+            ci->i_wrbuffer_ref == 0 &&               /* no dirty pages... */
+            ci->i_rdcache_gen &&                     /* may have cached pages */
+            (file_wanted == 0 ||                     /* no open files */
+             (revoking & CEPH_CAP_FILE_CACHE)) &&     /*  or revoking cache */
+            !tried_invalidate) {
+                dout("check_caps trying to invalidate on %p\n", inode);
+                if (try_nonblocking_invalidate(inode) < 0) {
+                        if (revoking & CEPH_CAP_FILE_CACHE) {
+                                dout("check_caps queuing invalidate\n");
+                                queue_invalidate = 1;
+                                ci->i_rdcache_revoking = ci->i_rdcache_gen;
+                        } else {
+                                dout("check_caps failed to invalidate pages\n");
+                                /* we failed to invalidate pages.  check these
+                                   caps again later. */
+                                force_requeue = 1;
+                                __cap_set_timeouts(mdsc, ci);
+                        }
+                }
+                tried_invalidate = 1;
+                goto retry_locked;
+        }
+
+        num = 0;
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                cap = rb_entry(p, struct ceph_cap, ci_node);
+                num++;
+
+                /* avoid looping forever */
+                if (mds >= cap->mds ||
+                    ((flags & CHECK_CAPS_AUTHONLY) && cap != ci->i_auth_cap))
+                        continue;
+
+                /* NOTE: no side-effects allowed, until we take s_mutex */
+
+                revoking = cap->implemented & ~cap->issued;
+                if (revoking)
+                        dout(" mds%d revoking %s\n", cap->mds,
+                             ceph_cap_string(revoking));
+
+                if (cap == ci->i_auth_cap &&
+                    (cap->issued & CEPH_CAP_FILE_WR)) {
+                        /* request larger max_size from MDS? */
+                        if (ci->i_wanted_max_size > ci->i_max_size &&
+                            ci->i_wanted_max_size > ci->i_requested_max_size) {
+                                dout("requesting new max_size\n");
+                                goto ack;
+                        }
+
+                        /* approaching file_max? */
+                        if ((inode->i_size << 1) >= ci->i_max_size &&
+                            (ci->i_reported_size << 1) < ci->i_max_size) {
+                                dout("i_size approaching max_size\n");
+                                goto ack;
+                        }
+                }
+                /* flush anything dirty? */
+                if (cap == ci->i_auth_cap && (flags & CHECK_CAPS_FLUSH) &&
+                    ci->i_dirty_caps) {
+                        dout("flushing dirty caps\n");
+                        goto ack;
+                }
+
+                /* completed revocation? going down and there are no caps? */
+                if (revoking && (revoking & used) == 0) {
+                        dout("completed revocation of %s\n",
+                             ceph_cap_string(cap->implemented & ~cap->issued));
+                        goto ack;
+                }
+
+                /* want more caps from mds? */
+                if (want & ~(cap->mds_wanted | cap->issued))
+                        goto ack;
+
+                /* things we might delay */
+                if ((cap->issued & ~retain) == 0 &&
+                    cap->mds_wanted == want)
+                        continue;     /* nope, all good */
+
+                if (is_delayed)
+                        goto ack;
+
+                /* delay? */
+                if ((ci->i_ceph_flags & CEPH_I_NODELAY) == 0 &&
+                    time_before(jiffies, ci->i_hold_caps_max)) {
+                        dout(" delaying issued %s -> %s, wanted %s -> %s\n",
+                             ceph_cap_string(cap->issued),
+                             ceph_cap_string(cap->issued & retain),
+                             ceph_cap_string(cap->mds_wanted),
+                             ceph_cap_string(want));
+                        delayed++;
+                        continue;
+                }
+
+ack:
+                if (ci->i_ceph_flags & CEPH_I_NOFLUSH) {
+                        dout(" skipping %p I_NOFLUSH set\n", inode);
+                        continue;
+                }
+
+                if (session && session != cap->session) {
+                        dout("oops, wrong session %p mutex\n", session);
+                        mutex_unlock(&session->s_mutex);
+                        session = NULL;
+                }
+                if (!session) {
+                        session = cap->session;
+                        if (mutex_trylock(&session->s_mutex) == 0) {
+                                dout("inverting session/ino locks on %p\n",
+                                     session);
+                                spin_unlock(&inode->i_lock);
+                                if (took_snap_rwsem) {
+                                        up_read(&mdsc->snap_rwsem);
+                                        took_snap_rwsem = 0;
+                                }
+                                mutex_lock(&session->s_mutex);
+                                goto retry;
+                        }
+                }
+                /* take snap_rwsem after session mutex */
+                if (!took_snap_rwsem) {
+                        if (down_read_trylock(&mdsc->snap_rwsem) == 0) {
+                                dout("inverting snap/in locks on %p\n",
+                                     inode);
+                                spin_unlock(&inode->i_lock);
+                                down_read(&mdsc->snap_rwsem);
+                                took_snap_rwsem = 1;
+                                goto retry;
+                        }
+                        took_snap_rwsem = 1;
+                }
+
+                if (cap == ci->i_auth_cap && ci->i_dirty_caps)
+                        flushing = __mark_caps_flushing(inode, session);
+
+                mds = cap->mds;  /* remember mds, so we don't repeat */
+                sent++;
+
+                /* __send_cap drops i_lock */
+                delayed += __send_cap(mdsc, cap, CEPH_CAP_OP_UPDATE, used, want,
+                                      retain, flushing, NULL);
+                goto retry; /* retake i_lock and restart our cap scan. */
+        }
+
+        /*
+         * Reschedule delayed caps release if we delayed anything,
+         * otherwise cancel.
+         */
+        if (delayed && is_delayed)
+                force_requeue = 1;   /* __send_cap delayed release; requeue */
+        if (!delayed && !is_delayed)
+                __cap_delay_cancel(mdsc, ci);
+        else if (!is_delayed || force_requeue)
+                __cap_delay_requeue(mdsc, ci);
+
+        spin_unlock(&inode->i_lock);
+
+        if (queue_invalidate)
+                ceph_queue_invalidate(inode);
+
+        if (session)
+                mutex_unlock(&session->s_mutex);
+        if (took_snap_rwsem)
+                up_read(&mdsc->snap_rwsem);
+}
+
+/*
+ * Try to flush dirty caps back to the auth mds.
+ */
+static int try_flush_caps(struct inode *inode, struct ceph_mds_session *session,
+                          unsigned *flush_tid)
+{
+        struct ceph_mds_client *mdsc = &ceph_client(inode->i_sb)->mdsc;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int unlock_session = session ? 0 : 1;
+        int flushing = 0;
+
+retry:
+        spin_lock(&inode->i_lock);
+        if (ci->i_ceph_flags & CEPH_I_NOFLUSH) {
+                dout("try_flush_caps skipping %p I_NOFLUSH set\n", inode);
+                goto out;
+        }
+        if (ci->i_dirty_caps && ci->i_auth_cap) {
+                struct ceph_cap *cap = ci->i_auth_cap;
+                int used = __ceph_caps_used(ci);
+                int want = __ceph_caps_wanted(ci);
+                int delayed;
+
+                if (!session) {
+                        spin_unlock(&inode->i_lock);
+                        session = cap->session;
+                        mutex_lock(&session->s_mutex);
+                        goto retry;
+                }
+                BUG_ON(session != cap->session);
+                if (cap->session->s_state < CEPH_MDS_SESSION_OPEN)
+                        goto out;
+
+                flushing = __mark_caps_flushing(inode, session);
+
+                /* __send_cap drops i_lock */
+                delayed = __send_cap(mdsc, cap, CEPH_CAP_OP_FLUSH, used, want,
+                                     cap->issued | cap->implemented, flushing,
+                                     flush_tid);
+                if (!delayed)
+                        goto out_unlocked;
+
+                spin_lock(&inode->i_lock);
+                __cap_delay_requeue(mdsc, ci);
+        }
+out:
+        spin_unlock(&inode->i_lock);
+out_unlocked:
+        if (session && unlock_session)
+                mutex_unlock(&session->s_mutex);
+        return flushing;
+}
+
+/*
+ * Return true if we've flushed caps through the given flush_tid.
+ */
+static int caps_are_flushed(struct inode *inode, unsigned tid)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int dirty, i, ret = 1;
+
+        spin_lock(&inode->i_lock);
+        dirty = __ceph_caps_dirty(ci);
+        for (i = 0; i < CEPH_CAP_BITS; i++)
+                if ((ci->i_flushing_caps & (1 << i)) &&
+                    ci->i_cap_flush_tid[i] <= tid) {
+                        /* still flushing this bit */
+                        ret = 0;
+                        break;
+                }
+        spin_unlock(&inode->i_lock);
+        return ret;
+}
+
+/*
+ * Wait on any unsafe replies for the given inode.  First wait on the
+ * newest request, and make that the upper bound.  Then, if there are
+ * more requests, keep waiting on the oldest as long as it is still older
+ * than the original request.
+ */
+static void sync_write_wait(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct list_head *head = &ci->i_unsafe_writes;
+        struct ceph_osd_request *req;
+        u64 last_tid;
+
+        spin_lock(&ci->i_unsafe_lock);
+        if (list_empty(head))
+                goto out;
+
+        /* set upper bound as _last_ entry in chain */
+        req = list_entry(head->prev, struct ceph_osd_request,
+                         r_unsafe_item);
+        last_tid = req->r_tid;
+
+        do {
+                ceph_osdc_get_request(req);
+                spin_unlock(&ci->i_unsafe_lock);
+                dout("sync_write_wait on tid %llu (until %llu)\n",
+                     req->r_tid, last_tid);
+                wait_for_completion(&req->r_safe_completion);
+                spin_lock(&ci->i_unsafe_lock);
+                ceph_osdc_put_request(req);
+
+                /*
+                 * from here on look at first entry in chain, since we
+                 * only want to wait for anything older than last_tid
+                 */
+                if (list_empty(head))
+                        break;
+                req = list_entry(head->next, struct ceph_osd_request,
+                                 r_unsafe_item);
+        } while (req->r_tid < last_tid);
+out:
+        spin_unlock(&ci->i_unsafe_lock);
+}
+
+int ceph_fsync(struct file *file, struct dentry *dentry, int datasync)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        unsigned flush_tid;
+        int ret;
+        int dirty;
+
+        dout("fsync %p%s\n", inode, datasync ? " datasync" : "");
+        sync_write_wait(inode);
+
+        ret = filemap_write_and_wait(inode->i_mapping);
+        if (ret < 0)
+                return ret;
+
+        dirty = try_flush_caps(inode, NULL, &flush_tid);
+        dout("fsync dirty caps are %s\n", ceph_cap_string(dirty));
+
+        /*
+         * only wait on non-file metadata writeback (the mds
+         * can recover size and mtime, so we don't need to
+         * wait for that)
+         */
+        if (!datasync && (dirty & ~CEPH_CAP_ANY_FILE_WR)) {
+                dout("fsync waiting for flush_tid %u\n", flush_tid);
+                ret = wait_event_interruptible(ci->i_cap_wq,
+                                       caps_are_flushed(inode, flush_tid));
+        }
+
+        dout("fsync %p%s done\n", inode, datasync ? " datasync" : "");
+        return ret;
+}
+
+/*
+ * Flush any dirty caps back to the mds.  If we aren't asked to wait,
+ * queue inode for flush but don't do so immediately, because we can
+ * get by with fewer MDS messages if we wait for data writeback to
+ * complete first.
+ */
+int ceph_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        unsigned flush_tid;
+        int err = 0;
+        int dirty;
+        int wait = wbc->sync_mode == WB_SYNC_ALL;
+
+        dout("write_inode %p wait=%d\n", inode, wait);
+        if (wait) {
+                dirty = try_flush_caps(inode, NULL, &flush_tid);
+                if (dirty)
+                        err = wait_event_interruptible(ci->i_cap_wq,
+                                       caps_are_flushed(inode, flush_tid));
+        } else {
+                struct ceph_mds_client *mdsc = &ceph_client(inode->i_sb)->mdsc;
+
+                spin_lock(&inode->i_lock);
+                if (__ceph_caps_dirty(ci))
+                        __cap_delay_requeue_front(mdsc, ci);
+                spin_unlock(&inode->i_lock);
+        }
+        return err;
+}
+
+/*
+ * After a recovering MDS goes active, we need to resend any caps
+ * we were flushing.
+ *
+ * Caller holds session->s_mutex.
+ */
+static void kick_flushing_capsnaps(struct ceph_mds_client *mdsc,
+                                   struct ceph_mds_session *session)
+{
+        struct ceph_cap_snap *capsnap;
+
+        dout("kick_flushing_capsnaps mds%d\n", session->s_mds);
+        list_for_each_entry(capsnap, &session->s_cap_snaps_flushing,
+                            flushing_item) {
+                struct ceph_inode_info *ci = capsnap->ci;
+                struct inode *inode = &ci->vfs_inode;
+                struct ceph_cap *cap;
+
+                spin_lock(&inode->i_lock);
+                cap = ci->i_auth_cap;
+                if (cap && cap->session == session) {
+                        dout("kick_flushing_caps %p cap %p capsnap %p\n", inode,
+                             cap, capsnap);
+                        __ceph_flush_snaps(ci, &session);
+                } else {
+                        pr_err("%p auth cap %p not mds%d ???\n", inode,
+                               cap, session->s_mds);
+                        spin_unlock(&inode->i_lock);
+                }
+        }
+}
+
+void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc,
+                             struct ceph_mds_session *session)
+{
+        struct ceph_inode_info *ci;
+
+        kick_flushing_capsnaps(mdsc, session);
+
+        dout("kick_flushing_caps mds%d\n", session->s_mds);
+        list_for_each_entry(ci, &session->s_cap_flushing, i_flushing_item) {
+                struct inode *inode = &ci->vfs_inode;
+                struct ceph_cap *cap;
+                int delayed = 0;
+
+                spin_lock(&inode->i_lock);
+                cap = ci->i_auth_cap;
+                if (cap && cap->session == session) {
+                        dout("kick_flushing_caps %p cap %p %s\n", inode,
+                             cap, ceph_cap_string(ci->i_flushing_caps));
+                        delayed = __send_cap(mdsc, cap, CEPH_CAP_OP_FLUSH,
+                                             __ceph_caps_used(ci),
+                                             __ceph_caps_wanted(ci),
+                                             cap->issued | cap->implemented,
+                                             ci->i_flushing_caps, NULL);
+                        if (delayed) {
+                                spin_lock(&inode->i_lock);
+                                __cap_delay_requeue(mdsc, ci);
+                                spin_unlock(&inode->i_lock);
+                        }
+                } else {
+                        pr_err("%p auth cap %p not mds%d ???\n", inode,
+                               cap, session->s_mds);
+                        spin_unlock(&inode->i_lock);
+                }
+        }
+}
+
+
+/*
+ * Take references to capabilities we hold, so that we don't release
+ * them to the MDS prematurely.
+ *
+ * Protected by i_lock.
+ */
+static void __take_cap_refs(struct ceph_inode_info *ci, int got)
+{
+        if (got & CEPH_CAP_PIN)
+                ci->i_pin_ref++;
+        if (got & CEPH_CAP_FILE_RD)
+                ci->i_rd_ref++;
+        if (got & CEPH_CAP_FILE_CACHE)
+                ci->i_rdcache_ref++;
+        if (got & CEPH_CAP_FILE_WR)
+                ci->i_wr_ref++;
+        if (got & CEPH_CAP_FILE_BUFFER) {
+                if (ci->i_wrbuffer_ref == 0)
+                        igrab(&ci->vfs_inode);
+                ci->i_wrbuffer_ref++;
+                dout("__take_cap_refs %p wrbuffer %d -> %d (?)\n",
+                     &ci->vfs_inode, ci->i_wrbuffer_ref-1, ci->i_wrbuffer_ref);
+        }
+}
+
+/*
+ * Try to grab cap references.  Specify those refs we @want, and the
+ * minimal set we @need.  Also include the larger offset we are writing
+ * to (when applicable), and check against max_size here as well.
+ * Note that caller is responsible for ensuring max_size increases are
+ * requested from the MDS.
+ */
+static int try_get_cap_refs(struct ceph_inode_info *ci, int need, int want,
+                            int *got, loff_t endoff, int *check_max, int *err)
+{
+        struct inode *inode = &ci->vfs_inode;
+        int ret = 0;
+        int have, implemented;
+        int file_wanted;
+
+        dout("get_cap_refs %p need %s want %s\n", inode,
+             ceph_cap_string(need), ceph_cap_string(want));
+        spin_lock(&inode->i_lock);
+
+        /* make sure file is actually open */
+        file_wanted = __ceph_caps_file_wanted(ci);
+        if ((file_wanted & need) == 0) {
+                dout("try_get_cap_refs need %s file_wanted %s, EBADF\n",
+                     ceph_cap_string(need), ceph_cap_string(file_wanted));
+                *err = -EBADF;
+                ret = 1;
+                goto out;
+        }
+
+        if (need & CEPH_CAP_FILE_WR) {
+                if (endoff >= 0 && endoff > (loff_t)ci->i_max_size) {
+                        dout("get_cap_refs %p endoff %llu > maxsize %llu\n",
+                             inode, endoff, ci->i_max_size);
+                        if (endoff > ci->i_wanted_max_size) {
+                                *check_max = 1;
+                                ret = 1;
+                        }
+                        goto out;
+                }
+                /*
+                 * If a sync write is in progress, we must wait, so that we
+                 * can get a final snapshot value for size+mtime.
+                 */
+                if (__ceph_have_pending_cap_snap(ci)) {
+                        dout("get_cap_refs %p cap_snap_pending\n", inode);
+                        goto out;
+                }
+        }
+        have = __ceph_caps_issued(ci, &implemented);
+
+        /*
+         * disallow writes while a truncate is pending
+         */
+        if (ci->i_truncate_pending)
+                have &= ~CEPH_CAP_FILE_WR;
+
+        if ((have & need) == need) {
+                /*
+                 * Look at (implemented & ~have & not) so that we keep waiting
+                 * on transition from wanted -> needed caps.  This is needed
+                 * for WRBUFFER|WR -> WR to avoid a new WR sync write from
+                 * going before a prior buffered writeback happens.
+                 */
+                int not = want & ~(have & need);
+                int revoking = implemented & ~have;
+                dout("get_cap_refs %p have %s but not %s (revoking %s)\n",
+                     inode, ceph_cap_string(have), ceph_cap_string(not),
+                     ceph_cap_string(revoking));
+                if ((revoking & not) == 0) {
+                        *got = need | (have & want);
+                        __take_cap_refs(ci, *got);
+                        ret = 1;
+                }
+        } else {
+                dout("get_cap_refs %p have %s needed %s\n", inode,
+                     ceph_cap_string(have), ceph_cap_string(need));
+        }
+out:
+        spin_unlock(&inode->i_lock);
+        dout("get_cap_refs %p ret %d got %s\n", inode,
+             ret, ceph_cap_string(*got));
+        return ret;
+}
+
+/*
+ * Check the offset we are writing up to against our current
+ * max_size.  If necessary, tell the MDS we want to write to
+ * a larger offset.
+ */
+static void check_max_size(struct inode *inode, loff_t endoff)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int check = 0;
+
+        /* do we need to explicitly request a larger max_size? */
+        spin_lock(&inode->i_lock);
+        if ((endoff >= ci->i_max_size ||
+             endoff > (inode->i_size << 1)) &&
+            endoff > ci->i_wanted_max_size) {
+                dout("write %p at large endoff %llu, req max_size\n",
+                     inode, endoff);
+                ci->i_wanted_max_size = endoff;
+                check = 1;
+        }
+        spin_unlock(&inode->i_lock);
+        if (check)
+                ceph_check_caps(ci, CHECK_CAPS_AUTHONLY, NULL);
+}
+
+/*
+ * Wait for caps, and take cap references.  If we can't get a WR cap
+ * due to a small max_size, make sure we check_max_size (and possibly
+ * ask the mds) so we don't get hung up indefinitely.
+ */
+int ceph_get_caps(struct ceph_inode_info *ci, int need, int want, int *got,
+                  loff_t endoff)
+{
+        int check_max, ret, err;
+
+retry:
+        if (endoff > 0)
+                check_max_size(&ci->vfs_inode, endoff);
+        check_max = 0;
+        err = 0;
+        ret = wait_event_interruptible(ci->i_cap_wq,
+                                       try_get_cap_refs(ci, need, want,
+                                                        got, endoff,
+                                                        &check_max, &err));
+        if (err)
+                ret = err;
+        if (check_max)
+                goto retry;
+        return ret;
+}
+
+/*
+ * Take cap refs.  Caller must already know we hold at least one ref
+ * on the caps in question or we don't know this is safe.
+ */
+void ceph_get_cap_refs(struct ceph_inode_info *ci, int caps)
+{
+        spin_lock(&ci->vfs_inode.i_lock);
+        __take_cap_refs(ci, caps);
+        spin_unlock(&ci->vfs_inode.i_lock);
+}
+
+/*
+ * Release cap refs.
+ *
+ * If we released the last ref on any given cap, call ceph_check_caps
+ * to release (or schedule a release).
+ *
+ * If we are releasing a WR cap (from a sync write), finalize any affected
+ * cap_snap, and wake up any waiters.
+ */
+void ceph_put_cap_refs(struct ceph_inode_info *ci, int had)
+{
+        struct inode *inode = &ci->vfs_inode;
+        int last = 0, put = 0, flushsnaps = 0, wake = 0;
+        struct ceph_cap_snap *capsnap;
+
+        spin_lock(&inode->i_lock);
+        if (had & CEPH_CAP_PIN)
+                --ci->i_pin_ref;
+        if (had & CEPH_CAP_FILE_RD)
+                if (--ci->i_rd_ref == 0)
+                        last++;
+        if (had & CEPH_CAP_FILE_CACHE)
+                if (--ci->i_rdcache_ref == 0)
+                        last++;
+        if (had & CEPH_CAP_FILE_BUFFER) {
+                if (--ci->i_wrbuffer_ref == 0) {
+                        last++;
+                        put++;
+                }
+                dout("put_cap_refs %p wrbuffer %d -> %d (?)\n",
+                     inode, ci->i_wrbuffer_ref+1, ci->i_wrbuffer_ref);
+        }
+        if (had & CEPH_CAP_FILE_WR)
+                if (--ci->i_wr_ref == 0) {
+                        last++;
+                        if (!list_empty(&ci->i_cap_snaps)) {
+                                capsnap = list_first_entry(&ci->i_cap_snaps,
+                                                     struct ceph_cap_snap,
+                                                     ci_item);
+                                if (capsnap->writing) {
+                                        capsnap->writing = 0;
+                                        flushsnaps =
+                                                __ceph_finish_cap_snap(ci,
+                                                                       capsnap);
+                                        wake = 1;
+                                }
+                        }
+                }
+        spin_unlock(&inode->i_lock);
+
+        dout("put_cap_refs %p had %s%s%s\n", inode, ceph_cap_string(had),
+             last ? " last" : "", put ? " put" : "");
+
+        if (last && !flushsnaps)
+                ceph_check_caps(ci, 0, NULL);
+        else if (flushsnaps)
+                ceph_flush_snaps(ci);
+        if (wake)
+                wake_up(&ci->i_cap_wq);
+        if (put)
+                iput(inode);
+}
+
+/*
+ * Release @nr WRBUFFER refs on dirty pages for the given @snapc snap
+ * context.  Adjust per-snap dirty page accounting as appropriate.
+ * Once all dirty data for a cap_snap is flushed, flush snapped file
+ * metadata back to the MDS.  If we dropped the last ref, call
+ * ceph_check_caps.
+ */
+void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
+                                struct ceph_snap_context *snapc)
+{
+        struct inode *inode = &ci->vfs_inode;
+        int last = 0;
+        int complete_capsnap = 0;
+        int drop_capsnap = 0;
+        int found = 0;
+        struct ceph_cap_snap *capsnap = NULL;
+
+        spin_lock(&inode->i_lock);
+        ci->i_wrbuffer_ref -= nr;
+        last = !ci->i_wrbuffer_ref;
+
+        if (ci->i_head_snapc == snapc) {
+                ci->i_wrbuffer_ref_head -= nr;
+                if (!ci->i_wrbuffer_ref_head) {
+                        ceph_put_snap_context(ci->i_head_snapc);
+                        ci->i_head_snapc = NULL;
+                }
+                dout("put_wrbuffer_cap_refs on %p head %d/%d -> %d/%d %s\n",
+                     inode,
+                     ci->i_wrbuffer_ref+nr, ci->i_wrbuffer_ref_head+nr,
+                     ci->i_wrbuffer_ref, ci->i_wrbuffer_ref_head,
+                     last ? " LAST" : "");
+        } else {
+                list_for_each_entry(capsnap, &ci->i_cap_snaps, ci_item) {
+                        if (capsnap->context == snapc) {
+                                found = 1;
+                                break;
+                        }
+                }
+                BUG_ON(!found);
+                capsnap->dirty_pages -= nr;
+                if (capsnap->dirty_pages == 0) {
+                        complete_capsnap = 1;
+                        if (capsnap->dirty == 0)
+                                /* cap writeback completed before we created
+                                 * the cap_snap; no FLUSHSNAP is needed */
+                                drop_capsnap = 1;
+                }
+                dout("put_wrbuffer_cap_refs on %p cap_snap %p "
+                     " snap %lld %d/%d -> %d/%d %s%s%s\n",
+                     inode, capsnap, capsnap->context->seq,
+                     ci->i_wrbuffer_ref+nr, capsnap->dirty_pages + nr,
+                     ci->i_wrbuffer_ref, capsnap->dirty_pages,
+                     last ? " (wrbuffer last)" : "",
+                     complete_capsnap ? " (complete capsnap)" : "",
+                     drop_capsnap ? " (drop capsnap)" : "");
+                if (drop_capsnap) {
+                        ceph_put_snap_context(capsnap->context);
+                        list_del(&capsnap->ci_item);
+                        list_del(&capsnap->flushing_item);
+                        ceph_put_cap_snap(capsnap);
+                }
+        }
+
+        spin_unlock(&inode->i_lock);
+
+        if (last) {
+                ceph_check_caps(ci, CHECK_CAPS_AUTHONLY, NULL);
+                iput(inode);
+        } else if (complete_capsnap) {
+                ceph_flush_snaps(ci);
+                wake_up(&ci->i_cap_wq);
+        }
+        if (drop_capsnap)
+                iput(inode);
+}
+
+/*
+ * Handle a cap GRANT message from the MDS.  (Note that a GRANT may
+ * actually be a revocation if it specifies a smaller cap set.)
+ *
+ * caller holds s_mutex and i_lock, we drop both.
+ *
+ * return value:
+ *  0 - ok
+ *  1 - check_caps on auth cap only (writeback)
+ *  2 - check_caps (ack revoke)
+ */
+static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
+                             struct ceph_mds_session *session,
+                             struct ceph_cap *cap,
+                             struct ceph_buffer *xattr_buf)
+        __releases(inode->i_lock)
+        __releases(session->s_mutex)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int mds = session->s_mds;
+        int seq = le32_to_cpu(grant->seq);
+        int newcaps = le32_to_cpu(grant->caps);
+        int issued, implemented, used, wanted, dirty;
+        u64 size = le64_to_cpu(grant->size);
+        u64 max_size = le64_to_cpu(grant->max_size);
+        struct timespec mtime, atime, ctime;
+        int check_caps = 0;
+        int wake = 0;
+        int writeback = 0;
+        int revoked_rdcache = 0;
+        int queue_invalidate = 0;
+
+        dout("handle_cap_grant inode %p cap %p mds%d seq %d %s\n",
+             inode, cap, mds, seq, ceph_cap_string(newcaps));
+        dout(" size %llu max_size %llu, i_size %llu\n", size, max_size,
+                inode->i_size);
+
+        /*
+         * If CACHE is being revoked, and we have no dirty buffers,
+         * try to invalidate (once).  (If there are dirty buffers, we
+         * will invalidate _after_ writeback.)
+         */
+        if (((cap->issued & ~newcaps) & CEPH_CAP_FILE_CACHE) &&
+            !ci->i_wrbuffer_ref) {
+                if (try_nonblocking_invalidate(inode) == 0) {
+                        revoked_rdcache = 1;
+                } else {
+                        /* there were locked pages.. invalidate later
+                           in a separate thread. */
+                        if (ci->i_rdcache_revoking != ci->i_rdcache_gen) {
+                                queue_invalidate = 1;
+                                ci->i_rdcache_revoking = ci->i_rdcache_gen;
+                        }
+                }
+        }
+
+        /* side effects now are allowed */
+
+        issued = __ceph_caps_issued(ci, &implemented);
+        issued |= implemented | __ceph_caps_dirty(ci);
+
+        cap->cap_gen = session->s_cap_gen;
+
+        __check_cap_issue(ci, cap, newcaps);
+
+        if ((issued & CEPH_CAP_AUTH_EXCL) == 0) {
+                inode->i_mode = le32_to_cpu(grant->mode);
+                inode->i_uid = le32_to_cpu(grant->uid);
+                inode->i_gid = le32_to_cpu(grant->gid);
+                dout("%p mode 0%o uid.gid %d.%d\n", inode, inode->i_mode,
+                     inode->i_uid, inode->i_gid);
+        }
+
+        if ((issued & CEPH_CAP_LINK_EXCL) == 0)
+                inode->i_nlink = le32_to_cpu(grant->nlink);
+
+        if ((issued & CEPH_CAP_XATTR_EXCL) == 0 && grant->xattr_len) {
+                int len = le32_to_cpu(grant->xattr_len);
+                u64 version = le64_to_cpu(grant->xattr_version);
+
+                if (version > ci->i_xattrs.version) {
+                        dout(" got new xattrs v%llu on %p len %d\n",
+                             version, inode, len);
+                        if (ci->i_xattrs.blob)
+                                ceph_buffer_put(ci->i_xattrs.blob);
+                        ci->i_xattrs.blob = ceph_buffer_get(xattr_buf);
+                        ci->i_xattrs.version = version;
+                }
+        }
+
+        /* size/ctime/mtime/atime? */
+        ceph_fill_file_size(inode, issued,
+                            le32_to_cpu(grant->truncate_seq),
+                            le64_to_cpu(grant->truncate_size), size);
+        ceph_decode_timespec(&mtime, &grant->mtime);
+        ceph_decode_timespec(&atime, &grant->atime);
+        ceph_decode_timespec(&ctime, &grant->ctime);
+        ceph_fill_file_time(inode, issued,
+                            le32_to_cpu(grant->time_warp_seq), &ctime, &mtime,
+                            &atime);
+
+        /* max size increase? */
+        if (max_size != ci->i_max_size) {
+                dout("max_size %lld -> %llu\n", ci->i_max_size, max_size);
+                ci->i_max_size = max_size;
+                if (max_size >= ci->i_wanted_max_size) {
+                        ci->i_wanted_max_size = 0;  /* reset */
+                        ci->i_requested_max_size = 0;
+                }
+                wake = 1;
+        }
+
+        /* check cap bits */
+        wanted = __ceph_caps_wanted(ci);
+        used = __ceph_caps_used(ci);
+        dirty = __ceph_caps_dirty(ci);
+        dout(" my wanted = %s, used = %s, dirty %s\n",
+             ceph_cap_string(wanted),
+             ceph_cap_string(used),
+             ceph_cap_string(dirty));
+        if (wanted != le32_to_cpu(grant->wanted)) {
+                dout("mds wanted %s -> %s\n",
+                     ceph_cap_string(le32_to_cpu(grant->wanted)),
+                     ceph_cap_string(wanted));
+                grant->wanted = cpu_to_le32(wanted);
+        }
+
+        cap->seq = seq;
+
+        /* file layout may have changed */
+        ci->i_layout = grant->layout;
+
+        /* revocation, grant, or no-op? */
+        if (cap->issued & ~newcaps) {
+                dout("revocation: %s -> %s\n", ceph_cap_string(cap->issued),
+                     ceph_cap_string(newcaps));
+                if ((used & ~newcaps) & CEPH_CAP_FILE_BUFFER)
+                        writeback = 1; /* will delay ack */
+                else if (dirty & ~newcaps)
+                        check_caps = 1;  /* initiate writeback in check_caps */
+                else if (((used & ~newcaps) & CEPH_CAP_FILE_CACHE) == 0 ||
+                           revoked_rdcache)
+                        check_caps = 2;     /* send revoke ack in check_caps */
+                cap->issued = newcaps;
+                cap->implemented |= newcaps;
+        } else if (cap->issued == newcaps) {
+                dout("caps unchanged: %s -> %s\n",
+                     ceph_cap_string(cap->issued), ceph_cap_string(newcaps));
+        } else {
+                dout("grant: %s -> %s\n", ceph_cap_string(cap->issued),
+                     ceph_cap_string(newcaps));
+                cap->issued = newcaps;
+                cap->implemented |= newcaps; /* add bits only, to
+                                              * avoid stepping on a
+                                              * pending revocation */
+                wake = 1;
+        }
+        BUG_ON(cap->issued & ~cap->implemented);
+
+        spin_unlock(&inode->i_lock);
+        if (writeback)
+                /*
+                 * queue inode for writeback: we can't actually call
+                 * filemap_write_and_wait, etc. from message handler
+                 * context.
+                 */
+                ceph_queue_writeback(inode);
+        if (queue_invalidate)
+                ceph_queue_invalidate(inode);
+        if (wake)
+                wake_up(&ci->i_cap_wq);
+
+        if (check_caps == 1)
+                ceph_check_caps(ci, CHECK_CAPS_NODELAY|CHECK_CAPS_AUTHONLY,
+                                session);
+        else if (check_caps == 2)
+                ceph_check_caps(ci, CHECK_CAPS_NODELAY, session);
+        else
+                mutex_unlock(&session->s_mutex);
+}
+
+/*
+ * Handle FLUSH_ACK from MDS, indicating that metadata we sent to the
+ * MDS has been safely committed.
+ */
+static void handle_cap_flush_ack(struct inode *inode, u64 flush_tid,
+                                 struct ceph_mds_caps *m,
+                                 struct ceph_mds_session *session,
+                                 struct ceph_cap *cap)
+        __releases(inode->i_lock)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_mds_client *mdsc = &ceph_client(inode->i_sb)->mdsc;
+        unsigned seq = le32_to_cpu(m->seq);
+        int dirty = le32_to_cpu(m->dirty);
+        int cleaned = 0;
+        int drop = 0;
+        int i;
+
+        for (i = 0; i < CEPH_CAP_BITS; i++)
+                if ((dirty & (1 << i)) &&
+                    flush_tid == ci->i_cap_flush_tid[i])
+                        cleaned |= 1 << i;
+
+        dout("handle_cap_flush_ack inode %p mds%d seq %d on %s cleaned %s,"
+             " flushing %s -> %s\n",
+             inode, session->s_mds, seq, ceph_cap_string(dirty),
+             ceph_cap_string(cleaned), ceph_cap_string(ci->i_flushing_caps),
+             ceph_cap_string(ci->i_flushing_caps & ~cleaned));
+
+        if (ci->i_flushing_caps == (ci->i_flushing_caps & ~cleaned))
+                goto out;
+
+        ci->i_flushing_caps &= ~cleaned;
+
+        spin_lock(&mdsc->cap_dirty_lock);
+        if (ci->i_flushing_caps == 0) {
+                list_del_init(&ci->i_flushing_item);
+                if (!list_empty(&session->s_cap_flushing))
+                        dout(" mds%d still flushing cap on %p\n",
+                             session->s_mds,
+                             &list_entry(session->s_cap_flushing.next,
+                                         struct ceph_inode_info,
+                                         i_flushing_item)->vfs_inode);
+                mdsc->num_cap_flushing--;
+                wake_up(&mdsc->cap_flushing_wq);
+                dout(" inode %p now !flushing\n", inode);
+
+                if (ci->i_dirty_caps == 0) {
+                        dout(" inode %p now clean\n", inode);
+                        BUG_ON(!list_empty(&ci->i_dirty_item));
+                        drop = 1;
+                } else {
+                        BUG_ON(list_empty(&ci->i_dirty_item));
+                }
+        }
+        spin_unlock(&mdsc->cap_dirty_lock);
+        wake_up(&ci->i_cap_wq);
+
+out:
+        spin_unlock(&inode->i_lock);
+        if (drop)
+                iput(inode);
+}
+
+/*
+ * Handle FLUSHSNAP_ACK.  MDS has flushed snap data to disk and we can
+ * throw away our cap_snap.
+ *
+ * Caller hold s_mutex.
+ */
+static void handle_cap_flushsnap_ack(struct inode *inode, u64 flush_tid,
+                                     struct ceph_mds_caps *m,
+                                     struct ceph_mds_session *session)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        u64 follows = le64_to_cpu(m->snap_follows);
+        struct ceph_cap_snap *capsnap;
+        int drop = 0;
+
+        dout("handle_cap_flushsnap_ack inode %p ci %p mds%d follows %lld\n",
+             inode, ci, session->s_mds, follows);
+
+        spin_lock(&inode->i_lock);
+        list_for_each_entry(capsnap, &ci->i_cap_snaps, ci_item) {
+                if (capsnap->follows == follows) {
+                        if (capsnap->flush_tid != flush_tid) {
+                                dout(" cap_snap %p follows %lld tid %lld !="
+                                     " %lld\n", capsnap, follows,
+                                     flush_tid, capsnap->flush_tid);
+                                break;
+                        }
+                        WARN_ON(capsnap->dirty_pages || capsnap->writing);
+                        dout(" removing %p cap_snap %p follows %lld\n",
+                             inode, capsnap, follows);
+                        ceph_put_snap_context(capsnap->context);
+                        list_del(&capsnap->ci_item);
+                        list_del(&capsnap->flushing_item);
+                        ceph_put_cap_snap(capsnap);
+                        drop = 1;
+                        break;
+                } else {
+                        dout(" skipping cap_snap %p follows %lld\n",
+                             capsnap, capsnap->follows);
+                }
+        }
+        spin_unlock(&inode->i_lock);
+        if (drop)
+                iput(inode);
+}
+
+/*
+ * Handle TRUNC from MDS, indicating file truncation.
+ *
+ * caller hold s_mutex.
+ */
+static void handle_cap_trunc(struct inode *inode,
+                             struct ceph_mds_caps *trunc,
+                             struct ceph_mds_session *session)
+        __releases(inode->i_lock)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int mds = session->s_mds;
+        int seq = le32_to_cpu(trunc->seq);
+        u32 truncate_seq = le32_to_cpu(trunc->truncate_seq);
+        u64 truncate_size = le64_to_cpu(trunc->truncate_size);
+        u64 size = le64_to_cpu(trunc->size);
+        int implemented = 0;
+        int dirty = __ceph_caps_dirty(ci);
+        int issued = __ceph_caps_issued(ceph_inode(inode), &implemented);
+        int queue_trunc = 0;
+
+        issued |= implemented | dirty;
+
+        dout("handle_cap_trunc inode %p mds%d seq %d to %lld seq %d\n",
+             inode, mds, seq, truncate_size, truncate_seq);
+        queue_trunc = ceph_fill_file_size(inode, issued,
+                                          truncate_seq, truncate_size, size);
+        spin_unlock(&inode->i_lock);
+
+        if (queue_trunc)
+                ceph_queue_vmtruncate(inode);
+}
+
+/*
+ * Handle EXPORT from MDS.  Cap is being migrated _from_ this mds to a
+ * different one.  If we are the most recent migration we've seen (as
+ * indicated by mseq), make note of the migrating cap bits for the
+ * duration (until we see the corresponding IMPORT).
+ *
+ * caller holds s_mutex
+ */
+static void handle_cap_export(struct inode *inode, struct ceph_mds_caps *ex,
+                              struct ceph_mds_session *session)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int mds = session->s_mds;
+        unsigned mseq = le32_to_cpu(ex->migrate_seq);
+        struct ceph_cap *cap = NULL, *t;
+        struct rb_node *p;
+        int remember = 1;
+
+        dout("handle_cap_export inode %p ci %p mds%d mseq %d\n",
+             inode, ci, mds, mseq);
+
+        spin_lock(&inode->i_lock);
+
+        /* make sure we haven't seen a higher mseq */
+        for (p = rb_first(&ci->i_caps); p; p = rb_next(p)) {
+                t = rb_entry(p, struct ceph_cap, ci_node);
+                if (ceph_seq_cmp(t->mseq, mseq) > 0) {
+                        dout(" higher mseq on cap from mds%d\n",
+                             t->session->s_mds);
+                        remember = 0;
+                }
+                if (t->session->s_mds == mds)
+                        cap = t;
+        }
+
+        if (cap) {
+                if (remember) {
+                        /* make note */
+                        ci->i_cap_exporting_mds = mds;
+                        ci->i_cap_exporting_mseq = mseq;
+                        ci->i_cap_exporting_issued = cap->issued;
+                }
+                __ceph_remove_cap(cap);
+        }
+        /* else, we already released it */
+
+        spin_unlock(&inode->i_lock);
+}
+
+/*
+ * Handle cap IMPORT.  If there are temp bits from an older EXPORT,
+ * clean them up.
+ *
+ * caller holds s_mutex.
+ */
+static void handle_cap_import(struct ceph_mds_client *mdsc,
+                              struct inode *inode, struct ceph_mds_caps *im,
+                              struct ceph_mds_session *session,
+                              void *snaptrace, int snaptrace_len)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int mds = session->s_mds;
+        unsigned issued = le32_to_cpu(im->caps);
+        unsigned wanted = le32_to_cpu(im->wanted);
+        unsigned seq = le32_to_cpu(im->seq);
+        unsigned mseq = le32_to_cpu(im->migrate_seq);
+        u64 realmino = le64_to_cpu(im->realm);
+        u64 cap_id = le64_to_cpu(im->cap_id);
+
+        if (ci->i_cap_exporting_mds >= 0 &&
+            ceph_seq_cmp(ci->i_cap_exporting_mseq, mseq) < 0) {
+                dout("handle_cap_import inode %p ci %p mds%d mseq %d"
+                     " - cleared exporting from mds%d\n",
+                     inode, ci, mds, mseq,
+                     ci->i_cap_exporting_mds);
+                ci->i_cap_exporting_issued = 0;
+                ci->i_cap_exporting_mseq = 0;
+                ci->i_cap_exporting_mds = -1;
+        } else {
+                dout("handle_cap_import inode %p ci %p mds%d mseq %d\n",
+                     inode, ci, mds, mseq);
+        }
+
+        down_write(&mdsc->snap_rwsem);
+        ceph_update_snap_trace(mdsc, snaptrace, snaptrace+snaptrace_len,
+                               false);
+        downgrade_write(&mdsc->snap_rwsem);
+        ceph_add_cap(inode, session, cap_id, -1,
+                     issued, wanted, seq, mseq, realmino, CEPH_CAP_FLAG_AUTH,
+                     NULL /* no caps context */);
+        try_flush_caps(inode, session, NULL);
+        up_read(&mdsc->snap_rwsem);
+}
+
+/*
+ * Handle a caps message from the MDS.
+ *
+ * Identify the appropriate session, inode, and call the right handler
+ * based on the cap op.
+ */
+void ceph_handle_caps(struct ceph_mds_session *session,
+                      struct ceph_msg *msg)
+{
+        struct ceph_mds_client *mdsc = session->s_mdsc;
+        struct super_block *sb = mdsc->client->sb;
+        struct inode *inode;
+        struct ceph_cap *cap;
+        struct ceph_mds_caps *h;
+        int mds = session->s_mds;
+        int op;
+        u32 seq;
+        struct ceph_vino vino;
+        u64 cap_id;
+        u64 size, max_size;
+        u64 tid;
+        void *snaptrace;
+
+        dout("handle_caps from mds%d\n", mds);
+
+        /* decode */
+        tid = le64_to_cpu(msg->hdr.tid);
+        if (msg->front.iov_len < sizeof(*h))
+                goto bad;
+        h = msg->front.iov_base;
+        snaptrace = h + 1;
+        op = le32_to_cpu(h->op);
+        vino.ino = le64_to_cpu(h->ino);
+        vino.snap = CEPH_NOSNAP;
+        cap_id = le64_to_cpu(h->cap_id);
+        seq = le32_to_cpu(h->seq);
+        size = le64_to_cpu(h->size);
+        max_size = le64_to_cpu(h->max_size);
+
+        mutex_lock(&session->s_mutex);
+        session->s_seq++;
+        dout(" mds%d seq %lld cap seq %u\n", session->s_mds, session->s_seq,
+             (unsigned)seq);
+
+        /* lookup ino */
+        inode = ceph_find_inode(sb, vino);
+        dout(" op %s ino %llx.%llx inode %p\n", ceph_cap_op_name(op), vino.ino,
+             vino.snap, inode);
+        if (!inode) {
+                dout(" i don't have ino %llx\n", vino.ino);
+                goto done;
+        }
+
+        /* these will work even if we don't have a cap yet */
+        switch (op) {
+        case CEPH_CAP_OP_FLUSHSNAP_ACK:
+                handle_cap_flushsnap_ack(inode, tid, h, session);
+                goto done;
+
+        case CEPH_CAP_OP_EXPORT:
+                handle_cap_export(inode, h, session);
+                goto done;
+
+        case CEPH_CAP_OP_IMPORT:
+                handle_cap_import(mdsc, inode, h, session,
+                                  snaptrace, le32_to_cpu(h->snap_trace_len));
+                ceph_check_caps(ceph_inode(inode), CHECK_CAPS_NODELAY,
+                                session);
+                goto done_unlocked;
+        }
+
+        /* the rest require a cap */
+        spin_lock(&inode->i_lock);
+        cap = __get_cap_for_mds(ceph_inode(inode), mds);
+        if (!cap) {
+                dout("no cap on %p ino %llx.%llx from mds%d, releasing\n",
+                     inode, ceph_ino(inode), ceph_snap(inode), mds);
+                spin_unlock(&inode->i_lock);
+                goto done;
+        }
+
+        /* note that each of these drops i_lock for us */
+        switch (op) {
+        case CEPH_CAP_OP_REVOKE:
+        case CEPH_CAP_OP_GRANT:
+                handle_cap_grant(inode, h, session, cap, msg->middle);
+                goto done_unlocked;
+
+        case CEPH_CAP_OP_FLUSH_ACK:
+                handle_cap_flush_ack(inode, tid, h, session, cap);
+                break;
+
+        case CEPH_CAP_OP_TRUNC:
+                handle_cap_trunc(inode, h, session);
+                break;
+
+        default:
+                spin_unlock(&inode->i_lock);
+                pr_err("ceph_handle_caps: unknown cap op %d %s\n", op,
+                       ceph_cap_op_name(op));
+        }
+
+done:
+        mutex_unlock(&session->s_mutex);
+done_unlocked:
+        if (inode)
+                iput(inode);
+        return;
+
+bad:
+        pr_err("ceph_handle_caps: corrupt message\n");
+        ceph_msg_dump(msg);
+        return;
+}
+
+/*
+ * Delayed work handler to process end of delayed cap release LRU list.
+ */
+void ceph_check_delayed_caps(struct ceph_mds_client *mdsc)
+{
+        struct ceph_inode_info *ci;
+        int flags = CHECK_CAPS_NODELAY;
+
+        dout("check_delayed_caps\n");
+        while (1) {
+                spin_lock(&mdsc->cap_delay_lock);
+                if (list_empty(&mdsc->cap_delay_list))
+                        break;
+                ci = list_first_entry(&mdsc->cap_delay_list,
+                                      struct ceph_inode_info,
+                                      i_cap_delay_list);
+                if ((ci->i_ceph_flags & CEPH_I_FLUSH) == 0 &&
+                    time_before(jiffies, ci->i_hold_caps_max))
+                        break;
+                list_del_init(&ci->i_cap_delay_list);
+                spin_unlock(&mdsc->cap_delay_lock);
+                dout("check_delayed_caps on %p\n", &ci->vfs_inode);
+                ceph_check_caps(ci, flags, NULL);
+        }
+        spin_unlock(&mdsc->cap_delay_lock);
+}
+
+/*
+ * Flush all dirty caps to the mds
+ */
+void ceph_flush_dirty_caps(struct ceph_mds_client *mdsc)
+{
+        struct ceph_inode_info *ci, *nci = NULL;
+        struct inode *inode, *ninode = NULL;
+        struct list_head *p, *n;
+
+        dout("flush_dirty_caps\n");
+        spin_lock(&mdsc->cap_dirty_lock);
+        list_for_each_safe(p, n, &mdsc->cap_dirty) {
+                if (nci) {
+                        ci = nci;
+                        inode = ninode;
+                        ci->i_ceph_flags &= ~CEPH_I_NOFLUSH;
+                        dout("flush_dirty_caps inode %p (was next inode)\n",
+                             inode);
+                } else {
+                        ci = list_entry(p, struct ceph_inode_info,
+                                        i_dirty_item);
+                        inode = igrab(&ci->vfs_inode);
+                        BUG_ON(!inode);
+                        dout("flush_dirty_caps inode %p\n", inode);
+                }
+                if (n != &mdsc->cap_dirty) {
+                        nci = list_entry(n, struct ceph_inode_info,
+                                         i_dirty_item);
+                        ninode = igrab(&nci->vfs_inode);
+                        BUG_ON(!ninode);
+                        nci->i_ceph_flags |= CEPH_I_NOFLUSH;
+                        dout("flush_dirty_caps next inode %p, noflush\n",
+                             ninode);
+                } else {
+                        nci = NULL;
+                        ninode = NULL;
+                }
+                spin_unlock(&mdsc->cap_dirty_lock);
+                if (inode) {
+                        ceph_check_caps(ci, CHECK_CAPS_NODELAY|CHECK_CAPS_FLUSH,
+                                        NULL);
+                        iput(inode);
+                }
+                spin_lock(&mdsc->cap_dirty_lock);
+        }
+        spin_unlock(&mdsc->cap_dirty_lock);
+}
+
+/*
+ * Drop open file reference.  If we were the last open file,
+ * we may need to release capabilities to the MDS (or schedule
+ * their delayed release).
+ */
+void ceph_put_fmode(struct ceph_inode_info *ci, int fmode)
+{
+        struct inode *inode = &ci->vfs_inode;
+        int last = 0;
+
+        spin_lock(&inode->i_lock);
+        dout("put_fmode %p fmode %d %d -> %d\n", inode, fmode,
+             ci->i_nr_by_mode[fmode], ci->i_nr_by_mode[fmode]-1);
+        BUG_ON(ci->i_nr_by_mode[fmode] == 0);
+        if (--ci->i_nr_by_mode[fmode] == 0)
+                last++;
+        spin_unlock(&inode->i_lock);
+
+        if (last && ci->i_vino.snap == CEPH_NOSNAP)
+                ceph_check_caps(ci, 0, NULL);
+}
+
+/*
+ * Helpers for embedding cap and dentry lease releases into mds
+ * requests.
+ *
+ * @force is used by dentry_release (below) to force inclusion of a
+ * record for the directory inode, even when there aren't any caps to
+ * drop.
+ */
+int ceph_encode_inode_release(void **p, struct inode *inode,
+                              int mds, int drop, int unless, int force)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_cap *cap;
+        struct ceph_mds_request_release *rel = *p;
+        int ret = 0;
+        int used = 0;
+
+        spin_lock(&inode->i_lock);
+        used = __ceph_caps_used(ci);
+
+        dout("encode_inode_release %p mds%d used %s drop %s unless %s\n", inode,
+             mds, ceph_cap_string(used), ceph_cap_string(drop),
+             ceph_cap_string(unless));
+
+        /* only drop unused caps */
+        drop &= ~used;
+
+        cap = __get_cap_for_mds(ci, mds);
+        if (cap && __cap_is_valid(cap)) {
+                if (force ||
+                    ((cap->issued & drop) &&
+                     (cap->issued & unless) == 0)) {
+                        if ((cap->issued & drop) &&
+                            (cap->issued & unless) == 0) {
+                                dout("encode_inode_release %p cap %p %s -> "
+                                     "%s\n", inode, cap,
+                                     ceph_cap_string(cap->issued),
+                                     ceph_cap_string(cap->issued & ~drop));
+                                cap->issued &= ~drop;
+                                cap->implemented &= ~drop;
+                                if (ci->i_ceph_flags & CEPH_I_NODELAY) {
+                                        int wanted = __ceph_caps_wanted(ci);
+                                        dout("  wanted %s -> %s (act %s)\n",
+                                             ceph_cap_string(cap->mds_wanted),
+                                             ceph_cap_string(cap->mds_wanted &
+                                                             ~wanted),
+                                             ceph_cap_string(wanted));
+                                        cap->mds_wanted &= wanted;
+                                }
+                        } else {
+                                dout("encode_inode_release %p cap %p %s"
+                                     " (force)\n", inode, cap,
+                                     ceph_cap_string(cap->issued));
+                        }
+
+                        rel->ino = cpu_to_le64(ceph_ino(inode));
+                        rel->cap_id = cpu_to_le64(cap->cap_id);
+                        rel->seq = cpu_to_le32(cap->seq);
+                        rel->issue_seq = cpu_to_le32(cap->issue_seq),
+                        rel->mseq = cpu_to_le32(cap->mseq);
+                        rel->caps = cpu_to_le32(cap->issued);
+                        rel->wanted = cpu_to_le32(cap->mds_wanted);
+                        rel->dname_len = 0;
+                        rel->dname_seq = 0;
+                        *p += sizeof(*rel);
+                        ret = 1;
+                } else {
+                        dout("encode_inode_release %p cap %p %s\n",
+                             inode, cap, ceph_cap_string(cap->issued));
+                }
+        }
+        spin_unlock(&inode->i_lock);
+        return ret;
+}
+
+int ceph_encode_dentry_release(void **p, struct dentry *dentry,
+                               int mds, int drop, int unless)
+{
+        struct inode *dir = dentry->d_parent->d_inode;
+        struct ceph_mds_request_release *rel = *p;
+        struct ceph_dentry_info *di = ceph_dentry(dentry);
+        int force = 0;
+        int ret;
+
+        /*
+         * force an record for the directory caps if we have a dentry lease.
+         * this is racy (can't take i_lock and d_lock together), but it
+         * doesn't have to be perfect; the mds will revoke anything we don't
+         * release.
+         */
+        spin_lock(&dentry->d_lock);
+        if (di->lease_session && di->lease_session->s_mds == mds)
+                force = 1;
+        spin_unlock(&dentry->d_lock);
+
+        ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force);
+
+        spin_lock(&dentry->d_lock);
+        if (ret && di->lease_session && di->lease_session->s_mds == mds) {
+                dout("encode_dentry_release %p mds%d seq %d\n",
+                     dentry, mds, (int)di->lease_seq);
+                rel->dname_len = cpu_to_le32(dentry->d_name.len);
+                memcpy(*p, dentry->d_name.name, dentry->d_name.len);
+                *p += dentry->d_name.len;
+                rel->dname_seq = cpu_to_le32(di->lease_seq);
+        }
+        spin_unlock(&dentry->d_lock);
+        return ret;
+}
diff --git a/fs/ceph/ceph_debug.h b/fs/ceph/ceph_debug.h
new file mode 100644
index 000000000000..1818c2305610
--- /dev/null
+++ b/fs/ceph/ceph_debug.h
@@ -0,0 +1,37 @@
+#ifndef _FS_CEPH_DEBUG_H
+#define _FS_CEPH_DEBUG_H
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#ifdef CONFIG_CEPH_FS_PRETTYDEBUG
+
+/*
+ * wrap pr_debug to include a filename:lineno prefix on each line.
+ * this incurs some overhead (kernel size and execution time) due to
+ * the extra function call at each call site.
+ */
+
+# if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
+extern const char *ceph_file_part(const char *s, int len);
+#  define dout(fmt, ...)                                                \
+        pr_debug(" %12.12s:%-4d : " fmt,                                \
+                 ceph_file_part(__FILE__, sizeof(__FILE__)),            \
+                 __LINE__, ##__VA_ARGS__)
+# else
+/* faux printk call just to see any compiler warnings. */
+#  define dout(fmt, ...)        do {                            \
+                if (0)                                          \
+                        printk(KERN_DEBUG fmt, ##__VA_ARGS__);  \
+        } while (0)
+# endif
+
+#else
+
+/*
+ * or, just wrap pr_debug
+ */
+# define dout(fmt, ...) pr_debug(" " fmt, ##__VA_ARGS__)
+
+#endif
+
+#endif
diff --git a/fs/ceph/ceph_frag.c b/fs/ceph/ceph_frag.c
new file mode 100644
index 000000000000..ab6cf35c4091
--- /dev/null
+++ b/fs/ceph/ceph_frag.c
@@ -0,0 +1,21 @@
+/*
+ * Ceph 'frag' type
+ */
+#include "types.h"
+
+int ceph_frag_compare(__u32 a, __u32 b)
+{
+        unsigned va = ceph_frag_value(a);
+        unsigned vb = ceph_frag_value(b);
+        if (va < vb)
+                return -1;
+        if (va > vb)
+                return 1;
+        va = ceph_frag_bits(a);
+        vb = ceph_frag_bits(b);
+        if (va < vb)
+                return -1;
+        if (va > vb)
+                return 1;
+        return 0;
+}
diff --git a/fs/ceph/ceph_frag.h b/fs/ceph/ceph_frag.h
new file mode 100644
index 000000000000..793f50cb7c22
--- /dev/null
+++ b/fs/ceph/ceph_frag.h
@@ -0,0 +1,109 @@
+#ifndef _FS_CEPH_FRAG_H
+#define _FS_CEPH_FRAG_H
+
+/*
+ * "Frags" are a way to describe a subset of a 32-bit number space,
+ * using a mask and a value to match against that mask.  Any given frag
+ * (subset of the number space) can be partitioned into 2^n sub-frags.
+ *
+ * Frags are encoded into a 32-bit word:
+ *   8 upper bits = "bits"
+ *  24 lower bits = "value"
+ * (We could go to 5+27 bits, but who cares.)
+ *
+ * We use the _most_ significant bits of the 24 bit value.  This makes
+ * values logically sort.
+ *
+ * Unfortunately, because the "bits" field is still in the high bits, we
+ * can't sort encoded frags numerically.  However, it does allow you
+ * to feed encoded frags as values into frag_contains_value.
+ */
+static inline __u32 ceph_frag_make(__u32 b, __u32 v)
+{
+        return (b << 24) |
+                (v & (0xffffffu << (24-b)) & 0xffffffu);
+}
+static inline __u32 ceph_frag_bits(__u32 f)
+{
+        return f >> 24;
+}
+static inline __u32 ceph_frag_value(__u32 f)
+{
+        return f & 0xffffffu;
+}
+static inline __u32 ceph_frag_mask(__u32 f)
+{
+        return (0xffffffu << (24-ceph_frag_bits(f))) & 0xffffffu;
+}
+static inline __u32 ceph_frag_mask_shift(__u32 f)
+{
+        return 24 - ceph_frag_bits(f);
+}
+
+static inline int ceph_frag_contains_value(__u32 f, __u32 v)
+{
+        return (v & ceph_frag_mask(f)) == ceph_frag_value(f);
+}
+static inline int ceph_frag_contains_frag(__u32 f, __u32 sub)
+{
+        /* is sub as specific as us, and contained by us? */
+        return ceph_frag_bits(sub) >= ceph_frag_bits(f) &&
+               (ceph_frag_value(sub) & ceph_frag_mask(f)) == ceph_frag_value(f);
+}
+
+static inline __u32 ceph_frag_parent(__u32 f)
+{
+        return ceph_frag_make(ceph_frag_bits(f) - 1,
+                         ceph_frag_value(f) & (ceph_frag_mask(f) << 1));
+}
+static inline int ceph_frag_is_left_child(__u32 f)
+{
+        return ceph_frag_bits(f) > 0 &&
+                (ceph_frag_value(f) & (0x1000000 >> ceph_frag_bits(f))) == 0;
+}
+static inline int ceph_frag_is_right_child(__u32 f)
+{
+        return ceph_frag_bits(f) > 0 &&
+                (ceph_frag_value(f) & (0x1000000 >> ceph_frag_bits(f))) == 1;
+}
+static inline __u32 ceph_frag_sibling(__u32 f)
+{
+        return ceph_frag_make(ceph_frag_bits(f),
+                      ceph_frag_value(f) ^ (0x1000000 >> ceph_frag_bits(f)));
+}
+static inline __u32 ceph_frag_left_child(__u32 f)
+{
+        return ceph_frag_make(ceph_frag_bits(f)+1, ceph_frag_value(f));
+}
+static inline __u32 ceph_frag_right_child(__u32 f)
+{
+        return ceph_frag_make(ceph_frag_bits(f)+1,
+              ceph_frag_value(f) | (0x1000000 >> (1+ceph_frag_bits(f))));
+}
+static inline __u32 ceph_frag_make_child(__u32 f, int by, int i)
+{
+        int newbits = ceph_frag_bits(f) + by;
+        return ceph_frag_make(newbits,
+                         ceph_frag_value(f) | (i << (24 - newbits)));
+}
+static inline int ceph_frag_is_leftmost(__u32 f)
+{
+        return ceph_frag_value(f) == 0;
+}
+static inline int ceph_frag_is_rightmost(__u32 f)
+{
+        return ceph_frag_value(f) == ceph_frag_mask(f);
+}
+static inline __u32 ceph_frag_next(__u32 f)
+{
+        return ceph_frag_make(ceph_frag_bits(f),
+                         ceph_frag_value(f) + (0x1000000 >> ceph_frag_bits(f)));
+}
+
+/*
+ * comparator to sort frags logically, as when traversing the
+ * number space in ascending order...
+ */
+int ceph_frag_compare(__u32 a, __u32 b);
+
+#endif
diff --git a/fs/ceph/ceph_fs.c b/fs/ceph/ceph_fs.c
new file mode 100644
index 000000000000..79d76bc4303f
--- /dev/null
+++ b/fs/ceph/ceph_fs.c
@@ -0,0 +1,74 @@
+/*
+ * Some non-inline ceph helpers
+ */
+#include "types.h"
+
+/*
+ * return true if @layout appears to be valid
+ */
+int ceph_file_layout_is_valid(const struct ceph_file_layout *layout)
+{
+        __u32 su = le32_to_cpu(layout->fl_stripe_unit);
+        __u32 sc = le32_to_cpu(layout->fl_stripe_count);
+        __u32 os = le32_to_cpu(layout->fl_object_size);
+
+        /* stripe unit, object size must be non-zero, 64k increment */
+        if (!su || (su & (CEPH_MIN_STRIPE_UNIT-1)))
+                return 0;
+        if (!os || (os & (CEPH_MIN_STRIPE_UNIT-1)))
+                return 0;
+        /* object size must be a multiple of stripe unit */
+        if (os < su || os % su)
+                return 0;
+        /* stripe count must be non-zero */
+        if (!sc)
+                return 0;
+        return 1;
+}
+
+
+int ceph_flags_to_mode(int flags)
+{
+#ifdef O_DIRECTORY  /* fixme */
+        if ((flags & O_DIRECTORY) == O_DIRECTORY)
+                return CEPH_FILE_MODE_PIN;
+#endif
+#ifdef O_LAZY
+        if (flags & O_LAZY)
+                return CEPH_FILE_MODE_LAZY;
+#endif
+        if ((flags & O_APPEND) == O_APPEND)
+                flags |= O_WRONLY;
+
+        flags &= O_ACCMODE;
+        if ((flags & O_RDWR) == O_RDWR)
+                return CEPH_FILE_MODE_RDWR;
+        if ((flags & O_WRONLY) == O_WRONLY)
+                return CEPH_FILE_MODE_WR;
+        return CEPH_FILE_MODE_RD;
+}
+
+int ceph_caps_for_mode(int mode)
+{
+        switch (mode) {
+        case CEPH_FILE_MODE_PIN:
+                return CEPH_CAP_PIN;
+        case CEPH_FILE_MODE_RD:
+                return CEPH_CAP_PIN | CEPH_CAP_FILE_SHARED |
+                        CEPH_CAP_FILE_RD | CEPH_CAP_FILE_CACHE;
+        case CEPH_FILE_MODE_RDWR:
+                return CEPH_CAP_PIN | CEPH_CAP_FILE_SHARED |
+                        CEPH_CAP_FILE_EXCL |
+                        CEPH_CAP_FILE_RD | CEPH_CAP_FILE_CACHE |
+                        CEPH_CAP_FILE_WR | CEPH_CAP_FILE_BUFFER |
+                        CEPH_CAP_AUTH_SHARED | CEPH_CAP_AUTH_EXCL |
+                        CEPH_CAP_XATTR_SHARED | CEPH_CAP_XATTR_EXCL;
+        case CEPH_FILE_MODE_WR:
+                return CEPH_CAP_PIN | CEPH_CAP_FILE_SHARED |
+                        CEPH_CAP_FILE_EXCL |
+                        CEPH_CAP_FILE_WR | CEPH_CAP_FILE_BUFFER |
+                        CEPH_CAP_AUTH_SHARED | CEPH_CAP_AUTH_EXCL |
+                        CEPH_CAP_XATTR_SHARED | CEPH_CAP_XATTR_EXCL;
+        }
+        return 0;
+}
diff --git a/fs/ceph/ceph_fs.h b/fs/ceph/ceph_fs.h
new file mode 100644
index 000000000000..0c2241ef3653
--- /dev/null
+++ b/fs/ceph/ceph_fs.h
@@ -0,0 +1,650 @@
+/*
+ * ceph_fs.h - Ceph constants and data types to share between kernel and
+ * user space.
+ *
+ * Most types in this file are defined as little-endian, and are
+ * primarily intended to describe data structures that pass over the
+ * wire or that are stored on disk.
+ *
+ * LGPL2
+ */
+
+#ifndef _FS_CEPH_CEPH_FS_H
+#define _FS_CEPH_CEPH_FS_H
+
+#include "msgr.h"
+#include "rados.h"
+
+/*
+ * Ceph release version
+ */
+#define CEPH_VERSION_MAJOR 0
+#define CEPH_VERSION_MINOR 19
+#define CEPH_VERSION_PATCH 0
+
+#define _CEPH_STRINGIFY(x) #x
+#define CEPH_STRINGIFY(x) _CEPH_STRINGIFY(x)
+#define CEPH_MAKE_VERSION(x, y, z) CEPH_STRINGIFY(x) "." CEPH_STRINGIFY(y) \
+        "." CEPH_STRINGIFY(z)
+#define CEPH_VERSION CEPH_MAKE_VERSION(CEPH_VERSION_MAJOR, \
+                                       CEPH_VERSION_MINOR, CEPH_VERSION_PATCH)
+
+/*
+ * subprotocol versions.  when specific messages types or high-level
+ * protocols change, bump the affected components.  we keep rev
+ * internal cluster protocols separately from the public,
+ * client-facing protocol.
+ */
+#define CEPH_OSD_PROTOCOL     8 /* cluster internal */
+#define CEPH_MDS_PROTOCOL     9 /* cluster internal */
+#define CEPH_MON_PROTOCOL     5 /* cluster internal */
+#define CEPH_OSDC_PROTOCOL   24 /* server/client */
+#define CEPH_MDSC_PROTOCOL   32 /* server/client */
+#define CEPH_MONC_PROTOCOL   15 /* server/client */
+
+
+#define CEPH_INO_ROOT  1
+#define CEPH_INO_CEPH  2        /* hidden .ceph dir */
+
+/* arbitrary limit on max # of monitors (cluster of 3 is typical) */
+#define CEPH_MAX_MON   31
+
+
+/*
+ * feature bits
+ */
+#define CEPH_FEATURE_SUPPORTED  0
+#define CEPH_FEATURE_REQUIRED   0
+
+
+/*
+ * ceph_file_layout - describe data layout for a file/inode
+ */
+struct ceph_file_layout {
+        /* file -> object mapping */
+        __le32 fl_stripe_unit;     /* stripe unit, in bytes.  must be multiple
+                                      of page size. */
+        __le32 fl_stripe_count;    /* over this many objects */
+        __le32 fl_object_size;     /* until objects are this big, then move to
+                                      new objects */
+        __le32 fl_cas_hash;        /* 0 = none; 1 = sha256 */
+
+        /* pg -> disk layout */
+        __le32 fl_object_stripe_unit;  /* for per-object parity, if any */
+
+        /* object -> pg layout */
+        __le32 fl_pg_preferred; /* preferred primary for pg (-1 for none) */
+        __le32 fl_pg_pool;      /* namespace, crush ruleset, rep level */
+} __attribute__ ((packed));
+
+#define CEPH_MIN_STRIPE_UNIT 65536
+
+int ceph_file_layout_is_valid(const struct ceph_file_layout *layout);
+
+
+/* crypto algorithms */
+#define CEPH_CRYPTO_NONE 0x0
+#define CEPH_CRYPTO_AES  0x1
+
+/* security/authentication protocols */
+#define CEPH_AUTH_UNKNOWN       0x0
+#define CEPH_AUTH_NONE          0x1
+#define CEPH_AUTH_CEPHX         0x2
+
+
+/*********************************************
+ * message layer
+ */
+
+/*
+ * message types
+ */
+
+/* misc */
+#define CEPH_MSG_SHUTDOWN               1
+#define CEPH_MSG_PING                   2
+
+/* client <-> monitor */
+#define CEPH_MSG_MON_MAP                4
+#define CEPH_MSG_MON_GET_MAP            5
+#define CEPH_MSG_STATFS                 13
+#define CEPH_MSG_STATFS_REPLY           14
+#define CEPH_MSG_MON_SUBSCRIBE          15
+#define CEPH_MSG_MON_SUBSCRIBE_ACK      16
+#define CEPH_MSG_AUTH                   17
+#define CEPH_MSG_AUTH_REPLY             18
+
+/* client <-> mds */
+#define CEPH_MSG_MDS_MAP                21
+
+#define CEPH_MSG_CLIENT_SESSION         22
+#define CEPH_MSG_CLIENT_RECONNECT       23
+
+#define CEPH_MSG_CLIENT_REQUEST         24
+#define CEPH_MSG_CLIENT_REQUEST_FORWARD 25
+#define CEPH_MSG_CLIENT_REPLY           26
+#define CEPH_MSG_CLIENT_CAPS            0x310
+#define CEPH_MSG_CLIENT_LEASE           0x311
+#define CEPH_MSG_CLIENT_SNAP            0x312
+#define CEPH_MSG_CLIENT_CAPRELEASE      0x313
+
+/* osd */
+#define CEPH_MSG_OSD_MAP          41
+#define CEPH_MSG_OSD_OP           42
+#define CEPH_MSG_OSD_OPREPLY      43
+
+struct ceph_mon_request_header {
+        __le64 have_version;
+        __le16 session_mon;
+        __le64 session_mon_tid;
+} __attribute__ ((packed));
+
+struct ceph_mon_statfs {
+        struct ceph_mon_request_header monhdr;
+        struct ceph_fsid fsid;
+} __attribute__ ((packed));
+
+struct ceph_statfs {
+        __le64 kb, kb_used, kb_avail;
+        __le64 num_objects;
+} __attribute__ ((packed));
+
+struct ceph_mon_statfs_reply {
+        struct ceph_fsid fsid;
+        __le64 version;
+        struct ceph_statfs st;
+} __attribute__ ((packed));
+
+struct ceph_osd_getmap {
+        struct ceph_mon_request_header monhdr;
+        struct ceph_fsid fsid;
+        __le32 start;
+} __attribute__ ((packed));
+
+struct ceph_mds_getmap {
+        struct ceph_mon_request_header monhdr;
+        struct ceph_fsid fsid;
+} __attribute__ ((packed));
+
+struct ceph_client_mount {
+        struct ceph_mon_request_header monhdr;
+} __attribute__ ((packed));
+
+struct ceph_mon_subscribe_item {
+        __le64 have_version;    __le64 have;
+        __u8 onetime;
+} __attribute__ ((packed));
+
+struct ceph_mon_subscribe_ack {
+        __le32 duration;         /* seconds */
+        struct ceph_fsid fsid;
+} __attribute__ ((packed));
+
+/*
+ * mds states
+ *   > 0 -> in
+ *  <= 0 -> out
+ */
+#define CEPH_MDS_STATE_DNE          0  /* down, does not exist. */
+#define CEPH_MDS_STATE_STOPPED     -1  /* down, once existed, but no subtrees.
+                                          empty log. */
+#define CEPH_MDS_STATE_BOOT        -4  /* up, boot announcement. */
+#define CEPH_MDS_STATE_STANDBY     -5  /* up, idle.  waiting for assignment. */
+#define CEPH_MDS_STATE_CREATING    -6  /* up, creating MDS instance. */
+#define CEPH_MDS_STATE_STARTING    -7  /* up, starting previously stopped mds */
+#define CEPH_MDS_STATE_STANDBY_REPLAY -8 /* up, tailing active node's journal */
+
+#define CEPH_MDS_STATE_REPLAY       8  /* up, replaying journal. */
+#define CEPH_MDS_STATE_RESOLVE      9  /* up, disambiguating distributed
+                                          operations (import, rename, etc.) */
+#define CEPH_MDS_STATE_RECONNECT    10 /* up, reconnect to clients */
+#define CEPH_MDS_STATE_REJOIN       11 /* up, rejoining distributed cache */
+#define CEPH_MDS_STATE_CLIENTREPLAY 12 /* up, replaying client operations */
+#define CEPH_MDS_STATE_ACTIVE       13 /* up, active */
+#define CEPH_MDS_STATE_STOPPING     14 /* up, but exporting metadata */
+
+extern const char *ceph_mds_state_name(int s);
+
+
+/*
+ * metadata lock types.
+ *  - these are bitmasks.. we can compose them
+ *  - they also define the lock ordering by the MDS
+ *  - a few of these are internal to the mds
+ */
+#define CEPH_LOCK_DN          1
+#define CEPH_LOCK_ISNAP       2
+#define CEPH_LOCK_IVERSION    4     /* mds internal */
+#define CEPH_LOCK_IFILE       8     /* mds internal */
+#define CEPH_LOCK_IAUTH       32
+#define CEPH_LOCK_ILINK       64
+#define CEPH_LOCK_IDFT        128   /* dir frag tree */
+#define CEPH_LOCK_INEST       256   /* mds internal */
+#define CEPH_LOCK_IXATTR      512
+#define CEPH_LOCK_INO         2048  /* immutable inode bits; not a lock */
+
+/* client_session ops */
+enum {
+        CEPH_SESSION_REQUEST_OPEN,
+        CEPH_SESSION_OPEN,
+        CEPH_SESSION_REQUEST_CLOSE,
+        CEPH_SESSION_CLOSE,
+        CEPH_SESSION_REQUEST_RENEWCAPS,
+        CEPH_SESSION_RENEWCAPS,
+        CEPH_SESSION_STALE,
+        CEPH_SESSION_RECALL_STATE,
+};
+
+extern const char *ceph_session_op_name(int op);
+
+struct ceph_mds_session_head {
+        __le32 op;
+        __le64 seq;
+        struct ceph_timespec stamp;
+        __le32 max_caps, max_leases;
+} __attribute__ ((packed));
+
+/* client_request */
+/*
+ * metadata ops.
+ *  & 0x001000 -> write op
+ *  & 0x010000 -> follow symlink (e.g. stat(), not lstat()).
+ &  & 0x100000 -> use weird ino/path trace
+ */
+#define CEPH_MDS_OP_WRITE        0x001000
+enum {
+        CEPH_MDS_OP_LOOKUP     = 0x00100,
+        CEPH_MDS_OP_GETATTR    = 0x00101,
+        CEPH_MDS_OP_LOOKUPHASH = 0x00102,
+        CEPH_MDS_OP_LOOKUPPARENT = 0x00103,
+
+        CEPH_MDS_OP_SETXATTR   = 0x01105,
+        CEPH_MDS_OP_RMXATTR    = 0x01106,
+        CEPH_MDS_OP_SETLAYOUT  = 0x01107,
+        CEPH_MDS_OP_SETATTR    = 0x01108,
+
+        CEPH_MDS_OP_MKNOD      = 0x01201,
+        CEPH_MDS_OP_LINK       = 0x01202,
+        CEPH_MDS_OP_UNLINK     = 0x01203,
+        CEPH_MDS_OP_RENAME     = 0x01204,
+        CEPH_MDS_OP_MKDIR      = 0x01220,
+        CEPH_MDS_OP_RMDIR      = 0x01221,
+        CEPH_MDS_OP_SYMLINK    = 0x01222,
+
+        CEPH_MDS_OP_CREATE     = 0x01301,
+        CEPH_MDS_OP_OPEN       = 0x00302,
+        CEPH_MDS_OP_READDIR    = 0x00305,
+
+        CEPH_MDS_OP_LOOKUPSNAP = 0x00400,
+        CEPH_MDS_OP_MKSNAP     = 0x01400,
+        CEPH_MDS_OP_RMSNAP     = 0x01401,
+        CEPH_MDS_OP_LSSNAP     = 0x00402,
+};
+
+extern const char *ceph_mds_op_name(int op);
+
+
+#define CEPH_SETATTR_MODE   1
+#define CEPH_SETATTR_UID    2
+#define CEPH_SETATTR_GID    4
+#define CEPH_SETATTR_MTIME  8
+#define CEPH_SETATTR_ATIME 16
+#define CEPH_SETATTR_SIZE  32
+#define CEPH_SETATTR_CTIME 64
+
+union ceph_mds_request_args {
+        struct {
+                __le32 mask;                 /* CEPH_CAP_* */
+        } __attribute__ ((packed)) getattr;
+        struct {
+                __le32 mode;
+                __le32 uid;
+                __le32 gid;
+                struct ceph_timespec mtime;
+                struct ceph_timespec atime;
+                __le64 size, old_size;       /* old_size needed by truncate */
+                __le32 mask;                 /* CEPH_SETATTR_* */
+        } __attribute__ ((packed)) setattr;
+        struct {
+                __le32 frag;                 /* which dir fragment */
+                __le32 max_entries;          /* how many dentries to grab */
+        } __attribute__ ((packed)) readdir;
+        struct {
+                __le32 mode;
+                __le32 rdev;
+        } __attribute__ ((packed)) mknod;
+        struct {
+                __le32 mode;
+        } __attribute__ ((packed)) mkdir;
+        struct {
+                __le32 flags;
+                __le32 mode;
+                __le32 stripe_unit;          /* layout for newly created file */
+                __le32 stripe_count;         /* ... */
+                __le32 object_size;
+                __le32 file_replication;
+                __le32 preferred;
+        } __attribute__ ((packed)) open;
+        struct {
+                __le32 flags;
+        } __attribute__ ((packed)) setxattr;
+        struct {
+                struct ceph_file_layout layout;
+        } __attribute__ ((packed)) setlayout;
+} __attribute__ ((packed));
+
+#define CEPH_MDS_FLAG_REPLAY        1  /* this is a replayed op */
+#define CEPH_MDS_FLAG_WANT_DENTRY   2  /* want dentry in reply */
+
+struct ceph_mds_request_head {
+        __le64 oldest_client_tid;
+        __le32 mdsmap_epoch;           /* on client */
+        __le32 flags;                  /* CEPH_MDS_FLAG_* */
+        __u8 num_retry, num_fwd;       /* count retry, fwd attempts */
+        __le16 num_releases;           /* # include cap/lease release records */
+        __le32 op;                     /* mds op code */
+        __le32 caller_uid, caller_gid;
+        __le64 ino;                    /* use this ino for openc, mkdir, mknod,
+                                          etc. (if replaying) */
+        union ceph_mds_request_args args;
+} __attribute__ ((packed));
+
+/* cap/lease release record */
+struct ceph_mds_request_release {
+        __le64 ino, cap_id;            /* ino and unique cap id */
+        __le32 caps, wanted;           /* new issued, wanted */
+        __le32 seq, issue_seq, mseq;
+        __le32 dname_seq;              /* if releasing a dentry lease, a */
+        __le32 dname_len;              /* string follows. */
+} __attribute__ ((packed));
+
+/* client reply */
+struct ceph_mds_reply_head {
+        __le32 op;
+        __le32 result;
+        __le32 mdsmap_epoch;
+        __u8 safe;                     /* true if committed to disk */
+        __u8 is_dentry, is_target;     /* true if dentry, target inode records
+                                          are included with reply */
+} __attribute__ ((packed));
+
+/* one for each node split */
+struct ceph_frag_tree_split {
+        __le32 frag;                   /* this frag splits... */
+        __le32 by;                     /* ...by this many bits */
+} __attribute__ ((packed));
+
+struct ceph_frag_tree_head {
+        __le32 nsplits;                /* num ceph_frag_tree_split records */
+        struct ceph_frag_tree_split splits[];
+} __attribute__ ((packed));
+
+/* capability issue, for bundling with mds reply */
+struct ceph_mds_reply_cap {
+        __le32 caps, wanted;           /* caps issued, wanted */
+        __le64 cap_id;
+        __le32 seq, mseq;
+        __le64 realm;                  /* snap realm */
+        __u8 flags;                    /* CEPH_CAP_FLAG_* */
+} __attribute__ ((packed));
+
+#define CEPH_CAP_FLAG_AUTH  1          /* cap is issued by auth mds */
+
+/* inode record, for bundling with mds reply */
+struct ceph_mds_reply_inode {
+        __le64 ino;
+        __le64 snapid;
+        __le32 rdev;
+        __le64 version;                /* inode version */
+        __le64 xattr_version;          /* version for xattr blob */
+        struct ceph_mds_reply_cap cap; /* caps issued for this inode */
+        struct ceph_file_layout layout;
+        struct ceph_timespec ctime, mtime, atime;
+        __le32 time_warp_seq;
+        __le64 size, max_size, truncate_size;
+        __le32 truncate_seq;
+        __le32 mode, uid, gid;
+        __le32 nlink;
+        __le64 files, subdirs, rbytes, rfiles, rsubdirs;  /* dir stats */
+        struct ceph_timespec rctime;
+        struct ceph_frag_tree_head fragtree;  /* (must be at end of struct) */
+} __attribute__ ((packed));
+/* followed by frag array, then symlink string, then xattr blob */
+
+/* reply_lease follows dname, and reply_inode */
+struct ceph_mds_reply_lease {
+        __le16 mask;            /* lease type(s) */
+        __le32 duration_ms;     /* lease duration */
+        __le32 seq;
+} __attribute__ ((packed));
+
+struct ceph_mds_reply_dirfrag {
+        __le32 frag;            /* fragment */
+        __le32 auth;            /* auth mds, if this is a delegation point */
+        __le32 ndist;           /* number of mds' this is replicated on */
+        __le32 dist[];
+} __attribute__ ((packed));
+
+/* file access modes */
+#define CEPH_FILE_MODE_PIN        0
+#define CEPH_FILE_MODE_RD         1
+#define CEPH_FILE_MODE_WR         2
+#define CEPH_FILE_MODE_RDWR       3  /* RD | WR */
+#define CEPH_FILE_MODE_LAZY       4  /* lazy io */
+#define CEPH_FILE_MODE_NUM        8  /* bc these are bit fields.. mostly */
+
+int ceph_flags_to_mode(int flags);
+
+
+/* capability bits */
+#define CEPH_CAP_PIN         1  /* no specific capabilities beyond the pin */
+
+/* generic cap bits */
+#define CEPH_CAP_GSHARED     1  /* client can reads */
+#define CEPH_CAP_GEXCL       2  /* client can read and update */
+#define CEPH_CAP_GCACHE      4  /* (file) client can cache reads */
+#define CEPH_CAP_GRD         8  /* (file) client can read */
+#define CEPH_CAP_GWR        16  /* (file) client can write */
+#define CEPH_CAP_GBUFFER    32  /* (file) client can buffer writes */
+#define CEPH_CAP_GWREXTEND  64  /* (file) client can extend EOF */
+#define CEPH_CAP_GLAZYIO   128  /* (file) client can perform lazy io */
+
+/* per-lock shift */
+#define CEPH_CAP_SAUTH      2
+#define CEPH_CAP_SLINK      4
+#define CEPH_CAP_SXATTR     6
+#define CEPH_CAP_SFILE      8   /* goes at the end (uses >2 cap bits) */
+
+#define CEPH_CAP_BITS       16
+
+/* composed values */
+#define CEPH_CAP_AUTH_SHARED  (CEPH_CAP_GSHARED  << CEPH_CAP_SAUTH)
+#define CEPH_CAP_AUTH_EXCL     (CEPH_CAP_GEXCL     << CEPH_CAP_SAUTH)
+#define CEPH_CAP_LINK_SHARED  (CEPH_CAP_GSHARED  << CEPH_CAP_SLINK)
+#define CEPH_CAP_LINK_EXCL     (CEPH_CAP_GEXCL     << CEPH_CAP_SLINK)
+#define CEPH_CAP_XATTR_SHARED (CEPH_CAP_GSHARED  << CEPH_CAP_SXATTR)
+#define CEPH_CAP_XATTR_EXCL    (CEPH_CAP_GEXCL     << CEPH_CAP_SXATTR)
+#define CEPH_CAP_FILE(x)    (x << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_SHARED   (CEPH_CAP_GSHARED   << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_EXCL     (CEPH_CAP_GEXCL     << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_CACHE    (CEPH_CAP_GCACHE    << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_RD       (CEPH_CAP_GRD       << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_WR       (CEPH_CAP_GWR       << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_BUFFER   (CEPH_CAP_GBUFFER   << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_WREXTEND (CEPH_CAP_GWREXTEND << CEPH_CAP_SFILE)
+#define CEPH_CAP_FILE_LAZYIO   (CEPH_CAP_GLAZYIO   << CEPH_CAP_SFILE)
+
+/* cap masks (for getattr) */
+#define CEPH_STAT_CAP_INODE    CEPH_CAP_PIN
+#define CEPH_STAT_CAP_TYPE     CEPH_CAP_PIN  /* mode >> 12 */
+#define CEPH_STAT_CAP_SYMLINK  CEPH_CAP_PIN
+#define CEPH_STAT_CAP_UID      CEPH_CAP_AUTH_SHARED
+#define CEPH_STAT_CAP_GID      CEPH_CAP_AUTH_SHARED
+#define CEPH_STAT_CAP_MODE     CEPH_CAP_AUTH_SHARED
+#define CEPH_STAT_CAP_NLINK    CEPH_CAP_LINK_SHARED
+#define CEPH_STAT_CAP_LAYOUT   CEPH_CAP_FILE_SHARED
+#define CEPH_STAT_CAP_MTIME    CEPH_CAP_FILE_SHARED
+#define CEPH_STAT_CAP_SIZE     CEPH_CAP_FILE_SHARED
+#define CEPH_STAT_CAP_ATIME    CEPH_CAP_FILE_SHARED  /* fixme */
+#define CEPH_STAT_CAP_XATTR    CEPH_CAP_XATTR_SHARED
+#define CEPH_STAT_CAP_INODE_ALL (CEPH_CAP_PIN |                 \
+                                 CEPH_CAP_AUTH_SHARED | \
+                                 CEPH_CAP_LINK_SHARED | \
+                                 CEPH_CAP_FILE_SHARED | \
+                                 CEPH_CAP_XATTR_SHARED)
+
+#define CEPH_CAP_ANY_SHARED (CEPH_CAP_AUTH_SHARED |                     \
+                              CEPH_CAP_LINK_SHARED |                    \
+                              CEPH_CAP_XATTR_SHARED |                   \
+                              CEPH_CAP_FILE_SHARED)
+#define CEPH_CAP_ANY_RD   (CEPH_CAP_ANY_SHARED | CEPH_CAP_FILE_RD |     \
+                           CEPH_CAP_FILE_CACHE)
+
+#define CEPH_CAP_ANY_EXCL (CEPH_CAP_AUTH_EXCL |         \
+                           CEPH_CAP_LINK_EXCL |         \
+                           CEPH_CAP_XATTR_EXCL |        \
+                           CEPH_CAP_FILE_EXCL)
+#define CEPH_CAP_ANY_FILE_WR (CEPH_CAP_FILE_WR | CEPH_CAP_FILE_BUFFER | \
+                              CEPH_CAP_FILE_EXCL)
+#define CEPH_CAP_ANY_WR   (CEPH_CAP_ANY_EXCL | CEPH_CAP_ANY_FILE_WR)
+#define CEPH_CAP_ANY      (CEPH_CAP_ANY_RD | CEPH_CAP_ANY_EXCL | \
+                           CEPH_CAP_ANY_FILE_WR | CEPH_CAP_PIN)
+
+#define CEPH_CAP_LOCKS (CEPH_LOCK_IFILE | CEPH_LOCK_IAUTH | CEPH_LOCK_ILINK | \
+                        CEPH_LOCK_IXATTR)
+
+int ceph_caps_for_mode(int mode);
+
+enum {
+        CEPH_CAP_OP_GRANT,         /* mds->client grant */
+        CEPH_CAP_OP_REVOKE,        /* mds->client revoke */
+        CEPH_CAP_OP_TRUNC,         /* mds->client trunc notify */
+        CEPH_CAP_OP_EXPORT,        /* mds has exported the cap */
+        CEPH_CAP_OP_IMPORT,        /* mds has imported the cap */
+        CEPH_CAP_OP_UPDATE,        /* client->mds update */
+        CEPH_CAP_OP_DROP,          /* client->mds drop cap bits */
+        CEPH_CAP_OP_FLUSH,         /* client->mds cap writeback */
+        CEPH_CAP_OP_FLUSH_ACK,     /* mds->client flushed */
+        CEPH_CAP_OP_FLUSHSNAP,     /* client->mds flush snapped metadata */
+        CEPH_CAP_OP_FLUSHSNAP_ACK, /* mds->client flushed snapped metadata */
+        CEPH_CAP_OP_RELEASE,       /* client->mds release (clean) cap */
+        CEPH_CAP_OP_RENEW,         /* client->mds renewal request */
+};
+
+extern const char *ceph_cap_op_name(int op);
+
+/*
+ * caps message, used for capability callbacks, acks, requests, etc.
+ */
+struct ceph_mds_caps {
+        __le32 op;                  /* CEPH_CAP_OP_* */
+        __le64 ino, realm;
+        __le64 cap_id;
+        __le32 seq, issue_seq;
+        __le32 caps, wanted, dirty; /* latest issued/wanted/dirty */
+        __le32 migrate_seq;
+        __le64 snap_follows;
+        __le32 snap_trace_len;
+
+        /* authlock */
+        __le32 uid, gid, mode;
+
+        /* linklock */
+        __le32 nlink;
+
+        /* xattrlock */
+        __le32 xattr_len;
+        __le64 xattr_version;
+
+        /* filelock */
+        __le64 size, max_size, truncate_size;
+        __le32 truncate_seq;
+        struct ceph_timespec mtime, atime, ctime;
+        struct ceph_file_layout layout;
+        __le32 time_warp_seq;
+} __attribute__ ((packed));
+
+/* cap release msg head */
+struct ceph_mds_cap_release {
+        __le32 num;                /* number of cap_items that follow */
+} __attribute__ ((packed));
+
+struct ceph_mds_cap_item {
+        __le64 ino;
+        __le64 cap_id;
+        __le32 migrate_seq, seq;
+} __attribute__ ((packed));
+
+#define CEPH_MDS_LEASE_REVOKE           1  /*    mds  -> client */
+#define CEPH_MDS_LEASE_RELEASE          2  /* client  -> mds    */
+#define CEPH_MDS_LEASE_RENEW            3  /* client <-> mds    */
+#define CEPH_MDS_LEASE_REVOKE_ACK       4  /* client  -> mds    */
+
+extern const char *ceph_lease_op_name(int o);
+
+/* lease msg header */
+struct ceph_mds_lease {
+        __u8 action;            /* CEPH_MDS_LEASE_* */
+        __le16 mask;            /* which lease */
+        __le64 ino;
+        __le64 first, last;     /* snap range */
+        __le32 seq;
+        __le32 duration_ms;     /* duration of renewal */
+} __attribute__ ((packed));
+/* followed by a __le32+string for dname */
+
+/* client reconnect */
+struct ceph_mds_cap_reconnect {
+        __le64 cap_id;
+        __le32 wanted;
+        __le32 issued;
+        __le64 size;
+        struct ceph_timespec mtime, atime;
+        __le64 snaprealm;
+        __le64 pathbase;        /* base ino for our path to this ino */
+} __attribute__ ((packed));
+/* followed by encoded string */
+
+struct ceph_mds_snaprealm_reconnect {
+        __le64 ino;     /* snap realm base */
+        __le64 seq;     /* snap seq for this snap realm */
+        __le64 parent;  /* parent realm */
+} __attribute__ ((packed));
+
+/*
+ * snaps
+ */
+enum {
+        CEPH_SNAP_OP_UPDATE,  /* CREATE or DESTROY */
+        CEPH_SNAP_OP_CREATE,
+        CEPH_SNAP_OP_DESTROY,
+        CEPH_SNAP_OP_SPLIT,
+};
+
+extern const char *ceph_snap_op_name(int o);
+
+/* snap msg header */
+struct ceph_mds_snap_head {
+        __le32 op;                /* CEPH_SNAP_OP_* */
+        __le64 split;             /* ino to split off, if any */
+        __le32 num_split_inos;    /* # inos belonging to new child realm */
+        __le32 num_split_realms;  /* # child realms udner new child realm */
+        __le32 trace_len;         /* size of snap trace blob */
+} __attribute__ ((packed));
+/* followed by split ino list, then split realms, then the trace blob */
+
+/*
+ * encode info about a snaprealm, as viewed by a client
+ */
+struct ceph_mds_snap_realm {
+        __le64 ino;           /* ino */
+        __le64 created;       /* snap: when created */
+        __le64 parent;        /* ino: parent realm */
+        __le64 parent_since;  /* snap: same parent since */
+        __le64 seq;           /* snap: version */
+        __le32 num_snaps;
+        __le32 num_prior_parent_snaps;
+} __attribute__ ((packed));
+/* followed by my snap list, then prior parent snap list */
+
+#endif
diff --git a/fs/ceph/ceph_hash.c b/fs/ceph/ceph_hash.c
new file mode 100644
index 000000000000..bd570015d147
--- /dev/null
+++ b/fs/ceph/ceph_hash.c
@@ -0,0 +1,118 @@
+
+#include "types.h"
+
+/*
+ * Robert Jenkin's hash function.
+ * http://burtleburtle.net/bob/hash/evahash.html
+ * This is in the public domain.
+ */
+#define mix(a, b, c)                                            \
+        do {                                                    \
+                a = a - b;  a = a - c;  a = a ^ (c >> 13);      \
+                b = b - c;  b = b - a;  b = b ^ (a << 8);       \
+                c = c - a;  c = c - b;  c = c ^ (b >> 13);      \
+                a = a - b;  a = a - c;  a = a ^ (c >> 12);      \
+                b = b - c;  b = b - a;  b = b ^ (a << 16);      \
+                c = c - a;  c = c - b;  c = c ^ (b >> 5);       \
+                a = a - b;  a = a - c;  a = a ^ (c >> 3);       \
+                b = b - c;  b = b - a;  b = b ^ (a << 10);      \
+                c = c - a;  c = c - b;  c = c ^ (b >> 15);      \
+        } while (0)
+
+unsigned ceph_str_hash_rjenkins(const char *str, unsigned length)
+{
+        const unsigned char *k = (const unsigned char *)str;
+        __u32 a, b, c;  /* the internal state */
+        __u32 len;      /* how many key bytes still need mixing */
+
+        /* Set up the internal state */
+        len = length;
+        a = 0x9e3779b9;      /* the golden ratio; an arbitrary value */
+        b = a;
+        c = 0;               /* variable initialization of internal state */
+
+        /* handle most of the key */
+        while (len >= 12) {
+                a = a + (k[0] + ((__u32)k[1] << 8) + ((__u32)k[2] << 16) +
+                         ((__u32)k[3] << 24));
+                b = b + (k[4] + ((__u32)k[5] << 8) + ((__u32)k[6] << 16) +
+                         ((__u32)k[7] << 24));
+                c = c + (k[8] + ((__u32)k[9] << 8) + ((__u32)k[10] << 16) +
+                         ((__u32)k[11] << 24));
+                mix(a, b, c);
+                k = k + 12;
+                len = len - 12;
+        }
+
+        /* handle the last 11 bytes */
+        c = c + length;
+        switch (len) {            /* all the case statements fall through */
+        case 11:
+                c = c + ((__u32)k[10] << 24);
+        case 10:
+                c = c + ((__u32)k[9] << 16);
+        case 9:
+                c = c + ((__u32)k[8] << 8);
+                /* the first byte of c is reserved for the length */
+        case 8:
+                b = b + ((__u32)k[7] << 24);
+        case 7:
+                b = b + ((__u32)k[6] << 16);
+        case 6:
+                b = b + ((__u32)k[5] << 8);
+        case 5:
+                b = b + k[4];
+        case 4:
+                a = a + ((__u32)k[3] << 24);
+        case 3:
+                a = a + ((__u32)k[2] << 16);
+        case 2:
+                a = a + ((__u32)k[1] << 8);
+        case 1:
+                a = a + k[0];
+                /* case 0: nothing left to add */
+        }
+        mix(a, b, c);
+
+        return c;
+}
+
+/*
+ * linux dcache hash
+ */
+unsigned ceph_str_hash_linux(const char *str, unsigned length)
+{
+        unsigned long hash = 0;
+        unsigned char c;
+
+        while (length--) {
+                c = *str++;
+                hash = (hash + (c << 4) + (c >> 4)) * 11;
+        }
+        return hash;
+}
+
+
+unsigned ceph_str_hash(int type, const char *s, unsigned len)
+{
+        switch (type) {
+        case CEPH_STR_HASH_LINUX:
+                return ceph_str_hash_linux(s, len);
+        case CEPH_STR_HASH_RJENKINS:
+                return ceph_str_hash_rjenkins(s, len);
+        default:
+                return -1;
+        }
+}
+
+const char *ceph_str_hash_name(int type)
+{
+        switch (type) {
+        case CEPH_STR_HASH_LINUX:
+                return "linux";
+        case CEPH_STR_HASH_RJENKINS:
+                return "rjenkins";
+        default:
+                return "unknown";
+        }
+}
diff --git a/fs/ceph/ceph_hash.h b/fs/ceph/ceph_hash.h
new file mode 100644
index 000000000000..5ac470c433c9
--- /dev/null
+++ b/fs/ceph/ceph_hash.h
@@ -0,0 +1,13 @@
+#ifndef _FS_CEPH_HASH_H
+#define _FS_CEPH_HASH_H
+
+#define CEPH_STR_HASH_LINUX      0x1  /* linux dcache hash */
+#define CEPH_STR_HASH_RJENKINS   0x2  /* robert jenkins' */
+
+extern unsigned ceph_str_hash_linux(const char *s, unsigned len);
+extern unsigned ceph_str_hash_rjenkins(const char *s, unsigned len);
+
+extern unsigned ceph_str_hash(int type, const char *s, unsigned len);
+extern const char *ceph_str_hash_name(int type);
+
+#endif
diff --git a/fs/ceph/ceph_strings.c b/fs/ceph/ceph_strings.c
new file mode 100644
index 000000000000..8e4be6a80c62
--- /dev/null
+++ b/fs/ceph/ceph_strings.c
@@ -0,0 +1,176 @@
+/*
+ * Ceph string constants
+ */
+#include "types.h"
+
+const char *ceph_entity_type_name(int type)
+{
+        switch (type) {
+        case CEPH_ENTITY_TYPE_MDS: return "mds";
+        case CEPH_ENTITY_TYPE_OSD: return "osd";
+        case CEPH_ENTITY_TYPE_MON: return "mon";
+        case CEPH_ENTITY_TYPE_CLIENT: return "client";
+        case CEPH_ENTITY_TYPE_ADMIN: return "admin";
+        case CEPH_ENTITY_TYPE_AUTH: return "auth";
+        default: return "unknown";
+        }
+}
+
+const char *ceph_osd_op_name(int op)
+{
+        switch (op) {
+        case CEPH_OSD_OP_READ: return "read";
+        case CEPH_OSD_OP_STAT: return "stat";
+
+        case CEPH_OSD_OP_MASKTRUNC: return "masktrunc";
+
+        case CEPH_OSD_OP_WRITE: return "write";
+        case CEPH_OSD_OP_DELETE: return "delete";
+        case CEPH_OSD_OP_TRUNCATE: return "truncate";
+        case CEPH_OSD_OP_ZERO: return "zero";
+        case CEPH_OSD_OP_WRITEFULL: return "writefull";
+
+        case CEPH_OSD_OP_APPEND: return "append";
+        case CEPH_OSD_OP_STARTSYNC: return "startsync";
+        case CEPH_OSD_OP_SETTRUNC: return "settrunc";
+        case CEPH_OSD_OP_TRIMTRUNC: return "trimtrunc";
+
+        case CEPH_OSD_OP_TMAPUP: return "tmapup";
+        case CEPH_OSD_OP_TMAPGET: return "tmapget";
+        case CEPH_OSD_OP_TMAPPUT: return "tmapput";
+
+        case CEPH_OSD_OP_GETXATTR: return "getxattr";
+        case CEPH_OSD_OP_GETXATTRS: return "getxattrs";
+        case CEPH_OSD_OP_SETXATTR: return "setxattr";
+        case CEPH_OSD_OP_SETXATTRS: return "setxattrs";
+        case CEPH_OSD_OP_RESETXATTRS: return "resetxattrs";
+        case CEPH_OSD_OP_RMXATTR: return "rmxattr";
+
+        case CEPH_OSD_OP_PULL: return "pull";
+        case CEPH_OSD_OP_PUSH: return "push";
+        case CEPH_OSD_OP_BALANCEREADS: return "balance-reads";
+        case CEPH_OSD_OP_UNBALANCEREADS: return "unbalance-reads";
+        case CEPH_OSD_OP_SCRUB: return "scrub";
+
+        case CEPH_OSD_OP_WRLOCK: return "wrlock";
+        case CEPH_OSD_OP_WRUNLOCK: return "wrunlock";
+        case CEPH_OSD_OP_RDLOCK: return "rdlock";
+        case CEPH_OSD_OP_RDUNLOCK: return "rdunlock";
+        case CEPH_OSD_OP_UPLOCK: return "uplock";
+        case CEPH_OSD_OP_DNLOCK: return "dnlock";
+
+        case CEPH_OSD_OP_CALL: return "call";
+
+        case CEPH_OSD_OP_PGLS: return "pgls";
+        }
+        return "???";
+}
+
+const char *ceph_mds_state_name(int s)
+{
+        switch (s) {
+                /* down and out */
+        case CEPH_MDS_STATE_DNE:        return "down:dne";
+        case CEPH_MDS_STATE_STOPPED:    return "down:stopped";
+                /* up and out */
+        case CEPH_MDS_STATE_BOOT:       return "up:boot";
+        case CEPH_MDS_STATE_STANDBY:    return "up:standby";
+        case CEPH_MDS_STATE_STANDBY_REPLAY:    return "up:standby-replay";
+        case CEPH_MDS_STATE_CREATING:   return "up:creating";
+        case CEPH_MDS_STATE_STARTING:   return "up:starting";
+                /* up and in */
+        case CEPH_MDS_STATE_REPLAY:     return "up:replay";
+        case CEPH_MDS_STATE_RESOLVE:    return "up:resolve";
+        case CEPH_MDS_STATE_RECONNECT:  return "up:reconnect";
+        case CEPH_MDS_STATE_REJOIN:     return "up:rejoin";
+        case CEPH_MDS_STATE_CLIENTREPLAY: return "up:clientreplay";
+        case CEPH_MDS_STATE_ACTIVE:     return "up:active";
+        case CEPH_MDS_STATE_STOPPING:   return "up:stopping";
+        }
+        return "???";
+}
+
+const char *ceph_session_op_name(int op)
+{
+        switch (op) {
+        case CEPH_SESSION_REQUEST_OPEN: return "request_open";
+        case CEPH_SESSION_OPEN: return "open";
+        case CEPH_SESSION_REQUEST_CLOSE: return "request_close";
+        case CEPH_SESSION_CLOSE: return "close";
+        case CEPH_SESSION_REQUEST_RENEWCAPS: return "request_renewcaps";
+        case CEPH_SESSION_RENEWCAPS: return "renewcaps";
+        case CEPH_SESSION_STALE: return "stale";
+        case CEPH_SESSION_RECALL_STATE: return "recall_state";
+        }
+        return "???";
+}
+
+const char *ceph_mds_op_name(int op)
+{
+        switch (op) {
+        case CEPH_MDS_OP_LOOKUP:  return "lookup";
+        case CEPH_MDS_OP_LOOKUPHASH:  return "lookuphash";
+        case CEPH_MDS_OP_LOOKUPPARENT:  return "lookupparent";
+        case CEPH_MDS_OP_GETATTR:  return "getattr";
+        case CEPH_MDS_OP_SETXATTR: return "setxattr";
+        case CEPH_MDS_OP_SETATTR: return "setattr";
+        case CEPH_MDS_OP_RMXATTR: return "rmxattr";
+        case CEPH_MDS_OP_READDIR: return "readdir";
+        case CEPH_MDS_OP_MKNOD: return "mknod";
+        case CEPH_MDS_OP_LINK: return "link";
+        case CEPH_MDS_OP_UNLINK: return "unlink";
+        case CEPH_MDS_OP_RENAME: return "rename";
+        case CEPH_MDS_OP_MKDIR: return "mkdir";
+        case CEPH_MDS_OP_RMDIR: return "rmdir";
+        case CEPH_MDS_OP_SYMLINK: return "symlink";
+        case CEPH_MDS_OP_CREATE: return "create";
+        case CEPH_MDS_OP_OPEN: return "open";
+        case CEPH_MDS_OP_LOOKUPSNAP: return "lookupsnap";
+        case CEPH_MDS_OP_LSSNAP: return "lssnap";
+        case CEPH_MDS_OP_MKSNAP: return "mksnap";
+        case CEPH_MDS_OP_RMSNAP: return "rmsnap";
+        }
+        return "???";
+}
+
+const char *ceph_cap_op_name(int op)
+{
+        switch (op) {
+        case CEPH_CAP_OP_GRANT: return "grant";
+        case CEPH_CAP_OP_REVOKE: return "revoke";
+        case CEPH_CAP_OP_TRUNC: return "trunc";
+        case CEPH_CAP_OP_EXPORT: return "export";
+        case CEPH_CAP_OP_IMPORT: return "import";
+        case CEPH_CAP_OP_UPDATE: return "update";
+        case CEPH_CAP_OP_DROP: return "drop";
+        case CEPH_CAP_OP_FLUSH: return "flush";
+        case CEPH_CAP_OP_FLUSH_ACK: return "flush_ack";
+        case CEPH_CAP_OP_FLUSHSNAP: return "flushsnap";
+        case CEPH_CAP_OP_FLUSHSNAP_ACK: return "flushsnap_ack";
+        case CEPH_CAP_OP_RELEASE: return "release";
+        case CEPH_CAP_OP_RENEW: return "renew";
+        }
+        return "???";
+}
+
+const char *ceph_lease_op_name(int o)
+{
+        switch (o) {
+        case CEPH_MDS_LEASE_REVOKE: return "revoke";
+        case CEPH_MDS_LEASE_RELEASE: return "release";
+        case CEPH_MDS_LEASE_RENEW: return "renew";
+        case CEPH_MDS_LEASE_REVOKE_ACK: return "revoke_ack";
+        }
+        return "???";
+}
+
+const char *ceph_snap_op_name(int o)
+{
+        switch (o) {
+        case CEPH_SNAP_OP_UPDATE: return "update";
+        case CEPH_SNAP_OP_CREATE: return "create";
+        case CEPH_SNAP_OP_DESTROY: return "destroy";
+        case CEPH_SNAP_OP_SPLIT: return "split";
+        }
+        return "???";
+}
diff --git a/fs/ceph/crush/crush.c b/fs/ceph/crush/crush.c
new file mode 100644
index 000000000000..fabd302e5779
--- /dev/null
+++ b/fs/ceph/crush/crush.c
@@ -0,0 +1,151 @@
+
+#ifdef __KERNEL__
+# include <linux/slab.h>
+#else
+# include <stdlib.h>
+# include <assert.h>
+# define kfree(x) do { if (x) free(x); } while (0)
+# define BUG_ON(x) assert(!(x))
+#endif
+
+#include "crush.h"
+
+const char *crush_bucket_alg_name(int alg)
+{
+        switch (alg) {
+        case CRUSH_BUCKET_UNIFORM: return "uniform";
+        case CRUSH_BUCKET_LIST: return "list";
+        case CRUSH_BUCKET_TREE: return "tree";
+        case CRUSH_BUCKET_STRAW: return "straw";
+        default: return "unknown";
+        }
+}
+
+/**
+ * crush_get_bucket_item_weight - Get weight of an item in given bucket
+ * @b: bucket pointer
+ * @p: item index in bucket
+ */
+int crush_get_bucket_item_weight(struct crush_bucket *b, int p)
+{
+        if (p >= b->size)
+                return 0;
+
+        switch (b->alg) {
+        case CRUSH_BUCKET_UNIFORM:
+                return ((struct crush_bucket_uniform *)b)->item_weight;
+        case CRUSH_BUCKET_LIST:
+                return ((struct crush_bucket_list *)b)->item_weights[p];
+        case CRUSH_BUCKET_TREE:
+                if (p & 1)
+                        return ((struct crush_bucket_tree *)b)->node_weights[p];
+                return 0;
+        case CRUSH_BUCKET_STRAW:
+                return ((struct crush_bucket_straw *)b)->item_weights[p];
+        }
+        return 0;
+}
+
+/**
+ * crush_calc_parents - Calculate parent vectors for the given crush map.
+ * @map: crush_map pointer
+ */
+void crush_calc_parents(struct crush_map *map)
+{
+        int i, b, c;
+
+        for (b = 0; b < map->max_buckets; b++) {
+                if (map->buckets[b] == NULL)
+                        continue;
+                for (i = 0; i < map->buckets[b]->size; i++) {
+                        c = map->buckets[b]->items[i];
+                        BUG_ON(c >= map->max_devices ||
+                               c < -map->max_buckets);
+                        if (c >= 0)
+                                map->device_parents[c] = map->buckets[b]->id;
+                        else
+                                map->bucket_parents[-1-c] = map->buckets[b]->id;
+                }
+        }
+}
+
+void crush_destroy_bucket_uniform(struct crush_bucket_uniform *b)
+{
+        kfree(b->h.perm);
+        kfree(b->h.items);
+        kfree(b);
+}
+
+void crush_destroy_bucket_list(struct crush_bucket_list *b)
+{
+        kfree(b->item_weights);
+        kfree(b->sum_weights);
+        kfree(b->h.perm);
+        kfree(b->h.items);
+        kfree(b);
+}
+
+void crush_destroy_bucket_tree(struct crush_bucket_tree *b)
+{
+        kfree(b->node_weights);
+        kfree(b);
+}
+
+void crush_destroy_bucket_straw(struct crush_bucket_straw *b)
+{
+        kfree(b->straws);
+        kfree(b->item_weights);
+        kfree(b->h.perm);
+        kfree(b->h.items);
+        kfree(b);
+}
+
+void crush_destroy_bucket(struct crush_bucket *b)
+{
+        switch (b->alg) {
+        case CRUSH_BUCKET_UNIFORM:
+                crush_destroy_bucket_uniform((struct crush_bucket_uniform *)b);
+                break;
+        case CRUSH_BUCKET_LIST:
+                crush_destroy_bucket_list((struct crush_bucket_list *)b);
+                break;
+        case CRUSH_BUCKET_TREE:
+                crush_destroy_bucket_tree((struct crush_bucket_tree *)b);
+                break;
+        case CRUSH_BUCKET_STRAW:
+                crush_destroy_bucket_straw((struct crush_bucket_straw *)b);
+                break;
+        }
+}
+
+/**
+ * crush_destroy - Destroy a crush_map
+ * @map: crush_map pointer
+ */
+void crush_destroy(struct crush_map *map)
+{
+        int b;
+
+        /* buckets */
+        if (map->buckets) {
+                for (b = 0; b < map->max_buckets; b++) {
+                        if (map->buckets[b] == NULL)
+                                continue;
+                        crush_destroy_bucket(map->buckets[b]);
+                }
+                kfree(map->buckets);
+        }
+
+        /* rules */
+        if (map->rules) {
+                for (b = 0; b < map->max_rules; b++)
+                        kfree(map->rules[b]);
+                kfree(map->rules);
+        }
+
+        kfree(map->bucket_parents);
+        kfree(map->device_parents);
+        kfree(map);
+}
+
+
diff --git a/fs/ceph/crush/crush.h b/fs/ceph/crush/crush.h
new file mode 100644
index 000000000000..dcd7e7523700
--- /dev/null
+++ b/fs/ceph/crush/crush.h
@@ -0,0 +1,180 @@
+#ifndef _CRUSH_CRUSH_H
+#define _CRUSH_CRUSH_H
+
+#include <linux/types.h>
+
+/*
+ * CRUSH is a pseudo-random data distribution algorithm that
+ * efficiently distributes input values (typically, data objects)
+ * across a heterogeneous, structured storage cluster.
+ *
+ * The algorithm was originally described in detail in this paper
+ * (although the algorithm has evolved somewhat since then):
+ *
+ *     http://www.ssrc.ucsc.edu/Papers/weil-sc06.pdf
+ *
+ * LGPL2
+ */
+
+
+#define CRUSH_MAGIC 0x00010000ul   /* for detecting algorithm revisions */
+
+
+#define CRUSH_MAX_DEPTH 10  /* max crush hierarchy depth */
+#define CRUSH_MAX_SET   10  /* max size of a mapping result */
+
+
+/*
+ * CRUSH uses user-defined "rules" to describe how inputs should be
+ * mapped to devices.  A rule consists of sequence of steps to perform
+ * to generate the set of output devices.
+ */
+struct crush_rule_step {
+        __u32 op;
+        __s32 arg1;
+        __s32 arg2;
+};
+
+/* step op codes */
+enum {
+        CRUSH_RULE_NOOP = 0,
+        CRUSH_RULE_TAKE = 1,          /* arg1 = value to start with */
+        CRUSH_RULE_CHOOSE_FIRSTN = 2, /* arg1 = num items to pick */
+                                      /* arg2 = type */
+        CRUSH_RULE_CHOOSE_INDEP = 3,  /* same */
+        CRUSH_RULE_EMIT = 4,          /* no args */
+        CRUSH_RULE_CHOOSE_LEAF_FIRSTN = 6,
+        CRUSH_RULE_CHOOSE_LEAF_INDEP = 7,
+};
+
+/*
+ * for specifying choose num (arg1) relative to the max parameter
+ * passed to do_rule
+ */
+#define CRUSH_CHOOSE_N            0
+#define CRUSH_CHOOSE_N_MINUS(x)   (-(x))
+
+/*
+ * The rule mask is used to describe what the rule is intended for.
+ * Given a ruleset and size of output set, we search through the
+ * rule list for a matching rule_mask.
+ */
+struct crush_rule_mask {
+        __u8 ruleset;
+        __u8 type;
+        __u8 min_size;
+        __u8 max_size;
+};
+
+struct crush_rule {
+        __u32 len;
+        struct crush_rule_mask mask;
+        struct crush_rule_step steps[0];
+};
+
+#define crush_rule_size(len) (sizeof(struct crush_rule) + \
+                              (len)*sizeof(struct crush_rule_step))
+
+
+
+/*
+ * A bucket is a named container of other items (either devices or
+ * other buckets).  Items within a bucket are chosen using one of a
+ * few different algorithms.  The table summarizes how the speed of
+ * each option measures up against mapping stability when items are
+ * added or removed.
+ *
+ *  Bucket Alg     Speed       Additions    Removals
+ *  ------------------------------------------------
+ *  uniform         O(1)       poor         poor
+ *  list            O(n)       optimal      poor
+ *  tree            O(log n)   good         good
+ *  straw           O(n)       optimal      optimal
+ */
+enum {
+        CRUSH_BUCKET_UNIFORM = 1,
+        CRUSH_BUCKET_LIST = 2,
+        CRUSH_BUCKET_TREE = 3,
+        CRUSH_BUCKET_STRAW = 4
+};
+extern const char *crush_bucket_alg_name(int alg);
+
+struct crush_bucket {
+        __s32 id;        /* this'll be negative */
+        __u16 type;      /* non-zero; type=0 is reserved for devices */
+        __u8 alg;        /* one of CRUSH_BUCKET_* */
+        __u8 hash;       /* which hash function to use, CRUSH_HASH_* */
+        __u32 weight;    /* 16-bit fixed point */
+        __u32 size;      /* num items */
+        __s32 *items;
+
+        /*
+         * cached random permutation: used for uniform bucket and for
+         * the linear search fallback for the other bucket types.
+         */
+        __u32 perm_x;  /* @x for which *perm is defined */
+        __u32 perm_n;  /* num elements of *perm that are permuted/defined */
+        __u32 *perm;
+};
+
+struct crush_bucket_uniform {
+        struct crush_bucket h;
+        __u32 item_weight;  /* 16-bit fixed point; all items equally weighted */
+};
+
+struct crush_bucket_list {
+        struct crush_bucket h;
+        __u32 *item_weights;  /* 16-bit fixed point */
+        __u32 *sum_weights;   /* 16-bit fixed point.  element i is sum
+                                 of weights 0..i, inclusive */
+};
+
+struct crush_bucket_tree {
+        struct crush_bucket h;  /* note: h.size is _tree_ size, not number of
+                                   actual items */
+        __u8 num_nodes;
+        __u32 *node_weights;
+};
+
+struct crush_bucket_straw {
+        struct crush_bucket h;
+        __u32 *item_weights;   /* 16-bit fixed point */
+        __u32 *straws;         /* 16-bit fixed point */
+};
+
+
+
+/*
+ * CRUSH map includes all buckets, rules, etc.
+ */
+struct crush_map {
+        struct crush_bucket **buckets;
+        struct crush_rule **rules;
+
+        /*
+         * Parent pointers to identify the parent bucket a device or
+         * bucket in the hierarchy.  If an item appears more than
+         * once, this is the _last_ time it appeared (where buckets
+         * are processed in bucket id order, from -1 on down to
+         * -max_buckets.
+         */
+        __u32 *bucket_parents;
+        __u32 *device_parents;
+
+        __s32 max_buckets;
+        __u32 max_rules;
+        __s32 max_devices;
+};
+
+
+/* crush.c */
+extern int crush_get_bucket_item_weight(struct crush_bucket *b, int pos);
+extern void crush_calc_parents(struct crush_map *map);
+extern void crush_destroy_bucket_uniform(struct crush_bucket_uniform *b);
+extern void crush_destroy_bucket_list(struct crush_bucket_list *b);
+extern void crush_destroy_bucket_tree(struct crush_bucket_tree *b);
+extern void crush_destroy_bucket_straw(struct crush_bucket_straw *b);
+extern void crush_destroy_bucket(struct crush_bucket *b);
+extern void crush_destroy(struct crush_map *map);
+
+#endif
diff --git a/fs/ceph/crush/hash.c b/fs/ceph/crush/hash.c
new file mode 100644
index 000000000000..5873aed694bf
--- /dev/null
+++ b/fs/ceph/crush/hash.c
@@ -0,0 +1,149 @@
+
+#include <linux/types.h>
+#include "hash.h"
+
+/*
+ * Robert Jenkins' function for mixing 32-bit values
+ * http://burtleburtle.net/bob/hash/evahash.html
+ * a, b = random bits, c = input and output
+ */
+#define crush_hashmix(a, b, c) do {                     \
+                a = a-b;  a = a-c;  a = a^(c>>13);      \
+                b = b-c;  b = b-a;  b = b^(a<<8);       \
+                c = c-a;  c = c-b;  c = c^(b>>13);      \
+                a = a-b;  a = a-c;  a = a^(c>>12);      \
+                b = b-c;  b = b-a;  b = b^(a<<16);      \
+                c = c-a;  c = c-b;  c = c^(b>>5);       \
+                a = a-b;  a = a-c;  a = a^(c>>3);       \
+                b = b-c;  b = b-a;  b = b^(a<<10);      \
+                c = c-a;  c = c-b;  c = c^(b>>15);      \
+        } while (0)
+
+#define crush_hash_seed 1315423911
+
+static __u32 crush_hash32_rjenkins1(__u32 a)
+{
+        __u32 hash = crush_hash_seed ^ a;
+        __u32 b = a;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(b, x, hash);
+        crush_hashmix(y, a, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_2(__u32 a, __u32 b)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(x, a, hash);
+        crush_hashmix(b, y, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_3(__u32 a, __u32 b, __u32 c)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b ^ c;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(c, x, hash);
+        crush_hashmix(y, a, hash);
+        crush_hashmix(b, x, hash);
+        crush_hashmix(y, c, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_4(__u32 a, __u32 b, __u32 c, __u32 d)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b ^ c ^ d;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(c, d, hash);
+        crush_hashmix(a, x, hash);
+        crush_hashmix(y, b, hash);
+        crush_hashmix(c, x, hash);
+        crush_hashmix(y, d, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_5(__u32 a, __u32 b, __u32 c, __u32 d,
+                                      __u32 e)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b ^ c ^ d ^ e;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(c, d, hash);
+        crush_hashmix(e, x, hash);
+        crush_hashmix(y, a, hash);
+        crush_hashmix(b, x, hash);
+        crush_hashmix(y, c, hash);
+        crush_hashmix(d, x, hash);
+        crush_hashmix(y, e, hash);
+        return hash;
+}
+
+
+__u32 crush_hash32(int type, __u32 a)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1(a);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_2(int type, __u32 a, __u32 b)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_2(a, b);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_3(int type, __u32 a, __u32 b, __u32 c)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_3(a, b, c);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_4(int type, __u32 a, __u32 b, __u32 c, __u32 d)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_4(a, b, c, d);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_5(int type, __u32 a, __u32 b, __u32 c, __u32 d, __u32 e)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_5(a, b, c, d, e);
+        default:
+                return 0;
+        }
+}
+
+const char *crush_hash_name(int type)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return "rjenkins1";
+        default:
+                return "unknown";
+        }
+}
diff --git a/fs/ceph/crush/hash.h b/fs/ceph/crush/hash.h
new file mode 100644
index 000000000000..ff48e110e4bb
--- /dev/null
+++ b/fs/ceph/crush/hash.h
@@ -0,0 +1,17 @@
+#ifndef _CRUSH_HASH_H
+#define _CRUSH_HASH_H
+
+#define CRUSH_HASH_RJENKINS1   0
+
+#define CRUSH_HASH_DEFAULT CRUSH_HASH_RJENKINS1
+
+extern const char *crush_hash_name(int type);
+
+extern __u32 crush_hash32(int type, __u32 a);
+extern __u32 crush_hash32_2(int type, __u32 a, __u32 b);
+extern __u32 crush_hash32_3(int type, __u32 a, __u32 b, __u32 c);
+extern __u32 crush_hash32_4(int type, __u32 a, __u32 b, __u32 c, __u32 d);
+extern __u32 crush_hash32_5(int type, __u32 a, __u32 b, __u32 c, __u32 d,
+                            __u32 e);
+
+#endif
diff --git a/fs/ceph/crush/mapper.c b/fs/ceph/crush/mapper.c
new file mode 100644
index 000000000000..9ba54efb6543
--- /dev/null
+++ b/fs/ceph/crush/mapper.c
@@ -0,0 +1,596 @@
+
+#ifdef __KERNEL__
+# include <linux/string.h>
+# include <linux/slab.h>
+# include <linux/bug.h>
+# include <linux/kernel.h>
+# ifndef dprintk
+#  define dprintk(args...)
+# endif
+#else
+# include <string.h>
+# include <stdio.h>
+# include <stdlib.h>
+# include <assert.h>
+# define BUG_ON(x) assert(!(x))
+# define dprintk(args...) /* printf(args) */
+# define kmalloc(x, f) malloc(x)
+# define kfree(x) free(x)
+#endif
+
+#include "crush.h"
+#include "hash.h"
+
+/*
+ * Implement the core CRUSH mapping algorithm.
+ */
+
+/**
+ * crush_find_rule - find a crush_rule id for a given ruleset, type, and size.
+ * @map: the crush_map
+ * @ruleset: the storage ruleset id (user defined)
+ * @type: storage ruleset type (user defined)
+ * @size: output set size
+ */
+int crush_find_rule(struct crush_map *map, int ruleset, int type, int size)
+{
+        int i;
+
+        for (i = 0; i < map->max_rules; i++) {
+                if (map->rules[i] &&
+                    map->rules[i]->mask.ruleset == ruleset &&
+                    map->rules[i]->mask.type == type &&
+                    map->rules[i]->mask.min_size <= size &&
+                    map->rules[i]->mask.max_size >= size)
+                        return i;
+        }
+        return -1;
+}
+
+
+/*
+ * bucket choose methods
+ *
+ * For each bucket algorithm, we have a "choose" method that, given a
+ * crush input @x and replica position (usually, position in output set) @r,
+ * will produce an item in the bucket.
+ */
+
+/*
+ * Choose based on a random permutation of the bucket.
+ *
+ * We used to use some prime number arithmetic to do this, but it
+ * wasn't very random, and had some other bad behaviors.  Instead, we
+ * calculate an actual random permutation of the bucket members.
+ * Since this is expensive, we optimize for the r=0 case, which
+ * captures the vast majority of calls.
+ */
+static int bucket_perm_choose(struct crush_bucket *bucket,
+                              int x, int r)
+{
+        unsigned pr = r % bucket->size;
+        unsigned i, s;
+
+        /* start a new permutation if @x has changed */
+        if (bucket->perm_x != x || bucket->perm_n == 0) {
+                dprintk("bucket %d new x=%d\n", bucket->id, x);
+                bucket->perm_x = x;
+
+                /* optimize common r=0 case */
+                if (pr == 0) {
+                        s = crush_hash32_3(bucket->hash, x, bucket->id, 0) %
+                                bucket->size;
+                        bucket->perm[0] = s;
+                        bucket->perm_n = 0xffff;   /* magic value, see below */
+                        goto out;
+                }
+
+                for (i = 0; i < bucket->size; i++)
+                        bucket->perm[i] = i;
+                bucket->perm_n = 0;
+        } else if (bucket->perm_n == 0xffff) {
+                /* clean up after the r=0 case above */
+                for (i = 1; i < bucket->size; i++)
+                        bucket->perm[i] = i;
+                bucket->perm[bucket->perm[0]] = 0;
+                bucket->perm_n = 1;
+        }
+
+        /* calculate permutation up to pr */
+        for (i = 0; i < bucket->perm_n; i++)
+                dprintk(" perm_choose have %d: %d\n", i, bucket->perm[i]);
+        while (bucket->perm_n <= pr) {
+                unsigned p = bucket->perm_n;
+                /* no point in swapping the final entry */
+                if (p < bucket->size - 1) {
+                        i = crush_hash32_3(bucket->hash, x, bucket->id, p) %
+                                (bucket->size - p);
+                        if (i) {
+                                unsigned t = bucket->perm[p + i];
+                                bucket->perm[p + i] = bucket->perm[p];
+                                bucket->perm[p] = t;
+                        }
+                        dprintk(" perm_choose swap %d with %d\n", p, p+i);
+                }
+                bucket->perm_n++;
+        }
+        for (i = 0; i < bucket->size; i++)
+                dprintk(" perm_choose  %d: %d\n", i, bucket->perm[i]);
+
+        s = bucket->perm[pr];
+out:
+        dprintk(" perm_choose %d sz=%d x=%d r=%d (%d) s=%d\n", bucket->id,
+                bucket->size, x, r, pr, s);
+        return bucket->items[s];
+}
+
+/* uniform */
+static int bucket_uniform_choose(struct crush_bucket_uniform *bucket,
+                                 int x, int r)
+{
+        return bucket_perm_choose(&bucket->h, x, r);
+}
+
+/* list */
+static int bucket_list_choose(struct crush_bucket_list *bucket,
+                              int x, int r)
+{
+        int i;
+
+        for (i = bucket->h.size-1; i >= 0; i--) {
+                __u64 w = crush_hash32_4(bucket->h.hash,x, bucket->h.items[i],
+                                         r, bucket->h.id);
+                w &= 0xffff;
+                dprintk("list_choose i=%d x=%d r=%d item %d weight %x "
+                        "sw %x rand %llx",
+                        i, x, r, bucket->h.items[i], bucket->item_weights[i],
+                        bucket->sum_weights[i], w);
+                w *= bucket->sum_weights[i];
+                w = w >> 16;
+                /*dprintk(" scaled %llx\n", w);*/
+                if (w < bucket->item_weights[i])
+                        return bucket->h.items[i];
+        }
+
+        BUG_ON(1);
+        return 0;
+}
+
+
+/* (binary) tree */
+static int height(int n)
+{
+        int h = 0;
+        while ((n & 1) == 0) {
+                h++;
+                n = n >> 1;
+        }
+        return h;
+}
+
+static int left(int x)
+{
+        int h = height(x);
+        return x - (1 << (h-1));
+}
+
+static int right(int x)
+{
+        int h = height(x);
+        return x + (1 << (h-1));
+}
+
+static int terminal(int x)
+{
+        return x & 1;
+}
+
+static int bucket_tree_choose(struct crush_bucket_tree *bucket,
+                              int x, int r)
+{
+        int n, l;
+        __u32 w;
+        __u64 t;
+
+        /* start at root */
+        n = bucket->num_nodes >> 1;
+
+        while (!terminal(n)) {
+                /* pick point in [0, w) */
+                w = bucket->node_weights[n];
+                t = (__u64)crush_hash32_4(bucket->h.hash, x, n, r,
+                                          bucket->h.id) * (__u64)w;
+                t = t >> 32;
+
+                /* descend to the left or right? */
+                l = left(n);
+                if (t < bucket->node_weights[l])
+                        n = l;
+                else
+                        n = right(n);
+        }
+
+        return bucket->h.items[n >> 1];
+}
+
+
+/* straw */
+
+static int bucket_straw_choose(struct crush_bucket_straw *bucket,
+                               int x, int r)
+{
+        int i;
+        int high = 0;
+        __u64 high_draw = 0;
+        __u64 draw;
+
+        for (i = 0; i < bucket->h.size; i++) {
+                draw = crush_hash32_3(bucket->h.hash, x, bucket->h.items[i], r);
+                draw &= 0xffff;
+                draw *= bucket->straws[i];
+                if (i == 0 || draw > high_draw) {
+                        high = i;
+                        high_draw = draw;
+                }
+        }
+        return bucket->h.items[high];
+}
+
+static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
+{
+        dprintk("choose %d x=%d r=%d\n", in->id, x, r);
+        switch (in->alg) {
+        case CRUSH_BUCKET_UNIFORM:
+                return bucket_uniform_choose((struct crush_bucket_uniform *)in,
+                                          x, r);
+        case CRUSH_BUCKET_LIST:
+                return bucket_list_choose((struct crush_bucket_list *)in,
+                                          x, r);
+        case CRUSH_BUCKET_TREE:
+                return bucket_tree_choose((struct crush_bucket_tree *)in,
+                                          x, r);
+        case CRUSH_BUCKET_STRAW:
+                return bucket_straw_choose((struct crush_bucket_straw *)in,
+                                           x, r);
+        default:
+                BUG_ON(1);
+                return in->items[0];
+        }
+}
+
+/*
+ * true if device is marked "out" (failed, fully offloaded)
+ * of the cluster
+ */
+static int is_out(struct crush_map *map, __u32 *weight, int item, int x)
+{
+        if (weight[item] >= 0x1000)
+                return 0;
+        if (weight[item] == 0)
+                return 1;
+        if ((crush_hash32_2(CRUSH_HASH_RJENKINS1, x, item) & 0xffff)
+            < weight[item])
+                return 0;
+        return 1;
+}
+
+/**
+ * crush_choose - choose numrep distinct items of given type
+ * @map: the crush_map
+ * @bucket: the bucket we are choose an item from
+ * @x: crush input value
+ * @numrep: the number of items to choose
+ * @type: the type of item to choose
+ * @out: pointer to output vector
+ * @outpos: our position in that vector
+ * @firstn: true if choosing "first n" items, false if choosing "indep"
+ * @recurse_to_leaf: true if we want one device under each item of given type
+ * @out2: second output vector for leaf items (if @recurse_to_leaf)
+ */
+static int crush_choose(struct crush_map *map,
+                        struct crush_bucket *bucket,
+                        __u32 *weight,
+                        int x, int numrep, int type,
+                        int *out, int outpos,
+                        int firstn, int recurse_to_leaf,
+                        int *out2)
+{
+        int rep;
+        int ftotal, flocal;
+        int retry_descent, retry_bucket, skip_rep;
+        struct crush_bucket *in = bucket;
+        int r;
+        int i;
+        int item = 0;
+        int itemtype;
+        int collide, reject;
+        const int orig_tries = 5; /* attempts before we fall back to search */
+        dprintk("choose bucket %d x %d outpos %d\n", bucket->id, x, outpos);
+
+        for (rep = outpos; rep < numrep; rep++) {
+                /* keep trying until we get a non-out, non-colliding item */
+                ftotal = 0;
+                skip_rep = 0;
+                do {
+                        retry_descent = 0;
+                        in = bucket;               /* initial bucket */
+
+                        /* choose through intervening buckets */
+                        flocal = 0;
+                        do {
+                                collide = 0;
+                                retry_bucket = 0;
+                                r = rep;
+                                if (in->alg == CRUSH_BUCKET_UNIFORM) {
+                                        /* be careful */
+                                        if (firstn || numrep >= in->size)
+                                                /* r' = r + f_total */
+                                                r += ftotal;
+                                        else if (in->size % numrep == 0)
+                                                /* r'=r+(n+1)*f_local */
+                                                r += (numrep+1) *
+                                                        (flocal+ftotal);
+                                        else
+                                                /* r' = r + n*f_local */
+                                                r += numrep * (flocal+ftotal);
+                                } else {
+                                        if (firstn)
+                                                /* r' = r + f_total */
+                                                r += ftotal;
+                                        else
+                                                /* r' = r + n*f_local */
+                                                r += numrep * (flocal+ftotal);
+                                }
+
+                                /* bucket choose */
+                                if (in->size == 0) {
+                                        reject = 1;
+                                        goto reject;
+                                }
+                                if (flocal >= (in->size>>1) &&
+                                    flocal > orig_tries)
+                                        item = bucket_perm_choose(in, x, r);
+                                else
+                                        item = crush_bucket_choose(in, x, r);
+                                BUG_ON(item >= map->max_devices);
+
+                                /* desired type? */
+                                if (item < 0)
+                                        itemtype = map->buckets[-1-item]->type;
+                                else
+                                        itemtype = 0;
+                                dprintk("  item %d type %d\n", item, itemtype);
+
+                                /* keep going? */
+                                if (itemtype != type) {
+                                        BUG_ON(item >= 0 ||
+                                               (-1-item) >= map->max_buckets);
+                                        in = map->buckets[-1-item];
+                                        continue;
+                                }
+
+                                /* collision? */
+                                for (i = 0; i < outpos; i++) {
+                                        if (out[i] == item) {
+                                                collide = 1;
+                                                break;
+                                        }
+                                }
+
+                                if (recurse_to_leaf &&
+                                    item < 0 &&
+                                    crush_choose(map, map->buckets[-1-item],
+                                                 weight,
+                                                 x, outpos+1, 0,
+                                                 out2, outpos,
+                                                 firstn, 0, NULL) <= outpos) {
+                                        reject = 1;
+                                } else {
+                                        /* out? */
+                                        if (itemtype == 0)
+                                                reject = is_out(map, weight,
+                                                                item, x);
+                                        else
+                                                reject = 0;
+                                }
+
+reject:
+                                if (reject || collide) {
+                                        ftotal++;
+                                        flocal++;
+
+                                        if (collide && flocal < 3)
+                                                /* retry locally a few times */
+                                                retry_bucket = 1;
+                                        else if (flocal < in->size + orig_tries)
+                                                /* exhaustive bucket search */
+                                                retry_bucket = 1;
+                                        else if (ftotal < 20)
+                                                /* then retry descent */
+                                                retry_descent = 1;
+                                        else
+                                                /* else give up */
+                                                skip_rep = 1;
+                                        dprintk("  reject %d  collide %d  "
+                                                "ftotal %d  flocal %d\n",
+                                                reject, collide, ftotal,
+                                                flocal);
+                                }
+                        } while (retry_bucket);
+                } while (retry_descent);
+
+                if (skip_rep) {
+                        dprintk("skip rep\n");
+                        continue;
+                }
+
+                dprintk("choose got %d\n", item);
+                out[outpos] = item;
+                outpos++;
+        }
+
+        dprintk("choose returns %d\n", outpos);
+        return outpos;
+}
+
+
+/**
+ * crush_do_rule - calculate a mapping with the given input and rule
+ * @map: the crush_map
+ * @ruleno: the rule id
+ * @x: hash input
+ * @result: pointer to result vector
+ * @result_max: maximum result size
+ * @force: force initial replica choice; -1 for none
+ */
+int crush_do_rule(struct crush_map *map,
+                  int ruleno, int x, int *result, int result_max,
+                  int force, __u32 *weight)
+{
+        int result_len;
+        int force_context[CRUSH_MAX_DEPTH];
+        int force_pos = -1;
+        int a[CRUSH_MAX_SET];
+        int b[CRUSH_MAX_SET];
+        int c[CRUSH_MAX_SET];
+        int recurse_to_leaf;
+        int *w;
+        int wsize = 0;
+        int *o;
+        int osize;
+        int *tmp;
+        struct crush_rule *rule;
+        int step;
+        int i, j;
+        int numrep;
+        int firstn;
+        int rc = -1;
+
+        BUG_ON(ruleno >= map->max_rules);
+
+        rule = map->rules[ruleno];
+        result_len = 0;
+        w = a;
+        o = b;
+
+        /*
+         * determine hierarchical context of force, if any.  note
+         * that this may or may not correspond to the specific types
+         * referenced by the crush rule.
+         */
+        if (force >= 0) {
+                if (force >= map->max_devices ||
+                    map->device_parents[force] == 0) {
+                        /*dprintk("CRUSH: forcefed device dne\n");*/
+                        rc = -1;  /* force fed device dne */
+                        goto out;
+                }
+                if (!is_out(map, weight, force, x)) {
+                        while (1) {
+                                force_context[++force_pos] = force;
+                                if (force >= 0)
+                                        force = map->device_parents[force];
+                                else
+                                        force = map->bucket_parents[-1-force];
+                                if (force == 0)
+                                        break;
+                        }
+                }
+        }
+
+        for (step = 0; step < rule->len; step++) {
+                firstn = 0;
+                switch (rule->steps[step].op) {
+                case CRUSH_RULE_TAKE:
+                        w[0] = rule->steps[step].arg1;
+                        if (force_pos >= 0) {
+                                BUG_ON(force_context[force_pos] != w[0]);
+                                force_pos--;
+                        }
+                        wsize = 1;
+                        break;
+
+                case CRUSH_RULE_CHOOSE_LEAF_FIRSTN:
+                case CRUSH_RULE_CHOOSE_FIRSTN:
+                        firstn = 1;
+                case CRUSH_RULE_CHOOSE_LEAF_INDEP:
+                case CRUSH_RULE_CHOOSE_INDEP:
+                        BUG_ON(wsize == 0);
+
+                        recurse_to_leaf =
+                                rule->steps[step].op ==
+                                 CRUSH_RULE_CHOOSE_LEAF_FIRSTN ||
+                                rule->steps[step].op ==
+                                CRUSH_RULE_CHOOSE_LEAF_INDEP;
+
+                        /* reset output */
+                        osize = 0;
+
+                        for (i = 0; i < wsize; i++) {
+                                /*
+                                 * see CRUSH_N, CRUSH_N_MINUS macros.
+                                 * basically, numrep <= 0 means relative to
+                                 * the provided result_max
+                                 */
+                                numrep = rule->steps[step].arg1;
+                                if (numrep <= 0) {
+                                        numrep += result_max;
+                                        if (numrep <= 0)
+                                                continue;
+                                }
+                                j = 0;
+                                if (osize == 0 && force_pos >= 0) {
+                                        /* skip any intermediate types */
+                                        while (force_pos &&
+                                               force_context[force_pos] < 0 &&
+                                               rule->steps[step].arg2 !=
+                                               map->buckets[-1 -
+                                               force_context[force_pos]]->type)
+                                                force_pos--;
+                                        o[osize] = force_context[force_pos];
+                                        if (recurse_to_leaf)
+                                                c[osize] = force_context[0];
+                                        j++;
+                                        force_pos--;
+                                }
+                                osize += crush_choose(map,
+                                                      map->buckets[-1-w[i]],
+                                                      weight,
+                                                      x, numrep,
+                                                      rule->steps[step].arg2,
+                                                      o+osize, j,
+                                                      firstn,
+                                                      recurse_to_leaf, c+osize);
+                        }
+
+                        if (recurse_to_leaf)
+                                /* copy final _leaf_ values to output set */
+                                memcpy(o, c, osize*sizeof(*o));
+
+                        /* swap t and w arrays */
+                        tmp = o;
+                        o = w;
+                        w = tmp;
+                        wsize = osize;
+                        break;
+
+
+                case CRUSH_RULE_EMIT:
+                        for (i = 0; i < wsize && result_len < result_max; i++) {
+                                result[result_len] = w[i];
+                                result_len++;
+                        }
+                        wsize = 0;
+                        break;
+
+                default:
+                        BUG_ON(1);
+                }
+        }
+        rc = result_len;
+
+out:
+        return rc;
+}
+
+
diff --git a/fs/ceph/crush/mapper.h b/fs/ceph/crush/mapper.h
new file mode 100644
index 000000000000..98e90046fd9f
--- /dev/null
+++ b/fs/ceph/crush/mapper.h
@@ -0,0 +1,20 @@
+#ifndef _CRUSH_MAPPER_H
+#define _CRUSH_MAPPER_H
+
+/*
+ * CRUSH functions for find rules and then mapping an input to an
+ * output set.
+ *
+ * LGPL2
+ */
+
+#include "crush.h"
+
+extern int crush_find_rule(struct crush_map *map, int pool, int type, int size);
+extern int crush_do_rule(struct crush_map *map,
+                         int ruleno,
+                         int x, int *result, int result_max,
+                         int forcefeed,    /* -1 for none */
+                         __u32 *weights);
+
+#endif
diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
new file mode 100644
index 000000000000..f704b3b62424
--- /dev/null
+++ b/fs/ceph/crypto.c
@@ -0,0 +1,409 @@
+
+#include "ceph_debug.h"
+
+#include <linux/err.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <crypto/hash.h>
+
+#include "crypto.h"
+#include "decode.h"
+
+int ceph_crypto_key_encode(struct ceph_crypto_key *key, void **p, void *end)
+{
+        if (*p + sizeof(u16) + sizeof(key->created) +
+            sizeof(u16) + key->len > end)
+                return -ERANGE;
+        ceph_encode_16(p, key->type);
+        ceph_encode_copy(p, &key->created, sizeof(key->created));
+        ceph_encode_16(p, key->len);
+        ceph_encode_copy(p, key->key, key->len);
+        return 0;
+}
+
+int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+{
+        ceph_decode_need(p, end, 2*sizeof(u16) + sizeof(key->created), bad);
+        key->type = ceph_decode_16(p);
+        ceph_decode_copy(p, &key->created, sizeof(key->created));
+        key->len = ceph_decode_16(p);
+        ceph_decode_need(p, end, key->len, bad);
+        key->key = kmalloc(key->len, GFP_NOFS);
+        if (!key->key)
+                return -ENOMEM;
+        ceph_decode_copy(p, key->key, key->len);
+        return 0;
+
+bad:
+        dout("failed to decode crypto key\n");
+        return -EINVAL;
+}
+
+int ceph_crypto_key_unarmor(struct ceph_crypto_key *key, const char *inkey)
+{
+        int inlen = strlen(inkey);
+        int blen = inlen * 3 / 4;
+        void *buf, *p;
+        int ret;
+
+        dout("crypto_key_unarmor %s\n", inkey);
+        buf = kmalloc(blen, GFP_NOFS);
+        if (!buf)
+                return -ENOMEM;
+        blen = ceph_unarmor(buf, inkey, inkey+inlen);
+        if (blen < 0) {
+                kfree(buf);
+                return blen;
+        }
+
+        p = buf;
+        ret = ceph_crypto_key_decode(key, &p, p + blen);
+        kfree(buf);
+        if (ret)
+                return ret;
+        dout("crypto_key_unarmor key %p type %d len %d\n", key,
+             key->type, key->len);
+        return 0;
+}
+
+
+
+#define AES_KEY_SIZE 16
+
+static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
+{
+        return crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+}
+
+const u8 *aes_iv = "cephsageyudagreg";
+
+int ceph_aes_encrypt(const void *key, int key_len, void *dst, size_t *dst_len,
+                     const void *src, size_t src_len)
+{
+        struct scatterlist sg_in[2], sg_out[1];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+        int ret;
+        void *iv;
+        int ivsize;
+        size_t zero_padding = (0x10 - (src_len & 0x0f));
+        char pad[16];
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        memset(pad, zero_padding, zero_padding);
+
+        *dst_len = src_len + zero_padding;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        sg_init_table(sg_in, 2);
+        sg_set_buf(&sg_in[0], src, src_len);
+        sg_set_buf(&sg_in[1], pad, zero_padding);
+        sg_init_table(sg_out, 1);
+        sg_set_buf(sg_out, dst, *dst_len);
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+        /*
+        print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "enc src: ", DUMP_PREFIX_NONE, 16, 1,
+                        src, src_len, 1);
+        print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
+                        pad, zero_padding, 1);
+        */
+        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+                                     src_len + zero_padding);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0)
+                pr_err("ceph_aes_crypt failed %d\n", ret);
+        /*
+        print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst, *dst_len, 1);
+        */
+        return 0;
+}
+
+int ceph_aes_encrypt2(const void *key, int key_len, void *dst, size_t *dst_len,
+                      const void *src1, size_t src1_len,
+                      const void *src2, size_t src2_len)
+{
+        struct scatterlist sg_in[3], sg_out[1];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+        int ret;
+        void *iv;
+        int ivsize;
+        size_t zero_padding = (0x10 - ((src1_len + src2_len) & 0x0f));
+        char pad[16];
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        memset(pad, zero_padding, zero_padding);
+
+        *dst_len = src1_len + src2_len + zero_padding;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        sg_init_table(sg_in, 3);
+        sg_set_buf(&sg_in[0], src1, src1_len);
+        sg_set_buf(&sg_in[1], src2, src2_len);
+        sg_set_buf(&sg_in[2], pad, zero_padding);
+        sg_init_table(sg_out, 1);
+        sg_set_buf(sg_out, dst, *dst_len);
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+        /*
+        print_hex_dump(KERN_ERR, "enc  key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "enc src1: ", DUMP_PREFIX_NONE, 16, 1,
+                        src1, src1_len, 1);
+        print_hex_dump(KERN_ERR, "enc src2: ", DUMP_PREFIX_NONE, 16, 1,
+                        src2, src2_len, 1);
+        print_hex_dump(KERN_ERR, "enc  pad: ", DUMP_PREFIX_NONE, 16, 1,
+                        pad, zero_padding, 1);
+        */
+        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+                                     src1_len + src2_len + zero_padding);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0)
+                pr_err("ceph_aes_crypt2 failed %d\n", ret);
+        /*
+        print_hex_dump(KERN_ERR, "enc  out: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst, *dst_len, 1);
+        */
+        return 0;
+}
+
+int ceph_aes_decrypt(const void *key, int key_len, void *dst, size_t *dst_len,
+                     const void *src, size_t src_len)
+{
+        struct scatterlist sg_in[1], sg_out[2];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm };
+        char pad[16];
+        void *iv;
+        int ivsize;
+        int ret;
+        int last_byte;
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        sg_init_table(sg_in, 1);
+        sg_init_table(sg_out, 2);
+        sg_set_buf(sg_in, src, src_len);
+        sg_set_buf(&sg_out[0], dst, *dst_len);
+        sg_set_buf(&sg_out[1], pad, sizeof(pad));
+
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+
+        /*
+        print_hex_dump(KERN_ERR, "dec key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "dec  in: ", DUMP_PREFIX_NONE, 16, 1,
+                       src, src_len, 1);
+        */
+
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0) {
+                pr_err("ceph_aes_decrypt failed %d\n", ret);
+                return ret;
+        }
+
+        if (src_len <= *dst_len)
+                last_byte = ((char *)dst)[src_len - 1];
+        else
+                last_byte = pad[src_len - *dst_len - 1];
+        if (last_byte <= 16 && src_len >= last_byte) {
+                *dst_len = src_len - last_byte;
+        } else {
+                pr_err("ceph_aes_decrypt got bad padding %d on src len %d\n",
+                       last_byte, (int)src_len);
+                return -EPERM;  /* bad padding */
+        }
+        /*
+        print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst, *dst_len, 1);
+        */
+        return 0;
+}
+
+int ceph_aes_decrypt2(const void *key, int key_len,
+                      void *dst1, size_t *dst1_len,
+                      void *dst2, size_t *dst2_len,
+                      const void *src, size_t src_len)
+{
+        struct scatterlist sg_in[1], sg_out[3];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm };
+        char pad[16];
+        void *iv;
+        int ivsize;
+        int ret;
+        int last_byte;
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        sg_init_table(sg_in, 1);
+        sg_set_buf(sg_in, src, src_len);
+        sg_init_table(sg_out, 3);
+        sg_set_buf(&sg_out[0], dst1, *dst1_len);
+        sg_set_buf(&sg_out[1], dst2, *dst2_len);
+        sg_set_buf(&sg_out[2], pad, sizeof(pad));
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+
+        /*
+        print_hex_dump(KERN_ERR, "dec  key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "dec   in: ", DUMP_PREFIX_NONE, 16, 1,
+                       src, src_len, 1);
+        */
+
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0) {
+                pr_err("ceph_aes_decrypt failed %d\n", ret);
+                return ret;
+        }
+
+        if (src_len <= *dst1_len)
+                last_byte = ((char *)dst1)[src_len - 1];
+        else if (src_len <= *dst1_len + *dst2_len)
+                last_byte = ((char *)dst2)[src_len - *dst1_len - 1];
+        else
+                last_byte = pad[src_len - *dst1_len - *dst2_len - 1];
+        if (last_byte <= 16 && src_len >= last_byte) {
+                src_len -= last_byte;
+        } else {
+                pr_err("ceph_aes_decrypt got bad padding %d on src len %d\n",
+                       last_byte, (int)src_len);
+                return -EPERM;  /* bad padding */
+        }
+
+        if (src_len < *dst1_len) {
+                *dst1_len = src_len;
+                *dst2_len = 0;
+        } else {
+                *dst2_len = src_len - *dst1_len;
+        }
+        /*
+        print_hex_dump(KERN_ERR, "dec  out1: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst1, *dst1_len, 1);
+        print_hex_dump(KERN_ERR, "dec  out2: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst2, *dst2_len, 1);
+        */
+
+        return 0;
+}
+
+
+int ceph_decrypt(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
+                 const void *src, size_t src_len)
+{
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst_len < src_len)
+                        return -ERANGE;
+                memcpy(dst, src, src_len);
+                *dst_len = src_len;
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_decrypt(secret->key, secret->len, dst,
+                                        dst_len, src, src_len);
+
+        default:
+                return -EINVAL;
+        }
+}
+
+int ceph_decrypt2(struct ceph_crypto_key *secret,
+                        void *dst1, size_t *dst1_len,
+                        void *dst2, size_t *dst2_len,
+                        const void *src, size_t src_len)
+{
+        size_t t;
+
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst1_len + *dst2_len < src_len)
+                        return -ERANGE;
+                t = min(*dst1_len, src_len);
+                memcpy(dst1, src, t);
+                *dst1_len = t;
+                src += t;
+                src_len -= t;
+                if (src_len) {
+                        t = min(*dst2_len, src_len);
+                        memcpy(dst2, src, t);
+                        *dst2_len = t;
+                }
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_decrypt2(secret->key, secret->len,
+                                         dst1, dst1_len, dst2, dst2_len,
+                                         src, src_len);
+
+        default:
+                return -EINVAL;
+        }
+}
+
+int ceph_encrypt(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
+                 const void *src, size_t src_len)
+{
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst_len < src_len)
+                        return -ERANGE;
+                memcpy(dst, src, src_len);
+                *dst_len = src_len;
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_encrypt(secret->key, secret->len, dst,
+                                        dst_len, src, src_len);
+
+        default:
+                return -EINVAL;
+        }
+}
+
+int ceph_encrypt2(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
+                  const void *src1, size_t src1_len,
+                  const void *src2, size_t src2_len)
+{
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst_len < src1_len + src2_len)
+                        return -ERANGE;
+                memcpy(dst, src1, src1_len);
+                memcpy(dst + src1_len, src2, src2_len);
+                *dst_len = src1_len + src2_len;
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_encrypt2(secret->key, secret->len, dst, dst_len,
+                                         src1, src1_len, src2, src2_len);
+
+        default:
+                return -EINVAL;
+        }
+}
diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h
new file mode 100644
index 000000000000..40b502e6bd89
--- /dev/null
+++ b/fs/ceph/crypto.h
@@ -0,0 +1,48 @@
+#ifndef _FS_CEPH_CRYPTO_H
+#define _FS_CEPH_CRYPTO_H
+
+#include "types.h"
+#include "buffer.h"
+
+/*
+ * cryptographic secret
+ */
+struct ceph_crypto_key {
+        int type;
+        struct ceph_timespec created;
+        int len;
+        void *key;
+};
+
+static inline void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
+{
+        kfree(key->key);
+}
+
+extern int ceph_crypto_key_encode(struct ceph_crypto_key *key,
+                                  void **p, void *end);
+extern int ceph_crypto_key_decode(struct ceph_crypto_key *key,
+                                  void **p, void *end);
+extern int ceph_crypto_key_unarmor(struct ceph_crypto_key *key, const char *in);
+
+/* crypto.c */
+extern int ceph_decrypt(struct ceph_crypto_key *secret,
+                        void *dst, size_t *dst_len,
+                        const void *src, size_t src_len);
+extern int ceph_encrypt(struct ceph_crypto_key *secret,
+                        void *dst, size_t *dst_len,
+                        const void *src, size_t src_len);
+extern int ceph_decrypt2(struct ceph_crypto_key *secret,
+                        void *dst1, size_t *dst1_len,
+                        void *dst2, size_t *dst2_len,
+                        const void *src, size_t src_len);
+extern int ceph_encrypt2(struct ceph_crypto_key *secret,
+                         void *dst, size_t *dst_len,
+                         const void *src1, size_t src1_len,
+                         const void *src2, size_t src2_len);
+
+/* armor.c */
+extern int ceph_armor(char *dst, const void *src, const void *end);
+extern int ceph_unarmor(void *dst, const char *src, const char *end);
+
+#endif
diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
new file mode 100644
index 000000000000..f7048da92acc
--- /dev/null
+++ b/fs/ceph/debugfs.c
@@ -0,0 +1,484 @@
+#include "ceph_debug.h"
+
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/ctype.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+#include "super.h"
+#include "mds_client.h"
+#include "mon_client.h"
+#include "auth.h"
+
+#ifdef CONFIG_DEBUG_FS
+
+/*
+ * Implement /sys/kernel/debug/ceph fun
+ *
+ * /sys/kernel/debug/ceph/client*  - an instance of the ceph client
+ *      .../osdmap      - current osdmap
+ *      .../mdsmap      - current mdsmap
+ *      .../monmap      - current monmap
+ *      .../osdc        - active osd requests
+ *      .../mdsc        - active mds requests
+ *      .../monc        - mon client state
+ *      .../dentry_lru  - dump contents of dentry lru
+ *      .../caps        - expose cap (reservation) stats
+ *      .../bdi         - symlink to ../../bdi/something
+ */
+
+static struct dentry *ceph_debugfs_dir;
+
+static int monmap_show(struct seq_file *s, void *p)
+{
+        int i;
+        struct ceph_client *client = s->private;
+
+        if (client->monc.monmap == NULL)
+                return 0;
+
+        seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
+        for (i = 0; i < client->monc.monmap->num_mon; i++) {
+                struct ceph_entity_inst *inst =
+                        &client->monc.monmap->mon_inst[i];
+
+                seq_printf(s, "\t%s%lld\t%s\n",
+                           ENTITY_NAME(inst->name),
+                           pr_addr(&inst->addr.in_addr));
+        }
+        return 0;
+}
+
+static int mdsmap_show(struct seq_file *s, void *p)
+{
+        int i;
+        struct ceph_client *client = s->private;
+
+        if (client->mdsc.mdsmap == NULL)
+                return 0;
+        seq_printf(s, "epoch %d\n", client->mdsc.mdsmap->m_epoch);
+        seq_printf(s, "root %d\n", client->mdsc.mdsmap->m_root);
+        seq_printf(s, "session_timeout %d\n",
+                       client->mdsc.mdsmap->m_session_timeout);
+        seq_printf(s, "session_autoclose %d\n",
+                       client->mdsc.mdsmap->m_session_autoclose);
+        for (i = 0; i < client->mdsc.mdsmap->m_max_mds; i++) {
+                struct ceph_entity_addr *addr =
+                        &client->mdsc.mdsmap->m_info[i].addr;
+                int state = client->mdsc.mdsmap->m_info[i].state;
+
+                seq_printf(s, "\tmds%d\t%s\t(%s)\n", i, pr_addr(&addr->in_addr),
+                               ceph_mds_state_name(state));
+        }
+        return 0;
+}
+
+static int osdmap_show(struct seq_file *s, void *p)
+{
+        int i;
+        struct ceph_client *client = s->private;
+        struct rb_node *n;
+
+        if (client->osdc.osdmap == NULL)
+                return 0;
+        seq_printf(s, "epoch %d\n", client->osdc.osdmap->epoch);
+        seq_printf(s, "flags%s%s\n",
+                   (client->osdc.osdmap->flags & CEPH_OSDMAP_NEARFULL) ?
+                   " NEARFULL" : "",
+                   (client->osdc.osdmap->flags & CEPH_OSDMAP_FULL) ?
+                   " FULL" : "");
+        for (n = rb_first(&client->osdc.osdmap->pg_pools); n; n = rb_next(n)) {
+                struct ceph_pg_pool_info *pool =
+                        rb_entry(n, struct ceph_pg_pool_info, node);
+                seq_printf(s, "pg_pool %d pg_num %d / %d, lpg_num %d / %d\n",
+                           pool->id, pool->v.pg_num, pool->pg_num_mask,
+                           pool->v.lpg_num, pool->lpg_num_mask);
+        }
+        for (i = 0; i < client->osdc.osdmap->max_osd; i++) {
+                struct ceph_entity_addr *addr =
+                        &client->osdc.osdmap->osd_addr[i];
+                int state = client->osdc.osdmap->osd_state[i];
+                char sb[64];
+
+                seq_printf(s, "\tosd%d\t%s\t%3d%%\t(%s)\n",
+                           i, pr_addr(&addr->in_addr),
+                           ((client->osdc.osdmap->osd_weight[i]*100) >> 16),
+                           ceph_osdmap_state_str(sb, sizeof(sb), state));
+        }
+        return 0;
+}
+
+static int monc_show(struct seq_file *s, void *p)
+{
+        struct ceph_client *client = s->private;
+        struct ceph_mon_statfs_request *req;
+        struct ceph_mon_client *monc = &client->monc;
+        struct rb_node *rp;
+
+        mutex_lock(&monc->mutex);
+
+        if (monc->have_mdsmap)
+                seq_printf(s, "have mdsmap %u\n", (unsigned)monc->have_mdsmap);
+        if (monc->have_osdmap)
+                seq_printf(s, "have osdmap %u\n", (unsigned)monc->have_osdmap);
+        if (monc->want_next_osdmap)
+                seq_printf(s, "want next osdmap\n");
+
+        for (rp = rb_first(&monc->statfs_request_tree); rp; rp = rb_next(rp)) {
+                req = rb_entry(rp, struct ceph_mon_statfs_request, node);
+                seq_printf(s, "%lld statfs\n", req->tid);
+        }
+
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+
+static int mdsc_show(struct seq_file *s, void *p)
+{
+        struct ceph_client *client = s->private;
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        struct rb_node *rp;
+        int pathlen;
+        u64 pathbase;
+        char *path;
+
+        mutex_lock(&mdsc->mutex);
+        for (rp = rb_first(&mdsc->request_tree); rp; rp = rb_next(rp)) {
+                req = rb_entry(rp, struct ceph_mds_request, r_node);
+
+                if (req->r_request)
+                        seq_printf(s, "%lld\tmds%d\t", req->r_tid, req->r_mds);
+                else
+                        seq_printf(s, "%lld\t(no request)\t", req->r_tid);
+
+                seq_printf(s, "%s", ceph_mds_op_name(req->r_op));
+
+                if (req->r_got_unsafe)
+                        seq_printf(s, "\t(unsafe)");
+                else
+                        seq_printf(s, "\t");
+
+                if (req->r_inode) {
+                        seq_printf(s, " #%llx", ceph_ino(req->r_inode));
+                } else if (req->r_dentry) {
+                        path = ceph_mdsc_build_path(req->r_dentry, &pathlen,
+                                                    &pathbase, 0);
+                        spin_lock(&req->r_dentry->d_lock);
+                        seq_printf(s, " #%llx/%.*s (%s)",
+                                   ceph_ino(req->r_dentry->d_parent->d_inode),
+                                   req->r_dentry->d_name.len,
+                                   req->r_dentry->d_name.name,
+                                   path ? path : "");
+                        spin_unlock(&req->r_dentry->d_lock);
+                        kfree(path);
+                } else if (req->r_path1) {
+                        seq_printf(s, " #%llx/%s", req->r_ino1.ino,
+                                   req->r_path1);
+                }
+
+                if (req->r_old_dentry) {
+                        path = ceph_mdsc_build_path(req->r_old_dentry, &pathlen,
+                                                    &pathbase, 0);
+                        spin_lock(&req->r_old_dentry->d_lock);
+                        seq_printf(s, " #%llx/%.*s (%s)",
+                           ceph_ino(req->r_old_dentry->d_parent->d_inode),
+                                   req->r_old_dentry->d_name.len,
+                                   req->r_old_dentry->d_name.name,
+                                   path ? path : "");
+                        spin_unlock(&req->r_old_dentry->d_lock);
+                        kfree(path);
+                } else if (req->r_path2) {
+                        if (req->r_ino2.ino)
+                                seq_printf(s, " #%llx/%s", req->r_ino2.ino,
+                                           req->r_path2);
+                        else
+                                seq_printf(s, " %s", req->r_path2);
+                }
+
+                seq_printf(s, "\n");
+        }
+        mutex_unlock(&mdsc->mutex);
+
+        return 0;
+}
+
+static int osdc_show(struct seq_file *s, void *pp)
+{
+        struct ceph_client *client = s->private;
+        struct ceph_osd_client *osdc = &client->osdc;
+        struct rb_node *p;
+
+        mutex_lock(&osdc->request_mutex);
+        for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
+                struct ceph_osd_request *req;
+                struct ceph_osd_request_head *head;
+                struct ceph_osd_op *op;
+                int num_ops;
+                int opcode, olen;
+                int i;
+
+                req = rb_entry(p, struct ceph_osd_request, r_node);
+
+                seq_printf(s, "%lld\tosd%d\t%d.%x\t", req->r_tid,
+                           req->r_osd ? req->r_osd->o_osd : -1,
+                           le32_to_cpu(req->r_pgid.pool),
+                           le16_to_cpu(req->r_pgid.ps));
+
+                head = req->r_request->front.iov_base;
+                op = (void *)(head + 1);
+
+                num_ops = le16_to_cpu(head->num_ops);
+                olen = le32_to_cpu(head->object_len);
+                seq_printf(s, "%.*s", olen,
+                           (const char *)(head->ops + num_ops));
+
+                if (req->r_reassert_version.epoch)
+                        seq_printf(s, "\t%u'%llu",
+                           (unsigned)le32_to_cpu(req->r_reassert_version.epoch),
+                           le64_to_cpu(req->r_reassert_version.version));
+                else
+                        seq_printf(s, "\t");
+
+                for (i = 0; i < num_ops; i++) {
+                        opcode = le16_to_cpu(op->op);
+                        seq_printf(s, "\t%s", ceph_osd_op_name(opcode));
+                        op++;
+                }
+
+                seq_printf(s, "\n");
+        }
+        mutex_unlock(&osdc->request_mutex);
+        return 0;
+}
+
+static int caps_show(struct seq_file *s, void *p)
+{
+        struct ceph_client *client = p;
+        int total, avail, used, reserved, min;
+
+        ceph_reservation_status(client, &total, &avail, &used, &reserved, &min);
+        seq_printf(s, "total\t\t%d\n"
+                   "avail\t\t%d\n"
+                   "used\t\t%d\n"
+                   "reserved\t%d\n"
+                   "min\t%d\n",
+                   total, avail, used, reserved, min);
+        return 0;
+}
+
+static int dentry_lru_show(struct seq_file *s, void *ptr)
+{
+        struct ceph_client *client = s->private;
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_dentry_info *di;
+
+        spin_lock(&mdsc->dentry_lru_lock);
+        list_for_each_entry(di, &mdsc->dentry_lru, lru) {
+                struct dentry *dentry = di->dentry;
+                seq_printf(s, "%p %p\t%.*s\n",
+                           di, dentry, dentry->d_name.len, dentry->d_name.name);
+        }
+        spin_unlock(&mdsc->dentry_lru_lock);
+
+        return 0;
+}
+
+#define DEFINE_SHOW_FUNC(name)                                          \
+static int name##_open(struct inode *inode, struct file *file)          \
+{                                                                       \
+        struct seq_file *sf;                                            \
+        int ret;                                                        \
+                                                                        \
+        ret = single_open(file, name, NULL);                            \
+        sf = file->private_data;                                        \
+        sf->private = inode->i_private;                                 \
+        return ret;                                                     \
+}                                                                       \
+                                                                        \
+static const struct file_operations name##_fops = {                     \
+        .open           = name##_open,                                  \
+        .read           = seq_read,                                     \
+        .llseek         = seq_lseek,                                    \
+        .release        = single_release,                               \
+};
+
+DEFINE_SHOW_FUNC(monmap_show)
+DEFINE_SHOW_FUNC(mdsmap_show)
+DEFINE_SHOW_FUNC(osdmap_show)
+DEFINE_SHOW_FUNC(monc_show)
+DEFINE_SHOW_FUNC(mdsc_show)
+DEFINE_SHOW_FUNC(osdc_show)
+DEFINE_SHOW_FUNC(dentry_lru_show)
+DEFINE_SHOW_FUNC(caps_show)
+
+static int congestion_kb_set(void *data, u64 val)
+{
+        struct ceph_client *client = (struct ceph_client *)data;
+
+        if (client)
+                client->mount_args->congestion_kb = (int)val;
+
+        return 0;
+}
+
+static int congestion_kb_get(void *data, u64 *val)
+{
+        struct ceph_client *client = (struct ceph_client *)data;
+
+        if (client)
+                *val = (u64)client->mount_args->congestion_kb;
+
+        return 0;
+}
+
+
+DEFINE_SIMPLE_ATTRIBUTE(congestion_kb_fops, congestion_kb_get,
+                        congestion_kb_set, "%llu\n");
+
+int __init ceph_debugfs_init(void)
+{
+        ceph_debugfs_dir = debugfs_create_dir("ceph", NULL);
+        if (!ceph_debugfs_dir)
+                return -ENOMEM;
+        return 0;
+}
+
+void ceph_debugfs_cleanup(void)
+{
+        debugfs_remove(ceph_debugfs_dir);
+}
+
+int ceph_debugfs_client_init(struct ceph_client *client)
+{
+        int ret = 0;
+        char name[80];
+
+        snprintf(name, sizeof(name), FSID_FORMAT ".client%lld",
+                 PR_FSID(&client->fsid), client->monc.auth->global_id);
+
+        client->debugfs_dir = debugfs_create_dir(name, ceph_debugfs_dir);
+        if (!client->debugfs_dir)
+                goto out;
+
+        client->monc.debugfs_file = debugfs_create_file("monc",
+                                                      0600,
+                                                      client->debugfs_dir,
+                                                      client,
+                                                      &monc_show_fops);
+        if (!client->monc.debugfs_file)
+                goto out;
+
+        client->mdsc.debugfs_file = debugfs_create_file("mdsc",
+                                                      0600,
+                                                      client->debugfs_dir,
+                                                      client,
+                                                      &mdsc_show_fops);
+        if (!client->mdsc.debugfs_file)
+                goto out;
+
+        client->osdc.debugfs_file = debugfs_create_file("osdc",
+                                                      0600,
+                                                      client->debugfs_dir,
+                                                      client,
+                                                      &osdc_show_fops);
+        if (!client->osdc.debugfs_file)
+                goto out;
+
+        client->debugfs_monmap = debugfs_create_file("monmap",
+                                        0600,
+                                        client->debugfs_dir,
+                                        client,
+                                        &monmap_show_fops);
+        if (!client->debugfs_monmap)
+                goto out;
+
+        client->debugfs_mdsmap = debugfs_create_file("mdsmap",
+                                        0600,
+                                        client->debugfs_dir,
+                                        client,
+                                        &mdsmap_show_fops);
+        if (!client->debugfs_mdsmap)
+                goto out;
+
+        client->debugfs_osdmap = debugfs_create_file("osdmap",
+                                        0600,
+                                        client->debugfs_dir,
+                                        client,
+                                        &osdmap_show_fops);
+        if (!client->debugfs_osdmap)
+                goto out;
+
+        client->debugfs_dentry_lru = debugfs_create_file("dentry_lru",
+                                        0600,
+                                        client->debugfs_dir,
+                                        client,
+                                        &dentry_lru_show_fops);
+        if (!client->debugfs_dentry_lru)
+                goto out;
+
+        client->debugfs_caps = debugfs_create_file("caps",
+                                                   0400,
+                                                   client->debugfs_dir,
+                                                   client,
+                                                   &caps_show_fops);
+        if (!client->debugfs_caps)
+                goto out;
+
+        client->debugfs_congestion_kb = debugfs_create_file("writeback_congestion_kb",
+                                                   0600,
+                                                   client->debugfs_dir,
+                                                   client,
+                                                   &congestion_kb_fops);
+        if (!client->debugfs_congestion_kb)
+                goto out;
+
+        sprintf(name, "../../bdi/%s", dev_name(client->sb->s_bdi->dev));
+        client->debugfs_bdi = debugfs_create_symlink("bdi", client->debugfs_dir,
+                                                     name);
+
+        return 0;
+
+out:
+        ceph_debugfs_client_cleanup(client);
+        return ret;
+}
+
+void ceph_debugfs_client_cleanup(struct ceph_client *client)
+{
+        debugfs_remove(client->debugfs_bdi);
+        debugfs_remove(client->debugfs_caps);
+        debugfs_remove(client->debugfs_dentry_lru);
+        debugfs_remove(client->debugfs_osdmap);
+        debugfs_remove(client->debugfs_mdsmap);
+        debugfs_remove(client->debugfs_monmap);
+        debugfs_remove(client->osdc.debugfs_file);
+        debugfs_remove(client->mdsc.debugfs_file);
+        debugfs_remove(client->monc.debugfs_file);
+        debugfs_remove(client->debugfs_congestion_kb);
+        debugfs_remove(client->debugfs_dir);
+}
+
+#else  // CONFIG_DEBUG_FS
+
+int __init ceph_debugfs_init(void)
+{
+        return 0;
+}
+
+void ceph_debugfs_cleanup(void)
+{
+}
+
+int ceph_debugfs_client_init(struct ceph_client *client)
+{
+        return 0;
+}
+
+void ceph_debugfs_client_cleanup(struct ceph_client *client)
+{
+}
+
+#endif  // CONFIG_DEBUG_FS
diff --git a/fs/ceph/decode.h b/fs/ceph/decode.h
new file mode 100644
index 000000000000..65b3e022eaf5
--- /dev/null
+++ b/fs/ceph/decode.h
@@ -0,0 +1,194 @@
+#ifndef __CEPH_DECODE_H
+#define __CEPH_DECODE_H
+
+#include <asm/unaligned.h>
+#include <linux/time.h>
+
+#include "types.h"
+
+/*
+ * in all cases,
+ *   void **p     pointer to position pointer
+ *   void *end    pointer to end of buffer (last byte + 1)
+ */
+
+static inline u64 ceph_decode_64(void **p)
+{
+        u64 v = get_unaligned_le64(*p);
+        *p += sizeof(u64);
+        return v;
+}
+static inline u32 ceph_decode_32(void **p)
+{
+        u32 v = get_unaligned_le32(*p);
+        *p += sizeof(u32);
+        return v;
+}
+static inline u16 ceph_decode_16(void **p)
+{
+        u16 v = get_unaligned_le16(*p);
+        *p += sizeof(u16);
+        return v;
+}
+static inline u8 ceph_decode_8(void **p)
+{
+        u8 v = *(u8 *)*p;
+        (*p)++;
+        return v;
+}
+static inline void ceph_decode_copy(void **p, void *pv, size_t n)
+{
+        memcpy(pv, *p, n);
+        *p += n;
+}
+
+/*
+ * bounds check input.
+ */
+#define ceph_decode_need(p, end, n, bad)                \
+        do {                                            \
+                if (unlikely(*(p) + (n) > (end)))       \
+                        goto bad;                       \
+        } while (0)
+
+#define ceph_decode_64_safe(p, end, v, bad)                     \
+        do {                                                    \
+                ceph_decode_need(p, end, sizeof(u64), bad);     \
+                v = ceph_decode_64(p);                          \
+        } while (0)
+#define ceph_decode_32_safe(p, end, v, bad)                     \
+        do {                                                    \
+                ceph_decode_need(p, end, sizeof(u32), bad);     \
+                v = ceph_decode_32(p);                          \
+        } while (0)
+#define ceph_decode_16_safe(p, end, v, bad)                     \
+        do {                                                    \
+                ceph_decode_need(p, end, sizeof(u16), bad);     \
+                v = ceph_decode_16(p);                          \
+        } while (0)
+#define ceph_decode_8_safe(p, end, v, bad)                      \
+        do {                                                    \
+                ceph_decode_need(p, end, sizeof(u8), bad);      \
+                v = ceph_decode_8(p);                           \
+        } while (0)
+
+#define ceph_decode_copy_safe(p, end, pv, n, bad)               \
+        do {                                                    \
+                ceph_decode_need(p, end, n, bad);               \
+                ceph_decode_copy(p, pv, n);                     \
+        } while (0)
+
+/*
+ * struct ceph_timespec <-> struct timespec
+ */
+static inline void ceph_decode_timespec(struct timespec *ts,
+                                        const struct ceph_timespec *tv)
+{
+        ts->tv_sec = le32_to_cpu(tv->tv_sec);
+        ts->tv_nsec = le32_to_cpu(tv->tv_nsec);
+}
+static inline void ceph_encode_timespec(struct ceph_timespec *tv,
+                                        const struct timespec *ts)
+{
+        tv->tv_sec = cpu_to_le32(ts->tv_sec);
+        tv->tv_nsec = cpu_to_le32(ts->tv_nsec);
+}
+
+/*
+ * sockaddr_storage <-> ceph_sockaddr
+ */
+static inline void ceph_encode_addr(struct ceph_entity_addr *a)
+{
+        a->in_addr.ss_family = htons(a->in_addr.ss_family);
+}
+static inline void ceph_decode_addr(struct ceph_entity_addr *a)
+{
+        a->in_addr.ss_family = ntohs(a->in_addr.ss_family);
+        WARN_ON(a->in_addr.ss_family == 512);
+}
+
+/*
+ * encoders
+ */
+static inline void ceph_encode_64(void **p, u64 v)
+{
+        put_unaligned_le64(v, (__le64 *)*p);
+        *p += sizeof(u64);
+}
+static inline void ceph_encode_32(void **p, u32 v)
+{
+        put_unaligned_le32(v, (__le32 *)*p);
+        *p += sizeof(u32);
+}
+static inline void ceph_encode_16(void **p, u16 v)
+{
+        put_unaligned_le16(v, (__le16 *)*p);
+        *p += sizeof(u16);
+}
+static inline void ceph_encode_8(void **p, u8 v)
+{
+        *(u8 *)*p = v;
+        (*p)++;
+}
+static inline void ceph_encode_copy(void **p, const void *s, int len)
+{
+        memcpy(*p, s, len);
+        *p += len;
+}
+
+/*
+ * filepath, string encoders
+ */
+static inline void ceph_encode_filepath(void **p, void *end,
+                                        u64 ino, const char *path)
+{
+        u32 len = path ? strlen(path) : 0;
+        BUG_ON(*p + sizeof(ino) + sizeof(len) + len > end);
+        ceph_encode_8(p, 1);
+        ceph_encode_64(p, ino);
+        ceph_encode_32(p, len);
+        if (len)
+                memcpy(*p, path, len);
+        *p += len;
+}
+
+static inline void ceph_encode_string(void **p, void *end,
+                                      const char *s, u32 len)
+{
+        BUG_ON(*p + sizeof(len) + len > end);
+        ceph_encode_32(p, len);
+        if (len)
+                memcpy(*p, s, len);
+        *p += len;
+}
+
+#define ceph_encode_need(p, end, n, bad)                \
+        do {                                            \
+                if (unlikely(*(p) + (n) > (end)))       \
+                        goto bad;                       \
+        } while (0)
+
+#define ceph_encode_64_safe(p, end, v, bad)                     \
+        do {                                                    \
+                ceph_encode_need(p, end, sizeof(u64), bad);     \
+                ceph_encode_64(p, v);                           \
+        } while (0)
+#define ceph_encode_32_safe(p, end, v, bad)                     \
+        do {                                                    \
+                ceph_encode_need(p, end, sizeof(u32), bad);     \
+                ceph_encode_32(p, v);                   \
+        } while (0)
+#define ceph_encode_16_safe(p, end, v, bad)                     \
+        do {                                                    \
+                ceph_encode_need(p, end, sizeof(u16), bad);     \
+                ceph_encode_16(p, v);                   \
+        } while (0)
+
+#define ceph_encode_copy_safe(p, end, pv, n, bad)               \
+        do {                                                    \
+                ceph_encode_need(p, end, n, bad);               \
+                ceph_encode_copy(p, pv, n);                     \
+        } while (0)
+
+
+#endif
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
new file mode 100644
index 000000000000..ea8ee2e526aa
--- /dev/null
+++ b/fs/ceph/dir.c
@@ -0,0 +1,1224 @@
+#include "ceph_debug.h"
+
+#include <linux/spinlock.h>
+#include <linux/fs_struct.h>
+#include <linux/namei.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+
+#include "super.h"
+
+/*
+ * Directory operations: readdir, lookup, create, link, unlink,
+ * rename, etc.
+ */
+
+/*
+ * Ceph MDS operations are specified in terms of a base ino and
+ * relative path.  Thus, the client can specify an operation on a
+ * specific inode (e.g., a getattr due to fstat(2)), or as a path
+ * relative to, say, the root directory.
+ *
+ * Normally, we limit ourselves to strict inode ops (no path component)
+ * or dentry operations (a single path component relative to an ino).  The
+ * exception to this is open_root_dentry(), which will open the mount
+ * point by name.
+ */
+
+const struct inode_operations ceph_dir_iops;
+const struct file_operations ceph_dir_fops;
+struct dentry_operations ceph_dentry_ops;
+
+/*
+ * Initialize ceph dentry state.
+ */
+int ceph_init_dentry(struct dentry *dentry)
+{
+        struct ceph_dentry_info *di;
+
+        if (dentry->d_fsdata)
+                return 0;
+
+        if (ceph_snap(dentry->d_parent->d_inode) == CEPH_NOSNAP)
+                dentry->d_op = &ceph_dentry_ops;
+        else if (ceph_snap(dentry->d_parent->d_inode) == CEPH_SNAPDIR)
+                dentry->d_op = &ceph_snapdir_dentry_ops;
+        else
+                dentry->d_op = &ceph_snap_dentry_ops;
+
+        di = kmem_cache_alloc(ceph_dentry_cachep, GFP_NOFS);
+        if (!di)
+                return -ENOMEM;          /* oh well */
+
+        spin_lock(&dentry->d_lock);
+        if (dentry->d_fsdata) /* lost a race */
+                goto out_unlock;
+        di->dentry = dentry;
+        di->lease_session = NULL;
+        dentry->d_fsdata = di;
+        dentry->d_time = jiffies;
+        ceph_dentry_lru_add(dentry);
+out_unlock:
+        spin_unlock(&dentry->d_lock);
+        return 0;
+}
+
+
+
+/*
+ * for readdir, we encode the directory frag and offset within that
+ * frag into f_pos.
+ */
+static unsigned fpos_frag(loff_t p)
+{
+        return p >> 32;
+}
+static unsigned fpos_off(loff_t p)
+{
+        return p & 0xffffffff;
+}
+
+/*
+ * When possible, we try to satisfy a readdir by peeking at the
+ * dcache.  We make this work by carefully ordering dentries on
+ * d_u.d_child when we initially get results back from the MDS, and
+ * falling back to a "normal" sync readdir if any dentries in the dir
+ * are dropped.
+ *
+ * I_COMPLETE tells indicates we have all dentries in the dir.  It is
+ * defined IFF we hold CEPH_CAP_FILE_SHARED (which will be revoked by
+ * the MDS if/when the directory is modified).
+ */
+static int __dcache_readdir(struct file *filp,
+                            void *dirent, filldir_t filldir)
+{
+        struct inode *inode = filp->f_dentry->d_inode;
+        struct ceph_file_info *fi = filp->private_data;
+        struct dentry *parent = filp->f_dentry;
+        struct inode *dir = parent->d_inode;
+        struct list_head *p;
+        struct dentry *dentry, *last;
+        struct ceph_dentry_info *di;
+        int err = 0;
+
+        /* claim ref on last dentry we returned */
+        last = fi->dentry;
+        fi->dentry = NULL;
+
+        dout("__dcache_readdir %p at %llu (last %p)\n", dir, filp->f_pos,
+             last);
+
+        spin_lock(&dcache_lock);
+
+        /* start at beginning? */
+        if (filp->f_pos == 2 || (last &&
+                                 filp->f_pos < ceph_dentry(last)->offset)) {
+                if (list_empty(&parent->d_subdirs))
+                        goto out_unlock;
+                p = parent->d_subdirs.prev;
+                dout(" initial p %p/%p\n", p->prev, p->next);
+        } else {
+                p = last->d_u.d_child.prev;
+        }
+
+more:
+        dentry = list_entry(p, struct dentry, d_u.d_child);
+        di = ceph_dentry(dentry);
+        while (1) {
+                dout(" p %p/%p d_subdirs %p/%p\n", p->prev, p->next,
+                     parent->d_subdirs.prev, parent->d_subdirs.next);
+                if (p == &parent->d_subdirs) {
+                        fi->at_end = 1;
+                        goto out_unlock;
+                }
+                if (!d_unhashed(dentry) && dentry->d_inode &&
+                    ceph_snap(dentry->d_inode) != CEPH_SNAPDIR &&
+                    ceph_ino(dentry->d_inode) != CEPH_INO_CEPH &&
+                    filp->f_pos <= di->offset)
+                        break;
+                dout(" skipping %p %.*s at %llu (%llu)%s%s\n", dentry,
+                     dentry->d_name.len, dentry->d_name.name, di->offset,
+                     filp->f_pos, d_unhashed(dentry) ? " unhashed" : "",
+                     !dentry->d_inode ? " null" : "");
+                p = p->prev;
+                dentry = list_entry(p, struct dentry, d_u.d_child);
+                di = ceph_dentry(dentry);
+        }
+
+        atomic_inc(&dentry->d_count);
+        spin_unlock(&dcache_lock);
+        spin_unlock(&inode->i_lock);
+
+        dout(" %llu (%llu) dentry %p %.*s %p\n", di->offset, filp->f_pos,
+             dentry, dentry->d_name.len, dentry->d_name.name, dentry->d_inode);
+        filp->f_pos = di->offset;
+        err = filldir(dirent, dentry->d_name.name,
+                      dentry->d_name.len, di->offset,
+                      dentry->d_inode->i_ino,
+                      dentry->d_inode->i_mode >> 12);
+
+        if (last) {
+                if (err < 0) {
+                        /* remember our position */
+                        fi->dentry = last;
+                        fi->next_offset = di->offset;
+                } else {
+                        dput(last);
+                }
+                last = NULL;
+        }
+
+        spin_lock(&inode->i_lock);
+        spin_lock(&dcache_lock);
+
+        last = dentry;
+
+        if (err < 0)
+                goto out_unlock;
+
+        p = p->prev;
+        filp->f_pos++;
+
+        /* make sure a dentry wasn't dropped while we didn't have dcache_lock */
+        if ((ceph_inode(dir)->i_ceph_flags & CEPH_I_COMPLETE))
+                goto more;
+        dout(" lost I_COMPLETE on %p; falling back to mds\n", dir);
+        err = -EAGAIN;
+
+out_unlock:
+        spin_unlock(&dcache_lock);
+
+        if (last) {
+                spin_unlock(&inode->i_lock);
+                dput(last);
+                spin_lock(&inode->i_lock);
+        }
+
+        return err;
+}
+
+/*
+ * make note of the last dentry we read, so we can
+ * continue at the same lexicographical point,
+ * regardless of what dir changes take place on the
+ * server.
+ */
+static int note_last_dentry(struct ceph_file_info *fi, const char *name,
+                            int len)
+{
+        kfree(fi->last_name);
+        fi->last_name = kmalloc(len+1, GFP_NOFS);
+        if (!fi->last_name)
+                return -ENOMEM;
+        memcpy(fi->last_name, name, len);
+        fi->last_name[len] = 0;
+        dout("note_last_dentry '%s'\n", fi->last_name);
+        return 0;
+}
+
+static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
+{
+        struct ceph_file_info *fi = filp->private_data;
+        struct inode *inode = filp->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_client *client = ceph_inode_to_client(inode);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        unsigned frag = fpos_frag(filp->f_pos);
+        int off = fpos_off(filp->f_pos);
+        int err;
+        u32 ftype;
+        struct ceph_mds_reply_info_parsed *rinfo;
+        const int max_entries = client->mount_args->max_readdir;
+
+        dout("readdir %p filp %p frag %u off %u\n", inode, filp, frag, off);
+        if (fi->at_end)
+                return 0;
+
+        /* always start with . and .. */
+        if (filp->f_pos == 0) {
+                /* note dir version at start of readdir so we can tell
+                 * if any dentries get dropped */
+                fi->dir_release_count = ci->i_release_count;
+
+                dout("readdir off 0 -> '.'\n");
+                if (filldir(dirent, ".", 1, ceph_make_fpos(0, 0),
+                            inode->i_ino, inode->i_mode >> 12) < 0)
+                        return 0;
+                filp->f_pos = 1;
+                off = 1;
+        }
+        if (filp->f_pos == 1) {
+                dout("readdir off 1 -> '..'\n");
+                if (filldir(dirent, "..", 2, ceph_make_fpos(0, 1),
+                            filp->f_dentry->d_parent->d_inode->i_ino,
+                            inode->i_mode >> 12) < 0)
+                        return 0;
+                filp->f_pos = 2;
+                off = 2;
+        }
+
+        /* can we use the dcache? */
+        spin_lock(&inode->i_lock);
+        if ((filp->f_pos == 2 || fi->dentry) &&
+            !ceph_test_opt(client, NOASYNCREADDIR) &&
+            (ci->i_ceph_flags & CEPH_I_COMPLETE) &&
+            __ceph_caps_issued_mask(ci, CEPH_CAP_FILE_SHARED, 1)) {
+                err = __dcache_readdir(filp, dirent, filldir);
+                if (err != -EAGAIN) {
+                        spin_unlock(&inode->i_lock);
+                        return err;
+                }
+        }
+        spin_unlock(&inode->i_lock);
+        if (fi->dentry) {
+                err = note_last_dentry(fi, fi->dentry->d_name.name,
+                                       fi->dentry->d_name.len);
+                if (err)
+                        return err;
+                dput(fi->dentry);
+                fi->dentry = NULL;
+        }
+
+        /* proceed with a normal readdir */
+
+more:
+        /* do we have the correct frag content buffered? */
+        if (fi->frag != frag || fi->last_readdir == NULL) {
+                struct ceph_mds_request *req;
+                int op = ceph_snap(inode) == CEPH_SNAPDIR ?
+                        CEPH_MDS_OP_LSSNAP : CEPH_MDS_OP_READDIR;
+
+                /* discard old result, if any */
+                if (fi->last_readdir) {
+                        ceph_mdsc_put_request(fi->last_readdir);
+                        fi->last_readdir = NULL;
+                }
+
+                /* requery frag tree, as the frag topology may have changed */
+                frag = ceph_choose_frag(ceph_inode(inode), frag, NULL, NULL);
+
+                dout("readdir fetching %llx.%llx frag %x offset '%s'\n",
+                     ceph_vinop(inode), frag, fi->last_name);
+                req = ceph_mdsc_create_request(mdsc, op, USE_AUTH_MDS);
+                if (IS_ERR(req))
+                        return PTR_ERR(req);
+                req->r_inode = igrab(inode);
+                req->r_dentry = dget(filp->f_dentry);
+                /* hints to request -> mds selection code */
+                req->r_direct_mode = USE_AUTH_MDS;
+                req->r_direct_hash = ceph_frag_value(frag);
+                req->r_direct_is_hash = true;
+                req->r_path2 = kstrdup(fi->last_name, GFP_NOFS);
+                req->r_readdir_offset = fi->next_offset;
+                req->r_args.readdir.frag = cpu_to_le32(frag);
+                req->r_args.readdir.max_entries = cpu_to_le32(max_entries);
+                req->r_num_caps = max_entries + 1;
+                err = ceph_mdsc_do_request(mdsc, NULL, req);
+                if (err < 0) {
+                        ceph_mdsc_put_request(req);
+                        return err;
+                }
+                dout("readdir got and parsed readdir result=%d"
+                     " on frag %x, end=%d, complete=%d\n", err, frag,
+                     (int)req->r_reply_info.dir_end,
+                     (int)req->r_reply_info.dir_complete);
+
+                if (!req->r_did_prepopulate) {
+                        dout("readdir !did_prepopulate");
+                        fi->dir_release_count--;    /* preclude I_COMPLETE */
+                }
+
+                /* note next offset and last dentry name */
+                fi->offset = fi->next_offset;
+                fi->last_readdir = req;
+
+                if (req->r_reply_info.dir_end) {
+                        kfree(fi->last_name);
+                        fi->last_name = NULL;
+                        fi->next_offset = 0;
+                } else {
+                        rinfo = &req->r_reply_info;
+                        err = note_last_dentry(fi,
+                                       rinfo->dir_dname[rinfo->dir_nr-1],
+                                       rinfo->dir_dname_len[rinfo->dir_nr-1]);
+                        if (err)
+                                return err;
+                        fi->next_offset += rinfo->dir_nr;
+                }
+        }
+
+        rinfo = &fi->last_readdir->r_reply_info;
+        dout("readdir frag %x num %d off %d chunkoff %d\n", frag,
+             rinfo->dir_nr, off, fi->offset);
+        while (off - fi->offset >= 0 && off - fi->offset < rinfo->dir_nr) {
+                u64 pos = ceph_make_fpos(frag, off);
+                struct ceph_mds_reply_inode *in =
+                        rinfo->dir_in[off - fi->offset].in;
+                dout("readdir off %d (%d/%d) -> %lld '%.*s' %p\n",
+                     off, off - fi->offset, rinfo->dir_nr, pos,
+                     rinfo->dir_dname_len[off - fi->offset],
+                     rinfo->dir_dname[off - fi->offset], in);
+                BUG_ON(!in);
+                ftype = le32_to_cpu(in->mode) >> 12;
+                if (filldir(dirent,
+                            rinfo->dir_dname[off - fi->offset],
+                            rinfo->dir_dname_len[off - fi->offset],
+                            pos,
+                            le64_to_cpu(in->ino),
+                            ftype) < 0) {
+                        dout("filldir stopping us...\n");
+                        return 0;
+                }
+                off++;
+                filp->f_pos = pos + 1;
+        }
+
+        if (fi->last_name) {
+                ceph_mdsc_put_request(fi->last_readdir);
+                fi->last_readdir = NULL;
+                goto more;
+        }
+
+        /* more frags? */
+        if (!ceph_frag_is_rightmost(frag)) {
+                frag = ceph_frag_next(frag);
+                off = 0;
+                filp->f_pos = ceph_make_fpos(frag, off);
+                dout("readdir next frag is %x\n", frag);
+                goto more;
+        }
+        fi->at_end = 1;
+
+        /*
+         * if dir_release_count still matches the dir, no dentries
+         * were released during the whole readdir, and we should have
+         * the complete dir contents in our cache.
+         */
+        spin_lock(&inode->i_lock);
+        if (ci->i_release_count == fi->dir_release_count) {
+                dout(" marking %p complete\n", inode);
+                ci->i_ceph_flags |= CEPH_I_COMPLETE;
+                ci->i_max_offset = filp->f_pos;
+        }
+        spin_unlock(&inode->i_lock);
+
+        dout("readdir %p filp %p done.\n", inode, filp);
+        return 0;
+}
+
+static void reset_readdir(struct ceph_file_info *fi)
+{
+        if (fi->last_readdir) {
+                ceph_mdsc_put_request(fi->last_readdir);
+                fi->last_readdir = NULL;
+        }
+        kfree(fi->last_name);
+        fi->next_offset = 2;  /* compensate for . and .. */
+        if (fi->dentry) {
+                dput(fi->dentry);
+                fi->dentry = NULL;
+        }
+        fi->at_end = 0;
+}
+
+static loff_t ceph_dir_llseek(struct file *file, loff_t offset, int origin)
+{
+        struct ceph_file_info *fi = file->private_data;
+        struct inode *inode = file->f_mapping->host;
+        loff_t old_offset = offset;
+        loff_t retval;
+
+        mutex_lock(&inode->i_mutex);
+        switch (origin) {
+        case SEEK_END:
+                offset += inode->i_size + 2;   /* FIXME */
+                break;
+        case SEEK_CUR:
+                offset += file->f_pos;
+        }
+        retval = -EINVAL;
+        if (offset >= 0 && offset <= inode->i_sb->s_maxbytes) {
+                if (offset != file->f_pos) {
+                        file->f_pos = offset;
+                        file->f_version = 0;
+                        fi->at_end = 0;
+                }
+                retval = offset;
+
+                /*
+                 * discard buffered readdir content on seekdir(0), or
+                 * seek to new frag, or seek prior to current chunk.
+                 */
+                if (offset == 0 ||
+                    fpos_frag(offset) != fpos_frag(old_offset) ||
+                    fpos_off(offset) < fi->offset) {
+                        dout("dir_llseek dropping %p content\n", file);
+                        reset_readdir(fi);
+                }
+
+                /* bump dir_release_count if we did a forward seek */
+                if (offset > old_offset)
+                        fi->dir_release_count--;
+        }
+        mutex_unlock(&inode->i_mutex);
+        return retval;
+}
+
+/*
+ * Process result of a lookup/open request.
+ *
+ * Mainly, make sure we return the final req->r_dentry (if it already
+ * existed) in place of the original VFS-provided dentry when they
+ * differ.
+ *
+ * Gracefully handle the case where the MDS replies with -ENOENT and
+ * no trace (which it may do, at its discretion, e.g., if it doesn't
+ * care to issue a lease on the negative dentry).
+ */
+struct dentry *ceph_finish_lookup(struct ceph_mds_request *req,
+                                  struct dentry *dentry, int err)
+{
+        struct ceph_client *client = ceph_client(dentry->d_sb);
+        struct inode *parent = dentry->d_parent->d_inode;
+
+        /* .snap dir? */
+        if (err == -ENOENT &&
+            ceph_vino(parent).ino != CEPH_INO_ROOT && /* no .snap in root dir */
+            strcmp(dentry->d_name.name,
+                   client->mount_args->snapdir_name) == 0) {
+                struct inode *inode = ceph_get_snapdir(parent);
+                dout("ENOENT on snapdir %p '%.*s', linking to snapdir %p\n",
+                     dentry, dentry->d_name.len, dentry->d_name.name, inode);
+                BUG_ON(!d_unhashed(dentry));
+                d_add(dentry, inode);
+                err = 0;
+        }
+
+        if (err == -ENOENT) {
+                /* no trace? */
+                err = 0;
+                if (!req->r_reply_info.head->is_dentry) {
+                        dout("ENOENT and no trace, dentry %p inode %p\n",
+                             dentry, dentry->d_inode);
+                        if (dentry->d_inode) {
+                                d_drop(dentry);
+                                err = -ENOENT;
+                        } else {
+                                d_add(dentry, NULL);
+                        }
+                }
+        }
+        if (err)
+                dentry = ERR_PTR(err);
+        else if (dentry != req->r_dentry)
+                dentry = dget(req->r_dentry);   /* we got spliced */
+        else
+                dentry = NULL;
+        return dentry;
+}
+
+static int is_root_ceph_dentry(struct inode *inode, struct dentry *dentry)
+{
+        return ceph_ino(inode) == CEPH_INO_ROOT &&
+                strncmp(dentry->d_name.name, ".ceph", 5) == 0;
+}
+
+/*
+ * Look up a single dir entry.  If there is a lookup intent, inform
+ * the MDS so that it gets our 'caps wanted' value in a single op.
+ */
+static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry,
+                                  struct nameidata *nd)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int op;
+        int err;
+
+        dout("lookup %p dentry %p '%.*s'\n",
+             dir, dentry, dentry->d_name.len, dentry->d_name.name);
+
+        if (dentry->d_name.len > NAME_MAX)
+                return ERR_PTR(-ENAMETOOLONG);
+
+        err = ceph_init_dentry(dentry);
+        if (err < 0)
+                return ERR_PTR(err);
+
+        /* open (but not create!) intent? */
+        if (nd &&
+            (nd->flags & LOOKUP_OPEN) &&
+            (nd->flags & LOOKUP_CONTINUE) == 0 && /* only open last component */
+            !(nd->intent.open.flags & O_CREAT)) {
+                int mode = nd->intent.open.create_mode & ~current->fs->umask;
+                return ceph_lookup_open(dir, dentry, nd, mode, 1);
+        }
+
+        /* can we conclude ENOENT locally? */
+        if (dentry->d_inode == NULL) {
+                struct ceph_inode_info *ci = ceph_inode(dir);
+                struct ceph_dentry_info *di = ceph_dentry(dentry);
+
+                spin_lock(&dir->i_lock);
+                dout(" dir %p flags are %d\n", dir, ci->i_ceph_flags);
+                if (strncmp(dentry->d_name.name,
+                            client->mount_args->snapdir_name,
+                            dentry->d_name.len) &&
+                    !is_root_ceph_dentry(dir, dentry) &&
+                    (ci->i_ceph_flags & CEPH_I_COMPLETE) &&
+                    (__ceph_caps_issued_mask(ci, CEPH_CAP_FILE_SHARED, 1))) {
+                        di->offset = ci->i_max_offset++;
+                        spin_unlock(&dir->i_lock);
+                        dout(" dir %p complete, -ENOENT\n", dir);
+                        d_add(dentry, NULL);
+                        di->lease_shared_gen = ci->i_shared_gen;
+                        return NULL;
+                }
+                spin_unlock(&dir->i_lock);
+        }
+
+        op = ceph_snap(dir) == CEPH_SNAPDIR ?
+                CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_LOOKUP;
+        req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS);
+        if (IS_ERR(req))
+                return ERR_PTR(PTR_ERR(req));
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        /* we only need inode linkage */
+        req->r_args.getattr.mask = cpu_to_le32(CEPH_STAT_CAP_INODE);
+        req->r_locked_dir = dir;
+        err = ceph_mdsc_do_request(mdsc, NULL, req);
+        dentry = ceph_finish_lookup(req, dentry, err);
+        ceph_mdsc_put_request(req);  /* will dput(dentry) */
+        dout("lookup result=%p\n", dentry);
+        return dentry;
+}
+
+/*
+ * If we do a create but get no trace back from the MDS, follow up with
+ * a lookup (the VFS expects us to link up the provided dentry).
+ */
+int ceph_handle_notrace_create(struct inode *dir, struct dentry *dentry)
+{
+        struct dentry *result = ceph_lookup(dir, dentry, NULL);
+
+        if (result && !IS_ERR(result)) {
+                /*
+                 * We created the item, then did a lookup, and found
+                 * it was already linked to another inode we already
+                 * had in our cache (and thus got spliced).  Link our
+                 * dentry to that inode, but don't hash it, just in
+                 * case the VFS wants to dereference it.
+                 */
+                BUG_ON(!result->d_inode);
+                d_instantiate(dentry, result->d_inode);
+                return 0;
+        }
+        return PTR_ERR(result);
+}
+
+static int ceph_mknod(struct inode *dir, struct dentry *dentry,
+                      int mode, dev_t rdev)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int err;
+
+        if (ceph_snap(dir) != CEPH_NOSNAP)
+                return -EROFS;
+
+        dout("mknod in dir %p dentry %p mode 0%o rdev %d\n",
+             dir, dentry, mode, rdev);
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_MKNOD, USE_AUTH_MDS);
+        if (IS_ERR(req)) {
+                d_drop(dentry);
+                return PTR_ERR(req);
+        }
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        req->r_locked_dir = dir;
+        req->r_args.mknod.mode = cpu_to_le32(mode);
+        req->r_args.mknod.rdev = cpu_to_le32(rdev);
+        req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        err = ceph_mdsc_do_request(mdsc, dir, req);
+        if (!err && !req->r_reply_info.head->is_dentry)
+                err = ceph_handle_notrace_create(dir, dentry);
+        ceph_mdsc_put_request(req);
+        if (err)
+                d_drop(dentry);
+        return err;
+}
+
+static int ceph_create(struct inode *dir, struct dentry *dentry, int mode,
+                       struct nameidata *nd)
+{
+        dout("create in dir %p dentry %p name '%.*s'\n",
+             dir, dentry, dentry->d_name.len, dentry->d_name.name);
+
+        if (ceph_snap(dir) != CEPH_NOSNAP)
+                return -EROFS;
+
+        if (nd) {
+                BUG_ON((nd->flags & LOOKUP_OPEN) == 0);
+                dentry = ceph_lookup_open(dir, dentry, nd, mode, 0);
+                /* hrm, what should i do here if we get aliased? */
+                if (IS_ERR(dentry))
+                        return PTR_ERR(dentry);
+                return 0;
+        }
+
+        /* fall back to mknod */
+        return ceph_mknod(dir, dentry, (mode & ~S_IFMT) | S_IFREG, 0);
+}
+
+static int ceph_symlink(struct inode *dir, struct dentry *dentry,
+                            const char *dest)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int err;
+
+        if (ceph_snap(dir) != CEPH_NOSNAP)
+                return -EROFS;
+
+        dout("symlink in dir %p dentry %p to '%s'\n", dir, dentry, dest);
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SYMLINK, USE_AUTH_MDS);
+        if (IS_ERR(req)) {
+                d_drop(dentry);
+                return PTR_ERR(req);
+        }
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        req->r_path2 = kstrdup(dest, GFP_NOFS);
+        req->r_locked_dir = dir;
+        req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        err = ceph_mdsc_do_request(mdsc, dir, req);
+        if (!err && !req->r_reply_info.head->is_dentry)
+                err = ceph_handle_notrace_create(dir, dentry);
+        ceph_mdsc_put_request(req);
+        if (err)
+                d_drop(dentry);
+        return err;
+}
+
+static int ceph_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int err = -EROFS;
+        int op;
+
+        if (ceph_snap(dir) == CEPH_SNAPDIR) {
+                /* mkdir .snap/foo is a MKSNAP */
+                op = CEPH_MDS_OP_MKSNAP;
+                dout("mksnap dir %p snap '%.*s' dn %p\n", dir,
+                     dentry->d_name.len, dentry->d_name.name, dentry);
+        } else if (ceph_snap(dir) == CEPH_NOSNAP) {
+                dout("mkdir dir %p dn %p mode 0%o\n", dir, dentry, mode);
+                op = CEPH_MDS_OP_MKDIR;
+        } else {
+                goto out;
+        }
+        req = ceph_mdsc_create_request(mdsc, op, USE_AUTH_MDS);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto out;
+        }
+
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        req->r_locked_dir = dir;
+        req->r_args.mkdir.mode = cpu_to_le32(mode);
+        req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        err = ceph_mdsc_do_request(mdsc, dir, req);
+        if (!err && !req->r_reply_info.head->is_dentry)
+                err = ceph_handle_notrace_create(dir, dentry);
+        ceph_mdsc_put_request(req);
+out:
+        if (err < 0)
+                d_drop(dentry);
+        return err;
+}
+
+static int ceph_link(struct dentry *old_dentry, struct inode *dir,
+                     struct dentry *dentry)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int err;
+
+        if (ceph_snap(dir) != CEPH_NOSNAP)
+                return -EROFS;
+
+        dout("link in dir %p old_dentry %p dentry %p\n", dir,
+             old_dentry, dentry);
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_LINK, USE_AUTH_MDS);
+        if (IS_ERR(req)) {
+                d_drop(dentry);
+                return PTR_ERR(req);
+        }
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        req->r_old_dentry = dget(old_dentry); /* or inode? hrm. */
+        req->r_locked_dir = dir;
+        req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        err = ceph_mdsc_do_request(mdsc, dir, req);
+        if (err)
+                d_drop(dentry);
+        else if (!req->r_reply_info.head->is_dentry)
+                d_instantiate(dentry, igrab(old_dentry->d_inode));
+        ceph_mdsc_put_request(req);
+        return err;
+}
+
+/*
+ * For a soon-to-be unlinked file, drop the AUTH_RDCACHE caps.  If it
+ * looks like the link count will hit 0, drop any other caps (other
+ * than PIN) we don't specifically want (due to the file still being
+ * open).
+ */
+static int drop_caps_for_unlink(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int drop = CEPH_CAP_LINK_SHARED | CEPH_CAP_LINK_EXCL;
+
+        spin_lock(&inode->i_lock);
+        if (inode->i_nlink == 1) {
+                drop |= ~(__ceph_caps_wanted(ci) | CEPH_CAP_PIN);
+                ci->i_ceph_flags |= CEPH_I_NODELAY;
+        }
+        spin_unlock(&inode->i_lock);
+        return drop;
+}
+
+/*
+ * rmdir and unlink are differ only by the metadata op code
+ */
+static int ceph_unlink(struct inode *dir, struct dentry *dentry)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct inode *inode = dentry->d_inode;
+        struct ceph_mds_request *req;
+        int err = -EROFS;
+        int op;
+
+        if (ceph_snap(dir) == CEPH_SNAPDIR) {
+                /* rmdir .snap/foo is RMSNAP */
+                dout("rmsnap dir %p '%.*s' dn %p\n", dir, dentry->d_name.len,
+                     dentry->d_name.name, dentry);
+                op = CEPH_MDS_OP_RMSNAP;
+        } else if (ceph_snap(dir) == CEPH_NOSNAP) {
+                dout("unlink/rmdir dir %p dn %p inode %p\n",
+                     dir, dentry, inode);
+                op = ((dentry->d_inode->i_mode & S_IFMT) == S_IFDIR) ?
+                        CEPH_MDS_OP_RMDIR : CEPH_MDS_OP_UNLINK;
+        } else
+                goto out;
+        req = ceph_mdsc_create_request(mdsc, op, USE_AUTH_MDS);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto out;
+        }
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        req->r_locked_dir = dir;
+        req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        req->r_inode_drop = drop_caps_for_unlink(inode);
+        err = ceph_mdsc_do_request(mdsc, dir, req);
+        if (!err && !req->r_reply_info.head->is_dentry)
+                d_delete(dentry);
+        ceph_mdsc_put_request(req);
+out:
+        return err;
+}
+
+static int ceph_rename(struct inode *old_dir, struct dentry *old_dentry,
+                       struct inode *new_dir, struct dentry *new_dentry)
+{
+        struct ceph_client *client = ceph_sb_to_client(old_dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int err;
+
+        if (ceph_snap(old_dir) != ceph_snap(new_dir))
+                return -EXDEV;
+        if (ceph_snap(old_dir) != CEPH_NOSNAP ||
+            ceph_snap(new_dir) != CEPH_NOSNAP)
+                return -EROFS;
+        dout("rename dir %p dentry %p to dir %p dentry %p\n",
+             old_dir, old_dentry, new_dir, new_dentry);
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_RENAME, USE_AUTH_MDS);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+        req->r_dentry = dget(new_dentry);
+        req->r_num_caps = 2;
+        req->r_old_dentry = dget(old_dentry);
+        req->r_locked_dir = new_dir;
+        req->r_old_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_old_dentry_unless = CEPH_CAP_FILE_EXCL;
+        req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+        req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        /* release LINK_RDCACHE on source inode (mds will lock it) */
+        req->r_old_inode_drop = CEPH_CAP_LINK_SHARED;
+        if (new_dentry->d_inode)
+                req->r_inode_drop = drop_caps_for_unlink(new_dentry->d_inode);
+        err = ceph_mdsc_do_request(mdsc, old_dir, req);
+        if (!err && !req->r_reply_info.head->is_dentry) {
+                /*
+                 * Normally d_move() is done by fill_trace (called by
+                 * do_request, above).  If there is no trace, we need
+                 * to do it here.
+                 */
+                d_move(old_dentry, new_dentry);
+        }
+        ceph_mdsc_put_request(req);
+        return err;
+}
+
+
+/*
+ * Check if dentry lease is valid.  If not, delete the lease.  Try to
+ * renew if the least is more than half up.
+ */
+static int dentry_lease_is_valid(struct dentry *dentry)
+{
+        struct ceph_dentry_info *di;
+        struct ceph_mds_session *s;
+        int valid = 0;
+        u32 gen;
+        unsigned long ttl;
+        struct ceph_mds_session *session = NULL;
+        struct inode *dir = NULL;
+        u32 seq = 0;
+
+        spin_lock(&dentry->d_lock);
+        di = ceph_dentry(dentry);
+        if (di && di->lease_session) {
+                s = di->lease_session;
+                spin_lock(&s->s_cap_lock);
+                gen = s->s_cap_gen;
+                ttl = s->s_cap_ttl;
+                spin_unlock(&s->s_cap_lock);
+
+                if (di->lease_gen == gen &&
+                    time_before(jiffies, dentry->d_time) &&
+                    time_before(jiffies, ttl)) {
+                        valid = 1;
+                        if (di->lease_renew_after &&
+                            time_after(jiffies, di->lease_renew_after)) {
+                                /* we should renew */
+                                dir = dentry->d_parent->d_inode;
+                                session = ceph_get_mds_session(s);
+                                seq = di->lease_seq;
+                                di->lease_renew_after = 0;
+                                di->lease_renew_from = jiffies;
+                        }
+                }
+        }
+        spin_unlock(&dentry->d_lock);
+
+        if (session) {
+                ceph_mdsc_lease_send_msg(session, dir, dentry,
+                                         CEPH_MDS_LEASE_RENEW, seq);
+                ceph_put_mds_session(session);
+        }
+        dout("dentry_lease_is_valid - dentry %p = %d\n", dentry, valid);
+        return valid;
+}
+
+/*
+ * Check if directory-wide content lease/cap is valid.
+ */
+static int dir_lease_is_valid(struct inode *dir, struct dentry *dentry)
+{
+        struct ceph_inode_info *ci = ceph_inode(dir);
+        struct ceph_dentry_info *di = ceph_dentry(dentry);
+        int valid = 0;
+
+        spin_lock(&dir->i_lock);
+        if (ci->i_shared_gen == di->lease_shared_gen)
+                valid = __ceph_caps_issued_mask(ci, CEPH_CAP_FILE_SHARED, 1);
+        spin_unlock(&dir->i_lock);
+        dout("dir_lease_is_valid dir %p v%u dentry %p v%u = %d\n",
+             dir, (unsigned)ci->i_shared_gen, dentry,
+             (unsigned)di->lease_shared_gen, valid);
+        return valid;
+}
+
+/*
+ * Check if cached dentry can be trusted.
+ */
+static int ceph_d_revalidate(struct dentry *dentry, struct nameidata *nd)
+{
+        struct inode *dir = dentry->d_parent->d_inode;
+
+        dout("d_revalidate %p '%.*s' inode %p\n", dentry,
+             dentry->d_name.len, dentry->d_name.name, dentry->d_inode);
+
+        /* always trust cached snapped dentries, snapdir dentry */
+        if (ceph_snap(dir) != CEPH_NOSNAP) {
+                dout("d_revalidate %p '%.*s' inode %p is SNAPPED\n", dentry,
+                     dentry->d_name.len, dentry->d_name.name, dentry->d_inode);
+                goto out_touch;
+        }
+        if (dentry->d_inode && ceph_snap(dentry->d_inode) == CEPH_SNAPDIR)
+                goto out_touch;
+
+        if (dentry_lease_is_valid(dentry) ||
+            dir_lease_is_valid(dir, dentry))
+                goto out_touch;
+
+        dout("d_revalidate %p invalid\n", dentry);
+        d_drop(dentry);
+        return 0;
+out_touch:
+        ceph_dentry_lru_touch(dentry);
+        return 1;
+}
+
+/*
+ * When a dentry is released, clear the dir I_COMPLETE if it was part
+ * of the current dir gen.
+ */
+static void ceph_dentry_release(struct dentry *dentry)
+{
+        struct ceph_dentry_info *di = ceph_dentry(dentry);
+        struct inode *parent_inode = dentry->d_parent->d_inode;
+
+        if (parent_inode) {
+                struct ceph_inode_info *ci = ceph_inode(parent_inode);
+
+                spin_lock(&parent_inode->i_lock);
+                if (ci->i_shared_gen == di->lease_shared_gen) {
+                        dout(" clearing %p complete (d_release)\n",
+                             parent_inode);
+                        ci->i_ceph_flags &= ~CEPH_I_COMPLETE;
+                        ci->i_release_count++;
+                }
+                spin_unlock(&parent_inode->i_lock);
+        }
+        if (di) {
+                ceph_dentry_lru_del(dentry);
+                if (di->lease_session)
+                        ceph_put_mds_session(di->lease_session);
+                kmem_cache_free(ceph_dentry_cachep, di);
+                dentry->d_fsdata = NULL;
+        }
+}
+
+static int ceph_snapdir_d_revalidate(struct dentry *dentry,
+                                          struct nameidata *nd)
+{
+        /*
+         * Eventually, we'll want to revalidate snapped metadata
+         * too... probably...
+         */
+        return 1;
+}
+
+
+
+/*
+ * read() on a dir.  This weird interface hack only works if mounted
+ * with '-o dirstat'.
+ */
+static ssize_t ceph_read_dir(struct file *file, char __user *buf, size_t size,
+                             loff_t *ppos)
+{
+        struct ceph_file_info *cf = file->private_data;
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int left;
+
+        if (!ceph_test_opt(ceph_client(inode->i_sb), DIRSTAT))
+                return -EISDIR;
+
+        if (!cf->dir_info) {
+                cf->dir_info = kmalloc(1024, GFP_NOFS);
+                if (!cf->dir_info)
+                        return -ENOMEM;
+                cf->dir_info_len =
+                        sprintf(cf->dir_info,
+                                "entries:   %20lld\n"
+                                " files:    %20lld\n"
+                                " subdirs:  %20lld\n"
+                                "rentries:  %20lld\n"
+                                " rfiles:   %20lld\n"
+                                " rsubdirs: %20lld\n"
+                                "rbytes:    %20lld\n"
+                                "rctime:    %10ld.%09ld\n",
+                                ci->i_files + ci->i_subdirs,
+                                ci->i_files,
+                                ci->i_subdirs,
+                                ci->i_rfiles + ci->i_rsubdirs,
+                                ci->i_rfiles,
+                                ci->i_rsubdirs,
+                                ci->i_rbytes,
+                                (long)ci->i_rctime.tv_sec,
+                                (long)ci->i_rctime.tv_nsec);
+        }
+
+        if (*ppos >= cf->dir_info_len)
+                return 0;
+        size = min_t(unsigned, size, cf->dir_info_len-*ppos);
+        left = copy_to_user(buf, cf->dir_info + *ppos, size);
+        if (left == size)
+                return -EFAULT;
+        *ppos += (size - left);
+        return size - left;
+}
+
+/*
+ * an fsync() on a dir will wait for any uncommitted directory
+ * operations to commit.
+ */
+static int ceph_dir_fsync(struct file *file, struct dentry *dentry,
+                          int datasync)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct list_head *head = &ci->i_unsafe_dirops;
+        struct ceph_mds_request *req;
+        u64 last_tid;
+        int ret = 0;
+
+        dout("dir_fsync %p\n", inode);
+        spin_lock(&ci->i_unsafe_lock);
+        if (list_empty(head))
+                goto out;
+
+        req = list_entry(head->prev,
+                         struct ceph_mds_request, r_unsafe_dir_item);
+        last_tid = req->r_tid;
+
+        do {
+                ceph_mdsc_get_request(req);
+                spin_unlock(&ci->i_unsafe_lock);
+                dout("dir_fsync %p wait on tid %llu (until %llu)\n",
+                     inode, req->r_tid, last_tid);
+                if (req->r_timeout) {
+                        ret = wait_for_completion_timeout(
+                                &req->r_safe_completion, req->r_timeout);
+                        if (ret > 0)
+                                ret = 0;
+                        else if (ret == 0)
+                                ret = -EIO;  /* timed out */
+                } else {
+                        wait_for_completion(&req->r_safe_completion);
+                }
+                spin_lock(&ci->i_unsafe_lock);
+                ceph_mdsc_put_request(req);
+
+                if (ret || list_empty(head))
+                        break;
+                req = list_entry(head->next,
+                                 struct ceph_mds_request, r_unsafe_dir_item);
+        } while (req->r_tid < last_tid);
+out:
+        spin_unlock(&ci->i_unsafe_lock);
+        return ret;
+}
+
+/*
+ * We maintain a private dentry LRU.
+ *
+ * FIXME: this needs to be changed to a per-mds lru to be useful.
+ */
+void ceph_dentry_lru_add(struct dentry *dn)
+{
+        struct ceph_dentry_info *di = ceph_dentry(dn);
+        struct ceph_mds_client *mdsc;
+
+        dout("dentry_lru_add %p %p '%.*s'\n", di, dn,
+             dn->d_name.len, dn->d_name.name);
+        if (di) {
+                mdsc = &ceph_client(dn->d_sb)->mdsc;
+                spin_lock(&mdsc->dentry_lru_lock);
+                list_add_tail(&di->lru, &mdsc->dentry_lru);
+                mdsc->num_dentry++;
+                spin_unlock(&mdsc->dentry_lru_lock);
+        }
+}
+
+void ceph_dentry_lru_touch(struct dentry *dn)
+{
+        struct ceph_dentry_info *di = ceph_dentry(dn);
+        struct ceph_mds_client *mdsc;
+
+        dout("dentry_lru_touch %p %p '%.*s'\n", di, dn,
+             dn->d_name.len, dn->d_name.name);
+        if (di) {
+                mdsc = &ceph_client(dn->d_sb)->mdsc;
+                spin_lock(&mdsc->dentry_lru_lock);
+                list_move_tail(&di->lru, &mdsc->dentry_lru);
+                spin_unlock(&mdsc->dentry_lru_lock);
+        }
+}
+
+void ceph_dentry_lru_del(struct dentry *dn)
+{
+        struct ceph_dentry_info *di = ceph_dentry(dn);
+        struct ceph_mds_client *mdsc;
+
+        dout("dentry_lru_del %p %p '%.*s'\n", di, dn,
+             dn->d_name.len, dn->d_name.name);
+        if (di) {
+                mdsc = &ceph_client(dn->d_sb)->mdsc;
+                spin_lock(&mdsc->dentry_lru_lock);
+                list_del_init(&di->lru);
+                mdsc->num_dentry--;
+                spin_unlock(&mdsc->dentry_lru_lock);
+        }
+}
+
+const struct file_operations ceph_dir_fops = {
+        .read = ceph_read_dir,
+        .readdir = ceph_readdir,
+        .llseek = ceph_dir_llseek,
+        .open = ceph_open,
+        .release = ceph_release,
+        .unlocked_ioctl = ceph_ioctl,
+        .fsync = ceph_dir_fsync,
+};
+
+const struct inode_operations ceph_dir_iops = {
+        .lookup = ceph_lookup,
+        .permission = ceph_permission,
+        .getattr = ceph_getattr,
+        .setattr = ceph_setattr,
+        .setxattr = ceph_setxattr,
+        .getxattr = ceph_getxattr,
+        .listxattr = ceph_listxattr,
+        .removexattr = ceph_removexattr,
+        .mknod = ceph_mknod,
+        .symlink = ceph_symlink,
+        .mkdir = ceph_mkdir,
+        .link = ceph_link,
+        .unlink = ceph_unlink,
+        .rmdir = ceph_unlink,
+        .rename = ceph_rename,
+        .create = ceph_create,
+};
+
+struct dentry_operations ceph_dentry_ops = {
+        .d_revalidate = ceph_d_revalidate,
+        .d_release = ceph_dentry_release,
+};
+
+struct dentry_operations ceph_snapdir_dentry_ops = {
+        .d_revalidate = ceph_snapdir_d_revalidate,
+};
+
+struct dentry_operations ceph_snap_dentry_ops = {
+};
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
new file mode 100644
index 000000000000..9d67572fb328
--- /dev/null
+++ b/fs/ceph/export.c
@@ -0,0 +1,224 @@
+#include "ceph_debug.h"
+
+#include <linux/exportfs.h>
+#include <linux/slab.h>
+#include <asm/unaligned.h>
+
+#include "super.h"
+
+/*
+ * NFS export support
+ *
+ * NFS re-export of a ceph mount is, at present, only semireliable.
+ * The basic issue is that the Ceph architectures doesn't lend itself
+ * well to generating filehandles that will remain valid forever.
+ *
+ * So, we do our best.  If you're lucky, your inode will be in the
+ * client's cache.  If it's not, and you have a connectable fh, then
+ * the MDS server may be able to find it for you.  Otherwise, you get
+ * ESTALE.
+ *
+ * There are ways to this more reliable, but in the non-connectable fh
+ * case, we won't every work perfectly, and in the connectable case,
+ * some changes are needed on the MDS side to work better.
+ */
+
+/*
+ * Basic fh
+ */
+struct ceph_nfs_fh {
+        u64 ino;
+} __attribute__ ((packed));
+
+/*
+ * Larger 'connectable' fh that includes parent ino and name hash.
+ * Use this whenever possible, as it works more reliably.
+ */
+struct ceph_nfs_confh {
+        u64 ino, parent_ino;
+        u32 parent_name_hash;
+} __attribute__ ((packed));
+
+static int ceph_encode_fh(struct dentry *dentry, u32 *rawfh, int *max_len,
+                          int connectable)
+{
+        struct ceph_nfs_fh *fh = (void *)rawfh;
+        struct ceph_nfs_confh *cfh = (void *)rawfh;
+        struct dentry *parent = dentry->d_parent;
+        struct inode *inode = dentry->d_inode;
+        int type;
+
+        /* don't re-export snaps */
+        if (ceph_snap(inode) != CEPH_NOSNAP)
+                return -EINVAL;
+
+        if (*max_len >= sizeof(*cfh)) {
+                dout("encode_fh %p connectable\n", dentry);
+                cfh->ino = ceph_ino(dentry->d_inode);
+                cfh->parent_ino = ceph_ino(parent->d_inode);
+                cfh->parent_name_hash = parent->d_name.hash;
+                *max_len = sizeof(*cfh);
+                type = 2;
+        } else if (*max_len > sizeof(*fh)) {
+                if (connectable)
+                        return -ENOSPC;
+                dout("encode_fh %p\n", dentry);
+                fh->ino = ceph_ino(dentry->d_inode);
+                *max_len = sizeof(*fh);
+                type = 1;
+        } else {
+                return -ENOSPC;
+        }
+        return type;
+}
+
+/*
+ * convert regular fh to dentry
+ *
+ * FIXME: we should try harder by querying the mds for the ino.
+ */
+static struct dentry *__fh_to_dentry(struct super_block *sb,
+                                     struct ceph_nfs_fh *fh)
+{
+        struct inode *inode;
+        struct dentry *dentry;
+        struct ceph_vino vino;
+        int err;
+
+        dout("__fh_to_dentry %llx\n", fh->ino);
+        vino.ino = fh->ino;
+        vino.snap = CEPH_NOSNAP;
+        inode = ceph_find_inode(sb, vino);
+        if (!inode)
+                return ERR_PTR(-ESTALE);
+
+        dentry = d_obtain_alias(inode);
+        if (!dentry) {
+                pr_err("fh_to_dentry %llx -- inode %p but ENOMEM\n",
+                       fh->ino, inode);
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        err = ceph_init_dentry(dentry);
+
+        if (err < 0) {
+                iput(inode);
+                return ERR_PTR(err);
+        }
+        dout("__fh_to_dentry %llx %p dentry %p\n", fh->ino, inode, dentry);
+        return dentry;
+}
+
+/*
+ * convert connectable fh to dentry
+ */
+static struct dentry *__cfh_to_dentry(struct super_block *sb,
+                                      struct ceph_nfs_confh *cfh)
+{
+        struct ceph_mds_client *mdsc = &ceph_client(sb)->mdsc;
+        struct inode *inode;
+        struct dentry *dentry;
+        struct ceph_vino vino;
+        int err;
+
+        dout("__cfh_to_dentry %llx (%llx/%x)\n",
+             cfh->ino, cfh->parent_ino, cfh->parent_name_hash);
+
+        vino.ino = cfh->ino;
+        vino.snap = CEPH_NOSNAP;
+        inode = ceph_find_inode(sb, vino);
+        if (!inode) {
+                struct ceph_mds_request *req;
+
+                req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_LOOKUPHASH,
+                                               USE_ANY_MDS);
+                if (IS_ERR(req))
+                        return ERR_PTR(PTR_ERR(req));
+
+                req->r_ino1 = vino;
+                req->r_ino2.ino = cfh->parent_ino;
+                req->r_ino2.snap = CEPH_NOSNAP;
+                req->r_path2 = kmalloc(16, GFP_NOFS);
+                snprintf(req->r_path2, 16, "%d", cfh->parent_name_hash);
+                req->r_num_caps = 1;
+                err = ceph_mdsc_do_request(mdsc, NULL, req);
+                ceph_mdsc_put_request(req);
+                inode = ceph_find_inode(sb, vino);
+                if (!inode)
+                        return ERR_PTR(err ? err : -ESTALE);
+        }
+
+        dentry = d_obtain_alias(inode);
+        if (!dentry) {
+                pr_err("cfh_to_dentry %llx -- inode %p but ENOMEM\n",
+                       cfh->ino, inode);
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        err = ceph_init_dentry(dentry);
+        if (err < 0) {
+                iput(inode);
+                return ERR_PTR(err);
+        }
+        dout("__cfh_to_dentry %llx %p dentry %p\n", cfh->ino, inode, dentry);
+        return dentry;
+}
+
+static struct dentry *ceph_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                                        int fh_len, int fh_type)
+{
+        if (fh_type == 1)
+                return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw);
+        else
+                return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw);
+}
+
+/*
+ * get parent, if possible.
+ *
+ * FIXME: we could do better by querying the mds to discover the
+ * parent.
+ */
+static struct dentry *ceph_fh_to_parent(struct super_block *sb,
+                                         struct fid *fid,
+                                        int fh_len, int fh_type)
+{
+        struct ceph_nfs_confh *cfh = (void *)fid->raw;
+        struct ceph_vino vino;
+        struct inode *inode;
+        struct dentry *dentry;
+        int err;
+
+        if (fh_type == 1)
+                return ERR_PTR(-ESTALE);
+
+        pr_debug("fh_to_parent %llx/%d\n", cfh->parent_ino,
+                 cfh->parent_name_hash);
+
+        vino.ino = cfh->ino;
+        vino.snap = CEPH_NOSNAP;
+        inode = ceph_find_inode(sb, vino);
+        if (!inode)
+                return ERR_PTR(-ESTALE);
+
+        dentry = d_obtain_alias(inode);
+        if (!dentry) {
+                pr_err("fh_to_parent %llx -- inode %p but ENOMEM\n",
+                       cfh->ino, inode);
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        err = ceph_init_dentry(dentry);
+        if (err < 0) {
+                iput(inode);
+                return ERR_PTR(err);
+        }
+        dout("fh_to_parent %llx %p dentry %p\n", cfh->ino, inode, dentry);
+        return dentry;
+}
+
+const struct export_operations ceph_export_ops = {
+        .encode_fh = ceph_encode_fh,
+        .fh_to_dentry = ceph_fh_to_dentry,
+        .fh_to_parent = ceph_fh_to_parent,
+};
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
new file mode 100644
index 000000000000..4add3d5da2c1
--- /dev/null
+++ b/fs/ceph/file.c
@@ -0,0 +1,938 @@
+#include "ceph_debug.h"
+
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/file.h>
+#include <linux/namei.h>
+#include <linux/writeback.h>
+
+#include "super.h"
+#include "mds_client.h"
+
+/*
+ * Ceph file operations
+ *
+ * Implement basic open/close functionality, and implement
+ * read/write.
+ *
+ * We implement three modes of file I/O:
+ *  - buffered uses the generic_file_aio_{read,write} helpers
+ *
+ *  - synchronous is used when there is multi-client read/write
+ *    sharing, avoids the page cache, and synchronously waits for an
+ *    ack from the OSD.
+ *
+ *  - direct io takes the variant of the sync path that references
+ *    user pages directly.
+ *
+ * fsync() flushes and waits on dirty pages, but just queues metadata
+ * for writeback: since the MDS can recover size and mtime there is no
+ * need to wait for MDS acknowledgement.
+ */
+
+
+/*
+ * Prepare an open request.  Preallocate ceph_cap to avoid an
+ * inopportune ENOMEM later.
+ */
+static struct ceph_mds_request *
+prepare_open_request(struct super_block *sb, int flags, int create_mode)
+{
+        struct ceph_client *client = ceph_sb_to_client(sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int want_auth = USE_ANY_MDS;
+        int op = (flags & O_CREAT) ? CEPH_MDS_OP_CREATE : CEPH_MDS_OP_OPEN;
+
+        if (flags & (O_WRONLY|O_RDWR|O_CREAT|O_TRUNC))
+                want_auth = USE_AUTH_MDS;
+
+        req = ceph_mdsc_create_request(mdsc, op, want_auth);
+        if (IS_ERR(req))
+                goto out;
+        req->r_fmode = ceph_flags_to_mode(flags);
+        req->r_args.open.flags = cpu_to_le32(flags);
+        req->r_args.open.mode = cpu_to_le32(create_mode);
+        req->r_args.open.preferred = cpu_to_le32(-1);
+out:
+        return req;
+}
+
+/*
+ * initialize private struct file data.
+ * if we fail, clean up by dropping fmode reference on the ceph_inode
+ */
+static int ceph_init_file(struct inode *inode, struct file *file, int fmode)
+{
+        struct ceph_file_info *cf;
+        int ret = 0;
+
+        switch (inode->i_mode & S_IFMT) {
+        case S_IFREG:
+        case S_IFDIR:
+                dout("init_file %p %p 0%o (regular)\n", inode, file,
+                     inode->i_mode);
+                cf = kmem_cache_alloc(ceph_file_cachep, GFP_NOFS | __GFP_ZERO);
+                if (cf == NULL) {
+                        ceph_put_fmode(ceph_inode(inode), fmode); /* clean up */
+                        return -ENOMEM;
+                }
+                cf->fmode = fmode;
+                cf->next_offset = 2;
+                file->private_data = cf;
+                BUG_ON(inode->i_fop->release != ceph_release);
+                break;
+
+        case S_IFLNK:
+                dout("init_file %p %p 0%o (symlink)\n", inode, file,
+                     inode->i_mode);
+                ceph_put_fmode(ceph_inode(inode), fmode); /* clean up */
+                break;
+
+        default:
+                dout("init_file %p %p 0%o (special)\n", inode, file,
+                     inode->i_mode);
+                /*
+                 * we need to drop the open ref now, since we don't
+                 * have .release set to ceph_release.
+                 */
+                ceph_put_fmode(ceph_inode(inode), fmode); /* clean up */
+                BUG_ON(inode->i_fop->release == ceph_release);
+
+                /* call the proper open fop */
+                ret = inode->i_fop->open(inode, file);
+        }
+        return ret;
+}
+
+/*
+ * If the filp already has private_data, that means the file was
+ * already opened by intent during lookup, and we do nothing.
+ *
+ * If we already have the requisite capabilities, we can satisfy
+ * the open request locally (no need to request new caps from the
+ * MDS).  We do, however, need to inform the MDS (asynchronously)
+ * if our wanted caps set expands.
+ */
+int ceph_open(struct inode *inode, struct file *file)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_client *client = ceph_sb_to_client(inode->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        struct ceph_file_info *cf = file->private_data;
+        struct inode *parent_inode = file->f_dentry->d_parent->d_inode;
+        int err;
+        int flags, fmode, wanted;
+
+        if (cf) {
+                dout("open file %p is already opened\n", file);
+                return 0;
+        }
+
+        /* filter out O_CREAT|O_EXCL; vfs did that already.  yuck. */
+        flags = file->f_flags & ~(O_CREAT|O_EXCL);
+        if (S_ISDIR(inode->i_mode))
+                flags = O_DIRECTORY;  /* mds likes to know */
+
+        dout("open inode %p ino %llx.%llx file %p flags %d (%d)\n", inode,
+             ceph_vinop(inode), file, flags, file->f_flags);
+        fmode = ceph_flags_to_mode(flags);
+        wanted = ceph_caps_for_mode(fmode);
+
+        /* snapped files are read-only */
+        if (ceph_snap(inode) != CEPH_NOSNAP && (file->f_mode & FMODE_WRITE))
+                return -EROFS;
+
+        /* trivially open snapdir */
+        if (ceph_snap(inode) == CEPH_SNAPDIR) {
+                spin_lock(&inode->i_lock);
+                __ceph_get_fmode(ci, fmode);
+                spin_unlock(&inode->i_lock);
+                return ceph_init_file(inode, file, fmode);
+        }
+
+        /*
+         * No need to block if we have any caps.  Update wanted set
+         * asynchronously.
+         */
+        spin_lock(&inode->i_lock);
+        if (__ceph_is_any_real_caps(ci)) {
+                int mds_wanted = __ceph_caps_mds_wanted(ci);
+                int issued = __ceph_caps_issued(ci, NULL);
+
+                dout("open %p fmode %d want %s issued %s using existing\n",
+                     inode, fmode, ceph_cap_string(wanted),
+                     ceph_cap_string(issued));
+                __ceph_get_fmode(ci, fmode);
+                spin_unlock(&inode->i_lock);
+
+                /* adjust wanted? */
+                if ((issued & wanted) != wanted &&
+                    (mds_wanted & wanted) != wanted &&
+                    ceph_snap(inode) != CEPH_SNAPDIR)
+                        ceph_check_caps(ci, 0, NULL);
+
+                return ceph_init_file(inode, file, fmode);
+        } else if (ceph_snap(inode) != CEPH_NOSNAP &&
+                   (ci->i_snap_caps & wanted) == wanted) {
+                __ceph_get_fmode(ci, fmode);
+                spin_unlock(&inode->i_lock);
+                return ceph_init_file(inode, file, fmode);
+        }
+        spin_unlock(&inode->i_lock);
+
+        dout("open fmode %d wants %s\n", fmode, ceph_cap_string(wanted));
+        req = prepare_open_request(inode->i_sb, flags, 0);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto out;
+        }
+        req->r_inode = igrab(inode);
+        req->r_num_caps = 1;
+        err = ceph_mdsc_do_request(mdsc, parent_inode, req);
+        if (!err)
+                err = ceph_init_file(inode, file, req->r_fmode);
+        ceph_mdsc_put_request(req);
+        dout("open result=%d on %llx.%llx\n", err, ceph_vinop(inode));
+out:
+        return err;
+}
+
+
+/*
+ * Do a lookup + open with a single request.
+ *
+ * If this succeeds, but some subsequent check in the vfs
+ * may_open() fails, the struct *file gets cleaned up (i.e.
+ * ceph_release gets called).  So fear not!
+ */
+/*
+ * flags
+ *  path_lookup_open   -> LOOKUP_OPEN
+ *  path_lookup_create -> LOOKUP_OPEN|LOOKUP_CREATE
+ */
+struct dentry *ceph_lookup_open(struct inode *dir, struct dentry *dentry,
+                                struct nameidata *nd, int mode,
+                                int locked_dir)
+{
+        struct ceph_client *client = ceph_sb_to_client(dir->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct file *file = nd->intent.open.file;
+        struct inode *parent_inode = get_dentry_parent_inode(file->f_dentry);
+        struct ceph_mds_request *req;
+        int err;
+        int flags = nd->intent.open.flags - 1;  /* silly vfs! */
+
+        dout("ceph_lookup_open dentry %p '%.*s' flags %d mode 0%o\n",
+             dentry, dentry->d_name.len, dentry->d_name.name, flags, mode);
+
+        /* do the open */
+        req = prepare_open_request(dir->i_sb, flags, mode);
+        if (IS_ERR(req))
+                return ERR_PTR(PTR_ERR(req));
+        req->r_dentry = dget(dentry);
+        req->r_num_caps = 2;
+        if (flags & O_CREAT) {
+                req->r_dentry_drop = CEPH_CAP_FILE_SHARED;
+                req->r_dentry_unless = CEPH_CAP_FILE_EXCL;
+        }
+        req->r_locked_dir = dir;           /* caller holds dir->i_mutex */
+        err = ceph_mdsc_do_request(mdsc, parent_inode, req);
+        dentry = ceph_finish_lookup(req, dentry, err);
+        if (!err && (flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
+                err = ceph_handle_notrace_create(dir, dentry);
+        if (!err)
+                err = ceph_init_file(req->r_dentry->d_inode, file,
+                                     req->r_fmode);
+        ceph_mdsc_put_request(req);
+        dout("ceph_lookup_open result=%p\n", dentry);
+        return dentry;
+}
+
+int ceph_release(struct inode *inode, struct file *file)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_file_info *cf = file->private_data;
+
+        dout("release inode %p file %p\n", inode, file);
+        ceph_put_fmode(ci, cf->fmode);
+        if (cf->last_readdir)
+                ceph_mdsc_put_request(cf->last_readdir);
+        kfree(cf->last_name);
+        kfree(cf->dir_info);
+        dput(cf->dentry);
+        kmem_cache_free(ceph_file_cachep, cf);
+
+        /* wake up anyone waiting for caps on this inode */
+        wake_up(&ci->i_cap_wq);
+        return 0;
+}
+
+/*
+ * build a vector of user pages
+ */
+static struct page **get_direct_page_vector(const char __user *data,
+                                            int num_pages,
+                                            loff_t off, size_t len)
+{
+        struct page **pages;
+        int rc;
+
+        pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
+
+        down_read(&current->mm->mmap_sem);
+        rc = get_user_pages(current, current->mm, (unsigned long)data,
+                            num_pages, 0, 0, pages, NULL);
+        up_read(&current->mm->mmap_sem);
+        if (rc < 0)
+                goto fail;
+        return pages;
+
+fail:
+        kfree(pages);
+        return ERR_PTR(rc);
+}
+
+static void put_page_vector(struct page **pages, int num_pages)
+{
+        int i;
+
+        for (i = 0; i < num_pages; i++)
+                put_page(pages[i]);
+        kfree(pages);
+}
+
+void ceph_release_page_vector(struct page **pages, int num_pages)
+{
+        int i;
+
+        for (i = 0; i < num_pages; i++)
+                __free_pages(pages[i], 0);
+        kfree(pages);
+}
+
+/*
+ * allocate a vector new pages
+ */
+static struct page **alloc_page_vector(int num_pages)
+{
+        struct page **pages;
+        int i;
+
+        pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
+        for (i = 0; i < num_pages; i++) {
+                pages[i] = alloc_page(GFP_NOFS);
+                if (pages[i] == NULL) {
+                        ceph_release_page_vector(pages, i);
+                        return ERR_PTR(-ENOMEM);
+                }
+        }
+        return pages;
+}
+
+/*
+ * copy user data into a page vector
+ */
+static int copy_user_to_page_vector(struct page **pages,
+                                    const char __user *data,
+                                    loff_t off, size_t len)
+{
+        int i = 0;
+        int po = off & ~PAGE_CACHE_MASK;
+        int left = len;
+        int l, bad;
+
+        while (left > 0) {
+                l = min_t(int, PAGE_CACHE_SIZE-po, left);
+                bad = copy_from_user(page_address(pages[i]) + po, data, l);
+                if (bad == l)
+                        return -EFAULT;
+                data += l - bad;
+                left -= l - bad;
+                po += l - bad;
+                if (po == PAGE_CACHE_SIZE) {
+                        po = 0;
+                        i++;
+                }
+        }
+        return len;
+}
+
+/*
+ * copy user data from a page vector into a user pointer
+ */
+static int copy_page_vector_to_user(struct page **pages, char __user *data,
+                                    loff_t off, size_t len)
+{
+        int i = 0;
+        int po = off & ~PAGE_CACHE_MASK;
+        int left = len;
+        int l, bad;
+
+        while (left > 0) {
+                l = min_t(int, left, PAGE_CACHE_SIZE-po);
+                bad = copy_to_user(data, page_address(pages[i]) + po, l);
+                if (bad == l)
+                        return -EFAULT;
+                data += l - bad;
+                left -= l - bad;
+                if (po) {
+                        po += l - bad;
+                        if (po == PAGE_CACHE_SIZE)
+                                po = 0;
+                }
+                i++;
+        }
+        return len;
+}
+
+/*
+ * Zero an extent within a page vector.  Offset is relative to the
+ * start of the first page.
+ */
+static void zero_page_vector_range(int off, int len, struct page **pages)
+{
+        int i = off >> PAGE_CACHE_SHIFT;
+
+        off &= ~PAGE_CACHE_MASK;
+
+        dout("zero_page_vector_page %u~%u\n", off, len);
+
+        /* leading partial page? */
+        if (off) {
+                int end = min((int)PAGE_CACHE_SIZE, off + len);
+                dout("zeroing %d %p head from %d\n", i, pages[i],
+                     (int)off);
+                zero_user_segment(pages[i], off, end);
+                len -= (end - off);
+                i++;
+        }
+        while (len >= PAGE_CACHE_SIZE) {
+                dout("zeroing %d %p len=%d\n", i, pages[i], len);
+                zero_user_segment(pages[i], 0, PAGE_CACHE_SIZE);
+                len -= PAGE_CACHE_SIZE;
+                i++;
+        }
+        /* trailing partial page? */
+        if (len) {
+                dout("zeroing %d %p tail to %d\n", i, pages[i], (int)len);
+                zero_user_segment(pages[i], 0, len);
+        }
+}
+
+
+/*
+ * Read a range of bytes striped over one or more objects.  Iterate over
+ * objects we stripe over.  (That's not atomic, but good enough for now.)
+ *
+ * If we get a short result from the OSD, check against i_size; we need to
+ * only return a short read to the caller if we hit EOF.
+ */
+static int striped_read(struct inode *inode,
+                        u64 off, u64 len,
+                        struct page **pages, int num_pages,
+                        int *checkeof)
+{
+        struct ceph_client *client = ceph_inode_to_client(inode);
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        u64 pos, this_len;
+        int page_off = off & ~PAGE_CACHE_MASK; /* first byte's offset in page */
+        int left, pages_left;
+        int read;
+        struct page **page_pos;
+        int ret;
+        bool hit_stripe, was_short;
+
+        /*
+         * we may need to do multiple reads.  not atomic, unfortunately.
+         */
+        pos = off;
+        left = len;
+        page_pos = pages;
+        pages_left = num_pages;
+        read = 0;
+
+more:
+        this_len = left;
+        ret = ceph_osdc_readpages(&client->osdc, ceph_vino(inode),
+                                  &ci->i_layout, pos, &this_len,
+                                  ci->i_truncate_seq,
+                                  ci->i_truncate_size,
+                                  page_pos, pages_left);
+        hit_stripe = this_len < left;
+        was_short = ret >= 0 && ret < this_len;
+        if (ret == -ENOENT)
+                ret = 0;
+        dout("striped_read %llu~%u (read %u) got %d%s%s\n", pos, left, read,
+             ret, hit_stripe ? " HITSTRIPE" : "", was_short ? " SHORT" : "");
+
+        if (ret > 0) {
+                int didpages =
+                        ((pos & ~PAGE_CACHE_MASK) + ret) >> PAGE_CACHE_SHIFT;
+
+                if (read < pos - off) {
+                        dout(" zero gap %llu to %llu\n", off + read, pos);
+                        zero_page_vector_range(page_off + read,
+                                               pos - off - read, pages);
+                }
+                pos += ret;
+                read = pos - off;
+                left -= ret;
+                page_pos += didpages;
+                pages_left -= didpages;
+
+                /* hit stripe? */
+                if (left && hit_stripe)
+                        goto more;
+        }
+
+        if (was_short) {
+                /* was original extent fully inside i_size? */
+                if (pos + left <= inode->i_size) {
+                        dout("zero tail\n");
+                        zero_page_vector_range(page_off + read, len - read,
+                                               pages);
+                        read = len;
+                        goto out;
+                }
+
+                /* check i_size */
+                *checkeof = 1;
+        }
+
+out:
+        if (ret >= 0)
+                ret = read;
+        dout("striped_read returns %d\n", ret);
+        return ret;
+}
+
+/*
+ * Completely synchronous read and write methods.  Direct from __user
+ * buffer to osd, or directly to user pages (if O_DIRECT).
+ *
+ * If the read spans object boundary, just do multiple reads.
+ */
+static ssize_t ceph_sync_read(struct file *file, char __user *data,
+                              unsigned len, loff_t *poff, int *checkeof)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct page **pages;
+        u64 off = *poff;
+        int num_pages = calc_pages_for(off, len);
+        int ret;
+
+        dout("sync_read on file %p %llu~%u %s\n", file, off, len,
+             (file->f_flags & O_DIRECT) ? "O_DIRECT" : "");
+
+        if (file->f_flags & O_DIRECT) {
+                pages = get_direct_page_vector(data, num_pages, off, len);
+
+                /*
+                 * flush any page cache pages in this range.  this
+                 * will make concurrent normal and O_DIRECT io slow,
+                 * but it will at least behave sensibly when they are
+                 * in sequence.
+                 */
+        } else {
+                pages = alloc_page_vector(num_pages);
+        }
+        if (IS_ERR(pages))
+                return PTR_ERR(pages);
+
+        ret = filemap_write_and_wait(inode->i_mapping);
+        if (ret < 0)
+                goto done;
+
+        ret = striped_read(inode, off, len, pages, num_pages, checkeof);
+
+        if (ret >= 0 && (file->f_flags & O_DIRECT) == 0)
+                ret = copy_page_vector_to_user(pages, data, off, ret);
+        if (ret >= 0)
+                *poff = off + ret;
+
+done:
+        if (file->f_flags & O_DIRECT)
+                put_page_vector(pages, num_pages);
+        else
+                ceph_release_page_vector(pages, num_pages);
+        dout("sync_read result %d\n", ret);
+        return ret;
+}
+
+/*
+ * Write commit callback, called if we requested both an ACK and
+ * ONDISK commit reply from the OSD.
+ */
+static void sync_write_commit(struct ceph_osd_request *req,
+                              struct ceph_msg *msg)
+{
+        struct ceph_inode_info *ci = ceph_inode(req->r_inode);
+
+        dout("sync_write_commit %p tid %llu\n", req, req->r_tid);
+        spin_lock(&ci->i_unsafe_lock);
+        list_del_init(&req->r_unsafe_item);
+        spin_unlock(&ci->i_unsafe_lock);
+        ceph_put_cap_refs(ci, CEPH_CAP_FILE_WR);
+}
+
+/*
+ * Synchronous write, straight from __user pointer or user pages (if
+ * O_DIRECT).
+ *
+ * If write spans object boundary, just do multiple writes.  (For a
+ * correct atomic write, we should e.g. take write locks on all
+ * objects, rollback on failure, etc.)
+ */
+static ssize_t ceph_sync_write(struct file *file, const char __user *data,
+                               size_t left, loff_t *offset)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_client *client = ceph_inode_to_client(inode);
+        struct ceph_osd_request *req;
+        struct page **pages;
+        int num_pages;
+        long long unsigned pos;
+        u64 len;
+        int written = 0;
+        int flags;
+        int do_sync = 0;
+        int check_caps = 0;
+        int ret;
+        struct timespec mtime = CURRENT_TIME;
+
+        if (ceph_snap(file->f_dentry->d_inode) != CEPH_NOSNAP)
+                return -EROFS;
+
+        dout("sync_write on file %p %lld~%u %s\n", file, *offset,
+             (unsigned)left, (file->f_flags & O_DIRECT) ? "O_DIRECT" : "");
+
+        if (file->f_flags & O_APPEND)
+                pos = i_size_read(inode);
+        else
+                pos = *offset;
+
+        ret = filemap_write_and_wait_range(inode->i_mapping, pos, pos + left);
+        if (ret < 0)
+                return ret;
+
+        ret = invalidate_inode_pages2_range(inode->i_mapping,
+                                            pos >> PAGE_CACHE_SHIFT,
+                                            (pos + left) >> PAGE_CACHE_SHIFT);
+        if (ret < 0)
+                dout("invalidate_inode_pages2_range returned %d\n", ret);
+
+        flags = CEPH_OSD_FLAG_ORDERSNAP |
+                CEPH_OSD_FLAG_ONDISK |
+                CEPH_OSD_FLAG_WRITE;
+        if ((file->f_flags & (O_SYNC|O_DIRECT)) == 0)
+                flags |= CEPH_OSD_FLAG_ACK;
+        else
+                do_sync = 1;
+
+        /*
+         * we may need to do multiple writes here if we span an object
+         * boundary.  this isn't atomic, unfortunately.  :(
+         */
+more:
+        len = left;
+        req = ceph_osdc_new_request(&client->osdc, &ci->i_layout,
+                                    ceph_vino(inode), pos, &len,
+                                    CEPH_OSD_OP_WRITE, flags,
+                                    ci->i_snap_realm->cached_context,
+                                    do_sync,
+                                    ci->i_truncate_seq, ci->i_truncate_size,
+                                    &mtime, false, 2);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+
+        num_pages = calc_pages_for(pos, len);
+
+        if (file->f_flags & O_DIRECT) {
+                pages = get_direct_page_vector(data, num_pages, pos, len);
+                if (IS_ERR(pages)) {
+                        ret = PTR_ERR(pages);
+                        goto out;
+                }
+
+                /*
+                 * throw out any page cache pages in this range. this
+                 * may block.
+                 */
+                truncate_inode_pages_range(inode->i_mapping, pos, pos+len);
+        } else {
+                pages = alloc_page_vector(num_pages);
+                if (IS_ERR(pages)) {
+                        ret = PTR_ERR(pages);
+                        goto out;
+                }
+                ret = copy_user_to_page_vector(pages, data, pos, len);
+                if (ret < 0) {
+                        ceph_release_page_vector(pages, num_pages);
+                        goto out;
+                }
+
+                if ((file->f_flags & O_SYNC) == 0) {
+                        /* get a second commit callback */
+                        req->r_safe_callback = sync_write_commit;
+                        req->r_own_pages = 1;
+                }
+        }
+        req->r_pages = pages;
+        req->r_num_pages = num_pages;
+        req->r_inode = inode;
+
+        ret = ceph_osdc_start_request(&client->osdc, req, false);
+        if (!ret) {
+                if (req->r_safe_callback) {
+                        /*
+                         * Add to inode unsafe list only after we
+                         * start_request so that a tid has been assigned.
+                         */
+                        spin_lock(&ci->i_unsafe_lock);
+                        list_add(&ci->i_unsafe_writes, &req->r_unsafe_item);
+                        spin_unlock(&ci->i_unsafe_lock);
+                        ceph_get_cap_refs(ci, CEPH_CAP_FILE_WR);
+                }
+                ret = ceph_osdc_wait_request(&client->osdc, req);
+        }
+
+        if (file->f_flags & O_DIRECT)
+                put_page_vector(pages, num_pages);
+        else if (file->f_flags & O_SYNC)
+                ceph_release_page_vector(pages, num_pages);
+
+out:
+        ceph_osdc_put_request(req);
+        if (ret == 0) {
+                pos += len;
+                written += len;
+                left -= len;
+                if (left)
+                        goto more;
+
+                ret = written;
+                *offset = pos;
+                if (pos > i_size_read(inode))
+                        check_caps = ceph_inode_set_size(inode, pos);
+                if (check_caps)
+                        ceph_check_caps(ceph_inode(inode), CHECK_CAPS_AUTHONLY,
+                                        NULL);
+        }
+        return ret;
+}
+
+/*
+ * Wrap generic_file_aio_read with checks for cap bits on the inode.
+ * Atomically grab references, so that those bits are not released
+ * back to the MDS mid-read.
+ *
+ * Hmm, the sync read case isn't actually async... should it be?
+ */
+static ssize_t ceph_aio_read(struct kiocb *iocb, const struct iovec *iov,
+                             unsigned long nr_segs, loff_t pos)
+{
+        struct file *filp = iocb->ki_filp;
+        loff_t *ppos = &iocb->ki_pos;
+        size_t len = iov->iov_len;
+        struct inode *inode = filp->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        void *base = iov->iov_base;
+        ssize_t ret;
+        int got = 0;
+        int checkeof = 0, read = 0;
+
+        dout("aio_read %p %llx.%llx %llu~%u trying to get caps on %p\n",
+             inode, ceph_vinop(inode), pos, (unsigned)len, inode);
+again:
+        __ceph_do_pending_vmtruncate(inode);
+        ret = ceph_get_caps(ci, CEPH_CAP_FILE_RD, CEPH_CAP_FILE_CACHE,
+                            &got, -1);
+        if (ret < 0)
+                goto out;
+        dout("aio_read %p %llx.%llx %llu~%u got cap refs on %s\n",
+             inode, ceph_vinop(inode), pos, (unsigned)len,
+             ceph_cap_string(got));
+
+        if ((got & CEPH_CAP_FILE_CACHE) == 0 ||
+            (iocb->ki_filp->f_flags & O_DIRECT) ||
+            (inode->i_sb->s_flags & MS_SYNCHRONOUS))
+                /* hmm, this isn't really async... */
+                ret = ceph_sync_read(filp, base, len, ppos, &checkeof);
+        else
+                ret = generic_file_aio_read(iocb, iov, nr_segs, pos);
+
+out:
+        dout("aio_read %p %llx.%llx dropping cap refs on %s = %d\n",
+             inode, ceph_vinop(inode), ceph_cap_string(got), (int)ret);
+        ceph_put_cap_refs(ci, got);
+
+        if (checkeof && ret >= 0) {
+                int statret = ceph_do_getattr(inode, CEPH_STAT_CAP_SIZE);
+
+                /* hit EOF or hole? */
+                if (statret == 0 && *ppos < inode->i_size) {
+                        dout("aio_read sync_read hit hole, reading more\n");
+                        read += ret;
+                        base += ret;
+                        len -= ret;
+                        checkeof = 0;
+                        goto again;
+                }
+        }
+        if (ret >= 0)
+                ret += read;
+
+        return ret;
+}
+
+/*
+ * Take cap references to avoid releasing caps to MDS mid-write.
+ *
+ * If we are synchronous, and write with an old snap context, the OSD
+ * may return EOLDSNAPC.  In that case, retry the write.. _after_
+ * dropping our cap refs and allowing the pending snap to logically
+ * complete _before_ this write occurs.
+ *
+ * If we are near ENOSPC, write synchronously.
+ */
+static ssize_t ceph_aio_write(struct kiocb *iocb, const struct iovec *iov,
+                       unsigned long nr_segs, loff_t pos)
+{
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_osd_client *osdc = &ceph_client(inode->i_sb)->osdc;
+        loff_t endoff = pos + iov->iov_len;
+        int got = 0;
+        int ret, err;
+
+        if (ceph_snap(inode) != CEPH_NOSNAP)
+                return -EROFS;
+
+retry_snap:
+        if (ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_FULL))
+                return -ENOSPC;
+        __ceph_do_pending_vmtruncate(inode);
+        dout("aio_write %p %llx.%llx %llu~%u getting caps. i_size %llu\n",
+             inode, ceph_vinop(inode), pos, (unsigned)iov->iov_len,
+             inode->i_size);
+        ret = ceph_get_caps(ci, CEPH_CAP_FILE_WR, CEPH_CAP_FILE_BUFFER,
+                            &got, endoff);
+        if (ret < 0)
+                goto out;
+
+        dout("aio_write %p %llx.%llx %llu~%u  got cap refs on %s\n",
+             inode, ceph_vinop(inode), pos, (unsigned)iov->iov_len,
+             ceph_cap_string(got));
+
+        if ((got & CEPH_CAP_FILE_BUFFER) == 0 ||
+            (iocb->ki_filp->f_flags & O_DIRECT) ||
+            (inode->i_sb->s_flags & MS_SYNCHRONOUS)) {
+                ret = ceph_sync_write(file, iov->iov_base, iov->iov_len,
+                        &iocb->ki_pos);
+        } else {
+                ret = generic_file_aio_write(iocb, iov, nr_segs, pos);
+
+                if ((ret >= 0 || ret == -EIOCBQUEUED) &&
+                    ((file->f_flags & O_SYNC) || IS_SYNC(file->f_mapping->host)
+                     || ceph_osdmap_flag(osdc->osdmap, CEPH_OSDMAP_NEARFULL))) {
+                        err = vfs_fsync_range(file, file->f_path.dentry,
+                                              pos, pos + ret - 1, 1);
+                        if (err < 0)
+                                ret = err;
+                }
+        }
+        if (ret >= 0) {
+                spin_lock(&inode->i_lock);
+                __ceph_mark_dirty_caps(ci, CEPH_CAP_FILE_WR);
+                spin_unlock(&inode->i_lock);
+        }
+
+out:
+        dout("aio_write %p %llx.%llx %llu~%u  dropping cap refs on %s\n",
+             inode, ceph_vinop(inode), pos, (unsigned)iov->iov_len,
+             ceph_cap_string(got));
+        ceph_put_cap_refs(ci, got);
+
+        if (ret == -EOLDSNAPC) {
+                dout("aio_write %p %llx.%llx %llu~%u got EOLDSNAPC, retrying\n",
+                     inode, ceph_vinop(inode), pos, (unsigned)iov->iov_len);
+                goto retry_snap;
+        }
+
+        return ret;
+}
+
+/*
+ * llseek.  be sure to verify file size on SEEK_END.
+ */
+static loff_t ceph_llseek(struct file *file, loff_t offset, int origin)
+{
+        struct inode *inode = file->f_mapping->host;
+        int ret;
+
+        mutex_lock(&inode->i_mutex);
+        __ceph_do_pending_vmtruncate(inode);
+        switch (origin) {
+        case SEEK_END:
+                ret = ceph_do_getattr(inode, CEPH_STAT_CAP_SIZE);
+                if (ret < 0) {
+                        offset = ret;
+                        goto out;
+                }
+                offset += inode->i_size;
+                break;
+        case SEEK_CUR:
+                /*
+                 * Here we special-case the lseek(fd, 0, SEEK_CUR)
+                 * position-querying operation.  Avoid rewriting the "same"
+                 * f_pos value back to the file because a concurrent read(),
+                 * write() or lseek() might have altered it
+                 */
+                if (offset == 0) {
+                        offset = file->f_pos;
+                        goto out;
+                }
+                offset += file->f_pos;
+                break;
+        }
+
+        if (offset < 0 || offset > inode->i_sb->s_maxbytes) {
+                offset = -EINVAL;
+                goto out;
+        }
+
+        /* Special lock needed here? */
+        if (offset != file->f_pos) {
+                file->f_pos = offset;
+                file->f_version = 0;
+        }
+
+out:
+        mutex_unlock(&inode->i_mutex);
+        return offset;
+}
+
+const struct file_operations ceph_file_fops = {
+        .open = ceph_open,
+        .release = ceph_release,
+        .llseek = ceph_llseek,
+        .read = do_sync_read,
+        .write = do_sync_write,
+        .aio_read = ceph_aio_read,
+        .aio_write = ceph_aio_write,
+        .mmap = ceph_mmap,
+        .fsync = ceph_fsync,
+        .splice_read = generic_file_splice_read,
+        .splice_write = generic_file_splice_write,
+        .unlocked_ioctl = ceph_ioctl,
+        .compat_ioctl   = ceph_ioctl,
+};
+
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
new file mode 100644
index 000000000000..26f883c275e8
--- /dev/null
+++ b/fs/ceph/inode.c
@@ -0,0 +1,1774 @@
+#include "ceph_debug.h"
+
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/smp_lock.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/uaccess.h>
+#include <linux/kernel.h>
+#include <linux/namei.h>
+#include <linux/writeback.h>
+#include <linux/vmalloc.h>
+#include <linux/pagevec.h>
+
+#include "super.h"
+#include "decode.h"
+
+/*
+ * Ceph inode operations
+ *
+ * Implement basic inode helpers (get, alloc) and inode ops (getattr,
+ * setattr, etc.), xattr helpers, and helpers for assimilating
+ * metadata returned by the MDS into our cache.
+ *
+ * Also define helpers for doing asynchronous writeback, invalidation,
+ * and truncation for the benefit of those who can't afford to block
+ * (typically because they are in the message handler path).
+ */
+
+static const struct inode_operations ceph_symlink_iops;
+
+static void ceph_invalidate_work(struct work_struct *work);
+static void ceph_writeback_work(struct work_struct *work);
+static void ceph_vmtruncate_work(struct work_struct *work);
+
+/*
+ * find or create an inode, given the ceph ino number
+ */
+struct inode *ceph_get_inode(struct super_block *sb, struct ceph_vino vino)
+{
+        struct inode *inode;
+        ino_t t = ceph_vino_to_ino(vino);
+
+        inode = iget5_locked(sb, t, ceph_ino_compare, ceph_set_ino_cb, &vino);
+        if (inode == NULL)
+                return ERR_PTR(-ENOMEM);
+        if (inode->i_state & I_NEW) {
+                dout("get_inode created new inode %p %llx.%llx ino %llx\n",
+                     inode, ceph_vinop(inode), (u64)inode->i_ino);
+                unlock_new_inode(inode);
+        }
+
+        dout("get_inode on %lu=%llx.%llx got %p\n", inode->i_ino, vino.ino,
+             vino.snap, inode);
+        return inode;
+}
+
+/*
+ * get/constuct snapdir inode for a given directory
+ */
+struct inode *ceph_get_snapdir(struct inode *parent)
+{
+        struct ceph_vino vino = {
+                .ino = ceph_ino(parent),
+                .snap = CEPH_SNAPDIR,
+        };
+        struct inode *inode = ceph_get_inode(parent->i_sb, vino);
+        struct ceph_inode_info *ci = ceph_inode(inode);
+
+        BUG_ON(!S_ISDIR(parent->i_mode));
+        if (IS_ERR(inode))
+                return ERR_PTR(PTR_ERR(inode));
+        inode->i_mode = parent->i_mode;
+        inode->i_uid = parent->i_uid;
+        inode->i_gid = parent->i_gid;
+        inode->i_op = &ceph_dir_iops;
+        inode->i_fop = &ceph_dir_fops;
+        ci->i_snap_caps = CEPH_CAP_PIN; /* so we can open */
+        ci->i_rbytes = 0;
+        return inode;
+}
+
+const struct inode_operations ceph_file_iops = {
+        .permission = ceph_permission,
+        .setattr = ceph_setattr,
+        .getattr = ceph_getattr,
+        .setxattr = ceph_setxattr,
+        .getxattr = ceph_getxattr,
+        .listxattr = ceph_listxattr,
+        .removexattr = ceph_removexattr,
+};
+
+
+/*
+ * We use a 'frag tree' to keep track of the MDS's directory fragments
+ * for a given inode (usually there is just a single fragment).  We
+ * need to know when a child frag is delegated to a new MDS, or when
+ * it is flagged as replicated, so we can direct our requests
+ * accordingly.
+ */
+
+/*
+ * find/create a frag in the tree
+ */
+static struct ceph_inode_frag *__get_or_create_frag(struct ceph_inode_info *ci,
+                                                    u32 f)
+{
+        struct rb_node **p;
+        struct rb_node *parent = NULL;
+        struct ceph_inode_frag *frag;
+        int c;
+
+        p = &ci->i_fragtree.rb_node;
+        while (*p) {
+                parent = *p;
+                frag = rb_entry(parent, struct ceph_inode_frag, node);
+                c = ceph_frag_compare(f, frag->frag);
+                if (c < 0)
+                        p = &(*p)->rb_left;
+                else if (c > 0)
+                        p = &(*p)->rb_right;
+                else
+                        return frag;
+        }
+
+        frag = kmalloc(sizeof(*frag), GFP_NOFS);
+        if (!frag) {
+                pr_err("__get_or_create_frag ENOMEM on %p %llx.%llx "
+                       "frag %x\n", &ci->vfs_inode,
+                       ceph_vinop(&ci->vfs_inode), f);
+                return ERR_PTR(-ENOMEM);
+        }
+        frag->frag = f;
+        frag->split_by = 0;
+        frag->mds = -1;
+        frag->ndist = 0;
+
+        rb_link_node(&frag->node, parent, p);
+        rb_insert_color(&frag->node, &ci->i_fragtree);
+
+        dout("get_or_create_frag added %llx.%llx frag %x\n",
+             ceph_vinop(&ci->vfs_inode), f);
+        return frag;
+}
+
+/*
+ * find a specific frag @f
+ */
+struct ceph_inode_frag *__ceph_find_frag(struct ceph_inode_info *ci, u32 f)
+{
+        struct rb_node *n = ci->i_fragtree.rb_node;
+
+        while (n) {
+                struct ceph_inode_frag *frag =
+                        rb_entry(n, struct ceph_inode_frag, node);
+                int c = ceph_frag_compare(f, frag->frag);
+                if (c < 0)
+                        n = n->rb_left;
+                else if (c > 0)
+                        n = n->rb_right;
+                else
+                        return frag;
+        }
+        return NULL;
+}
+
+/*
+ * Choose frag containing the given value @v.  If @pfrag is
+ * specified, copy the frag delegation info to the caller if
+ * it is present.
+ */
+u32 ceph_choose_frag(struct ceph_inode_info *ci, u32 v,
+                     struct ceph_inode_frag *pfrag,
+                     int *found)
+{
+        u32 t = ceph_frag_make(0, 0);
+        struct ceph_inode_frag *frag;
+        unsigned nway, i;
+        u32 n;
+
+        if (found)
+                *found = 0;
+
+        mutex_lock(&ci->i_fragtree_mutex);
+        while (1) {
+                WARN_ON(!ceph_frag_contains_value(t, v));
+                frag = __ceph_find_frag(ci, t);
+                if (!frag)
+                        break; /* t is a leaf */
+                if (frag->split_by == 0) {
+                        if (pfrag)
+                                memcpy(pfrag, frag, sizeof(*pfrag));
+                        if (found)
+                                *found = 1;
+                        break;
+                }
+
+                /* choose child */
+                nway = 1 << frag->split_by;
+                dout("choose_frag(%x) %x splits by %d (%d ways)\n", v, t,
+                     frag->split_by, nway);
+                for (i = 0; i < nway; i++) {
+                        n = ceph_frag_make_child(t, frag->split_by, i);
+                        if (ceph_frag_contains_value(n, v)) {
+                                t = n;
+                                break;
+                        }
+                }
+                BUG_ON(i == nway);
+        }
+        dout("choose_frag(%x) = %x\n", v, t);
+
+        mutex_unlock(&ci->i_fragtree_mutex);
+        return t;
+}
+
+/*
+ * Process dirfrag (delegation) info from the mds.  Include leaf
+ * fragment in tree ONLY if ndist > 0.  Otherwise, only
+ * branches/splits are included in i_fragtree)
+ */
+static int ceph_fill_dirfrag(struct inode *inode,
+                             struct ceph_mds_reply_dirfrag *dirinfo)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_inode_frag *frag;
+        u32 id = le32_to_cpu(dirinfo->frag);
+        int mds = le32_to_cpu(dirinfo->auth);
+        int ndist = le32_to_cpu(dirinfo->ndist);
+        int i;
+        int err = 0;
+
+        mutex_lock(&ci->i_fragtree_mutex);
+        if (ndist == 0) {
+                /* no delegation info needed. */
+                frag = __ceph_find_frag(ci, id);
+                if (!frag)
+                        goto out;
+                if (frag->split_by == 0) {
+                        /* tree leaf, remove */
+                        dout("fill_dirfrag removed %llx.%llx frag %x"
+                             " (no ref)\n", ceph_vinop(inode), id);
+                        rb_erase(&frag->node, &ci->i_fragtree);
+                        kfree(frag);
+                } else {
+                        /* tree branch, keep and clear */
+                        dout("fill_dirfrag cleared %llx.%llx frag %x"
+                             " referral\n", ceph_vinop(inode), id);
+                        frag->mds = -1;
+                        frag->ndist = 0;
+                }
+                goto out;
+        }
+
+
+        /* find/add this frag to store mds delegation info */
+        frag = __get_or_create_frag(ci, id);
+        if (IS_ERR(frag)) {
+                /* this is not the end of the world; we can continue
+                   with bad/inaccurate delegation info */
+                pr_err("fill_dirfrag ENOMEM on mds ref %llx.%llx fg %x\n",
+                       ceph_vinop(inode), le32_to_cpu(dirinfo->frag));
+                err = -ENOMEM;
+                goto out;
+        }
+
+        frag->mds = mds;
+        frag->ndist = min_t(u32, ndist, CEPH_MAX_DIRFRAG_REP);
+        for (i = 0; i < frag->ndist; i++)
+                frag->dist[i] = le32_to_cpu(dirinfo->dist[i]);
+        dout("fill_dirfrag %llx.%llx frag %x ndist=%d\n",
+             ceph_vinop(inode), frag->frag, frag->ndist);
+
+out:
+        mutex_unlock(&ci->i_fragtree_mutex);
+        return err;
+}
+
+
+/*
+ * initialize a newly allocated inode.
+ */
+struct inode *ceph_alloc_inode(struct super_block *sb)
+{
+        struct ceph_inode_info *ci;
+        int i;
+
+        ci = kmem_cache_alloc(ceph_inode_cachep, GFP_NOFS);
+        if (!ci)
+                return NULL;
+
+        dout("alloc_inode %p\n", &ci->vfs_inode);
+
+        ci->i_version = 0;
+        ci->i_time_warp_seq = 0;
+        ci->i_ceph_flags = 0;
+        ci->i_release_count = 0;
+        ci->i_symlink = NULL;
+
+        ci->i_fragtree = RB_ROOT;
+        mutex_init(&ci->i_fragtree_mutex);
+
+        ci->i_xattrs.blob = NULL;
+        ci->i_xattrs.prealloc_blob = NULL;
+        ci->i_xattrs.dirty = false;
+        ci->i_xattrs.index = RB_ROOT;
+        ci->i_xattrs.count = 0;
+        ci->i_xattrs.names_size = 0;
+        ci->i_xattrs.vals_size = 0;
+        ci->i_xattrs.version = 0;
+        ci->i_xattrs.index_version = 0;
+
+        ci->i_caps = RB_ROOT;
+        ci->i_auth_cap = NULL;
+        ci->i_dirty_caps = 0;
+        ci->i_flushing_caps = 0;
+        INIT_LIST_HEAD(&ci->i_dirty_item);
+        INIT_LIST_HEAD(&ci->i_flushing_item);
+        ci->i_cap_flush_seq = 0;
+        ci->i_cap_flush_last_tid = 0;
+        memset(&ci->i_cap_flush_tid, 0, sizeof(ci->i_cap_flush_tid));
+        init_waitqueue_head(&ci->i_cap_wq);
+        ci->i_hold_caps_min = 0;
+        ci->i_hold_caps_max = 0;
+        INIT_LIST_HEAD(&ci->i_cap_delay_list);
+        ci->i_cap_exporting_mds = 0;
+        ci->i_cap_exporting_mseq = 0;
+        ci->i_cap_exporting_issued = 0;
+        INIT_LIST_HEAD(&ci->i_cap_snaps);
+        ci->i_head_snapc = NULL;
+        ci->i_snap_caps = 0;
+
+        for (i = 0; i < CEPH_FILE_MODE_NUM; i++)
+                ci->i_nr_by_mode[i] = 0;
+
+        ci->i_truncate_seq = 0;
+        ci->i_truncate_size = 0;
+        ci->i_truncate_pending = 0;
+
+        ci->i_max_size = 0;
+        ci->i_reported_size = 0;
+        ci->i_wanted_max_size = 0;
+        ci->i_requested_max_size = 0;
+
+        ci->i_pin_ref = 0;
+        ci->i_rd_ref = 0;
+        ci->i_rdcache_ref = 0;
+        ci->i_wr_ref = 0;
+        ci->i_wrbuffer_ref = 0;
+        ci->i_wrbuffer_ref_head = 0;
+        ci->i_shared_gen = 0;
+        ci->i_rdcache_gen = 0;
+        ci->i_rdcache_revoking = 0;
+
+        INIT_LIST_HEAD(&ci->i_unsafe_writes);
+        INIT_LIST_HEAD(&ci->i_unsafe_dirops);
+        spin_lock_init(&ci->i_unsafe_lock);
+
+        ci->i_snap_realm = NULL;
+        INIT_LIST_HEAD(&ci->i_snap_realm_item);
+        INIT_LIST_HEAD(&ci->i_snap_flush_item);
+
+        INIT_WORK(&ci->i_wb_work, ceph_writeback_work);
+        INIT_WORK(&ci->i_pg_inv_work, ceph_invalidate_work);
+
+        INIT_WORK(&ci->i_vmtruncate_work, ceph_vmtruncate_work);
+
+        return &ci->vfs_inode;
+}
+
+void ceph_destroy_inode(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_inode_frag *frag;
+        struct rb_node *n;
+
+        dout("destroy_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
+
+        ceph_queue_caps_release(inode);
+
+        /*
+         * we may still have a snap_realm reference if there are stray
+         * caps in i_cap_exporting_issued or i_snap_caps.
+         */
+        if (ci->i_snap_realm) {
+                struct ceph_mds_client *mdsc =
+                        &ceph_client(ci->vfs_inode.i_sb)->mdsc;
+                struct ceph_snap_realm *realm = ci->i_snap_realm;
+
+                dout(" dropping residual ref to snap realm %p\n", realm);
+                spin_lock(&realm->inodes_with_caps_lock);
+                list_del_init(&ci->i_snap_realm_item);
+                spin_unlock(&realm->inodes_with_caps_lock);
+                ceph_put_snap_realm(mdsc, realm);
+        }
+
+        kfree(ci->i_symlink);
+        while ((n = rb_first(&ci->i_fragtree)) != NULL) {
+                frag = rb_entry(n, struct ceph_inode_frag, node);
+                rb_erase(n, &ci->i_fragtree);
+                kfree(frag);
+        }
+
+        __ceph_destroy_xattrs(ci);
+        if (ci->i_xattrs.blob)
+                ceph_buffer_put(ci->i_xattrs.blob);
+        if (ci->i_xattrs.prealloc_blob)
+                ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+
+        kmem_cache_free(ceph_inode_cachep, ci);
+}
+
+
+/*
+ * Helpers to fill in size, ctime, mtime, and atime.  We have to be
+ * careful because either the client or MDS may have more up to date
+ * info, depending on which capabilities are held, and whether
+ * time_warp_seq or truncate_seq have increased.  (Ordinarily, mtime
+ * and size are monotonically increasing, except when utimes() or
+ * truncate() increments the corresponding _seq values.)
+ */
+int ceph_fill_file_size(struct inode *inode, int issued,
+                        u32 truncate_seq, u64 truncate_size, u64 size)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int queue_trunc = 0;
+
+        if (ceph_seq_cmp(truncate_seq, ci->i_truncate_seq) > 0 ||
+            (truncate_seq == ci->i_truncate_seq && size > inode->i_size)) {
+                dout("size %lld -> %llu\n", inode->i_size, size);
+                inode->i_size = size;
+                inode->i_blocks = (size + (1<<9) - 1) >> 9;
+                ci->i_reported_size = size;
+                if (truncate_seq != ci->i_truncate_seq) {
+                        dout("truncate_seq %u -> %u\n",
+                             ci->i_truncate_seq, truncate_seq);
+                        ci->i_truncate_seq = truncate_seq;
+                        /*
+                         * If we hold relevant caps, or in the case where we're
+                         * not the only client referencing this file and we
+                         * don't hold those caps, then we need to check whether
+                         * the file is either opened or mmaped
+                         */
+                        if ((issued & (CEPH_CAP_FILE_CACHE|CEPH_CAP_FILE_RD|
+                                      CEPH_CAP_FILE_WR|CEPH_CAP_FILE_BUFFER|
+                                      CEPH_CAP_FILE_EXCL)) ||
+                            mapping_mapped(inode->i_mapping) ||
+                            __ceph_caps_file_wanted(ci)) {
+                                ci->i_truncate_pending++;
+                                queue_trunc = 1;
+                        }
+                }
+        }
+        if (ceph_seq_cmp(truncate_seq, ci->i_truncate_seq) >= 0 &&
+            ci->i_truncate_size != truncate_size) {
+                dout("truncate_size %lld -> %llu\n", ci->i_truncate_size,
+                     truncate_size);
+                ci->i_truncate_size = truncate_size;
+        }
+        return queue_trunc;
+}
+
+void ceph_fill_file_time(struct inode *inode, int issued,
+                         u64 time_warp_seq, struct timespec *ctime,
+                         struct timespec *mtime, struct timespec *atime)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int warn = 0;
+
+        if (issued & (CEPH_CAP_FILE_EXCL|
+                      CEPH_CAP_FILE_WR|
+                      CEPH_CAP_FILE_BUFFER)) {
+                if (timespec_compare(ctime, &inode->i_ctime) > 0) {
+                        dout("ctime %ld.%09ld -> %ld.%09ld inc w/ cap\n",
+                             inode->i_ctime.tv_sec, inode->i_ctime.tv_nsec,
+                             ctime->tv_sec, ctime->tv_nsec);
+                        inode->i_ctime = *ctime;
+                }
+                if (ceph_seq_cmp(time_warp_seq, ci->i_time_warp_seq) > 0) {
+                        /* the MDS did a utimes() */
+                        dout("mtime %ld.%09ld -> %ld.%09ld "
+                             "tw %d -> %d\n",
+                             inode->i_mtime.tv_sec, inode->i_mtime.tv_nsec,
+                             mtime->tv_sec, mtime->tv_nsec,
+                             ci->i_time_warp_seq, (int)time_warp_seq);
+
+                        inode->i_mtime = *mtime;
+                        inode->i_atime = *atime;
+                        ci->i_time_warp_seq = time_warp_seq;
+                } else if (time_warp_seq == ci->i_time_warp_seq) {
+                        /* nobody did utimes(); take the max */
+                        if (timespec_compare(mtime, &inode->i_mtime) > 0) {
+                                dout("mtime %ld.%09ld -> %ld.%09ld inc\n",
+                                     inode->i_mtime.tv_sec,
+                                     inode->i_mtime.tv_nsec,
+                                     mtime->tv_sec, mtime->tv_nsec);
+                                inode->i_mtime = *mtime;
+                        }
+                        if (timespec_compare(atime, &inode->i_atime) > 0) {
+                                dout("atime %ld.%09ld -> %ld.%09ld inc\n",
+                                     inode->i_atime.tv_sec,
+                                     inode->i_atime.tv_nsec,
+                                     atime->tv_sec, atime->tv_nsec);
+                                inode->i_atime = *atime;
+                        }
+                } else if (issued & CEPH_CAP_FILE_EXCL) {
+                        /* we did a utimes(); ignore mds values */
+                } else {
+                        warn = 1;
+                }
+        } else {
+                /* we have no write caps; whatever the MDS says is true */
+                if (ceph_seq_cmp(time_warp_seq, ci->i_time_warp_seq) >= 0) {
+                        inode->i_ctime = *ctime;
+                        inode->i_mtime = *mtime;
+                        inode->i_atime = *atime;
+                        ci->i_time_warp_seq = time_warp_seq;
+                } else {
+                        warn = 1;
+                }
+        }
+        if (warn) /* time_warp_seq shouldn't go backwards */
+                dout("%p mds time_warp_seq %llu < %u\n",
+                     inode, time_warp_seq, ci->i_time_warp_seq);
+}
+
+/*
+ * Populate an inode based on info from mds.  May be called on new or
+ * existing inodes.
+ */
+static int fill_inode(struct inode *inode,
+                      struct ceph_mds_reply_info_in *iinfo,
+                      struct ceph_mds_reply_dirfrag *dirinfo,
+                      struct ceph_mds_session *session,
+                      unsigned long ttl_from, int cap_fmode,
+                      struct ceph_cap_reservation *caps_reservation)
+{
+        struct ceph_mds_reply_inode *info = iinfo->in;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int i;
+        int issued, implemented;
+        struct timespec mtime, atime, ctime;
+        u32 nsplits;
+        struct ceph_buffer *xattr_blob = NULL;
+        int err = 0;
+        int queue_trunc = 0;
+
+        dout("fill_inode %p ino %llx.%llx v %llu had %llu\n",
+             inode, ceph_vinop(inode), le64_to_cpu(info->version),
+             ci->i_version);
+
+        /*
+         * prealloc xattr data, if it looks like we'll need it.  only
+         * if len > 4 (meaning there are actually xattrs; the first 4
+         * bytes are the xattr count).
+         */
+        if (iinfo->xattr_len > 4) {
+                xattr_blob = ceph_buffer_new(iinfo->xattr_len, GFP_NOFS);
+                if (!xattr_blob)
+                        pr_err("fill_inode ENOMEM xattr blob %d bytes\n",
+                               iinfo->xattr_len);
+        }
+
+        spin_lock(&inode->i_lock);
+
+        /*
+         * provided version will be odd if inode value is projected,
+         * even if stable.  skip the update if we have a newer info
+         * (e.g., due to inode info racing form multiple MDSs), or if
+         * we are getting projected (unstable) inode info.
+         */
+        if (le64_to_cpu(info->version) > 0 &&
+            (ci->i_version & ~1) > le64_to_cpu(info->version))
+                goto no_change;
+
+        issued = __ceph_caps_issued(ci, &implemented);
+        issued |= implemented | __ceph_caps_dirty(ci);
+
+        /* update inode */
+        ci->i_version = le64_to_cpu(info->version);
+        inode->i_version++;
+        inode->i_rdev = le32_to_cpu(info->rdev);
+
+        if ((issued & CEPH_CAP_AUTH_EXCL) == 0) {
+                inode->i_mode = le32_to_cpu(info->mode);
+                inode->i_uid = le32_to_cpu(info->uid);
+                inode->i_gid = le32_to_cpu(info->gid);
+                dout("%p mode 0%o uid.gid %d.%d\n", inode, inode->i_mode,
+                     inode->i_uid, inode->i_gid);
+        }
+
+        if ((issued & CEPH_CAP_LINK_EXCL) == 0)
+                inode->i_nlink = le32_to_cpu(info->nlink);
+
+        /* be careful with mtime, atime, size */
+        ceph_decode_timespec(&atime, &info->atime);
+        ceph_decode_timespec(&mtime, &info->mtime);
+        ceph_decode_timespec(&ctime, &info->ctime);
+        queue_trunc = ceph_fill_file_size(inode, issued,
+                                          le32_to_cpu(info->truncate_seq),
+                                          le64_to_cpu(info->truncate_size),
+                                          le64_to_cpu(info->size));
+        ceph_fill_file_time(inode, issued,
+                            le32_to_cpu(info->time_warp_seq),
+                            &ctime, &mtime, &atime);
+
+        ci->i_max_size = le64_to_cpu(info->max_size);
+        ci->i_layout = info->layout;
+        inode->i_blkbits = fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
+
+        /* xattrs */
+        /* note that if i_xattrs.len <= 4, i_xattrs.data will still be NULL. */
+        if ((issued & CEPH_CAP_XATTR_EXCL) == 0 &&
+            le64_to_cpu(info->xattr_version) > ci->i_xattrs.version) {
+                if (ci->i_xattrs.blob)
+                        ceph_buffer_put(ci->i_xattrs.blob);
+                ci->i_xattrs.blob = xattr_blob;
+                if (xattr_blob)
+                        memcpy(ci->i_xattrs.blob->vec.iov_base,
+                               iinfo->xattr_data, iinfo->xattr_len);
+                ci->i_xattrs.version = le64_to_cpu(info->xattr_version);
+        }
+
+        inode->i_mapping->a_ops = &ceph_aops;
+        inode->i_mapping->backing_dev_info =
+                &ceph_client(inode->i_sb)->backing_dev_info;
+
+        switch (inode->i_mode & S_IFMT) {
+        case S_IFIFO:
+        case S_IFBLK:
+        case S_IFCHR:
+        case S_IFSOCK:
+                init_special_inode(inode, inode->i_mode, inode->i_rdev);
+                inode->i_op = &ceph_file_iops;
+                break;
+        case S_IFREG:
+                inode->i_op = &ceph_file_iops;
+                inode->i_fop = &ceph_file_fops;
+                break;
+        case S_IFLNK:
+                inode->i_op = &ceph_symlink_iops;
+                if (!ci->i_symlink) {
+                        int symlen = iinfo->symlink_len;
+                        char *sym;
+
+                        BUG_ON(symlen != inode->i_size);
+                        spin_unlock(&inode->i_lock);
+
+                        err = -ENOMEM;
+                        sym = kmalloc(symlen+1, GFP_NOFS);
+                        if (!sym)
+                                goto out;
+                        memcpy(sym, iinfo->symlink, symlen);
+                        sym[symlen] = 0;
+
+                        spin_lock(&inode->i_lock);
+                        if (!ci->i_symlink)
+                                ci->i_symlink = sym;
+                        else
+                                kfree(sym); /* lost a race */
+                }
+                break;
+        case S_IFDIR:
+                inode->i_op = &ceph_dir_iops;
+                inode->i_fop = &ceph_dir_fops;
+
+                ci->i_files = le64_to_cpu(info->files);
+                ci->i_subdirs = le64_to_cpu(info->subdirs);
+                ci->i_rbytes = le64_to_cpu(info->rbytes);
+                ci->i_rfiles = le64_to_cpu(info->rfiles);
+                ci->i_rsubdirs = le64_to_cpu(info->rsubdirs);
+                ceph_decode_timespec(&ci->i_rctime, &info->rctime);
+
+                /* set dir completion flag? */
+                if (ci->i_files == 0 && ci->i_subdirs == 0 &&
+                    ceph_snap(inode) == CEPH_NOSNAP &&
+                    (le32_to_cpu(info->cap.caps) & CEPH_CAP_FILE_SHARED)) {
+                        dout(" marking %p complete (empty)\n", inode);
+                        ci->i_ceph_flags |= CEPH_I_COMPLETE;
+                        ci->i_max_offset = 2;
+                }
+
+                /* it may be better to set st_size in getattr instead? */
+                if (ceph_test_opt(ceph_client(inode->i_sb), RBYTES))
+                        inode->i_size = ci->i_rbytes;
+                break;
+        default:
+                pr_err("fill_inode %llx.%llx BAD mode 0%o\n",
+                       ceph_vinop(inode), inode->i_mode);
+        }
+
+no_change:
+        spin_unlock(&inode->i_lock);
+
+        /* queue truncate if we saw i_size decrease */
+        if (queue_trunc)
+                ceph_queue_vmtruncate(inode);
+
+        /* populate frag tree */
+        /* FIXME: move me up, if/when version reflects fragtree changes */
+        nsplits = le32_to_cpu(info->fragtree.nsplits);
+        mutex_lock(&ci->i_fragtree_mutex);
+        for (i = 0; i < nsplits; i++) {
+                u32 id = le32_to_cpu(info->fragtree.splits[i].frag);
+                struct ceph_inode_frag *frag = __get_or_create_frag(ci, id);
+
+                if (IS_ERR(frag))
+                        continue;
+                frag->split_by = le32_to_cpu(info->fragtree.splits[i].by);
+                dout(" frag %x split by %d\n", frag->frag, frag->split_by);
+        }
+        mutex_unlock(&ci->i_fragtree_mutex);
+
+        /* were we issued a capability? */
+        if (info->cap.caps) {
+                if (ceph_snap(inode) == CEPH_NOSNAP) {
+                        ceph_add_cap(inode, session,
+                                     le64_to_cpu(info->cap.cap_id),
+                                     cap_fmode,
+                                     le32_to_cpu(info->cap.caps),
+                                     le32_to_cpu(info->cap.wanted),
+                                     le32_to_cpu(info->cap.seq),
+                                     le32_to_cpu(info->cap.mseq),
+                                     le64_to_cpu(info->cap.realm),
+                                     info->cap.flags,
+                                     caps_reservation);
+                } else {
+                        spin_lock(&inode->i_lock);
+                        dout(" %p got snap_caps %s\n", inode,
+                             ceph_cap_string(le32_to_cpu(info->cap.caps)));
+                        ci->i_snap_caps |= le32_to_cpu(info->cap.caps);
+                        if (cap_fmode >= 0)
+                                __ceph_get_fmode(ci, cap_fmode);
+                        spin_unlock(&inode->i_lock);
+                }
+        }
+
+        /* update delegation info? */
+        if (dirinfo)
+                ceph_fill_dirfrag(inode, dirinfo);
+
+        err = 0;
+
+out:
+        if (xattr_blob)
+                ceph_buffer_put(xattr_blob);
+        return err;
+}
+
+/*
+ * caller should hold session s_mutex.
+ */
+static void update_dentry_lease(struct dentry *dentry,
+                                struct ceph_mds_reply_lease *lease,
+                                struct ceph_mds_session *session,
+                                unsigned long from_time)
+{
+        struct ceph_dentry_info *di = ceph_dentry(dentry);
+        long unsigned duration = le32_to_cpu(lease->duration_ms);
+        long unsigned ttl = from_time + (duration * HZ) / 1000;
+        long unsigned half_ttl = from_time + (duration * HZ / 2) / 1000;
+        struct inode *dir;
+
+        /* only track leases on regular dentries */
+        if (dentry->d_op != &ceph_dentry_ops)
+                return;
+
+        spin_lock(&dentry->d_lock);
+        dout("update_dentry_lease %p mask %d duration %lu ms ttl %lu\n",
+             dentry, le16_to_cpu(lease->mask), duration, ttl);
+
+        /* make lease_rdcache_gen match directory */
+        dir = dentry->d_parent->d_inode;
+        di->lease_shared_gen = ceph_inode(dir)->i_shared_gen;
+
+        if (lease->mask == 0)
+                goto out_unlock;
+
+        if (di->lease_gen == session->s_cap_gen &&
+            time_before(ttl, dentry->d_time))
+                goto out_unlock;  /* we already have a newer lease. */
+
+        if (di->lease_session && di->lease_session != session)
+                goto out_unlock;
+
+        ceph_dentry_lru_touch(dentry);
+
+        if (!di->lease_session)
+                di->lease_session = ceph_get_mds_session(session);
+        di->lease_gen = session->s_cap_gen;
+        di->lease_seq = le32_to_cpu(lease->seq);
+        di->lease_renew_after = half_ttl;
+        di->lease_renew_from = 0;
+        dentry->d_time = ttl;
+out_unlock:
+        spin_unlock(&dentry->d_lock);
+        return;
+}
+
+/*
+ * splice a dentry to an inode.
+ * caller must hold directory i_mutex for this to be safe.
+ *
+ * we will only rehash the resulting dentry if @prehash is
+ * true; @prehash will be set to false (for the benefit of
+ * the caller) if we fail.
+ */
+static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
+                                    bool *prehash)
+{
+        struct dentry *realdn;
+
+        /* dn must be unhashed */
+        if (!d_unhashed(dn))
+                d_drop(dn);
+        realdn = d_materialise_unique(dn, in);
+        if (IS_ERR(realdn)) {
+                pr_err("splice_dentry error %p inode %p ino %llx.%llx\n",
+                       dn, in, ceph_vinop(in));
+                if (prehash)
+                        *prehash = false; /* don't rehash on error */
+                dn = realdn; /* note realdn contains the error */
+                goto out;
+        } else if (realdn) {
+                dout("dn %p (%d) spliced with %p (%d) "
+                     "inode %p ino %llx.%llx\n",
+                     dn, atomic_read(&dn->d_count),
+                     realdn, atomic_read(&realdn->d_count),
+                     realdn->d_inode, ceph_vinop(realdn->d_inode));
+                dput(dn);
+                dn = realdn;
+        } else {
+                BUG_ON(!ceph_dentry(dn));
+
+                dout("dn %p attached to %p ino %llx.%llx\n",
+                     dn, dn->d_inode, ceph_vinop(dn->d_inode));
+        }
+        if ((!prehash || *prehash) && d_unhashed(dn))
+                d_rehash(dn);
+out:
+        return dn;
+}
+
+/*
+ * Set dentry's directory position based on the current dir's max, and
+ * order it in d_subdirs, so that dcache_readdir behaves.
+ */
+static void ceph_set_dentry_offset(struct dentry *dn)
+{
+        struct dentry *dir = dn->d_parent;
+        struct inode *inode = dn->d_parent->d_inode;
+        struct ceph_dentry_info *di;
+
+        BUG_ON(!inode);
+
+        di = ceph_dentry(dn);
+
+        spin_lock(&inode->i_lock);
+        di->offset = ceph_inode(inode)->i_max_offset++;
+        spin_unlock(&inode->i_lock);
+
+        spin_lock(&dcache_lock);
+        spin_lock(&dn->d_lock);
+        list_move_tail(&dir->d_subdirs, &dn->d_u.d_child);
+        dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
+             dn->d_u.d_child.prev, dn->d_u.d_child.next);
+        spin_unlock(&dn->d_lock);
+        spin_unlock(&dcache_lock);
+}
+
+/*
+ * Incorporate results into the local cache.  This is either just
+ * one inode, or a directory, dentry, and possibly linked-to inode (e.g.,
+ * after a lookup).
+ *
+ * A reply may contain
+ *         a directory inode along with a dentry.
+ *  and/or a target inode
+ *
+ * Called with snap_rwsem (read).
+ */
+int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
+                    struct ceph_mds_session *session)
+{
+        struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info;
+        struct inode *in = NULL;
+        struct ceph_mds_reply_inode *ininfo;
+        struct ceph_vino vino;
+        struct ceph_client *client = ceph_sb_to_client(sb);
+        int i = 0;
+        int err = 0;
+
+        dout("fill_trace %p is_dentry %d is_target %d\n", req,
+             rinfo->head->is_dentry, rinfo->head->is_target);
+
+#if 0
+        /*
+         * Debugging hook:
+         *
+         * If we resend completed ops to a recovering mds, we get no
+         * trace.  Since that is very rare, pretend this is the case
+         * to ensure the 'no trace' handlers in the callers behave.
+         *
+         * Fill in inodes unconditionally to avoid breaking cap
+         * invariants.
+         */
+        if (rinfo->head->op & CEPH_MDS_OP_WRITE) {
+                pr_info("fill_trace faking empty trace on %lld %s\n",
+                        req->r_tid, ceph_mds_op_name(rinfo->head->op));
+                if (rinfo->head->is_dentry) {
+                        rinfo->head->is_dentry = 0;
+                        err = fill_inode(req->r_locked_dir,
+                                         &rinfo->diri, rinfo->dirfrag,
+                                         session, req->r_request_started, -1);
+                }
+                if (rinfo->head->is_target) {
+                        rinfo->head->is_target = 0;
+                        ininfo = rinfo->targeti.in;
+                        vino.ino = le64_to_cpu(ininfo->ino);
+                        vino.snap = le64_to_cpu(ininfo->snapid);
+                        in = ceph_get_inode(sb, vino);
+                        err = fill_inode(in, &rinfo->targeti, NULL,
+                                         session, req->r_request_started,
+                                         req->r_fmode);
+                        iput(in);
+                }
+        }
+#endif
+
+        if (!rinfo->head->is_target && !rinfo->head->is_dentry) {
+                dout("fill_trace reply is empty!\n");
+                if (rinfo->head->result == 0 && req->r_locked_dir) {
+                        struct ceph_inode_info *ci =
+                                ceph_inode(req->r_locked_dir);
+                        dout(" clearing %p complete (empty trace)\n",
+                             req->r_locked_dir);
+                        ci->i_ceph_flags &= ~CEPH_I_COMPLETE;
+                        ci->i_release_count++;
+                }
+                return 0;
+        }
+
+        if (rinfo->head->is_dentry) {
+                struct inode *dir = req->r_locked_dir;
+
+                err = fill_inode(dir, &rinfo->diri, rinfo->dirfrag,
+                                 session, req->r_request_started, -1,
+                                 &req->r_caps_reservation);
+                if (err < 0)
+                        return err;
+        }
+
+        /*
+         * ignore null lease/binding on snapdir ENOENT, or else we
+         * will have trouble splicing in the virtual snapdir later
+         */
+        if (rinfo->head->is_dentry && !req->r_aborted &&
+            (rinfo->head->is_target || strncmp(req->r_dentry->d_name.name,
+                                               client->mount_args->snapdir_name,
+                                               req->r_dentry->d_name.len))) {
+                /*
+                 * lookup link rename   : null -> possibly existing inode
+                 * mknod symlink mkdir  : null -> new inode
+                 * unlink               : linked -> null
+                 */
+                struct inode *dir = req->r_locked_dir;
+                struct dentry *dn = req->r_dentry;
+                bool have_dir_cap, have_lease;
+
+                BUG_ON(!dn);
+                BUG_ON(!dir);
+                BUG_ON(dn->d_parent->d_inode != dir);
+                BUG_ON(ceph_ino(dir) !=
+                       le64_to_cpu(rinfo->diri.in->ino));
+                BUG_ON(ceph_snap(dir) !=
+                       le64_to_cpu(rinfo->diri.in->snapid));
+
+                /* do we have a lease on the whole dir? */
+                have_dir_cap =
+                        (le32_to_cpu(rinfo->diri.in->cap.caps) &
+                         CEPH_CAP_FILE_SHARED);
+
+                /* do we have a dn lease? */
+                have_lease = have_dir_cap ||
+                        (le16_to_cpu(rinfo->dlease->mask) &
+                         CEPH_LOCK_DN);
+
+                if (!have_lease)
+                        dout("fill_trace  no dentry lease or dir cap\n");
+
+                /* rename? */
+                if (req->r_old_dentry && req->r_op == CEPH_MDS_OP_RENAME) {
+                        dout(" src %p '%.*s' dst %p '%.*s'\n",
+                             req->r_old_dentry,
+                             req->r_old_dentry->d_name.len,
+                             req->r_old_dentry->d_name.name,
+                             dn, dn->d_name.len, dn->d_name.name);
+                        dout("fill_trace doing d_move %p -> %p\n",
+                             req->r_old_dentry, dn);
+                        d_move(req->r_old_dentry, dn);
+                        dout(" src %p '%.*s' dst %p '%.*s'\n",
+                             req->r_old_dentry,
+                             req->r_old_dentry->d_name.len,
+                             req->r_old_dentry->d_name.name,
+                             dn, dn->d_name.len, dn->d_name.name);
+                        /* ensure target dentry is invalidated, despite
+                           rehashing bug in vfs_rename_dir */
+                        dn->d_time = jiffies;
+                        ceph_dentry(dn)->lease_shared_gen = 0;
+                        /* take overwritten dentry's readdir offset */
+                        ceph_dentry(req->r_old_dentry)->offset =
+                                ceph_dentry(dn)->offset;
+                        dn = req->r_old_dentry;  /* use old_dentry */
+                        in = dn->d_inode;
+                }
+
+                /* null dentry? */
+                if (!rinfo->head->is_target) {
+                        dout("fill_trace null dentry\n");
+                        if (dn->d_inode) {
+                                dout("d_delete %p\n", dn);
+                                d_delete(dn);
+                        } else {
+                                dout("d_instantiate %p NULL\n", dn);
+                                d_instantiate(dn, NULL);
+                                if (have_lease && d_unhashed(dn))
+                                        d_rehash(dn);
+                                update_dentry_lease(dn, rinfo->dlease,
+                                                    session,
+                                                    req->r_request_started);
+                        }
+                        goto done;
+                }
+
+                /* attach proper inode */
+                ininfo = rinfo->targeti.in;
+                vino.ino = le64_to_cpu(ininfo->ino);
+                vino.snap = le64_to_cpu(ininfo->snapid);
+                if (!dn->d_inode) {
+                        in = ceph_get_inode(sb, vino);
+                        if (IS_ERR(in)) {
+                                pr_err("fill_trace bad get_inode "
+                                       "%llx.%llx\n", vino.ino, vino.snap);
+                                err = PTR_ERR(in);
+                                d_delete(dn);
+                                goto done;
+                        }
+                        dn = splice_dentry(dn, in, &have_lease);
+                        if (IS_ERR(dn)) {
+                                err = PTR_ERR(dn);
+                                goto done;
+                        }
+                        req->r_dentry = dn;  /* may have spliced */
+                        ceph_set_dentry_offset(dn);
+                        igrab(in);
+                } else if (ceph_ino(in) == vino.ino &&
+                           ceph_snap(in) == vino.snap) {
+                        igrab(in);
+                } else {
+                        dout(" %p links to %p %llx.%llx, not %llx.%llx\n",
+                             dn, in, ceph_ino(in), ceph_snap(in),
+                             vino.ino, vino.snap);
+                        have_lease = false;
+                        in = NULL;
+                }
+
+                if (have_lease)
+                        update_dentry_lease(dn, rinfo->dlease, session,
+                                            req->r_request_started);
+                dout(" final dn %p\n", dn);
+                i++;
+        } else if (req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
+                   req->r_op == CEPH_MDS_OP_MKSNAP) {
+                struct dentry *dn = req->r_dentry;
+
+                /* fill out a snapdir LOOKUPSNAP dentry */
+                BUG_ON(!dn);
+                BUG_ON(!req->r_locked_dir);
+                BUG_ON(ceph_snap(req->r_locked_dir) != CEPH_SNAPDIR);
+                ininfo = rinfo->targeti.in;
+                vino.ino = le64_to_cpu(ininfo->ino);
+                vino.snap = le64_to_cpu(ininfo->snapid);
+                in = ceph_get_inode(sb, vino);
+                if (IS_ERR(in)) {
+                        pr_err("fill_inode get_inode badness %llx.%llx\n",
+                               vino.ino, vino.snap);
+                        err = PTR_ERR(in);
+                        d_delete(dn);
+                        goto done;
+                }
+                dout(" linking snapped dir %p to dn %p\n", in, dn);
+                dn = splice_dentry(dn, in, NULL);
+                if (IS_ERR(dn)) {
+                        err = PTR_ERR(dn);
+                        goto done;
+                }
+                ceph_set_dentry_offset(dn);
+                req->r_dentry = dn;  /* may have spliced */
+                igrab(in);
+                rinfo->head->is_dentry = 1;  /* fool notrace handlers */
+        }
+
+        if (rinfo->head->is_target) {
+                vino.ino = le64_to_cpu(rinfo->targeti.in->ino);
+                vino.snap = le64_to_cpu(rinfo->targeti.in->snapid);
+
+                if (in == NULL || ceph_ino(in) != vino.ino ||
+                    ceph_snap(in) != vino.snap) {
+                        in = ceph_get_inode(sb, vino);
+                        if (IS_ERR(in)) {
+                                err = PTR_ERR(in);
+                                goto done;
+                        }
+                }
+                req->r_target_inode = in;
+
+                err = fill_inode(in,
+                                 &rinfo->targeti, NULL,
+                                 session, req->r_request_started,
+                                 (le32_to_cpu(rinfo->head->result) == 0) ?
+                                 req->r_fmode : -1,
+                                 &req->r_caps_reservation);
+                if (err < 0) {
+                        pr_err("fill_inode badness %p %llx.%llx\n",
+                               in, ceph_vinop(in));
+                        goto done;
+                }
+        }
+
+done:
+        dout("fill_trace done err=%d\n", err);
+        return err;
+}
+
+/*
+ * Prepopulate our cache with readdir results, leases, etc.
+ */
+int ceph_readdir_prepopulate(struct ceph_mds_request *req,
+                             struct ceph_mds_session *session)
+{
+        struct dentry *parent = req->r_dentry;
+        struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info;
+        struct qstr dname;
+        struct dentry *dn;
+        struct inode *in;
+        int err = 0, i;
+        struct inode *snapdir = NULL;
+        struct ceph_mds_request_head *rhead = req->r_request->front.iov_base;
+        u64 frag = le32_to_cpu(rhead->args.readdir.frag);
+        struct ceph_dentry_info *di;
+
+        if (le32_to_cpu(rinfo->head->op) == CEPH_MDS_OP_LSSNAP) {
+                snapdir = ceph_get_snapdir(parent->d_inode);
+                parent = d_find_alias(snapdir);
+                dout("readdir_prepopulate %d items under SNAPDIR dn %p\n",
+                     rinfo->dir_nr, parent);
+        } else {
+                dout("readdir_prepopulate %d items under dn %p\n",
+                     rinfo->dir_nr, parent);
+                if (rinfo->dir_dir)
+                        ceph_fill_dirfrag(parent->d_inode, rinfo->dir_dir);
+        }
+
+        for (i = 0; i < rinfo->dir_nr; i++) {
+                struct ceph_vino vino;
+
+                dname.name = rinfo->dir_dname[i];
+                dname.len = rinfo->dir_dname_len[i];
+                dname.hash = full_name_hash(dname.name, dname.len);
+
+                vino.ino = le64_to_cpu(rinfo->dir_in[i].in->ino);
+                vino.snap = le64_to_cpu(rinfo->dir_in[i].in->snapid);
+
+retry_lookup:
+                dn = d_lookup(parent, &dname);
+                dout("d_lookup on parent=%p name=%.*s got %p\n",
+                     parent, dname.len, dname.name, dn);
+
+                if (!dn) {
+                        dn = d_alloc(parent, &dname);
+                        dout("d_alloc %p '%.*s' = %p\n", parent,
+                             dname.len, dname.name, dn);
+                        if (dn == NULL) {
+                                dout("d_alloc badness\n");
+                                err = -ENOMEM;
+                                goto out;
+                        }
+                        err = ceph_init_dentry(dn);
+                        if (err < 0)
+                                goto out;
+                } else if (dn->d_inode &&
+                           (ceph_ino(dn->d_inode) != vino.ino ||
+                            ceph_snap(dn->d_inode) != vino.snap)) {
+                        dout(" dn %p points to wrong inode %p\n",
+                             dn, dn->d_inode);
+                        d_delete(dn);
+                        dput(dn);
+                        goto retry_lookup;
+                } else {
+                        /* reorder parent's d_subdirs */
+                        spin_lock(&dcache_lock);
+                        spin_lock(&dn->d_lock);
+                        list_move(&dn->d_u.d_child, &parent->d_subdirs);
+                        spin_unlock(&dn->d_lock);
+                        spin_unlock(&dcache_lock);
+                }
+
+                di = dn->d_fsdata;
+                di->offset = ceph_make_fpos(frag, i + req->r_readdir_offset);
+
+                /* inode */
+                if (dn->d_inode) {
+                        in = dn->d_inode;
+                } else {
+                        in = ceph_get_inode(parent->d_sb, vino);
+                        if (in == NULL) {
+                                dout("new_inode badness\n");
+                                d_delete(dn);
+                                dput(dn);
+                                err = -ENOMEM;
+                                goto out;
+                        }
+                        dn = splice_dentry(dn, in, NULL);
+                }
+
+                if (fill_inode(in, &rinfo->dir_in[i], NULL, session,
+                               req->r_request_started, -1,
+                               &req->r_caps_reservation) < 0) {
+                        pr_err("fill_inode badness on %p\n", in);
+                        dput(dn);
+                        continue;
+                }
+                update_dentry_lease(dn, rinfo->dir_dlease[i],
+                                    req->r_session, req->r_request_started);
+                dput(dn);
+        }
+        req->r_did_prepopulate = true;
+
+out:
+        if (snapdir) {
+                iput(snapdir);
+                dput(parent);
+        }
+        dout("readdir_prepopulate done\n");
+        return err;
+}
+
+int ceph_inode_set_size(struct inode *inode, loff_t size)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int ret = 0;
+
+        spin_lock(&inode->i_lock);
+        dout("set_size %p %llu -> %llu\n", inode, inode->i_size, size);
+        inode->i_size = size;
+        inode->i_blocks = (size + (1 << 9) - 1) >> 9;
+
+        /* tell the MDS if we are approaching max_size */
+        if ((size << 1) >= ci->i_max_size &&
+            (ci->i_reported_size << 1) < ci->i_max_size)
+                ret = 1;
+
+        spin_unlock(&inode->i_lock);
+        return ret;
+}
+
+/*
+ * Write back inode data in a worker thread.  (This can't be done
+ * in the message handler context.)
+ */
+void ceph_queue_writeback(struct inode *inode)
+{
+        if (queue_work(ceph_inode_to_client(inode)->wb_wq,
+                       &ceph_inode(inode)->i_wb_work)) {
+                dout("ceph_queue_writeback %p\n", inode);
+                igrab(inode);
+        } else {
+                dout("ceph_queue_writeback %p failed\n", inode);
+        }
+}
+
+static void ceph_writeback_work(struct work_struct *work)
+{
+        struct ceph_inode_info *ci = container_of(work, struct ceph_inode_info,
+                                                  i_wb_work);
+        struct inode *inode = &ci->vfs_inode;
+
+        dout("writeback %p\n", inode);
+        filemap_fdatawrite(&inode->i_data);
+        iput(inode);
+}
+
+/*
+ * queue an async invalidation
+ */
+void ceph_queue_invalidate(struct inode *inode)
+{
+        if (queue_work(ceph_inode_to_client(inode)->pg_inv_wq,
+                       &ceph_inode(inode)->i_pg_inv_work)) {
+                dout("ceph_queue_invalidate %p\n", inode);
+                igrab(inode);
+        } else {
+                dout("ceph_queue_invalidate %p failed\n", inode);
+        }
+}
+
+/*
+ * invalidate any pages that are not dirty or under writeback.  this
+ * includes pages that are clean and mapped.
+ */
+static void ceph_invalidate_nondirty_pages(struct address_space *mapping)
+{
+        struct pagevec pvec;
+        pgoff_t next = 0;
+        int i;
+
+        pagevec_init(&pvec, 0);
+        while (pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)) {
+                for (i = 0; i < pagevec_count(&pvec); i++) {
+                        struct page *page = pvec.pages[i];
+                        pgoff_t index;
+                        int skip_page =
+                                (PageDirty(page) || PageWriteback(page));
+
+                        if (!skip_page)
+                                skip_page = !trylock_page(page);
+
+                        /*
+                         * We really shouldn't be looking at the ->index of an
+                         * unlocked page.  But we're not allowed to lock these
+                         * pages.  So we rely upon nobody altering the ->index
+                         * of this (pinned-by-us) page.
+                         */
+                        index = page->index;
+                        if (index > next)
+                                next = index;
+                        next++;
+
+                        if (skip_page)
+                                continue;
+
+                        generic_error_remove_page(mapping, page);
+                        unlock_page(page);
+                }
+                pagevec_release(&pvec);
+                cond_resched();
+        }
+}
+
+/*
+ * Invalidate inode pages in a worker thread.  (This can't be done
+ * in the message handler context.)
+ */
+static void ceph_invalidate_work(struct work_struct *work)
+{
+        struct ceph_inode_info *ci = container_of(work, struct ceph_inode_info,
+                                                  i_pg_inv_work);
+        struct inode *inode = &ci->vfs_inode;
+        u32 orig_gen;
+        int check = 0;
+
+        spin_lock(&inode->i_lock);
+        dout("invalidate_pages %p gen %d revoking %d\n", inode,
+             ci->i_rdcache_gen, ci->i_rdcache_revoking);
+        if (ci->i_rdcache_gen == 0 ||
+            ci->i_rdcache_revoking != ci->i_rdcache_gen) {
+                BUG_ON(ci->i_rdcache_revoking > ci->i_rdcache_gen);
+                /* nevermind! */
+                ci->i_rdcache_revoking = 0;
+                spin_unlock(&inode->i_lock);
+                goto out;
+        }
+        orig_gen = ci->i_rdcache_gen;
+        spin_unlock(&inode->i_lock);
+
+        ceph_invalidate_nondirty_pages(inode->i_mapping);
+
+        spin_lock(&inode->i_lock);
+        if (orig_gen == ci->i_rdcache_gen) {
+                dout("invalidate_pages %p gen %d successful\n", inode,
+                     ci->i_rdcache_gen);
+                ci->i_rdcache_gen = 0;
+                ci->i_rdcache_revoking = 0;
+                check = 1;
+        } else {
+                dout("invalidate_pages %p gen %d raced, gen now %d\n",
+                     inode, orig_gen, ci->i_rdcache_gen);
+        }
+        spin_unlock(&inode->i_lock);
+
+        if (check)
+                ceph_check_caps(ci, 0, NULL);
+out:
+        iput(inode);
+}
+
+
+/*
+ * called by trunc_wq; take i_mutex ourselves
+ *
+ * We also truncate in a separate thread as well.
+ */
+static void ceph_vmtruncate_work(struct work_struct *work)
+{
+        struct ceph_inode_info *ci = container_of(work, struct ceph_inode_info,
+                                                  i_vmtruncate_work);
+        struct inode *inode = &ci->vfs_inode;
+
+        dout("vmtruncate_work %p\n", inode);
+        mutex_lock(&inode->i_mutex);
+        __ceph_do_pending_vmtruncate(inode);
+        mutex_unlock(&inode->i_mutex);
+        iput(inode);
+}
+
+/*
+ * Queue an async vmtruncate.  If we fail to queue work, we will handle
+ * the truncation the next time we call __ceph_do_pending_vmtruncate.
+ */
+void ceph_queue_vmtruncate(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+
+        if (queue_work(ceph_client(inode->i_sb)->trunc_wq,
+                       &ci->i_vmtruncate_work)) {
+                dout("ceph_queue_vmtruncate %p\n", inode);
+                igrab(inode);
+        } else {
+                dout("ceph_queue_vmtruncate %p failed, pending=%d\n",
+                     inode, ci->i_truncate_pending);
+        }
+}
+
+/*
+ * called with i_mutex held.
+ *
+ * Make sure any pending truncation is applied before doing anything
+ * that may depend on it.
+ */
+void __ceph_do_pending_vmtruncate(struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        u64 to;
+        int wrbuffer_refs, wake = 0;
+
+retry:
+        spin_lock(&inode->i_lock);
+        if (ci->i_truncate_pending == 0) {
+                dout("__do_pending_vmtruncate %p none pending\n", inode);
+                spin_unlock(&inode->i_lock);
+                return;
+        }
+
+        /*
+         * make sure any dirty snapped pages are flushed before we
+         * possibly truncate them.. so write AND block!
+         */
+        if (ci->i_wrbuffer_ref_head < ci->i_wrbuffer_ref) {
+                dout("__do_pending_vmtruncate %p flushing snaps first\n",
+                     inode);
+                spin_unlock(&inode->i_lock);
+                filemap_write_and_wait_range(&inode->i_data, 0,
+                                             inode->i_sb->s_maxbytes);
+                goto retry;
+        }
+
+        to = ci->i_truncate_size;
+        wrbuffer_refs = ci->i_wrbuffer_ref;
+        dout("__do_pending_vmtruncate %p (%d) to %lld\n", inode,
+             ci->i_truncate_pending, to);
+        spin_unlock(&inode->i_lock);
+
+        truncate_inode_pages(inode->i_mapping, to);
+
+        spin_lock(&inode->i_lock);
+        ci->i_truncate_pending--;
+        if (ci->i_truncate_pending == 0)
+                wake = 1;
+        spin_unlock(&inode->i_lock);
+
+        if (wrbuffer_refs == 0)
+                ceph_check_caps(ci, CHECK_CAPS_AUTHONLY, NULL);
+        if (wake)
+                wake_up(&ci->i_cap_wq);
+}
+
+
+/*
+ * symlinks
+ */
+static void *ceph_sym_follow_link(struct dentry *dentry, struct nameidata *nd)
+{
+        struct ceph_inode_info *ci = ceph_inode(dentry->d_inode);
+        nd_set_link(nd, ci->i_symlink);
+        return NULL;
+}
+
+static const struct inode_operations ceph_symlink_iops = {
+        .readlink = generic_readlink,
+        .follow_link = ceph_sym_follow_link,
+};
+
+/*
+ * setattr
+ */
+int ceph_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct inode *parent_inode = dentry->d_parent->d_inode;
+        const unsigned int ia_valid = attr->ia_valid;
+        struct ceph_mds_request *req;
+        struct ceph_mds_client *mdsc = &ceph_client(dentry->d_sb)->mdsc;
+        int issued;
+        int release = 0, dirtied = 0;
+        int mask = 0;
+        int err = 0;
+
+        if (ceph_snap(inode) != CEPH_NOSNAP)
+                return -EROFS;
+
+        __ceph_do_pending_vmtruncate(inode);
+
+        err = inode_change_ok(inode, attr);
+        if (err != 0)
+                return err;
+
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SETATTR,
+                                       USE_AUTH_MDS);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+
+        spin_lock(&inode->i_lock);
+        issued = __ceph_caps_issued(ci, NULL);
+        dout("setattr %p issued %s\n", inode, ceph_cap_string(issued));
+
+        if (ia_valid & ATTR_UID) {
+                dout("setattr %p uid %d -> %d\n", inode,
+                     inode->i_uid, attr->ia_uid);
+                if (issued & CEPH_CAP_AUTH_EXCL) {
+                        inode->i_uid = attr->ia_uid;
+                        dirtied |= CEPH_CAP_AUTH_EXCL;
+                } else if ((issued & CEPH_CAP_AUTH_SHARED) == 0 ||
+                           attr->ia_uid != inode->i_uid) {
+                        req->r_args.setattr.uid = cpu_to_le32(attr->ia_uid);
+                        mask |= CEPH_SETATTR_UID;
+                        release |= CEPH_CAP_AUTH_SHARED;
+                }
+        }
+        if (ia_valid & ATTR_GID) {
+                dout("setattr %p gid %d -> %d\n", inode,
+                     inode->i_gid, attr->ia_gid);
+                if (issued & CEPH_CAP_AUTH_EXCL) {
+                        inode->i_gid = attr->ia_gid;
+                        dirtied |= CEPH_CAP_AUTH_EXCL;
+                } else if ((issued & CEPH_CAP_AUTH_SHARED) == 0 ||
+                           attr->ia_gid != inode->i_gid) {
+                        req->r_args.setattr.gid = cpu_to_le32(attr->ia_gid);
+                        mask |= CEPH_SETATTR_GID;
+                        release |= CEPH_CAP_AUTH_SHARED;
+                }
+        }
+        if (ia_valid & ATTR_MODE) {
+                dout("setattr %p mode 0%o -> 0%o\n", inode, inode->i_mode,
+                     attr->ia_mode);
+                if (issued & CEPH_CAP_AUTH_EXCL) {
+                        inode->i_mode = attr->ia_mode;
+                        dirtied |= CEPH_CAP_AUTH_EXCL;
+                } else if ((issued & CEPH_CAP_AUTH_SHARED) == 0 ||
+                           attr->ia_mode != inode->i_mode) {
+                        req->r_args.setattr.mode = cpu_to_le32(attr->ia_mode);
+                        mask |= CEPH_SETATTR_MODE;
+                        release |= CEPH_CAP_AUTH_SHARED;
+                }
+        }
+
+        if (ia_valid & ATTR_ATIME) {
+                dout("setattr %p atime %ld.%ld -> %ld.%ld\n", inode,
+                     inode->i_atime.tv_sec, inode->i_atime.tv_nsec,
+                     attr->ia_atime.tv_sec, attr->ia_atime.tv_nsec);
+                if (issued & CEPH_CAP_FILE_EXCL) {
+                        ci->i_time_warp_seq++;
+                        inode->i_atime = attr->ia_atime;
+                        dirtied |= CEPH_CAP_FILE_EXCL;
+                } else if ((issued & CEPH_CAP_FILE_WR) &&
+                           timespec_compare(&inode->i_atime,
+                                            &attr->ia_atime) < 0) {
+                        inode->i_atime = attr->ia_atime;
+                        dirtied |= CEPH_CAP_FILE_WR;
+                } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
+                           !timespec_equal(&inode->i_atime, &attr->ia_atime)) {
+                        ceph_encode_timespec(&req->r_args.setattr.atime,
+                                             &attr->ia_atime);
+                        mask |= CEPH_SETATTR_ATIME;
+                        release |= CEPH_CAP_FILE_CACHE | CEPH_CAP_FILE_RD |
+                                CEPH_CAP_FILE_WR;
+                }
+        }
+        if (ia_valid & ATTR_MTIME) {
+                dout("setattr %p mtime %ld.%ld -> %ld.%ld\n", inode,
+                     inode->i_mtime.tv_sec, inode->i_mtime.tv_nsec,
+                     attr->ia_mtime.tv_sec, attr->ia_mtime.tv_nsec);
+                if (issued & CEPH_CAP_FILE_EXCL) {
+                        ci->i_time_warp_seq++;
+                        inode->i_mtime = attr->ia_mtime;
+                        dirtied |= CEPH_CAP_FILE_EXCL;
+                } else if ((issued & CEPH_CAP_FILE_WR) &&
+                           timespec_compare(&inode->i_mtime,
+                                            &attr->ia_mtime) < 0) {
+                        inode->i_mtime = attr->ia_mtime;
+                        dirtied |= CEPH_CAP_FILE_WR;
+                } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
+                           !timespec_equal(&inode->i_mtime, &attr->ia_mtime)) {
+                        ceph_encode_timespec(&req->r_args.setattr.mtime,
+                                             &attr->ia_mtime);
+                        mask |= CEPH_SETATTR_MTIME;
+                        release |= CEPH_CAP_FILE_SHARED | CEPH_CAP_FILE_RD |
+                                CEPH_CAP_FILE_WR;
+                }
+        }
+        if (ia_valid & ATTR_SIZE) {
+                dout("setattr %p size %lld -> %lld\n", inode,
+                     inode->i_size, attr->ia_size);
+                if (attr->ia_size > inode->i_sb->s_maxbytes) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                if ((issued & CEPH_CAP_FILE_EXCL) &&
+                    attr->ia_size > inode->i_size) {
+                        inode->i_size = attr->ia_size;
+                        inode->i_blocks =
+                                (attr->ia_size + (1 << 9) - 1) >> 9;
+                        inode->i_ctime = attr->ia_ctime;
+                        ci->i_reported_size = attr->ia_size;
+                        dirtied |= CEPH_CAP_FILE_EXCL;
+                } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
+                           attr->ia_size != inode->i_size) {
+                        req->r_args.setattr.size = cpu_to_le64(attr->ia_size);
+                        req->r_args.setattr.old_size =
+                                cpu_to_le64(inode->i_size);
+                        mask |= CEPH_SETATTR_SIZE;
+                        release |= CEPH_CAP_FILE_SHARED | CEPH_CAP_FILE_RD |
+                                CEPH_CAP_FILE_WR;
+                }
+        }
+
+        /* these do nothing */
+        if (ia_valid & ATTR_CTIME) {
+                bool only = (ia_valid & (ATTR_SIZE|ATTR_MTIME|ATTR_ATIME|
+                                         ATTR_MODE|ATTR_UID|ATTR_GID)) == 0;
+                dout("setattr %p ctime %ld.%ld -> %ld.%ld (%s)\n", inode,
+                     inode->i_ctime.tv_sec, inode->i_ctime.tv_nsec,
+                     attr->ia_ctime.tv_sec, attr->ia_ctime.tv_nsec,
+                     only ? "ctime only" : "ignored");
+                inode->i_ctime = attr->ia_ctime;
+                if (only) {
+                        /*
+                         * if kernel wants to dirty ctime but nothing else,
+                         * we need to choose a cap to dirty under, or do
+                         * a almost-no-op setattr
+                         */
+                        if (issued & CEPH_CAP_AUTH_EXCL)
+                                dirtied |= CEPH_CAP_AUTH_EXCL;
+                        else if (issued & CEPH_CAP_FILE_EXCL)
+                                dirtied |= CEPH_CAP_FILE_EXCL;
+                        else if (issued & CEPH_CAP_XATTR_EXCL)
+                                dirtied |= CEPH_CAP_XATTR_EXCL;
+                        else
+                                mask |= CEPH_SETATTR_CTIME;
+                }
+        }
+        if (ia_valid & ATTR_FILE)
+                dout("setattr %p ATTR_FILE ... hrm!\n", inode);
+
+        if (dirtied) {
+                __ceph_mark_dirty_caps(ci, dirtied);
+                inode->i_ctime = CURRENT_TIME;
+        }
+
+        release &= issued;
+        spin_unlock(&inode->i_lock);
+
+        if (mask) {
+                req->r_inode = igrab(inode);
+                req->r_inode_drop = release;
+                req->r_args.setattr.mask = cpu_to_le32(mask);
+                req->r_num_caps = 1;
+                err = ceph_mdsc_do_request(mdsc, parent_inode, req);
+        }
+        dout("setattr %p result=%d (%s locally, %d remote)\n", inode, err,
+             ceph_cap_string(dirtied), mask);
+
+        ceph_mdsc_put_request(req);
+        __ceph_do_pending_vmtruncate(inode);
+        return err;
+out:
+        spin_unlock(&inode->i_lock);
+        ceph_mdsc_put_request(req);
+        return err;
+}
+
+/*
+ * Verify that we have a lease on the given mask.  If not,
+ * do a getattr against an mds.
+ */
+int ceph_do_getattr(struct inode *inode, int mask)
+{
+        struct ceph_client *client = ceph_sb_to_client(inode->i_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req;
+        int err;
+
+        if (ceph_snap(inode) == CEPH_SNAPDIR) {
+                dout("do_getattr inode %p SNAPDIR\n", inode);
+                return 0;
+        }
+
+        dout("do_getattr inode %p mask %s\n", inode, ceph_cap_string(mask));
+        if (ceph_caps_issued_mask(ceph_inode(inode), mask, 1))
+                return 0;
+
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_GETATTR, USE_ANY_MDS);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+        req->r_inode = igrab(inode);
+        req->r_num_caps = 1;
+        req->r_args.getattr.mask = cpu_to_le32(mask);
+        err = ceph_mdsc_do_request(mdsc, NULL, req);
+        ceph_mdsc_put_request(req);
+        dout("do_getattr result=%d\n", err);
+        return err;
+}
+
+
+/*
+ * Check inode permissions.  We verify we have a valid value for
+ * the AUTH cap, then call the generic handler.
+ */
+int ceph_permission(struct inode *inode, int mask)
+{
+        int err = ceph_do_getattr(inode, CEPH_CAP_AUTH_SHARED);
+
+        if (!err)
+                err = generic_permission(inode, mask, NULL);
+        return err;
+}
+
+/*
+ * Get all attributes.  Hopefully somedata we'll have a statlite()
+ * and can limit the fields we require to be accurate.
+ */
+int ceph_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                 struct kstat *stat)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int err;
+
+        err = ceph_do_getattr(inode, CEPH_STAT_CAP_INODE_ALL);
+        if (!err) {
+                generic_fillattr(inode, stat);
+                stat->ino = inode->i_ino;
+                if (ceph_snap(inode) != CEPH_NOSNAP)
+                        stat->dev = ceph_snap(inode);
+                else
+                        stat->dev = 0;
+                if (S_ISDIR(inode->i_mode)) {
+                        stat->size = ci->i_rbytes;
+                        stat->blocks = 0;
+                        stat->blksize = 65536;
+                }
+        }
+        return err;
+}
diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
new file mode 100644
index 000000000000..8a5bcae62846
--- /dev/null
+++ b/fs/ceph/ioctl.c
@@ -0,0 +1,160 @@
+#include <linux/in.h>
+
+#include "ioctl.h"
+#include "super.h"
+#include "ceph_debug.h"
+
+
+/*
+ * ioctls
+ */
+
+/*
+ * get and set the file layout
+ */
+static long ceph_ioctl_get_layout(struct file *file, void __user *arg)
+{
+        struct ceph_inode_info *ci = ceph_inode(file->f_dentry->d_inode);
+        struct ceph_ioctl_layout l;
+        int err;
+
+        err = ceph_do_getattr(file->f_dentry->d_inode, CEPH_STAT_CAP_LAYOUT);
+        if (!err) {
+                l.stripe_unit = ceph_file_layout_su(ci->i_layout);
+                l.stripe_count = ceph_file_layout_stripe_count(ci->i_layout);
+                l.object_size = ceph_file_layout_object_size(ci->i_layout);
+                l.data_pool = le32_to_cpu(ci->i_layout.fl_pg_pool);
+                l.preferred_osd =
+                        (s32)le32_to_cpu(ci->i_layout.fl_pg_preferred);
+                if (copy_to_user(arg, &l, sizeof(l)))
+                        return -EFAULT;
+        }
+
+        return err;
+}
+
+static long ceph_ioctl_set_layout(struct file *file, void __user *arg)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        struct inode *parent_inode = file->f_dentry->d_parent->d_inode;
+        struct ceph_mds_client *mdsc = &ceph_sb_to_client(inode->i_sb)->mdsc;
+        struct ceph_mds_request *req;
+        struct ceph_ioctl_layout l;
+        int err, i;
+
+        /* copy and validate */
+        if (copy_from_user(&l, arg, sizeof(l)))
+                return -EFAULT;
+
+        if ((l.object_size & ~PAGE_MASK) ||
+            (l.stripe_unit & ~PAGE_MASK) ||
+            !l.stripe_unit ||
+            (l.object_size &&
+             (unsigned)l.object_size % (unsigned)l.stripe_unit))
+                return -EINVAL;
+
+        /* make sure it's a valid data pool */
+        if (l.data_pool > 0) {
+                mutex_lock(&mdsc->mutex);
+                err = -EINVAL;
+                for (i = 0; i < mdsc->mdsmap->m_num_data_pg_pools; i++)
+                        if (mdsc->mdsmap->m_data_pg_pools[i] == l.data_pool) {
+                                err = 0;
+                                break;
+                        }
+                mutex_unlock(&mdsc->mutex);
+                if (err)
+                        return err;
+        }
+
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SETLAYOUT,
+                                       USE_AUTH_MDS);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+        req->r_inode = igrab(inode);
+        req->r_inode_drop = CEPH_CAP_FILE_SHARED | CEPH_CAP_FILE_EXCL;
+
+        req->r_args.setlayout.layout.fl_stripe_unit =
+                cpu_to_le32(l.stripe_unit);
+        req->r_args.setlayout.layout.fl_stripe_count =
+                cpu_to_le32(l.stripe_count);
+        req->r_args.setlayout.layout.fl_object_size =
+                cpu_to_le32(l.object_size);
+        req->r_args.setlayout.layout.fl_pg_pool = cpu_to_le32(l.data_pool);
+        req->r_args.setlayout.layout.fl_pg_preferred =
+                cpu_to_le32(l.preferred_osd);
+
+        err = ceph_mdsc_do_request(mdsc, parent_inode, req);
+        ceph_mdsc_put_request(req);
+        return err;
+}
+
+/*
+ * Return object name, size/offset information, and location (OSD
+ * number, network address) for a given file offset.
+ */
+static long ceph_ioctl_get_dataloc(struct file *file, void __user *arg)
+{
+        struct ceph_ioctl_dataloc dl;
+        struct inode *inode = file->f_dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_osd_client *osdc = &ceph_client(inode->i_sb)->osdc;
+        u64 len = 1, olen;
+        u64 tmp;
+        struct ceph_object_layout ol;
+        struct ceph_pg pgid;
+
+        /* copy and validate */
+        if (copy_from_user(&dl, arg, sizeof(dl)))
+                return -EFAULT;
+
+        down_read(&osdc->map_sem);
+        ceph_calc_file_object_mapping(&ci->i_layout, dl.file_offset, &len,
+                                      &dl.object_no, &dl.object_offset, &olen);
+        dl.file_offset -= dl.object_offset;
+        dl.object_size = ceph_file_layout_object_size(ci->i_layout);
+        dl.block_size = ceph_file_layout_su(ci->i_layout);
+
+        /* block_offset = object_offset % block_size */
+        tmp = dl.object_offset;
+        dl.block_offset = do_div(tmp, dl.block_size);
+
+        snprintf(dl.object_name, sizeof(dl.object_name), "%llx.%08llx",
+                 ceph_ino(inode), dl.object_no);
+        ceph_calc_object_layout(&ol, dl.object_name, &ci->i_layout,
+                                osdc->osdmap);
+
+        pgid = ol.ol_pgid;
+        dl.osd = ceph_calc_pg_primary(osdc->osdmap, pgid);
+        if (dl.osd >= 0) {
+                struct ceph_entity_addr *a =
+                        ceph_osd_addr(osdc->osdmap, dl.osd);
+                if (a)
+                        memcpy(&dl.osd_addr, &a->in_addr, sizeof(dl.osd_addr));
+        } else {
+                memset(&dl.osd_addr, 0, sizeof(dl.osd_addr));
+        }
+        up_read(&osdc->map_sem);
+
+        /* send result back to user */
+        if (copy_to_user(arg, &dl, sizeof(dl)))
+                return -EFAULT;
+
+        return 0;
+}
+
+long ceph_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        dout("ioctl file %p cmd %u arg %lu\n", file, cmd, arg);
+        switch (cmd) {
+        case CEPH_IOC_GET_LAYOUT:
+                return ceph_ioctl_get_layout(file, (void __user *)arg);
+
+        case CEPH_IOC_SET_LAYOUT:
+                return ceph_ioctl_set_layout(file, (void __user *)arg);
+
+        case CEPH_IOC_GET_DATALOC:
+                return ceph_ioctl_get_dataloc(file, (void __user *)arg);
+        }
+        return -ENOTTY;
+}
diff --git a/fs/ceph/ioctl.h b/fs/ceph/ioctl.h
new file mode 100644
index 000000000000..25e4f1a9d059
--- /dev/null
+++ b/fs/ceph/ioctl.h
@@ -0,0 +1,40 @@
+#ifndef FS_CEPH_IOCTL_H
+#define FS_CEPH_IOCTL_H
+
+#include <linux/ioctl.h>
+#include <linux/types.h>
+
+#define CEPH_IOCTL_MAGIC 0x97
+
+/* just use u64 to align sanely on all archs */
+struct ceph_ioctl_layout {
+        __u64 stripe_unit, stripe_count, object_size;
+        __u64 data_pool;
+        __s64 preferred_osd;
+};
+
+#define CEPH_IOC_GET_LAYOUT _IOR(CEPH_IOCTL_MAGIC, 1,           \
+                                   struct ceph_ioctl_layout)
+#define CEPH_IOC_SET_LAYOUT _IOW(CEPH_IOCTL_MAGIC, 2,           \
+                                   struct ceph_ioctl_layout)
+
+/*
+ * Extract identity, address of the OSD and object storing a given
+ * file offset.
+ */
+struct ceph_ioctl_dataloc {
+        __u64 file_offset;           /* in+out: file offset */
+        __u64 object_offset;         /* out: offset in object */
+        __u64 object_no;             /* out: object # */
+        __u64 object_size;           /* out: object size */
+        char object_name[64];        /* out: object name */
+        __u64 block_offset;          /* out: offset in block */
+        __u64 block_size;            /* out: block length */
+        __s64 osd;                   /* out: osd # */
+        struct sockaddr_storage osd_addr; /* out: osd address */
+};
+
+#define CEPH_IOC_GET_DATALOC _IOWR(CEPH_IOCTL_MAGIC, 3, \
+                                   struct ceph_ioctl_dataloc)
+
+#endif
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
new file mode 100644
index 000000000000..60a9a4ae47be
--- /dev/null
+++ b/fs/ceph/mds_client.c
@@ -0,0 +1,3043 @@
+#include "ceph_debug.h"
+
+#include <linux/wait.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+
+#include "mds_client.h"
+#include "mon_client.h"
+#include "super.h"
+#include "messenger.h"
+#include "decode.h"
+#include "auth.h"
+#include "pagelist.h"
+
+/*
+ * A cluster of MDS (metadata server) daemons is responsible for
+ * managing the file system namespace (the directory hierarchy and
+ * inodes) and for coordinating shared access to storage.  Metadata is
+ * partitioning hierarchically across a number of servers, and that
+ * partition varies over time as the cluster adjusts the distribution
+ * in order to balance load.
+ *
+ * The MDS client is primarily responsible to managing synchronous
+ * metadata requests for operations like open, unlink, and so forth.
+ * If there is a MDS failure, we find out about it when we (possibly
+ * request and) receive a new MDS map, and can resubmit affected
+ * requests.
+ *
+ * For the most part, though, we take advantage of a lossless
+ * communications channel to the MDS, and do not need to worry about
+ * timing out or resubmitting requests.
+ *
+ * We maintain a stateful "session" with each MDS we interact with.
+ * Within each session, we sent periodic heartbeat messages to ensure
+ * any capabilities or leases we have been issues remain valid.  If
+ * the session times out and goes stale, our leases and capabilities
+ * are no longer valid.
+ */
+
+static void __wake_requests(struct ceph_mds_client *mdsc,
+                            struct list_head *head);
+
+const static struct ceph_connection_operations mds_con_ops;
+
+
+/*
+ * mds reply parsing
+ */
+
+/*
+ * parse individual inode info
+ */
+static int parse_reply_info_in(void **p, void *end,
+                               struct ceph_mds_reply_info_in *info)
+{
+        int err = -EIO;
+
+        info->in = *p;
+        *p += sizeof(struct ceph_mds_reply_inode) +
+                sizeof(*info->in->fragtree.splits) *
+                le32_to_cpu(info->in->fragtree.nsplits);
+
+        ceph_decode_32_safe(p, end, info->symlink_len, bad);
+        ceph_decode_need(p, end, info->symlink_len, bad);
+        info->symlink = *p;
+        *p += info->symlink_len;
+
+        ceph_decode_32_safe(p, end, info->xattr_len, bad);
+        ceph_decode_need(p, end, info->xattr_len, bad);
+        info->xattr_data = *p;
+        *p += info->xattr_len;
+        return 0;
+bad:
+        return err;
+}
+
+/*
+ * parse a normal reply, which may contain a (dir+)dentry and/or a
+ * target inode.
+ */
+static int parse_reply_info_trace(void **p, void *end,
+                                  struct ceph_mds_reply_info_parsed *info)
+{
+        int err;
+
+        if (info->head->is_dentry) {
+                err = parse_reply_info_in(p, end, &info->diri);
+                if (err < 0)
+                        goto out_bad;
+
+                if (unlikely(*p + sizeof(*info->dirfrag) > end))
+                        goto bad;
+                info->dirfrag = *p;
+                *p += sizeof(*info->dirfrag) +
+                        sizeof(u32)*le32_to_cpu(info->dirfrag->ndist);
+                if (unlikely(*p > end))
+                        goto bad;
+
+                ceph_decode_32_safe(p, end, info->dname_len, bad);
+                ceph_decode_need(p, end, info->dname_len, bad);
+                info->dname = *p;
+                *p += info->dname_len;
+                info->dlease = *p;
+                *p += sizeof(*info->dlease);
+        }
+
+        if (info->head->is_target) {
+                err = parse_reply_info_in(p, end, &info->targeti);
+                if (err < 0)
+                        goto out_bad;
+        }
+
+        if (unlikely(*p != end))
+                goto bad;
+        return 0;
+
+bad:
+        err = -EIO;
+out_bad:
+        pr_err("problem parsing mds trace %d\n", err);
+        return err;
+}
+
+/*
+ * parse readdir results
+ */
+static int parse_reply_info_dir(void **p, void *end,
+                                struct ceph_mds_reply_info_parsed *info)
+{
+        u32 num, i = 0;
+        int err;
+
+        info->dir_dir = *p;
+        if (*p + sizeof(*info->dir_dir) > end)
+                goto bad;
+        *p += sizeof(*info->dir_dir) +
+                sizeof(u32)*le32_to_cpu(info->dir_dir->ndist);
+        if (*p > end)
+                goto bad;
+
+        ceph_decode_need(p, end, sizeof(num) + 2, bad);
+        num = ceph_decode_32(p);
+        info->dir_end = ceph_decode_8(p);
+        info->dir_complete = ceph_decode_8(p);
+        if (num == 0)
+                goto done;
+
+        /* alloc large array */
+        info->dir_nr = num;
+        info->dir_in = kcalloc(num, sizeof(*info->dir_in) +
+                               sizeof(*info->dir_dname) +
+                               sizeof(*info->dir_dname_len) +
+                               sizeof(*info->dir_dlease),
+                               GFP_NOFS);
+        if (info->dir_in == NULL) {
+                err = -ENOMEM;
+                goto out_bad;
+        }
+        info->dir_dname = (void *)(info->dir_in + num);
+        info->dir_dname_len = (void *)(info->dir_dname + num);
+        info->dir_dlease = (void *)(info->dir_dname_len + num);
+
+        while (num) {
+                /* dentry */
+                ceph_decode_need(p, end, sizeof(u32)*2, bad);
+                info->dir_dname_len[i] = ceph_decode_32(p);
+                ceph_decode_need(p, end, info->dir_dname_len[i], bad);
+                info->dir_dname[i] = *p;
+                *p += info->dir_dname_len[i];
+                dout("parsed dir dname '%.*s'\n", info->dir_dname_len[i],
+                     info->dir_dname[i]);
+                info->dir_dlease[i] = *p;
+                *p += sizeof(struct ceph_mds_reply_lease);
+
+                /* inode */
+                err = parse_reply_info_in(p, end, &info->dir_in[i]);
+                if (err < 0)
+                        goto out_bad;
+                i++;
+                num--;
+        }
+
+done:
+        if (*p != end)
+                goto bad;
+        return 0;
+
+bad:
+        err = -EIO;
+out_bad:
+        pr_err("problem parsing dir contents %d\n", err);
+        return err;
+}
+
+/*
+ * parse entire mds reply
+ */
+static int parse_reply_info(struct ceph_msg *msg,
+                            struct ceph_mds_reply_info_parsed *info)
+{
+        void *p, *end;
+        u32 len;
+        int err;
+
+        info->head = msg->front.iov_base;
+        p = msg->front.iov_base + sizeof(struct ceph_mds_reply_head);
+        end = p + msg->front.iov_len - sizeof(struct ceph_mds_reply_head);
+
+        /* trace */
+        ceph_decode_32_safe(&p, end, len, bad);
+        if (len > 0) {
+                err = parse_reply_info_trace(&p, p+len, info);
+                if (err < 0)
+                        goto out_bad;
+        }
+
+        /* dir content */
+        ceph_decode_32_safe(&p, end, len, bad);
+        if (len > 0) {
+                err = parse_reply_info_dir(&p, p+len, info);
+                if (err < 0)
+                        goto out_bad;
+        }
+
+        /* snap blob */
+        ceph_decode_32_safe(&p, end, len, bad);
+        info->snapblob_len = len;
+        info->snapblob = p;
+        p += len;
+
+        if (p != end)
+                goto bad;
+        return 0;
+
+bad:
+        err = -EIO;
+out_bad:
+        pr_err("mds parse_reply err %d\n", err);
+        return err;
+}
+
+static void destroy_reply_info(struct ceph_mds_reply_info_parsed *info)
+{
+        kfree(info->dir_in);
+}
+
+
+/*
+ * sessions
+ */
+static const char *session_state_name(int s)
+{
+        switch (s) {
+        case CEPH_MDS_SESSION_NEW: return "new";
+        case CEPH_MDS_SESSION_OPENING: return "opening";
+        case CEPH_MDS_SESSION_OPEN: return "open";
+        case CEPH_MDS_SESSION_HUNG: return "hung";
+        case CEPH_MDS_SESSION_CLOSING: return "closing";
+        case CEPH_MDS_SESSION_RESTARTING: return "restarting";
+        case CEPH_MDS_SESSION_RECONNECTING: return "reconnecting";
+        default: return "???";
+        }
+}
+
+static struct ceph_mds_session *get_session(struct ceph_mds_session *s)
+{
+        if (atomic_inc_not_zero(&s->s_ref)) {
+                dout("mdsc get_session %p %d -> %d\n", s,
+                     atomic_read(&s->s_ref)-1, atomic_read(&s->s_ref));
+                return s;
+        } else {
+                dout("mdsc get_session %p 0 -- FAIL", s);
+                return NULL;
+        }
+}
+
+void ceph_put_mds_session(struct ceph_mds_session *s)
+{
+        dout("mdsc put_session %p %d -> %d\n", s,
+             atomic_read(&s->s_ref), atomic_read(&s->s_ref)-1);
+        if (atomic_dec_and_test(&s->s_ref)) {
+                if (s->s_authorizer)
+                        s->s_mdsc->client->monc.auth->ops->destroy_authorizer(
+                                s->s_mdsc->client->monc.auth, s->s_authorizer);
+                kfree(s);
+        }
+}
+
+/*
+ * called under mdsc->mutex
+ */
+struct ceph_mds_session *__ceph_lookup_mds_session(struct ceph_mds_client *mdsc,
+                                                   int mds)
+{
+        struct ceph_mds_session *session;
+
+        if (mds >= mdsc->max_sessions || mdsc->sessions[mds] == NULL)
+                return NULL;
+        session = mdsc->sessions[mds];
+        dout("lookup_mds_session %p %d\n", session,
+             atomic_read(&session->s_ref));
+        get_session(session);
+        return session;
+}
+
+static bool __have_session(struct ceph_mds_client *mdsc, int mds)
+{
+        if (mds >= mdsc->max_sessions)
+                return false;
+        return mdsc->sessions[mds];
+}
+
+static int __verify_registered_session(struct ceph_mds_client *mdsc,
+                                       struct ceph_mds_session *s)
+{
+        if (s->s_mds >= mdsc->max_sessions ||
+            mdsc->sessions[s->s_mds] != s)
+                return -ENOENT;
+        return 0;
+}
+
+/*
+ * create+register a new session for given mds.
+ * called under mdsc->mutex.
+ */
+static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
+                                                 int mds)
+{
+        struct ceph_mds_session *s;
+
+        s = kzalloc(sizeof(*s), GFP_NOFS);
+        if (!s)
+                return ERR_PTR(-ENOMEM);
+        s->s_mdsc = mdsc;
+        s->s_mds = mds;
+        s->s_state = CEPH_MDS_SESSION_NEW;
+        s->s_ttl = 0;
+        s->s_seq = 0;
+        mutex_init(&s->s_mutex);
+
+        ceph_con_init(mdsc->client->msgr, &s->s_con);
+        s->s_con.private = s;
+        s->s_con.ops = &mds_con_ops;
+        s->s_con.peer_name.type = CEPH_ENTITY_TYPE_MDS;
+        s->s_con.peer_name.num = cpu_to_le64(mds);
+
+        spin_lock_init(&s->s_cap_lock);
+        s->s_cap_gen = 0;
+        s->s_cap_ttl = 0;
+        s->s_renew_requested = 0;
+        s->s_renew_seq = 0;
+        INIT_LIST_HEAD(&s->s_caps);
+        s->s_nr_caps = 0;
+        s->s_trim_caps = 0;
+        atomic_set(&s->s_ref, 1);
+        INIT_LIST_HEAD(&s->s_waiting);
+        INIT_LIST_HEAD(&s->s_unsafe);
+        s->s_num_cap_releases = 0;
+        s->s_cap_iterator = NULL;
+        INIT_LIST_HEAD(&s->s_cap_releases);
+        INIT_LIST_HEAD(&s->s_cap_releases_done);
+        INIT_LIST_HEAD(&s->s_cap_flushing);
+        INIT_LIST_HEAD(&s->s_cap_snaps_flushing);
+
+        dout("register_session mds%d\n", mds);
+        if (mds >= mdsc->max_sessions) {
+                int newmax = 1 << get_count_order(mds+1);
+                struct ceph_mds_session **sa;
+
+                dout("register_session realloc to %d\n", newmax);
+                sa = kcalloc(newmax, sizeof(void *), GFP_NOFS);
+                if (sa == NULL)
+                        goto fail_realloc;
+                if (mdsc->sessions) {
+                        memcpy(sa, mdsc->sessions,
+                               mdsc->max_sessions * sizeof(void *));
+                        kfree(mdsc->sessions);
+                }
+                mdsc->sessions = sa;
+                mdsc->max_sessions = newmax;
+        }
+        mdsc->sessions[mds] = s;
+        atomic_inc(&s->s_ref);  /* one ref to sessions[], one to caller */
+
+        ceph_con_open(&s->s_con, ceph_mdsmap_get_addr(mdsc->mdsmap, mds));
+
+        return s;
+
+fail_realloc:
+        kfree(s);
+        return ERR_PTR(-ENOMEM);
+}
+
+/*
+ * called under mdsc->mutex
+ */
+static void __unregister_session(struct ceph_mds_client *mdsc,
+                               struct ceph_mds_session *s)
+{
+        dout("__unregister_session mds%d %p\n", s->s_mds, s);
+        BUG_ON(mdsc->sessions[s->s_mds] != s);
+        mdsc->sessions[s->s_mds] = NULL;
+        ceph_con_close(&s->s_con);
+        ceph_put_mds_session(s);
+}
+
+/*
+ * drop session refs in request.
+ *
+ * should be last request ref, or hold mdsc->mutex
+ */
+static void put_request_session(struct ceph_mds_request *req)
+{
+        if (req->r_session) {
+                ceph_put_mds_session(req->r_session);
+                req->r_session = NULL;
+        }
+}
+
+void ceph_mdsc_release_request(struct kref *kref)
+{
+        struct ceph_mds_request *req = container_of(kref,
+                                                    struct ceph_mds_request,
+                                                    r_kref);
+        if (req->r_request)
+                ceph_msg_put(req->r_request);
+        if (req->r_reply) {
+                ceph_msg_put(req->r_reply);
+                destroy_reply_info(&req->r_reply_info);
+        }
+        if (req->r_inode) {
+                ceph_put_cap_refs(ceph_inode(req->r_inode),
+                                  CEPH_CAP_PIN);
+                iput(req->r_inode);
+        }
+        if (req->r_locked_dir)
+                ceph_put_cap_refs(ceph_inode(req->r_locked_dir),
+                                  CEPH_CAP_PIN);
+        if (req->r_target_inode)
+                iput(req->r_target_inode);
+        if (req->r_dentry)
+                dput(req->r_dentry);
+        if (req->r_old_dentry) {
+                ceph_put_cap_refs(
+                        ceph_inode(req->r_old_dentry->d_parent->d_inode),
+                        CEPH_CAP_PIN);
+                dput(req->r_old_dentry);
+        }
+        kfree(req->r_path1);
+        kfree(req->r_path2);
+        put_request_session(req);
+        ceph_unreserve_caps(&req->r_caps_reservation);
+        kfree(req);
+}
+
+/*
+ * lookup session, bump ref if found.
+ *
+ * called under mdsc->mutex.
+ */
+static struct ceph_mds_request *__lookup_request(struct ceph_mds_client *mdsc,
+                                             u64 tid)
+{
+        struct ceph_mds_request *req;
+        struct rb_node *n = mdsc->request_tree.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_mds_request, r_node);
+                if (tid < req->r_tid)
+                        n = n->rb_left;
+                else if (tid > req->r_tid)
+                        n = n->rb_right;
+                else {
+                        ceph_mdsc_get_request(req);
+                        return req;
+                }
+        }
+        return NULL;
+}
+
+static void __insert_request(struct ceph_mds_client *mdsc,
+                             struct ceph_mds_request *new)
+{
+        struct rb_node **p = &mdsc->request_tree.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_mds_request *req = NULL;
+
+        while (*p) {
+                parent = *p;
+                req = rb_entry(parent, struct ceph_mds_request, r_node);
+                if (new->r_tid < req->r_tid)
+                        p = &(*p)->rb_left;
+                else if (new->r_tid > req->r_tid)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->r_node, parent, p);
+        rb_insert_color(&new->r_node, &mdsc->request_tree);
+}
+
+/*
+ * Register an in-flight request, and assign a tid.  Link to directory
+ * are modifying (if any).
+ *
+ * Called under mdsc->mutex.
+ */
+static void __register_request(struct ceph_mds_client *mdsc,
+                               struct ceph_mds_request *req,
+                               struct inode *dir)
+{
+        req->r_tid = ++mdsc->last_tid;
+        if (req->r_num_caps)
+                ceph_reserve_caps(&req->r_caps_reservation, req->r_num_caps);
+        dout("__register_request %p tid %lld\n", req, req->r_tid);
+        ceph_mdsc_get_request(req);
+        __insert_request(mdsc, req);
+
+        if (dir) {
+                struct ceph_inode_info *ci = ceph_inode(dir);
+
+                spin_lock(&ci->i_unsafe_lock);
+                req->r_unsafe_dir = dir;
+                list_add_tail(&req->r_unsafe_dir_item, &ci->i_unsafe_dirops);
+                spin_unlock(&ci->i_unsafe_lock);
+        }
+}
+
+static void __unregister_request(struct ceph_mds_client *mdsc,
+                                 struct ceph_mds_request *req)
+{
+        dout("__unregister_request %p tid %lld\n", req, req->r_tid);
+        rb_erase(&req->r_node, &mdsc->request_tree);
+        RB_CLEAR_NODE(&req->r_node);
+
+        if (req->r_unsafe_dir) {
+                struct ceph_inode_info *ci = ceph_inode(req->r_unsafe_dir);
+
+                spin_lock(&ci->i_unsafe_lock);
+                list_del_init(&req->r_unsafe_dir_item);
+                spin_unlock(&ci->i_unsafe_lock);
+        }
+
+        ceph_mdsc_put_request(req);
+}
+
+/*
+ * Choose mds to send request to next.  If there is a hint set in the
+ * request (e.g., due to a prior forward hint from the mds), use that.
+ * Otherwise, consult frag tree and/or caps to identify the
+ * appropriate mds.  If all else fails, choose randomly.
+ *
+ * Called under mdsc->mutex.
+ */
+static int __choose_mds(struct ceph_mds_client *mdsc,
+                        struct ceph_mds_request *req)
+{
+        struct inode *inode;
+        struct ceph_inode_info *ci;
+        struct ceph_cap *cap;
+        int mode = req->r_direct_mode;
+        int mds = -1;
+        u32 hash = req->r_direct_hash;
+        bool is_hash = req->r_direct_is_hash;
+
+        /*
+         * is there a specific mds we should try?  ignore hint if we have
+         * no session and the mds is not up (active or recovering).
+         */
+        if (req->r_resend_mds >= 0 &&
+            (__have_session(mdsc, req->r_resend_mds) ||
+             ceph_mdsmap_get_state(mdsc->mdsmap, req->r_resend_mds) > 0)) {
+                dout("choose_mds using resend_mds mds%d\n",
+                     req->r_resend_mds);
+                return req->r_resend_mds;
+        }
+
+        if (mode == USE_RANDOM_MDS)
+                goto random;
+
+        inode = NULL;
+        if (req->r_inode) {
+                inode = req->r_inode;
+        } else if (req->r_dentry) {
+                if (req->r_dentry->d_inode) {
+                        inode = req->r_dentry->d_inode;
+                } else {
+                        inode = req->r_dentry->d_parent->d_inode;
+                        hash = req->r_dentry->d_name.hash;
+                        is_hash = true;
+                }
+        }
+        dout("__choose_mds %p is_hash=%d (%d) mode %d\n", inode, (int)is_hash,
+             (int)hash, mode);
+        if (!inode)
+                goto random;
+        ci = ceph_inode(inode);
+
+        if (is_hash && S_ISDIR(inode->i_mode)) {
+                struct ceph_inode_frag frag;
+                int found;
+
+                ceph_choose_frag(ci, hash, &frag, &found);
+                if (found) {
+                        if (mode == USE_ANY_MDS && frag.ndist > 0) {
+                                u8 r;
+
+                                /* choose a random replica */
+                                get_random_bytes(&r, 1);
+                                r %= frag.ndist;
+                                mds = frag.dist[r];
+                                dout("choose_mds %p %llx.%llx "
+                                     "frag %u mds%d (%d/%d)\n",
+                                     inode, ceph_vinop(inode),
+                                     frag.frag, frag.mds,
+                                     (int)r, frag.ndist);
+                                return mds;
+                        }
+
+                        /* since this file/dir wasn't known to be
+                         * replicated, then we want to look for the
+                         * authoritative mds. */
+                        mode = USE_AUTH_MDS;
+                        if (frag.mds >= 0) {
+                                /* choose auth mds */
+                                mds = frag.mds;
+                                dout("choose_mds %p %llx.%llx "
+                                     "frag %u mds%d (auth)\n",
+                                     inode, ceph_vinop(inode), frag.frag, mds);
+                                return mds;
+                        }
+                }
+        }
+
+        spin_lock(&inode->i_lock);
+        cap = NULL;
+        if (mode == USE_AUTH_MDS)
+                cap = ci->i_auth_cap;
+        if (!cap && !RB_EMPTY_ROOT(&ci->i_caps))
+                cap = rb_entry(rb_first(&ci->i_caps), struct ceph_cap, ci_node);
+        if (!cap) {
+                spin_unlock(&inode->i_lock);
+                goto random;
+        }
+        mds = cap->session->s_mds;
+        dout("choose_mds %p %llx.%llx mds%d (%scap %p)\n",
+             inode, ceph_vinop(inode), mds,
+             cap == ci->i_auth_cap ? "auth " : "", cap);
+        spin_unlock(&inode->i_lock);
+        return mds;
+
+random:
+        mds = ceph_mdsmap_get_random_mds(mdsc->mdsmap);
+        dout("choose_mds chose random mds%d\n", mds);
+        return mds;
+}
+
+
+/*
+ * session messages
+ */
+static struct ceph_msg *create_session_msg(u32 op, u64 seq)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_session_head *h;
+
+        msg = ceph_msg_new(CEPH_MSG_CLIENT_SESSION, sizeof(*h), 0, 0, NULL);
+        if (IS_ERR(msg)) {
+                pr_err("create_session_msg ENOMEM creating msg\n");
+                return ERR_PTR(PTR_ERR(msg));
+        }
+        h = msg->front.iov_base;
+        h->op = cpu_to_le32(op);
+        h->seq = cpu_to_le64(seq);
+        return msg;
+}
+
+/*
+ * send session open request.
+ *
+ * called under mdsc->mutex
+ */
+static int __open_session(struct ceph_mds_client *mdsc,
+                          struct ceph_mds_session *session)
+{
+        struct ceph_msg *msg;
+        int mstate;
+        int mds = session->s_mds;
+        int err = 0;
+
+        /* wait for mds to go active? */
+        mstate = ceph_mdsmap_get_state(mdsc->mdsmap, mds);
+        dout("open_session to mds%d (%s)\n", mds,
+             ceph_mds_state_name(mstate));
+        session->s_state = CEPH_MDS_SESSION_OPENING;
+        session->s_renew_requested = jiffies;
+
+        /* send connect message */
+        msg = create_session_msg(CEPH_SESSION_REQUEST_OPEN, session->s_seq);
+        if (IS_ERR(msg)) {
+                err = PTR_ERR(msg);
+                goto out;
+        }
+        ceph_con_send(&session->s_con, msg);
+
+out:
+        return 0;
+}
+
+/*
+ * session caps
+ */
+
+/*
+ * Free preallocated cap messages assigned to this session
+ */
+static void cleanup_cap_releases(struct ceph_mds_session *session)
+{
+        struct ceph_msg *msg;
+
+        spin_lock(&session->s_cap_lock);
+        while (!list_empty(&session->s_cap_releases)) {
+                msg = list_first_entry(&session->s_cap_releases,
+                                       struct ceph_msg, list_head);
+                list_del_init(&msg->list_head);
+                ceph_msg_put(msg);
+        }
+        while (!list_empty(&session->s_cap_releases_done)) {
+                msg = list_first_entry(&session->s_cap_releases_done,
+                                       struct ceph_msg, list_head);
+                list_del_init(&msg->list_head);
+                ceph_msg_put(msg);
+        }
+        spin_unlock(&session->s_cap_lock);
+}
+
+/*
+ * Helper to safely iterate over all caps associated with a session.
+ *
+ * caller must hold session s_mutex
+ */
+static int iterate_session_caps(struct ceph_mds_session *session,
+                                 int (*cb)(struct inode *, struct ceph_cap *,
+                                            void *), void *arg)
+{
+        struct list_head *p;
+        struct ceph_cap *cap;
+        struct inode *inode, *last_inode = NULL;
+        struct ceph_cap *old_cap = NULL;
+        int ret;
+
+        dout("iterate_session_caps %p mds%d\n", session, session->s_mds);
+        spin_lock(&session->s_cap_lock);
+        p = session->s_caps.next;
+        while (p != &session->s_caps) {
+                cap = list_entry(p, struct ceph_cap, session_caps);
+                inode = igrab(&cap->ci->vfs_inode);
+                if (!inode) {
+                        p = p->next;
+                        continue;
+                }
+                session->s_cap_iterator = cap;
+                spin_unlock(&session->s_cap_lock);
+
+                if (last_inode) {
+                        iput(last_inode);
+                        last_inode = NULL;
+                }
+                if (old_cap) {
+                        ceph_put_cap(old_cap);
+                        old_cap = NULL;
+                }
+
+                ret = cb(inode, cap, arg);
+                last_inode = inode;
+
+                spin_lock(&session->s_cap_lock);
+                p = p->next;
+                if (cap->ci == NULL) {
+                        dout("iterate_session_caps  finishing cap %p removal\n",
+                             cap);
+                        BUG_ON(cap->session != session);
+                        list_del_init(&cap->session_caps);
+                        session->s_nr_caps--;
+                        cap->session = NULL;
+                        old_cap = cap;  /* put_cap it w/o locks held */
+                }
+                if (ret < 0)
+                        goto out;
+        }
+        ret = 0;
+out:
+        session->s_cap_iterator = NULL;
+        spin_unlock(&session->s_cap_lock);
+
+        if (last_inode)
+                iput(last_inode);
+        if (old_cap)
+                ceph_put_cap(old_cap);
+
+        return ret;
+}
+
+static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
+                                   void *arg)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        dout("removing cap %p, ci is %p, inode is %p\n",
+             cap, ci, &ci->vfs_inode);
+        ceph_remove_cap(cap);
+        return 0;
+}
+
+/*
+ * caller must hold session s_mutex
+ */
+static void remove_session_caps(struct ceph_mds_session *session)
+{
+        dout("remove_session_caps on %p\n", session);
+        iterate_session_caps(session, remove_session_caps_cb, NULL);
+        BUG_ON(session->s_nr_caps > 0);
+        cleanup_cap_releases(session);
+}
+
+/*
+ * wake up any threads waiting on this session's caps.  if the cap is
+ * old (didn't get renewed on the client reconnect), remove it now.
+ *
+ * caller must hold s_mutex.
+ */
+static int wake_up_session_cb(struct inode *inode, struct ceph_cap *cap,
+                              void *arg)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+
+        wake_up(&ci->i_cap_wq);
+        if (arg) {
+                spin_lock(&inode->i_lock);
+                ci->i_wanted_max_size = 0;
+                ci->i_requested_max_size = 0;
+                spin_unlock(&inode->i_lock);
+        }
+        return 0;
+}
+
+static void wake_up_session_caps(struct ceph_mds_session *session,
+                                 int reconnect)
+{
+        dout("wake_up_session_caps %p mds%d\n", session, session->s_mds);
+        iterate_session_caps(session, wake_up_session_cb,
+                             (void *)(unsigned long)reconnect);
+}
+
+/*
+ * Send periodic message to MDS renewing all currently held caps.  The
+ * ack will reset the expiration for all caps from this session.
+ *
+ * caller holds s_mutex
+ */
+static int send_renew_caps(struct ceph_mds_client *mdsc,
+                           struct ceph_mds_session *session)
+{
+        struct ceph_msg *msg;
+        int state;
+
+        if (time_after_eq(jiffies, session->s_cap_ttl) &&
+            time_after_eq(session->s_cap_ttl, session->s_renew_requested))
+                pr_info("mds%d caps stale\n", session->s_mds);
+        session->s_renew_requested = jiffies;
+
+        /* do not try to renew caps until a recovering mds has reconnected
+         * with its clients. */
+        state = ceph_mdsmap_get_state(mdsc->mdsmap, session->s_mds);
+        if (state < CEPH_MDS_STATE_RECONNECT) {
+                dout("send_renew_caps ignoring mds%d (%s)\n",
+                     session->s_mds, ceph_mds_state_name(state));
+                return 0;
+        }
+
+        dout("send_renew_caps to mds%d (%s)\n", session->s_mds,
+                ceph_mds_state_name(state));
+        msg = create_session_msg(CEPH_SESSION_REQUEST_RENEWCAPS,
+                                 ++session->s_renew_seq);
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
+        ceph_con_send(&session->s_con, msg);
+        return 0;
+}
+
+/*
+ * Note new cap ttl, and any transition from stale -> not stale (fresh?).
+ *
+ * Called under session->s_mutex
+ */
+static void renewed_caps(struct ceph_mds_client *mdsc,
+                         struct ceph_mds_session *session, int is_renew)
+{
+        int was_stale;
+        int wake = 0;
+
+        spin_lock(&session->s_cap_lock);
+        was_stale = is_renew && (session->s_cap_ttl == 0 ||
+                                 time_after_eq(jiffies, session->s_cap_ttl));
+
+        session->s_cap_ttl = session->s_renew_requested +
+                mdsc->mdsmap->m_session_timeout*HZ;
+
+        if (was_stale) {
+                if (time_before(jiffies, session->s_cap_ttl)) {
+                        pr_info("mds%d caps renewed\n", session->s_mds);
+                        wake = 1;
+                } else {
+                        pr_info("mds%d caps still stale\n", session->s_mds);
+                }
+        }
+        dout("renewed_caps mds%d ttl now %lu, was %s, now %s\n",
+             session->s_mds, session->s_cap_ttl, was_stale ? "stale" : "fresh",
+             time_before(jiffies, session->s_cap_ttl) ? "stale" : "fresh");
+        spin_unlock(&session->s_cap_lock);
+
+        if (wake)
+                wake_up_session_caps(session, 0);
+}
+
+/*
+ * send a session close request
+ */
+static int request_close_session(struct ceph_mds_client *mdsc,
+                                 struct ceph_mds_session *session)
+{
+        struct ceph_msg *msg;
+        int err = 0;
+
+        dout("request_close_session mds%d state %s seq %lld\n",
+             session->s_mds, session_state_name(session->s_state),
+             session->s_seq);
+        msg = create_session_msg(CEPH_SESSION_REQUEST_CLOSE, session->s_seq);
+        if (IS_ERR(msg))
+                err = PTR_ERR(msg);
+        else
+                ceph_con_send(&session->s_con, msg);
+        return err;
+}
+
+/*
+ * Called with s_mutex held.
+ */
+static int __close_session(struct ceph_mds_client *mdsc,
+                         struct ceph_mds_session *session)
+{
+        if (session->s_state >= CEPH_MDS_SESSION_CLOSING)
+                return 0;
+        session->s_state = CEPH_MDS_SESSION_CLOSING;
+        return request_close_session(mdsc, session);
+}
+
+/*
+ * Trim old(er) caps.
+ *
+ * Because we can't cache an inode without one or more caps, we do
+ * this indirectly: if a cap is unused, we prune its aliases, at which
+ * point the inode will hopefully get dropped to.
+ *
+ * Yes, this is a bit sloppy.  Our only real goal here is to respond to
+ * memory pressure from the MDS, though, so it needn't be perfect.
+ */
+static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg)
+{
+        struct ceph_mds_session *session = arg;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int used, oissued, mine;
+
+        if (session->s_trim_caps <= 0)
+                return -1;
+
+        spin_lock(&inode->i_lock);
+        mine = cap->issued | cap->implemented;
+        used = __ceph_caps_used(ci);
+        oissued = __ceph_caps_issued_other(ci, cap);
+
+        dout("trim_caps_cb %p cap %p mine %s oissued %s used %s\n",
+             inode, cap, ceph_cap_string(mine), ceph_cap_string(oissued),
+             ceph_cap_string(used));
+        if (ci->i_dirty_caps)
+                goto out;   /* dirty caps */
+        if ((used & ~oissued) & mine)
+                goto out;   /* we need these caps */
+
+        session->s_trim_caps--;
+        if (oissued) {
+                /* we aren't the only cap.. just remove us */
+                __ceph_remove_cap(cap);
+        } else {
+                /* try to drop referring dentries */
+                spin_unlock(&inode->i_lock);
+                d_prune_aliases(inode);
+                dout("trim_caps_cb %p cap %p  pruned, count now %d\n",
+                     inode, cap, atomic_read(&inode->i_count));
+                return 0;
+        }
+
+out:
+        spin_unlock(&inode->i_lock);
+        return 0;
+}
+
+/*
+ * Trim session cap count down to some max number.
+ */
+static int trim_caps(struct ceph_mds_client *mdsc,
+                     struct ceph_mds_session *session,
+                     int max_caps)
+{
+        int trim_caps = session->s_nr_caps - max_caps;
+
+        dout("trim_caps mds%d start: %d / %d, trim %d\n",
+             session->s_mds, session->s_nr_caps, max_caps, trim_caps);
+        if (trim_caps > 0) {
+                session->s_trim_caps = trim_caps;
+                iterate_session_caps(session, trim_caps_cb, session);
+                dout("trim_caps mds%d done: %d / %d, trimmed %d\n",
+                     session->s_mds, session->s_nr_caps, max_caps,
+                        trim_caps - session->s_trim_caps);
+                session->s_trim_caps = 0;
+        }
+        return 0;
+}
+
+/*
+ * Allocate cap_release messages.  If there is a partially full message
+ * in the queue, try to allocate enough to cover it's remainder, so that
+ * we can send it immediately.
+ *
+ * Called under s_mutex.
+ */
+static int add_cap_releases(struct ceph_mds_client *mdsc,
+                            struct ceph_mds_session *session,
+                            int extra)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_cap_release *head;
+        int err = -ENOMEM;
+
+        if (extra < 0)
+                extra = mdsc->client->mount_args->cap_release_safety;
+
+        spin_lock(&session->s_cap_lock);
+
+        if (!list_empty(&session->s_cap_releases)) {
+                msg = list_first_entry(&session->s_cap_releases,
+                                       struct ceph_msg,
+                                 list_head);
+                head = msg->front.iov_base;
+                extra += CEPH_CAPS_PER_RELEASE - le32_to_cpu(head->num);
+        }
+
+        while (session->s_num_cap_releases < session->s_nr_caps + extra) {
+                spin_unlock(&session->s_cap_lock);
+                msg = ceph_msg_new(CEPH_MSG_CLIENT_CAPRELEASE, PAGE_CACHE_SIZE,
+                                   0, 0, NULL);
+                if (!msg)
+                        goto out_unlocked;
+                dout("add_cap_releases %p msg %p now %d\n", session, msg,
+                     (int)msg->front.iov_len);
+                head = msg->front.iov_base;
+                head->num = cpu_to_le32(0);
+                msg->front.iov_len = sizeof(*head);
+                spin_lock(&session->s_cap_lock);
+                list_add(&msg->list_head, &session->s_cap_releases);
+                session->s_num_cap_releases += CEPH_CAPS_PER_RELEASE;
+        }
+
+        if (!list_empty(&session->s_cap_releases)) {
+                msg = list_first_entry(&session->s_cap_releases,
+                                       struct ceph_msg,
+                                       list_head);
+                head = msg->front.iov_base;
+                if (head->num) {
+                        dout(" queueing non-full %p (%d)\n", msg,
+                             le32_to_cpu(head->num));
+                        list_move_tail(&msg->list_head,
+                                      &session->s_cap_releases_done);
+                        session->s_num_cap_releases -=
+                                CEPH_CAPS_PER_RELEASE - le32_to_cpu(head->num);
+                }
+        }
+        err = 0;
+        spin_unlock(&session->s_cap_lock);
+out_unlocked:
+        return err;
+}
+
+/*
+ * flush all dirty inode data to disk.
+ *
+ * returns true if we've flushed through want_flush_seq
+ */
+static int check_cap_flush(struct ceph_mds_client *mdsc, u64 want_flush_seq)
+{
+        int mds, ret = 1;
+
+        dout("check_cap_flush want %lld\n", want_flush_seq);
+        mutex_lock(&mdsc->mutex);
+        for (mds = 0; ret && mds < mdsc->max_sessions; mds++) {
+                struct ceph_mds_session *session = mdsc->sessions[mds];
+
+                if (!session)
+                        continue;
+                get_session(session);
+                mutex_unlock(&mdsc->mutex);
+
+                mutex_lock(&session->s_mutex);
+                if (!list_empty(&session->s_cap_flushing)) {
+                        struct ceph_inode_info *ci =
+                                list_entry(session->s_cap_flushing.next,
+                                           struct ceph_inode_info,
+                                           i_flushing_item);
+                        struct inode *inode = &ci->vfs_inode;
+
+                        spin_lock(&inode->i_lock);
+                        if (ci->i_cap_flush_seq <= want_flush_seq) {
+                                dout("check_cap_flush still flushing %p "
+                                     "seq %lld <= %lld to mds%d\n", inode,
+                                     ci->i_cap_flush_seq, want_flush_seq,
+                                     session->s_mds);
+                                ret = 0;
+                        }
+                        spin_unlock(&inode->i_lock);
+                }
+                mutex_unlock(&session->s_mutex);
+                ceph_put_mds_session(session);
+
+                if (!ret)
+                        return ret;
+                mutex_lock(&mdsc->mutex);
+        }
+
+        mutex_unlock(&mdsc->mutex);
+        dout("check_cap_flush ok, flushed thru %lld\n", want_flush_seq);
+        return ret;
+}
+
+/*
+ * called under s_mutex
+ */
+static void send_cap_releases(struct ceph_mds_client *mdsc,
+                       struct ceph_mds_session *session)
+{
+        struct ceph_msg *msg;
+
+        dout("send_cap_releases mds%d\n", session->s_mds);
+        while (1) {
+                spin_lock(&session->s_cap_lock);
+                if (list_empty(&session->s_cap_releases_done))
+                        break;
+                msg = list_first_entry(&session->s_cap_releases_done,
+                                 struct ceph_msg, list_head);
+                list_del_init(&msg->list_head);
+                spin_unlock(&session->s_cap_lock);
+                msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
+                dout("send_cap_releases mds%d %p\n", session->s_mds, msg);
+                ceph_con_send(&session->s_con, msg);
+        }
+        spin_unlock(&session->s_cap_lock);
+}
+
+/*
+ * requests
+ */
+
+/*
+ * Create an mds request.
+ */
+struct ceph_mds_request *
+ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode)
+{
+        struct ceph_mds_request *req = kzalloc(sizeof(*req), GFP_NOFS);
+
+        if (!req)
+                return ERR_PTR(-ENOMEM);
+
+        req->r_started = jiffies;
+        req->r_resend_mds = -1;
+        INIT_LIST_HEAD(&req->r_unsafe_dir_item);
+        req->r_fmode = -1;
+        kref_init(&req->r_kref);
+        INIT_LIST_HEAD(&req->r_wait);
+        init_completion(&req->r_completion);
+        init_completion(&req->r_safe_completion);
+        INIT_LIST_HEAD(&req->r_unsafe_item);
+
+        req->r_op = op;
+        req->r_direct_mode = mode;
+        return req;
+}
+
+/*
+ * return oldest (lowest) request, tid in request tree, 0 if none.
+ *
+ * called under mdsc->mutex.
+ */
+static struct ceph_mds_request *__get_oldest_req(struct ceph_mds_client *mdsc)
+{
+        if (RB_EMPTY_ROOT(&mdsc->request_tree))
+                return NULL;
+        return rb_entry(rb_first(&mdsc->request_tree),
+                        struct ceph_mds_request, r_node);
+}
+
+static u64 __get_oldest_tid(struct ceph_mds_client *mdsc)
+{
+        struct ceph_mds_request *req = __get_oldest_req(mdsc);
+
+        if (req)
+                return req->r_tid;
+        return 0;
+}
+
+/*
+ * Build a dentry's path.  Allocate on heap; caller must kfree.  Based
+ * on build_path_from_dentry in fs/cifs/dir.c.
+ *
+ * If @stop_on_nosnap, generate path relative to the first non-snapped
+ * inode.
+ *
+ * Encode hidden .snap dirs as a double /, i.e.
+ *   foo/.snap/bar -> foo//bar
+ */
+char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
+                           int stop_on_nosnap)
+{
+        struct dentry *temp;
+        char *path;
+        int len, pos;
+
+        if (dentry == NULL)
+                return ERR_PTR(-EINVAL);
+
+retry:
+        len = 0;
+        for (temp = dentry; !IS_ROOT(temp);) {
+                struct inode *inode = temp->d_inode;
+                if (inode && ceph_snap(inode) == CEPH_SNAPDIR)
+                        len++;  /* slash only */
+                else if (stop_on_nosnap && inode &&
+                         ceph_snap(inode) == CEPH_NOSNAP)
+                        break;
+                else
+                        len += 1 + temp->d_name.len;
+                temp = temp->d_parent;
+                if (temp == NULL) {
+                        pr_err("build_path_dentry corrupt dentry %p\n", dentry);
+                        return ERR_PTR(-EINVAL);
+                }
+        }
+        if (len)
+                len--;  /* no leading '/' */
+
+        path = kmalloc(len+1, GFP_NOFS);
+        if (path == NULL)
+                return ERR_PTR(-ENOMEM);
+        pos = len;
+        path[pos] = 0;  /* trailing null */
+        for (temp = dentry; !IS_ROOT(temp) && pos != 0; ) {
+                struct inode *inode = temp->d_inode;
+
+                if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
+                        dout("build_path_dentry path+%d: %p SNAPDIR\n",
+                             pos, temp);
+                } else if (stop_on_nosnap && inode &&
+                           ceph_snap(inode) == CEPH_NOSNAP) {
+                        break;
+                } else {
+                        pos -= temp->d_name.len;
+                        if (pos < 0)
+                                break;
+                        strncpy(path + pos, temp->d_name.name,
+                                temp->d_name.len);
+                        dout("build_path_dentry path+%d: %p '%.*s'\n",
+                             pos, temp, temp->d_name.len, path + pos);
+                }
+                if (pos)
+                        path[--pos] = '/';
+                temp = temp->d_parent;
+                if (temp == NULL) {
+                        pr_err("build_path_dentry corrupt dentry\n");
+                        kfree(path);
+                        return ERR_PTR(-EINVAL);
+                }
+        }
+        if (pos != 0) {
+                pr_err("build_path_dentry did not end path lookup where "
+                       "expected, namelen is %d, pos is %d\n", len, pos);
+                /* presumably this is only possible if racing with a
+                   rename of one of the parent directories (we can not
+                   lock the dentries above us to prevent this, but
+                   retrying should be harmless) */
+                kfree(path);
+                goto retry;
+        }
+
+        *base = ceph_ino(temp->d_inode);
+        *plen = len;
+        dout("build_path_dentry on %p %d built %llx '%.*s'\n",
+             dentry, atomic_read(&dentry->d_count), *base, len, path);
+        return path;
+}
+
+static int build_dentry_path(struct dentry *dentry,
+                             const char **ppath, int *ppathlen, u64 *pino,
+                             int *pfreepath)
+{
+        char *path;
+
+        if (ceph_snap(dentry->d_parent->d_inode) == CEPH_NOSNAP) {
+                *pino = ceph_ino(dentry->d_parent->d_inode);
+                *ppath = dentry->d_name.name;
+                *ppathlen = dentry->d_name.len;
+                return 0;
+        }
+        path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        *ppath = path;
+        *pfreepath = 1;
+        return 0;
+}
+
+static int build_inode_path(struct inode *inode,
+                            const char **ppath, int *ppathlen, u64 *pino,
+                            int *pfreepath)
+{
+        struct dentry *dentry;
+        char *path;
+
+        if (ceph_snap(inode) == CEPH_NOSNAP) {
+                *pino = ceph_ino(inode);
+                *ppathlen = 0;
+                return 0;
+        }
+        dentry = d_find_alias(inode);
+        path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1);
+        dput(dentry);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        *ppath = path;
+        *pfreepath = 1;
+        return 0;
+}
+
+/*
+ * request arguments may be specified via an inode *, a dentry *, or
+ * an explicit ino+path.
+ */
+static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
+                                  const char *rpath, u64 rino,
+                                  const char **ppath, int *pathlen,
+                                  u64 *ino, int *freepath)
+{
+        int r = 0;
+
+        if (rinode) {
+                r = build_inode_path(rinode, ppath, pathlen, ino, freepath);
+                dout(" inode %p %llx.%llx\n", rinode, ceph_ino(rinode),
+                     ceph_snap(rinode));
+        } else if (rdentry) {
+                r = build_dentry_path(rdentry, ppath, pathlen, ino, freepath);
+                dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen,
+                     *ppath);
+        } else if (rpath) {
+                *ino = rino;
+                *ppath = rpath;
+                *pathlen = strlen(rpath);
+                dout(" path %.*s\n", *pathlen, rpath);
+        }
+
+        return r;
+}
+
+/*
+ * called under mdsc->mutex
+ */
+static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
+                                               struct ceph_mds_request *req,
+                                               int mds)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_request_head *head;
+        const char *path1 = NULL;
+        const char *path2 = NULL;
+        u64 ino1 = 0, ino2 = 0;
+        int pathlen1 = 0, pathlen2 = 0;
+        int freepath1 = 0, freepath2 = 0;
+        int len;
+        u16 releases;
+        void *p, *end;
+        int ret;
+
+        ret = set_request_path_attr(req->r_inode, req->r_dentry,
+                              req->r_path1, req->r_ino1.ino,
+                              &path1, &pathlen1, &ino1, &freepath1);
+        if (ret < 0) {
+                msg = ERR_PTR(ret);
+                goto out;
+        }
+
+        ret = set_request_path_attr(NULL, req->r_old_dentry,
+                              req->r_path2, req->r_ino2.ino,
+                              &path2, &pathlen2, &ino2, &freepath2);
+        if (ret < 0) {
+                msg = ERR_PTR(ret);
+                goto out_free1;
+        }
+
+        len = sizeof(*head) +
+                pathlen1 + pathlen2 + 2*(1 + sizeof(u32) + sizeof(u64));
+
+        /* calculate (max) length for cap releases */
+        len += sizeof(struct ceph_mds_request_release) *
+                (!!req->r_inode_drop + !!req->r_dentry_drop +
+                 !!req->r_old_inode_drop + !!req->r_old_dentry_drop);
+        if (req->r_dentry_drop)
+                len += req->r_dentry->d_name.len;
+        if (req->r_old_dentry_drop)
+                len += req->r_old_dentry->d_name.len;
+
+        msg = ceph_msg_new(CEPH_MSG_CLIENT_REQUEST, len, 0, 0, NULL);
+        if (IS_ERR(msg))
+                goto out_free2;
+
+        msg->hdr.tid = cpu_to_le64(req->r_tid);
+
+        head = msg->front.iov_base;
+        p = msg->front.iov_base + sizeof(*head);
+        end = msg->front.iov_base + msg->front.iov_len;
+
+        head->mdsmap_epoch = cpu_to_le32(mdsc->mdsmap->m_epoch);
+        head->op = cpu_to_le32(req->r_op);
+        head->caller_uid = cpu_to_le32(current_fsuid());
+        head->caller_gid = cpu_to_le32(current_fsgid());
+        head->args = req->r_args;
+
+        ceph_encode_filepath(&p, end, ino1, path1);
+        ceph_encode_filepath(&p, end, ino2, path2);
+
+        /* cap releases */
+        releases = 0;
+        if (req->r_inode_drop)
+                releases += ceph_encode_inode_release(&p,
+                      req->r_inode ? req->r_inode : req->r_dentry->d_inode,
+                      mds, req->r_inode_drop, req->r_inode_unless, 0);
+        if (req->r_dentry_drop)
+                releases += ceph_encode_dentry_release(&p, req->r_dentry,
+                       mds, req->r_dentry_drop, req->r_dentry_unless);
+        if (req->r_old_dentry_drop)
+                releases += ceph_encode_dentry_release(&p, req->r_old_dentry,
+                       mds, req->r_old_dentry_drop, req->r_old_dentry_unless);
+        if (req->r_old_inode_drop)
+                releases += ceph_encode_inode_release(&p,
+                      req->r_old_dentry->d_inode,
+                      mds, req->r_old_inode_drop, req->r_old_inode_unless, 0);
+        head->num_releases = cpu_to_le16(releases);
+
+        BUG_ON(p > end);
+        msg->front.iov_len = p - msg->front.iov_base;
+        msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
+
+        msg->pages = req->r_pages;
+        msg->nr_pages = req->r_num_pages;
+        msg->hdr.data_len = cpu_to_le32(req->r_data_len);
+        msg->hdr.data_off = cpu_to_le16(0);
+
+out_free2:
+        if (freepath2)
+                kfree((char *)path2);
+out_free1:
+        if (freepath1)
+                kfree((char *)path1);
+out:
+        return msg;
+}
+
+/*
+ * called under mdsc->mutex if error, under no mutex if
+ * success.
+ */
+static void complete_request(struct ceph_mds_client *mdsc,
+                             struct ceph_mds_request *req)
+{
+        if (req->r_callback)
+                req->r_callback(mdsc, req);
+        else
+                complete(&req->r_completion);
+}
+
+/*
+ * called under mdsc->mutex
+ */
+static int __prepare_send_request(struct ceph_mds_client *mdsc,
+                                  struct ceph_mds_request *req,
+                                  int mds)
+{
+        struct ceph_mds_request_head *rhead;
+        struct ceph_msg *msg;
+        int flags = 0;
+
+        req->r_mds = mds;
+        req->r_attempts++;
+        dout("prepare_send_request %p tid %lld %s (attempt %d)\n", req,
+             req->r_tid, ceph_mds_op_name(req->r_op), req->r_attempts);
+
+        if (req->r_request) {
+                ceph_msg_put(req->r_request);
+                req->r_request = NULL;
+        }
+        msg = create_request_message(mdsc, req, mds);
+        if (IS_ERR(msg)) {
+                req->r_reply = ERR_PTR(PTR_ERR(msg));
+                complete_request(mdsc, req);
+                return -PTR_ERR(msg);
+        }
+        req->r_request = msg;
+
+        rhead = msg->front.iov_base;
+        rhead->oldest_client_tid = cpu_to_le64(__get_oldest_tid(mdsc));
+        if (req->r_got_unsafe)
+                flags |= CEPH_MDS_FLAG_REPLAY;
+        if (req->r_locked_dir)
+                flags |= CEPH_MDS_FLAG_WANT_DENTRY;
+        rhead->flags = cpu_to_le32(flags);
+        rhead->num_fwd = req->r_num_fwd;
+        rhead->num_retry = req->r_attempts - 1;
+
+        dout(" r_locked_dir = %p\n", req->r_locked_dir);
+
+        if (req->r_target_inode && req->r_got_unsafe)
+                rhead->ino = cpu_to_le64(ceph_ino(req->r_target_inode));
+        else
+                rhead->ino = 0;
+        return 0;
+}
+
+/*
+ * send request, or put it on the appropriate wait list.
+ */
+static int __do_request(struct ceph_mds_client *mdsc,
+                        struct ceph_mds_request *req)
+{
+        struct ceph_mds_session *session = NULL;
+        int mds = -1;
+        int err = -EAGAIN;
+
+        if (req->r_reply)
+                goto out;
+
+        if (req->r_timeout &&
+            time_after_eq(jiffies, req->r_started + req->r_timeout)) {
+                dout("do_request timed out\n");
+                err = -EIO;
+                goto finish;
+        }
+
+        mds = __choose_mds(mdsc, req);
+        if (mds < 0 ||
+            ceph_mdsmap_get_state(mdsc->mdsmap, mds) < CEPH_MDS_STATE_ACTIVE) {
+                dout("do_request no mds or not active, waiting for map\n");
+                list_add(&req->r_wait, &mdsc->waiting_for_map);
+                goto out;
+        }
+
+        /* get, open session */
+        session = __ceph_lookup_mds_session(mdsc, mds);
+        if (!session) {
+                session = register_session(mdsc, mds);
+                if (IS_ERR(session)) {
+                        err = PTR_ERR(session);
+                        goto finish;
+                }
+        }
+        dout("do_request mds%d session %p state %s\n", mds, session,
+             session_state_name(session->s_state));
+        if (session->s_state != CEPH_MDS_SESSION_OPEN &&
+            session->s_state != CEPH_MDS_SESSION_HUNG) {
+                if (session->s_state == CEPH_MDS_SESSION_NEW ||
+                    session->s_state == CEPH_MDS_SESSION_CLOSING)
+                        __open_session(mdsc, session);
+                list_add(&req->r_wait, &session->s_waiting);
+                goto out_session;
+        }
+
+        /* send request */
+        req->r_session = get_session(session);
+        req->r_resend_mds = -1;   /* forget any previous mds hint */
+
+        if (req->r_request_started == 0)   /* note request start time */
+                req->r_request_started = jiffies;
+
+        err = __prepare_send_request(mdsc, req, mds);
+        if (!err) {
+                ceph_msg_get(req->r_request);
+                ceph_con_send(&session->s_con, req->r_request);
+        }
+
+out_session:
+        ceph_put_mds_session(session);
+out:
+        return err;
+
+finish:
+        req->r_reply = ERR_PTR(err);
+        complete_request(mdsc, req);
+        goto out;
+}
+
+/*
+ * called under mdsc->mutex
+ */
+static void __wake_requests(struct ceph_mds_client *mdsc,
+                            struct list_head *head)
+{
+        struct ceph_mds_request *req, *nreq;
+
+        list_for_each_entry_safe(req, nreq, head, r_wait) {
+                list_del_init(&req->r_wait);
+                __do_request(mdsc, req);
+        }
+}
+
+/*
+ * Wake up threads with requests pending for @mds, so that they can
+ * resubmit their requests to a possibly different mds.  If @all is set,
+ * wake up if their requests has been forwarded to @mds, too.
+ */
+static void kick_requests(struct ceph_mds_client *mdsc, int mds, int all)
+{
+        struct ceph_mds_request *req;
+        struct rb_node *p;
+
+        dout("kick_requests mds%d\n", mds);
+        for (p = rb_first(&mdsc->request_tree); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_mds_request, r_node);
+                if (req->r_got_unsafe)
+                        continue;
+                if (req->r_session &&
+                    req->r_session->s_mds == mds) {
+                        dout(" kicking tid %llu\n", req->r_tid);
+                        put_request_session(req);
+                        __do_request(mdsc, req);
+                }
+        }
+}
+
+void ceph_mdsc_submit_request(struct ceph_mds_client *mdsc,
+                              struct ceph_mds_request *req)
+{
+        dout("submit_request on %p\n", req);
+        mutex_lock(&mdsc->mutex);
+        __register_request(mdsc, req, NULL);
+        __do_request(mdsc, req);
+        mutex_unlock(&mdsc->mutex);
+}
+
+/*
+ * Synchrously perform an mds request.  Take care of all of the
+ * session setup, forwarding, retry details.
+ */
+int ceph_mdsc_do_request(struct ceph_mds_client *mdsc,
+                         struct inode *dir,
+                         struct ceph_mds_request *req)
+{
+        int err;
+
+        dout("do_request on %p\n", req);
+
+        /* take CAP_PIN refs for r_inode, r_locked_dir, r_old_dentry */
+        if (req->r_inode)
+                ceph_get_cap_refs(ceph_inode(req->r_inode), CEPH_CAP_PIN);
+        if (req->r_locked_dir)
+                ceph_get_cap_refs(ceph_inode(req->r_locked_dir), CEPH_CAP_PIN);
+        if (req->r_old_dentry)
+                ceph_get_cap_refs(
+                        ceph_inode(req->r_old_dentry->d_parent->d_inode),
+                        CEPH_CAP_PIN);
+
+        /* issue */
+        mutex_lock(&mdsc->mutex);
+        __register_request(mdsc, req, dir);
+        __do_request(mdsc, req);
+
+        /* wait */
+        if (!req->r_reply) {
+                mutex_unlock(&mdsc->mutex);
+                if (req->r_timeout) {
+                        err = (long)wait_for_completion_interruptible_timeout(
+                                &req->r_completion, req->r_timeout);
+                        if (err == 0)
+                                req->r_reply = ERR_PTR(-EIO);
+                        else if (err < 0)
+                                req->r_reply = ERR_PTR(err);
+                } else {
+                        err = wait_for_completion_interruptible(
+                                &req->r_completion);
+                        if (err)
+                                req->r_reply = ERR_PTR(err);
+                }
+                mutex_lock(&mdsc->mutex);
+        }
+
+        if (IS_ERR(req->r_reply)) {
+                err = PTR_ERR(req->r_reply);
+                req->r_reply = NULL;
+
+                if (err == -ERESTARTSYS) {
+                        /* aborted */
+                        req->r_aborted = true;
+
+                        if (req->r_locked_dir &&
+                            (req->r_op & CEPH_MDS_OP_WRITE)) {
+                                struct ceph_inode_info *ci =
+                                        ceph_inode(req->r_locked_dir);
+
+                                dout("aborted, clearing I_COMPLETE on %p\n", 
+                                     req->r_locked_dir);
+                                spin_lock(&req->r_locked_dir->i_lock);
+                                ci->i_ceph_flags &= ~CEPH_I_COMPLETE;
+                                ci->i_release_count++;
+                                spin_unlock(&req->r_locked_dir->i_lock);
+                        }
+                } else {
+                        /* clean up this request */
+                        __unregister_request(mdsc, req);
+                        if (!list_empty(&req->r_unsafe_item))
+                                list_del_init(&req->r_unsafe_item);
+                        complete(&req->r_safe_completion);
+                }
+        } else if (req->r_err) {
+                err = req->r_err;
+        } else {
+                err = le32_to_cpu(req->r_reply_info.head->result);
+        }
+        mutex_unlock(&mdsc->mutex);
+
+        dout("do_request %p done, result %d\n", req, err);
+        return err;
+}
+
+/*
+ * Handle mds reply.
+ *
+ * We take the session mutex and parse and process the reply immediately.
+ * This preserves the logical ordering of replies, capabilities, etc., sent
+ * by the MDS as they are applied to our local cache.
+ */
+static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
+{
+        struct ceph_mds_client *mdsc = session->s_mdsc;
+        struct ceph_mds_request *req;
+        struct ceph_mds_reply_head *head = msg->front.iov_base;
+        struct ceph_mds_reply_info_parsed *rinfo;  /* parsed reply info */
+        u64 tid;
+        int err, result;
+        int mds = session->s_mds;
+
+        if (msg->front.iov_len < sizeof(*head)) {
+                pr_err("mdsc_handle_reply got corrupt (short) reply\n");
+                ceph_msg_dump(msg);
+                return;
+        }
+
+        /* get request, session */
+        tid = le64_to_cpu(msg->hdr.tid);
+        mutex_lock(&mdsc->mutex);
+        req = __lookup_request(mdsc, tid);
+        if (!req) {
+                dout("handle_reply on unknown tid %llu\n", tid);
+                mutex_unlock(&mdsc->mutex);
+                return;
+        }
+        dout("handle_reply %p\n", req);
+
+        /* correct session? */
+        if (req->r_session != session) {
+                pr_err("mdsc_handle_reply got %llu on session mds%d"
+                       " not mds%d\n", tid, session->s_mds,
+                       req->r_session ? req->r_session->s_mds : -1);
+                mutex_unlock(&mdsc->mutex);
+                goto out;
+        }
+
+        /* dup? */
+        if ((req->r_got_unsafe && !head->safe) ||
+            (req->r_got_safe && head->safe)) {
+                pr_warning("got a dup %s reply on %llu from mds%d\n",
+                           head->safe ? "safe" : "unsafe", tid, mds);
+                mutex_unlock(&mdsc->mutex);
+                goto out;
+        }
+
+        result = le32_to_cpu(head->result);
+
+        /*
+         * Tolerate 2 consecutive ESTALEs from the same mds.
+         * FIXME: we should be looking at the cap migrate_seq.
+         */
+        if (result == -ESTALE) {
+                req->r_direct_mode = USE_AUTH_MDS;
+                req->r_num_stale++;
+                if (req->r_num_stale <= 2) {
+                        __do_request(mdsc, req);
+                        mutex_unlock(&mdsc->mutex);
+                        goto out;
+                }
+        } else {
+                req->r_num_stale = 0;
+        }
+
+        if (head->safe) {
+                req->r_got_safe = true;
+                __unregister_request(mdsc, req);
+                complete(&req->r_safe_completion);
+
+                if (req->r_got_unsafe) {
+                        /*
+                         * We already handled the unsafe response, now do the
+                         * cleanup.  No need to examine the response; the MDS
+                         * doesn't include any result info in the safe
+                         * response.  And even if it did, there is nothing
+                         * useful we could do with a revised return value.
+                         */
+                        dout("got safe reply %llu, mds%d\n", tid, mds);
+                        list_del_init(&req->r_unsafe_item);
+
+                        /* last unsafe request during umount? */
+                        if (mdsc->stopping && !__get_oldest_req(mdsc))
+                                complete(&mdsc->safe_umount_waiters);
+                        mutex_unlock(&mdsc->mutex);
+                        goto out;
+                }
+        }
+
+        BUG_ON(req->r_reply);
+
+        if (!head->safe) {
+                req->r_got_unsafe = true;
+                list_add_tail(&req->r_unsafe_item, &req->r_session->s_unsafe);
+        }
+
+        dout("handle_reply tid %lld result %d\n", tid, result);
+        rinfo = &req->r_reply_info;
+        err = parse_reply_info(msg, rinfo);
+        mutex_unlock(&mdsc->mutex);
+
+        mutex_lock(&session->s_mutex);
+        if (err < 0) {
+                pr_err("mdsc_handle_reply got corrupt reply mds%d\n", mds);
+                ceph_msg_dump(msg);
+                goto out_err;
+        }
+
+        /* snap trace */
+        if (rinfo->snapblob_len) {
+                down_write(&mdsc->snap_rwsem);
+                ceph_update_snap_trace(mdsc, rinfo->snapblob,
+                               rinfo->snapblob + rinfo->snapblob_len,
+                               le32_to_cpu(head->op) == CEPH_MDS_OP_RMSNAP);
+                downgrade_write(&mdsc->snap_rwsem);
+        } else {
+                down_read(&mdsc->snap_rwsem);
+        }
+
+        /* insert trace into our cache */
+        err = ceph_fill_trace(mdsc->client->sb, req, req->r_session);
+        if (err == 0) {
+                if (result == 0 && rinfo->dir_nr)
+                        ceph_readdir_prepopulate(req, req->r_session);
+                ceph_unreserve_caps(&req->r_caps_reservation);
+        }
+
+        up_read(&mdsc->snap_rwsem);
+out_err:
+        if (err) {
+                req->r_err = err;
+        } else {
+                req->r_reply = msg;
+                ceph_msg_get(msg);
+        }
+
+        add_cap_releases(mdsc, req->r_session, -1);
+        mutex_unlock(&session->s_mutex);
+
+        /* kick calling process */
+        complete_request(mdsc, req);
+out:
+        ceph_mdsc_put_request(req);
+        return;
+}
+
+
+
+/*
+ * handle mds notification that our request has been forwarded.
+ */
+static void handle_forward(struct ceph_mds_client *mdsc,
+                           struct ceph_mds_session *session,
+                           struct ceph_msg *msg)
+{
+        struct ceph_mds_request *req;
+        u64 tid = le64_to_cpu(msg->hdr.tid);
+        u32 next_mds;
+        u32 fwd_seq;
+        int err = -EINVAL;
+        void *p = msg->front.iov_base;
+        void *end = p + msg->front.iov_len;
+
+        ceph_decode_need(&p, end, 2*sizeof(u32), bad);
+        next_mds = ceph_decode_32(&p);
+        fwd_seq = ceph_decode_32(&p);
+
+        mutex_lock(&mdsc->mutex);
+        req = __lookup_request(mdsc, tid);
+        if (!req) {
+                dout("forward %llu to mds%d - req dne\n", tid, next_mds);
+                goto out;  /* dup reply? */
+        }
+
+        if (fwd_seq <= req->r_num_fwd) {
+                dout("forward %llu to mds%d - old seq %d <= %d\n",
+                     tid, next_mds, req->r_num_fwd, fwd_seq);
+        } else {
+                /* resend. forward race not possible; mds would drop */
+                dout("forward %llu to mds%d (we resend)\n", tid, next_mds);
+                req->r_num_fwd = fwd_seq;
+                req->r_resend_mds = next_mds;
+                put_request_session(req);
+                __do_request(mdsc, req);
+        }
+        ceph_mdsc_put_request(req);
+out:
+        mutex_unlock(&mdsc->mutex);
+        return;
+
+bad:
+        pr_err("mdsc_handle_forward decode error err=%d\n", err);
+}
+
+/*
+ * handle a mds session control message
+ */
+static void handle_session(struct ceph_mds_session *session,
+                           struct ceph_msg *msg)
+{
+        struct ceph_mds_client *mdsc = session->s_mdsc;
+        u32 op;
+        u64 seq;
+        int mds = session->s_mds;
+        struct ceph_mds_session_head *h = msg->front.iov_base;
+        int wake = 0;
+
+        /* decode */
+        if (msg->front.iov_len != sizeof(*h))
+                goto bad;
+        op = le32_to_cpu(h->op);
+        seq = le64_to_cpu(h->seq);
+
+        mutex_lock(&mdsc->mutex);
+        if (op == CEPH_SESSION_CLOSE)
+                __unregister_session(mdsc, session);
+        /* FIXME: this ttl calculation is generous */
+        session->s_ttl = jiffies + HZ*mdsc->mdsmap->m_session_autoclose;
+        mutex_unlock(&mdsc->mutex);
+
+        mutex_lock(&session->s_mutex);
+
+        dout("handle_session mds%d %s %p state %s seq %llu\n",
+             mds, ceph_session_op_name(op), session,
+             session_state_name(session->s_state), seq);
+
+        if (session->s_state == CEPH_MDS_SESSION_HUNG) {
+                session->s_state = CEPH_MDS_SESSION_OPEN;
+                pr_info("mds%d came back\n", session->s_mds);
+        }
+
+        switch (op) {
+        case CEPH_SESSION_OPEN:
+                session->s_state = CEPH_MDS_SESSION_OPEN;
+                renewed_caps(mdsc, session, 0);
+                wake = 1;
+                if (mdsc->stopping)
+                        __close_session(mdsc, session);
+                break;
+
+        case CEPH_SESSION_RENEWCAPS:
+                if (session->s_renew_seq == seq)
+                        renewed_caps(mdsc, session, 1);
+                break;
+
+        case CEPH_SESSION_CLOSE:
+                remove_session_caps(session);
+                wake = 1; /* for good measure */
+                complete(&mdsc->session_close_waiters);
+                kick_requests(mdsc, mds, 0);      /* cur only */
+                break;
+
+        case CEPH_SESSION_STALE:
+                pr_info("mds%d caps went stale, renewing\n",
+                        session->s_mds);
+                spin_lock(&session->s_cap_lock);
+                session->s_cap_gen++;
+                session->s_cap_ttl = 0;
+                spin_unlock(&session->s_cap_lock);
+                send_renew_caps(mdsc, session);
+                break;
+
+        case CEPH_SESSION_RECALL_STATE:
+                trim_caps(mdsc, session, le32_to_cpu(h->max_caps));
+                break;
+
+        default:
+                pr_err("mdsc_handle_session bad op %d mds%d\n", op, mds);
+                WARN_ON(1);
+        }
+
+        mutex_unlock(&session->s_mutex);
+        if (wake) {
+                mutex_lock(&mdsc->mutex);
+                __wake_requests(mdsc, &session->s_waiting);
+                mutex_unlock(&mdsc->mutex);
+        }
+        return;
+
+bad:
+        pr_err("mdsc_handle_session corrupt message mds%d len %d\n", mds,
+               (int)msg->front.iov_len);
+        ceph_msg_dump(msg);
+        return;
+}
+
+
+/*
+ * called under session->mutex.
+ */
+static void replay_unsafe_requests(struct ceph_mds_client *mdsc,
+                                   struct ceph_mds_session *session)
+{
+        struct ceph_mds_request *req, *nreq;
+        int err;
+
+        dout("replay_unsafe_requests mds%d\n", session->s_mds);
+
+        mutex_lock(&mdsc->mutex);
+        list_for_each_entry_safe(req, nreq, &session->s_unsafe, r_unsafe_item) {
+                err = __prepare_send_request(mdsc, req, session->s_mds);
+                if (!err) {
+                        ceph_msg_get(req->r_request);
+                        ceph_con_send(&session->s_con, req->r_request);
+                }
+        }
+        mutex_unlock(&mdsc->mutex);
+}
+
+/*
+ * Encode information about a cap for a reconnect with the MDS.
+ */
+static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
+                          void *arg)
+{
+        struct ceph_mds_cap_reconnect rec;
+        struct ceph_inode_info *ci;
+        struct ceph_pagelist *pagelist = arg;
+        char *path;
+        int pathlen, err;
+        u64 pathbase;
+        struct dentry *dentry;
+
+        ci = cap->ci;
+
+        dout(" adding %p ino %llx.%llx cap %p %lld %s\n",
+             inode, ceph_vinop(inode), cap, cap->cap_id,
+             ceph_cap_string(cap->issued));
+        err = ceph_pagelist_encode_64(pagelist, ceph_ino(inode));
+        if (err)
+                return err;
+
+        dentry = d_find_alias(inode);
+        if (dentry) {
+                path = ceph_mdsc_build_path(dentry, &pathlen, &pathbase, 0);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        BUG_ON(err);
+                }
+        } else {
+                path = NULL;
+                pathlen = 0;
+        }
+        err = ceph_pagelist_encode_string(pagelist, path, pathlen);
+        if (err)
+                goto out;
+
+        spin_lock(&inode->i_lock);
+        cap->seq = 0;        /* reset cap seq */
+        cap->issue_seq = 0;  /* and issue_seq */
+        rec.cap_id = cpu_to_le64(cap->cap_id);
+        rec.pathbase = cpu_to_le64(pathbase);
+        rec.wanted = cpu_to_le32(__ceph_caps_wanted(ci));
+        rec.issued = cpu_to_le32(cap->issued);
+        rec.size = cpu_to_le64(inode->i_size);
+        ceph_encode_timespec(&rec.mtime, &inode->i_mtime);
+        ceph_encode_timespec(&rec.atime, &inode->i_atime);
+        rec.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);
+        spin_unlock(&inode->i_lock);
+
+        err = ceph_pagelist_append(pagelist, &rec, sizeof(rec));
+
+out:
+        kfree(path);
+        dput(dentry);
+        return err;
+}
+
+
+/*
+ * If an MDS fails and recovers, clients need to reconnect in order to
+ * reestablish shared state.  This includes all caps issued through
+ * this session _and_ the snap_realm hierarchy.  Because it's not
+ * clear which snap realms the mds cares about, we send everything we
+ * know about.. that ensures we'll then get any new info the
+ * recovering MDS might have.
+ *
+ * This is a relatively heavyweight operation, but it's rare.
+ *
+ * called with mdsc->mutex held.
+ */
+static void send_mds_reconnect(struct ceph_mds_client *mdsc, int mds)
+{
+        struct ceph_mds_session *session = NULL;
+        struct ceph_msg *reply;
+        struct rb_node *p;
+        int err;
+        struct ceph_pagelist *pagelist;
+
+        pr_info("reconnect to recovering mds%d\n", mds);
+
+        pagelist = kmalloc(sizeof(*pagelist), GFP_NOFS);
+        if (!pagelist)
+                goto fail_nopagelist;
+        ceph_pagelist_init(pagelist);
+
+        reply = ceph_msg_new(CEPH_MSG_CLIENT_RECONNECT, 0, 0, 0, NULL);
+        if (IS_ERR(reply)) {
+                err = PTR_ERR(reply);
+                goto fail_nomsg;
+        }
+
+        /* find session */
+        session = __ceph_lookup_mds_session(mdsc, mds);
+        mutex_unlock(&mdsc->mutex);    /* drop lock for duration */
+
+        if (session) {
+                mutex_lock(&session->s_mutex);
+
+                session->s_state = CEPH_MDS_SESSION_RECONNECTING;
+                session->s_seq = 0;
+
+                ceph_con_open(&session->s_con,
+                              ceph_mdsmap_get_addr(mdsc->mdsmap, mds));
+
+                /* replay unsafe requests */
+                replay_unsafe_requests(mdsc, session);
+        } else {
+                dout("no session for mds%d, will send short reconnect\n",
+                     mds);
+        }
+
+        down_read(&mdsc->snap_rwsem);
+
+        if (!session)
+                goto send;
+        dout("session %p state %s\n", session,
+             session_state_name(session->s_state));
+
+        /* traverse this session's caps */
+        err = ceph_pagelist_encode_32(pagelist, session->s_nr_caps);
+        if (err)
+                goto fail;
+        err = iterate_session_caps(session, encode_caps_cb, pagelist);
+        if (err < 0)
+                goto out;
+
+        /*
+         * snaprealms.  we provide mds with the ino, seq (version), and
+         * parent for all of our realms.  If the mds has any newer info,
+         * it will tell us.
+         */
+        for (p = rb_first(&mdsc->snap_realms); p; p = rb_next(p)) {
+                struct ceph_snap_realm *realm =
+                        rb_entry(p, struct ceph_snap_realm, node);
+                struct ceph_mds_snaprealm_reconnect sr_rec;
+
+                dout(" adding snap realm %llx seq %lld parent %llx\n",
+                     realm->ino, realm->seq, realm->parent_ino);
+                sr_rec.ino = cpu_to_le64(realm->ino);
+                sr_rec.seq = cpu_to_le64(realm->seq);
+                sr_rec.parent = cpu_to_le64(realm->parent_ino);
+                err = ceph_pagelist_append(pagelist, &sr_rec, sizeof(sr_rec));
+                if (err)
+                        goto fail;
+        }
+
+send:
+        reply->pagelist = pagelist;
+        reply->hdr.data_len = cpu_to_le32(pagelist->length);
+        reply->nr_pages = calc_pages_for(0, pagelist->length);
+        ceph_con_send(&session->s_con, reply);
+
+        if (session) {
+                session->s_state = CEPH_MDS_SESSION_OPEN;
+                __wake_requests(mdsc, &session->s_waiting);
+        }
+
+out:
+        up_read(&mdsc->snap_rwsem);
+        if (session) {
+                mutex_unlock(&session->s_mutex);
+                ceph_put_mds_session(session);
+        }
+        mutex_lock(&mdsc->mutex);
+        return;
+
+fail:
+        ceph_msg_put(reply);
+fail_nomsg:
+        ceph_pagelist_release(pagelist);
+        kfree(pagelist);
+fail_nopagelist:
+        pr_err("ENOMEM preparing reconnect for mds%d\n", mds);
+        goto out;
+}
+
+
+/*
+ * compare old and new mdsmaps, kicking requests
+ * and closing out old connections as necessary
+ *
+ * called under mdsc->mutex.
+ */
+static void check_new_map(struct ceph_mds_client *mdsc,
+                          struct ceph_mdsmap *newmap,
+                          struct ceph_mdsmap *oldmap)
+{
+        int i;
+        int oldstate, newstate;
+        struct ceph_mds_session *s;
+
+        dout("check_new_map new %u old %u\n",
+             newmap->m_epoch, oldmap->m_epoch);
+
+        for (i = 0; i < oldmap->m_max_mds && i < mdsc->max_sessions; i++) {
+                if (mdsc->sessions[i] == NULL)
+                        continue;
+                s = mdsc->sessions[i];
+                oldstate = ceph_mdsmap_get_state(oldmap, i);
+                newstate = ceph_mdsmap_get_state(newmap, i);
+
+                dout("check_new_map mds%d state %s -> %s (session %s)\n",
+                     i, ceph_mds_state_name(oldstate),
+                     ceph_mds_state_name(newstate),
+                     session_state_name(s->s_state));
+
+                if (memcmp(ceph_mdsmap_get_addr(oldmap, i),
+                           ceph_mdsmap_get_addr(newmap, i),
+                           sizeof(struct ceph_entity_addr))) {
+                        if (s->s_state == CEPH_MDS_SESSION_OPENING) {
+                                /* the session never opened, just close it
+                                 * out now */
+                                __wake_requests(mdsc, &s->s_waiting);
+                                __unregister_session(mdsc, s);
+                        } else {
+                                /* just close it */
+                                mutex_unlock(&mdsc->mutex);
+                                mutex_lock(&s->s_mutex);
+                                mutex_lock(&mdsc->mutex);
+                                ceph_con_close(&s->s_con);
+                                mutex_unlock(&s->s_mutex);
+                                s->s_state = CEPH_MDS_SESSION_RESTARTING;
+                        }
+
+                        /* kick any requests waiting on the recovering mds */
+                        kick_requests(mdsc, i, 1);
+                } else if (oldstate == newstate) {
+                        continue;  /* nothing new with this mds */
+                }
+
+                /*
+                 * send reconnect?
+                 */
+                if (s->s_state == CEPH_MDS_SESSION_RESTARTING &&
+                    newstate >= CEPH_MDS_STATE_RECONNECT)
+                        send_mds_reconnect(mdsc, i);
+
+                /*
+                 * kick requests on any mds that has gone active.
+                 *
+                 * kick requests on cur or forwarder: we may have sent
+                 * the request to mds1, mds1 told us it forwarded it
+                 * to mds2, but then we learn mds1 failed and can't be
+                 * sure it successfully forwarded our request before
+                 * it died.
+                 */
+                if (oldstate < CEPH_MDS_STATE_ACTIVE &&
+                    newstate >= CEPH_MDS_STATE_ACTIVE) {
+                        pr_info("mds%d reconnect completed\n", s->s_mds);
+                        kick_requests(mdsc, i, 1);
+                        ceph_kick_flushing_caps(mdsc, s);
+                        wake_up_session_caps(s, 1);
+                }
+        }
+}
+
+
+
+/*
+ * leases
+ */
+
+/*
+ * caller must hold session s_mutex, dentry->d_lock
+ */
+void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry)
+{
+        struct ceph_dentry_info *di = ceph_dentry(dentry);
+
+        ceph_put_mds_session(di->lease_session);
+        di->lease_session = NULL;
+}
+
+static void handle_lease(struct ceph_mds_client *mdsc,
+                         struct ceph_mds_session *session,
+                         struct ceph_msg *msg)
+{
+        struct super_block *sb = mdsc->client->sb;
+        struct inode *inode;
+        struct ceph_inode_info *ci;
+        struct dentry *parent, *dentry;
+        struct ceph_dentry_info *di;
+        int mds = session->s_mds;
+        struct ceph_mds_lease *h = msg->front.iov_base;
+        struct ceph_vino vino;
+        int mask;
+        struct qstr dname;
+        int release = 0;
+
+        dout("handle_lease from mds%d\n", mds);
+
+        /* decode */
+        if (msg->front.iov_len < sizeof(*h) + sizeof(u32))
+                goto bad;
+        vino.ino = le64_to_cpu(h->ino);
+        vino.snap = CEPH_NOSNAP;
+        mask = le16_to_cpu(h->mask);
+        dname.name = (void *)h + sizeof(*h) + sizeof(u32);
+        dname.len = msg->front.iov_len - sizeof(*h) - sizeof(u32);
+        if (dname.len != get_unaligned_le32(h+1))
+                goto bad;
+
+        mutex_lock(&session->s_mutex);
+        session->s_seq++;
+
+        /* lookup inode */
+        inode = ceph_find_inode(sb, vino);
+        dout("handle_lease '%s', mask %d, ino %llx %p\n",
+             ceph_lease_op_name(h->action), mask, vino.ino, inode);
+        if (inode == NULL) {
+                dout("handle_lease no inode %llx\n", vino.ino);
+                goto release;
+        }
+        ci = ceph_inode(inode);
+
+        /* dentry */
+        parent = d_find_alias(inode);
+        if (!parent) {
+                dout("no parent dentry on inode %p\n", inode);
+                WARN_ON(1);
+                goto release;  /* hrm... */
+        }
+        dname.hash = full_name_hash(dname.name, dname.len);
+        dentry = d_lookup(parent, &dname);
+        dput(parent);
+        if (!dentry)
+                goto release;
+
+        spin_lock(&dentry->d_lock);
+        di = ceph_dentry(dentry);
+        switch (h->action) {
+        case CEPH_MDS_LEASE_REVOKE:
+                if (di && di->lease_session == session) {
+                        h->seq = cpu_to_le32(di->lease_seq);
+                        __ceph_mdsc_drop_dentry_lease(dentry);
+                }
+                release = 1;
+                break;
+
+        case CEPH_MDS_LEASE_RENEW:
+                if (di && di->lease_session == session &&
+                    di->lease_gen == session->s_cap_gen &&
+                    di->lease_renew_from &&
+                    di->lease_renew_after == 0) {
+                        unsigned long duration =
+                                le32_to_cpu(h->duration_ms) * HZ / 1000;
+
+                        di->lease_seq = le32_to_cpu(h->seq);
+                        dentry->d_time = di->lease_renew_from + duration;
+                        di->lease_renew_after = di->lease_renew_from +
+                                (duration >> 1);
+                        di->lease_renew_from = 0;
+                }
+                break;
+        }
+        spin_unlock(&dentry->d_lock);
+        dput(dentry);
+
+        if (!release)
+                goto out;
+
+release:
+        /* let's just reuse the same message */
+        h->action = CEPH_MDS_LEASE_REVOKE_ACK;
+        ceph_msg_get(msg);
+        ceph_con_send(&session->s_con, msg);
+
+out:
+        iput(inode);
+        mutex_unlock(&session->s_mutex);
+        return;
+
+bad:
+        pr_err("corrupt lease message\n");
+        ceph_msg_dump(msg);
+}
+
+void ceph_mdsc_lease_send_msg(struct ceph_mds_session *session,
+                              struct inode *inode,
+                              struct dentry *dentry, char action,
+                              u32 seq)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_lease *lease;
+        int len = sizeof(*lease) + sizeof(u32);
+        int dnamelen = 0;
+
+        dout("lease_send_msg inode %p dentry %p %s to mds%d\n",
+             inode, dentry, ceph_lease_op_name(action), session->s_mds);
+        dnamelen = dentry->d_name.len;
+        len += dnamelen;
+
+        msg = ceph_msg_new(CEPH_MSG_CLIENT_LEASE, len, 0, 0, NULL);
+        if (IS_ERR(msg))
+                return;
+        lease = msg->front.iov_base;
+        lease->action = action;
+        lease->mask = cpu_to_le16(CEPH_LOCK_DN);
+        lease->ino = cpu_to_le64(ceph_vino(inode).ino);
+        lease->first = lease->last = cpu_to_le64(ceph_vino(inode).snap);
+        lease->seq = cpu_to_le32(seq);
+        put_unaligned_le32(dnamelen, lease + 1);
+        memcpy((void *)(lease + 1) + 4, dentry->d_name.name, dnamelen);
+
+        /*
+         * if this is a preemptive lease RELEASE, no need to
+         * flush request stream, since the actual request will
+         * soon follow.
+         */
+        msg->more_to_follow = (action == CEPH_MDS_LEASE_RELEASE);
+
+        ceph_con_send(&session->s_con, msg);
+}
+
+/*
+ * Preemptively release a lease we expect to invalidate anyway.
+ * Pass @inode always, @dentry is optional.
+ */
+void ceph_mdsc_lease_release(struct ceph_mds_client *mdsc, struct inode *inode,
+                             struct dentry *dentry, int mask)
+{
+        struct ceph_dentry_info *di;
+        struct ceph_mds_session *session;
+        u32 seq;
+
+        BUG_ON(inode == NULL);
+        BUG_ON(dentry == NULL);
+        BUG_ON(mask != CEPH_LOCK_DN);
+
+        /* is dentry lease valid? */
+        spin_lock(&dentry->d_lock);
+        di = ceph_dentry(dentry);
+        if (!di || !di->lease_session ||
+            di->lease_session->s_mds < 0 ||
+            di->lease_gen != di->lease_session->s_cap_gen ||
+            !time_before(jiffies, dentry->d_time)) {
+                dout("lease_release inode %p dentry %p -- "
+                     "no lease on %d\n",
+                     inode, dentry, mask);
+                spin_unlock(&dentry->d_lock);
+                return;
+        }
+
+        /* we do have a lease on this dentry; note mds and seq */
+        session = ceph_get_mds_session(di->lease_session);
+        seq = di->lease_seq;
+        __ceph_mdsc_drop_dentry_lease(dentry);
+        spin_unlock(&dentry->d_lock);
+
+        dout("lease_release inode %p dentry %p mask %d to mds%d\n",
+             inode, dentry, mask, session->s_mds);
+        ceph_mdsc_lease_send_msg(session, inode, dentry,
+                                 CEPH_MDS_LEASE_RELEASE, seq);
+        ceph_put_mds_session(session);
+}
+
+/*
+ * drop all leases (and dentry refs) in preparation for umount
+ */
+static void drop_leases(struct ceph_mds_client *mdsc)
+{
+        int i;
+
+        dout("drop_leases\n");
+        mutex_lock(&mdsc->mutex);
+        for (i = 0; i < mdsc->max_sessions; i++) {
+                struct ceph_mds_session *s = __ceph_lookup_mds_session(mdsc, i);
+                if (!s)
+                        continue;
+                mutex_unlock(&mdsc->mutex);
+                mutex_lock(&s->s_mutex);
+                mutex_unlock(&s->s_mutex);
+                ceph_put_mds_session(s);
+                mutex_lock(&mdsc->mutex);
+        }
+        mutex_unlock(&mdsc->mutex);
+}
+
+
+
+/*
+ * delayed work -- periodically trim expired leases, renew caps with mds
+ */
+static void schedule_delayed(struct ceph_mds_client *mdsc)
+{
+        int delay = 5;
+        unsigned hz = round_jiffies_relative(HZ * delay);
+        schedule_delayed_work(&mdsc->delayed_work, hz);
+}
+
+static void delayed_work(struct work_struct *work)
+{
+        int i;
+        struct ceph_mds_client *mdsc =
+                container_of(work, struct ceph_mds_client, delayed_work.work);
+        int renew_interval;
+        int renew_caps;
+
+        dout("mdsc delayed_work\n");
+        ceph_check_delayed_caps(mdsc);
+
+        mutex_lock(&mdsc->mutex);
+        renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
+        renew_caps = time_after_eq(jiffies, HZ*renew_interval +
+                                   mdsc->last_renew_caps);
+        if (renew_caps)
+                mdsc->last_renew_caps = jiffies;
+
+        for (i = 0; i < mdsc->max_sessions; i++) {
+                struct ceph_mds_session *s = __ceph_lookup_mds_session(mdsc, i);
+                if (s == NULL)
+                        continue;
+                if (s->s_state == CEPH_MDS_SESSION_CLOSING) {
+                        dout("resending session close request for mds%d\n",
+                             s->s_mds);
+                        request_close_session(mdsc, s);
+                        ceph_put_mds_session(s);
+                        continue;
+                }
+                if (s->s_ttl && time_after(jiffies, s->s_ttl)) {
+                        if (s->s_state == CEPH_MDS_SESSION_OPEN) {
+                                s->s_state = CEPH_MDS_SESSION_HUNG;
+                                pr_info("mds%d hung\n", s->s_mds);
+                        }
+                }
+                if (s->s_state < CEPH_MDS_SESSION_OPEN) {
+                        /* this mds is failed or recovering, just wait */
+                        ceph_put_mds_session(s);
+                        continue;
+                }
+                mutex_unlock(&mdsc->mutex);
+
+                mutex_lock(&s->s_mutex);
+                if (renew_caps)
+                        send_renew_caps(mdsc, s);
+                else
+                        ceph_con_keepalive(&s->s_con);
+                add_cap_releases(mdsc, s, -1);
+                send_cap_releases(mdsc, s);
+                mutex_unlock(&s->s_mutex);
+                ceph_put_mds_session(s);
+
+                mutex_lock(&mdsc->mutex);
+        }
+        mutex_unlock(&mdsc->mutex);
+
+        schedule_delayed(mdsc);
+}
+
+
+int ceph_mdsc_init(struct ceph_mds_client *mdsc, struct ceph_client *client)
+{
+        mdsc->client = client;
+        mutex_init(&mdsc->mutex);
+        mdsc->mdsmap = kzalloc(sizeof(*mdsc->mdsmap), GFP_NOFS);
+        init_completion(&mdsc->safe_umount_waiters);
+        init_completion(&mdsc->session_close_waiters);
+        INIT_LIST_HEAD(&mdsc->waiting_for_map);
+        mdsc->sessions = NULL;
+        mdsc->max_sessions = 0;
+        mdsc->stopping = 0;
+        init_rwsem(&mdsc->snap_rwsem);
+        mdsc->snap_realms = RB_ROOT;
+        INIT_LIST_HEAD(&mdsc->snap_empty);
+        spin_lock_init(&mdsc->snap_empty_lock);
+        mdsc->last_tid = 0;
+        mdsc->request_tree = RB_ROOT;
+        INIT_DELAYED_WORK(&mdsc->delayed_work, delayed_work);
+        mdsc->last_renew_caps = jiffies;
+        INIT_LIST_HEAD(&mdsc->cap_delay_list);
+        spin_lock_init(&mdsc->cap_delay_lock);
+        INIT_LIST_HEAD(&mdsc->snap_flush_list);
+        spin_lock_init(&mdsc->snap_flush_lock);
+        mdsc->cap_flush_seq = 0;
+        INIT_LIST_HEAD(&mdsc->cap_dirty);
+        mdsc->num_cap_flushing = 0;
+        spin_lock_init(&mdsc->cap_dirty_lock);
+        init_waitqueue_head(&mdsc->cap_flushing_wq);
+        spin_lock_init(&mdsc->dentry_lru_lock);
+        INIT_LIST_HEAD(&mdsc->dentry_lru);
+        return 0;
+}
+
+/*
+ * Wait for safe replies on open mds requests.  If we time out, drop
+ * all requests from the tree to avoid dangling dentry refs.
+ */
+static void wait_requests(struct ceph_mds_client *mdsc)
+{
+        struct ceph_mds_request *req;
+        struct ceph_client *client = mdsc->client;
+
+        mutex_lock(&mdsc->mutex);
+        if (__get_oldest_req(mdsc)) {
+                mutex_unlock(&mdsc->mutex);
+
+                dout("wait_requests waiting for requests\n");
+                wait_for_completion_timeout(&mdsc->safe_umount_waiters,
+                                    client->mount_args->mount_timeout * HZ);
+
+                /* tear down remaining requests */
+                mutex_lock(&mdsc->mutex);
+                while ((req = __get_oldest_req(mdsc))) {
+                        dout("wait_requests timed out on tid %llu\n",
+                             req->r_tid);
+                        __unregister_request(mdsc, req);
+                }
+        }
+        mutex_unlock(&mdsc->mutex);
+        dout("wait_requests done\n");
+}
+
+/*
+ * called before mount is ro, and before dentries are torn down.
+ * (hmm, does this still race with new lookups?)
+ */
+void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
+{
+        dout("pre_umount\n");
+        mdsc->stopping = 1;
+
+        drop_leases(mdsc);
+        ceph_flush_dirty_caps(mdsc);
+        wait_requests(mdsc);
+}
+
+/*
+ * wait for all write mds requests to flush.
+ */
+static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
+{
+        struct ceph_mds_request *req = NULL, *nextreq;
+        struct rb_node *n;
+
+        mutex_lock(&mdsc->mutex);
+        dout("wait_unsafe_requests want %lld\n", want_tid);
+restart:
+        req = __get_oldest_req(mdsc);
+        while (req && req->r_tid <= want_tid) {
+                /* find next request */
+                n = rb_next(&req->r_node);
+                if (n)
+                        nextreq = rb_entry(n, struct ceph_mds_request, r_node);
+                else
+                        nextreq = NULL;
+                if ((req->r_op & CEPH_MDS_OP_WRITE)) {
+                        /* write op */
+                        ceph_mdsc_get_request(req);
+                        if (nextreq)
+                                ceph_mdsc_get_request(nextreq);
+                        mutex_unlock(&mdsc->mutex);
+                        dout("wait_unsafe_requests  wait on %llu (want %llu)\n",
+                             req->r_tid, want_tid);
+                        wait_for_completion(&req->r_safe_completion);
+                        mutex_lock(&mdsc->mutex);
+                        ceph_mdsc_put_request(req);
+                        if (!nextreq)
+                                break;  /* next dne before, so we're done! */
+                        if (RB_EMPTY_NODE(&nextreq->r_node)) {
+                                /* next request was removed from tree */
+                                ceph_mdsc_put_request(nextreq);
+                                goto restart;
+                        }
+                        ceph_mdsc_put_request(nextreq);  /* won't go away */
+                }
+                req = nextreq;
+        }
+        mutex_unlock(&mdsc->mutex);
+        dout("wait_unsafe_requests done\n");
+}
+
+void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
+{
+        u64 want_tid, want_flush;
+
+        dout("sync\n");
+        mutex_lock(&mdsc->mutex);
+        want_tid = mdsc->last_tid;
+        want_flush = mdsc->cap_flush_seq;
+        mutex_unlock(&mdsc->mutex);
+        dout("sync want tid %lld flush_seq %lld\n", want_tid, want_flush);
+
+        ceph_flush_dirty_caps(mdsc);
+
+        wait_unsafe_requests(mdsc, want_tid);
+        wait_event(mdsc->cap_flushing_wq, check_cap_flush(mdsc, want_flush));
+}
+
+
+/*
+ * called after sb is ro.
+ */
+void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc)
+{
+        struct ceph_mds_session *session;
+        int i;
+        int n;
+        struct ceph_client *client = mdsc->client;
+        unsigned long started, timeout = client->mount_args->mount_timeout * HZ;
+
+        dout("close_sessions\n");
+
+        mutex_lock(&mdsc->mutex);
+
+        /* close sessions */
+        started = jiffies;
+        while (time_before(jiffies, started + timeout)) {
+                dout("closing sessions\n");
+                n = 0;
+                for (i = 0; i < mdsc->max_sessions; i++) {
+                        session = __ceph_lookup_mds_session(mdsc, i);
+                        if (!session)
+                                continue;
+                        mutex_unlock(&mdsc->mutex);
+                        mutex_lock(&session->s_mutex);
+                        __close_session(mdsc, session);
+                        mutex_unlock(&session->s_mutex);
+                        ceph_put_mds_session(session);
+                        mutex_lock(&mdsc->mutex);
+                        n++;
+                }
+                if (n == 0)
+                        break;
+
+                if (client->mount_state == CEPH_MOUNT_SHUTDOWN)
+                        break;
+
+                dout("waiting for sessions to close\n");
+                mutex_unlock(&mdsc->mutex);
+                wait_for_completion_timeout(&mdsc->session_close_waiters,
+                                            timeout);
+                mutex_lock(&mdsc->mutex);
+        }
+
+        /* tear down remaining sessions */
+        for (i = 0; i < mdsc->max_sessions; i++) {
+                if (mdsc->sessions[i]) {
+                        session = get_session(mdsc->sessions[i]);
+                        __unregister_session(mdsc, session);
+                        mutex_unlock(&mdsc->mutex);
+                        mutex_lock(&session->s_mutex);
+                        remove_session_caps(session);
+                        mutex_unlock(&session->s_mutex);
+                        ceph_put_mds_session(session);
+                        mutex_lock(&mdsc->mutex);
+                }
+        }
+
+        WARN_ON(!list_empty(&mdsc->cap_delay_list));
+
+        mutex_unlock(&mdsc->mutex);
+
+        ceph_cleanup_empty_realms(mdsc);
+
+        cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
+
+        dout("stopped\n");
+}
+
+void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
+{
+        dout("stop\n");
+        cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
+        if (mdsc->mdsmap)
+                ceph_mdsmap_destroy(mdsc->mdsmap);
+        kfree(mdsc->sessions);
+}
+
+
+/*
+ * handle mds map update.
+ */
+void ceph_mdsc_handle_map(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
+{
+        u32 epoch;
+        u32 maplen;
+        void *p = msg->front.iov_base;
+        void *end = p + msg->front.iov_len;
+        struct ceph_mdsmap *newmap, *oldmap;
+        struct ceph_fsid fsid;
+        int err = -EINVAL;
+
+        ceph_decode_need(&p, end, sizeof(fsid)+2*sizeof(u32), bad);
+        ceph_decode_copy(&p, &fsid, sizeof(fsid));
+        if (ceph_check_fsid(mdsc->client, &fsid) < 0)
+                return;
+        epoch = ceph_decode_32(&p);
+        maplen = ceph_decode_32(&p);
+        dout("handle_map epoch %u len %d\n", epoch, (int)maplen);
+
+        /* do we need it? */
+        ceph_monc_got_mdsmap(&mdsc->client->monc, epoch);
+        mutex_lock(&mdsc->mutex);
+        if (mdsc->mdsmap && epoch <= mdsc->mdsmap->m_epoch) {
+                dout("handle_map epoch %u <= our %u\n",
+                     epoch, mdsc->mdsmap->m_epoch);
+                mutex_unlock(&mdsc->mutex);
+                return;
+        }
+
+        newmap = ceph_mdsmap_decode(&p, end);
+        if (IS_ERR(newmap)) {
+                err = PTR_ERR(newmap);
+                goto bad_unlock;
+        }
+
+        /* swap into place */
+        if (mdsc->mdsmap) {
+                oldmap = mdsc->mdsmap;
+                mdsc->mdsmap = newmap;
+                check_new_map(mdsc, newmap, oldmap);
+                ceph_mdsmap_destroy(oldmap);
+        } else {
+                mdsc->mdsmap = newmap;  /* first mds map */
+        }
+        mdsc->client->sb->s_maxbytes = mdsc->mdsmap->m_max_file_size;
+
+        __wake_requests(mdsc, &mdsc->waiting_for_map);
+
+        mutex_unlock(&mdsc->mutex);
+        schedule_delayed(mdsc);
+        return;
+
+bad_unlock:
+        mutex_unlock(&mdsc->mutex);
+bad:
+        pr_err("error decoding mdsmap %d\n", err);
+        return;
+}
+
+static struct ceph_connection *con_get(struct ceph_connection *con)
+{
+        struct ceph_mds_session *s = con->private;
+
+        if (get_session(s)) {
+                dout("mdsc con_get %p ok (%d)\n", s, atomic_read(&s->s_ref));
+                return con;
+        }
+        dout("mdsc con_get %p FAIL\n", s);
+        return NULL;
+}
+
+static void con_put(struct ceph_connection *con)
+{
+        struct ceph_mds_session *s = con->private;
+
+        ceph_put_mds_session(s);
+        dout("mdsc con_put %p (%d)\n", s, atomic_read(&s->s_ref));
+}
+
+/*
+ * if the client is unresponsive for long enough, the mds will kill
+ * the session entirely.
+ */
+static void peer_reset(struct ceph_connection *con)
+{
+        struct ceph_mds_session *s = con->private;
+
+        pr_err("mds%d gave us the boot.  IMPLEMENT RECONNECT.\n",
+               s->s_mds);
+}
+
+static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        struct ceph_mds_session *s = con->private;
+        struct ceph_mds_client *mdsc = s->s_mdsc;
+        int type = le16_to_cpu(msg->hdr.type);
+
+        mutex_lock(&mdsc->mutex);
+        if (__verify_registered_session(mdsc, s) < 0) {
+                mutex_unlock(&mdsc->mutex);
+                goto out;
+        }
+        mutex_unlock(&mdsc->mutex);
+
+        switch (type) {
+        case CEPH_MSG_MDS_MAP:
+                ceph_mdsc_handle_map(mdsc, msg);
+                break;
+        case CEPH_MSG_CLIENT_SESSION:
+                handle_session(s, msg);
+                break;
+        case CEPH_MSG_CLIENT_REPLY:
+                handle_reply(s, msg);
+                break;
+        case CEPH_MSG_CLIENT_REQUEST_FORWARD:
+                handle_forward(mdsc, s, msg);
+                break;
+        case CEPH_MSG_CLIENT_CAPS:
+                ceph_handle_caps(s, msg);
+                break;
+        case CEPH_MSG_CLIENT_SNAP:
+                ceph_handle_snap(mdsc, s, msg);
+                break;
+        case CEPH_MSG_CLIENT_LEASE:
+                handle_lease(mdsc, s, msg);
+                break;
+
+        default:
+                pr_err("received unknown message type %d %s\n", type,
+                       ceph_msg_type_name(type));
+        }
+out:
+        ceph_msg_put(msg);
+}
+
+/*
+ * authentication
+ */
+static int get_authorizer(struct ceph_connection *con,
+                          void **buf, int *len, int *proto,
+                          void **reply_buf, int *reply_len, int force_new)
+{
+        struct ceph_mds_session *s = con->private;
+        struct ceph_mds_client *mdsc = s->s_mdsc;
+        struct ceph_auth_client *ac = mdsc->client->monc.auth;
+        int ret = 0;
+
+        if (force_new && s->s_authorizer) {
+                ac->ops->destroy_authorizer(ac, s->s_authorizer);
+                s->s_authorizer = NULL;
+        }
+        if (s->s_authorizer == NULL) {
+                if (ac->ops->create_authorizer) {
+                        ret = ac->ops->create_authorizer(
+                                ac, CEPH_ENTITY_TYPE_MDS,
+                                &s->s_authorizer,
+                                &s->s_authorizer_buf,
+                                &s->s_authorizer_buf_len,
+                                &s->s_authorizer_reply_buf,
+                                &s->s_authorizer_reply_buf_len);
+                        if (ret)
+                                return ret;
+                }
+        }
+
+        *proto = ac->protocol;
+        *buf = s->s_authorizer_buf;
+        *len = s->s_authorizer_buf_len;
+        *reply_buf = s->s_authorizer_reply_buf;
+        *reply_len = s->s_authorizer_reply_buf_len;
+        return 0;
+}
+
+
+static int verify_authorizer_reply(struct ceph_connection *con, int len)
+{
+        struct ceph_mds_session *s = con->private;
+        struct ceph_mds_client *mdsc = s->s_mdsc;
+        struct ceph_auth_client *ac = mdsc->client->monc.auth;
+
+        return ac->ops->verify_authorizer_reply(ac, s->s_authorizer, len);
+}
+
+static int invalidate_authorizer(struct ceph_connection *con)
+{
+        struct ceph_mds_session *s = con->private;
+        struct ceph_mds_client *mdsc = s->s_mdsc;
+        struct ceph_auth_client *ac = mdsc->client->monc.auth;
+
+        if (ac->ops->invalidate_authorizer)
+                ac->ops->invalidate_authorizer(ac, CEPH_ENTITY_TYPE_MDS);
+
+        return ceph_monc_validate_auth(&mdsc->client->monc);
+}
+
+const static struct ceph_connection_operations mds_con_ops = {
+        .get = con_get,
+        .put = con_put,
+        .dispatch = dispatch,
+        .get_authorizer = get_authorizer,
+        .verify_authorizer_reply = verify_authorizer_reply,
+        .invalidate_authorizer = invalidate_authorizer,
+        .peer_reset = peer_reset,
+};
+
+
+
+
+/* eof */
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
new file mode 100644
index 000000000000..961cc6f65878
--- /dev/null
+++ b/fs/ceph/mds_client.h
@@ -0,0 +1,335 @@
+#ifndef _FS_CEPH_MDS_CLIENT_H
+#define _FS_CEPH_MDS_CLIENT_H
+
+#include <linux/completion.h>
+#include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/rbtree.h>
+#include <linux/spinlock.h>
+
+#include "types.h"
+#include "messenger.h"
+#include "mdsmap.h"
+
+/*
+ * Some lock dependencies:
+ *
+ * session->s_mutex
+ *         mdsc->mutex
+ *
+ *         mdsc->snap_rwsem
+ *
+ *         inode->i_lock
+ *                 mdsc->snap_flush_lock
+ *                 mdsc->cap_delay_lock
+ *
+ */
+
+struct ceph_client;
+struct ceph_cap;
+
+/*
+ * parsed info about a single inode.  pointers are into the encoded
+ * on-wire structures within the mds reply message payload.
+ */
+struct ceph_mds_reply_info_in {
+        struct ceph_mds_reply_inode *in;
+        u32 symlink_len;
+        char *symlink;
+        u32 xattr_len;
+        char *xattr_data;
+};
+
+/*
+ * parsed info about an mds reply, including information about the
+ * target inode and/or its parent directory and dentry, and directory
+ * contents (for readdir results).
+ */
+struct ceph_mds_reply_info_parsed {
+        struct ceph_mds_reply_head    *head;
+
+        struct ceph_mds_reply_info_in diri, targeti;
+        struct ceph_mds_reply_dirfrag *dirfrag;
+        char                          *dname;
+        u32                           dname_len;
+        struct ceph_mds_reply_lease   *dlease;
+
+        struct ceph_mds_reply_dirfrag *dir_dir;
+        int                           dir_nr;
+        char                          **dir_dname;
+        u32                           *dir_dname_len;
+        struct ceph_mds_reply_lease   **dir_dlease;
+        struct ceph_mds_reply_info_in *dir_in;
+        u8                            dir_complete, dir_end;
+
+        /* encoded blob describing snapshot contexts for certain
+           operations (e.g., open) */
+        void *snapblob;
+        int snapblob_len;
+};
+
+
+/*
+ * cap releases are batched and sent to the MDS en masse.
+ */
+#define CEPH_CAPS_PER_RELEASE ((PAGE_CACHE_SIZE -                       \
+                                sizeof(struct ceph_mds_cap_release)) /  \
+                               sizeof(struct ceph_mds_cap_item))
+
+
+/*
+ * state associated with each MDS<->client session
+ */
+enum {
+        CEPH_MDS_SESSION_NEW = 1,
+        CEPH_MDS_SESSION_OPENING = 2,
+        CEPH_MDS_SESSION_OPEN = 3,
+        CEPH_MDS_SESSION_HUNG = 4,
+        CEPH_MDS_SESSION_CLOSING = 5,
+        CEPH_MDS_SESSION_RESTARTING = 6,
+        CEPH_MDS_SESSION_RECONNECTING = 7,
+};
+
+struct ceph_mds_session {
+        struct ceph_mds_client *s_mdsc;
+        int               s_mds;
+        int               s_state;
+        unsigned long     s_ttl;      /* time until mds kills us */
+        u64               s_seq;      /* incoming msg seq # */
+        struct mutex      s_mutex;    /* serialize session messages */
+
+        struct ceph_connection s_con;
+
+        struct ceph_authorizer *s_authorizer;
+        void             *s_authorizer_buf, *s_authorizer_reply_buf;
+        size_t            s_authorizer_buf_len, s_authorizer_reply_buf_len;
+
+        /* protected by s_cap_lock */
+        spinlock_t        s_cap_lock;
+        u32               s_cap_gen;  /* inc each time we get mds stale msg */
+        unsigned long     s_cap_ttl;  /* when session caps expire */
+        struct list_head  s_caps;     /* all caps issued by this session */
+        int               s_nr_caps, s_trim_caps;
+        int               s_num_cap_releases;
+        struct list_head  s_cap_releases; /* waiting cap_release messages */
+        struct list_head  s_cap_releases_done; /* ready to send */
+        struct ceph_cap  *s_cap_iterator;
+
+        /* protected by mutex */
+        struct list_head  s_cap_flushing;     /* inodes w/ flushing caps */
+        struct list_head  s_cap_snaps_flushing;
+        unsigned long     s_renew_requested; /* last time we sent a renew req */
+        u64               s_renew_seq;
+
+        atomic_t          s_ref;
+        struct list_head  s_waiting;  /* waiting requests */
+        struct list_head  s_unsafe;   /* unsafe requests */
+};
+
+/*
+ * modes of choosing which MDS to send a request to
+ */
+enum {
+        USE_ANY_MDS,
+        USE_RANDOM_MDS,
+        USE_AUTH_MDS,   /* prefer authoritative mds for this metadata item */
+};
+
+struct ceph_mds_request;
+struct ceph_mds_client;
+
+/*
+ * request completion callback
+ */
+typedef void (*ceph_mds_request_callback_t) (struct ceph_mds_client *mdsc,
+                                             struct ceph_mds_request *req);
+
+/*
+ * an in-flight mds request
+ */
+struct ceph_mds_request {
+        u64 r_tid;                   /* transaction id */
+        struct rb_node r_node;
+
+        int r_op;                    /* mds op code */
+        int r_mds;
+
+        /* operation on what? */
+        struct inode *r_inode;              /* arg1 */
+        struct dentry *r_dentry;            /* arg1 */
+        struct dentry *r_old_dentry;        /* arg2: rename from or link from */
+        char *r_path1, *r_path2;
+        struct ceph_vino r_ino1, r_ino2;
+
+        struct inode *r_locked_dir; /* dir (if any) i_mutex locked by vfs */
+        struct inode *r_target_inode;       /* resulting inode */
+
+        union ceph_mds_request_args r_args;
+        int r_fmode;        /* file mode, if expecting cap */
+
+        /* for choosing which mds to send this request to */
+        int r_direct_mode;
+        u32 r_direct_hash;      /* choose dir frag based on this dentry hash */
+        bool r_direct_is_hash;  /* true if r_direct_hash is valid */
+
+        /* data payload is used for xattr ops */
+        struct page **r_pages;
+        int r_num_pages;
+        int r_data_len;
+
+        /* what caps shall we drop? */
+        int r_inode_drop, r_inode_unless;
+        int r_dentry_drop, r_dentry_unless;
+        int r_old_dentry_drop, r_old_dentry_unless;
+        struct inode *r_old_inode;
+        int r_old_inode_drop, r_old_inode_unless;
+
+        struct ceph_msg  *r_request;  /* original request */
+        struct ceph_msg  *r_reply;
+        struct ceph_mds_reply_info_parsed r_reply_info;
+        int r_err;
+        bool r_aborted;
+
+        unsigned long r_timeout;  /* optional.  jiffies */
+        unsigned long r_started;  /* start time to measure timeout against */
+        unsigned long r_request_started; /* start time for mds request only,
+                                            used to measure lease durations */
+
+        /* link unsafe requests to parent directory, for fsync */
+        struct inode    *r_unsafe_dir;
+        struct list_head r_unsafe_dir_item;
+
+        struct ceph_mds_session *r_session;
+
+        int               r_attempts;   /* resend attempts */
+        int               r_num_fwd;    /* number of forward attempts */
+        int               r_num_stale;
+        int               r_resend_mds; /* mds to resend to next, if any*/
+
+        struct kref       r_kref;
+        struct list_head  r_wait;
+        struct completion r_completion;
+        struct completion r_safe_completion;
+        ceph_mds_request_callback_t r_callback;
+        struct list_head  r_unsafe_item;  /* per-session unsafe list item */
+        bool              r_got_unsafe, r_got_safe;
+
+        bool              r_did_prepopulate;
+        u32               r_readdir_offset;
+
+        struct ceph_cap_reservation r_caps_reservation;
+        int r_num_caps;
+};
+
+/*
+ * mds client state
+ */
+struct ceph_mds_client {
+        struct ceph_client      *client;
+        struct mutex            mutex;         /* all nested structures */
+
+        struct ceph_mdsmap      *mdsmap;
+        struct completion       safe_umount_waiters, session_close_waiters;
+        struct list_head        waiting_for_map;
+
+        struct ceph_mds_session **sessions;    /* NULL for mds if no session */
+        int                     max_sessions;  /* len of s_mds_sessions */
+        int                     stopping;      /* true if shutting down */
+
+        /*
+         * snap_rwsem will cover cap linkage into snaprealms, and
+         * realm snap contexts.  (later, we can do per-realm snap
+         * contexts locks..)  the empty list contains realms with no
+         * references (implying they contain no inodes with caps) that
+         * should be destroyed.
+         */
+        struct rw_semaphore     snap_rwsem;
+        struct rb_root          snap_realms;
+        struct list_head        snap_empty;
+        spinlock_t              snap_empty_lock;  /* protect snap_empty */
+
+        u64                    last_tid;      /* most recent mds request */
+        struct rb_root         request_tree;  /* pending mds requests */
+        struct delayed_work    delayed_work;  /* delayed work */
+        unsigned long    last_renew_caps;  /* last time we renewed our caps */
+        struct list_head cap_delay_list;   /* caps with delayed release */
+        spinlock_t       cap_delay_lock;   /* protects cap_delay_list */
+        struct list_head snap_flush_list;  /* cap_snaps ready to flush */
+        spinlock_t       snap_flush_lock;
+
+        u64               cap_flush_seq;
+        struct list_head  cap_dirty;        /* inodes with dirty caps */
+        int               num_cap_flushing; /* # caps we are flushing */
+        spinlock_t        cap_dirty_lock;   /* protects above items */
+        wait_queue_head_t cap_flushing_wq;
+
+#ifdef CONFIG_DEBUG_FS
+        struct dentry     *debugfs_file;
+#endif
+
+        spinlock_t        dentry_lru_lock;
+        struct list_head  dentry_lru;
+        int               num_dentry;
+};
+
+extern const char *ceph_mds_op_name(int op);
+
+extern struct ceph_mds_session *
+__ceph_lookup_mds_session(struct ceph_mds_client *, int mds);
+
+static inline struct ceph_mds_session *
+ceph_get_mds_session(struct ceph_mds_session *s)
+{
+        atomic_inc(&s->s_ref);
+        return s;
+}
+
+extern void ceph_put_mds_session(struct ceph_mds_session *s);
+
+extern int ceph_send_msg_mds(struct ceph_mds_client *mdsc,
+                             struct ceph_msg *msg, int mds);
+
+extern int ceph_mdsc_init(struct ceph_mds_client *mdsc,
+                           struct ceph_client *client);
+extern void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc);
+extern void ceph_mdsc_stop(struct ceph_mds_client *mdsc);
+
+extern void ceph_mdsc_sync(struct ceph_mds_client *mdsc);
+
+extern void ceph_mdsc_lease_release(struct ceph_mds_client *mdsc,
+                                    struct inode *inode,
+                                    struct dentry *dn, int mask);
+
+extern struct ceph_mds_request *
+ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode);
+extern void ceph_mdsc_submit_request(struct ceph_mds_client *mdsc,
+                                     struct ceph_mds_request *req);
+extern int ceph_mdsc_do_request(struct ceph_mds_client *mdsc,
+                                struct inode *dir,
+                                struct ceph_mds_request *req);
+static inline void ceph_mdsc_get_request(struct ceph_mds_request *req)
+{
+        kref_get(&req->r_kref);
+}
+extern void ceph_mdsc_release_request(struct kref *kref);
+static inline void ceph_mdsc_put_request(struct ceph_mds_request *req)
+{
+        kref_put(&req->r_kref, ceph_mdsc_release_request);
+}
+
+extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);
+
+extern char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
+                                  int stop_on_nosnap);
+
+extern void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry);
+extern void ceph_mdsc_lease_send_msg(struct ceph_mds_session *session,
+                                     struct inode *inode,
+                                     struct dentry *dentry, char action,
+                                     u32 seq);
+
+extern void ceph_mdsc_handle_map(struct ceph_mds_client *mdsc,
+                                 struct ceph_msg *msg);
+
+#endif
diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c
new file mode 100644
index 000000000000..c4c498e6dfef
--- /dev/null
+++ b/fs/ceph/mdsmap.c
@@ -0,0 +1,174 @@
+#include "ceph_debug.h"
+
+#include <linux/bug.h>
+#include <linux/err.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#include "mdsmap.h"
+#include "messenger.h"
+#include "decode.h"
+
+#include "super.h"
+
+
+/*
+ * choose a random mds that is "up" (i.e. has a state > 0), or -1.
+ */
+int ceph_mdsmap_get_random_mds(struct ceph_mdsmap *m)
+{
+        int n = 0;
+        int i;
+        char r;
+
+        /* count */
+        for (i = 0; i < m->m_max_mds; i++)
+                if (m->m_info[i].state > 0)
+                        n++;
+        if (n == 0)
+                return -1;
+
+        /* pick */
+        get_random_bytes(&r, 1);
+        n = r % n;
+        i = 0;
+        for (i = 0; n > 0; i++, n--)
+                while (m->m_info[i].state <= 0)
+                        i++;
+
+        return i;
+}
+
+/*
+ * Decode an MDS map
+ *
+ * Ignore any fields we don't care about (there are quite a few of
+ * them).
+ */
+struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end)
+{
+        struct ceph_mdsmap *m;
+        const void *start = *p;
+        int i, j, n;
+        int err = -EINVAL;
+        u16 version;
+
+        m = kzalloc(sizeof(*m), GFP_NOFS);
+        if (m == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        ceph_decode_16_safe(p, end, version, bad);
+
+        ceph_decode_need(p, end, 8*sizeof(u32) + sizeof(u64), bad);
+        m->m_epoch = ceph_decode_32(p);
+        m->m_client_epoch = ceph_decode_32(p);
+        m->m_last_failure = ceph_decode_32(p);
+        m->m_root = ceph_decode_32(p);
+        m->m_session_timeout = ceph_decode_32(p);
+        m->m_session_autoclose = ceph_decode_32(p);
+        m->m_max_file_size = ceph_decode_64(p);
+        m->m_max_mds = ceph_decode_32(p);
+
+        m->m_info = kcalloc(m->m_max_mds, sizeof(*m->m_info), GFP_NOFS);
+        if (m->m_info == NULL)
+                goto badmem;
+
+        /* pick out active nodes from mds_info (state > 0) */
+        n = ceph_decode_32(p);
+        for (i = 0; i < n; i++) {
+                u64 global_id;
+                u32 namelen;
+                s32 mds, inc, state;
+                u64 state_seq;
+                u8 infoversion;
+                struct ceph_entity_addr addr;
+                u32 num_export_targets;
+                void *pexport_targets = NULL;
+
+                ceph_decode_need(p, end, sizeof(u64)*2 + 1 + sizeof(u32), bad);
+                global_id = ceph_decode_64(p);
+                infoversion = ceph_decode_8(p);
+                *p += sizeof(u64);
+                namelen = ceph_decode_32(p);  /* skip mds name */
+                *p += namelen;
+
+                ceph_decode_need(p, end,
+                                 4*sizeof(u32) + sizeof(u64) +
+                                 sizeof(addr) + sizeof(struct ceph_timespec),
+                                 bad);
+                mds = ceph_decode_32(p);
+                inc = ceph_decode_32(p);
+                state = ceph_decode_32(p);
+                state_seq = ceph_decode_64(p);
+                ceph_decode_copy(p, &addr, sizeof(addr));
+                ceph_decode_addr(&addr);
+                *p += sizeof(struct ceph_timespec);
+                *p += sizeof(u32);
+                ceph_decode_32_safe(p, end, namelen, bad);
+                *p += namelen;
+                if (infoversion >= 2) {
+                        ceph_decode_32_safe(p, end, num_export_targets, bad);
+                        pexport_targets = *p;
+                        *p += num_export_targets * sizeof(u32);
+                } else {
+                        num_export_targets = 0;
+                }
+
+                dout("mdsmap_decode %d/%d %lld mds%d.%d %s %s\n",
+                     i+1, n, global_id, mds, inc, pr_addr(&addr.in_addr),
+                     ceph_mds_state_name(state));
+                if (mds >= 0 && mds < m->m_max_mds && state > 0) {
+                        m->m_info[mds].global_id = global_id;
+                        m->m_info[mds].state = state;
+                        m->m_info[mds].addr = addr;
+                        m->m_info[mds].num_export_targets = num_export_targets;
+                        if (num_export_targets) {
+                                m->m_info[mds].export_targets =
+                                        kcalloc(num_export_targets, sizeof(u32),
+                                                GFP_NOFS);
+                                for (j = 0; j < num_export_targets; j++)
+                                        m->m_info[mds].export_targets[j] =
+                                               ceph_decode_32(&pexport_targets);
+                        } else {
+                                m->m_info[mds].export_targets = NULL;
+                        }
+                }
+        }
+
+        /* pg_pools */
+        ceph_decode_32_safe(p, end, n, bad);
+        m->m_num_data_pg_pools = n;
+        m->m_data_pg_pools = kcalloc(n, sizeof(u32), GFP_NOFS);
+        if (!m->m_data_pg_pools)
+                goto badmem;
+        ceph_decode_need(p, end, sizeof(u32)*(n+1), bad);
+        for (i = 0; i < n; i++)
+                m->m_data_pg_pools[i] = ceph_decode_32(p);
+        m->m_cas_pg_pool = ceph_decode_32(p);
+
+        /* ok, we don't care about the rest. */
+        dout("mdsmap_decode success epoch %u\n", m->m_epoch);
+        return m;
+
+badmem:
+        err = -ENOMEM;
+bad:
+        pr_err("corrupt mdsmap\n");
+        print_hex_dump(KERN_DEBUG, "mdsmap: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       start, end - start, true);
+        ceph_mdsmap_destroy(m);
+        return ERR_PTR(-EINVAL);
+}
+
+void ceph_mdsmap_destroy(struct ceph_mdsmap *m)
+{
+        int i;
+
+        for (i = 0; i < m->m_max_mds; i++)
+                kfree(m->m_info[i].export_targets);
+        kfree(m->m_info);
+        kfree(m->m_data_pg_pools);
+        kfree(m);
+}
diff --git a/fs/ceph/mdsmap.h b/fs/ceph/mdsmap.h
new file mode 100644
index 000000000000..eacc131aa5cb
--- /dev/null
+++ b/fs/ceph/mdsmap.h
@@ -0,0 +1,54 @@
+#ifndef _FS_CEPH_MDSMAP_H
+#define _FS_CEPH_MDSMAP_H
+
+#include "types.h"
+
+/*
+ * mds map - describe servers in the mds cluster.
+ *
+ * we limit fields to those the client actually xcares about
+ */
+struct ceph_mds_info {
+        u64 global_id;
+        struct ceph_entity_addr addr;
+        s32 state;
+        int num_export_targets;
+        u32 *export_targets;
+};
+
+struct ceph_mdsmap {
+        u32 m_epoch, m_client_epoch, m_last_failure;
+        u32 m_root;
+        u32 m_session_timeout;          /* seconds */
+        u32 m_session_autoclose;        /* seconds */
+        u64 m_max_file_size;
+        u32 m_max_mds;                  /* size of m_addr, m_state arrays */
+        struct ceph_mds_info *m_info;
+
+        /* which object pools file data can be stored in */
+        int m_num_data_pg_pools;
+        u32 *m_data_pg_pools;
+        u32 m_cas_pg_pool;
+};
+
+static inline struct ceph_entity_addr *
+ceph_mdsmap_get_addr(struct ceph_mdsmap *m, int w)
+{
+        if (w >= m->m_max_mds)
+                return NULL;
+        return &m->m_info[w].addr;
+}
+
+static inline int ceph_mdsmap_get_state(struct ceph_mdsmap *m, int w)
+{
+        BUG_ON(w < 0);
+        if (w >= m->m_max_mds)
+                return CEPH_MDS_STATE_DNE;
+        return m->m_info[w].state;
+}
+
+extern int ceph_mdsmap_get_random_mds(struct ceph_mdsmap *m);
+extern struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end);
+extern void ceph_mdsmap_destroy(struct ceph_mdsmap *m);
+
+#endif
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
new file mode 100644
index 000000000000..cdaaa131add3
--- /dev/null
+++ b/fs/ceph/messenger.c
@@ -0,0 +1,2249 @@
+#include "ceph_debug.h"
+
+#include <linux/crc32c.h>
+#include <linux/ctype.h>
+#include <linux/highmem.h>
+#include <linux/inet.h>
+#include <linux/kthread.h>
+#include <linux/net.h>
+#include <linux/slab.h>
+#include <linux/socket.h>
+#include <linux/string.h>
+#include <net/tcp.h>
+
+#include "super.h"
+#include "messenger.h"
+#include "decode.h"
+#include "pagelist.h"
+
+/*
+ * Ceph uses the messenger to exchange ceph_msg messages with other
+ * hosts in the system.  The messenger provides ordered and reliable
+ * delivery.  We tolerate TCP disconnects by reconnecting (with
+ * exponential backoff) in the case of a fault (disconnection, bad
+ * crc, protocol error).  Acks allow sent messages to be discarded by
+ * the sender.
+ */
+
+/* static tag bytes (protocol control messages) */
+static char tag_msg = CEPH_MSGR_TAG_MSG;
+static char tag_ack = CEPH_MSGR_TAG_ACK;
+static char tag_keepalive = CEPH_MSGR_TAG_KEEPALIVE;
+
+#ifdef CONFIG_LOCKDEP
+static struct lock_class_key socket_class;
+#endif
+
+
+static void queue_con(struct ceph_connection *con);
+static void con_work(struct work_struct *);
+static void ceph_fault(struct ceph_connection *con);
+
+const char *ceph_name_type_str(int t)
+{
+        switch (t) {
+        case CEPH_ENTITY_TYPE_MON: return "mon";
+        case CEPH_ENTITY_TYPE_MDS: return "mds";
+        case CEPH_ENTITY_TYPE_OSD: return "osd";
+        case CEPH_ENTITY_TYPE_CLIENT: return "client";
+        case CEPH_ENTITY_TYPE_ADMIN: return "admin";
+        default: return "???";
+        }
+}
+
+/*
+ * nicely render a sockaddr as a string.
+ */
+#define MAX_ADDR_STR 20
+static char addr_str[MAX_ADDR_STR][40];
+static DEFINE_SPINLOCK(addr_str_lock);
+static int last_addr_str;
+
+const char *pr_addr(const struct sockaddr_storage *ss)
+{
+        int i;
+        char *s;
+        struct sockaddr_in *in4 = (void *)ss;
+        unsigned char *quad = (void *)&in4->sin_addr.s_addr;
+        struct sockaddr_in6 *in6 = (void *)ss;
+
+        spin_lock(&addr_str_lock);
+        i = last_addr_str++;
+        if (last_addr_str == MAX_ADDR_STR)
+                last_addr_str = 0;
+        spin_unlock(&addr_str_lock);
+        s = addr_str[i];
+
+        switch (ss->ss_family) {
+        case AF_INET:
+                sprintf(s, "%u.%u.%u.%u:%u",
+                        (unsigned int)quad[0],
+                        (unsigned int)quad[1],
+                        (unsigned int)quad[2],
+                        (unsigned int)quad[3],
+                        (unsigned int)ntohs(in4->sin_port));
+                break;
+
+        case AF_INET6:
+                sprintf(s, "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x:%u",
+                        in6->sin6_addr.s6_addr16[0],
+                        in6->sin6_addr.s6_addr16[1],
+                        in6->sin6_addr.s6_addr16[2],
+                        in6->sin6_addr.s6_addr16[3],
+                        in6->sin6_addr.s6_addr16[4],
+                        in6->sin6_addr.s6_addr16[5],
+                        in6->sin6_addr.s6_addr16[6],
+                        in6->sin6_addr.s6_addr16[7],
+                        (unsigned int)ntohs(in6->sin6_port));
+                break;
+
+        default:
+                sprintf(s, "(unknown sockaddr family %d)", (int)ss->ss_family);
+        }
+
+        return s;
+}
+
+static void encode_my_addr(struct ceph_messenger *msgr)
+{
+        memcpy(&msgr->my_enc_addr, &msgr->inst.addr, sizeof(msgr->my_enc_addr));
+        ceph_encode_addr(&msgr->my_enc_addr);
+}
+
+/*
+ * work queue for all reading and writing to/from the socket.
+ */
+struct workqueue_struct *ceph_msgr_wq;
+
+int __init ceph_msgr_init(void)
+{
+        ceph_msgr_wq = create_workqueue("ceph-msgr");
+        if (IS_ERR(ceph_msgr_wq)) {
+                int ret = PTR_ERR(ceph_msgr_wq);
+                pr_err("msgr_init failed to create workqueue: %d\n", ret);
+                ceph_msgr_wq = NULL;
+                return ret;
+        }
+        return 0;
+}
+
+void ceph_msgr_exit(void)
+{
+        destroy_workqueue(ceph_msgr_wq);
+}
+
+/*
+ * socket callback functions
+ */
+
+/* data available on socket, or listen socket received a connect */
+static void ceph_data_ready(struct sock *sk, int count_unused)
+{
+        struct ceph_connection *con =
+                (struct ceph_connection *)sk->sk_user_data;
+        if (sk->sk_state != TCP_CLOSE_WAIT) {
+                dout("ceph_data_ready on %p state = %lu, queueing work\n",
+                     con, con->state);
+                queue_con(con);
+        }
+}
+
+/* socket has buffer space for writing */
+static void ceph_write_space(struct sock *sk)
+{
+        struct ceph_connection *con =
+                (struct ceph_connection *)sk->sk_user_data;
+
+        /* only queue to workqueue if there is data we want to write. */
+        if (test_bit(WRITE_PENDING, &con->state)) {
+                dout("ceph_write_space %p queueing write work\n", con);
+                queue_con(con);
+        } else {
+                dout("ceph_write_space %p nothing to write\n", con);
+        }
+
+        /* since we have our own write_space, clear the SOCK_NOSPACE flag */
+        clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+}
+
+/* socket's state has changed */
+static void ceph_state_change(struct sock *sk)
+{
+        struct ceph_connection *con =
+                (struct ceph_connection *)sk->sk_user_data;
+
+        dout("ceph_state_change %p state = %lu sk_state = %u\n",
+             con, con->state, sk->sk_state);
+
+        if (test_bit(CLOSED, &con->state))
+                return;
+
+        switch (sk->sk_state) {
+        case TCP_CLOSE:
+                dout("ceph_state_change TCP_CLOSE\n");
+        case TCP_CLOSE_WAIT:
+                dout("ceph_state_change TCP_CLOSE_WAIT\n");
+                if (test_and_set_bit(SOCK_CLOSED, &con->state) == 0) {
+                        if (test_bit(CONNECTING, &con->state))
+                                con->error_msg = "connection failed";
+                        else
+                                con->error_msg = "socket closed";
+                        queue_con(con);
+                }
+                break;
+        case TCP_ESTABLISHED:
+                dout("ceph_state_change TCP_ESTABLISHED\n");
+                queue_con(con);
+                break;
+        }
+}
+
+/*
+ * set up socket callbacks
+ */
+static void set_sock_callbacks(struct socket *sock,
+                               struct ceph_connection *con)
+{
+        struct sock *sk = sock->sk;
+        sk->sk_user_data = (void *)con;
+        sk->sk_data_ready = ceph_data_ready;
+        sk->sk_write_space = ceph_write_space;
+        sk->sk_state_change = ceph_state_change;
+}
+
+
+/*
+ * socket helpers
+ */
+
+/*
+ * initiate connection to a remote socket.
+ */
+static struct socket *ceph_tcp_connect(struct ceph_connection *con)
+{
+        struct sockaddr *paddr = (struct sockaddr *)&con->peer_addr.in_addr;
+        struct socket *sock;
+        int ret;
+
+        BUG_ON(con->sock);
+        ret = sock_create_kern(AF_INET, SOCK_STREAM, IPPROTO_TCP, &sock);
+        if (ret)
+                return ERR_PTR(ret);
+        con->sock = sock;
+        sock->sk->sk_allocation = GFP_NOFS;
+
+#ifdef CONFIG_LOCKDEP
+        lockdep_set_class(&sock->sk->sk_lock, &socket_class);
+#endif
+
+        set_sock_callbacks(sock, con);
+
+        dout("connect %s\n", pr_addr(&con->peer_addr.in_addr));
+
+        ret = sock->ops->connect(sock, paddr, sizeof(*paddr), O_NONBLOCK);
+        if (ret == -EINPROGRESS) {
+                dout("connect %s EINPROGRESS sk_state = %u\n",
+                     pr_addr(&con->peer_addr.in_addr),
+                     sock->sk->sk_state);
+                ret = 0;
+        }
+        if (ret < 0) {
+                pr_err("connect %s error %d\n",
+                       pr_addr(&con->peer_addr.in_addr), ret);
+                sock_release(sock);
+                con->sock = NULL;
+                con->error_msg = "connect error";
+        }
+
+        if (ret < 0)
+                return ERR_PTR(ret);
+        return sock;
+}
+
+static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len)
+{
+        struct kvec iov = {buf, len};
+        struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+
+        return kernel_recvmsg(sock, &msg, &iov, 1, len, msg.msg_flags);
+}
+
+/*
+ * write something.  @more is true if caller will be sending more data
+ * shortly.
+ */
+static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
+                     size_t kvlen, size_t len, int more)
+{
+        struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+
+        if (more)
+                msg.msg_flags |= MSG_MORE;
+        else
+                msg.msg_flags |= MSG_EOR;  /* superfluous, but what the hell */
+
+        return kernel_sendmsg(sock, &msg, iov, kvlen, len);
+}
+
+
+/*
+ * Shutdown/close the socket for the given connection.
+ */
+static int con_close_socket(struct ceph_connection *con)
+{
+        int rc;
+
+        dout("con_close_socket on %p sock %p\n", con, con->sock);
+        if (!con->sock)
+                return 0;
+        set_bit(SOCK_CLOSED, &con->state);
+        rc = con->sock->ops->shutdown(con->sock, SHUT_RDWR);
+        sock_release(con->sock);
+        con->sock = NULL;
+        clear_bit(SOCK_CLOSED, &con->state);
+        return rc;
+}
+
+/*
+ * Reset a connection.  Discard all incoming and outgoing messages
+ * and clear *_seq state.
+ */
+static void ceph_msg_remove(struct ceph_msg *msg)
+{
+        list_del_init(&msg->list_head);
+        ceph_msg_put(msg);
+}
+static void ceph_msg_remove_list(struct list_head *head)
+{
+        while (!list_empty(head)) {
+                struct ceph_msg *msg = list_first_entry(head, struct ceph_msg,
+                                                        list_head);
+                ceph_msg_remove(msg);
+        }
+}
+
+static void reset_connection(struct ceph_connection *con)
+{
+        /* reset connection, out_queue, msg_ and connect_seq */
+        /* discard existing out_queue and msg_seq */
+        ceph_msg_remove_list(&con->out_queue);
+        ceph_msg_remove_list(&con->out_sent);
+
+        if (con->in_msg) {
+                ceph_msg_put(con->in_msg);
+                con->in_msg = NULL;
+        }
+
+        con->connect_seq = 0;
+        con->out_seq = 0;
+        if (con->out_msg) {
+                ceph_msg_put(con->out_msg);
+                con->out_msg = NULL;
+        }
+        con->in_seq = 0;
+        con->in_seq_acked = 0;
+}
+
+/*
+ * mark a peer down.  drop any open connections.
+ */
+void ceph_con_close(struct ceph_connection *con)
+{
+        dout("con_close %p peer %s\n", con, pr_addr(&con->peer_addr.in_addr));
+        set_bit(CLOSED, &con->state);  /* in case there's queued work */
+        clear_bit(STANDBY, &con->state);  /* avoid connect_seq bump */
+        clear_bit(LOSSYTX, &con->state);  /* so we retry next connect */
+        clear_bit(KEEPALIVE_PENDING, &con->state);
+        clear_bit(WRITE_PENDING, &con->state);
+        mutex_lock(&con->mutex);
+        reset_connection(con);
+        cancel_delayed_work(&con->work);
+        mutex_unlock(&con->mutex);
+        queue_con(con);
+}
+
+/*
+ * Reopen a closed connection, with a new peer address.
+ */
+void ceph_con_open(struct ceph_connection *con, struct ceph_entity_addr *addr)
+{
+        dout("con_open %p %s\n", con, pr_addr(&addr->in_addr));
+        set_bit(OPENING, &con->state);
+        clear_bit(CLOSED, &con->state);
+        memcpy(&con->peer_addr, addr, sizeof(*addr));
+        con->delay = 0;      /* reset backoff memory */
+        queue_con(con);
+}
+
+/*
+ * return true if this connection ever successfully opened
+ */
+bool ceph_con_opened(struct ceph_connection *con)
+{
+        return con->connect_seq > 0;
+}
+
+/*
+ * generic get/put
+ */
+struct ceph_connection *ceph_con_get(struct ceph_connection *con)
+{
+        dout("con_get %p nref = %d -> %d\n", con,
+             atomic_read(&con->nref), atomic_read(&con->nref) + 1);
+        if (atomic_inc_not_zero(&con->nref))
+                return con;
+        return NULL;
+}
+
+void ceph_con_put(struct ceph_connection *con)
+{
+        dout("con_put %p nref = %d -> %d\n", con,
+             atomic_read(&con->nref), atomic_read(&con->nref) - 1);
+        BUG_ON(atomic_read(&con->nref) == 0);
+        if (atomic_dec_and_test(&con->nref)) {
+                BUG_ON(con->sock);
+                kfree(con);
+        }
+}
+
+/*
+ * initialize a new connection.
+ */
+void ceph_con_init(struct ceph_messenger *msgr, struct ceph_connection *con)
+{
+        dout("con_init %p\n", con);
+        memset(con, 0, sizeof(*con));
+        atomic_set(&con->nref, 1);
+        con->msgr = msgr;
+        mutex_init(&con->mutex);
+        INIT_LIST_HEAD(&con->out_queue);
+        INIT_LIST_HEAD(&con->out_sent);
+        INIT_DELAYED_WORK(&con->work, con_work);
+}
+
+
+/*
+ * We maintain a global counter to order connection attempts.  Get
+ * a unique seq greater than @gt.
+ */
+static u32 get_global_seq(struct ceph_messenger *msgr, u32 gt)
+{
+        u32 ret;
+
+        spin_lock(&msgr->global_seq_lock);
+        if (msgr->global_seq < gt)
+                msgr->global_seq = gt;
+        ret = ++msgr->global_seq;
+        spin_unlock(&msgr->global_seq_lock);
+        return ret;
+}
+
+
+/*
+ * Prepare footer for currently outgoing message, and finish things
+ * off.  Assumes out_kvec* are already valid.. we just add on to the end.
+ */
+static void prepare_write_message_footer(struct ceph_connection *con, int v)
+{
+        struct ceph_msg *m = con->out_msg;
+
+        dout("prepare_write_message_footer %p\n", con);
+        con->out_kvec_is_msg = true;
+        con->out_kvec[v].iov_base = &m->footer;
+        con->out_kvec[v].iov_len = sizeof(m->footer);
+        con->out_kvec_bytes += sizeof(m->footer);
+        con->out_kvec_left++;
+        con->out_more = m->more_to_follow;
+        con->out_msg_done = true;
+}
+
+/*
+ * Prepare headers for the next outgoing message.
+ */
+static void prepare_write_message(struct ceph_connection *con)
+{
+        struct ceph_msg *m;
+        int v = 0;
+
+        con->out_kvec_bytes = 0;
+        con->out_kvec_is_msg = true;
+        con->out_msg_done = false;
+
+        /* Sneak an ack in there first?  If we can get it into the same
+         * TCP packet that's a good thing. */
+        if (con->in_seq > con->in_seq_acked) {
+                con->in_seq_acked = con->in_seq;
+                con->out_kvec[v].iov_base = &tag_ack;
+                con->out_kvec[v++].iov_len = 1;
+                con->out_temp_ack = cpu_to_le64(con->in_seq_acked);
+                con->out_kvec[v].iov_base = &con->out_temp_ack;
+                con->out_kvec[v++].iov_len = sizeof(con->out_temp_ack);
+                con->out_kvec_bytes = 1 + sizeof(con->out_temp_ack);
+        }
+
+        m = list_first_entry(&con->out_queue,
+                       struct ceph_msg, list_head);
+        con->out_msg = m;
+        if (test_bit(LOSSYTX, &con->state)) {
+                list_del_init(&m->list_head);
+        } else {
+                /* put message on sent list */
+                ceph_msg_get(m);
+                list_move_tail(&m->list_head, &con->out_sent);
+        }
+
+        m->hdr.seq = cpu_to_le64(++con->out_seq);
+
+        dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n",
+             m, con->out_seq, le16_to_cpu(m->hdr.type),
+             le32_to_cpu(m->hdr.front_len), le32_to_cpu(m->hdr.middle_len),
+             le32_to_cpu(m->hdr.data_len),
+             m->nr_pages);
+        BUG_ON(le32_to_cpu(m->hdr.front_len) != m->front.iov_len);
+
+        /* tag + hdr + front + middle */
+        con->out_kvec[v].iov_base = &tag_msg;
+        con->out_kvec[v++].iov_len = 1;
+        con->out_kvec[v].iov_base = &m->hdr;
+        con->out_kvec[v++].iov_len = sizeof(m->hdr);
+        con->out_kvec[v++] = m->front;
+        if (m->middle)
+                con->out_kvec[v++] = m->middle->vec;
+        con->out_kvec_left = v;
+        con->out_kvec_bytes += 1 + sizeof(m->hdr) + m->front.iov_len +
+                (m->middle ? m->middle->vec.iov_len : 0);
+        con->out_kvec_cur = con->out_kvec;
+
+        /* fill in crc (except data pages), footer */
+        con->out_msg->hdr.crc =
+                cpu_to_le32(crc32c(0, (void *)&m->hdr,
+                                      sizeof(m->hdr) - sizeof(m->hdr.crc)));
+        con->out_msg->footer.flags = CEPH_MSG_FOOTER_COMPLETE;
+        con->out_msg->footer.front_crc =
+                cpu_to_le32(crc32c(0, m->front.iov_base, m->front.iov_len));
+        if (m->middle)
+                con->out_msg->footer.middle_crc =
+                        cpu_to_le32(crc32c(0, m->middle->vec.iov_base,
+                                           m->middle->vec.iov_len));
+        else
+                con->out_msg->footer.middle_crc = 0;
+        con->out_msg->footer.data_crc = 0;
+        dout("prepare_write_message front_crc %u data_crc %u\n",
+             le32_to_cpu(con->out_msg->footer.front_crc),
+             le32_to_cpu(con->out_msg->footer.middle_crc));
+
+        /* is there a data payload? */
+        if (le32_to_cpu(m->hdr.data_len) > 0) {
+                /* initialize page iterator */
+                con->out_msg_pos.page = 0;
+                con->out_msg_pos.page_pos =
+                        le16_to_cpu(m->hdr.data_off) & ~PAGE_MASK;
+                con->out_msg_pos.data_pos = 0;
+                con->out_msg_pos.did_page_crc = 0;
+                con->out_more = 1;  /* data + footer will follow */
+        } else {
+                /* no, queue up footer too and be done */
+                prepare_write_message_footer(con, v);
+        }
+
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+/*
+ * Prepare an ack.
+ */
+static void prepare_write_ack(struct ceph_connection *con)
+{
+        dout("prepare_write_ack %p %llu -> %llu\n", con,
+             con->in_seq_acked, con->in_seq);
+        con->in_seq_acked = con->in_seq;
+
+        con->out_kvec[0].iov_base = &tag_ack;
+        con->out_kvec[0].iov_len = 1;
+        con->out_temp_ack = cpu_to_le64(con->in_seq_acked);
+        con->out_kvec[1].iov_base = &con->out_temp_ack;
+        con->out_kvec[1].iov_len = sizeof(con->out_temp_ack);
+        con->out_kvec_left = 2;
+        con->out_kvec_bytes = 1 + sizeof(con->out_temp_ack);
+        con->out_kvec_cur = con->out_kvec;
+        con->out_more = 1;  /* more will follow.. eventually.. */
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+/*
+ * Prepare to write keepalive byte.
+ */
+static void prepare_write_keepalive(struct ceph_connection *con)
+{
+        dout("prepare_write_keepalive %p\n", con);
+        con->out_kvec[0].iov_base = &tag_keepalive;
+        con->out_kvec[0].iov_len = 1;
+        con->out_kvec_left = 1;
+        con->out_kvec_bytes = 1;
+        con->out_kvec_cur = con->out_kvec;
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+/*
+ * Connection negotiation.
+ */
+
+static void prepare_connect_authorizer(struct ceph_connection *con)
+{
+        void *auth_buf;
+        int auth_len = 0;
+        int auth_protocol = 0;
+
+        mutex_unlock(&con->mutex);
+        if (con->ops->get_authorizer)
+                con->ops->get_authorizer(con, &auth_buf, &auth_len,
+                                         &auth_protocol, &con->auth_reply_buf,
+                                         &con->auth_reply_buf_len,
+                                         con->auth_retry);
+        mutex_lock(&con->mutex);
+
+        con->out_connect.authorizer_protocol = cpu_to_le32(auth_protocol);
+        con->out_connect.authorizer_len = cpu_to_le32(auth_len);
+
+        con->out_kvec[con->out_kvec_left].iov_base = auth_buf;
+        con->out_kvec[con->out_kvec_left].iov_len = auth_len;
+        con->out_kvec_left++;
+        con->out_kvec_bytes += auth_len;
+}
+
+/*
+ * We connected to a peer and are saying hello.
+ */
+static void prepare_write_banner(struct ceph_messenger *msgr,
+                                 struct ceph_connection *con)
+{
+        int len = strlen(CEPH_BANNER);
+
+        con->out_kvec[0].iov_base = CEPH_BANNER;
+        con->out_kvec[0].iov_len = len;
+        con->out_kvec[1].iov_base = &msgr->my_enc_addr;
+        con->out_kvec[1].iov_len = sizeof(msgr->my_enc_addr);
+        con->out_kvec_left = 2;
+        con->out_kvec_bytes = len + sizeof(msgr->my_enc_addr);
+        con->out_kvec_cur = con->out_kvec;
+        con->out_more = 0;
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+static void prepare_write_connect(struct ceph_messenger *msgr,
+                                  struct ceph_connection *con,
+                                  int after_banner)
+{
+        unsigned global_seq = get_global_seq(con->msgr, 0);
+        int proto;
+
+        switch (con->peer_name.type) {
+        case CEPH_ENTITY_TYPE_MON:
+                proto = CEPH_MONC_PROTOCOL;
+                break;
+        case CEPH_ENTITY_TYPE_OSD:
+                proto = CEPH_OSDC_PROTOCOL;
+                break;
+        case CEPH_ENTITY_TYPE_MDS:
+                proto = CEPH_MDSC_PROTOCOL;
+                break;
+        default:
+                BUG();
+        }
+
+        dout("prepare_write_connect %p cseq=%d gseq=%d proto=%d\n", con,
+             con->connect_seq, global_seq, proto);
+
+        con->out_connect.features = CEPH_FEATURE_SUPPORTED;
+        con->out_connect.host_type = cpu_to_le32(CEPH_ENTITY_TYPE_CLIENT);
+        con->out_connect.connect_seq = cpu_to_le32(con->connect_seq);
+        con->out_connect.global_seq = cpu_to_le32(global_seq);
+        con->out_connect.protocol_version = cpu_to_le32(proto);
+        con->out_connect.flags = 0;
+
+        if (!after_banner) {
+                con->out_kvec_left = 0;
+                con->out_kvec_bytes = 0;
+        }
+        con->out_kvec[con->out_kvec_left].iov_base = &con->out_connect;
+        con->out_kvec[con->out_kvec_left].iov_len = sizeof(con->out_connect);
+        con->out_kvec_left++;
+        con->out_kvec_bytes += sizeof(con->out_connect);
+        con->out_kvec_cur = con->out_kvec;
+        con->out_more = 0;
+        set_bit(WRITE_PENDING, &con->state);
+
+        prepare_connect_authorizer(con);
+}
+
+
+/*
+ * write as much of pending kvecs to the socket as we can.
+ *  1 -> done
+ *  0 -> socket full, but more to do
+ * <0 -> error
+ */
+static int write_partial_kvec(struct ceph_connection *con)
+{
+        int ret;
+
+        dout("write_partial_kvec %p %d left\n", con, con->out_kvec_bytes);
+        while (con->out_kvec_bytes > 0) {
+                ret = ceph_tcp_sendmsg(con->sock, con->out_kvec_cur,
+                                       con->out_kvec_left, con->out_kvec_bytes,
+                                       con->out_more);
+                if (ret <= 0)
+                        goto out;
+                con->out_kvec_bytes -= ret;
+                if (con->out_kvec_bytes == 0)
+                        break;            /* done */
+                while (ret > 0) {
+                        if (ret >= con->out_kvec_cur->iov_len) {
+                                ret -= con->out_kvec_cur->iov_len;
+                                con->out_kvec_cur++;
+                                con->out_kvec_left--;
+                        } else {
+                                con->out_kvec_cur->iov_len -= ret;
+                                con->out_kvec_cur->iov_base += ret;
+                                ret = 0;
+                                break;
+                        }
+                }
+        }
+        con->out_kvec_left = 0;
+        con->out_kvec_is_msg = false;
+        ret = 1;
+out:
+        dout("write_partial_kvec %p %d left in %d kvecs ret = %d\n", con,
+             con->out_kvec_bytes, con->out_kvec_left, ret);
+        return ret;  /* done! */
+}
+
+/*
+ * Write as much message data payload as we can.  If we finish, queue
+ * up the footer.
+ *  1 -> done, footer is now queued in out_kvec[].
+ *  0 -> socket full, but more to do
+ * <0 -> error
+ */
+static int write_partial_msg_pages(struct ceph_connection *con)
+{
+        struct ceph_msg *msg = con->out_msg;
+        unsigned data_len = le32_to_cpu(msg->hdr.data_len);
+        size_t len;
+        int crc = con->msgr->nocrc;
+        int ret;
+
+        dout("write_partial_msg_pages %p msg %p page %d/%d offset %d\n",
+             con, con->out_msg, con->out_msg_pos.page, con->out_msg->nr_pages,
+             con->out_msg_pos.page_pos);
+
+        while (con->out_msg_pos.page < con->out_msg->nr_pages) {
+                struct page *page = NULL;
+                void *kaddr = NULL;
+
+                /*
+                 * if we are calculating the data crc (the default), we need
+                 * to map the page.  if our pages[] has been revoked, use the
+                 * zero page.
+                 */
+                if (msg->pages) {
+                        page = msg->pages[con->out_msg_pos.page];
+                        if (crc)
+                                kaddr = kmap(page);
+                } else if (msg->pagelist) {
+                        page = list_first_entry(&msg->pagelist->head,
+                                                struct page, lru);
+                        if (crc)
+                                kaddr = kmap(page);
+                } else {
+                        page = con->msgr->zero_page;
+                        if (crc)
+                                kaddr = page_address(con->msgr->zero_page);
+                }
+                len = min((int)(PAGE_SIZE - con->out_msg_pos.page_pos),
+                          (int)(data_len - con->out_msg_pos.data_pos));
+                if (crc && !con->out_msg_pos.did_page_crc) {
+                        void *base = kaddr + con->out_msg_pos.page_pos;
+                        u32 tmpcrc = le32_to_cpu(con->out_msg->footer.data_crc);
+
+                        BUG_ON(kaddr == NULL);
+                        con->out_msg->footer.data_crc =
+                                cpu_to_le32(crc32c(tmpcrc, base, len));
+                        con->out_msg_pos.did_page_crc = 1;
+                }
+
+                ret = kernel_sendpage(con->sock, page,
+                                      con->out_msg_pos.page_pos, len,
+                                      MSG_DONTWAIT | MSG_NOSIGNAL |
+                                      MSG_MORE);
+
+                if (crc && (msg->pages || msg->pagelist))
+                        kunmap(page);
+
+                if (ret <= 0)
+                        goto out;
+
+                con->out_msg_pos.data_pos += ret;
+                con->out_msg_pos.page_pos += ret;
+                if (ret == len) {
+                        con->out_msg_pos.page_pos = 0;
+                        con->out_msg_pos.page++;
+                        con->out_msg_pos.did_page_crc = 0;
+                        if (msg->pagelist)
+                                list_move_tail(&page->lru,
+                                               &msg->pagelist->head);
+                }
+        }
+
+        dout("write_partial_msg_pages %p msg %p done\n", con, msg);
+
+        /* prepare and queue up footer, too */
+        if (!crc)
+                con->out_msg->footer.flags |= CEPH_MSG_FOOTER_NOCRC;
+        con->out_kvec_bytes = 0;
+        con->out_kvec_left = 0;
+        con->out_kvec_cur = con->out_kvec;
+        prepare_write_message_footer(con, 0);
+        ret = 1;
+out:
+        return ret;
+}
+
+/*
+ * write some zeros
+ */
+static int write_partial_skip(struct ceph_connection *con)
+{
+        int ret;
+
+        while (con->out_skip > 0) {
+                struct kvec iov = {
+                        .iov_base = page_address(con->msgr->zero_page),
+                        .iov_len = min(con->out_skip, (int)PAGE_CACHE_SIZE)
+                };
+
+                ret = ceph_tcp_sendmsg(con->sock, &iov, 1, iov.iov_len, 1);
+                if (ret <= 0)
+                        goto out;
+                con->out_skip -= ret;
+        }
+        ret = 1;
+out:
+        return ret;
+}
+
+/*
+ * Prepare to read connection handshake, or an ack.
+ */
+static void prepare_read_banner(struct ceph_connection *con)
+{
+        dout("prepare_read_banner %p\n", con);
+        con->in_base_pos = 0;
+}
+
+static void prepare_read_connect(struct ceph_connection *con)
+{
+        dout("prepare_read_connect %p\n", con);
+        con->in_base_pos = 0;
+}
+
+static void prepare_read_ack(struct ceph_connection *con)
+{
+        dout("prepare_read_ack %p\n", con);
+        con->in_base_pos = 0;
+}
+
+static void prepare_read_tag(struct ceph_connection *con)
+{
+        dout("prepare_read_tag %p\n", con);
+        con->in_base_pos = 0;
+        con->in_tag = CEPH_MSGR_TAG_READY;
+}
+
+/*
+ * Prepare to read a message.
+ */
+static int prepare_read_message(struct ceph_connection *con)
+{
+        dout("prepare_read_message %p\n", con);
+        BUG_ON(con->in_msg != NULL);
+        con->in_base_pos = 0;
+        con->in_front_crc = con->in_middle_crc = con->in_data_crc = 0;
+        return 0;
+}
+
+
+static int read_partial(struct ceph_connection *con,
+                        int *to, int size, void *object)
+{
+        *to += size;
+        while (con->in_base_pos < *to) {
+                int left = *to - con->in_base_pos;
+                int have = size - left;
+                int ret = ceph_tcp_recvmsg(con->sock, object + have, left);
+                if (ret <= 0)
+                        return ret;
+                con->in_base_pos += ret;
+        }
+        return 1;
+}
+
+
+/*
+ * Read all or part of the connect-side handshake on a new connection
+ */
+static int read_partial_banner(struct ceph_connection *con)
+{
+        int ret, to = 0;
+
+        dout("read_partial_banner %p at %d\n", con, con->in_base_pos);
+
+        /* peer's banner */
+        ret = read_partial(con, &to, strlen(CEPH_BANNER), con->in_banner);
+        if (ret <= 0)
+                goto out;
+        ret = read_partial(con, &to, sizeof(con->actual_peer_addr),
+                           &con->actual_peer_addr);
+        if (ret <= 0)
+                goto out;
+        ret = read_partial(con, &to, sizeof(con->peer_addr_for_me),
+                           &con->peer_addr_for_me);
+        if (ret <= 0)
+                goto out;
+out:
+        return ret;
+}
+
+static int read_partial_connect(struct ceph_connection *con)
+{
+        int ret, to = 0;
+
+        dout("read_partial_connect %p at %d\n", con, con->in_base_pos);
+
+        ret = read_partial(con, &to, sizeof(con->in_reply), &con->in_reply);
+        if (ret <= 0)
+                goto out;
+        ret = read_partial(con, &to, le32_to_cpu(con->in_reply.authorizer_len),
+                           con->auth_reply_buf);
+        if (ret <= 0)
+                goto out;
+
+        dout("read_partial_connect %p tag %d, con_seq = %u, g_seq = %u\n",
+             con, (int)con->in_reply.tag,
+             le32_to_cpu(con->in_reply.connect_seq),
+             le32_to_cpu(con->in_reply.global_seq));
+out:
+        return ret;
+
+}
+
+/*
+ * Verify the hello banner looks okay.
+ */
+static int verify_hello(struct ceph_connection *con)
+{
+        if (memcmp(con->in_banner, CEPH_BANNER, strlen(CEPH_BANNER))) {
+                pr_err("connect to %s got bad banner\n",
+                       pr_addr(&con->peer_addr.in_addr));
+                con->error_msg = "protocol error, bad banner";
+                return -1;
+        }
+        return 0;
+}
+
+static bool addr_is_blank(struct sockaddr_storage *ss)
+{
+        switch (ss->ss_family) {
+        case AF_INET:
+                return ((struct sockaddr_in *)ss)->sin_addr.s_addr == 0;
+        case AF_INET6:
+                return
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[0] == 0 &&
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[1] == 0 &&
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[2] == 0 &&
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[3] == 0;
+        }
+        return false;
+}
+
+static int addr_port(struct sockaddr_storage *ss)
+{
+        switch (ss->ss_family) {
+        case AF_INET:
+                return ntohs(((struct sockaddr_in *)ss)->sin_port);
+        case AF_INET6:
+                return ntohs(((struct sockaddr_in6 *)ss)->sin6_port);
+        }
+        return 0;
+}
+
+static void addr_set_port(struct sockaddr_storage *ss, int p)
+{
+        switch (ss->ss_family) {
+        case AF_INET:
+                ((struct sockaddr_in *)ss)->sin_port = htons(p);
+        case AF_INET6:
+                ((struct sockaddr_in6 *)ss)->sin6_port = htons(p);
+        }
+}
+
+/*
+ * Parse an ip[:port] list into an addr array.  Use the default
+ * monitor port if a port isn't specified.
+ */
+int ceph_parse_ips(const char *c, const char *end,
+                   struct ceph_entity_addr *addr,
+                   int max_count, int *count)
+{
+        int i;
+        const char *p = c;
+
+        dout("parse_ips on '%.*s'\n", (int)(end-c), c);
+        for (i = 0; i < max_count; i++) {
+                const char *ipend;
+                struct sockaddr_storage *ss = &addr[i].in_addr;
+                struct sockaddr_in *in4 = (void *)ss;
+                struct sockaddr_in6 *in6 = (void *)ss;
+                int port;
+
+                memset(ss, 0, sizeof(*ss));
+                if (in4_pton(p, end - p, (u8 *)&in4->sin_addr.s_addr,
+                             ',', &ipend)) {
+                        ss->ss_family = AF_INET;
+                } else if (in6_pton(p, end - p, (u8 *)&in6->sin6_addr.s6_addr,
+                                    ',', &ipend)) {
+                        ss->ss_family = AF_INET6;
+                } else {
+                        goto bad;
+                }
+                p = ipend;
+
+                /* port? */
+                if (p < end && *p == ':') {
+                        port = 0;
+                        p++;
+                        while (p < end && *p >= '0' && *p <= '9') {
+                                port = (port * 10) + (*p - '0');
+                                p++;
+                        }
+                        if (port > 65535 || port == 0)
+                                goto bad;
+                } else {
+                        port = CEPH_MON_PORT;
+                }
+
+                addr_set_port(ss, port);
+
+                dout("parse_ips got %s\n", pr_addr(ss));
+
+                if (p == end)
+                        break;
+                if (*p != ',')
+                        goto bad;
+                p++;
+        }
+
+        if (p != end)
+                goto bad;
+
+        if (count)
+                *count = i + 1;
+        return 0;
+
+bad:
+        pr_err("parse_ips bad ip '%s'\n", c);
+        return -EINVAL;
+}
+
+static int process_banner(struct ceph_connection *con)
+{
+        dout("process_banner on %p\n", con);
+
+        if (verify_hello(con) < 0)
+                return -1;
+
+        ceph_decode_addr(&con->actual_peer_addr);
+        ceph_decode_addr(&con->peer_addr_for_me);
+
+        /*
+         * Make sure the other end is who we wanted.  note that the other
+         * end may not yet know their ip address, so if it's 0.0.0.0, give
+         * them the benefit of the doubt.
+         */
+        if (memcmp(&con->peer_addr, &con->actual_peer_addr,
+                   sizeof(con->peer_addr)) != 0 &&
+            !(addr_is_blank(&con->actual_peer_addr.in_addr) &&
+              con->actual_peer_addr.nonce == con->peer_addr.nonce)) {
+                pr_warning("wrong peer, want %s/%lld, got %s/%lld\n",
+                           pr_addr(&con->peer_addr.in_addr),
+                           le64_to_cpu(con->peer_addr.nonce),
+                           pr_addr(&con->actual_peer_addr.in_addr),
+                           le64_to_cpu(con->actual_peer_addr.nonce));
+                con->error_msg = "wrong peer at address";
+                return -1;
+        }
+
+        /*
+         * did we learn our address?
+         */
+        if (addr_is_blank(&con->msgr->inst.addr.in_addr)) {
+                int port = addr_port(&con->msgr->inst.addr.in_addr);
+
+                memcpy(&con->msgr->inst.addr.in_addr,
+                       &con->peer_addr_for_me.in_addr,
+                       sizeof(con->peer_addr_for_me.in_addr));
+                addr_set_port(&con->msgr->inst.addr.in_addr, port);
+                encode_my_addr(con->msgr);
+                dout("process_banner learned my addr is %s\n",
+                     pr_addr(&con->msgr->inst.addr.in_addr));
+        }
+
+        set_bit(NEGOTIATING, &con->state);
+        prepare_read_connect(con);
+        return 0;
+}
+
+static void fail_protocol(struct ceph_connection *con)
+{
+        reset_connection(con);
+        set_bit(CLOSED, &con->state);  /* in case there's queued work */
+
+        mutex_unlock(&con->mutex);
+        if (con->ops->bad_proto)
+                con->ops->bad_proto(con);
+        mutex_lock(&con->mutex);
+}
+
+static int process_connect(struct ceph_connection *con)
+{
+        u64 sup_feat = CEPH_FEATURE_SUPPORTED;
+        u64 req_feat = CEPH_FEATURE_REQUIRED;
+        u64 server_feat = le64_to_cpu(con->in_reply.features);
+
+        dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+
+        switch (con->in_reply.tag) {
+        case CEPH_MSGR_TAG_FEATURES:
+                pr_err("%s%lld %s feature set mismatch,"
+                       " my %llx < server's %llx, missing %llx\n",
+                       ENTITY_NAME(con->peer_name),
+                       pr_addr(&con->peer_addr.in_addr),
+                       sup_feat, server_feat, server_feat & ~sup_feat);
+                con->error_msg = "missing required protocol features";
+                fail_protocol(con);
+                return -1;
+
+        case CEPH_MSGR_TAG_BADPROTOVER:
+                pr_err("%s%lld %s protocol version mismatch,"
+                       " my %d != server's %d\n",
+                       ENTITY_NAME(con->peer_name),
+                       pr_addr(&con->peer_addr.in_addr),
+                       le32_to_cpu(con->out_connect.protocol_version),
+                       le32_to_cpu(con->in_reply.protocol_version));
+                con->error_msg = "protocol version mismatch";
+                fail_protocol(con);
+                return -1;
+
+        case CEPH_MSGR_TAG_BADAUTHORIZER:
+                con->auth_retry++;
+                dout("process_connect %p got BADAUTHORIZER attempt %d\n", con,
+                     con->auth_retry);
+                if (con->auth_retry == 2) {
+                        con->error_msg = "connect authorization failure";
+                        reset_connection(con);
+                        set_bit(CLOSED, &con->state);
+                        return -1;
+                }
+                con->auth_retry = 1;
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+                break;
+
+        case CEPH_MSGR_TAG_RESETSESSION:
+                /*
+                 * If we connected with a large connect_seq but the peer
+                 * has no record of a session with us (no connection, or
+                 * connect_seq == 0), they will send RESETSESION to indicate
+                 * that they must have reset their session, and may have
+                 * dropped messages.
+                 */
+                dout("process_connect got RESET peer seq %u\n",
+                     le32_to_cpu(con->in_connect.connect_seq));
+                pr_err("%s%lld %s connection reset\n",
+                       ENTITY_NAME(con->peer_name),
+                       pr_addr(&con->peer_addr.in_addr));
+                reset_connection(con);
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+
+                /* Tell ceph about it. */
+                mutex_unlock(&con->mutex);
+                pr_info("reset on %s%lld\n", ENTITY_NAME(con->peer_name));
+                if (con->ops->peer_reset)
+                        con->ops->peer_reset(con);
+                mutex_lock(&con->mutex);
+                break;
+
+        case CEPH_MSGR_TAG_RETRY_SESSION:
+                /*
+                 * If we sent a smaller connect_seq than the peer has, try
+                 * again with a larger value.
+                 */
+                dout("process_connect got RETRY my seq = %u, peer_seq = %u\n",
+                     le32_to_cpu(con->out_connect.connect_seq),
+                     le32_to_cpu(con->in_connect.connect_seq));
+                con->connect_seq = le32_to_cpu(con->in_connect.connect_seq);
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+                break;
+
+        case CEPH_MSGR_TAG_RETRY_GLOBAL:
+                /*
+                 * If we sent a smaller global_seq than the peer has, try
+                 * again with a larger value.
+                 */
+                dout("process_connect got RETRY_GLOBAL my %u peer_gseq %u\n",
+                     con->peer_global_seq,
+                     le32_to_cpu(con->in_connect.global_seq));
+                get_global_seq(con->msgr,
+                               le32_to_cpu(con->in_connect.global_seq));
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+                break;
+
+        case CEPH_MSGR_TAG_READY:
+                if (req_feat & ~server_feat) {
+                        pr_err("%s%lld %s protocol feature mismatch,"
+                               " my required %llx > server's %llx, need %llx\n",
+                               ENTITY_NAME(con->peer_name),
+                               pr_addr(&con->peer_addr.in_addr),
+                               req_feat, server_feat, req_feat & ~server_feat);
+                        con->error_msg = "missing required protocol features";
+                        fail_protocol(con);
+                        return -1;
+                }
+                clear_bit(CONNECTING, &con->state);
+                con->peer_global_seq = le32_to_cpu(con->in_reply.global_seq);
+                con->connect_seq++;
+                dout("process_connect got READY gseq %d cseq %d (%d)\n",
+                     con->peer_global_seq,
+                     le32_to_cpu(con->in_reply.connect_seq),
+                     con->connect_seq);
+                WARN_ON(con->connect_seq !=
+                        le32_to_cpu(con->in_reply.connect_seq));
+
+                if (con->in_reply.flags & CEPH_MSG_CONNECT_LOSSY)
+                        set_bit(LOSSYTX, &con->state);
+
+                prepare_read_tag(con);
+                break;
+
+        case CEPH_MSGR_TAG_WAIT:
+                /*
+                 * If there is a connection race (we are opening
+                 * connections to each other), one of us may just have
+                 * to WAIT.  This shouldn't happen if we are the
+                 * client.
+                 */
+                pr_err("process_connect peer connecting WAIT\n");
+
+        default:
+                pr_err("connect protocol error, will retry\n");
+                con->error_msg = "protocol error, garbage tag during connect";
+                return -1;
+        }
+        return 0;
+}
+
+
+/*
+ * read (part of) an ack
+ */
+static int read_partial_ack(struct ceph_connection *con)
+{
+        int to = 0;
+
+        return read_partial(con, &to, sizeof(con->in_temp_ack),
+                            &con->in_temp_ack);
+}
+
+
+/*
+ * We can finally discard anything that's been acked.
+ */
+static void process_ack(struct ceph_connection *con)
+{
+        struct ceph_msg *m;
+        u64 ack = le64_to_cpu(con->in_temp_ack);
+        u64 seq;
+
+        while (!list_empty(&con->out_sent)) {
+                m = list_first_entry(&con->out_sent, struct ceph_msg,
+                                     list_head);
+                seq = le64_to_cpu(m->hdr.seq);
+                if (seq > ack)
+                        break;
+                dout("got ack for seq %llu type %d at %p\n", seq,
+                     le16_to_cpu(m->hdr.type), m);
+                ceph_msg_remove(m);
+        }
+        prepare_read_tag(con);
+}
+
+
+
+
+static int read_partial_message_section(struct ceph_connection *con,
+                                        struct kvec *section, unsigned int sec_len,
+                                        u32 *crc)
+{
+        int left;
+        int ret;
+
+        BUG_ON(!section);
+
+        while (section->iov_len < sec_len) {
+                BUG_ON(section->iov_base == NULL);
+                left = sec_len - section->iov_len;
+                ret = ceph_tcp_recvmsg(con->sock, (char *)section->iov_base +
+                                       section->iov_len, left);
+                if (ret <= 0)
+                        return ret;
+                section->iov_len += ret;
+                if (section->iov_len == sec_len)
+                        *crc = crc32c(0, section->iov_base,
+                                      section->iov_len);
+        }
+
+        return 1;
+}
+
+static struct ceph_msg *ceph_alloc_msg(struct ceph_connection *con,
+                                struct ceph_msg_header *hdr,
+                                int *skip);
+/*
+ * read (part of) a message.
+ */
+static int read_partial_message(struct ceph_connection *con)
+{
+        struct ceph_msg *m = con->in_msg;
+        void *p;
+        int ret;
+        int to, left;
+        unsigned front_len, middle_len, data_len, data_off;
+        int datacrc = con->msgr->nocrc;
+        int skip;
+
+        dout("read_partial_message con %p msg %p\n", con, m);
+
+        /* header */
+        while (con->in_base_pos < sizeof(con->in_hdr)) {
+                left = sizeof(con->in_hdr) - con->in_base_pos;
+                ret = ceph_tcp_recvmsg(con->sock,
+                                       (char *)&con->in_hdr + con->in_base_pos,
+                                       left);
+                if (ret <= 0)
+                        return ret;
+                con->in_base_pos += ret;
+                if (con->in_base_pos == sizeof(con->in_hdr)) {
+                        u32 crc = crc32c(0, (void *)&con->in_hdr,
+                                 sizeof(con->in_hdr) - sizeof(con->in_hdr.crc));
+                        if (crc != le32_to_cpu(con->in_hdr.crc)) {
+                                pr_err("read_partial_message bad hdr "
+                                       " crc %u != expected %u\n",
+                                       crc, con->in_hdr.crc);
+                                return -EBADMSG;
+                        }
+                }
+        }
+        front_len = le32_to_cpu(con->in_hdr.front_len);
+        if (front_len > CEPH_MSG_MAX_FRONT_LEN)
+                return -EIO;
+        middle_len = le32_to_cpu(con->in_hdr.middle_len);
+        if (middle_len > CEPH_MSG_MAX_DATA_LEN)
+                return -EIO;
+        data_len = le32_to_cpu(con->in_hdr.data_len);
+        if (data_len > CEPH_MSG_MAX_DATA_LEN)
+                return -EIO;
+        data_off = le16_to_cpu(con->in_hdr.data_off);
+
+        /* allocate message? */
+        if (!con->in_msg) {
+                dout("got hdr type %d front %d data %d\n", con->in_hdr.type,
+                     con->in_hdr.front_len, con->in_hdr.data_len);
+                con->in_msg = ceph_alloc_msg(con, &con->in_hdr, &skip);
+                if (skip) {
+                        /* skip this message */
+                        dout("alloc_msg returned NULL, skipping message\n");
+                        con->in_base_pos = -front_len - middle_len - data_len -
+                                sizeof(m->footer);
+                        con->in_tag = CEPH_MSGR_TAG_READY;
+                        return 0;
+                }
+                if (IS_ERR(con->in_msg)) {
+                        ret = PTR_ERR(con->in_msg);
+                        con->in_msg = NULL;
+                        con->error_msg =
+                                "error allocating memory for incoming message";
+                        return ret;
+                }
+                m = con->in_msg;
+                m->front.iov_len = 0;    /* haven't read it yet */
+                if (m->middle)
+                        m->middle->vec.iov_len = 0;
+
+                con->in_msg_pos.page = 0;
+                con->in_msg_pos.page_pos = data_off & ~PAGE_MASK;
+                con->in_msg_pos.data_pos = 0;
+        }
+
+        /* front */
+        ret = read_partial_message_section(con, &m->front, front_len,
+                                           &con->in_front_crc);
+        if (ret <= 0)
+                return ret;
+
+        /* middle */
+        if (m->middle) {
+                ret = read_partial_message_section(con, &m->middle->vec, middle_len,
+                                                   &con->in_middle_crc);
+                if (ret <= 0)
+                        return ret;
+        }
+
+        /* (page) data */
+        while (con->in_msg_pos.data_pos < data_len) {
+                left = min((int)(data_len - con->in_msg_pos.data_pos),
+                           (int)(PAGE_SIZE - con->in_msg_pos.page_pos));
+                BUG_ON(m->pages == NULL);
+                p = kmap(m->pages[con->in_msg_pos.page]);
+                ret = ceph_tcp_recvmsg(con->sock, p + con->in_msg_pos.page_pos,
+                                       left);
+                if (ret > 0 && datacrc)
+                        con->in_data_crc =
+                                crc32c(con->in_data_crc,
+                                          p + con->in_msg_pos.page_pos, ret);
+                kunmap(m->pages[con->in_msg_pos.page]);
+                if (ret <= 0)
+                        return ret;
+                con->in_msg_pos.data_pos += ret;
+                con->in_msg_pos.page_pos += ret;
+                if (con->in_msg_pos.page_pos == PAGE_SIZE) {
+                        con->in_msg_pos.page_pos = 0;
+                        con->in_msg_pos.page++;
+                }
+        }
+
+        /* footer */
+        to = sizeof(m->hdr) + sizeof(m->footer);
+        while (con->in_base_pos < to) {
+                left = to - con->in_base_pos;
+                ret = ceph_tcp_recvmsg(con->sock, (char *)&m->footer +
+                                       (con->in_base_pos - sizeof(m->hdr)),
+                                       left);
+                if (ret <= 0)
+                        return ret;
+                con->in_base_pos += ret;
+        }
+        dout("read_partial_message got msg %p %d (%u) + %d (%u) + %d (%u)\n",
+             m, front_len, m->footer.front_crc, middle_len,
+             m->footer.middle_crc, data_len, m->footer.data_crc);
+
+        /* crc ok? */
+        if (con->in_front_crc != le32_to_cpu(m->footer.front_crc)) {
+                pr_err("read_partial_message %p front crc %u != exp. %u\n",
+                       m, con->in_front_crc, m->footer.front_crc);
+                return -EBADMSG;
+        }
+        if (con->in_middle_crc != le32_to_cpu(m->footer.middle_crc)) {
+                pr_err("read_partial_message %p middle crc %u != exp %u\n",
+                       m, con->in_middle_crc, m->footer.middle_crc);
+                return -EBADMSG;
+        }
+        if (datacrc &&
+            (m->footer.flags & CEPH_MSG_FOOTER_NOCRC) == 0 &&
+            con->in_data_crc != le32_to_cpu(m->footer.data_crc)) {
+                pr_err("read_partial_message %p data crc %u != exp. %u\n", m,
+                       con->in_data_crc, le32_to_cpu(m->footer.data_crc));
+                return -EBADMSG;
+        }
+
+        return 1; /* done! */
+}
+
+/*
+ * Process message.  This happens in the worker thread.  The callback should
+ * be careful not to do anything that waits on other incoming messages or it
+ * may deadlock.
+ */
+static void process_message(struct ceph_connection *con)
+{
+        struct ceph_msg *msg;
+
+        msg = con->in_msg;
+        con->in_msg = NULL;
+
+        /* if first message, set peer_name */
+        if (con->peer_name.type == 0)
+                con->peer_name = msg->hdr.src.name;
+
+        con->in_seq++;
+        mutex_unlock(&con->mutex);
+
+        dout("===== %p %llu from %s%lld %d=%s len %d+%d (%u %u %u) =====\n",
+             msg, le64_to_cpu(msg->hdr.seq),
+             ENTITY_NAME(msg->hdr.src.name),
+             le16_to_cpu(msg->hdr.type),
+             ceph_msg_type_name(le16_to_cpu(msg->hdr.type)),
+             le32_to_cpu(msg->hdr.front_len),
+             le32_to_cpu(msg->hdr.data_len),
+             con->in_front_crc, con->in_middle_crc, con->in_data_crc);
+        con->ops->dispatch(con, msg);
+
+        mutex_lock(&con->mutex);
+        prepare_read_tag(con);
+}
+
+
+/*
+ * Write something to the socket.  Called in a worker thread when the
+ * socket appears to be writeable and we have something ready to send.
+ */
+static int try_write(struct ceph_connection *con)
+{
+        struct ceph_messenger *msgr = con->msgr;
+        int ret = 1;
+
+        dout("try_write start %p state %lu nref %d\n", con, con->state,
+             atomic_read(&con->nref));
+
+        mutex_lock(&con->mutex);
+more:
+        dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
+
+        /* open the socket first? */
+        if (con->sock == NULL) {
+                /*
+                 * if we were STANDBY and are reconnecting _this_
+                 * connection, bump connect_seq now.  Always bump
+                 * global_seq.
+                 */
+                if (test_and_clear_bit(STANDBY, &con->state))
+                        con->connect_seq++;
+
+                prepare_write_banner(msgr, con);
+                prepare_write_connect(msgr, con, 1);
+                prepare_read_banner(con);
+                set_bit(CONNECTING, &con->state);
+                clear_bit(NEGOTIATING, &con->state);
+
+                BUG_ON(con->in_msg);
+                con->in_tag = CEPH_MSGR_TAG_READY;
+                dout("try_write initiating connect on %p new state %lu\n",
+                     con, con->state);
+                con->sock = ceph_tcp_connect(con);
+                if (IS_ERR(con->sock)) {
+                        con->sock = NULL;
+                        con->error_msg = "connect error";
+                        ret = -1;
+                        goto out;
+                }
+        }
+
+more_kvec:
+        /* kvec data queued? */
+        if (con->out_skip) {
+                ret = write_partial_skip(con);
+                if (ret <= 0)
+                        goto done;
+                if (ret < 0) {
+                        dout("try_write write_partial_skip err %d\n", ret);
+                        goto done;
+                }
+        }
+        if (con->out_kvec_left) {
+                ret = write_partial_kvec(con);
+                if (ret <= 0)
+                        goto done;
+        }
+
+        /* msg pages? */
+        if (con->out_msg) {
+                if (con->out_msg_done) {
+                        ceph_msg_put(con->out_msg);
+                        con->out_msg = NULL;   /* we're done with this one */
+                        goto do_next;
+                }
+
+                ret = write_partial_msg_pages(con);
+                if (ret == 1)
+                        goto more_kvec;  /* we need to send the footer, too! */
+                if (ret == 0)
+                        goto done;
+                if (ret < 0) {
+                        dout("try_write write_partial_msg_pages err %d\n",
+                             ret);
+                        goto done;
+                }
+        }
+
+do_next:
+        if (!test_bit(CONNECTING, &con->state)) {
+                /* is anything else pending? */
+                if (!list_empty(&con->out_queue)) {
+                        prepare_write_message(con);
+                        goto more;
+                }
+                if (con->in_seq > con->in_seq_acked) {
+                        prepare_write_ack(con);
+                        goto more;
+                }
+                if (test_and_clear_bit(KEEPALIVE_PENDING, &con->state)) {
+                        prepare_write_keepalive(con);
+                        goto more;
+                }
+        }
+
+        /* Nothing to do! */
+        clear_bit(WRITE_PENDING, &con->state);
+        dout("try_write nothing else to write.\n");
+done:
+        ret = 0;
+out:
+        mutex_unlock(&con->mutex);
+        dout("try_write done on %p\n", con);
+        return ret;
+}
+
+
+
+/*
+ * Read what we can from the socket.
+ */
+static int try_read(struct ceph_connection *con)
+{
+        struct ceph_messenger *msgr;
+        int ret = -1;
+
+        if (!con->sock)
+                return 0;
+
+        if (test_bit(STANDBY, &con->state))
+                return 0;
+
+        dout("try_read start on %p\n", con);
+        msgr = con->msgr;
+
+        mutex_lock(&con->mutex);
+
+more:
+        dout("try_read tag %d in_base_pos %d\n", (int)con->in_tag,
+             con->in_base_pos);
+        if (test_bit(CONNECTING, &con->state)) {
+                if (!test_bit(NEGOTIATING, &con->state)) {
+                        dout("try_read connecting\n");
+                        ret = read_partial_banner(con);
+                        if (ret <= 0)
+                                goto done;
+                        if (process_banner(con) < 0) {
+                                ret = -1;
+                                goto out;
+                        }
+                }
+                ret = read_partial_connect(con);
+                if (ret <= 0)
+                        goto done;
+                if (process_connect(con) < 0) {
+                        ret = -1;
+                        goto out;
+                }
+                goto more;
+        }
+
+        if (con->in_base_pos < 0) {
+                /*
+                 * skipping + discarding content.
+                 *
+                 * FIXME: there must be a better way to do this!
+                 */
+                static char buf[1024];
+                int skip = min(1024, -con->in_base_pos);
+                dout("skipping %d / %d bytes\n", skip, -con->in_base_pos);
+                ret = ceph_tcp_recvmsg(con->sock, buf, skip);
+                if (ret <= 0)
+                        goto done;
+                con->in_base_pos += ret;
+                if (con->in_base_pos)
+                        goto more;
+        }
+        if (con->in_tag == CEPH_MSGR_TAG_READY) {
+                /*
+                 * what's next?
+                 */
+                ret = ceph_tcp_recvmsg(con->sock, &con->in_tag, 1);
+                if (ret <= 0)
+                        goto done;
+                dout("try_read got tag %d\n", (int)con->in_tag);
+                switch (con->in_tag) {
+                case CEPH_MSGR_TAG_MSG:
+                        prepare_read_message(con);
+                        break;
+                case CEPH_MSGR_TAG_ACK:
+                        prepare_read_ack(con);
+                        break;
+                case CEPH_MSGR_TAG_CLOSE:
+                        set_bit(CLOSED, &con->state);   /* fixme */
+                        goto done;
+                default:
+                        goto bad_tag;
+                }
+        }
+        if (con->in_tag == CEPH_MSGR_TAG_MSG) {
+                ret = read_partial_message(con);
+                if (ret <= 0) {
+                        switch (ret) {
+                        case -EBADMSG:
+                                con->error_msg = "bad crc";
+                                ret = -EIO;
+                                goto out;
+                        case -EIO:
+                                con->error_msg = "io error";
+                                goto out;
+                        default:
+                                goto done;
+                        }
+                }
+                if (con->in_tag == CEPH_MSGR_TAG_READY)
+                        goto more;
+                process_message(con);
+                goto more;
+        }
+        if (con->in_tag == CEPH_MSGR_TAG_ACK) {
+                ret = read_partial_ack(con);
+                if (ret <= 0)
+                        goto done;
+                process_ack(con);
+                goto more;
+        }
+
+done:
+        ret = 0;
+out:
+        mutex_unlock(&con->mutex);
+        dout("try_read done on %p\n", con);
+        return ret;
+
+bad_tag:
+        pr_err("try_read bad con->in_tag = %d\n", (int)con->in_tag);
+        con->error_msg = "protocol error, garbage tag";
+        ret = -1;
+        goto out;
+}
+
+
+/*
+ * Atomically queue work on a connection.  Bump @con reference to
+ * avoid races with connection teardown.
+ *
+ * There is some trickery going on with QUEUED and BUSY because we
+ * only want a _single_ thread operating on each connection at any
+ * point in time, but we want to use all available CPUs.
+ *
+ * The worker thread only proceeds if it can atomically set BUSY.  It
+ * clears QUEUED and does it's thing.  When it thinks it's done, it
+ * clears BUSY, then rechecks QUEUED.. if it's set again, it loops
+ * (tries again to set BUSY).
+ *
+ * To queue work, we first set QUEUED, _then_ if BUSY isn't set, we
+ * try to queue work.  If that fails (work is already queued, or BUSY)
+ * we give up (work also already being done or is queued) but leave QUEUED
+ * set so that the worker thread will loop if necessary.
+ */
+static void queue_con(struct ceph_connection *con)
+{
+        if (test_bit(DEAD, &con->state)) {
+                dout("queue_con %p ignoring: DEAD\n",
+                     con);
+                return;
+        }
+
+        if (!con->ops->get(con)) {
+                dout("queue_con %p ref count 0\n", con);
+                return;
+        }
+
+        set_bit(QUEUED, &con->state);
+        if (test_bit(BUSY, &con->state)) {
+                dout("queue_con %p - already BUSY\n", con);
+                con->ops->put(con);
+        } else if (!queue_work(ceph_msgr_wq, &con->work.work)) {
+                dout("queue_con %p - already queued\n", con);
+                con->ops->put(con);
+        } else {
+                dout("queue_con %p\n", con);
+        }
+}
+
+/*
+ * Do some work on a connection.  Drop a connection ref when we're done.
+ */
+static void con_work(struct work_struct *work)
+{
+        struct ceph_connection *con = container_of(work, struct ceph_connection,
+                                                   work.work);
+        int backoff = 0;
+
+more:
+        if (test_and_set_bit(BUSY, &con->state) != 0) {
+                dout("con_work %p BUSY already set\n", con);
+                goto out;
+        }
+        dout("con_work %p start, clearing QUEUED\n", con);
+        clear_bit(QUEUED, &con->state);
+
+        if (test_bit(CLOSED, &con->state)) { /* e.g. if we are replaced */
+                dout("con_work CLOSED\n");
+                con_close_socket(con);
+                goto done;
+        }
+        if (test_and_clear_bit(OPENING, &con->state)) {
+                /* reopen w/ new peer */
+                dout("con_work OPENING\n");
+                con_close_socket(con);
+        }
+
+        if (test_and_clear_bit(SOCK_CLOSED, &con->state) ||
+            try_read(con) < 0 ||
+            try_write(con) < 0) {
+                backoff = 1;
+                ceph_fault(con);     /* error/fault path */
+        }
+
+done:
+        clear_bit(BUSY, &con->state);
+        dout("con->state=%lu\n", con->state);
+        if (test_bit(QUEUED, &con->state)) {
+                if (!backoff || test_bit(OPENING, &con->state)) {
+                        dout("con_work %p QUEUED reset, looping\n", con);
+                        goto more;
+                }
+                dout("con_work %p QUEUED reset, but just faulted\n", con);
+                clear_bit(QUEUED, &con->state);
+        }
+        dout("con_work %p done\n", con);
+
+out:
+        con->ops->put(con);
+}
+
+
+/*
+ * Generic error/fault handler.  A retry mechanism is used with
+ * exponential backoff
+ */
+static void ceph_fault(struct ceph_connection *con)
+{
+        pr_err("%s%lld %s %s\n", ENTITY_NAME(con->peer_name),
+               pr_addr(&con->peer_addr.in_addr), con->error_msg);
+        dout("fault %p state %lu to peer %s\n",
+             con, con->state, pr_addr(&con->peer_addr.in_addr));
+
+        if (test_bit(LOSSYTX, &con->state)) {
+                dout("fault on LOSSYTX channel\n");
+                goto out;
+        }
+
+        mutex_lock(&con->mutex);
+        if (test_bit(CLOSED, &con->state))
+                goto out_unlock;
+
+        con_close_socket(con);
+
+        if (con->in_msg) {
+                ceph_msg_put(con->in_msg);
+                con->in_msg = NULL;
+        }
+
+        /* Requeue anything that hasn't been acked */
+        list_splice_init(&con->out_sent, &con->out_queue);
+
+        /* If there are no messages in the queue, place the connection
+         * in a STANDBY state (i.e., don't try to reconnect just yet). */
+        if (list_empty(&con->out_queue) && !con->out_keepalive_pending) {
+                dout("fault setting STANDBY\n");
+                set_bit(STANDBY, &con->state);
+        } else {
+                /* retry after a delay. */
+                if (con->delay == 0)
+                        con->delay = BASE_DELAY_INTERVAL;
+                else if (con->delay < MAX_DELAY_INTERVAL)
+                        con->delay *= 2;
+                dout("fault queueing %p delay %lu\n", con, con->delay);
+                con->ops->get(con);
+                if (queue_delayed_work(ceph_msgr_wq, &con->work,
+                                       round_jiffies_relative(con->delay)) == 0)
+                        con->ops->put(con);
+        }
+
+out_unlock:
+        mutex_unlock(&con->mutex);
+out:
+        /*
+         * in case we faulted due to authentication, invalidate our
+         * current tickets so that we can get new ones.
+         */
+        if (con->auth_retry && con->ops->invalidate_authorizer) {
+                dout("calling invalidate_authorizer()\n");
+                con->ops->invalidate_authorizer(con);
+        }
+
+        if (con->ops->fault)
+                con->ops->fault(con);
+}
+
+
+
+/*
+ * create a new messenger instance
+ */
+struct ceph_messenger *ceph_messenger_create(struct ceph_entity_addr *myaddr)
+{
+        struct ceph_messenger *msgr;
+
+        msgr = kzalloc(sizeof(*msgr), GFP_KERNEL);
+        if (msgr == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        spin_lock_init(&msgr->global_seq_lock);
+
+        /* the zero page is needed if a request is "canceled" while the message
+         * is being written over the socket */
+        msgr->zero_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+        if (!msgr->zero_page) {
+                kfree(msgr);
+                return ERR_PTR(-ENOMEM);
+        }
+        kmap(msgr->zero_page);
+
+        if (myaddr)
+                msgr->inst.addr = *myaddr;
+
+        /* select a random nonce */
+        msgr->inst.addr.type = 0;
+        get_random_bytes(&msgr->inst.addr.nonce, sizeof(msgr->inst.addr.nonce));
+        encode_my_addr(msgr);
+
+        dout("messenger_create %p\n", msgr);
+        return msgr;
+}
+
+void ceph_messenger_destroy(struct ceph_messenger *msgr)
+{
+        dout("destroy %p\n", msgr);
+        kunmap(msgr->zero_page);
+        __free_page(msgr->zero_page);
+        kfree(msgr);
+        dout("destroyed messenger %p\n", msgr);
+}
+
+/*
+ * Queue up an outgoing message on the given connection.
+ */
+void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        if (test_bit(CLOSED, &con->state)) {
+                dout("con_send %p closed, dropping %p\n", con, msg);
+                ceph_msg_put(msg);
+                return;
+        }
+
+        /* set src+dst */
+        msg->hdr.src.name = con->msgr->inst.name;
+        msg->hdr.src.addr = con->msgr->my_enc_addr;
+        msg->hdr.orig_src = msg->hdr.src;
+
+        BUG_ON(msg->front.iov_len != le32_to_cpu(msg->hdr.front_len));
+
+        /* queue */
+        mutex_lock(&con->mutex);
+        BUG_ON(!list_empty(&msg->list_head));
+        list_add_tail(&msg->list_head, &con->out_queue);
+        dout("----- %p to %s%lld %d=%s len %d+%d+%d -----\n", msg,
+             ENTITY_NAME(con->peer_name), le16_to_cpu(msg->hdr.type),
+             ceph_msg_type_name(le16_to_cpu(msg->hdr.type)),
+             le32_to_cpu(msg->hdr.front_len),
+             le32_to_cpu(msg->hdr.middle_len),
+             le32_to_cpu(msg->hdr.data_len));
+        mutex_unlock(&con->mutex);
+
+        /* if there wasn't anything waiting to send before, queue
+         * new work */
+        if (test_and_set_bit(WRITE_PENDING, &con->state) == 0)
+                queue_con(con);
+}
+
+/*
+ * Revoke a message that was previously queued for send
+ */
+void ceph_con_revoke(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        mutex_lock(&con->mutex);
+        if (!list_empty(&msg->list_head)) {
+                dout("con_revoke %p msg %p\n", con, msg);
+                list_del_init(&msg->list_head);
+                ceph_msg_put(msg);
+                msg->hdr.seq = 0;
+                if (con->out_msg == msg) {
+                        ceph_msg_put(con->out_msg);
+                        con->out_msg = NULL;
+                }
+                if (con->out_kvec_is_msg) {
+                        con->out_skip = con->out_kvec_bytes;
+                        con->out_kvec_is_msg = false;
+                }
+        } else {
+                dout("con_revoke %p msg %p - not queued (sent?)\n", con, msg);
+        }
+        mutex_unlock(&con->mutex);
+}
+
+/*
+ * Revoke a message that we may be reading data into
+ */
+void ceph_con_revoke_message(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        mutex_lock(&con->mutex);
+        if (con->in_msg && con->in_msg == msg) {
+                unsigned front_len = le32_to_cpu(con->in_hdr.front_len);
+                unsigned middle_len = le32_to_cpu(con->in_hdr.middle_len);
+                unsigned data_len = le32_to_cpu(con->in_hdr.data_len);
+
+                /* skip rest of message */
+                dout("con_revoke_pages %p msg %p revoked\n", con, msg);
+                        con->in_base_pos = con->in_base_pos -
+                                sizeof(struct ceph_msg_header) -
+                                front_len -
+                                middle_len -
+                                data_len -
+                                sizeof(struct ceph_msg_footer);
+                ceph_msg_put(con->in_msg);
+                con->in_msg = NULL;
+                con->in_tag = CEPH_MSGR_TAG_READY;
+        } else {
+                dout("con_revoke_pages %p msg %p pages %p no-op\n",
+                     con, con->in_msg, msg);
+        }
+        mutex_unlock(&con->mutex);
+}
+
+/*
+ * Queue a keepalive byte to ensure the tcp connection is alive.
+ */
+void ceph_con_keepalive(struct ceph_connection *con)
+{
+        if (test_and_set_bit(KEEPALIVE_PENDING, &con->state) == 0 &&
+            test_and_set_bit(WRITE_PENDING, &con->state) == 0)
+                queue_con(con);
+}
+
+
+/*
+ * construct a new message with given type, size
+ * the new msg has a ref count of 1.
+ */
+struct ceph_msg *ceph_msg_new(int type, int front_len,
+                              int page_len, int page_off, struct page **pages)
+{
+        struct ceph_msg *m;
+
+        m = kmalloc(sizeof(*m), GFP_NOFS);
+        if (m == NULL)
+                goto out;
+        kref_init(&m->kref);
+        INIT_LIST_HEAD(&m->list_head);
+
+        m->hdr.type = cpu_to_le16(type);
+        m->hdr.front_len = cpu_to_le32(front_len);
+        m->hdr.middle_len = 0;
+        m->hdr.data_len = cpu_to_le32(page_len);
+        m->hdr.data_off = cpu_to_le16(page_off);
+        m->hdr.priority = cpu_to_le16(CEPH_MSG_PRIO_DEFAULT);
+        m->footer.front_crc = 0;
+        m->footer.middle_crc = 0;
+        m->footer.data_crc = 0;
+        m->front_max = front_len;
+        m->front_is_vmalloc = false;
+        m->more_to_follow = false;
+        m->pool = NULL;
+
+        /* front */
+        if (front_len) {
+                if (front_len > PAGE_CACHE_SIZE) {
+                        m->front.iov_base = __vmalloc(front_len, GFP_NOFS,
+                                                      PAGE_KERNEL);
+                        m->front_is_vmalloc = true;
+                } else {
+                        m->front.iov_base = kmalloc(front_len, GFP_NOFS);
+                }
+                if (m->front.iov_base == NULL) {
+                        pr_err("msg_new can't allocate %d bytes\n",
+                             front_len);
+                        goto out2;
+                }
+        } else {
+                m->front.iov_base = NULL;
+        }
+        m->front.iov_len = front_len;
+
+        /* middle */
+        m->middle = NULL;
+
+        /* data */
+        m->nr_pages = calc_pages_for(page_off, page_len);
+        m->pages = pages;
+        m->pagelist = NULL;
+
+        dout("ceph_msg_new %p page %d~%d -> %d\n", m, page_off, page_len,
+             m->nr_pages);
+        return m;
+
+out2:
+        ceph_msg_put(m);
+out:
+        pr_err("msg_new can't create type %d len %d\n", type, front_len);
+        return ERR_PTR(-ENOMEM);
+}
+
+/*
+ * Allocate "middle" portion of a message, if it is needed and wasn't
+ * allocated by alloc_msg.  This allows us to read a small fixed-size
+ * per-type header in the front and then gracefully fail (i.e.,
+ * propagate the error to the caller based on info in the front) when
+ * the middle is too large.
+ */
+static int ceph_alloc_middle(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        int type = le16_to_cpu(msg->hdr.type);
+        int middle_len = le32_to_cpu(msg->hdr.middle_len);
+
+        dout("alloc_middle %p type %d %s middle_len %d\n", msg, type,
+             ceph_msg_type_name(type), middle_len);
+        BUG_ON(!middle_len);
+        BUG_ON(msg->middle);
+
+        msg->middle = ceph_buffer_new(middle_len, GFP_NOFS);
+        if (!msg->middle)
+                return -ENOMEM;
+        return 0;
+}
+
+/*
+ * Generic message allocator, for incoming messages.
+ */
+static struct ceph_msg *ceph_alloc_msg(struct ceph_connection *con,
+                                struct ceph_msg_header *hdr,
+                                int *skip)
+{
+        int type = le16_to_cpu(hdr->type);
+        int front_len = le32_to_cpu(hdr->front_len);
+        int middle_len = le32_to_cpu(hdr->middle_len);
+        struct ceph_msg *msg = NULL;
+        int ret;
+
+        if (con->ops->alloc_msg) {
+                mutex_unlock(&con->mutex);
+                msg = con->ops->alloc_msg(con, hdr, skip);
+                mutex_lock(&con->mutex);
+                if (IS_ERR(msg))
+                        return msg;
+
+                if (*skip)
+                        return NULL;
+        }
+        if (!msg) {
+                *skip = 0;
+                msg = ceph_msg_new(type, front_len, 0, 0, NULL);
+                if (!msg) {
+                        pr_err("unable to allocate msg type %d len %d\n",
+                               type, front_len);
+                        return ERR_PTR(-ENOMEM);
+                }
+        }
+        memcpy(&msg->hdr, &con->in_hdr, sizeof(con->in_hdr));
+
+        if (middle_len) {
+                ret = ceph_alloc_middle(con, msg);
+
+                if (ret < 0) {
+                        ceph_msg_put(msg);
+                        return msg;
+                }
+        }
+
+        return msg;
+}
+
+
+/*
+ * Free a generically kmalloc'd message.
+ */
+void ceph_msg_kfree(struct ceph_msg *m)
+{
+        dout("msg_kfree %p\n", m);
+        if (m->front_is_vmalloc)
+                vfree(m->front.iov_base);
+        else
+                kfree(m->front.iov_base);
+        kfree(m);
+}
+
+/*
+ * Drop a msg ref.  Destroy as needed.
+ */
+void ceph_msg_last_put(struct kref *kref)
+{
+        struct ceph_msg *m = container_of(kref, struct ceph_msg, kref);
+
+        dout("ceph_msg_put last one on %p\n", m);
+        WARN_ON(!list_empty(&m->list_head));
+
+        /* drop middle, data, if any */
+        if (m->middle) {
+                ceph_buffer_put(m->middle);
+                m->middle = NULL;
+        }
+        m->nr_pages = 0;
+        m->pages = NULL;
+
+        if (m->pagelist) {
+                ceph_pagelist_release(m->pagelist);
+                kfree(m->pagelist);
+                m->pagelist = NULL;
+        }
+
+        if (m->pool)
+                ceph_msgpool_put(m->pool, m);
+        else
+                ceph_msg_kfree(m);
+}
+
+void ceph_msg_dump(struct ceph_msg *msg)
+{
+        pr_debug("msg_dump %p (front_max %d nr_pages %d)\n", msg,
+                 msg->front_max, msg->nr_pages);
+        print_hex_dump(KERN_DEBUG, "header: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       &msg->hdr, sizeof(msg->hdr), true);
+        print_hex_dump(KERN_DEBUG, " front: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       msg->front.iov_base, msg->front.iov_len, true);
+        if (msg->middle)
+                print_hex_dump(KERN_DEBUG, "middle: ",
+                               DUMP_PREFIX_OFFSET, 16, 1,
+                               msg->middle->vec.iov_base,
+                               msg->middle->vec.iov_len, true);
+        print_hex_dump(KERN_DEBUG, "footer: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       &msg->footer, sizeof(msg->footer), true);
+}
diff --git a/fs/ceph/messenger.h b/fs/ceph/messenger.h
new file mode 100644
index 000000000000..a343dae73cdc
--- /dev/null
+++ b/fs/ceph/messenger.h
@@ -0,0 +1,255 @@
+#ifndef __FS_CEPH_MESSENGER_H
+#define __FS_CEPH_MESSENGER_H
+
+#include <linux/kref.h>
+#include <linux/mutex.h>
+#include <linux/net.h>
+#include <linux/radix-tree.h>
+#include <linux/uio.h>
+#include <linux/version.h>
+#include <linux/workqueue.h>
+
+#include "types.h"
+#include "buffer.h"
+
+struct ceph_msg;
+struct ceph_connection;
+
+extern struct workqueue_struct *ceph_msgr_wq;       /* receive work queue */
+
+/*
+ * Ceph defines these callbacks for handling connection events.
+ */
+struct ceph_connection_operations {
+        struct ceph_connection *(*get)(struct ceph_connection *);
+        void (*put)(struct ceph_connection *);
+
+        /* handle an incoming message. */
+        void (*dispatch) (struct ceph_connection *con, struct ceph_msg *m);
+
+        /* authorize an outgoing connection */
+        int (*get_authorizer) (struct ceph_connection *con,
+                               void **buf, int *len, int *proto,
+                               void **reply_buf, int *reply_len, int force_new);
+        int (*verify_authorizer_reply) (struct ceph_connection *con, int len);
+        int (*invalidate_authorizer)(struct ceph_connection *con);
+
+        /* protocol version mismatch */
+        void (*bad_proto) (struct ceph_connection *con);
+
+        /* there was some error on the socket (disconnect, whatever) */
+        void (*fault) (struct ceph_connection *con);
+
+        /* a remote host as terminated a message exchange session, and messages
+         * we sent (or they tried to send us) may be lost. */
+        void (*peer_reset) (struct ceph_connection *con);
+
+        struct ceph_msg * (*alloc_msg) (struct ceph_connection *con,
+                                        struct ceph_msg_header *hdr,
+                                        int *skip);
+};
+
+extern const char *ceph_name_type_str(int t);
+
+/* use format string %s%d */
+#define ENTITY_NAME(n) ceph_name_type_str((n).type), le64_to_cpu((n).num)
+
+struct ceph_messenger {
+        struct ceph_entity_inst inst;    /* my name+address */
+        struct ceph_entity_addr my_enc_addr;
+        struct page *zero_page;          /* used in certain error cases */
+
+        bool nocrc;
+
+        /*
+         * the global_seq counts connections i (attempt to) initiate
+         * in order to disambiguate certain connect race conditions.
+         */
+        u32 global_seq;
+        spinlock_t global_seq_lock;
+};
+
+/*
+ * a single message.  it contains a header (src, dest, message type, etc.),
+ * footer (crc values, mainly), a "front" message body, and possibly a
+ * data payload (stored in some number of pages).
+ */
+struct ceph_msg {
+        struct ceph_msg_header hdr;     /* header */
+        struct ceph_msg_footer footer;  /* footer */
+        struct kvec front;              /* unaligned blobs of message */
+        struct ceph_buffer *middle;
+        struct page **pages;            /* data payload.  NOT OWNER. */
+        unsigned nr_pages;              /* size of page array */
+        struct ceph_pagelist *pagelist; /* instead of pages */
+        struct list_head list_head;
+        struct kref kref;
+        bool front_is_vmalloc;
+        bool more_to_follow;
+        int front_max;
+
+        struct ceph_msgpool *pool;
+};
+
+struct ceph_msg_pos {
+        int page, page_pos;  /* which page; offset in page */
+        int data_pos;        /* offset in data payload */
+        int did_page_crc;    /* true if we've calculated crc for current page */
+};
+
+/* ceph connection fault delay defaults, for exponential backoff */
+#define BASE_DELAY_INTERVAL     (HZ/2)
+#define MAX_DELAY_INTERVAL      (5 * 60 * HZ)
+
+/*
+ * ceph_connection state bit flags
+ *
+ * QUEUED and BUSY are used together to ensure that only a single
+ * thread is currently opening, reading or writing data to the socket.
+ */
+#define LOSSYTX         0  /* we can close channel or drop messages on errors */
+#define CONNECTING      1
+#define NEGOTIATING     2
+#define KEEPALIVE_PENDING      3
+#define WRITE_PENDING   4  /* we have data ready to send */
+#define QUEUED          5  /* there is work queued on this connection */
+#define BUSY            6  /* work is being done */
+#define STANDBY         8  /* no outgoing messages, socket closed.  we keep
+                            * the ceph_connection around to maintain shared
+                            * state with the peer. */
+#define CLOSED          10 /* we've closed the connection */
+#define SOCK_CLOSED     11 /* socket state changed to closed */
+#define OPENING         13 /* open connection w/ (possibly new) peer */
+#define DEAD            14 /* dead, about to kfree */
+
+/*
+ * A single connection with another host.
+ *
+ * We maintain a queue of outgoing messages, and some session state to
+ * ensure that we can preserve the lossless, ordered delivery of
+ * messages in the case of a TCP disconnect.
+ */
+struct ceph_connection {
+        void *private;
+        atomic_t nref;
+
+        const struct ceph_connection_operations *ops;
+
+        struct ceph_messenger *msgr;
+        struct socket *sock;
+        unsigned long state;    /* connection state (see flags above) */
+        const char *error_msg;  /* error message, if any */
+
+        struct ceph_entity_addr peer_addr; /* peer address */
+        struct ceph_entity_name peer_name; /* peer name */
+        struct ceph_entity_addr peer_addr_for_me;
+        u32 connect_seq;      /* identify the most recent connection
+                                 attempt for this connection, client */
+        u32 peer_global_seq;  /* peer's global seq for this connection */
+
+        int auth_retry;       /* true if we need a newer authorizer */
+        void *auth_reply_buf;   /* where to put the authorizer reply */
+        int auth_reply_buf_len;
+
+        struct mutex mutex;
+
+        /* out queue */
+        struct list_head out_queue;
+        struct list_head out_sent;   /* sending or sent but unacked */
+        u64 out_seq;                 /* last message queued for send */
+        u64 out_seq_sent;            /* last message sent */
+        bool out_keepalive_pending;
+
+        u64 in_seq, in_seq_acked;  /* last message received, acked */
+
+        /* connection negotiation temps */
+        char in_banner[CEPH_BANNER_MAX_LEN];
+        union {
+                struct {  /* outgoing connection */
+                        struct ceph_msg_connect out_connect;
+                        struct ceph_msg_connect_reply in_reply;
+                };
+                struct {  /* incoming */
+                        struct ceph_msg_connect in_connect;
+                        struct ceph_msg_connect_reply out_reply;
+                };
+        };
+        struct ceph_entity_addr actual_peer_addr;
+
+        /* message out temps */
+        struct ceph_msg *out_msg;        /* sending message (== tail of
+                                            out_sent) */
+        bool out_msg_done;
+        struct ceph_msg_pos out_msg_pos;
+
+        struct kvec out_kvec[8],         /* sending header/footer data */
+                *out_kvec_cur;
+        int out_kvec_left;   /* kvec's left in out_kvec */
+        int out_skip;        /* skip this many bytes */
+        int out_kvec_bytes;  /* total bytes left */
+        bool out_kvec_is_msg; /* kvec refers to out_msg */
+        int out_more;        /* there is more data after the kvecs */
+        __le64 out_temp_ack; /* for writing an ack */
+
+        /* message in temps */
+        struct ceph_msg_header in_hdr;
+        struct ceph_msg *in_msg;
+        struct ceph_msg_pos in_msg_pos;
+        u32 in_front_crc, in_middle_crc, in_data_crc;  /* calculated crc */
+
+        char in_tag;         /* protocol control byte */
+        int in_base_pos;     /* bytes read */
+        __le64 in_temp_ack;  /* for reading an ack */
+
+        struct delayed_work work;           /* send|recv work */
+        unsigned long       delay;          /* current delay interval */
+};
+
+
+extern const char *pr_addr(const struct sockaddr_storage *ss);
+extern int ceph_parse_ips(const char *c, const char *end,
+                          struct ceph_entity_addr *addr,
+                          int max_count, int *count);
+
+
+extern int ceph_msgr_init(void);
+extern void ceph_msgr_exit(void);
+
+extern struct ceph_messenger *ceph_messenger_create(
+        struct ceph_entity_addr *myaddr);
+extern void ceph_messenger_destroy(struct ceph_messenger *);
+
+extern void ceph_con_init(struct ceph_messenger *msgr,
+                          struct ceph_connection *con);
+extern void ceph_con_open(struct ceph_connection *con,
+                          struct ceph_entity_addr *addr);
+extern bool ceph_con_opened(struct ceph_connection *con);
+extern void ceph_con_close(struct ceph_connection *con);
+extern void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg);
+extern void ceph_con_revoke(struct ceph_connection *con, struct ceph_msg *msg);
+extern void ceph_con_revoke_message(struct ceph_connection *con,
+                                  struct ceph_msg *msg);
+extern void ceph_con_keepalive(struct ceph_connection *con);
+extern struct ceph_connection *ceph_con_get(struct ceph_connection *con);
+extern void ceph_con_put(struct ceph_connection *con);
+
+extern struct ceph_msg *ceph_msg_new(int type, int front_len,
+                                     int page_len, int page_off,
+                                     struct page **pages);
+extern void ceph_msg_kfree(struct ceph_msg *m);
+
+
+static inline struct ceph_msg *ceph_msg_get(struct ceph_msg *msg)
+{
+        kref_get(&msg->kref);
+        return msg;
+}
+extern void ceph_msg_last_put(struct kref *kref);
+static inline void ceph_msg_put(struct ceph_msg *msg)
+{
+        kref_put(&msg->kref, ceph_msg_last_put);
+}
+
+extern void ceph_msg_dump(struct ceph_msg *msg);
+
+#endif
diff --git a/fs/ceph/mon_client.c b/fs/ceph/mon_client.c
new file mode 100644
index 000000000000..8fdc011ca956
--- /dev/null
+++ b/fs/ceph/mon_client.c
@@ -0,0 +1,835 @@
+#include "ceph_debug.h"
+
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/sched.h>
+
+#include "mon_client.h"
+#include "super.h"
+#include "auth.h"
+#include "decode.h"
+
+/*
+ * Interact with Ceph monitor cluster.  Handle requests for new map
+ * versions, and periodically resend as needed.  Also implement
+ * statfs() and umount().
+ *
+ * A small cluster of Ceph "monitors" are responsible for managing critical
+ * cluster configuration and state information.  An odd number (e.g., 3, 5)
+ * of cmon daemons use a modified version of the Paxos part-time parliament
+ * algorithm to manage the MDS map (mds cluster membership), OSD map, and
+ * list of clients who have mounted the file system.
+ *
+ * We maintain an open, active session with a monitor at all times in order to
+ * receive timely MDSMap updates.  We periodically send a keepalive byte on the
+ * TCP socket to ensure we detect a failure.  If the connection does break, we
+ * randomly hunt for a new monitor.  Once the connection is reestablished, we
+ * resend any outstanding requests.
+ */
+
+const static struct ceph_connection_operations mon_con_ops;
+
+static int __validate_auth(struct ceph_mon_client *monc);
+
+/*
+ * Decode a monmap blob (e.g., during mount).
+ */
+struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
+{
+        struct ceph_monmap *m = NULL;
+        int i, err = -EINVAL;
+        struct ceph_fsid fsid;
+        u32 epoch, num_mon;
+        u16 version;
+        u32 len;
+
+        ceph_decode_32_safe(&p, end, len, bad);
+        ceph_decode_need(&p, end, len, bad);
+
+        dout("monmap_decode %p %p len %d\n", p, end, (int)(end-p));
+
+        ceph_decode_16_safe(&p, end, version, bad);
+
+        ceph_decode_need(&p, end, sizeof(fsid) + 2*sizeof(u32), bad);
+        ceph_decode_copy(&p, &fsid, sizeof(fsid));
+        epoch = ceph_decode_32(&p);
+
+        num_mon = ceph_decode_32(&p);
+        ceph_decode_need(&p, end, num_mon*sizeof(m->mon_inst[0]), bad);
+
+        if (num_mon >= CEPH_MAX_MON)
+                goto bad;
+        m = kmalloc(sizeof(*m) + sizeof(m->mon_inst[0])*num_mon, GFP_NOFS);
+        if (m == NULL)
+                return ERR_PTR(-ENOMEM);
+        m->fsid = fsid;
+        m->epoch = epoch;
+        m->num_mon = num_mon;
+        ceph_decode_copy(&p, m->mon_inst, num_mon*sizeof(m->mon_inst[0]));
+        for (i = 0; i < num_mon; i++)
+                ceph_decode_addr(&m->mon_inst[i].addr);
+
+        dout("monmap_decode epoch %d, num_mon %d\n", m->epoch,
+             m->num_mon);
+        for (i = 0; i < m->num_mon; i++)
+                dout("monmap_decode  mon%d is %s\n", i,
+                     pr_addr(&m->mon_inst[i].addr.in_addr));
+        return m;
+
+bad:
+        dout("monmap_decode failed with %d\n", err);
+        kfree(m);
+        return ERR_PTR(err);
+}
+
+/*
+ * return true if *addr is included in the monmap.
+ */
+int ceph_monmap_contains(struct ceph_monmap *m, struct ceph_entity_addr *addr)
+{
+        int i;
+
+        for (i = 0; i < m->num_mon; i++)
+                if (memcmp(addr, &m->mon_inst[i].addr, sizeof(*addr)) == 0)
+                        return 1;
+        return 0;
+}
+
+/*
+ * Send an auth request.
+ */
+static void __send_prepared_auth_request(struct ceph_mon_client *monc, int len)
+{
+        monc->pending_auth = 1;
+        monc->m_auth->front.iov_len = len;
+        monc->m_auth->hdr.front_len = cpu_to_le32(len);
+        ceph_msg_get(monc->m_auth);  /* keep our ref */
+        ceph_con_send(monc->con, monc->m_auth);
+}
+
+/*
+ * Close monitor session, if any.
+ */
+static void __close_session(struct ceph_mon_client *monc)
+{
+        if (monc->con) {
+                dout("__close_session closing mon%d\n", monc->cur_mon);
+                ceph_con_revoke(monc->con, monc->m_auth);
+                ceph_con_close(monc->con);
+                monc->cur_mon = -1;
+                monc->pending_auth = 0;
+                ceph_auth_reset(monc->auth);
+        }
+}
+
+/*
+ * Open a session with a (new) monitor.
+ */
+static int __open_session(struct ceph_mon_client *monc)
+{
+        char r;
+        int ret;
+
+        if (monc->cur_mon < 0) {
+                get_random_bytes(&r, 1);
+                monc->cur_mon = r % monc->monmap->num_mon;
+                dout("open_session num=%d r=%d -> mon%d\n",
+                     monc->monmap->num_mon, r, monc->cur_mon);
+                monc->sub_sent = 0;
+                monc->sub_renew_after = jiffies;  /* i.e., expired */
+                monc->want_next_osdmap = !!monc->want_next_osdmap;
+
+                dout("open_session mon%d opening\n", monc->cur_mon);
+                monc->con->peer_name.type = CEPH_ENTITY_TYPE_MON;
+                monc->con->peer_name.num = cpu_to_le64(monc->cur_mon);
+                ceph_con_open(monc->con,
+                              &monc->monmap->mon_inst[monc->cur_mon].addr);
+
+                /* initiatiate authentication handshake */
+                ret = ceph_auth_build_hello(monc->auth,
+                                            monc->m_auth->front.iov_base,
+                                            monc->m_auth->front_max);
+                __send_prepared_auth_request(monc, ret);
+        } else {
+                dout("open_session mon%d already open\n", monc->cur_mon);
+        }
+        return 0;
+}
+
+static bool __sub_expired(struct ceph_mon_client *monc)
+{
+        return time_after_eq(jiffies, monc->sub_renew_after);
+}
+
+/*
+ * Reschedule delayed work timer.
+ */
+static void __schedule_delayed(struct ceph_mon_client *monc)
+{
+        unsigned delay;
+
+        if (monc->cur_mon < 0 || __sub_expired(monc))
+                delay = 10 * HZ;
+        else
+                delay = 20 * HZ;
+        dout("__schedule_delayed after %u\n", delay);
+        schedule_delayed_work(&monc->delayed_work, delay);
+}
+
+/*
+ * Send subscribe request for mdsmap and/or osdmap.
+ */
+static void __send_subscribe(struct ceph_mon_client *monc)
+{
+        dout("__send_subscribe sub_sent=%u exp=%u want_osd=%d\n",
+             (unsigned)monc->sub_sent, __sub_expired(monc),
+             monc->want_next_osdmap);
+        if ((__sub_expired(monc) && !monc->sub_sent) ||
+            monc->want_next_osdmap == 1) {
+                struct ceph_msg *msg;
+                struct ceph_mon_subscribe_item *i;
+                void *p, *end;
+
+                msg = ceph_msg_new(CEPH_MSG_MON_SUBSCRIBE, 96, 0, 0, NULL);
+                if (!msg)
+                        return;
+
+                p = msg->front.iov_base;
+                end = p + msg->front.iov_len;
+
+                dout("__send_subscribe to 'mdsmap' %u+\n",
+                     (unsigned)monc->have_mdsmap);
+                if (monc->want_next_osdmap) {
+                        dout("__send_subscribe to 'osdmap' %u\n",
+                             (unsigned)monc->have_osdmap);
+                        ceph_encode_32(&p, 3);
+                        ceph_encode_string(&p, end, "osdmap", 6);
+                        i = p;
+                        i->have = cpu_to_le64(monc->have_osdmap);
+                        i->onetime = 1;
+                        p += sizeof(*i);
+                        monc->want_next_osdmap = 2;  /* requested */
+                } else {
+                        ceph_encode_32(&p, 2);
+                }
+                ceph_encode_string(&p, end, "mdsmap", 6);
+                i = p;
+                i->have = cpu_to_le64(monc->have_mdsmap);
+                i->onetime = 0;
+                p += sizeof(*i);
+                ceph_encode_string(&p, end, "monmap", 6);
+                i = p;
+                i->have = 0;
+                i->onetime = 0;
+                p += sizeof(*i);
+
+                msg->front.iov_len = p - msg->front.iov_base;
+                msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
+                ceph_con_send(monc->con, msg);
+
+                monc->sub_sent = jiffies | 1;  /* never 0 */
+        }
+}
+
+static void handle_subscribe_ack(struct ceph_mon_client *monc,
+                                 struct ceph_msg *msg)
+{
+        unsigned seconds;
+        struct ceph_mon_subscribe_ack *h = msg->front.iov_base;
+
+        if (msg->front.iov_len < sizeof(*h))
+                goto bad;
+        seconds = le32_to_cpu(h->duration);
+
+        mutex_lock(&monc->mutex);
+        if (monc->hunting) {
+                pr_info("mon%d %s session established\n",
+                        monc->cur_mon, pr_addr(&monc->con->peer_addr.in_addr));
+                monc->hunting = false;
+        }
+        dout("handle_subscribe_ack after %d seconds\n", seconds);
+        monc->sub_renew_after = monc->sub_sent + (seconds >> 1)*HZ - 1;
+        monc->sub_sent = 0;
+        mutex_unlock(&monc->mutex);
+        return;
+bad:
+        pr_err("got corrupt subscribe-ack msg\n");
+        ceph_msg_dump(msg);
+}
+
+/*
+ * Keep track of which maps we have
+ */
+int ceph_monc_got_mdsmap(struct ceph_mon_client *monc, u32 got)
+{
+        mutex_lock(&monc->mutex);
+        monc->have_mdsmap = got;
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+
+int ceph_monc_got_osdmap(struct ceph_mon_client *monc, u32 got)
+{
+        mutex_lock(&monc->mutex);
+        monc->have_osdmap = got;
+        monc->want_next_osdmap = 0;
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+
+/*
+ * Register interest in the next osdmap
+ */
+void ceph_monc_request_next_osdmap(struct ceph_mon_client *monc)
+{
+        dout("request_next_osdmap have %u\n", monc->have_osdmap);
+        mutex_lock(&monc->mutex);
+        if (!monc->want_next_osdmap)
+                monc->want_next_osdmap = 1;
+        if (monc->want_next_osdmap < 2)
+                __send_subscribe(monc);
+        mutex_unlock(&monc->mutex);
+}
+
+/*
+ *
+ */
+int ceph_monc_open_session(struct ceph_mon_client *monc)
+{
+        if (!monc->con) {
+                monc->con = kmalloc(sizeof(*monc->con), GFP_KERNEL);
+                if (!monc->con)
+                        return -ENOMEM;
+                ceph_con_init(monc->client->msgr, monc->con);
+                monc->con->private = monc;
+                monc->con->ops = &mon_con_ops;
+        }
+
+        mutex_lock(&monc->mutex);
+        __open_session(monc);
+        __schedule_delayed(monc);
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+
+/*
+ * The monitor responds with mount ack indicate mount success.  The
+ * included client ticket allows the client to talk to MDSs and OSDs.
+ */
+static void ceph_monc_handle_map(struct ceph_mon_client *monc,
+                                 struct ceph_msg *msg)
+{
+        struct ceph_client *client = monc->client;
+        struct ceph_monmap *monmap = NULL, *old = monc->monmap;
+        void *p, *end;
+
+        mutex_lock(&monc->mutex);
+
+        dout("handle_monmap\n");
+        p = msg->front.iov_base;
+        end = p + msg->front.iov_len;
+
+        monmap = ceph_monmap_decode(p, end);
+        if (IS_ERR(monmap)) {
+                pr_err("problem decoding monmap, %d\n",
+                       (int)PTR_ERR(monmap));
+                goto out;
+        }
+
+        if (ceph_check_fsid(monc->client, &monmap->fsid) < 0) {
+                kfree(monmap);
+                goto out;
+        }
+
+        client->monc.monmap = monmap;
+        kfree(old);
+
+out:
+        mutex_unlock(&monc->mutex);
+        wake_up(&client->auth_wq);
+}
+
+/*
+ * statfs
+ */
+static struct ceph_mon_statfs_request *__lookup_statfs(
+        struct ceph_mon_client *monc, u64 tid)
+{
+        struct ceph_mon_statfs_request *req;
+        struct rb_node *n = monc->statfs_request_tree.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_mon_statfs_request, node);
+                if (tid < req->tid)
+                        n = n->rb_left;
+                else if (tid > req->tid)
+                        n = n->rb_right;
+                else
+                        return req;
+        }
+        return NULL;
+}
+
+static void __insert_statfs(struct ceph_mon_client *monc,
+                            struct ceph_mon_statfs_request *new)
+{
+        struct rb_node **p = &monc->statfs_request_tree.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_mon_statfs_request *req = NULL;
+
+        while (*p) {
+                parent = *p;
+                req = rb_entry(parent, struct ceph_mon_statfs_request, node);
+                if (new->tid < req->tid)
+                        p = &(*p)->rb_left;
+                else if (new->tid > req->tid)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, &monc->statfs_request_tree);
+}
+
+static void handle_statfs_reply(struct ceph_mon_client *monc,
+                                struct ceph_msg *msg)
+{
+        struct ceph_mon_statfs_request *req;
+        struct ceph_mon_statfs_reply *reply = msg->front.iov_base;
+        u64 tid;
+
+        if (msg->front.iov_len != sizeof(*reply))
+                goto bad;
+        tid = le64_to_cpu(msg->hdr.tid);
+        dout("handle_statfs_reply %p tid %llu\n", msg, tid);
+
+        mutex_lock(&monc->mutex);
+        req = __lookup_statfs(monc, tid);
+        if (req) {
+                *req->buf = reply->st;
+                req->result = 0;
+        }
+        mutex_unlock(&monc->mutex);
+        if (req)
+                complete(&req->completion);
+        return;
+
+bad:
+        pr_err("corrupt statfs reply, no tid\n");
+        ceph_msg_dump(msg);
+}
+
+/*
+ * (re)send a statfs request
+ */
+static int send_statfs(struct ceph_mon_client *monc,
+                       struct ceph_mon_statfs_request *req)
+{
+        struct ceph_msg *msg;
+        struct ceph_mon_statfs *h;
+
+        dout("send_statfs tid %llu\n", req->tid);
+        msg = ceph_msg_new(CEPH_MSG_STATFS, sizeof(*h), 0, 0, NULL);
+        if (IS_ERR(msg))
+                return PTR_ERR(msg);
+        req->request = msg;
+        msg->hdr.tid = cpu_to_le64(req->tid);
+        h = msg->front.iov_base;
+        h->monhdr.have_version = 0;
+        h->monhdr.session_mon = cpu_to_le16(-1);
+        h->monhdr.session_mon_tid = 0;
+        h->fsid = monc->monmap->fsid;
+        ceph_con_send(monc->con, msg);
+        return 0;
+}
+
+/*
+ * Do a synchronous statfs().
+ */
+int ceph_monc_do_statfs(struct ceph_mon_client *monc, struct ceph_statfs *buf)
+{
+        struct ceph_mon_statfs_request req;
+        int err;
+
+        req.buf = buf;
+        init_completion(&req.completion);
+
+        /* allocate memory for reply */
+        err = ceph_msgpool_resv(&monc->msgpool_statfs_reply, 1);
+        if (err)
+                return err;
+
+        /* register request */
+        mutex_lock(&monc->mutex);
+        req.tid = ++monc->last_tid;
+        req.last_attempt = jiffies;
+        req.delay = BASE_DELAY_INTERVAL;
+        __insert_statfs(monc, &req);
+        monc->num_statfs_requests++;
+        mutex_unlock(&monc->mutex);
+
+        /* send request and wait */
+        err = send_statfs(monc, &req);
+        if (!err)
+                err = wait_for_completion_interruptible(&req.completion);
+
+        mutex_lock(&monc->mutex);
+        rb_erase(&req.node, &monc->statfs_request_tree);
+        monc->num_statfs_requests--;
+        ceph_msgpool_resv(&monc->msgpool_statfs_reply, -1);
+        mutex_unlock(&monc->mutex);
+
+        if (!err)
+                err = req.result;
+        return err;
+}
+
+/*
+ * Resend pending statfs requests.
+ */
+static void __resend_statfs(struct ceph_mon_client *monc)
+{
+        struct ceph_mon_statfs_request *req;
+        struct rb_node *p;
+
+        for (p = rb_first(&monc->statfs_request_tree); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_mon_statfs_request, node);
+                send_statfs(monc, req);
+        }
+}
+
+/*
+ * Delayed work.  If we haven't mounted yet, retry.  Otherwise,
+ * renew/retry subscription as needed (in case it is timing out, or we
+ * got an ENOMEM).  And keep the monitor connection alive.
+ */
+static void delayed_work(struct work_struct *work)
+{
+        struct ceph_mon_client *monc =
+                container_of(work, struct ceph_mon_client, delayed_work.work);
+
+        dout("monc delayed_work\n");
+        mutex_lock(&monc->mutex);
+        if (monc->hunting) {
+                __close_session(monc);
+                __open_session(monc);  /* continue hunting */
+        } else {
+                ceph_con_keepalive(monc->con);
+
+                __validate_auth(monc);
+
+                if (monc->auth->ops->is_authenticated(monc->auth))
+                        __send_subscribe(monc);
+        }
+        __schedule_delayed(monc);
+        mutex_unlock(&monc->mutex);
+}
+
+/*
+ * On startup, we build a temporary monmap populated with the IPs
+ * provided by mount(2).
+ */
+static int build_initial_monmap(struct ceph_mon_client *monc)
+{
+        struct ceph_mount_args *args = monc->client->mount_args;
+        struct ceph_entity_addr *mon_addr = args->mon_addr;
+        int num_mon = args->num_mon;
+        int i;
+
+        /* build initial monmap */
+        monc->monmap = kzalloc(sizeof(*monc->monmap) +
+                               num_mon*sizeof(monc->monmap->mon_inst[0]),
+                               GFP_KERNEL);
+        if (!monc->monmap)
+                return -ENOMEM;
+        for (i = 0; i < num_mon; i++) {
+                monc->monmap->mon_inst[i].addr = mon_addr[i];
+                monc->monmap->mon_inst[i].addr.nonce = 0;
+                monc->monmap->mon_inst[i].name.type =
+                        CEPH_ENTITY_TYPE_MON;
+                monc->monmap->mon_inst[i].name.num = cpu_to_le64(i);
+        }
+        monc->monmap->num_mon = num_mon;
+        monc->have_fsid = false;
+
+        /* release addr memory */
+        kfree(args->mon_addr);
+        args->mon_addr = NULL;
+        args->num_mon = 0;
+        return 0;
+}
+
+int ceph_monc_init(struct ceph_mon_client *monc, struct ceph_client *cl)
+{
+        int err = 0;
+
+        dout("init\n");
+        memset(monc, 0, sizeof(*monc));
+        monc->client = cl;
+        monc->monmap = NULL;
+        mutex_init(&monc->mutex);
+
+        err = build_initial_monmap(monc);
+        if (err)
+                goto out;
+
+        monc->con = NULL;
+
+        /* authentication */
+        monc->auth = ceph_auth_init(cl->mount_args->name,
+                                    cl->mount_args->secret);
+        if (IS_ERR(monc->auth))
+                return PTR_ERR(monc->auth);
+        monc->auth->want_keys =
+                CEPH_ENTITY_TYPE_AUTH | CEPH_ENTITY_TYPE_MON |
+                CEPH_ENTITY_TYPE_OSD | CEPH_ENTITY_TYPE_MDS;
+
+        /* msg pools */
+        err = ceph_msgpool_init(&monc->msgpool_subscribe_ack,
+                               sizeof(struct ceph_mon_subscribe_ack), 1, false);
+        if (err < 0)
+                goto out_monmap;
+        err = ceph_msgpool_init(&monc->msgpool_statfs_reply,
+                                sizeof(struct ceph_mon_statfs_reply), 0, false);
+        if (err < 0)
+                goto out_pool1;
+        err = ceph_msgpool_init(&monc->msgpool_auth_reply, 4096, 1, false);
+        if (err < 0)
+                goto out_pool2;
+
+        monc->m_auth = ceph_msg_new(CEPH_MSG_AUTH, 4096, 0, 0, NULL);
+        monc->pending_auth = 0;
+        if (IS_ERR(monc->m_auth)) {
+                err = PTR_ERR(monc->m_auth);
+                monc->m_auth = NULL;
+                goto out_pool3;
+        }
+
+        monc->cur_mon = -1;
+        monc->hunting = true;
+        monc->sub_renew_after = jiffies;
+        monc->sub_sent = 0;
+
+        INIT_DELAYED_WORK(&monc->delayed_work, delayed_work);
+        monc->statfs_request_tree = RB_ROOT;
+        monc->num_statfs_requests = 0;
+        monc->last_tid = 0;
+
+        monc->have_mdsmap = 0;
+        monc->have_osdmap = 0;
+        monc->want_next_osdmap = 1;
+        return 0;
+
+out_pool3:
+        ceph_msgpool_destroy(&monc->msgpool_auth_reply);
+out_pool2:
+        ceph_msgpool_destroy(&monc->msgpool_subscribe_ack);
+out_pool1:
+        ceph_msgpool_destroy(&monc->msgpool_statfs_reply);
+out_monmap:
+        kfree(monc->monmap);
+out:
+        return err;
+}
+
+void ceph_monc_stop(struct ceph_mon_client *monc)
+{
+        dout("stop\n");
+        cancel_delayed_work_sync(&monc->delayed_work);
+
+        mutex_lock(&monc->mutex);
+        __close_session(monc);
+        if (monc->con) {
+                monc->con->private = NULL;
+                monc->con->ops->put(monc->con);
+                monc->con = NULL;
+        }
+        mutex_unlock(&monc->mutex);
+
+        ceph_auth_destroy(monc->auth);
+
+        ceph_msg_put(monc->m_auth);
+        ceph_msgpool_destroy(&monc->msgpool_subscribe_ack);
+        ceph_msgpool_destroy(&monc->msgpool_statfs_reply);
+        ceph_msgpool_destroy(&monc->msgpool_auth_reply);
+
+        kfree(monc->monmap);
+}
+
+static void handle_auth_reply(struct ceph_mon_client *monc,
+                              struct ceph_msg *msg)
+{
+        int ret;
+
+        mutex_lock(&monc->mutex);
+        monc->pending_auth = 0;
+        ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base,
+                                     msg->front.iov_len,
+                                     monc->m_auth->front.iov_base,
+                                     monc->m_auth->front_max);
+        if (ret < 0) {
+                monc->client->auth_err = ret;
+                wake_up(&monc->client->auth_wq);
+        } else if (ret > 0) {
+                __send_prepared_auth_request(monc, ret);
+        } else if (monc->auth->ops->is_authenticated(monc->auth)) {
+                dout("authenticated, starting session\n");
+
+                monc->client->msgr->inst.name.type = CEPH_ENTITY_TYPE_CLIENT;
+                monc->client->msgr->inst.name.num = monc->auth->global_id;
+
+                __send_subscribe(monc);
+                __resend_statfs(monc);
+        }
+        mutex_unlock(&monc->mutex);
+}
+
+static int __validate_auth(struct ceph_mon_client *monc)
+{
+        int ret;
+
+        if (monc->pending_auth)
+                return 0;
+
+        ret = ceph_build_auth(monc->auth, monc->m_auth->front.iov_base,
+                              monc->m_auth->front_max);
+        if (ret <= 0)
+                return ret; /* either an error, or no need to authenticate */
+        __send_prepared_auth_request(monc, ret);
+        return 0;
+}
+
+int ceph_monc_validate_auth(struct ceph_mon_client *monc)
+{
+        int ret;
+
+        mutex_lock(&monc->mutex);
+        ret = __validate_auth(monc);
+        mutex_unlock(&monc->mutex);
+        return ret;
+}
+
+/*
+ * handle incoming message
+ */
+static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        struct ceph_mon_client *monc = con->private;
+        int type = le16_to_cpu(msg->hdr.type);
+
+        if (!monc)
+                return;
+
+        switch (type) {
+        case CEPH_MSG_AUTH_REPLY:
+                handle_auth_reply(monc, msg);
+                break;
+
+        case CEPH_MSG_MON_SUBSCRIBE_ACK:
+                handle_subscribe_ack(monc, msg);
+                break;
+
+        case CEPH_MSG_STATFS_REPLY:
+                handle_statfs_reply(monc, msg);
+                break;
+
+        case CEPH_MSG_MON_MAP:
+                ceph_monc_handle_map(monc, msg);
+                break;
+
+        case CEPH_MSG_MDS_MAP:
+                ceph_mdsc_handle_map(&monc->client->mdsc, msg);
+                break;
+
+        case CEPH_MSG_OSD_MAP:
+                ceph_osdc_handle_map(&monc->client->osdc, msg);
+                break;
+
+        default:
+                pr_err("received unknown message type %d %s\n", type,
+                       ceph_msg_type_name(type));
+        }
+        ceph_msg_put(msg);
+}
+
+/*
+ * Allocate memory for incoming message
+ */
+static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
+                                      struct ceph_msg_header *hdr,
+                                      int *skip)
+{
+        struct ceph_mon_client *monc = con->private;
+        int type = le16_to_cpu(hdr->type);
+        int front_len = le32_to_cpu(hdr->front_len);
+        struct ceph_msg *m = NULL;
+
+        *skip = 0;
+
+        switch (type) {
+        case CEPH_MSG_MON_SUBSCRIBE_ACK:
+                m = ceph_msgpool_get(&monc->msgpool_subscribe_ack, front_len);
+                break;
+        case CEPH_MSG_STATFS_REPLY:
+                m = ceph_msgpool_get(&monc->msgpool_statfs_reply, front_len);
+                break;
+        case CEPH_MSG_AUTH_REPLY:
+                m = ceph_msgpool_get(&monc->msgpool_auth_reply, front_len);
+                break;
+        case CEPH_MSG_MON_MAP:
+        case CEPH_MSG_MDS_MAP:
+        case CEPH_MSG_OSD_MAP:
+                m = ceph_msg_new(type, front_len, 0, 0, NULL);
+                break;
+        }
+
+        if (!m) {
+                pr_info("alloc_msg unknown type %d\n", type);
+                *skip = 1;
+        }
+        return m;
+}
+
+/*
+ * If the monitor connection resets, pick a new monitor and resubmit
+ * any pending requests.
+ */
+static void mon_fault(struct ceph_connection *con)
+{
+        struct ceph_mon_client *monc = con->private;
+
+        if (!monc)
+                return;
+
+        dout("mon_fault\n");
+        mutex_lock(&monc->mutex);
+        if (!con->private)
+                goto out;
+
+        if (monc->con && !monc->hunting)
+                pr_info("mon%d %s session lost, "
+                        "hunting for new mon\n", monc->cur_mon,
+                        pr_addr(&monc->con->peer_addr.in_addr));
+
+        __close_session(monc);
+        if (!monc->hunting) {
+                /* start hunting */
+                monc->hunting = true;
+                __open_session(monc);
+        } else {
+                /* already hunting, let's wait a bit */
+                __schedule_delayed(monc);
+        }
+out:
+        mutex_unlock(&monc->mutex);
+}
+
+const static struct ceph_connection_operations mon_con_ops = {
+        .get = ceph_con_get,
+        .put = ceph_con_put,
+        .dispatch = dispatch,
+        .fault = mon_fault,
+        .alloc_msg = mon_alloc_msg,
+};
diff --git a/fs/ceph/mon_client.h b/fs/ceph/mon_client.h
new file mode 100644
index 000000000000..b958ad5afa06
--- /dev/null
+++ b/fs/ceph/mon_client.h
@@ -0,0 +1,119 @@
+#ifndef _FS_CEPH_MON_CLIENT_H
+#define _FS_CEPH_MON_CLIENT_H
+
+#include <linux/completion.h>
+#include <linux/rbtree.h>
+
+#include "messenger.h"
+#include "msgpool.h"
+
+struct ceph_client;
+struct ceph_mount_args;
+struct ceph_auth_client;
+
+/*
+ * The monitor map enumerates the set of all monitors.
+ */
+struct ceph_monmap {
+        struct ceph_fsid fsid;
+        u32 epoch;
+        u32 num_mon;
+        struct ceph_entity_inst mon_inst[0];
+};
+
+struct ceph_mon_client;
+struct ceph_mon_statfs_request;
+
+
+/*
+ * Generic mechanism for resending monitor requests.
+ */
+typedef void (*ceph_monc_request_func_t)(struct ceph_mon_client *monc,
+                                         int newmon);
+
+/* a pending monitor request */
+struct ceph_mon_request {
+        struct ceph_mon_client *monc;
+        struct delayed_work delayed_work;
+        unsigned long delay;
+        ceph_monc_request_func_t do_request;
+};
+
+/*
+ * statfs() is done a bit differently because we need to get data back
+ * to the caller
+ */
+struct ceph_mon_statfs_request {
+        u64 tid;
+        struct rb_node node;
+        int result;
+        struct ceph_statfs *buf;
+        struct completion completion;
+        unsigned long last_attempt, delay; /* jiffies */
+        struct ceph_msg *request;  /* original request */
+};
+
+struct ceph_mon_client {
+        struct ceph_client *client;
+        struct ceph_monmap *monmap;
+
+        struct mutex mutex;
+        struct delayed_work delayed_work;
+
+        struct ceph_auth_client *auth;
+        struct ceph_msg *m_auth;
+        int pending_auth;
+
+        bool hunting;
+        int cur_mon;                       /* last monitor i contacted */
+        unsigned long sub_sent, sub_renew_after;
+        struct ceph_connection *con;
+        bool have_fsid;
+
+        /* msg pools */
+        struct ceph_msgpool msgpool_subscribe_ack;
+        struct ceph_msgpool msgpool_statfs_reply;
+        struct ceph_msgpool msgpool_auth_reply;
+
+        /* pending statfs requests */
+        struct rb_root statfs_request_tree;
+        int num_statfs_requests;
+        u64 last_tid;
+
+        /* mds/osd map */
+        int want_next_osdmap; /* 1 = want, 2 = want+asked */
+        u32 have_osdmap, have_mdsmap;
+
+#ifdef CONFIG_DEBUG_FS
+        struct dentry *debugfs_file;
+#endif
+};
+
+extern struct ceph_monmap *ceph_monmap_decode(void *p, void *end);
+extern int ceph_monmap_contains(struct ceph_monmap *m,
+                                struct ceph_entity_addr *addr);
+
+extern int ceph_monc_init(struct ceph_mon_client *monc, struct ceph_client *cl);
+extern void ceph_monc_stop(struct ceph_mon_client *monc);
+
+/*
+ * The model here is to indicate that we need a new map of at least
+ * epoch @want, and also call in when we receive a map.  We will
+ * periodically rerequest the map from the monitor cluster until we
+ * get what we want.
+ */
+extern int ceph_monc_got_mdsmap(struct ceph_mon_client *monc, u32 have);
+extern int ceph_monc_got_osdmap(struct ceph_mon_client *monc, u32 have);
+
+extern void ceph_monc_request_next_osdmap(struct ceph_mon_client *monc);
+
+extern int ceph_monc_do_statfs(struct ceph_mon_client *monc,
+                               struct ceph_statfs *buf);
+
+extern int ceph_monc_open_session(struct ceph_mon_client *monc);
+
+extern int ceph_monc_validate_auth(struct ceph_mon_client *monc);
+
+
+
+#endif
diff --git a/fs/ceph/msgpool.c b/fs/ceph/msgpool.c
new file mode 100644
index 000000000000..ca3b44a89f2d
--- /dev/null
+++ b/fs/ceph/msgpool.c
@@ -0,0 +1,186 @@
+#include "ceph_debug.h"
+
+#include <linux/err.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/vmalloc.h>
+
+#include "msgpool.h"
+
+/*
+ * We use msg pools to preallocate memory for messages we expect to
+ * receive over the wire, to avoid getting ourselves into OOM
+ * conditions at unexpected times.  We take use a few different
+ * strategies:
+ *
+ *  - for request/response type interactions, we preallocate the
+ * memory needed for the response when we generate the request.
+ *
+ *  - for messages we can receive at any time from the MDS, we preallocate
+ * a pool of messages we can re-use.
+ *
+ *  - for writeback, we preallocate some number of messages to use for
+ * requests and their replies, so that we always make forward
+ * progress.
+ *
+ * The msgpool behaves like a mempool_t, but keeps preallocated
+ * ceph_msgs strung together on a list_head instead of using a pointer
+ * vector.  This avoids vector reallocation when we adjust the number
+ * of preallocated items (which happens frequently).
+ */
+
+
+/*
+ * Allocate or release as necessary to meet our target pool size.
+ */
+static int __fill_msgpool(struct ceph_msgpool *pool)
+{
+        struct ceph_msg *msg;
+
+        while (pool->num < pool->min) {
+                dout("fill_msgpool %p %d/%d allocating\n", pool, pool->num,
+                     pool->min);
+                spin_unlock(&pool->lock);
+                msg = ceph_msg_new(0, pool->front_len, 0, 0, NULL);
+                spin_lock(&pool->lock);
+                if (IS_ERR(msg))
+                        return PTR_ERR(msg);
+                msg->pool = pool;
+                list_add(&msg->list_head, &pool->msgs);
+                pool->num++;
+        }
+        while (pool->num > pool->min) {
+                msg = list_first_entry(&pool->msgs, struct ceph_msg, list_head);
+                dout("fill_msgpool %p %d/%d releasing %p\n", pool, pool->num,
+                     pool->min, msg);
+                list_del_init(&msg->list_head);
+                pool->num--;
+                ceph_msg_kfree(msg);
+        }
+        return 0;
+}
+
+int ceph_msgpool_init(struct ceph_msgpool *pool,
+                      int front_len, int min, bool blocking)
+{
+        int ret;
+
+        dout("msgpool_init %p front_len %d min %d\n", pool, front_len, min);
+        spin_lock_init(&pool->lock);
+        pool->front_len = front_len;
+        INIT_LIST_HEAD(&pool->msgs);
+        pool->num = 0;
+        pool->min = min;
+        pool->blocking = blocking;
+        init_waitqueue_head(&pool->wait);
+
+        spin_lock(&pool->lock);
+        ret = __fill_msgpool(pool);
+        spin_unlock(&pool->lock);
+        return ret;
+}
+
+void ceph_msgpool_destroy(struct ceph_msgpool *pool)
+{
+        dout("msgpool_destroy %p\n", pool);
+        spin_lock(&pool->lock);
+        pool->min = 0;
+        __fill_msgpool(pool);
+        spin_unlock(&pool->lock);
+}
+
+int ceph_msgpool_resv(struct ceph_msgpool *pool, int delta)
+{
+        int ret;
+
+        spin_lock(&pool->lock);
+        dout("msgpool_resv %p delta %d\n", pool, delta);
+        pool->min += delta;
+        ret = __fill_msgpool(pool);
+        spin_unlock(&pool->lock);
+        return ret;
+}
+
+struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool, int front_len)
+{
+        wait_queue_t wait;
+        struct ceph_msg *msg;
+
+        if (front_len && front_len > pool->front_len) {
+                pr_err("msgpool_get pool %p need front %d, pool size is %d\n",
+                       pool, front_len, pool->front_len);
+                WARN_ON(1);
+
+                /* try to alloc a fresh message */
+                msg = ceph_msg_new(0, front_len, 0, 0, NULL);
+                if (!IS_ERR(msg))
+                        return msg;
+        }
+
+        if (!front_len)
+                front_len = pool->front_len;
+
+        if (pool->blocking) {
+                /* mempool_t behavior; first try to alloc */
+                msg = ceph_msg_new(0, front_len, 0, 0, NULL);
+                if (!IS_ERR(msg))
+                        return msg;
+        }
+
+        while (1) {
+                spin_lock(&pool->lock);
+                if (likely(pool->num)) {
+                        msg = list_entry(pool->msgs.next, struct ceph_msg,
+                                         list_head);
+                        list_del_init(&msg->list_head);
+                        pool->num--;
+                        dout("msgpool_get %p got %p, now %d/%d\n", pool, msg,
+                             pool->num, pool->min);
+                        spin_unlock(&pool->lock);
+                        return msg;
+                }
+                pr_err("msgpool_get %p now %d/%d, %s\n", pool, pool->num,
+                       pool->min, pool->blocking ? "waiting" : "may fail");
+                spin_unlock(&pool->lock);
+
+                if (!pool->blocking) {
+                        WARN_ON(1);
+
+                        /* maybe we can allocate it now? */
+                        msg = ceph_msg_new(0, front_len, 0, 0, NULL);
+                        if (!IS_ERR(msg))
+                                return msg;
+
+                        pr_err("msgpool_get %p empty + alloc failed\n", pool);
+                        return ERR_PTR(-ENOMEM);
+                }
+
+                init_wait(&wait);
+                prepare_to_wait(&pool->wait, &wait, TASK_UNINTERRUPTIBLE);
+                schedule();
+                finish_wait(&pool->wait, &wait);
+        }
+}
+
+void ceph_msgpool_put(struct ceph_msgpool *pool, struct ceph_msg *msg)
+{
+        spin_lock(&pool->lock);
+        if (pool->num < pool->min) {
+                /* reset msg front_len; user may have changed it */
+                msg->front.iov_len = pool->front_len;
+                msg->hdr.front_len = cpu_to_le32(pool->front_len);
+
+                kref_set(&msg->kref, 1);  /* retake a single ref */
+                list_add(&msg->list_head, &pool->msgs);
+                pool->num++;
+                dout("msgpool_put %p reclaim %p, now %d/%d\n", pool, msg,
+                     pool->num, pool->min);
+                spin_unlock(&pool->lock);
+                wake_up(&pool->wait);
+        } else {
+                dout("msgpool_put %p drop %p, at %d/%d\n", pool, msg,
+                     pool->num, pool->min);
+                spin_unlock(&pool->lock);
+                ceph_msg_kfree(msg);
+        }
+}
diff --git a/fs/ceph/msgpool.h b/fs/ceph/msgpool.h
new file mode 100644
index 000000000000..bc834bfcd720
--- /dev/null
+++ b/fs/ceph/msgpool.h
@@ -0,0 +1,27 @@
+#ifndef _FS_CEPH_MSGPOOL
+#define _FS_CEPH_MSGPOOL
+
+#include "messenger.h"
+
+/*
+ * we use memory pools for preallocating messages we may receive, to
+ * avoid unexpected OOM conditions.
+ */
+struct ceph_msgpool {
+        spinlock_t lock;
+        int front_len;          /* preallocated payload size */
+        struct list_head msgs;  /* msgs in the pool; each has 1 ref */
+        int num, min;           /* cur, min # msgs in the pool */
+        bool blocking;
+        wait_queue_head_t wait;
+};
+
+extern int ceph_msgpool_init(struct ceph_msgpool *pool,
+                             int front_len, int size, bool blocking);
+extern void ceph_msgpool_destroy(struct ceph_msgpool *pool);
+extern int ceph_msgpool_resv(struct ceph_msgpool *, int delta);
+extern struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *,
+                                         int front_len);
+extern void ceph_msgpool_put(struct ceph_msgpool *, struct ceph_msg *);
+
+#endif
diff --git a/fs/ceph/msgr.h b/fs/ceph/msgr.h
new file mode 100644
index 000000000000..8aaab414f3f8
--- /dev/null
+++ b/fs/ceph/msgr.h
@@ -0,0 +1,158 @@
+#ifndef __MSGR_H
+#define __MSGR_H
+
+/*
+ * Data types for message passing layer used by Ceph.
+ */
+
+#define CEPH_MON_PORT    6789  /* default monitor port */
+
+/*
+ * client-side processes will try to bind to ports in this
+ * range, simply for the benefit of tools like nmap or wireshark
+ * that would like to identify the protocol.
+ */
+#define CEPH_PORT_FIRST  6789
+#define CEPH_PORT_START  6800  /* non-monitors start here */
+#define CEPH_PORT_LAST   6900
+
+/*
+ * tcp connection banner.  include a protocol version. and adjust
+ * whenever the wire protocol changes.  try to keep this string length
+ * constant.
+ */
+#define CEPH_BANNER "ceph v027"
+#define CEPH_BANNER_MAX_LEN 30
+
+
+/*
+ * Rollover-safe type and comparator for 32-bit sequence numbers.
+ * Comparator returns -1, 0, or 1.
+ */
+typedef __u32 ceph_seq_t;
+
+static inline __s32 ceph_seq_cmp(__u32 a, __u32 b)
+{
+       return (__s32)a - (__s32)b;
+}
+
+
+/*
+ * entity_name -- logical name for a process participating in the
+ * network, e.g. 'mds0' or 'osd3'.
+ */
+struct ceph_entity_name {
+        __u8 type;      /* CEPH_ENTITY_TYPE_* */
+        __le64 num;
+} __attribute__ ((packed));
+
+#define CEPH_ENTITY_TYPE_MON    0x01
+#define CEPH_ENTITY_TYPE_MDS    0x02
+#define CEPH_ENTITY_TYPE_OSD    0x04
+#define CEPH_ENTITY_TYPE_CLIENT 0x08
+#define CEPH_ENTITY_TYPE_ADMIN  0x10
+#define CEPH_ENTITY_TYPE_AUTH   0x20
+
+#define CEPH_ENTITY_TYPE_ANY    0xFF
+
+extern const char *ceph_entity_type_name(int type);
+
+/*
+ * entity_addr -- network address
+ */
+struct ceph_entity_addr {
+        __le32 type;
+        __le32 nonce;  /* unique id for process (e.g. pid) */
+        struct sockaddr_storage in_addr;
+} __attribute__ ((packed));
+
+struct ceph_entity_inst {
+        struct ceph_entity_name name;
+        struct ceph_entity_addr addr;
+} __attribute__ ((packed));
+
+
+/* used by message exchange protocol */
+#define CEPH_MSGR_TAG_READY         1  /* server->client: ready for messages */
+#define CEPH_MSGR_TAG_RESETSESSION  2  /* server->client: reset, try again */
+#define CEPH_MSGR_TAG_WAIT          3  /* server->client: wait for racing
+                                          incoming connection */
+#define CEPH_MSGR_TAG_RETRY_SESSION 4  /* server->client + cseq: try again
+                                          with higher cseq */
+#define CEPH_MSGR_TAG_RETRY_GLOBAL  5  /* server->client + gseq: try again
+                                          with higher gseq */
+#define CEPH_MSGR_TAG_CLOSE         6  /* closing pipe */
+#define CEPH_MSGR_TAG_MSG           7  /* message */
+#define CEPH_MSGR_TAG_ACK           8  /* message ack */
+#define CEPH_MSGR_TAG_KEEPALIVE     9  /* just a keepalive byte! */
+#define CEPH_MSGR_TAG_BADPROTOVER  10  /* bad protocol version */
+#define CEPH_MSGR_TAG_BADAUTHORIZER 11 /* bad authorizer */
+#define CEPH_MSGR_TAG_FEATURES      12 /* insufficient features */
+
+
+/*
+ * connection negotiation
+ */
+struct ceph_msg_connect {
+        __le64 features;     /* supported feature bits */
+        __le32 host_type;    /* CEPH_ENTITY_TYPE_* */
+        __le32 global_seq;   /* count connections initiated by this host */
+        __le32 connect_seq;  /* count connections initiated in this session */
+        __le32 protocol_version;
+        __le32 authorizer_protocol;
+        __le32 authorizer_len;
+        __u8  flags;         /* CEPH_MSG_CONNECT_* */
+} __attribute__ ((packed));
+
+struct ceph_msg_connect_reply {
+        __u8 tag;
+        __le64 features;     /* feature bits for this session */
+        __le32 global_seq;
+        __le32 connect_seq;
+        __le32 protocol_version;
+        __le32 authorizer_len;
+        __u8 flags;
+} __attribute__ ((packed));
+
+#define CEPH_MSG_CONNECT_LOSSY  1  /* messages i send may be safely dropped */
+
+
+/*
+ * message header
+ */
+struct ceph_msg_header {
+        __le64 seq;       /* message seq# for this session */
+        __le64 tid;       /* transaction id */
+        __le16 type;      /* message type */
+        __le16 priority;  /* priority.  higher value == higher priority */
+        __le16 version;   /* version of message encoding */
+
+        __le32 front_len; /* bytes in main payload */
+        __le32 middle_len;/* bytes in middle payload */
+        __le32 data_len;  /* bytes of data payload */
+        __le16 data_off;  /* sender: include full offset;
+                             receiver: mask against ~PAGE_MASK */
+
+        struct ceph_entity_inst src, orig_src;
+        __le32 reserved;
+        __le32 crc;       /* header crc32c */
+} __attribute__ ((packed));
+
+#define CEPH_MSG_PRIO_LOW     64
+#define CEPH_MSG_PRIO_DEFAULT 127
+#define CEPH_MSG_PRIO_HIGH    196
+#define CEPH_MSG_PRIO_HIGHEST 255
+
+/*
+ * follows data payload
+ */
+struct ceph_msg_footer {
+        __le32 front_crc, middle_crc, data_crc;
+        __u8 flags;
+} __attribute__ ((packed));
+
+#define CEPH_MSG_FOOTER_COMPLETE  (1<<0)   /* msg wasn't aborted */
+#define CEPH_MSG_FOOTER_NOCRC     (1<<1)   /* no data crc */
+
+
+#endif
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
new file mode 100644
index 000000000000..c7b4dedaace6
--- /dev/null
+++ b/fs/ceph/osd_client.c
@@ -0,0 +1,1550 @@
+#include "ceph_debug.h"
+
+#include <linux/err.h>
+#include <linux/highmem.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include "super.h"
+#include "osd_client.h"
+#include "messenger.h"
+#include "decode.h"
+#include "auth.h"
+
+#define OSD_OP_FRONT_LEN        4096
+#define OSD_OPREPLY_FRONT_LEN   512
+
+const static struct ceph_connection_operations osd_con_ops;
+static int __kick_requests(struct ceph_osd_client *osdc,
+                          struct ceph_osd *kickosd);
+
+static void kick_requests(struct ceph_osd_client *osdc, struct ceph_osd *osd);
+
+/*
+ * Implement client access to distributed object storage cluster.
+ *
+ * All data objects are stored within a cluster/cloud of OSDs, or
+ * "object storage devices."  (Note that Ceph OSDs have _nothing_ to
+ * do with the T10 OSD extensions to SCSI.)  Ceph OSDs are simply
+ * remote daemons serving up and coordinating consistent and safe
+ * access to storage.
+ *
+ * Cluster membership and the mapping of data objects onto storage devices
+ * are described by the osd map.
+ *
+ * We keep track of pending OSD requests (read, write), resubmit
+ * requests to different OSDs when the cluster topology/data layout
+ * change, or retry the affected requests when the communications
+ * channel with an OSD is reset.
+ */
+
+/*
+ * calculate the mapping of a file extent onto an object, and fill out the
+ * request accordingly.  shorten extent as necessary if it crosses an
+ * object boundary.
+ *
+ * fill osd op in request message.
+ */
+static void calc_layout(struct ceph_osd_client *osdc,
+                        struct ceph_vino vino, struct ceph_file_layout *layout,
+                        u64 off, u64 *plen,
+                        struct ceph_osd_request *req)
+{
+        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
+        struct ceph_osd_op *op = (void *)(reqhead + 1);
+        u64 orig_len = *plen;
+        u64 objoff, objlen;    /* extent in object */
+        u64 bno;
+
+        reqhead->snapid = cpu_to_le64(vino.snap);
+
+        /* object extent? */
+        ceph_calc_file_object_mapping(layout, off, plen, &bno,
+                                      &objoff, &objlen);
+        if (*plen < orig_len)
+                dout(" skipping last %llu, final file extent %llu~%llu\n",
+                     orig_len - *plen, off, *plen);
+
+        sprintf(req->r_oid, "%llx.%08llx", vino.ino, bno);
+        req->r_oid_len = strlen(req->r_oid);
+
+        op->extent.offset = cpu_to_le64(objoff);
+        op->extent.length = cpu_to_le64(objlen);
+        req->r_num_pages = calc_pages_for(off, *plen);
+
+        dout("calc_layout %s (%d) %llu~%llu (%d pages)\n",
+             req->r_oid, req->r_oid_len, objoff, objlen, req->r_num_pages);
+}
+
+/*
+ * requests
+ */
+void ceph_osdc_release_request(struct kref *kref)
+{
+        struct ceph_osd_request *req = container_of(kref,
+                                                    struct ceph_osd_request,
+                                                    r_kref);
+
+        if (req->r_request)
+                ceph_msg_put(req->r_request);
+        if (req->r_reply)
+                ceph_msg_put(req->r_reply);
+        if (req->r_con_filling_msg) {
+                dout("release_request revoking pages %p from con %p\n",
+                     req->r_pages, req->r_con_filling_msg);
+                ceph_con_revoke_message(req->r_con_filling_msg,
+                                      req->r_reply);
+                ceph_con_put(req->r_con_filling_msg);
+        }
+        if (req->r_own_pages)
+                ceph_release_page_vector(req->r_pages,
+                                         req->r_num_pages);
+        ceph_put_snap_context(req->r_snapc);
+        if (req->r_mempool)
+                mempool_free(req, req->r_osdc->req_mempool);
+        else
+                kfree(req);
+}
+
+/*
+ * build new request AND message, calculate layout, and adjust file
+ * extent as needed.
+ *
+ * if the file was recently truncated, we include information about its
+ * old and new size so that the object can be updated appropriately.  (we
+ * avoid synchronously deleting truncated objects because it's slow.)
+ *
+ * if @do_sync, include a 'startsync' command so that the osd will flush
+ * data quickly.
+ */
+struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
+                                               struct ceph_file_layout *layout,
+                                               struct ceph_vino vino,
+                                               u64 off, u64 *plen,
+                                               int opcode, int flags,
+                                               struct ceph_snap_context *snapc,
+                                               int do_sync,
+                                               u32 truncate_seq,
+                                               u64 truncate_size,
+                                               struct timespec *mtime,
+                                               bool use_mempool, int num_reply)
+{
+        struct ceph_osd_request *req;
+        struct ceph_msg *msg;
+        struct ceph_osd_request_head *head;
+        struct ceph_osd_op *op;
+        void *p;
+        int num_op = 1 + do_sync;
+        size_t msg_size = sizeof(*head) + num_op*sizeof(*op);
+        int i;
+
+        if (use_mempool) {
+                req = mempool_alloc(osdc->req_mempool, GFP_NOFS);
+                memset(req, 0, sizeof(*req));
+        } else {
+                req = kzalloc(sizeof(*req), GFP_NOFS);
+        }
+        if (req == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        req->r_osdc = osdc;
+        req->r_mempool = use_mempool;
+        kref_init(&req->r_kref);
+        init_completion(&req->r_completion);
+        init_completion(&req->r_safe_completion);
+        INIT_LIST_HEAD(&req->r_unsafe_item);
+        req->r_flags = flags;
+
+        WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
+
+        /* create reply message */
+        if (use_mempool)
+                msg = ceph_msgpool_get(&osdc->msgpool_op_reply, 0);
+        else
+                msg = ceph_msg_new(CEPH_MSG_OSD_OPREPLY,
+                                   OSD_OPREPLY_FRONT_LEN, 0, 0, NULL);
+        if (IS_ERR(msg)) {
+                ceph_osdc_put_request(req);
+                return ERR_PTR(PTR_ERR(msg));
+        }
+        req->r_reply = msg;
+
+        /* create request message; allow space for oid */
+        msg_size += 40;
+        if (snapc)
+                msg_size += sizeof(u64) * snapc->num_snaps;
+        if (use_mempool)
+                msg = ceph_msgpool_get(&osdc->msgpool_op, 0);
+        else
+                msg = ceph_msg_new(CEPH_MSG_OSD_OP, msg_size, 0, 0, NULL);
+        if (IS_ERR(msg)) {
+                ceph_osdc_put_request(req);
+                return ERR_PTR(PTR_ERR(msg));
+        }
+        msg->hdr.type = cpu_to_le16(CEPH_MSG_OSD_OP);
+        memset(msg->front.iov_base, 0, msg->front.iov_len);
+        head = msg->front.iov_base;
+        op = (void *)(head + 1);
+        p = (void *)(op + num_op);
+
+        req->r_request = msg;
+        req->r_snapc = ceph_get_snap_context(snapc);
+
+        head->client_inc = cpu_to_le32(1); /* always, for now. */
+        head->flags = cpu_to_le32(flags);
+        if (flags & CEPH_OSD_FLAG_WRITE)
+                ceph_encode_timespec(&head->mtime, mtime);
+        head->num_ops = cpu_to_le16(num_op);
+        op->op = cpu_to_le16(opcode);
+
+        /* calculate max write size */
+        calc_layout(osdc, vino, layout, off, plen, req);
+        req->r_file_layout = *layout;  /* keep a copy */
+
+        if (flags & CEPH_OSD_FLAG_WRITE) {
+                req->r_request->hdr.data_off = cpu_to_le16(off);
+                req->r_request->hdr.data_len = cpu_to_le32(*plen);
+                op->payload_len = cpu_to_le32(*plen);
+        }
+        op->extent.truncate_size = cpu_to_le64(truncate_size);
+        op->extent.truncate_seq = cpu_to_le32(truncate_seq);
+
+        /* fill in oid */
+        head->object_len = cpu_to_le32(req->r_oid_len);
+        memcpy(p, req->r_oid, req->r_oid_len);
+        p += req->r_oid_len;
+
+        if (do_sync) {
+                op++;
+                op->op = cpu_to_le16(CEPH_OSD_OP_STARTSYNC);
+        }
+        if (snapc) {
+                head->snap_seq = cpu_to_le64(snapc->seq);
+                head->num_snaps = cpu_to_le32(snapc->num_snaps);
+                for (i = 0; i < snapc->num_snaps; i++) {
+                        put_unaligned_le64(snapc->snaps[i], p);
+                        p += sizeof(u64);
+                }
+        }
+
+        BUG_ON(p > msg->front.iov_base + msg->front.iov_len);
+        msg_size = p - msg->front.iov_base;
+        msg->front.iov_len = msg_size;
+        msg->hdr.front_len = cpu_to_le32(msg_size);
+        return req;
+}
+
+/*
+ * We keep osd requests in an rbtree, sorted by ->r_tid.
+ */
+static void __insert_request(struct ceph_osd_client *osdc,
+                             struct ceph_osd_request *new)
+{
+        struct rb_node **p = &osdc->requests.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_osd_request *req = NULL;
+
+        while (*p) {
+                parent = *p;
+                req = rb_entry(parent, struct ceph_osd_request, r_node);
+                if (new->r_tid < req->r_tid)
+                        p = &(*p)->rb_left;
+                else if (new->r_tid > req->r_tid)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->r_node, parent, p);
+        rb_insert_color(&new->r_node, &osdc->requests);
+}
+
+static struct ceph_osd_request *__lookup_request(struct ceph_osd_client *osdc,
+                                                 u64 tid)
+{
+        struct ceph_osd_request *req;
+        struct rb_node *n = osdc->requests.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_osd_request, r_node);
+                if (tid < req->r_tid)
+                        n = n->rb_left;
+                else if (tid > req->r_tid)
+                        n = n->rb_right;
+                else
+                        return req;
+        }
+        return NULL;
+}
+
+static struct ceph_osd_request *
+__lookup_request_ge(struct ceph_osd_client *osdc,
+                    u64 tid)
+{
+        struct ceph_osd_request *req;
+        struct rb_node *n = osdc->requests.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_osd_request, r_node);
+                if (tid < req->r_tid) {
+                        if (!n->rb_left)
+                                return req;
+                        n = n->rb_left;
+                } else if (tid > req->r_tid) {
+                        n = n->rb_right;
+                } else {
+                        return req;
+                }
+        }
+        return NULL;
+}
+
+
+/*
+ * If the osd connection drops, we need to resubmit all requests.
+ */
+static void osd_reset(struct ceph_connection *con)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc;
+
+        if (!osd)
+                return;
+        dout("osd_reset osd%d\n", osd->o_osd);
+        osdc = osd->o_osdc;
+        down_read(&osdc->map_sem);
+        kick_requests(osdc, osd);
+        up_read(&osdc->map_sem);
+}
+
+/*
+ * Track open sessions with osds.
+ */
+static struct ceph_osd *create_osd(struct ceph_osd_client *osdc)
+{
+        struct ceph_osd *osd;
+
+        osd = kzalloc(sizeof(*osd), GFP_NOFS);
+        if (!osd)
+                return NULL;
+
+        atomic_set(&osd->o_ref, 1);
+        osd->o_osdc = osdc;
+        INIT_LIST_HEAD(&osd->o_requests);
+        INIT_LIST_HEAD(&osd->o_osd_lru);
+        osd->o_incarnation = 1;
+
+        ceph_con_init(osdc->client->msgr, &osd->o_con);
+        osd->o_con.private = osd;
+        osd->o_con.ops = &osd_con_ops;
+        osd->o_con.peer_name.type = CEPH_ENTITY_TYPE_OSD;
+
+        INIT_LIST_HEAD(&osd->o_keepalive_item);
+        return osd;
+}
+
+static struct ceph_osd *get_osd(struct ceph_osd *osd)
+{
+        if (atomic_inc_not_zero(&osd->o_ref)) {
+                dout("get_osd %p %d -> %d\n", osd, atomic_read(&osd->o_ref)-1,
+                     atomic_read(&osd->o_ref));
+                return osd;
+        } else {
+                dout("get_osd %p FAIL\n", osd);
+                return NULL;
+        }
+}
+
+static void put_osd(struct ceph_osd *osd)
+{
+        dout("put_osd %p %d -> %d\n", osd, atomic_read(&osd->o_ref),
+             atomic_read(&osd->o_ref) - 1);
+        if (atomic_dec_and_test(&osd->o_ref))
+                kfree(osd);
+}
+
+/*
+ * remove an osd from our map
+ */
+static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+{
+        dout("__remove_osd %p\n", osd);
+        BUG_ON(!list_empty(&osd->o_requests));
+        rb_erase(&osd->o_node, &osdc->osds);
+        list_del_init(&osd->o_osd_lru);
+        ceph_con_close(&osd->o_con);
+        put_osd(osd);
+}
+
+static void __move_osd_to_lru(struct ceph_osd_client *osdc,
+                              struct ceph_osd *osd)
+{
+        dout("__move_osd_to_lru %p\n", osd);
+        BUG_ON(!list_empty(&osd->o_osd_lru));
+        list_add_tail(&osd->o_osd_lru, &osdc->osd_lru);
+        osd->lru_ttl = jiffies + osdc->client->mount_args->osd_idle_ttl * HZ;
+}
+
+static void __remove_osd_from_lru(struct ceph_osd *osd)
+{
+        dout("__remove_osd_from_lru %p\n", osd);
+        if (!list_empty(&osd->o_osd_lru))
+                list_del_init(&osd->o_osd_lru);
+}
+
+static void remove_old_osds(struct ceph_osd_client *osdc, int remove_all)
+{
+        struct ceph_osd *osd, *nosd;
+
+        dout("__remove_old_osds %p\n", osdc);
+        mutex_lock(&osdc->request_mutex);
+        list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
+                if (!remove_all && time_before(jiffies, osd->lru_ttl))
+                        break;
+                __remove_osd(osdc, osd);
+        }
+        mutex_unlock(&osdc->request_mutex);
+}
+
+/*
+ * reset osd connect
+ */
+static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+{
+        struct ceph_osd_request *req;
+        int ret = 0;
+
+        dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
+        if (list_empty(&osd->o_requests)) {
+                __remove_osd(osdc, osd);
+        } else if (memcmp(&osdc->osdmap->osd_addr[osd->o_osd],
+                          &osd->o_con.peer_addr,
+                          sizeof(osd->o_con.peer_addr)) == 0 &&
+                   !ceph_con_opened(&osd->o_con)) {
+                dout(" osd addr hasn't changed and connection never opened,"
+                     " letting msgr retry");
+                /* touch each r_stamp for handle_timeout()'s benfit */
+                list_for_each_entry(req, &osd->o_requests, r_osd_item)
+                        req->r_stamp = jiffies;
+                ret = -EAGAIN;
+        } else {
+                ceph_con_close(&osd->o_con);
+                ceph_con_open(&osd->o_con, &osdc->osdmap->osd_addr[osd->o_osd]);
+                osd->o_incarnation++;
+        }
+        return ret;
+}
+
+static void __insert_osd(struct ceph_osd_client *osdc, struct ceph_osd *new)
+{
+        struct rb_node **p = &osdc->osds.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_osd *osd = NULL;
+
+        while (*p) {
+                parent = *p;
+                osd = rb_entry(parent, struct ceph_osd, o_node);
+                if (new->o_osd < osd->o_osd)
+                        p = &(*p)->rb_left;
+                else if (new->o_osd > osd->o_osd)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->o_node, parent, p);
+        rb_insert_color(&new->o_node, &osdc->osds);
+}
+
+static struct ceph_osd *__lookup_osd(struct ceph_osd_client *osdc, int o)
+{
+        struct ceph_osd *osd;
+        struct rb_node *n = osdc->osds.rb_node;
+
+        while (n) {
+                osd = rb_entry(n, struct ceph_osd, o_node);
+                if (o < osd->o_osd)
+                        n = n->rb_left;
+                else if (o > osd->o_osd)
+                        n = n->rb_right;
+                else
+                        return osd;
+        }
+        return NULL;
+}
+
+static void __schedule_osd_timeout(struct ceph_osd_client *osdc)
+{
+        schedule_delayed_work(&osdc->timeout_work,
+                        osdc->client->mount_args->osd_keepalive_timeout * HZ);
+}
+
+static void __cancel_osd_timeout(struct ceph_osd_client *osdc)
+{
+        cancel_delayed_work(&osdc->timeout_work);
+}
+
+/*
+ * Register request, assign tid.  If this is the first request, set up
+ * the timeout event.
+ */
+static void register_request(struct ceph_osd_client *osdc,
+                             struct ceph_osd_request *req)
+{
+        mutex_lock(&osdc->request_mutex);
+        req->r_tid = ++osdc->last_tid;
+        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
+        INIT_LIST_HEAD(&req->r_req_lru_item);
+
+        dout("register_request %p tid %lld\n", req, req->r_tid);
+        __insert_request(osdc, req);
+        ceph_osdc_get_request(req);
+        osdc->num_requests++;
+
+        if (osdc->num_requests == 1) {
+                dout(" first request, scheduling timeout\n");
+                __schedule_osd_timeout(osdc);
+        }
+        mutex_unlock(&osdc->request_mutex);
+}
+
+/*
+ * called under osdc->request_mutex
+ */
+static void __unregister_request(struct ceph_osd_client *osdc,
+                                 struct ceph_osd_request *req)
+{
+        dout("__unregister_request %p tid %lld\n", req, req->r_tid);
+        rb_erase(&req->r_node, &osdc->requests);
+        osdc->num_requests--;
+
+        if (req->r_osd) {
+                /* make sure the original request isn't in flight. */
+                ceph_con_revoke(&req->r_osd->o_con, req->r_request);
+
+                list_del_init(&req->r_osd_item);
+                if (list_empty(&req->r_osd->o_requests))
+                        __move_osd_to_lru(osdc, req->r_osd);
+                req->r_osd = NULL;
+        }
+
+        ceph_osdc_put_request(req);
+
+        list_del_init(&req->r_req_lru_item);
+        if (osdc->num_requests == 0) {
+                dout(" no requests, canceling timeout\n");
+                __cancel_osd_timeout(osdc);
+        }
+}
+
+/*
+ * Cancel a previously queued request message
+ */
+static void __cancel_request(struct ceph_osd_request *req)
+{
+        if (req->r_sent) {
+                ceph_con_revoke(&req->r_osd->o_con, req->r_request);
+                req->r_sent = 0;
+        }
+        list_del_init(&req->r_req_lru_item);
+}
+
+/*
+ * Pick an osd (the first 'up' osd in the pg), allocate the osd struct
+ * (as needed), and set the request r_osd appropriately.  If there is
+ * no up osd, set r_osd to NULL.
+ *
+ * Return 0 if unchanged, 1 if changed, or negative on error.
+ *
+ * Caller should hold map_sem for read and request_mutex.
+ */
+static int __map_osds(struct ceph_osd_client *osdc,
+                      struct ceph_osd_request *req)
+{
+        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
+        struct ceph_pg pgid;
+        int o = -1;
+        int err;
+
+        dout("map_osds %p tid %lld\n", req, req->r_tid);
+        err = ceph_calc_object_layout(&reqhead->layout, req->r_oid,
+                                      &req->r_file_layout, osdc->osdmap);
+        if (err)
+                return err;
+        pgid = reqhead->layout.ol_pgid;
+        req->r_pgid = pgid;
+
+        o = ceph_calc_pg_primary(osdc->osdmap, pgid);
+
+        if ((req->r_osd && req->r_osd->o_osd == o &&
+             req->r_sent >= req->r_osd->o_incarnation) ||
+            (req->r_osd == NULL && o == -1))
+                return 0;  /* no change */
+
+        dout("map_osds tid %llu pgid %d.%x osd%d (was osd%d)\n",
+             req->r_tid, le32_to_cpu(pgid.pool), le16_to_cpu(pgid.ps), o,
+             req->r_osd ? req->r_osd->o_osd : -1);
+
+        if (req->r_osd) {
+                __cancel_request(req);
+                list_del_init(&req->r_osd_item);
+                req->r_osd = NULL;
+        }
+
+        req->r_osd = __lookup_osd(osdc, o);
+        if (!req->r_osd && o >= 0) {
+                err = -ENOMEM;
+                req->r_osd = create_osd(osdc);
+                if (!req->r_osd)
+                        goto out;
+
+                dout("map_osds osd %p is osd%d\n", req->r_osd, o);
+                req->r_osd->o_osd = o;
+                req->r_osd->o_con.peer_name.num = cpu_to_le64(o);
+                __insert_osd(osdc, req->r_osd);
+
+                ceph_con_open(&req->r_osd->o_con, &osdc->osdmap->osd_addr[o]);
+        }
+
+        if (req->r_osd) {
+                __remove_osd_from_lru(req->r_osd);
+                list_add(&req->r_osd_item, &req->r_osd->o_requests);
+        }
+        err = 1;   /* osd changed */
+
+out:
+        return err;
+}
+
+/*
+ * caller should hold map_sem (for read) and request_mutex
+ */
+static int __send_request(struct ceph_osd_client *osdc,
+                          struct ceph_osd_request *req)
+{
+        struct ceph_osd_request_head *reqhead;
+        int err;
+
+        err = __map_osds(osdc, req);
+        if (err < 0)
+                return err;
+        if (req->r_osd == NULL) {
+                dout("send_request %p no up osds in pg\n", req);
+                ceph_monc_request_next_osdmap(&osdc->client->monc);
+                return 0;
+        }
+
+        dout("send_request %p tid %llu to osd%d flags %d\n",
+             req, req->r_tid, req->r_osd->o_osd, req->r_flags);
+
+        reqhead = req->r_request->front.iov_base;
+        reqhead->osdmap_epoch = cpu_to_le32(osdc->osdmap->epoch);
+        reqhead->flags |= cpu_to_le32(req->r_flags);  /* e.g., RETRY */
+        reqhead->reassert_version = req->r_reassert_version;
+
+        req->r_stamp = jiffies;
+        list_move_tail(&osdc->req_lru, &req->r_req_lru_item);
+
+        ceph_msg_get(req->r_request); /* send consumes a ref */
+        ceph_con_send(&req->r_osd->o_con, req->r_request);
+        req->r_sent = req->r_osd->o_incarnation;
+        return 0;
+}
+
+/*
+ * Timeout callback, called every N seconds when 1 or more osd
+ * requests has been active for more than N seconds.  When this
+ * happens, we ping all OSDs with requests who have timed out to
+ * ensure any communications channel reset is detected.  Reset the
+ * request timeouts another N seconds in the future as we go.
+ * Reschedule the timeout event another N seconds in future (unless
+ * there are no open requests).
+ */
+static void handle_timeout(struct work_struct *work)
+{
+        struct ceph_osd_client *osdc =
+                container_of(work, struct ceph_osd_client, timeout_work.work);
+        struct ceph_osd_request *req, *last_req = NULL;
+        struct ceph_osd *osd;
+        unsigned long timeout = osdc->client->mount_args->osd_timeout * HZ;
+        unsigned long keepalive =
+                osdc->client->mount_args->osd_keepalive_timeout * HZ;
+        unsigned long last_stamp = 0;
+        struct rb_node *p;
+        struct list_head slow_osds;
+
+        dout("timeout\n");
+        down_read(&osdc->map_sem);
+
+        ceph_monc_request_next_osdmap(&osdc->client->monc);
+
+        mutex_lock(&osdc->request_mutex);
+        for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_osd_request, r_node);
+
+                if (req->r_resend) {
+                        int err;
+
+                        dout("osdc resending prev failed %lld\n", req->r_tid);
+                        err = __send_request(osdc, req);
+                        if (err)
+                                dout("osdc failed again on %lld\n", req->r_tid);
+                        else
+                                req->r_resend = false;
+                        continue;
+                }
+        }
+
+        /*
+         * reset osds that appear to be _really_ unresponsive.  this
+         * is a failsafe measure.. we really shouldn't be getting to
+         * this point if the system is working properly.  the monitors
+         * should mark the osd as failed and we should find out about
+         * it from an updated osd map.
+         */
+        while (!list_empty(&osdc->req_lru)) {
+                req = list_entry(osdc->req_lru.next, struct ceph_osd_request,
+                                 r_req_lru_item);
+
+                if (time_before(jiffies, req->r_stamp + timeout))
+                        break;
+
+                BUG_ON(req == last_req && req->r_stamp == last_stamp);
+                last_req = req;
+                last_stamp = req->r_stamp;
+
+                osd = req->r_osd;
+                BUG_ON(!osd);
+                pr_warning(" tid %llu timed out on osd%d, will reset osd\n",
+                           req->r_tid, osd->o_osd);
+                __kick_requests(osdc, osd);
+        }
+
+        /*
+         * ping osds that are a bit slow.  this ensures that if there
+         * is a break in the TCP connection we will notice, and reopen
+         * a connection with that osd (from the fault callback).
+         */
+        INIT_LIST_HEAD(&slow_osds);
+        list_for_each_entry(req, &osdc->req_lru, r_req_lru_item) {
+                if (time_before(jiffies, req->r_stamp + keepalive))
+                        break;
+
+                osd = req->r_osd;
+                BUG_ON(!osd);
+                dout(" tid %llu is slow, will send keepalive on osd%d\n",
+                     req->r_tid, osd->o_osd);
+                list_move_tail(&osd->o_keepalive_item, &slow_osds);
+        }
+        while (!list_empty(&slow_osds)) {
+                osd = list_entry(slow_osds.next, struct ceph_osd,
+                                 o_keepalive_item);
+                list_del_init(&osd->o_keepalive_item);
+                ceph_con_keepalive(&osd->o_con);
+        }
+
+        __schedule_osd_timeout(osdc);
+        mutex_unlock(&osdc->request_mutex);
+
+        up_read(&osdc->map_sem);
+}
+
+static void handle_osds_timeout(struct work_struct *work)
+{
+        struct ceph_osd_client *osdc =
+                container_of(work, struct ceph_osd_client,
+                             osds_timeout_work.work);
+        unsigned long delay =
+                osdc->client->mount_args->osd_idle_ttl * HZ >> 2;
+
+        dout("osds timeout\n");
+        down_read(&osdc->map_sem);
+        remove_old_osds(osdc, 0);
+        up_read(&osdc->map_sem);
+
+        schedule_delayed_work(&osdc->osds_timeout_work,
+                              round_jiffies_relative(delay));
+}
+
+/*
+ * handle osd op reply.  either call the callback if it is specified,
+ * or do the completion to wake up the waiting thread.
+ */
+static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
+                         struct ceph_connection *con)
+{
+        struct ceph_osd_reply_head *rhead = msg->front.iov_base;
+        struct ceph_osd_request *req;
+        u64 tid;
+        int numops, object_len, flags;
+
+        tid = le64_to_cpu(msg->hdr.tid);
+        if (msg->front.iov_len < sizeof(*rhead))
+                goto bad;
+        numops = le32_to_cpu(rhead->num_ops);
+        object_len = le32_to_cpu(rhead->object_len);
+        if (msg->front.iov_len != sizeof(*rhead) + object_len +
+            numops * sizeof(struct ceph_osd_op))
+                goto bad;
+        dout("handle_reply %p tid %llu\n", msg, tid);
+
+        /* lookup */
+        mutex_lock(&osdc->request_mutex);
+        req = __lookup_request(osdc, tid);
+        if (req == NULL) {
+                dout("handle_reply tid %llu dne\n", tid);
+                mutex_unlock(&osdc->request_mutex);
+                return;
+        }
+        ceph_osdc_get_request(req);
+        flags = le32_to_cpu(rhead->flags);
+
+        /*
+         * if this connection filled our message, drop our reference now, to
+         * avoid a (safe but slower) revoke later.
+         */
+        if (req->r_con_filling_msg == con && req->r_reply == msg) {
+                dout(" dropping con_filling_msg ref %p\n", con);
+                req->r_con_filling_msg = NULL;
+                ceph_con_put(con);
+        }
+
+        if (!req->r_got_reply) {
+                unsigned bytes;
+
+                req->r_result = le32_to_cpu(rhead->result);
+                bytes = le32_to_cpu(msg->hdr.data_len);
+                dout("handle_reply result %d bytes %d\n", req->r_result,
+                     bytes);
+                if (req->r_result == 0)
+                        req->r_result = bytes;
+
+                /* in case this is a write and we need to replay, */
+                req->r_reassert_version = rhead->reassert_version;
+
+                req->r_got_reply = 1;
+        } else if ((flags & CEPH_OSD_FLAG_ONDISK) == 0) {
+                dout("handle_reply tid %llu dup ack\n", tid);
+                mutex_unlock(&osdc->request_mutex);
+                goto done;
+        }
+
+        dout("handle_reply tid %llu flags %d\n", tid, flags);
+
+        /* either this is a read, or we got the safe response */
+        if ((flags & CEPH_OSD_FLAG_ONDISK) ||
+            ((flags & CEPH_OSD_FLAG_WRITE) == 0))
+                __unregister_request(osdc, req);
+
+        mutex_unlock(&osdc->request_mutex);
+
+        if (req->r_callback)
+                req->r_callback(req, msg);
+        else
+                complete(&req->r_completion);
+
+        if (flags & CEPH_OSD_FLAG_ONDISK) {
+                if (req->r_safe_callback)
+                        req->r_safe_callback(req, msg);
+                complete(&req->r_safe_completion);  /* fsync waiter */
+        }
+
+done:
+        ceph_osdc_put_request(req);
+        return;
+
+bad:
+        pr_err("corrupt osd_op_reply got %d %d expected %d\n",
+               (int)msg->front.iov_len, le32_to_cpu(msg->hdr.front_len),
+               (int)sizeof(*rhead));
+        ceph_msg_dump(msg);
+}
+
+
+static int __kick_requests(struct ceph_osd_client *osdc,
+                          struct ceph_osd *kickosd)
+{
+        struct ceph_osd_request *req;
+        struct rb_node *p, *n;
+        int needmap = 0;
+        int err;
+
+        dout("kick_requests osd%d\n", kickosd ? kickosd->o_osd : -1);
+        if (kickosd) {
+                err = __reset_osd(osdc, kickosd);
+                if (err == -EAGAIN)
+                        return 1;
+        } else {
+                for (p = rb_first(&osdc->osds); p; p = n) {
+                        struct ceph_osd *osd =
+                                rb_entry(p, struct ceph_osd, o_node);
+
+                        n = rb_next(p);
+                        if (!ceph_osd_is_up(osdc->osdmap, osd->o_osd) ||
+                            memcmp(&osd->o_con.peer_addr,
+                                   ceph_osd_addr(osdc->osdmap,
+                                                 osd->o_osd),
+                                   sizeof(struct ceph_entity_addr)) != 0)
+                                __reset_osd(osdc, osd);
+                }
+        }
+
+        for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_osd_request, r_node);
+
+                if (req->r_resend) {
+                        dout(" r_resend set on tid %llu\n", req->r_tid);
+                        __cancel_request(req);
+                        goto kick;
+                }
+                if (req->r_osd && kickosd == req->r_osd) {
+                        __cancel_request(req);
+                        goto kick;
+                }
+
+                err = __map_osds(osdc, req);
+                if (err == 0)
+                        continue;  /* no change */
+                if (err < 0) {
+                        /*
+                         * FIXME: really, we should set the request
+                         * error and fail if this isn't a 'nofail'
+                         * request, but that's a fair bit more
+                         * complicated to do.  So retry!
+                         */
+                        dout(" setting r_resend on %llu\n", req->r_tid);
+                        req->r_resend = true;
+                        continue;
+                }
+                if (req->r_osd == NULL) {
+                        dout("tid %llu maps to no valid osd\n", req->r_tid);
+                        needmap++;  /* request a newer map */
+                        continue;
+                }
+
+kick:
+                dout("kicking %p tid %llu osd%d\n", req, req->r_tid,
+                     req->r_osd ? req->r_osd->o_osd : -1);
+                req->r_flags |= CEPH_OSD_FLAG_RETRY;
+                err = __send_request(osdc, req);
+                if (err) {
+                        dout(" setting r_resend on %llu\n", req->r_tid);
+                        req->r_resend = true;
+                }
+        }
+
+        return needmap;
+}
+
+/*
+ * Resubmit osd requests whose osd or osd address has changed.  Request
+ * a new osd map if osds are down, or we are otherwise unable to determine
+ * how to direct a request.
+ *
+ * Close connections to down osds.
+ *
+ * If @who is specified, resubmit requests for that specific osd.
+ *
+ * Caller should hold map_sem for read and request_mutex.
+ */
+static void kick_requests(struct ceph_osd_client *osdc,
+                          struct ceph_osd *kickosd)
+{
+        int needmap;
+
+        mutex_lock(&osdc->request_mutex);
+        needmap = __kick_requests(osdc, kickosd);
+        mutex_unlock(&osdc->request_mutex);
+
+        if (needmap) {
+                dout("%d requests for down osds, need new map\n", needmap);
+                ceph_monc_request_next_osdmap(&osdc->client->monc);
+        }
+
+}
+/*
+ * Process updated osd map.
+ *
+ * The message contains any number of incremental and full maps, normally
+ * indicating some sort of topology change in the cluster.  Kick requests
+ * off to different OSDs as needed.
+ */
+void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+{
+        void *p, *end, *next;
+        u32 nr_maps, maplen;
+        u32 epoch;
+        struct ceph_osdmap *newmap = NULL, *oldmap;
+        int err;
+        struct ceph_fsid fsid;
+
+        dout("handle_map have %u\n", osdc->osdmap ? osdc->osdmap->epoch : 0);
+        p = msg->front.iov_base;
+        end = p + msg->front.iov_len;
+
+        /* verify fsid */
+        ceph_decode_need(&p, end, sizeof(fsid), bad);
+        ceph_decode_copy(&p, &fsid, sizeof(fsid));
+        if (ceph_check_fsid(osdc->client, &fsid) < 0)
+                return;
+
+        down_write(&osdc->map_sem);
+
+        /* incremental maps */
+        ceph_decode_32_safe(&p, end, nr_maps, bad);
+        dout(" %d inc maps\n", nr_maps);
+        while (nr_maps > 0) {
+                ceph_decode_need(&p, end, 2*sizeof(u32), bad);
+                epoch = ceph_decode_32(&p);
+                maplen = ceph_decode_32(&p);
+                ceph_decode_need(&p, end, maplen, bad);
+                next = p + maplen;
+                if (osdc->osdmap && osdc->osdmap->epoch+1 == epoch) {
+                        dout("applying incremental map %u len %d\n",
+                             epoch, maplen);
+                        newmap = osdmap_apply_incremental(&p, next,
+                                                          osdc->osdmap,
+                                                          osdc->client->msgr);
+                        if (IS_ERR(newmap)) {
+                                err = PTR_ERR(newmap);
+                                goto bad;
+                        }
+                        BUG_ON(!newmap);
+                        if (newmap != osdc->osdmap) {
+                                ceph_osdmap_destroy(osdc->osdmap);
+                                osdc->osdmap = newmap;
+                        }
+                } else {
+                        dout("ignoring incremental map %u len %d\n",
+                             epoch, maplen);
+                }
+                p = next;
+                nr_maps--;
+        }
+        if (newmap)
+                goto done;
+
+        /* full maps */
+        ceph_decode_32_safe(&p, end, nr_maps, bad);
+        dout(" %d full maps\n", nr_maps);
+        while (nr_maps) {
+                ceph_decode_need(&p, end, 2*sizeof(u32), bad);
+                epoch = ceph_decode_32(&p);
+                maplen = ceph_decode_32(&p);
+                ceph_decode_need(&p, end, maplen, bad);
+                if (nr_maps > 1) {
+                        dout("skipping non-latest full map %u len %d\n",
+                             epoch, maplen);
+                } else if (osdc->osdmap && osdc->osdmap->epoch >= epoch) {
+                        dout("skipping full map %u len %d, "
+                             "older than our %u\n", epoch, maplen,
+                             osdc->osdmap->epoch);
+                } else {
+                        dout("taking full map %u len %d\n", epoch, maplen);
+                        newmap = osdmap_decode(&p, p+maplen);
+                        if (IS_ERR(newmap)) {
+                                err = PTR_ERR(newmap);
+                                goto bad;
+                        }
+                        BUG_ON(!newmap);
+                        oldmap = osdc->osdmap;
+                        osdc->osdmap = newmap;
+                        if (oldmap)
+                                ceph_osdmap_destroy(oldmap);
+                }
+                p += maplen;
+                nr_maps--;
+        }
+
+done:
+        downgrade_write(&osdc->map_sem);
+        ceph_monc_got_osdmap(&osdc->client->monc, osdc->osdmap->epoch);
+        if (newmap)
+                kick_requests(osdc, NULL);
+        up_read(&osdc->map_sem);
+        return;
+
+bad:
+        pr_err("osdc handle_map corrupt msg\n");
+        ceph_msg_dump(msg);
+        up_write(&osdc->map_sem);
+        return;
+}
+
+
+/*
+ * A read request prepares specific pages that data is to be read into.
+ * When a message is being read off the wire, we call prepare_pages to
+ * find those pages.
+ *  0 = success, -1 failure.
+ */
+static int __prepare_pages(struct ceph_connection *con,
+                         struct ceph_msg_header *hdr,
+                         struct ceph_osd_request *req,
+                         u64 tid,
+                         struct ceph_msg *m)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc;
+        int ret = -1;
+        int data_len = le32_to_cpu(hdr->data_len);
+        unsigned data_off = le16_to_cpu(hdr->data_off);
+
+        int want = calc_pages_for(data_off & ~PAGE_MASK, data_len);
+
+        if (!osd)
+                return -1;
+
+        osdc = osd->o_osdc;
+
+        dout("__prepare_pages on msg %p tid %llu, has %d pages, want %d\n", m,
+             tid, req->r_num_pages, want);
+        if (unlikely(req->r_num_pages < want))
+                goto out;
+        m->pages = req->r_pages;
+        m->nr_pages = req->r_num_pages;
+        ret = 0; /* success */
+out:
+        BUG_ON(ret < 0 || m->nr_pages < want);
+
+        return ret;
+}
+
+/*
+ * Register request, send initial attempt.
+ */
+int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+                            struct ceph_osd_request *req,
+                            bool nofail)
+{
+        int rc = 0;
+
+        req->r_request->pages = req->r_pages;
+        req->r_request->nr_pages = req->r_num_pages;
+
+        register_request(osdc, req);
+
+        down_read(&osdc->map_sem);
+        mutex_lock(&osdc->request_mutex);
+        /*
+         * a racing kick_requests() may have sent the message for us
+         * while we dropped request_mutex above, so only send now if
+         * the request still han't been touched yet.
+         */
+        if (req->r_sent == 0) {
+                rc = __send_request(osdc, req);
+                if (rc) {
+                        if (nofail) {
+                                dout("osdc_start_request failed send, "
+                                     " marking %lld\n", req->r_tid);
+                                req->r_resend = true;
+                                rc = 0;
+                        } else {
+                                __unregister_request(osdc, req);
+                        }
+                }
+        }
+        mutex_unlock(&osdc->request_mutex);
+        up_read(&osdc->map_sem);
+        return rc;
+}
+
+/*
+ * wait for a request to complete
+ */
+int ceph_osdc_wait_request(struct ceph_osd_client *osdc,
+                           struct ceph_osd_request *req)
+{
+        int rc;
+
+        rc = wait_for_completion_interruptible(&req->r_completion);
+        if (rc < 0) {
+                mutex_lock(&osdc->request_mutex);
+                __cancel_request(req);
+                __unregister_request(osdc, req);
+                mutex_unlock(&osdc->request_mutex);
+                dout("wait_request tid %llu canceled/timed out\n", req->r_tid);
+                return rc;
+        }
+
+        dout("wait_request tid %llu result %d\n", req->r_tid, req->r_result);
+        return req->r_result;
+}
+
+/*
+ * sync - wait for all in-flight requests to flush.  avoid starvation.
+ */
+void ceph_osdc_sync(struct ceph_osd_client *osdc)
+{
+        struct ceph_osd_request *req;
+        u64 last_tid, next_tid = 0;
+
+        mutex_lock(&osdc->request_mutex);
+        last_tid = osdc->last_tid;
+        while (1) {
+                req = __lookup_request_ge(osdc, next_tid);
+                if (!req)
+                        break;
+                if (req->r_tid > last_tid)
+                        break;
+
+                next_tid = req->r_tid + 1;
+                if ((req->r_flags & CEPH_OSD_FLAG_WRITE) == 0)
+                        continue;
+
+                ceph_osdc_get_request(req);
+                mutex_unlock(&osdc->request_mutex);
+                dout("sync waiting on tid %llu (last is %llu)\n",
+                     req->r_tid, last_tid);
+                wait_for_completion(&req->r_safe_completion);
+                mutex_lock(&osdc->request_mutex);
+                ceph_osdc_put_request(req);
+        }
+        mutex_unlock(&osdc->request_mutex);
+        dout("sync done (thru tid %llu)\n", last_tid);
+}
+
+/*
+ * init, shutdown
+ */
+int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
+{
+        int err;
+
+        dout("init\n");
+        osdc->client = client;
+        osdc->osdmap = NULL;
+        init_rwsem(&osdc->map_sem);
+        init_completion(&osdc->map_waiters);
+        osdc->last_requested_map = 0;
+        mutex_init(&osdc->request_mutex);
+        osdc->last_tid = 0;
+        osdc->osds = RB_ROOT;
+        INIT_LIST_HEAD(&osdc->osd_lru);
+        osdc->requests = RB_ROOT;
+        INIT_LIST_HEAD(&osdc->req_lru);
+        osdc->num_requests = 0;
+        INIT_DELAYED_WORK(&osdc->timeout_work, handle_timeout);
+        INIT_DELAYED_WORK(&osdc->osds_timeout_work, handle_osds_timeout);
+
+        schedule_delayed_work(&osdc->osds_timeout_work,
+           round_jiffies_relative(osdc->client->mount_args->osd_idle_ttl * HZ));
+
+        err = -ENOMEM;
+        osdc->req_mempool = mempool_create_kmalloc_pool(10,
+                                        sizeof(struct ceph_osd_request));
+        if (!osdc->req_mempool)
+                goto out;
+
+        err = ceph_msgpool_init(&osdc->msgpool_op, OSD_OP_FRONT_LEN, 10, true);
+        if (err < 0)
+                goto out_mempool;
+        err = ceph_msgpool_init(&osdc->msgpool_op_reply,
+                                OSD_OPREPLY_FRONT_LEN, 10, true);
+        if (err < 0)
+                goto out_msgpool;
+        return 0;
+
+out_msgpool:
+        ceph_msgpool_destroy(&osdc->msgpool_op);
+out_mempool:
+        mempool_destroy(osdc->req_mempool);
+out:
+        return err;
+}
+
+void ceph_osdc_stop(struct ceph_osd_client *osdc)
+{
+        cancel_delayed_work_sync(&osdc->timeout_work);
+        cancel_delayed_work_sync(&osdc->osds_timeout_work);
+        if (osdc->osdmap) {
+                ceph_osdmap_destroy(osdc->osdmap);
+                osdc->osdmap = NULL;
+        }
+        remove_old_osds(osdc, 1);
+        mempool_destroy(osdc->req_mempool);
+        ceph_msgpool_destroy(&osdc->msgpool_op);
+        ceph_msgpool_destroy(&osdc->msgpool_op_reply);
+}
+
+/*
+ * Read some contiguous pages.  If we cross a stripe boundary, shorten
+ * *plen.  Return number of bytes read, or error.
+ */
+int ceph_osdc_readpages(struct ceph_osd_client *osdc,
+                        struct ceph_vino vino, struct ceph_file_layout *layout,
+                        u64 off, u64 *plen,
+                        u32 truncate_seq, u64 truncate_size,
+                        struct page **pages, int num_pages)
+{
+        struct ceph_osd_request *req;
+        int rc = 0;
+
+        dout("readpages on ino %llx.%llx on %llu~%llu\n", vino.ino,
+             vino.snap, off, *plen);
+        req = ceph_osdc_new_request(osdc, layout, vino, off, plen,
+                                    CEPH_OSD_OP_READ, CEPH_OSD_FLAG_READ,
+                                    NULL, 0, truncate_seq, truncate_size, NULL,
+                                    false, 1);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+
+        /* it may be a short read due to an object boundary */
+        req->r_pages = pages;
+        num_pages = calc_pages_for(off, *plen);
+        req->r_num_pages = num_pages;
+
+        dout("readpages  final extent is %llu~%llu (%d pages)\n",
+             off, *plen, req->r_num_pages);
+
+        rc = ceph_osdc_start_request(osdc, req, false);
+        if (!rc)
+                rc = ceph_osdc_wait_request(osdc, req);
+
+        ceph_osdc_put_request(req);
+        dout("readpages result %d\n", rc);
+        return rc;
+}
+
+/*
+ * do a synchronous write on N pages
+ */
+int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
+                         struct ceph_file_layout *layout,
+                         struct ceph_snap_context *snapc,
+                         u64 off, u64 len,
+                         u32 truncate_seq, u64 truncate_size,
+                         struct timespec *mtime,
+                         struct page **pages, int num_pages,
+                         int flags, int do_sync, bool nofail)
+{
+        struct ceph_osd_request *req;
+        int rc = 0;
+
+        BUG_ON(vino.snap != CEPH_NOSNAP);
+        req = ceph_osdc_new_request(osdc, layout, vino, off, &len,
+                                    CEPH_OSD_OP_WRITE,
+                                    flags | CEPH_OSD_FLAG_ONDISK |
+                                            CEPH_OSD_FLAG_WRITE,
+                                    snapc, do_sync,
+                                    truncate_seq, truncate_size, mtime,
+                                    nofail, 1);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+
+        /* it may be a short write due to an object boundary */
+        req->r_pages = pages;
+        req->r_num_pages = calc_pages_for(off, len);
+        dout("writepages %llu~%llu (%d pages)\n", off, len,
+             req->r_num_pages);
+
+        rc = ceph_osdc_start_request(osdc, req, nofail);
+        if (!rc)
+                rc = ceph_osdc_wait_request(osdc, req);
+
+        ceph_osdc_put_request(req);
+        if (rc == 0)
+                rc = len;
+        dout("writepages result %d\n", rc);
+        return rc;
+}
+
+/*
+ * handle incoming message
+ */
+static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc;
+        int type = le16_to_cpu(msg->hdr.type);
+
+        if (!osd)
+                return;
+        osdc = osd->o_osdc;
+
+        switch (type) {
+        case CEPH_MSG_OSD_MAP:
+                ceph_osdc_handle_map(osdc, msg);
+                break;
+        case CEPH_MSG_OSD_OPREPLY:
+                handle_reply(osdc, msg, con);
+                break;
+
+        default:
+                pr_err("received unknown message type %d %s\n", type,
+                       ceph_msg_type_name(type));
+        }
+        ceph_msg_put(msg);
+}
+
+/*
+ * lookup and return message for incoming reply
+ */
+static struct ceph_msg *get_reply(struct ceph_connection *con,
+                                  struct ceph_msg_header *hdr,
+                                  int *skip)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc = osd->o_osdc;
+        struct ceph_msg *m;
+        struct ceph_osd_request *req;
+        int front = le32_to_cpu(hdr->front_len);
+        int data_len = le32_to_cpu(hdr->data_len);
+        u64 tid;
+        int err;
+
+        tid = le64_to_cpu(hdr->tid);
+        mutex_lock(&osdc->request_mutex);
+        req = __lookup_request(osdc, tid);
+        if (!req) {
+                *skip = 1;
+                m = NULL;
+                pr_info("get_reply unknown tid %llu from osd%d\n", tid,
+                        osd->o_osd);
+                goto out;
+        }
+
+        if (req->r_con_filling_msg) {
+                dout("get_reply revoking msg %p from old con %p\n",
+                     req->r_reply, req->r_con_filling_msg);
+                ceph_con_revoke_message(req->r_con_filling_msg, req->r_reply);
+                ceph_con_put(req->r_con_filling_msg);
+        }
+
+        if (front > req->r_reply->front.iov_len) {
+                pr_warning("get_reply front %d > preallocated %d\n",
+                           front, (int)req->r_reply->front.iov_len);
+                m = ceph_msg_new(CEPH_MSG_OSD_OPREPLY, front, 0, 0, NULL);
+                if (IS_ERR(m))
+                        goto out;
+                ceph_msg_put(req->r_reply);
+                req->r_reply = m;
+        }
+        m = ceph_msg_get(req->r_reply);
+
+        if (data_len > 0) {
+                err = __prepare_pages(con, hdr, req, tid, m);
+                if (err < 0) {
+                        *skip = 1;
+                        ceph_msg_put(m);
+                        m = ERR_PTR(err);
+                }
+        }
+        *skip = 0;
+        req->r_con_filling_msg = ceph_con_get(con);
+        dout("get_reply tid %lld %p\n", tid, m);
+
+out:
+        mutex_unlock(&osdc->request_mutex);
+        return m;
+
+}
+
+static struct ceph_msg *alloc_msg(struct ceph_connection *con,
+                                  struct ceph_msg_header *hdr,
+                                  int *skip)
+{
+        struct ceph_osd *osd = con->private;
+        int type = le16_to_cpu(hdr->type);
+        int front = le32_to_cpu(hdr->front_len);
+
+        switch (type) {
+        case CEPH_MSG_OSD_MAP:
+                return ceph_msg_new(type, front, 0, 0, NULL);
+        case CEPH_MSG_OSD_OPREPLY:
+                return get_reply(con, hdr, skip);
+        default:
+                pr_info("alloc_msg unexpected msg type %d from osd%d\n", type,
+                        osd->o_osd);
+                *skip = 1;
+                return NULL;
+        }
+}
+
+/*
+ * Wrappers to refcount containing ceph_osd struct
+ */
+static struct ceph_connection *get_osd_con(struct ceph_connection *con)
+{
+        struct ceph_osd *osd = con->private;
+        if (get_osd(osd))
+                return con;
+        return NULL;
+}
+
+static void put_osd_con(struct ceph_connection *con)
+{
+        struct ceph_osd *osd = con->private;
+        put_osd(osd);
+}
+
+/*
+ * authentication
+ */
+static int get_authorizer(struct ceph_connection *con,
+                          void **buf, int *len, int *proto,
+                          void **reply_buf, int *reply_len, int force_new)
+{
+        struct ceph_osd *o = con->private;
+        struct ceph_osd_client *osdc = o->o_osdc;
+        struct ceph_auth_client *ac = osdc->client->monc.auth;
+        int ret = 0;
+
+        if (force_new && o->o_authorizer) {
+                ac->ops->destroy_authorizer(ac, o->o_authorizer);
+                o->o_authorizer = NULL;
+        }
+        if (o->o_authorizer == NULL) {
+                ret = ac->ops->create_authorizer(
+                        ac, CEPH_ENTITY_TYPE_OSD,
+                        &o->o_authorizer,
+                        &o->o_authorizer_buf,
+                        &o->o_authorizer_buf_len,
+                        &o->o_authorizer_reply_buf,
+                        &o->o_authorizer_reply_buf_len);
+                if (ret)
+                return ret;
+        }
+
+        *proto = ac->protocol;
+        *buf = o->o_authorizer_buf;
+        *len = o->o_authorizer_buf_len;
+        *reply_buf = o->o_authorizer_reply_buf;
+        *reply_len = o->o_authorizer_reply_buf_len;
+        return 0;
+}
+
+
+static int verify_authorizer_reply(struct ceph_connection *con, int len)
+{
+        struct ceph_osd *o = con->private;
+        struct ceph_osd_client *osdc = o->o_osdc;
+        struct ceph_auth_client *ac = osdc->client->monc.auth;
+
+        return ac->ops->verify_authorizer_reply(ac, o->o_authorizer, len);
+}
+
+static int invalidate_authorizer(struct ceph_connection *con)
+{
+        struct ceph_osd *o = con->private;
+        struct ceph_osd_client *osdc = o->o_osdc;
+        struct ceph_auth_client *ac = osdc->client->monc.auth;
+
+        if (ac->ops->invalidate_authorizer)
+                ac->ops->invalidate_authorizer(ac, CEPH_ENTITY_TYPE_OSD);
+
+        return ceph_monc_validate_auth(&osdc->client->monc);
+}
+
+const static struct ceph_connection_operations osd_con_ops = {
+        .get = get_osd_con,
+        .put = put_osd_con,
+        .dispatch = dispatch,
+        .get_authorizer = get_authorizer,
+        .verify_authorizer_reply = verify_authorizer_reply,
+        .invalidate_authorizer = invalidate_authorizer,
+        .alloc_msg = alloc_msg,
+        .fault = osd_reset,
+};
diff --git a/fs/ceph/osd_client.h b/fs/ceph/osd_client.h
new file mode 100644
index 000000000000..b0759911e7c3
--- /dev/null
+++ b/fs/ceph/osd_client.h
@@ -0,0 +1,166 @@
+#ifndef _FS_CEPH_OSD_CLIENT_H
+#define _FS_CEPH_OSD_CLIENT_H
+
+#include <linux/completion.h>
+#include <linux/kref.h>
+#include <linux/mempool.h>
+#include <linux/rbtree.h>
+
+#include "types.h"
+#include "osdmap.h"
+#include "messenger.h"
+
+struct ceph_msg;
+struct ceph_snap_context;
+struct ceph_osd_request;
+struct ceph_osd_client;
+struct ceph_authorizer;
+
+/*
+ * completion callback for async writepages
+ */
+typedef void (*ceph_osdc_callback_t)(struct ceph_osd_request *,
+                                     struct ceph_msg *);
+
+/* a given osd we're communicating with */
+struct ceph_osd {
+        atomic_t o_ref;
+        struct ceph_osd_client *o_osdc;
+        int o_osd;
+        int o_incarnation;
+        struct rb_node o_node;
+        struct ceph_connection o_con;
+        struct list_head o_requests;
+        struct list_head o_osd_lru;
+        struct ceph_authorizer *o_authorizer;
+        void *o_authorizer_buf, *o_authorizer_reply_buf;
+        size_t o_authorizer_buf_len, o_authorizer_reply_buf_len;
+        unsigned long lru_ttl;
+        int o_marked_for_keepalive;
+        struct list_head o_keepalive_item;
+};
+
+/* an in-flight request */
+struct ceph_osd_request {
+        u64             r_tid;              /* unique for this client */
+        struct rb_node  r_node;
+        struct list_head r_req_lru_item;
+        struct list_head r_osd_item;
+        struct ceph_osd *r_osd;
+        struct ceph_pg   r_pgid;
+
+        struct ceph_connection *r_con_filling_msg;
+
+        struct ceph_msg  *r_request, *r_reply;
+        int               r_result;
+        int               r_flags;     /* any additional flags for the osd */
+        u32               r_sent;      /* >0 if r_request is sending/sent */
+        int               r_got_reply;
+
+        struct ceph_osd_client *r_osdc;
+        struct kref       r_kref;
+        bool              r_mempool;
+        struct completion r_completion, r_safe_completion;
+        ceph_osdc_callback_t r_callback, r_safe_callback;
+        struct ceph_eversion r_reassert_version;
+        struct list_head  r_unsafe_item;
+
+        struct inode *r_inode;                /* for use by callbacks */
+        struct writeback_control *r_wbc;      /* ditto */
+
+        char              r_oid[40];          /* object name */
+        int               r_oid_len;
+        unsigned long     r_stamp;            /* send OR check time */
+        bool              r_resend;           /* msg send failed, needs retry */
+
+        struct ceph_file_layout r_file_layout;
+        struct ceph_snap_context *r_snapc;    /* snap context for writes */
+        unsigned          r_num_pages;        /* size of page array (follows) */
+        struct page     **r_pages;            /* pages for data payload */
+        int               r_pages_from_pool;
+        int               r_own_pages;        /* if true, i own page list */
+};
+
+struct ceph_osd_client {
+        struct ceph_client     *client;
+
+        struct ceph_osdmap     *osdmap;       /* current map */
+        struct rw_semaphore    map_sem;
+        struct completion      map_waiters;
+        u64                    last_requested_map;
+
+        struct mutex           request_mutex;
+        struct rb_root         osds;          /* osds */
+        struct list_head       osd_lru;       /* idle osds */
+        u64                    timeout_tid;   /* tid of timeout triggering rq */
+        u64                    last_tid;      /* tid of last request */
+        struct rb_root         requests;      /* pending requests */
+        struct list_head       req_lru;       /* pending requests lru */
+        int                    num_requests;
+        struct delayed_work    timeout_work;
+        struct delayed_work    osds_timeout_work;
+#ifdef CONFIG_DEBUG_FS
+        struct dentry          *debugfs_file;
+#endif
+
+        mempool_t              *req_mempool;
+
+        struct ceph_msgpool     msgpool_op;
+        struct ceph_msgpool     msgpool_op_reply;
+};
+
+extern int ceph_osdc_init(struct ceph_osd_client *osdc,
+                          struct ceph_client *client);
+extern void ceph_osdc_stop(struct ceph_osd_client *osdc);
+
+extern void ceph_osdc_handle_reply(struct ceph_osd_client *osdc,
+                                   struct ceph_msg *msg);
+extern void ceph_osdc_handle_map(struct ceph_osd_client *osdc,
+                                 struct ceph_msg *msg);
+
+extern struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *,
+                                      struct ceph_file_layout *layout,
+                                      struct ceph_vino vino,
+                                      u64 offset, u64 *len, int op, int flags,
+                                      struct ceph_snap_context *snapc,
+                                      int do_sync, u32 truncate_seq,
+                                      u64 truncate_size,
+                                      struct timespec *mtime,
+                                      bool use_mempool, int num_reply);
+
+static inline void ceph_osdc_get_request(struct ceph_osd_request *req)
+{
+        kref_get(&req->r_kref);
+}
+extern void ceph_osdc_release_request(struct kref *kref);
+static inline void ceph_osdc_put_request(struct ceph_osd_request *req)
+{
+        kref_put(&req->r_kref, ceph_osdc_release_request);
+}
+
+extern int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+                                   struct ceph_osd_request *req,
+                                   bool nofail);
+extern int ceph_osdc_wait_request(struct ceph_osd_client *osdc,
+                                  struct ceph_osd_request *req);
+extern void ceph_osdc_sync(struct ceph_osd_client *osdc);
+
+extern int ceph_osdc_readpages(struct ceph_osd_client *osdc,
+                               struct ceph_vino vino,
+                               struct ceph_file_layout *layout,
+                               u64 off, u64 *plen,
+                               u32 truncate_seq, u64 truncate_size,
+                               struct page **pages, int nr_pages);
+
+extern int ceph_osdc_writepages(struct ceph_osd_client *osdc,
+                                struct ceph_vino vino,
+                                struct ceph_file_layout *layout,
+                                struct ceph_snap_context *sc,
+                                u64 off, u64 len,
+                                u32 truncate_seq, u64 truncate_size,
+                                struct timespec *mtime,
+                                struct page **pages, int nr_pages,
+                                int flags, int do_sync, bool nofail);
+
+#endif
+
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
new file mode 100644
index 000000000000..2e2c15eed82a
--- /dev/null
+++ b/fs/ceph/osdmap.c
@@ -0,0 +1,1062 @@
+
+#include "ceph_debug.h"
+
+#include <linux/slab.h>
+#include <asm/div64.h>
+
+#include "super.h"
+#include "osdmap.h"
+#include "crush/hash.h"
+#include "crush/mapper.h"
+#include "decode.h"
+
+char *ceph_osdmap_state_str(char *str, int len, int state)
+{
+        int flag = 0;
+
+        if (!len)
+                goto done;
+
+        *str = '\0';
+        if (state) {
+                if (state & CEPH_OSD_EXISTS) {
+                        snprintf(str, len, "exists");
+                        flag = 1;
+                }
+                if (state & CEPH_OSD_UP) {
+                        snprintf(str, len, "%s%s%s", str, (flag ? ", " : ""),
+                                 "up");
+                        flag = 1;
+                }
+        } else {
+                snprintf(str, len, "doesn't exist");
+        }
+done:
+        return str;
+}
+
+/* maps */
+
+static int calc_bits_of(unsigned t)
+{
+        int b = 0;
+        while (t) {
+                t = t >> 1;
+                b++;
+        }
+        return b;
+}
+
+/*
+ * the foo_mask is the smallest value 2^n-1 that is >= foo.
+ */
+static void calc_pg_masks(struct ceph_pg_pool_info *pi)
+{
+        pi->pg_num_mask = (1 << calc_bits_of(le32_to_cpu(pi->v.pg_num)-1)) - 1;
+        pi->pgp_num_mask =
+                (1 << calc_bits_of(le32_to_cpu(pi->v.pgp_num)-1)) - 1;
+        pi->lpg_num_mask =
+                (1 << calc_bits_of(le32_to_cpu(pi->v.lpg_num)-1)) - 1;
+        pi->lpgp_num_mask =
+                (1 << calc_bits_of(le32_to_cpu(pi->v.lpgp_num)-1)) - 1;
+}
+
+/*
+ * decode crush map
+ */
+static int crush_decode_uniform_bucket(void **p, void *end,
+                                       struct crush_bucket_uniform *b)
+{
+        dout("crush_decode_uniform_bucket %p to %p\n", *p, end);
+        ceph_decode_need(p, end, (1+b->h.size) * sizeof(u32), bad);
+        b->item_weight = ceph_decode_32(p);
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static int crush_decode_list_bucket(void **p, void *end,
+                                    struct crush_bucket_list *b)
+{
+        int j;
+        dout("crush_decode_list_bucket %p to %p\n", *p, end);
+        b->item_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->item_weights == NULL)
+                return -ENOMEM;
+        b->sum_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->sum_weights == NULL)
+                return -ENOMEM;
+        ceph_decode_need(p, end, 2 * b->h.size * sizeof(u32), bad);
+        for (j = 0; j < b->h.size; j++) {
+                b->item_weights[j] = ceph_decode_32(p);
+                b->sum_weights[j] = ceph_decode_32(p);
+        }
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static int crush_decode_tree_bucket(void **p, void *end,
+                                    struct crush_bucket_tree *b)
+{
+        int j;
+        dout("crush_decode_tree_bucket %p to %p\n", *p, end);
+        ceph_decode_32_safe(p, end, b->num_nodes, bad);
+        b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
+        if (b->node_weights == NULL)
+                return -ENOMEM;
+        ceph_decode_need(p, end, b->num_nodes * sizeof(u32), bad);
+        for (j = 0; j < b->num_nodes; j++)
+                b->node_weights[j] = ceph_decode_32(p);
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static int crush_decode_straw_bucket(void **p, void *end,
+                                     struct crush_bucket_straw *b)
+{
+        int j;
+        dout("crush_decode_straw_bucket %p to %p\n", *p, end);
+        b->item_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->item_weights == NULL)
+                return -ENOMEM;
+        b->straws = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->straws == NULL)
+                return -ENOMEM;
+        ceph_decode_need(p, end, 2 * b->h.size * sizeof(u32), bad);
+        for (j = 0; j < b->h.size; j++) {
+                b->item_weights[j] = ceph_decode_32(p);
+                b->straws[j] = ceph_decode_32(p);
+        }
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static struct crush_map *crush_decode(void *pbyval, void *end)
+{
+        struct crush_map *c;
+        int err = -EINVAL;
+        int i, j;
+        void **p = &pbyval;
+        void *start = pbyval;
+        u32 magic;
+
+        dout("crush_decode %p to %p len %d\n", *p, end, (int)(end - *p));
+
+        c = kzalloc(sizeof(*c), GFP_NOFS);
+        if (c == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        ceph_decode_need(p, end, 4*sizeof(u32), bad);
+        magic = ceph_decode_32(p);
+        if (magic != CRUSH_MAGIC) {
+                pr_err("crush_decode magic %x != current %x\n",
+                       (unsigned)magic, (unsigned)CRUSH_MAGIC);
+                goto bad;
+        }
+        c->max_buckets = ceph_decode_32(p);
+        c->max_rules = ceph_decode_32(p);
+        c->max_devices = ceph_decode_32(p);
+
+        c->device_parents = kcalloc(c->max_devices, sizeof(u32), GFP_NOFS);
+        if (c->device_parents == NULL)
+                goto badmem;
+        c->bucket_parents = kcalloc(c->max_buckets, sizeof(u32), GFP_NOFS);
+        if (c->bucket_parents == NULL)
+                goto badmem;
+
+        c->buckets = kcalloc(c->max_buckets, sizeof(*c->buckets), GFP_NOFS);
+        if (c->buckets == NULL)
+                goto badmem;
+        c->rules = kcalloc(c->max_rules, sizeof(*c->rules), GFP_NOFS);
+        if (c->rules == NULL)
+                goto badmem;
+
+        /* buckets */
+        for (i = 0; i < c->max_buckets; i++) {
+                int size = 0;
+                u32 alg;
+                struct crush_bucket *b;
+
+                ceph_decode_32_safe(p, end, alg, bad);
+                if (alg == 0) {
+                        c->buckets[i] = NULL;
+                        continue;
+                }
+                dout("crush_decode bucket %d off %x %p to %p\n",
+                     i, (int)(*p-start), *p, end);
+
+                switch (alg) {
+                case CRUSH_BUCKET_UNIFORM:
+                        size = sizeof(struct crush_bucket_uniform);
+                        break;
+                case CRUSH_BUCKET_LIST:
+                        size = sizeof(struct crush_bucket_list);
+                        break;
+                case CRUSH_BUCKET_TREE:
+                        size = sizeof(struct crush_bucket_tree);
+                        break;
+                case CRUSH_BUCKET_STRAW:
+                        size = sizeof(struct crush_bucket_straw);
+                        break;
+                default:
+                        err = -EINVAL;
+                        goto bad;
+                }
+                BUG_ON(size == 0);
+                b = c->buckets[i] = kzalloc(size, GFP_NOFS);
+                if (b == NULL)
+                        goto badmem;
+
+                ceph_decode_need(p, end, 4*sizeof(u32), bad);
+                b->id = ceph_decode_32(p);
+                b->type = ceph_decode_16(p);
+                b->alg = ceph_decode_8(p);
+                b->hash = ceph_decode_8(p);
+                b->weight = ceph_decode_32(p);
+                b->size = ceph_decode_32(p);
+
+                dout("crush_decode bucket size %d off %x %p to %p\n",
+                     b->size, (int)(*p-start), *p, end);
+
+                b->items = kcalloc(b->size, sizeof(__s32), GFP_NOFS);
+                if (b->items == NULL)
+                        goto badmem;
+                b->perm = kcalloc(b->size, sizeof(u32), GFP_NOFS);
+                if (b->perm == NULL)
+                        goto badmem;
+                b->perm_n = 0;
+
+                ceph_decode_need(p, end, b->size*sizeof(u32), bad);
+                for (j = 0; j < b->size; j++)
+                        b->items[j] = ceph_decode_32(p);
+
+                switch (b->alg) {
+                case CRUSH_BUCKET_UNIFORM:
+                        err = crush_decode_uniform_bucket(p, end,
+                                  (struct crush_bucket_uniform *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                case CRUSH_BUCKET_LIST:
+                        err = crush_decode_list_bucket(p, end,
+                               (struct crush_bucket_list *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                case CRUSH_BUCKET_TREE:
+                        err = crush_decode_tree_bucket(p, end,
+                                (struct crush_bucket_tree *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                case CRUSH_BUCKET_STRAW:
+                        err = crush_decode_straw_bucket(p, end,
+                                (struct crush_bucket_straw *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                }
+        }
+
+        /* rules */
+        dout("rule vec is %p\n", c->rules);
+        for (i = 0; i < c->max_rules; i++) {
+                u32 yes;
+                struct crush_rule *r;
+
+                ceph_decode_32_safe(p, end, yes, bad);
+                if (!yes) {
+                        dout("crush_decode NO rule %d off %x %p to %p\n",
+                             i, (int)(*p-start), *p, end);
+                        c->rules[i] = NULL;
+                        continue;
+                }
+
+                dout("crush_decode rule %d off %x %p to %p\n",
+                     i, (int)(*p-start), *p, end);
+
+                /* len */
+                ceph_decode_32_safe(p, end, yes, bad);
+#if BITS_PER_LONG == 32
+                err = -EINVAL;
+                if (yes > ULONG_MAX / sizeof(struct crush_rule_step))
+                        goto bad;
+#endif
+                r = c->rules[i] = kmalloc(sizeof(*r) +
+                                          yes*sizeof(struct crush_rule_step),
+                                          GFP_NOFS);
+                if (r == NULL)
+                        goto badmem;
+                dout(" rule %d is at %p\n", i, r);
+                r->len = yes;
+                ceph_decode_copy_safe(p, end, &r->mask, 4, bad); /* 4 u8's */
+                ceph_decode_need(p, end, r->len*3*sizeof(u32), bad);
+                for (j = 0; j < r->len; j++) {
+                        r->steps[j].op = ceph_decode_32(p);
+                        r->steps[j].arg1 = ceph_decode_32(p);
+                        r->steps[j].arg2 = ceph_decode_32(p);
+                }
+        }
+
+        /* ignore trailing name maps. */
+
+        dout("crush_decode success\n");
+        return c;
+
+badmem:
+        err = -ENOMEM;
+bad:
+        dout("crush_decode fail %d\n", err);
+        crush_destroy(c);
+        return ERR_PTR(err);
+}
+
+/*
+ * rbtree of pg_mapping for handling pg_temp (explicit mapping of pgid
+ * to a set of osds)
+ */
+static int pgid_cmp(struct ceph_pg l, struct ceph_pg r)
+{
+        u64 a = *(u64 *)&l;
+        u64 b = *(u64 *)&r;
+
+        if (a < b)
+                return -1;
+        if (a > b)
+                return 1;
+        return 0;
+}
+
+static int __insert_pg_mapping(struct ceph_pg_mapping *new,
+                               struct rb_root *root)
+{
+        struct rb_node **p = &root->rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_pg_mapping *pg = NULL;
+        int c;
+
+        while (*p) {
+                parent = *p;
+                pg = rb_entry(parent, struct ceph_pg_mapping, node);
+                c = pgid_cmp(new->pgid, pg->pgid);
+                if (c < 0)
+                        p = &(*p)->rb_left;
+                else if (c > 0)
+                        p = &(*p)->rb_right;
+                else
+                        return -EEXIST;
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, root);
+        return 0;
+}
+
+static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
+                                                   struct ceph_pg pgid)
+{
+        struct rb_node *n = root->rb_node;
+        struct ceph_pg_mapping *pg;
+        int c;
+
+        while (n) {
+                pg = rb_entry(n, struct ceph_pg_mapping, node);
+                c = pgid_cmp(pgid, pg->pgid);
+                if (c < 0)
+                        n = n->rb_left;
+                else if (c > 0)
+                        n = n->rb_right;
+                else
+                        return pg;
+        }
+        return NULL;
+}
+
+/*
+ * rbtree of pg pool info
+ */
+static int __insert_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *new)
+{
+        struct rb_node **p = &root->rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_pg_pool_info *pi = NULL;
+
+        while (*p) {
+                parent = *p;
+                pi = rb_entry(parent, struct ceph_pg_pool_info, node);
+                if (new->id < pi->id)
+                        p = &(*p)->rb_left;
+                else if (new->id > pi->id)
+                        p = &(*p)->rb_right;
+                else
+                        return -EEXIST;
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, root);
+        return 0;
+}
+
+static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, int id)
+{
+        struct ceph_pg_pool_info *pi;
+        struct rb_node *n = root->rb_node;
+
+        while (n) {
+                pi = rb_entry(n, struct ceph_pg_pool_info, node);
+                if (id < pi->id)
+                        n = n->rb_left;
+                else if (id > pi->id)
+                        n = n->rb_right;
+                else
+                        return pi;
+        }
+        return NULL;
+}
+
+static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
+{
+        rb_erase(&pi->node, root);
+        kfree(pi->name);
+        kfree(pi);
+}
+
+void __decode_pool(void **p, struct ceph_pg_pool_info *pi)
+{
+        ceph_decode_copy(p, &pi->v, sizeof(pi->v));
+        calc_pg_masks(pi);
+        *p += le32_to_cpu(pi->v.num_snaps) * sizeof(u64);
+        *p += le32_to_cpu(pi->v.num_removed_snap_intervals) * sizeof(u64) * 2;
+}
+
+static int __decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
+{
+        struct ceph_pg_pool_info *pi;
+        u32 num, len, pool;
+
+        ceph_decode_32_safe(p, end, num, bad);
+        dout(" %d pool names\n", num);
+        while (num--) {
+                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_32_safe(p, end, len, bad);
+                dout("  pool %d len %d\n", pool, len);
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (pi) {
+                        kfree(pi->name);
+                        pi->name = kmalloc(len + 1, GFP_NOFS);
+                        if (pi->name) {
+                                memcpy(pi->name, *p, len);
+                                pi->name[len] = '\0';
+                                dout("  name is %s\n", pi->name);
+                        }
+                }
+                *p += len;
+        }
+        return 0;
+
+bad:
+        return -EINVAL;
+}
+
+/*
+ * osd map
+ */
+void ceph_osdmap_destroy(struct ceph_osdmap *map)
+{
+        dout("osdmap_destroy %p\n", map);
+        if (map->crush)
+                crush_destroy(map->crush);
+        while (!RB_EMPTY_ROOT(&map->pg_temp)) {
+                struct ceph_pg_mapping *pg =
+                        rb_entry(rb_first(&map->pg_temp),
+                                 struct ceph_pg_mapping, node);
+                rb_erase(&pg->node, &map->pg_temp);
+                kfree(pg);
+        }
+        while (!RB_EMPTY_ROOT(&map->pg_pools)) {
+                struct ceph_pg_pool_info *pi =
+                        rb_entry(rb_first(&map->pg_pools),
+                                 struct ceph_pg_pool_info, node);
+                __remove_pg_pool(&map->pg_pools, pi);
+        }
+        kfree(map->osd_state);
+        kfree(map->osd_weight);
+        kfree(map->osd_addr);
+        kfree(map);
+}
+
+/*
+ * adjust max osd value.  reallocate arrays.
+ */
+static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
+{
+        u8 *state;
+        struct ceph_entity_addr *addr;
+        u32 *weight;
+
+        state = kcalloc(max, sizeof(*state), GFP_NOFS);
+        addr = kcalloc(max, sizeof(*addr), GFP_NOFS);
+        weight = kcalloc(max, sizeof(*weight), GFP_NOFS);
+        if (state == NULL || addr == NULL || weight == NULL) {
+                kfree(state);
+                kfree(addr);
+                kfree(weight);
+                return -ENOMEM;
+        }
+
+        /* copy old? */
+        if (map->osd_state) {
+                memcpy(state, map->osd_state, map->max_osd*sizeof(*state));
+                memcpy(addr, map->osd_addr, map->max_osd*sizeof(*addr));
+                memcpy(weight, map->osd_weight, map->max_osd*sizeof(*weight));
+                kfree(map->osd_state);
+                kfree(map->osd_addr);
+                kfree(map->osd_weight);
+        }
+
+        map->osd_state = state;
+        map->osd_weight = weight;
+        map->osd_addr = addr;
+        map->max_osd = max;
+        return 0;
+}
+
+/*
+ * decode a full map.
+ */
+struct ceph_osdmap *osdmap_decode(void **p, void *end)
+{
+        struct ceph_osdmap *map;
+        u16 version;
+        u32 len, max, i;
+        u8 ev;
+        int err = -EINVAL;
+        void *start = *p;
+        struct ceph_pg_pool_info *pi;
+
+        dout("osdmap_decode %p to %p len %d\n", *p, end, (int)(end - *p));
+
+        map = kzalloc(sizeof(*map), GFP_NOFS);
+        if (map == NULL)
+                return ERR_PTR(-ENOMEM);
+        map->pg_temp = RB_ROOT;
+
+        ceph_decode_16_safe(p, end, version, bad);
+        if (version > CEPH_OSDMAP_VERSION) {
+                pr_warning("got unknown v %d > %d of osdmap\n", version,
+                           CEPH_OSDMAP_VERSION);
+                goto bad;
+        }
+
+        ceph_decode_need(p, end, 2*sizeof(u64)+6*sizeof(u32), bad);
+        ceph_decode_copy(p, &map->fsid, sizeof(map->fsid));
+        map->epoch = ceph_decode_32(p);
+        ceph_decode_copy(p, &map->created, sizeof(map->created));
+        ceph_decode_copy(p, &map->modified, sizeof(map->modified));
+
+        ceph_decode_32_safe(p, end, max, bad);
+        while (max--) {
+                ceph_decode_need(p, end, 4 + 1 + sizeof(pi->v), bad);
+                pi = kzalloc(sizeof(*pi), GFP_NOFS);
+                if (!pi)
+                        goto bad;
+                pi->id = ceph_decode_32(p);
+                ev = ceph_decode_8(p); /* encoding version */
+                if (ev > CEPH_PG_POOL_VERSION) {
+                        pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
+                                   ev, CEPH_PG_POOL_VERSION);
+                        goto bad;
+                }
+                __decode_pool(p, pi);
+                __insert_pg_pool(&map->pg_pools, pi);
+        }
+
+        if (version >= 5 && __decode_pool_names(p, end, map) < 0)
+                goto bad;
+
+        ceph_decode_32_safe(p, end, map->pool_max, bad);
+
+        ceph_decode_32_safe(p, end, map->flags, bad);
+
+        max = ceph_decode_32(p);
+
+        /* (re)alloc osd arrays */
+        err = osdmap_set_max_osd(map, max);
+        if (err < 0)
+                goto bad;
+        dout("osdmap_decode max_osd = %d\n", map->max_osd);
+
+        /* osds */
+        err = -EINVAL;
+        ceph_decode_need(p, end, 3*sizeof(u32) +
+                         map->max_osd*(1 + sizeof(*map->osd_weight) +
+                                       sizeof(*map->osd_addr)), bad);
+        *p += 4; /* skip length field (should match max) */
+        ceph_decode_copy(p, map->osd_state, map->max_osd);
+
+        *p += 4; /* skip length field (should match max) */
+        for (i = 0; i < map->max_osd; i++)
+                map->osd_weight[i] = ceph_decode_32(p);
+
+        *p += 4; /* skip length field (should match max) */
+        ceph_decode_copy(p, map->osd_addr, map->max_osd*sizeof(*map->osd_addr));
+        for (i = 0; i < map->max_osd; i++)
+                ceph_decode_addr(&map->osd_addr[i]);
+
+        /* pg_temp */
+        ceph_decode_32_safe(p, end, len, bad);
+        for (i = 0; i < len; i++) {
+                int n, j;
+                struct ceph_pg pgid;
+                struct ceph_pg_mapping *pg;
+
+                ceph_decode_need(p, end, sizeof(u32) + sizeof(u64), bad);
+                ceph_decode_copy(p, &pgid, sizeof(pgid));
+                n = ceph_decode_32(p);
+                ceph_decode_need(p, end, n * sizeof(u32), bad);
+                err = -ENOMEM;
+                pg = kmalloc(sizeof(*pg) + n*sizeof(u32), GFP_NOFS);
+                if (!pg)
+                        goto bad;
+                pg->pgid = pgid;
+                pg->len = n;
+                for (j = 0; j < n; j++)
+                        pg->osds[j] = ceph_decode_32(p);
+
+                err = __insert_pg_mapping(pg, &map->pg_temp);
+                if (err)
+                        goto bad;
+                dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid, len);
+        }
+
+        /* crush */
+        ceph_decode_32_safe(p, end, len, bad);
+        dout("osdmap_decode crush len %d from off 0x%x\n", len,
+             (int)(*p - start));
+        ceph_decode_need(p, end, len, bad);
+        map->crush = crush_decode(*p, end);
+        *p += len;
+        if (IS_ERR(map->crush)) {
+                err = PTR_ERR(map->crush);
+                map->crush = NULL;
+                goto bad;
+        }
+
+        /* ignore the rest of the map */
+        *p = end;
+
+        dout("osdmap_decode done %p %p\n", *p, end);
+        return map;
+
+bad:
+        dout("osdmap_decode fail\n");
+        ceph_osdmap_destroy(map);
+        return ERR_PTR(err);
+}
+
+/*
+ * decode and apply an incremental map update.
+ */
+struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
+                                             struct ceph_osdmap *map,
+                                             struct ceph_messenger *msgr)
+{
+        struct crush_map *newcrush = NULL;
+        struct ceph_fsid fsid;
+        u32 epoch = 0;
+        struct ceph_timespec modified;
+        u32 len, pool;
+        __s32 new_pool_max, new_flags, max;
+        void *start = *p;
+        int err = -EINVAL;
+        u16 version;
+        struct rb_node *rbp;
+
+        ceph_decode_16_safe(p, end, version, bad);
+        if (version > CEPH_OSDMAP_INC_VERSION) {
+                pr_warning("got unknown v %d > %d of inc osdmap\n", version,
+                           CEPH_OSDMAP_INC_VERSION);
+                goto bad;
+        }
+
+        ceph_decode_need(p, end, sizeof(fsid)+sizeof(modified)+2*sizeof(u32),
+                         bad);
+        ceph_decode_copy(p, &fsid, sizeof(fsid));
+        epoch = ceph_decode_32(p);
+        BUG_ON(epoch != map->epoch+1);
+        ceph_decode_copy(p, &modified, sizeof(modified));
+        new_pool_max = ceph_decode_32(p);
+        new_flags = ceph_decode_32(p);
+
+        /* full map? */
+        ceph_decode_32_safe(p, end, len, bad);
+        if (len > 0) {
+                dout("apply_incremental full map len %d, %p to %p\n",
+                     len, *p, end);
+                return osdmap_decode(p, min(*p+len, end));
+        }
+
+        /* new crush? */
+        ceph_decode_32_safe(p, end, len, bad);
+        if (len > 0) {
+                dout("apply_incremental new crush map len %d, %p to %p\n",
+                     len, *p, end);
+                newcrush = crush_decode(*p, min(*p+len, end));
+                if (IS_ERR(newcrush))
+                        return ERR_PTR(PTR_ERR(newcrush));
+        }
+
+        /* new flags? */
+        if (new_flags >= 0)
+                map->flags = new_flags;
+        if (new_pool_max >= 0)
+                map->pool_max = new_pool_max;
+
+        ceph_decode_need(p, end, 5*sizeof(u32), bad);
+
+        /* new max? */
+        max = ceph_decode_32(p);
+        if (max >= 0) {
+                err = osdmap_set_max_osd(map, max);
+                if (err < 0)
+                        goto bad;
+        }
+
+        map->epoch++;
+        map->modified = map->modified;
+        if (newcrush) {
+                if (map->crush)
+                        crush_destroy(map->crush);
+                map->crush = newcrush;
+                newcrush = NULL;
+        }
+
+        /* new_pool */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                __u8 ev;
+                struct ceph_pg_pool_info *pi;
+
+                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_need(p, end, 1 + sizeof(pi->v), bad);
+                ev = ceph_decode_8(p);  /* encoding version */
+                if (ev > CEPH_PG_POOL_VERSION) {
+                        pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
+                                   ev, CEPH_PG_POOL_VERSION);
+                        goto bad;
+                }
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (!pi) {
+                        pi = kzalloc(sizeof(*pi), GFP_NOFS);
+                        if (!pi) {
+                                err = -ENOMEM;
+                                goto bad;
+                        }
+                        pi->id = pool;
+                        __insert_pg_pool(&map->pg_pools, pi);
+                }
+                __decode_pool(p, pi);
+        }
+        if (version >= 5 && __decode_pool_names(p, end, map) < 0)
+                goto bad;
+
+        /* old_pool */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                struct ceph_pg_pool_info *pi;
+
+                ceph_decode_32_safe(p, end, pool, bad);
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (pi)
+                        __remove_pg_pool(&map->pg_pools, pi);
+        }
+
+        /* new_up */
+        err = -EINVAL;
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                u32 osd;
+                struct ceph_entity_addr addr;
+                ceph_decode_32_safe(p, end, osd, bad);
+                ceph_decode_copy_safe(p, end, &addr, sizeof(addr), bad);
+                ceph_decode_addr(&addr);
+                pr_info("osd%d up\n", osd);
+                BUG_ON(osd >= map->max_osd);
+                map->osd_state[osd] |= CEPH_OSD_UP;
+                map->osd_addr[osd] = addr;
+        }
+
+        /* new_down */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                u32 osd;
+                ceph_decode_32_safe(p, end, osd, bad);
+                (*p)++;  /* clean flag */
+                pr_info("osd%d down\n", osd);
+                if (osd < map->max_osd)
+                        map->osd_state[osd] &= ~CEPH_OSD_UP;
+        }
+
+        /* new_weight */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                u32 osd, off;
+                ceph_decode_need(p, end, sizeof(u32)*2, bad);
+                osd = ceph_decode_32(p);
+                off = ceph_decode_32(p);
+                pr_info("osd%d weight 0x%x %s\n", osd, off,
+                     off == CEPH_OSD_IN ? "(in)" :
+                     (off == CEPH_OSD_OUT ? "(out)" : ""));
+                if (osd < map->max_osd)
+                        map->osd_weight[osd] = off;
+        }
+
+        /* new_pg_temp */
+        rbp = rb_first(&map->pg_temp);
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                struct ceph_pg_mapping *pg;
+                int j;
+                struct ceph_pg pgid;
+                u32 pglen;
+                ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
+                ceph_decode_copy(p, &pgid, sizeof(pgid));
+                pglen = ceph_decode_32(p);
+
+                /* remove any? */
+                while (rbp && pgid_cmp(rb_entry(rbp, struct ceph_pg_mapping,
+                                                node)->pgid, pgid) <= 0) {
+                        struct rb_node *cur = rbp;
+                        rbp = rb_next(rbp);
+                        dout(" removed pg_temp %llx\n",
+                             *(u64 *)&rb_entry(cur, struct ceph_pg_mapping,
+                                               node)->pgid);
+                        rb_erase(cur, &map->pg_temp);
+                }
+
+                if (pglen) {
+                        /* insert */
+                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
+                        pg = kmalloc(sizeof(*pg) + sizeof(u32)*pglen, GFP_NOFS);
+                        if (!pg) {
+                                err = -ENOMEM;
+                                goto bad;
+                        }
+                        pg->pgid = pgid;
+                        pg->len = pglen;
+                        for (j = 0; j < pglen; j++)
+                                pg->osds[j] = ceph_decode_32(p);
+                        err = __insert_pg_mapping(pg, &map->pg_temp);
+                        if (err)
+                                goto bad;
+                        dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
+                             pglen);
+                }
+        }
+        while (rbp) {
+                struct rb_node *cur = rbp;
+                rbp = rb_next(rbp);
+                dout(" removed pg_temp %llx\n",
+                     *(u64 *)&rb_entry(cur, struct ceph_pg_mapping,
+                                       node)->pgid);
+                rb_erase(cur, &map->pg_temp);
+        }
+
+        /* ignore the rest */
+        *p = end;
+        return map;
+
+bad:
+        pr_err("corrupt inc osdmap epoch %d off %d (%p of %p-%p)\n",
+               epoch, (int)(*p - start), *p, start, end);
+        print_hex_dump(KERN_DEBUG, "osdmap: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       start, end - start, true);
+        if (newcrush)
+                crush_destroy(newcrush);
+        return ERR_PTR(err);
+}
+
+
+
+
+/*
+ * calculate file layout from given offset, length.
+ * fill in correct oid, logical length, and object extent
+ * offset, length.
+ *
+ * for now, we write only a single su, until we can
+ * pass a stride back to the caller.
+ */
+void ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
+                                   u64 off, u64 *plen,
+                                   u64 *ono,
+                                   u64 *oxoff, u64 *oxlen)
+{
+        u32 osize = le32_to_cpu(layout->fl_object_size);
+        u32 su = le32_to_cpu(layout->fl_stripe_unit);
+        u32 sc = le32_to_cpu(layout->fl_stripe_count);
+        u32 bl, stripeno, stripepos, objsetno;
+        u32 su_per_object;
+        u64 t, su_offset;
+
+        dout("mapping %llu~%llu  osize %u fl_su %u\n", off, *plen,
+             osize, su);
+        su_per_object = osize / su;
+        dout("osize %u / su %u = su_per_object %u\n", osize, su,
+             su_per_object);
+
+        BUG_ON((su & ~PAGE_MASK) != 0);
+        /* bl = *off / su; */
+        t = off;
+        do_div(t, su);
+        bl = t;
+        dout("off %llu / su %u = bl %u\n", off, su, bl);
+
+        stripeno = bl / sc;
+        stripepos = bl % sc;
+        objsetno = stripeno / su_per_object;
+
+        *ono = objsetno * sc + stripepos;
+        dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned)*ono);
+
+        /* *oxoff = *off % layout->fl_stripe_unit;  # offset in su */
+        t = off;
+        su_offset = do_div(t, su);
+        *oxoff = su_offset + (stripeno % su_per_object) * su;
+
+        /*
+         * Calculate the length of the extent being written to the selected
+         * object. This is the minimum of the full length requested (plen) or
+         * the remainder of the current stripe being written to.
+         */
+        *oxlen = min_t(u64, *plen, su - su_offset);
+        *plen = *oxlen;
+
+        dout(" obj extent %llu~%llu\n", *oxoff, *oxlen);
+}
+
+/*
+ * calculate an object layout (i.e. pgid) from an oid,
+ * file_layout, and osdmap
+ */
+int ceph_calc_object_layout(struct ceph_object_layout *ol,
+                            const char *oid,
+                            struct ceph_file_layout *fl,
+                            struct ceph_osdmap *osdmap)
+{
+        unsigned num, num_mask;
+        struct ceph_pg pgid;
+        s32 preferred = (s32)le32_to_cpu(fl->fl_pg_preferred);
+        int poolid = le32_to_cpu(fl->fl_pg_pool);
+        struct ceph_pg_pool_info *pool;
+        unsigned ps;
+
+        BUG_ON(!osdmap);
+
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return -EIO;
+        ps = ceph_str_hash(pool->v.object_hash, oid, strlen(oid));
+        if (preferred >= 0) {
+                ps += preferred;
+                num = le32_to_cpu(pool->v.lpg_num);
+                num_mask = pool->lpg_num_mask;
+        } else {
+                num = le32_to_cpu(pool->v.pg_num);
+                num_mask = pool->pg_num_mask;
+        }
+
+        pgid.ps = cpu_to_le16(ps);
+        pgid.preferred = cpu_to_le16(preferred);
+        pgid.pool = fl->fl_pg_pool;
+        if (preferred >= 0)
+                dout("calc_object_layout '%s' pgid %d.%xp%d\n", oid, poolid, ps,
+                     (int)preferred);
+        else
+                dout("calc_object_layout '%s' pgid %d.%x\n", oid, poolid, ps);
+
+        ol->ol_pgid = pgid;
+        ol->ol_stripe_unit = fl->fl_object_stripe_unit;
+        return 0;
+}
+
+/*
+ * Calculate raw osd vector for the given pgid.  Return pointer to osd
+ * array, or NULL on failure.
+ */
+static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                        int *osds, int *num)
+{
+        struct ceph_pg_mapping *pg;
+        struct ceph_pg_pool_info *pool;
+        int ruleno;
+        unsigned poolid, ps, pps;
+        int preferred;
+
+        /* pg_temp? */
+        pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
+        if (pg) {
+                *num = pg->len;
+                return pg->osds;
+        }
+
+        /* crush */
+        poolid = le32_to_cpu(pgid.pool);
+        ps = le16_to_cpu(pgid.ps);
+        preferred = (s16)le16_to_cpu(pgid.preferred);
+
+        /* don't forcefeed bad device ids to crush */
+        if (preferred >= osdmap->max_osd ||
+            preferred >= osdmap->crush->max_devices)
+                preferred = -1;
+
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return NULL;
+        ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
+                                 pool->v.type, pool->v.size);
+        if (ruleno < 0) {
+                pr_err("no crush rule pool %d type %d size %d\n",
+                       poolid, pool->v.type, pool->v.size);
+                return NULL;
+        }
+
+        if (preferred >= 0)
+                pps = ceph_stable_mod(ps,
+                                      le32_to_cpu(pool->v.lpgp_num),
+                                      pool->lpgp_num_mask);
+        else
+                pps = ceph_stable_mod(ps,
+                                      le32_to_cpu(pool->v.pgp_num),
+                                      pool->pgp_num_mask);
+        pps += poolid;
+        *num = crush_do_rule(osdmap->crush, ruleno, pps, osds,
+                             min_t(int, pool->v.size, *num),
+                             preferred, osdmap->osd_weight);
+        return osds;
+}
+
+/*
+ * Return primary osd for given pgid, or -1 if none.
+ */
+int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
+{
+        int rawosds[10], *osds;
+        int i, num = ARRAY_SIZE(rawosds);
+
+        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
+        if (!osds)
+                return -1;
+
+        /* primary is first up osd */
+        for (i = 0; i < num; i++)
+                if (ceph_osd_is_up(osdmap, osds[i])) {
+                        return osds[i];
+                        break;
+                }
+        return -1;
+}
diff --git a/fs/ceph/osdmap.h b/fs/ceph/osdmap.h
new file mode 100644
index 000000000000..8bc9f1e4f562
--- /dev/null
+++ b/fs/ceph/osdmap.h
@@ -0,0 +1,126 @@
+#ifndef _FS_CEPH_OSDMAP_H
+#define _FS_CEPH_OSDMAP_H
+
+#include <linux/rbtree.h>
+#include "types.h"
+#include "ceph_fs.h"
+#include "crush/crush.h"
+
+/*
+ * The osd map describes the current membership of the osd cluster and
+ * specifies the mapping of objects to placement groups and placement
+ * groups to (sets of) osds.  That is, it completely specifies the
+ * (desired) distribution of all data objects in the system at some
+ * point in time.
+ *
+ * Each map version is identified by an epoch, which increases monotonically.
+ *
+ * The map can be updated either via an incremental map (diff) describing
+ * the change between two successive epochs, or as a fully encoded map.
+ */
+struct ceph_pg_pool_info {
+        struct rb_node node;
+        int id;
+        struct ceph_pg_pool v;
+        int pg_num_mask, pgp_num_mask, lpg_num_mask, lpgp_num_mask;
+        char *name;
+};
+
+struct ceph_pg_mapping {
+        struct rb_node node;
+        struct ceph_pg pgid;
+        int len;
+        int osds[];
+};
+
+struct ceph_osdmap {
+        struct ceph_fsid fsid;
+        u32 epoch;
+        u32 mkfs_epoch;
+        struct ceph_timespec created, modified;
+
+        u32 flags;         /* CEPH_OSDMAP_* */
+
+        u32 max_osd;       /* size of osd_state, _offload, _addr arrays */
+        u8 *osd_state;     /* CEPH_OSD_* */
+        u32 *osd_weight;   /* 0 = failed, 0x10000 = 100% normal */
+        struct ceph_entity_addr *osd_addr;
+
+        struct rb_root pg_temp;
+        struct rb_root pg_pools;
+        u32 pool_max;
+
+        /* the CRUSH map specifies the mapping of placement groups to
+         * the list of osds that store+replicate them. */
+        struct crush_map *crush;
+};
+
+/*
+ * file layout helpers
+ */
+#define ceph_file_layout_su(l) ((__s32)le32_to_cpu((l).fl_stripe_unit))
+#define ceph_file_layout_stripe_count(l) \
+        ((__s32)le32_to_cpu((l).fl_stripe_count))
+#define ceph_file_layout_object_size(l) ((__s32)le32_to_cpu((l).fl_object_size))
+#define ceph_file_layout_cas_hash(l) ((__s32)le32_to_cpu((l).fl_cas_hash))
+#define ceph_file_layout_object_su(l) \
+        ((__s32)le32_to_cpu((l).fl_object_stripe_unit))
+#define ceph_file_layout_pg_preferred(l) \
+        ((__s32)le32_to_cpu((l).fl_pg_preferred))
+#define ceph_file_layout_pg_pool(l) \
+        ((__s32)le32_to_cpu((l).fl_pg_pool))
+
+static inline unsigned ceph_file_layout_stripe_width(struct ceph_file_layout *l)
+{
+        return le32_to_cpu(l->fl_stripe_unit) *
+                le32_to_cpu(l->fl_stripe_count);
+}
+
+/* "period" == bytes before i start on a new set of objects */
+static inline unsigned ceph_file_layout_period(struct ceph_file_layout *l)
+{
+        return le32_to_cpu(l->fl_object_size) *
+                le32_to_cpu(l->fl_stripe_count);
+}
+
+
+static inline int ceph_osd_is_up(struct ceph_osdmap *map, int osd)
+{
+        return (osd < map->max_osd) && (map->osd_state[osd] & CEPH_OSD_UP);
+}
+
+static inline bool ceph_osdmap_flag(struct ceph_osdmap *map, int flag)
+{
+        return map && (map->flags & flag);
+}
+
+extern char *ceph_osdmap_state_str(char *str, int len, int state);
+
+static inline struct ceph_entity_addr *ceph_osd_addr(struct ceph_osdmap *map,
+                                                     int osd)
+{
+        if (osd >= map->max_osd)
+                return NULL;
+        return &map->osd_addr[osd];
+}
+
+extern struct ceph_osdmap *osdmap_decode(void **p, void *end);
+extern struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
+                                            struct ceph_osdmap *map,
+                                            struct ceph_messenger *msgr);
+extern void ceph_osdmap_destroy(struct ceph_osdmap *map);
+
+/* calculate mapping of a file extent to an object */
+extern void ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
+                                          u64 off, u64 *plen,
+                                          u64 *bno, u64 *oxoff, u64 *oxlen);
+
+/* calculate mapping of object to a placement group */
+extern int ceph_calc_object_layout(struct ceph_object_layout *ol,
+                                   const char *oid,
+                                   struct ceph_file_layout *fl,
+                                   struct ceph_osdmap *osdmap);
+extern int ceph_calc_pg_primary(struct ceph_osdmap *osdmap,
+                                struct ceph_pg pgid);
+
+#endif
diff --git a/fs/ceph/pagelist.c b/fs/ceph/pagelist.c
new file mode 100644
index 000000000000..5f8dbf7c745a
--- /dev/null
+++ b/fs/ceph/pagelist.c
@@ -0,0 +1,55 @@
+
+#include <linux/gfp.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+
+#include "pagelist.h"
+
+int ceph_pagelist_release(struct ceph_pagelist *pl)
+{
+        if (pl->mapped_tail)
+                kunmap(pl->mapped_tail);
+        while (!list_empty(&pl->head)) {
+                struct page *page = list_first_entry(&pl->head, struct page,
+                                                     lru);
+                list_del(&page->lru);
+                __free_page(page);
+        }
+        return 0;
+}
+
+static int ceph_pagelist_addpage(struct ceph_pagelist *pl)
+{
+        struct page *page = alloc_page(GFP_NOFS);
+        if (!page)
+                return -ENOMEM;
+        pl->room += PAGE_SIZE;
+        list_add_tail(&page->lru, &pl->head);
+        if (pl->mapped_tail)
+                kunmap(pl->mapped_tail);
+        pl->mapped_tail = kmap(page);
+        return 0;
+}
+
+int ceph_pagelist_append(struct ceph_pagelist *pl, void *buf, size_t len)
+{
+        while (pl->room < len) {
+                size_t bit = pl->room;
+                int ret;
+
+                memcpy(pl->mapped_tail + (pl->length & ~PAGE_CACHE_MASK),
+                       buf, bit);
+                pl->length += bit;
+                pl->room -= bit;
+                buf += bit;
+                len -= bit;
+                ret = ceph_pagelist_addpage(pl);
+                if (ret)
+                        return ret;
+        }
+
+        memcpy(pl->mapped_tail + (pl->length & ~PAGE_CACHE_MASK), buf, len);
+        pl->length += len;
+        pl->room -= len;
+        return 0;
+}
diff --git a/fs/ceph/pagelist.h b/fs/ceph/pagelist.h
new file mode 100644
index 000000000000..e8a4187e1087
--- /dev/null
+++ b/fs/ceph/pagelist.h
@@ -0,0 +1,54 @@
+#ifndef __FS_CEPH_PAGELIST_H
+#define __FS_CEPH_PAGELIST_H
+
+#include <linux/list.h>
+
+struct ceph_pagelist {
+        struct list_head head;
+        void *mapped_tail;
+        size_t length;
+        size_t room;
+};
+
+static inline void ceph_pagelist_init(struct ceph_pagelist *pl)
+{
+        INIT_LIST_HEAD(&pl->head);
+        pl->mapped_tail = NULL;
+        pl->length = 0;
+        pl->room = 0;
+}
+extern int ceph_pagelist_release(struct ceph_pagelist *pl);
+
+extern int ceph_pagelist_append(struct ceph_pagelist *pl, void *d, size_t l);
+
+static inline int ceph_pagelist_encode_64(struct ceph_pagelist *pl, u64 v)
+{
+        __le64 ev = cpu_to_le64(v);
+        return ceph_pagelist_append(pl, &ev, sizeof(ev));
+}
+static inline int ceph_pagelist_encode_32(struct ceph_pagelist *pl, u32 v)
+{
+        __le32 ev = cpu_to_le32(v);
+        return ceph_pagelist_append(pl, &ev, sizeof(ev));
+}
+static inline int ceph_pagelist_encode_16(struct ceph_pagelist *pl, u16 v)
+{
+        __le16 ev = cpu_to_le16(v);
+        return ceph_pagelist_append(pl, &ev, sizeof(ev));
+}
+static inline int ceph_pagelist_encode_8(struct ceph_pagelist *pl, u8 v)
+{
+        return ceph_pagelist_append(pl, &v, 1);
+}
+static inline int ceph_pagelist_encode_string(struct ceph_pagelist *pl,
+                                              char *s, size_t len)
+{
+        int ret = ceph_pagelist_encode_32(pl, len);
+        if (ret)
+                return ret;
+        if (len)
+                return ceph_pagelist_append(pl, s, len);
+        return 0;
+}
+
+#endif
diff --git a/fs/ceph/rados.h b/fs/ceph/rados.h
new file mode 100644
index 000000000000..a1fc1d017b58
--- /dev/null
+++ b/fs/ceph/rados.h
@@ -0,0 +1,376 @@
+#ifndef __RADOS_H
+#define __RADOS_H
+
+/*
+ * Data types for the Ceph distributed object storage layer RADOS
+ * (Reliable Autonomic Distributed Object Store).
+ */
+
+#include "msgr.h"
+
+/*
+ * osdmap encoding versions
+ */
+#define CEPH_OSDMAP_INC_VERSION     5
+#define CEPH_OSDMAP_INC_VERSION_EXT 5
+#define CEPH_OSDMAP_VERSION         5
+#define CEPH_OSDMAP_VERSION_EXT     5
+
+/*
+ * fs id
+ */
+struct ceph_fsid {
+        unsigned char fsid[16];
+};
+
+static inline int ceph_fsid_compare(const struct ceph_fsid *a,
+                                    const struct ceph_fsid *b)
+{
+        return memcmp(a, b, sizeof(*a));
+}
+
+/*
+ * ino, object, etc.
+ */
+typedef __le64 ceph_snapid_t;
+#define CEPH_SNAPDIR ((__u64)(-1))  /* reserved for hidden .snap dir */
+#define CEPH_NOSNAP  ((__u64)(-2))  /* "head", "live" revision */
+#define CEPH_MAXSNAP ((__u64)(-3))  /* largest valid snapid */
+
+struct ceph_timespec {
+        __le32 tv_sec;
+        __le32 tv_nsec;
+} __attribute__ ((packed));
+
+
+/*
+ * object layout - how objects are mapped into PGs
+ */
+#define CEPH_OBJECT_LAYOUT_HASH     1
+#define CEPH_OBJECT_LAYOUT_LINEAR   2
+#define CEPH_OBJECT_LAYOUT_HASHINO  3
+
+/*
+ * pg layout -- how PGs are mapped onto (sets of) OSDs
+ */
+#define CEPH_PG_LAYOUT_CRUSH  0
+#define CEPH_PG_LAYOUT_HASH   1
+#define CEPH_PG_LAYOUT_LINEAR 2
+#define CEPH_PG_LAYOUT_HYBRID 3
+
+
+/*
+ * placement group.
+ * we encode this into one __le64.
+ */
+struct ceph_pg {
+        __le16 preferred; /* preferred primary osd */
+        __le16 ps;        /* placement seed */
+        __le32 pool;      /* object pool */
+} __attribute__ ((packed));
+
+/*
+ * pg_pool is a set of pgs storing a pool of objects
+ *
+ *  pg_num -- base number of pseudorandomly placed pgs
+ *
+ *  pgp_num -- effective number when calculating pg placement.  this
+ * is used for pg_num increases.  new pgs result in data being "split"
+ * into new pgs.  for this to proceed smoothly, new pgs are intiially
+ * colocated with their parents; that is, pgp_num doesn't increase
+ * until the new pgs have successfully split.  only _then_ are the new
+ * pgs placed independently.
+ *
+ *  lpg_num -- localized pg count (per device).  replicas are randomly
+ * selected.
+ *
+ *  lpgp_num -- as above.
+ */
+#define CEPH_PG_TYPE_REP     1
+#define CEPH_PG_TYPE_RAID4   2
+#define CEPH_PG_POOL_VERSION 2
+struct ceph_pg_pool {
+        __u8 type;                /* CEPH_PG_TYPE_* */
+        __u8 size;                /* number of osds in each pg */
+        __u8 crush_ruleset;       /* crush placement rule */
+        __u8 object_hash;         /* hash mapping object name to ps */
+        __le32 pg_num, pgp_num;   /* number of pg's */
+        __le32 lpg_num, lpgp_num; /* number of localized pg's */
+        __le32 last_change;       /* most recent epoch changed */
+        __le64 snap_seq;          /* seq for per-pool snapshot */
+        __le32 snap_epoch;        /* epoch of last snap */
+        __le32 num_snaps;
+        __le32 num_removed_snap_intervals;
+        __le64 uid;
+} __attribute__ ((packed));
+
+/*
+ * stable_mod func is used to control number of placement groups.
+ * similar to straight-up modulo, but produces a stable mapping as b
+ * increases over time.  b is the number of bins, and bmask is the
+ * containing power of 2 minus 1.
+ *
+ * b <= bmask and bmask=(2**n)-1
+ * e.g., b=12 -> bmask=15, b=123 -> bmask=127
+ */
+static inline int ceph_stable_mod(int x, int b, int bmask)
+{
+        if ((x & bmask) < b)
+                return x & bmask;
+        else
+                return x & (bmask >> 1);
+}
+
+/*
+ * object layout - how a given object should be stored.
+ */
+struct ceph_object_layout {
+        struct ceph_pg ol_pgid;   /* raw pg, with _full_ ps precision. */
+        __le32 ol_stripe_unit;    /* for per-object parity, if any */
+} __attribute__ ((packed));
+
+/*
+ * compound epoch+version, used by storage layer to serialize mutations
+ */
+struct ceph_eversion {
+        __le32 epoch;
+        __le64 version;
+} __attribute__ ((packed));
+
+/*
+ * osd map bits
+ */
+
+/* status bits */
+#define CEPH_OSD_EXISTS 1
+#define CEPH_OSD_UP     2
+
+/* osd weights.  fixed point value: 0x10000 == 1.0 ("in"), 0 == "out" */
+#define CEPH_OSD_IN  0x10000
+#define CEPH_OSD_OUT 0
+
+
+/*
+ * osd map flag bits
+ */
+#define CEPH_OSDMAP_NEARFULL (1<<0)  /* sync writes (near ENOSPC) */
+#define CEPH_OSDMAP_FULL     (1<<1)  /* no data writes (ENOSPC) */
+#define CEPH_OSDMAP_PAUSERD  (1<<2)  /* pause all reads */
+#define CEPH_OSDMAP_PAUSEWR  (1<<3)  /* pause all writes */
+#define CEPH_OSDMAP_PAUSEREC (1<<4)  /* pause recovery */
+
+/*
+ * osd ops
+ */
+#define CEPH_OSD_OP_MODE       0xf000
+#define CEPH_OSD_OP_MODE_RD    0x1000
+#define CEPH_OSD_OP_MODE_WR    0x2000
+#define CEPH_OSD_OP_MODE_RMW   0x3000
+#define CEPH_OSD_OP_MODE_SUB   0x4000
+
+#define CEPH_OSD_OP_TYPE       0x0f00
+#define CEPH_OSD_OP_TYPE_LOCK  0x0100
+#define CEPH_OSD_OP_TYPE_DATA  0x0200
+#define CEPH_OSD_OP_TYPE_ATTR  0x0300
+#define CEPH_OSD_OP_TYPE_EXEC  0x0400
+#define CEPH_OSD_OP_TYPE_PG    0x0500
+
+enum {
+        /** data **/
+        /* read */
+        CEPH_OSD_OP_READ      = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_DATA | 1,
+        CEPH_OSD_OP_STAT      = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_DATA | 2,
+
+        /* fancy read */
+        CEPH_OSD_OP_MASKTRUNC = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_DATA | 4,
+
+        /* write */
+        CEPH_OSD_OP_WRITE     = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 1,
+        CEPH_OSD_OP_WRITEFULL = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 2,
+        CEPH_OSD_OP_TRUNCATE  = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 3,
+        CEPH_OSD_OP_ZERO      = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 4,
+        CEPH_OSD_OP_DELETE    = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 5,
+
+        /* fancy write */
+        CEPH_OSD_OP_APPEND    = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 6,
+        CEPH_OSD_OP_STARTSYNC = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 7,
+        CEPH_OSD_OP_SETTRUNC  = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 8,
+        CEPH_OSD_OP_TRIMTRUNC = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 9,
+
+        CEPH_OSD_OP_TMAPUP  = CEPH_OSD_OP_MODE_RMW | CEPH_OSD_OP_TYPE_DATA | 10,
+        CEPH_OSD_OP_TMAPPUT = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 11,
+        CEPH_OSD_OP_TMAPGET = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_DATA | 12,
+
+        CEPH_OSD_OP_CREATE  = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_DATA | 13,
+
+        /** attrs **/
+        /* read */
+        CEPH_OSD_OP_GETXATTR  = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_ATTR | 1,
+        CEPH_OSD_OP_GETXATTRS = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_ATTR | 2,
+
+        /* write */
+        CEPH_OSD_OP_SETXATTR  = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_ATTR | 1,
+        CEPH_OSD_OP_SETXATTRS = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_ATTR | 2,
+        CEPH_OSD_OP_RESETXATTRS = CEPH_OSD_OP_MODE_WR|CEPH_OSD_OP_TYPE_ATTR | 3,
+        CEPH_OSD_OP_RMXATTR   = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_ATTR | 4,
+
+        /** subop **/
+        CEPH_OSD_OP_PULL           = CEPH_OSD_OP_MODE_SUB | 1,
+        CEPH_OSD_OP_PUSH           = CEPH_OSD_OP_MODE_SUB | 2,
+        CEPH_OSD_OP_BALANCEREADS   = CEPH_OSD_OP_MODE_SUB | 3,
+        CEPH_OSD_OP_UNBALANCEREADS = CEPH_OSD_OP_MODE_SUB | 4,
+        CEPH_OSD_OP_SCRUB          = CEPH_OSD_OP_MODE_SUB | 5,
+
+        /** lock **/
+        CEPH_OSD_OP_WRLOCK    = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_LOCK | 1,
+        CEPH_OSD_OP_WRUNLOCK  = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_LOCK | 2,
+        CEPH_OSD_OP_RDLOCK    = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_LOCK | 3,
+        CEPH_OSD_OP_RDUNLOCK  = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_LOCK | 4,
+        CEPH_OSD_OP_UPLOCK    = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_LOCK | 5,
+        CEPH_OSD_OP_DNLOCK    = CEPH_OSD_OP_MODE_WR | CEPH_OSD_OP_TYPE_LOCK | 6,
+
+        /** exec **/
+        CEPH_OSD_OP_CALL    = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_EXEC | 1,
+
+        /** pg **/
+        CEPH_OSD_OP_PGLS      = CEPH_OSD_OP_MODE_RD | CEPH_OSD_OP_TYPE_PG | 1,
+};
+
+static inline int ceph_osd_op_type_lock(int op)
+{
+        return (op & CEPH_OSD_OP_TYPE) == CEPH_OSD_OP_TYPE_LOCK;
+}
+static inline int ceph_osd_op_type_data(int op)
+{
+        return (op & CEPH_OSD_OP_TYPE) == CEPH_OSD_OP_TYPE_DATA;
+}
+static inline int ceph_osd_op_type_attr(int op)
+{
+        return (op & CEPH_OSD_OP_TYPE) == CEPH_OSD_OP_TYPE_ATTR;
+}
+static inline int ceph_osd_op_type_exec(int op)
+{
+        return (op & CEPH_OSD_OP_TYPE) == CEPH_OSD_OP_TYPE_EXEC;
+}
+static inline int ceph_osd_op_type_pg(int op)
+{
+        return (op & CEPH_OSD_OP_TYPE) == CEPH_OSD_OP_TYPE_PG;
+}
+
+static inline int ceph_osd_op_mode_subop(int op)
+{
+        return (op & CEPH_OSD_OP_MODE) == CEPH_OSD_OP_MODE_SUB;
+}
+static inline int ceph_osd_op_mode_read(int op)
+{
+        return (op & CEPH_OSD_OP_MODE) == CEPH_OSD_OP_MODE_RD;
+}
+static inline int ceph_osd_op_mode_modify(int op)
+{
+        return (op & CEPH_OSD_OP_MODE) == CEPH_OSD_OP_MODE_WR;
+}
+
+#define CEPH_OSD_TMAP_HDR 'h'
+#define CEPH_OSD_TMAP_SET 's'
+#define CEPH_OSD_TMAP_RM  'r'
+
+extern const char *ceph_osd_op_name(int op);
+
+
+/*
+ * osd op flags
+ *
+ * An op may be READ, WRITE, or READ|WRITE.
+ */
+enum {
+        CEPH_OSD_FLAG_ACK = 1,          /* want (or is) "ack" ack */
+        CEPH_OSD_FLAG_ONNVRAM = 2,      /* want (or is) "onnvram" ack */
+        CEPH_OSD_FLAG_ONDISK = 4,       /* want (or is) "ondisk" ack */
+        CEPH_OSD_FLAG_RETRY = 8,        /* resend attempt */
+        CEPH_OSD_FLAG_READ = 16,        /* op may read */
+        CEPH_OSD_FLAG_WRITE = 32,       /* op may write */
+        CEPH_OSD_FLAG_ORDERSNAP = 64,   /* EOLDSNAP if snapc is out of order */
+        CEPH_OSD_FLAG_PEERSTAT = 128,   /* msg includes osd_peer_stat */
+        CEPH_OSD_FLAG_BALANCE_READS = 256,
+        CEPH_OSD_FLAG_PARALLELEXEC = 512, /* execute op in parallel */
+        CEPH_OSD_FLAG_PGOP = 1024,      /* pg op, no object */
+        CEPH_OSD_FLAG_EXEC = 2048,      /* op may exec */
+};
+
+enum {
+        CEPH_OSD_OP_FLAG_EXCL = 1,      /* EXCL object create */
+};
+
+#define EOLDSNAPC    ERESTART  /* ORDERSNAP flag set; writer has old snapc*/
+#define EBLACKLISTED ESHUTDOWN /* blacklisted */
+
+/*
+ * an individual object operation.  each may be accompanied by some data
+ * payload
+ */
+struct ceph_osd_op {
+        __le16 op;           /* CEPH_OSD_OP_* */
+        __le32 flags;        /* CEPH_OSD_FLAG_* */
+        union {
+                struct {
+                        __le64 offset, length;
+                        __le64 truncate_size;
+                        __le32 truncate_seq;
+                } __attribute__ ((packed)) extent;
+                struct {
+                        __le32 name_len;
+                        __le32 value_len;
+                } __attribute__ ((packed)) xattr;
+                struct {
+                        __u8 class_len;
+                        __u8 method_len;
+                        __u8 argc;
+                        __le32 indata_len;
+                } __attribute__ ((packed)) cls;
+                struct {
+                        __le64 cookie, count;
+                } __attribute__ ((packed)) pgls;
+        };
+        __le32 payload_len;
+} __attribute__ ((packed));
+
+/*
+ * osd request message header.  each request may include multiple
+ * ceph_osd_op object operations.
+ */
+struct ceph_osd_request_head {
+        __le32 client_inc;                 /* client incarnation */
+        struct ceph_object_layout layout;  /* pgid */
+        __le32 osdmap_epoch;               /* client's osdmap epoch */
+
+        __le32 flags;
+
+        struct ceph_timespec mtime;        /* for mutations only */
+        struct ceph_eversion reassert_version; /* if we are replaying op */
+
+        __le32 object_len;     /* length of object name */
+
+        __le64 snapid;         /* snapid to read */
+        __le64 snap_seq;       /* writer's snap context */
+        __le32 num_snaps;
+
+        __le16 num_ops;
+        struct ceph_osd_op ops[];  /* followed by ops[], obj, ticket, snaps */
+} __attribute__ ((packed));
+
+struct ceph_osd_reply_head {
+        __le32 client_inc;                /* client incarnation */
+        __le32 flags;
+        struct ceph_object_layout layout;
+        __le32 osdmap_epoch;
+        struct ceph_eversion reassert_version; /* for replaying uncommitted */
+
+        __le32 result;                    /* result code */
+
+        __le32 object_len;                /* length of object name */
+        __le32 num_ops;
+        struct ceph_osd_op ops[0];  /* ops[], object */
+} __attribute__ ((packed));
+
+
+#endif
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
new file mode 100644
index 000000000000..2b881262ef67
--- /dev/null
+++ b/fs/ceph/snap.c
@@ -0,0 +1,907 @@
+#include "ceph_debug.h"
+
+#include <linux/sort.h>
+#include <linux/slab.h>
+
+#include "super.h"
+#include "decode.h"
+
+/*
+ * Snapshots in ceph are driven in large part by cooperation from the
+ * client.  In contrast to local file systems or file servers that
+ * implement snapshots at a single point in the system, ceph's
+ * distributed access to storage requires clients to help decide
+ * whether a write logically occurs before or after a recently created
+ * snapshot.
+ *
+ * This provides a perfect instantanous client-wide snapshot.  Between
+ * clients, however, snapshots may appear to be applied at slightly
+ * different points in time, depending on delays in delivering the
+ * snapshot notification.
+ *
+ * Snapshots are _not_ file system-wide.  Instead, each snapshot
+ * applies to the subdirectory nested beneath some directory.  This
+ * effectively divides the hierarchy into multiple "realms," where all
+ * of the files contained by each realm share the same set of
+ * snapshots.  An individual realm's snap set contains snapshots
+ * explicitly created on that realm, as well as any snaps in its
+ * parent's snap set _after_ the point at which the parent became it's
+ * parent (due to, say, a rename).  Similarly, snaps from prior parents
+ * during the time intervals during which they were the parent are included.
+ *
+ * The client is spared most of this detail, fortunately... it must only
+ * maintains a hierarchy of realms reflecting the current parent/child
+ * realm relationship, and for each realm has an explicit list of snaps
+ * inherited from prior parents.
+ *
+ * A snap_realm struct is maintained for realms containing every inode
+ * with an open cap in the system.  (The needed snap realm information is
+ * provided by the MDS whenever a cap is issued, i.e., on open.)  A 'seq'
+ * version number is used to ensure that as realm parameters change (new
+ * snapshot, new parent, etc.) the client's realm hierarchy is updated.
+ *
+ * The realm hierarchy drives the generation of a 'snap context' for each
+ * realm, which simply lists the resulting set of snaps for the realm.  This
+ * is attached to any writes sent to OSDs.
+ */
+/*
+ * Unfortunately error handling is a bit mixed here.  If we get a snap
+ * update, but don't have enough memory to update our realm hierarchy,
+ * it's not clear what we can do about it (besides complaining to the
+ * console).
+ */
+
+
+/*
+ * increase ref count for the realm
+ *
+ * caller must hold snap_rwsem for write.
+ */
+void ceph_get_snap_realm(struct ceph_mds_client *mdsc,
+                         struct ceph_snap_realm *realm)
+{
+        dout("get_realm %p %d -> %d\n", realm,
+             atomic_read(&realm->nref), atomic_read(&realm->nref)+1);
+        /*
+         * since we _only_ increment realm refs or empty the empty
+         * list with snap_rwsem held, adjusting the empty list here is
+         * safe.  we do need to protect against concurrent empty list
+         * additions, however.
+         */
+        if (atomic_read(&realm->nref) == 0) {
+                spin_lock(&mdsc->snap_empty_lock);
+                list_del_init(&realm->empty_item);
+                spin_unlock(&mdsc->snap_empty_lock);
+        }
+
+        atomic_inc(&realm->nref);
+}
+
+static void __insert_snap_realm(struct rb_root *root,
+                                struct ceph_snap_realm *new)
+{
+        struct rb_node **p = &root->rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_snap_realm *r = NULL;
+
+        while (*p) {
+                parent = *p;
+                r = rb_entry(parent, struct ceph_snap_realm, node);
+                if (new->ino < r->ino)
+                        p = &(*p)->rb_left;
+                else if (new->ino > r->ino)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, root);
+}
+
+/*
+ * create and get the realm rooted at @ino and bump its ref count.
+ *
+ * caller must hold snap_rwsem for write.
+ */
+static struct ceph_snap_realm *ceph_create_snap_realm(
+        struct ceph_mds_client *mdsc,
+        u64 ino)
+{
+        struct ceph_snap_realm *realm;
+
+        realm = kzalloc(sizeof(*realm), GFP_NOFS);
+        if (!realm)
+                return ERR_PTR(-ENOMEM);
+
+        atomic_set(&realm->nref, 0);    /* tree does not take a ref */
+        realm->ino = ino;
+        INIT_LIST_HEAD(&realm->children);
+        INIT_LIST_HEAD(&realm->child_item);
+        INIT_LIST_HEAD(&realm->empty_item);
+        INIT_LIST_HEAD(&realm->inodes_with_caps);
+        spin_lock_init(&realm->inodes_with_caps_lock);
+        __insert_snap_realm(&mdsc->snap_realms, realm);
+        dout("create_snap_realm %llx %p\n", realm->ino, realm);
+        return realm;
+}
+
+/*
+ * lookup the realm rooted at @ino.
+ *
+ * caller must hold snap_rwsem for write.
+ */
+struct ceph_snap_realm *ceph_lookup_snap_realm(struct ceph_mds_client *mdsc,
+                                               u64 ino)
+{
+        struct rb_node *n = mdsc->snap_realms.rb_node;
+        struct ceph_snap_realm *r;
+
+        while (n) {
+                r = rb_entry(n, struct ceph_snap_realm, node);
+                if (ino < r->ino)
+                        n = n->rb_left;
+                else if (ino > r->ino)
+                        n = n->rb_right;
+                else {
+                        dout("lookup_snap_realm %llx %p\n", r->ino, r);
+                        return r;
+                }
+        }
+        return NULL;
+}
+
+static void __put_snap_realm(struct ceph_mds_client *mdsc,
+                             struct ceph_snap_realm *realm);
+
+/*
+ * called with snap_rwsem (write)
+ */
+static void __destroy_snap_realm(struct ceph_mds_client *mdsc,
+                                 struct ceph_snap_realm *realm)
+{
+        dout("__destroy_snap_realm %p %llx\n", realm, realm->ino);
+
+        rb_erase(&realm->node, &mdsc->snap_realms);
+
+        if (realm->parent) {
+                list_del_init(&realm->child_item);
+                __put_snap_realm(mdsc, realm->parent);
+        }
+
+        kfree(realm->prior_parent_snaps);
+        kfree(realm->snaps);
+        ceph_put_snap_context(realm->cached_context);
+        kfree(realm);
+}
+
+/*
+ * caller holds snap_rwsem (write)
+ */
+static void __put_snap_realm(struct ceph_mds_client *mdsc,
+                             struct ceph_snap_realm *realm)
+{
+        dout("__put_snap_realm %llx %p %d -> %d\n", realm->ino, realm,
+             atomic_read(&realm->nref), atomic_read(&realm->nref)-1);
+        if (atomic_dec_and_test(&realm->nref))
+                __destroy_snap_realm(mdsc, realm);
+}
+
+/*
+ * caller needn't hold any locks
+ */
+void ceph_put_snap_realm(struct ceph_mds_client *mdsc,
+                         struct ceph_snap_realm *realm)
+{
+        dout("put_snap_realm %llx %p %d -> %d\n", realm->ino, realm,
+             atomic_read(&realm->nref), atomic_read(&realm->nref)-1);
+        if (!atomic_dec_and_test(&realm->nref))
+                return;
+
+        if (down_write_trylock(&mdsc->snap_rwsem)) {
+                __destroy_snap_realm(mdsc, realm);
+                up_write(&mdsc->snap_rwsem);
+        } else {
+                spin_lock(&mdsc->snap_empty_lock);
+                list_add(&mdsc->snap_empty, &realm->empty_item);
+                spin_unlock(&mdsc->snap_empty_lock);
+        }
+}
+
+/*
+ * Clean up any realms whose ref counts have dropped to zero.  Note
+ * that this does not include realms who were created but not yet
+ * used.
+ *
+ * Called under snap_rwsem (write)
+ */
+static void __cleanup_empty_realms(struct ceph_mds_client *mdsc)
+{
+        struct ceph_snap_realm *realm;
+
+        spin_lock(&mdsc->snap_empty_lock);
+        while (!list_empty(&mdsc->snap_empty)) {
+                realm = list_first_entry(&mdsc->snap_empty,
+                                   struct ceph_snap_realm, empty_item);
+                list_del(&realm->empty_item);
+                spin_unlock(&mdsc->snap_empty_lock);
+                __destroy_snap_realm(mdsc, realm);
+                spin_lock(&mdsc->snap_empty_lock);
+        }
+        spin_unlock(&mdsc->snap_empty_lock);
+}
+
+void ceph_cleanup_empty_realms(struct ceph_mds_client *mdsc)
+{
+        down_write(&mdsc->snap_rwsem);
+        __cleanup_empty_realms(mdsc);
+        up_write(&mdsc->snap_rwsem);
+}
+
+/*
+ * adjust the parent realm of a given @realm.  adjust child list, and parent
+ * pointers, and ref counts appropriately.
+ *
+ * return true if parent was changed, 0 if unchanged, <0 on error.
+ *
+ * caller must hold snap_rwsem for write.
+ */
+static int adjust_snap_realm_parent(struct ceph_mds_client *mdsc,
+                                    struct ceph_snap_realm *realm,
+                                    u64 parentino)
+{
+        struct ceph_snap_realm *parent;
+
+        if (realm->parent_ino == parentino)
+                return 0;
+
+        parent = ceph_lookup_snap_realm(mdsc, parentino);
+        if (!parent) {
+                parent = ceph_create_snap_realm(mdsc, parentino);
+                if (IS_ERR(parent))
+                        return PTR_ERR(parent);
+        }
+        dout("adjust_snap_realm_parent %llx %p: %llx %p -> %llx %p\n",
+             realm->ino, realm, realm->parent_ino, realm->parent,
+             parentino, parent);
+        if (realm->parent) {
+                list_del_init(&realm->child_item);
+                ceph_put_snap_realm(mdsc, realm->parent);
+        }
+        realm->parent_ino = parentino;
+        realm->parent = parent;
+        ceph_get_snap_realm(mdsc, parent);
+        list_add(&realm->child_item, &parent->children);
+        return 1;
+}
+
+
+static int cmpu64_rev(const void *a, const void *b)
+{
+        if (*(u64 *)a < *(u64 *)b)
+                return 1;
+        if (*(u64 *)a > *(u64 *)b)
+                return -1;
+        return 0;
+}
+
+/*
+ * build the snap context for a given realm.
+ */
+static int build_snap_context(struct ceph_snap_realm *realm)
+{
+        struct ceph_snap_realm *parent = realm->parent;
+        struct ceph_snap_context *snapc;
+        int err = 0;
+        int i;
+        int num = realm->num_prior_parent_snaps + realm->num_snaps;
+
+        /*
+         * build parent context, if it hasn't been built.
+         * conservatively estimate that all parent snaps might be
+         * included by us.
+         */
+        if (parent) {
+                if (!parent->cached_context) {
+                        err = build_snap_context(parent);
+                        if (err)
+                                goto fail;
+                }
+                num += parent->cached_context->num_snaps;
+        }
+
+        /* do i actually need to update?  not if my context seq
+           matches realm seq, and my parents' does to.  (this works
+           because we rebuild_snap_realms() works _downward_ in
+           hierarchy after each update.) */
+        if (realm->cached_context &&
+            realm->cached_context->seq == realm->seq &&
+            (!parent ||
+             realm->cached_context->seq >= parent->cached_context->seq)) {
+                dout("build_snap_context %llx %p: %p seq %lld (%d snaps)"
+                     " (unchanged)\n",
+                     realm->ino, realm, realm->cached_context,
+                     realm->cached_context->seq,
+                     realm->cached_context->num_snaps);
+                return 0;
+        }
+
+        /* alloc new snap context */
+        err = -ENOMEM;
+        if (num > ULONG_MAX / sizeof(u64) - sizeof(*snapc))
+                goto fail;
+        snapc = kzalloc(sizeof(*snapc) + num*sizeof(u64), GFP_NOFS);
+        if (!snapc)
+                goto fail;
+        atomic_set(&snapc->nref, 1);
+
+        /* build (reverse sorted) snap vector */
+        num = 0;
+        snapc->seq = realm->seq;
+        if (parent) {
+                /* include any of parent's snaps occuring _after_ my
+                   parent became my parent */
+                for (i = 0; i < parent->cached_context->num_snaps; i++)
+                        if (parent->cached_context->snaps[i] >=
+                            realm->parent_since)
+                                snapc->snaps[num++] =
+                                        parent->cached_context->snaps[i];
+                if (parent->cached_context->seq > snapc->seq)
+                        snapc->seq = parent->cached_context->seq;
+        }
+        memcpy(snapc->snaps + num, realm->snaps,
+               sizeof(u64)*realm->num_snaps);
+        num += realm->num_snaps;
+        memcpy(snapc->snaps + num, realm->prior_parent_snaps,
+               sizeof(u64)*realm->num_prior_parent_snaps);
+        num += realm->num_prior_parent_snaps;
+
+        sort(snapc->snaps, num, sizeof(u64), cmpu64_rev, NULL);
+        snapc->num_snaps = num;
+        dout("build_snap_context %llx %p: %p seq %lld (%d snaps)\n",
+             realm->ino, realm, snapc, snapc->seq, snapc->num_snaps);
+
+        if (realm->cached_context)
+                ceph_put_snap_context(realm->cached_context);
+        realm->cached_context = snapc;
+        return 0;
+
+fail:
+        /*
+         * if we fail, clear old (incorrect) cached_context... hopefully
+         * we'll have better luck building it later
+         */
+        if (realm->cached_context) {
+                ceph_put_snap_context(realm->cached_context);
+                realm->cached_context = NULL;
+        }
+        pr_err("build_snap_context %llx %p fail %d\n", realm->ino,
+               realm, err);
+        return err;
+}
+
+/*
+ * rebuild snap context for the given realm and all of its children.
+ */
+static void rebuild_snap_realms(struct ceph_snap_realm *realm)
+{
+        struct ceph_snap_realm *child;
+
+        dout("rebuild_snap_realms %llx %p\n", realm->ino, realm);
+        build_snap_context(realm);
+
+        list_for_each_entry(child, &realm->children, child_item)
+                rebuild_snap_realms(child);
+}
+
+
+/*
+ * helper to allocate and decode an array of snapids.  free prior
+ * instance, if any.
+ */
+static int dup_array(u64 **dst, __le64 *src, int num)
+{
+        int i;
+
+        kfree(*dst);
+        if (num) {
+                *dst = kcalloc(num, sizeof(u64), GFP_NOFS);
+                if (!*dst)
+                        return -ENOMEM;
+                for (i = 0; i < num; i++)
+                        (*dst)[i] = get_unaligned_le64(src + i);
+        } else {
+                *dst = NULL;
+        }
+        return 0;
+}
+
+
+/*
+ * When a snapshot is applied, the size/mtime inode metadata is queued
+ * in a ceph_cap_snap (one for each snapshot) until writeback
+ * completes and the metadata can be flushed back to the MDS.
+ *
+ * However, if a (sync) write is currently in-progress when we apply
+ * the snapshot, we have to wait until the write succeeds or fails
+ * (and a final size/mtime is known).  In this case the
+ * cap_snap->writing = 1, and is said to be "pending."  When the write
+ * finishes, we __ceph_finish_cap_snap().
+ *
+ * Caller must hold snap_rwsem for read (i.e., the realm topology won't
+ * change).
+ */
+void ceph_queue_cap_snap(struct ceph_inode_info *ci)
+{
+        struct inode *inode = &ci->vfs_inode;
+        struct ceph_cap_snap *capsnap;
+        int used;
+
+        capsnap = kzalloc(sizeof(*capsnap), GFP_NOFS);
+        if (!capsnap) {
+                pr_err("ENOMEM allocating ceph_cap_snap on %p\n", inode);
+                return;
+        }
+
+        spin_lock(&inode->i_lock);
+        used = __ceph_caps_used(ci);
+        if (__ceph_have_pending_cap_snap(ci)) {
+                /* there is no point in queuing multiple "pending" cap_snaps,
+                   as no new writes are allowed to start when pending, so any
+                   writes in progress now were started before the previous
+                   cap_snap.  lucky us. */
+                dout("queue_cap_snap %p already pending\n", inode);
+                kfree(capsnap);
+        } else if (ci->i_wrbuffer_ref_head || (used & CEPH_CAP_FILE_WR)) {
+                struct ceph_snap_context *snapc = ci->i_head_snapc;
+
+                igrab(inode);
+
+                atomic_set(&capsnap->nref, 1);
+                capsnap->ci = ci;
+                INIT_LIST_HEAD(&capsnap->ci_item);
+                INIT_LIST_HEAD(&capsnap->flushing_item);
+
+                capsnap->follows = snapc->seq - 1;
+                capsnap->issued = __ceph_caps_issued(ci, NULL);
+                capsnap->dirty = __ceph_caps_dirty(ci);
+
+                capsnap->mode = inode->i_mode;
+                capsnap->uid = inode->i_uid;
+                capsnap->gid = inode->i_gid;
+
+                /* fixme? */
+                capsnap->xattr_blob = NULL;
+                capsnap->xattr_len = 0;
+
+                /* dirty page count moved from _head to this cap_snap;
+                   all subsequent writes page dirties occur _after_ this
+                   snapshot. */
+                capsnap->dirty_pages = ci->i_wrbuffer_ref_head;
+                ci->i_wrbuffer_ref_head = 0;
+                capsnap->context = snapc;
+                ci->i_head_snapc = NULL;
+                list_add_tail(&capsnap->ci_item, &ci->i_cap_snaps);
+
+                if (used & CEPH_CAP_FILE_WR) {
+                        dout("queue_cap_snap %p cap_snap %p snapc %p"
+                             " seq %llu used WR, now pending\n", inode,
+                             capsnap, snapc, snapc->seq);
+                        capsnap->writing = 1;
+                } else {
+                        /* note mtime, size NOW. */
+                        __ceph_finish_cap_snap(ci, capsnap);
+                }
+        } else {
+                dout("queue_cap_snap %p nothing dirty|writing\n", inode);
+                kfree(capsnap);
+        }
+
+        spin_unlock(&inode->i_lock);
+}
+
+/*
+ * Finalize the size, mtime for a cap_snap.. that is, settle on final values
+ * to be used for the snapshot, to be flushed back to the mds.
+ *
+ * If capsnap can now be flushed, add to snap_flush list, and return 1.
+ *
+ * Caller must hold i_lock.
+ */
+int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
+                            struct ceph_cap_snap *capsnap)
+{
+        struct inode *inode = &ci->vfs_inode;
+        struct ceph_mds_client *mdsc = &ceph_client(inode->i_sb)->mdsc;
+
+        BUG_ON(capsnap->writing);
+        capsnap->size = inode->i_size;
+        capsnap->mtime = inode->i_mtime;
+        capsnap->atime = inode->i_atime;
+        capsnap->ctime = inode->i_ctime;
+        capsnap->time_warp_seq = ci->i_time_warp_seq;
+        if (capsnap->dirty_pages) {
+                dout("finish_cap_snap %p cap_snap %p snapc %p %llu %s s=%llu "
+                     "still has %d dirty pages\n", inode, capsnap,
+                     capsnap->context, capsnap->context->seq,
+                     ceph_cap_string(capsnap->dirty), capsnap->size,
+                     capsnap->dirty_pages);
+                return 0;
+        }
+        dout("finish_cap_snap %p cap_snap %p snapc %p %llu %s s=%llu\n",
+             inode, capsnap, capsnap->context,
+             capsnap->context->seq, ceph_cap_string(capsnap->dirty),
+             capsnap->size);
+
+        spin_lock(&mdsc->snap_flush_lock);
+        list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
+        spin_unlock(&mdsc->snap_flush_lock);
+        return 1;  /* caller may want to ceph_flush_snaps */
+}
+
+
+/*
+ * Parse and apply a snapblob "snap trace" from the MDS.  This specifies
+ * the snap realm parameters from a given realm and all of its ancestors,
+ * up to the root.
+ *
+ * Caller must hold snap_rwsem for write.
+ */
+int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
+                           void *p, void *e, bool deletion)
+{
+        struct ceph_mds_snap_realm *ri;    /* encoded */
+        __le64 *snaps;                     /* encoded */
+        __le64 *prior_parent_snaps;        /* encoded */
+        struct ceph_snap_realm *realm;
+        int invalidate = 0;
+        int err = -ENOMEM;
+
+        dout("update_snap_trace deletion=%d\n", deletion);
+more:
+        ceph_decode_need(&p, e, sizeof(*ri), bad);
+        ri = p;
+        p += sizeof(*ri);
+        ceph_decode_need(&p, e, sizeof(u64)*(le32_to_cpu(ri->num_snaps) +
+                            le32_to_cpu(ri->num_prior_parent_snaps)), bad);
+        snaps = p;
+        p += sizeof(u64) * le32_to_cpu(ri->num_snaps);
+        prior_parent_snaps = p;
+        p += sizeof(u64) * le32_to_cpu(ri->num_prior_parent_snaps);
+
+        realm = ceph_lookup_snap_realm(mdsc, le64_to_cpu(ri->ino));
+        if (!realm) {
+                realm = ceph_create_snap_realm(mdsc, le64_to_cpu(ri->ino));
+                if (IS_ERR(realm)) {
+                        err = PTR_ERR(realm);
+                        goto fail;
+                }
+        }
+
+        if (le64_to_cpu(ri->seq) > realm->seq) {
+                dout("update_snap_trace updating %llx %p %lld -> %lld\n",
+                     realm->ino, realm, realm->seq, le64_to_cpu(ri->seq));
+                /*
+                 * if the realm seq has changed, queue a cap_snap for every
+                 * inode with open caps.  we do this _before_ we update
+                 * the realm info so that we prepare for writeback under the
+                 * _previous_ snap context.
+                 *
+                 * ...unless it's a snap deletion!
+                 */
+                if (!deletion) {
+                        struct ceph_inode_info *ci;
+                        struct inode *lastinode = NULL;
+
+                        spin_lock(&realm->inodes_with_caps_lock);
+                        list_for_each_entry(ci, &realm->inodes_with_caps,
+                                            i_snap_realm_item) {
+                                struct inode *inode = igrab(&ci->vfs_inode);
+                                if (!inode)
+                                        continue;
+                                spin_unlock(&realm->inodes_with_caps_lock);
+                                if (lastinode)
+                                        iput(lastinode);
+                                lastinode = inode;
+                                ceph_queue_cap_snap(ci);
+                                spin_lock(&realm->inodes_with_caps_lock);
+                        }
+                        spin_unlock(&realm->inodes_with_caps_lock);
+                        if (lastinode)
+                                iput(lastinode);
+                        dout("update_snap_trace cap_snaps queued\n");
+                }
+
+        } else {
+                dout("update_snap_trace %llx %p seq %lld unchanged\n",
+                     realm->ino, realm, realm->seq);
+        }
+
+        /* ensure the parent is correct */
+        err = adjust_snap_realm_parent(mdsc, realm, le64_to_cpu(ri->parent));
+        if (err < 0)
+                goto fail;
+        invalidate += err;
+
+        if (le64_to_cpu(ri->seq) > realm->seq) {
+                /* update realm parameters, snap lists */
+                realm->seq = le64_to_cpu(ri->seq);
+                realm->created = le64_to_cpu(ri->created);
+                realm->parent_since = le64_to_cpu(ri->parent_since);
+
+                realm->num_snaps = le32_to_cpu(ri->num_snaps);
+                err = dup_array(&realm->snaps, snaps, realm->num_snaps);
+                if (err < 0)
+                        goto fail;
+
+                realm->num_prior_parent_snaps =
+                        le32_to_cpu(ri->num_prior_parent_snaps);
+                err = dup_array(&realm->prior_parent_snaps, prior_parent_snaps,
+                                realm->num_prior_parent_snaps);
+                if (err < 0)
+                        goto fail;
+
+                invalidate = 1;
+        } else if (!realm->cached_context) {
+                invalidate = 1;
+        }
+
+        dout("done with %llx %p, invalidated=%d, %p %p\n", realm->ino,
+             realm, invalidate, p, e);
+
+        if (p < e)
+                goto more;
+
+        /* invalidate when we reach the _end_ (root) of the trace */
+        if (invalidate)
+                rebuild_snap_realms(realm);
+
+        __cleanup_empty_realms(mdsc);
+        return 0;
+
+bad:
+        err = -EINVAL;
+fail:
+        pr_err("update_snap_trace error %d\n", err);
+        return err;
+}
+
+
+/*
+ * Send any cap_snaps that are queued for flush.  Try to carry
+ * s_mutex across multiple snap flushes to avoid locking overhead.
+ *
+ * Caller holds no locks.
+ */
+static void flush_snaps(struct ceph_mds_client *mdsc)
+{
+        struct ceph_inode_info *ci;
+        struct inode *inode;
+        struct ceph_mds_session *session = NULL;
+
+        dout("flush_snaps\n");
+        spin_lock(&mdsc->snap_flush_lock);
+        while (!list_empty(&mdsc->snap_flush_list)) {
+                ci = list_first_entry(&mdsc->snap_flush_list,
+                                struct ceph_inode_info, i_snap_flush_item);
+                inode = &ci->vfs_inode;
+                igrab(inode);
+                spin_unlock(&mdsc->snap_flush_lock);
+                spin_lock(&inode->i_lock);
+                __ceph_flush_snaps(ci, &session);
+                spin_unlock(&inode->i_lock);
+                iput(inode);
+                spin_lock(&mdsc->snap_flush_lock);
+        }
+        spin_unlock(&mdsc->snap_flush_lock);
+
+        if (session) {
+                mutex_unlock(&session->s_mutex);
+                ceph_put_mds_session(session);
+        }
+        dout("flush_snaps done\n");
+}
+
+
+/*
+ * Handle a snap notification from the MDS.
+ *
+ * This can take two basic forms: the simplest is just a snap creation
+ * or deletion notification on an existing realm.  This should update the
+ * realm and its children.
+ *
+ * The more difficult case is realm creation, due to snap creation at a
+ * new point in the file hierarchy, or due to a rename that moves a file or
+ * directory into another realm.
+ */
+void ceph_handle_snap(struct ceph_mds_client *mdsc,
+                      struct ceph_mds_session *session,
+                      struct ceph_msg *msg)
+{
+        struct super_block *sb = mdsc->client->sb;
+        int mds = session->s_mds;
+        u64 split;
+        int op;
+        int trace_len;
+        struct ceph_snap_realm *realm = NULL;
+        void *p = msg->front.iov_base;
+        void *e = p + msg->front.iov_len;
+        struct ceph_mds_snap_head *h;
+        int num_split_inos, num_split_realms;
+        __le64 *split_inos = NULL, *split_realms = NULL;
+        int i;
+        int locked_rwsem = 0;
+
+        /* decode */
+        if (msg->front.iov_len < sizeof(*h))
+                goto bad;
+        h = p;
+        op = le32_to_cpu(h->op);
+        split = le64_to_cpu(h->split);   /* non-zero if we are splitting an
+                                          * existing realm */
+        num_split_inos = le32_to_cpu(h->num_split_inos);
+        num_split_realms = le32_to_cpu(h->num_split_realms);
+        trace_len = le32_to_cpu(h->trace_len);
+        p += sizeof(*h);
+
+        dout("handle_snap from mds%d op %s split %llx tracelen %d\n", mds,
+             ceph_snap_op_name(op), split, trace_len);
+
+        mutex_lock(&session->s_mutex);
+        session->s_seq++;
+        mutex_unlock(&session->s_mutex);
+
+        down_write(&mdsc->snap_rwsem);
+        locked_rwsem = 1;
+
+        if (op == CEPH_SNAP_OP_SPLIT) {
+                struct ceph_mds_snap_realm *ri;
+
+                /*
+                 * A "split" breaks part of an existing realm off into
+                 * a new realm.  The MDS provides a list of inodes
+                 * (with caps) and child realms that belong to the new
+                 * child.
+                 */
+                split_inos = p;
+                p += sizeof(u64) * num_split_inos;
+                split_realms = p;
+                p += sizeof(u64) * num_split_realms;
+                ceph_decode_need(&p, e, sizeof(*ri), bad);
+                /* we will peek at realm info here, but will _not_
+                 * advance p, as the realm update will occur below in
+                 * ceph_update_snap_trace. */
+                ri = p;
+
+                realm = ceph_lookup_snap_realm(mdsc, split);
+                if (!realm) {
+                        realm = ceph_create_snap_realm(mdsc, split);
+                        if (IS_ERR(realm))
+                                goto out;
+                }
+                ceph_get_snap_realm(mdsc, realm);
+
+                dout("splitting snap_realm %llx %p\n", realm->ino, realm);
+                for (i = 0; i < num_split_inos; i++) {
+                        struct ceph_vino vino = {
+                                .ino = le64_to_cpu(split_inos[i]),
+                                .snap = CEPH_NOSNAP,
+                        };
+                        struct inode *inode = ceph_find_inode(sb, vino);
+                        struct ceph_inode_info *ci;
+
+                        if (!inode)
+                                continue;
+                        ci = ceph_inode(inode);
+
+                        spin_lock(&inode->i_lock);
+                        if (!ci->i_snap_realm)
+                                goto skip_inode;
+                        /*
+                         * If this inode belongs to a realm that was
+                         * created after our new realm, we experienced
+                         * a race (due to another split notifications
+                         * arriving from a different MDS).  So skip
+                         * this inode.
+                         */
+                        if (ci->i_snap_realm->created >
+                            le64_to_cpu(ri->created)) {
+                                dout(" leaving %p in newer realm %llx %p\n",
+                                     inode, ci->i_snap_realm->ino,
+                                     ci->i_snap_realm);
+                                goto skip_inode;
+                        }
+                        dout(" will move %p to split realm %llx %p\n",
+                             inode, realm->ino, realm);
+                        /*
+                         * Remove the inode from the realm's inode
+                         * list, but don't add it to the new realm
+                         * yet.  We don't want the cap_snap to be
+                         * queued (again) by ceph_update_snap_trace()
+                         * below.  Queue it _now_, under the old context.
+                         */
+                        spin_lock(&realm->inodes_with_caps_lock);
+                        list_del_init(&ci->i_snap_realm_item);
+                        spin_unlock(&realm->inodes_with_caps_lock);
+                        spin_unlock(&inode->i_lock);
+
+                        ceph_queue_cap_snap(ci);
+
+                        iput(inode);
+                        continue;
+
+skip_inode:
+                        spin_unlock(&inode->i_lock);
+                        iput(inode);
+                }
+
+                /* we may have taken some of the old realm's children. */
+                for (i = 0; i < num_split_realms; i++) {
+                        struct ceph_snap_realm *child =
+                                ceph_lookup_snap_realm(mdsc,
+                                           le64_to_cpu(split_realms[i]));
+                        if (!child)
+                                continue;
+                        adjust_snap_realm_parent(mdsc, child, realm->ino);
+                }
+        }
+
+        /*
+         * update using the provided snap trace. if we are deleting a
+         * snap, we can avoid queueing cap_snaps.
+         */
+        ceph_update_snap_trace(mdsc, p, e,
+                               op == CEPH_SNAP_OP_DESTROY);
+
+        if (op == CEPH_SNAP_OP_SPLIT) {
+                /*
+                 * ok, _now_ add the inodes into the new realm.
+                 */
+                for (i = 0; i < num_split_inos; i++) {
+                        struct ceph_vino vino = {
+                                .ino = le64_to_cpu(split_inos[i]),
+                                .snap = CEPH_NOSNAP,
+                        };
+                        struct inode *inode = ceph_find_inode(sb, vino);
+                        struct ceph_inode_info *ci;
+
+                        if (!inode)
+                                continue;
+                        ci = ceph_inode(inode);
+                        spin_lock(&inode->i_lock);
+                        if (!ci->i_snap_realm)
+                                goto split_skip_inode;
+                        ceph_put_snap_realm(mdsc, ci->i_snap_realm);
+                        spin_lock(&realm->inodes_with_caps_lock);
+                        list_add(&ci->i_snap_realm_item,
+                                 &realm->inodes_with_caps);
+                        ci->i_snap_realm = realm;
+                        spin_unlock(&realm->inodes_with_caps_lock);
+                        ceph_get_snap_realm(mdsc, realm);
+split_skip_inode:
+                        spin_unlock(&inode->i_lock);
+                        iput(inode);
+                }
+
+                /* we took a reference when we created the realm, above */
+                ceph_put_snap_realm(mdsc, realm);
+        }
+
+        __cleanup_empty_realms(mdsc);
+
+        up_write(&mdsc->snap_rwsem);
+
+        flush_snaps(mdsc);
+        return;
+
+bad:
+        pr_err("corrupt snap message from mds%d\n", mds);
+        ceph_msg_dump(msg);
+out:
+        if (locked_rwsem)
+                up_write(&mdsc->snap_rwsem);
+        return;
+}
+
+
+
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
new file mode 100644
index 000000000000..75d02eaa1279
--- /dev/null
+++ b/fs/ceph/super.c
@@ -0,0 +1,1031 @@
+
+#include "ceph_debug.h"
+
+#include <linux/backing-dev.h>
+#include <linux/fs.h>
+#include <linux/inet.h>
+#include <linux/in6.h>
+#include <linux/module.h>
+#include <linux/mount.h>
+#include <linux/parser.h>
+#include <linux/rwsem.h>
+#include <linux/sched.h>
+#include <linux/seq_file.h>
+#include <linux/slab.h>
+#include <linux/statfs.h>
+#include <linux/string.h>
+#include <linux/version.h>
+#include <linux/vmalloc.h>
+
+#include "decode.h"
+#include "super.h"
+#include "mon_client.h"
+#include "auth.h"
+
+/*
+ * Ceph superblock operations
+ *
+ * Handle the basics of mounting, unmounting.
+ */
+
+
+/*
+ * find filename portion of a path (/foo/bar/baz -> baz)
+ */
+const char *ceph_file_part(const char *s, int len)
+{
+        const char *e = s + len;
+
+        while (e != s && *(e-1) != '/')
+                e--;
+        return e;
+}
+
+
+/*
+ * super ops
+ */
+static void ceph_put_super(struct super_block *s)
+{
+        struct ceph_client *cl = ceph_client(s);
+
+        dout("put_super\n");
+        ceph_mdsc_close_sessions(&cl->mdsc);
+        return;
+}
+
+static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
+{
+        struct ceph_client *client = ceph_inode_to_client(dentry->d_inode);
+        struct ceph_monmap *monmap = client->monc.monmap;
+        struct ceph_statfs st;
+        u64 fsid;
+        int err;
+
+        dout("statfs\n");
+        err = ceph_monc_do_statfs(&client->monc, &st);
+        if (err < 0)
+                return err;
+
+        /* fill in kstatfs */
+        buf->f_type = CEPH_SUPER_MAGIC;  /* ?? */
+
+        /*
+         * express utilization in terms of large blocks to avoid
+         * overflow on 32-bit machines.
+         */
+        buf->f_bsize = 1 << CEPH_BLOCK_SHIFT;
+        buf->f_blocks = le64_to_cpu(st.kb) >> (CEPH_BLOCK_SHIFT-10);
+        buf->f_bfree = (le64_to_cpu(st.kb) - le64_to_cpu(st.kb_used)) >>
+                (CEPH_BLOCK_SHIFT-10);
+        buf->f_bavail = le64_to_cpu(st.kb_avail) >> (CEPH_BLOCK_SHIFT-10);
+
+        buf->f_files = le64_to_cpu(st.num_objects);
+        buf->f_ffree = -1;
+        buf->f_namelen = PATH_MAX;
+        buf->f_frsize = PAGE_CACHE_SIZE;
+
+        /* leave fsid little-endian, regardless of host endianness */
+        fsid = *(u64 *)(&monmap->fsid) ^ *((u64 *)&monmap->fsid + 1);
+        buf->f_fsid.val[0] = fsid & 0xffffffff;
+        buf->f_fsid.val[1] = fsid >> 32;
+
+        return 0;
+}
+
+
+static int ceph_syncfs(struct super_block *sb, int wait)
+{
+        dout("sync_fs %d\n", wait);
+        ceph_osdc_sync(&ceph_client(sb)->osdc);
+        ceph_mdsc_sync(&ceph_client(sb)->mdsc);
+        dout("sync_fs %d done\n", wait);
+        return 0;
+}
+
+
+/**
+ * ceph_show_options - Show mount options in /proc/mounts
+ * @m: seq_file to write to
+ * @mnt: mount descriptor
+ */
+static int ceph_show_options(struct seq_file *m, struct vfsmount *mnt)
+{
+        struct ceph_client *client = ceph_sb_to_client(mnt->mnt_sb);
+        struct ceph_mount_args *args = client->mount_args;
+
+        if (args->flags & CEPH_OPT_FSID)
+                seq_printf(m, ",fsidmajor=%llu,fsidminor%llu",
+                           le64_to_cpu(*(__le64 *)&args->fsid.fsid[0]),
+                           le64_to_cpu(*(__le64 *)&args->fsid.fsid[8]));
+        if (args->flags & CEPH_OPT_NOSHARE)
+                seq_puts(m, ",noshare");
+        if (args->flags & CEPH_OPT_DIRSTAT)
+                seq_puts(m, ",dirstat");
+        if ((args->flags & CEPH_OPT_RBYTES) == 0)
+                seq_puts(m, ",norbytes");
+        if (args->flags & CEPH_OPT_NOCRC)
+                seq_puts(m, ",nocrc");
+        if (args->flags & CEPH_OPT_NOASYNCREADDIR)
+                seq_puts(m, ",noasyncreaddir");
+        if (strcmp(args->snapdir_name, CEPH_SNAPDIRNAME_DEFAULT))
+                seq_printf(m, ",snapdirname=%s", args->snapdir_name);
+        if (args->name)
+                seq_printf(m, ",name=%s", args->name);
+        if (args->secret)
+                seq_puts(m, ",secret=<hidden>");
+        return 0;
+}
+
+/*
+ * caches
+ */
+struct kmem_cache *ceph_inode_cachep;
+struct kmem_cache *ceph_cap_cachep;
+struct kmem_cache *ceph_dentry_cachep;
+struct kmem_cache *ceph_file_cachep;
+
+static void ceph_inode_init_once(void *foo)
+{
+        struct ceph_inode_info *ci = foo;
+        inode_init_once(&ci->vfs_inode);
+}
+
+static int default_congestion_kb(void)
+{
+        int congestion_kb;
+
+        /*
+         * Copied from NFS
+         *
+         * congestion size, scale with available memory.
+         *
+         *  64MB:    8192k
+         * 128MB:   11585k
+         * 256MB:   16384k
+         * 512MB:   23170k
+         *   1GB:   32768k
+         *   2GB:   46340k
+         *   4GB:   65536k
+         *   8GB:   92681k
+         *  16GB:  131072k
+         *
+         * This allows larger machines to have larger/more transfers.
+         * Limit the default to 256M
+         */
+        congestion_kb = (16*int_sqrt(totalram_pages)) << (PAGE_SHIFT-10);
+        if (congestion_kb > 256*1024)
+                congestion_kb = 256*1024;
+
+        return congestion_kb;
+}
+
+static int __init init_caches(void)
+{
+        ceph_inode_cachep = kmem_cache_create("ceph_inode_info",
+                                      sizeof(struct ceph_inode_info),
+                                      __alignof__(struct ceph_inode_info),
+                                      (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD),
+                                      ceph_inode_init_once);
+        if (ceph_inode_cachep == NULL)
+                return -ENOMEM;
+
+        ceph_cap_cachep = KMEM_CACHE(ceph_cap,
+                                     SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD);
+        if (ceph_cap_cachep == NULL)
+                goto bad_cap;
+
+        ceph_dentry_cachep = KMEM_CACHE(ceph_dentry_info,
+                                        SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD);
+        if (ceph_dentry_cachep == NULL)
+                goto bad_dentry;
+
+        ceph_file_cachep = KMEM_CACHE(ceph_file_info,
+                                      SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD);
+        if (ceph_file_cachep == NULL)
+                goto bad_file;
+
+        return 0;
+
+bad_file:
+        kmem_cache_destroy(ceph_dentry_cachep);
+bad_dentry:
+        kmem_cache_destroy(ceph_cap_cachep);
+bad_cap:
+        kmem_cache_destroy(ceph_inode_cachep);
+        return -ENOMEM;
+}
+
+static void destroy_caches(void)
+{
+        kmem_cache_destroy(ceph_inode_cachep);
+        kmem_cache_destroy(ceph_cap_cachep);
+        kmem_cache_destroy(ceph_dentry_cachep);
+        kmem_cache_destroy(ceph_file_cachep);
+}
+
+
+/*
+ * ceph_umount_begin - initiate forced umount.  Tear down down the
+ * mount, skipping steps that may hang while waiting for server(s).
+ */
+static void ceph_umount_begin(struct super_block *sb)
+{
+        struct ceph_client *client = ceph_sb_to_client(sb);
+
+        dout("ceph_umount_begin - starting forced umount\n");
+        if (!client)
+                return;
+        client->mount_state = CEPH_MOUNT_SHUTDOWN;
+        return;
+}
+
+static const struct super_operations ceph_super_ops = {
+        .alloc_inode    = ceph_alloc_inode,
+        .destroy_inode  = ceph_destroy_inode,
+        .write_inode    = ceph_write_inode,
+        .sync_fs        = ceph_syncfs,
+        .put_super      = ceph_put_super,
+        .show_options   = ceph_show_options,
+        .statfs         = ceph_statfs,
+        .umount_begin   = ceph_umount_begin,
+};
+
+
+const char *ceph_msg_type_name(int type)
+{
+        switch (type) {
+        case CEPH_MSG_SHUTDOWN: return "shutdown";
+        case CEPH_MSG_PING: return "ping";
+        case CEPH_MSG_AUTH: return "auth";
+        case CEPH_MSG_AUTH_REPLY: return "auth_reply";
+        case CEPH_MSG_MON_MAP: return "mon_map";
+        case CEPH_MSG_MON_GET_MAP: return "mon_get_map";
+        case CEPH_MSG_MON_SUBSCRIBE: return "mon_subscribe";
+        case CEPH_MSG_MON_SUBSCRIBE_ACK: return "mon_subscribe_ack";
+        case CEPH_MSG_STATFS: return "statfs";
+        case CEPH_MSG_STATFS_REPLY: return "statfs_reply";
+        case CEPH_MSG_MDS_MAP: return "mds_map";
+        case CEPH_MSG_CLIENT_SESSION: return "client_session";
+        case CEPH_MSG_CLIENT_RECONNECT: return "client_reconnect";
+        case CEPH_MSG_CLIENT_REQUEST: return "client_request";
+        case CEPH_MSG_CLIENT_REQUEST_FORWARD: return "client_request_forward";
+        case CEPH_MSG_CLIENT_REPLY: return "client_reply";
+        case CEPH_MSG_CLIENT_CAPS: return "client_caps";
+        case CEPH_MSG_CLIENT_CAPRELEASE: return "client_cap_release";
+        case CEPH_MSG_CLIENT_SNAP: return "client_snap";
+        case CEPH_MSG_CLIENT_LEASE: return "client_lease";
+        case CEPH_MSG_OSD_MAP: return "osd_map";
+        case CEPH_MSG_OSD_OP: return "osd_op";
+        case CEPH_MSG_OSD_OPREPLY: return "osd_opreply";
+        default: return "unknown";
+        }
+}
+
+
+/*
+ * mount options
+ */
+enum {
+        Opt_fsidmajor,
+        Opt_fsidminor,
+        Opt_monport,
+        Opt_wsize,
+        Opt_rsize,
+        Opt_osdtimeout,
+        Opt_osdkeepalivetimeout,
+        Opt_mount_timeout,
+        Opt_osd_idle_ttl,
+        Opt_caps_wanted_delay_min,
+        Opt_caps_wanted_delay_max,
+        Opt_readdir_max_entries,
+        Opt_congestion_kb,
+        Opt_last_int,
+        /* int args above */
+        Opt_snapdirname,
+        Opt_name,
+        Opt_secret,
+        Opt_last_string,
+        /* string args above */
+        Opt_ip,
+        Opt_noshare,
+        Opt_dirstat,
+        Opt_nodirstat,
+        Opt_rbytes,
+        Opt_norbytes,
+        Opt_nocrc,
+        Opt_noasyncreaddir,
+};
+
+static match_table_t arg_tokens = {
+        {Opt_fsidmajor, "fsidmajor=%ld"},
+        {Opt_fsidminor, "fsidminor=%ld"},
+        {Opt_monport, "monport=%d"},
+        {Opt_wsize, "wsize=%d"},
+        {Opt_rsize, "rsize=%d"},
+        {Opt_osdtimeout, "osdtimeout=%d"},
+        {Opt_osdkeepalivetimeout, "osdkeepalive=%d"},
+        {Opt_mount_timeout, "mount_timeout=%d"},
+        {Opt_osd_idle_ttl, "osd_idle_ttl=%d"},
+        {Opt_caps_wanted_delay_min, "caps_wanted_delay_min=%d"},
+        {Opt_caps_wanted_delay_max, "caps_wanted_delay_max=%d"},
+        {Opt_readdir_max_entries, "readdir_max_entries=%d"},
+        {Opt_congestion_kb, "write_congestion_kb=%d"},
+        /* int args above */
+        {Opt_snapdirname, "snapdirname=%s"},
+        {Opt_name, "name=%s"},
+        {Opt_secret, "secret=%s"},
+        /* string args above */
+        {Opt_ip, "ip=%s"},
+        {Opt_noshare, "noshare"},
+        {Opt_dirstat, "dirstat"},
+        {Opt_nodirstat, "nodirstat"},
+        {Opt_rbytes, "rbytes"},
+        {Opt_norbytes, "norbytes"},
+        {Opt_nocrc, "nocrc"},
+        {Opt_noasyncreaddir, "noasyncreaddir"},
+        {-1, NULL}
+};
+
+
+static struct ceph_mount_args *parse_mount_args(int flags, char *options,
+                                                const char *dev_name,
+                                                const char **path)
+{
+        struct ceph_mount_args *args;
+        const char *c;
+        int err = -ENOMEM;
+        substring_t argstr[MAX_OPT_ARGS];
+
+        args = kzalloc(sizeof(*args), GFP_KERNEL);
+        if (!args)
+                return ERR_PTR(-ENOMEM);
+        args->mon_addr = kcalloc(CEPH_MAX_MON, sizeof(*args->mon_addr),
+                                 GFP_KERNEL);
+        if (!args->mon_addr)
+                goto out;
+
+        dout("parse_mount_args %p, dev_name '%s'\n", args, dev_name);
+
+        /* start with defaults */
+        args->sb_flags = flags;
+        args->flags = CEPH_OPT_DEFAULT;
+        args->osd_timeout = CEPH_OSD_TIMEOUT_DEFAULT;
+        args->osd_keepalive_timeout = CEPH_OSD_KEEPALIVE_DEFAULT;
+        args->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT; /* seconds */
+        args->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;   /* seconds */
+        args->caps_wanted_delay_min = CEPH_CAPS_WANTED_DELAY_MIN_DEFAULT;
+        args->caps_wanted_delay_max = CEPH_CAPS_WANTED_DELAY_MAX_DEFAULT;
+        args->rsize = CEPH_MOUNT_RSIZE_DEFAULT;
+        args->snapdir_name = kstrdup(CEPH_SNAPDIRNAME_DEFAULT, GFP_KERNEL);
+        args->cap_release_safety = CEPH_CAPS_PER_RELEASE * 4;
+        args->max_readdir = 1024;
+        args->congestion_kb = default_congestion_kb();
+
+        /* ip1[:port1][,ip2[:port2]...]:/subdir/in/fs */
+        err = -EINVAL;
+        if (!dev_name)
+                goto out;
+        *path = strstr(dev_name, ":/");
+        if (*path == NULL) {
+                pr_err("device name is missing path (no :/ in %s)\n",
+                       dev_name);
+                goto out;
+        }
+
+        /* get mon ip(s) */
+        err = ceph_parse_ips(dev_name, *path, args->mon_addr,
+                             CEPH_MAX_MON, &args->num_mon);
+        if (err < 0)
+                goto out;
+
+        /* path on server */
+        *path += 2;
+        dout("server path '%s'\n", *path);
+
+        /* parse mount options */
+        while ((c = strsep(&options, ",")) != NULL) {
+                int token, intval, ret;
+                if (!*c)
+                        continue;
+                err = -EINVAL;
+                token = match_token((char *)c, arg_tokens, argstr);
+                if (token < 0) {
+                        pr_err("bad mount option at '%s'\n", c);
+                        goto out;
+                }
+                if (token < Opt_last_int) {
+                        ret = match_int(&argstr[0], &intval);
+                        if (ret < 0) {
+                                pr_err("bad mount option arg (not int) "
+                                       "at '%s'\n", c);
+                                continue;
+                        }
+                        dout("got int token %d val %d\n", token, intval);
+                } else if (token > Opt_last_int && token < Opt_last_string) {
+                        dout("got string token %d val %s\n", token,
+                             argstr[0].from);
+                } else {
+                        dout("got token %d\n", token);
+                }
+                switch (token) {
+                case Opt_fsidmajor:
+                        *(__le64 *)&args->fsid.fsid[0] = cpu_to_le64(intval);
+                        break;
+                case Opt_fsidminor:
+                        *(__le64 *)&args->fsid.fsid[8] = cpu_to_le64(intval);
+                        break;
+                case Opt_ip:
+                        err = ceph_parse_ips(argstr[0].from,
+                                             argstr[0].to,
+                                             &args->my_addr,
+                                             1, NULL);
+                        if (err < 0)
+                                goto out;
+                        args->flags |= CEPH_OPT_MYIP;
+                        break;
+
+                case Opt_snapdirname:
+                        kfree(args->snapdir_name);
+                        args->snapdir_name = kstrndup(argstr[0].from,
+                                              argstr[0].to-argstr[0].from,
+                                              GFP_KERNEL);
+                        break;
+                case Opt_name:
+                        args->name = kstrndup(argstr[0].from,
+                                              argstr[0].to-argstr[0].from,
+                                              GFP_KERNEL);
+                        break;
+                case Opt_secret:
+                        args->secret = kstrndup(argstr[0].from,
+                                                argstr[0].to-argstr[0].from,
+                                                GFP_KERNEL);
+                        break;
+
+                        /* misc */
+                case Opt_wsize:
+                        args->wsize = intval;
+                        break;
+                case Opt_rsize:
+                        args->rsize = intval;
+                        break;
+                case Opt_osdtimeout:
+                        args->osd_timeout = intval;
+                        break;
+                case Opt_osdkeepalivetimeout:
+                        args->osd_keepalive_timeout = intval;
+                        break;
+                case Opt_mount_timeout:
+                        args->mount_timeout = intval;
+                        break;
+                case Opt_caps_wanted_delay_min:
+                        args->caps_wanted_delay_min = intval;
+                        break;
+                case Opt_caps_wanted_delay_max:
+                        args->caps_wanted_delay_max = intval;
+                        break;
+                case Opt_readdir_max_entries:
+                        args->max_readdir = intval;
+                        break;
+                case Opt_congestion_kb:
+                        args->congestion_kb = intval;
+                        break;
+
+                case Opt_noshare:
+                        args->flags |= CEPH_OPT_NOSHARE;
+                        break;
+
+                case Opt_dirstat:
+                        args->flags |= CEPH_OPT_DIRSTAT;
+                        break;
+                case Opt_nodirstat:
+                        args->flags &= ~CEPH_OPT_DIRSTAT;
+                        break;
+                case Opt_rbytes:
+                        args->flags |= CEPH_OPT_RBYTES;
+                        break;
+                case Opt_norbytes:
+                        args->flags &= ~CEPH_OPT_RBYTES;
+                        break;
+                case Opt_nocrc:
+                        args->flags |= CEPH_OPT_NOCRC;
+                        break;
+                case Opt_noasyncreaddir:
+                        args->flags |= CEPH_OPT_NOASYNCREADDIR;
+                        break;
+
+                default:
+                        BUG_ON(token);
+                }
+        }
+        return args;
+
+out:
+        kfree(args->mon_addr);
+        kfree(args);
+        return ERR_PTR(err);
+}
+
+static void destroy_mount_args(struct ceph_mount_args *args)
+{
+        dout("destroy_mount_args %p\n", args);
+        kfree(args->snapdir_name);
+        args->snapdir_name = NULL;
+        kfree(args->name);
+        args->name = NULL;
+        kfree(args->secret);
+        args->secret = NULL;
+        kfree(args);
+}
+
+/*
+ * create a fresh client instance
+ */
+static struct ceph_client *ceph_create_client(struct ceph_mount_args *args)
+{
+        struct ceph_client *client;
+        int err = -ENOMEM;
+
+        client = kzalloc(sizeof(*client), GFP_KERNEL);
+        if (client == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        mutex_init(&client->mount_mutex);
+
+        init_waitqueue_head(&client->auth_wq);
+
+        client->sb = NULL;
+        client->mount_state = CEPH_MOUNT_MOUNTING;
+        client->mount_args = args;
+
+        client->msgr = NULL;
+
+        client->auth_err = 0;
+        atomic_long_set(&client->writeback_count, 0);
+
+        err = bdi_init(&client->backing_dev_info);
+        if (err < 0)
+                goto fail;
+
+        err = -ENOMEM;
+        client->wb_wq = create_workqueue("ceph-writeback");
+        if (client->wb_wq == NULL)
+                goto fail_bdi;
+        client->pg_inv_wq = create_singlethread_workqueue("ceph-pg-invalid");
+        if (client->pg_inv_wq == NULL)
+                goto fail_wb_wq;
+        client->trunc_wq = create_singlethread_workqueue("ceph-trunc");
+        if (client->trunc_wq == NULL)
+                goto fail_pg_inv_wq;
+
+        /* set up mempools */
+        err = -ENOMEM;
+        client->wb_pagevec_pool = mempool_create_kmalloc_pool(10,
+                              client->mount_args->wsize >> PAGE_CACHE_SHIFT);
+        if (!client->wb_pagevec_pool)
+                goto fail_trunc_wq;
+
+        /* caps */
+        client->min_caps = args->max_readdir;
+        ceph_adjust_min_caps(client->min_caps);
+
+        /* subsystems */
+        err = ceph_monc_init(&client->monc, client);
+        if (err < 0)
+                goto fail_mempool;
+        err = ceph_osdc_init(&client->osdc, client);
+        if (err < 0)
+                goto fail_monc;
+        err = ceph_mdsc_init(&client->mdsc, client);
+        if (err < 0)
+                goto fail_osdc;
+        return client;
+
+fail_osdc:
+        ceph_osdc_stop(&client->osdc);
+fail_monc:
+        ceph_monc_stop(&client->monc);
+fail_mempool:
+        mempool_destroy(client->wb_pagevec_pool);
+fail_trunc_wq:
+        destroy_workqueue(client->trunc_wq);
+fail_pg_inv_wq:
+        destroy_workqueue(client->pg_inv_wq);
+fail_wb_wq:
+        destroy_workqueue(client->wb_wq);
+fail_bdi:
+        bdi_destroy(&client->backing_dev_info);
+fail:
+        kfree(client);
+        return ERR_PTR(err);
+}
+
+static void ceph_destroy_client(struct ceph_client *client)
+{
+        dout("destroy_client %p\n", client);
+
+        /* unmount */
+        ceph_mdsc_stop(&client->mdsc);
+        ceph_monc_stop(&client->monc);
+        ceph_osdc_stop(&client->osdc);
+
+        ceph_adjust_min_caps(-client->min_caps);
+
+        ceph_debugfs_client_cleanup(client);
+        destroy_workqueue(client->wb_wq);
+        destroy_workqueue(client->pg_inv_wq);
+        destroy_workqueue(client->trunc_wq);
+
+        if (client->msgr)
+                ceph_messenger_destroy(client->msgr);
+        mempool_destroy(client->wb_pagevec_pool);
+
+        destroy_mount_args(client->mount_args);
+
+        kfree(client);
+        dout("destroy_client %p done\n", client);
+}
+
+/*
+ * Initially learn our fsid, or verify an fsid matches.
+ */
+int ceph_check_fsid(struct ceph_client *client, struct ceph_fsid *fsid)
+{
+        if (client->have_fsid) {
+                if (ceph_fsid_compare(&client->fsid, fsid)) {
+                        pr_err("bad fsid, had " FSID_FORMAT " got " FSID_FORMAT,
+                               PR_FSID(&client->fsid), PR_FSID(fsid));
+                        return -1;
+                }
+        } else {
+                pr_info("client%lld fsid " FSID_FORMAT "\n",
+                        client->monc.auth->global_id, PR_FSID(fsid));
+                memcpy(&client->fsid, fsid, sizeof(*fsid));
+                ceph_debugfs_client_init(client);
+                client->have_fsid = true;
+        }
+        return 0;
+}
+
+/*
+ * true if we have the mon map (and have thus joined the cluster)
+ */
+static int have_mon_map(struct ceph_client *client)
+{
+        return client->monc.monmap && client->monc.monmap->epoch;
+}
+
+/*
+ * Bootstrap mount by opening the root directory.  Note the mount
+ * @started time from caller, and time out if this takes too long.
+ */
+static struct dentry *open_root_dentry(struct ceph_client *client,
+                                       const char *path,
+                                       unsigned long started)
+{
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct ceph_mds_request *req = NULL;
+        int err;
+        struct dentry *root;
+
+        /* open dir */
+        dout("open_root_inode opening '%s'\n", path);
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_GETATTR, USE_ANY_MDS);
+        if (IS_ERR(req))
+                return ERR_PTR(PTR_ERR(req));
+        req->r_path1 = kstrdup(path, GFP_NOFS);
+        req->r_ino1.ino = CEPH_INO_ROOT;
+        req->r_ino1.snap = CEPH_NOSNAP;
+        req->r_started = started;
+        req->r_timeout = client->mount_args->mount_timeout * HZ;
+        req->r_args.getattr.mask = cpu_to_le32(CEPH_STAT_CAP_INODE);
+        req->r_num_caps = 2;
+        err = ceph_mdsc_do_request(mdsc, NULL, req);
+        if (err == 0) {
+                dout("open_root_inode success\n");
+                if (ceph_ino(req->r_target_inode) == CEPH_INO_ROOT &&
+                    client->sb->s_root == NULL)
+                        root = d_alloc_root(req->r_target_inode);
+                else
+                        root = d_obtain_alias(req->r_target_inode);
+                req->r_target_inode = NULL;
+                dout("open_root_inode success, root dentry is %p\n", root);
+        } else {
+                root = ERR_PTR(err);
+        }
+        ceph_mdsc_put_request(req);
+        return root;
+}
+
+/*
+ * mount: join the ceph cluster, and open root directory.
+ */
+static int ceph_mount(struct ceph_client *client, struct vfsmount *mnt,
+                      const char *path)
+{
+        struct ceph_entity_addr *myaddr = NULL;
+        int err;
+        unsigned long timeout = client->mount_args->mount_timeout * HZ;
+        unsigned long started = jiffies;  /* note the start time */
+        struct dentry *root;
+
+        dout("mount start\n");
+        mutex_lock(&client->mount_mutex);
+
+        /* initialize the messenger */
+        if (client->msgr == NULL) {
+                if (ceph_test_opt(client, MYIP))
+                        myaddr = &client->mount_args->my_addr;
+                client->msgr = ceph_messenger_create(myaddr);
+                if (IS_ERR(client->msgr)) {
+                        err = PTR_ERR(client->msgr);
+                        client->msgr = NULL;
+                        goto out;
+                }
+                client->msgr->nocrc = ceph_test_opt(client, NOCRC);
+        }
+
+        /* open session, and wait for mon, mds, and osd maps */
+        err = ceph_monc_open_session(&client->monc);
+        if (err < 0)
+                goto out;
+
+        while (!have_mon_map(client)) {
+                err = -EIO;
+                if (timeout && time_after_eq(jiffies, started + timeout))
+                        goto out;
+
+                /* wait */
+                dout("mount waiting for mon_map\n");
+                err = wait_event_interruptible_timeout(client->auth_wq,
+                               have_mon_map(client) || (client->auth_err < 0),
+                               timeout);
+                if (err == -EINTR || err == -ERESTARTSYS)
+                        goto out;
+                if (client->auth_err < 0) {
+                        err = client->auth_err;
+                        goto out;
+                }
+        }
+
+        dout("mount opening root\n");
+        root = open_root_dentry(client, "", started);
+        if (IS_ERR(root)) {
+                err = PTR_ERR(root);
+                goto out;
+        }
+        if (client->sb->s_root)
+                dput(root);
+        else
+                client->sb->s_root = root;
+
+        if (path[0] == 0) {
+                dget(root);
+        } else {
+                dout("mount opening base mountpoint\n");
+                root = open_root_dentry(client, path, started);
+                if (IS_ERR(root)) {
+                        err = PTR_ERR(root);
+                        dput(client->sb->s_root);
+                        client->sb->s_root = NULL;
+                        goto out;
+                }
+        }
+
+        mnt->mnt_root = root;
+        mnt->mnt_sb = client->sb;
+
+        client->mount_state = CEPH_MOUNT_MOUNTED;
+        dout("mount success\n");
+        err = 0;
+
+out:
+        mutex_unlock(&client->mount_mutex);
+        return err;
+}
+
+static int ceph_set_super(struct super_block *s, void *data)
+{
+        struct ceph_client *client = data;
+        int ret;
+
+        dout("set_super %p data %p\n", s, data);
+
+        s->s_flags = client->mount_args->sb_flags;
+        s->s_maxbytes = 1ULL << 40;  /* temp value until we get mdsmap */
+
+        s->s_fs_info = client;
+        client->sb = s;
+
+        s->s_op = &ceph_super_ops;
+        s->s_export_op = &ceph_export_ops;
+
+        s->s_time_gran = 1000;  /* 1000 ns == 1 us */
+
+        ret = set_anon_super(s, NULL);  /* what is that second arg for? */
+        if (ret != 0)
+                goto fail;
+
+        return ret;
+
+fail:
+        s->s_fs_info = NULL;
+        client->sb = NULL;
+        return ret;
+}
+
+/*
+ * share superblock if same fs AND options
+ */
+static int ceph_compare_super(struct super_block *sb, void *data)
+{
+        struct ceph_client *new = data;
+        struct ceph_mount_args *args = new->mount_args;
+        struct ceph_client *other = ceph_sb_to_client(sb);
+        int i;
+
+        dout("ceph_compare_super %p\n", sb);
+        if (args->flags & CEPH_OPT_FSID) {
+                if (ceph_fsid_compare(&args->fsid, &other->fsid)) {
+                        dout("fsid doesn't match\n");
+                        return 0;
+                }
+        } else {
+                /* do we share (a) monitor? */
+                for (i = 0; i < new->monc.monmap->num_mon; i++)
+                        if (ceph_monmap_contains(other->monc.monmap,
+                                         &new->monc.monmap->mon_inst[i].addr))
+                                break;
+                if (i == new->monc.monmap->num_mon) {
+                        dout("mon ip not part of monmap\n");
+                        return 0;
+                }
+                dout("mon ip matches existing sb %p\n", sb);
+        }
+        if (args->sb_flags != other->mount_args->sb_flags) {
+                dout("flags differ\n");
+                return 0;
+        }
+        return 1;
+}
+
+/*
+ * construct our own bdi so we can control readahead, etc.
+ */
+static int ceph_register_bdi(struct super_block *sb, struct ceph_client *client)
+{
+        int err;
+
+        sb->s_bdi = &client->backing_dev_info;
+
+        /* set ra_pages based on rsize mount option? */
+        if (client->mount_args->rsize >= PAGE_CACHE_SIZE)
+                client->backing_dev_info.ra_pages =
+                        (client->mount_args->rsize + PAGE_CACHE_SIZE - 1)
+                        >> PAGE_SHIFT;
+        err = bdi_register_dev(&client->backing_dev_info, sb->s_dev);
+        return err;
+}
+
+static int ceph_get_sb(struct file_system_type *fs_type,
+                       int flags, const char *dev_name, void *data,
+                       struct vfsmount *mnt)
+{
+        struct super_block *sb;
+        struct ceph_client *client;
+        int err;
+        int (*compare_super)(struct super_block *, void *) = ceph_compare_super;
+        const char *path = NULL;
+        struct ceph_mount_args *args;
+
+        dout("ceph_get_sb\n");
+        args = parse_mount_args(flags, data, dev_name, &path);
+        if (IS_ERR(args)) {
+                err = PTR_ERR(args);
+                goto out_final;
+        }
+
+        /* create client (which we may/may not use) */
+        client = ceph_create_client(args);
+        if (IS_ERR(client)) {
+                err = PTR_ERR(client);
+                goto out_final;
+        }
+
+        if (client->mount_args->flags & CEPH_OPT_NOSHARE)
+                compare_super = NULL;
+        sb = sget(fs_type, compare_super, ceph_set_super, client);
+        if (IS_ERR(sb)) {
+                err = PTR_ERR(sb);
+                goto out;
+        }
+
+        if (ceph_client(sb) != client) {
+                ceph_destroy_client(client);
+                client = ceph_client(sb);
+                dout("get_sb got existing client %p\n", client);
+        } else {
+                dout("get_sb using new client %p\n", client);
+                err = ceph_register_bdi(sb, client);
+                if (err < 0)
+                        goto out_splat;
+        }
+
+        err = ceph_mount(client, mnt, path);
+        if (err < 0)
+                goto out_splat;
+        dout("root %p inode %p ino %llx.%llx\n", mnt->mnt_root,
+             mnt->mnt_root->d_inode, ceph_vinop(mnt->mnt_root->d_inode));
+        return 0;
+
+out_splat:
+        ceph_mdsc_close_sessions(&client->mdsc);
+        up_write(&sb->s_umount);
+        deactivate_super(sb);
+        goto out_final;
+
+out:
+        ceph_destroy_client(client);
+out_final:
+        dout("ceph_get_sb fail %d\n", err);
+        return err;
+}
+
+static void ceph_kill_sb(struct super_block *s)
+{
+        struct ceph_client *client = ceph_sb_to_client(s);
+        dout("kill_sb %p\n", s);
+        ceph_mdsc_pre_umount(&client->mdsc);
+        kill_anon_super(s);    /* will call put_super after sb is r/o */
+        if (s->s_bdi == &client->backing_dev_info)
+                bdi_unregister(&client->backing_dev_info);
+        bdi_destroy(&client->backing_dev_info);
+        ceph_destroy_client(client);
+}
+
+static struct file_system_type ceph_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "ceph",
+        .get_sb         = ceph_get_sb,
+        .kill_sb        = ceph_kill_sb,
+        .fs_flags       = FS_RENAME_DOES_D_MOVE,
+};
+
+#define _STRINGIFY(x) #x
+#define STRINGIFY(x) _STRINGIFY(x)
+
+static int __init init_ceph(void)
+{
+        int ret = 0;
+
+        ret = ceph_debugfs_init();
+        if (ret < 0)
+                goto out;
+
+        ret = ceph_msgr_init();
+        if (ret < 0)
+                goto out_debugfs;
+
+        ret = init_caches();
+        if (ret)
+                goto out_msgr;
+
+        ceph_caps_init();
+
+        ret = register_filesystem(&ceph_fs_type);
+        if (ret)
+                goto out_icache;
+
+        pr_info("loaded %d.%d.%d (mon/mds/osd proto %d/%d/%d)\n",
+                CEPH_VERSION_MAJOR, CEPH_VERSION_MINOR, CEPH_VERSION_PATCH,
+                CEPH_MONC_PROTOCOL, CEPH_MDSC_PROTOCOL, CEPH_OSDC_PROTOCOL);
+        return 0;
+
+out_icache:
+        destroy_caches();
+out_msgr:
+        ceph_msgr_exit();
+out_debugfs:
+        ceph_debugfs_cleanup();
+out:
+        return ret;
+}
+
+static void __exit exit_ceph(void)
+{
+        dout("exit_ceph\n");
+        unregister_filesystem(&ceph_fs_type);
+        ceph_caps_finalize();
+        destroy_caches();
+        ceph_msgr_exit();
+        ceph_debugfs_cleanup();
+}
+
+module_init(init_ceph);
+module_exit(exit_ceph);
+
+MODULE_AUTHOR("Sage Weil <sage@newdream.net>");
+MODULE_AUTHOR("Yehuda Sadeh <yehuda@hq.newdream.net>");
+MODULE_AUTHOR("Patience Warnick <patience@newdream.net>");
+MODULE_DESCRIPTION("Ceph filesystem for Linux");
+MODULE_LICENSE("GPL");
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
new file mode 100644
index 000000000000..e30dfbb056c3
--- /dev/null
+++ b/fs/ceph/super.h
@@ -0,0 +1,901 @@
+#ifndef _FS_CEPH_SUPER_H
+#define _FS_CEPH_SUPER_H
+
+#include "ceph_debug.h"
+
+#include <asm/unaligned.h>
+#include <linux/backing-dev.h>
+#include <linux/completion.h>
+#include <linux/exportfs.h>
+#include <linux/fs.h>
+#include <linux/mempool.h>
+#include <linux/pagemap.h>
+#include <linux/wait.h>
+#include <linux/writeback.h>
+#include <linux/slab.h>
+
+#include "types.h"
+#include "messenger.h"
+#include "msgpool.h"
+#include "mon_client.h"
+#include "mds_client.h"
+#include "osd_client.h"
+#include "ceph_fs.h"
+
+/* f_type in struct statfs */
+#define CEPH_SUPER_MAGIC 0x00c36400
+
+/* large granularity for statfs utilization stats to facilitate
+ * large volume sizes on 32-bit machines. */
+#define CEPH_BLOCK_SHIFT   20  /* 1 MB */
+#define CEPH_BLOCK         (1 << CEPH_BLOCK_SHIFT)
+
+/*
+ * mount options
+ */
+#define CEPH_OPT_FSID             (1<<0)
+#define CEPH_OPT_NOSHARE          (1<<1) /* don't share client with other sbs */
+#define CEPH_OPT_MYIP             (1<<2) /* specified my ip */
+#define CEPH_OPT_DIRSTAT          (1<<4) /* funky `cat dirname` for stats */
+#define CEPH_OPT_RBYTES           (1<<5) /* dir st_bytes = rbytes */
+#define CEPH_OPT_NOCRC            (1<<6) /* no data crc on writes */
+#define CEPH_OPT_NOASYNCREADDIR   (1<<7) /* no dcache readdir */
+
+#define CEPH_OPT_DEFAULT   (CEPH_OPT_RBYTES)
+
+#define ceph_set_opt(client, opt) \
+        (client)->mount_args->flags |= CEPH_OPT_##opt;
+#define ceph_test_opt(client, opt) \
+        (!!((client)->mount_args->flags & CEPH_OPT_##opt))
+
+
+struct ceph_mount_args {
+        int sb_flags;
+        int num_mon;
+        struct ceph_entity_addr *mon_addr;
+        int flags;
+        int mount_timeout;
+        int osd_idle_ttl;
+        int caps_wanted_delay_min, caps_wanted_delay_max;
+        struct ceph_fsid fsid;
+        struct ceph_entity_addr my_addr;
+        int wsize;
+        int rsize;            /* max readahead */
+        int max_readdir;      /* max readdir size */
+        int congestion_kb;      /* max readdir size */
+        int osd_timeout;
+        int osd_keepalive_timeout;
+        char *snapdir_name;   /* default ".snap" */
+        char *name;
+        char *secret;
+        int cap_release_safety;
+};
+
+/*
+ * defaults
+ */
+#define CEPH_MOUNT_TIMEOUT_DEFAULT  60
+#define CEPH_OSD_TIMEOUT_DEFAULT    60  /* seconds */
+#define CEPH_OSD_KEEPALIVE_DEFAULT  5
+#define CEPH_OSD_IDLE_TTL_DEFAULT    60
+#define CEPH_MOUNT_RSIZE_DEFAULT    (512*1024) /* readahead */
+
+#define CEPH_MSG_MAX_FRONT_LEN  (16*1024*1024)
+#define CEPH_MSG_MAX_DATA_LEN   (16*1024*1024)
+
+#define CEPH_SNAPDIRNAME_DEFAULT ".snap"
+#define CEPH_AUTH_NAME_DEFAULT   "guest"
+
+/*
+ * Delay telling the MDS we no longer want caps, in case we reopen
+ * the file.  Delay a minimum amount of time, even if we send a cap
+ * message for some other reason.  Otherwise, take the oppotunity to
+ * update the mds to avoid sending another message later.
+ */
+#define CEPH_CAPS_WANTED_DELAY_MIN_DEFAULT      5  /* cap release delay */
+#define CEPH_CAPS_WANTED_DELAY_MAX_DEFAULT     60  /* cap release delay */
+
+
+/* mount state */
+enum {
+        CEPH_MOUNT_MOUNTING,
+        CEPH_MOUNT_MOUNTED,
+        CEPH_MOUNT_UNMOUNTING,
+        CEPH_MOUNT_UNMOUNTED,
+        CEPH_MOUNT_SHUTDOWN,
+};
+
+/*
+ * subtract jiffies
+ */
+static inline unsigned long time_sub(unsigned long a, unsigned long b)
+{
+        BUG_ON(time_after(b, a));
+        return (long)a - (long)b;
+}
+
+/*
+ * per-filesystem client state
+ *
+ * possibly shared by multiple mount points, if they are
+ * mounting the same ceph filesystem/cluster.
+ */
+struct ceph_client {
+        struct ceph_fsid fsid;
+        bool have_fsid;
+
+        struct mutex mount_mutex;       /* serialize mount attempts */
+        struct ceph_mount_args *mount_args;
+
+        struct super_block *sb;
+
+        unsigned long mount_state;
+        wait_queue_head_t auth_wq;
+
+        int auth_err;
+
+        int min_caps;                  /* min caps i added */
+
+        struct ceph_messenger *msgr;   /* messenger instance */
+        struct ceph_mon_client monc;
+        struct ceph_mds_client mdsc;
+        struct ceph_osd_client osdc;
+
+        /* writeback */
+        mempool_t *wb_pagevec_pool;
+        struct workqueue_struct *wb_wq;
+        struct workqueue_struct *pg_inv_wq;
+        struct workqueue_struct *trunc_wq;
+        atomic_long_t writeback_count;
+
+        struct backing_dev_info backing_dev_info;
+
+#ifdef CONFIG_DEBUG_FS
+        struct dentry *debugfs_monmap;
+        struct dentry *debugfs_mdsmap, *debugfs_osdmap;
+        struct dentry *debugfs_dir, *debugfs_dentry_lru, *debugfs_caps;
+        struct dentry *debugfs_congestion_kb;
+        struct dentry *debugfs_bdi;
+#endif
+};
+
+static inline struct ceph_client *ceph_client(struct super_block *sb)
+{
+        return sb->s_fs_info;
+}
+
+
+/*
+ * File i/o capability.  This tracks shared state with the metadata
+ * server that allows us to cache or writeback attributes or to read
+ * and write data.  For any given inode, we should have one or more
+ * capabilities, one issued by each metadata server, and our
+ * cumulative access is the OR of all issued capabilities.
+ *
+ * Each cap is referenced by the inode's i_caps rbtree and by per-mds
+ * session capability lists.
+ */
+struct ceph_cap {
+        struct ceph_inode_info *ci;
+        struct rb_node ci_node;          /* per-ci cap tree */
+        struct ceph_mds_session *session;
+        struct list_head session_caps;   /* per-session caplist */
+        int mds;
+        u64 cap_id;       /* unique cap id (mds provided) */
+        int issued;       /* latest, from the mds */
+        int implemented;  /* implemented superset of issued (for revocation) */
+        int mds_wanted;
+        u32 seq, issue_seq, mseq;
+        u32 cap_gen;      /* active/stale cycle */
+        unsigned long last_used;
+        struct list_head caps_item;
+};
+
+#define CHECK_CAPS_NODELAY    1  /* do not delay any further */
+#define CHECK_CAPS_AUTHONLY   2  /* only check auth cap */
+#define CHECK_CAPS_FLUSH      4  /* flush any dirty caps */
+
+/*
+ * Snapped cap state that is pending flush to mds.  When a snapshot occurs,
+ * we first complete any in-process sync writes and writeback any dirty
+ * data before flushing the snapped state (tracked here) back to the MDS.
+ */
+struct ceph_cap_snap {
+        atomic_t nref;
+        struct ceph_inode_info *ci;
+        struct list_head ci_item, flushing_item;
+
+        u64 follows, flush_tid;
+        int issued, dirty;
+        struct ceph_snap_context *context;
+
+        mode_t mode;
+        uid_t uid;
+        gid_t gid;
+
+        void *xattr_blob;
+        int xattr_len;
+        u64 xattr_version;
+
+        u64 size;
+        struct timespec mtime, atime, ctime;
+        u64 time_warp_seq;
+        int writing;   /* a sync write is still in progress */
+        int dirty_pages;     /* dirty pages awaiting writeback */
+};
+
+static inline void ceph_put_cap_snap(struct ceph_cap_snap *capsnap)
+{
+        if (atomic_dec_and_test(&capsnap->nref))
+                kfree(capsnap);
+}
+
+/*
+ * The frag tree describes how a directory is fragmented, potentially across
+ * multiple metadata servers.  It is also used to indicate points where
+ * metadata authority is delegated, and whether/where metadata is replicated.
+ *
+ * A _leaf_ frag will be present in the i_fragtree IFF there is
+ * delegation info.  That is, if mds >= 0 || ndist > 0.
+ */
+#define CEPH_MAX_DIRFRAG_REP 4
+
+struct ceph_inode_frag {
+        struct rb_node node;
+
+        /* fragtree state */
+        u32 frag;
+        int split_by;         /* i.e. 2^(split_by) children */
+
+        /* delegation and replication info */
+        int mds;              /* -1 if same authority as parent */
+        int ndist;            /* >0 if replicated */
+        int dist[CEPH_MAX_DIRFRAG_REP];
+};
+
+/*
+ * We cache inode xattrs as an encoded blob until they are first used,
+ * at which point we parse them into an rbtree.
+ */
+struct ceph_inode_xattr {
+        struct rb_node node;
+
+        const char *name;
+        int name_len;
+        const char *val;
+        int val_len;
+        int dirty;
+
+        int should_free_name;
+        int should_free_val;
+};
+
+struct ceph_inode_xattrs_info {
+        /*
+         * (still encoded) xattr blob. we avoid the overhead of parsing
+         * this until someone actually calls getxattr, etc.
+         *
+         * blob->vec.iov_len == 4 implies there are no xattrs; blob ==
+         * NULL means we don't know.
+        */
+        struct ceph_buffer *blob, *prealloc_blob;
+
+        struct rb_root index;
+        bool dirty;
+        int count;
+        int names_size;
+        int vals_size;
+        u64 version, index_version;
+};
+
+/*
+ * Ceph inode.
+ */
+#define CEPH_I_COMPLETE  1  /* we have complete directory cached */
+#define CEPH_I_NODELAY   4  /* do not delay cap release */
+#define CEPH_I_FLUSH     8  /* do not delay flush of dirty metadata */
+#define CEPH_I_NOFLUSH  16  /* do not flush dirty caps */
+
+struct ceph_inode_info {
+        struct ceph_vino i_vino;   /* ceph ino + snap */
+
+        u64 i_version;
+        u32 i_time_warp_seq;
+
+        unsigned i_ceph_flags;
+        unsigned long i_release_count;
+
+        struct ceph_file_layout i_layout;
+        char *i_symlink;
+
+        /* for dirs */
+        struct timespec i_rctime;
+        u64 i_rbytes, i_rfiles, i_rsubdirs;
+        u64 i_files, i_subdirs;
+        u64 i_max_offset;  /* largest readdir offset, set with I_COMPLETE */
+
+        struct rb_root i_fragtree;
+        struct mutex i_fragtree_mutex;
+
+        struct ceph_inode_xattrs_info i_xattrs;
+
+        /* capabilities.  protected _both_ by i_lock and cap->session's
+         * s_mutex. */
+        struct rb_root i_caps;           /* cap list */
+        struct ceph_cap *i_auth_cap;     /* authoritative cap, if any */
+        unsigned i_dirty_caps, i_flushing_caps;     /* mask of dirtied fields */
+        struct list_head i_dirty_item, i_flushing_item;
+        u64 i_cap_flush_seq;
+        /* we need to track cap writeback on a per-cap-bit basis, to allow
+         * overlapping, pipelined cap flushes to the mds.  we can probably
+         * reduce the tid to 8 bits if we're concerned about inode size. */
+        u16 i_cap_flush_last_tid, i_cap_flush_tid[CEPH_CAP_BITS];
+        wait_queue_head_t i_cap_wq;      /* threads waiting on a capability */
+        unsigned long i_hold_caps_min; /* jiffies */
+        unsigned long i_hold_caps_max; /* jiffies */
+        struct list_head i_cap_delay_list;  /* for delayed cap release to mds */
+        int i_cap_exporting_mds;         /* to handle cap migration between */
+        unsigned i_cap_exporting_mseq;   /*  mds's. */
+        unsigned i_cap_exporting_issued;
+        struct ceph_cap_reservation i_cap_migration_resv;
+        struct list_head i_cap_snaps;   /* snapped state pending flush to mds */
+        struct ceph_snap_context *i_head_snapc;  /* set if wr_buffer_head > 0 */
+        unsigned i_snap_caps;           /* cap bits for snapped files */
+
+        int i_nr_by_mode[CEPH_FILE_MODE_NUM];  /* open file counts */
+
+        u32 i_truncate_seq;        /* last truncate to smaller size */
+        u64 i_truncate_size;       /*  and the size we last truncated down to */
+        int i_truncate_pending;    /*  still need to call vmtruncate */
+
+        u64 i_max_size;            /* max file size authorized by mds */
+        u64 i_reported_size; /* (max_)size reported to or requested of mds */
+        u64 i_wanted_max_size;     /* offset we'd like to write too */
+        u64 i_requested_max_size;  /* max_size we've requested */
+
+        /* held references to caps */
+        int i_pin_ref;
+        int i_rd_ref, i_rdcache_ref, i_wr_ref;
+        int i_wrbuffer_ref, i_wrbuffer_ref_head;
+        u32 i_shared_gen;       /* increment each time we get FILE_SHARED */
+        u32 i_rdcache_gen;      /* we increment this each time we get
+                                   FILE_CACHE.  If it's non-zero, we
+                                   _may_ have cached pages. */
+        u32 i_rdcache_revoking; /* RDCACHE gen to async invalidate, if any */
+
+        struct list_head i_unsafe_writes; /* uncommitted sync writes */
+        struct list_head i_unsafe_dirops; /* uncommitted mds dir ops */
+        spinlock_t i_unsafe_lock;
+
+        struct ceph_snap_realm *i_snap_realm; /* snap realm (if caps) */
+        int i_snap_realm_counter; /* snap realm (if caps) */
+        struct list_head i_snap_realm_item;
+        struct list_head i_snap_flush_item;
+
+        struct work_struct i_wb_work;  /* writeback work */
+        struct work_struct i_pg_inv_work;  /* page invalidation work */
+
+        struct work_struct i_vmtruncate_work;
+
+        struct inode vfs_inode; /* at end */
+};
+
+static inline struct ceph_inode_info *ceph_inode(struct inode *inode)
+{
+        return container_of(inode, struct ceph_inode_info, vfs_inode);
+}
+
+static inline void ceph_i_clear(struct inode *inode, unsigned mask)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+
+        spin_lock(&inode->i_lock);
+        ci->i_ceph_flags &= ~mask;
+        spin_unlock(&inode->i_lock);
+}
+
+static inline void ceph_i_set(struct inode *inode, unsigned mask)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+
+        spin_lock(&inode->i_lock);
+        ci->i_ceph_flags |= mask;
+        spin_unlock(&inode->i_lock);
+}
+
+static inline bool ceph_i_test(struct inode *inode, unsigned mask)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        bool r;
+
+        smp_mb();
+        r = (ci->i_ceph_flags & mask) == mask;
+        return r;
+}
+
+
+/* find a specific frag @f */
+extern struct ceph_inode_frag *__ceph_find_frag(struct ceph_inode_info *ci,
+                                                u32 f);
+
+/*
+ * choose fragment for value @v.  copy frag content to pfrag, if leaf
+ * exists
+ */
+extern u32 ceph_choose_frag(struct ceph_inode_info *ci, u32 v,
+                            struct ceph_inode_frag *pfrag,
+                            int *found);
+
+/*
+ * Ceph dentry state
+ */
+struct ceph_dentry_info {
+        struct ceph_mds_session *lease_session;
+        u32 lease_gen, lease_shared_gen;
+        u32 lease_seq;
+        unsigned long lease_renew_after, lease_renew_from;
+        struct list_head lru;
+        struct dentry *dentry;
+        u64 time;
+        u64 offset;
+};
+
+static inline struct ceph_dentry_info *ceph_dentry(struct dentry *dentry)
+{
+        return (struct ceph_dentry_info *)dentry->d_fsdata;
+}
+
+static inline loff_t ceph_make_fpos(unsigned frag, unsigned off)
+{
+        return ((loff_t)frag << 32) | (loff_t)off;
+}
+
+/*
+ * ino_t is <64 bits on many architectures, blech.
+ *
+ * don't include snap in ino hash, at least for now.
+ */
+static inline ino_t ceph_vino_to_ino(struct ceph_vino vino)
+{
+        ino_t ino = (ino_t)vino.ino;  /* ^ (vino.snap << 20); */
+#if BITS_PER_LONG == 32
+        ino ^= vino.ino >> (sizeof(u64)-sizeof(ino_t)) * 8;
+        if (!ino)
+                ino = 1;
+#endif
+        return ino;
+}
+
+static inline int ceph_set_ino_cb(struct inode *inode, void *data)
+{
+        ceph_inode(inode)->i_vino = *(struct ceph_vino *)data;
+        inode->i_ino = ceph_vino_to_ino(*(struct ceph_vino *)data);
+        return 0;
+}
+
+static inline struct ceph_vino ceph_vino(struct inode *inode)
+{
+        return ceph_inode(inode)->i_vino;
+}
+
+/* for printf-style formatting */
+#define ceph_vinop(i) ceph_inode(i)->i_vino.ino, ceph_inode(i)->i_vino.snap
+
+static inline u64 ceph_ino(struct inode *inode)
+{
+        return ceph_inode(inode)->i_vino.ino;
+}
+static inline u64 ceph_snap(struct inode *inode)
+{
+        return ceph_inode(inode)->i_vino.snap;
+}
+
+static inline int ceph_ino_compare(struct inode *inode, void *data)
+{
+        struct ceph_vino *pvino = (struct ceph_vino *)data;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        return ci->i_vino.ino == pvino->ino &&
+                ci->i_vino.snap == pvino->snap;
+}
+
+static inline struct inode *ceph_find_inode(struct super_block *sb,
+                                            struct ceph_vino vino)
+{
+        ino_t t = ceph_vino_to_ino(vino);
+        return ilookup5(sb, t, ceph_ino_compare, &vino);
+}
+
+
+/*
+ * caps helpers
+ */
+static inline bool __ceph_is_any_real_caps(struct ceph_inode_info *ci)
+{
+        return !RB_EMPTY_ROOT(&ci->i_caps);
+}
+
+extern int __ceph_caps_issued(struct ceph_inode_info *ci, int *implemented);
+extern int __ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask, int t);
+extern int __ceph_caps_issued_other(struct ceph_inode_info *ci,
+                                    struct ceph_cap *cap);
+
+static inline int ceph_caps_issued(struct ceph_inode_info *ci)
+{
+        int issued;
+        spin_lock(&ci->vfs_inode.i_lock);
+        issued = __ceph_caps_issued(ci, NULL);
+        spin_unlock(&ci->vfs_inode.i_lock);
+        return issued;
+}
+
+static inline int ceph_caps_issued_mask(struct ceph_inode_info *ci, int mask,
+                                        int touch)
+{
+        int r;
+        spin_lock(&ci->vfs_inode.i_lock);
+        r = __ceph_caps_issued_mask(ci, mask, touch);
+        spin_unlock(&ci->vfs_inode.i_lock);
+        return r;
+}
+
+static inline int __ceph_caps_dirty(struct ceph_inode_info *ci)
+{
+        return ci->i_dirty_caps | ci->i_flushing_caps;
+}
+extern void __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask);
+
+extern int ceph_caps_revoking(struct ceph_inode_info *ci, int mask);
+extern int __ceph_caps_used(struct ceph_inode_info *ci);
+
+extern int __ceph_caps_file_wanted(struct ceph_inode_info *ci);
+
+/*
+ * wanted, by virtue of open file modes AND cap refs (buffered/cached data)
+ */
+static inline int __ceph_caps_wanted(struct ceph_inode_info *ci)
+{
+        int w = __ceph_caps_file_wanted(ci) | __ceph_caps_used(ci);
+        if (w & CEPH_CAP_FILE_BUFFER)
+                w |= CEPH_CAP_FILE_EXCL;  /* we want EXCL if dirty data */
+        return w;
+}
+
+/* what the mds thinks we want */
+extern int __ceph_caps_mds_wanted(struct ceph_inode_info *ci);
+
+extern void ceph_caps_init(void);
+extern void ceph_caps_finalize(void);
+extern void ceph_adjust_min_caps(int delta);
+extern int ceph_reserve_caps(struct ceph_cap_reservation *ctx, int need);
+extern int ceph_unreserve_caps(struct ceph_cap_reservation *ctx);
+extern void ceph_reservation_status(struct ceph_client *client,
+                                    int *total, int *avail, int *used,
+                                    int *reserved, int *min);
+
+static inline struct ceph_client *ceph_inode_to_client(struct inode *inode)
+{
+        return (struct ceph_client *)inode->i_sb->s_fs_info;
+}
+
+static inline struct ceph_client *ceph_sb_to_client(struct super_block *sb)
+{
+        return (struct ceph_client *)sb->s_fs_info;
+}
+
+
+/*
+ * we keep buffered readdir results attached to file->private_data
+ */
+struct ceph_file_info {
+        int fmode;     /* initialized on open */
+
+        /* readdir: position within the dir */
+        u32 frag;
+        struct ceph_mds_request *last_readdir;
+        int at_end;
+
+        /* readdir: position within a frag */
+        unsigned offset;       /* offset of last chunk, adjusted for . and .. */
+        u64 next_offset;       /* offset of next chunk (last_name's + 1) */
+        char *last_name;       /* last entry in previous chunk */
+        struct dentry *dentry; /* next dentry (for dcache readdir) */
+        unsigned long dir_release_count;
+
+        /* used for -o dirstat read() on directory thing */
+        char *dir_info;
+        int dir_info_len;
+};
+
+
+
+/*
+ * snapshots
+ */
+
+/*
+ * A "snap context" is the set of existing snapshots when we
+ * write data.  It is used by the OSD to guide its COW behavior.
+ *
+ * The ceph_snap_context is refcounted, and attached to each dirty
+ * page, indicating which context the dirty data belonged when it was
+ * dirtied.
+ */
+struct ceph_snap_context {
+        atomic_t nref;
+        u64 seq;
+        int num_snaps;
+        u64 snaps[];
+};
+
+static inline struct ceph_snap_context *
+ceph_get_snap_context(struct ceph_snap_context *sc)
+{
+        /*
+        printk("get_snap_context %p %d -> %d\n", sc, atomic_read(&sc->nref),
+               atomic_read(&sc->nref)+1);
+        */
+        if (sc)
+                atomic_inc(&sc->nref);
+        return sc;
+}
+
+static inline void ceph_put_snap_context(struct ceph_snap_context *sc)
+{
+        if (!sc)
+                return;
+        /*
+        printk("put_snap_context %p %d -> %d\n", sc, atomic_read(&sc->nref),
+               atomic_read(&sc->nref)-1);
+        */
+        if (atomic_dec_and_test(&sc->nref)) {
+                /*printk(" deleting snap_context %p\n", sc);*/
+                kfree(sc);
+        }
+}
+
+/*
+ * A "snap realm" describes a subset of the file hierarchy sharing
+ * the same set of snapshots that apply to it.  The realms themselves
+ * are organized into a hierarchy, such that children inherit (some of)
+ * the snapshots of their parents.
+ *
+ * All inodes within the realm that have capabilities are linked into a
+ * per-realm list.
+ */
+struct ceph_snap_realm {
+        u64 ino;
+        atomic_t nref;
+        struct rb_node node;
+
+        u64 created, seq;
+        u64 parent_ino;
+        u64 parent_since;   /* snapid when our current parent became so */
+
+        u64 *prior_parent_snaps;      /* snaps inherited from any parents we */
+        int num_prior_parent_snaps;   /*  had prior to parent_since */
+        u64 *snaps;                   /* snaps specific to this realm */
+        int num_snaps;
+
+        struct ceph_snap_realm *parent;
+        struct list_head children;       /* list of child realms */
+        struct list_head child_item;
+
+        struct list_head empty_item;     /* if i have ref==0 */
+
+        /* the current set of snaps for this realm */
+        struct ceph_snap_context *cached_context;
+
+        struct list_head inodes_with_caps;
+        spinlock_t inodes_with_caps_lock;
+};
+
+
+
+/*
+ * calculate the number of pages a given length and offset map onto,
+ * if we align the data.
+ */
+static inline int calc_pages_for(u64 off, u64 len)
+{
+        return ((off+len+PAGE_CACHE_SIZE-1) >> PAGE_CACHE_SHIFT) -
+                (off >> PAGE_CACHE_SHIFT);
+}
+
+
+
+/* snap.c */
+struct ceph_snap_realm *ceph_lookup_snap_realm(struct ceph_mds_client *mdsc,
+                                               u64 ino);
+extern void ceph_get_snap_realm(struct ceph_mds_client *mdsc,
+                                struct ceph_snap_realm *realm);
+extern void ceph_put_snap_realm(struct ceph_mds_client *mdsc,
+                                struct ceph_snap_realm *realm);
+extern int ceph_update_snap_trace(struct ceph_mds_client *m,
+                                  void *p, void *e, bool deletion);
+extern void ceph_handle_snap(struct ceph_mds_client *mdsc,
+                             struct ceph_mds_session *session,
+                             struct ceph_msg *msg);
+extern void ceph_queue_cap_snap(struct ceph_inode_info *ci);
+extern int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
+                                  struct ceph_cap_snap *capsnap);
+extern void ceph_cleanup_empty_realms(struct ceph_mds_client *mdsc);
+
+/*
+ * a cap_snap is "pending" if it is still awaiting an in-progress
+ * sync write (that may/may not still update size, mtime, etc.).
+ */
+static inline bool __ceph_have_pending_cap_snap(struct ceph_inode_info *ci)
+{
+        return !list_empty(&ci->i_cap_snaps) &&
+                list_entry(ci->i_cap_snaps.prev, struct ceph_cap_snap,
+                           ci_item)->writing;
+}
+
+
+/* super.c */
+extern struct kmem_cache *ceph_inode_cachep;
+extern struct kmem_cache *ceph_cap_cachep;
+extern struct kmem_cache *ceph_dentry_cachep;
+extern struct kmem_cache *ceph_file_cachep;
+
+extern const char *ceph_msg_type_name(int type);
+extern int ceph_check_fsid(struct ceph_client *client, struct ceph_fsid *fsid);
+
+#define FSID_FORMAT "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-" \
+        "%02x%02x%02x%02x%02x%02x"
+#define PR_FSID(f) (f)->fsid[0], (f)->fsid[1], (f)->fsid[2], (f)->fsid[3], \
+                (f)->fsid[4], (f)->fsid[5], (f)->fsid[6], (f)->fsid[7],    \
+                (f)->fsid[8], (f)->fsid[9], (f)->fsid[10], (f)->fsid[11],  \
+                (f)->fsid[12], (f)->fsid[13], (f)->fsid[14], (f)->fsid[15]
+
+/* inode.c */
+extern const struct inode_operations ceph_file_iops;
+
+extern struct inode *ceph_alloc_inode(struct super_block *sb);
+extern void ceph_destroy_inode(struct inode *inode);
+
+extern struct inode *ceph_get_inode(struct super_block *sb,
+                                    struct ceph_vino vino);
+extern struct inode *ceph_get_snapdir(struct inode *parent);
+extern int ceph_fill_file_size(struct inode *inode, int issued,
+                               u32 truncate_seq, u64 truncate_size, u64 size);
+extern void ceph_fill_file_time(struct inode *inode, int issued,
+                                u64 time_warp_seq, struct timespec *ctime,
+                                struct timespec *mtime, struct timespec *atime);
+extern int ceph_fill_trace(struct super_block *sb,
+                           struct ceph_mds_request *req,
+                           struct ceph_mds_session *session);
+extern int ceph_readdir_prepopulate(struct ceph_mds_request *req,
+                                    struct ceph_mds_session *session);
+
+extern int ceph_inode_holds_cap(struct inode *inode, int mask);
+
+extern int ceph_inode_set_size(struct inode *inode, loff_t size);
+extern void __ceph_do_pending_vmtruncate(struct inode *inode);
+extern void ceph_queue_vmtruncate(struct inode *inode);
+
+extern void ceph_queue_invalidate(struct inode *inode);
+extern void ceph_queue_writeback(struct inode *inode);
+
+extern int ceph_do_getattr(struct inode *inode, int mask);
+extern int ceph_permission(struct inode *inode, int mask);
+extern int ceph_setattr(struct dentry *dentry, struct iattr *attr);
+extern int ceph_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                        struct kstat *stat);
+
+/* xattr.c */
+extern int ceph_setxattr(struct dentry *, const char *, const void *,
+                         size_t, int);
+extern ssize_t ceph_getxattr(struct dentry *, const char *, void *, size_t);
+extern ssize_t ceph_listxattr(struct dentry *, char *, size_t);
+extern int ceph_removexattr(struct dentry *, const char *);
+extern void __ceph_build_xattrs_blob(struct ceph_inode_info *ci);
+extern void __ceph_destroy_xattrs(struct ceph_inode_info *ci);
+
+/* caps.c */
+extern const char *ceph_cap_string(int c);
+extern void ceph_handle_caps(struct ceph_mds_session *session,
+                             struct ceph_msg *msg);
+extern int ceph_add_cap(struct inode *inode,
+                        struct ceph_mds_session *session, u64 cap_id,
+                        int fmode, unsigned issued, unsigned wanted,
+                        unsigned cap, unsigned seq, u64 realmino, int flags,
+                        struct ceph_cap_reservation *caps_reservation);
+extern void __ceph_remove_cap(struct ceph_cap *cap);
+static inline void ceph_remove_cap(struct ceph_cap *cap)
+{
+        struct inode *inode = &cap->ci->vfs_inode;
+        spin_lock(&inode->i_lock);
+        __ceph_remove_cap(cap);
+        spin_unlock(&inode->i_lock);
+}
+extern void ceph_put_cap(struct ceph_cap *cap);
+
+extern void ceph_queue_caps_release(struct inode *inode);
+extern int ceph_write_inode(struct inode *inode, struct writeback_control *wbc);
+extern int ceph_fsync(struct file *file, struct dentry *dentry, int datasync);
+extern void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc,
+                                    struct ceph_mds_session *session);
+extern int ceph_get_cap_mds(struct inode *inode);
+extern void ceph_get_cap_refs(struct ceph_inode_info *ci, int caps);
+extern void ceph_put_cap_refs(struct ceph_inode_info *ci, int had);
+extern void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
+                                       struct ceph_snap_context *snapc);
+extern void __ceph_flush_snaps(struct ceph_inode_info *ci,
+                               struct ceph_mds_session **psession);
+extern void ceph_check_caps(struct ceph_inode_info *ci, int flags,
+                            struct ceph_mds_session *session);
+extern void ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
+extern void ceph_flush_dirty_caps(struct ceph_mds_client *mdsc);
+
+extern int ceph_encode_inode_release(void **p, struct inode *inode,
+                                     int mds, int drop, int unless, int force);
+extern int ceph_encode_dentry_release(void **p, struct dentry *dn,
+                                      int mds, int drop, int unless);
+
+extern int ceph_get_caps(struct ceph_inode_info *ci, int need, int want,
+                         int *got, loff_t endoff);
+
+/* for counting open files by mode */
+static inline void __ceph_get_fmode(struct ceph_inode_info *ci, int mode)
+{
+        ci->i_nr_by_mode[mode]++;
+}
+extern void ceph_put_fmode(struct ceph_inode_info *ci, int mode);
+
+/* addr.c */
+extern const struct address_space_operations ceph_aops;
+extern int ceph_mmap(struct file *file, struct vm_area_struct *vma);
+
+/* file.c */
+extern const struct file_operations ceph_file_fops;
+extern const struct address_space_operations ceph_aops;
+extern int ceph_open(struct inode *inode, struct file *file);
+extern struct dentry *ceph_lookup_open(struct inode *dir, struct dentry *dentry,
+                                       struct nameidata *nd, int mode,
+                                       int locked_dir);
+extern int ceph_release(struct inode *inode, struct file *filp);
+extern void ceph_release_page_vector(struct page **pages, int num_pages);
+
+/* dir.c */
+extern const struct file_operations ceph_dir_fops;
+extern const struct inode_operations ceph_dir_iops;
+extern struct dentry_operations ceph_dentry_ops, ceph_snap_dentry_ops,
+        ceph_snapdir_dentry_ops;
+
+extern int ceph_handle_notrace_create(struct inode *dir, struct dentry *dentry);
+extern struct dentry *ceph_finish_lookup(struct ceph_mds_request *req,
+                                         struct dentry *dentry, int err);
+
+extern void ceph_dentry_lru_add(struct dentry *dn);
+extern void ceph_dentry_lru_touch(struct dentry *dn);
+extern void ceph_dentry_lru_del(struct dentry *dn);
+
+/*
+ * our d_ops vary depending on whether the inode is live,
+ * snapshotted (read-only), or a virtual ".snap" directory.
+ */
+int ceph_init_dentry(struct dentry *dentry);
+
+
+/* ioctl.c */
+extern long ceph_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+
+/* export.c */
+extern const struct export_operations ceph_export_ops;
+
+/* debugfs.c */
+extern int ceph_debugfs_init(void);
+extern void ceph_debugfs_cleanup(void);
+extern int ceph_debugfs_client_init(struct ceph_client *client);
+extern void ceph_debugfs_client_cleanup(struct ceph_client *client);
+
+static inline struct inode *get_dentry_parent_inode(struct dentry *dentry)
+{
+        if (dentry && dentry->d_parent)
+                return dentry->d_parent->d_inode;
+
+        return NULL;
+}
+
+#endif /* _FS_CEPH_SUPER_H */
diff --git a/fs/ceph/types.h b/fs/ceph/types.h
new file mode 100644
index 000000000000..28b35a005ec2
--- /dev/null
+++ b/fs/ceph/types.h
@@ -0,0 +1,29 @@
+#ifndef _FS_CEPH_TYPES_H
+#define _FS_CEPH_TYPES_H
+
+/* needed before including ceph_fs.h */
+#include <linux/in.h>
+#include <linux/types.h>
+#include <linux/fcntl.h>
+#include <linux/string.h>
+
+#include "ceph_fs.h"
+#include "ceph_frag.h"
+#include "ceph_hash.h"
+
+/*
+ * Identify inodes by both their ino AND snapshot id (a u64).
+ */
+struct ceph_vino {
+        u64 ino;
+        u64 snap;
+};
+
+
+/* context for the caps reservation mechanism */
+struct ceph_cap_reservation {
+        int count;
+};
+
+
+#endif
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
new file mode 100644
index 000000000000..2845422907fc
--- /dev/null
+++ b/fs/ceph/xattr.c
@@ -0,0 +1,845 @@
+#include "ceph_debug.h"
+#include "super.h"
+#include "decode.h"
+
+#include <linux/xattr.h>
+#include <linux/slab.h>
+
+static bool ceph_is_valid_xattr(const char *name)
+{
+        return !strncmp(name, XATTR_SECURITY_PREFIX,
+                        XATTR_SECURITY_PREFIX_LEN) ||
+               !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+               !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
+}
+
+/*
+ * These define virtual xattrs exposing the recursive directory
+ * statistics and layout metadata.
+ */
+struct ceph_vxattr_cb {
+        bool readonly;
+        char *name;
+        size_t (*getxattr_cb)(struct ceph_inode_info *ci, char *val,
+                              size_t size);
+};
+
+/* directories */
+
+static size_t ceph_vxattrcb_entries(struct ceph_inode_info *ci, char *val,
+                                        size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_files + ci->i_subdirs);
+}
+
+static size_t ceph_vxattrcb_files(struct ceph_inode_info *ci, char *val,
+                                      size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_files);
+}
+
+static size_t ceph_vxattrcb_subdirs(struct ceph_inode_info *ci, char *val,
+                                        size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_subdirs);
+}
+
+static size_t ceph_vxattrcb_rentries(struct ceph_inode_info *ci, char *val,
+                                         size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_rfiles + ci->i_rsubdirs);
+}
+
+static size_t ceph_vxattrcb_rfiles(struct ceph_inode_info *ci, char *val,
+                                       size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_rfiles);
+}
+
+static size_t ceph_vxattrcb_rsubdirs(struct ceph_inode_info *ci, char *val,
+                                         size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_rsubdirs);
+}
+
+static size_t ceph_vxattrcb_rbytes(struct ceph_inode_info *ci, char *val,
+                                       size_t size)
+{
+        return snprintf(val, size, "%lld", ci->i_rbytes);
+}
+
+static size_t ceph_vxattrcb_rctime(struct ceph_inode_info *ci, char *val,
+                                       size_t size)
+{
+        return snprintf(val, size, "%ld.%ld", (long)ci->i_rctime.tv_sec,
+                        (long)ci->i_rctime.tv_nsec);
+}
+
+static struct ceph_vxattr_cb ceph_dir_vxattrs[] = {
+        { true, "user.ceph.dir.entries", ceph_vxattrcb_entries},
+        { true, "user.ceph.dir.files", ceph_vxattrcb_files},
+        { true, "user.ceph.dir.subdirs", ceph_vxattrcb_subdirs},
+        { true, "user.ceph.dir.rentries", ceph_vxattrcb_rentries},
+        { true, "user.ceph.dir.rfiles", ceph_vxattrcb_rfiles},
+        { true, "user.ceph.dir.rsubdirs", ceph_vxattrcb_rsubdirs},
+        { true, "user.ceph.dir.rbytes", ceph_vxattrcb_rbytes},
+        { true, "user.ceph.dir.rctime", ceph_vxattrcb_rctime},
+        { true, NULL, NULL }
+};
+
+/* files */
+
+static size_t ceph_vxattrcb_layout(struct ceph_inode_info *ci, char *val,
+                                   size_t size)
+{
+        int ret;
+
+        ret = snprintf(val, size,
+                "chunk_bytes=%lld\nstripe_count=%lld\nobject_size=%lld\n",
+                (unsigned long long)ceph_file_layout_su(ci->i_layout),
+                (unsigned long long)ceph_file_layout_stripe_count(ci->i_layout),
+                (unsigned long long)ceph_file_layout_object_size(ci->i_layout));
+        if (ceph_file_layout_pg_preferred(ci->i_layout))
+                ret += snprintf(val + ret, size, "preferred_osd=%lld\n",
+                            (unsigned long long)ceph_file_layout_pg_preferred(
+                                    ci->i_layout));
+        return ret;
+}
+
+static struct ceph_vxattr_cb ceph_file_vxattrs[] = {
+        { true, "user.ceph.layout", ceph_vxattrcb_layout},
+        { NULL, NULL }
+};
+
+static struct ceph_vxattr_cb *ceph_inode_vxattrs(struct inode *inode)
+{
+        if (S_ISDIR(inode->i_mode))
+                return ceph_dir_vxattrs;
+        else if (S_ISREG(inode->i_mode))
+                return ceph_file_vxattrs;
+        return NULL;
+}
+
+static struct ceph_vxattr_cb *ceph_match_vxattr(struct ceph_vxattr_cb *vxattr,
+                                                const char *name)
+{
+        do {
+                if (strcmp(vxattr->name, name) == 0)
+                        return vxattr;
+                vxattr++;
+        } while (vxattr->name);
+        return NULL;
+}
+
+static int __set_xattr(struct ceph_inode_info *ci,
+                           const char *name, int name_len,
+                           const char *val, int val_len,
+                           int dirty,
+                           int should_free_name, int should_free_val,
+                           struct ceph_inode_xattr **newxattr)
+{
+        struct rb_node **p;
+        struct rb_node *parent = NULL;
+        struct ceph_inode_xattr *xattr = NULL;
+        int c;
+        int new = 0;
+
+        p = &ci->i_xattrs.index.rb_node;
+        while (*p) {
+                parent = *p;
+                xattr = rb_entry(parent, struct ceph_inode_xattr, node);
+                c = strncmp(name, xattr->name, min(name_len, xattr->name_len));
+                if (c < 0)
+                        p = &(*p)->rb_left;
+                else if (c > 0)
+                        p = &(*p)->rb_right;
+                else {
+                        if (name_len == xattr->name_len)
+                                break;
+                        else if (name_len < xattr->name_len)
+                                p = &(*p)->rb_left;
+                        else
+                                p = &(*p)->rb_right;
+                }
+                xattr = NULL;
+        }
+
+        if (!xattr) {
+                new = 1;
+                xattr = *newxattr;
+                xattr->name = name;
+                xattr->name_len = name_len;
+                xattr->should_free_name = should_free_name;
+
+                ci->i_xattrs.count++;
+                dout("__set_xattr count=%d\n", ci->i_xattrs.count);
+        } else {
+                kfree(*newxattr);
+                *newxattr = NULL;
+                if (xattr->should_free_val)
+                        kfree((void *)xattr->val);
+
+                if (should_free_name) {
+                        kfree((void *)name);
+                        name = xattr->name;
+                }
+                ci->i_xattrs.names_size -= xattr->name_len;
+                ci->i_xattrs.vals_size -= xattr->val_len;
+        }
+        if (!xattr) {
+                pr_err("__set_xattr ENOMEM on %p %llx.%llx xattr %s=%s\n",
+                       &ci->vfs_inode, ceph_vinop(&ci->vfs_inode), name,
+                       xattr->val);
+                return -ENOMEM;
+        }
+        ci->i_xattrs.names_size += name_len;
+        ci->i_xattrs.vals_size += val_len;
+        if (val)
+                xattr->val = val;
+        else
+                xattr->val = "";
+
+        xattr->val_len = val_len;
+        xattr->dirty = dirty;
+        xattr->should_free_val = (val && should_free_val);
+
+        if (new) {
+                rb_link_node(&xattr->node, parent, p);
+                rb_insert_color(&xattr->node, &ci->i_xattrs.index);
+                dout("__set_xattr_val p=%p\n", p);
+        }
+
+        dout("__set_xattr_val added %llx.%llx xattr %p %s=%.*s\n",
+             ceph_vinop(&ci->vfs_inode), xattr, name, val_len, val);
+
+        return 0;
+}
+
+static struct ceph_inode_xattr *__get_xattr(struct ceph_inode_info *ci,
+                           const char *name)
+{
+        struct rb_node **p;
+        struct rb_node *parent = NULL;
+        struct ceph_inode_xattr *xattr = NULL;
+        int c;
+
+        p = &ci->i_xattrs.index.rb_node;
+        while (*p) {
+                parent = *p;
+                xattr = rb_entry(parent, struct ceph_inode_xattr, node);
+                c = strncmp(name, xattr->name, xattr->name_len);
+                if (c < 0)
+                        p = &(*p)->rb_left;
+                else if (c > 0)
+                        p = &(*p)->rb_right;
+                else {
+                        dout("__get_xattr %s: found %.*s\n", name,
+                             xattr->val_len, xattr->val);
+                        return xattr;
+                }
+        }
+
+        dout("__get_xattr %s: not found\n", name);
+
+        return NULL;
+}
+
+static void __free_xattr(struct ceph_inode_xattr *xattr)
+{
+        BUG_ON(!xattr);
+
+        if (xattr->should_free_name)
+                kfree((void *)xattr->name);
+        if (xattr->should_free_val)
+                kfree((void *)xattr->val);
+
+        kfree(xattr);
+}
+
+static int __remove_xattr(struct ceph_inode_info *ci,
+                          struct ceph_inode_xattr *xattr)
+{
+        if (!xattr)
+                return -EOPNOTSUPP;
+
+        rb_erase(&xattr->node, &ci->i_xattrs.index);
+
+        if (xattr->should_free_name)
+                kfree((void *)xattr->name);
+        if (xattr->should_free_val)
+                kfree((void *)xattr->val);
+
+        ci->i_xattrs.names_size -= xattr->name_len;
+        ci->i_xattrs.vals_size -= xattr->val_len;
+        ci->i_xattrs.count--;
+        kfree(xattr);
+
+        return 0;
+}
+
+static int __remove_xattr_by_name(struct ceph_inode_info *ci,
+                           const char *name)
+{
+        struct rb_node **p;
+        struct ceph_inode_xattr *xattr;
+        int err;
+
+        p = &ci->i_xattrs.index.rb_node;
+        xattr = __get_xattr(ci, name);
+        err = __remove_xattr(ci, xattr);
+        return err;
+}
+
+static char *__copy_xattr_names(struct ceph_inode_info *ci,
+                                char *dest)
+{
+        struct rb_node *p;
+        struct ceph_inode_xattr *xattr = NULL;
+
+        p = rb_first(&ci->i_xattrs.index);
+        dout("__copy_xattr_names count=%d\n", ci->i_xattrs.count);
+
+        while (p) {
+                xattr = rb_entry(p, struct ceph_inode_xattr, node);
+                memcpy(dest, xattr->name, xattr->name_len);
+                dest[xattr->name_len] = '\0';
+
+                dout("dest=%s %p (%s) (%d/%d)\n", dest, xattr, xattr->name,
+                     xattr->name_len, ci->i_xattrs.names_size);
+
+                dest += xattr->name_len + 1;
+                p = rb_next(p);
+        }
+
+        return dest;
+}
+
+void __ceph_destroy_xattrs(struct ceph_inode_info *ci)
+{
+        struct rb_node *p, *tmp;
+        struct ceph_inode_xattr *xattr = NULL;
+
+        p = rb_first(&ci->i_xattrs.index);
+
+        dout("__ceph_destroy_xattrs p=%p\n", p);
+
+        while (p) {
+                xattr = rb_entry(p, struct ceph_inode_xattr, node);
+                tmp = p;
+                p = rb_next(tmp);
+                dout("__ceph_destroy_xattrs next p=%p (%.*s)\n", p,
+                     xattr->name_len, xattr->name);
+                rb_erase(tmp, &ci->i_xattrs.index);
+
+                __free_xattr(xattr);
+        }
+
+        ci->i_xattrs.names_size = 0;
+        ci->i_xattrs.vals_size = 0;
+        ci->i_xattrs.index_version = 0;
+        ci->i_xattrs.count = 0;
+        ci->i_xattrs.index = RB_ROOT;
+}
+
+static int __build_xattrs(struct inode *inode)
+{
+        u32 namelen;
+        u32 numattr = 0;
+        void *p, *end;
+        u32 len;
+        const char *name, *val;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        int xattr_version;
+        struct ceph_inode_xattr **xattrs = NULL;
+        int err = 0;
+        int i;
+
+        dout("__build_xattrs() len=%d\n",
+             ci->i_xattrs.blob ? (int)ci->i_xattrs.blob->vec.iov_len : 0);
+
+        if (ci->i_xattrs.index_version >= ci->i_xattrs.version)
+                return 0; /* already built */
+
+        __ceph_destroy_xattrs(ci);
+
+start:
+        /* updated internal xattr rb tree */
+        if (ci->i_xattrs.blob && ci->i_xattrs.blob->vec.iov_len > 4) {
+                p = ci->i_xattrs.blob->vec.iov_base;
+                end = p + ci->i_xattrs.blob->vec.iov_len;
+                ceph_decode_32_safe(&p, end, numattr, bad);
+                xattr_version = ci->i_xattrs.version;
+                spin_unlock(&inode->i_lock);
+
+                xattrs = kcalloc(numattr, sizeof(struct ceph_xattr *),
+                                 GFP_NOFS);
+                err = -ENOMEM;
+                if (!xattrs)
+                        goto bad_lock;
+                memset(xattrs, 0, numattr*sizeof(struct ceph_xattr *));
+                for (i = 0; i < numattr; i++) {
+                        xattrs[i] = kmalloc(sizeof(struct ceph_inode_xattr),
+                                            GFP_NOFS);
+                        if (!xattrs[i])
+                                goto bad_lock;
+                }
+
+                spin_lock(&inode->i_lock);
+                if (ci->i_xattrs.version != xattr_version) {
+                        /* lost a race, retry */
+                        for (i = 0; i < numattr; i++)
+                                kfree(xattrs[i]);
+                        kfree(xattrs);
+                        goto start;
+                }
+                err = -EIO;
+                while (numattr--) {
+                        ceph_decode_32_safe(&p, end, len, bad);
+                        namelen = len;
+                        name = p;
+                        p += len;
+                        ceph_decode_32_safe(&p, end, len, bad);
+                        val = p;
+                        p += len;
+
+                        err = __set_xattr(ci, name, namelen, val, len,
+                                          0, 0, 0, &xattrs[numattr]);
+
+                        if (err < 0)
+                                goto bad;
+                }
+                kfree(xattrs);
+        }
+        ci->i_xattrs.index_version = ci->i_xattrs.version;
+        ci->i_xattrs.dirty = false;
+
+        return err;
+bad_lock:
+        spin_lock(&inode->i_lock);
+bad:
+        if (xattrs) {
+                for (i = 0; i < numattr; i++)
+                        kfree(xattrs[i]);
+                kfree(xattrs);
+        }
+        ci->i_xattrs.names_size = 0;
+        return err;
+}
+
+static int __get_required_blob_size(struct ceph_inode_info *ci, int name_size,
+                                    int val_size)
+{
+        /*
+         * 4 bytes for the length, and additional 4 bytes per each xattr name,
+         * 4 bytes per each value
+         */
+        int size = 4 + ci->i_xattrs.count*(4 + 4) +
+                             ci->i_xattrs.names_size +
+                             ci->i_xattrs.vals_size;
+        dout("__get_required_blob_size c=%d names.size=%d vals.size=%d\n",
+             ci->i_xattrs.count, ci->i_xattrs.names_size,
+             ci->i_xattrs.vals_size);
+
+        if (name_size)
+                size += 4 + 4 + name_size + val_size;
+
+        return size;
+}
+
+/*
+ * If there are dirty xattrs, reencode xattrs into the prealloc_blob
+ * and swap into place.
+ */
+void __ceph_build_xattrs_blob(struct ceph_inode_info *ci)
+{
+        struct rb_node *p;
+        struct ceph_inode_xattr *xattr = NULL;
+        void *dest;
+
+        dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
+        if (ci->i_xattrs.dirty) {
+                int need = __get_required_blob_size(ci, 0, 0);
+
+                BUG_ON(need > ci->i_xattrs.prealloc_blob->alloc_len);
+
+                p = rb_first(&ci->i_xattrs.index);
+                dest = ci->i_xattrs.prealloc_blob->vec.iov_base;
+
+                ceph_encode_32(&dest, ci->i_xattrs.count);
+                while (p) {
+                        xattr = rb_entry(p, struct ceph_inode_xattr, node);
+
+                        ceph_encode_32(&dest, xattr->name_len);
+                        memcpy(dest, xattr->name, xattr->name_len);
+                        dest += xattr->name_len;
+                        ceph_encode_32(&dest, xattr->val_len);
+                        memcpy(dest, xattr->val, xattr->val_len);
+                        dest += xattr->val_len;
+
+                        p = rb_next(p);
+                }
+
+                /* adjust buffer len; it may be larger than we need */
+                ci->i_xattrs.prealloc_blob->vec.iov_len =
+                        dest - ci->i_xattrs.prealloc_blob->vec.iov_base;
+
+                if (ci->i_xattrs.blob)
+                        ceph_buffer_put(ci->i_xattrs.blob);
+                ci->i_xattrs.blob = ci->i_xattrs.prealloc_blob;
+                ci->i_xattrs.prealloc_blob = NULL;
+                ci->i_xattrs.dirty = false;
+        }
+}
+
+ssize_t ceph_getxattr(struct dentry *dentry, const char *name, void *value,
+                      size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_vxattr_cb *vxattrs = ceph_inode_vxattrs(inode);
+        int err;
+        struct ceph_inode_xattr *xattr;
+        struct ceph_vxattr_cb *vxattr = NULL;
+
+        if (!ceph_is_valid_xattr(name))
+                return -ENODATA;
+
+        /* let's see if a virtual xattr was requested */
+        if (vxattrs)
+                vxattr = ceph_match_vxattr(vxattrs, name);
+
+        spin_lock(&inode->i_lock);
+        dout("getxattr %p ver=%lld index_ver=%lld\n", inode,
+             ci->i_xattrs.version, ci->i_xattrs.index_version);
+
+        if (__ceph_caps_issued_mask(ci, CEPH_CAP_XATTR_SHARED, 1) &&
+            (ci->i_xattrs.index_version >= ci->i_xattrs.version)) {
+                goto get_xattr;
+        } else {
+                spin_unlock(&inode->i_lock);
+                /* get xattrs from mds (if we don't already have them) */
+                err = ceph_do_getattr(inode, CEPH_STAT_CAP_XATTR);
+                if (err)
+                        return err;
+        }
+
+        spin_lock(&inode->i_lock);
+
+        if (vxattr && vxattr->readonly) {
+                err = vxattr->getxattr_cb(ci, value, size);
+                goto out;
+        }
+
+        err = __build_xattrs(inode);
+        if (err < 0)
+                goto out;
+
+get_xattr:
+        err = -ENODATA;  /* == ENOATTR */
+        xattr = __get_xattr(ci, name);
+        if (!xattr) {
+                if (vxattr)
+                        err = vxattr->getxattr_cb(ci, value, size);
+                goto out;
+        }
+
+        err = -ERANGE;
+        if (size && size < xattr->val_len)
+                goto out;
+
+        err = xattr->val_len;
+        if (size == 0)
+                goto out;
+
+        memcpy(value, xattr->val, xattr->val_len);
+
+out:
+        spin_unlock(&inode->i_lock);
+        return err;
+}
+
+ssize_t ceph_listxattr(struct dentry *dentry, char *names, size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_vxattr_cb *vxattrs = ceph_inode_vxattrs(inode);
+        u32 vir_namelen = 0;
+        u32 namelen;
+        int err;
+        u32 len;
+        int i;
+
+        spin_lock(&inode->i_lock);
+        dout("listxattr %p ver=%lld index_ver=%lld\n", inode,
+             ci->i_xattrs.version, ci->i_xattrs.index_version);
+
+        if (__ceph_caps_issued_mask(ci, CEPH_CAP_XATTR_SHARED, 1) &&
+            (ci->i_xattrs.index_version > ci->i_xattrs.version)) {
+                goto list_xattr;
+        } else {
+                spin_unlock(&inode->i_lock);
+                err = ceph_do_getattr(inode, CEPH_STAT_CAP_XATTR);
+                if (err)
+                        return err;
+        }
+
+        spin_lock(&inode->i_lock);
+
+        err = __build_xattrs(inode);
+        if (err < 0)
+                goto out;
+
+list_xattr:
+        vir_namelen = 0;
+        /* include virtual dir xattrs */
+        if (vxattrs)
+                for (i = 0; vxattrs[i].name; i++)
+                        vir_namelen += strlen(vxattrs[i].name) + 1;
+        /* adding 1 byte per each variable due to the null termination */
+        namelen = vir_namelen + ci->i_xattrs.names_size + ci->i_xattrs.count;
+        err = -ERANGE;
+        if (size && namelen > size)
+                goto out;
+
+        err = namelen;
+        if (size == 0)
+                goto out;
+
+        names = __copy_xattr_names(ci, names);
+
+        /* virtual xattr names, too */
+        if (vxattrs)
+                for (i = 0; vxattrs[i].name; i++) {
+                        len = sprintf(names, "%s", vxattrs[i].name);
+                        names += len + 1;
+                }
+
+out:
+        spin_unlock(&inode->i_lock);
+        return err;
+}
+
+static int ceph_sync_setxattr(struct dentry *dentry, const char *name,
+                              const char *value, size_t size, int flags)
+{
+        struct ceph_client *client = ceph_client(dentry->d_sb);
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct inode *parent_inode = dentry->d_parent->d_inode;
+        struct ceph_mds_request *req;
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        int err;
+        int i, nr_pages;
+        struct page **pages = NULL;
+        void *kaddr;
+
+        /* copy value into some pages */
+        nr_pages = calc_pages_for(0, size);
+        if (nr_pages) {
+                pages = kmalloc(sizeof(pages[0])*nr_pages, GFP_NOFS);
+                if (!pages)
+                        return -ENOMEM;
+                err = -ENOMEM;
+                for (i = 0; i < nr_pages; i++) {
+                        pages[i] = alloc_page(GFP_NOFS);
+                        if (!pages[i]) {
+                                nr_pages = i;
+                                goto out;
+                        }
+                        kaddr = kmap(pages[i]);
+                        memcpy(kaddr, value + i*PAGE_CACHE_SIZE,
+                               min(PAGE_CACHE_SIZE, size-i*PAGE_CACHE_SIZE));
+                }
+        }
+
+        dout("setxattr value=%.*s\n", (int)size, value);
+
+        /* do request */
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_SETXATTR,
+                                       USE_AUTH_MDS);
+        if (IS_ERR(req)) {
+                err = PTR_ERR(req);
+                goto out;
+        }
+        req->r_inode = igrab(inode);
+        req->r_inode_drop = CEPH_CAP_XATTR_SHARED;
+        req->r_num_caps = 1;
+        req->r_args.setxattr.flags = cpu_to_le32(flags);
+        req->r_path2 = kstrdup(name, GFP_NOFS);
+
+        req->r_pages = pages;
+        req->r_num_pages = nr_pages;
+        req->r_data_len = size;
+
+        dout("xattr.ver (before): %lld\n", ci->i_xattrs.version);
+        err = ceph_mdsc_do_request(mdsc, parent_inode, req);
+        ceph_mdsc_put_request(req);
+        dout("xattr.ver (after): %lld\n", ci->i_xattrs.version);
+
+out:
+        if (pages) {
+                for (i = 0; i < nr_pages; i++)
+                        __free_page(pages[i]);
+                kfree(pages);
+        }
+        return err;
+}
+
+int ceph_setxattr(struct dentry *dentry, const char *name,
+                  const void *value, size_t size, int flags)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_vxattr_cb *vxattrs = ceph_inode_vxattrs(inode);
+        int err;
+        int name_len = strlen(name);
+        int val_len = size;
+        char *newname = NULL;
+        char *newval = NULL;
+        struct ceph_inode_xattr *xattr = NULL;
+        int issued;
+        int required_blob_size;
+
+        if (ceph_snap(inode) != CEPH_NOSNAP)
+                return -EROFS;
+
+        if (!ceph_is_valid_xattr(name))
+                return -EOPNOTSUPP;
+
+        if (vxattrs) {
+                struct ceph_vxattr_cb *vxattr =
+                        ceph_match_vxattr(vxattrs, name);
+                if (vxattr && vxattr->readonly)
+                        return -EOPNOTSUPP;
+        }
+
+        /* preallocate memory for xattr name, value, index node */
+        err = -ENOMEM;
+        newname = kmalloc(name_len + 1, GFP_NOFS);
+        if (!newname)
+                goto out;
+        memcpy(newname, name, name_len + 1);
+
+        if (val_len) {
+                newval = kmalloc(val_len + 1, GFP_NOFS);
+                if (!newval)
+                        goto out;
+                memcpy(newval, value, val_len);
+                newval[val_len] = '\0';
+        }
+
+        xattr = kmalloc(sizeof(struct ceph_inode_xattr), GFP_NOFS);
+        if (!xattr)
+                goto out;
+
+        spin_lock(&inode->i_lock);
+retry:
+        issued = __ceph_caps_issued(ci, NULL);
+        if (!(issued & CEPH_CAP_XATTR_EXCL))
+                goto do_sync;
+        __build_xattrs(inode);
+
+        required_blob_size = __get_required_blob_size(ci, name_len, val_len);
+
+        if (!ci->i_xattrs.prealloc_blob ||
+            required_blob_size > ci->i_xattrs.prealloc_blob->alloc_len) {
+                struct ceph_buffer *blob = NULL;
+
+                spin_unlock(&inode->i_lock);
+                dout(" preaallocating new blob size=%d\n", required_blob_size);
+                blob = ceph_buffer_new(required_blob_size, GFP_NOFS);
+                if (!blob)
+                        goto out;
+                spin_lock(&inode->i_lock);
+                if (ci->i_xattrs.prealloc_blob)
+                        ceph_buffer_put(ci->i_xattrs.prealloc_blob);
+                ci->i_xattrs.prealloc_blob = blob;
+                goto retry;
+        }
+
+        dout("setxattr %p issued %s\n", inode, ceph_cap_string(issued));
+        err = __set_xattr(ci, newname, name_len, newval,
+                          val_len, 1, 1, 1, &xattr);
+        __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+        ci->i_xattrs.dirty = true;
+        inode->i_ctime = CURRENT_TIME;
+        spin_unlock(&inode->i_lock);
+
+        return err;
+
+do_sync:
+        spin_unlock(&inode->i_lock);
+        err = ceph_sync_setxattr(dentry, name, value, size, flags);
+out:
+        kfree(newname);
+        kfree(newval);
+        kfree(xattr);
+        return err;
+}
+
+static int ceph_send_removexattr(struct dentry *dentry, const char *name)
+{
+        struct ceph_client *client = ceph_client(dentry->d_sb);
+        struct ceph_mds_client *mdsc = &client->mdsc;
+        struct inode *inode = dentry->d_inode;
+        struct inode *parent_inode = dentry->d_parent->d_inode;
+        struct ceph_mds_request *req;
+        int err;
+
+        req = ceph_mdsc_create_request(mdsc, CEPH_MDS_OP_RMXATTR,
+                                       USE_AUTH_MDS);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
+        req->r_inode = igrab(inode);
+        req->r_inode_drop = CEPH_CAP_XATTR_SHARED;
+        req->r_num_caps = 1;
+        req->r_path2 = kstrdup(name, GFP_NOFS);
+
+        err = ceph_mdsc_do_request(mdsc, parent_inode, req);
+        ceph_mdsc_put_request(req);
+        return err;
+}
+
+int ceph_removexattr(struct dentry *dentry, const char *name)
+{
+        struct inode *inode = dentry->d_inode;
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_vxattr_cb *vxattrs = ceph_inode_vxattrs(inode);
+        int issued;
+        int err;
+
+        if (ceph_snap(inode) != CEPH_NOSNAP)
+                return -EROFS;
+
+        if (!ceph_is_valid_xattr(name))
+                return -EOPNOTSUPP;
+
+        if (vxattrs) {
+                struct ceph_vxattr_cb *vxattr =
+                        ceph_match_vxattr(vxattrs, name);
+                if (vxattr && vxattr->readonly)
+                        return -EOPNOTSUPP;
+        }
+
+        spin_lock(&inode->i_lock);
+        __build_xattrs(inode);
+        issued = __ceph_caps_issued(ci, NULL);
+        dout("removexattr %p issued %s\n", inode, ceph_cap_string(issued));
+
+        if (!(issued & CEPH_CAP_XATTR_EXCL))
+                goto do_sync;
+
+        err = __remove_xattr_by_name(ceph_inode(inode), name);
+        __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+        ci->i_xattrs.dirty = true;
+        inode->i_ctime = CURRENT_TIME;
+
+        spin_unlock(&inode->i_lock);
+
+        return err;
+do_sync:
+        spin_unlock(&inode->i_lock);
+        err = ceph_send_removexattr(dentry, name);
+        return err;
+}
+
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 094ea65afc85..bc0025cdd1c9 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,8 @@
+Version 1.62
+------------
+Add sockopt=TCP_NODELAY mount option. EA (xattr) routines hardened
+to more strictly handle corrupt frames.
+
 Version 1.61
 ------------
 Fix append problem to Samba servers (files opened with O_APPEND could
@@ -5,7 +10,9 @@ have duplicated data). Fix oops in cifs_lookup. Workaround problem
 mounting to OS/400 Netserve. Fix oops in cifs_get_tcp_session.
 Disable use of server inode numbers when server only
 partially supports them (e.g. for one server querying inode numbers on
-FindFirst fails but QPathInfo queries works).
+FindFirst fails but QPathInfo queries works). Fix oops with dfs in 
+cifs_put_smb_ses. Fix mmap to work on directio mounts (needed
+for OpenOffice when on forcedirectio mount e.g.)
 
 Version 1.60
 -------------
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index 20692fbfdb24..a20bea598933 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -136,7 +136,7 @@ asn1_enum_decode(struct asn1_ctx *ctx, __le32 *val)
                 return 0;
         }
 
-        ch = *(ctx->pointer)++; /* ch has 0xa, ptr points to lenght octet */
+        ch = *(ctx->pointer)++; /* ch has 0xa, ptr points to length octet */
         if ((ch) == ASN1_ENUM)  /* if ch value is ENUM, 0xa */
                 *val = *(++(ctx->pointer)); /* value has enum value */
         else
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index fea9e898c4ba..78e4d2a3a68b 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -15,6 +15,7 @@
 #include <linux/dcache.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 #include <linux/vfs.h>
 #include <linux/fs.h>
 #include "cifsglob.h"
@@ -54,7 +55,7 @@ void cifs_dfs_release_automount_timer(void)
  * Extracts sharename form full UNC.
  * i.e. strips from UNC trailing path that is not part of share
  * name and fixup missing '\' in the begining of DFS node refferal
- * if neccessary.
+ * if necessary.
  * Returns pointer to share name on success or ERR_PTR on error.
  * Caller is responsible for freeing returned string.
  */
@@ -269,7 +270,7 @@ static int add_mount_helper(struct vfsmount *newmnt, struct nameidata *nd,
         int err;
 
         mntget(newmnt);
-        err = do_add_mount(newmnt, &nd->path, nd->path.mnt->mnt_flags, mntlist);
+        err = do_add_mount(newmnt, &nd->path, nd->path.mnt->mnt_flags | MNT_SHRINKABLE, mntlist);
         switch (err) {
         case 0:
                 path_put(&nd->path);
@@ -371,7 +372,6 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
         if (IS_ERR(mnt))
                 goto out_err;
 
-        nd->path.mnt->mnt_flags |= MNT_SHRINKABLE;
         rc = add_mount_helper(mnt, nd, &cifs_dfs_automount_list);
 
 out:
diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
index 4797787c6a44..246a167cb913 100644
--- a/fs/cifs/cifs_fs_sb.h
+++ b/fs/cifs/cifs_fs_sb.h
@@ -18,6 +18,8 @@
 #ifndef _CIFS_FS_SB_H
 #define _CIFS_FS_SB_H
 
+#include <linux/backing-dev.h>
+
 #define CIFS_MOUNT_NO_PERM      1 /* do not do client vfs_perm check */
 #define CIFS_MOUNT_SET_UID      2 /* set current's euid in create etc. */
 #define CIFS_MOUNT_SERVER_INUM  4 /* inode numbers from uniqueid from server  */
@@ -50,5 +52,6 @@ struct cifs_sb_info {
 #ifdef CONFIG_CIFS_DFS_UPCALL
         char   *mountdata; /* mount options received at mount time */
 #endif
+        struct backing_dev_info bdi;
 };
 #endif                          /* _CIFS_FS_SB_H */
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 8ec7736ce954..310d12f69a92 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -20,6 +20,7 @@
  */
 
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <keys/user-type.h>
 #include <linux/key-type.h>
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 714a542cbafc..d07676bd76d2 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -19,6 +19,7 @@
  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include "cifs_unicode.h"
 #include "cifs_uniupr.h"
 #include "cifspdu.h"
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 7dfe0842a6f6..9b716d044bbd 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -22,6 +22,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifsacl.h"
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 7efe1745494d..fbe986430d0c 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -20,6 +20,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifs_debug.h"
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 29f1da761bbf..ad235d604a0b 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -103,6 +103,12 @@ cifs_read_super(struct super_block *sb, void *data,
         if (cifs_sb == NULL)
                 return -ENOMEM;
 
+        rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
+        if (rc) {
+                kfree(cifs_sb);
+                return rc;
+        }
+
 #ifdef CONFIG_CIFS_DFS_UPCALL
         /* copy mount params to sb for use in submounts */
         /* BB: should we move this after the mount so we
@@ -115,6 +121,7 @@ cifs_read_super(struct super_block *sb, void *data,
                 int len = strlen(data);
                 cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
                 if (cifs_sb->mountdata == NULL) {
+                        bdi_destroy(&cifs_sb->bdi);
                         kfree(sb->s_fs_info);
                         sb->s_fs_info = NULL;
                         return -ENOMEM;
@@ -135,6 +142,7 @@ cifs_read_super(struct super_block *sb, void *data,
 
         sb->s_magic = CIFS_MAGIC_NUMBER;
         sb->s_op = &cifs_super_ops;
+        sb->s_bdi = &cifs_sb->bdi;
 /*      if (cifs_sb->tcon->ses->server->maxBuf > MAX_CIFS_HDR_SIZE + 512)
             sb->s_blocksize =
                 cifs_sb->tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE; */
@@ -183,6 +191,7 @@ out_mount_failed:
                 }
 #endif
                 unload_nls(cifs_sb->local_nls);
+                bdi_destroy(&cifs_sb->bdi);
                 kfree(cifs_sb);
         }
         return rc;
@@ -214,6 +223,7 @@ cifs_put_super(struct super_block *sb)
 #endif
 
         unload_nls(cifs_sb->local_nls);
+        bdi_destroy(&cifs_sb->bdi);
         kfree(cifs_sb);
 
         unlock_kernel();
@@ -312,6 +322,7 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_inode->clientCanCacheRead = false;
         cifs_inode->clientCanCacheAll = false;
         cifs_inode->delete_pending = false;
+        cifs_inode->invalid_mapping = false;
         cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
         cifs_inode->server_eof = 0;
 
@@ -638,7 +649,7 @@ static loff_t cifs_llseek(struct file *file, loff_t offset, int origin)
                    setting the revalidate time to zero */
                 CIFS_I(file->f_path.dentry->d_inode)->time = 0;
 
-                retval = cifs_revalidate(file->f_path.dentry);
+                retval = cifs_revalidate_file(file);
                 if (retval < 0)
                         return (loff_t)retval;
         }
@@ -758,7 +769,7 @@ const struct file_operations cifs_file_ops = {
 };
 
 const struct file_operations cifs_file_direct_ops = {
-        /* no mmap, no aio, no readv -
+        /* no aio, no readv -
            BB reevaluate whether they can be done with directio, no cache */
         .read = cifs_user_read,
         .write = cifs_user_write,
@@ -767,6 +778,7 @@ const struct file_operations cifs_file_direct_ops = {
         .lock = cifs_lock,
         .fsync = cifs_fsync,
         .flush = cifs_flush,
+        .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
         .unlocked_ioctl  = cifs_ioctl,
@@ -806,6 +818,7 @@ const struct file_operations cifs_file_direct_nobrl_ops = {
         .release = cifs_close,
         .fsync = cifs_fsync,
         .flush = cifs_flush,
+        .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
         .unlocked_ioctl  = cifs_ioctl,
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index ac2b24c192f8..7aa57ecdc437 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -61,7 +61,8 @@ extern int cifs_mkdir(struct inode *, struct dentry *, int);
 extern int cifs_rmdir(struct inode *, struct dentry *);
 extern int cifs_rename(struct inode *, struct dentry *, struct inode *,
                        struct dentry *);
-extern int cifs_revalidate(struct dentry *);
+extern int cifs_revalidate_file(struct file *filp);
+extern int cifs_revalidate_dentry(struct dentry *);
 extern int cifs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
 extern int cifs_setattr(struct dentry *, struct iattr *);
 
@@ -113,5 +114,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
 
-#define CIFS_VERSION   "1.61"
+#define CIFS_VERSION   "1.62"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 4b35f7ec0583..ecf0ffbe2b64 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -18,6 +18,7 @@
  */
 #include <linux/in.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <linux/slow-work.h>
 #include "cifs_fs_sb.h"
 #include "cifsacl.h"
@@ -149,6 +150,7 @@ struct TCP_Server_Info {
         bool svlocal:1;                 /* local server or remote */
         bool noblocksnd;                /* use blocking sendmsg */
         bool noautotune;                /* do not autotune send buf sizes */
+        bool tcp_nodelay;
         atomic_t inFlight;  /* number of requests on the wire to server */
 #ifdef CONFIG_CIFS_STATS2
         atomic_t inSend; /* requests trying to send */
@@ -204,7 +206,7 @@ struct cifsUidInfo {
 struct cifsSesInfo {
         struct list_head smb_ses_list;
         struct list_head tcon_list;
-        struct semaphore sesSem;
+        struct mutex session_mutex;
 #if 0
         struct cifsUidInfo *uidInfo;    /* pointer to user info */
 #endif
@@ -388,6 +390,7 @@ struct cifsInodeInfo {
         bool clientCanCacheRead:1;      /* read oplock */
         bool clientCanCacheAll:1;       /* read and writebehind oplock */
         bool delete_pending:1;          /* DELETE_ON_CLOSE is set */
+        bool invalid_mapping:1;         /* pagecache is invalid */
         u64  server_eof;                /* current file size on server */
         u64  uniqueid;                  /* server inode number */
         struct inode vfs_inode;
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 3877737f96a6..14d036d8db11 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -415,10 +415,10 @@ struct smb_hdr {
         __u8 WordCount;
 } __attribute__((packed));
 /* given a pointer to an smb_hdr retrieve the value of byte count */
-#define BCC(smb_var) (*(__u16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount)))
-#define BCC_LE(smb_var) (*(__le16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount)))
+#define BCC(smb_var) (*(__u16 *)((char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount)))
+#define BCC_LE(smb_var) (*(__le16 *)((char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount)))
 /* given a pointer to an smb_hdr retrieve the pointer to the byte area */
-#define pByteArea(smb_var) ((unsigned char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount) + 2)
+#define pByteArea(smb_var) ((unsigned char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount) + 2)
 
 /*
  * Computer Name Length (since Netbios name was length 16 with last byte 0x20)
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 5646727e33f5..39e47f46dea5 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -104,10 +104,12 @@ extern void cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr);
 extern struct inode *cifs_iget(struct super_block *sb,
                                struct cifs_fattr *fattr);
 
+extern int cifs_get_file_info(struct file *filp);
 extern int cifs_get_inode_info(struct inode **pinode,
                         const unsigned char *search_path,
                         FILE_ALL_INFO *pfile_info,
                         struct super_block *sb, int xid, const __u16 *pfid);
+extern int cifs_get_file_info_unix(struct file *filp);
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                         const unsigned char *search_path,
                         struct super_block *sb, int xid);
@@ -142,6 +144,8 @@ extern int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
 extern int CIFSFindClose(const int, struct cifsTconInfo *tcon,
                         const __u16 search_handle);
 
+extern int CIFSSMBQFileInfo(const int xid, struct cifsTconInfo *tcon,
+                        u16 netfid, FILE_ALL_INFO *pFindData);
 extern int CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
                         FILE_ALL_INFO *findData,
@@ -152,6 +156,8 @@ extern int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
                         FILE_ALL_INFO *findData,
                         const struct nls_table *nls_codepage, int remap);
 
+extern int CIFSSMBUnixQFileInfo(const int xid, struct cifsTconInfo *tcon,
+                        u16 netfid, FILE_UNIX_BASIC_INFO *pFindData);
 extern int CIFSSMBUnixQPathInfo(const int xid,
                         struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
@@ -363,13 +369,10 @@ extern int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon,
                         __u32 filter, struct file *file, int multishot,
                         const struct nls_table *nls_codepage);
 extern ssize_t CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
-                        const unsigned char *searchName, char *EAData,
+                        const unsigned char *searchName,
+                        const unsigned char *ea_name, char *EAData,
                         size_t bufsize, const struct nls_table *nls_codepage,
                         int remap_special_chars);
-extern ssize_t CIFSSMBQueryEA(const int xid, struct cifsTconInfo *tcon,
-                const unsigned char *searchName, const unsigned char *ea_name,
-                unsigned char *ea_value, size_t buf_size,
-                const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon,
                 const char *fileName, const char *ea_name,
                 const void *ea_value, const __u16 ea_value_len,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 941441d3e386..5d3f29fef532 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -30,6 +30,7 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/vfs.h>
+#include <linux/slab.h>
 #include <linux/posix_acl_xattr.h>
 #include <asm/uaccess.h>
 #include "cifspdu.h"
@@ -170,19 +171,19 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
          * need to prevent multiple threads trying to simultaneously
          * reconnect the same SMB session
          */
-        down(&ses->sesSem);
+        mutex_lock(&ses->session_mutex);
         if (ses->need_reconnect)
                 rc = cifs_setup_session(0, ses, nls_codepage);
 
         /* do we need to reconnect tcon? */
         if (rc || !tcon->need_reconnect) {
-                up(&ses->sesSem);
+                mutex_unlock(&ses->session_mutex);
                 goto out;
         }
 
         mark_open_files_invalid(tcon);
         rc = CIFSTCon(0, ses, tcon->treeName, tcon, nls_codepage);
-        up(&ses->sesSem);
+        mutex_unlock(&ses->session_mutex);
         cFYI(1, ("reconnect tcon rc = %d", rc));
 
         if (rc)
@@ -500,7 +501,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
         } else if (pSMBr->hdr.WordCount == 13) {
                 cERROR(1, ("mount failed, cifs module not built "
                           "with CIFS_WEAK_PW_HASH support"));
-                        rc = -EOPNOTSUPP;
+                rc = -EOPNOTSUPP;
 #endif /* WEAK_PW_HASH */
                 goto neg_err_exit;
         } else if (pSMBr->hdr.WordCount != 17) {
@@ -700,13 +701,13 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         if (!ses || !ses->server)
                 return -EIO;
 
-        down(&ses->sesSem);
+        mutex_lock(&ses->session_mutex);
         if (ses->need_reconnect)
                 goto session_already_dead; /* no need to send SMBlogoff if uid
                                               already closed due to reconnect */
         rc = small_smb_init(SMB_COM_LOGOFF_ANDX, 2, NULL, (void **)&pSMB);
         if (rc) {
-                up(&ses->sesSem);
+                mutex_unlock(&ses->session_mutex);
                 return rc;
         }
 
@@ -721,7 +722,7 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         pSMB->AndXCommand = 0xFF;
         rc = SendReceiveNoRsp(xid, ses, (struct smb_hdr *) pSMB, 0);
 session_already_dead:
-        up(&ses->sesSem);
+        mutex_unlock(&ses->session_mutex);
 
         /* if session dead then we do not need to do ulogoff,
                 since server closed smb session, no sense reporting
@@ -1430,6 +1431,8 @@ CIFSSMBWrite(const int xid, struct cifsTconInfo *tcon,
         __u32 bytes_sent;
         __u16 byte_count;
 
+        *nbytes = 0;
+
         /* cFYI(1, ("write at %lld %d bytes", offset, count));*/
         if (tcon->ses == NULL)
                 return -ECONNABORTED;
@@ -1512,11 +1515,18 @@ CIFSSMBWrite(const int xid, struct cifsTconInfo *tcon,
         cifs_stats_inc(&tcon->num_writes);
         if (rc) {
                 cFYI(1, ("Send error in write = %d", rc));
-                *nbytes = 0;
         } else {
                 *nbytes = le16_to_cpu(pSMBr->CountHigh);
                 *nbytes = (*nbytes) << 16;
                 *nbytes += le16_to_cpu(pSMBr->Count);
+
+                /*
+                 * Mask off high 16 bits when bytes written as returned by the
+                 * server is greater than bytes requested by the client. Some
+                 * OS/2 servers are known to set incorrect CountHigh values.
+                 */
+                if (*nbytes > count)
+                        *nbytes &= 0xFFFF;
         }
 
         cifs_buf_release(pSMB);
@@ -1605,6 +1615,14 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
                 *nbytes = le16_to_cpu(pSMBr->CountHigh);
                 *nbytes = (*nbytes) << 16;
                 *nbytes += le16_to_cpu(pSMBr->Count);
+
+                /*
+                 * Mask off high 16 bits when bytes written as returned by the
+                 * server is greater than bytes requested by the client. OS/2
+                 * servers are known to set incorrect CountHigh values.
+                 */
+                if (*nbytes > count)
+                        *nbytes &= 0xFFFF;
         }
 
 /*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
@@ -1793,8 +1811,21 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                 }
                 parm_data = (struct cifs_posix_lock *)
                         ((char *)&pSMBr->hdr.Protocol + data_offset);
-                if (parm_data->lock_type == cpu_to_le16(CIFS_UNLCK))
+                if (parm_data->lock_type == __constant_cpu_to_le16(CIFS_UNLCK))
                         pLockData->fl_type = F_UNLCK;
+                else {
+                        if (parm_data->lock_type ==
+                                        __constant_cpu_to_le16(CIFS_RDLCK))
+                                pLockData->fl_type = F_RDLCK;
+                        else if (parm_data->lock_type ==
+                                        __constant_cpu_to_le16(CIFS_WRLCK))
+                                pLockData->fl_type = F_WRLCK;
+
+                        pLockData->fl_start = parm_data->start;
+                        pLockData->fl_end = parm_data->start +
+                                                parm_data->length - 1;
+                        pLockData->fl_pid = parm_data->pid;
+                }
         }
 
 plk_err_exit:
@@ -3230,8 +3261,72 @@ QInfRetry:
         return rc;
 }
 
+int
+CIFSSMBQFileInfo(const int xid, struct cifsTconInfo *tcon,
+                 u16 netfid, FILE_ALL_INFO *pFindData)
+{
+        struct smb_t2_qfi_req *pSMB = NULL;
+        struct smb_t2_qfi_rsp *pSMBr = NULL;
+        int rc = 0;
+        int bytes_returned;
+        __u16 params, byte_count;
+
+QFileInfoRetry:
+        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+                      (void **) &pSMBr);
+        if (rc)
+                return rc;
+
+        params = 2 /* level */ + 2 /* fid */;
+        pSMB->t2.TotalDataCount = 0;
+        pSMB->t2.MaxParameterCount = cpu_to_le16(4);
+        /* BB find exact max data count below from sess structure BB */
+        pSMB->t2.MaxDataCount = cpu_to_le16(CIFSMaxBufSize);
+        pSMB->t2.MaxSetupCount = 0;
+        pSMB->t2.Reserved = 0;
+        pSMB->t2.Flags = 0;
+        pSMB->t2.Timeout = 0;
+        pSMB->t2.Reserved2 = 0;
+        pSMB->t2.ParameterOffset = cpu_to_le16(offsetof(struct smb_t2_qfi_req,
+                                               Fid) - 4);
+        pSMB->t2.DataCount = 0;
+        pSMB->t2.DataOffset = 0;
+        pSMB->t2.SetupCount = 1;
+        pSMB->t2.Reserved3 = 0;
+        pSMB->t2.SubCommand = cpu_to_le16(TRANS2_QUERY_FILE_INFORMATION);
+        byte_count = params + 1 /* pad */ ;
+        pSMB->t2.TotalParameterCount = cpu_to_le16(params);
+        pSMB->t2.ParameterCount = pSMB->t2.TotalParameterCount;
+        pSMB->InformationLevel = cpu_to_le16(SMB_QUERY_FILE_ALL_INFO);
+        pSMB->Pad = 0;
+        pSMB->Fid = netfid;
+        pSMB->hdr.smb_buf_length += byte_count;
+
+        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        if (rc) {
+                cFYI(1, ("Send error in QPathInfo = %d", rc));
+        } else {                /* decode response */
+                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
+                if (rc) /* BB add auto retry on EOPNOTSUPP? */
+                        rc = -EIO;
+                else if (pSMBr->ByteCount < 40)
+                        rc = -EIO;      /* bad smb */
+                else if (pFindData) {
+                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+                        memcpy((char *) pFindData,
+                               (char *) &pSMBr->hdr.Protocol +
+                               data_offset, sizeof(FILE_ALL_INFO));
+                } else
+                    rc = -ENOMEM;
+        }
+        cifs_buf_release(pSMB);
+        if (rc == -EAGAIN)
+                goto QFileInfoRetry;
 
+        return rc;
+}
 
 int
 CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
@@ -3335,6 +3430,75 @@ QPathInfoRetry:
 }
 
 int
+CIFSSMBUnixQFileInfo(const int xid, struct cifsTconInfo *tcon,
+                 u16 netfid, FILE_UNIX_BASIC_INFO *pFindData)
+{
+        struct smb_t2_qfi_req *pSMB = NULL;
+        struct smb_t2_qfi_rsp *pSMBr = NULL;
+        int rc = 0;
+        int bytes_returned;
+        __u16 params, byte_count;
+
+UnixQFileInfoRetry:
+        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+                      (void **) &pSMBr);
+        if (rc)
+                return rc;
+
+        params = 2 /* level */ + 2 /* fid */;
+        pSMB->t2.TotalDataCount = 0;
+        pSMB->t2.MaxParameterCount = cpu_to_le16(4);
+        /* BB find exact max data count below from sess structure BB */
+        pSMB->t2.MaxDataCount = cpu_to_le16(CIFSMaxBufSize);
+        pSMB->t2.MaxSetupCount = 0;
+        pSMB->t2.Reserved = 0;
+        pSMB->t2.Flags = 0;
+        pSMB->t2.Timeout = 0;
+        pSMB->t2.Reserved2 = 0;
+        pSMB->t2.ParameterOffset = cpu_to_le16(offsetof(struct smb_t2_qfi_req,
+                                               Fid) - 4);
+        pSMB->t2.DataCount = 0;
+        pSMB->t2.DataOffset = 0;
+        pSMB->t2.SetupCount = 1;
+        pSMB->t2.Reserved3 = 0;
+        pSMB->t2.SubCommand = cpu_to_le16(TRANS2_QUERY_FILE_INFORMATION);
+        byte_count = params + 1 /* pad */ ;
+        pSMB->t2.TotalParameterCount = cpu_to_le16(params);
+        pSMB->t2.ParameterCount = pSMB->t2.TotalParameterCount;
+        pSMB->InformationLevel = cpu_to_le16(SMB_QUERY_FILE_UNIX_BASIC);
+        pSMB->Pad = 0;
+        pSMB->Fid = netfid;
+        pSMB->hdr.smb_buf_length += byte_count;
+
+        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        if (rc) {
+                cFYI(1, ("Send error in QPathInfo = %d", rc));
+        } else {                /* decode response */
+                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+
+                if (rc || (pSMBr->ByteCount < sizeof(FILE_UNIX_BASIC_INFO))) {
+                        cERROR(1, ("Malformed FILE_UNIX_BASIC_INFO response.\n"
+                                   "Unix Extensions can be disabled on mount "
+                                   "by specifying the nosfu mount option."));
+                        rc = -EIO;      /* bad smb */
+                } else {
+                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+                        memcpy((char *) pFindData,
+                               (char *) &pSMBr->hdr.Protocol +
+                               data_offset,
+                               sizeof(FILE_UNIX_BASIC_INFO));
+                }
+        }
+
+        cifs_buf_release(pSMB);
+        if (rc == -EAGAIN)
+                goto UnixQFileInfoRetry;
+
+        return rc;
+}
+
+int
 CIFSSMBUnixQPathInfo(const int xid, struct cifsTconInfo *tcon,
                      const unsigned char *searchName,
                      FILE_UNIX_BASIC_INFO *pFindData,
@@ -3886,7 +4050,7 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 goto parse_DFS_referrals_exit;
         }
 
-        /* collect neccessary data from referrals */
+        /* collect necessary data from referrals */
         for (i = 0; i < *num_of_nodes; i++) {
                 char *temp;
                 int max_len;
@@ -5269,22 +5433,34 @@ int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon,
         cifs_buf_release(pSMB);
         return rc;
 }
+
 #ifdef CONFIG_CIFS_XATTR
+/*
+ * Do a path-based QUERY_ALL_EAS call and parse the result. This is a common
+ * function used by listxattr and getxattr type calls. When ea_name is set,
+ * it looks for that attribute name and stuffs that value into the EAData
+ * buffer. When ea_name is NULL, it stuffs a list of attribute names into the
+ * buffer. In both cases, the return value is either the length of the
+ * resulting data or a negative error code. If EAData is a NULL pointer then
+ * the data isn't copied to it, but the length is returned.
+ */
 ssize_t
 CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
-                 const unsigned char *searchName,
-                 char *EAData, size_t buf_size,
-                 const struct nls_table *nls_codepage, int remap)
+                const unsigned char *searchName, const unsigned char *ea_name,
+                char *EAData, size_t buf_size,
+                const struct nls_table *nls_codepage, int remap)
 {
                 /* BB assumes one setup word */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
         TRANSACTION2_QPI_RSP *pSMBr = NULL;
         int rc = 0;
         int bytes_returned;
-        int name_len;
+        int list_len;
+        struct fealist *ea_response_data;
         struct fea *temp_fea;
         char *temp_ptr;
-        __u16 params, byte_count;
+        char *end_of_smb;
+        __u16 params, byte_count, data_offset;
 
         cFYI(1, ("In Query All EAs path %s", searchName));
 QAllEAsRetry:
@@ -5294,22 +5470,22 @@ QAllEAsRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len =
+                list_len =
                     cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
                                      PATH_MAX, nls_codepage, remap);
-                name_len++;     /* trailing null */
-                name_len *= 2;
+                list_len++;     /* trailing null */
+                list_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
-                name_len = strnlen(searchName, PATH_MAX);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
+                list_len = strnlen(searchName, PATH_MAX);
+                list_len++;     /* trailing null */
+                strncpy(pSMB->FileName, searchName, list_len);
         }
 
-        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
+        params = 2 /* level */ + 4 /* reserved */ + list_len /* includes NUL */;
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
         /* BB find exact max SMB PDU from sess structure BB */
-        pSMB->MaxDataCount = cpu_to_le16(4000);
+        pSMB->MaxDataCount = cpu_to_le16(CIFSMaxBufSize);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -5334,237 +5510,117 @@ QAllEAsRetry:
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
                 cFYI(1, ("Send error in QueryAllEAs = %d", rc));
-        } else {                /* decode response */
-                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                goto QAllEAsOut;
+        }
 
-                /* BB also check enough total bytes returned */
-                /* BB we need to improve the validity checking
-                of these trans2 responses */
-                if (rc || (pSMBr->ByteCount < 4))
-                        rc = -EIO;      /* bad smb */
-           /* else if (pFindData){
-                        memcpy((char *) pFindData,
-                               (char *) &pSMBr->hdr.Protocol +
-                               data_offset, kl);
-                }*/ else {
-                        /* check that length of list is not more than bcc */
-                        /* check that each entry does not go beyond length
-                           of list */
-                        /* check that each element of each entry does not
-                           go beyond end of list */
-                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
-                        struct fealist *ea_response_data;
-                        rc = 0;
-                        /* validate_trans2_offsets() */
-                        /* BB check if start of smb + data_offset > &bcc+ bcc */
-                        ea_response_data = (struct fealist *)
-                                (((char *) &pSMBr->hdr.Protocol) +
-                                data_offset);
-                        name_len = le32_to_cpu(ea_response_data->list_len);
-                        cFYI(1, ("ea length %d", name_len));
-                        if (name_len <= 8) {
-                        /* returned EA size zeroed at top of function */
-                                cFYI(1, ("empty EA list returned from server"));
-                        } else {
-                                /* account for ea list len */
-                                name_len -= 4;
-                                temp_fea = ea_response_data->list;
-                                temp_ptr = (char *)temp_fea;
-                                while (name_len > 0) {
-                                        __u16 value_len;
-                                        name_len -= 4;
-                                        temp_ptr += 4;
-                                        rc += temp_fea->name_len;
-                                /* account for prefix user. and trailing null */
-                                        rc = rc + 5 + 1;
-                                        if (rc < (int)buf_size) {
-                                                memcpy(EAData, "user.", 5);
-                                                EAData += 5;
-                                                memcpy(EAData, temp_ptr,
-                                                       temp_fea->name_len);
-                                                EAData += temp_fea->name_len;
-                                                /* null terminate name */
-                                                *EAData = 0;
-                                                EAData = EAData + 1;
-                                        } else if (buf_size == 0) {
-                                                /* skip copy - calc size only */
-                                        } else {
-                                                /* stop before overrun buffer */
-                                                rc = -ERANGE;
-                                                break;
-                                        }
-                                        name_len -= temp_fea->name_len;
-                                        temp_ptr += temp_fea->name_len;
-                                        /* account for trailing null */
-                                        name_len--;
-                                        temp_ptr++;
-                                        value_len =
-                                              le16_to_cpu(temp_fea->value_len);
-                                        name_len -= value_len;
-                                        temp_ptr += value_len;
-                                        /* BB check that temp_ptr is still
-                                              within the SMB BB*/
-
-                                        /* no trailing null to account for
-                                           in value len */
-                                        /* go on to next EA */
-                                        temp_fea = (struct fea *)temp_ptr;
-                                }
-                        }
-                }
+
+        /* BB also check enough total bytes returned */
+        /* BB we need to improve the validity checking
+        of these trans2 responses */
+
+        rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+        if (rc || (pSMBr->ByteCount < 4)) {
+                rc = -EIO;      /* bad smb */
+                goto QAllEAsOut;
         }
-        cifs_buf_release(pSMB);
-        if (rc == -EAGAIN)
-                goto QAllEAsRetry;
 
-        return (ssize_t)rc;
-}
+        /* check that length of list is not more than bcc */
+        /* check that each entry does not go beyond length
+           of list */
+        /* check that each element of each entry does not
+           go beyond end of list */
+        /* validate_trans2_offsets() */
+        /* BB check if start of smb + data_offset > &bcc+ bcc */
 
-ssize_t CIFSSMBQueryEA(const int xid, struct cifsTconInfo *tcon,
-                const unsigned char *searchName, const unsigned char *ea_name,
-                unsigned char *ea_value, size_t buf_size,
-                const struct nls_table *nls_codepage, int remap)
-{
-        TRANSACTION2_QPI_REQ *pSMB = NULL;
-        TRANSACTION2_QPI_RSP *pSMBr = NULL;
-        int rc = 0;
-        int bytes_returned;
-        int name_len;
-        struct fea *temp_fea;
-        char *temp_ptr;
-        __u16 params, byte_count;
+        data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+        ea_response_data = (struct fealist *)
+                                (((char *) &pSMBr->hdr.Protocol) + data_offset);
 
-        cFYI(1, ("In Query EA path %s", searchName));
-QEARetry:
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
-        if (rc)
-                return rc;
+        list_len = le32_to_cpu(ea_response_data->list_len);
+        cFYI(1, ("ea length %d", list_len));
+        if (list_len <= 8) {
+                cFYI(1, ("empty EA list returned from server"));
+                goto QAllEAsOut;
+        }
 
-        if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                     PATH_MAX, nls_codepage, remap);
-                name_len++;     /* trailing null */
-                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
-                name_len = strnlen(searchName, PATH_MAX);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
+        /* make sure list_len doesn't go past end of SMB */
+        end_of_smb = (char *)pByteArea(&pSMBr->hdr) + BCC(&pSMBr->hdr);
+        if ((char *)ea_response_data + list_len > end_of_smb) {
+                cFYI(1, ("EA list appears to go beyond SMB"));
+                rc = -EIO;
+                goto QAllEAsOut;
         }
 
-        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
-        pSMB->TotalDataCount = 0;
-        pSMB->MaxParameterCount = cpu_to_le16(2);
-        /* BB find exact max SMB PDU from sess structure BB */
-        pSMB->MaxDataCount = cpu_to_le16(4000);
-        pSMB->MaxSetupCount = 0;
-        pSMB->Reserved = 0;
-        pSMB->Flags = 0;
-        pSMB->Timeout = 0;
-        pSMB->Reserved2 = 0;
-        pSMB->ParameterOffset = cpu_to_le16(offsetof(
-                struct smb_com_transaction2_qpi_req, InformationLevel) - 4);
-        pSMB->DataCount = 0;
-        pSMB->DataOffset = 0;
-        pSMB->SetupCount = 1;
-        pSMB->Reserved3 = 0;
-        pSMB->SubCommand = cpu_to_le16(TRANS2_QUERY_PATH_INFORMATION);
-        byte_count = params + 1 /* pad */ ;
-        pSMB->TotalParameterCount = cpu_to_le16(params);
-        pSMB->ParameterCount = pSMB->TotalParameterCount;
-        pSMB->InformationLevel = cpu_to_le16(SMB_INFO_QUERY_ALL_EAS);
-        pSMB->Reserved4 = 0;
-        pSMB->hdr.smb_buf_length += byte_count;
-        pSMB->ByteCount = cpu_to_le16(byte_count);
+        /* account for ea list len */
+        list_len -= 4;
+        temp_fea = ea_response_data->list;
+        temp_ptr = (char *)temp_fea;
+        while (list_len > 0) {
+                unsigned int name_len;
+                __u16 value_len;
+
+                list_len -= 4;
+                temp_ptr += 4;
+                /* make sure we can read name_len and value_len */
+                if (list_len < 0) {
+                        cFYI(1, ("EA entry goes beyond length of list"));
+                        rc = -EIO;
+                        goto QAllEAsOut;
+                }
 
-        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
-        if (rc) {
-                cFYI(1, ("Send error in Query EA = %d", rc));
-        } else {                /* decode response */
-                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                name_len = temp_fea->name_len;
+                value_len = le16_to_cpu(temp_fea->value_len);
+                list_len -= name_len + 1 + value_len;
+                if (list_len < 0) {
+                        cFYI(1, ("EA entry goes beyond length of list"));
+                        rc = -EIO;
+                        goto QAllEAsOut;
+                }
 
-                /* BB also check enough total bytes returned */
-                /* BB we need to improve the validity checking
-                of these trans2 responses */
-                if (rc || (pSMBr->ByteCount < 4))
-                        rc = -EIO;      /* bad smb */
-           /* else if (pFindData){
-                        memcpy((char *) pFindData,
-                               (char *) &pSMBr->hdr.Protocol +
-                               data_offset, kl);
-                }*/ else {
-                        /* check that length of list is not more than bcc */
-                        /* check that each entry does not go beyond length
-                           of list */
-                        /* check that each element of each entry does not
-                           go beyond end of list */
-                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
-                        struct fealist *ea_response_data;
-                        rc = -ENODATA;
-                        /* validate_trans2_offsets() */
-                        /* BB check if start of smb + data_offset > &bcc+ bcc*/
-                        ea_response_data = (struct fealist *)
-                                (((char *) &pSMBr->hdr.Protocol) +
-                                data_offset);
-                        name_len = le32_to_cpu(ea_response_data->list_len);
-                        cFYI(1, ("ea length %d", name_len));
-                        if (name_len <= 8) {
-                        /* returned EA size zeroed at top of function */
-                                cFYI(1, ("empty EA list returned from server"));
-                        } else {
-                                /* account for ea list len */
-                                name_len -= 4;
-                                temp_fea = ea_response_data->list;
-                                temp_ptr = (char *)temp_fea;
-                                /* loop through checking if we have a matching
-                                name and then return the associated value */
-                                while (name_len > 0) {
-                                        __u16 value_len;
-                                        name_len -= 4;
-                                        temp_ptr += 4;
-                                        value_len =
-                                              le16_to_cpu(temp_fea->value_len);
-                                /* BB validate that value_len falls within SMB,
-                                even though maximum for name_len is 255 */
-                                        if (memcmp(temp_fea->name, ea_name,
-                                                  temp_fea->name_len) == 0) {
-                                                /* found a match */
-                                                rc = value_len;
-                                /* account for prefix user. and trailing null */
-                                                if (rc <= (int)buf_size) {
-                                                        memcpy(ea_value,
-                                                                temp_fea->name+temp_fea->name_len+1,
-                                                                rc);
-                                                        /* ea values, unlike ea
-                                                           names, are not null
-                                                           terminated */
-                                                } else if (buf_size == 0) {
-                                                /* skip copy - calc size only */
-                                                } else {
-                                                /* stop before overrun buffer */
-                                                        rc = -ERANGE;
-                                                }
-                                                break;
-                                        }
-                                        name_len -= temp_fea->name_len;
-                                        temp_ptr += temp_fea->name_len;
-                                        /* account for trailing null */
-                                        name_len--;
-                                        temp_ptr++;
-                                        name_len -= value_len;
-                                        temp_ptr += value_len;
-                                        /* No trailing null to account for in
-                                           value_len.  Go on to next EA */
-                                        temp_fea = (struct fea *)temp_ptr;
+                if (ea_name) {
+                        if (strncmp(ea_name, temp_ptr, name_len) == 0) {
+                                temp_ptr += name_len + 1;
+                                rc = value_len;
+                                if (buf_size == 0)
+                                        goto QAllEAsOut;
+                                if ((size_t)value_len > buf_size) {
+                                        rc = -ERANGE;
+                                        goto QAllEAsOut;
                                 }
+                                memcpy(EAData, temp_ptr, value_len);
+                                goto QAllEAsOut;
+                        }
+                } else {
+                        /* account for prefix user. and trailing null */
+                        rc += (5 + 1 + name_len);
+                        if (rc < (int) buf_size) {
+                                memcpy(EAData, "user.", 5);
+                                EAData += 5;
+                                memcpy(EAData, temp_ptr, name_len);
+                                EAData += name_len;
+                                /* null terminate name */
+                                *EAData = 0;
+                                ++EAData;
+                        } else if (buf_size == 0) {
+                                /* skip copy - calc size only */
+                        } else {
+                                /* stop before overrun buffer */
+                                rc = -ERANGE;
+                                break;
                         }
                 }
+                temp_ptr += name_len + 1 + value_len;
+                temp_fea = (struct fea *)temp_ptr;
         }
+
+        /* didn't find the named attribute */
+        if (ea_name)
+                rc = -ENODATA;
+
+QAllEAsOut:
         cifs_buf_release(pSMB);
         if (rc == -EAGAIN)
-                goto QEARetry;
+                goto QAllEAsRetry;
 
         return (ssize_t)rc;
 }
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 63ea83ff687f..d9566bf8f917 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -23,6 +23,7 @@
 #include <linux/string.h>
 #include <linux/list.h>
 #include <linux/wait.h>
+#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/ctype.h>
 #include <linux/utsname.h>
@@ -98,7 +99,7 @@ struct smb_vol {
         bool nostrictsync:1; /* do not force expensive SMBflush on every sync */
         unsigned int rsize;
         unsigned int wsize;
-        unsigned int sockopt;
+        bool sockopt_tcp_nodelay:1;
         unsigned short int port;
         char *prepath;
 };
@@ -1142,9 +1143,11 @@ cifs_parse_mount_options(char *options, const char *devname,
                                         simple_strtoul(value, &value, 0);
                         }
                 } else if (strnicmp(data, "sockopt", 5) == 0) {
-                        if (value && *value) {
-                                vol->sockopt =
-                                        simple_strtoul(value, &value, 0);
+                        if (!value || !*value) {
+                                cERROR(1, ("no socket option specified"));
+                                continue;
+                        } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
+                                vol->sockopt_tcp_nodelay = 1;
                         }
                 } else if (strnicmp(data, "netbiosname", 4) == 0) {
                         if (!value || !*value || (*value == ' ')) {
@@ -1514,6 +1517,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
 
         tcp_ses->noblocksnd = volume_info->noblocksnd;
         tcp_ses->noautotune = volume_info->noautotune;
+        tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
         atomic_set(&tcp_ses->inFlight, 0);
         init_waitqueue_head(&tcp_ses->response_q);
         init_waitqueue_head(&tcp_ses->request_q);
@@ -1764,6 +1768,7 @@ static int
 ipv4_connect(struct TCP_Server_Info *server)
 {
         int rc = 0;
+        int val;
         bool connected = false;
         __be16 orig_port = 0;
         struct socket *socket = server->ssocket;
@@ -1845,6 +1850,14 @@ ipv4_connect(struct TCP_Server_Info *server)
                         socket->sk->sk_rcvbuf = 140 * 1024;
         }
 
+        if (server->tcp_nodelay) {
+                val = 1;
+                rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
+                                (char *)&val, sizeof(val));
+                if (rc)
+                        cFYI(1, ("set TCP_NODELAY socket option error %d", rc));
+        }
+
          cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
                  socket->sk->sk_sndbuf,
                  socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo));
@@ -1916,6 +1929,7 @@ static int
 ipv6_connect(struct TCP_Server_Info *server)
 {
         int rc = 0;
+        int val;
         bool connected = false;
         __be16 orig_port = 0;
         struct socket *socket = server->ssocket;
@@ -1987,6 +2001,15 @@ ipv6_connect(struct TCP_Server_Info *server)
          */
         socket->sk->sk_rcvtimeo = 7 * HZ;
         socket->sk->sk_sndtimeo = 5 * HZ;
+
+        if (server->tcp_nodelay) {
+                val = 1;
+                rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
+                                (char *)&val, sizeof(val));
+                if (rc)
+                        cFYI(1, ("set TCP_NODELAY socket option error %d", rc));
+        }
+
         server->ssocket = socket;
 
         return rc;
@@ -2287,12 +2310,12 @@ int
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 char *mount_data_global, const char *devname)
 {
-        int rc = 0;
+        int rc;
         int xid;
         struct smb_vol *volume_info;
-        struct cifsSesInfo *pSesInfo = NULL;
-        struct cifsTconInfo *tcon = NULL;
-        struct TCP_Server_Info *srvTcp = NULL;
+        struct cifsSesInfo *pSesInfo;
+        struct cifsTconInfo *tcon;
+        struct TCP_Server_Info *srvTcp;
         char   *full_path;
         char *mount_data = mount_data_global;
 #ifdef CONFIG_CIFS_DFS_UPCALL
@@ -2301,6 +2324,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         int referral_walks_count = 0;
 try_mount_again:
 #endif
+        rc = 0;
+        tcon = NULL;
+        pSesInfo = NULL;
+        srvTcp = NULL;
         full_path = NULL;
 
         xid = GetXid();
@@ -2362,13 +2389,13 @@ try_mount_again:
                  */
                 cifs_put_tcp_session(srvTcp);
 
-                down(&pSesInfo->sesSem);
+                mutex_lock(&pSesInfo->session_mutex);
                 if (pSesInfo->need_reconnect) {
                         cFYI(1, ("Session needs reconnect"));
                         rc = cifs_setup_session(xid, pSesInfo,
                                                 cifs_sb->local_nls);
                 }
-                up(&pSesInfo->sesSem);
+                mutex_unlock(&pSesInfo->session_mutex);
         } else if (!rc) {
                 cFYI(1, ("Existing smb sess not found"));
                 pSesInfo = sesInfoAlloc();
@@ -2411,12 +2438,12 @@ try_mount_again:
                 }
                 pSesInfo->linux_uid = volume_info->linux_uid;
                 pSesInfo->overrideSecFlg = volume_info->secFlg;
-                down(&pSesInfo->sesSem);
+                mutex_lock(&pSesInfo->session_mutex);
 
                 /* BB FIXME need to pass vol->secFlgs BB */
                 rc = cifs_setup_session(xid, pSesInfo,
                                         cifs_sb->local_nls);
-                up(&pSesInfo->sesSem);
+                mutex_unlock(&pSesInfo->session_mutex);
         }
 
         /* search for existing tcon to this server share */
@@ -2597,6 +2624,7 @@ remote_path_check:
 
                         cleanup_volume_info(&volume_info);
                         referral_walks_count++;
+                        FreeXid(xid);
                         goto try_mount_again;
                 }
 #else /* No DFS support, return error on mount */
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 6ccf7262d1b7..e9f7ecc2714b 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -739,7 +739,7 @@ cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
         int isValid = 1;
 
         if (direntry->d_inode) {
-                if (cifs_revalidate(direntry))
+                if (cifs_revalidate_dentry(direntry))
                         return 0;
         } else {
                 cFYI(1, ("neg dentry 0x%p name = %s",
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 87948147d7ec..6f8a0e3fb25b 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -23,6 +23,7 @@
  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
+#include <linux/slab.h>
 #include <keys/user-type.h>
 #include "dns_resolve.h"
 #include "cifsglob.h"
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 057e1dae12ab..9b11a8f56f3a 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -31,6 +31,7 @@
 #include <linux/task_io_accounting_ops.h>
 #include <linux/delay.h>
 #include <linux/mount.h>
+#include <linux/slab.h>
 #include <asm/div64.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
@@ -219,8 +220,8 @@ static inline int cifs_open_inode_helper(struct inode *inode, struct file *file,
                 cFYI(1, ("inode unchanged on server"));
         } else {
                 if (file->f_path.dentry->d_inode->i_mapping) {
-                /* BB no need to lock inode until after invalidate
-                   since namei code should already have it locked? */
+                        /* BB no need to lock inode until after invalidate
+                        since namei code should already have it locked? */
                         rc = filemap_write_and_wait(file->f_path.dentry->d_inode->i_mapping);
                         if (rc != 0)
                                 CIFS_I(file->f_path.dentry->d_inode)->write_behind_rc = rc;
@@ -838,8 +839,32 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
 
                 } else {
                         /* if rc == ERR_SHARING_VIOLATION ? */
-                        rc = 0; /* do not change lock type to unlock
-                                   since range in use */
+                        rc = 0;
+
+                        if (lockType & LOCKING_ANDX_SHARED_LOCK) {
+                                pfLock->fl_type = F_WRLCK;
+                        } else {
+                                rc = CIFSSMBLock(xid, tcon, netfid, length,
+                                        pfLock->fl_start, 0, 1,
+                                        lockType | LOCKING_ANDX_SHARED_LOCK,
+                                        0 /* wait flag */);
+                                if (rc == 0) {
+                                        rc = CIFSSMBLock(xid, tcon, netfid,
+                                                length, pfLock->fl_start, 1, 0,
+                                                lockType |
+                                                LOCKING_ANDX_SHARED_LOCK,
+                                                0 /* wait flag */);
+                                        pfLock->fl_type = F_RDLCK;
+                                        if (rc != 0)
+                                                cERROR(1, ("Error unlocking "
+                                                "previously locked range %d "
+                                                "during test of lock", rc));
+                                        rc = 0;
+                                } else {
+                                        pfLock->fl_type = F_WRLCK;
+                                        rc = 0;
+                                }
+                        }
                 }
 
                 FreeXid(xid);
@@ -1890,11 +1915,10 @@ static ssize_t cifs_read(struct file *file, char *read_data, size_t read_size,
 
 int cifs_file_mmap(struct file *file, struct vm_area_struct *vma)
 {
-        struct dentry *dentry = file->f_path.dentry;
         int rc, xid;
 
         xid = GetXid();
-        rc = cifs_revalidate(dentry);
+        rc = cifs_revalidate_file(file);
         if (rc) {
                 cFYI(1, ("Validation prior to mmap failed, error=%d", rc));
                 FreeXid(xid);
@@ -2289,9 +2313,9 @@ cifs_oplock_break(struct slow_work *work)
         if (inode && S_ISREG(inode->i_mode)) {
 #ifdef CONFIG_CIFS_EXPERIMENTAL
                 if (cinode->clientCanCacheAll == 0)
-                        break_lease(inode, FMODE_READ);
+                        break_lease(inode, O_RDONLY);
                 else if (cinode->clientCanCacheRead == 0)
-                        break_lease(inode, FMODE_WRITE);
+                        break_lease(inode, O_WRONLY);
 #endif
                 rc = filemap_fdatawrite(inode->i_mapping);
                 if (cinode->clientCanCacheRead == 0) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index cf18ee765590..35ec11716213 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -20,6 +20,7 @@
  */
 #include <linux/fs.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <asm/div64.h>
 #include "cifsfs.h"
@@ -77,6 +78,41 @@ static void cifs_set_ops(struct inode *inode, const bool is_dfs_referral)
         }
 }
 
+/* check inode attributes against fattr. If they don't match, tag the
+ * inode for cache invalidation
+ */
+static void
+cifs_revalidate_cache(struct inode *inode, struct cifs_fattr *fattr)
+{
+        struct cifsInodeInfo *cifs_i = CIFS_I(inode);
+
+        cFYI(1, ("%s: revalidating inode %llu", __func__, cifs_i->uniqueid));
+
+        if (inode->i_state & I_NEW) {
+                cFYI(1, ("%s: inode %llu is new", __func__, cifs_i->uniqueid));
+                return;
+        }
+
+        /* don't bother with revalidation if we have an oplock */
+        if (cifs_i->clientCanCacheRead) {
+                cFYI(1, ("%s: inode %llu is oplocked", __func__,
+                         cifs_i->uniqueid));
+                return;
+        }
+
+         /* revalidate if mtime or size have changed */
+        if (timespec_equal(&inode->i_mtime, &fattr->cf_mtime) &&
+            cifs_i->server_eof == fattr->cf_eof) {
+                cFYI(1, ("%s: inode %llu is unchanged", __func__,
+                         cifs_i->uniqueid));
+                return;
+        }
+
+        cFYI(1, ("%s: invalidating inode %llu mapping", __func__,
+                 cifs_i->uniqueid));
+        cifs_i->invalid_mapping = true;
+}
+
 /* populate an inode with info from a cifs_fattr struct */
 void
 cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
@@ -85,6 +121,8 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
         struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
         unsigned long oldtime = cifs_i->time;
 
+        cifs_revalidate_cache(inode, fattr);
+
         inode->i_atime = fattr->cf_atime;
         inode->i_mtime = fattr->cf_mtime;
         inode->i_ctime = fattr->cf_ctime;
@@ -111,6 +149,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
 
         cifs_i->delete_pending = fattr->cf_flags & CIFS_FATTR_DELETE_PENDING;
 
+        cifs_i->server_eof = fattr->cf_eof;
         /*
          * Can't safely change the file size here if the client is writing to
          * it due to potential races.
@@ -230,6 +269,31 @@ cifs_create_dfs_fattr(struct cifs_fattr *fattr, struct super_block *sb)
         fattr->cf_flags |= CIFS_FATTR_DFS_REFERRAL;
 }
 
+int cifs_get_file_info_unix(struct file *filp)
+{
+        int rc;
+        int xid;
+        FILE_UNIX_BASIC_INFO find_data;
+        struct cifs_fattr fattr;
+        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        struct cifsTconInfo *tcon = cifs_sb->tcon;
+        struct cifsFileInfo *cfile = (struct cifsFileInfo *) filp->private_data;
+
+        xid = GetXid();
+        rc = CIFSSMBUnixQFileInfo(xid, tcon, cfile->netfid, &find_data);
+        if (!rc) {
+                cifs_unix_basic_to_fattr(&fattr, &find_data, cifs_sb);
+        } else if (rc == -EREMOTE) {
+                cifs_create_dfs_fattr(&fattr, inode->i_sb);
+                rc = 0;
+        }
+
+        cifs_fattr_to_inode(inode, &fattr);
+        FreeXid(xid);
+        return rc;
+}
+
 int cifs_get_inode_info_unix(struct inode **pinode,
                              const unsigned char *full_path,
                              struct super_block *sb, int xid)
@@ -366,7 +430,7 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
         char ea_value[4];
         __u32 mode;
 
-        rc = CIFSSMBQueryEA(xid, cifs_sb->tcon, path, "SETFILEBITS",
+        rc = CIFSSMBQAllEAs(xid, cifs_sb->tcon, path, "SETFILEBITS",
                             ea_value, 4 /* size of buf */, cifs_sb->local_nls,
                             cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -431,6 +495,47 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
         fattr->cf_gid = cifs_sb->mnt_gid;
 }
 
+int cifs_get_file_info(struct file *filp)
+{
+        int rc;
+        int xid;
+        FILE_ALL_INFO find_data;
+        struct cifs_fattr fattr;
+        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+        struct cifsTconInfo *tcon = cifs_sb->tcon;
+        struct cifsFileInfo *cfile = (struct cifsFileInfo *) filp->private_data;
+
+        xid = GetXid();
+        rc = CIFSSMBQFileInfo(xid, tcon, cfile->netfid, &find_data);
+        if (rc == -EOPNOTSUPP || rc == -EINVAL) {
+                /*
+                 * FIXME: legacy server -- fall back to path-based call?
+                 * for now, just skip revalidating and mark inode for
+                 * immediate reval.
+                 */
+                rc = 0;
+                CIFS_I(inode)->time = 0;
+                goto cgfi_exit;
+        } else if (rc == -EREMOTE) {
+                cifs_create_dfs_fattr(&fattr, inode->i_sb);
+                rc = 0;
+        } else if (rc)
+                goto cgfi_exit;
+
+        /*
+         * don't bother with SFU junk here -- just mark inode as needing
+         * revalidation.
+         */
+        cifs_all_info_to_fattr(&fattr, &find_data, cifs_sb, false);
+        fattr.cf_uniqueid = CIFS_I(inode)->uniqueid;
+        fattr.cf_flags |= CIFS_FATTR_NEED_REVAL;
+        cifs_fattr_to_inode(inode, &fattr);
+cgfi_exit:
+        FreeXid(xid);
+        return rc;
+}
+
 int cifs_get_inode_info(struct inode **pinode,
         const unsigned char *full_path, FILE_ALL_INFO *pfindData,
         struct super_block *sb, int xid, const __u16 *pfid)
@@ -1388,135 +1493,103 @@ cifs_rename_exit:
         return rc;
 }
 
-int cifs_revalidate(struct dentry *direntry)
+static bool
+cifs_inode_needs_reval(struct inode *inode)
 {
-        int xid;
-        int rc = 0, wbrc = 0;
-        char *full_path;
-        struct cifs_sb_info *cifs_sb;
-        struct cifsInodeInfo *cifsInode;
-        loff_t local_size;
-        struct timespec local_mtime;
-        bool invalidate_inode = false;
+        struct cifsInodeInfo *cifs_i = CIFS_I(inode);
 
-        if (direntry->d_inode == NULL)
-                return -ENOENT;
+        if (cifs_i->clientCanCacheRead)
+                return false;
 
-        cifsInode = CIFS_I(direntry->d_inode);
+        if (!lookupCacheEnabled)
+                return true;
 
-        if (cifsInode == NULL)
-                return -ENOENT;
+        if (cifs_i->time == 0)
+                return true;
 
-        /* no sense revalidating inode info on file that no one can write */
-        if (CIFS_I(direntry->d_inode)->clientCanCacheRead)
-                return rc;
+        /* FIXME: the actimeo should be tunable */
+        if (time_after_eq(jiffies, cifs_i->time + HZ))
+                return true;
+
+        return false;
+}
+
+/* check invalid_mapping flag and zap the cache if it's set */
+static void
+cifs_invalidate_mapping(struct inode *inode)
+{
+        int rc;
+        struct cifsInodeInfo *cifs_i = CIFS_I(inode);
+
+        cifs_i->invalid_mapping = false;
+
+        /* write back any cached data */
+        if (inode->i_mapping && inode->i_mapping->nrpages != 0) {
+                rc = filemap_write_and_wait(inode->i_mapping);
+                if (rc)
+                        cifs_i->write_behind_rc = rc;
+        }
+        invalidate_remote_inode(inode);
+}
+
+int cifs_revalidate_file(struct file *filp)
+{
+        int rc = 0;
+        struct inode *inode = filp->f_path.dentry->d_inode;
+
+        if (!cifs_inode_needs_reval(inode))
+                goto check_inval;
+
+        if (CIFS_SB(inode->i_sb)->tcon->unix_ext)
+                rc = cifs_get_file_info_unix(filp);
+        else
+                rc = cifs_get_file_info(filp);
+
+check_inval:
+        if (CIFS_I(inode)->invalid_mapping)
+                cifs_invalidate_mapping(inode);
+
+        return rc;
+}
+
+/* revalidate a dentry's inode attributes */
+int cifs_revalidate_dentry(struct dentry *dentry)
+{
+        int xid;
+        int rc = 0;
+        char *full_path = NULL;
+        struct inode *inode = dentry->d_inode;
+        struct super_block *sb = dentry->d_sb;
+
+        if (inode == NULL)
+                return -ENOENT;
 
         xid = GetXid();
 
-        cifs_sb = CIFS_SB(direntry->d_sb);
+        if (!cifs_inode_needs_reval(inode))
+                goto check_inval;
 
         /* can not safely grab the rename sem here if rename calls revalidate
            since that would deadlock */
-        full_path = build_path_from_dentry(direntry);
+        full_path = build_path_from_dentry(dentry);
         if (full_path == NULL) {
                 rc = -ENOMEM;
-                FreeXid(xid);
-                return rc;
-        }
-        cFYI(1, ("Revalidate: %s inode 0x%p count %d dentry: 0x%p d_time %ld "
-                 "jiffies %ld", full_path, direntry->d_inode,
-                 direntry->d_inode->i_count.counter, direntry,
-                 direntry->d_time, jiffies));
-
-        if (cifsInode->time == 0) {
-                /* was set to zero previously to force revalidate */
-        } else if (time_before(jiffies, cifsInode->time + HZ) &&
-                   lookupCacheEnabled) {
-                if ((S_ISREG(direntry->d_inode->i_mode) == 0) ||
-                    (direntry->d_inode->i_nlink == 1)) {
-                        kfree(full_path);
-                        FreeXid(xid);
-                        return rc;
-                } else {
-                        cFYI(1, ("Have to revalidate file due to hardlinks"));
-                }
-        }
-
-        /* save mtime and size */
-        local_mtime = direntry->d_inode->i_mtime;
-        local_size = direntry->d_inode->i_size;
-
-        if (cifs_sb->tcon->unix_ext) {
-                rc = cifs_get_inode_info_unix(&direntry->d_inode, full_path,
-                                              direntry->d_sb, xid);
-                if (rc) {
-                        cFYI(1, ("error on getting revalidate info %d", rc));
-/*                      if (rc != -ENOENT)
-                                rc = 0; */      /* BB should we cache info on
-                                                   certain errors? */
-                }
-        } else {
-                rc = cifs_get_inode_info(&direntry->d_inode, full_path, NULL,
-                                         direntry->d_sb, xid, NULL);
-                if (rc) {
-                        cFYI(1, ("error on getting revalidate info %d", rc));
-/*                      if (rc != -ENOENT)
-                                rc = 0; */      /* BB should we cache info on
-                                                   certain errors? */
-                }
+                goto check_inval;
         }
-        /* should we remap certain errors, access denied?, to zero */
 
-        /* if not oplocked, we invalidate inode pages if mtime or file size
-           had changed on server */
+        cFYI(1, ("Revalidate: %s inode 0x%p count %d dentry: 0x%p d_time %ld "
+                 "jiffies %ld", full_path, inode, inode->i_count.counter,
+                 dentry, dentry->d_time, jiffies));
 
-        if (timespec_equal(&local_mtime, &direntry->d_inode->i_mtime) &&
-            (local_size == direntry->d_inode->i_size)) {
-                cFYI(1, ("cifs_revalidate - inode unchanged"));
-        } else {
-                /* file may have changed on server */
-                if (cifsInode->clientCanCacheRead) {
-                        /* no need to invalidate inode pages since we were the
-                           only ones who could have modified the file and the
-                           server copy is staler than ours */
-                } else {
-                        invalidate_inode = true;
-                }
-        }
+        if (CIFS_SB(sb)->tcon->unix_ext)
+                rc = cifs_get_inode_info_unix(&inode, full_path, sb, xid);
+        else
+                rc = cifs_get_inode_info(&inode, full_path, NULL, sb,
+                                         xid, NULL);
 
-        /* can not grab this sem since kernel filesys locking documentation
-           indicates i_mutex may be taken by the kernel on lookup and rename
-           which could deadlock if we grab the i_mutex here as well */
-/*      mutex_lock(&direntry->d_inode->i_mutex);*/
-        /* need to write out dirty pages here  */
-        if (direntry->d_inode->i_mapping) {
-                /* do we need to lock inode until after invalidate completes
-                   below? */
-                wbrc = filemap_fdatawrite(direntry->d_inode->i_mapping);
-                if (wbrc)
-                        CIFS_I(direntry->d_inode)->write_behind_rc = wbrc;
-        }
-        if (invalidate_inode) {
-        /* shrink_dcache not necessary now that cifs dentry ops
-        are exported for negative dentries */
-/*              if (S_ISDIR(direntry->d_inode->i_mode))
-                        shrink_dcache_parent(direntry); */
-                if (S_ISREG(direntry->d_inode->i_mode)) {
-                        if (direntry->d_inode->i_mapping) {
-                                wbrc = filemap_fdatawait(direntry->d_inode->i_mapping);
-                                if (wbrc)
-                                        CIFS_I(direntry->d_inode)->write_behind_rc = wbrc;
-                        }
-                        /* may eventually have to do this for open files too */
-                        if (list_empty(&(cifsInode->openFileList))) {
-                                /* changed on server - flush read ahead pages */
-                                cFYI(1, ("Invalidating read ahead data on "
-                                         "closed file"));
-                                invalidate_remote_inode(direntry->d_inode);
-                        }
-                }
-        }
-/*      mutex_unlock(&direntry->d_inode->i_mutex); */
+check_inval:
+        if (CIFS_I(inode)->invalid_mapping)
+                cifs_invalidate_mapping(inode);
 
         kfree(full_path);
         FreeXid(xid);
@@ -1526,7 +1599,7 @@ int cifs_revalidate(struct dentry *direntry)
 int cifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         struct kstat *stat)
 {
-        int err = cifs_revalidate(dentry);
+        int err = cifs_revalidate_dentry(dentry);
         if (!err) {
                 generic_fillattr(dentry->d_inode, stat);
                 stat->blksize = CIFS_MAX_MSGSIZE;
@@ -1762,8 +1835,18 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
         }
 
-        if (!rc)
+        if (!rc) {
                 rc = inode_setattr(inode, attrs);
+
+                /* force revalidate when any of these times are set since some
+                   of the fs types (eg ext3, fat) do not have fine enough
+                   time granularity to match protocol, and we do not have a
+                   a way (yet) to query the server fs's time granularity (and
+                   whether it rounds times down).
+                */
+                if (!rc && (attrs->ia_valid & (ATTR_MTIME | ATTR_CTIME)))
+                        cifsInode->time = 0;
+        }
 out:
         kfree(args);
         kfree(full_path);
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index fc1e0487eaee..c1a9d4236a8c 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -20,6 +20,7 @@
  */
 #include <linux/fs.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index d27d4ec6579b..d1474996a812 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -79,7 +79,7 @@ sesInfoAlloc(void)
                 ++ret_buf->ses_count;
                 INIT_LIST_HEAD(&ret_buf->smb_ses_list);
                 INIT_LIST_HEAD(&ret_buf->tcon_list);
-                init_MUTEX(&ret_buf->sesSem);
+                mutex_init(&ret_buf->session_mutex);
         }
         return ret_buf;
 }
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index f84062f9a985..18e0bc1fb593 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -22,6 +22,7 @@
  */
 #include <linux/fs.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/stat.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
@@ -77,6 +78,11 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
 
         cFYI(1, ("For %s", name->name));
 
+        if (parent->d_op && parent->d_op->d_hash)
+                parent->d_op->d_hash(parent, name);
+        else
+                name->hash = full_name_hash(name->name, name->len);
+
         dentry = d_lookup(parent, name);
         if (dentry) {
                 /* FIXME: check for inode number changes? */
@@ -666,12 +672,11 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                                            min(len, max_len), nlt,
                                            cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
+                pqst->len -= nls_nullsize(nlt);
         } else {
                 pqst->name = filename;
                 pqst->len = len;
         }
-        pqst->hash = full_name_hash(pqst->name, pqst->len);
-/*      cFYI(1, ("filldir on %s",pqst->name));  */
         return rc;
 }
 
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 7085a6275c4c..7c3fd7463f44 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -29,6 +29,7 @@
 #include "ntlmssp.h"
 #include "nterr.h"
 #include <linux/utsname.h>
+#include <linux/slab.h>
 #include "cifs_spnego.h"
 
 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
@@ -223,9 +224,9 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
                 /* null user mount */
                 *bcc_ptr = 0;
                 *(bcc_ptr+1) = 0;
-        } else { /* 300 should be long enough for any conceivable user name */
+        } else {
                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
-                                          300, nls_cp);
+                                          MAX_USERNAME_SIZE, nls_cp);
         }
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* account for null termination */
@@ -246,11 +247,10 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
         /* copy user */
         if (ses->userName == NULL) {
                 /* BB what about null user mounts - check that we do this BB */
-        } else { /* 300 should be long enough for any conceivable user name */
-                strncpy(bcc_ptr, ses->userName, 300);
+        } else {
+                strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE);
         }
-        /* BB improve check for overflow */
-        bcc_ptr += strnlen(ses->userName, 300);
+        bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE);
         *bcc_ptr = 0;
         bcc_ptr++; /* account for null termination */
 
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 93fb09a99c69..192ea51af20f 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -24,6 +24,7 @@
 */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 07b8e71544ee..ad081fe7eb18 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -22,6 +22,7 @@
 
 #include <linux/fs.h>
 #include <linux/list.h>
+#include <linux/gfp.h>
 #include <linux/wait.h>
 #include <linux/net.h>
 #include <linux/delay.h>
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index a75afa3dd9e1..f555ce077d4f 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -21,6 +21,7 @@
 
 #include <linux/fs.h>
 #include <linux/posix_acl_xattr.h>
+#include <linux/slab.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
 #include "cifsglob.h"
@@ -244,7 +245,7 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                         /* revalidate/getattr then populate from inode */
                 } /* BB add else when above is implemented */
                 ea_name += 5; /* skip past user. prefix */
-                rc = CIFSSMBQueryEA(xid, pTcon, full_path, ea_name, ea_value,
+                rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
                         buf_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if (strncmp(ea_name, CIFS_XATTR_OS2_PREFIX, 4) == 0) {
@@ -252,7 +253,7 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                         goto get_ea_exit;
 
                 ea_name += 4; /* skip past os2. prefix */
-                rc = CIFSSMBQueryEA(xid, pTcon, full_path, ea_name, ea_value,
+                rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
                         buf_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if (strncmp(ea_name, POSIX_ACL_XATTR_ACCESS,
@@ -364,8 +365,8 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size)
         /* if proc/fs/cifs/streamstoxattr is set then
                 search server for EAs or streams to
                 returns as xattrs */
-        rc = CIFSSMBQAllEAs(xid, pTcon, full_path, data, buf_size,
-                                cifs_sb->local_nls,
+        rc = CIFSSMBQAllEAs(xid, pTcon, full_path, NULL, data,
+                                buf_size, cifs_sb->local_nls,
                                 cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
 
diff --git a/fs/coda/dir.c b/fs/coda/dir.c
index 4bb9d0a5decc..ccd98b0f2b0b 100644
--- a/fs/coda/dir.c
+++ b/fs/coda/dir.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/time.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/file.h>
 #include <linux/stat.h>
 #include <linux/errno.h>
diff --git a/fs/coda/file.c b/fs/coda/file.c
index ffd42815fda1..4c813f2cdc52 100644
--- a/fs/coda/file.c
+++ b/fs/coda/file.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/smp_lock.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 #include <linux/coda.h>
diff --git a/fs/coda/inode.c b/fs/coda/inode.c
index 830f51abb971..d97f9935a028 100644
--- a/fs/coda/inode.c
+++ b/fs/coda/inode.c
@@ -18,6 +18,7 @@
 #include <linux/smp_lock.h>
 #include <linux/file.h>
 #include <linux/vfs.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -166,6 +167,10 @@ static int coda_fill_super(struct super_block *sb, void *data, int silent)
                 return -EBUSY;
         }
 
+        error = bdi_setup_and_register(&vc->bdi, "coda", BDI_CAP_MAP_COPY);
+        if (error)
+                goto bdi_err;
+
         vc->vc_sb = sb;
 
         sb->s_fs_info = vc;
@@ -174,6 +179,7 @@ static int coda_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_blocksize_bits = 12;
         sb->s_magic = CODA_SUPER_MAGIC;
         sb->s_op = &coda_super_operations;
+        sb->s_bdi = &vc->bdi;
 
         /* get root fid from Venus: this needs the root inode */
         error = venus_rootfid(sb, &fid);
@@ -199,6 +205,8 @@ static int coda_fill_super(struct super_block *sb, void *data, int silent)
         return 0;
 
  error:
+        bdi_destroy(&vc->bdi);
+ bdi_err:
         if (root)
                 iput(root);
         if (vc)
@@ -209,6 +217,7 @@ static int coda_fill_super(struct super_block *sb, void *data, int silent)
 
 static void coda_put_super(struct super_block *sb)
 {
+        bdi_destroy(&coda_vcp(sb)->bdi);
         coda_vcp(sb)->vc_sb = NULL;
         sb->s_fs_info = NULL;
 
diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c
index c274d949179d..f09c5ed76f6c 100644
--- a/fs/coda/upcall.c
+++ b/fs/coda/upcall.c
@@ -26,6 +26,7 @@
 #include <linux/stat.h>
 #include <linux/errno.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/vmalloc.h>
 #include <linux/vfs.h>
diff --git a/fs/compat.c b/fs/compat.c
index 00d90c2e66f0..4b6ed03cc478 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -49,6 +49,7 @@
 #include <linux/mm.h>
 #include <linux/eventpoll.h>
 #include <linux/fs_struct.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -1795,6 +1796,24 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
         return ret;
 }
 
+struct compat_sel_arg_struct {
+        compat_ulong_t n;
+        compat_uptr_t inp;
+        compat_uptr_t outp;
+        compat_uptr_t exp;
+        compat_uptr_t tvp;
+};
+
+asmlinkage long compat_sys_old_select(struct compat_sel_arg_struct __user *arg)
+{
+        struct compat_sel_arg_struct a;
+
+        if (copy_from_user(&a, arg, sizeof(a)))
+                return -EFAULT;
+        return compat_sys_select(a.n, compat_ptr(a.inp), compat_ptr(a.outp),
+                                 compat_ptr(a.exp), compat_ptr(a.tvp));
+}
+
 #ifdef HAVE_SET_RESTORE_SIGMASK
 static long do_compat_pselect(int n, compat_ulong_t __user *inp,
         compat_ulong_t __user *outp, compat_ulong_t __user *exp,
diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
index 0adced2f296f..112e45a17e99 100644
--- a/fs/compat_binfmt_elf.c
+++ b/fs/compat_binfmt_elf.c
@@ -28,10 +28,12 @@
 
 #undef  elfhdr
 #undef  elf_phdr
+#undef  elf_shdr
 #undef  elf_note
 #undef  elf_addr_t
 #define elfhdr          elf32_hdr
 #define elf_phdr        elf32_phdr
+#define elf_shdr        elf32_shdr
 #define elf_note        elf32_note
 #define elf_addr_t      Elf32_Addr
 
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 332dd00f0894..c32a1b6a856b 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -23,7 +23,6 @@
 #include <linux/ioctl.h>
 #include <linux/if.h>
 #include <linux/if_bridge.h>
-#include <linux/slab.h>
 #include <linux/raid/md_u.h>
 #include <linux/kd.h>
 #include <linux/route.h>
@@ -60,6 +59,7 @@
 #include <linux/i2c.h>
 #include <linux/i2c-dev.h>
 #include <linux/atalk.h>
+#include <linux/gfp.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci.h>
@@ -301,6 +301,12 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd,
         u32 data;
         void __user *dxferp;
         int err;
+        int interface_id;
+
+        if (get_user(interface_id, &sgio32->interface_id))
+                return -EFAULT;
+        if (interface_id != 'S')
+                return sys_ioctl(fd, cmd, (unsigned long)sgio32);
 
         if (get_user(iovec_count, &sgio32->iovec_count))
                 return -EFAULT;
@@ -539,7 +545,7 @@ static int mt_ioctl_trans(unsigned int fd, unsigned int cmd, void __user *argp)
                 kcmd = MTIOCPOS;
                 karg = &pos;
                 break;
-        case MTIOCGET32:
+        default:        /* MTIOCGET32 */
                 kcmd = MTIOCGET;
                 karg = &get;
                 break;
@@ -657,7 +663,7 @@ static int raw_ioctl(unsigned fd, unsigned cmd,
 
         switch (cmd) {
         case RAW_SETBIND:
-        case RAW_GETBIND: {
+        default: {      /* RAW_GETBIND */
                 struct raw_config_request req;
                 mm_segment_t oldfs = get_fs();
 
@@ -936,6 +942,7 @@ COMPATIBLE_IOCTL(TCSETSF)
 COMPATIBLE_IOCTL(TIOCLINUX)
 COMPATIBLE_IOCTL(TIOCSBRK)
 COMPATIBLE_IOCTL(TIOCCBRK)
+COMPATIBLE_IOCTL(TIOCGSID)
 COMPATIBLE_IOCTL(TIOCGICOUNT)
 /* Little t */
 COMPATIBLE_IOCTL(TIOCGETD)
@@ -1005,6 +1012,9 @@ COMPATIBLE_IOCTL(SCSI_IOCTL_SEND_COMMAND)
 COMPATIBLE_IOCTL(SCSI_IOCTL_PROBE_HOST)
 COMPATIBLE_IOCTL(SCSI_IOCTL_GET_PCI)
 #endif
+/* Big V (don't complain on serial console) */
+IGNORE_IOCTL(VT_OPENQRY)
+IGNORE_IOCTL(VT_GETMODE)
 /* Little p (/dev/rtc, /dev/envctrl, etc.) */
 COMPATIBLE_IOCTL(RTC_AIE_ON)
 COMPATIBLE_IOCTL(RTC_AIE_OFF)
@@ -1035,6 +1045,8 @@ COMPATIBLE_IOCTL(FIOQSIZE)
 #ifdef CONFIG_BLOCK
 /* loop */
 IGNORE_IOCTL(LOOP_CLR_FD)
+/* md calls this on random blockdevs */
+IGNORE_IOCTL(RAID_VERSION)
 /* SG stuff */
 COMPATIBLE_IOCTL(SG_SET_TIMEOUT)
 COMPATIBLE_IOCTL(SG_GET_TIMEOUT)
diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c
index a2f746066c5d..c8af2d91174b 100644
--- a/fs/configfs/inode.c
+++ b/fs/configfs/inode.c
@@ -34,6 +34,7 @@
 #include <linux/capability.h>
 #include <linux/sched.h>
 #include <linux/lockdep.h>
+#include <linux/slab.h>
 
 #include <linux/configfs.h>
 #include "configfs_internal.h"
diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index 8421cea7d8c7..8c8d64230c2d 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -29,6 +29,7 @@
 #include <linux/mount.h>
 #include <linux/pagemap.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <linux/configfs.h>
 #include "configfs_internal.h"
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index c8afa6b1d91d..0f3eb41d9201 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -27,6 +27,7 @@
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 
 #include <linux/configfs.h>
 #include "configfs_internal.h"
@@ -121,8 +122,10 @@ static int get_target(const char *symname, struct path *path,
                                 ret = -ENOENT;
                                 path_put(path);
                         }
-                } else
+                } else {
                         ret = -EPERM;
+                        path_put(path);
+                }
         }
 
         return ret;
diff --git a/fs/dcache.c b/fs/dcache.c
index 953173a293a9..f1358e5c3a59 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -257,6 +257,7 @@ kill_it:
         if (dentry)
                 goto repeat;
 }
+EXPORT_SYMBOL(dput);
 
 /**
  * d_invalidate - invalidate a dentry
@@ -314,6 +315,7 @@ int d_invalidate(struct dentry * dentry)
         spin_unlock(&dcache_lock);
         return 0;
 }
+EXPORT_SYMBOL(d_invalidate);
 
 /* This should be called _only_ with dcache_lock held */
 
@@ -328,6 +330,7 @@ struct dentry * dget_locked(struct dentry *dentry)
 {
         return __dget_locked(dentry);
 }
+EXPORT_SYMBOL(dget_locked);
 
 /**
  * d_find_alias - grab a hashed alias of inode
@@ -384,6 +387,7 @@ struct dentry * d_find_alias(struct inode *inode)
         }
         return de;
 }
+EXPORT_SYMBOL(d_find_alias);
 
 /*
  *      Try to kill dentries associated with this inode.
@@ -408,6 +412,7 @@ restart:
         }
         spin_unlock(&dcache_lock);
 }
+EXPORT_SYMBOL(d_prune_aliases);
 
 /*
  * Throw away a dentry - free the inode, dput the parent.  This requires that
@@ -610,6 +615,7 @@ void shrink_dcache_sb(struct super_block * sb)
 {
         __shrink_dcache_sb(sb, NULL, 0);
 }
+EXPORT_SYMBOL(shrink_dcache_sb);
 
 /*
  * destroy a single subtree of dentries for unmount
@@ -792,6 +798,7 @@ positive:
         spin_unlock(&dcache_lock);
         return 1;
 }
+EXPORT_SYMBOL(have_submounts);
 
 /*
  * Search the dentry child list for the specified parent,
@@ -876,6 +883,7 @@ void shrink_dcache_parent(struct dentry * parent)
         while ((found = select_parent(parent)) != 0)
                 __shrink_dcache_sb(sb, &found, 0);
 }
+EXPORT_SYMBOL(shrink_dcache_parent);
 
 /*
  * Scan `nr' dentries and return the number which remain.
@@ -968,6 +976,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
 
         return dentry;
 }
+EXPORT_SYMBOL(d_alloc);
 
 struct dentry *d_alloc_name(struct dentry *parent, const char *name)
 {
@@ -1012,6 +1021,7 @@ void d_instantiate(struct dentry *entry, struct inode * inode)
         spin_unlock(&dcache_lock);
         security_d_instantiate(entry, inode);
 }
+EXPORT_SYMBOL(d_instantiate);
 
 /**
  * d_instantiate_unique - instantiate a non-aliased dentry
@@ -1108,6 +1118,7 @@ struct dentry * d_alloc_root(struct inode * root_inode)
         }
         return res;
 }
+EXPORT_SYMBOL(d_alloc_root);
 
 static inline struct hlist_head *d_hash(struct dentry *parent,
                                         unsigned long hash)
@@ -1211,7 +1222,6 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                         BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
                         spin_unlock(&dcache_lock);
                         security_d_instantiate(new, inode);
-                        d_rehash(dentry);
                         d_move(new, dentry);
                         iput(inode);
                 } else {
@@ -1225,6 +1235,7 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                 d_add(dentry, inode);
         return new;
 }
+EXPORT_SYMBOL(d_splice_alias);
 
 /**
  * d_add_ci - lookup or allocate new dentry with case-exact name
@@ -1314,6 +1325,7 @@ err_out:
         iput(inode);
         return ERR_PTR(error);
 }
+EXPORT_SYMBOL(d_add_ci);
 
 /**
  * d_lookup - search for a dentry
@@ -1357,6 +1369,7 @@ struct dentry * d_lookup(struct dentry * parent, struct qstr * name)
         } while (read_seqretry(&rename_lock, seq));
         return dentry;
 }
+EXPORT_SYMBOL(d_lookup);
 
 struct dentry * __d_lookup(struct dentry * parent, struct qstr * name)
 {
@@ -1483,6 +1496,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent)
 out:
         return 0;
 }
+EXPORT_SYMBOL(d_validate);
 
 /*
  * When a file is deleted, we have two options:
@@ -1528,6 +1542,7 @@ void d_delete(struct dentry * dentry)
 
         fsnotify_nameremove(dentry, isdir);
 }
+EXPORT_SYMBOL(d_delete);
 
 static void __d_rehash(struct dentry * entry, struct hlist_head *list)
 {
@@ -1556,6 +1571,7 @@ void d_rehash(struct dentry * entry)
         spin_unlock(&entry->d_lock);
         spin_unlock(&dcache_lock);
 }
+EXPORT_SYMBOL(d_rehash);
 
 /*
  * When switching names, the actual string doesn't strictly have to
@@ -1702,6 +1718,7 @@ void d_move(struct dentry * dentry, struct dentry * target)
         d_move_locked(dentry, target);
         spin_unlock(&dcache_lock);
 }
+EXPORT_SYMBOL(d_move);
 
 /**
  * d_ancestor - search for an ancestor
@@ -1868,6 +1885,7 @@ shouldnt_be_hashed:
         spin_unlock(&dcache_lock);
         BUG();
 }
+EXPORT_SYMBOL_GPL(d_materialise_unique);
 
 static int prepend(char **buffer, int *buflen, const char *str, int namelen)
 {
@@ -2005,6 +2023,7 @@ char *d_path(const struct path *path, char *buf, int buflen)
         path_put(&root);
         return res;
 }
+EXPORT_SYMBOL(d_path);
 
 /*
  * Helper function for dentry_operations.d_dname() members
@@ -2171,6 +2190,30 @@ int is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
         return result;
 }
 
+int path_is_under(struct path *path1, struct path *path2)
+{
+        struct vfsmount *mnt = path1->mnt;
+        struct dentry *dentry = path1->dentry;
+        int res;
+        spin_lock(&vfsmount_lock);
+        if (mnt != path2->mnt) {
+                for (;;) {
+                        if (mnt->mnt_parent == mnt) {
+                                spin_unlock(&vfsmount_lock);
+                                return 0;
+                        }
+                        if (mnt->mnt_parent == path2->mnt)
+                                break;
+                        mnt = mnt->mnt_parent;
+                }
+                dentry = mnt->mnt_mountpoint;
+        }
+        res = is_subdir(dentry, path2->dentry);
+        spin_unlock(&vfsmount_lock);
+        return res;
+}
+EXPORT_SYMBOL(path_is_under);
+
 void d_genocide(struct dentry *root)
 {
         struct dentry *this_parent = root;
@@ -2228,6 +2271,7 @@ ino_t find_inode_number(struct dentry *dir, struct qstr *name)
         }
         return ino;
 }
+EXPORT_SYMBOL(find_inode_number);
 
 static __initdata unsigned long dhash_entries;
 static int __init set_dhash_entries(char *str)
@@ -2297,6 +2341,7 @@ static void __init dcache_init(void)
 
 /* SLAB cache for __getname() consumers */
 struct kmem_cache *names_cachep __read_mostly;
+EXPORT_SYMBOL(names_cachep);
 
 EXPORT_SYMBOL(d_genocide);
 
@@ -2326,26 +2371,3 @@ void __init vfs_caches_init(unsigned long mempages)
         bdev_cache_init();
         chrdev_init();
 }
-
-EXPORT_SYMBOL(d_alloc);
-EXPORT_SYMBOL(d_alloc_root);
-EXPORT_SYMBOL(d_delete);
-EXPORT_SYMBOL(d_find_alias);
-EXPORT_SYMBOL(d_instantiate);
-EXPORT_SYMBOL(d_invalidate);
-EXPORT_SYMBOL(d_lookup);
-EXPORT_SYMBOL(d_move);
-EXPORT_SYMBOL_GPL(d_materialise_unique);
-EXPORT_SYMBOL(d_path);
-EXPORT_SYMBOL(d_prune_aliases);
-EXPORT_SYMBOL(d_rehash);
-EXPORT_SYMBOL(d_splice_alias);
-EXPORT_SYMBOL(d_add_ci);
-EXPORT_SYMBOL(d_validate);
-EXPORT_SYMBOL(dget_locked);
-EXPORT_SYMBOL(dput);
-EXPORT_SYMBOL(find_inode_number);
-EXPORT_SYMBOL(have_submounts);
-EXPORT_SYMBOL(names_cachep);
-EXPORT_SYMBOL(shrink_dcache_parent);
-EXPORT_SYMBOL(shrink_dcache_sb);
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index b486169f42bf..30a87b3dbcac 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -27,6 +27,7 @@
 #include <linux/fsnotify.h>
 #include <linux/string.h>
 #include <linux/magic.h>
+#include <linux/slab.h>
 
 static struct vfsmount *debugfs_mount;
 static int debugfs_mount_count;
@@ -160,15 +161,8 @@ static int debugfs_create_by_name(const char *name, mode_t mode,
          * block. A pointer to that is in the struct vfsmount that we
          * have around.
          */
-        if (!parent) {
-                if (debugfs_mount && debugfs_mount->mnt_sb) {
-                        parent = debugfs_mount->mnt_sb->s_root;
-                }
-        }
-        if (!parent) {
-                pr_debug("debugfs: Ah! can not find a parent!\n");
-                return -EFAULT;
-        }
+        if (!parent)
+                parent = debugfs_mount->mnt_sb->s_root;
 
         *dentry = NULL;
         mutex_lock(&parent->d_inode->i_mutex);
@@ -503,7 +497,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
         }
         d_move(old_dentry, dentry);
         fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name,
-                old_dentry->d_name.name, S_ISDIR(old_dentry->d_inode->i_mode),
+                S_ISDIR(old_dentry->d_inode->i_mode),
                 NULL, old_dentry);
         fsnotify_oldname_free(old_name);
         unlock_rename(new_dir, old_dir);
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 8882ecc0f1bf..0120247b41c0 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -15,6 +15,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/tty.h>
 #include <linux/mutex.h>
diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c
index dc2ad6008b2d..4314f0d48d85 100644
--- a/fs/dlm/ast.c
+++ b/fs/dlm/ast.c
@@ -2,7 +2,7 @@
 *******************************************************************************
 **
 **  Copyright (C) Sistina Software, Inc.  1997-2003  All rights reserved.
-**  Copyright (C) 2004-2008 Red Hat, Inc.  All rights reserved.
+**  Copyright (C) 2004-2010 Red Hat, Inc.  All rights reserved.
 **
 **  This copyrighted material is made available to anyone wishing to use,
 **  modify, copy, or redistribute it subject to the terms and conditions
@@ -33,10 +33,10 @@ void dlm_del_ast(struct dlm_lkb *lkb)
         spin_unlock(&ast_queue_lock);
 }
 
-void dlm_add_ast(struct dlm_lkb *lkb, int type, int bastmode)
+void dlm_add_ast(struct dlm_lkb *lkb, int type, int mode)
 {
         if (lkb->lkb_flags & DLM_IFL_USER) {
-                dlm_user_add_ast(lkb, type, bastmode);
+                dlm_user_add_ast(lkb, type, mode);
                 return;
         }
 
@@ -44,10 +44,21 @@ void dlm_add_ast(struct dlm_lkb *lkb, int type, int bastmode)
         if (!(lkb->lkb_ast_type & (AST_COMP | AST_BAST))) {
                 kref_get(&lkb->lkb_ref);
                 list_add_tail(&lkb->lkb_astqueue, &ast_queue);
+                lkb->lkb_ast_first = type;
         }
+
+        /* sanity check, this should not happen */
+
+        if ((type == AST_COMP) && (lkb->lkb_ast_type & AST_COMP))
+                log_print("repeat cast %d castmode %d lock %x %s",
+                          mode, lkb->lkb_castmode,
+                          lkb->lkb_id, lkb->lkb_resource->res_name);
+
         lkb->lkb_ast_type |= type;
-        if (bastmode)
-                lkb->lkb_bastmode = bastmode;
+        if (type == AST_BAST)
+                lkb->lkb_bastmode = mode;
+        else
+                lkb->lkb_castmode = mode;
         spin_unlock(&ast_queue_lock);
 
         set_bit(WAKE_ASTS, &astd_wakeflags);
@@ -59,9 +70,9 @@ static void process_asts(void)
         struct dlm_ls *ls = NULL;
         struct dlm_rsb *r = NULL;
         struct dlm_lkb *lkb;
-        void (*cast) (void *astparam);
-        void (*bast) (void *astparam, int mode);
-        int type = 0, bastmode;
+        void (*castfn) (void *astparam);
+        void (*bastfn) (void *astparam, int mode);
+        int type, first, bastmode, castmode, do_bast, do_cast, last_castmode;
 
 repeat:
         spin_lock(&ast_queue_lock);
@@ -75,17 +86,48 @@ repeat:
                 list_del(&lkb->lkb_astqueue);
                 type = lkb->lkb_ast_type;
                 lkb->lkb_ast_type = 0;
+                first = lkb->lkb_ast_first;
+                lkb->lkb_ast_first = 0;
                 bastmode = lkb->lkb_bastmode;
-
+                castmode = lkb->lkb_castmode;
+                castfn = lkb->lkb_astfn;
+                bastfn = lkb->lkb_bastfn;
                 spin_unlock(&ast_queue_lock);
-                cast = lkb->lkb_astfn;
-                bast = lkb->lkb_bastfn;
-
-                if ((type & AST_COMP) && cast)
-                        cast(lkb->lkb_astparam);
 
-                if ((type & AST_BAST) && bast)
-                        bast(lkb->lkb_astparam, bastmode);
+                do_cast = (type & AST_COMP) && castfn;
+                do_bast = (type & AST_BAST) && bastfn;
+
+                /* Skip a bast if its blocking mode is compatible with the
+                   granted mode of the preceding cast. */
+
+                if (do_bast) {
+                        if (first == AST_COMP)
+                                last_castmode = castmode;
+                        else
+                                last_castmode = lkb->lkb_castmode_done;
+                        if (dlm_modes_compat(bastmode, last_castmode))
+                                do_bast = 0;
+                }
+
+                if (first == AST_COMP) {
+                        if (do_cast)
+                                castfn(lkb->lkb_astparam);
+                        if (do_bast)
+                                bastfn(lkb->lkb_astparam, bastmode);
+                } else if (first == AST_BAST) {
+                        if (do_bast)
+                                bastfn(lkb->lkb_astparam, bastmode);
+                        if (do_cast)
+                                castfn(lkb->lkb_astparam);
+                } else {
+                        log_error(ls, "bad ast_first %d ast_type %d",
+                                  first, type);
+                }
+
+                if (do_cast)
+                        lkb->lkb_castmode_done = castmode;
+                if (do_bast)
+                        lkb->lkb_bastmode_done = bastmode;
 
                 /* this removes the reference added by dlm_add_ast
                    and may result in the lkb being freed */
diff --git a/fs/dlm/ast.h b/fs/dlm/ast.h
index 1b5fc5f428fd..bcb1aaba519d 100644
--- a/fs/dlm/ast.h
+++ b/fs/dlm/ast.h
@@ -1,7 +1,7 @@
 /******************************************************************************
 *******************************************************************************
 **
-**  Copyright (C) 2005-2008 Red Hat, Inc.  All rights reserved.
+**  Copyright (C) 2005-2010 Red Hat, Inc.  All rights reserved.
 **
 **  This copyrighted material is made available to anyone wishing to use,
 **  modify, copy, or redistribute it subject to the terms and conditions
@@ -13,7 +13,7 @@
 #ifndef __ASTD_DOT_H__
 #define __ASTD_DOT_H__
 
-void dlm_add_ast(struct dlm_lkb *lkb, int type, int bastmode);
+void dlm_add_ast(struct dlm_lkb *lkb, int type, int mode);
 void dlm_del_ast(struct dlm_lkb *lkb);
 
 void dlm_astd_wake(void);
diff --git a/fs/dlm/config.c b/fs/dlm/config.c
index 0df243850818..b54bca03d92f 100644
--- a/fs/dlm/config.c
+++ b/fs/dlm/config.c
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/configfs.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <net/ipv6.h>
diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
index 375a2359b3bf..c6cf25158746 100644
--- a/fs/dlm/debug_fs.c
+++ b/fs/dlm/debug_fs.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/ctype.h>
 #include <linux/debugfs.h>
+#include <linux/slab.h>
 
 #include "dlm_internal.h"
 #include "lock.h"
@@ -256,7 +257,7 @@ static int print_format3_lock(struct seq_file *s, struct dlm_lkb *lkb,
                         lkb->lkb_status,
                         lkb->lkb_grmode,
                         lkb->lkb_rqmode,
-                        lkb->lkb_highbast,
+                        lkb->lkb_bastmode,
                         rsb_lookup,
                         lkb->lkb_wait_type,
                         lkb->lkb_lvbseq,
diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h
index 826d3dc6e0ab..f632b58cd222 100644
--- a/fs/dlm/dlm_internal.h
+++ b/fs/dlm/dlm_internal.h
@@ -2,7 +2,7 @@
 *******************************************************************************
 **
 **  Copyright (C) Sistina Software, Inc.  1997-2003  All rights reserved.
-**  Copyright (C) 2004-2008 Red Hat, Inc.  All rights reserved.
+**  Copyright (C) 2004-2010 Red Hat, Inc.  All rights reserved.
 **
 **  This copyrighted material is made available to anyone wishing to use,
 **  modify, copy, or redistribute it subject to the terms and conditions
@@ -232,11 +232,17 @@ struct dlm_lkb {
         int8_t                  lkb_status;     /* granted, waiting, convert */
         int8_t                  lkb_rqmode;     /* requested lock mode */
         int8_t                  lkb_grmode;     /* granted lock mode */
-        int8_t                  lkb_bastmode;   /* requested mode */
         int8_t                  lkb_highbast;   /* highest mode bast sent for */
+
         int8_t                  lkb_wait_type;  /* type of reply waiting for */
         int8_t                  lkb_wait_count;
         int8_t                  lkb_ast_type;   /* type of ast queued for */
+        int8_t                  lkb_ast_first;  /* type of first ast queued */
+
+        int8_t                  lkb_bastmode;   /* req mode of queued bast */
+        int8_t                  lkb_castmode;   /* gr mode of queued cast */
+        int8_t                  lkb_bastmode_done; /* last delivered bastmode */
+        int8_t                  lkb_castmode_done; /* last delivered castmode */
 
         struct list_head        lkb_idtbl_list; /* lockspace lkbtbl */
         struct list_head        lkb_statequeue; /* rsb g/c/w list */
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index 9c0c1db1e105..17903b491298 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -1,7 +1,7 @@
 /******************************************************************************
 *******************************************************************************
 **
-**  Copyright (C) 2005-2008 Red Hat, Inc.  All rights reserved.
+**  Copyright (C) 2005-2010 Red Hat, Inc.  All rights reserved.
 **
 **  This copyrighted material is made available to anyone wishing to use,
 **  modify, copy, or redistribute it subject to the terms and conditions
@@ -56,6 +56,7 @@
    L: receive_xxxx_reply()     <-  R: send_xxxx_reply()
 */
 #include <linux/types.h>
+#include <linux/slab.h>
 #include "dlm_internal.h"
 #include <linux/dlm_device.h>
 #include "memory.h"
@@ -307,7 +308,7 @@ static void queue_cast(struct dlm_rsb *r, struct dlm_lkb *lkb, int rv)
         lkb->lkb_lksb->sb_status = rv;
         lkb->lkb_lksb->sb_flags = lkb->lkb_sbflags;
 
-        dlm_add_ast(lkb, AST_COMP, 0);
+        dlm_add_ast(lkb, AST_COMP, lkb->lkb_grmode);
 }
 
 static inline void queue_cast_overlap(struct dlm_rsb *r, struct dlm_lkb *lkb)
@@ -320,10 +321,12 @@ static void queue_bast(struct dlm_rsb *r, struct dlm_lkb *lkb, int rqmode)
 {
         lkb->lkb_time_bast = ktime_get();
 
-        if (is_master_copy(lkb))
+        if (is_master_copy(lkb)) {
+                lkb->lkb_bastmode = rqmode; /* printed by debugfs */
                 send_bast(r, lkb, rqmode);
-        else
+        } else {
                 dlm_add_ast(lkb, AST_BAST, rqmode);
+        }
 }
 
 /*
@@ -2280,20 +2283,30 @@ static int do_request(struct dlm_rsb *r, struct dlm_lkb *lkb)
         if (can_be_queued(lkb)) {
                 error = -EINPROGRESS;
                 add_lkb(r, lkb, DLM_LKSTS_WAITING);
-                send_blocking_asts(r, lkb);
                 add_timeout(lkb);
                 goto out;
         }
 
         error = -EAGAIN;
-        if (force_blocking_asts(lkb))
-                send_blocking_asts_all(r, lkb);
         queue_cast(r, lkb, -EAGAIN);
-
  out:
         return error;
 }
 
+static void do_request_effects(struct dlm_rsb *r, struct dlm_lkb *lkb,
+                               int error)
+{
+        switch (error) {
+        case -EAGAIN:
+                if (force_blocking_asts(lkb))
+                        send_blocking_asts_all(r, lkb);
+                break;
+        case -EINPROGRESS:
+                send_blocking_asts(r, lkb);
+                break;
+        }
+}
+
 static int do_convert(struct dlm_rsb *r, struct dlm_lkb *lkb)
 {
         int error = 0;
@@ -2304,7 +2317,6 @@ static int do_convert(struct dlm_rsb *r, struct dlm_lkb *lkb)
         if (can_be_granted(r, lkb, 1, &deadlk)) {
                 grant_lock(r, lkb);
                 queue_cast(r, lkb, 0);
-                grant_pending_locks(r);
                 goto out;
         }
 
@@ -2334,7 +2346,6 @@ static int do_convert(struct dlm_rsb *r, struct dlm_lkb *lkb)
                 if (_can_be_granted(r, lkb, 1)) {
                         grant_lock(r, lkb);
                         queue_cast(r, lkb, 0);
-                        grant_pending_locks(r);
                         goto out;
                 }
                 /* else fall through and move to convert queue */
@@ -2344,28 +2355,47 @@ static int do_convert(struct dlm_rsb *r, struct dlm_lkb *lkb)
                 error = -EINPROGRESS;
                 del_lkb(r, lkb);
                 add_lkb(r, lkb, DLM_LKSTS_CONVERT);
-                send_blocking_asts(r, lkb);
                 add_timeout(lkb);
                 goto out;
         }
 
         error = -EAGAIN;
-        if (force_blocking_asts(lkb))
-                send_blocking_asts_all(r, lkb);
         queue_cast(r, lkb, -EAGAIN);
-
  out:
         return error;
 }
 
+static void do_convert_effects(struct dlm_rsb *r, struct dlm_lkb *lkb,
+                               int error)
+{
+        switch (error) {
+        case 0:
+                grant_pending_locks(r);
+                /* grant_pending_locks also sends basts */
+                break;
+        case -EAGAIN:
+                if (force_blocking_asts(lkb))
+                        send_blocking_asts_all(r, lkb);
+                break;
+        case -EINPROGRESS:
+                send_blocking_asts(r, lkb);
+                break;
+        }
+}
+
 static int do_unlock(struct dlm_rsb *r, struct dlm_lkb *lkb)
 {
         remove_lock(r, lkb);
         queue_cast(r, lkb, -DLM_EUNLOCK);
-        grant_pending_locks(r);
         return -DLM_EUNLOCK;
 }
 
+static void do_unlock_effects(struct dlm_rsb *r, struct dlm_lkb *lkb,
+                              int error)
+{
+        grant_pending_locks(r);
+}
+
 /* returns: 0 did nothing, -DLM_ECANCEL canceled lock */
  
 static int do_cancel(struct dlm_rsb *r, struct dlm_lkb *lkb)
@@ -2375,12 +2405,18 @@ static int do_cancel(struct dlm_rsb *r, struct dlm_lkb *lkb)
         error = revert_lock(r, lkb);
         if (error) {
                 queue_cast(r, lkb, -DLM_ECANCEL);
-                grant_pending_locks(r);
                 return -DLM_ECANCEL;
         }
         return 0;
 }
 
+static void do_cancel_effects(struct dlm_rsb *r, struct dlm_lkb *lkb,
+                              int error)
+{
+        if (error)
+                grant_pending_locks(r);
+}
+
 /*
  * Four stage 3 varieties:
  * _request_lock(), _convert_lock(), _unlock_lock(), _cancel_lock()
@@ -2402,11 +2438,15 @@ static int _request_lock(struct dlm_rsb *r, struct dlm_lkb *lkb)
                 goto out;
         }
 
-        if (is_remote(r))
+        if (is_remote(r)) {
                 /* receive_request() calls do_request() on remote node */
                 error = send_request(r, lkb);
-        else
+        } else {
                 error = do_request(r, lkb);
+                /* for remote locks the request_reply is sent
+                   between do_request and do_request_effects */
+                do_request_effects(r, lkb, error);
+        }
  out:
         return error;
 }
@@ -2417,11 +2457,15 @@ static int _convert_lock(struct dlm_rsb *r, struct dlm_lkb *lkb)
 {
         int error;
 
-        if (is_remote(r))
+        if (is_remote(r)) {
                 /* receive_convert() calls do_convert() on remote node */
                 error = send_convert(r, lkb);
-        else
+        } else {
                 error = do_convert(r, lkb);
+                /* for remote locks the convert_reply is sent
+                   between do_convert and do_convert_effects */
+                do_convert_effects(r, lkb, error);
+        }
 
         return error;
 }
@@ -2432,11 +2476,15 @@ static int _unlock_lock(struct dlm_rsb *r, struct dlm_lkb *lkb)
 {
         int error;
 
-        if (is_remote(r))
+        if (is_remote(r)) {
                 /* receive_unlock() calls do_unlock() on remote node */
                 error = send_unlock(r, lkb);
-        else
+        } else {
                 error = do_unlock(r, lkb);
+                /* for remote locks the unlock_reply is sent
+                   between do_unlock and do_unlock_effects */
+                do_unlock_effects(r, lkb, error);
+        }
 
         return error;
 }
@@ -2447,11 +2495,15 @@ static int _cancel_lock(struct dlm_rsb *r, struct dlm_lkb *lkb)
 {
         int error;
 
-        if (is_remote(r))
+        if (is_remote(r)) {
                 /* receive_cancel() calls do_cancel() on remote node */
                 error = send_cancel(r, lkb);
-        else
+        } else {
                 error = do_cancel(r, lkb);
+                /* for remote locks the cancel_reply is sent
+                   between do_cancel and do_cancel_effects */
+                do_cancel_effects(r, lkb, error);
+        }
 
         return error;
 }
@@ -3191,6 +3243,7 @@ static void receive_request(struct dlm_ls *ls, struct dlm_message *ms)
         attach_lkb(r, lkb);
         error = do_request(r, lkb);
         send_request_reply(r, lkb, error);
+        do_request_effects(r, lkb, error);
 
         unlock_rsb(r);
         put_rsb(r);
@@ -3226,15 +3279,19 @@ static void receive_convert(struct dlm_ls *ls, struct dlm_message *ms)
                 goto out;
 
         receive_flags(lkb, ms);
+
         error = receive_convert_args(ls, lkb, ms);
-        if (error)
-                goto out_reply;
+        if (error) {
+                send_convert_reply(r, lkb, error);
+                goto out;
+        }
+
         reply = !down_conversion(lkb);
 
         error = do_convert(r, lkb);
- out_reply:
         if (reply)
                 send_convert_reply(r, lkb, error);
+        do_convert_effects(r, lkb, error);
  out:
         unlock_rsb(r);
         put_rsb(r);
@@ -3266,13 +3323,16 @@ static void receive_unlock(struct dlm_ls *ls, struct dlm_message *ms)
                 goto out;
 
         receive_flags(lkb, ms);
+
         error = receive_unlock_args(ls, lkb, ms);
-        if (error)
-                goto out_reply;
+        if (error) {
+                send_unlock_reply(r, lkb, error);
+                goto out;
+        }
 
         error = do_unlock(r, lkb);
- out_reply:
         send_unlock_reply(r, lkb, error);
+        do_unlock_effects(r, lkb, error);
  out:
         unlock_rsb(r);
         put_rsb(r);
@@ -3307,6 +3367,7 @@ static void receive_cancel(struct dlm_ls *ls, struct dlm_message *ms)
 
         error = do_cancel(r, lkb);
         send_cancel_reply(r, lkb, error);
+        do_cancel_effects(r, lkb, error);
  out:
         unlock_rsb(r);
         put_rsb(r);
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index c010ecfc0d29..f994a7dfda85 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struct kobject *k)
         kfree(ls);
 }
 
-static struct sysfs_ops dlm_attr_ops = {
+static const struct sysfs_ops dlm_attr_ops = {
         .show  = dlm_attr_show,
         .store = dlm_attr_store,
 };
@@ -191,6 +191,18 @@ static int do_uevent(struct dlm_ls *ls, int in)
         return error;
 }
 
+static int dlm_uevent(struct kset *kset, struct kobject *kobj,
+                      struct kobj_uevent_env *env)
+{
+        struct dlm_ls *ls = container_of(kobj, struct dlm_ls, ls_kobj);
+
+        add_uevent_var(env, "LOCKSPACE=%s", ls->ls_name);
+        return 0;
+}
+
+static struct kset_uevent_ops dlm_uevent_ops = {
+        .uevent = dlm_uevent,
+};
 
 int __init dlm_lockspace_init(void)
 {
@@ -199,7 +211,7 @@ int __init dlm_lockspace_init(void)
         INIT_LIST_HEAD(&lslist);
         spin_lock_init(&lslist_lock);
 
-        dlm_kset = kset_create_and_add("dlm", NULL, kernel_kobj);
+        dlm_kset = kset_create_and_add("dlm", &dlm_uevent_ops, kernel_kobj);
         if (!dlm_kset) {
                 printk(KERN_WARNING "%s: can not create kset\n", __func__);
                 return -ENOMEM;
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 52cab160893c..c0d35c620526 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -51,6 +51,7 @@
 #include <linux/file.h>
 #include <linux/mutex.h>
 #include <linux/sctp.h>
+#include <linux/slab.h>
 #include <net/sctp/user.h>
 #include <net/ipv6.h>
 
diff --git a/fs/dlm/member.c b/fs/dlm/member.c
index 84f70bfb0baf..b12532e553f8 100644
--- a/fs/dlm/member.c
+++ b/fs/dlm/member.c
@@ -312,7 +312,7 @@ int dlm_ls_stop(struct dlm_ls *ls)
         /*
          * This in_recovery lock does two things:
          * 1) Keeps this function from returning until all threads are out
-         *    of locking routines and locking is truely stopped.
+         *    of locking routines and locking is truly stopped.
          * 2) Keeps any new requests from being processed until it's unlocked
          *    when recovery is complete.
          */
diff --git a/fs/dlm/netlink.c b/fs/dlm/netlink.c
index 052095cd592f..2c6ad518100d 100644
--- a/fs/dlm/netlink.c
+++ b/fs/dlm/netlink.c
@@ -9,6 +9,7 @@
 #include <net/genetlink.h>
 #include <linux/dlm.h>
 #include <linux/dlm_netlink.h>
+#include <linux/gfp.h>
 
 #include "dlm_internal.h"
 
diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c
index b5f89aef3b29..d45c02db6943 100644
--- a/fs/dlm/plock.c
+++ b/fs/dlm/plock.c
@@ -11,6 +11,7 @@
 #include <linux/poll.h>
 #include <linux/dlm.h>
 #include <linux/dlm_plock.h>
+#include <linux/slab.h>
 
 #include "dlm_internal.h"
 #include "lockspace.h"
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index e73a4bb572aa..8b6e73c47435 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2009 Red Hat, Inc.  All rights reserved.
+ * Copyright (C) 2006-2010 Red Hat, Inc.  All rights reserved.
  *
  * This copyrighted material is made available to anyone wishing to use,
  * modify, copy, or redistribute it subject to the terms and conditions
@@ -17,6 +17,7 @@
 #include <linux/spinlock.h>
 #include <linux/dlm.h>
 #include <linux/dlm_device.h>
+#include <linux/slab.h>
 
 #include "dlm_internal.h"
 #include "lockspace.h"
@@ -173,7 +174,7 @@ static int lkb_is_endoflife(struct dlm_lkb *lkb, int sb_status, int type)
 /* we could possibly check if the cancel of an orphan has resulted in the lkb
    being removed and then remove that lkb from the orphans list and free it */
 
-void dlm_user_add_ast(struct dlm_lkb *lkb, int type, int bastmode)
+void dlm_user_add_ast(struct dlm_lkb *lkb, int type, int mode)
 {
         struct dlm_ls *ls;
         struct dlm_user_args *ua;
@@ -206,8 +207,10 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type, int bastmode)
 
         ast_type = lkb->lkb_ast_type;
         lkb->lkb_ast_type |= type;
-        if (bastmode)
-                lkb->lkb_bastmode = bastmode;
+        if (type == AST_BAST)
+                lkb->lkb_bastmode = mode;
+        else
+                lkb->lkb_castmode = mode;
 
         if (!ast_type) {
                 kref_get(&lkb->lkb_ref);
diff --git a/fs/dlm/user.h b/fs/dlm/user.h
index 1c9686492286..f196091dd7ff 100644
--- a/fs/dlm/user.h
+++ b/fs/dlm/user.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2008 Red Hat, Inc.  All rights reserved.
+ * Copyright (C) 2006-2010 Red Hat, Inc.  All rights reserved.
  *
  * This copyrighted material is made available to anyone wishing to use,
  * modify, copy, or redistribute it subject to the terms and conditions
@@ -9,7 +9,7 @@
 #ifndef __USER_DOT_H__
 #define __USER_DOT_H__
 
-void dlm_user_add_ast(struct dlm_lkb *lkb, int type, int bastmode);
+void dlm_user_add_ast(struct dlm_lkb *lkb, int type, int mode);
 int dlm_user_init(void);
 void dlm_user_exit(void);
 int dlm_device_deregister(struct dlm_ls *ls);
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index fbb6e5eed697..1cc087635a5e 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -33,6 +33,7 @@
 #include <linux/crypto.h>
 #include <linux/file.h>
 #include <linux/scatterlist.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 #include "ecryptfs_kernel.h"
 
@@ -381,8 +382,8 @@ out:
 static void ecryptfs_lower_offset_for_extent(loff_t *offset, loff_t extent_num,
                                              struct ecryptfs_crypt_stat *crypt_stat)
 {
-        (*offset) = (crypt_stat->num_header_bytes_at_front
-                     + (crypt_stat->extent_size * extent_num));
+        (*offset) = ecryptfs_lower_header_size(crypt_stat)
+                    + (crypt_stat->extent_size * extent_num);
 }
 
 /**
@@ -834,13 +835,13 @@ void ecryptfs_set_default_sizes(struct ecryptfs_crypt_stat *crypt_stat)
         set_extent_mask_and_shift(crypt_stat);
         crypt_stat->iv_bytes = ECRYPTFS_DEFAULT_IV_BYTES;
         if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                crypt_stat->num_header_bytes_at_front = 0;
+                crypt_stat->metadata_size = ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
         else {
                 if (PAGE_CACHE_SIZE <= ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)
-                        crypt_stat->num_header_bytes_at_front =
+                        crypt_stat->metadata_size =
                                 ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
                 else
-                        crypt_stat->num_header_bytes_at_front = PAGE_CACHE_SIZE;
+                        crypt_stat->metadata_size = PAGE_CACHE_SIZE;
         }
 }
 
@@ -1107,9 +1108,9 @@ static void write_ecryptfs_marker(char *page_virt, size_t *written)
         (*written) = MAGIC_ECRYPTFS_MARKER_SIZE_BYTES;
 }
 
-static void
-write_ecryptfs_flags(char *page_virt, struct ecryptfs_crypt_stat *crypt_stat,
-                     size_t *written)
+void ecryptfs_write_crypt_stat_flags(char *page_virt,
+                                     struct ecryptfs_crypt_stat *crypt_stat,
+                                     size_t *written)
 {
         u32 flags = 0;
         int i;
@@ -1237,8 +1238,7 @@ ecryptfs_write_header_metadata(char *virt,
 
         header_extent_size = (u32)crypt_stat->extent_size;
         num_header_extents_at_front =
-                (u16)(crypt_stat->num_header_bytes_at_front
-                      / crypt_stat->extent_size);
+                (u16)(crypt_stat->metadata_size / crypt_stat->extent_size);
         put_unaligned_be32(header_extent_size, virt);
         virt += 4;
         put_unaligned_be16(num_header_extents_at_front, virt);
@@ -1291,7 +1291,8 @@ static int ecryptfs_write_headers_virt(char *page_virt, size_t max,
         offset = ECRYPTFS_FILE_SIZE_BYTES;
         write_ecryptfs_marker((page_virt + offset), &written);
         offset += written;
-        write_ecryptfs_flags((page_virt + offset), crypt_stat, &written);
+        ecryptfs_write_crypt_stat_flags((page_virt + offset), crypt_stat,
+                                        &written);
         offset += written;
         ecryptfs_write_header_metadata((page_virt + offset), crypt_stat,
                                        &written);
@@ -1381,7 +1382,7 @@ int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry)
                 rc = -EINVAL;
                 goto out;
         }
-        virt_len = crypt_stat->num_header_bytes_at_front;
+        virt_len = crypt_stat->metadata_size;
         order = get_order(virt_len);
         /* Released in this function */
         virt = (char *)ecryptfs_get_zeroed_pages(GFP_KERNEL, order);
@@ -1427,16 +1428,15 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat,
         header_extent_size = get_unaligned_be32(virt);
         virt += sizeof(__be32);
         num_header_extents_at_front = get_unaligned_be16(virt);
-        crypt_stat->num_header_bytes_at_front =
-                (((size_t)num_header_extents_at_front
-                  * (size_t)header_extent_size));
+        crypt_stat->metadata_size = (((size_t)num_header_extents_at_front
+                                     * (size_t)header_extent_size));
         (*bytes_read) = (sizeof(__be32) + sizeof(__be16));
         if ((validate_header_size == ECRYPTFS_VALIDATE_HEADER_SIZE)
-            && (crypt_stat->num_header_bytes_at_front
+            && (crypt_stat->metadata_size
                 < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)) {
                 rc = -EINVAL;
                 printk(KERN_WARNING "Invalid header size: [%zd]\n",
-                       crypt_stat->num_header_bytes_at_front);
+                       crypt_stat->metadata_size);
         }
         return rc;
 }
@@ -1451,8 +1451,7 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat,
  */
 static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat)
 {
-        crypt_stat->num_header_bytes_at_front =
-                ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
+        crypt_stat->metadata_size = ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
 }
 
 /**
@@ -1606,6 +1605,7 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                                 ecryptfs_dentry,
                                                 ECRYPTFS_VALIDATE_HEADER_SIZE);
         if (rc) {
+                memset(page_virt, 0, PAGE_CACHE_SIZE);
                 rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
@@ -1748,7 +1748,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
                             char *cipher_name, size_t *key_size)
 {
         char dummy_key[ECRYPTFS_MAX_KEY_BYTES];
-        char *full_alg_name;
+        char *full_alg_name = NULL;
         int rc;
 
         *key_tfm = NULL;
@@ -1763,7 +1763,6 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
         if (rc)
                 goto out;
         *key_tfm = crypto_alloc_blkcipher(full_alg_name, 0, CRYPTO_ALG_ASYNC);
-        kfree(full_alg_name);
         if (IS_ERR(*key_tfm)) {
                 rc = PTR_ERR(*key_tfm);
                 printk(KERN_ERR "Unable to allocate crypto cipher with name "
@@ -1786,6 +1785,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
                 goto out;
         }
 out:
+        kfree(full_alg_name);
         return rc;
 }
 
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 8f006a0d6076..906e803f7f79 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -26,6 +26,7 @@
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/fs_stack.h>
+#include <linux/slab.h>
 #include "ecryptfs_kernel.h"
 
 /**
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 542f625312f3..bfc2e0f78f00 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -35,6 +35,7 @@
 #include <linux/scatterlist.h>
 #include <linux/hash.h>
 #include <linux/nsproxy.h>
+#include <linux/backing-dev.h>
 
 /* Version verification for shared data structures w/ userspace */
 #define ECRYPTFS_VERSION_MAJOR 0x00
@@ -273,7 +274,7 @@ struct ecryptfs_crypt_stat {
         u32 flags;
         unsigned int file_version;
         size_t iv_bytes;
-        size_t num_header_bytes_at_front;
+        size_t metadata_size;
         size_t extent_size; /* Data extent size; default is 4096 */
         size_t key_size;
         size_t extent_shift;
@@ -393,6 +394,7 @@ struct ecryptfs_mount_crypt_stat {
 struct ecryptfs_sb_info {
         struct super_block *wsi_sb;
         struct ecryptfs_mount_crypt_stat mount_crypt_stat;
+        struct backing_dev_info bdi;
 };
 
 /* file private data. */
@@ -464,6 +466,14 @@ struct ecryptfs_daemon {
 
 extern struct mutex ecryptfs_daemon_hash_mux;
 
+static inline size_t
+ecryptfs_lower_header_size(struct ecryptfs_crypt_stat *crypt_stat)
+{
+        if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
+                return 0;
+        return crypt_stat->metadata_size;
+}
+
 static inline struct ecryptfs_file_info *
 ecryptfs_file_to_private(struct file *file)
 {
@@ -651,6 +661,9 @@ int ecryptfs_decrypt_page(struct page *page);
 int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry);
 int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry);
 int ecryptfs_new_file_context(struct dentry *ecryptfs_dentry);
+void ecryptfs_write_crypt_stat_flags(char *page_virt,
+                                     struct ecryptfs_crypt_stat *crypt_stat,
+                                     size_t *written);
 int ecryptfs_read_and_validate_header_region(char *data,
                                              struct inode *ecryptfs_inode);
 int ecryptfs_read_and_validate_xattr_region(char *page_virt,
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 9e944057001b..e7440a6f5ebf 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -25,6 +25,7 @@
 
 #include <linux/file.h>
 #include <linux/poll.h>
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/pagemap.h>
 #include <linux/security.h>
@@ -158,7 +159,7 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
         struct dentry *ecryptfs_dentry = file->f_path.dentry;
         /* Private value of ecryptfs_dentry allocated in
          * ecryptfs_lookup() */
-        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
+        struct dentry *lower_dentry;
         struct ecryptfs_file_info *file_info;
 
         mount_crypt_stat = &ecryptfs_superblock_to_private(
@@ -191,13 +192,6 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                                       | ECRYPTFS_ENCRYPTED);
         }
         mutex_unlock(&crypt_stat->cs_mutex);
-        if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
-            && !(file->f_flags & O_RDONLY)) {
-                rc = -EPERM;
-                printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
-                       "file must hence be opened RO\n", __func__);
-                goto out;
-        }
         if (!ecryptfs_inode_to_private(inode)->lower_file) {
                 rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
                 if (rc) {
@@ -208,6 +202,13 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                         goto out;
                 }
         }
+        if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
+            && !(file->f_flags & O_RDONLY)) {
+                rc = -EPERM;
+                printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
+                       "file must hence be opened RO\n", __func__);
+                goto out;
+        }
         ecryptfs_set_file_lower(
                 file, ecryptfs_inode_to_private(inode)->lower_file);
         if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
@@ -299,7 +300,6 @@ static int ecryptfs_ioctl(struct inode *inode, struct file *file,
 const struct file_operations ecryptfs_dir_fops = {
         .readdir = ecryptfs_readdir,
         .ioctl = ecryptfs_ioctl,
-        .mmap = generic_file_mmap,
         .open = ecryptfs_open,
         .flush = ecryptfs_flush,
         .release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 429ca0b3ba08..e2d4418affac 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -31,6 +31,7 @@
 #include <linux/mount.h>
 #include <linux/crypto.h>
 #include <linux/fs_stack.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 #include "ecryptfs_kernel.h"
 
@@ -282,7 +283,8 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                 goto out;
         }
         rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
-                                ecryptfs_dir_inode->i_sb, 1);
+                                ecryptfs_dir_inode->i_sb,
+                                ECRYPTFS_INTERPOSE_FLAG_D_ADD);
         if (rc) {
                 printk(KERN_ERR "%s: Error interposing; rc = [%d]\n",
                        __func__, rc);
@@ -322,6 +324,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
         rc = ecryptfs_read_and_validate_header_region(page_virt,
                                                       ecryptfs_dentry->d_inode);
         if (rc) {
+                memset(page_virt, 0, PAGE_CACHE_SIZE);
                 rc = ecryptfs_read_and_validate_xattr_region(page_virt,
                                                              ecryptfs_dentry);
                 if (rc) {
@@ -334,7 +337,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                 ecryptfs_dentry->d_sb)->mount_crypt_stat;
         if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
                 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                        file_size = (crypt_stat->num_header_bytes_at_front
+                        file_size = (crypt_stat->metadata_size
                                      + i_size_read(lower_dentry->d_inode));
                 else
                         file_size = i_size_read(lower_dentry->d_inode);
@@ -386,9 +389,9 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
         if (IS_ERR(lower_dentry)) {
                 rc = PTR_ERR(lower_dentry);
-                printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
-                       "lower_dentry = [%s]\n", __func__, rc,
-                       ecryptfs_dentry->d_name.name);
+                ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
+                                "[%d] on lower_dentry = [%s]\n", __func__, rc,
+                                encrypted_and_encoded_name);
                 goto out_d_drop;
         }
         if (lower_dentry->d_inode)
@@ -415,9 +418,9 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
         if (IS_ERR(lower_dentry)) {
                 rc = PTR_ERR(lower_dentry);
-                printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
-                       "lower_dentry = [%s]\n", __func__, rc,
-                       encrypted_and_encoded_name);
+                ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
+                                "[%d] on lower_dentry = [%s]\n", __func__, rc,
+                                encrypted_and_encoded_name);
                 goto out_d_drop;
         }
 lookup_and_interpose:
@@ -454,8 +457,8 @@ static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
         rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0);
         if (rc)
                 goto out_lock;
-        fsstack_copy_attr_times(dir, lower_new_dentry->d_inode);
-        fsstack_copy_inode_size(dir, lower_new_dentry->d_inode);
+        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
+        fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
         old_dentry->d_inode->i_nlink =
                 ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink;
         i_size_write(new_dentry->d_inode, file_size_save);
@@ -463,9 +466,6 @@ out_lock:
         unlock_dir(lower_dir_dentry);
         dput(lower_new_dentry);
         dput(lower_old_dentry);
-        d_drop(lower_old_dentry);
-        d_drop(new_dentry);
-        d_drop(old_dentry);
         return rc;
 }
 
@@ -614,6 +614,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct dentry *lower_new_dentry;
         struct dentry *lower_old_dir_dentry;
         struct dentry *lower_new_dir_dentry;
+        struct dentry *trap = NULL;
 
         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
@@ -621,7 +622,17 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         dget(lower_new_dentry);
         lower_old_dir_dentry = dget_parent(lower_old_dentry);
         lower_new_dir_dentry = dget_parent(lower_new_dentry);
-        lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+        trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+        /* source should not be ancestor of target */
+        if (trap == lower_old_dentry) {
+                rc = -EINVAL;
+                goto out_lock;
+        }
+        /* target should not be ancestor of source */
+        if (trap == lower_new_dentry) {
+                rc = -ENOTEMPTY;
+                goto out_lock;
+        }
         rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
                         lower_new_dir_dentry->d_inode, lower_new_dentry);
         if (rc)
@@ -638,38 +649,17 @@ out_lock:
         return rc;
 }
 
-static int
-ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
+                                   size_t *bufsiz)
 {
+        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
         char *lower_buf;
-        size_t lower_bufsiz;
-        struct dentry *lower_dentry;
-        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
-        char *plaintext_name;
-        size_t plaintext_name_size;
+        size_t lower_bufsiz = PATH_MAX;
         mm_segment_t old_fs;
         int rc;
 
-        lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        if (!lower_dentry->d_inode->i_op->readlink) {
-                rc = -EINVAL;
-                goto out;
-        }
-        mount_crypt_stat = &ecryptfs_superblock_to_private(
-                                                dentry->d_sb)->mount_crypt_stat;
-        /*
-         * If the lower filename is encrypted, it will result in a significantly
-         * longer name.  If needed, truncate the name after decode and decrypt.
-         */
-        if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
-                lower_bufsiz = PATH_MAX;
-        else
-                lower_bufsiz = bufsiz;
-        /* Released in this function */
         lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL);
-        if (lower_buf == NULL) {
-                printk(KERN_ERR "%s: Out of memory whilst attempting to "
-                       "kmalloc [%zd] bytes\n", __func__, lower_bufsiz);
+        if (!lower_buf) {
                 rc = -ENOMEM;
                 goto out;
         }
@@ -679,29 +669,31 @@ ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
                                                    (char __user *)lower_buf,
                                                    lower_bufsiz);
         set_fs(old_fs);
-        if (rc >= 0) {
-                rc = ecryptfs_decode_and_decrypt_filename(&plaintext_name,
-                                                          &plaintext_name_size,
-                                                          dentry, lower_buf,
-                                                          rc);
-                if (rc) {
-                        printk(KERN_ERR "%s: Error attempting to decode and "
-                               "decrypt filename; rc = [%d]\n", __func__,
-                                rc);
-                        goto out_free_lower_buf;
-                }
-                /* Check for bufsiz <= 0 done in sys_readlinkat() */
-                rc = copy_to_user(buf, plaintext_name,
-                                  min((size_t) bufsiz, plaintext_name_size));
-                if (rc)
-                        rc = -EFAULT;
-                else
-                        rc = plaintext_name_size;
-                kfree(plaintext_name);
-                fsstack_copy_attr_atime(dentry->d_inode, lower_dentry->d_inode);
-        }
-out_free_lower_buf:
+        if (rc < 0)
+                goto out;
+        lower_bufsiz = rc;
+        rc = ecryptfs_decode_and_decrypt_filename(buf, bufsiz, dentry,
+                                                  lower_buf, lower_bufsiz);
+out:
         kfree(lower_buf);
+        return rc;
+}
+
+static int
+ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+{
+        char *kbuf;
+        size_t kbufsiz, copied;
+        int rc;
+
+        rc = ecryptfs_readlink_lower(dentry, &kbuf, &kbufsiz);
+        if (rc)
+                goto out;
+        copied = min_t(size_t, bufsiz, kbufsiz);
+        rc = copy_to_user(buf, kbuf, copied) ? -EFAULT : copied;
+        kfree(kbuf);
+        fsstack_copy_attr_atime(dentry->d_inode,
+                                ecryptfs_dentry_to_lower(dentry)->d_inode);
 out:
         return rc;
 }
@@ -715,31 +707,31 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         /* Released in ecryptfs_put_link(); only release here on error */
         buf = kmalloc(len, GFP_KERNEL);
         if (!buf) {
-                rc = -ENOMEM;
+                buf = ERR_PTR(-ENOMEM);
                 goto out;
         }
         old_fs = get_fs();
         set_fs(get_ds());
         rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
         set_fs(old_fs);
-        if (rc < 0)
-                goto out_free;
-        else
+        if (rc < 0) {
+                kfree(buf);
+                buf = ERR_PTR(rc);
+        } else
                 buf[rc] = '\0';
-        rc = 0;
-        nd_set_link(nd, buf);
-        goto out;
-out_free:
-        kfree(buf);
 out:
-        return ERR_PTR(rc);
+        nd_set_link(nd, buf);
+        return NULL;
 }
 
 static void
 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
 {
-        /* Free the char* */
-        kfree(nd_get_link(nd));
+        char *buf = nd_get_link(nd);
+        if (!IS_ERR(buf)) {
+                /* Free the char* */
+                kfree(buf);
+        }
 }
 
 /**
@@ -759,7 +751,7 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
 {
         loff_t lower_size;
 
-        lower_size = crypt_stat->num_header_bytes_at_front;
+        lower_size = ecryptfs_lower_header_size(crypt_stat);
         if (upper_size != 0) {
                 loff_t num_extents;
 
@@ -772,18 +764,23 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
 }
 
 /**
- * ecryptfs_truncate
+ * truncate_upper
  * @dentry: The ecryptfs layer dentry
- * @new_length: The length to expand the file to
+ * @ia: Address of the ecryptfs inode's attributes
+ * @lower_ia: Address of the lower inode's attributes
  *
  * Function to handle truncations modifying the size of the file. Note
  * that the file sizes are interpolated. When expanding, we are simply
- * writing strings of 0's out. When truncating, we need to modify the
- * underlying file size according to the page index interpolations.
+ * writing strings of 0's out. When truncating, we truncate the upper
+ * inode and update the lower_ia according to the page index
+ * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
+ * the caller must use lower_ia in a call to notify_change() to perform
+ * the truncation of the lower inode.
  *
  * Returns zero on success; non-zero otherwise
  */
-int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+static int truncate_upper(struct dentry *dentry, struct iattr *ia,
+                          struct iattr *lower_ia)
 {
         int rc = 0;
         struct inode *inode = dentry->d_inode;
@@ -794,8 +791,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         loff_t lower_size_before_truncate;
         loff_t lower_size_after_truncate;
 
-        if (unlikely((new_length == i_size)))
+        if (unlikely((ia->ia_size == i_size))) {
+                lower_ia->ia_valid &= ~ATTR_SIZE;
                 goto out;
+        }
         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
         /* Set up a fake ecryptfs file, this is used to interface with
          * the file in the underlying filesystem so that the
@@ -815,28 +814,30 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                 &fake_ecryptfs_file,
                 ecryptfs_inode_to_private(dentry->d_inode)->lower_file);
         /* Switch on growing or shrinking file */
-        if (new_length > i_size) {
+        if (ia->ia_size > i_size) {
                 char zero[] = { 0x00 };
 
+                lower_ia->ia_valid &= ~ATTR_SIZE;
                 /* Write a single 0 at the last position of the file;
                  * this triggers code that will fill in 0's throughout
                  * the intermediate portion of the previous end of the
                  * file and the new and of the file */
                 rc = ecryptfs_write(&fake_ecryptfs_file, zero,
-                                    (new_length - 1), 1);
-        } else { /* new_length < i_size_read(inode) */
-                /* We're chopping off all the pages down do the page
-                 * in which new_length is located. Fill in the end of
-                 * that page from (new_length & ~PAGE_CACHE_MASK) to
+                                    (ia->ia_size - 1), 1);
+        } else { /* ia->ia_size < i_size_read(inode) */
+                /* We're chopping off all the pages down to the page
+                 * in which ia->ia_size is located. Fill in the end of
+                 * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to
                  * PAGE_CACHE_SIZE with zeros. */
                 size_t num_zeros = (PAGE_CACHE_SIZE
-                                    - (new_length & ~PAGE_CACHE_MASK));
+                                    - (ia->ia_size & ~PAGE_CACHE_MASK));
 
                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
-                        rc = vmtruncate(inode, new_length);
+                        rc = vmtruncate(inode, ia->ia_size);
                         if (rc)
                                 goto out_free;
-                        rc = vmtruncate(lower_dentry->d_inode, new_length);
+                        lower_ia->ia_size = ia->ia_size;
+                        lower_ia->ia_valid |= ATTR_SIZE;
                         goto out_free;
                 }
                 if (num_zeros) {
@@ -848,7 +849,7 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                                 goto out_free;
                         }
                         rc = ecryptfs_write(&fake_ecryptfs_file, zeros_virt,
-                                            new_length, num_zeros);
+                                            ia->ia_size, num_zeros);
                         kfree(zeros_virt);
                         if (rc) {
                                 printk(KERN_ERR "Error attempting to zero out "
@@ -857,7 +858,7 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                                 goto out_free;
                         }
                 }
-                vmtruncate(inode, new_length);
+                vmtruncate(inode, ia->ia_size);
                 rc = ecryptfs_write_inode_size_to_metadata(inode);
                 if (rc) {
                         printk(KERN_ERR "Problem with "
@@ -870,10 +871,12 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                 lower_size_before_truncate =
                     upper_size_to_lower_size(crypt_stat, i_size);
                 lower_size_after_truncate =
-                    upper_size_to_lower_size(crypt_stat, new_length);
-                if (lower_size_after_truncate < lower_size_before_truncate)
-                        vmtruncate(lower_dentry->d_inode,
-                                   lower_size_after_truncate);
+                    upper_size_to_lower_size(crypt_stat, ia->ia_size);
+                if (lower_size_after_truncate < lower_size_before_truncate) {
+                        lower_ia->ia_size = lower_size_after_truncate;
+                        lower_ia->ia_valid |= ATTR_SIZE;
+                } else
+                        lower_ia->ia_valid &= ~ATTR_SIZE;
         }
 out_free:
         if (ecryptfs_file_to_private(&fake_ecryptfs_file))
@@ -883,6 +886,33 @@ out:
         return rc;
 }
 
+/**
+ * ecryptfs_truncate
+ * @dentry: The ecryptfs layer dentry
+ * @new_length: The length to expand the file to
+ *
+ * Simple function that handles the truncation of an eCryptfs inode and
+ * its corresponding lower inode.
+ *
+ * Returns zero on success; non-zero otherwise
+ */
+int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+{
+        struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
+        struct iattr lower_ia = { .ia_valid = 0 };
+        int rc;
+
+        rc = truncate_upper(dentry, &ia, &lower_ia);
+        if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
+                struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+
+                mutex_lock(&lower_dentry->d_inode->i_mutex);
+                rc = notify_change(lower_dentry, &lower_ia);
+                mutex_unlock(&lower_dentry->d_inode->i_mutex);
+        }
+        return rc;
+}
+
 static int
 ecryptfs_permission(struct inode *inode, int mask)
 {
@@ -905,6 +935,7 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
 {
         int rc = 0;
         struct dentry *lower_dentry;
+        struct iattr lower_ia;
         struct inode *inode;
         struct inode *lower_inode;
         struct ecryptfs_crypt_stat *crypt_stat;
@@ -943,15 +974,11 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                 }
         }
         mutex_unlock(&crypt_stat->cs_mutex);
+        memcpy(&lower_ia, ia, sizeof(lower_ia));
+        if (ia->ia_valid & ATTR_FILE)
+                lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
         if (ia->ia_valid & ATTR_SIZE) {
-                ecryptfs_printk(KERN_DEBUG,
-                                "ia->ia_valid = [0x%x] ATTR_SIZE" " = [0x%x]\n",
-                                ia->ia_valid, ATTR_SIZE);
-                rc = ecryptfs_truncate(dentry, ia->ia_size);
-                /* ecryptfs_truncate handles resizing of the lower file */
-                ia->ia_valid &= ~ATTR_SIZE;
-                ecryptfs_printk(KERN_DEBUG, "ia->ia_valid = [%x]\n",
-                                ia->ia_valid);
+                rc = truncate_upper(dentry, ia, &lower_ia);
                 if (rc < 0)
                         goto out;
         }
@@ -960,17 +987,54 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
          * mode change is for clearing setuid/setgid bits. Allow lower fs
          * to interpret this in its own way.
          */
-        if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
-                ia->ia_valid &= ~ATTR_MODE;
+        if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
+                lower_ia.ia_valid &= ~ATTR_MODE;
 
         mutex_lock(&lower_dentry->d_inode->i_mutex);
-        rc = notify_change(lower_dentry, ia);
+        rc = notify_change(lower_dentry, &lower_ia);
         mutex_unlock(&lower_dentry->d_inode->i_mutex);
 out:
         fsstack_copy_attr_all(inode, lower_inode);
         return rc;
 }
 
+int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
+                          struct kstat *stat)
+{
+        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+        int rc = 0;
+
+        mount_crypt_stat = &ecryptfs_superblock_to_private(
+                                                dentry->d_sb)->mount_crypt_stat;
+        generic_fillattr(dentry->d_inode, stat);
+        if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
+                char *target;
+                size_t targetsiz;
+
+                rc = ecryptfs_readlink_lower(dentry, &target, &targetsiz);
+                if (!rc) {
+                        kfree(target);
+                        stat->size = targetsiz;
+                }
+        }
+        return rc;
+}
+
+int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                     struct kstat *stat)
+{
+        struct kstat lower_stat;
+        int rc;
+
+        rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
+                         ecryptfs_dentry_to_lower(dentry), &lower_stat);
+        if (!rc) {
+                generic_fillattr(dentry->d_inode, stat);
+                stat->blocks = lower_stat.blocks;
+        }
+        return rc;
+}
+
 int
 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
                   size_t size, int flags)
@@ -980,7 +1044,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         if (!lower_dentry->d_inode->i_op->setxattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -998,7 +1062,7 @@ ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name,
         int rc = 0;
 
         if (!lower_dentry->d_inode->i_op->getxattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1025,7 +1089,7 @@ ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         if (!lower_dentry->d_inode->i_op->listxattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1042,7 +1106,7 @@ static int ecryptfs_removexattr(struct dentry *dentry, const char *name)
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         if (!lower_dentry->d_inode->i_op->removexattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1073,6 +1137,7 @@ const struct inode_operations ecryptfs_symlink_iops = {
         .put_link = ecryptfs_put_link,
         .permission = ecryptfs_permission,
         .setattr = ecryptfs_setattr,
+        .getattr = ecryptfs_getattr_link,
         .setxattr = ecryptfs_setxattr,
         .getxattr = ecryptfs_getxattr,
         .listxattr = ecryptfs_listxattr,
@@ -1100,6 +1165,7 @@ const struct inode_operations ecryptfs_dir_iops = {
 const struct inode_operations ecryptfs_main_iops = {
         .permission = ecryptfs_permission,
         .setattr = ecryptfs_setattr,
+        .getattr = ecryptfs_getattr,
         .setxattr = ecryptfs_setxattr,
         .getxattr = ecryptfs_getxattr,
         .listxattr = ecryptfs_listxattr,
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index a0a7847567e9..89c5476506ef 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -32,6 +32,7 @@
 #include <linux/random.h>
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <linux/slab.h>
 #include "ecryptfs_kernel.h"
 
 /**
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index e14cf7e588db..d8c3a373aafa 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -22,6 +22,7 @@
 
 #include <linux/kthread.h>
 #include <linux/freezer.h>
+#include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/mount.h>
 #include "ecryptfs_kernel.h"
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 567bc4b9f70a..760983d0f25e 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -35,6 +35,7 @@
 #include <linux/key.h>
 #include <linux/parser.h>
 #include <linux/fs_stack.h>
+#include <linux/slab.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -496,17 +497,25 @@ struct kmem_cache *ecryptfs_sb_info_cache;
 static int
 ecryptfs_fill_super(struct super_block *sb, void *raw_data, int silent)
 {
+        struct ecryptfs_sb_info *esi;
         int rc = 0;
 
         /* Released in ecryptfs_put_super() */
         ecryptfs_set_superblock_private(sb,
                                         kmem_cache_zalloc(ecryptfs_sb_info_cache,
                                                          GFP_KERNEL));
-        if (!ecryptfs_superblock_to_private(sb)) {
+        esi = ecryptfs_superblock_to_private(sb);
+        if (!esi) {
                 ecryptfs_printk(KERN_WARNING, "Out of memory\n");
                 rc = -ENOMEM;
                 goto out;
         }
+
+        rc = bdi_setup_and_register(&esi->bdi, "ecryptfs", BDI_CAP_MAP_COPY);
+        if (rc)
+                goto out;
+
+        sb->s_bdi = &esi->bdi;
         sb->s_op = &ecryptfs_sops;
         /* Released through deactivate_super(sb) from get_sb_nodev */
         sb->s_root = d_alloc(NULL, &(const struct qstr) {
@@ -585,8 +594,8 @@ out:
  *                        with as much information as it can before needing
  *                        the lower filesystem.
  * ecryptfs_read_super(): this accesses the lower filesystem and uses
- *                        ecryptfs_interpolate to perform most of the linking
- * ecryptfs_interpolate(): links the lower filesystem into ecryptfs
+ *                        ecryptfs_interpose to perform most of the linking
+ * ecryptfs_interpose(): links the lower filesystem into ecryptfs (inode.c)
  */
 static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags,
                         const char *dev_name, void *raw_data,
diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index f1c17e87c5fb..2d8dbce9d485 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -20,6 +20,7 @@
  * 02111-1307, USA.
  */
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/user_namespace.h>
 #include <linux/nsproxy.h>
 #include "ecryptfs_kernel.h"
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 4ec8f61ccf5a..3745f612bcd4 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -24,6 +24,7 @@
 #include <linux/random.h>
 #include <linux/miscdevice.h>
 #include <linux/poll.h>
+#include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/module.h>
 #include "ecryptfs_kernel.h"
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
index df4ce99d0597..2ee9a3a7b68c 100644
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -32,6 +32,7 @@
 #include <linux/file.h>
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <linux/slab.h>
 #include <asm/unaligned.h>
 #include "ecryptfs_kernel.h"
 
@@ -82,6 +83,19 @@ out:
         return rc;
 }
 
+static void strip_xattr_flag(char *page_virt,
+                             struct ecryptfs_crypt_stat *crypt_stat)
+{
+        if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
+                size_t written;
+
+                crypt_stat->flags &= ~ECRYPTFS_METADATA_IN_XATTR;
+                ecryptfs_write_crypt_stat_flags(page_virt, crypt_stat,
+                                                &written);
+                crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
+        }
+}
+
 /**
  *   Header Extent:
  *     Octets 0-7:        Unencrypted file size (big-endian)
@@ -97,19 +111,6 @@ out:
  *                        (big-endian)
  *     Octet  26:         Begin RFC 2440 authentication token packet set
  */
-static void set_header_info(char *page_virt,
-                            struct ecryptfs_crypt_stat *crypt_stat)
-{
-        size_t written;
-        size_t save_num_header_bytes_at_front =
-                crypt_stat->num_header_bytes_at_front;
-
-        crypt_stat->num_header_bytes_at_front =
-                ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
-        ecryptfs_write_header_metadata(page_virt + 20, crypt_stat, &written);
-        crypt_stat->num_header_bytes_at_front =
-                save_num_header_bytes_at_front;
-}
 
 /**
  * ecryptfs_copy_up_encrypted_with_header
@@ -135,8 +136,7 @@ ecryptfs_copy_up_encrypted_with_header(struct page *page,
                                            * num_extents_per_page)
                                           + extent_num_in_page);
                 size_t num_header_extents_at_front =
-                        (crypt_stat->num_header_bytes_at_front
-                         / crypt_stat->extent_size);
+                        (crypt_stat->metadata_size / crypt_stat->extent_size);
 
                 if (view_extent_num < num_header_extents_at_front) {
                         /* This is a header extent */
@@ -146,9 +146,14 @@ ecryptfs_copy_up_encrypted_with_header(struct page *page,
                         memset(page_virt, 0, PAGE_CACHE_SIZE);
                         /* TODO: Support more than one header extent */
                         if (view_extent_num == 0) {
+                                size_t written;
+
                                 rc = ecryptfs_read_xattr_region(
                                         page_virt, page->mapping->host);
-                                set_header_info(page_virt, crypt_stat);
+                                strip_xattr_flag(page_virt + 16, crypt_stat);
+                                ecryptfs_write_header_metadata(page_virt + 20,
+                                                               crypt_stat,
+                                                               &written);
                         }
                         kunmap_atomic(page_virt, KM_USER0);
                         flush_dcache_page(page);
@@ -161,7 +166,7 @@ ecryptfs_copy_up_encrypted_with_header(struct page *page,
                         /* This is an encrypted data extent */
                         loff_t lower_offset =
                                 ((view_extent_num * crypt_stat->extent_size)
-                                 - crypt_stat->num_header_bytes_at_front);
+                                 - crypt_stat->metadata_size);
 
                         rc = ecryptfs_read_lower_page_segment(
                                 page, (lower_offset >> PAGE_CACHE_SHIFT),
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index b15a43a80ab7..0c0ae491d231 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -26,6 +26,7 @@
 #include <linux/fs.h>
 #include <linux/mount.h>
 #include <linux/key.h>
+#include <linux/slab.h>
 #include <linux/seq_file.h>
 #include <linux/smp_lock.h>
 #include <linux/file.h>
@@ -85,7 +86,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
                 if (lower_dentry->d_inode) {
                         fput(inode_info->lower_file);
                         inode_info->lower_file = NULL;
-                        d_drop(lower_dentry);
                 }
         }
         ecryptfs_destroy_crypt_stat(&inode_info->crypt_stat);
@@ -122,6 +122,7 @@ static void ecryptfs_put_super(struct super_block *sb)
         lock_kernel();
 
         ecryptfs_destroy_mount_crypt_stat(&sb_info->mount_crypt_stat);
+        bdi_destroy(&sb_info->bdi);
         kmem_cache_free(ecryptfs_sb_info_cache, sb_info);
         ecryptfs_set_superblock_private(sb, NULL);
 
diff --git a/fs/eventfd.c b/fs/eventfd.c
index d26402ff06ea..6bd3f76fdf88 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -11,6 +11,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/anon_inodes.h>
@@ -135,26 +136,71 @@ static unsigned int eventfd_poll(struct file *file, poll_table *wait)
         return events;
 }
 
-static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
-                            loff_t *ppos)
+static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
+{
+        *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
+        ctx->count -= *cnt;
+}
+
+/**
+ * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue.
+ * @ctx: [in] Pointer to eventfd context.
+ * @wait: [in] Wait queue to be removed.
+ * @cnt: [out] Pointer to the 64bit conter value.
+ *
+ * Returns zero if successful, or the following error codes:
+ *
+ * -EAGAIN      : The operation would have blocked.
+ *
+ * This is used to atomically remove a wait queue entry from the eventfd wait
+ * queue head, and read/reset the counter value.
+ */
+int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_t *wait,
+                                  __u64 *cnt)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ctx->wqh.lock, flags);
+        eventfd_ctx_do_read(ctx, cnt);
+        __remove_wait_queue(&ctx->wqh, wait);
+        if (*cnt != 0 && waitqueue_active(&ctx->wqh))
+                wake_up_locked_poll(&ctx->wqh, POLLOUT);
+        spin_unlock_irqrestore(&ctx->wqh.lock, flags);
+
+        return *cnt != 0 ? 0 : -EAGAIN;
+}
+EXPORT_SYMBOL_GPL(eventfd_ctx_remove_wait_queue);
+
+/**
+ * eventfd_ctx_read - Reads the eventfd counter or wait if it is zero.
+ * @ctx: [in] Pointer to eventfd context.
+ * @no_wait: [in] Different from zero if the operation should not block.
+ * @cnt: [out] Pointer to the 64bit conter value.
+ *
+ * Returns zero if successful, or the following error codes:
+ *
+ * -EAGAIN      : The operation would have blocked but @no_wait was nonzero.
+ * -ERESTARTSYS : A signal interrupted the wait operation.
+ *
+ * If @no_wait is zero, the function might sleep until the eventfd internal
+ * counter becomes greater than zero.
+ */
+ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt)
 {
-        struct eventfd_ctx *ctx = file->private_data;
         ssize_t res;
-        __u64 ucnt = 0;
         DECLARE_WAITQUEUE(wait, current);
 
-        if (count < sizeof(ucnt))
-                return -EINVAL;
         spin_lock_irq(&ctx->wqh.lock);
+        *cnt = 0;
         res = -EAGAIN;
         if (ctx->count > 0)
-                res = sizeof(ucnt);
-        else if (!(file->f_flags & O_NONBLOCK)) {
+                res = 0;
+        else if (!no_wait) {
                 __add_wait_queue(&ctx->wqh, &wait);
-                for (res = 0;;) {
+                for (;;) {
                         set_current_state(TASK_INTERRUPTIBLE);
                         if (ctx->count > 0) {
-                                res = sizeof(ucnt);
+                                res = 0;
                                 break;
                         }
                         if (signal_pending(current)) {
@@ -168,18 +214,32 @@ static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
                 __remove_wait_queue(&ctx->wqh, &wait);
                 __set_current_state(TASK_RUNNING);
         }
-        if (likely(res > 0)) {
-                ucnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
-                ctx->count -= ucnt;
+        if (likely(res == 0)) {
+                eventfd_ctx_do_read(ctx, cnt);
                 if (waitqueue_active(&ctx->wqh))
                         wake_up_locked_poll(&ctx->wqh, POLLOUT);
         }
         spin_unlock_irq(&ctx->wqh.lock);
-        if (res > 0 && put_user(ucnt, (__u64 __user *) buf))
-                return -EFAULT;
 
         return res;
 }
+EXPORT_SYMBOL_GPL(eventfd_ctx_read);
+
+static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
+                            loff_t *ppos)
+{
+        struct eventfd_ctx *ctx = file->private_data;
+        ssize_t res;
+        __u64 cnt;
+
+        if (count < sizeof(cnt))
+                return -EINVAL;
+        res = eventfd_ctx_read(ctx, file->f_flags & O_NONBLOCK, &cnt);
+        if (res < 0)
+                return res;
+
+        return put_user(cnt, (__u64 __user *) buf) ? -EFAULT : sizeof(cnt);
+}
 
 static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t count,
                              loff_t *ppos)
diff --git a/fs/exec.c b/fs/exec.c
index 632b02e34ec7..49cdaa19e5b9 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -195,7 +195,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
                  *    to work from.
                  */
                 rlim = current->signal->rlim;
-                if (size > rlim[RLIMIT_STACK].rlim_cur / 4) {
+                if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
                         put_page(page);
                         return NULL;
                 }
@@ -246,6 +246,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         vma->vm_start = vma->vm_end - PAGE_SIZE;
         vma->vm_flags = VM_STACK_FLAGS;
         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+        INIT_LIST_HEAD(&vma->anon_vma_chain);
         err = insert_vm_struct(mm, vma);
         if (err)
                 goto err;
@@ -516,7 +517,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
         /*
          * cover the whole range: [new_start, old_end)
          */
-        vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL);
+        if (vma_adjust(vma, new_start, old_end, vma->vm_pgoff, NULL))
+                return -ENOMEM;
 
         /*
          * move the page tables downwards, on failure we rely on
@@ -547,15 +549,13 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
         tlb_finish_mmu(tlb, new_end, old_end);
 
         /*
-         * shrink the vma to just the new range.
+         * Shrink the vma to just the new range.  Always succeeds.
          */
         vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
 
         return 0;
 }
 
-#define EXTRA_STACK_VM_PAGES    20      /* random */
-
 /*
  * Finalizes the stack vm_area_struct. The flags and permissions are updated,
  * the stack is optionally relocated, and some extra space is added.
@@ -571,10 +571,13 @@ int setup_arg_pages(struct linux_binprm *bprm,
         struct vm_area_struct *prev = NULL;
         unsigned long vm_flags;
         unsigned long stack_base;
+        unsigned long stack_size;
+        unsigned long stack_expand;
+        unsigned long rlim_stack;
 
 #ifdef CONFIG_STACK_GROWSUP
         /* Limit stack size to 1GB */
-        stack_base = current->signal->rlim[RLIMIT_STACK].rlim_max;
+        stack_base = rlimit_max(RLIMIT_STACK);
         if (stack_base > (1 << 30))
                 stack_base = 1 << 30;
 
@@ -627,10 +630,23 @@ int setup_arg_pages(struct linux_binprm *bprm,
                         goto out_unlock;
         }
 
+        stack_expand = 131072UL; /* randomly 32*4k (or 2*64k) pages */
+        stack_size = vma->vm_end - vma->vm_start;
+        /*
+         * Align this down to a page boundary as expand_stack
+         * will align it up.
+         */
+        rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
 #ifdef CONFIG_STACK_GROWSUP
-        stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+        if (stack_size + stack_expand > rlim_stack)
+                stack_base = vma->vm_start + rlim_stack;
+        else
+                stack_base = vma->vm_end + stack_expand;
 #else
-        stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+        if (stack_size + stack_expand > rlim_stack)
+                stack_base = vma->vm_end - rlim_stack;
+        else
+                stack_base = vma->vm_start - stack_expand;
 #endif
         ret = expand_stack(vma, stack_base);
         if (ret)
@@ -702,6 +718,7 @@ static int exec_mmap(struct mm_struct *mm)
         /* Notify parent that we're no longer interested in the old VM */
         tsk = current;
         old_mm = current->mm;
+        sync_mm_rss(tsk, old_mm);
         mm_release(tsk, old_mm);
 
         if (old_mm) {
@@ -941,9 +958,7 @@ void set_task_comm(struct task_struct *tsk, char *buf)
 
 int flush_old_exec(struct linux_binprm * bprm)
 {
-        char * name;
-        int i, ch, retval;
-        char tcomm[sizeof(current->comm)];
+        int retval;
 
         /*
          * Make sure we have a private signal table and that
@@ -964,6 +979,25 @@ int flush_old_exec(struct linux_binprm * bprm)
 
         bprm->mm = NULL;                /* We're using it now */
 
+        current->flags &= ~PF_RANDOMIZE;
+        flush_thread();
+        current->personality &= ~bprm->per_clear;
+
+        return 0;
+
+out:
+        return retval;
+}
+EXPORT_SYMBOL(flush_old_exec);
+
+void setup_new_exec(struct linux_binprm * bprm)
+{
+        int i, ch;
+        char * name;
+        char tcomm[sizeof(current->comm)];
+
+        arch_pick_mmap_layout(current->mm);
+
         /* This is the point of no return */
         current->sas_ss_sp = current->sas_ss_size = 0;
 
@@ -985,9 +1019,6 @@ int flush_old_exec(struct linux_binprm * bprm)
         tcomm[i] = '\0';
         set_task_comm(current, tcomm);
 
-        current->flags &= ~PF_RANDOMIZE;
-        flush_thread();
-
         /* Set the new mm task size. We have to do that late because it may
          * depend on TIF_32BIT which is only updated in flush_thread() on
          * some architectures like powerpc
@@ -1003,8 +1034,6 @@ int flush_old_exec(struct linux_binprm * bprm)
                 set_dumpable(current->mm, suid_dumpable);
         }
 
-        current->personality &= ~bprm->per_clear;
-
         /*
          * Flush performance counters when crossing a
          * security domain:
@@ -1019,14 +1048,8 @@ int flush_old_exec(struct linux_binprm * bprm)
                         
         flush_signal_handlers(current, 0);
         flush_old_files(current->files);
-
-        return 0;
-
-out:
-        return retval;
 }
-
-EXPORT_SYMBOL(flush_old_exec);
+EXPORT_SYMBOL(setup_new_exec);
 
 /*
  * Prepare credentials and lock ->cred_guard_mutex.
@@ -1510,7 +1533,7 @@ static int format_corename(char *corename, long signr)
                         /* core limit size */
                         case 'c':
                                 rc = snprintf(out_ptr, out_end - out_ptr,
-                                              "%lu", current->signal->rlim[RLIMIT_CORE].rlim_cur);
+                                              "%lu", rlimit(RLIMIT_CORE));
                                 if (rc > out_end - out_ptr)
                                         goto out;
                                 out_ptr += rc;
@@ -1538,12 +1561,13 @@ out:
         return ispipe;
 }
 
-static int zap_process(struct task_struct *start)
+static int zap_process(struct task_struct *start, int exit_code)
 {
         struct task_struct *t;
         int nr = 0;
 
         start->signal->flags = SIGNAL_GROUP_EXIT;
+        start->signal->group_exit_code = exit_code;
         start->signal->group_stop_count = 0;
 
         t = start;
@@ -1568,8 +1592,7 @@ static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
         spin_lock_irq(&tsk->sighand->siglock);
         if (!signal_group_exit(tsk->signal)) {
                 mm->core_state = core_state;
-                tsk->signal->group_exit_code = exit_code;
-                nr = zap_process(tsk);
+                nr = zap_process(tsk, exit_code);
         }
         spin_unlock_irq(&tsk->sighand->siglock);
         if (unlikely(nr < 0))
@@ -1618,7 +1641,7 @@ static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
                         if (p->mm) {
                                 if (unlikely(p->mm == mm)) {
                                         lock_task_sighand(p, &flags);
-                                        nr += zap_process(p);
+                                        nr += zap_process(p, exit_code);
                                         unlock_task_sighand(p, &flags);
                                 }
                                 break;
@@ -1725,14 +1748,19 @@ void set_dumpable(struct mm_struct *mm, int value)
         }
 }
 
-int get_dumpable(struct mm_struct *mm)
+static int __get_dumpable(unsigned long mm_flags)
 {
         int ret;
 
-        ret = mm->flags & 0x3;
+        ret = mm_flags & MMF_DUMPABLE_MASK;
         return (ret >= 2) ? 2 : ret;
 }
 
+int get_dumpable(struct mm_struct *mm)
+{
+        return __get_dumpable(mm->flags);
+}
+
 static void wait_for_dump_helpers(struct file *file)
 {
         struct pipe_inode_info *pipe;
@@ -1775,7 +1803,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         struct coredump_params cprm = {
                 .signr = signr,
                 .regs = regs,
-                .limit = current->signal->rlim[RLIMIT_CORE].rlim_cur,
+                .limit = rlimit(RLIMIT_CORE),
+                /*
+                 * We must use the same mm->flags while dumping core to avoid
+                 * inconsistency of bit flags, since this flag is not protected
+                 * by any locks.
+                 */
+                .mm_flags = mm->flags,
         };
 
         audit_core_dumps(signr);
@@ -1794,7 +1828,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         /*
          * If another thread got here first, or we are not dumpable, bail out.
          */
-        if (mm->core_state || !get_dumpable(mm)) {
+        if (mm->core_state || !__get_dumpable(cprm.mm_flags)) {
                 up_write(&mm->mmap_sem);
                 put_cred(cred);
                 goto fail;
@@ -1805,7 +1839,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
          *      process nor do we know its entire history. We only know it
          *      was tainted so we dump it as root in mode 2.
          */
-        if (get_dumpable(mm) == 2) {    /* Setuid core dump mode */
+        if (__get_dumpable(cprm.mm_flags) == 2) {
+                /* Setuid core dump mode */
                 flag = O_EXCL;          /* Stop rewrite attacks */
                 cred->fsuid = 0;        /* Dump root private */
         }
@@ -1901,8 +1936,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         /*
          * Dont allow local users get cute and trick others to coredump
          * into their pre-created files:
+         * Note, this is not relevant for pipes
          */
-        if (inode->i_uid != current_fsuid())
+        if (!ispipe && (inode->i_uid != current_fsuid()))
                 goto close_fail;
         if (!cprm.file->f_op)
                 goto close_fail;
diff --git a/fs/exofs/common.h b/fs/exofs/common.h
index b1b178e61718..f0d520312d8b 100644
--- a/fs/exofs/common.h
+++ b/fs/exofs/common.h
@@ -55,6 +55,8 @@
 /* exofs Application specific page/attribute */
 # define EXOFS_APAGE_FS_DATA    (OSD_APAGE_APP_DEFINED_FIRST + 3)
 # define EXOFS_ATTR_INODE_DATA  1
+# define EXOFS_ATTR_INODE_FILE_LAYOUT   2
+# define EXOFS_ATTR_INODE_DIR_LAYOUT    3
 
 /*
  * The maximum number of files we can have is limited by the size of the
@@ -206,4 +208,41 @@ enum {
         (((name_len) + offsetof(struct exofs_dir_entry, name)  + \
           EXOFS_DIR_ROUND) & ~EXOFS_DIR_ROUND)
 
+/*
+ * The on-disk (optional) layout structure.
+ * sits in an EXOFS_ATTR_INODE_FILE_LAYOUT or EXOFS_ATTR_INODE_DIR_LAYOUT
+ * attribute, attached to any inode, usually to a directory.
+ */
+
+enum exofs_inode_layout_gen_functions {
+        LAYOUT_MOVING_WINDOW = 0,
+        LAYOUT_IMPLICT = 1,
+};
+
+struct exofs_on_disk_inode_layout {
+        __le16 gen_func; /* One of enum exofs_inode_layout_gen_functions */
+        __le16 pad;
+        union {
+                /* gen_func == LAYOUT_MOVING_WINDOW (default) */
+                struct exofs_layout_sliding_window {
+                        __le32 num_devices; /* first n devices in global-table*/
+                } sliding_window __packed;
+
+                /* gen_func == LAYOUT_IMPLICT */
+                struct exofs_layout_implict_list {
+                        struct exofs_dt_data_map data_map;
+                        /* Variable array of size data_map.cb_num_comps. These
+                         * are device indexes of the devices in the global table
+                         */
+                        __le32 dev_indexes[];
+                } implict __packed;
+        };
+} __packed;
+
+static inline size_t exofs_on_disk_inode_layout_size(unsigned max_devs)
+{
+        return sizeof(struct exofs_on_disk_inode_layout) +
+                max_devs * sizeof(__le32);
+}
+
 #endif /*ifndef __EXOFS_COM_H__*/
diff --git a/fs/exofs/exofs.h b/fs/exofs/exofs.h
index c35fd4623986..54373278a353 100644
--- a/fs/exofs/exofs.h
+++ b/fs/exofs/exofs.h
@@ -35,6 +35,7 @@
 
 #include <linux/fs.h>
 #include <linux/time.h>
+#include <linux/backing-dev.h>
 #include "common.h"
 
 /* FIXME: Remove once pnfs hits mainline
@@ -55,12 +56,28 @@
 /* u64 has problems with printk this will cast it to unsigned long long */
 #define _LLU(x) (unsigned long long)(x)
 
+struct exofs_layout {
+        osd_id          s_pid;                  /* partition ID of file system*/
+
+        /* Our way of looking at the data_map */
+        unsigned stripe_unit;
+        unsigned mirrors_p1;
+
+        unsigned group_width;
+        u64      group_depth;
+        unsigned group_count;
+
+        enum exofs_inode_layout_gen_functions lay_func;
+
+        unsigned        s_numdevs;              /* Num of devices in array    */
+        struct osd_dev  *s_ods[0];              /* Variable length            */
+};
+
 /*
  * our extension to the in-memory superblock
  */
 struct exofs_sb_info {
         struct exofs_fscb s_fscb;               /* Written often, pre-allocate*/
-        osd_id          s_pid;                  /* partition ID of file system*/
         int             s_timeout;              /* timeout for OSD operations */
         uint64_t        s_nextid;               /* highest object ID used     */
         uint32_t        s_numfiles;             /* number of files on fs      */
@@ -69,22 +86,28 @@ struct exofs_sb_info {
         atomic_t        s_curr_pending;         /* number of pending commands */
         uint8_t         s_cred[OSD_CAP_LEN];    /* credential for the fscb    */
 
-        struct pnfs_osd_data_map data_map;      /* Default raid to use        */
-        unsigned        s_numdevs;              /* Num of devices in array    */
-        struct osd_dev  *s_ods[1];              /* Variable length, minimum 1 */
+        struct pnfs_osd_data_map data_map;      /* Default raid to use
+                                                 * FIXME: Needed ?
+                                                 */
+/*      struct exofs_layout     dir_layout;*/   /* Default dir layout */
+        struct exofs_layout     layout;         /* Default files layout,
+                                                 * contains the variable osd_dev
+                                                 * array. Keep last */
+        struct backing_dev_info bdi;
+        struct osd_dev  *_min_one_dev[1];       /* Place holder for one dev   */
 };
 
 /*
  * our extension to the in-memory inode
  */
 struct exofs_i_info {
+        struct inode   vfs_inode;          /* normal in-memory inode          */
+        wait_queue_head_t i_wq;            /* wait queue for inode            */
         unsigned long  i_flags;            /* various atomic flags            */
         uint32_t       i_data[EXOFS_IDATA];/*short symlink names and device #s*/
         uint32_t       i_dir_start_lookup; /* which page to start lookup      */
-        wait_queue_head_t i_wq;            /* wait queue for inode            */
         uint64_t       i_commit_size;      /* the object's written length     */
         uint8_t        i_cred[OSD_CAP_LEN];/* all-powerful credential         */
-        struct inode   vfs_inode;          /* normal in-memory inode          */
 };
 
 static inline osd_id exofs_oi_objno(struct exofs_i_info *oi)
@@ -101,7 +124,7 @@ struct exofs_io_state {
         void                    *private;
         exofs_io_done_fn        done;
 
-        struct exofs_sb_info    *sbi;
+        struct exofs_layout     *layout;
         struct osd_obj_id       obj;
         u8                      *cred;
 
@@ -109,7 +132,11 @@ struct exofs_io_state {
         loff_t                  offset;
         unsigned long           length;
         void                    *kern_buff;
-        struct bio              *bio;
+
+        struct page             **pages;
+        unsigned                nr_pages;
+        unsigned                pgbase;
+        unsigned                pages_consumed;
 
         /* Attributes */
         unsigned                in_attr_len;
@@ -122,6 +149,9 @@ struct exofs_io_state {
         struct exofs_per_dev_state {
                 struct osd_request *or;
                 struct bio *bio;
+                loff_t offset;
+                unsigned length;
+                unsigned dev;
         } per_dev[];
 };
 
@@ -175,6 +205,12 @@ static inline struct exofs_i_info *exofs_i(struct inode *inode)
 }
 
 /*
+ * Given a layout, object_number and stripe_index return the associated global
+ * dev_index
+ */
+unsigned exofs_layout_od_id(struct exofs_layout *layout,
+                            osd_id obj_no, unsigned layout_index);
+/*
  * Maximum count of links to a file
  */
 #define EXOFS_LINK_MAX           32000
@@ -189,7 +225,8 @@ void exofs_make_credential(u8 cred_a[OSD_CAP_LEN],
 int exofs_read_kern(struct osd_dev *od, u8 *cred, struct osd_obj_id *obj,
                     u64 offset, void *p, unsigned length);
 
-int  exofs_get_io_state(struct exofs_sb_info *sbi, struct exofs_io_state** ios);
+int  exofs_get_io_state(struct exofs_layout *layout,
+                        struct exofs_io_state **ios);
 void exofs_put_io_state(struct exofs_io_state *ios);
 
 int exofs_check_io(struct exofs_io_state *ios, u64 *resid);
@@ -226,7 +263,7 @@ int exofs_write_begin(struct file *file, struct address_space *mapping,
                 struct page **pagep, void **fsdata);
 extern struct inode *exofs_iget(struct super_block *, unsigned long);
 struct inode *exofs_new_inode(struct inode *, int);
-extern int exofs_write_inode(struct inode *, int);
+extern int exofs_write_inode(struct inode *, struct writeback_control *wbc);
 extern void exofs_delete_inode(struct inode *);
 
 /* dir.c:                */
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 698a8636d39c..76d2a79ef93e 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -31,6 +31,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <linux/slab.h>
 #include <linux/writeback.h>
 #include <linux/buffer_head.h>
 #include <scsi/scsi_device.h>
@@ -41,16 +42,18 @@
 
 enum { BIO_MAX_PAGES_KMALLOC =
                 (PAGE_SIZE - sizeof(struct bio)) / sizeof(struct bio_vec),
+        MAX_PAGES_KMALLOC =
+                PAGE_SIZE / sizeof(struct page *),
 };
 
 struct page_collect {
         struct exofs_sb_info *sbi;
-        struct request_queue *req_q;
         struct inode *inode;
         unsigned expected_pages;
         struct exofs_io_state *ios;
 
-        struct bio *bio;
+        struct page **pages;
+        unsigned alloc_pages;
         unsigned nr_pages;
         unsigned long length;
         loff_t pg_first; /* keep 64bit also in 32-arches */
@@ -62,15 +65,12 @@ static void _pcol_init(struct page_collect *pcol, unsigned expected_pages,
         struct exofs_sb_info *sbi = inode->i_sb->s_fs_info;
 
         pcol->sbi = sbi;
-        /* Create master bios on first Q, later on cloning, each clone will be
-         * allocated on it's destination Q
-         */
-        pcol->req_q = osd_request_queue(sbi->s_ods[0]);
         pcol->inode = inode;
         pcol->expected_pages = expected_pages;
 
         pcol->ios = NULL;
-        pcol->bio = NULL;
+        pcol->pages = NULL;
+        pcol->alloc_pages = 0;
         pcol->nr_pages = 0;
         pcol->length = 0;
         pcol->pg_first = -1;
@@ -80,7 +80,8 @@ static void _pcol_reset(struct page_collect *pcol)
 {
         pcol->expected_pages -= min(pcol->nr_pages, pcol->expected_pages);
 
-        pcol->bio = NULL;
+        pcol->pages = NULL;
+        pcol->alloc_pages = 0;
         pcol->nr_pages = 0;
         pcol->length = 0;
         pcol->pg_first = -1;
@@ -90,38 +91,43 @@ static void _pcol_reset(struct page_collect *pcol)
          * it might not end here. don't be left with nothing
          */
         if (!pcol->expected_pages)
-                pcol->expected_pages = BIO_MAX_PAGES_KMALLOC;
+                pcol->expected_pages = MAX_PAGES_KMALLOC;
 }
 
 static int pcol_try_alloc(struct page_collect *pcol)
 {
-        int pages = min_t(unsigned, pcol->expected_pages,
-                          BIO_MAX_PAGES_KMALLOC);
+        unsigned pages = min_t(unsigned, pcol->expected_pages,
+                          MAX_PAGES_KMALLOC);
 
         if (!pcol->ios) { /* First time allocate io_state */
-                int ret = exofs_get_io_state(pcol->sbi, &pcol->ios);
+                int ret = exofs_get_io_state(&pcol->sbi->layout, &pcol->ios);
 
                 if (ret)
                         return ret;
         }
 
+        /* TODO: easily support bio chaining */
+        pages =  min_t(unsigned, pages,
+                       pcol->sbi->layout.group_width * BIO_MAX_PAGES_KMALLOC);
+
         for (; pages; pages >>= 1) {
-                pcol->bio = bio_kmalloc(GFP_KERNEL, pages);
-                if (likely(pcol->bio))
+                pcol->pages = kmalloc(pages * sizeof(struct page *),
+                                      GFP_KERNEL);
+                if (likely(pcol->pages)) {
+                        pcol->alloc_pages = pages;
                         return 0;
+                }
         }
 
-        EXOFS_ERR("Failed to bio_kmalloc expected_pages=%u\n",
+        EXOFS_ERR("Failed to kmalloc expected_pages=%u\n",
                   pcol->expected_pages);
         return -ENOMEM;
 }
 
 static void pcol_free(struct page_collect *pcol)
 {
-        if (pcol->bio) {
-                bio_put(pcol->bio);
-                pcol->bio = NULL;
-        }
+        kfree(pcol->pages);
+        pcol->pages = NULL;
 
         if (pcol->ios) {
                 exofs_put_io_state(pcol->ios);
@@ -132,11 +138,10 @@ static void pcol_free(struct page_collect *pcol)
 static int pcol_add_page(struct page_collect *pcol, struct page *page,
                          unsigned len)
 {
-        int added_len = bio_add_pc_page(pcol->req_q, pcol->bio, page, len, 0);
-        if (unlikely(len != added_len))
+        if (unlikely(pcol->nr_pages >= pcol->alloc_pages))
                 return -ENOMEM;
 
-        ++pcol->nr_pages;
+        pcol->pages[pcol->nr_pages++] = page;
         pcol->length += len;
         return 0;
 }
@@ -181,7 +186,6 @@ static void update_write_page(struct page *page, int ret)
  */
 static int __readpages_done(struct page_collect *pcol, bool do_unlock)
 {
-        struct bio_vec *bvec;
         int i;
         u64 resid;
         u64 good_bytes;
@@ -193,13 +197,13 @@ static int __readpages_done(struct page_collect *pcol, bool do_unlock)
         else
                 good_bytes = pcol->length - resid;
 
-        EXOFS_DBGMSG("readpages_done(0x%lx) good_bytes=0x%llx"
+        EXOFS_DBGMSG2("readpages_done(0x%lx) good_bytes=0x%llx"
                      " length=0x%lx nr_pages=%u\n",
                      pcol->inode->i_ino, _LLU(good_bytes), pcol->length,
                      pcol->nr_pages);
 
-        __bio_for_each_segment(bvec, pcol->bio, i, 0) {
-                struct page *page = bvec->bv_page;
+        for (i = 0; i < pcol->nr_pages; i++) {
+                struct page *page = pcol->pages[i];
                 struct inode *inode = page->mapping->host;
                 int page_stat;
 
@@ -218,11 +222,11 @@ static int __readpages_done(struct page_collect *pcol, bool do_unlock)
                 ret = update_read_page(page, page_stat);
                 if (do_unlock)
                         unlock_page(page);
-                length += bvec->bv_len;
+                length += PAGE_SIZE;
         }
 
         pcol_free(pcol);
-        EXOFS_DBGMSG("readpages_done END\n");
+        EXOFS_DBGMSG2("readpages_done END\n");
         return ret;
 }
 
@@ -238,11 +242,10 @@ static void readpages_done(struct exofs_io_state *ios, void *p)
 
 static void _unlock_pcol_pages(struct page_collect *pcol, int ret, int rw)
 {
-        struct bio_vec *bvec;
         int i;
 
-        __bio_for_each_segment(bvec, pcol->bio, i, 0) {
-                struct page *page = bvec->bv_page;
+        for (i = 0; i < pcol->nr_pages; i++) {
+                struct page *page = pcol->pages[i];
 
                 if (rw == READ)
                         update_read_page(page, ret);
@@ -260,13 +263,14 @@ static int read_exec(struct page_collect *pcol, bool is_sync)
         struct page_collect *pcol_copy = NULL;
         int ret;
 
-        if (!pcol->bio)
+        if (!pcol->pages)
                 return 0;
 
         /* see comment in _readpage() about sync reads */
         WARN_ON(is_sync && (pcol->nr_pages != 1));
 
-        ios->bio = pcol->bio;
+        ios->pages = pcol->pages;
+        ios->nr_pages = pcol->nr_pages;
         ios->length = pcol->length;
         ios->offset = pcol->pg_first << PAGE_CACHE_SHIFT;
 
@@ -290,7 +294,7 @@ static int read_exec(struct page_collect *pcol, bool is_sync)
 
         atomic_inc(&pcol->sbi->s_curr_pending);
 
-        EXOFS_DBGMSG("read_exec obj=0x%llx start=0x%llx length=0x%lx\n",
+        EXOFS_DBGMSG2("read_exec obj=0x%llx start=0x%llx length=0x%lx\n",
                   ios->obj.id, _LLU(ios->offset), pcol->length);
 
         /* pages ownership was passed to pcol_copy */
@@ -366,7 +370,7 @@ try_again:
                 goto try_again;
         }
 
-        if (!pcol->bio) {
+        if (!pcol->pages) {
                 ret = pcol_try_alloc(pcol);
                 if (unlikely(ret))
                         goto fail;
@@ -448,7 +452,6 @@ static int exofs_readpage(struct file *file, struct page *page)
 static void writepages_done(struct exofs_io_state *ios, void *p)
 {
         struct page_collect *pcol = p;
-        struct bio_vec *bvec;
         int i;
         u64 resid;
         u64  good_bytes;
@@ -462,13 +465,13 @@ static void writepages_done(struct exofs_io_state *ios, void *p)
         else
                 good_bytes = pcol->length - resid;
 
-        EXOFS_DBGMSG("writepages_done(0x%lx) good_bytes=0x%llx"
+        EXOFS_DBGMSG2("writepages_done(0x%lx) good_bytes=0x%llx"
                      " length=0x%lx nr_pages=%u\n",
                      pcol->inode->i_ino, _LLU(good_bytes), pcol->length,
                      pcol->nr_pages);
 
-        __bio_for_each_segment(bvec, pcol->bio, i, 0) {
-                struct page *page = bvec->bv_page;
+        for (i = 0; i < pcol->nr_pages; i++) {
+                struct page *page = pcol->pages[i];
                 struct inode *inode = page->mapping->host;
                 int page_stat;
 
@@ -485,12 +488,12 @@ static void writepages_done(struct exofs_io_state *ios, void *p)
                 EXOFS_DBGMSG2("    writepages_done(0x%lx, 0x%lx) status=%d\n",
                              inode->i_ino, page->index, page_stat);
 
-                length += bvec->bv_len;
+                length += PAGE_SIZE;
         }
 
         pcol_free(pcol);
         kfree(pcol);
-        EXOFS_DBGMSG("writepages_done END\n");
+        EXOFS_DBGMSG2("writepages_done END\n");
 }
 
 static int write_exec(struct page_collect *pcol)
@@ -500,7 +503,7 @@ static int write_exec(struct page_collect *pcol)
         struct page_collect *pcol_copy = NULL;
         int ret;
 
-        if (!pcol->bio)
+        if (!pcol->pages)
                 return 0;
 
         pcol_copy = kmalloc(sizeof(*pcol_copy), GFP_KERNEL);
@@ -512,9 +515,8 @@ static int write_exec(struct page_collect *pcol)
 
         *pcol_copy = *pcol;
 
-        pcol_copy->bio->bi_rw |= (1 << BIO_RW); /* FIXME: bio_set_dir() */
-
-        ios->bio = pcol_copy->bio;
+        ios->pages = pcol_copy->pages;
+        ios->nr_pages = pcol_copy->nr_pages;
         ios->offset = pcol_copy->pg_first << PAGE_CACHE_SHIFT;
         ios->length = pcol_copy->length;
         ios->done = writepages_done;
@@ -527,7 +529,7 @@ static int write_exec(struct page_collect *pcol)
         }
 
         atomic_inc(&pcol->sbi->s_curr_pending);
-        EXOFS_DBGMSG("write_exec(0x%lx, 0x%llx) start=0x%llx length=0x%lx\n",
+        EXOFS_DBGMSG2("write_exec(0x%lx, 0x%llx) start=0x%llx length=0x%lx\n",
                   pcol->inode->i_ino, pcol->pg_first, _LLU(ios->offset),
                   pcol->length);
         /* pages ownership was passed to pcol_copy */
@@ -605,7 +607,7 @@ try_again:
                 goto try_again;
         }
 
-        if (!pcol->bio) {
+        if (!pcol->pages) {
                 ret = pcol_try_alloc(pcol);
                 if (unlikely(ret))
                         goto fail;
@@ -616,7 +618,7 @@ try_again:
 
         ret = pcol_add_page(pcol, page, len);
         if (unlikely(ret)) {
-                EXOFS_DBGMSG("Failed pcol_add_page "
+                EXOFS_DBGMSG2("Failed pcol_add_page "
                              "nr_pages=%u total_length=0x%lx\n",
                              pcol->nr_pages, pcol->length);
 
@@ -663,7 +665,7 @@ static int exofs_writepages(struct address_space *mapping,
         if (expected_pages < 32L)
                 expected_pages = 32L;
 
-        EXOFS_DBGMSG("inode(0x%lx) wbc->start=0x%llx wbc->end=0x%llx "
+        EXOFS_DBGMSG2("inode(0x%lx) wbc->start=0x%llx wbc->end=0x%llx "
                      "nrpages=%lu start=0x%lx end=0x%lx expected_pages=%ld\n",
                      mapping->host->i_ino, wbc->range_start, wbc->range_end,
                      mapping->nrpages, start, end, expected_pages);
@@ -738,13 +740,28 @@ static int exofs_write_begin_export(struct file *file,
                                         fsdata);
 }
 
+static int exofs_write_end(struct file *file, struct address_space *mapping,
+                        loff_t pos, unsigned len, unsigned copied,
+                        struct page *page, void *fsdata)
+{
+        struct inode *inode = mapping->host;
+        /* According to comment in simple_write_end i_mutex is held */
+        loff_t i_size = inode->i_size;
+        int ret;
+
+        ret = simple_write_end(file, mapping,pos, len, copied, page, fsdata);
+        if (i_size != inode->i_size)
+                mark_inode_dirty(inode);
+        return ret;
+}
+
 const struct address_space_operations exofs_aops = {
         .readpage       = exofs_readpage,
         .readpages      = exofs_readpages,
         .writepage      = exofs_writepage,
         .writepages     = exofs_writepages,
         .write_begin    = exofs_write_begin_export,
-        .write_end      = simple_write_end,
+        .write_end      = exofs_write_end,
 };
 
 /******************************************************************************
@@ -844,20 +861,33 @@ int exofs_setattr(struct dentry *dentry, struct iattr *iattr)
         return error;
 }
 
+static const struct osd_attr g_attr_inode_file_layout = ATTR_DEF(
+        EXOFS_APAGE_FS_DATA,
+        EXOFS_ATTR_INODE_FILE_LAYOUT,
+        0);
+static const struct osd_attr g_attr_inode_dir_layout = ATTR_DEF(
+        EXOFS_APAGE_FS_DATA,
+        EXOFS_ATTR_INODE_DIR_LAYOUT,
+        0);
+
 /*
- * Read an inode from the OSD, and return it as is.  We also return the size
- * attribute in the 'obj_size' argument.
+ * Read the Linux inode info from the OSD, and return it as is. In exofs the
+ * inode info is in an application specific page/attribute of the osd-object.
  */
 static int exofs_get_inode(struct super_block *sb, struct exofs_i_info *oi,
-                    struct exofs_fcb *inode, uint64_t *obj_size)
+                    struct exofs_fcb *inode)
 {
         struct exofs_sb_info *sbi = sb->s_fs_info;
-        struct osd_attr attrs[2];
+        struct osd_attr attrs[] = {
+                [0] = g_attr_inode_data,
+                [1] = g_attr_inode_file_layout,
+                [2] = g_attr_inode_dir_layout,
+        };
         struct exofs_io_state *ios;
+        struct exofs_on_disk_inode_layout *layout;
         int ret;
 
-        *obj_size = ~0;
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("%s: exofs_get_io_state failed.\n", __func__);
                 return ret;
@@ -867,14 +897,25 @@ static int exofs_get_inode(struct super_block *sb, struct exofs_i_info *oi,
         exofs_make_credential(oi->i_cred, &ios->obj);
         ios->cred = oi->i_cred;
 
-        attrs[0] = g_attr_inode_data;
-        attrs[1] = g_attr_logical_length;
+        attrs[1].len = exofs_on_disk_inode_layout_size(sbi->layout.s_numdevs);
+        attrs[2].len = exofs_on_disk_inode_layout_size(sbi->layout.s_numdevs);
+
         ios->in_attr = attrs;
         ios->in_attr_len = ARRAY_SIZE(attrs);
 
         ret = exofs_sbi_read(ios);
-        if (ret)
+        if (unlikely(ret)) {
+                EXOFS_ERR("object(0x%llx) corrupted, return empty file=>%d\n",
+                          _LLU(ios->obj.id), ret);
+                memset(inode, 0, sizeof(*inode));
+                inode->i_mode = 0040000 | (0777 & ~022);
+                /* If object is lost on target we might as well enable it's
+                 * delete.
+                 */
+                if ((ret == -ENOENT) || (ret == -EINVAL))
+                        ret = 0;
                 goto out;
+        }
 
         ret = extract_attr_from_ios(ios, &attrs[0]);
         if (ret) {
@@ -886,11 +927,33 @@ static int exofs_get_inode(struct super_block *sb, struct exofs_i_info *oi,
 
         ret = extract_attr_from_ios(ios, &attrs[1]);
         if (ret) {
-                EXOFS_ERR("%s: extract_attr of logical_length failed\n",
-                          __func__);
+                EXOFS_ERR("%s: extract_attr of inode_data failed\n", __func__);
                 goto out;
         }
-        *obj_size = get_unaligned_be64(attrs[1].val_ptr);
+        if (attrs[1].len) {
+                layout = attrs[1].val_ptr;
+                if (layout->gen_func != cpu_to_le16(LAYOUT_MOVING_WINDOW)) {
+                        EXOFS_ERR("%s: unsupported files layout %d\n",
+                                __func__, layout->gen_func);
+                        ret = -ENOTSUPP;
+                        goto out;
+                }
+        }
+
+        ret = extract_attr_from_ios(ios, &attrs[2]);
+        if (ret) {
+                EXOFS_ERR("%s: extract_attr of inode_data failed\n", __func__);
+                goto out;
+        }
+        if (attrs[2].len) {
+                layout = attrs[2].val_ptr;
+                if (layout->gen_func != cpu_to_le16(LAYOUT_MOVING_WINDOW)) {
+                        EXOFS_ERR("%s: unsupported meta-data layout %d\n",
+                                __func__, layout->gen_func);
+                        ret = -ENOTSUPP;
+                        goto out;
+                }
+        }
 
 out:
         exofs_put_io_state(ios);
@@ -910,7 +973,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
         struct exofs_i_info *oi;
         struct exofs_fcb fcb;
         struct inode *inode;
-        uint64_t obj_size;
         int ret;
 
         inode = iget_locked(sb, ino);
@@ -922,7 +984,7 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
         __oi_init(oi);
 
         /* read the inode from the osd */
-        ret = exofs_get_inode(sb, oi, &fcb, &obj_size);
+        ret = exofs_get_inode(sb, oi, &fcb);
         if (ret)
                 goto bad_inode;
 
@@ -943,13 +1005,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
         inode->i_blkbits = EXOFS_BLKSHIFT;
         inode->i_generation = le32_to_cpu(fcb.i_generation);
 
-        if ((inode->i_size != obj_size) &&
-                (!exofs_inode_is_fast_symlink(inode))) {
-                EXOFS_ERR("WARNING: Size of inode=%llu != object=%llu\n",
-                          inode->i_size, _LLU(obj_size));
-                /* FIXME: call exofs_inode_recovery() */
-        }
-
         oi->i_dir_start_lookup = 0;
 
         if ((inode->i_nlink == 0) && (inode->i_mode == 0)) {
@@ -1028,7 +1083,7 @@ static void create_done(struct exofs_io_state *ios, void *p)
 
         if (unlikely(ret)) {
                 EXOFS_ERR("object=0x%llx creation faild in pid=0x%llx",
-                          _LLU(exofs_oi_objno(oi)), _LLU(sbi->s_pid));
+                          _LLU(exofs_oi_objno(oi)), _LLU(sbi->layout.s_pid));
                 /*TODO: When FS is corrupted creation can fail, object already
                  * exist. Get rid of this asynchronous creation, if exist
                  * increment the obj counter and try the next object. Until we
@@ -1089,7 +1144,7 @@ struct inode *exofs_new_inode(struct inode *dir, int mode)
 
         mark_inode_dirty(inode);
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("exofs_new_inode: exofs_get_io_state failed\n");
                 return ERR_PTR(ret);
@@ -1155,8 +1210,10 @@ static int exofs_update_inode(struct inode *inode, int do_sync)
         int ret;
 
         args = kzalloc(sizeof(*args), GFP_KERNEL);
-        if (!args)
+        if (!args) {
+                EXOFS_DBGMSG("Faild kzalloc of args\n");
                 return -ENOMEM;
+        }
 
         fcb = &args->fcb;
 
@@ -1185,7 +1242,7 @@ static int exofs_update_inode(struct inode *inode, int do_sync)
         } else
                 memcpy(fcb->i_data, oi->i_data, sizeof(fcb->i_data));
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("%s: exofs_get_io_state failed.\n", __func__);
                 goto free_args;
@@ -1219,13 +1276,14 @@ static int exofs_update_inode(struct inode *inode, int do_sync)
 free_args:
         kfree(args);
 out:
-        EXOFS_DBGMSG("ret=>%d\n", ret);
+        EXOFS_DBGMSG("(0x%lx) do_sync=%d ret=>%d\n",
+                     inode->i_ino, do_sync, ret);
         return ret;
 }
 
-int exofs_write_inode(struct inode *inode, int wait)
+int exofs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
-        return exofs_update_inode(inode, wait);
+        return exofs_update_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
 }
 
 /*
@@ -1268,7 +1326,7 @@ void exofs_delete_inode(struct inode *inode)
 
         clear_inode(inode);
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("%s: exofs_get_io_state failed\n", __func__);
                 return;
diff --git a/fs/exofs/ios.c b/fs/exofs/ios.c
index 5bad01fa1f9f..4337cad7777b 100644
--- a/fs/exofs/ios.c
+++ b/fs/exofs/ios.c
@@ -22,10 +22,15 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#include <linux/slab.h>
 #include <scsi/scsi_device.h>
+#include <asm/div64.h>
 
 #include "exofs.h"
 
+#define EXOFS_DBGMSG2(M...) do {} while (0)
+/* #define EXOFS_DBGMSG2 EXOFS_DBGMSG */
+
 void exofs_make_credential(u8 cred_a[OSD_CAP_LEN], const struct osd_obj_id *obj)
 {
         osd_sec_init_nosec_doall_caps(cred_a, obj, false, true);
@@ -64,21 +69,24 @@ out:
         return ret;
 }
 
-int exofs_get_io_state(struct exofs_sb_info *sbi, struct exofs_io_state** pios)
+int exofs_get_io_state(struct exofs_layout *layout,
+                       struct exofs_io_state **pios)
 {
         struct exofs_io_state *ios;
 
         /*TODO: Maybe use kmem_cach per sbi of size
-         * exofs_io_state_size(sbi->s_numdevs)
+         * exofs_io_state_size(layout->s_numdevs)
          */
-        ios = kzalloc(exofs_io_state_size(sbi->s_numdevs), GFP_KERNEL);
+        ios = kzalloc(exofs_io_state_size(layout->s_numdevs), GFP_KERNEL);
         if (unlikely(!ios)) {
+                EXOFS_DBGMSG("Faild kzalloc bytes=%d\n",
+                             exofs_io_state_size(layout->s_numdevs));
                 *pios = NULL;
                 return -ENOMEM;
         }
 
-        ios->sbi = sbi;
-        ios->obj.partition = sbi->s_pid;
+        ios->layout = layout;
+        ios->obj.partition = layout->s_pid;
         *pios = ios;
         return 0;
 }
@@ -101,6 +109,29 @@ void exofs_put_io_state(struct exofs_io_state *ios)
         }
 }
 
+unsigned exofs_layout_od_id(struct exofs_layout *layout,
+                            osd_id obj_no, unsigned layout_index)
+{
+/*      switch (layout->lay_func) {
+        case LAYOUT_MOVING_WINDOW:
+        {*/
+                unsigned dev_mod = obj_no;
+
+                return (layout_index + dev_mod * layout->mirrors_p1) %
+                                                              layout->s_numdevs;
+/*      }
+        case LAYOUT_FUNC_IMPLICT:
+                return layout->devs[layout_index];
+        }*/
+}
+
+static inline struct osd_dev *exofs_ios_od(struct exofs_io_state *ios,
+                                           unsigned layout_index)
+{
+        return ios->layout->s_ods[
+                exofs_layout_od_id(ios->layout, ios->obj.id, layout_index)];
+}
+
 static void _sync_done(struct exofs_io_state *ios, void *p)
 {
         struct completion *waiting = p;
@@ -168,6 +199,21 @@ static int exofs_io_execute(struct exofs_io_state *ios)
         return ret;
 }
 
+static void _clear_bio(struct bio *bio)
+{
+        struct bio_vec *bv;
+        unsigned i;
+
+        __bio_for_each_segment(bv, bio, i, 0) {
+                unsigned this_count = bv->bv_len;
+
+                if (likely(PAGE_SIZE == this_count))
+                        clear_highpage(bv->bv_page);
+                else
+                        zero_user(bv->bv_page, bv->bv_offset, this_count);
+        }
+}
+
 int exofs_check_io(struct exofs_io_state *ios, u64 *resid)
 {
         enum osd_err_priority acumulated_osd_err = 0;
@@ -176,16 +222,25 @@ int exofs_check_io(struct exofs_io_state *ios, u64 *resid)
 
         for (i = 0; i < ios->numdevs; i++) {
                 struct osd_sense_info osi;
-                int ret = osd_req_decode_sense(ios->per_dev[i].or, &osi);
+                struct osd_request *or = ios->per_dev[i].or;
+                int ret;
+
+                if (unlikely(!or))
+                        continue;
 
+                ret = osd_req_decode_sense(or, &osi);
                 if (likely(!ret))
                         continue;
 
-                if (unlikely(ret == -EFAULT)) {
-                        EXOFS_DBGMSG("%s: EFAULT Need page clear\n", __func__);
-                        /*FIXME: All the pages in this device range should:
-                         *      clear_highpage(page);
-                         */
+                if (OSD_ERR_PRI_CLEAR_PAGES == osi.osd_err_pri) {
+                        /* start read offset passed endof file */
+                        _clear_bio(ios->per_dev[i].bio);
+                        EXOFS_DBGMSG("start read offset passed end of file "
+                                "offset=0x%llx, length=0x%llx\n",
+                                _LLU(ios->per_dev[i].offset),
+                                _LLU(ios->per_dev[i].length));
+
+                        continue; /* we recovered */
                 }
 
                 if (osi.osd_err_pri >= acumulated_osd_err) {
@@ -205,14 +260,259 @@ int exofs_check_io(struct exofs_io_state *ios, u64 *resid)
         return acumulated_lin_err;
 }
 
+/*
+ * L - logical offset into the file
+ *
+ * U - The number of bytes in a stripe within a group
+ *
+ *      U = stripe_unit * group_width
+ *
+ * T - The number of bytes striped within a group of component objects
+ *     (before advancing to the next group)
+ *
+ *      T = stripe_unit * group_width * group_depth
+ *
+ * S - The number of bytes striped across all component objects
+ *     before the pattern repeats
+ *
+ *      S = stripe_unit * group_width * group_depth * group_count
+ *
+ * M - The "major" (i.e., across all components) stripe number
+ *
+ *      M = L / S
+ *
+ * G - Counts the groups from the beginning of the major stripe
+ *
+ *      G = (L - (M * S)) / T   [or (L % S) / T]
+ *
+ * H - The byte offset within the group
+ *
+ *      H = (L - (M * S)) % T   [or (L % S) % T]
+ *
+ * N - The "minor" (i.e., across the group) stripe number
+ *
+ *      N = H / U
+ *
+ * C - The component index coresponding to L
+ *
+ *      C = (H - (N * U)) / stripe_unit + G * group_width
+ *      [or (L % U) / stripe_unit + G * group_width]
+ *
+ * O - The component offset coresponding to L
+ *
+ *      O = L % stripe_unit + N * stripe_unit + M * group_depth * stripe_unit
+ */
+struct _striping_info {
+        u64 obj_offset;
+        u64 group_length;
+        u64 total_group_length;
+        u64 Major;
+        unsigned dev;
+        unsigned unit_off;
+};
+
+static void _calc_stripe_info(struct exofs_io_state *ios, u64 file_offset,
+                              struct _striping_info *si)
+{
+        u32     stripe_unit = ios->layout->stripe_unit;
+        u32     group_width = ios->layout->group_width;
+        u64     group_depth = ios->layout->group_depth;
+
+        u32     U = stripe_unit * group_width;
+        u64     T = U * group_depth;
+        u64     S = T * ios->layout->group_count;
+        u64     M = div64_u64(file_offset, S);
+
+        /*
+        G = (L - (M * S)) / T
+        H = (L - (M * S)) % T
+        */
+        u64     LmodS = file_offset - M * S;
+        u32     G = div64_u64(LmodS, T);
+        u64     H = LmodS - G * T;
+
+        u32     N = div_u64(H, U);
+
+        /* "H - (N * U)" is just "H % U" so it's bound to u32 */
+        si->dev = (u32)(H - (N * U)) / stripe_unit + G * group_width;
+        si->dev *= ios->layout->mirrors_p1;
+
+        div_u64_rem(file_offset, stripe_unit, &si->unit_off);
+
+        si->obj_offset = si->unit_off + (N * stripe_unit) +
+                                  (M * group_depth * stripe_unit);
+
+        si->group_length = T - H;
+        si->total_group_length = T;
+        si->Major = M;
+}
+
+static int _add_stripe_unit(struct exofs_io_state *ios,  unsigned *cur_pg,
+                unsigned pgbase, struct exofs_per_dev_state *per_dev,
+                int cur_len)
+{
+        unsigned pg = *cur_pg;
+        struct request_queue *q =
+                        osd_request_queue(exofs_ios_od(ios, per_dev->dev));
+
+        per_dev->length += cur_len;
+
+        if (per_dev->bio == NULL) {
+                unsigned pages_in_stripe = ios->layout->group_width *
+                                        (ios->layout->stripe_unit / PAGE_SIZE);
+                unsigned bio_size = (ios->nr_pages + pages_in_stripe) /
+                                                ios->layout->group_width;
+
+                per_dev->bio = bio_kmalloc(GFP_KERNEL, bio_size);
+                if (unlikely(!per_dev->bio)) {
+                        EXOFS_DBGMSG("Faild to allocate BIO size=%u\n",
+                                     bio_size);
+                        return -ENOMEM;
+                }
+        }
+
+        while (cur_len > 0) {
+                unsigned pglen = min_t(unsigned, PAGE_SIZE - pgbase, cur_len);
+                unsigned added_len;
+
+                BUG_ON(ios->nr_pages <= pg);
+                cur_len -= pglen;
+
+                added_len = bio_add_pc_page(q, per_dev->bio, ios->pages[pg],
+                                            pglen, pgbase);
+                if (unlikely(pglen != added_len))
+                        return -ENOMEM;
+                pgbase = 0;
+                ++pg;
+        }
+        BUG_ON(cur_len);
+
+        *cur_pg = pg;
+        return 0;
+}
+
+static int _prepare_one_group(struct exofs_io_state *ios, u64 length,
+                              struct _striping_info *si, unsigned first_comp)
+{
+        unsigned stripe_unit = ios->layout->stripe_unit;
+        unsigned mirrors_p1 = ios->layout->mirrors_p1;
+        unsigned devs_in_group = ios->layout->group_width * mirrors_p1;
+        unsigned dev = si->dev;
+        unsigned first_dev = dev - (dev % devs_in_group);
+        unsigned comp = first_comp + (dev - first_dev);
+        unsigned max_comp = ios->numdevs ? ios->numdevs - mirrors_p1 : 0;
+        unsigned cur_pg = ios->pages_consumed;
+        int ret = 0;
+
+        while (length) {
+                struct exofs_per_dev_state *per_dev = &ios->per_dev[comp];
+                unsigned cur_len, page_off = 0;
+
+                if (!per_dev->length) {
+                        per_dev->dev = dev;
+                        if (dev < si->dev) {
+                                per_dev->offset = si->obj_offset + stripe_unit -
+                                                                   si->unit_off;
+                                cur_len = stripe_unit;
+                        } else if (dev == si->dev) {
+                                per_dev->offset = si->obj_offset;
+                                cur_len = stripe_unit - si->unit_off;
+                                page_off = si->unit_off & ~PAGE_MASK;
+                                BUG_ON(page_off && (page_off != ios->pgbase));
+                        } else { /* dev > si->dev */
+                                per_dev->offset = si->obj_offset - si->unit_off;
+                                cur_len = stripe_unit;
+                        }
+
+                        if (max_comp < comp)
+                                max_comp = comp;
+
+                        dev += mirrors_p1;
+                        dev = (dev % devs_in_group) + first_dev;
+                } else {
+                        cur_len = stripe_unit;
+                }
+                if (cur_len >= length)
+                        cur_len = length;
+
+                ret = _add_stripe_unit(ios, &cur_pg, page_off , per_dev,
+                                       cur_len);
+                if (unlikely(ret))
+                        goto out;
+
+                comp += mirrors_p1;
+                comp = (comp % devs_in_group) + first_comp;
+
+                length -= cur_len;
+        }
+out:
+        ios->numdevs = max_comp + mirrors_p1;
+        ios->pages_consumed = cur_pg;
+        return ret;
+}
+
+static int _prepare_for_striping(struct exofs_io_state *ios)
+{
+        u64 length = ios->length;
+        struct _striping_info si;
+        unsigned devs_in_group = ios->layout->group_width *
+                                 ios->layout->mirrors_p1;
+        unsigned first_comp = 0;
+        int ret = 0;
+
+        _calc_stripe_info(ios, ios->offset, &si);
+
+        if (!ios->pages) {
+                if (ios->kern_buff) {
+                        struct exofs_per_dev_state *per_dev = &ios->per_dev[0];
+
+                        per_dev->offset = si.obj_offset;
+                        per_dev->dev = si.dev;
+
+                        /* no cross device without page array */
+                        BUG_ON((ios->layout->group_width > 1) &&
+                               (si.unit_off + ios->length >
+                                ios->layout->stripe_unit));
+                }
+                ios->numdevs = ios->layout->mirrors_p1;
+                return 0;
+        }
+
+        while (length) {
+                if (length < si.group_length)
+                        si.group_length = length;
+
+                ret = _prepare_one_group(ios, si.group_length, &si, first_comp);
+                if (unlikely(ret))
+                        goto out;
+
+                length -= si.group_length;
+
+                si.group_length = si.total_group_length;
+                si.unit_off = 0;
+                ++si.Major;
+                si.obj_offset = si.Major * ios->layout->stripe_unit *
+                                                ios->layout->group_depth;
+
+                si.dev = (si.dev - (si.dev % devs_in_group)) + devs_in_group;
+                si.dev %= ios->layout->s_numdevs;
+
+                first_comp += devs_in_group;
+                first_comp %= ios->layout->s_numdevs;
+        }
+
+out:
+        return ret;
+}
+
 int exofs_sbi_create(struct exofs_io_state *ios)
 {
         int i, ret;
 
-        for (i = 0; i < ios->sbi->s_numdevs; i++) {
+        for (i = 0; i < ios->layout->s_numdevs; i++) {
                 struct osd_request *or;
 
-                or = osd_start_request(ios->sbi->s_ods[i], GFP_KERNEL);
+                or = osd_start_request(exofs_ios_od(ios, i), GFP_KERNEL);
                 if (unlikely(!or)) {
                         EXOFS_ERR("%s: osd_start_request failed\n", __func__);
                         ret = -ENOMEM;
@@ -233,10 +533,10 @@ int exofs_sbi_remove(struct exofs_io_state *ios)
 {
         int i, ret;
 
-        for (i = 0; i < ios->sbi->s_numdevs; i++) {
+        for (i = 0; i < ios->layout->s_numdevs; i++) {
                 struct osd_request *or;
 
-                or = osd_start_request(ios->sbi->s_ods[i], GFP_KERNEL);
+                or = osd_start_request(exofs_ios_od(ios, i), GFP_KERNEL);
                 if (unlikely(!or)) {
                         EXOFS_ERR("%s: osd_start_request failed\n", __func__);
                         ret = -ENOMEM;
@@ -253,51 +553,74 @@ out:
         return ret;
 }
 
-int exofs_sbi_write(struct exofs_io_state *ios)
+static int _sbi_write_mirror(struct exofs_io_state *ios, int cur_comp)
 {
-        int i, ret;
+        struct exofs_per_dev_state *master_dev = &ios->per_dev[cur_comp];
+        unsigned dev = ios->per_dev[cur_comp].dev;
+        unsigned last_comp = cur_comp + ios->layout->mirrors_p1;
+        int ret = 0;
 
-        for (i = 0; i < ios->sbi->s_numdevs; i++) {
+        if (ios->pages && !master_dev->length)
+                return 0; /* Just an empty slot */
+
+        for (; cur_comp < last_comp; ++cur_comp, ++dev) {
+                struct exofs_per_dev_state *per_dev = &ios->per_dev[cur_comp];
                 struct osd_request *or;
 
-                or = osd_start_request(ios->sbi->s_ods[i], GFP_KERNEL);
+                or = osd_start_request(exofs_ios_od(ios, dev), GFP_KERNEL);
                 if (unlikely(!or)) {
                         EXOFS_ERR("%s: osd_start_request failed\n", __func__);
                         ret = -ENOMEM;
                         goto out;
                 }
-                ios->per_dev[i].or = or;
-                ios->numdevs++;
+                per_dev->or = or;
+                per_dev->offset = master_dev->offset;
 
-                if (ios->bio) {
+                if (ios->pages) {
                         struct bio *bio;
 
-                        if (i != 0) {
+                        if (per_dev != master_dev) {
                                 bio = bio_kmalloc(GFP_KERNEL,
-                                                  ios->bio->bi_max_vecs);
+                                                  master_dev->bio->bi_max_vecs);
                                 if (unlikely(!bio)) {
+                                        EXOFS_DBGMSG(
+                                              "Faild to allocate BIO size=%u\n",
+                                              master_dev->bio->bi_max_vecs);
                                         ret = -ENOMEM;
                                         goto out;
                                 }
 
-                                __bio_clone(bio, ios->bio);
+                                __bio_clone(bio, master_dev->bio);
                                 bio->bi_bdev = NULL;
                                 bio->bi_next = NULL;
-                                ios->per_dev[i].bio =  bio;
+                                per_dev->length = master_dev->length;
+                                per_dev->bio =  bio;
+                                per_dev->dev = dev;
                         } else {
-                                bio = ios->bio;
+                                bio = master_dev->bio;
+                                /* FIXME: bio_set_dir() */
+                                bio->bi_rw |= (1 << BIO_RW);
                         }
 
-                        osd_req_write(or, &ios->obj, ios->offset, bio,
-                                      ios->length);
-/*                      EXOFS_DBGMSG("write sync=%d\n", sync);*/
+                        osd_req_write(or, &ios->obj, per_dev->offset, bio,
+                                      per_dev->length);
+                        EXOFS_DBGMSG("write(0x%llx) offset=0x%llx "
+                                      "length=0x%llx dev=%d\n",
+                                     _LLU(ios->obj.id), _LLU(per_dev->offset),
+                                     _LLU(per_dev->length), dev);
                 } else if (ios->kern_buff) {
-                        osd_req_write_kern(or, &ios->obj, ios->offset,
+                        ret = osd_req_write_kern(or, &ios->obj, per_dev->offset,
                                            ios->kern_buff, ios->length);
-/*                      EXOFS_DBGMSG("write_kern sync=%d\n", sync);*/
+                        if (unlikely(ret))
+                                goto out;
+                        EXOFS_DBGMSG2("write_kern(0x%llx) offset=0x%llx "
+                                      "length=0x%llx dev=%d\n",
+                                     _LLU(ios->obj.id), _LLU(per_dev->offset),
+                                     _LLU(ios->length), dev);
                 } else {
                         osd_req_set_attributes(or, &ios->obj);
-/*                      EXOFS_DBGMSG("set_attributes sync=%d\n", sync);*/
+                        EXOFS_DBGMSG2("obj(0x%llx) set_attributes=%d dev=%d\n",
+                                     _LLU(ios->obj.id), ios->out_attr_len, dev);
                 }
 
                 if (ios->out_attr)
@@ -308,54 +631,93 @@ int exofs_sbi_write(struct exofs_io_state *ios)
                         osd_req_add_get_attr_list(or, ios->in_attr,
                                                   ios->in_attr_len);
         }
-        ret = exofs_io_execute(ios);
 
 out:
         return ret;
 }
 
-int exofs_sbi_read(struct exofs_io_state *ios)
+int exofs_sbi_write(struct exofs_io_state *ios)
 {
-        int i, ret;
+        int i;
+        int ret;
 
-        for (i = 0; i < 1; i++) {
-                struct osd_request *or;
-                unsigned first_dev = (unsigned)ios->obj.id;
+        ret = _prepare_for_striping(ios);
+        if (unlikely(ret))
+                return ret;
 
-                first_dev %= ios->sbi->s_numdevs;
-                or = osd_start_request(ios->sbi->s_ods[first_dev], GFP_KERNEL);
-                if (unlikely(!or)) {
-                        EXOFS_ERR("%s: osd_start_request failed\n", __func__);
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                ios->per_dev[i].or = or;
-                ios->numdevs++;
+        for (i = 0; i < ios->numdevs; i += ios->layout->mirrors_p1) {
+                ret = _sbi_write_mirror(ios, i);
+                if (unlikely(ret))
+                        return ret;
+        }
 
-                if (ios->bio) {
-                        osd_req_read(or, &ios->obj, ios->offset, ios->bio,
-                                     ios->length);
-/*                      EXOFS_DBGMSG("read sync=%d\n", sync);*/
-                } else if (ios->kern_buff) {
-                        osd_req_read_kern(or, &ios->obj, ios->offset,
-                                           ios->kern_buff, ios->length);
-/*                      EXOFS_DBGMSG("read_kern sync=%d\n", sync);*/
-                } else {
-                        osd_req_get_attributes(or, &ios->obj);
-/*                      EXOFS_DBGMSG("get_attributes sync=%d\n", sync);*/
-                }
+        ret = exofs_io_execute(ios);
+        return ret;
+}
 
-                if (ios->out_attr)
-                        osd_req_add_set_attr_list(or, ios->out_attr,
-                                                  ios->out_attr_len);
+static int _sbi_read_mirror(struct exofs_io_state *ios, unsigned cur_comp)
+{
+        struct osd_request *or;
+        struct exofs_per_dev_state *per_dev = &ios->per_dev[cur_comp];
+        unsigned first_dev = (unsigned)ios->obj.id;
 
-                if (ios->in_attr)
-                        osd_req_add_get_attr_list(or, ios->in_attr,
-                                                  ios->in_attr_len);
+        if (ios->pages && !per_dev->length)
+                return 0; /* Just an empty slot */
+
+        first_dev = per_dev->dev + first_dev % ios->layout->mirrors_p1;
+        or = osd_start_request(exofs_ios_od(ios, first_dev), GFP_KERNEL);
+        if (unlikely(!or)) {
+                EXOFS_ERR("%s: osd_start_request failed\n", __func__);
+                return -ENOMEM;
         }
-        ret = exofs_io_execute(ios);
+        per_dev->or = or;
+
+        if (ios->pages) {
+                osd_req_read(or, &ios->obj, per_dev->offset,
+                                per_dev->bio, per_dev->length);
+                EXOFS_DBGMSG("read(0x%llx) offset=0x%llx length=0x%llx"
+                             " dev=%d\n", _LLU(ios->obj.id),
+                             _LLU(per_dev->offset), _LLU(per_dev->length),
+                             first_dev);
+        } else if (ios->kern_buff) {
+                int ret = osd_req_read_kern(or, &ios->obj, per_dev->offset,
+                                            ios->kern_buff, ios->length);
+                EXOFS_DBGMSG2("read_kern(0x%llx) offset=0x%llx "
+                              "length=0x%llx dev=%d ret=>%d\n",
+                              _LLU(ios->obj.id), _LLU(per_dev->offset),
+                              _LLU(ios->length), first_dev, ret);
+                if (unlikely(ret))
+                        return ret;
+        } else {
+                osd_req_get_attributes(or, &ios->obj);
+                EXOFS_DBGMSG2("obj(0x%llx) get_attributes=%d dev=%d\n",
+                              _LLU(ios->obj.id), ios->in_attr_len, first_dev);
+        }
+        if (ios->out_attr)
+                osd_req_add_set_attr_list(or, ios->out_attr, ios->out_attr_len);
 
-out:
+        if (ios->in_attr)
+                osd_req_add_get_attr_list(or, ios->in_attr, ios->in_attr_len);
+
+        return 0;
+}
+
+int exofs_sbi_read(struct exofs_io_state *ios)
+{
+        int i;
+        int ret;
+
+        ret = _prepare_for_striping(ios);
+        if (unlikely(ret))
+                return ret;
+
+        for (i = 0; i < ios->numdevs; i += ios->layout->mirrors_p1) {
+                ret = _sbi_read_mirror(ios, i);
+                if (unlikely(ret))
+                        return ret;
+        }
+
+        ret = exofs_io_execute(ios);
         return ret;
 }
 
@@ -380,42 +742,82 @@ int extract_attr_from_ios(struct exofs_io_state *ios, struct osd_attr *attr)
         return -EIO;
 }
 
+static int _truncate_mirrors(struct exofs_io_state *ios, unsigned cur_comp,
+                             struct osd_attr *attr)
+{
+        int last_comp = cur_comp + ios->layout->mirrors_p1;
+
+        for (; cur_comp < last_comp; ++cur_comp) {
+                struct exofs_per_dev_state *per_dev = &ios->per_dev[cur_comp];
+                struct osd_request *or;
+
+                or = osd_start_request(exofs_ios_od(ios, cur_comp), GFP_KERNEL);
+                if (unlikely(!or)) {
+                        EXOFS_ERR("%s: osd_start_request failed\n", __func__);
+                        return -ENOMEM;
+                }
+                per_dev->or = or;
+
+                osd_req_set_attributes(or, &ios->obj);
+                osd_req_add_set_attr_list(or, attr, 1);
+        }
+
+        return 0;
+}
+
 int exofs_oi_truncate(struct exofs_i_info *oi, u64 size)
 {
         struct exofs_sb_info *sbi = oi->vfs_inode.i_sb->s_fs_info;
         struct exofs_io_state *ios;
-        struct osd_attr attr;
-        __be64 newsize;
+        struct exofs_trunc_attr {
+                struct osd_attr attr;
+                __be64 newsize;
+        } *size_attrs;
+        struct _striping_info si;
         int i, ret;
 
-        if (exofs_get_io_state(sbi, &ios))
-                return -ENOMEM;
+        ret = exofs_get_io_state(&sbi->layout, &ios);
+        if (unlikely(ret))
+                return ret;
+
+        size_attrs = kcalloc(ios->layout->group_width, sizeof(*size_attrs),
+                             GFP_KERNEL);
+        if (unlikely(!size_attrs)) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         ios->obj.id = exofs_oi_objno(oi);
         ios->cred = oi->i_cred;
 
-        newsize = cpu_to_be64(size);
-        attr = g_attr_logical_length;
-        attr.val_ptr = &newsize;
+        ios->numdevs = ios->layout->s_numdevs;
+        _calc_stripe_info(ios, size, &si);
 
-        for (i = 0; i < sbi->s_numdevs; i++) {
-                struct osd_request *or;
+        for (i = 0; i < ios->layout->group_width; ++i) {
+                struct exofs_trunc_attr *size_attr = &size_attrs[i];
+                u64 obj_size;
 
-                or = osd_start_request(sbi->s_ods[i], GFP_KERNEL);
-                if (unlikely(!or)) {
-                        EXOFS_ERR("%s: osd_start_request failed\n", __func__);
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                ios->per_dev[i].or = or;
-                ios->numdevs++;
+                if (i < si.dev)
+                        obj_size = si.obj_offset +
+                                        ios->layout->stripe_unit - si.unit_off;
+                else if (i == si.dev)
+                        obj_size = si.obj_offset;
+                else /* i > si.dev */
+                        obj_size = si.obj_offset - si.unit_off;
 
-                osd_req_set_attributes(or, &ios->obj);
-                osd_req_add_set_attr_list(or, &attr, 1);
+                size_attr->newsize = cpu_to_be64(obj_size);
+                size_attr->attr = g_attr_logical_length;
+                size_attr->attr.val_ptr = &size_attr->newsize;
+
+                ret = _truncate_mirrors(ios, i * ios->layout->mirrors_p1,
+                                        &size_attr->attr);
+                if (unlikely(ret))
+                        goto out;
         }
         ret = exofs_io_execute(ios);
 
 out:
+        kfree(size_attrs);
         exofs_put_io_state(ios);
         return ret;
 }
diff --git a/fs/exofs/pnfs.h b/fs/exofs/pnfs.h
index 423033addd1f..c52e9888b8ab 100644
--- a/fs/exofs/pnfs.h
+++ b/fs/exofs/pnfs.h
@@ -15,13 +15,7 @@
 #ifndef __EXOFS_PNFS_H__
 #define __EXOFS_PNFS_H__
 
-#if defined(CONFIG_PNFS)
-
-
-/* FIXME: move this file to: linux/exportfs/pnfs_osd_xdr.h */
-#include "../nfs/objlayout/pnfs_osd_xdr.h"
-
-#else /* defined(CONFIG_PNFS) */
+#if ! defined(__PNFS_OSD_XDR_H__)
 
 enum pnfs_iomode {
         IOMODE_READ = 1,
@@ -46,6 +40,6 @@ struct pnfs_osd_data_map {
         u32     odm_raid_algorithm;
 };
 
-#endif /* else defined(CONFIG_PNFS) */
+#endif /* ! defined(__PNFS_OSD_XDR_H__) */
 
 #endif /* __EXOFS_PNFS_H__ */
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index a1d1e77b12eb..03149b9a5178 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -37,6 +37,7 @@
 #include <linux/vfs.h>
 #include <linux/random.h>
 #include <linux/exportfs.h>
+#include <linux/slab.h>
 
 #include "exofs.h"
 
@@ -210,7 +211,7 @@ int exofs_sync_fs(struct super_block *sb, int wait)
         sbi = sb->s_fs_info;
         fscb = &sbi->s_fscb;
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (ret)
                 goto out;
 
@@ -264,12 +265,12 @@ static void _exofs_print_device(const char *msg, const char *dev_path,
 
 void exofs_free_sbi(struct exofs_sb_info *sbi)
 {
-        while (sbi->s_numdevs) {
-                int i = --sbi->s_numdevs;
-                struct osd_dev *od = sbi->s_ods[i];
+        while (sbi->layout.s_numdevs) {
+                int i = --sbi->layout.s_numdevs;
+                struct osd_dev *od = sbi->layout.s_ods[i];
 
                 if (od) {
-                        sbi->s_ods[i] = NULL;
+                        sbi->layout.s_ods[i] = NULL;
                         osduld_put_device(od);
                 }
         }
@@ -298,8 +299,10 @@ static void exofs_put_super(struct super_block *sb)
                                   msecs_to_jiffies(100));
         }
 
-        _exofs_print_device("Unmounting", NULL, sbi->s_ods[0], sbi->s_pid);
+        _exofs_print_device("Unmounting", NULL, sbi->layout.s_ods[0],
+                            sbi->layout.s_pid);
 
+        bdi_destroy(&sbi->bdi);
         exofs_free_sbi(sbi);
         sb->s_fs_info = NULL;
 }
@@ -307,6 +310,8 @@ static void exofs_put_super(struct super_block *sb)
 static int _read_and_match_data_map(struct exofs_sb_info *sbi, unsigned numdevs,
                                     struct exofs_device_table *dt)
 {
+        u64 stripe_length;
+
         sbi->data_map.odm_num_comps   =
                                 le32_to_cpu(dt->dt_data_map.cb_num_comps);
         sbi->data_map.odm_stripe_unit =
@@ -320,14 +325,63 @@ static int _read_and_match_data_map(struct exofs_sb_info *sbi, unsigned numdevs,
         sbi->data_map.odm_raid_algorithm  =
                                 le32_to_cpu(dt->dt_data_map.cb_raid_algorithm);
 
-/* FIXME: Hard coded mirror only for now. if not so do not mount */
-        if ((sbi->data_map.odm_num_comps != numdevs) ||
-            (sbi->data_map.odm_stripe_unit != EXOFS_BLKSIZE) ||
-            (sbi->data_map.odm_raid_algorithm != PNFS_OSD_RAID_0) ||
-            (sbi->data_map.odm_mirror_cnt != (numdevs - 1)))
+/* FIXME: Only raid0 for now. if not so, do not mount */
+        if (sbi->data_map.odm_num_comps != numdevs) {
+                EXOFS_ERR("odm_num_comps(%u) != numdevs(%u)\n",
+                          sbi->data_map.odm_num_comps, numdevs);
                 return -EINVAL;
-        else
-                return 0;
+        }
+        if (sbi->data_map.odm_raid_algorithm != PNFS_OSD_RAID_0) {
+                EXOFS_ERR("Only RAID_0 for now\n");
+                return -EINVAL;
+        }
+        if (0 != (numdevs % (sbi->data_map.odm_mirror_cnt + 1))) {
+                EXOFS_ERR("Data Map wrong, numdevs=%d mirrors=%d\n",
+                          numdevs, sbi->data_map.odm_mirror_cnt);
+                return -EINVAL;
+        }
+
+        if (0 != (sbi->data_map.odm_stripe_unit & ~PAGE_MASK)) {
+                EXOFS_ERR("Stripe Unit(0x%llx)"
+                          " must be Multples of PAGE_SIZE(0x%lx)\n",
+                          _LLU(sbi->data_map.odm_stripe_unit), PAGE_SIZE);
+                return -EINVAL;
+        }
+
+        sbi->layout.stripe_unit = sbi->data_map.odm_stripe_unit;
+        sbi->layout.mirrors_p1 = sbi->data_map.odm_mirror_cnt + 1;
+
+        if (sbi->data_map.odm_group_width) {
+                sbi->layout.group_width = sbi->data_map.odm_group_width;
+                sbi->layout.group_depth = sbi->data_map.odm_group_depth;
+                if (!sbi->layout.group_depth) {
+                        EXOFS_ERR("group_depth == 0 && group_width != 0\n");
+                        return -EINVAL;
+                }
+                sbi->layout.group_count = sbi->data_map.odm_num_comps /
+                                                sbi->layout.mirrors_p1 /
+                                                sbi->data_map.odm_group_width;
+        } else {
+                if (sbi->data_map.odm_group_depth) {
+                        printk(KERN_NOTICE "Warning: group_depth ignored "
+                                "group_width == 0 && group_depth == %d\n",
+                                sbi->data_map.odm_group_depth);
+                        sbi->data_map.odm_group_depth = 0;
+                }
+                sbi->layout.group_width = sbi->data_map.odm_num_comps /
+                                                        sbi->layout.mirrors_p1;
+                sbi->layout.group_depth = -1;
+                sbi->layout.group_count = 1;
+        }
+
+        stripe_length = (u64)sbi->layout.group_width * sbi->layout.stripe_unit;
+        if (stripe_length >= (1ULL << 32)) {
+                EXOFS_ERR("Total Stripe length(0x%llx)"
+                          " >= 32bit is not supported\n", _LLU(stripe_length));
+                return -EINVAL;
+        }
+
+        return 0;
 }
 
 /* @odi is valid only as long as @fscb_dev is valid */
@@ -361,7 +415,7 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
 {
         struct exofs_sb_info *sbi = *psbi;
         struct osd_dev *fscb_od;
-        struct osd_obj_id obj = {.partition = sbi->s_pid,
+        struct osd_obj_id obj = {.partition = sbi->layout.s_pid,
                                  .id = EXOFS_DEVTABLE_ID};
         struct exofs_device_table *dt;
         unsigned table_bytes = table_count * sizeof(dt->dt_dev_table[0]) +
@@ -376,9 +430,9 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                 return -ENOMEM;
         }
 
-        fscb_od = sbi->s_ods[0];
-        sbi->s_ods[0] = NULL;
-        sbi->s_numdevs = 0;
+        fscb_od = sbi->layout.s_ods[0];
+        sbi->layout.s_ods[0] = NULL;
+        sbi->layout.s_numdevs = 0;
         ret = exofs_read_kern(fscb_od, sbi->s_cred, &obj, 0, dt, table_bytes);
         if (unlikely(ret)) {
                 EXOFS_ERR("ERROR: reading device table\n");
@@ -397,14 +451,15 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                 goto out;
 
         if (likely(numdevs > 1)) {
-                unsigned size = numdevs * sizeof(sbi->s_ods[0]);
+                unsigned size = numdevs * sizeof(sbi->layout.s_ods[0]);
 
                 sbi = krealloc(sbi, sizeof(*sbi) + size, GFP_KERNEL);
                 if (unlikely(!sbi)) {
                         ret = -ENOMEM;
                         goto out;
                 }
-                memset(&sbi->s_ods[1], 0, size - sizeof(sbi->s_ods[0]));
+                memset(&sbi->layout.s_ods[1], 0,
+                       size - sizeof(sbi->layout.s_ods[0]));
                 *psbi = sbi;
         }
 
@@ -427,8 +482,8 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                  * line. We always keep them in device-table order.
                  */
                 if (fscb_od && osduld_device_same(fscb_od, &odi)) {
-                        sbi->s_ods[i] = fscb_od;
-                        ++sbi->s_numdevs;
+                        sbi->layout.s_ods[i] = fscb_od;
+                        ++sbi->layout.s_numdevs;
                         fscb_od = NULL;
                         continue;
                 }
@@ -441,8 +496,8 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                         goto out;
                 }
 
-                sbi->s_ods[i] = od;
-                ++sbi->s_numdevs;
+                sbi->layout.s_ods[i] = od;
+                ++sbi->layout.s_numdevs;
 
                 /* Read the fscb of the other devices to make sure the FS
                  * partition is there.
@@ -492,6 +547,10 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
         if (!sbi)
                 return -ENOMEM;
 
+        ret = bdi_setup_and_register(&sbi->bdi, "exofs", BDI_CAP_MAP_COPY);
+        if (ret)
+                goto free_bdi;
+
         /* use mount options to fill superblock */
         od = osduld_path_lookup(opts->dev_name);
         if (IS_ERR(od)) {
@@ -499,9 +558,15 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
                 goto free_sbi;
         }
 
-        sbi->s_ods[0] = od;
-        sbi->s_numdevs = 1;
-        sbi->s_pid = opts->pid;
+        /* Default layout in case we do not have a device-table */
+        sbi->layout.stripe_unit = PAGE_SIZE;
+        sbi->layout.mirrors_p1 = 1;
+        sbi->layout.group_width = 1;
+        sbi->layout.group_depth = -1;
+        sbi->layout.group_count = 1;
+        sbi->layout.s_ods[0] = od;
+        sbi->layout.s_numdevs = 1;
+        sbi->layout.s_pid = opts->pid;
         sbi->s_timeout = opts->timeout;
 
         /* fill in some other data by hand */
@@ -514,7 +579,7 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_bdev = NULL;
         sb->s_dev = 0;
 
-        obj.partition = sbi->s_pid;
+        obj.partition = sbi->layout.s_pid;
         obj.id = EXOFS_SUPER_ID;
         exofs_make_credential(sbi->s_cred, &obj);
 
@@ -552,6 +617,7 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
         }
 
         /* set up operation vectors */
+        sb->s_bdi = &sbi->bdi;
         sb->s_fs_info = sbi;
         sb->s_op = &exofs_sops;
         sb->s_export_op = &exofs_export_ops;
@@ -578,13 +644,15 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
                 goto free_sbi;
         }
 
-        _exofs_print_device("Mounting", opts->dev_name, sbi->s_ods[0],
-                            sbi->s_pid);
+        _exofs_print_device("Mounting", opts->dev_name, sbi->layout.s_ods[0],
+                            sbi->layout.s_pid);
         return 0;
 
 free_sbi:
+        bdi_destroy(&sbi->bdi);
+free_bdi:
         EXOFS_ERR("Unable to mount exofs on %s pid=0x%llx err=%d\n",
-                  opts->dev_name, sbi->s_pid, ret);
+                  opts->dev_name, sbi->layout.s_pid, ret);
         exofs_free_sbi(sbi);
         return ret;
 }
@@ -627,7 +695,7 @@ static int exofs_statfs(struct dentry *dentry, struct kstatfs *buf)
         uint8_t cred_a[OSD_CAP_LEN];
         int ret;
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (ret) {
                 EXOFS_DBGMSG("exofs_get_io_state failed.\n");
                 return ret;
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 7f8d2e5a7ea6..3cf038c055d7 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -13,6 +13,7 @@
 
 #include "ext2.h"
 #include <linux/quotaops.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/buffer_head.h>
 #include <linux/capability.h>
@@ -570,7 +571,7 @@ do_more:
 error_return:
         brelse(bitmap_bh);
         release_blocks(sb, freed);
-        vfs_dq_free_block(inode, freed);
+        dquot_free_block(inode, freed);
 }
 
 /**
@@ -1236,6 +1237,7 @@ ext2_fsblk_t ext2_new_blocks(struct inode *inode, ext2_fsblk_t goal,
         unsigned short windowsz = 0;
         unsigned long ngroups;
         unsigned long num = *count;
+        int ret;
 
         *errp = -ENOSPC;
         sb = inode->i_sb;
@@ -1247,8 +1249,9 @@ ext2_fsblk_t ext2_new_blocks(struct inode *inode, ext2_fsblk_t goal,
         /*
          * Check quota for allocation of this block.
          */
-        if (vfs_dq_alloc_block(inode, num)) {
-                *errp = -EDQUOT;
+        ret = dquot_alloc_block(inode, num);
+        if (ret) {
+                *errp = ret;
                 return 0;
         }
 
@@ -1409,7 +1412,7 @@ allocated:
 
         *errp = 0;
         brelse(bitmap_bh);
-        vfs_dq_free_block(inode, *count-num);
+        dquot_free_block(inode, *count-num);
         *count = num;
         return ret_block;
 
@@ -1420,7 +1423,7 @@ out:
          * Undo the block allocation
          */
         if (!performed_allocation)
-                vfs_dq_free_block(inode, *count);
+                dquot_free_block(inode, *count);
         brelse(bitmap_bh);
         return 0;
 }
diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
index 061914add3cf..0b038e47ad2f 100644
--- a/fs/ext2/ext2.h
+++ b/fs/ext2/ext2.h
@@ -118,7 +118,7 @@ extern unsigned long ext2_count_free (struct buffer_head *, unsigned);
 
 /* inode.c */
 extern struct inode *ext2_iget (struct super_block *, unsigned long);
-extern int ext2_write_inode (struct inode *, int);
+extern int ext2_write_inode (struct inode *, struct writeback_control *);
 extern void ext2_delete_inode (struct inode *);
 extern int ext2_sync_inode (struct inode *);
 extern int ext2_get_block(struct inode *, sector_t, struct buffer_head *, int);
diff --git a/fs/ext2/file.c b/fs/ext2/file.c
index 586e3589d4c2..5d198d0697fb 100644
--- a/fs/ext2/file.c
+++ b/fs/ext2/file.c
@@ -20,6 +20,7 @@
 
 #include <linux/time.h>
 #include <linux/pagemap.h>
+#include <linux/quotaops.h>
 #include "ext2.h"
 #include "xattr.h"
 #include "acl.h"
@@ -70,7 +71,7 @@ const struct file_operations ext2_file_operations = {
         .compat_ioctl   = ext2_compat_ioctl,
 #endif
         .mmap           = generic_file_mmap,
-        .open           = generic_file_open,
+        .open           = dquot_file_open,
         .release        = ext2_release_file,
         .fsync          = ext2_fsync,
         .splice_read    = generic_file_splice_read,
@@ -87,7 +88,7 @@ const struct file_operations ext2_xip_file_operations = {
         .compat_ioctl   = ext2_compat_ioctl,
 #endif
         .mmap           = xip_file_mmap,
-        .open           = generic_file_open,
+        .open           = dquot_file_open,
         .release        = ext2_release_file,
         .fsync          = ext2_fsync,
 };
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index 15387c9c17d8..ad7d572ee8dc 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -121,8 +121,8 @@ void ext2_free_inode (struct inode * inode)
         if (!is_bad_inode(inode)) {
                 /* Quota is already initialized in iput() */
                 ext2_xattr_delete_inode(inode);
-                vfs_dq_free_inode(inode);
-                vfs_dq_drop(inode);
+                dquot_free_inode(inode);
+                dquot_drop(inode);
         }
 
         es = EXT2_SB(sb)->s_es;
@@ -586,10 +586,10 @@ got:
                 goto fail_drop;
         }
 
-        if (vfs_dq_alloc_inode(inode)) {
-                err = -EDQUOT;
+        dquot_initialize(inode);
+        err = dquot_alloc_inode(inode);
+        if (err)
                 goto fail_drop;
-        }
 
         err = ext2_init_acl(inode, dir);
         if (err)
@@ -605,10 +605,10 @@ got:
         return inode;
 
 fail_free_drop:
-        vfs_dq_free_inode(inode);
+        dquot_free_inode(inode);
 
 fail_drop:
-        vfs_dq_drop(inode);
+        dquot_drop(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         unlock_new_inode(inode);
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index 71b032c65a02..fc13cc119aad 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -41,6 +41,8 @@ MODULE_AUTHOR("Remy Card and others");
 MODULE_DESCRIPTION("Second Extended Filesystem");
 MODULE_LICENSE("GPL");
 
+static int __ext2_write_inode(struct inode *inode, int do_sync);
+
 /*
  * Test whether an inode is a fast symlink.
  */
@@ -58,13 +60,15 @@ static inline int ext2_inode_is_fast_symlink(struct inode *inode)
  */
 void ext2_delete_inode (struct inode * inode)
 {
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
         truncate_inode_pages(&inode->i_data, 0);
 
         if (is_bad_inode(inode))
                 goto no_delete;
         EXT2_I(inode)->i_dtime  = get_seconds();
         mark_inode_dirty(inode);
-        ext2_write_inode(inode, inode_needs_sync(inode));
+        __ext2_write_inode(inode, inode_needs_sync(inode));
 
         inode->i_size = 0;
         if (inode->i_blocks)
@@ -1335,7 +1339,7 @@ bad_inode:
         return ERR_PTR(ret);
 }
 
-int ext2_write_inode(struct inode *inode, int do_sync)
+static int __ext2_write_inode(struct inode *inode, int do_sync)
 {
         struct ext2_inode_info *ei = EXT2_I(inode);
         struct super_block *sb = inode->i_sb;
@@ -1440,6 +1444,11 @@ int ext2_write_inode(struct inode *inode, int do_sync)
         return err;
 }
 
+int ext2_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __ext2_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int ext2_sync_inode(struct inode *inode)
 {
         struct writeback_control wbc = {
@@ -1457,9 +1466,12 @@ int ext2_setattr(struct dentry *dentry, struct iattr *iattr)
         error = inode_change_ok(inode, iattr);
         if (error)
                 return error;
+
+        if (iattr->ia_valid & ATTR_SIZE)
+                dquot_initialize(inode);
         if ((iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) ||
             (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid)) {
-                error = vfs_dq_transfer(inode, iattr) ? -EDQUOT : 0;
+                error = dquot_transfer(inode, iattr);
                 if (error)
                         return error;
         }
diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index dd7175ce5606..71efb0e9a3f2 100644
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/quotaops.h>
 #include "ext2.h"
 #include "xattr.h"
 #include "acl.h"
@@ -99,24 +100,27 @@ struct dentry *ext2_get_parent(struct dentry *child)
  */
 static int ext2_create (struct inode * dir, struct dentry * dentry, int mode, struct nameidata *nd)
 {
-        struct inode * inode = ext2_new_inode (dir, mode);
-        int err = PTR_ERR(inode);
-        if (!IS_ERR(inode)) {
-                inode->i_op = &ext2_file_inode_operations;
-                if (ext2_use_xip(inode->i_sb)) {
-                        inode->i_mapping->a_ops = &ext2_aops_xip;
-                        inode->i_fop = &ext2_xip_file_operations;
-                } else if (test_opt(inode->i_sb, NOBH)) {
-                        inode->i_mapping->a_ops = &ext2_nobh_aops;
-                        inode->i_fop = &ext2_file_operations;
-                } else {
-                        inode->i_mapping->a_ops = &ext2_aops;
-                        inode->i_fop = &ext2_file_operations;
-                }
-                mark_inode_dirty(inode);
-                err = ext2_add_nondir(dentry, inode);
+        struct inode *inode;
+
+        dquot_initialize(dir);
+
+        inode = ext2_new_inode(dir, mode);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+
+        inode->i_op = &ext2_file_inode_operations;
+        if (ext2_use_xip(inode->i_sb)) {
+                inode->i_mapping->a_ops = &ext2_aops_xip;
+                inode->i_fop = &ext2_xip_file_operations;
+        } else if (test_opt(inode->i_sb, NOBH)) {
+                inode->i_mapping->a_ops = &ext2_nobh_aops;
+                inode->i_fop = &ext2_file_operations;
+        } else {
+                inode->i_mapping->a_ops = &ext2_aops;
+                inode->i_fop = &ext2_file_operations;
         }
-        return err;
+        mark_inode_dirty(inode);
+        return ext2_add_nondir(dentry, inode);
 }
 
 static int ext2_mknod (struct inode * dir, struct dentry *dentry, int mode, dev_t rdev)
@@ -127,6 +131,8 @@ static int ext2_mknod (struct inode * dir, struct dentry *dentry, int mode, dev_
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
+        dquot_initialize(dir);
+
         inode = ext2_new_inode (dir, mode);
         err = PTR_ERR(inode);
         if (!IS_ERR(inode)) {
@@ -151,6 +157,8 @@ static int ext2_symlink (struct inode * dir, struct dentry * dentry,
         if (l > sb->s_blocksize)
                 goto out;
 
+        dquot_initialize(dir);
+
         inode = ext2_new_inode (dir, S_IFLNK | S_IRWXUGO);
         err = PTR_ERR(inode);
         if (IS_ERR(inode))
@@ -194,6 +202,8 @@ static int ext2_link (struct dentry * old_dentry, struct inode * dir,
         if (inode->i_nlink >= EXT2_LINK_MAX)
                 return -EMLINK;
 
+        dquot_initialize(dir);
+
         inode->i_ctime = CURRENT_TIME_SEC;
         inode_inc_link_count(inode);
         atomic_inc(&inode->i_count);
@@ -216,6 +226,8 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, int mode)
         if (dir->i_nlink >= EXT2_LINK_MAX)
                 goto out;
 
+        dquot_initialize(dir);
+
         inode_inc_link_count(dir);
 
         inode = ext2_new_inode (dir, S_IFDIR | mode);
@@ -262,6 +274,8 @@ static int ext2_unlink(struct inode * dir, struct dentry *dentry)
         struct page * page;
         int err = -ENOENT;
 
+        dquot_initialize(dir);
+
         de = ext2_find_entry (dir, &dentry->d_name, &page);
         if (!de)
                 goto out;
@@ -304,6 +318,9 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
         struct ext2_dir_entry_2 * old_de;
         int err = -ENOENT;
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         old_de = ext2_find_entry (old_dir, &old_dentry->d_name, &old_page);
         if (!old_de)
                 goto out;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index f9cb54a585ce..42e4a303b675 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -194,6 +194,8 @@ static void destroy_inodecache(void)
 static void ext2_clear_inode(struct inode *inode)
 {
         struct ext2_block_alloc_info *rsv = EXT2_I(inode)->i_block_alloc_info;
+
+        dquot_drop(inode);
         ext2_discard_reservation(inode);
         EXT2_I(inode)->i_block_alloc_info = NULL;
         if (unlikely(rsv))
diff --git a/fs/ext2/symlink.c b/fs/ext2/symlink.c
index 4e2426e22bbe..565cf817bbf1 100644
--- a/fs/ext2/symlink.c
+++ b/fs/ext2/symlink.c
@@ -32,6 +32,7 @@ const struct inode_operations ext2_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = page_follow_link_light,
         .put_link       = page_put_link,
+        .setattr        = ext2_setattr,
 #ifdef CONFIG_EXT2_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
@@ -43,6 +44,7 @@ const struct inode_operations ext2_symlink_inode_operations = {
 const struct inode_operations ext2_fast_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = ext2_follow_link,
+        .setattr        = ext2_setattr,
 #ifdef CONFIG_EXT2_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index 904f00642f84..e44dc92609be 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -644,8 +644,8 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,
                                    the inode.  */
                                 ea_bdebug(new_bh, "reusing block");
 
-                                error = -EDQUOT;
-                                if (vfs_dq_alloc_block(inode, 1)) {
+                                error = dquot_alloc_block(inode, 1);
+                                if (error) {
                                         unlock_buffer(new_bh);
                                         goto cleanup;
                                 }
@@ -702,7 +702,7 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,
                  * as if nothing happened and cleanup the unused block */
                 if (error && error != -ENOSPC) {
                         if (new_bh && new_bh != old_bh)
-                                vfs_dq_free_block(inode, 1);
+                                dquot_free_block(inode, 1);
                         goto cleanup;
                 }
         } else
@@ -734,7 +734,7 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,
                         le32_add_cpu(&HDR(old_bh)->h_refcount, -1);
                         if (ce)
                                 mb_cache_entry_release(ce);
-                        vfs_dq_free_block(inode, 1);
+                        dquot_free_block(inode, 1);
                         mark_buffer_dirty(old_bh);
                         ea_bdebug(old_bh, "refcount now=%d",
                                 le32_to_cpu(HDR(old_bh)->h_refcount));
@@ -797,7 +797,7 @@ ext2_xattr_delete_inode(struct inode *inode)
                 mark_buffer_dirty(bh);
                 if (IS_SYNC(inode))
                         sync_dirty_buffer(bh);
-                vfs_dq_free_block(inode, 1);
+                dquot_free_block(inode, 1);
         }
         EXT2_I(inode)->i_file_acl = 0;
 
diff --git a/fs/ext2/xattr_security.c b/fs/ext2/xattr_security.c
index c8155845ac05..b118c6383c6d 100644
--- a/fs/ext2/xattr_security.c
+++ b/fs/ext2/xattr_security.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/fs.h>
 #include <linux/ext2_fs.h>
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index 27967f92e820..a177122a1b25 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -14,6 +14,7 @@
 #include <linux/time.h>
 #include <linux/capability.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/jbd.h>
 #include <linux/ext3_fs.h>
 #include <linux/ext3_jbd.h>
@@ -676,7 +677,7 @@ void ext3_free_blocks(handle_t *handle, struct inode *inode,
         }
         ext3_free_blocks_sb(handle, sb, block, count, &dquot_freed_blocks);
         if (dquot_freed_blocks)
-                vfs_dq_free_block(inode, dquot_freed_blocks);
+                dquot_free_block(inode, dquot_freed_blocks);
         return;
 }
 
@@ -1502,8 +1503,9 @@ ext3_fsblk_t ext3_new_blocks(handle_t *handle, struct inode *inode,
         /*
          * Check quota for allocation of this block.
          */
-        if (vfs_dq_alloc_block(inode, num)) {
-                *errp = -EDQUOT;
+        err = dquot_alloc_block(inode, num);
+        if (err) {
+                *errp = err;
                 return 0;
         }
 
@@ -1713,7 +1715,7 @@ allocated:
 
         *errp = 0;
         brelse(bitmap_bh);
-        vfs_dq_free_block(inode, *count-num);
+        dquot_free_block(inode, *count-num);
         *count = num;
         return ret_block;
 
@@ -1728,7 +1730,7 @@ out:
          * Undo the block allocation
          */
         if (!performed_allocation)
-                vfs_dq_free_block(inode, *count);
+                dquot_free_block(inode, *count);
         brelse(bitmap_bh);
         return 0;
 }
diff --git a/fs/ext3/file.c b/fs/ext3/file.c
index 388bbdfa0b4e..f55df0e61cbd 100644
--- a/fs/ext3/file.c
+++ b/fs/ext3/file.c
@@ -21,6 +21,7 @@
 #include <linux/time.h>
 #include <linux/fs.h>
 #include <linux/jbd.h>
+#include <linux/quotaops.h>
 #include <linux/ext3_fs.h>
 #include <linux/ext3_jbd.h>
 #include "xattr.h"
@@ -33,9 +34,9 @@
  */
 static int ext3_release_file (struct inode * inode, struct file * filp)
 {
-        if (EXT3_I(inode)->i_state & EXT3_STATE_FLUSH_ON_CLOSE) {
+        if (ext3_test_inode_state(inode, EXT3_STATE_FLUSH_ON_CLOSE)) {
                 filemap_flush(inode->i_mapping);
-                EXT3_I(inode)->i_state &= ~EXT3_STATE_FLUSH_ON_CLOSE;
+                ext3_clear_inode_state(inode, EXT3_STATE_FLUSH_ON_CLOSE);
         }
         /* if we are the last writer on the inode, drop the block reservation */
         if ((filp->f_mode & FMODE_WRITE) &&
@@ -62,7 +63,7 @@ const struct file_operations ext3_file_operations = {
         .compat_ioctl   = ext3_compat_ioctl,
 #endif
         .mmap           = generic_file_mmap,
-        .open           = generic_file_open,
+        .open           = dquot_file_open,
         .release        = ext3_release_file,
         .fsync          = ext3_sync_file,
         .splice_read    = generic_file_splice_read,
diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
index b39991285136..0d0e97ed3ff6 100644
--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
@@ -123,10 +123,10 @@ void ext3_free_inode (handle_t *handle, struct inode * inode)
          * Note: we must free any quota before locking the superblock,
          * as writing the quota to disk may need the lock as well.
          */
-        vfs_dq_init(inode);
+        dquot_initialize(inode);
         ext3_xattr_delete_inode(handle, inode);
-        vfs_dq_free_inode(inode);
-        vfs_dq_drop(inode);
+        dquot_free_inode(inode);
+        dquot_drop(inode);
 
         is_directory = S_ISDIR(inode->i_mode);
 
@@ -582,16 +582,18 @@ got:
         inode->i_generation = sbi->s_next_generation++;
         spin_unlock(&sbi->s_next_gen_lock);
 
-        ei->i_state = EXT3_STATE_NEW;
+        ei->i_state_flags = 0;
+        ext3_set_inode_state(inode, EXT3_STATE_NEW);
+
         ei->i_extra_isize =
                 (EXT3_INODE_SIZE(inode->i_sb) > EXT3_GOOD_OLD_INODE_SIZE) ?
                 sizeof(struct ext3_inode) - EXT3_GOOD_OLD_INODE_SIZE : 0;
 
         ret = inode;
-        if (vfs_dq_alloc_inode(inode)) {
-                err = -EDQUOT;
+        dquot_initialize(inode);
+        err = dquot_alloc_inode(inode);
+        if (err)
                 goto fail_drop;
-        }
 
         err = ext3_init_acl(handle, inode, dir);
         if (err)
@@ -619,10 +621,10 @@ really_out:
         return ret;
 
 fail_free_drop:
-        vfs_dq_free_inode(inode);
+        dquot_free_inode(inode);
 
 fail_drop:
-        vfs_dq_drop(inode);
+        dquot_drop(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         unlock_new_inode(inode);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 455e6e6e5cb9..ea33bdf0a300 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -196,6 +196,9 @@ void ext3_delete_inode (struct inode * inode)
 {
         handle_t *handle;
 
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
+
         truncate_inode_pages(&inode->i_data, 0);
 
         if (is_bad_inode(inode))
@@ -1378,7 +1381,7 @@ static int ext3_journalled_write_end(struct file *file,
          */
         if (pos + len > inode->i_size && ext3_can_truncate(inode))
                 ext3_orphan_add(handle, inode);
-        EXT3_I(inode)->i_state |= EXT3_STATE_JDATA;
+        ext3_set_inode_state(inode, EXT3_STATE_JDATA);
         if (inode->i_size > EXT3_I(inode)->i_disksize) {
                 EXT3_I(inode)->i_disksize = inode->i_size;
                 ret2 = ext3_mark_inode_dirty(handle, inode);
@@ -1417,7 +1420,7 @@ static sector_t ext3_bmap(struct address_space *mapping, sector_t block)
         journal_t *journal;
         int err;
 
-        if (EXT3_I(inode)->i_state & EXT3_STATE_JDATA) {
+        if (ext3_test_inode_state(inode, EXT3_STATE_JDATA)) {
                 /*
                  * This is a REALLY heavyweight approach, but the use of
                  * bmap on dirty files is expected to be extremely rare:
@@ -1436,7 +1439,7 @@ static sector_t ext3_bmap(struct address_space *mapping, sector_t block)
                  * everything they get.
                  */
 
-                EXT3_I(inode)->i_state &= ~EXT3_STATE_JDATA;
+                ext3_clear_inode_state(inode, EXT3_STATE_JDATA);
                 journal = EXT3_JOURNAL(inode);
                 journal_lock_updates(journal);
                 err = journal_flush(journal);
@@ -1528,6 +1531,7 @@ static int ext3_ordered_writepage(struct page *page,
         int err;
 
         J_ASSERT(PageLocked(page));
+        WARN_ON_ONCE(IS_RDONLY(inode));
 
         /*
          * We give up here if we're reentered, because it might be for a
@@ -1600,6 +1604,9 @@ static int ext3_writeback_writepage(struct page *page,
         int ret = 0;
         int err;
 
+        J_ASSERT(PageLocked(page));
+        WARN_ON_ONCE(IS_RDONLY(inode));
+
         if (ext3_journal_current_handle())
                 goto out_fail;
 
@@ -1642,6 +1649,9 @@ static int ext3_journalled_writepage(struct page *page,
         int ret = 0;
         int err;
 
+        J_ASSERT(PageLocked(page));
+        WARN_ON_ONCE(IS_RDONLY(inode));
+
         if (ext3_journal_current_handle())
                 goto no_write;
 
@@ -1670,7 +1680,7 @@ static int ext3_journalled_writepage(struct page *page,
                                 PAGE_CACHE_SIZE, NULL, write_end_fn);
                 if (ret == 0)
                         ret = err;
-                EXT3_I(inode)->i_state |= EXT3_STATE_JDATA;
+                ext3_set_inode_state(inode, EXT3_STATE_JDATA);
                 unlock_page(page);
         } else {
                 /*
@@ -1785,8 +1795,9 @@ retry:
                 handle = ext3_journal_start(inode, 2);
                 if (IS_ERR(handle)) {
                         /* This is really bad luck. We've written the data
-                         * but cannot extend i_size. Bail out and pretend
-                         * the write failed... */
+                         * but cannot extend i_size. Truncate allocated blocks
+                         * and pretend the write failed... */
+                        ext3_truncate(inode);
                         ret = PTR_ERR(handle);
                         goto out;
                 }
@@ -2402,7 +2413,7 @@ void ext3_truncate(struct inode *inode)
                 goto out_notrans;
 
         if (inode->i_size == 0 && ext3_should_writeback_data(inode))
-                ei->i_state |= EXT3_STATE_FLUSH_ON_CLOSE;
+                ext3_set_inode_state(inode, EXT3_STATE_FLUSH_ON_CLOSE);
 
         /*
          * We have to lock the EOF page here, because lock_page() nests
@@ -2721,7 +2732,7 @@ int ext3_get_inode_loc(struct inode *inode, struct ext3_iloc *iloc)
 {
         /* We have all inode data except xattrs in memory here. */
         return __ext3_get_inode_loc(inode, iloc,
-                !(EXT3_I(inode)->i_state & EXT3_STATE_XATTR));
+                !ext3_test_inode_state(inode, EXT3_STATE_XATTR));
 }
 
 void ext3_set_inode_flags(struct inode *inode)
@@ -2800,7 +2811,7 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
         inode->i_mtime.tv_sec = (signed)le32_to_cpu(raw_inode->i_mtime);
         inode->i_atime.tv_nsec = inode->i_ctime.tv_nsec = inode->i_mtime.tv_nsec = 0;
 
-        ei->i_state = 0;
+        ei->i_state_flags = 0;
         ei->i_dir_start_lookup = 0;
         ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
         /* We now have enough fields to check if the inode was active or not.
@@ -2893,7 +2904,7 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
                                         EXT3_GOOD_OLD_INODE_SIZE +
                                         ei->i_extra_isize;
                         if (*magic == cpu_to_le32(EXT3_XATTR_MAGIC))
-                                 ei->i_state |= EXT3_STATE_XATTR;
+                                 ext3_set_inode_state(inode, EXT3_STATE_XATTR);
                 }
         } else
                 ei->i_extra_isize = 0;
@@ -2955,7 +2966,7 @@ again:
 
         /* For fields not not tracking in the in-memory inode,
          * initialise them to zero for new inodes. */
-        if (ei->i_state & EXT3_STATE_NEW)
+        if (ext3_test_inode_state(inode, EXT3_STATE_NEW))
                 memset(raw_inode, 0, EXT3_SB(inode->i_sb)->s_inode_size);
 
         ext3_get_inode_flags(ei);
@@ -3052,7 +3063,7 @@ again:
         rc = ext3_journal_dirty_metadata(handle, bh);
         if (!err)
                 err = rc;
-        ei->i_state &= ~EXT3_STATE_NEW;
+        ext3_clear_inode_state(inode, EXT3_STATE_NEW);
 
         atomic_set(&ei->i_sync_tid, handle->h_transaction->t_tid);
 out_brelse:
@@ -3096,7 +3107,7 @@ out_brelse:
  * `stuff()' is running, and the new i_size will be lost.  Plus the inode
  * will no longer be on the superblock's dirty inode list.
  */
-int ext3_write_inode(struct inode *inode, int wait)
+int ext3_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         if (current->flags & PF_MEMALLOC)
                 return 0;
@@ -3107,7 +3118,7 @@ int ext3_write_inode(struct inode *inode, int wait)
                 return -EIO;
         }
 
-        if (!wait)
+        if (wbc->sync_mode != WB_SYNC_ALL)
                 return 0;
 
         return ext3_force_commit(inode->i_sb);
@@ -3140,6 +3151,8 @@ int ext3_setattr(struct dentry *dentry, struct iattr *attr)
         if (error)
                 return error;
 
+        if (ia_valid & ATTR_SIZE)
+                dquot_initialize(inode);
         if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
                 (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
                 handle_t *handle;
@@ -3152,7 +3165,7 @@ int ext3_setattr(struct dentry *dentry, struct iattr *attr)
                         error = PTR_ERR(handle);
                         goto err_out;
                 }
-                error = vfs_dq_transfer(inode, attr) ? -EDQUOT : 0;
+                error = dquot_transfer(inode, attr);
                 if (error) {
                         ext3_journal_stop(handle);
                         return error;
@@ -3237,7 +3250,7 @@ static int ext3_writepage_trans_blocks(struct inode *inode)
                 ret = 2 * (bpp + indirects) + 2;
 
 #ifdef CONFIG_QUOTA
-        /* We know that structure was already allocated during vfs_dq_init so
+        /* We know that structure was already allocated during dquot_initialize so
          * we will be updating only the data blocks + inodes */
         ret += EXT3_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb);
 #endif
@@ -3328,7 +3341,7 @@ int ext3_mark_inode_dirty(handle_t *handle, struct inode *inode)
  * i_size has been changed by generic_commit_write() and we thus need
  * to include the updated inode in the current transaction.
  *
- * Also, vfs_dq_alloc_space() will always dirty the inode when blocks
+ * Also, dquot_alloc_space() will always dirty the inode when blocks
  * are allocated to the file.
  *
  * If the inode is marked synchronous, we don't honour that here - doing
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 7b0e44f7d66f..ee184084ca42 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1696,6 +1696,8 @@ static int ext3_create (struct inode * dir, struct dentry * dentry, int mode,
         struct inode * inode;
         int err, retries = 0;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext3_journal_start(dir, EXT3_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT3_INDEX_EXTRA_TRANS_BLOCKS + 3 +
@@ -1730,6 +1732,8 @@ static int ext3_mknod (struct inode * dir, struct dentry *dentry,
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext3_journal_start(dir, EXT3_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT3_INDEX_EXTRA_TRANS_BLOCKS + 3 +
@@ -1766,6 +1770,8 @@ static int ext3_mkdir(struct inode * dir, struct dentry * dentry, int mode)
         if (dir->i_nlink >= EXT3_LINK_MAX)
                 return -EMLINK;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext3_journal_start(dir, EXT3_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT3_INDEX_EXTRA_TRANS_BLOCKS + 3 +
@@ -2060,7 +2066,9 @@ static int ext3_rmdir (struct inode * dir, struct dentry *dentry)
 
         /* Initialize quotas before so that eventual writes go in
          * separate transaction */
-        vfs_dq_init(dentry->d_inode);
+        dquot_initialize(dir);
+        dquot_initialize(dentry->d_inode);
+
         handle = ext3_journal_start(dir, EXT3_DELETE_TRANS_BLOCKS(dir->i_sb));
         if (IS_ERR(handle))
                 return PTR_ERR(handle);
@@ -2119,7 +2127,9 @@ static int ext3_unlink(struct inode * dir, struct dentry *dentry)
 
         /* Initialize quotas before so that eventual writes go
          * in separate transaction */
-        vfs_dq_init(dentry->d_inode);
+        dquot_initialize(dir);
+        dquot_initialize(dentry->d_inode);
+
         handle = ext3_journal_start(dir, EXT3_DELETE_TRANS_BLOCKS(dir->i_sb));
         if (IS_ERR(handle))
                 return PTR_ERR(handle);
@@ -2174,6 +2184,8 @@ static int ext3_symlink (struct inode * dir,
         if (l > dir->i_sb->s_blocksize)
                 return -ENAMETOOLONG;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext3_journal_start(dir, EXT3_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT3_INDEX_EXTRA_TRANS_BLOCKS + 5 +
@@ -2228,6 +2240,9 @@ static int ext3_link (struct dentry * old_dentry,
 
         if (inode->i_nlink >= EXT3_LINK_MAX)
                 return -EMLINK;
+
+        dquot_initialize(dir);
+
         /*
          * Return -ENOENT if we've raced with unlink and i_nlink is 0.  Doing
          * otherwise has the potential to corrupt the orphan inode list.
@@ -2278,12 +2293,15 @@ static int ext3_rename (struct inode * old_dir, struct dentry *old_dentry,
         struct ext3_dir_entry_2 * old_de, * new_de;
         int retval, flush_file = 0;
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         old_bh = new_bh = dir_bh = NULL;
 
         /* Initialize quotas before so that eventual writes go
          * in separate transaction */
         if (new_dentry->d_inode)
-                vfs_dq_init(new_dentry->d_inode);
+                dquot_initialize(new_dentry->d_inode);
         handle = ext3_journal_start(old_dir, 2 *
                                         EXT3_DATA_TRANS_BLOCKS(old_dir->i_sb) +
                                         EXT3_INDEX_EXTRA_TRANS_BLOCKS + 2);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index afa2b569da10..1bee604cc6cd 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -164,7 +164,7 @@ void ext3_msg(struct super_block *sb, const char *prefix,
  * write out the superblock safely.
  *
  * We'll just use the journal_abort() error code to record an error in
- * the journal instead.  On recovery, the journal will compain about
+ * the journal instead.  On recovery, the journal will complain about
  * that error until we've noted it down and cleared it.
  */
 
@@ -181,7 +181,7 @@ static void ext3_handle_error(struct super_block *sb)
         if (!test_opt (sb, ERRORS_CONT)) {
                 journal_t *journal = EXT3_SB(sb)->s_journal;
 
-                EXT3_SB(sb)->s_mount_opt |= EXT3_MOUNT_ABORT;
+                set_opt(EXT3_SB(sb)->s_mount_opt, ABORT);
                 if (journal)
                         journal_abort(journal, -EIO);
         }
@@ -296,7 +296,7 @@ void ext3_abort (struct super_block * sb, const char * function,
                 "error: remounting filesystem read-only");
         EXT3_SB(sb)->s_mount_state |= EXT3_ERROR_FS;
         sb->s_flags |= MS_RDONLY;
-        EXT3_SB(sb)->s_mount_opt |= EXT3_MOUNT_ABORT;
+        set_opt(EXT3_SB(sb)->s_mount_opt, ABORT);
         if (EXT3_SB(sb)->s_journal)
                 journal_abort(EXT3_SB(sb)->s_journal, -EIO);
 }
@@ -528,6 +528,8 @@ static void destroy_inodecache(void)
 static void ext3_clear_inode(struct inode *inode)
 {
         struct ext3_block_alloc_info *rsv = EXT3_I(inode)->i_block_alloc_info;
+
+        dquot_drop(inode);
         ext3_discard_reservation(inode);
         EXT3_I(inode)->i_block_alloc_info = NULL;
         if (unlikely(rsv))
@@ -562,10 +564,10 @@ static inline void ext3_show_quota_options(struct seq_file *seq, struct super_bl
         if (sbi->s_qf_names[GRPQUOTA])
                 seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
 
-        if (sbi->s_mount_opt & EXT3_MOUNT_USRQUOTA)
+        if (test_opt(sb, USRQUOTA))
                 seq_puts(seq, ",usrquota");
 
-        if (sbi->s_mount_opt & EXT3_MOUNT_GRPQUOTA)
+        if (test_opt(sb, GRPQUOTA))
                 seq_puts(seq, ",grpquota");
 #endif
 }
@@ -656,8 +658,7 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
         if (test_opt(sb, NOBH))
                 seq_puts(seq, ",nobh");
 
-        seq_printf(seq, ",data=%s", data_mode_string(sbi->s_mount_opt &
-                                                     EXT3_MOUNT_DATA_FLAGS));
+        seq_printf(seq, ",data=%s", data_mode_string(test_opt(sb, DATA_FLAGS)));
         if (test_opt(sb, DATA_ERR_ABORT))
                 seq_puts(seq, ",data_err=abort");
 
@@ -751,13 +752,6 @@ static ssize_t ext3_quota_write(struct super_block *sb, int type,
                                 const char *data, size_t len, loff_t off);
 
 static const struct dquot_operations ext3_quota_operations = {
-        .initialize     = dquot_initialize,
-        .drop           = dquot_drop,
-        .alloc_space    = dquot_alloc_space,
-        .alloc_inode    = dquot_alloc_inode,
-        .free_space     = dquot_free_space,
-        .free_inode     = dquot_free_inode,
-        .transfer       = dquot_transfer,
         .write_dquot    = ext3_write_dquot,
         .acquire_dquot  = ext3_acquire_dquot,
         .release_dquot  = ext3_release_dquot,
@@ -896,6 +890,63 @@ static ext3_fsblk_t get_sb_block(void **data, struct super_block *sb)
         return sb_block;
 }
 
+#ifdef CONFIG_QUOTA
+static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+{
+        struct ext3_sb_info *sbi = EXT3_SB(sb);
+        char *qname;
+
+        if (sb_any_quota_loaded(sb) &&
+                !sbi->s_qf_names[qtype]) {
+                ext3_msg(sb, KERN_ERR,
+                        "Cannot change journaled "
+                        "quota options when quota turned on");
+                return 0;
+        }
+        qname = match_strdup(args);
+        if (!qname) {
+                ext3_msg(sb, KERN_ERR,
+                        "Not enough memory for storing quotafile name");
+                return 0;
+        }
+        if (sbi->s_qf_names[qtype] &&
+                strcmp(sbi->s_qf_names[qtype], qname)) {
+                ext3_msg(sb, KERN_ERR,
+                        "%s quota file already specified", QTYPE2NAME(qtype));
+                kfree(qname);
+                return 0;
+        }
+        sbi->s_qf_names[qtype] = qname;
+        if (strchr(sbi->s_qf_names[qtype], '/')) {
+                ext3_msg(sb, KERN_ERR,
+                        "quotafile must be on filesystem root");
+                kfree(sbi->s_qf_names[qtype]);
+                sbi->s_qf_names[qtype] = NULL;
+                return 0;
+        }
+        set_opt(sbi->s_mount_opt, QUOTA);
+        return 1;
+}
+
+static int clear_qf_name(struct super_block *sb, int qtype) {
+
+        struct ext3_sb_info *sbi = EXT3_SB(sb);
+
+        if (sb_any_quota_loaded(sb) &&
+                sbi->s_qf_names[qtype]) {
+                ext3_msg(sb, KERN_ERR, "Cannot change journaled quota options"
+                        " when quota turned on");
+                return 0;
+        }
+        /*
+         * The space will be released later when all options are confirmed
+         * to be correct
+         */
+        sbi->s_qf_names[qtype] = NULL;
+        return 1;
+}
+#endif
+
 static int parse_options (char *options, struct super_block *sb,
                           unsigned int *inum, unsigned long *journal_devnum,
                           ext3_fsblk_t *n_blocks_count, int is_remount)
@@ -906,8 +957,7 @@ static int parse_options (char *options, struct super_block *sb,
         int data_opt = 0;
         int option;
 #ifdef CONFIG_QUOTA
-        int qtype, qfmt;
-        char *qname;
+        int qfmt;
 #endif
 
         if (!options)
@@ -1065,20 +1115,19 @@ static int parse_options (char *options, struct super_block *sb,
                         data_opt = EXT3_MOUNT_WRITEBACK_DATA;
                 datacheck:
                         if (is_remount) {
-                                if ((sbi->s_mount_opt & EXT3_MOUNT_DATA_FLAGS)
-                                                == data_opt)
+                                if (test_opt(sb, DATA_FLAGS) == data_opt)
                                         break;
                                 ext3_msg(sb, KERN_ERR,
                                         "error: cannot change "
                                         "data mode on remount. The filesystem "
                                         "is mounted in data=%s mode and you "
                                         "try to remount it in data=%s mode.",
-                                        data_mode_string(sbi->s_mount_opt &
-                                                        EXT3_MOUNT_DATA_FLAGS),
+                                        data_mode_string(test_opt(sb,
+                                                        DATA_FLAGS)),
                                         data_mode_string(data_opt));
                                 return 0;
                         } else {
-                                sbi->s_mount_opt &= ~EXT3_MOUNT_DATA_FLAGS;
+                                clear_opt(sbi->s_mount_opt, DATA_FLAGS);
                                 sbi->s_mount_opt |= data_opt;
                         }
                         break;
@@ -1090,62 +1139,20 @@ static int parse_options (char *options, struct super_block *sb,
                         break;
 #ifdef CONFIG_QUOTA
                 case Opt_usrjquota:
-                        qtype = USRQUOTA;
-                        goto set_qf_name;
-                case Opt_grpjquota:
-                        qtype = GRPQUOTA;
-set_qf_name:
-                        if (sb_any_quota_loaded(sb) &&
-                            !sbi->s_qf_names[qtype]) {
-                                ext3_msg(sb, KERN_ERR,
-                                        "error: cannot change journaled "
-                                        "quota options when quota turned on.");
-                                return 0;
-                        }
-                        qname = match_strdup(&args[0]);
-                        if (!qname) {
-                                ext3_msg(sb, KERN_ERR,
-                                        "error: not enough memory for "
-                                        "storing quotafile name.");
+                        if (!set_qf_name(sb, USRQUOTA, &args[0]))
                                 return 0;
-                        }
-                        if (sbi->s_qf_names[qtype] &&
-                            strcmp(sbi->s_qf_names[qtype], qname)) {
-                                ext3_msg(sb, KERN_ERR,
-                                        "error: %s quota file already "
-                                        "specified.", QTYPE2NAME(qtype));
-                                kfree(qname);
-                                return 0;
-                        }
-                        sbi->s_qf_names[qtype] = qname;
-                        if (strchr(sbi->s_qf_names[qtype], '/')) {
-                                ext3_msg(sb, KERN_ERR,
-                                        "error: quotafile must be on "
-                                        "filesystem root.");
-                                kfree(sbi->s_qf_names[qtype]);
-                                sbi->s_qf_names[qtype] = NULL;
+                        break;
+                case Opt_grpjquota:
+                        if (!set_qf_name(sb, GRPQUOTA, &args[0]))
                                 return 0;
-                        }
-                        set_opt(sbi->s_mount_opt, QUOTA);
                         break;
                 case Opt_offusrjquota:
-                        qtype = USRQUOTA;
-                        goto clear_qf_name;
+                        if (!clear_qf_name(sb, USRQUOTA))
+                                return 0;
+                        break;
                 case Opt_offgrpjquota:
-                        qtype = GRPQUOTA;
-clear_qf_name:
-                        if (sb_any_quota_loaded(sb) &&
-                            sbi->s_qf_names[qtype]) {
-                                ext3_msg(sb, KERN_ERR, "error: cannot change "
-                                        "journaled quota options when "
-                                        "quota turned on.");
+                        if (!clear_qf_name(sb, GRPQUOTA))
                                 return 0;
-                        }
-                        /*
-                         * The space will be released later when all options
-                         * are confirmed to be correct
-                         */
-                        sbi->s_qf_names[qtype] = NULL;
                         break;
                 case Opt_jqfmt_vfsold:
                         qfmt = QFMT_VFS_OLD;
@@ -1244,18 +1251,12 @@ set_qf_format:
         }
 #ifdef CONFIG_QUOTA
         if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
-                if ((sbi->s_mount_opt & EXT3_MOUNT_USRQUOTA) &&
-                     sbi->s_qf_names[USRQUOTA])
+                if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
                         clear_opt(sbi->s_mount_opt, USRQUOTA);
-
-                if ((sbi->s_mount_opt & EXT3_MOUNT_GRPQUOTA) &&
-                     sbi->s_qf_names[GRPQUOTA])
+                if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
                         clear_opt(sbi->s_mount_opt, GRPQUOTA);
 
-                if ((sbi->s_qf_names[USRQUOTA] &&
-                                (sbi->s_mount_opt & EXT3_MOUNT_GRPQUOTA)) ||
-                    (sbi->s_qf_names[GRPQUOTA] &&
-                                (sbi->s_mount_opt & EXT3_MOUNT_USRQUOTA))) {
+                if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
                         ext3_msg(sb, KERN_ERR, "error: old and new quota "
                                         "format mixing.");
                         return 0;
@@ -1478,7 +1479,7 @@ static void ext3_orphan_cleanup (struct super_block * sb,
                 }
 
                 list_add(&EXT3_I(inode)->i_orphan, &EXT3_SB(sb)->s_orphan);
-                vfs_dq_init(inode);
+                dquot_initialize(inode);
                 if (inode->i_nlink) {
                         printk(KERN_DEBUG
                                 "%s: truncating inode %lu to %Ld bytes\n",
@@ -1671,11 +1672,11 @@ static int ext3_fill_super (struct super_block *sb, void *data, int silent)
                 set_opt(sbi->s_mount_opt, POSIX_ACL);
 #endif
         if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_DATA)
-                sbi->s_mount_opt |= EXT3_MOUNT_JOURNAL_DATA;
+                set_opt(sbi->s_mount_opt, JOURNAL_DATA);
         else if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_ORDERED)
-                sbi->s_mount_opt |= EXT3_MOUNT_ORDERED_DATA;
+                set_opt(sbi->s_mount_opt, ORDERED_DATA);
         else if ((def_mount_opts & EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_WBACK)
-                sbi->s_mount_opt |= EXT3_MOUNT_WRITEBACK_DATA;
+                set_opt(sbi->s_mount_opt, WRITEBACK_DATA);
 
         if (le16_to_cpu(sbi->s_es->s_errors) == EXT3_ERRORS_PANIC)
                 set_opt(sbi->s_mount_opt, ERRORS_PANIC);
@@ -1694,7 +1695,7 @@ static int ext3_fill_super (struct super_block *sb, void *data, int silent)
                 goto failed_mount;
 
         sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
-                ((sbi->s_mount_opt & EXT3_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+                (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
 
         if (le32_to_cpu(es->s_rev_level) == EXT3_GOOD_OLD_REV &&
             (EXT3_HAS_COMPAT_FEATURE(sb, ~0U) ||
@@ -2561,11 +2562,11 @@ static int ext3_remount (struct super_block * sb, int * flags, char * data)
                 goto restore_opts;
         }
 
-        if (sbi->s_mount_opt & EXT3_MOUNT_ABORT)
+        if (test_opt(sb, ABORT))
                 ext3_abort(sb, __func__, "Abort forced by user");
 
         sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
-                ((sbi->s_mount_opt & EXT3_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+                (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
 
         es = sbi->s_es;
 
@@ -2573,7 +2574,7 @@ static int ext3_remount (struct super_block * sb, int * flags, char * data)
 
         if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY) ||
                 n_blocks_count > le32_to_cpu(es->s_blocks_count)) {
-                if (sbi->s_mount_opt & EXT3_MOUNT_ABORT) {
+                if (test_opt(sb, ABORT)) {
                         err = -EROFS;
                         goto restore_opts;
                 }
@@ -2734,7 +2735,7 @@ static int ext3_statfs (struct dentry * dentry, struct kstatfs * buf)
  * Process 1                         Process 2
  * ext3_create()                     quota_sync()
  *   journal_start()                   write_dquot()
- *   vfs_dq_init()                       down(dqio_mutex)
+ *   dquot_initialize()                       down(dqio_mutex)
  *     down(dqio_mutex)                    journal_start()
  *
  */
@@ -2942,9 +2943,7 @@ static ssize_t ext3_quota_write(struct super_block *sb, int type,
         sector_t blk = off >> EXT3_BLOCK_SIZE_BITS(sb);
         int err = 0;
         int offset = off & (sb->s_blocksize - 1);
-        int tocopy;
         int journal_quota = EXT3_SB(sb)->s_qf_names[type] != NULL;
-        size_t towrite = len;
         struct buffer_head *bh;
         handle_t *handle = journal_current_handle();
 
@@ -2955,53 +2954,54 @@ static ssize_t ext3_quota_write(struct super_block *sb, int type,
                         (unsigned long long)off, (unsigned long long)len);
                 return -EIO;
         }
+
+        /*
+         * Since we account only one data block in transaction credits,
+         * then it is impossible to cross a block boundary.
+         */
+        if (sb->s_blocksize - offset < len) {
+                ext3_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+                        " cancelled because not block aligned",
+                        (unsigned long long)off, (unsigned long long)len);
+                return -EIO;
+        }
         mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
-        while (towrite > 0) {
-                tocopy = sb->s_blocksize - offset < towrite ?
-                                sb->s_blocksize - offset : towrite;
-                bh = ext3_bread(handle, inode, blk, 1, &err);
-                if (!bh)
+        bh = ext3_bread(handle, inode, blk, 1, &err);
+        if (!bh)
+                goto out;
+        if (journal_quota) {
+                err = ext3_journal_get_write_access(handle, bh);
+                if (err) {
+                        brelse(bh);
                         goto out;
-                if (journal_quota) {
-                        err = ext3_journal_get_write_access(handle, bh);
-                        if (err) {
-                                brelse(bh);
-                                goto out;
-                        }
-                }
-                lock_buffer(bh);
-                memcpy(bh->b_data+offset, data, tocopy);
-                flush_dcache_page(bh->b_page);
-                unlock_buffer(bh);
-                if (journal_quota)
-                        err = ext3_journal_dirty_metadata(handle, bh);
-                else {
-                        /* Always do at least ordered writes for quotas */
-                        err = ext3_journal_dirty_data(handle, bh);
-                        mark_buffer_dirty(bh);
                 }
-                brelse(bh);
-                if (err)
-                        goto out;
-                offset = 0;
-                towrite -= tocopy;
-                data += tocopy;
-                blk++;
         }
+        lock_buffer(bh);
+        memcpy(bh->b_data+offset, data, len);
+        flush_dcache_page(bh->b_page);
+        unlock_buffer(bh);
+        if (journal_quota)
+                err = ext3_journal_dirty_metadata(handle, bh);
+        else {
+                /* Always do at least ordered writes for quotas */
+                err = ext3_journal_dirty_data(handle, bh);
+                mark_buffer_dirty(bh);
+        }
+        brelse(bh);
 out:
-        if (len == towrite) {
+        if (err) {
                 mutex_unlock(&inode->i_mutex);
                 return err;
         }
-        if (inode->i_size < off+len-towrite) {
-                i_size_write(inode, off+len-towrite);
+        if (inode->i_size < off + len) {
+                i_size_write(inode, off + len);
                 EXT3_I(inode)->i_disksize = inode->i_size;
         }
         inode->i_version++;
         inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         ext3_mark_inode_dirty(handle, inode);
         mutex_unlock(&inode->i_mutex);
-        return len - towrite;
+        return len;
 }
 
 #endif
diff --git a/fs/ext3/symlink.c b/fs/ext3/symlink.c
index ff7b4ccd8983..7c4898207776 100644
--- a/fs/ext3/symlink.c
+++ b/fs/ext3/symlink.c
@@ -34,6 +34,7 @@ const struct inode_operations ext3_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = page_follow_link_light,
         .put_link       = page_put_link,
+        .setattr        = ext3_setattr,
 #ifdef CONFIG_EXT3_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
@@ -45,6 +46,7 @@ const struct inode_operations ext3_symlink_inode_operations = {
 const struct inode_operations ext3_fast_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = ext3_follow_link,
+        .setattr        = ext3_setattr,
 #ifdef CONFIG_EXT3_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index 66895ccf76c7..534a94c3a933 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -274,7 +274,7 @@ ext3_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
         void *end;
         int error;
 
-        if (!(EXT3_I(inode)->i_state & EXT3_STATE_XATTR))
+        if (!ext3_test_inode_state(inode, EXT3_STATE_XATTR))
                 return -ENODATA;
         error = ext3_get_inode_loc(inode, &iloc);
         if (error)
@@ -403,7 +403,7 @@ ext3_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)
         void *end;
         int error;
 
-        if (!(EXT3_I(inode)->i_state & EXT3_STATE_XATTR))
+        if (!ext3_test_inode_state(inode, EXT3_STATE_XATTR))
                 return 0;
         error = ext3_get_inode_loc(inode, &iloc);
         if (error)
@@ -500,7 +500,7 @@ ext3_xattr_release_block(handle_t *handle, struct inode *inode,
                 error = ext3_journal_dirty_metadata(handle, bh);
                 if (IS_SYNC(inode))
                         handle->h_sync = 1;
-                vfs_dq_free_block(inode, 1);
+                dquot_free_block(inode, 1);
                 ea_bdebug(bh, "refcount now=%d; releasing",
                           le32_to_cpu(BHDR(bh)->h_refcount));
                 if (ce)
@@ -775,8 +775,8 @@ inserted:
                         else {
                                 /* The old block is released after updating
                                    the inode. */
-                                error = -EDQUOT;
-                                if (vfs_dq_alloc_block(inode, 1))
+                                error = dquot_alloc_block(inode, 1);
+                                if (error)
                                         goto cleanup;
                                 error = ext3_journal_get_write_access(handle,
                                                                       new_bh);
@@ -850,7 +850,7 @@ cleanup:
         return error;
 
 cleanup_dquot:
-        vfs_dq_free_block(inode, 1);
+        dquot_free_block(inode, 1);
         goto cleanup;
 
 bad_block:
@@ -882,7 +882,7 @@ ext3_xattr_ibody_find(struct inode *inode, struct ext3_xattr_info *i,
         is->s.base = is->s.first = IFIRST(header);
         is->s.here = is->s.first;
         is->s.end = (void *)raw_inode + EXT3_SB(inode->i_sb)->s_inode_size;
-        if (EXT3_I(inode)->i_state & EXT3_STATE_XATTR) {
+        if (ext3_test_inode_state(inode, EXT3_STATE_XATTR)) {
                 error = ext3_xattr_check_names(IFIRST(header), is->s.end);
                 if (error)
                         return error;
@@ -914,10 +914,10 @@ ext3_xattr_ibody_set(handle_t *handle, struct inode *inode,
         header = IHDR(inode, ext3_raw_inode(&is->iloc));
         if (!IS_LAST_ENTRY(s->first)) {
                 header->h_magic = cpu_to_le32(EXT3_XATTR_MAGIC);
-                EXT3_I(inode)->i_state |= EXT3_STATE_XATTR;
+                ext3_set_inode_state(inode, EXT3_STATE_XATTR);
         } else {
                 header->h_magic = cpu_to_le32(0);
-                EXT3_I(inode)->i_state &= ~EXT3_STATE_XATTR;
+                ext3_clear_inode_state(inode, EXT3_STATE_XATTR);
         }
         return 0;
 }
@@ -967,10 +967,10 @@ ext3_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
         if (error)
                 goto cleanup;
 
-        if (EXT3_I(inode)->i_state & EXT3_STATE_NEW) {
+        if (ext3_test_inode_state(inode, EXT3_STATE_NEW)) {
                 struct ext3_inode *raw_inode = ext3_raw_inode(&is.iloc);
                 memset(raw_inode, 0, EXT3_SB(inode->i_sb)->s_inode_size);
-                EXT3_I(inode)->i_state &= ~EXT3_STATE_NEW;
+                ext3_clear_inode_state(inode, EXT3_STATE_NEW);
         }
 
         error = ext3_xattr_ibody_find(inode, &i, &is);
diff --git a/fs/ext3/xattr_security.c b/fs/ext3/xattr_security.c
index 474348788dd9..3af91f476dff 100644
--- a/fs/ext3/xattr_security.c
+++ b/fs/ext3/xattr_security.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/fs.h>
 #include <linux/ext3_jbd.h>
diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
index 9acf7e808139..9ed1bb1f319f 100644
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -28,6 +28,7 @@ config EXT4_FS
 
 config EXT4_USE_FOR_EXT23
         bool "Use ext4 for ext2/ext3 file systems"
+        depends on EXT4_FS
         depends on EXT3_FS=n || EXT2_FS=n
         default y
         help
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 22bc7435d913..d2f37a5516c7 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -97,8 +97,8 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                 /* If checksum is bad mark all blocks used to prevent allocation
                  * essentially implementing a per-group read-only flag. */
                 if (!ext4_group_desc_csum_verify(sbi, block_group, gdp)) {
-                        ext4_error(sb, __func__,
-                                  "Checksum bad for group %u", block_group);
+                        ext4_error(sb, "Checksum bad for group %u",
+                                        block_group);
                         ext4_free_blks_set(sb, gdp, 0);
                         ext4_free_inodes_set(sb, gdp, 0);
                         ext4_itable_unused_set(sb, gdp, 0);
@@ -130,8 +130,7 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                  * to make sure we calculate the right free blocks
                  */
                 group_blocks = ext4_blocks_count(sbi->s_es) -
-                        le32_to_cpu(sbi->s_es->s_first_data_block) -
-                        (EXT4_BLOCKS_PER_GROUP(sb) * (ngroups - 1));
+                        ext4_group_first_block_no(sb, ngroups - 1);
         } else {
                 group_blocks = EXT4_BLOCKS_PER_GROUP(sb);
         }
@@ -189,9 +188,6 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
  * when a file system is mounted (see ext4_fill_super).
  */
 
-
-#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
-
 /**
  * ext4_get_group_desc() -- load group descriptor from disk
  * @sb:                 super block
@@ -210,10 +206,8 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
         struct ext4_sb_info *sbi = EXT4_SB(sb);
 
         if (block_group >= ngroups) {
-                ext4_error(sb, "ext4_get_group_desc",
-                           "block_group >= groups_count - "
-                           "block_group = %u, groups_count = %u",
-                           block_group, ngroups);
+                ext4_error(sb, "block_group >= groups_count - block_group = %u,"
+                           " groups_count = %u", block_group, ngroups);
 
                 return NULL;
         }
@@ -221,8 +215,7 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
         group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
         offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
         if (!sbi->s_group_desc[group_desc]) {
-                ext4_error(sb, "ext4_get_group_desc",
-                           "Group descriptor not loaded - "
+                ext4_error(sb, "Group descriptor not loaded - "
                            "block_group = %u, group_desc = %u, desc = %u",
                            block_group, group_desc, offset);
                 return NULL;
@@ -282,9 +275,7 @@ static int ext4_valid_block_bitmap(struct super_block *sb,
                 return 1;
 
 err_out:
-        ext4_error(sb, __func__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %llu",
+        ext4_error(sb, "Invalid block bitmap - block_group = %d, block = %llu",
                         block_group, bitmap_blk);
         return 0;
 }
@@ -311,8 +302,7 @@ ext4_read_block_bitmap(struct super_block *sb, ext4_group_t block_group)
         bitmap_blk = ext4_block_bitmap(sb, desc);
         bh = sb_getblk(sb, bitmap_blk);
         if (unlikely(!bh)) {
-                ext4_error(sb, __func__,
-                            "Cannot read block bitmap - "
+                ext4_error(sb, "Cannot read block bitmap - "
                             "block_group = %u, block_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -354,8 +344,7 @@ ext4_read_block_bitmap(struct super_block *sb, ext4_group_t block_group)
         set_bitmap_uptodate(bh);
         if (bh_submit_read(bh) < 0) {
                 put_bh(bh);
-                ext4_error(sb, __func__,
-                            "Cannot read block bitmap - "
+                ext4_error(sb, "Cannot read block bitmap - "
                             "block_group = %u, block_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -419,8 +408,7 @@ void ext4_add_groupblocks(handle_t *handle, struct super_block *sb,
             in_range(block, ext4_inode_table(sb, desc), sbi->s_itb_per_group) ||
             in_range(block + count - 1, ext4_inode_table(sb, desc),
                      sbi->s_itb_per_group)) {
-                ext4_error(sb, __func__,
-                           "Adding blocks in system zones - "
+                ext4_error(sb, "Adding blocks in system zones - "
                            "Block = %llu, count = %lu",
                            block, count);
                 goto error_return;
@@ -453,8 +441,7 @@ void ext4_add_groupblocks(handle_t *handle, struct super_block *sb,
                 BUFFER_TRACE(bitmap_bh, "clear bit");
                 if (!ext4_clear_bit_atomic(ext4_group_lock_ptr(sb, block_group),
                                                 bit + i, bitmap_bh->b_data)) {
-                        ext4_error(sb, __func__,
-                                   "bit already cleared for block %llu",
+                        ext4_error(sb, "bit already cleared for block %llu",
                                    (ext4_fsblk_t)(block + i));
                         BUFFER_TRACE(bitmap_bh, "bit already cleared");
                 } else {
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index 4df8621ec31c..538c48655084 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -16,9 +16,9 @@
 #include <linux/module.h>
 #include <linux/swap.h>
 #include <linux/pagemap.h>
-#include <linux/version.h>
 #include <linux/blkdev.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include "ext4.h"
 
 struct ext4_system_zone {
@@ -206,14 +206,14 @@ void ext4_release_system_zone(struct super_block *sb)
                 entry = rb_entry(n, struct ext4_system_zone, node);
                 kmem_cache_free(ext4_system_zone_cachep, entry);
                 if (!parent)
-                        EXT4_SB(sb)->system_blks.rb_node = NULL;
+                        EXT4_SB(sb)->system_blks = RB_ROOT;
                 else if (parent->rb_left == n)
                         parent->rb_left = NULL;
                 else if (parent->rb_right == n)
                         parent->rb_right = NULL;
                 n = parent;
         }
-        EXT4_SB(sb)->system_blks.rb_node = NULL;
+        EXT4_SB(sb)->system_blks = RB_ROOT;
 }
 
 /*
diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
index 9dc93168e262..86cb6d86a048 100644
--- a/fs/ext4/dir.c
+++ b/fs/ext4/dir.c
@@ -83,10 +83,12 @@ int ext4_check_dir_entry(const char *function, struct inode *dir,
                 error_msg = "inode out of bounds";
 
         if (error_msg != NULL)
-                ext4_error(dir->i_sb, function,
-                        "bad entry in directory #%lu: %s - "
-                        "offset=%u, inode=%u, rec_len=%d, name_len=%d",
-                        dir->i_ino, error_msg, offset,
+                __ext4_error(dir->i_sb, function,
+                        "bad entry in directory #%lu: %s - block=%llu"
+                        "offset=%u(%u), inode=%u, rec_len=%d, name_len=%d",
+                        dir->i_ino, error_msg, 
+                        (unsigned long long) bh->b_blocknr,     
+                        (unsigned) (offset%bh->b_size), offset,
                         le32_to_cpu(de->inode),
                         rlen, de->name_len);
         return error_msg == NULL ? 1 : 0;
@@ -150,7 +152,7 @@ static int ext4_readdir(struct file *filp,
                  */
                 if (!bh) {
                         if (!dir_has_error) {
-                                ext4_error(sb, __func__, "directory #%lu "
+                                ext4_error(sb, "directory #%lu "
                                            "contains a hole at offset %Lu",
                                            inode->i_ino,
                                            (unsigned long long) filp->f_pos);
@@ -303,7 +305,7 @@ static void free_rb_tree_fname(struct rb_root *root)
                         kfree(old);
                 }
                 if (!parent)
-                        root->rb_node = NULL;
+                        *root = RB_ROOT;
                 else if (parent->rb_left == n)
                         parent->rb_left = NULL;
                 else if (parent->rb_right == n)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 56f9271ee8cc..bf938cf7c5f0 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -53,6 +53,12 @@
 #define ext4_debug(f, a...)     do {} while (0)
 #endif
 
+#define EXT4_ERROR_INODE(inode, fmt, a...) \
+        ext4_error_inode(__func__, (inode), (fmt), ## a);
+
+#define EXT4_ERROR_FILE(file, fmt, a...)        \
+        ext4_error_file(__func__, (file), (fmt), ## a);
+
 /* data type for block offset of block group */
 typedef int ext4_grpblk_t;
 
@@ -133,14 +139,14 @@ struct mpage_da_data {
         int pages_written;
         int retval;
 };
-#define DIO_AIO_UNWRITTEN       0x1
+#define EXT4_IO_UNWRITTEN       0x1
 typedef struct ext4_io_end {
         struct list_head        list;           /* per-file finished AIO list */
         struct inode            *inode;         /* file being written to */
         unsigned int            flag;           /* unwritten or not */
-        int                     error;          /* I/O error code */
-        ext4_lblk_t             offset;         /* offset in the file */
-        size_t                  size;           /* size of the extent */
+        struct page             *page;          /* page struct for buffer write */
+        loff_t                  offset;         /* offset in the file */
+        ssize_t                 size;           /* size of the extent */
         struct work_struct      work;           /* data work queue */
 } ext4_io_end_t;
 
@@ -284,10 +290,12 @@ struct flex_groups {
 #define EXT4_TOPDIR_FL                  0x00020000 /* Top of directory hierarchies*/
 #define EXT4_HUGE_FILE_FL               0x00040000 /* Set to each huge file */
 #define EXT4_EXTENTS_FL                 0x00080000 /* Inode uses extents */
+#define EXT4_EA_INODE_FL                0x00200000 /* Inode used for large EA */
+#define EXT4_EOFBLOCKS_FL               0x00400000 /* Blocks allocated beyond EOF */
 #define EXT4_RESERVED_FL                0x80000000 /* reserved for ext4 lib */
 
-#define EXT4_FL_USER_VISIBLE            0x000BDFFF /* User visible flags */
-#define EXT4_FL_USER_MODIFIABLE         0x000B80FF /* User modifiable flags */
+#define EXT4_FL_USER_VISIBLE            0x004BDFFF /* User visible flags */
+#define EXT4_FL_USER_MODIFIABLE         0x004B80FF /* User modifiable flags */
 
 /* Flags that should be inherited by new inodes from their parent. */
 #define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
@@ -313,17 +321,6 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
                 return flags & EXT4_OTHER_FLMASK;
 }
 
-/*
- * Inode dynamic state flags
- */
-#define EXT4_STATE_JDATA                0x00000001 /* journaled data exists */
-#define EXT4_STATE_NEW                  0x00000002 /* inode is newly created */
-#define EXT4_STATE_XATTR                0x00000004 /* has in-inode xattrs */
-#define EXT4_STATE_NO_EXPAND            0x00000008 /* No space for expansion */
-#define EXT4_STATE_DA_ALLOC_CLOSE       0x00000010 /* Alloc DA blks on close */
-#define EXT4_STATE_EXT_MIGRATE          0x00000020 /* Inode is migrating */
-#define EXT4_STATE_DIO_UNWRITTEN        0x00000040 /* need convert on dio done*/
-
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
         __u32 group;            /* Group number for this data */
@@ -361,25 +358,23 @@ struct ext4_new_group_data {
            so set the magic i_delalloc_reserve_flag after taking the 
            inode allocation semaphore for */
 #define EXT4_GET_BLOCKS_DELALLOC_RESERVE        0x0004
-        /* Call ext4_da_update_reserve_space() after successfully 
-           allocating the blocks */
-#define EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE    0x0008
         /* caller is from the direct IO path, request to creation of an
         unitialized extents if not allocated, split the uninitialized
         extent if blocks has been preallocated already*/
-#define EXT4_GET_BLOCKS_DIO                     0x0010
-#define EXT4_GET_BLOCKS_CONVERT                 0x0020
-#define EXT4_GET_BLOCKS_DIO_CREATE_EXT          (EXT4_GET_BLOCKS_DIO|\
+#define EXT4_GET_BLOCKS_PRE_IO                  0x0008
+#define EXT4_GET_BLOCKS_CONVERT                 0x0010
+#define EXT4_GET_BLOCKS_IO_CREATE_EXT           (EXT4_GET_BLOCKS_PRE_IO|\
+                                         EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
+        /* Convert extent to initialized after IO complete */
+#define EXT4_GET_BLOCKS_IO_CONVERT_EXT          (EXT4_GET_BLOCKS_CONVERT|\
                                          EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
-        /* Convert extent to initialized after direct IO complete */
-#define EXT4_GET_BLOCKS_DIO_CONVERT_EXT         (EXT4_GET_BLOCKS_CONVERT|\
-                                         EXT4_GET_BLOCKS_DIO_CREATE_EXT)
 
 /*
  * Flags used by ext4_free_blocks
  */
 #define EXT4_FREE_BLOCKS_METADATA       0x0001
 #define EXT4_FREE_BLOCKS_FORGET         0x0002
+#define EXT4_FREE_BLOCKS_VALIDATED      0x0004
 
 /*
  * ioctl commands
@@ -633,7 +628,7 @@ struct ext4_inode_info {
          * near to their parent directory's inode.
          */
         ext4_group_t    i_block_group;
-        __u32   i_state;                /* Dynamic state flags for ext4 */
+        unsigned long   i_state_flags;          /* Dynamic state flags */
 
         ext4_lblk_t             i_dir_start_lookup;
 #ifdef CONFIG_EXT4_FS_XATTR
@@ -699,6 +694,8 @@ struct ext4_inode_info {
         unsigned int i_reserved_meta_blocks;
         unsigned int i_allocated_meta_blocks;
         unsigned short i_delalloc_reserved_flag;
+        sector_t i_da_metadata_calc_last_lblock;
+        int i_da_metadata_calc_len;
 
         /* on-disk additional length */
         __u16 i_extra_isize;
@@ -709,8 +706,9 @@ struct ext4_inode_info {
         qsize_t i_reserved_quota;
 #endif
 
-        /* completed async DIOs that might need unwritten extents handling */
-        struct list_head i_aio_dio_complete_list;
+        /* completed IOs that might need unwritten extents handling */
+        struct list_head i_completed_io_list;
+        spinlock_t i_completed_io_lock;
         /* current io_end structure for async DIO write*/
         ext4_io_end_t *cur_aio_dio;
 
@@ -761,6 +759,7 @@ struct ext4_inode_info {
 #define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_DIOREAD_NOLOCK       0x400000 /* Enable support for dio read nolocking */
 #define EXT4_MOUNT_JOURNAL_CHECKSUM     0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
@@ -1015,7 +1014,7 @@ struct ext4_sb_info {
         atomic_t s_lock_busy;
 
         /* locality groups */
-        struct ext4_locality_group *s_locality_groups;
+        struct ext4_locality_group __percpu *s_locality_groups;
 
         /* for write statistics */
         unsigned long s_sectors_written_start;
@@ -1051,6 +1050,34 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
                 (ino >= EXT4_FIRST_INO(sb) &&
                  ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
 }
+
+/*
+ * Inode dynamic state flags
+ */
+enum {
+        EXT4_STATE_JDATA,               /* journaled data exists */
+        EXT4_STATE_NEW,                 /* inode is newly created */
+        EXT4_STATE_XATTR,               /* has in-inode xattrs */
+        EXT4_STATE_NO_EXPAND,           /* No space for expansion */
+        EXT4_STATE_DA_ALLOC_CLOSE,      /* Alloc DA blks on close */
+        EXT4_STATE_EXT_MIGRATE,         /* Inode is migrating */
+        EXT4_STATE_DIO_UNWRITTEN,       /* need convert on dio done*/
+};
+
+static inline int ext4_test_inode_state(struct inode *inode, int bit)
+{
+        return test_bit(bit, &EXT4_I(inode)->i_state_flags);
+}
+
+static inline void ext4_set_inode_state(struct inode *inode, int bit)
+{
+        set_bit(bit, &EXT4_I(inode)->i_state_flags);
+}
+
+static inline void ext4_clear_inode_state(struct inode *inode, int bit)
+{
+        clear_bit(bit, &EXT4_I(inode)->i_state_flags);
+}
 #else
 /* Assume that user mode programs are passing in an ext4fs superblock, not
  * a kernel struct super_block.  This will allow us to call the feature-test
@@ -1127,6 +1154,8 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
 #define EXT4_FEATURE_INCOMPAT_64BIT             0x0080
 #define EXT4_FEATURE_INCOMPAT_MMP               0x0100
 #define EXT4_FEATURE_INCOMPAT_FLEX_BG           0x0200
+#define EXT4_FEATURE_INCOMPAT_EA_INODE          0x0400 /* EA in inode */
+#define EXT4_FEATURE_INCOMPAT_DIRDATA           0x1000 /* data in dirent */
 
 #define EXT4_FEATURE_COMPAT_SUPP        EXT2_FEATURE_COMPAT_EXT_ATTR
 #define EXT4_FEATURE_INCOMPAT_SUPP      (EXT4_FEATURE_INCOMPAT_FILETYPE| \
@@ -1417,7 +1446,7 @@ int ext4_get_block(struct inode *inode, sector_t iblock,
                                 struct buffer_head *bh_result, int create);
 
 extern struct inode *ext4_iget(struct super_block *, unsigned long);
-extern int  ext4_write_inode(struct inode *, int);
+extern int  ext4_write_inode(struct inode *, struct writeback_control *);
 extern int  ext4_setattr(struct dentry *, struct iattr *);
 extern int  ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
                                 struct kstat *stat);
@@ -1440,7 +1469,9 @@ extern int ext4_block_truncate_page(handle_t *handle,
                 struct address_space *mapping, loff_t from);
 extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
 extern qsize_t *ext4_get_reserved_space(struct inode *inode);
-extern int flush_aio_dio_completed_IO(struct inode *inode);
+extern int flush_completed_IO(struct inode *inode);
+extern void ext4_da_update_reserve_space(struct inode *inode,
+                                        int used, int quota_claim);
 /* ioctl.c */
 extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
 extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
@@ -1464,13 +1495,20 @@ extern int ext4_group_extend(struct super_block *sb,
                                 ext4_fsblk_t n_blocks_count);
 
 /* super.c */
-extern void ext4_error(struct super_block *, const char *, const char *, ...)
+extern void __ext4_error(struct super_block *, const char *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+#define ext4_error(sb, message...)      __ext4_error(sb, __func__, ## message)
+extern void ext4_error_inode(const char *, struct inode *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+extern void ext4_error_file(const char *, struct file *, const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
 extern void __ext4_std_error(struct super_block *, const char *, int);
 extern void ext4_abort(struct super_block *, const char *, const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern void ext4_warning(struct super_block *, const char *, const char *, ...)
+extern void __ext4_warning(struct super_block *, const char *,
+                          const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
+#define ext4_warning(sb, message...)    __ext4_warning(sb, __func__, ## message)
 extern void ext4_msg(struct super_block *, const char *, const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
 extern void ext4_grp_locked_error(struct super_block *, ext4_group_t,
@@ -1743,7 +1781,7 @@ extern void ext4_ext_release(struct super_block *);
 extern long ext4_fallocate(struct inode *inode, int mode, loff_t offset,
                           loff_t len);
 extern int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
-                          loff_t len);
+                          ssize_t len);
 extern int ext4_get_blocks(handle_t *handle, struct inode *inode,
                            sector_t block, unsigned int max_blocks,
                            struct buffer_head *bh, int flags);
@@ -1755,6 +1793,15 @@ extern int ext4_move_extents(struct file *o_filp, struct file *d_filp,
                              __u64 len, __u64 *moved_len);
 
 
+/* BH_Uninit flag: blocks are allocated but uninitialized on disk */
+enum ext4_state_bits {
+        BH_Uninit       /* blocks are allocated but uninitialized on disk */
+          = BH_JBDPrivateStart,
+};
+
+BUFFER_FNS(Uninit, uninit)
+TAS_BUFFER_FNS(Uninit, uninit)
+
 /*
  * Add new method to test wether block and inode bitmaps are properly
  * initialized. With uninit_bg reading the block from disk is not enough
@@ -1772,6 +1819,8 @@ static inline void set_bitmap_uptodate(struct buffer_head *bh)
         set_bit(BH_BITMAP_UPTODATE, &(bh)->b_state);
 }
 
+#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
+
 #endif  /* __KERNEL__ */
 
 #endif  /* _EXT4_H */
diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 2ca686454e87..bdb6ce7e2eb4 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -225,7 +225,8 @@ static inline void ext4_ext_mark_initialized(struct ext4_extent *ext)
         ext->ee_len = cpu_to_le16(ext4_ext_get_actual_len(ext));
 }
 
-extern int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks);
+extern int ext4_ext_calc_metadata_amount(struct inode *inode,
+                                         sector_t lblocks);
 extern ext4_fsblk_t ext_pblock(struct ext4_extent *ex);
 extern ext4_fsblk_t idx_pblock(struct ext4_extent_idx *);
 extern void ext4_ext_store_pblock(struct ext4_extent *, ext4_fsblk_t);
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index b57e5c711b6d..53d2764d71ca 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -125,14 +125,14 @@ int __ext4_handle_dirty_metadata(const char *where, handle_t *handle,
                         ext4_journal_abort_handle(where, __func__, bh,
                                                   handle, err);
         } else {
-                if (inode && bh)
+                if (inode)
                         mark_buffer_dirty_inode(bh, inode);
                 else
                         mark_buffer_dirty(bh);
                 if (inode && inode_needs_sync(inode)) {
                         sync_dirty_buffer(bh);
                         if (buffer_req(bh) && !buffer_uptodate(bh)) {
-                                ext4_error(inode->i_sb, __func__,
+                                ext4_error(inode->i_sb,
                                            "IO error syncing inode, "
                                            "inode=%lu, block=%llu",
                                            inode->i_ino,
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 05eca817d704..b79ad5126468 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -304,4 +304,28 @@ static inline int ext4_should_writeback_data(struct inode *inode)
         return 0;
 }
 
+/*
+ * This function controls whether or not we should try to go down the
+ * dioread_nolock code paths, which makes it safe to avoid taking
+ * i_mutex for direct I/O reads.  This only works for extent-based
+ * files, and it doesn't work for nobh or if data journaling is
+ * enabled, since the dioread_nolock code uses b_private to pass
+ * information back to the I/O completion handler, and this conflicts
+ * with the jbd's use of b_private.
+ */
+static inline int ext4_should_dioread_nolock(struct inode *inode)
+{
+        if (!test_opt(inode->i_sb, DIOREAD_NOLOCK))
+                return 0;
+        if (test_opt(inode->i_sb, NOBH))
+                return 0;
+        if (!S_ISREG(inode->i_mode))
+                return 0;
+        if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
+                return 0;
+        if (ext4_should_journal_data(inode))
+                return 0;
+        return 1;
+}
+
 #endif  /* _EXT4_JBD2_H */
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 3a7928f825e4..236b834b4ca8 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -195,8 +195,7 @@ static ext4_fsblk_t ext4_ext_find_goal(struct inode *inode,
                 if (S_ISREG(inode->i_mode))
                         block_group++;
         }
-        bg_start = (block_group * EXT4_BLOCKS_PER_GROUP(inode->i_sb)) +
-                le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_first_data_block);
+        bg_start = ext4_group_first_block_no(inode->i_sb, block_group);
         last_block = ext4_blocks_count(EXT4_SB(inode->i_sb)->s_es) - 1;
 
         /*
@@ -296,29 +295,44 @@ static inline int ext4_ext_space_root_idx(struct inode *inode, int check)
  * to allocate @blocks
  * Worse case is one block per extent
  */
-int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks)
+int ext4_ext_calc_metadata_amount(struct inode *inode, sector_t lblock)
 {
-        int lcap, icap, rcap, leafs, idxs, num;
-        int newextents = blocks;
-
-        rcap = ext4_ext_space_root_idx(inode, 0);
-        lcap = ext4_ext_space_block(inode, 0);
-        icap = ext4_ext_space_block_idx(inode, 0);
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int idxs, num = 0;
 
-        /* number of new leaf blocks needed */
-        num = leafs = (newextents + lcap - 1) / lcap;
+        idxs = ((inode->i_sb->s_blocksize - sizeof(struct ext4_extent_header))
+                / sizeof(struct ext4_extent_idx));
 
         /*
-         * Worse case, we need separate index block(s)
-         * to link all new leaf blocks
+         * If the new delayed allocation block is contiguous with the
+         * previous da block, it can share index blocks with the
+         * previous block, so we only need to allocate a new index
+         * block every idxs leaf blocks.  At ldxs**2 blocks, we need
+         * an additional index block, and at ldxs**3 blocks, yet
+         * another index blocks.
          */
-        idxs = (leafs + icap - 1) / icap;
-        do {
-                num += idxs;
-                idxs = (idxs + icap - 1) / icap;
-        } while (idxs > rcap);
+        if (ei->i_da_metadata_calc_len &&
+            ei->i_da_metadata_calc_last_lblock+1 == lblock) {
+                if ((ei->i_da_metadata_calc_len % idxs) == 0)
+                        num++;
+                if ((ei->i_da_metadata_calc_len % (idxs*idxs)) == 0)
+                        num++;
+                if ((ei->i_da_metadata_calc_len % (idxs*idxs*idxs)) == 0) {
+                        num++;
+                        ei->i_da_metadata_calc_len = 0;
+                } else
+                        ei->i_da_metadata_calc_len++;
+                ei->i_da_metadata_calc_last_lblock++;
+                return num;
+        }
 
-        return num;
+        /*
+         * In the worst case we need a new set of index blocks at
+         * every level of the inode's extent tree.
+         */
+        ei->i_da_metadata_calc_len = 1;
+        ei->i_da_metadata_calc_last_lblock = lblock;
+        return ext_depth(inode) + 1;
 }
 
 static int
@@ -425,7 +439,7 @@ static int __ext4_ext_check(const char *function, struct inode *inode,
         return 0;
 
 corrupted:
-        ext4_error(inode->i_sb, function,
+        __ext4_error(inode->i_sb, function,
                         "bad header/extent in inode #%lu: %s - magic %x, "
                         "entries %u, max %u(%u), depth %u(%u)",
                         inode->i_ino, error_msg, le16_to_cpu(eh->eh_magic),
@@ -688,7 +702,12 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block,
                 }
                 eh = ext_block_hdr(bh);
                 ppos++;
-                BUG_ON(ppos > depth);
+                if (unlikely(ppos > depth)) {
+                        put_bh(bh);
+                        EXT4_ERROR_INODE(inode,
+                                         "ppos %d > depth %d", ppos, depth);
+                        goto err;
+                }
                 path[ppos].p_bh = bh;
                 path[ppos].p_hdr = eh;
                 i--;
@@ -734,7 +753,12 @@ int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
         if (err)
                 return err;
 
-        BUG_ON(logical == le32_to_cpu(curp->p_idx->ei_block));
+        if (unlikely(logical == le32_to_cpu(curp->p_idx->ei_block))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d == ei_block %d!",
+                                 logical, le32_to_cpu(curp->p_idx->ei_block));
+                return -EIO;
+        }
         len = EXT_MAX_INDEX(curp->p_hdr) - curp->p_idx;
         if (logical > le32_to_cpu(curp->p_idx->ei_block)) {
                 /* insert after */
@@ -764,9 +788,17 @@ int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
         ext4_idx_store_pblock(ix, ptr);
         le16_add_cpu(&curp->p_hdr->eh_entries, 1);
 
-        BUG_ON(le16_to_cpu(curp->p_hdr->eh_entries)
-                             > le16_to_cpu(curp->p_hdr->eh_max));
-        BUG_ON(ix > EXT_LAST_INDEX(curp->p_hdr));
+        if (unlikely(le16_to_cpu(curp->p_hdr->eh_entries)
+                             > le16_to_cpu(curp->p_hdr->eh_max))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d == ei_block %d!",
+                                 logical, le32_to_cpu(curp->p_idx->ei_block));
+                return -EIO;
+        }
+        if (unlikely(ix > EXT_LAST_INDEX(curp->p_hdr))) {
+                EXT4_ERROR_INODE(inode, "ix > EXT_LAST_INDEX!");
+                return -EIO;
+        }
 
         err = ext4_ext_dirty(handle, inode, curp);
         ext4_std_error(inode->i_sb, err);
@@ -804,7 +836,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
         /* if current leaf will be split, then we should use
          * border from split point */
-        BUG_ON(path[depth].p_ext > EXT_MAX_EXTENT(path[depth].p_hdr));
+        if (unlikely(path[depth].p_ext > EXT_MAX_EXTENT(path[depth].p_hdr))) {
+                EXT4_ERROR_INODE(inode, "p_ext > EXT_MAX_EXTENT!");
+                return -EIO;
+        }
         if (path[depth].p_ext != EXT_MAX_EXTENT(path[depth].p_hdr)) {
                 border = path[depth].p_ext[1].ee_block;
                 ext_debug("leaf will be split."
@@ -845,7 +880,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
         /* initialize new leaf */
         newblock = ablocks[--a];
-        BUG_ON(newblock == 0);
+        if (unlikely(newblock == 0)) {
+                EXT4_ERROR_INODE(inode, "newblock == 0!");
+                err = -EIO;
+                goto cleanup;
+        }
         bh = sb_getblk(inode->i_sb, newblock);
         if (!bh) {
                 err = -EIO;
@@ -865,7 +904,14 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
         ex = EXT_FIRST_EXTENT(neh);
 
         /* move remainder of path[depth] to the new leaf */
-        BUG_ON(path[depth].p_hdr->eh_entries != path[depth].p_hdr->eh_max);
+        if (unlikely(path[depth].p_hdr->eh_entries !=
+                     path[depth].p_hdr->eh_max)) {
+                EXT4_ERROR_INODE(inode, "eh_entries %d != eh_max %d!",
+                                 path[depth].p_hdr->eh_entries,
+                                 path[depth].p_hdr->eh_max);
+                err = -EIO;
+                goto cleanup;
+        }
         /* start copy from next extent */
         /* TODO: we could do it by single memmove */
         m = 0;
@@ -912,7 +958,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
         /* create intermediate indexes */
         k = depth - at - 1;
-        BUG_ON(k < 0);
+        if (unlikely(k < 0)) {
+                EXT4_ERROR_INODE(inode, "k %d < 0!", k);
+                err = -EIO;
+                goto cleanup;
+        }
         if (k)
                 ext_debug("create %d intermediate indices\n", k);
         /* insert new index into current index block */
@@ -949,8 +999,14 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
                 ext_debug("cur 0x%p, last 0x%p\n", path[i].p_idx,
                                 EXT_MAX_INDEX(path[i].p_hdr));
-                BUG_ON(EXT_MAX_INDEX(path[i].p_hdr) !=
-                                EXT_LAST_INDEX(path[i].p_hdr));
+                if (unlikely(EXT_MAX_INDEX(path[i].p_hdr) !=
+                                        EXT_LAST_INDEX(path[i].p_hdr))) {
+                        EXT4_ERROR_INODE(inode,
+                                         "EXT_MAX_INDEX != EXT_LAST_INDEX ee_block %d!",
+                                         le32_to_cpu(path[i].p_ext->ee_block));
+                        err = -EIO;
+                        goto cleanup;
+                }
                 while (path[i].p_idx <= EXT_MAX_INDEX(path[i].p_hdr)) {
                         ext_debug("%d: move %d:%llu in new index %llu\n", i,
                                         le32_to_cpu(path[i].p_idx->ei_block),
@@ -1188,7 +1244,10 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
         struct ext4_extent *ex;
         int depth, ee_len;
 
-        BUG_ON(path == NULL);
+        if (unlikely(path == NULL)) {
+                EXT4_ERROR_INODE(inode, "path == NULL *logical %d!", *logical);
+                return -EIO;
+        }
         depth = path->p_depth;
         *phys = 0;
 
@@ -1202,15 +1261,33 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
         ex = path[depth].p_ext;
         ee_len = ext4_ext_get_actual_len(ex);
         if (*logical < le32_to_cpu(ex->ee_block)) {
-                BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
+                if (unlikely(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "EXT_FIRST_EXTENT != ex *logical %d ee_block %d!",
+                                         *logical, le32_to_cpu(ex->ee_block));
+                        return -EIO;
+                }
                 while (--depth >= 0) {
                         ix = path[depth].p_idx;
-                        BUG_ON(ix != EXT_FIRST_INDEX(path[depth].p_hdr));
+                        if (unlikely(ix != EXT_FIRST_INDEX(path[depth].p_hdr))) {
+                                EXT4_ERROR_INODE(inode,
+                                  "ix (%d) != EXT_FIRST_INDEX (%d) (depth %d)!",
+                                  ix != NULL ? ix->ei_block : 0,
+                                  EXT_FIRST_INDEX(path[depth].p_hdr) != NULL ?
+                                    EXT_FIRST_INDEX(path[depth].p_hdr)->ei_block : 0,
+                                  depth);
+                                return -EIO;
+                        }
                 }
                 return 0;
         }
 
-        BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));
+        if (unlikely(*logical < (le32_to_cpu(ex->ee_block) + ee_len))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d < ee_block %d + ee_len %d!",
+                                 *logical, le32_to_cpu(ex->ee_block), ee_len);
+                return -EIO;
+        }
 
         *logical = le32_to_cpu(ex->ee_block) + ee_len - 1;
         *phys = ext_pblock(ex) + ee_len - 1;
@@ -1236,7 +1313,10 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
         int depth;      /* Note, NOT eh_depth; depth from top of tree */
         int ee_len;
 
-        BUG_ON(path == NULL);
+        if (unlikely(path == NULL)) {
+                EXT4_ERROR_INODE(inode, "path == NULL *logical %d!", *logical);
+                return -EIO;
+        }
         depth = path->p_depth;
         *phys = 0;
 
@@ -1250,17 +1330,32 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
         ex = path[depth].p_ext;
         ee_len = ext4_ext_get_actual_len(ex);
         if (*logical < le32_to_cpu(ex->ee_block)) {
-                BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
+                if (unlikely(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "first_extent(path[%d].p_hdr) != ex",
+                                         depth);
+                        return -EIO;
+                }
                 while (--depth >= 0) {
                         ix = path[depth].p_idx;
-                        BUG_ON(ix != EXT_FIRST_INDEX(path[depth].p_hdr));
+                        if (unlikely(ix != EXT_FIRST_INDEX(path[depth].p_hdr))) {
+                                EXT4_ERROR_INODE(inode,
+                                                 "ix != EXT_FIRST_INDEX *logical %d!",
+                                                 *logical);
+                                return -EIO;
+                        }
                 }
                 *logical = le32_to_cpu(ex->ee_block);
                 *phys = ext_pblock(ex);
                 return 0;
         }
 
-        BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));
+        if (unlikely(*logical < (le32_to_cpu(ex->ee_block) + ee_len))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d < ee_block %d + ee_len %d!",
+                                 *logical, le32_to_cpu(ex->ee_block), ee_len);
+                return -EIO;
+        }
 
         if (ex != EXT_LAST_EXTENT(path[depth].p_hdr)) {
                 /* next allocated block in this leaf */
@@ -1399,8 +1494,12 @@ static int ext4_ext_correct_indexes(handle_t *handle, struct inode *inode,
 
         eh = path[depth].p_hdr;
         ex = path[depth].p_ext;
-        BUG_ON(ex == NULL);
-        BUG_ON(eh == NULL);
+
+        if (unlikely(ex == NULL || eh == NULL)) {
+                EXT4_ERROR_INODE(inode,
+                                 "ex %p == NULL or eh %p == NULL", ex, eh);
+                return -EIO;
+        }
 
         if (depth == 0) {
                 /* there is no tree at all */
@@ -1523,8 +1622,9 @@ int ext4_ext_try_to_merge(struct inode *inode,
                 merge_done = 1;
                 WARN_ON(eh->eh_entries == 0);
                 if (!eh->eh_entries)
-                        ext4_error(inode->i_sb, "ext4_ext_try_to_merge",
-                           "inode#%lu, eh->eh_entries = 0!", inode->i_ino);
+                        ext4_error(inode->i_sb,
+                                   "inode#%lu, eh->eh_entries = 0!",
+                                   inode->i_ino);
         }
 
         return merge_done;
@@ -1597,13 +1697,19 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,
         ext4_lblk_t next;
         unsigned uninitialized = 0;
 
-        BUG_ON(ext4_ext_get_actual_len(newext) == 0);
+        if (unlikely(ext4_ext_get_actual_len(newext) == 0)) {
+                EXT4_ERROR_INODE(inode, "ext4_ext_get_actual_len(newext) == 0");
+                return -EIO;
+        }
         depth = ext_depth(inode);
         ex = path[depth].p_ext;
-        BUG_ON(path[depth].p_hdr == NULL);
+        if (unlikely(path[depth].p_hdr == NULL)) {
+                EXT4_ERROR_INODE(inode, "path[%d].p_hdr == NULL", depth);
+                return -EIO;
+        }
 
         /* try to insert block into found extent and return */
-        if (ex && (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+        if (ex && !(flag & EXT4_GET_BLOCKS_PRE_IO)
                 && ext4_can_extents_be_merged(inode, ex, newext)) {
                 ext_debug("append [%d]%d block to %d:[%d]%d (from %llu)\n",
                                 ext4_ext_is_uninitialized(newext),
@@ -1724,7 +1830,7 @@ has_space:
 
 merge:
         /* try to merge extents to the right */
-        if (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+        if (!(flag & EXT4_GET_BLOCKS_PRE_IO))
                 ext4_ext_try_to_merge(inode, path, nearex);
 
         /* try to merge extents to the left */
@@ -1772,7 +1878,11 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
                 }
 
                 depth = ext_depth(inode);
-                BUG_ON(path[depth].p_hdr == NULL);
+                if (unlikely(path[depth].p_hdr == NULL)) {
+                        EXT4_ERROR_INODE(inode, "path[%d].p_hdr == NULL", depth);
+                        err = -EIO;
+                        break;
+                }
                 ex = path[depth].p_ext;
                 next = ext4_ext_next_allocated_block(path);
 
@@ -1823,7 +1933,11 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
                         cbex.ec_type = EXT4_EXT_CACHE_EXTENT;
                 }
 
-                BUG_ON(cbex.ec_len == 0);
+                if (unlikely(cbex.ec_len == 0)) {
+                        EXT4_ERROR_INODE(inode, "cbex.ec_len == 0");
+                        err = -EIO;
+                        break;
+                }
                 err = func(inode, path, &cbex, ex, cbdata);
                 ext4_ext_drop_refs(path);
 
@@ -1937,7 +2051,7 @@ ext4_ext_in_cache(struct inode *inode, ext4_lblk_t block,
 
         BUG_ON(cex->ec_type != EXT4_EXT_CACHE_GAP &&
                         cex->ec_type != EXT4_EXT_CACHE_EXTENT);
-        if (block >= cex->ec_block && block < cex->ec_block + cex->ec_len) {
+        if (in_range(block, cex->ec_block, cex->ec_len)) {
                 ex->ee_block = cpu_to_le32(cex->ec_block);
                 ext4_ext_store_pblock(ex, cex->ec_start);
                 ex->ee_len = cpu_to_le16(cex->ec_len);
@@ -1966,7 +2080,10 @@ static int ext4_ext_rm_idx(handle_t *handle, struct inode *inode,
         /* free index block */
         path--;
         leaf = idx_pblock(path->p_idx);
-        BUG_ON(path->p_hdr->eh_entries == 0);
+        if (unlikely(path->p_hdr->eh_entries == 0)) {
+                EXT4_ERROR_INODE(inode, "path->p_hdr->eh_entries == 0");
+                return -EIO;
+        }
         err = ext4_ext_get_access(handle, inode, path);
         if (err)
                 return err;
@@ -2104,8 +2221,10 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
         if (!path[depth].p_hdr)
                 path[depth].p_hdr = ext_block_hdr(path[depth].p_bh);
         eh = path[depth].p_hdr;
-        BUG_ON(eh == NULL);
-
+        if (unlikely(path[depth].p_hdr == NULL)) {
+                EXT4_ERROR_INODE(inode, "path[%d].p_hdr == NULL", depth);
+                return -EIO;
+        }
         /* find where to start removing */
         ex = EXT_LAST_EXTENT(eh);
 
@@ -2968,7 +3087,7 @@ fix_extent_len:
         ext4_ext_dirty(handle, inode, path + depth);
         return err;
 }
-static int ext4_convert_unwritten_extents_dio(handle_t *handle,
+static int ext4_convert_unwritten_extents_endio(handle_t *handle,
                                               struct inode *inode,
                                               struct ext4_ext_path *path)
 {
@@ -3023,6 +3142,14 @@ out:
         return err;
 }
 
+static void unmap_underlying_metadata_blocks(struct block_device *bdev,
+                        sector_t block, int count)
+{
+        int i;
+        for (i = 0; i < count; i++)
+                unmap_underlying_metadata(bdev, block + i);
+}
+
 static int
 ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                         ext4_lblk_t iblock, unsigned int max_blocks,
@@ -3040,8 +3167,8 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                   flags, allocated);
         ext4_ext_show_leaf(inode, path);
 
-        /* DIO get_block() before submit the IO, split the extent */
-        if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+        /* get_block() before submit the IO, split the extent */
+        if ((flags & EXT4_GET_BLOCKS_PRE_IO)) {
                 ret = ext4_split_unwritten_extents(handle,
                                                 inode, path, iblock,
                                                 max_blocks, flags);
@@ -3051,14 +3178,16 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                  * completed
                  */
                 if (io)
-                        io->flag = DIO_AIO_UNWRITTEN;
+                        io->flag = EXT4_IO_UNWRITTEN;
                 else
-                        EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
+                        ext4_set_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
+                if (ext4_should_dioread_nolock(inode))
+                        set_buffer_uninit(bh_result);
                 goto out;
         }
-        /* async DIO end_io complete, convert the filled extent to written */
-        if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
-                ret = ext4_convert_unwritten_extents_dio(handle, inode,
+        /* IO end_io complete, convert the filled extent to written */
+        if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
+                ret = ext4_convert_unwritten_extents_endio(handle, inode,
                                                         path);
                 if (ret >= 0)
                         ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -3098,6 +3227,30 @@ out:
         } else
                 allocated = ret;
         set_buffer_new(bh_result);
+        /*
+         * if we allocated more blocks than requested
+         * we need to make sure we unmap the extra block
+         * allocated. The actual needed block will get
+         * unmapped later when we find the buffer_head marked
+         * new.
+         */
+        if (allocated > max_blocks) {
+                unmap_underlying_metadata_blocks(inode->i_sb->s_bdev,
+                                        newblock + max_blocks,
+                                        allocated - max_blocks);
+                allocated = max_blocks;
+        }
+
+        /*
+         * If we have done fallocate with the offset that is already
+         * delayed allocated, we would have block reservation
+         * and quota reservation done in the delayed write path.
+         * But fallocate would have already updated quota and block
+         * count for this offset. So cancel these reservation
+         */
+        if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
+                ext4_da_update_reserve_space(inode, allocated, 0);
+
 map_out:
         set_buffer_mapped(bh_result);
 out1:
@@ -3138,7 +3291,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
 {
         struct ext4_ext_path *path = NULL;
         struct ext4_extent_header *eh;
-        struct ext4_extent newex, *ex;
+        struct ext4_extent newex, *ex, *last_ex;
         ext4_fsblk_t newblock;
         int err = 0, depth, ret, cache_type;
         unsigned int allocated = 0;
@@ -3190,7 +3343,13 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
          * this situation is possible, though, _during_ tree modification;
          * this is why assert can't be put in ext4_ext_find_extent()
          */
-        BUG_ON(path[depth].p_ext == NULL && depth != 0);
+        if (unlikely(path[depth].p_ext == NULL && depth != 0)) {
+                EXT4_ERROR_INODE(inode, "bad extent address "
+                                 "iblock: %d, depth: %d pblock %lld",
+                                 iblock, depth, path[depth].p_block);
+                err = -EIO;
+                goto out2;
+        }
         eh = path[depth].p_hdr;
 
         ex = path[depth].p_ext;
@@ -3205,7 +3364,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                  */
                 ee_len = ext4_ext_get_actual_len(ex);
                 /* if found extent covers block, simply return it */
-                if (iblock >= ee_block && iblock < ee_block + ee_len) {
+                if (in_range(iblock, ee_block, ee_len)) {
                         newblock = iblock - ee_block + ee_start;
                         /* number of remaining blocks in the extent */
                         allocated = ee_len - (iblock - ee_block);
@@ -3297,21 +3456,35 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
         if (flags & EXT4_GET_BLOCKS_UNINIT_EXT){
                 ext4_ext_mark_uninitialized(&newex);
                 /*
-                 * io_end structure was created for every async
-                 * direct IO write to the middle of the file.
-                 * To avoid unecessary convertion for every aio dio rewrite
-                 * to the mid of file, here we flag the IO that is really
-                 * need the convertion.
+                 * io_end structure was created for every IO write to an
+                 * uninitialized extent. To avoid unecessary conversion,
+                 * here we flag the IO that really needs the conversion.
                  * For non asycn direct IO case, flag the inode state
                  * that we need to perform convertion when IO is done.
                  */
-                if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                if ((flags & EXT4_GET_BLOCKS_PRE_IO)) {
                         if (io)
-                                io->flag = DIO_AIO_UNWRITTEN;
+                                io->flag = EXT4_IO_UNWRITTEN;
                         else
-                                EXT4_I(inode)->i_state |=
-                                        EXT4_STATE_DIO_UNWRITTEN;;
+                                ext4_set_inode_state(inode,
+                                                     EXT4_STATE_DIO_UNWRITTEN);
                 }
+                if (ext4_should_dioread_nolock(inode))
+                        set_buffer_uninit(bh_result);
+        }
+
+        if (unlikely(EXT4_I(inode)->i_flags & EXT4_EOFBLOCKS_FL)) {
+                if (unlikely(!eh->eh_entries)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "eh->eh_entries == 0 ee_block %d",
+                                         ex->ee_block);
+                        err = -EIO;
+                        goto out2;
+                }
+                last_ex = EXT_LAST_EXTENT(eh);
+                if (iblock + ar.len > le32_to_cpu(last_ex->ee_block)
+                    + ext4_ext_get_actual_len(last_ex))
+                        EXT4_I(inode)->i_flags &= ~EXT4_EOFBLOCKS_FL;
         }
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err) {
@@ -3327,9 +3500,18 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
         /* previous routine could use block we allocated */
         newblock = ext_pblock(&newex);
         allocated = ext4_ext_get_actual_len(&newex);
+        if (allocated > max_blocks)
+                allocated = max_blocks;
         set_buffer_new(bh_result);
 
         /*
+         * Update reserved blocks/metadata blocks after successful
+         * block allocation which had been deferred till now.
+         */
+        if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
+                ext4_da_update_reserve_space(inode, allocated, 1);
+
+        /*
          * Cache the extent and update transaction to commit on fdatasync only
          * when it is _not_ an uninitialized extent.
          */
@@ -3437,6 +3619,13 @@ static void ext4_falloc_update_inode(struct inode *inode,
                         i_size_write(inode, new_size);
                 if (new_size > EXT4_I(inode)->i_disksize)
                         ext4_update_i_disksize(inode, new_size);
+        } else {
+                /*
+                 * Mark that we allocate beyond EOF so the subsequent truncate
+                 * can proceed even if the new size is the same as i_size.
+                 */
+                if (new_size > i_size_read(inode))
+                        EXT4_I(inode)->i_flags |= EXT4_EOFBLOCKS_FL;
         }
 
 }
@@ -3541,7 +3730,7 @@ retry:
  * Returns 0 on success.
  */
 int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
-                                    loff_t len)
+                                    ssize_t len)
 {
         handle_t *handle;
         ext4_lblk_t block;
@@ -3573,7 +3762,7 @@ int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
                 map_bh.b_state = 0;
                 ret = ext4_get_blocks(handle, inode, block,
                                       max_blocks, &map_bh,
-                                      EXT4_GET_BLOCKS_DIO_CONVERT_EXT);
+                                      EXT4_GET_BLOCKS_IO_CONVERT_EXT);
                 if (ret <= 0) {
                         WARN_ON(ret <= 0);
                         printk(KERN_ERR "%s: ext4_ext_get_blocks "
@@ -3677,7 +3866,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
         int error = 0;
 
         /* in-inode? */
-        if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
                 struct ext4_iloc iloc;
                 int offset;     /* offset of xattr in inode */
 
@@ -3690,6 +3879,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
                 physical += offset;
                 length = EXT4_SB(inode->i_sb)->s_inode_size - offset;
                 flags |= FIEMAP_EXTENT_DATA_INLINE;
+                brelse(iloc.bh);
         } else { /* external block */
                 physical = EXT4_I(inode)->i_file_acl << blockbits;
                 length = inode->i_sb->s_blocksize;
@@ -3705,7 +3895,6 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 __u64 start, __u64 len)
 {
         ext4_lblk_t start_blk;
-        ext4_lblk_t len_blks;
         int error = 0;
 
         /* fallback to generic here if not in extents fmt */
@@ -3719,8 +3908,14 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
                 error = ext4_xattr_fiemap(inode, fieinfo);
         } else {
+                ext4_lblk_t len_blks;
+                __u64 last_blk;
+
                 start_blk = start >> inode->i_sb->s_blocksize_bits;
-                len_blks = len >> inode->i_sb->s_blocksize_bits;
+                last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
+                if (last_blk >= EXT_MAX_BLOCK)
+                        last_blk = EXT_MAX_BLOCK-1;
+                len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
 
                 /*
                  * Walk the extent tree gathering extent information.
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 9630583cef28..d0776e410f34 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -23,6 +23,7 @@
 #include <linux/jbd2.h>
 #include <linux/mount.h>
 #include <linux/path.h>
+#include <linux/quotaops.h>
 #include "ext4.h"
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -35,9 +36,9 @@
  */
 static int ext4_release_file(struct inode *inode, struct file *filp)
 {
-        if (EXT4_I(inode)->i_state & EXT4_STATE_DA_ALLOC_CLOSE) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE)) {
                 ext4_alloc_da_blocks(inode);
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_DA_ALLOC_CLOSE;
+                ext4_clear_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
         }
         /* if we are the last writer on the inode, drop the block reservation */
         if ((filp->f_mode & FMODE_WRITE) &&
@@ -116,18 +117,16 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
                  * devices or filesystem images.
                  */
                 memset(buf, 0, sizeof(buf));
-                path.mnt = mnt->mnt_parent;
-                path.dentry = mnt->mnt_mountpoint;
-                path_get(&path);
+                path.mnt = mnt;
+                path.dentry = mnt->mnt_root;
                 cp = d_path(&path, buf, sizeof(buf));
-                path_put(&path);
                 if (!IS_ERR(cp)) {
                         memcpy(sbi->s_es->s_last_mounted, cp,
                                sizeof(sbi->s_es->s_last_mounted));
                         sb->s_dirt = 1;
                 }
         }
-        return generic_file_open(inode, filp);
+        return dquot_file_open(inode, filp);
 }
 
 const struct file_operations ext4_file_operations = {
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 0b22497d92e1..0d0c3239c1cd 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -63,7 +63,7 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
         if (inode->i_sb->s_flags & MS_RDONLY)
                 return 0;
 
-        ret = flush_aio_dio_completed_IO(inode);
+        ret = flush_completed_IO(inode);
         if (ret < 0)
                 return ret;
         
@@ -88,9 +88,21 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
                 return ext4_force_commit(inode->i_sb);
 
         commit_tid = datasync ? ei->i_datasync_tid : ei->i_sync_tid;
-        if (jbd2_log_start_commit(journal, commit_tid))
+        if (jbd2_log_start_commit(journal, commit_tid)) {
+                /*
+                 * When the journal is on a different device than the
+                 * fs data disk, we need to issue the barrier in
+                 * writeback mode.  (In ordered mode, the jbd2 layer
+                 * will take care of issuing the barrier.  In
+                 * data=journal, all of the data blocks are written to
+                 * the journal device.)
+                 */
+                if (ext4_should_writeback_data(inode) &&
+                    (journal->j_fs_dev != journal->j_dev) &&
+                    (journal->j_flags & JBD2_BARRIER))
+                        blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
                 jbd2_log_wait_commit(journal, commit_tid);
-        else if (journal->j_flags & JBD2_BARRIER)
+        } else if (journal->j_flags & JBD2_BARRIER)
                 blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
         return ret;
 }
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index f3624ead4f6c..57f6eef6ccd6 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -76,8 +76,7 @@ unsigned ext4_init_inode_bitmap(struct super_block *sb, struct buffer_head *bh,
         /* If checksum is bad mark all blocks and inodes use to prevent
          * allocation, essentially implementing a per-group read-only flag. */
         if (!ext4_group_desc_csum_verify(sbi, block_group, gdp)) {
-                ext4_error(sb, __func__, "Checksum bad for group %u",
-                           block_group);
+                ext4_error(sb, "Checksum bad for group %u", block_group);
                 ext4_free_blks_set(sb, gdp, 0);
                 ext4_free_inodes_set(sb, gdp, 0);
                 ext4_itable_unused_set(sb, gdp, 0);
@@ -111,8 +110,7 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
         bitmap_blk = ext4_inode_bitmap(sb, desc);
         bh = sb_getblk(sb, bitmap_blk);
         if (unlikely(!bh)) {
-                ext4_error(sb, __func__,
-                            "Cannot read inode bitmap - "
+                ext4_error(sb, "Cannot read inode bitmap - "
                             "block_group = %u, inode_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -153,8 +151,7 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
         set_bitmap_uptodate(bh);
         if (bh_submit_read(bh) < 0) {
                 put_bh(bh);
-                ext4_error(sb, __func__,
-                            "Cannot read inode bitmap - "
+                ext4_error(sb, "Cannot read inode bitmap - "
                             "block_group = %u, inode_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -217,10 +214,10 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
          * Note: we must free any quota before locking the superblock,
          * as writing the quota to disk may need the lock as well.
          */
-        vfs_dq_init(inode);
+        dquot_initialize(inode);
         ext4_xattr_delete_inode(handle, inode);
-        vfs_dq_free_inode(inode);
-        vfs_dq_drop(inode);
+        dquot_free_inode(inode);
+        dquot_drop(inode);
 
         is_directory = S_ISDIR(inode->i_mode);
 
@@ -229,8 +226,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
 
         es = EXT4_SB(sb)->s_es;
         if (ino < EXT4_FIRST_INO(sb) || ino > le32_to_cpu(es->s_inodes_count)) {
-                ext4_error(sb, "ext4_free_inode",
-                           "reserved or nonexistent inode %lu", ino);
+                ext4_error(sb, "reserved or nonexistent inode %lu", ino);
                 goto error_return;
         }
         block_group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
@@ -248,8 +244,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
         cleared = ext4_clear_bit_atomic(ext4_group_lock_ptr(sb, block_group),
                                         bit, bitmap_bh->b_data);
         if (!cleared)
-                ext4_error(sb, "ext4_free_inode",
-                           "bit already cleared for inode %lu", ino);
+                ext4_error(sb, "bit already cleared for inode %lu", ino);
         else {
                 gdp = ext4_get_group_desc(sb, block_group, &bh2);
 
@@ -268,7 +263,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
                                         ext4_group_t f;
 
                                         f = ext4_flex_group(sbi, block_group);
-                                        atomic_dec(&sbi->s_flex_groups[f].free_inodes);
+                                        atomic_dec(&sbi->s_flex_groups[f].used_dirs);
                                 }
 
                         }
@@ -736,8 +731,7 @@ static int ext4_claim_inode(struct super_block *sb,
         if ((group == 0 && ino < EXT4_FIRST_INO(sb)) ||
                         ino > EXT4_INODES_PER_GROUP(sb)) {
                 ext4_unlock_group(sb, group);
-                ext4_error(sb, __func__,
-                           "reserved inode or inode > inodes count - "
+                ext4_error(sb, "reserved inode or inode > inodes count - "
                            "block_group = %u, inode=%lu", group,
                            ino + group * EXT4_INODES_PER_GROUP(sb));
                 return 1;
@@ -779,7 +773,7 @@ static int ext4_claim_inode(struct super_block *sb,
                 if (sbi->s_log_groups_per_flex) {
                         ext4_group_t f = ext4_flex_group(sbi, group);
 
-                        atomic_inc(&sbi->s_flex_groups[f].free_inodes);
+                        atomic_inc(&sbi->s_flex_groups[f].used_dirs);
                 }
         }
         gdp->bg_checksum = ext4_group_desc_csum(sbi, group, gdp);
@@ -904,7 +898,7 @@ repeat_in_this_group:
                                 BUFFER_TRACE(inode_bitmap_bh,
                                         "call ext4_handle_dirty_metadata");
                                 err = ext4_handle_dirty_metadata(handle,
-                                                                 inode,
+                                                                 NULL,
                                                         inode_bitmap_bh);
                                 if (err)
                                         goto fail;
@@ -1029,15 +1023,16 @@ got:
         inode->i_generation = sbi->s_next_generation++;
         spin_unlock(&sbi->s_next_gen_lock);
 
-        ei->i_state = EXT4_STATE_NEW;
+        ei->i_state_flags = 0;
+        ext4_set_inode_state(inode, EXT4_STATE_NEW);
 
         ei->i_extra_isize = EXT4_SB(sb)->s_want_extra_isize;
 
         ret = inode;
-        if (vfs_dq_alloc_inode(inode)) {
-                err = -EDQUOT;
+        dquot_initialize(inode);
+        err = dquot_alloc_inode(inode);
+        if (err)
                 goto fail_drop;
-        }
 
         err = ext4_init_acl(handle, inode, dir);
         if (err)
@@ -1074,10 +1069,10 @@ really_out:
         return ret;
 
 fail_free_drop:
-        vfs_dq_free_inode(inode);
+        dquot_free_inode(inode);
 
 fail_drop:
-        vfs_dq_drop(inode);
+        dquot_drop(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         unlock_new_inode(inode);
@@ -1098,8 +1093,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
 
         /* Error cases - e2fsck has already cleaned up for us */
         if (ino > max_ino) {
-                ext4_warning(sb, __func__,
-                             "bad orphan ino %lu!  e2fsck was run?", ino);
+                ext4_warning(sb, "bad orphan ino %lu!  e2fsck was run?", ino);
                 goto error;
         }
 
@@ -1107,8 +1101,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
         bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
         bitmap_bh = ext4_read_inode_bitmap(sb, block_group);
         if (!bitmap_bh) {
-                ext4_warning(sb, __func__,
-                             "inode bitmap error for orphan %lu", ino);
+                ext4_warning(sb, "inode bitmap error for orphan %lu", ino);
                 goto error;
         }
 
@@ -1140,8 +1133,7 @@ iget_failed:
         err = PTR_ERR(inode);
         inode = NULL;
 bad_orphan:
-        ext4_warning(sb, __func__,
-                     "bad orphan inode %lu!  e2fsck was run?", ino);
+        ext4_warning(sb, "bad orphan inode %lu!  e2fsck was run?", ino);
         printk(KERN_NOTICE "ext4_test_bit(bit=%d, block=%llu) = %d\n",
                bit, (unsigned long long)bitmap_bh->b_blocknr,
                ext4_test_bit(bit, bitmap_bh->b_data));
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ab807963a614..81d605412844 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -38,6 +38,8 @@
 #include <linux/uio.h>
 #include <linux/bio.h>
 #include <linux/workqueue.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -170,6 +172,9 @@ void ext4_delete_inode(struct inode *inode)
         handle_t *handle;
         int err;
 
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
+
         if (ext4_should_order_data(inode))
                 ext4_begin_ordered_truncate(inode, 0);
         truncate_inode_pages(&inode->i_data, 0);
@@ -194,7 +199,7 @@ void ext4_delete_inode(struct inode *inode)
         inode->i_size = 0;
         err = ext4_mark_inode_dirty(handle, inode);
         if (err) {
-                ext4_warning(inode->i_sb, __func__,
+                ext4_warning(inode->i_sb,
                              "couldn't mark inode dirty (err %d)", err);
                 goto stop_handle;
         }
@@ -212,7 +217,7 @@ void ext4_delete_inode(struct inode *inode)
                 if (err > 0)
                         err = ext4_journal_restart(handle, 3);
                 if (err != 0) {
-                        ext4_warning(inode->i_sb, __func__,
+                        ext4_warning(inode->i_sb,
                                      "couldn't extend journal (err %d)", err);
                 stop_handle:
                         ext4_journal_stop(handle);
@@ -323,8 +328,7 @@ static int ext4_block_to_path(struct inode *inode,
                 offsets[n++] = i_block & (ptrs - 1);
                 final = ptrs;
         } else {
-                ext4_warning(inode->i_sb, "ext4_block_to_path",
-                             "block %lu > max in inode %lu",
+                ext4_warning(inode->i_sb, "block %lu > max in inode %lu",
                              i_block + direct_blocks +
                              indirect_blocks + double_blocks, inode->i_ino);
         }
@@ -344,7 +348,7 @@ static int __ext4_check_blockref(const char *function, struct inode *inode,
                 if (blk &&
                     unlikely(!ext4_data_block_valid(EXT4_SB(inode->i_sb),
                                                     blk, 1))) {
-                        ext4_error(inode->i_sb, function,
+                        __ext4_error(inode->i_sb, function,
                                    "invalid block reference %u "
                                    "in inode #%lu", blk, inode->i_ino);
                         return -EIO;
@@ -607,7 +611,14 @@ static int ext4_alloc_blocks(handle_t *handle, struct inode *inode,
                 if (*err)
                         goto failed_out;
 
-                BUG_ON(current_block + count > EXT4_MAX_BLOCK_FILE_PHYS);
+                if (unlikely(current_block + count > EXT4_MAX_BLOCK_FILE_PHYS)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "current_block %llu + count %lu > %d!",
+                                         current_block, count,
+                                         EXT4_MAX_BLOCK_FILE_PHYS);
+                        *err = -EIO;
+                        goto failed_out;
+                }
 
                 target -= count;
                 /* allocate blocks for indirect blocks */
@@ -643,7 +654,14 @@ static int ext4_alloc_blocks(handle_t *handle, struct inode *inode,
                 ar.flags = EXT4_MB_HINT_DATA;
 
         current_block = ext4_mb_new_blocks(handle, &ar, err);
-        BUG_ON(current_block + ar.len > EXT4_MAX_BLOCK_FILE_PHYS);
+        if (unlikely(current_block + ar.len > EXT4_MAX_BLOCK_FILE_PHYS)) {
+                EXT4_ERROR_INODE(inode,
+                                 "current_block %llu + ar.len %d > %d!",
+                                 current_block, ar.len,
+                                 EXT4_MAX_BLOCK_FILE_PHYS);
+                *err = -EIO;
+                goto failed_out;
+        }
 
         if (*err && (target == blks)) {
                 /*
@@ -1009,86 +1027,115 @@ qsize_t *ext4_get_reserved_space(struct inode *inode)
         return &EXT4_I(inode)->i_reserved_quota;
 }
 #endif
+
 /*
  * Calculate the number of metadata blocks need to reserve
- * to allocate @blocks for non extent file based file
+ * to allocate a new block at @lblocks for non extent file based file
  */
-static int ext4_indirect_calc_metadata_amount(struct inode *inode, int blocks)
+static int ext4_indirect_calc_metadata_amount(struct inode *inode,
+                                              sector_t lblock)
 {
-        int icap = EXT4_ADDR_PER_BLOCK(inode->i_sb);
-        int ind_blks, dind_blks, tind_blks;
-
-        /* number of new indirect blocks needed */
-        ind_blks = (blocks + icap - 1) / icap;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        sector_t dind_mask = ~((sector_t)EXT4_ADDR_PER_BLOCK(inode->i_sb) - 1);
+        int blk_bits;
 
-        dind_blks = (ind_blks + icap - 1) / icap;
+        if (lblock < EXT4_NDIR_BLOCKS)
+                return 0;
 
-        tind_blks = 1;
+        lblock -= EXT4_NDIR_BLOCKS;
 
-        return ind_blks + dind_blks + tind_blks;
+        if (ei->i_da_metadata_calc_len &&
+            (lblock & dind_mask) == ei->i_da_metadata_calc_last_lblock) {
+                ei->i_da_metadata_calc_len++;
+                return 0;
+        }
+        ei->i_da_metadata_calc_last_lblock = lblock & dind_mask;
+        ei->i_da_metadata_calc_len = 1;
+        blk_bits = order_base_2(lblock);
+        return (blk_bits / EXT4_ADDR_PER_BLOCK_BITS(inode->i_sb)) + 1;
 }
 
 /*
  * Calculate the number of metadata blocks need to reserve
- * to allocate given number of blocks
+ * to allocate a block located at @lblock
  */
-static int ext4_calc_metadata_amount(struct inode *inode, int blocks)
+static int ext4_calc_metadata_amount(struct inode *inode, sector_t lblock)
 {
-        if (!blocks)
-                return 0;
-
         if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
-                return ext4_ext_calc_metadata_amount(inode, blocks);
+                return ext4_ext_calc_metadata_amount(inode, lblock);
 
-        return ext4_indirect_calc_metadata_amount(inode, blocks);
+        return ext4_indirect_calc_metadata_amount(inode, lblock);
 }
 
-static void ext4_da_update_reserve_space(struct inode *inode, int used)
+/*
+ * Called with i_data_sem down, which is important since we can call
+ * ext4_discard_preallocations() from here.
+ */
+void ext4_da_update_reserve_space(struct inode *inode,
+                                        int used, int quota_claim)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        int total, mdb, mdb_free, mdb_claim = 0;
-
-        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-        /* recalculate the number of metablocks still need to be reserved */
-        total = EXT4_I(inode)->i_reserved_data_blocks - used;
-        mdb = ext4_calc_metadata_amount(inode, total);
-
-        /* figure out how many metablocks to release */
-        BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
-        mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
-
-        if (mdb_free) {
-                /* Account for allocated meta_blocks */
-                mdb_claim = EXT4_I(inode)->i_allocated_meta_blocks;
-                BUG_ON(mdb_free < mdb_claim);
-                mdb_free -= mdb_claim;
-
-                /* update fs dirty blocks counter */
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int mdb_free = 0, allocated_meta_blocks = 0;
+
+        spin_lock(&ei->i_block_reservation_lock);
+        trace_ext4_da_update_reserve_space(inode, used);
+        if (unlikely(used > ei->i_reserved_data_blocks)) {
+                ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, used %d "
+                         "with only %d reserved data blocks\n",
+                         __func__, inode->i_ino, used,
+                         ei->i_reserved_data_blocks);
+                WARN_ON(1);
+                used = ei->i_reserved_data_blocks;
+        }
+
+        /* Update per-inode reservations */
+        ei->i_reserved_data_blocks -= used;
+        used += ei->i_allocated_meta_blocks;
+        ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks;
+        allocated_meta_blocks = ei->i_allocated_meta_blocks;
+        ei->i_allocated_meta_blocks = 0;
+        percpu_counter_sub(&sbi->s_dirtyblocks_counter, used);
+
+        if (ei->i_reserved_data_blocks == 0) {
+                /*
+                 * We can release all of the reserved metadata blocks
+                 * only when we have written all of the delayed
+                 * allocation blocks.
+                 */
+                mdb_free = ei->i_reserved_meta_blocks;
+                ei->i_reserved_meta_blocks = 0;
+                ei->i_da_metadata_calc_len = 0;
                 percpu_counter_sub(&sbi->s_dirtyblocks_counter, mdb_free);
-                EXT4_I(inode)->i_allocated_meta_blocks = 0;
-                EXT4_I(inode)->i_reserved_meta_blocks = mdb;
         }
-
-        /* update per-inode reservations */
-        BUG_ON(used  > EXT4_I(inode)->i_reserved_data_blocks);
-        EXT4_I(inode)->i_reserved_data_blocks -= used;
-        percpu_counter_sub(&sbi->s_dirtyblocks_counter, used + mdb_claim);
         spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
 
-        vfs_dq_claim_block(inode, used + mdb_claim);
-
-        /*
-         * free those over-booking quota for metadata blocks
-         */
-        if (mdb_free)
-                vfs_dq_release_reservation_block(inode, mdb_free);
+        /* Update quota subsystem */
+        if (quota_claim) {
+                dquot_claim_block(inode, used);
+                if (mdb_free)
+                        dquot_release_reservation_block(inode, mdb_free);
+        } else {
+                /*
+                 * We did fallocate with an offset that is already delayed
+                 * allocated. So on delayed allocated writeback we should
+                 * not update the quota for allocated blocks. But then
+                 * converting an fallocate region to initialized region would
+                 * have caused a metadata allocation. So claim quota for
+                 * that
+                 */
+                if (allocated_meta_blocks)
+                        dquot_claim_block(inode, allocated_meta_blocks);
+                dquot_release_reservation_block(inode, mdb_free + used);
+        }
 
         /*
          * If we have done all the pending block allocations and if
          * there aren't any writers on the inode, we can discard the
          * inode's preallocations.
          */
-        if (!total && (atomic_read(&inode->i_writecount) == 0))
+        if ((ei->i_reserved_data_blocks == 0) &&
+            (atomic_read(&inode->i_writecount) == 0))
                 ext4_discard_preallocations(inode);
 }
 
@@ -1096,7 +1143,7 @@ static int check_block_validity(struct inode *inode, const char *msg,
                                 sector_t logical, sector_t phys, int len)
 {
         if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), phys, len)) {
-                ext4_error(inode->i_sb, msg,
+                __ext4_error(inode->i_sb, msg,
                            "inode #%lu logical block %llu mapped to %llu "
                            "(size %d)", inode->i_ino,
                            (unsigned long long) logical,
@@ -1278,20 +1325,22 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
                          * i_data's format changing.  Force the migrate
                          * to fail by clearing migrate flags
                          */
-                        EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
+                        ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
                 }
-        }
 
+                /*
+                 * Update reserved blocks/metadata blocks after successful
+                 * block allocation which had been deferred till now. We don't
+                 * support fallocate for non extent files. So we can update
+                 * reserve space here.
+                 */
+                if ((retval > 0) &&
+                        (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE))
+                        ext4_da_update_reserve_space(inode, retval, 1);
+        }
         if (flags & EXT4_GET_BLOCKS_DELALLOC_RESERVE)
                 EXT4_I(inode)->i_delalloc_reserved_flag = 0;
 
-        /*
-         * Update reserved blocks/metadata blocks after successful
-         * block allocation which had been deferred till now.
-         */
-        if ((retval > 0) && (flags & EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE))
-                ext4_da_update_reserve_space(inode, retval);
-
         up_write((&EXT4_I(inode)->i_data_sem));
         if (retval > 0 && buffer_mapped(bh)) {
                 int ret = check_block_validity(inode, "file system "
@@ -1504,6 +1553,8 @@ static void ext4_truncate_failed_write(struct inode *inode)
         ext4_truncate(inode);
 }
 
+static int ext4_get_block_write(struct inode *inode, sector_t iblock,
+                   struct buffer_head *bh_result, int create);
 static int ext4_write_begin(struct file *file, struct address_space *mapping,
                             loff_t pos, unsigned len, unsigned flags,
                             struct page **pagep, void **fsdata)
@@ -1545,8 +1596,12 @@ retry:
         }
         *pagep = page;
 
-        ret = block_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
-                                ext4_get_block);
+        if (ext4_should_dioread_nolock(inode))
+                ret = block_write_begin(file, mapping, pos, len, flags, pagep,
+                                fsdata, ext4_get_block_write);
+        else
+                ret = block_write_begin(file, mapping, pos, len, flags, pagep,
+                                fsdata, ext4_get_block);
 
         if (!ret && ext4_should_journal_data(inode)) {
                 ret = walk_page_buffers(handle, page_buffers(page),
@@ -1763,7 +1818,7 @@ static int ext4_journalled_write_end(struct file *file,
         new_i_size = pos + copied;
         if (new_i_size > inode->i_size)
                 i_size_write(inode, pos+copied);
-        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+        ext4_set_inode_state(inode, EXT4_STATE_JDATA);
         if (new_i_size > EXT4_I(inode)->i_disksize) {
                 ext4_update_i_disksize(inode, new_i_size);
                 ret2 = ext4_mark_inode_dirty(handle, inode);
@@ -1797,11 +1852,16 @@ static int ext4_journalled_write_end(struct file *file,
         return ret ? ret : copied;
 }
 
-static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
+/*
+ * Reserve a single block located at lblock
+ */
+static int ext4_da_reserve_space(struct inode *inode, sector_t lblock)
 {
         int retries = 0;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        unsigned long md_needed, mdblocks, total = 0;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned long md_needed, md_reserved;
+        int ret;
 
         /*
          * recalculate the amount of metadata blocks to reserve
@@ -1809,35 +1869,33 @@ static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
          * worse case is one extent per block
          */
 repeat:
-        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-        total = EXT4_I(inode)->i_reserved_data_blocks + nrblocks;
-        mdblocks = ext4_calc_metadata_amount(inode, total);
-        BUG_ON(mdblocks < EXT4_I(inode)->i_reserved_meta_blocks);
-
-        md_needed = mdblocks - EXT4_I(inode)->i_reserved_meta_blocks;
-        total = md_needed + nrblocks;
-        spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+        spin_lock(&ei->i_block_reservation_lock);
+        md_reserved = ei->i_reserved_meta_blocks;
+        md_needed = ext4_calc_metadata_amount(inode, lblock);
+        trace_ext4_da_reserve_space(inode, md_needed);
+        spin_unlock(&ei->i_block_reservation_lock);
 
         /*
          * Make quota reservation here to prevent quota overflow
          * later. Real quota accounting is done at pages writeout
          * time.
          */
-        if (vfs_dq_reserve_block(inode, total))
-                return -EDQUOT;
+        ret = dquot_reserve_block(inode, md_needed + 1);
+        if (ret)
+                return ret;
 
-        if (ext4_claim_free_blocks(sbi, total)) {
-                vfs_dq_release_reservation_block(inode, total);
+        if (ext4_claim_free_blocks(sbi, md_needed + 1)) {
+                dquot_release_reservation_block(inode, md_needed + 1);
                 if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
                         yield();
                         goto repeat;
                 }
                 return -ENOSPC;
         }
-        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-        EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
-        EXT4_I(inode)->i_reserved_meta_blocks += md_needed;
-        spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+        spin_lock(&ei->i_block_reservation_lock);
+        ei->i_reserved_data_blocks++;
+        ei->i_reserved_meta_blocks += md_needed;
+        spin_unlock(&ei->i_block_reservation_lock);
 
         return 0;       /* success */
 }
@@ -1845,49 +1903,46 @@ repeat:
 static void ext4_da_release_space(struct inode *inode, int to_free)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        int total, mdb, mdb_free, release;
+        struct ext4_inode_info *ei = EXT4_I(inode);
 
         if (!to_free)
                 return;         /* Nothing to release, exit */
 
         spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
 
-        if (!EXT4_I(inode)->i_reserved_data_blocks) {
+        if (unlikely(to_free > ei->i_reserved_data_blocks)) {
                 /*
-                 * if there is no reserved blocks, but we try to free some
-                 * then the counter is messed up somewhere.
-                 * but since this function is called from invalidate
-                 * page, it's harmless to return without any action
+                 * if there aren't enough reserved blocks, then the
+                 * counter is messed up somewhere.  Since this
+                 * function is called from invalidate page, it's
+                 * harmless to return without any action.
                  */
-                printk(KERN_INFO "ext4 delalloc try to release %d reserved "
-                            "blocks for inode %lu, but there is no reserved "
-                            "data blocks\n", to_free, inode->i_ino);
-                spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
-                return;
+                ext4_msg(inode->i_sb, KERN_NOTICE, "ext4_da_release_space: "
+                         "ino %lu, to_free %d with only %d reserved "
+                         "data blocks\n", inode->i_ino, to_free,
+                         ei->i_reserved_data_blocks);
+                WARN_ON(1);
+                to_free = ei->i_reserved_data_blocks;
         }
+        ei->i_reserved_data_blocks -= to_free;
 
-        /* recalculate the number of metablocks still need to be reserved */
-        total = EXT4_I(inode)->i_reserved_data_blocks - to_free;
-        mdb = ext4_calc_metadata_amount(inode, total);
-
-        /* figure out how many metablocks to release */
-        BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
-        mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
-
-        release = to_free + mdb_free;
-
-        /* update fs dirty blocks counter for truncate case */
-        percpu_counter_sub(&sbi->s_dirtyblocks_counter, release);
+        if (ei->i_reserved_data_blocks == 0) {
+                /*
+                 * We can release all of the reserved metadata blocks
+                 * only when we have written all of the delayed
+                 * allocation blocks.
+                 */
+                to_free += ei->i_reserved_meta_blocks;
+                ei->i_reserved_meta_blocks = 0;
+                ei->i_da_metadata_calc_len = 0;
+        }
 
-        /* update per-inode reservations */
-        BUG_ON(to_free > EXT4_I(inode)->i_reserved_data_blocks);
-        EXT4_I(inode)->i_reserved_data_blocks -= to_free;
+        /* update fs dirty blocks counter */
+        percpu_counter_sub(&sbi->s_dirtyblocks_counter, to_free);
 
-        BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
-        EXT4_I(inode)->i_reserved_meta_blocks = mdb;
         spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
 
-        vfs_dq_release_reservation_block(inode, release);
+        dquot_release_reservation_block(inode, to_free);
 }
 
 static void ext4_da_page_release_reservation(struct page *page,
@@ -2064,6 +2119,8 @@ static void mpage_put_bnr_to_bhs(struct mpage_da_data *mpd, sector_t logical,
                                 } else if (buffer_mapped(bh))
                                         BUG_ON(bh->b_blocknr != pblock);
 
+                                if (buffer_uninit(exbh))
+                                        set_buffer_uninit(bh);
                                 cur_logical++;
                                 pblock++;
                         } while ((bh = bh->b_this_page) != head);
@@ -2106,17 +2163,16 @@ static void ext4_da_block_invalidatepages(struct mpage_da_data *mpd,
                         break;
                 for (i = 0; i < nr_pages; i++) {
                         struct page *page = pvec.pages[i];
-                        index = page->index;
-                        if (index > end)
+                        if (page->index > end)
                                 break;
-                        index++;
-
                         BUG_ON(!PageLocked(page));
                         BUG_ON(PageWriteback(page));
                         block_invalidatepage(page, 0);
                         ClearPageUptodate(page);
                         unlock_page(page);
                 }
+                index = pvec.pages[nr_pages - 1]->index + 1;
+                pagevec_release(&pvec);
         }
         return;
 }
@@ -2192,10 +2248,12 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
          * variables are updated after the blocks have been allocated.
          */
         new.b_state = 0;
-        get_blocks_flags = (EXT4_GET_BLOCKS_CREATE |
-                            EXT4_GET_BLOCKS_DELALLOC_RESERVE);
+        get_blocks_flags = EXT4_GET_BLOCKS_CREATE;
+        if (ext4_should_dioread_nolock(mpd->inode))
+                get_blocks_flags |= EXT4_GET_BLOCKS_IO_CREATE_EXT;
         if (mpd->b_state & (1 << BH_Delay))
-                get_blocks_flags |= EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE;
+                get_blocks_flags |= EXT4_GET_BLOCKS_DELALLOC_RESERVE;
+
         blks = ext4_get_blocks(handle, mpd->inode, next, max_blocks,
                                &new, get_blocks_flags);
         if (blks < 0) {
@@ -2493,7 +2551,7 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                  * XXX: __block_prepare_write() unmaps passed block,
                  * is it OK?
                  */
-                ret = ext4_da_reserve_space(inode, 1);
+                ret = ext4_da_reserve_space(inode, iblock);
                 if (ret)
                         /* not enough space to reserve */
                         return ret;
@@ -2603,11 +2661,14 @@ static int __ext4_journalled_writepage(struct page *page,
                 ret = err;
 
         walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
-        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+        ext4_set_inode_state(inode, EXT4_STATE_JDATA);
 out:
         return ret;
 }
 
+static int ext4_set_bh_endio(struct buffer_head *bh, struct inode *inode);
+static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate);
+
 /*
  * Note that we don't need to start a transaction unless we're journaling data
  * because we should have holes filled from ext4_page_mkwrite(). We even don't
@@ -2655,7 +2716,7 @@ static int ext4_writepage(struct page *page,
         int ret = 0;
         loff_t size;
         unsigned int len;
-        struct buffer_head *page_bufs;
+        struct buffer_head *page_bufs = NULL;
         struct inode *inode = page->mapping->host;
 
         trace_ext4_writepage(inode, page);
@@ -2731,7 +2792,11 @@ static int ext4_writepage(struct page *page,
 
         if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
                 ret = nobh_writepage(page, noalloc_get_block_write, wbc);
-        else
+        else if (page_bufs && buffer_uninit(page_bufs)) {
+                ext4_set_bh_endio(page_bufs, inode);
+                ret = block_write_full_page_endio(page, noalloc_get_block_write,
+                                            wbc, ext4_end_io_buffer_write);
+        } else
                 ret = block_write_full_page(page, noalloc_get_block_write,
                                             wbc);
 
@@ -2967,8 +3032,7 @@ retry:
 out_writepages:
         if (!no_nrwrite_index_update)
                 wbc->no_nrwrite_index_update = 0;
-        if (wbc->nr_to_write > nr_to_writebump)
-                wbc->nr_to_write -= nr_to_writebump;
+        wbc->nr_to_write -= nr_to_writebump;
         wbc->range_start = range_start;
         trace_ext4_da_writepages_result(inode, wbc, ret, pages_written);
         return ret;
@@ -2993,11 +3057,18 @@ static int ext4_nonda_switch(struct super_block *sb)
         if (2 * free_blocks < 3 * dirty_blocks ||
                 free_blocks < (dirty_blocks + EXT4_FREEBLOCKS_WATERMARK)) {
                 /*
-                 * free block count is less that 150% of dirty blocks
-                 * or free blocks is less that watermark
+                 * free block count is less than 150% of dirty blocks
+                 * or free blocks is less than watermark
                  */
                 return 1;
         }
+        /*
+         * Even if we don't switch but are nearing capacity,
+         * start pushing delalloc when 1/2 of free blocks are dirty.
+         */
+        if (free_blocks < 2 * dirty_blocks)
+                writeback_inodes_sb_if_idle(sb);
+
         return 0;
 }
 
@@ -3005,7 +3076,7 @@ static int ext4_da_write_begin(struct file *file, struct address_space *mapping,
                                loff_t pos, unsigned len, unsigned flags,
                                struct page **pagep, void **fsdata)
 {
-        int ret, retries = 0;
+        int ret, retries = 0, quota_retries = 0;
         struct page *page;
         pgoff_t index;
         unsigned from, to;
@@ -3064,6 +3135,22 @@ retry:
 
         if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
                 goto retry;
+
+        if ((ret == -EDQUOT) &&
+            EXT4_I(inode)->i_reserved_meta_blocks &&
+            (quota_retries++ < 3)) {
+                /*
+                 * Since we often over-estimate the number of meta
+                 * data blocks required, we may sometimes get a
+                 * spurios out of quota error even though there would
+                 * be enough space once we write the data blocks and
+                 * find out how many meta data blocks were _really_
+                 * required.  So try forcing the inode write to see if
+                 * that helps.
+                 */
+                write_inode_now(inode, (quota_retries == 3));
+                goto retry;
+        }
 out:
         return ret;
 }
@@ -3252,7 +3339,8 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                 filemap_write_and_wait(mapping);
         }
 
-        if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
+        if (EXT4_JOURNAL(inode) &&
+            ext4_test_inode_state(inode, EXT4_STATE_JDATA)) {
                 /*
                  * This is a REALLY heavyweight approach, but the use of
                  * bmap on dirty files is expected to be extremely rare:
@@ -3271,7 +3359,7 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                  * everything they get.
                  */
 
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_JDATA;
+                ext4_clear_inode_state(inode, EXT4_STATE_JDATA);
                 journal = EXT4_JOURNAL(inode);
                 jbd2_journal_lock_updates(journal);
                 err = jbd2_journal_flush(journal);
@@ -3296,11 +3384,45 @@ ext4_readpages(struct file *file, struct address_space *mapping,
         return mpage_readpages(mapping, pages, nr_pages, ext4_get_block);
 }
 
+static void ext4_free_io_end(ext4_io_end_t *io)
+{
+        BUG_ON(!io);
+        if (io->page)
+                put_page(io->page);
+        iput(io->inode);
+        kfree(io);
+}
+
+static void ext4_invalidatepage_free_endio(struct page *page, unsigned long offset)
+{
+        struct buffer_head *head, *bh;
+        unsigned int curr_off = 0;
+
+        if (!page_has_buffers(page))
+                return;
+        head = bh = page_buffers(page);
+        do {
+                if (offset <= curr_off && test_clear_buffer_uninit(bh)
+                                        && bh->b_private) {
+                        ext4_free_io_end(bh->b_private);
+                        bh->b_private = NULL;
+                        bh->b_end_io = NULL;
+                }
+                curr_off = curr_off + bh->b_size;
+                bh = bh->b_this_page;
+        } while (bh != head);
+}
+
 static void ext4_invalidatepage(struct page *page, unsigned long offset)
 {
         journal_t *journal = EXT4_JOURNAL(page->mapping->host);
 
         /*
+         * free any io_end structure allocated for buffers to be discarded
+         */
+        if (ext4_should_dioread_nolock(page->mapping->host))
+                ext4_invalidatepage_free_endio(page, offset);
+        /*
          * If it's a full truncate we just forget about the pending dirtying
          */
         if (offset == 0)
@@ -3371,7 +3493,14 @@ static ssize_t ext4_ind_direct_IO(int rw, struct kiocb *iocb,
         }
 
 retry:
-        ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
+        if (rw == READ && ext4_should_dioread_nolock(inode))
+                ret = blockdev_direct_IO_no_locking(rw, iocb, inode,
+                                 inode->i_sb->s_bdev, iov,
+                                 offset, nr_segs,
+                                 ext4_get_block, NULL);
+        else
+                ret = blockdev_direct_IO(rw, iocb, inode,
+                                 inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext4_get_block, NULL);
         if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
@@ -3387,6 +3516,9 @@ retry:
                          * but cannot extend i_size. Bail out and pretend
                          * the write failed... */
                         ret = PTR_ERR(handle);
+                        if (inode->i_nlink)
+                                ext4_orphan_del(NULL, inode);
+
                         goto out;
                 }
                 if (inode->i_nlink)
@@ -3414,75 +3546,63 @@ out:
         return ret;
 }
 
-static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
+static int ext4_get_block_write(struct inode *inode, sector_t iblock,
                    struct buffer_head *bh_result, int create)
 {
-        handle_t *handle = NULL;
+        handle_t *handle = ext4_journal_current_handle();
         int ret = 0;
         unsigned max_blocks = bh_result->b_size >> inode->i_blkbits;
         int dio_credits;
+        int started = 0;
 
-        ext4_debug("ext4_get_block_dio_write: inode %lu, create flag %d\n",
+        ext4_debug("ext4_get_block_write: inode %lu, create flag %d\n",
                    inode->i_ino, create);
         /*
-         * DIO VFS code passes create = 0 flag for write to
-         * the middle of file. It does this to avoid block
-         * allocation for holes, to prevent expose stale data
-         * out when there is parallel buffered read (which does
-         * not hold the i_mutex lock) while direct IO write has
-         * not completed. DIO request on holes finally falls back
-         * to buffered IO for this reason.
-         *
-         * For ext4 extent based file, since we support fallocate,
-         * new allocated extent as uninitialized, for holes, we
-         * could fallocate blocks for holes, thus parallel
-         * buffered IO read will zero out the page when read on
-         * a hole while parallel DIO write to the hole has not completed.
-         *
-         * when we come here, we know it's a direct IO write to
-         * to the middle of file (<i_size)
-         * so it's safe to override the create flag from VFS.
+         * ext4_get_block in prepare for a DIO write or buffer write.
+         * We allocate an uinitialized extent if blocks haven't been allocated.
+         * The extent will be converted to initialized after IO complete.
          */
-        create = EXT4_GET_BLOCKS_DIO_CREATE_EXT;
+        create = EXT4_GET_BLOCKS_IO_CREATE_EXT;
 
-        if (max_blocks > DIO_MAX_BLOCKS)
-                max_blocks = DIO_MAX_BLOCKS;
-        dio_credits = ext4_chunk_trans_blocks(inode, max_blocks);
-        handle = ext4_journal_start(inode, dio_credits);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                goto out;
+        if (!handle) {
+                if (max_blocks > DIO_MAX_BLOCKS)
+                        max_blocks = DIO_MAX_BLOCKS;
+                dio_credits = ext4_chunk_trans_blocks(inode, max_blocks);
+                handle = ext4_journal_start(inode, dio_credits);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        goto out;
+                }
+                started = 1;
         }
+
         ret = ext4_get_blocks(handle, inode, iblock, max_blocks, bh_result,
                               create);
         if (ret > 0) {
                 bh_result->b_size = (ret << inode->i_blkbits);
                 ret = 0;
         }
-        ext4_journal_stop(handle);
+        if (started)
+                ext4_journal_stop(handle);
 out:
         return ret;
 }
 
-static void ext4_free_io_end(ext4_io_end_t *io)
-{
-        BUG_ON(!io);
-        iput(io->inode);
-        kfree(io);
-}
-static void dump_aio_dio_list(struct inode * inode)
+static void dump_completed_IO(struct inode * inode)
 {
 #ifdef  EXT4_DEBUG
         struct list_head *cur, *before, *after;
         ext4_io_end_t *io, *io0, *io1;
+        unsigned long flags;
 
-        if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
-                ext4_debug("inode %lu aio dio list is empty\n", inode->i_ino);
+        if (list_empty(&EXT4_I(inode)->i_completed_io_list)){
+                ext4_debug("inode %lu completed_io list is empty\n", inode->i_ino);
                 return;
         }
 
-        ext4_debug("Dump inode %lu aio_dio_completed_IO list \n", inode->i_ino);
-        list_for_each_entry(io, &EXT4_I(inode)->i_aio_dio_complete_list, list){
+        ext4_debug("Dump inode %lu completed_io list \n", inode->i_ino);
+        spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
+        list_for_each_entry(io, &EXT4_I(inode)->i_completed_io_list, list){
                 cur = &io->list;
                 before = cur->prev;
                 io0 = container_of(before, ext4_io_end_t, list);
@@ -3492,32 +3612,31 @@ static void dump_aio_dio_list(struct inode * inode)
                 ext4_debug("io 0x%p from inode %lu,prev 0x%p,next 0x%p\n",
                             io, inode->i_ino, io0, io1);
         }
+        spin_unlock_irqrestore(&EXT4_I(inode)->i_completed_io_lock, flags);
 #endif
 }
 
 /*
  * check a range of space and convert unwritten extents to written.
  */
-static int ext4_end_aio_dio_nolock(ext4_io_end_t *io)
+static int ext4_end_io_nolock(ext4_io_end_t *io)
 {
         struct inode *inode = io->inode;
         loff_t offset = io->offset;
-        size_t size = io->size;
+        ssize_t size = io->size;
         int ret = 0;
 
-        ext4_debug("end_aio_dio_onlock: io 0x%p from inode %lu,list->next 0x%p,"
+        ext4_debug("ext4_end_io_nolock: io 0x%p from inode %lu,list->next 0x%p,"
                    "list->prev 0x%p\n",
                    io, inode->i_ino, io->list.next, io->list.prev);
 
         if (list_empty(&io->list))
                 return ret;
 
-        if (io->flag != DIO_AIO_UNWRITTEN)
+        if (io->flag != EXT4_IO_UNWRITTEN)
                 return ret;
 
-        if (offset + size <= i_size_read(inode))
-                ret = ext4_convert_unwritten_extents(inode, offset, size);
-
+        ret = ext4_convert_unwritten_extents(inode, offset, size);
         if (ret < 0) {
                 printk(KERN_EMERG "%s: failed to convert unwritten"
                         "extents to written extents, error is %d"
@@ -3530,50 +3649,64 @@ static int ext4_end_aio_dio_nolock(ext4_io_end_t *io)
         io->flag = 0;
         return ret;
 }
+
 /*
  * work on completed aio dio IO, to convert unwritten extents to extents
  */
-static void ext4_end_aio_dio_work(struct work_struct *work)
+static void ext4_end_io_work(struct work_struct *work)
 {
-        ext4_io_end_t *io  = container_of(work, ext4_io_end_t, work);
-        struct inode *inode = io->inode;
-        int ret = 0;
+        ext4_io_end_t           *io = container_of(work, ext4_io_end_t, work);
+        struct inode            *inode = io->inode;
+        struct ext4_inode_info  *ei = EXT4_I(inode);
+        unsigned long           flags;
+        int                     ret;
 
         mutex_lock(&inode->i_mutex);
-        ret = ext4_end_aio_dio_nolock(io);
-        if (ret >= 0) {
-                if (!list_empty(&io->list))
-                        list_del_init(&io->list);
-                ext4_free_io_end(io);
+        ret = ext4_end_io_nolock(io);
+        if (ret < 0) {
+                mutex_unlock(&inode->i_mutex);
+                return;
         }
+
+        spin_lock_irqsave(&ei->i_completed_io_lock, flags);
+        if (!list_empty(&io->list))
+                list_del_init(&io->list);
+        spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
         mutex_unlock(&inode->i_mutex);
+        ext4_free_io_end(io);
 }
+
 /*
  * This function is called from ext4_sync_file().
  *
- * When AIO DIO IO is completed, the work to convert unwritten
- * extents to written is queued on workqueue but may not get immediately
+ * When IO is completed, the work to convert unwritten extents to
+ * written is queued on workqueue but may not get immediately
  * scheduled. When fsync is called, we need to ensure the
  * conversion is complete before fsync returns.
- * The inode keeps track of a list of completed AIO from DIO path
- * that might needs to do the conversion. This function walks through
- * the list and convert the related unwritten extents to written.
+ * The inode keeps track of a list of pending/completed IO that
+ * might needs to do the conversion. This function walks through
+ * the list and convert the related unwritten extents for completed IO
+ * to written.
+ * The function return the number of pending IOs on success.
  */
-int flush_aio_dio_completed_IO(struct inode *inode)
+int flush_completed_IO(struct inode *inode)
 {
         ext4_io_end_t *io;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned long flags;
         int ret = 0;
         int ret2 = 0;
 
-        if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list))
+        if (list_empty(&ei->i_completed_io_list))
                 return ret;
 
-        dump_aio_dio_list(inode);
-        while (!list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
-                io = list_entry(EXT4_I(inode)->i_aio_dio_complete_list.next,
+        dump_completed_IO(inode);
+        spin_lock_irqsave(&ei->i_completed_io_lock, flags);
+        while (!list_empty(&ei->i_completed_io_list)){
+                io = list_entry(ei->i_completed_io_list.next,
                                 ext4_io_end_t, list);
                 /*
-                 * Calling ext4_end_aio_dio_nolock() to convert completed
+                 * Calling ext4_end_io_nolock() to convert completed
                  * IO to written.
                  *
                  * When ext4_sync_file() is called, run_queue() may already
@@ -3586,20 +3719,23 @@ int flush_aio_dio_completed_IO(struct inode *inode)
                  * avoid double converting from both fsync and background work
                  * queue work.
                  */
-                ret = ext4_end_aio_dio_nolock(io);
+                spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
+                ret = ext4_end_io_nolock(io);
+                spin_lock_irqsave(&ei->i_completed_io_lock, flags);
                 if (ret < 0)
                         ret2 = ret;
                 else
                         list_del_init(&io->list);
         }
+        spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
         return (ret2 < 0) ? ret2 : 0;
 }
 
-static ext4_io_end_t *ext4_init_io_end (struct inode *inode)
+static ext4_io_end_t *ext4_init_io_end (struct inode *inode, gfp_t flags)
 {
         ext4_io_end_t *io = NULL;
 
-        io = kmalloc(sizeof(*io), GFP_NOFS);
+        io = kmalloc(sizeof(*io), flags);
 
         if (io) {
                 igrab(inode);
@@ -3607,8 +3743,8 @@ static ext4_io_end_t *ext4_init_io_end (struct inode *inode)
                 io->flag = 0;
                 io->offset = 0;
                 io->size = 0;
-                io->error = 0;
-                INIT_WORK(&io->work, ext4_end_aio_dio_work);
+                io->page = NULL;
+                INIT_WORK(&io->work, ext4_end_io_work);
                 INIT_LIST_HEAD(&io->list);
         }
 
@@ -3620,6 +3756,8 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
 {
         ext4_io_end_t *io_end = iocb->private;
         struct workqueue_struct *wq;
+        unsigned long flags;
+        struct ext4_inode_info *ei;
 
         /* if not async direct IO or dio with 0 bytes write, just return */
         if (!io_end || !size)
@@ -3631,7 +3769,7 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
                   size);
 
         /* if not aio dio with unwritten extents, just free io and return */
-        if (io_end->flag != DIO_AIO_UNWRITTEN){
+        if (io_end->flag != EXT4_IO_UNWRITTEN){
                 ext4_free_io_end(io_end);
                 iocb->private = NULL;
                 return;
@@ -3639,16 +3777,85 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
 
         io_end->offset = offset;
         io_end->size = size;
+        io_end->flag = EXT4_IO_UNWRITTEN;
         wq = EXT4_SB(io_end->inode->i_sb)->dio_unwritten_wq;
 
         /* queue the work to convert unwritten extents to written */
         queue_work(wq, &io_end->work);
 
         /* Add the io_end to per-inode completed aio dio list*/
-        list_add_tail(&io_end->list,
-                 &EXT4_I(io_end->inode)->i_aio_dio_complete_list);
+        ei = EXT4_I(io_end->inode);
+        spin_lock_irqsave(&ei->i_completed_io_lock, flags);
+        list_add_tail(&io_end->list, &ei->i_completed_io_list);
+        spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
         iocb->private = NULL;
 }
+
+static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate)
+{
+        ext4_io_end_t *io_end = bh->b_private;
+        struct workqueue_struct *wq;
+        struct inode *inode;
+        unsigned long flags;
+
+        if (!test_clear_buffer_uninit(bh) || !io_end)
+                goto out;
+
+        if (!(io_end->inode->i_sb->s_flags & MS_ACTIVE)) {
+                printk("sb umounted, discard end_io request for inode %lu\n",
+                        io_end->inode->i_ino);
+                ext4_free_io_end(io_end);
+                goto out;
+        }
+
+        io_end->flag = EXT4_IO_UNWRITTEN;
+        inode = io_end->inode;
+
+        /* Add the io_end to per-inode completed io list*/
+        spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
+        list_add_tail(&io_end->list, &EXT4_I(inode)->i_completed_io_list);
+        spin_unlock_irqrestore(&EXT4_I(inode)->i_completed_io_lock, flags);
+
+        wq = EXT4_SB(inode->i_sb)->dio_unwritten_wq;
+        /* queue the work to convert unwritten extents to written */
+        queue_work(wq, &io_end->work);
+out:
+        bh->b_private = NULL;
+        bh->b_end_io = NULL;
+        clear_buffer_uninit(bh);
+        end_buffer_async_write(bh, uptodate);
+}
+
+static int ext4_set_bh_endio(struct buffer_head *bh, struct inode *inode)
+{
+        ext4_io_end_t *io_end;
+        struct page *page = bh->b_page;
+        loff_t offset = (sector_t)page->index << PAGE_CACHE_SHIFT;
+        size_t size = bh->b_size;
+
+retry:
+        io_end = ext4_init_io_end(inode, GFP_ATOMIC);
+        if (!io_end) {
+                if (printk_ratelimit())
+                        printk(KERN_WARNING "%s: allocation fail\n", __func__);
+                schedule();
+                goto retry;
+        }
+        io_end->offset = offset;
+        io_end->size = size;
+        /*
+         * We need to hold a reference to the page to make sure it
+         * doesn't get evicted before ext4_end_io_work() has a chance
+         * to convert the extent from written to unwritten.
+         */
+        io_end->page = page;
+        get_page(io_end->page);
+
+        bh->b_private = io_end;
+        bh->b_end_io = ext4_end_io_buffer_write;
+        return 0;
+}
+
 /*
  * For ext4 extent files, ext4 will do direct-io write to holes,
  * preallocated extents, and those write extend the file, no need to
@@ -3702,7 +3909,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 iocb->private = NULL;
                 EXT4_I(inode)->cur_aio_dio = NULL;
                 if (!is_sync_kiocb(iocb)) {
-                        iocb->private = ext4_init_io_end(inode);
+                        iocb->private = ext4_init_io_end(inode, GFP_NOFS);
                         if (!iocb->private)
                                 return -ENOMEM;
                         /*
@@ -3718,7 +3925,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 ret = blockdev_direct_IO(rw, iocb, inode,
                                          inode->i_sb->s_bdev, iov,
                                          offset, nr_segs,
-                                         ext4_get_block_dio_write,
+                                         ext4_get_block_write,
                                          ext4_end_io_dio);
                 if (iocb->private)
                         EXT4_I(inode)->cur_aio_dio = NULL;
@@ -3739,8 +3946,8 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
                         ext4_free_io_end(iocb->private);
                         iocb->private = NULL;
-                } else if (ret > 0 && (EXT4_I(inode)->i_state &
-                                       EXT4_STATE_DIO_UNWRITTEN)) {
+                } else if (ret > 0 && ext4_test_inode_state(inode,
+                                                EXT4_STATE_DIO_UNWRITTEN)) {
                         int err;
                         /*
                          * for non AIO case, since the IO is already
@@ -3750,7 +3957,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                                                              offset, ret);
                         if (err < 0)
                                 ret = err;
-                        EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+                        ext4_clear_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
                 }
                 return ret;
         }
@@ -4081,18 +4288,27 @@ no_top:
  * We release `count' blocks on disk, but (last - first) may be greater
  * than `count' because there can be holes in there.
  */
-static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
-                              struct buffer_head *bh,
-                              ext4_fsblk_t block_to_free,
-                              unsigned long count, __le32 *first,
-                              __le32 *last)
+static int ext4_clear_blocks(handle_t *handle, struct inode *inode,
+                             struct buffer_head *bh,
+                             ext4_fsblk_t block_to_free,
+                             unsigned long count, __le32 *first,
+                             __le32 *last)
 {
         __le32 *p;
-        int     flags = EXT4_FREE_BLOCKS_FORGET;
+        int     flags = EXT4_FREE_BLOCKS_FORGET | EXT4_FREE_BLOCKS_VALIDATED;
 
         if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))
                 flags |= EXT4_FREE_BLOCKS_METADATA;
 
+        if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), block_to_free,
+                                   count)) {
+                ext4_error(inode->i_sb, "inode #%lu: "
+                           "attempt to clear blocks %llu len %lu, invalid",
+                           inode->i_ino, (unsigned long long) block_to_free,
+                           count);
+                return 1;
+        }
+
         if (try_to_extend_transaction(handle, inode)) {
                 if (bh) {
                         BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
@@ -4111,6 +4327,7 @@ static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
                 *p = 0;
 
         ext4_free_blocks(handle, inode, 0, block_to_free, count, flags);
+        return 0;
 }
 
 /**
@@ -4166,9 +4383,10 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                         } else if (nr == block_to_free + count) {
                                 count++;
                         } else {
-                                ext4_clear_blocks(handle, inode, this_bh,
-                                                  block_to_free,
-                                                  count, block_to_free_p, p);
+                                if (ext4_clear_blocks(handle, inode, this_bh,
+                                                      block_to_free, count,
+                                                      block_to_free_p, p))
+                                        break;
                                 block_to_free = nr;
                                 block_to_free_p = p;
                                 count = 1;
@@ -4192,7 +4410,7 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                 if ((EXT4_JOURNAL(inode) == NULL) || bh2jh(this_bh))
                         ext4_handle_dirty_metadata(handle, inode, this_bh);
                 else
-                        ext4_error(inode->i_sb, __func__,
+                        ext4_error(inode->i_sb,
                                    "circular indirect block detected, "
                                    "inode=%lu, block=%llu",
                                    inode->i_ino,
@@ -4232,6 +4450,16 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
                         if (!nr)
                                 continue;               /* A hole */
 
+                        if (!ext4_data_block_valid(EXT4_SB(inode->i_sb),
+                                                   nr, 1)) {
+                                ext4_error(inode->i_sb,
+                                           "indirect mapped block in inode "
+                                           "#%lu invalid (level %d, blk #%lu)",
+                                           inode->i_ino, depth,
+                                           (unsigned long) nr);
+                                break;
+                        }
+
                         /* Go read the buffer for the next level down */
                         bh = sb_bread(inode->i_sb, nr);
 
@@ -4240,7 +4468,7 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
                          * (should be rare).
                          */
                         if (!bh) {
-                                ext4_error(inode->i_sb, "ext4_free_branches",
+                                ext4_error(inode->i_sb,
                                            "Read failure, inode=%lu, block=%llu",
                                            inode->i_ino, nr);
                                 continue;
@@ -4384,8 +4612,10 @@ void ext4_truncate(struct inode *inode)
         if (!ext4_can_truncate(inode))
                 return;
 
+        EXT4_I(inode)->i_flags &= ~EXT4_EOFBLOCKS_FL;
+
         if (inode->i_size == 0 && !test_opt(inode->i_sb, NO_AUTO_DA_ALLOC))
-                ei->i_state |= EXT4_STATE_DA_ALLOC_CLOSE;
+                ext4_set_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
 
         if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
                 ext4_ext_truncate(inode);
@@ -4555,9 +4785,8 @@ static int __ext4_get_inode_loc(struct inode *inode,
 
         bh = sb_getblk(sb, block);
         if (!bh) {
-                ext4_error(sb, "ext4_get_inode_loc", "unable to read "
-                           "inode block - inode=%lu, block=%llu",
-                           inode->i_ino, block);
+                ext4_error(sb, "unable to read inode block - "
+                           "inode=%lu, block=%llu", inode->i_ino, block);
                 return -EIO;
         }
         if (!buffer_uptodate(bh)) {
@@ -4655,9 +4884,8 @@ make_io:
                 submit_bh(READ_META, bh);
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh)) {
-                        ext4_error(sb, __func__,
-                                   "unable to read inode block - inode=%lu, "
-                                   "block=%llu", inode->i_ino, block);
+                        ext4_error(sb, "unable to read inode block - inode=%lu,"
+                                   " block=%llu", inode->i_ino, block);
                         brelse(bh);
                         return -EIO;
                 }
@@ -4671,7 +4899,7 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
 {
         /* We have all inode data except xattrs in memory here. */
         return __ext4_get_inode_loc(inode, iloc,
-                !(EXT4_I(inode)->i_state & EXT4_STATE_XATTR));
+                !ext4_test_inode_state(inode, EXT4_STATE_XATTR));
 }
 
 void ext4_set_inode_flags(struct inode *inode)
@@ -4765,7 +4993,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
         }
         inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
 
-        ei->i_state = 0;
+        ei->i_state_flags = 0;
         ei->i_dir_start_lookup = 0;
         ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
         /* We now have enough fields to check if the inode was active or not.
@@ -4848,7 +5076,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
                                         EXT4_GOOD_OLD_INODE_SIZE +
                                         ei->i_extra_isize;
                         if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC))
-                                ei->i_state |= EXT4_STATE_XATTR;
+                                ext4_set_inode_state(inode, EXT4_STATE_XATTR);
                 }
         } else
                 ei->i_extra_isize = 0;
@@ -4868,8 +5096,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
         ret = 0;
         if (ei->i_file_acl &&
             !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
-                ext4_error(sb, __func__,
-                           "bad extended attribute block %llu in inode #%lu",
+                ext4_error(sb, "bad extended attribute block %llu inode #%lu",
                            ei->i_file_acl, inode->i_ino);
                 ret = -EIO;
                 goto bad_inode;
@@ -4915,8 +5142,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
                            new_decode_dev(le32_to_cpu(raw_inode->i_block[1])));
         } else {
                 ret = -EIO;
-                ext4_error(inode->i_sb, __func__,
-                           "bogus i_mode (%o) for inode=%lu",
+                ext4_error(inode->i_sb, "bogus i_mode (%o) for inode=%lu",
                            inode->i_mode, inode->i_ino);
                 goto bad_inode;
         }
@@ -4988,7 +5214,7 @@ static int ext4_do_update_inode(handle_t *handle,
 
         /* For fields not not tracking in the in-memory inode,
          * initialise them to zero for new inodes. */
-        if (ei->i_state & EXT4_STATE_NEW)
+        if (ext4_test_inode_state(inode, EXT4_STATE_NEW))
                 memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
 
         ext4_get_inode_flags(ei);
@@ -5052,7 +5278,7 @@ static int ext4_do_update_inode(handle_t *handle,
                                         EXT4_FEATURE_RO_COMPAT_LARGE_FILE);
                         sb->s_dirt = 1;
                         ext4_handle_sync(handle);
-                        err = ext4_handle_dirty_metadata(handle, inode,
+                        err = ext4_handle_dirty_metadata(handle, NULL,
                                         EXT4_SB(sb)->s_sbh);
                 }
         }
@@ -5081,10 +5307,10 @@ static int ext4_do_update_inode(handle_t *handle,
         }
 
         BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
-        rc = ext4_handle_dirty_metadata(handle, inode, bh);
+        rc = ext4_handle_dirty_metadata(handle, NULL, bh);
         if (!err)
                 err = rc;
-        ei->i_state &= ~EXT4_STATE_NEW;
+        ext4_clear_inode_state(inode, EXT4_STATE_NEW);
 
         ext4_update_inode_fsync_trans(handle, inode, 0);
 out_brelse:
@@ -5128,7 +5354,7 @@ out_brelse:
  * `stuff()' is running, and the new i_size will be lost.  Plus the inode
  * will no longer be on the superblock's dirty inode list.
  */
-int ext4_write_inode(struct inode *inode, int wait)
+int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int err;
 
@@ -5142,26 +5368,25 @@ int ext4_write_inode(struct inode *inode, int wait)
                         return -EIO;
                 }
 
-                if (!wait)
+                if (wbc->sync_mode != WB_SYNC_ALL)
                         return 0;
 
                 err = ext4_force_commit(inode->i_sb);
         } else {
                 struct ext4_iloc iloc;
 
-                err = ext4_get_inode_loc(inode, &iloc);
+                err = __ext4_get_inode_loc(inode, &iloc, 0);
                 if (err)
                         return err;
-                if (wait)
+                if (wbc->sync_mode == WB_SYNC_ALL)
                         sync_dirty_buffer(iloc.bh);
                 if (buffer_req(iloc.bh) && !buffer_uptodate(iloc.bh)) {
-                        ext4_error(inode->i_sb, __func__,
-                                   "IO error syncing inode, "
-                                   "inode=%lu, block=%llu",
-                                   inode->i_ino,
+                        ext4_error(inode->i_sb, "IO error syncing inode, "
+                                   "inode=%lu, block=%llu", inode->i_ino,
                                    (unsigned long long)iloc.bh->b_blocknr);
                         err = -EIO;
                 }
+                brelse(iloc.bh);
         }
         return err;
 }
@@ -5200,6 +5425,8 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
         if (error)
                 return error;
 
+        if (ia_valid & ATTR_SIZE)
+                dquot_initialize(inode);
         if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
                 (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
                 handle_t *handle;
@@ -5212,7 +5439,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
                         error = PTR_ERR(handle);
                         goto err_out;
                 }
-                error = vfs_dq_transfer(inode, attr) ? -EDQUOT : 0;
+                error = dquot_transfer(inode, attr);
                 if (error) {
                         ext4_journal_stop(handle);
                         return error;
@@ -5239,7 +5466,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         if (S_ISREG(inode->i_mode) &&
-            attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
+            attr->ia_valid & ATTR_SIZE &&
+            (attr->ia_size < inode->i_size ||
+             (EXT4_I(inode)->i_flags & EXT4_EOFBLOCKS_FL))) {
                 handle_t *handle;
 
                 handle = ext4_journal_start(inode, 3);
@@ -5270,6 +5499,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
                                 goto err_out;
                         }
                 }
+                /* ext4_truncate will clear the flag */
+                if ((EXT4_I(inode)->i_flags & EXT4_EOFBLOCKS_FL))
+                        ext4_truncate(inode);
         }
 
         rc = inode_setattr(inode, attr);
@@ -5508,8 +5740,8 @@ static int ext4_expand_extra_isize(struct inode *inode,
         entry = IFIRST(header);
 
         /* No extended attributes present */
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR) ||
-                header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
+        if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
+            header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
                 memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
                         new_extra_isize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
@@ -5553,7 +5785,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
         err = ext4_reserve_inode_write(handle, inode, &iloc);
         if (ext4_handle_valid(handle) &&
             EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
-            !(EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND)) {
+            !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
                 /*
                  * We need extra buffer credits since we may write into EA block
                  * with this same handle. If journal_extend fails, then it will
@@ -5567,10 +5799,11 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
                                                       sbi->s_want_extra_isize,
                                                       iloc, handle);
                         if (ret) {
-                                EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
+                                ext4_set_inode_state(inode,
+                                                     EXT4_STATE_NO_EXPAND);
                                 if (mnt_count !=
                                         le16_to_cpu(sbi->s_es->s_mnt_count)) {
-                                        ext4_warning(inode->i_sb, __func__,
+                                        ext4_warning(inode->i_sb,
                                         "Unable to expand inode %lu. Delete"
                                         " some EAs or run e2fsck.",
                                         inode->i_ino);
@@ -5592,7 +5825,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
  * i_size has been changed by generic_commit_write() and we thus need
  * to include the updated inode in the current transaction.
  *
- * Also, vfs_dq_alloc_block() will always dirty the inode when blocks
+ * Also, dquot_alloc_block() will always dirty the inode when blocks
  * are allocated to the file.
  *
  * If the inode is marked synchronous, we don't honour that here - doing
@@ -5634,7 +5867,7 @@ static int ext4_pin_inode(handle_t *handle, struct inode *inode)
                         err = jbd2_journal_get_write_access(handle, iloc.bh);
                         if (!err)
                                 err = ext4_handle_dirty_metadata(handle,
-                                                                 inode,
+                                                                 NULL,
                                                                  iloc.bh);
                         brelse(iloc.bh);
                 }
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index b63d193126db..016d0249294f 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -92,6 +92,15 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                         flags &= ~EXT4_EXTENTS_FL;
                 }
 
+                if (flags & EXT4_EOFBLOCKS_FL) {
+                        /* we don't support adding EOFBLOCKS flag */
+                        if (!(oldflags & EXT4_EOFBLOCKS_FL)) {
+                                err = -EOPNOTSUPP;
+                                goto flags_out;
+                        }
+                } else if (oldflags & EXT4_EOFBLOCKS_FL)
+                        ext4_truncate(inode);
+
                 handle = ext4_journal_start(inode, 1);
                 if (IS_ERR(handle)) {
                         err = PTR_ERR(handle);
@@ -249,7 +258,8 @@ setversion_out:
                 if (me.moved_len > 0)
                         file_remove_suid(donor_filp);
 
-                if (copy_to_user((struct move_extent *)arg, &me, sizeof(me)))
+                if (copy_to_user((struct move_extent __user *)arg, 
+                                 &me, sizeof(me)))
                         err = -EFAULT;
 mext_out:
                 fput(donor_filp);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index d34afad3e137..b423a364dca3 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -23,6 +23,7 @@
 
 #include "mballoc.h"
 #include <linux/debugfs.h>
+#include <linux/slab.h>
 #include <trace/events/ext4.h>
 
 /*
@@ -69,7 +70,7 @@
  *
  * pa_lstart -> the logical start block for this prealloc space
  * pa_pstart -> the physical start block for this prealloc space
- * pa_len    -> lenght for this prealloc space
+ * pa_len    -> length for this prealloc space
  * pa_free   ->  free space available in this prealloc space
  *
  * The inode preallocation space is used looking at the _logical_ start
@@ -441,10 +442,9 @@ static void mb_free_blocks_double(struct inode *inode, struct ext4_buddy *e4b,
         for (i = 0; i < count; i++) {
                 if (!mb_test_bit(first + i, e4b->bd_info->bb_bitmap)) {
                         ext4_fsblk_t blocknr;
-                        blocknr = e4b->bd_group * EXT4_BLOCKS_PER_GROUP(sb);
+
+                        blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
                         blocknr += first + i;
-                        blocknr +=
-                            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
                         ext4_grp_locked_error(sb, e4b->bd_group,
                                    __func__, "double-free of inode"
                                    " %lu's block %llu(bit %u in group %u)",
@@ -1255,10 +1255,9 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
 
                 if (!mb_test_bit(block, EXT4_MB_BITMAP(e4b))) {
                         ext4_fsblk_t blocknr;
-                        blocknr = e4b->bd_group * EXT4_BLOCKS_PER_GROUP(sb);
+
+                        blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
                         blocknr += block;
-                        blocknr +=
-                            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
                         ext4_grp_locked_error(sb, e4b->bd_group,
                                    __func__, "double-free of inode"
                                    " %lu's block %llu(bit %u in group %u)",
@@ -1631,7 +1630,6 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
         int max;
         int err;
         struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
-        struct ext4_super_block *es = sbi->s_es;
         struct ext4_free_extent ex;
 
         if (!(ac->ac_flags & EXT4_MB_HINT_TRY_GOAL))
@@ -1648,8 +1646,8 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
         if (max >= ac->ac_g_ex.fe_len && ac->ac_g_ex.fe_len == sbi->s_stripe) {
                 ext4_fsblk_t start;
 
-                start = (e4b->bd_group * EXT4_BLOCKS_PER_GROUP(ac->ac_sb)) +
-                        ex.fe_start + le32_to_cpu(es->s_first_data_block);
+                start = ext4_group_first_block_no(ac->ac_sb, e4b->bd_group) +
+                        ex.fe_start;
                 /* use do_div to get remainder (would be 64-bit modulo) */
                 if (do_div(start, sbi->s_stripe) == 0) {
                         ac->ac_found++;
@@ -1803,8 +1801,8 @@ void ext4_mb_scan_aligned(struct ext4_allocation_context *ac,
         BUG_ON(sbi->s_stripe == 0);
 
         /* find first stripe-aligned block in group */
-        first_group_block = e4b->bd_group * EXT4_BLOCKS_PER_GROUP(sb)
-                + le32_to_cpu(sbi->s_es->s_first_data_block);
+        first_group_block = ext4_group_first_block_no(sb, e4b->bd_group);
+
         a = first_group_block + sbi->s_stripe - 1;
         do_div(a, sbi->s_stripe);
         i = (a * sbi->s_stripe) - first_group_block;
@@ -2256,7 +2254,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
 
         INIT_LIST_HEAD(&meta_group_info[i]->bb_prealloc_list);
         init_rwsem(&meta_group_info[i]->alloc_sem);
-        meta_group_info[i]->bb_free_root.rb_node = NULL;
+        meta_group_info[i]->bb_free_root = RB_ROOT;
 
 #ifdef DOUBLE_CHECK
         {
@@ -2537,6 +2535,17 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
                 mb_debug(1, "gonna free %u blocks in group %u (0x%p):",
                          entry->count, entry->group, entry);
 
+                if (test_opt(sb, DISCARD)) {
+                        ext4_fsblk_t discard_block;
+
+                        discard_block = entry->start_blk +
+                                ext4_group_first_block_no(sb, entry->group);
+                        trace_ext4_discard_blocks(sb,
+                                        (unsigned long long)discard_block,
+                                        entry->count);
+                        sb_issue_discard(sb, discard_block, entry->count);
+                }
+
                 err = ext4_mb_load_buddy(sb, entry->group, &e4b);
                 /* we expect to find existing buddy because it's pinned */
                 BUG_ON(err != 0);
@@ -2558,19 +2567,6 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
                         page_cache_release(e4b.bd_bitmap_page);
                 }
                 ext4_unlock_group(sb, entry->group);
-                if (test_opt(sb, DISCARD)) {
-                        ext4_fsblk_t discard_block;
-                        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
-
-                        discard_block = (ext4_fsblk_t)entry->group *
-                                                EXT4_BLOCKS_PER_GROUP(sb)
-                                        + entry->start_blk
-                                        + le32_to_cpu(es->s_first_data_block);
-                        trace_ext4_discard_blocks(sb,
-                                        (unsigned long long)discard_block,
-                                        entry->count);
-                        sb_issue_discard(sb, discard_block, entry->count);
-                }
                 kmem_cache_free(ext4_free_ext_cachep, entry);
                 ext4_mb_release_desc(&e4b);
         }
@@ -2703,14 +2699,11 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
         if (err)
                 goto out_err;
 
-        block = ac->ac_b_ex.fe_group * EXT4_BLOCKS_PER_GROUP(sb)
-                + ac->ac_b_ex.fe_start
-                + le32_to_cpu(es->s_first_data_block);
+        block = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);
 
         len = ac->ac_b_ex.fe_len;
         if (!ext4_data_block_valid(sbi, block, len)) {
-                ext4_error(sb, __func__,
-                           "Allocating blocks %llu-%llu which overlap "
+                ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
                            "fs metadata\n", block, block+len);
                 /* File system mounted not to panic on error
                  * Fix the bitmap and repeat the block allocation
@@ -3161,9 +3154,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)
                 /* The max size of hash table is PREALLOC_TB_SIZE */
                 order = PREALLOC_TB_SIZE - 1;
 
-        goal_block = ac->ac_g_ex.fe_group * EXT4_BLOCKS_PER_GROUP(ac->ac_sb) +
-                     ac->ac_g_ex.fe_start +
-                     le32_to_cpu(EXT4_SB(ac->ac_sb)->s_es->s_first_data_block);
+        goal_block = ext4_grp_offs_to_block(ac->ac_sb, &ac->ac_g_ex);
         /*
          * search for the prealloc space that is having
          * minimal distance from the goal block.
@@ -3526,8 +3517,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
                 if (bit >= end)
                         break;
                 next = mb_find_next_bit(bitmap_bh->b_data, end, bit);
-                start = group * EXT4_BLOCKS_PER_GROUP(sb) + bit +
-                                le32_to_cpu(sbi->s_es->s_first_data_block);
+                start = ext4_group_first_block_no(sb, group) + bit;
                 mb_debug(1, "    free preallocated %u/%u in group %u\n",
                                 (unsigned) start, (unsigned) next - bit,
                                 (unsigned) group);
@@ -3623,15 +3613,13 @@ ext4_mb_discard_group_preallocations(struct super_block *sb,
 
         bitmap_bh = ext4_read_block_bitmap(sb, group);
         if (bitmap_bh == NULL) {
-                ext4_error(sb, __func__, "Error in reading block "
-                                "bitmap for %u", group);
+                ext4_error(sb, "Error reading block bitmap for %u", group);
                 return 0;
         }
 
         err = ext4_mb_load_buddy(sb, group, &e4b);
         if (err) {
-                ext4_error(sb, __func__, "Error in loading buddy "
-                                "information for %u", group);
+                ext4_error(sb, "Error loading buddy information for %u", group);
                 put_bh(bitmap_bh);
                 return 0;
         }
@@ -3804,15 +3792,15 @@ repeat:
 
                 err = ext4_mb_load_buddy(sb, group, &e4b);
                 if (err) {
-                        ext4_error(sb, __func__, "Error in loading buddy "
-                                        "information for %u", group);
+                        ext4_error(sb, "Error loading buddy information for %u",
+                                        group);
                         continue;
                 }
 
                 bitmap_bh = ext4_read_block_bitmap(sb, group);
                 if (bitmap_bh == NULL) {
-                        ext4_error(sb, __func__, "Error in reading block "
-                                        "bitmap for %u", group);
+                        ext4_error(sb, "Error reading block bitmap for %u",
+                                        group);
                         ext4_mb_release_desc(&e4b);
                         continue;
                 }
@@ -3938,7 +3926,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)
 
         /* don't use group allocation for large files */
         size = max(size, isize);
-        if (size >= sbi->s_mb_stream_request) {
+        if (size > sbi->s_mb_stream_request) {
                 ac->ac_flags |= EXT4_MB_STREAM_ALLOC;
                 return;
         }
@@ -4077,8 +4065,8 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
 
                 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, NULL);
                 if (ext4_mb_load_buddy(sb, group, &e4b)) {
-                        ext4_error(sb, __func__, "Error in loading buddy "
-                                        "information for %u", group);
+                        ext4_error(sb, "Error loading buddy information for %u",
+                                        group);
                         continue;
                 }
                 ext4_lock_group(sb, group);
@@ -4254,7 +4242,7 @@ ext4_fsblk_t ext4_mb_new_blocks(handle_t *handle,
                         return 0;
                 }
                 reserv_blks = ar->len;
-                while (ar->len && vfs_dq_alloc_block(ar->inode, ar->len)) {
+                while (ar->len && dquot_alloc_block(ar->inode, ar->len)) {
                         ar->flags |= EXT4_MB_HINT_NOPREALLOC;
                         ar->len--;
                 }
@@ -4331,7 +4319,7 @@ out2:
         kmem_cache_free(ext4_ac_cachep, ac);
 out1:
         if (inquota && ar->len < inquota)
-                vfs_dq_free_block(ar->inode, inquota - ar->len);
+                dquot_free_block(ar->inode, inquota - ar->len);
 out3:
         if (!ar->len) {
                 if (!EXT4_I(ar->inode)->i_delalloc_reserved_flag)
@@ -4476,10 +4464,10 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
 
         sbi = EXT4_SB(sb);
         es = EXT4_SB(sb)->s_es;
-        if (!ext4_data_block_valid(sbi, block, count)) {
-                ext4_error(sb, __func__,
-                            "Freeing blocks not in datazone - "
-                            "block = %llu, count = %lu", block, count);
+        if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
+            !ext4_data_block_valid(sbi, block, count)) {
+                ext4_error(sb, "Freeing blocks not in datazone - "
+                           "block = %llu, count = %lu", block, count);
                 goto error_return;
         }
 
@@ -4547,8 +4535,7 @@ do_more:
             in_range(block + count - 1, ext4_inode_table(sb, gdp),
                       EXT4_SB(sb)->s_itb_per_group)) {
 
-                ext4_error(sb, __func__,
-                           "Freeing blocks in system zone - "
+                ext4_error(sb, "Freeing blocks in system zone - "
                            "Block = %llu, count = %lu", block, count);
                 /* err = 0. ext4_std_error should be a no op */
                 goto error_return;
@@ -4646,7 +4633,7 @@ do_more:
         sb->s_dirt = 1;
 error_return:
         if (freed)
-                vfs_dq_free_block(inode, freed);
+                dquot_free_block(inode, freed);
         brelse(bitmap_bh);
         ext4_std_error(sb, err);
         if (ac)
diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h
index 0ca811061bc7..b619322c76f0 100644
--- a/fs/ext4/mballoc.h
+++ b/fs/ext4/mballoc.h
@@ -17,7 +17,6 @@
 #include <linux/proc_fs.h>
 #include <linux/pagemap.h>
 #include <linux/seq_file.h>
-#include <linux/version.h>
 #include <linux/blkdev.h>
 #include <linux/mutex.h>
 #include "ext4_jbd2.h"
@@ -221,16 +220,9 @@ struct ext4_buddy {
 #define EXT4_MB_BITMAP(e4b)     ((e4b)->bd_bitmap)
 #define EXT4_MB_BUDDY(e4b)      ((e4b)->bd_buddy)
 
-#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
-
 static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb,
                                         struct ext4_free_extent *fex)
 {
-        ext4_fsblk_t block;
-
-        block = (ext4_fsblk_t) fex->fe_group * EXT4_BLOCKS_PER_GROUP(sb)
-                        + fex->fe_start
-                        + le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
-        return block;
+        return ext4_group_first_block_no(sb, fex->fe_group) + fex->fe_start;
 }
 #endif
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index 81415814b00b..34dcfc52ef44 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include "ext4_jbd2.h"
 #include "ext4_extents.h"
 
@@ -365,12 +366,12 @@ static int ext4_ext_swap_inode_data(handle_t *handle, struct inode *inode,
          * happened after we started the migrate. We need to
          * fail the migrate
          */
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_EXT_MIGRATE)) {
+        if (!ext4_test_inode_state(inode, EXT4_STATE_EXT_MIGRATE)) {
                 retval = -EAGAIN;
                 up_write(&EXT4_I(inode)->i_data_sem);
                 goto err_out;
         } else
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
+                ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
         /*
          * We have the extent map build with the tmp inode.
          * Now copy the i_data across
@@ -503,14 +504,10 @@ int ext4_ext_migrate(struct inode *inode)
         }
         i_size_write(tmp_inode, i_size_read(inode));
         /*
-         * We don't want the inode to be reclaimed
-         * if we got interrupted in between. We have
-         * this tmp inode carrying reference to the
-         * data blocks of the original file. We set
-         * the i_nlink to zero at the last stage after
-         * switching the original file to extent format
+         * Set the i_nlink to zero so it will be deleted later
+         * when we drop inode reference.
          */
-        tmp_inode->i_nlink = 1;
+        tmp_inode->i_nlink = 0;
 
         ext4_ext_tree_init(handle, tmp_inode);
         ext4_orphan_add(handle, tmp_inode);
@@ -533,10 +530,20 @@ int ext4_ext_migrate(struct inode *inode)
          * allocation.
          */
         down_read((&EXT4_I(inode)->i_data_sem));
-        EXT4_I(inode)->i_state |= EXT4_STATE_EXT_MIGRATE;
+        ext4_set_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
         up_read((&EXT4_I(inode)->i_data_sem));
 
         handle = ext4_journal_start(inode, 1);
+        if (IS_ERR(handle)) {
+                /*
+                 * It is impossible to update on-disk structures without
+                 * a handle, so just rollback in-core changes and live other
+                 * work to orphan_list_cleanup()
+                 */
+                ext4_orphan_del(NULL, tmp_inode);
+                retval = PTR_ERR(handle);
+                goto out;
+        }
 
         ei = EXT4_I(inode);
         i_data = ei->i_data;
@@ -618,15 +625,8 @@ err_out:
 
         /* Reset the extent details */
         ext4_ext_tree_init(handle, tmp_inode);
-
-        /*
-         * Set the i_nlink to zero so that
-         * generic_drop_inode really deletes the
-         * inode
-         */
-        tmp_inode->i_nlink = 0;
-
         ext4_journal_stop(handle);
+out:
         unlock_new_inode(tmp_inode);
         iput(tmp_inode);
 
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 82c415be87a4..d1fc662cc311 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -15,6 +15,7 @@
 
 #include <linux/fs.h>
 #include <linux/quotaops.h>
+#include <linux/slab.h>
 #include "ext4_jbd2.h"
 #include "ext4_extents.h"
 #include "ext4.h"
@@ -152,12 +153,12 @@ mext_check_null_inode(struct inode *inode1, struct inode *inode2,
         int ret = 0;
 
         if (inode1 == NULL) {
-                ext4_error(inode2->i_sb, function,
+                __ext4_error(inode2->i_sb, function,
                         "Both inodes should not be NULL: "
                         "inode1 NULL inode2 %lu", inode2->i_ino);
                 ret = -EIO;
         } else if (inode2 == NULL) {
-                ext4_error(inode1->i_sb, function,
+                __ext4_error(inode1->i_sb, function,
                         "Both inodes should not be NULL: "
                         "inode1 %lu inode2 NULL", inode1->i_ino);
                 ret = -EIO;
@@ -252,6 +253,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
                 }
 
                 o_start->ee_len = start_ext->ee_len;
+                eblock = le32_to_cpu(start_ext->ee_block);
                 new_flag = 1;
 
         } else if (start_ext->ee_len && new_ext->ee_len &&
@@ -262,6 +264,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
                  * orig  |------------------------------|
                  */
                 o_start->ee_len = start_ext->ee_len;
+                eblock = le32_to_cpu(start_ext->ee_block);
                 new_flag = 1;
 
         } else if (!start_ext->ee_len && new_ext->ee_len &&
@@ -475,7 +478,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
         struct ext4_extent *oext, *o_start, *o_end, *prev_ext;
         struct ext4_extent new_ext, start_ext, end_ext;
         ext4_lblk_t new_ext_end;
-        ext4_fsblk_t new_phys_end;
         int oext_alen, new_ext_alen, end_ext_alen;
         int depth = ext_depth(orig_inode);
         int ret;
@@ -489,7 +491,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
         new_ext.ee_len = dext->ee_len;
         new_ext_alen = ext4_ext_get_actual_len(&new_ext);
         new_ext_end = le32_to_cpu(new_ext.ee_block) + new_ext_alen - 1;
-        new_phys_end = ext_pblock(&new_ext) + new_ext_alen - 1;
 
         /*
          * Case: original extent is first
@@ -502,6 +503,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
                 le32_to_cpu(oext->ee_block) + oext_alen) {
                 start_ext.ee_len = cpu_to_le16(le32_to_cpu(new_ext.ee_block) -
                                                le32_to_cpu(oext->ee_block));
+                start_ext.ee_block = oext->ee_block;
                 copy_extent_status(oext, &start_ext);
         } else if (oext > EXT_FIRST_EXTENT(orig_path[depth].p_hdr)) {
                 prev_ext = oext - 1;
@@ -515,6 +517,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
                         start_ext.ee_len = cpu_to_le16(
                                 ext4_ext_get_actual_len(prev_ext) +
                                 new_ext_alen);
+                        start_ext.ee_block = oext->ee_block;
                         copy_extent_status(prev_ext, &start_ext);
                         new_ext.ee_len = 0;
                 }
@@ -526,7 +529,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
          * new_ext       |-------|
          */
         if (le32_to_cpu(oext->ee_block) + oext_alen - 1 < new_ext_end) {
-                ext4_error(orig_inode->i_sb, __func__,
+                ext4_error(orig_inode->i_sb,
                         "new_ext_end(%u) should be less than or equal to "
                         "oext->ee_block(%u) + oext_alen(%d) - 1",
                         new_ext_end, le32_to_cpu(oext->ee_block),
@@ -689,12 +692,12 @@ mext_replace_branches(handle_t *handle, struct inode *orig_inode,
         while (1) {
                 /* The extent for donor must be found. */
                 if (!dext) {
-                        ext4_error(donor_inode->i_sb, __func__,
+                        ext4_error(donor_inode->i_sb,
                                    "The extent for donor must be found");
                         *err = -EIO;
                         goto out;
                 } else if (donor_off != le32_to_cpu(tmp_dext.ee_block)) {
-                        ext4_error(donor_inode->i_sb, __func__,
+                        ext4_error(donor_inode->i_sb,
                                 "Donor offset(%u) and the first block of donor "
                                 "extent(%u) should be equal",
                                 donor_off,
@@ -928,7 +931,7 @@ out2:
 }
 
 /**
- * mext_check_argumants - Check whether move extent can be done
+ * mext_check_arguments - Check whether move extent can be done
  *
  * @orig_inode:         original inode
  * @donor_inode:        donor inode
@@ -949,14 +952,6 @@ mext_check_arguments(struct inode *orig_inode,
         unsigned int blkbits = orig_inode->i_blkbits;
         unsigned int blocksize = 1 << blkbits;
 
-        /* Regular file check */
-        if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
-                ext4_debug("ext4 move extent: The argument files should be "
-                        "regular file [ino:orig %lu, donor %lu]\n",
-                        orig_inode->i_ino, donor_inode->i_ino);
-                return -EINVAL;
-        }
-
         if (donor_inode->i_mode & (S_ISUID|S_ISGID)) {
                 ext4_debug("ext4 move extent: suid or sgid is set"
                            " to donor file [ino:orig %lu, donor %lu]\n",
@@ -1204,6 +1199,14 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
                 return -EINVAL;
         }
 
+        /* Regular file check */
+        if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
+                ext4_debug("ext4 move extent: The argument files should be "
+                        "regular file [ino:orig %lu, donor %lu]\n",
+                        orig_inode->i_ino, donor_inode->i_ino);
+                return -EINVAL;
+        }
+
         /* Protect orig and donor inodes against a truncate */
         ret1 = mext_inode_double_lock(orig_inode, donor_inode);
         if (ret1 < 0)
@@ -1351,7 +1354,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
                         if (ret1 < 0)
                                 break;
                         if (*moved_len > len) {
-                                ext4_error(orig_inode->i_sb, __func__,
+                                ext4_error(orig_inode->i_sb,
                                         "We replaced blocks too much! "
                                         "sum of replaced: %llu requested: %llu",
                                         *moved_len, len);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 17a17e10dd60..0c070fabd108 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -383,8 +383,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         if (root->info.hash_version != DX_HASH_TEA &&
             root->info.hash_version != DX_HASH_HALF_MD4 &&
             root->info.hash_version != DX_HASH_LEGACY) {
-                ext4_warning(dir->i_sb, __func__,
-                             "Unrecognised inode hash code %d",
+                ext4_warning(dir->i_sb, "Unrecognised inode hash code %d",
                              root->info.hash_version);
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
@@ -399,8 +398,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         hash = hinfo->hash;
 
         if (root->info.unused_flags & 1) {
-                ext4_warning(dir->i_sb, __func__,
-                             "Unimplemented inode hash flags: %#06x",
+                ext4_warning(dir->i_sb, "Unimplemented inode hash flags: %#06x",
                              root->info.unused_flags);
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
@@ -408,8 +406,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         }
 
         if ((indirect = root->info.indirect_levels) > 1) {
-                ext4_warning(dir->i_sb, __func__,
-                             "Unimplemented inode hash depth: %#06x",
+                ext4_warning(dir->i_sb, "Unimplemented inode hash depth: %#06x",
                              root->info.indirect_levels);
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
@@ -421,8 +418,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
 
         if (dx_get_limit(entries) != dx_root_limit(dir,
                                                    root->info.info_length)) {
-                ext4_warning(dir->i_sb, __func__,
-                             "dx entry: limit != root limit");
+                ext4_warning(dir->i_sb, "dx entry: limit != root limit");
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
                 goto fail;
@@ -433,7 +429,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         {
                 count = dx_get_count(entries);
                 if (!count || count > dx_get_limit(entries)) {
-                        ext4_warning(dir->i_sb, __func__,
+                        ext4_warning(dir->i_sb,
                                      "dx entry: no count or count > limit");
                         brelse(bh);
                         *err = ERR_BAD_DX_DIR;
@@ -478,7 +474,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
                         goto fail2;
                 at = entries = ((struct dx_node *) bh->b_data)->entries;
                 if (dx_get_limit(entries) != dx_node_limit (dir)) {
-                        ext4_warning(dir->i_sb, __func__,
+                        ext4_warning(dir->i_sb,
                                      "dx entry: limit != node limit");
                         brelse(bh);
                         *err = ERR_BAD_DX_DIR;
@@ -494,7 +490,7 @@ fail2:
         }
 fail:
         if (*err == ERR_BAD_DX_DIR)
-                ext4_warning(dir->i_sb, __func__,
+                ext4_warning(dir->i_sb,
                              "Corrupt dir inode %ld, running e2fsck is "
                              "recommended.", dir->i_ino);
         return NULL;
@@ -947,9 +943,8 @@ restart:
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh)) {
                         /* read error, skip block & hope for the best */
-                        ext4_error(sb, __func__, "reading directory #%lu "
-                                   "offset %lu", dir->i_ino,
-                                   (unsigned long)block);
+                        ext4_error(sb, "reading directory #%lu offset %lu",
+                                   dir->i_ino, (unsigned long)block);
                         brelse(bh);
                         goto next;
                 }
@@ -1041,7 +1036,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir, const struct q
                 retval = ext4_htree_next_block(dir, hash, frame,
                                                frames, NULL);
                 if (retval < 0) {
-                        ext4_warning(sb, __func__,
+                        ext4_warning(sb,
                              "error reading index page in directory #%lu",
                              dir->i_ino);
                         *err = retval;
@@ -1071,14 +1066,13 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, stru
                 __u32 ino = le32_to_cpu(de->inode);
                 brelse(bh);
                 if (!ext4_valid_inum(dir->i_sb, ino)) {
-                        ext4_error(dir->i_sb, "ext4_lookup",
-                                   "bad inode number: %u", ino);
+                        ext4_error(dir->i_sb, "bad inode number: %u", ino);
                         return ERR_PTR(-EIO);
                 }
                 inode = ext4_iget(dir->i_sb, ino);
                 if (unlikely(IS_ERR(inode))) {
                         if (PTR_ERR(inode) == -ESTALE) {
-                                ext4_error(dir->i_sb, __func__,
+                                ext4_error(dir->i_sb,
                                                 "deleted inode referenced: %u",
                                                 ino);
                                 return ERR_PTR(-EIO);
@@ -1110,7 +1104,7 @@ struct dentry *ext4_get_parent(struct dentry *child)
         brelse(bh);
 
         if (!ext4_valid_inum(child->d_inode->i_sb, ino)) {
-                ext4_error(child->d_inode->i_sb, "ext4_get_parent",
+                ext4_error(child->d_inode->i_sb,
                            "bad inode number: %u", ino);
                 return ERR_PTR(-EIO);
         }
@@ -1410,7 +1404,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         de = (struct ext4_dir_entry_2 *)((char *)fde +
                 ext4_rec_len_from_disk(fde->rec_len, blocksize));
         if ((char *) de >= (((char *) root) + blocksize)) {
-                ext4_error(dir->i_sb, __func__,
+                ext4_error(dir->i_sb,
                            "invalid rec_len for '..' in inode %lu",
                            dir->i_ino);
                 brelse(bh);
@@ -1575,8 +1569,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
 
                 if (levels && (dx_get_count(frames->entries) ==
                                dx_get_limit(frames->entries))) {
-                        ext4_warning(sb, __func__,
-                                     "Directory index full!");
+                        ext4_warning(sb, "Directory index full!");
                         err = -ENOSPC;
                         goto cleanup;
                 }
@@ -1766,6 +1759,8 @@ static int ext4_create(struct inode *dir, struct dentry *dentry, int mode,
         struct inode *inode;
         int err, retries = 0;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
@@ -1800,6 +1795,8 @@ static int ext4_mknod(struct inode *dir, struct dentry *dentry,
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
@@ -1837,6 +1834,8 @@ static int ext4_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         if (EXT4_DIR_LINK_MAX(dir))
                 return -EMLINK;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
@@ -1916,11 +1915,11 @@ static int empty_dir(struct inode *inode)
         if (inode->i_size < EXT4_DIR_REC_LEN(1) + EXT4_DIR_REC_LEN(2) ||
             !(bh = ext4_bread(NULL, inode, 0, 0, &err))) {
                 if (err)
-                        ext4_error(inode->i_sb, __func__,
+                        ext4_error(inode->i_sb,
                                    "error %d reading directory #%lu offset 0",
                                    err, inode->i_ino);
                 else
-                        ext4_warning(inode->i_sb, __func__,
+                        ext4_warning(inode->i_sb,
                                      "bad directory (dir #%lu) - no data block",
                                      inode->i_ino);
                 return 1;
@@ -1931,7 +1930,7 @@ static int empty_dir(struct inode *inode)
                         !le32_to_cpu(de1->inode) ||
                         strcmp(".", de->name) ||
                         strcmp("..", de1->name)) {
-                ext4_warning(inode->i_sb, "empty_dir",
+                ext4_warning(inode->i_sb,
                              "bad directory (dir #%lu) - no `.' or `..'",
                              inode->i_ino);
                 brelse(bh);
@@ -1949,7 +1948,7 @@ static int empty_dir(struct inode *inode)
                                 offset >> EXT4_BLOCK_SIZE_BITS(sb), 0, &err);
                         if (!bh) {
                                 if (err)
-                                        ext4_error(sb, __func__,
+                                        ext4_error(sb,
                                                    "error %d reading directory"
                                                    " #%lu offset %u",
                                                    err, inode->i_ino, offset);
@@ -2020,11 +2019,18 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
         err = ext4_reserve_inode_write(handle, inode, &iloc);
         if (err)
                 goto out_unlock;
+        /*
+         * Due to previous errors inode may be already a part of on-disk
+         * orphan list. If so skip on-disk list modification.
+         */
+        if (NEXT_ORPHAN(inode) && NEXT_ORPHAN(inode) <=
+                (le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)))
+                        goto mem_insert;
 
         /* Insert this inode at the head of the on-disk orphan list... */
         NEXT_ORPHAN(inode) = le32_to_cpu(EXT4_SB(sb)->s_es->s_last_orphan);
         EXT4_SB(sb)->s_es->s_last_orphan = cpu_to_le32(inode->i_ino);
-        err = ext4_handle_dirty_metadata(handle, inode, EXT4_SB(sb)->s_sbh);
+        err = ext4_handle_dirty_metadata(handle, NULL, EXT4_SB(sb)->s_sbh);
         rc = ext4_mark_iloc_dirty(handle, inode, &iloc);
         if (!err)
                 err = rc;
@@ -2037,6 +2043,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
          *
          * This is safe: on error we're going to ignore the orphan list
          * anyway on the next recovery. */
+mem_insert:
         if (!err)
                 list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);
 
@@ -2096,7 +2103,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
                 if (err)
                         goto out_brelse;
                 sbi->s_es->s_last_orphan = cpu_to_le32(ino_next);
-                err = ext4_handle_dirty_metadata(handle, inode, sbi->s_sbh);
+                err = ext4_handle_dirty_metadata(handle, NULL, sbi->s_sbh);
         } else {
                 struct ext4_iloc iloc2;
                 struct inode *i_prev =
@@ -2136,7 +2143,9 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
 
         /* Initialize quotas before so that eventual writes go in
          * separate transaction */
-        vfs_dq_init(dentry->d_inode);
+        dquot_initialize(dir);
+        dquot_initialize(dentry->d_inode);
+
         handle = ext4_journal_start(dir, EXT4_DELETE_TRANS_BLOCKS(dir->i_sb));
         if (IS_ERR(handle))
                 return PTR_ERR(handle);
@@ -2163,7 +2172,7 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
         if (retval)
                 goto end_rmdir;
         if (!EXT4_DIR_LINK_EMPTY(inode))
-                ext4_warning(inode->i_sb, "ext4_rmdir",
+                ext4_warning(inode->i_sb,
                              "empty directory has too many links (%d)",
                              inode->i_nlink);
         inode->i_version++;
@@ -2195,7 +2204,9 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
 
         /* Initialize quotas before so that eventual writes go
          * in separate transaction */
-        vfs_dq_init(dentry->d_inode);
+        dquot_initialize(dir);
+        dquot_initialize(dentry->d_inode);
+
         handle = ext4_journal_start(dir, EXT4_DELETE_TRANS_BLOCKS(dir->i_sb));
         if (IS_ERR(handle))
                 return PTR_ERR(handle);
@@ -2215,7 +2226,7 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
                 goto end_unlink;
 
         if (!inode->i_nlink) {
-                ext4_warning(inode->i_sb, "ext4_unlink",
+                ext4_warning(inode->i_sb,
                              "Deleting nonexistent file (%lu), %d",
                              inode->i_ino, inode->i_nlink);
                 inode->i_nlink = 1;
@@ -2250,6 +2261,8 @@ static int ext4_symlink(struct inode *dir,
         if (l > dir->i_sb->s_blocksize)
                 return -ENAMETOOLONG;
 
+        dquot_initialize(dir);
+
 retry:
         handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
                                         EXT4_INDEX_EXTRA_TRANS_BLOCKS + 5 +
@@ -2308,6 +2321,8 @@ static int ext4_link(struct dentry *old_dentry,
         if (inode->i_nlink >= EXT4_LINK_MAX)
                 return -EMLINK;
 
+        dquot_initialize(dir);
+
         /*
          * Return -ENOENT if we've raced with unlink and i_nlink is 0.  Doing
          * otherwise has the potential to corrupt the orphan inode list.
@@ -2358,12 +2373,15 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct ext4_dir_entry_2 *old_de, *new_de;
         int retval, force_da_alloc = 0;
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         old_bh = new_bh = dir_bh = NULL;
 
         /* Initialize quotas before so that eventual writes go
          * in separate transaction */
         if (new_dentry->d_inode)
-                vfs_dq_init(new_dentry->d_inode);
+                dquot_initialize(new_dentry->d_inode);
         handle = ext4_journal_start(old_dir, 2 *
                                         EXT4_DATA_TRANS_BLOCKS(old_dir->i_sb) +
                                         EXT4_INDEX_EXTRA_TRANS_BLOCKS + 2);
@@ -2462,7 +2480,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 }
         }
         if (retval) {
-                ext4_warning(old_dir->i_sb, "ext4_rename",
+                ext4_warning(old_dir->i_sb,
                                 "Deleting old file (%lu), %d, error=%d",
                                 old_dir->i_ino, old_dir->i_nlink, retval);
         }
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 3b2c5541d8a6..5692c48754a0 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -48,65 +48,54 @@ static int verify_group_input(struct super_block *sb,
 
         ext4_get_group_no_and_offset(sb, start, NULL, &offset);
         if (group != sbi->s_groups_count)
-                ext4_warning(sb, __func__,
-                             "Cannot add at group %u (only %u groups)",
+                ext4_warning(sb, "Cannot add at group %u (only %u groups)",
                              input->group, sbi->s_groups_count);
         else if (offset != 0)
-                        ext4_warning(sb, __func__, "Last group not full");
+                        ext4_warning(sb, "Last group not full");
         else if (input->reserved_blocks > input->blocks_count / 5)
-                ext4_warning(sb, __func__, "Reserved blocks too high (%u)",
+                ext4_warning(sb, "Reserved blocks too high (%u)",
                              input->reserved_blocks);
         else if (free_blocks_count < 0)
-                ext4_warning(sb, __func__, "Bad blocks count %u",
+                ext4_warning(sb, "Bad blocks count %u",
                              input->blocks_count);
         else if (!(bh = sb_bread(sb, end - 1)))
-                ext4_warning(sb, __func__,
-                             "Cannot read last block (%llu)",
+                ext4_warning(sb, "Cannot read last block (%llu)",
                              end - 1);
         else if (outside(input->block_bitmap, start, end))
-                ext4_warning(sb, __func__,
-                             "Block bitmap not in group (block %llu)",
+                ext4_warning(sb, "Block bitmap not in group (block %llu)",
                              (unsigned long long)input->block_bitmap);
         else if (outside(input->inode_bitmap, start, end))
-                ext4_warning(sb, __func__,
-                             "Inode bitmap not in group (block %llu)",
+                ext4_warning(sb, "Inode bitmap not in group (block %llu)",
                              (unsigned long long)input->inode_bitmap);
         else if (outside(input->inode_table, start, end) ||
                  outside(itend - 1, start, end))
-                ext4_warning(sb, __func__,
-                             "Inode table not in group (blocks %llu-%llu)",
+                ext4_warning(sb, "Inode table not in group (blocks %llu-%llu)",
                              (unsigned long long)input->inode_table, itend - 1);
         else if (input->inode_bitmap == input->block_bitmap)
-                ext4_warning(sb, __func__,
-                             "Block bitmap same as inode bitmap (%llu)",
+                ext4_warning(sb, "Block bitmap same as inode bitmap (%llu)",
                              (unsigned long long)input->block_bitmap);
         else if (inside(input->block_bitmap, input->inode_table, itend))
-                ext4_warning(sb, __func__,
-                             "Block bitmap (%llu) in inode table (%llu-%llu)",
+                ext4_warning(sb, "Block bitmap (%llu) in inode table "
+                             "(%llu-%llu)",
                              (unsigned long long)input->block_bitmap,
                              (unsigned long long)input->inode_table, itend - 1);
         else if (inside(input->inode_bitmap, input->inode_table, itend))
-                ext4_warning(sb, __func__,
-                             "Inode bitmap (%llu) in inode table (%llu-%llu)",
+                ext4_warning(sb, "Inode bitmap (%llu) in inode table "
+                             "(%llu-%llu)",
                              (unsigned long long)input->inode_bitmap,
                              (unsigned long long)input->inode_table, itend - 1);
         else if (inside(input->block_bitmap, start, metaend))
-                ext4_warning(sb, __func__,
-                             "Block bitmap (%llu) in GDT table"
-                             " (%llu-%llu)",
+                ext4_warning(sb, "Block bitmap (%llu) in GDT table (%llu-%llu)",
                              (unsigned long long)input->block_bitmap,
                              start, metaend - 1);
         else if (inside(input->inode_bitmap, start, metaend))
-                ext4_warning(sb, __func__,
-                             "Inode bitmap (%llu) in GDT table"
-                             " (%llu-%llu)",
+                ext4_warning(sb, "Inode bitmap (%llu) in GDT table (%llu-%llu)",
                              (unsigned long long)input->inode_bitmap,
                              start, metaend - 1);
         else if (inside(input->inode_table, start, metaend) ||
                  inside(itend - 1, start, metaend))
-                ext4_warning(sb, __func__,
-                             "Inode table (%llu-%llu) overlaps"
-                             "GDT table (%llu-%llu)",
+                ext4_warning(sb, "Inode table (%llu-%llu) overlaps GDT table "
+                             "(%llu-%llu)",
                              (unsigned long long)input->inode_table,
                              itend - 1, start, metaend - 1);
         else
@@ -364,8 +353,7 @@ static int verify_reserved_gdb(struct super_block *sb,
         while ((grp = ext4_list_backups(sb, &three, &five, &seven)) < end) {
                 if (le32_to_cpu(*p++) !=
                     grp * EXT4_BLOCKS_PER_GROUP(sb) + blk){
-                        ext4_warning(sb, __func__,
-                                     "reserved GDT %llu"
+                        ext4_warning(sb, "reserved GDT %llu"
                                      " missing grp %d (%llu)",
                                      blk, grp,
                                      grp *
@@ -420,8 +408,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
          */
         if (EXT4_SB(sb)->s_sbh->b_blocknr !=
             le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
-                ext4_warning(sb, __func__,
-                        "won't resize using backup superblock at %llu",
+                ext4_warning(sb, "won't resize using backup superblock at %llu",
                         (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
                 return -EPERM;
         }
@@ -444,8 +431,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
 
         data = (__le32 *)dind->b_data;
         if (le32_to_cpu(data[gdb_num % EXT4_ADDR_PER_BLOCK(sb)]) != gdblock) {
-                ext4_warning(sb, __func__,
-                             "new group %u GDT block %llu not reserved",
+                ext4_warning(sb, "new group %u GDT block %llu not reserved",
                              input->group, gdblock);
                 err = -EINVAL;
                 goto exit_dind;
@@ -468,7 +454,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                         GFP_NOFS);
         if (!n_group_desc) {
                 err = -ENOMEM;
-                ext4_warning(sb, __func__,
+                ext4_warning(sb,
                               "not enough memory for %lu groups", gdb_num + 1);
                 goto exit_inode;
         }
@@ -567,8 +553,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         /* Get each reserved primary GDT block and verify it holds backups */
         for (res = 0; res < reserved_gdb; res++, blk++) {
                 if (le32_to_cpu(*data) != blk) {
-                        ext4_warning(sb, __func__,
-                                     "reserved block %llu"
+                        ext4_warning(sb, "reserved block %llu"
                                      " not at offset %ld",
                                      blk,
                                      (long)(data - (__le32 *)dind->b_data));
@@ -713,8 +698,7 @@ static void update_backups(struct super_block *sb,
          */
 exit_err:
         if (err) {
-                ext4_warning(sb, __func__,
-                             "can't update backup for group %u (err %d), "
+                ext4_warning(sb, "can't update backup for group %u (err %d), "
                              "forcing fsck on next reboot", group, err);
                 sbi->s_mount_state &= ~EXT4_VALID_FS;
                 sbi->s_es->s_state &= cpu_to_le16(~EXT4_VALID_FS);
@@ -753,20 +737,19 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
 
         if (gdb_off == 0 && !EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                         EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER)) {
-                ext4_warning(sb, __func__,
-                             "Can't resize non-sparse filesystem further");
+                ext4_warning(sb, "Can't resize non-sparse filesystem further");
                 return -EPERM;
         }
 
         if (ext4_blocks_count(es) + input->blocks_count <
             ext4_blocks_count(es)) {
-                ext4_warning(sb, __func__, "blocks_count overflow");
+                ext4_warning(sb, "blocks_count overflow");
                 return -EINVAL;
         }
 
         if (le32_to_cpu(es->s_inodes_count) + EXT4_INODES_PER_GROUP(sb) <
             le32_to_cpu(es->s_inodes_count)) {
-                ext4_warning(sb, __func__, "inodes_count overflow");
+                ext4_warning(sb, "inodes_count overflow");
                 return -EINVAL;
         }
 
@@ -774,14 +757,13 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
                 if (!EXT4_HAS_COMPAT_FEATURE(sb,
                                              EXT4_FEATURE_COMPAT_RESIZE_INODE)
                     || !le16_to_cpu(es->s_reserved_gdt_blocks)) {
-                        ext4_warning(sb, __func__,
+                        ext4_warning(sb,
                                      "No reserved GDT blocks, can't resize");
                         return -EPERM;
                 }
                 inode = ext4_iget(sb, EXT4_RESIZE_INO);
                 if (IS_ERR(inode)) {
-                        ext4_warning(sb, __func__,
-                                     "Error opening resize inode");
+                        ext4_warning(sb, "Error opening resize inode");
                         return PTR_ERR(inode);
                 }
         }
@@ -810,8 +792,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
 
         mutex_lock(&sbi->s_resize_lock);
         if (input->group != sbi->s_groups_count) {
-                ext4_warning(sb, __func__,
-                             "multiple resizers run on filesystem!");
+                ext4_warning(sb, "multiple resizers run on filesystem!");
                 err = -EBUSY;
                 goto exit_journal;
         }
@@ -997,13 +978,12 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
                         " too large to resize to %llu blocks safely\n",
                         sb->s_id, n_blocks_count);
                 if (sizeof(sector_t) < 8)
-                        ext4_warning(sb, __func__, "CONFIG_LBDAF not enabled");
+                        ext4_warning(sb, "CONFIG_LBDAF not enabled");
                 return -EINVAL;
         }
 
         if (n_blocks_count < o_blocks_count) {
-                ext4_warning(sb, __func__,
-                             "can't shrink FS - resize aborted");
+                ext4_warning(sb, "can't shrink FS - resize aborted");
                 return -EBUSY;
         }
 
@@ -1011,15 +991,14 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
         ext4_get_group_no_and_offset(sb, o_blocks_count, &group, &last);
 
         if (last == 0) {
-                ext4_warning(sb, __func__,
-                             "need to use ext2online to resize further");
+                ext4_warning(sb, "need to use ext2online to resize further");
                 return -EPERM;
         }
 
         add = EXT4_BLOCKS_PER_GROUP(sb) - last;
 
         if (o_blocks_count + add < o_blocks_count) {
-                ext4_warning(sb, __func__, "blocks_count overflow");
+                ext4_warning(sb, "blocks_count overflow");
                 return -EINVAL;
         }
 
@@ -1027,16 +1006,13 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
                 add = n_blocks_count - o_blocks_count;
 
         if (o_blocks_count + add < n_blocks_count)
-                ext4_warning(sb, __func__,
-                             "will only finish group (%llu"
-                             " blocks, %u new)",
+                ext4_warning(sb, "will only finish group (%llu blocks, %u new)",
                              o_blocks_count + add, add);
 
         /* See if the device is actually as big as what was requested */
         bh = sb_bread(sb, o_blocks_count + add - 1);
         if (!bh) {
-                ext4_warning(sb, __func__,
-                             "can't read last block, resize aborted");
+                ext4_warning(sb, "can't read last block, resize aborted");
                 return -ENOSPC;
         }
         brelse(bh);
@@ -1047,14 +1023,13 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
         handle = ext4_journal_start_sb(sb, 3);
         if (IS_ERR(handle)) {
                 err = PTR_ERR(handle);
-                ext4_warning(sb, __func__, "error %d on journal start", err);
+                ext4_warning(sb, "error %d on journal start", err);
                 goto exit_put;
         }
 
         mutex_lock(&EXT4_SB(sb)->s_resize_lock);
         if (o_blocks_count != ext4_blocks_count(es)) {
-                ext4_warning(sb, __func__,
-                             "multiple resizers run on filesystem!");
+                ext4_warning(sb, "multiple resizers run on filesystem!");
                 mutex_unlock(&EXT4_SB(sb)->s_resize_lock);
                 ext4_journal_stop(handle);
                 err = -EBUSY;
@@ -1063,8 +1038,7 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
 
         if ((err = ext4_journal_get_write_access(handle,
                                                  EXT4_SB(sb)->s_sbh))) {
-                ext4_warning(sb, __func__,
-                             "error %d on journal write access", err);
+                ext4_warning(sb, "error %d on journal write access", err);
                 mutex_unlock(&EXT4_SB(sb)->s_resize_lock);
                 ext4_journal_stop(handle);
                 goto exit_put;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 6ed9aa91f27d..e14d22c170d5 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -68,7 +68,21 @@ static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf);
 static int ext4_unfreeze(struct super_block *sb);
 static void ext4_write_super(struct super_block *sb);
 static int ext4_freeze(struct super_block *sb);
+static int ext4_get_sb(struct file_system_type *fs_type, int flags,
+                       const char *dev_name, void *data, struct vfsmount *mnt);
 
+#if !defined(CONFIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
+static struct file_system_type ext3_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "ext3",
+        .get_sb         = ext4_get_sb,
+        .kill_sb        = kill_block_super,
+        .fs_flags       = FS_REQUIRES_DEV,
+};
+#define IS_EXT3_SB(sb) ((sb)->s_bdev->bd_holder == &ext3_fs_type)
+#else
+#define IS_EXT3_SB(sb) (0)
+#endif
 
 ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
                                struct ext4_group_desc *bg)
@@ -302,7 +316,7 @@ void ext4_journal_abort_handle(const char *caller, const char *err_fn,
  * write out the superblock safely.
  *
  * We'll just use the jbd2_journal_abort() error code to record an error in
- * the journal instead.  On recovery, the journal will compain about
+ * the journal instead.  On recovery, the journal will complain about
  * that error until we've noted it down and cleared it.
  */
 
@@ -333,7 +347,7 @@ static void ext4_handle_error(struct super_block *sb)
                         sb->s_id);
 }
 
-void ext4_error(struct super_block *sb, const char *function,
+void __ext4_error(struct super_block *sb, const char *function,
                 const char *fmt, ...)
 {
         va_list args;
@@ -347,6 +361,42 @@ void ext4_error(struct super_block *sb, const char *function,
         ext4_handle_error(sb);
 }
 
+void ext4_error_inode(const char *function, struct inode *inode,
+                      const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        printk(KERN_CRIT "EXT4-fs error (device %s): %s: inode #%lu: (comm %s) ",
+               inode->i_sb->s_id, function, inode->i_ino, current->comm);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+
+        ext4_handle_error(inode->i_sb);
+}
+
+void ext4_error_file(const char *function, struct file *file,
+                     const char *fmt, ...)
+{
+        va_list args;
+        struct inode *inode = file->f_dentry->d_inode;
+        char pathname[80], *path;
+
+        va_start(args, fmt);
+        path = d_path(&(file->f_path), pathname, sizeof(pathname));
+        if (!path)
+                path = "(unknown)";
+        printk(KERN_CRIT
+               "EXT4-fs error (device %s): %s: inode #%lu (comm %s path %s): ",
+               inode->i_sb->s_id, function, inode->i_ino, current->comm, path);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+
+        ext4_handle_error(inode->i_sb);
+}
+
 static const char *ext4_decode_error(struct super_block *sb, int errno,
                                      char nbuf[16])
 {
@@ -450,7 +500,7 @@ void ext4_msg (struct super_block * sb, const char *prefix,
         va_end(args);
 }
 
-void ext4_warning(struct super_block *sb, const char *function,
+void __ext4_warning(struct super_block *sb, const char *function,
                   const char *fmt, ...)
 {
         va_list args;
@@ -507,7 +557,7 @@ void ext4_update_dynamic_rev(struct super_block *sb)
         if (le32_to_cpu(es->s_rev_level) > EXT4_GOOD_OLD_REV)
                 return;
 
-        ext4_warning(sb, __func__,
+        ext4_warning(sb,
                      "updating to rev %d because of new feature flag, "
                      "running e2fsck is recommended",
                      EXT4_DYNAMIC_REV);
@@ -702,12 +752,14 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
         ei->i_reserved_data_blocks = 0;
         ei->i_reserved_meta_blocks = 0;
         ei->i_allocated_meta_blocks = 0;
+        ei->i_da_metadata_calc_len = 0;
         ei->i_delalloc_reserved_flag = 0;
         spin_lock_init(&(ei->i_block_reservation_lock));
 #ifdef CONFIG_QUOTA
         ei->i_reserved_quota = 0;
 #endif
-        INIT_LIST_HEAD(&ei->i_aio_dio_complete_list);
+        INIT_LIST_HEAD(&ei->i_completed_io_list);
+        spin_lock_init(&ei->i_completed_io_lock);
         ei->cur_aio_dio = NULL;
         ei->i_sync_tid = 0;
         ei->i_datasync_tid = 0;
@@ -760,6 +812,7 @@ static void destroy_inodecache(void)
 
 static void ext4_clear_inode(struct inode *inode)
 {
+        dquot_drop(inode);
         ext4_discard_preallocations(inode);
         if (EXT4_JOURNAL(inode))
                 jbd2_journal_release_jbd_inode(EXT4_SB(inode->i_sb)->s_journal,
@@ -795,10 +848,10 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
         if (sbi->s_qf_names[GRPQUOTA])
                 seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
 
-        if (sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA)
+        if (test_opt(sb, USRQUOTA))
                 seq_puts(seq, ",usrquota");
 
-        if (sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA)
+        if (test_opt(sb, GRPQUOTA))
                 seq_puts(seq, ",grpquota");
 #endif
 }
@@ -925,6 +978,9 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
         if (test_opt(sb, NOLOAD))
                 seq_puts(seq, ",norecovery");
 
+        if (test_opt(sb, DIOREAD_NOLOCK))
+                seq_puts(seq, ",dioread_nolock");
+
         ext4_show_quota_options(seq, sb);
 
         return 0;
@@ -1011,19 +1067,9 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
                                 const char *data, size_t len, loff_t off);
 
 static const struct dquot_operations ext4_quota_operations = {
-        .initialize     = dquot_initialize,
-        .drop           = dquot_drop,
-        .alloc_space    = dquot_alloc_space,
-        .reserve_space  = dquot_reserve_space,
-        .claim_space    = dquot_claim_space,
-        .release_rsv    = dquot_release_reserved_space,
 #ifdef CONFIG_QUOTA
         .get_reserved_space = ext4_get_reserved_space,
 #endif
-        .alloc_inode    = dquot_alloc_inode,
-        .free_space     = dquot_free_space,
-        .free_inode     = dquot_free_inode,
-        .transfer       = dquot_transfer,
         .write_dquot    = ext4_write_dquot,
         .acquire_dquot  = ext4_acquire_dquot,
         .release_dquot  = ext4_release_dquot,
@@ -1108,6 +1154,7 @@ enum {
         Opt_stripe, Opt_delalloc, Opt_nodelalloc,
         Opt_block_validity, Opt_noblock_validity,
         Opt_inode_readahead_blks, Opt_journal_ioprio,
+        Opt_dioread_nolock, Opt_dioread_lock,
         Opt_discard, Opt_nodiscard,
 };
 
@@ -1175,6 +1222,8 @@ static const match_table_t tokens = {
         {Opt_auto_da_alloc, "auto_da_alloc=%u"},
         {Opt_auto_da_alloc, "auto_da_alloc"},
         {Opt_noauto_da_alloc, "noauto_da_alloc"},
+        {Opt_dioread_nolock, "dioread_nolock"},
+        {Opt_dioread_lock, "dioread_lock"},
         {Opt_discard, "discard"},
         {Opt_nodiscard, "nodiscard"},
         {Opt_err, NULL},
@@ -1204,6 +1253,66 @@ static ext4_fsblk_t get_sb_block(void **data)
 }
 
 #define DEFAULT_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3))
+static char deprecated_msg[] = "Mount option \"%s\" will be removed by %s\n"
+        "Contact linux-ext4@vger.kernel.org if you think we should keep it.\n";
+
+#ifdef CONFIG_QUOTA
+static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        char *qname;
+
+        if (sb_any_quota_loaded(sb) &&
+                !sbi->s_qf_names[qtype]) {
+                ext4_msg(sb, KERN_ERR,
+                        "Cannot change journaled "
+                        "quota options when quota turned on");
+                return 0;
+        }
+        qname = match_strdup(args);
+        if (!qname) {
+                ext4_msg(sb, KERN_ERR,
+                        "Not enough memory for storing quotafile name");
+                return 0;
+        }
+        if (sbi->s_qf_names[qtype] &&
+                strcmp(sbi->s_qf_names[qtype], qname)) {
+                ext4_msg(sb, KERN_ERR,
+                        "%s quota file already specified", QTYPE2NAME(qtype));
+                kfree(qname);
+                return 0;
+        }
+        sbi->s_qf_names[qtype] = qname;
+        if (strchr(sbi->s_qf_names[qtype], '/')) {
+                ext4_msg(sb, KERN_ERR,
+                        "quotafile must be on filesystem root");
+                kfree(sbi->s_qf_names[qtype]);
+                sbi->s_qf_names[qtype] = NULL;
+                return 0;
+        }
+        set_opt(sbi->s_mount_opt, QUOTA);
+        return 1;
+}
+
+static int clear_qf_name(struct super_block *sb, int qtype)
+{
+
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+
+        if (sb_any_quota_loaded(sb) &&
+                sbi->s_qf_names[qtype]) {
+                ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
+                        " when quota turned on");
+                return 0;
+        }
+        /*
+         * The space will be released later when all options are confirmed
+         * to be correct
+         */
+        sbi->s_qf_names[qtype] = NULL;
+        return 1;
+}
+#endif
 
 static int parse_options(char *options, struct super_block *sb,
                          unsigned long *journal_devnum,
@@ -1216,8 +1325,7 @@ static int parse_options(char *options, struct super_block *sb,
         int data_opt = 0;
         int option;
 #ifdef CONFIG_QUOTA
-        int qtype, qfmt;
-        char *qname;
+        int qfmt;
 #endif
 
         if (!options)
@@ -1228,19 +1336,31 @@ static int parse_options(char *options, struct super_block *sb,
                 if (!*p)
                         continue;
 
+                /*
+                 * Initialize args struct so we know whether arg was
+                 * found; some options take optional arguments.
+                 */
+                args[0].to = args[0].from = 0;
                 token = match_token(p, tokens, args);
                 switch (token) {
                 case Opt_bsd_df:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         clear_opt(sbi->s_mount_opt, MINIX_DF);
                         break;
                 case Opt_minix_df:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         set_opt(sbi->s_mount_opt, MINIX_DF);
+
                         break;
                 case Opt_grpid:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         set_opt(sbi->s_mount_opt, GRPID);
+
                         break;
                 case Opt_nogrpid:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         clear_opt(sbi->s_mount_opt, GRPID);
+
                         break;
                 case Opt_resuid:
                         if (match_int(&args[0], &option))
@@ -1377,14 +1497,13 @@ static int parse_options(char *options, struct super_block *sb,
                         data_opt = EXT4_MOUNT_WRITEBACK_DATA;
                 datacheck:
                         if (is_remount) {
-                                if ((sbi->s_mount_opt & EXT4_MOUNT_DATA_FLAGS)
-                                                != data_opt) {
+                                if (test_opt(sb, DATA_FLAGS) != data_opt) {
                                         ext4_msg(sb, KERN_ERR,
                                                 "Cannot change data mode on remount");
                                         return 0;
                                 }
                         } else {
-                                sbi->s_mount_opt &= ~EXT4_MOUNT_DATA_FLAGS;
+                                clear_opt(sbi->s_mount_opt, DATA_FLAGS);
                                 sbi->s_mount_opt |= data_opt;
                         }
                         break;
@@ -1396,63 +1515,22 @@ static int parse_options(char *options, struct super_block *sb,
                         break;
 #ifdef CONFIG_QUOTA
                 case Opt_usrjquota:
-                        qtype = USRQUOTA;
-                        goto set_qf_name;
-                case Opt_grpjquota:
-                        qtype = GRPQUOTA;
-set_qf_name:
-                        if (sb_any_quota_loaded(sb) &&
-                            !sbi->s_qf_names[qtype]) {
-                                ext4_msg(sb, KERN_ERR,
-                                       "Cannot change journaled "
-                                       "quota options when quota turned on");
+                        if (!set_qf_name(sb, USRQUOTA, &args[0]))
                                 return 0;
-                        }
-                        qname = match_strdup(&args[0]);
-                        if (!qname) {
-                                ext4_msg(sb, KERN_ERR,
-                                        "Not enough memory for "
-                                        "storing quotafile name");
-                                return 0;
-                        }
-                        if (sbi->s_qf_names[qtype] &&
-                            strcmp(sbi->s_qf_names[qtype], qname)) {
-                                ext4_msg(sb, KERN_ERR,
-                                        "%s quota file already "
-                                        "specified", QTYPE2NAME(qtype));
-                                kfree(qname);
-                                return 0;
-                        }
-                        sbi->s_qf_names[qtype] = qname;
-                        if (strchr(sbi->s_qf_names[qtype], '/')) {
-                                ext4_msg(sb, KERN_ERR,
-                                        "quotafile must be on "
-                                        "filesystem root");
-                                kfree(sbi->s_qf_names[qtype]);
-                                sbi->s_qf_names[qtype] = NULL;
+                        break;
+                case Opt_grpjquota:
+                        if (!set_qf_name(sb, GRPQUOTA, &args[0]))
                                 return 0;
-                        }
-                        set_opt(sbi->s_mount_opt, QUOTA);
                         break;
                 case Opt_offusrjquota:
-                        qtype = USRQUOTA;
-                        goto clear_qf_name;
+                        if (!clear_qf_name(sb, USRQUOTA))
+                                return 0;
+                        break;
                 case Opt_offgrpjquota:
-                        qtype = GRPQUOTA;
-clear_qf_name:
-                        if (sb_any_quota_loaded(sb) &&
-                            sbi->s_qf_names[qtype]) {
-                                ext4_msg(sb, KERN_ERR, "Cannot change "
-                                        "journaled quota options when "
-                                        "quota turned on");
+                        if (!clear_qf_name(sb, GRPQUOTA))
                                 return 0;
-                        }
-                        /*
-                         * The space will be released later when all options
-                         * are confirmed to be correct
-                         */
-                        sbi->s_qf_names[qtype] = NULL;
                         break;
+
                 case Opt_jqfmt_vfsold:
                         qfmt = QFMT_VFS_OLD;
                         goto set_qf_format;
@@ -1517,10 +1595,11 @@ set_qf_format:
                         clear_opt(sbi->s_mount_opt, BARRIER);
                         break;
                 case Opt_barrier:
-                        if (match_int(&args[0], &option)) {
-                                set_opt(sbi->s_mount_opt, BARRIER);
-                                break;
-                        }
+                        if (args[0].from) {
+                                if (match_int(&args[0], &option))
+                                        return 0;
+                        } else
+                                option = 1;     /* No argument, default to 1 */
                         if (option)
                                 set_opt(sbi->s_mount_opt, BARRIER);
                         else
@@ -1593,10 +1672,11 @@ set_qf_format:
                         set_opt(sbi->s_mount_opt,NO_AUTO_DA_ALLOC);
                         break;
                 case Opt_auto_da_alloc:
-                        if (match_int(&args[0], &option)) {
-                                clear_opt(sbi->s_mount_opt, NO_AUTO_DA_ALLOC);
-                                break;
-                        }
+                        if (args[0].from) {
+                                if (match_int(&args[0], &option))
+                                        return 0;
+                        } else
+                                option = 1;     /* No argument, default to 1 */
                         if (option)
                                 clear_opt(sbi->s_mount_opt, NO_AUTO_DA_ALLOC);
                         else
@@ -1608,6 +1688,12 @@ set_qf_format:
                 case Opt_nodiscard:
                         clear_opt(sbi->s_mount_opt, DISCARD);
                         break;
+                case Opt_dioread_nolock:
+                        set_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                        break;
+                case Opt_dioread_lock:
+                        clear_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                        break;
                 default:
                         ext4_msg(sb, KERN_ERR,
                                "Unrecognized mount option \"%s\" "
@@ -1617,18 +1703,13 @@ set_qf_format:
         }
 #ifdef CONFIG_QUOTA
         if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
-                if ((sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA) &&
-                     sbi->s_qf_names[USRQUOTA])
+                if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
                         clear_opt(sbi->s_mount_opt, USRQUOTA);
 
-                if ((sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA) &&
-                     sbi->s_qf_names[GRPQUOTA])
+                if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
                         clear_opt(sbi->s_mount_opt, GRPQUOTA);
 
-                if ((sbi->s_qf_names[USRQUOTA] &&
-                                (sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA)) ||
-                    (sbi->s_qf_names[GRPQUOTA] &&
-                                (sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA))) {
+                if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
                         ext4_msg(sb, KERN_ERR, "old and new quota "
                                         "format mixing");
                         return 0;
@@ -1938,7 +2019,7 @@ static void ext4_orphan_cleanup(struct super_block *sb,
                 }
 
                 list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);
-                vfs_dq_init(inode);
+                dquot_initialize(inode);
                 if (inode->i_nlink) {
                         ext4_msg(sb, KERN_DEBUG,
                                 "%s: truncating inode %lu to %lld bytes",
@@ -2174,9 +2255,9 @@ static ssize_t lifetime_write_kbytes_show(struct ext4_attr *a,
         struct super_block *sb = sbi->s_buddy_cache->i_sb;
 
         return snprintf(buf, PAGE_SIZE, "%llu\n",
-                        sbi->s_kbytes_written + 
+                        (unsigned long long)(sbi->s_kbytes_written +
                         ((part_stat_read(sb->s_bdev->bd_part, sectors[1]) -
-                          EXT4_SB(sb)->s_sectors_written_start) >> 1));
+                          EXT4_SB(sb)->s_sectors_written_start) >> 1)));
 }
 
 static ssize_t inode_readahead_blks_store(struct ext4_attr *a,
@@ -2291,7 +2372,7 @@ static void ext4_sb_release(struct kobject *kobj)
 }
 
 
-static struct sysfs_ops ext4_attr_ops = {
+static const struct sysfs_ops ext4_attr_ops = {
         .show   = ext4_attr_show,
         .store  = ext4_attr_store,
 };
@@ -2431,8 +2512,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
         if (def_mount_opts & EXT4_DEFM_DEBUG)
                 set_opt(sbi->s_mount_opt, DEBUG);
-        if (def_mount_opts & EXT4_DEFM_BSDGROUPS)
+        if (def_mount_opts & EXT4_DEFM_BSDGROUPS) {
+                ext4_msg(sb, KERN_WARNING, deprecated_msg, "bsdgroups",
+                        "2.6.38");
                 set_opt(sbi->s_mount_opt, GRPID);
+        }
         if (def_mount_opts & EXT4_DEFM_UID16)
                 set_opt(sbi->s_mount_opt, NO_UID32);
 #ifdef CONFIG_EXT4_FS_XATTR
@@ -2444,11 +2528,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 set_opt(sbi->s_mount_opt, POSIX_ACL);
 #endif
         if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
-                sbi->s_mount_opt |= EXT4_MOUNT_JOURNAL_DATA;
+                set_opt(sbi->s_mount_opt, JOURNAL_DATA);
         else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)
-                sbi->s_mount_opt |= EXT4_MOUNT_ORDERED_DATA;
+                set_opt(sbi->s_mount_opt, ORDERED_DATA);
         else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_WBACK)
-                sbi->s_mount_opt |= EXT4_MOUNT_WRITEBACK_DATA;
+                set_opt(sbi->s_mount_opt, WRITEBACK_DATA);
 
         if (le16_to_cpu(sbi->s_es->s_errors) == EXT4_ERRORS_PANIC)
                 set_opt(sbi->s_mount_opt, ERRORS_PANIC);
@@ -2469,14 +2553,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
          * enable delayed allocation by default
          * Use -o nodelalloc to turn it off
          */
-        set_opt(sbi->s_mount_opt, DELALLOC);
+        if (!IS_EXT3_SB(sb))
+                set_opt(sbi->s_mount_opt, DELALLOC);
 
         if (!parse_options((char *) data, sb, &journal_devnum,
                            &journal_ioprio, NULL, 0))
                 goto failed_mount;
 
         sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
-                ((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+                (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
 
         if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV &&
             (EXT4_HAS_COMPAT_FEATURE(sb, ~0U) ||
@@ -2765,7 +2850,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
               EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER)) {
                 ext4_msg(sb, KERN_ERR, "required journal recovery "
                        "suppressed and not mounted read-only");
-                goto failed_mount4;
+                goto failed_mount_wq;
         } else {
                 clear_opt(sbi->s_mount_opt, DATA_FLAGS);
                 set_opt(sbi->s_mount_opt, WRITEBACK_DATA);
@@ -2778,7 +2863,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
             !jbd2_journal_set_features(EXT4_SB(sb)->s_journal, 0, 0,
                                        JBD2_FEATURE_INCOMPAT_64BIT)) {
                 ext4_msg(sb, KERN_ERR, "Failed to set 64-bit journal feature");
-                goto failed_mount4;
+                goto failed_mount_wq;
         }
 
         if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
@@ -2817,7 +2902,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                     (sbi->s_journal, 0, 0, JBD2_FEATURE_INCOMPAT_REVOKE)) {
                         ext4_msg(sb, KERN_ERR, "Journal does not support "
                                "requested data journaling mode");
-                        goto failed_mount4;
+                        goto failed_mount_wq;
                 }
         default:
                 break;
@@ -2825,13 +2910,17 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
 
 no_journal:
-
         if (test_opt(sb, NOBH)) {
                 if (!(test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)) {
                         ext4_msg(sb, KERN_WARNING, "Ignoring nobh option - "
                                 "its supported only with writeback mode");
                         clear_opt(sbi->s_mount_opt, NOBH);
                 }
+                if (test_opt(sb, DIOREAD_NOLOCK)) {
+                        ext4_msg(sb, KERN_WARNING, "dioread_nolock option is "
+                                "not supported with nobh mode");
+                        goto failed_mount_wq;
+                }
         }
         EXT4_SB(sb)->dio_unwritten_wq = create_workqueue("ext4-dio-unwritten");
         if (!EXT4_SB(sb)->dio_unwritten_wq) {
@@ -2896,6 +2985,18 @@ no_journal:
                          "requested data journaling mode");
                 clear_opt(sbi->s_mount_opt, DELALLOC);
         }
+        if (test_opt(sb, DIOREAD_NOLOCK)) {
+                if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
+                        ext4_msg(sb, KERN_WARNING, "Ignoring dioread_nolock "
+                                "option - requested data journaling mode");
+                        clear_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                }
+                if (sb->s_blocksize < PAGE_SIZE) {
+                        ext4_msg(sb, KERN_WARNING, "Ignoring dioread_nolock "
+                                "option - block size is too small");
+                        clear_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                }
+        }
 
         err = ext4_setup_system_zone(sb);
         if (err) {
@@ -3359,10 +3460,9 @@ static void ext4_clear_journal_err(struct super_block *sb,
                 char nbuf[16];
 
                 errstr = ext4_decode_error(sb, j_errno, nbuf);
-                ext4_warning(sb, __func__, "Filesystem error recorded "
+                ext4_warning(sb, "Filesystem error recorded "
                              "from previous mount: %s", errstr);
-                ext4_warning(sb, __func__, "Marking fs in need of "
-                             "filesystem check.");
+                ext4_warning(sb, "Marking fs in need of filesystem check.");
 
                 EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
                 es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
@@ -3513,7 +3613,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                 ext4_abort(sb, __func__, "Abort forced by user");
 
         sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
-                ((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+                (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
 
         es = sbi->s_es;
 
@@ -3707,7 +3807,7 @@ static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf)
  * Process 1                         Process 2
  * ext4_create()                     quota_sync()
  *   jbd2_journal_start()                  write_dquot()
- *   vfs_dq_init()                         down(dqio_mutex)
+ *   dquot_initialize()                         down(dqio_mutex)
  *     down(dqio_mutex)                    jbd2_journal_start()
  *
  */
@@ -3916,9 +4016,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
         ext4_lblk_t blk = off >> EXT4_BLOCK_SIZE_BITS(sb);
         int err = 0;
         int offset = off & (sb->s_blocksize - 1);
-        int tocopy;
         int journal_quota = EXT4_SB(sb)->s_qf_names[type] != NULL;
-        size_t towrite = len;
         struct buffer_head *bh;
         handle_t *handle = journal_current_handle();
 
@@ -3928,52 +4026,53 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
                         (unsigned long long)off, (unsigned long long)len);
                 return -EIO;
         }
+        /*
+         * Since we account only one data block in transaction credits,
+         * then it is impossible to cross a block boundary.
+         */
+        if (sb->s_blocksize - offset < len) {
+                ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+                        " cancelled because not block aligned",
+                        (unsigned long long)off, (unsigned long long)len);
+                return -EIO;
+        }
+
         mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
-        while (towrite > 0) {
-                tocopy = sb->s_blocksize - offset < towrite ?
-                                sb->s_blocksize - offset : towrite;
-                bh = ext4_bread(handle, inode, blk, 1, &err);
-                if (!bh)
+        bh = ext4_bread(handle, inode, blk, 1, &err);
+        if (!bh)
+                goto out;
+        if (journal_quota) {
+                err = ext4_journal_get_write_access(handle, bh);
+                if (err) {
+                        brelse(bh);
                         goto out;
-                if (journal_quota) {
-                        err = ext4_journal_get_write_access(handle, bh);
-                        if (err) {
-                                brelse(bh);
-                                goto out;
-                        }
-                }
-                lock_buffer(bh);
-                memcpy(bh->b_data+offset, data, tocopy);
-                flush_dcache_page(bh->b_page);
-                unlock_buffer(bh);
-                if (journal_quota)
-                        err = ext4_handle_dirty_metadata(handle, NULL, bh);
-                else {
-                        /* Always do at least ordered writes for quotas */
-                        err = ext4_jbd2_file_inode(handle, inode);
-                        mark_buffer_dirty(bh);
                 }
-                brelse(bh);
-                if (err)
-                        goto out;
-                offset = 0;
-                towrite -= tocopy;
-                data += tocopy;
-                blk++;
         }
+        lock_buffer(bh);
+        memcpy(bh->b_data+offset, data, len);
+        flush_dcache_page(bh->b_page);
+        unlock_buffer(bh);
+        if (journal_quota)
+                err = ext4_handle_dirty_metadata(handle, NULL, bh);
+        else {
+                /* Always do at least ordered writes for quotas */
+                err = ext4_jbd2_file_inode(handle, inode);
+                mark_buffer_dirty(bh);
+        }
+        brelse(bh);
 out:
-        if (len == towrite) {
+        if (err) {
                 mutex_unlock(&inode->i_mutex);
                 return err;
         }
-        if (inode->i_size < off+len-towrite) {
-                i_size_write(inode, off+len-towrite);
+        if (inode->i_size < off + len) {
+                i_size_write(inode, off + len);
                 EXT4_I(inode)->i_disksize = inode->i_size;
         }
         inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         ext4_mark_inode_dirty(handle, inode);
         mutex_unlock(&inode->i_mutex);
-        return len - towrite;
+        return len;
 }
 
 #endif
@@ -3984,7 +4083,7 @@ static int ext4_get_sb(struct file_system_type *fs_type, int flags,
         return get_sb_bdev(fs_type, flags, dev_name, data, ext4_fill_super,mnt);
 }
 
-#if !defined(CONTIG_EXT2_FS) && !defined(CONFIG_EXT2_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
+#if !defined(CONFIG_EXT2_FS) && !defined(CONFIG_EXT2_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
 static struct file_system_type ext2_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "ext2",
@@ -4005,20 +4104,13 @@ static inline void unregister_as_ext2(void)
 {
         unregister_filesystem(&ext2_fs_type);
 }
+MODULE_ALIAS("ext2");
 #else
 static inline void register_as_ext2(void) { }
 static inline void unregister_as_ext2(void) { }
 #endif
 
-#if !defined(CONTIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
-static struct file_system_type ext3_fs_type = {
-        .owner          = THIS_MODULE,
-        .name           = "ext3",
-        .get_sb         = ext4_get_sb,
-        .kill_sb        = kill_block_super,
-        .fs_flags       = FS_REQUIRES_DEV,
-};
-
+#if !defined(CONFIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
 static inline void register_as_ext3(void)
 {
         int err = register_filesystem(&ext3_fs_type);
@@ -4031,6 +4123,7 @@ static inline void unregister_as_ext3(void)
 {
         unregister_filesystem(&ext3_fs_type);
 }
+MODULE_ALIAS("ext3");
 #else
 static inline void register_as_ext3(void) { }
 static inline void unregister_as_ext3(void) { }
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 83218bebbc7c..b4c5aa8489d8 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -227,7 +227,8 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name,
         ea_bdebug(bh, "b_count=%d, refcount=%d",
                 atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
         if (ext4_xattr_check_block(bh)) {
-bad_block:      ext4_error(inode->i_sb, __func__,
+bad_block:
+                ext4_error(inode->i_sb,
                            "inode %lu: bad block %llu", inode->i_ino,
                            EXT4_I(inode)->i_file_acl);
                 error = -EIO;
@@ -267,7 +268,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
         void *end;
         int error;
 
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
+        if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
                 return -ENODATA;
         error = ext4_get_inode_loc(inode, &iloc);
         if (error)
@@ -371,7 +372,7 @@ ext4_xattr_block_list(struct dentry *dentry, char *buffer, size_t buffer_size)
         ea_bdebug(bh, "b_count=%d, refcount=%d",
                 atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
         if (ext4_xattr_check_block(bh)) {
-                ext4_error(inode->i_sb, __func__,
+                ext4_error(inode->i_sb,
                            "inode %lu: bad block %llu", inode->i_ino,
                            EXT4_I(inode)->i_file_acl);
                 error = -EIO;
@@ -396,7 +397,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)
         void *end;
         int error;
 
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
+        if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
                 return 0;
         error = ext4_get_inode_loc(inode, &iloc);
         if (error)
@@ -494,7 +495,7 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
                 error = ext4_handle_dirty_metadata(handle, inode, bh);
                 if (IS_SYNC(inode))
                         ext4_handle_sync(handle);
-                vfs_dq_free_block(inode, 1);
+                dquot_free_block(inode, 1);
                 ea_bdebug(bh, "refcount now=%d; releasing",
                           le32_to_cpu(BHDR(bh)->h_refcount));
                 if (ce)
@@ -665,9 +666,8 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i,
                         atomic_read(&(bs->bh->b_count)),
                         le32_to_cpu(BHDR(bs->bh)->h_refcount));
                 if (ext4_xattr_check_block(bs->bh)) {
-                        ext4_error(sb, __func__,
-                                "inode %lu: bad block %llu", inode->i_ino,
-                                EXT4_I(inode)->i_file_acl);
+                        ext4_error(sb, "inode %lu: bad block %llu",
+                                   inode->i_ino, EXT4_I(inode)->i_file_acl);
                         error = -EIO;
                         goto cleanup;
                 }
@@ -787,8 +787,8 @@ inserted:
                         else {
                                 /* The old block is released after updating
                                    the inode. */
-                                error = -EDQUOT;
-                                if (vfs_dq_alloc_block(inode, 1))
+                                error = dquot_alloc_block(inode, 1);
+                                if (error)
                                         goto cleanup;
                                 error = ext4_journal_get_write_access(handle,
                                                                       new_bh);
@@ -876,13 +876,12 @@ cleanup:
         return error;
 
 cleanup_dquot:
-        vfs_dq_free_block(inode, 1);
+        dquot_free_block(inode, 1);
         goto cleanup;
 
 bad_block:
-        ext4_error(inode->i_sb, __func__,
-                   "inode %lu: bad block %llu", inode->i_ino,
-                   EXT4_I(inode)->i_file_acl);
+        ext4_error(inode->i_sb, "inode %lu: bad block %llu",
+                   inode->i_ino, EXT4_I(inode)->i_file_acl);
         goto cleanup;
 
 #undef header
@@ -908,7 +907,7 @@ ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
         is->s.base = is->s.first = IFIRST(header);
         is->s.here = is->s.first;
         is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
-        if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
                 error = ext4_xattr_check_names(IFIRST(header), is->s.end);
                 if (error)
                         return error;
@@ -940,10 +939,10 @@ ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
         header = IHDR(inode, ext4_raw_inode(&is->iloc));
         if (!IS_LAST_ENTRY(s->first)) {
                 header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
-                EXT4_I(inode)->i_state |= EXT4_STATE_XATTR;
+                ext4_set_inode_state(inode, EXT4_STATE_XATTR);
         } else {
                 header->h_magic = cpu_to_le32(0);
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_XATTR;
+                ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
         }
         return 0;
 }
@@ -986,8 +985,8 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
         if (strlen(name) > 255)
                 return -ERANGE;
         down_write(&EXT4_I(inode)->xattr_sem);
-        no_expand = EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND;
-        EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
+        no_expand = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND);
+        ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 
         error = ext4_get_inode_loc(inode, &is.iloc);
         if (error)
@@ -997,10 +996,10 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
         if (error)
                 goto cleanup;
 
-        if (EXT4_I(inode)->i_state & EXT4_STATE_NEW) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_NEW)) {
                 struct ext4_inode *raw_inode = ext4_raw_inode(&is.iloc);
                 memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_NEW;
+                ext4_clear_inode_state(inode, EXT4_STATE_NEW);
         }
 
         error = ext4_xattr_ibody_find(inode, &i, &is);
@@ -1052,7 +1051,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
                 ext4_xattr_update_super_block(handle, inode->i_sb);
                 inode->i_ctime = ext4_current_time(inode);
                 if (!value)
-                        EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
+                        ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
                 error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
                 /*
                  * The bh is consumed by ext4_mark_iloc_dirty, even with
@@ -1067,7 +1066,7 @@ cleanup:
         brelse(is.iloc.bh);
         brelse(bs.bh);
         if (no_expand == 0)
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
+                ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
         up_write(&EXT4_I(inode)->xattr_sem);
         return error;
 }
@@ -1195,9 +1194,8 @@ retry:
                 if (!bh)
                         goto cleanup;
                 if (ext4_xattr_check_block(bh)) {
-                        ext4_error(inode->i_sb, __func__,
-                                "inode %lu: bad block %llu", inode->i_ino,
-                                EXT4_I(inode)->i_file_acl);
+                        ext4_error(inode->i_sb, "inode %lu: bad block %llu",
+                                   inode->i_ino, EXT4_I(inode)->i_file_acl);
                         error = -EIO;
                         goto cleanup;
                 }
@@ -1302,6 +1300,8 @@ retry:
 
                 /* Remove the chosen entry from the inode */
                 error = ext4_xattr_ibody_set(handle, inode, &i, is);
+                if (error)
+                        goto cleanup;
 
                 entry = IFIRST(header);
                 if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
@@ -1332,6 +1332,8 @@ retry:
                         goto cleanup;
                 kfree(b_entry_name);
                 kfree(buffer);
+                b_entry_name = NULL;
+                buffer = NULL;
                 brelse(is->iloc.bh);
                 kfree(is);
                 kfree(bs);
@@ -1370,16 +1372,14 @@ ext4_xattr_delete_inode(handle_t *handle, struct inode *inode)
                 goto cleanup;
         bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
         if (!bh) {
-                ext4_error(inode->i_sb, __func__,
-                        "inode %lu: block %llu read error", inode->i_ino,
-                        EXT4_I(inode)->i_file_acl);
+                ext4_error(inode->i_sb, "inode %lu: block %llu read error",
+                           inode->i_ino, EXT4_I(inode)->i_file_acl);
                 goto cleanup;
         }
         if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
             BHDR(bh)->h_blocks != cpu_to_le32(1)) {
-                ext4_error(inode->i_sb, __func__,
-                        "inode %lu: bad block %llu", inode->i_ino,
-                        EXT4_I(inode)->i_file_acl);
+                ext4_error(inode->i_sb, "inode %lu: bad block %llu",
+                           inode->i_ino, EXT4_I(inode)->i_file_acl);
                 goto cleanup;
         }
         ext4_xattr_release_block(handle, inode, bh);
@@ -1504,7 +1504,7 @@ again:
                 }
                 bh = sb_bread(inode->i_sb, ce->e_block);
                 if (!bh) {
-                        ext4_error(inode->i_sb, __func__,
+                        ext4_error(inode->i_sb,
                                 "inode %lu: block %lu read error",
                                 inode->i_ino, (unsigned long) ce->e_block);
                 } else if (le32_to_cpu(BHDR(bh)->h_refcount) >=
diff --git a/fs/ext4/xattr_security.c b/fs/ext4/xattr_security.c
index 983c253999a7..8b145e98df07 100644
--- a/fs/ext4/xattr_security.c
+++ b/fs/ext4/xattr_security.c
@@ -7,6 +7,7 @@
 #include <linux/string.h>
 #include <linux/fs.h>
 #include <linux/security.h>
+#include <linux/slab.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 #include "xattr.h"
diff --git a/fs/fat/cache.c b/fs/fat/cache.c
index 923990e4f16e..113f0a1e565d 100644
--- a/fs/fat/cache.c
+++ b/fs/fat/cache.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/buffer_head.h>
 #include "fat.h"
 
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 14da530b05ca..0ce143bd7d56 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -558,7 +558,7 @@ static int fat_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_bavail = sbi->free_clusters;
         buf->f_fsid.val[0] = (u32)id;
         buf->f_fsid.val[1] = (u32)(id >> 32);
-        buf->f_namelen = sbi->options.isvfat ? 260 : 12;
+        buf->f_namelen = sbi->options.isvfat ? FAT_LFN_LEN : 12;
 
         return 0;
 }
@@ -577,7 +577,7 @@ static inline loff_t fat_i_pos_read(struct msdos_sb_info *sbi,
         return i_pos;
 }
 
-static int fat_write_inode(struct inode *inode, int wait)
+static int __fat_write_inode(struct inode *inode, int wait)
 {
         struct super_block *sb = inode->i_sb;
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
@@ -634,9 +634,14 @@ retry:
         return err;
 }
 
+static int fat_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __fat_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int fat_sync_inode(struct inode *inode)
 {
-        return fat_write_inode(inode, 1);
+        return __fat_write_inode(inode, 1);
 }
 
 EXPORT_SYMBOL_GPL(fat_sync_inode);
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index f565f24019b5..6fcc7e71fbaa 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -309,7 +309,7 @@ static int vfat_create_shortname(struct inode *dir, struct nls_table *nls,
 {
         struct fat_mount_options *opts = &MSDOS_SB(dir->i_sb)->options;
         wchar_t *ip, *ext_start, *end, *name_start;
-        unsigned char base[9], ext[4], buf[8], *p;
+        unsigned char base[9], ext[4], buf[5], *p;
         unsigned char charbuf[NLS_MAX_CHARSET_SIZE];
         int chl, chi;
         int sz = 0, extlen, baselen, i, numtail_baselen, numtail2_baselen;
@@ -467,7 +467,7 @@ static int vfat_create_shortname(struct inode *dir, struct nls_table *nls,
                         return 0;
         }
 
-        i = jiffies & 0xffff;
+        i = jiffies;
         sz = (jiffies >> 16) & 0x7;
         if (baselen > 2) {
                 baselen = numtail2_baselen;
@@ -476,7 +476,7 @@ static int vfat_create_shortname(struct inode *dir, struct nls_table *nls,
         name_res[baselen + 4] = '~';
         name_res[baselen + 5] = '1' + sz;
         while (1) {
-                sprintf(buf, "%04X", i);
+                snprintf(buf, sizeof(buf), "%04X", i & 0xffff);
                 memcpy(&name_res[baselen], buf, 4);
                 if (vfat_find_form(dir, name_res) < 0)
                         break;
@@ -502,14 +502,14 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
                 *outlen = utf8s_to_utf16s(name, len, (wchar_t *)outname);
                 if (*outlen < 0)
                         return *outlen;
-                else if (*outlen > 255)
+                else if (*outlen > FAT_LFN_LEN)
                         return -ENAMETOOLONG;
 
                 op = &outname[*outlen * sizeof(wchar_t)];
         } else {
                 if (nls) {
                         for (i = 0, ip = name, op = outname, *outlen = 0;
-                             i < len && *outlen <= 255;
+                             i < len && *outlen <= FAT_LFN_LEN;
                              *outlen += 1)
                         {
                                 if (escape && (*ip == ':')) {
@@ -549,7 +549,7 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
                                 return -ENAMETOOLONG;
                 } else {
                         for (i = 0, ip = name, op = outname, *outlen = 0;
-                             i < len && *outlen <= 255;
+                             i < len && *outlen <= FAT_LFN_LEN;
                              i++, *outlen += 1)
                         {
                                 *op++ = *ip++;
@@ -701,6 +701,15 @@ static int vfat_find(struct inode *dir, struct qstr *qname,
         return fat_search_long(dir, qname->name, len, sinfo);
 }
 
+/*
+ * (nfsd's) anonymous disconnected dentry?
+ * NOTE: !IS_ROOT() is not anonymous (I.e. d_splice_alias() did the job).
+ */
+static int vfat_d_anon_disconn(struct dentry *dentry)
+{
+        return IS_ROOT(dentry) && (dentry->d_flags & DCACHE_DISCONNECTED);
+}
+
 static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
                                   struct nameidata *nd)
 {
@@ -729,11 +738,11 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
         }
 
         alias = d_find_alias(inode);
-        if (alias && !(alias->d_flags & DCACHE_DISCONNECTED)) {
+        if (alias && !vfat_d_anon_disconn(alias)) {
                 /*
-                 * This inode has non DCACHE_DISCONNECTED dentry. This
-                 * means, the user did ->lookup() by an another name
-                 * (longname vs 8.3 alias of it) in past.
+                 * This inode has non anonymous-DCACHE_DISCONNECTED
+                 * dentry. This means, the user did ->lookup() by an
+                 * another name (longname vs 8.3 alias of it) in past.
                  *
                  * Switch to new one for reason of locality if possible.
                  */
@@ -743,7 +752,9 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
                 iput(inode);
                 unlock_super(sb);
                 return alias;
-        }
+        } else
+                dput(alias);
+
 out:
         unlock_super(sb);
         dentry->d_op = sb->s_root->d_op;
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 2cf93ec40a67..452d02f9075e 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -344,7 +344,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
         switch (cmd) {
         case F_DUPFD:
         case F_DUPFD_CLOEXEC:
-                if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+                if (arg >= rlimit(RLIMIT_NOFILE))
                         break;
                 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
                 if (err >= 0) {
@@ -618,60 +618,90 @@ static DEFINE_RWLOCK(fasync_lock);
 static struct kmem_cache *fasync_cache __read_mostly;
 
 /*
- * fasync_helper() is used by almost all character device drivers
- * to set up the fasync queue. It returns negative on error, 0 if it did
- * no changes and positive if it added/deleted the entry.
+ * Remove a fasync entry. If successfully removed, return
+ * positive and clear the FASYNC flag. If no entry exists,
+ * do nothing and return 0.
+ *
+ * NOTE! It is very important that the FASYNC flag always
+ * match the state "is the filp on a fasync list".
+ *
+ * We always take the 'filp->f_lock', in since fasync_lock
+ * needs to be irq-safe.
  */
-int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
+static int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
 {
         struct fasync_struct *fa, **fp;
-        struct fasync_struct *new = NULL;
         int result = 0;
 
-        if (on) {
-                new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
-                if (!new)
-                        return -ENOMEM;
+        spin_lock(&filp->f_lock);
+        write_lock_irq(&fasync_lock);
+        for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
+                if (fa->fa_file != filp)
+                        continue;
+                *fp = fa->fa_next;
+                kmem_cache_free(fasync_cache, fa);
+                filp->f_flags &= ~FASYNC;
+                result = 1;
+                break;
         }
+        write_unlock_irq(&fasync_lock);
+        spin_unlock(&filp->f_lock);
+        return result;
+}
+
+/*
+ * Add a fasync entry. Return negative on error, positive if
+ * added, and zero if did nothing but change an existing one.
+ *
+ * NOTE! It is very important that the FASYNC flag always
+ * match the state "is the filp on a fasync list".
+ */
+static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
+{
+        struct fasync_struct *new, *fa, **fp;
+        int result = 0;
+
+        new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
+        if (!new)
+                return -ENOMEM;
 
-        /*
-         * We need to take f_lock first since it's not an IRQ-safe
-         * lock.
-         */
         spin_lock(&filp->f_lock);
         write_lock_irq(&fasync_lock);
         for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
-                if (fa->fa_file == filp) {
-                        if(on) {
-                                fa->fa_fd = fd;
-                                kmem_cache_free(fasync_cache, new);
-                        } else {
-                                *fp = fa->fa_next;
-                                kmem_cache_free(fasync_cache, fa);
-                                result = 1;
-                        }
-                        goto out;
-                }
+                if (fa->fa_file != filp)
+                        continue;
+                fa->fa_fd = fd;
+                kmem_cache_free(fasync_cache, new);
+                goto out;
         }
 
-        if (on) {
-                new->magic = FASYNC_MAGIC;
-                new->fa_file = filp;
-                new->fa_fd = fd;
-                new->fa_next = *fapp;
-                *fapp = new;
-                result = 1;
-        }
+        new->magic = FASYNC_MAGIC;
+        new->fa_file = filp;
+        new->fa_fd = fd;
+        new->fa_next = *fapp;
+        *fapp = new;
+        result = 1;
+        filp->f_flags |= FASYNC;
+
 out:
-        if (on)
-                filp->f_flags |= FASYNC;
-        else
-                filp->f_flags &= ~FASYNC;
         write_unlock_irq(&fasync_lock);
         spin_unlock(&filp->f_lock);
         return result;
 }
 
+/*
+ * fasync_helper() is used by almost all character device drivers
+ * to set up the fasync queue, and for regular files by the file
+ * lease code. It returns negative on error, 0 if it did no changes
+ * and positive if it added/deleted the entry.
+ */
+int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
+{
+        if (!on)
+                return fasync_remove_entry(filp, fapp);
+        return fasync_add_entry(fd, filp, fapp);
+}
+
 EXPORT_SYMBOL(fasync_helper);
 
 void __kill_fasync(struct fasync_struct *fa, int sig, int band)
diff --git a/fs/fifo.c b/fs/fifo.c
index f8f97b8b6d44..5d6606ffc2d2 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/pipe_fs_i.h>
diff --git a/fs/file.c b/fs/file.c
index 87e129030ab1..34bb7f71d994 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -257,7 +257,7 @@ int expand_files(struct files_struct *files, int nr)
          * N.B. For clone tasks sharing a files structure, this test
          * will limit the total number of files that can be opened.
          */
-        if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+        if (nr >= rlimit(RLIMIT_NOFILE))
                 return -EMFILE;
 
         /* Do we need to expand? */
@@ -478,7 +478,7 @@ repeat:
         error = fd;
 #if 1
         /* Sanity check */
-        if (rcu_dereference(fdt->fd[fd]) != NULL) {
+        if (rcu_dereference_raw(fdt->fd[fd]) != NULL) {
                 printk(KERN_WARNING "alloc_fd: slot %d not NULL!\n", fd);
                 rcu_assign_pointer(fdt->fd[fd], NULL);
         }
diff --git a/fs/file_table.c b/fs/file_table.c
index 69652c5bd5f0..32d12b78bac8 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -253,6 +253,7 @@ void __fput(struct file *file)
         if (file->f_op && file->f_op->release)
                 file->f_op->release(inode, file);
         security_file_free(file);
+        ima_file_free(file);
         if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
                 cdev_put(inode->i_cdev);
         fops_put(file->f_op);
@@ -392,7 +393,9 @@ retry:
                         continue;
                 if (!(f->f_mode & FMODE_WRITE))
                         continue;
+                spin_lock(&f->f_lock);
                 f->f_mode &= ~FMODE_WRITE;
+                spin_unlock(&f->f_lock);
                 if (file_check_writeable(f) != 0)
                         continue;
                 file_release_write(f);
diff --git a/fs/filesystems.c b/fs/filesystems.c
index a24c58e181db..68ba492d8eef 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -10,10 +10,10 @@
 #include <linux/fs.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/slab.h>
 #include <linux/kmod.h>
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 /*
diff --git a/fs/freevxfs/vxfs_subr.c b/fs/freevxfs/vxfs_subr.c
index ed8f0b0dd880..1429f3ae1e86 100644
--- a/fs/freevxfs/vxfs_subr.c
+++ b/fs/freevxfs/vxfs_subr.c
@@ -33,7 +33,6 @@
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 
 #include "vxfs_extern.h"
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 49bc1b8e8f19..4b37f7cea4dd 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
@@ -242,6 +243,7 @@ static void bdi_sync_writeback(struct backing_dev_info *bdi,
 /**
  * bdi_start_writeback - start writeback
  * @bdi: the backing device to write from
+ * @sb: write inodes from this super_block
  * @nr_pages: the number of pages to write
  *
  * Description:
@@ -380,10 +382,10 @@ static void queue_io(struct bdi_writeback *wb, unsigned long *older_than_this)
         move_expired_inodes(&wb->b_dirty, &wb->b_io, older_than_this);
 }
 
-static int write_inode(struct inode *inode, int sync)
+static int write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         if (inode->i_sb->s_op->write_inode && !is_bad_inode(inode))
-                return inode->i_sb->s_op->write_inode(inode, sync);
+                return inode->i_sb->s_op->write_inode(inode, wbc);
         return 0;
 }
 
@@ -420,7 +422,6 @@ static int
 writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct address_space *mapping = inode->i_mapping;
-        int wait = wbc->sync_mode == WB_SYNC_ALL;
         unsigned dirty;
         int ret;
 
@@ -438,7 +439,7 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                  * We'll have another go at writing back this inode when we
                  * completed a full scan of b_io.
                  */
-                if (!wait) {
+                if (wbc->sync_mode != WB_SYNC_ALL) {
                         requeue_io(inode);
                         return 0;
                 }
@@ -460,15 +461,20 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
 
         ret = do_writepages(mapping, wbc);
 
-        /* Don't write the inode if only I_DIRTY_PAGES was set */
-        if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
-                int err = write_inode(inode, wait);
+        /*
+         * Make sure to wait on the data before writing out the metadata.
+         * This is important for filesystems that modify metadata on data
+         * I/O completion.
+         */
+        if (wbc->sync_mode == WB_SYNC_ALL) {
+                int err = filemap_fdatawait(mapping);
                 if (ret == 0)
                         ret = err;
         }
 
-        if (wait) {
-                int err = filemap_fdatawait(mapping);
+        /* Don't write the inode if only I_DIRTY_PAGES was set */
+        if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
+                int err = write_inode(inode, wbc);
                 if (ret == 0)
                         ret = err;
         }
@@ -548,108 +554,85 @@ select_queue:
         return ret;
 }
 
-static void unpin_sb_for_writeback(struct super_block **psb)
+static void unpin_sb_for_writeback(struct super_block *sb)
 {
-        struct super_block *sb = *psb;
-
-        if (sb) {
-                up_read(&sb->s_umount);
-                put_super(sb);
-                *psb = NULL;
-        }
+        up_read(&sb->s_umount);
+        put_super(sb);
 }
 
+enum sb_pin_state {
+        SB_PINNED,
+        SB_NOT_PINNED,
+        SB_PIN_FAILED
+};
+
 /*
  * For WB_SYNC_NONE writeback, the caller does not have the sb pinned
  * before calling writeback. So make sure that we do pin it, so it doesn't
  * go away while we are writing inodes from it.
- *
- * Returns 0 if the super was successfully pinned (or pinning wasn't needed),
- * 1 if we failed.
  */
-static int pin_sb_for_writeback(struct writeback_control *wbc,
-                                struct inode *inode, struct super_block **psb)
+static enum sb_pin_state pin_sb_for_writeback(struct writeback_control *wbc,
+                                              struct super_block *sb)
 {
-        struct super_block *sb = inode->i_sb;
-
-        /*
-         * If this sb is already pinned, nothing more to do. If not and
-         * *psb is non-NULL, unpin the old one first
-         */
-        if (sb == *psb)
-                return 0;
-        else if (*psb)
-                unpin_sb_for_writeback(psb);
-
         /*
          * Caller must already hold the ref for this
          */
         if (wbc->sync_mode == WB_SYNC_ALL) {
                 WARN_ON(!rwsem_is_locked(&sb->s_umount));
-                return 0;
+                return SB_NOT_PINNED;
         }
-
         spin_lock(&sb_lock);
         sb->s_count++;
         if (down_read_trylock(&sb->s_umount)) {
                 if (sb->s_root) {
                         spin_unlock(&sb_lock);
-                        goto pinned;
+                        return SB_PINNED;
                 }
                 /*
                  * umounted, drop rwsem again and fall through to failure
                  */
                 up_read(&sb->s_umount);
         }
-
         sb->s_count--;
         spin_unlock(&sb_lock);
-        return 1;
-pinned:
-        *psb = sb;
-        return 0;
+        return SB_PIN_FAILED;
 }
 
-static void writeback_inodes_wb(struct bdi_writeback *wb,
-                                struct writeback_control *wbc)
+/*
+ * Write a portion of b_io inodes which belong to @sb.
+ * If @wbc->sb != NULL, then find and write all such
+ * inodes. Otherwise write only ones which go sequentially
+ * in reverse order.
+ * Return 1, if the caller writeback routine should be
+ * interrupted. Otherwise return 0.
+ */
+static int writeback_sb_inodes(struct super_block *sb,
+                               struct bdi_writeback *wb,
+                               struct writeback_control *wbc)
 {
-        struct super_block *sb = wbc->sb, *pin_sb = NULL;
-        const unsigned long start = jiffies;    /* livelock avoidance */
-
-        spin_lock(&inode_lock);
-
-        if (!wbc->for_kupdate || list_empty(&wb->b_io))
-                queue_io(wb, wbc->older_than_this);
-
         while (!list_empty(&wb->b_io)) {
-                struct inode *inode = list_entry(wb->b_io.prev,
-                                                struct inode, i_list);
                 long pages_skipped;
-
-                /*
-                 * super block given and doesn't match, skip this inode
-                 */
-                if (sb && sb != inode->i_sb) {
+                struct inode *inode = list_entry(wb->b_io.prev,
+                                                 struct inode, i_list);
+                if (wbc->sb && sb != inode->i_sb) {
+                        /* super block given and doesn't
+                           match, skip this inode */
                         redirty_tail(inode);
                         continue;
                 }
-
+                if (sb != inode->i_sb)
+                        /* finish with this superblock */
+                        return 0;
                 if (inode->i_state & (I_NEW | I_WILL_FREE)) {
                         requeue_io(inode);
                         continue;
                 }
-
                 /*
                  * Was this inode dirtied after sync_sb_inodes was called?
                  * This keeps sync from extra jobs and livelock.
                  */
-                if (inode_dirtied_after(inode, start))
-                        break;
-
-                if (pin_sb_for_writeback(wbc, inode, &pin_sb)) {
-                        requeue_io(inode);
-                        continue;
-                }
+                if (inode_dirtied_after(inode, wbc->wb_start))
+                        return 1;
 
                 BUG_ON(inode->i_state & (I_FREEING | I_CLEAR));
                 __iget(inode);
@@ -668,14 +651,50 @@ static void writeback_inodes_wb(struct bdi_writeback *wb,
                 spin_lock(&inode_lock);
                 if (wbc->nr_to_write <= 0) {
                         wbc->more_io = 1;
-                        break;
+                        return 1;
                 }
                 if (!list_empty(&wb->b_more_io))
                         wbc->more_io = 1;
         }
+        /* b_io is empty */
+        return 1;
+}
+
+static void writeback_inodes_wb(struct bdi_writeback *wb,
+                                struct writeback_control *wbc)
+{
+        int ret = 0;
 
-        unpin_sb_for_writeback(&pin_sb);
+        wbc->wb_start = jiffies; /* livelock avoidance */
+        spin_lock(&inode_lock);
+        if (!wbc->for_kupdate || list_empty(&wb->b_io))
+                queue_io(wb, wbc->older_than_this);
 
+        while (!list_empty(&wb->b_io)) {
+                struct inode *inode = list_entry(wb->b_io.prev,
+                                                 struct inode, i_list);
+                struct super_block *sb = inode->i_sb;
+                enum sb_pin_state state;
+
+                if (wbc->sb && sb != wbc->sb) {
+                        /* super block given and doesn't
+                           match, skip this inode */
+                        redirty_tail(inode);
+                        continue;
+                }
+                state = pin_sb_for_writeback(wbc, sb);
+
+                if (state == SB_PIN_FAILED) {
+                        requeue_io(inode);
+                        continue;
+                }
+                ret = writeback_sb_inodes(sb, wb, wbc);
+
+                if (state == SB_PINNED)
+                        unpin_sb_for_writeback(sb);
+                if (ret)
+                        break;
+        }
         spin_unlock(&inode_lock);
         /* Leave any unwritten inodes on b_io */
 }
@@ -1187,6 +1206,23 @@ void writeback_inodes_sb(struct super_block *sb)
 EXPORT_SYMBOL(writeback_inodes_sb);
 
 /**
+ * writeback_inodes_sb_if_idle  -       start writeback if none underway
+ * @sb: the superblock
+ *
+ * Invoke writeback_inodes_sb if no writeback is currently underway.
+ * Returns 1 if writeback was started, 0 if not.
+ */
+int writeback_inodes_sb_if_idle(struct super_block *sb)
+{
+        if (!writeback_in_progress(sb->s_bdi)) {
+                writeback_inodes_sb(sb);
+                return 1;
+        } else
+                return 0;
+}
+EXPORT_SYMBOL(writeback_inodes_sb_if_idle);
+
+/**
  * sync_inodes_sb       -       sync sb inode pages
  * @sb: the superblock
  *
diff --git a/fs/fscache/Kconfig b/fs/fscache/Kconfig
index 864dac20a242..cc94bb9563f2 100644
--- a/fs/fscache/Kconfig
+++ b/fs/fscache/Kconfig
@@ -1,7 +1,6 @@
 
 config FSCACHE
         tristate "General filesystem local caching manager"
-        depends on EXPERIMENTAL
         select SLOW_WORK
         help
           This option enables a generic filesystem caching manager that can be
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index 3221a0c7944e..1e1f286dd70e 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -12,6 +12,7 @@
 #define FSCACHE_DEBUG_LEVEL COOKIE
 #include <linux/module.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/key.h>
 #include <keys/user-type.h>
 #include "internal.h"
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index e513ac599c8e..0b589a9b4ffc 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -53,7 +53,7 @@ const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5] = {
 static void fscache_object_slow_work_put_ref(struct slow_work *);
 static int  fscache_object_slow_work_get_ref(struct slow_work *);
 static void fscache_object_slow_work_execute(struct slow_work *);
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
 static void fscache_object_slow_work_desc(struct slow_work *, struct seq_file *);
 #endif
 static void fscache_initialise_object(struct fscache_object *);
@@ -69,7 +69,7 @@ const struct slow_work_ops fscache_object_slow_work_ops = {
         .get_ref        = fscache_object_slow_work_get_ref,
         .put_ref        = fscache_object_slow_work_put_ref,
         .execute        = fscache_object_slow_work_execute,
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         .desc           = fscache_object_slow_work_desc,
 #endif
 };
@@ -364,7 +364,7 @@ static void fscache_object_slow_work_execute(struct slow_work *work)
 /*
  * describe an object for slow-work debugging
  */
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
 static void fscache_object_slow_work_desc(struct slow_work *work,
                                           struct seq_file *m)
 {
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index 313e79a14266..f17cecafae44 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -14,6 +14,7 @@
 #define FSCACHE_DEBUG_LEVEL OPERATION
 #include <linux/module.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 atomic_t fscache_op_debug_id;
@@ -500,7 +501,7 @@ static void fscache_op_execute(struct slow_work *work)
 /*
  * describe an operation for slow-work debugging
  */
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
 static void fscache_op_desc(struct slow_work *work, struct seq_file *m)
 {
         struct fscache_operation *op =
@@ -517,7 +518,7 @@ const struct slow_work_ops fscache_op_slow_work_ops = {
         .get_ref        = fscache_op_get_ref,
         .put_ref        = fscache_op_put_ref,
         .execute        = fscache_op_execute,
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         .desc           = fscache_op_desc,
 #endif
 };
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index c598ea4c4e7d..47aefd376e54 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -14,6 +14,7 @@
 #include <linux/fscache-cache.h>
 #include <linux/buffer_head.h>
 #include <linux/pagevec.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 /*
@@ -881,6 +882,7 @@ submit_failed:
         goto nobufs;
 
 nobufs_unlock_obj:
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
 nobufs:
         spin_unlock(&cookie->lock);
diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
index 46435f3aae68..4765190d537f 100644
--- a/fs/fscache/stats.c
+++ b/fs/fscache/stats.c
@@ -165,8 +165,8 @@ static int fscache_stats_show(struct seq_file *m, void *v)
                    atomic_read(&fscache_n_object_lookups),
                    atomic_read(&fscache_n_object_lookups_negative),
                    atomic_read(&fscache_n_object_lookups_positive),
-                   atomic_read(&fscache_n_object_lookups_timed_out),
-                   atomic_read(&fscache_n_object_created));
+                   atomic_read(&fscache_n_object_created),
+                   atomic_read(&fscache_n_object_lookups_timed_out));
 
         seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
                    atomic_read(&fscache_n_updates),
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index de792dcf3274..e1f8171278bd 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -44,6 +44,7 @@
 #include <linux/magic.h>
 #include <linux/miscdevice.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/stat.h>
 
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 51d9e33d634f..eb7e9423691f 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -865,13 +865,10 @@ static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
 
         down_read(&fc->killsb);
         err = -ENOENT;
-        if (!fc->sb)
-                goto err_unlock;
-
-        err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
-                                       outarg.off, outarg.len);
-
-err_unlock:
+        if (fc->sb) {
+                err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
+                                               outarg.off, outarg.len);
+        }
         up_read(&fc->killsb);
         return err;
 
@@ -884,10 +881,15 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
                                    struct fuse_copy_state *cs)
 {
         struct fuse_notify_inval_entry_out outarg;
-        int err = -EINVAL;
-        char buf[FUSE_NAME_MAX+1];
+        int err = -ENOMEM;
+        char *buf;
         struct qstr name;
 
+        buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
+        if (!buf)
+                goto err;
+
+        err = -EINVAL;
         if (size < sizeof(outarg))
                 goto err;
 
@@ -910,16 +912,14 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
 
         down_read(&fc->killsb);
         err = -ENOENT;
-        if (!fc->sb)
-                goto err_unlock;
-
-        err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
-
-err_unlock:
+        if (fc->sb)
+                err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
         up_read(&fc->killsb);
+        kfree(buf);
         return err;
 
 err:
+        kfree(buf);
         fuse_copy_finish(cs);
         return err;
 }
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c18913a777ae..a9f5e137f1d3 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -828,6 +828,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                 if (!page)
                         break;
 
+                if (mapping_writably_mapped(mapping))
+                        flush_dcache_page(page);
+
                 pagefault_disable();
                 tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
                 pagefault_enable();
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 1a822ce2b24b..ec14d19ce501 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -850,7 +850,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
         req->in.args[0].size = sizeof(*arg);
         req->in.args[0].value = arg;
         req->out.numargs = 1;
-        /* Variable length arguement used for backward compatibility
+        /* Variable length argument used for backward compatibility
            with interface version < 7.5.  Rest of init_out is zeroed
            by do_get_request(), so a short reply is not a problem */
         req->out.argvar = 1;
diff --git a/fs/generic_acl.c b/fs/generic_acl.c
index 55458031e501..fe5df5457656 100644
--- a/fs/generic_acl.c
+++ b/fs/generic_acl.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/gfp.h>
 #include <linux/fs.h>
 #include <linux/generic_acl.h>
 #include <linux/posix_acl.h>
diff --git a/fs/gfs2/Kconfig b/fs/gfs2/Kconfig
index 4dcddf83326f..a47b43107112 100644
--- a/fs/gfs2/Kconfig
+++ b/fs/gfs2/Kconfig
@@ -8,7 +8,6 @@ config GFS2_FS
         select FS_POSIX_ACL
         select CRC32
         select SLOW_WORK
-        select QUOTA
         select QUOTACTL
         help
           A cluster filesystem.
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 7b8da9415267..0c1d0b82dcf1 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -1061,8 +1061,8 @@ out:
 
 int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
 {
-        struct inode *aspace = page->mapping->host;
-        struct gfs2_sbd *sdp = aspace->i_sb->s_fs_info;
+        struct address_space *mapping = page->mapping;
+        struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct buffer_head *bh, *head;
         struct gfs2_bufdata *bd;
 
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 6d47379e794b..5e411d5f4697 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -7,7 +7,6 @@
  * of the GNU General Public License version 2.
  */
 
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
 #include <linux/buffer_head.h>
@@ -541,7 +540,7 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                                 *ptr++ = cpu_to_be64(bn++);
                         break;
                 }
-        } while (state != ALLOC_DATA);
+        } while ((state != ALLOC_DATA) || !dblock);
 
         ip->i_height = height;
         gfs2_add_inode_blocks(&ip->i_inode, alloced);
diff --git a/fs/gfs2/dentry.c b/fs/gfs2/dentry.c
index 91beddadd388..bb7907bde3d8 100644
--- a/fs/gfs2/dentry.c
+++ b/fs/gfs2/dentry.c
@@ -7,7 +7,6 @@
  * of the GNU General Public License version 2.
  */
 
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
 #include <linux/buffer_head.h>
diff --git a/fs/gfs2/export.c b/fs/gfs2/export.c
index d15876e9aa26..c22c21174833 100644
--- a/fs/gfs2/export.c
+++ b/fs/gfs2/export.c
@@ -7,7 +7,6 @@
  * of the GNU General Public License version 2.
  */
 
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
 #include <linux/buffer_head.h>
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 4eb308aa3234..e6dd2aec6f82 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -569,6 +569,40 @@ static int gfs2_fsync(struct file *file, struct dentry *dentry, int datasync)
         return ret;
 }
 
+/**
+ * gfs2_file_aio_write - Perform a write to a file
+ * @iocb: The io context
+ * @iov: The data to write
+ * @nr_segs: Number of @iov segments
+ * @pos: The file position
+ *
+ * We have to do a lock/unlock here to refresh the inode size for
+ * O_APPEND writes, otherwise we can land up writing at the wrong
+ * offset. There is still a race, but provided the app is using its
+ * own file locking, this will make O_APPEND work as expected.
+ *
+ */
+
+static ssize_t gfs2_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+                                   unsigned long nr_segs, loff_t pos)
+{
+        struct file *file = iocb->ki_filp;
+
+        if (file->f_flags & O_APPEND) {
+                struct dentry *dentry = file->f_dentry;
+                struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
+                struct gfs2_holder gh;
+                int ret;
+
+                ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+                if (ret)
+                        return ret;
+                gfs2_glock_dq_uninit(&gh);
+        }
+
+        return generic_file_aio_write(iocb, iov, nr_segs, pos);
+}
+
 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
 
 /**
@@ -606,7 +640,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
 
         if (!(fl->fl_flags & FL_POSIX))
                 return -ENOLCK;
-        if (__mandatory_lock(&ip->i_inode))
+        if (__mandatory_lock(&ip->i_inode) && fl->fl_type != F_UNLCK)
                 return -ENOLCK;
 
         if (cmd == F_CANCELLK) {
@@ -711,7 +745,7 @@ const struct file_operations gfs2_file_fops = {
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
         .write          = do_sync_write,
-        .aio_write      = generic_file_aio_write,
+        .aio_write      = gfs2_file_aio_write,
         .unlocked_ioctl = gfs2_ioctl,
         .mmap           = gfs2_mmap,
         .open           = gfs2_open,
@@ -741,7 +775,7 @@ const struct file_operations gfs2_file_fops_nolock = {
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
         .write          = do_sync_write,
-        .aio_write      = generic_file_aio_write,
+        .aio_write      = gfs2_file_aio_write,
         .unlocked_ioctl = gfs2_ioctl,
         .mmap           = gfs2_mmap,
         .open           = gfs2_open,
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index f455a03a09e2..454d4b4eb36b 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -19,7 +19,6 @@
 #include <linux/list.h>
 #include <linux/wait.h>
 #include <linux/module.h>
-#include <linux/rwsem.h>
 #include <asm/uaccess.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
@@ -60,7 +59,6 @@ static int __dump_glock(struct seq_file *seq, const struct gfs2_glock *gl);
 #define GLOCK_BUG_ON(gl,x) do { if (unlikely(x)) { __dump_glock(NULL, gl); BUG(); } } while(0)
 static void do_xmote(struct gfs2_glock *gl, struct gfs2_holder *gh, unsigned int target);
 
-static DECLARE_RWSEM(gfs2_umount_flush_sem);
 static struct dentry *gfs2_root;
 static struct workqueue_struct *glock_workqueue;
 struct workqueue_struct *gfs2_delete_workqueue;
@@ -154,12 +152,14 @@ static unsigned int gl_hash(const struct gfs2_sbd *sdp,
 static void glock_free(struct gfs2_glock *gl)
 {
         struct gfs2_sbd *sdp = gl->gl_sbd;
-        struct inode *aspace = gl->gl_aspace;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
+        struct kmem_cache *cachep = gfs2_glock_cachep;
 
-        if (aspace)
-                gfs2_aspace_put(aspace);
+        GLOCK_BUG_ON(gl, mapping && mapping->nrpages);
         trace_gfs2_glock_put(gl);
-        sdp->sd_lockstruct.ls_ops->lm_put_lock(gfs2_glock_cachep, gl);
+        if (mapping)
+                cachep = gfs2_glock_aspace_cachep;
+        sdp->sd_lockstruct.ls_ops->lm_put_lock(cachep, gl);
 }
 
 /**
@@ -712,7 +712,6 @@ static void glock_work_func(struct work_struct *work)
                 finish_xmote(gl, gl->gl_reply);
                 drop_ref = 1;
         }
-        down_read(&gfs2_umount_flush_sem);
         spin_lock(&gl->gl_spin);
         if (test_and_clear_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) &&
             gl->gl_state != LM_ST_UNLOCKED &&
@@ -725,7 +724,6 @@ static void glock_work_func(struct work_struct *work)
         }
         run_queue(gl, 0);
         spin_unlock(&gl->gl_spin);
-        up_read(&gfs2_umount_flush_sem);
         if (!delay ||
             queue_delayed_work(glock_workqueue, &gl->gl_work, delay) == 0)
                 gfs2_glock_put(gl);
@@ -750,10 +748,11 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
                    const struct gfs2_glock_operations *glops, int create,
                    struct gfs2_glock **glp)
 {
+        struct super_block *s = sdp->sd_vfs;
         struct lm_lockname name = { .ln_number = number, .ln_type = glops->go_type };
         struct gfs2_glock *gl, *tmp;
         unsigned int hash = gl_hash(sdp, &name);
-        int error;
+        struct address_space *mapping;
 
         read_lock(gl_lock_addr(hash));
         gl = search_bucket(hash, sdp, &name);
@@ -765,10 +764,14 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         if (!create)
                 return -ENOENT;
 
-        gl = kmem_cache_alloc(gfs2_glock_cachep, GFP_KERNEL);
+        if (glops->go_flags & GLOF_ASPACE)
+                gl = kmem_cache_alloc(gfs2_glock_aspace_cachep, GFP_KERNEL);
+        else
+                gl = kmem_cache_alloc(gfs2_glock_cachep, GFP_KERNEL);
         if (!gl)
                 return -ENOMEM;
 
+        atomic_inc(&sdp->sd_glock_disposal);
         gl->gl_flags = 0;
         gl->gl_name = name;
         atomic_set(&gl->gl_ref, 1);
@@ -783,18 +786,18 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         gl->gl_tchange = jiffies;
         gl->gl_object = NULL;
         gl->gl_sbd = sdp;
-        gl->gl_aspace = NULL;
         INIT_DELAYED_WORK(&gl->gl_work, glock_work_func);
         INIT_WORK(&gl->gl_delete, delete_work_func);
 
-        /* If this glock protects actual on-disk data or metadata blocks,
-           create a VFS inode to manage the pages/buffers holding them. */
-        if (glops == &gfs2_inode_glops || glops == &gfs2_rgrp_glops) {
-                gl->gl_aspace = gfs2_aspace_get(sdp);
-                if (!gl->gl_aspace) {
-                        error = -ENOMEM;
-                        goto fail;
-                }
+        mapping = gfs2_glock2aspace(gl);
+        if (mapping) {
+                mapping->a_ops = &gfs2_meta_aops;
+                mapping->host = s->s_bdev->bd_inode;
+                mapping->flags = 0;
+                mapping_set_gfp_mask(mapping, GFP_NOFS);
+                mapping->assoc_mapping = NULL;
+                mapping->backing_dev_info = s->s_bdi;
+                mapping->writeback_index = 0;
         }
 
         write_lock(gl_lock_addr(hash));
@@ -811,10 +814,6 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         *glp = gl;
 
         return 0;
-
-fail:
-        kmem_cache_free(gfs2_glock_cachep, gl);
-        return error;
 }
 
 /**
@@ -1509,35 +1508,13 @@ void gfs2_glock_thaw(struct gfs2_sbd *sdp)
 
 void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
 {
-        unsigned long t;
         unsigned int x;
-        int cont;
 
-        t = jiffies;
-
-        for (;;) {
-                cont = 0;
-                for (x = 0; x < GFS2_GL_HASH_SIZE; x++) {
-                        if (examine_bucket(clear_glock, sdp, x))
-                                cont = 1;
-                }
-
-                if (!cont)
-                        break;
-
-                if (time_after_eq(jiffies,
-                                  t + gfs2_tune_get(sdp, gt_stall_secs) * HZ)) {
-                        fs_warn(sdp, "Unmount seems to be stalled. "
-                                     "Dumping lock state...\n");
-                        gfs2_dump_lockstate(sdp);
-                        t = jiffies;
-                }
-
-                down_write(&gfs2_umount_flush_sem);
-                invalidate_inodes(sdp->sd_vfs);
-                up_write(&gfs2_umount_flush_sem);
-                msleep(10);
-        }
+        for (x = 0; x < GFS2_GL_HASH_SIZE; x++)
+                examine_bucket(clear_glock, sdp, x);
+        flush_workqueue(glock_workqueue);
+        wait_event(sdp->sd_glock_wait, atomic_read(&sdp->sd_glock_disposal) == 0);
+        gfs2_dump_lockstate(sdp);
 }
 
 void gfs2_glock_finish_truncate(struct gfs2_inode *ip)
@@ -1681,7 +1658,7 @@ static int __dump_glock(struct seq_file *seq, const struct gfs2_glock *gl)
         dtime *= 1000000/HZ; /* demote time in uSec */
         if (!test_bit(GLF_DEMOTE, &gl->gl_flags))
                 dtime = 0;
-        gfs2_print_dbg(seq, "G:  s:%s n:%u/%llu f:%s t:%s d:%s/%llu a:%d r:%d\n",
+        gfs2_print_dbg(seq, "G:  s:%s n:%u/%llx f:%s t:%s d:%s/%llu a:%d r:%d\n",
                   state2str(gl->gl_state),
                   gl->gl_name.ln_type,
                   (unsigned long long)gl->gl_name.ln_number,
diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index 13f0bd228132..2bda1911b156 100644
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -123,7 +123,7 @@ struct lm_lockops {
         int (*lm_mount) (struct gfs2_sbd *sdp, const char *fsname);
         void (*lm_unmount) (struct gfs2_sbd *sdp);
         void (*lm_withdraw) (struct gfs2_sbd *sdp);
-        void (*lm_put_lock) (struct kmem_cache *cachep, void *gl);
+        void (*lm_put_lock) (struct kmem_cache *cachep, struct gfs2_glock *gl);
         unsigned int (*lm_lock) (struct gfs2_glock *gl,
                                  unsigned int req_state, unsigned int flags);
         void (*lm_cancel) (struct gfs2_glock *gl);
@@ -180,6 +180,13 @@ static inline int gfs2_glock_is_held_shrd(struct gfs2_glock *gl)
         return gl->gl_state == LM_ST_SHARED;
 }
 
+static inline struct address_space *gfs2_glock2aspace(struct gfs2_glock *gl)
+{
+        if (gl->gl_ops->go_flags & GLOF_ASPACE)
+                return (struct address_space *)(gl + 1);
+        return NULL;
+}
+
 int gfs2_glock_get(struct gfs2_sbd *sdp,
                    u64 number, const struct gfs2_glock_operations *glops,
                    int create, struct gfs2_glock **glp);
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 78554acc0605..49f97d3bb690 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -7,7 +7,6 @@
  * of the GNU General Public License version 2.
  */
 
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
 #include <linux/buffer_head.h>
@@ -87,7 +86,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
 
 static void rgrp_go_sync(struct gfs2_glock *gl)
 {
-        struct address_space *metamapping = gl->gl_aspace->i_mapping;
+        struct address_space *metamapping = gfs2_glock2aspace(gl);
         int error;
 
         if (!test_and_clear_bit(GLF_DIRTY, &gl->gl_flags))
@@ -113,7 +112,7 @@ static void rgrp_go_sync(struct gfs2_glock *gl)
 
 static void rgrp_go_inval(struct gfs2_glock *gl, int flags)
 {
-        struct address_space *mapping = gl->gl_aspace->i_mapping;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
 
         BUG_ON(!(flags & DIO_METADATA));
         gfs2_assert_withdraw(gl->gl_sbd, !atomic_read(&gl->gl_ail_count));
@@ -134,7 +133,7 @@ static void rgrp_go_inval(struct gfs2_glock *gl, int flags)
 static void inode_go_sync(struct gfs2_glock *gl)
 {
         struct gfs2_inode *ip = gl->gl_object;
-        struct address_space *metamapping = gl->gl_aspace->i_mapping;
+        struct address_space *metamapping = gfs2_glock2aspace(gl);
         int error;
 
         if (ip && !S_ISREG(ip->i_inode.i_mode))
@@ -183,7 +182,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
         gfs2_assert_withdraw(gl->gl_sbd, !atomic_read(&gl->gl_ail_count));
 
         if (flags & DIO_METADATA) {
-                struct address_space *mapping = gl->gl_aspace->i_mapping;
+                struct address_space *mapping = gfs2_glock2aspace(gl);
                 truncate_inode_pages(mapping, 0);
                 if (ip) {
                         set_bit(GIF_INVALID, &ip->i_flags);
@@ -282,7 +281,8 @@ static int inode_go_dump(struct seq_file *seq, const struct gfs2_glock *gl)
 
 static int rgrp_go_demote_ok(const struct gfs2_glock *gl)
 {
-        return !gl->gl_aspace->i_mapping->nrpages;
+        const struct address_space *mapping = (const struct address_space *)(gl + 1);
+        return !mapping->nrpages;
 }
 
 /**
@@ -387,8 +387,7 @@ static void iopen_go_callback(struct gfs2_glock *gl)
         struct gfs2_inode *ip = (struct gfs2_inode *)gl->gl_object;
 
         if (gl->gl_demote_state == LM_ST_UNLOCKED &&
-            gl->gl_state == LM_ST_SHARED &&
-            ip && test_bit(GIF_USER, &ip->i_flags)) {
+            gl->gl_state == LM_ST_SHARED && ip) {
                 gfs2_glock_hold(gl);
                 if (queue_work(gfs2_delete_workqueue, &gl->gl_delete) == 0)
                         gfs2_glock_put_nolock(gl);
@@ -407,6 +406,7 @@ const struct gfs2_glock_operations gfs2_inode_glops = {
         .go_dump = inode_go_dump,
         .go_type = LM_TYPE_INODE,
         .go_min_hold_time = HZ / 5,
+        .go_flags = GLOF_ASPACE,
 };
 
 const struct gfs2_glock_operations gfs2_rgrp_glops = {
@@ -418,6 +418,7 @@ const struct gfs2_glock_operations gfs2_rgrp_glops = {
         .go_dump = gfs2_rgrp_dump,
         .go_type = LM_TYPE_RGRP,
         .go_min_hold_time = HZ / 5,
+        .go_flags = GLOF_ASPACE,
 };
 
 const struct gfs2_glock_operations gfs2_trans_glops = {
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 4792200978c8..3aac46f6853e 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -162,6 +162,8 @@ struct gfs2_glock_operations {
         void (*go_callback) (struct gfs2_glock *gl);
         const int go_type;
         const unsigned long go_min_hold_time;
+        const unsigned long go_flags;
+#define GLOF_ASPACE 1
 };
 
 enum {
@@ -225,7 +227,6 @@ struct gfs2_glock {
 
         struct gfs2_sbd *gl_sbd;
 
-        struct inode *gl_aspace;
         struct list_head gl_ail_list;
         atomic_t gl_ail_count;
         struct delayed_work gl_work;
@@ -258,7 +259,6 @@ enum {
         GIF_INVALID             = 0,
         GIF_QD_LOCKED           = 1,
         GIF_SW_PAGED            = 3,
-        GIF_USER                = 4, /* user inode, not metadata addr space */
 };
 
 
@@ -451,7 +451,6 @@ struct gfs2_tune {
         unsigned int gt_quota_quantum; /* Secs between syncs to quota file */
         unsigned int gt_new_files_jdata;
         unsigned int gt_max_readahead; /* Max bytes to read-ahead from disk */
-        unsigned int gt_stall_secs; /* Detects trouble! */
         unsigned int gt_complain_secs;
         unsigned int gt_statfs_quantum;
         unsigned int gt_statfs_slow;
@@ -544,6 +543,8 @@ struct gfs2_sbd {
         struct gfs2_holder sd_live_gh;
         struct gfs2_glock *sd_rename_gl;
         struct gfs2_glock *sd_trans_gl;
+        wait_queue_head_t sd_glock_wait;
+        atomic_t sd_glock_disposal;
 
         /* Inode Stuff */
 
@@ -615,7 +616,7 @@ struct gfs2_sbd {
         unsigned int sd_log_blks_reserved;
         unsigned int sd_log_commited_buf;
         unsigned int sd_log_commited_databuf;
-        unsigned int sd_log_commited_revoke;
+        int sd_log_commited_revoke;
 
         unsigned int sd_log_num_buf;
         unsigned int sd_log_num_revoke;
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 6e220f4eee7d..b1bf2694fb2b 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -45,7 +45,7 @@ static int iget_test(struct inode *inode, void *opaque)
         struct gfs2_inode *ip = GFS2_I(inode);
         u64 *no_addr = opaque;
 
-        if (ip->i_no_addr == *no_addr && test_bit(GIF_USER, &ip->i_flags))
+        if (ip->i_no_addr == *no_addr)
                 return 1;
 
         return 0;
@@ -58,7 +58,6 @@ static int iget_set(struct inode *inode, void *opaque)
 
         inode->i_ino = (unsigned long)*no_addr;
         ip->i_no_addr = *no_addr;
-        set_bit(GIF_USER, &ip->i_flags);
         return 0;
 }
 
@@ -84,7 +83,7 @@ static int iget_skip_test(struct inode *inode, void *opaque)
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_skip_data *data = opaque;
 
-        if (ip->i_no_addr == data->no_addr && test_bit(GIF_USER, &ip->i_flags)){
+        if (ip->i_no_addr == data->no_addr) {
                 if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE)){
                         data->skipped = 1;
                         return 0;
@@ -103,7 +102,6 @@ static int iget_skip_set(struct inode *inode, void *opaque)
                 return 1;
         inode->i_ino = (unsigned long)(data->no_addr);
         ip->i_no_addr = data->no_addr;
-        set_bit(GIF_USER, &ip->i_flags);
         return 0;
 }
 
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 46df988323bc..0e0470ed34c2 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -9,6 +9,7 @@
 
 #include <linux/fs.h>
 #include <linux/dlm.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/gfs2_ondisk.h>
 
@@ -21,6 +22,7 @@ static void gdlm_ast(void *arg)
 {
         struct gfs2_glock *gl = arg;
         unsigned ret = gl->gl_state;
+        struct gfs2_sbd *sdp = gl->gl_sbd;
 
         BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
 
@@ -29,7 +31,12 @@ static void gdlm_ast(void *arg)
 
         switch (gl->gl_lksb.sb_status) {
         case -DLM_EUNLOCK: /* Unlocked, so glock can be freed */
-                kmem_cache_free(gfs2_glock_cachep, gl);
+                if (gl->gl_ops->go_flags & GLOF_ASPACE)
+                        kmem_cache_free(gfs2_glock_aspace_cachep, gl);
+                else
+                        kmem_cache_free(gfs2_glock_cachep, gl);
+                if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+                        wake_up(&sdp->sd_glock_wait);
                 return;
         case -DLM_ECANCEL: /* Cancel while getting lock */
                 ret |= LM_OUT_CANCELED;
@@ -164,14 +171,16 @@ static unsigned int gdlm_lock(struct gfs2_glock *gl,
         return LM_OUT_ASYNC;
 }
 
-static void gdlm_put_lock(struct kmem_cache *cachep, void *ptr)
+static void gdlm_put_lock(struct kmem_cache *cachep, struct gfs2_glock *gl)
 {
-        struct gfs2_glock *gl = ptr;
-        struct lm_lockstruct *ls = &gl->gl_sbd->sd_lockstruct;
+        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
         int error;
 
         if (gl->gl_lksb.sb_lkid == 0) {
                 kmem_cache_free(cachep, gl);
+                if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+                        wake_up(&sdp->sd_glock_wait);
                 return;
         }
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 4511b08fc451..e5bf4b59d46e 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -417,7 +417,7 @@ static unsigned int calc_reserved(struct gfs2_sbd *sdp)
         databufhdrs_needed = (sdp->sd_log_commited_databuf +
                               (dbuf_limit - 1)) / dbuf_limit;
 
-        if (sdp->sd_log_commited_revoke)
+        if (sdp->sd_log_commited_revoke > 0)
                 revokes = gfs2_struct2blk(sdp, sdp->sd_log_commited_revoke,
                                           sizeof(u64));
 
@@ -790,7 +790,6 @@ static void log_refund(struct gfs2_sbd *sdp, struct gfs2_trans *tr)
         gfs2_assert_withdraw(sdp, (((int)sdp->sd_log_commited_buf) >= 0) ||
                              (((int)sdp->sd_log_commited_databuf) >= 0));
         sdp->sd_log_commited_revoke += tr->tr_num_revoke - tr->tr_num_revoke_rm;
-        gfs2_assert_withdraw(sdp, ((int)sdp->sd_log_commited_revoke) >= 0);
         reserved = calc_reserved(sdp);
         gfs2_assert_withdraw(sdp, sdp->sd_log_blks_reserved + tr->tr_reserved >= reserved);
         unused = sdp->sd_log_blks_reserved - reserved + tr->tr_reserved;
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index de97632ba32f..adc260fbea90 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -528,9 +528,9 @@ static void databuf_lo_add(struct gfs2_sbd *sdp, struct gfs2_log_element *le)
                 gfs2_pin(sdp, bd->bd_bh);
                 tr->tr_num_databuf_new++;
                 sdp->sd_log_num_databuf++;
-                list_add(&le->le_list, &sdp->sd_log_le_databuf);
+                list_add_tail(&le->le_list, &sdp->sd_log_le_databuf);
         } else {
-                list_add(&le->le_list, &sdp->sd_log_le_ordered);
+                list_add_tail(&le->le_list, &sdp->sd_log_le_ordered);
         }
 out:
         gfs2_log_unlock(sdp);
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index 5b31f7741a8f..a88fadc704bb 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -52,6 +52,22 @@ static void gfs2_init_glock_once(void *foo)
         atomic_set(&gl->gl_ail_count, 0);
 }
 
+static void gfs2_init_gl_aspace_once(void *foo)
+{
+        struct gfs2_glock *gl = foo;
+        struct address_space *mapping = (struct address_space *)(gl + 1);
+
+        gfs2_init_glock_once(gl);
+        memset(mapping, 0, sizeof(*mapping));
+        INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
+        spin_lock_init(&mapping->tree_lock);
+        spin_lock_init(&mapping->i_mmap_lock);
+        INIT_LIST_HEAD(&mapping->private_list);
+        spin_lock_init(&mapping->private_lock);
+        INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);
+        INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);
+}
+
 /**
  * init_gfs2_fs - Register GFS2 as a filesystem
  *
@@ -78,6 +94,14 @@ static int __init init_gfs2_fs(void)
         if (!gfs2_glock_cachep)
                 goto fail;
 
+        gfs2_glock_aspace_cachep = kmem_cache_create("gfs2_glock (aspace)",
+                                        sizeof(struct gfs2_glock) +
+                                        sizeof(struct address_space),
+                                        0, 0, gfs2_init_gl_aspace_once);
+
+        if (!gfs2_glock_aspace_cachep)
+                goto fail;
+
         gfs2_inode_cachep = kmem_cache_create("gfs2_inode",
                                               sizeof(struct gfs2_inode),
                                               0,  SLAB_RECLAIM_ACCOUNT|
@@ -144,6 +168,9 @@ fail:
         if (gfs2_inode_cachep)
                 kmem_cache_destroy(gfs2_inode_cachep);
 
+        if (gfs2_glock_aspace_cachep)
+                kmem_cache_destroy(gfs2_glock_aspace_cachep);
+
         if (gfs2_glock_cachep)
                 kmem_cache_destroy(gfs2_glock_cachep);
 
@@ -169,6 +196,7 @@ static void __exit exit_gfs2_fs(void)
         kmem_cache_destroy(gfs2_rgrpd_cachep);
         kmem_cache_destroy(gfs2_bufdata_cachep);
         kmem_cache_destroy(gfs2_inode_cachep);
+        kmem_cache_destroy(gfs2_glock_aspace_cachep);
         kmem_cache_destroy(gfs2_glock_cachep);
 
         gfs2_sys_uninit();
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index cb8d7a93d5ec..0bb12c80937a 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -93,49 +93,13 @@ static int gfs2_aspace_writepage(struct page *page, struct writeback_control *wb
         return err;
 }
 
-static const struct address_space_operations aspace_aops = {
+const struct address_space_operations gfs2_meta_aops = {
         .writepage = gfs2_aspace_writepage,
         .releasepage = gfs2_releasepage,
         .sync_page = block_sync_page,
 };
 
 /**
- * gfs2_aspace_get - Create and initialize a struct inode structure
- * @sdp: the filesystem the aspace is in
- *
- * Right now a struct inode is just a struct inode.  Maybe Linux
- * will supply a more lightweight address space construct (that works)
- * in the future.
- *
- * Make sure pages/buffers in this aspace aren't in high memory.
- *
- * Returns: the aspace
- */
-
-struct inode *gfs2_aspace_get(struct gfs2_sbd *sdp)
-{
-        struct inode *aspace;
-        struct gfs2_inode *ip;
-
-        aspace = new_inode(sdp->sd_vfs);
-        if (aspace) {
-                mapping_set_gfp_mask(aspace->i_mapping, GFP_NOFS);
-                aspace->i_mapping->a_ops = &aspace_aops;
-                aspace->i_size = ~0ULL;
-                ip = GFS2_I(aspace);
-                clear_bit(GIF_USER, &ip->i_flags);
-                insert_inode_hash(aspace);
-        }
-        return aspace;
-}
-
-void gfs2_aspace_put(struct inode *aspace)
-{
-        remove_inode_hash(aspace);
-        iput(aspace);
-}
-
-/**
  * gfs2_meta_sync - Sync all buffers associated with a glock
  * @gl: The glock
  *
@@ -143,7 +107,7 @@ void gfs2_aspace_put(struct inode *aspace)
 
 void gfs2_meta_sync(struct gfs2_glock *gl)
 {
-        struct address_space *mapping = gl->gl_aspace->i_mapping;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
         int error;
 
         filemap_fdatawrite(mapping);
@@ -164,7 +128,7 @@ void gfs2_meta_sync(struct gfs2_glock *gl)
 
 struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create)
 {
-        struct address_space *mapping = gl->gl_aspace->i_mapping;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct page *page;
         struct buffer_head *bh;
@@ -344,8 +308,10 @@ void gfs2_attach_bufdata(struct gfs2_glock *gl, struct buffer_head *bh,
 
 void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int meta)
 {
-        struct gfs2_sbd *sdp = GFS2_SB(bh->b_page->mapping->host);
+        struct address_space *mapping = bh->b_page->mapping;
+        struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct gfs2_bufdata *bd = bh->b_private;
+
         if (test_clear_buffer_pinned(bh)) {
                 list_del_init(&bd->bd_le.le_list);
                 if (meta) {
diff --git a/fs/gfs2/meta_io.h b/fs/gfs2/meta_io.h
index de270c2f9b63..6a1d9ba16411 100644
--- a/fs/gfs2/meta_io.h
+++ b/fs/gfs2/meta_io.h
@@ -37,8 +37,16 @@ static inline void gfs2_buffer_copy_tail(struct buffer_head *to_bh,
                0, from_head - to_head);
 }
 
-struct inode *gfs2_aspace_get(struct gfs2_sbd *sdp);
-void gfs2_aspace_put(struct inode *aspace);
+extern const struct address_space_operations gfs2_meta_aops;
+
+static inline struct gfs2_sbd *gfs2_mapping2sbd(struct address_space *mapping)
+{
+        struct inode *inode = mapping->host;
+        if (mapping->a_ops == &gfs2_meta_aops)
+                return (((struct gfs2_glock *)mapping) - 1)->gl_sbd;
+        else
+                return inode->i_sb->s_fs_info;
+}
 
 void gfs2_meta_sync(struct gfs2_glock *gl);
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index edfee24f3636..c1309ed1c496 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -65,7 +65,6 @@ static void gfs2_tune_init(struct gfs2_tune *gt)
         gt->gt_quota_scale_den = 1;
         gt->gt_new_files_jdata = 0;
         gt->gt_max_readahead = 1 << 18;
-        gt->gt_stall_secs = 600;
         gt->gt_complain_secs = 10;
 }
 
@@ -82,6 +81,8 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
 
         gfs2_tune_init(&sdp->sd_tune);
 
+        init_waitqueue_head(&sdp->sd_glock_wait);
+        atomic_set(&sdp->sd_glock_disposal, 0);
         spin_lock_init(&sdp->sd_statfs_spin);
 
         spin_lock_init(&sdp->sd_rindex_spin);
@@ -723,7 +724,7 @@ static int init_journal(struct gfs2_sbd *sdp, int undo)
                 goto fail;
         }
 
-        error = -EINVAL;
+        error = -EUSERS;
         if (!gfs2_jindex_size(sdp)) {
                 fs_err(sdp, "no journals!\n");
                 goto fail_jindex;
@@ -983,16 +984,24 @@ static const match_table_t nolock_tokens = {
         { Opt_err, NULL },
 };
 
+static void nolock_put_lock(struct kmem_cache *cachep, struct gfs2_glock *gl)
+{
+        struct gfs2_sbd *sdp = gl->gl_sbd;
+        kmem_cache_free(cachep, gl);
+        if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+                wake_up(&sdp->sd_glock_wait);
+}
+
 static const struct lm_lockops nolock_ops = {
         .lm_proto_name = "lock_nolock",
-        .lm_put_lock = kmem_cache_free,
+        .lm_put_lock = nolock_put_lock,
         .lm_tokens = &nolock_tokens,
 };
 
 /**
  * gfs2_lm_mount - mount a locking protocol
  * @sdp: the filesystem
- * @args: mount arguements
+ * @args: mount arguments
  * @silent: if 1, don't complain if the FS isn't a GFS2 fs
  *
  * Returns: errno
@@ -1231,10 +1240,9 @@ fail_sb:
 fail_locking:
         init_locking(sdp, &mount_gh, UNDO);
 fail_lm:
+        invalidate_inodes(sb);
         gfs2_gl_hash_clear(sdp);
         gfs2_lm_unmount(sdp);
-        while (invalidate_inodes(sb))
-                yield();
 fail_sys:
         gfs2_sys_fs_del(sdp);
 fail:
diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
index 247436c10deb..4e64352d49de 100644
--- a/fs/gfs2/ops_inode.c
+++ b/fs/gfs2/ops_inode.c
@@ -748,7 +748,7 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
         struct gfs2_rgrpd *nrgd;
         unsigned int num_gh;
         int dir_rename = 0;
-        int alloc_required;
+        int alloc_required = 0;
         unsigned int x;
         int error;
 
@@ -867,7 +867,9 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
                         goto out_gunlock;
         }
 
-        alloc_required = error = gfs2_diradd_alloc_required(ndir, &ndentry->d_name);
+        if (nip == NULL)
+                alloc_required = gfs2_diradd_alloc_required(ndir, &ndentry->d_name);
+        error = alloc_required;
         if (error < 0)
                 goto out_gunlock;
         error = 0;
@@ -974,121 +976,62 @@ out:
 }
 
 /**
- * gfs2_readlinki - return the contents of a symlink
- * @ip: the symlink's inode
- * @buf: a pointer to the buffer to be filled
- * @len: a pointer to the length of @buf
+ * gfs2_follow_link - Follow a symbolic link
+ * @dentry: The dentry of the link
+ * @nd: Data that we pass to vfs_follow_link()
  *
- * If @buf is too small, a piece of memory is kmalloc()ed and needs
- * to be freed by the caller.
+ * This can handle symlinks of any size.
  *
- * Returns: errno
+ * Returns: 0 on success or error code
  */
 
-static int gfs2_readlinki(struct gfs2_inode *ip, char **buf, unsigned int *len)
+static void *gfs2_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
+        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
         struct gfs2_holder i_gh;
         struct buffer_head *dibh;
         unsigned int x;
+        char *buf;
         int error;
 
         gfs2_holder_init(ip->i_gl, LM_ST_SHARED, 0, &i_gh);
         error = gfs2_glock_nq(&i_gh);
         if (error) {
                 gfs2_holder_uninit(&i_gh);
-                return error;
+                nd_set_link(nd, ERR_PTR(error));
+                return NULL;
         }
 
         if (!ip->i_disksize) {
                 gfs2_consist_inode(ip);
-                error = -EIO;
+                buf = ERR_PTR(-EIO);
                 goto out;
         }
 
         error = gfs2_meta_inode_buffer(ip, &dibh);
-        if (error)
+        if (error) {
+                buf = ERR_PTR(error);
                 goto out;
-
-        x = ip->i_disksize + 1;
-        if (x > *len) {
-                *buf = kmalloc(x, GFP_NOFS);
-                if (!*buf) {
-                        error = -ENOMEM;
-                        goto out_brelse;
-                }
         }
 
-        memcpy(*buf, dibh->b_data + sizeof(struct gfs2_dinode), x);
-        *len = x;
-
-out_brelse:
+        x = ip->i_disksize + 1;
+        buf = kmalloc(x, GFP_NOFS);
+        if (!buf)
+                buf = ERR_PTR(-ENOMEM);
+        else
+                memcpy(buf, dibh->b_data + sizeof(struct gfs2_dinode), x);
         brelse(dibh);
 out:
         gfs2_glock_dq_uninit(&i_gh);
-        return error;
-}
-
-/**
- * gfs2_readlink - Read the value of a symlink
- * @dentry: the symlink
- * @buf: the buffer to read the symlink data into
- * @size: the size of the buffer
- *
- * Returns: errno
- */
-
-static int gfs2_readlink(struct dentry *dentry, char __user *user_buf,
-                         int user_size)
-{
-        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
-        char array[GFS2_FAST_NAME_SIZE], *buf = array;
-        unsigned int len = GFS2_FAST_NAME_SIZE;
-        int error;
-
-        error = gfs2_readlinki(ip, &buf, &len);
-        if (error)
-                return error;
-
-        if (user_size > len - 1)
-                user_size = len - 1;
-
-        if (copy_to_user(user_buf, buf, user_size))
-                error = -EFAULT;
-        else
-                error = user_size;
-
-        if (buf != array)
-                kfree(buf);
-
-        return error;
+        nd_set_link(nd, buf);
+        return NULL;
 }
 
-/**
- * gfs2_follow_link - Follow a symbolic link
- * @dentry: The dentry of the link
- * @nd: Data that we pass to vfs_follow_link()
- *
- * This can handle symlinks of any size. It is optimised for symlinks
- * under GFS2_FAST_NAME_SIZE.
- *
- * Returns: 0 on success or error code
- */
-
-static void *gfs2_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
-        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
-        char array[GFS2_FAST_NAME_SIZE], *buf = array;
-        unsigned int len = GFS2_FAST_NAME_SIZE;
-        int error;
-
-        error = gfs2_readlinki(ip, &buf, &len);
-        if (!error) {
-                error = vfs_follow_link(nd, buf);
-                if (buf != array)
-                        kfree(buf);
-        }
-
-        return ERR_PTR(error);
+        char *s = nd_get_link(nd);
+        if (!IS_ERR(s))
+                kfree(s);
 }
 
 /**
@@ -1423,8 +1366,9 @@ const struct inode_operations gfs2_dir_iops = {
 };
 
 const struct inode_operations gfs2_symlink_iops = {
-        .readlink = gfs2_readlink,
+        .readlink = generic_readlink,
         .follow_link = gfs2_follow_link,
+        .put_link = gfs2_put_link,
         .permission = gfs2_permission,
         .setattr = gfs2_setattr,
         .getattr = gfs2_getattr,
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index e3bf6eab8750..6dbcbad6ab17 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -1083,7 +1083,7 @@ void gfs2_quota_change(struct gfs2_inode *ip, s64 change,
         }
 }
 
-int gfs2_quota_sync(struct super_block *sb, int type)
+int gfs2_quota_sync(struct super_block *sb, int type, int wait)
 {
         struct gfs2_sbd *sdp = sb->s_fs_info;
         struct gfs2_quota_data **qda;
@@ -1127,6 +1127,11 @@ int gfs2_quota_sync(struct super_block *sb, int type)
         return error;
 }
 
+static int gfs2_quota_sync_timeo(struct super_block *sb, int type)
+{
+        return gfs2_quota_sync(sb, type, 0);
+}
+
 int gfs2_quota_refresh(struct gfs2_sbd *sdp, int user, u32 id)
 {
         struct gfs2_quota_data *qd;
@@ -1382,7 +1387,7 @@ int gfs2_quotad(void *data)
                                            &tune->gt_statfs_quantum);
 
                 /* Update quota file */
-                quotad_check_timeo(sdp, "sync", gfs2_quota_sync, t,
+                quotad_check_timeo(sdp, "sync", gfs2_quota_sync_timeo, t,
                                    &quotad_timeo, &tune->gt_quota_quantum);
 
                 /* Check for & recover partially truncated inodes */
diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h
index e271fa07ad02..195f60c8bd14 100644
--- a/fs/gfs2/quota.h
+++ b/fs/gfs2/quota.h
@@ -25,7 +25,7 @@ extern int gfs2_quota_check(struct gfs2_inode *ip, u32 uid, u32 gid);
 extern void gfs2_quota_change(struct gfs2_inode *ip, s64 change,
                               u32 uid, u32 gid);
 
-extern int gfs2_quota_sync(struct super_block *sb, int type);
+extern int gfs2_quota_sync(struct super_block *sb, int type, int wait);
 extern int gfs2_quota_refresh(struct gfs2_sbd *sdp, int user, u32 id);
 
 extern int gfs2_quota_init(struct gfs2_sbd *sdp);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 0608f490c295..503b842f3ba2 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -591,11 +591,7 @@ static int gfs2_ri_update(struct gfs2_inode *ip)
         u64 rgrp_count = ip->i_disksize;
         int error;
 
-        if (do_div(rgrp_count, sizeof(struct gfs2_rindex))) {
-                gfs2_consist_inode(ip);
-                return -EIO;
-        }
-
+        do_div(rgrp_count, sizeof(struct gfs2_rindex));
         clear_rgrpdi(sdp);
 
         file_ra_state_init(&ra_state, inode->i_mapping);
@@ -915,7 +911,7 @@ void gfs2_rgrp_repolish_clones(struct gfs2_rgrpd *rgd)
 struct gfs2_alloc *gfs2_alloc_get(struct gfs2_inode *ip)
 {
         BUG_ON(ip->i_alloc != NULL);
-        ip->i_alloc = kzalloc(sizeof(struct gfs2_alloc), GFP_KERNEL);
+        ip->i_alloc = kzalloc(sizeof(struct gfs2_alloc), GFP_NOFS);
         return ip->i_alloc;
 }
 
diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h
index b4106ddaaa98..f07119d89557 100644
--- a/fs/gfs2/rgrp.h
+++ b/fs/gfs2/rgrp.h
@@ -10,6 +10,8 @@
 #ifndef __RGRP_DOT_H__
 #define __RGRP_DOT_H__
 
+#include <linux/slab.h>
+
 struct gfs2_rgrpd;
 struct gfs2_sbd;
 struct gfs2_holder;
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index c282ad41f3d1..50aac606b990 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -21,6 +21,8 @@
 #include <linux/gfs2_ondisk.h>
 #include <linux/crc32.h>
 #include <linux/time.h>
+#include <linux/wait.h>
+#include <linux/writeback.h>
 
 #include "gfs2.h"
 #include "incore.h"
@@ -710,7 +712,7 @@ void gfs2_unfreeze_fs(struct gfs2_sbd *sdp)
  * Returns: errno
  */
 
-static int gfs2_write_inode(struct inode *inode, int sync)
+static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
@@ -721,8 +723,7 @@ static int gfs2_write_inode(struct inode *inode, int sync)
         int ret = 0;
 
         /* Check this is a "normal" inode, etc */
-        if (!test_bit(GIF_USER, &ip->i_flags) ||
-            (current->flags & PF_MEMALLOC))
+        if (current->flags & PF_MEMALLOC)
                 return 0;
         ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         if (ret)
@@ -745,7 +746,7 @@ static int gfs2_write_inode(struct inode *inode, int sync)
 do_unlock:
         gfs2_glock_dq_uninit(&gh);
 do_flush:
-        if (sync != 0)
+        if (wbc->sync_mode == WB_SYNC_ALL)
                 gfs2_log_flush(GFS2_SB(inode), ip->i_gl);
         return ret;
 }
@@ -763,7 +764,7 @@ static int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
         int error;
 
         flush_workqueue(gfs2_delete_workqueue);
-        gfs2_quota_sync(sdp->sd_vfs, 0);
+        gfs2_quota_sync(sdp->sd_vfs, 0, 1);
         gfs2_statfs_sync(sdp->sd_vfs, 0);
 
         error = gfs2_glock_nq_init(sdp->sd_trans_gl, LM_ST_SHARED, GL_NOCACHE,
@@ -859,6 +860,7 @@ restart:
         gfs2_clear_rgrpd(sdp);
         gfs2_jindex_free(sdp);
         /*  Take apart glock structures and buffer lists  */
+        invalidate_inodes(sdp->sd_vfs);
         gfs2_gl_hash_clear(sdp);
         /*  Unmount the locking protocol  */
         gfs2_lm_unmount(sdp);
@@ -1193,7 +1195,7 @@ static void gfs2_drop_inode(struct inode *inode)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
 
-        if (test_bit(GIF_USER, &ip->i_flags) && inode->i_nlink) {
+        if (inode->i_nlink) {
                 struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
                 if (gl && test_bit(GLF_DEMOTE, &gl->gl_flags))
                         clear_nlink(inode);
@@ -1211,18 +1213,12 @@ static void gfs2_clear_inode(struct inode *inode)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
 
-        /* This tells us its a "real" inode and not one which only
-         * serves to contain an address space (see rgrp.c, meta_io.c)
-         * which therefore doesn't have its own glocks.
-         */
-        if (test_bit(GIF_USER, &ip->i_flags)) {
-                ip->i_gl->gl_object = NULL;
-                gfs2_glock_put(ip->i_gl);
-                ip->i_gl = NULL;
-                if (ip->i_iopen_gh.gh_gl) {
-                        ip->i_iopen_gh.gh_gl->gl_object = NULL;
-                        gfs2_glock_dq_uninit(&ip->i_iopen_gh);
-                }
+        ip->i_gl->gl_object = NULL;
+        gfs2_glock_put(ip->i_gl);
+        ip->i_gl = NULL;
+        if (ip->i_iopen_gh.gh_gl) {
+                ip->i_iopen_gh.gh_gl->gl_object = NULL;
+                gfs2_glock_dq_uninit(&ip->i_iopen_gh);
         }
 }
 
@@ -1357,9 +1353,6 @@ static void gfs2_delete_inode(struct inode *inode)
         struct gfs2_holder gh;
         int error;
 
-        if (!test_bit(GIF_USER, &ip->i_flags))
-                goto out;
-
         error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         if (unlikely(error)) {
                 gfs2_glock_dq_uninit(&ip->i_iopen_gh);
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 0dc34621f6a6..54fd98425991 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
 #include <linux/buffer_head.h>
@@ -49,7 +48,7 @@ static ssize_t gfs2_attr_store(struct kobject *kobj, struct attribute *attr,
         return a->store ? a->store(sdp, buf, len) : len;
 }
 
-static struct sysfs_ops gfs2_attr_ops = {
+static const struct sysfs_ops gfs2_attr_ops = {
         .show  = gfs2_attr_show,
         .store = gfs2_attr_store,
 };
@@ -167,7 +166,7 @@ static ssize_t quota_sync_store(struct gfs2_sbd *sdp, const char *buf,
         if (simple_strtol(buf, NULL, 0) != 1)
                 return -EINVAL;
 
-        gfs2_quota_sync(sdp->sd_vfs, 0);
+        gfs2_quota_sync(sdp->sd_vfs, 0, 1);
         return len;
 }
 
@@ -478,7 +477,6 @@ TUNE_ATTR(complain_secs, 0);
 TUNE_ATTR(statfs_slow, 0);
 TUNE_ATTR(new_files_jdata, 0);
 TUNE_ATTR(quota_simul_sync, 1);
-TUNE_ATTR(stall_secs, 1);
 TUNE_ATTR(statfs_quantum, 1);
 TUNE_ATTR_3(quota_scale, quota_scale_show, quota_scale_store);
 
@@ -491,7 +489,6 @@ static struct attribute *tune_attrs[] = {
         &tune_attr_complain_secs.attr,
         &tune_attr_statfs_slow.attr,
         &tune_attr_quota_simul_sync.attr,
-        &tune_attr_stall_secs.attr,
         &tune_attr_statfs_quantum.attr,
         &tune_attr_quota_scale.attr,
         &tune_attr_new_files_jdata.attr,
@@ -576,7 +573,7 @@ static int gfs2_uevent(struct kset *kset, struct kobject *kobj,
         return 0;
 }
 
-static struct kset_uevent_ops gfs2_uevent_ops = {
+static const struct kset_uevent_ops gfs2_uevent_ops = {
         .uevent = gfs2_uevent,
 };
 
diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c
index f6a7efa34eb9..53511291fe36 100644
--- a/fs/gfs2/util.c
+++ b/fs/gfs2/util.c
@@ -7,7 +7,6 @@
  * of the GNU General Public License version 2.
  */
 
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
 #include <linux/buffer_head.h>
@@ -21,6 +20,7 @@
 #include "util.h"
 
 struct kmem_cache *gfs2_glock_cachep __read_mostly;
+struct kmem_cache *gfs2_glock_aspace_cachep __read_mostly;
 struct kmem_cache *gfs2_inode_cachep __read_mostly;
 struct kmem_cache *gfs2_bufdata_cachep __read_mostly;
 struct kmem_cache *gfs2_rgrpd_cachep __read_mostly;
diff --git a/fs/gfs2/util.h b/fs/gfs2/util.h
index 33e96b0ce9ab..b432e04600de 100644
--- a/fs/gfs2/util.h
+++ b/fs/gfs2/util.h
@@ -145,6 +145,7 @@ gfs2_io_error_bh_i((sdp), (bh), __func__, __FILE__, __LINE__);
 
 
 extern struct kmem_cache *gfs2_glock_cachep;
+extern struct kmem_cache *gfs2_glock_aspace_cachep;
 extern struct kmem_cache *gfs2_inode_cachep;
 extern struct kmem_cache *gfs2_bufdata_cachep;
 extern struct kmem_cache *gfs2_rgrpd_cachep;
diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
index 8a04108e0c22..c2ebdf2c01d4 100644
--- a/fs/gfs2/xattr.c
+++ b/fs/gfs2/xattr.c
@@ -1296,6 +1296,7 @@ fail:
 
 int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
 {
+        struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
         struct gfs2_ea_location el;
         struct buffer_head *dibh;
         int error;
@@ -1305,16 +1306,17 @@ int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
                 return error;
 
         if (GFS2_EA_IS_STUFFED(el.el_ea)) {
-                error = gfs2_trans_begin(GFS2_SB(&ip->i_inode), RES_DINODE + RES_EATTR, 0);
-                if (error)
-                        return error;
-
-                gfs2_trans_add_bh(ip->i_gl, el.el_bh, 1);
-                memcpy(GFS2_EA2DATA(el.el_ea), data,
-                       GFS2_EA_DATA_LEN(el.el_ea));
-        } else
+                error = gfs2_trans_begin(sdp, RES_DINODE + RES_EATTR, 0);
+                if (error == 0) {
+                        gfs2_trans_add_bh(ip->i_gl, el.el_bh, 1);
+                        memcpy(GFS2_EA2DATA(el.el_ea), data,
+                               GFS2_EA_DATA_LEN(el.el_ea));
+                }
+        } else {
                 error = ea_acl_chmod_unstuffed(ip, el.el_ea, data);
+        }
 
+        brelse(el.el_bh);
         if (error)
                 return error;
 
@@ -1327,8 +1329,7 @@ int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
                 brelse(dibh);
         }
 
-        gfs2_trans_end(GFS2_SB(&ip->i_inode));
-
+        gfs2_trans_end(sdp);
         return error;
 }
 
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index 0d200068d0af..cdb41a1f6a64 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 
 #include "btree.h"
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 052f214ea6f0..38a0a9917d7f 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/log2.h>
 
 #include "btree.h"
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index 052387e11671..fe35e3b626c4 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -188,7 +188,7 @@ extern const struct address_space_operations hfs_btree_aops;
 
 extern struct inode *hfs_new_inode(struct inode *, struct qstr *, int);
 extern void hfs_inode_write_fork(struct inode *, struct hfs_extent *, __be32 *, __be32 *);
-extern int hfs_write_inode(struct inode *, int);
+extern int hfs_write_inode(struct inode *, struct writeback_control *);
 extern int hfs_inode_setattr(struct dentry *, struct iattr *);
 extern void hfs_inode_read_fork(struct inode *inode, struct hfs_extent *ext,
                         __be32 log_size, __be32 phys_size, u32 clump_size);
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index a1cbff2b4d99..14f5cb1b9fdc 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -381,7 +381,7 @@ void hfs_inode_write_fork(struct inode *inode, struct hfs_extent *ext,
                                          HFS_SB(inode->i_sb)->alloc_blksz);
 }
 
-int hfs_write_inode(struct inode *inode, int unused)
+int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct inode *main_inode = inode;
         struct hfs_find_data fd;
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 8bbe03c3f6d5..86428f5ac991 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -11,6 +11,7 @@
 #include <linux/cdrom.h>
 #include <linux/genhd.h>
 #include <linux/nls.h>
+#include <linux/slab.h>
 
 #include "hfs_fs.h"
 #include "btree.h"
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 5ed7252b7b23..0a81eb7111f3 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -19,6 +19,7 @@
 #include <linux/nls.h>
 #include <linux/parser.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/vfs.h>
 
diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
index 3fcbb0e1f6fc..572628b4b07d 100644
--- a/fs/hfsplus/options.c
+++ b/fs/hfsplus/options.c
@@ -15,6 +15,7 @@
 #include <linux/nls.h>
 #include <linux/mount.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "hfsplus_fs.h"
 
 enum {
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 43022f3d5148..74b473a8ef92 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -87,7 +87,8 @@ bad_inode:
         return ERR_PTR(err);
 }
 
-static int hfsplus_write_inode(struct inode *inode, int unused)
+static int hfsplus_write_inode(struct inode *inode,
+                struct writeback_control *wbc)
 {
         struct hfsplus_vh *vhdr;
         int ret = 0;
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 032604e5ef2c..3a029d8f4cf1 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -11,6 +11,7 @@
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/statfs.h>
+#include <linux/slab.h>
 #include <linux/seq_file.h>
 #include <linux/mount.h>
 #include "hostfs.h"
diff --git a/fs/hpfs/anode.c b/fs/hpfs/anode.c
index 1aa88c4e0964..6a2f04bf3df0 100644
--- a/fs/hpfs/anode.c
+++ b/fs/hpfs/anode.c
@@ -353,7 +353,7 @@ int hpfs_ea_read(struct super_block *s, secno a, int ano, unsigned pos,
 }
 
 int hpfs_ea_write(struct super_block *s, secno a, int ano, unsigned pos,
-             unsigned len, char *buf)
+             unsigned len, const char *buf)
 {
         struct buffer_head *bh;
         char *data;
diff --git a/fs/hpfs/buffer.c b/fs/hpfs/buffer.c
index b6fca543544c..eac5f96323e3 100644
--- a/fs/hpfs/buffer.c
+++ b/fs/hpfs/buffer.c
@@ -6,6 +6,7 @@
  *  general buffer i/o
  */
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include "hpfs_fn.h"
 
 void hpfs_lock_creation(struct super_block *s)
diff --git a/fs/hpfs/dentry.c b/fs/hpfs/dentry.c
index 940d6d150bee..67d9d36b3d5f 100644
--- a/fs/hpfs/dentry.c
+++ b/fs/hpfs/dentry.c
@@ -20,8 +20,8 @@ static int hpfs_hash_dentry(struct dentry *dentry, struct qstr *qstr)
 
         if (l == 1) if (qstr->name[0]=='.') goto x;
         if (l == 2) if (qstr->name[0]=='.' || qstr->name[1]=='.') goto x;
-        hpfs_adjust_length((char *)qstr->name, &l);
-        /*if (hpfs_chk_name((char *)qstr->name,&l))*/
+        hpfs_adjust_length(qstr->name, &l);
+        /*if (hpfs_chk_name(qstr->name,&l))*/
                 /*return -ENAMETOOLONG;*/
                 /*return -ENOENT;*/
         x:
@@ -38,14 +38,16 @@ static int hpfs_compare_dentry(struct dentry *dentry, struct qstr *a, struct qst
 {
         unsigned al=a->len;
         unsigned bl=b->len;
-        hpfs_adjust_length((char *)a->name, &al);
-        /*hpfs_adjust_length((char *)b->name, &bl);*/
+        hpfs_adjust_length(a->name, &al);
+        /*hpfs_adjust_length(b->name, &bl);*/
         /* 'a' is the qstr of an already existing dentry, so the name
          * must be valid. 'b' must be validated first.
          */
 
-        if (hpfs_chk_name((char *)b->name, &bl)) return 1;
-        if (hpfs_compare_names(dentry->d_sb, (char *)a->name, al, (char *)b->name, bl, 0)) return 1;
+        if (hpfs_chk_name(b->name, &bl))
+                return 1;
+        if (hpfs_compare_names(dentry->d_sb, a->name, al, b->name, bl, 0))
+                return 1;
         return 0;
 }
 
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 8865c94f55f6..2338130cceba 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include "hpfs_fn.h"
 
 static int hpfs_dir_release(struct inode *inode, struct file *filp)
@@ -59,7 +60,7 @@ static int hpfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         struct hpfs_dirent *de;
         int lc;
         long old_pos;
-        char *tempname;
+        unsigned char *tempname;
         int c1, c2 = 0;
         int ret = 0;
 
@@ -158,11 +159,11 @@ static int hpfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 tempname = hpfs_translate_name(inode->i_sb, de->name, de->namelen, lc, de->not_8x3);
                 if (filldir(dirent, tempname, de->namelen, old_pos, de->fnode, DT_UNKNOWN) < 0) {
                         filp->f_pos = old_pos;
-                        if (tempname != (char *)de->name) kfree(tempname);
+                        if (tempname != de->name) kfree(tempname);
                         hpfs_brelse4(&qbh);
                         goto out;
                 }
-                if (tempname != (char *)de->name) kfree(tempname);
+                if (tempname != de->name) kfree(tempname);
                 hpfs_brelse4(&qbh);
         }
 out:
@@ -187,7 +188,7 @@ out:
 
 struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh;
         struct hpfs_dirent *de;
@@ -197,7 +198,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
         struct hpfs_inode_info *hpfs_result;
 
         lock_kernel();
-        if ((err = hpfs_chk_name((char *)name, &len))) {
+        if ((err = hpfs_chk_name(name, &len))) {
                 if (err == -ENAMETOOLONG) {
                         unlock_kernel();
                         return ERR_PTR(-ENAMETOOLONG);
@@ -209,7 +210,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
          * '.' and '..' will never be passed here.
          */
 
-        de = map_dirent(dir, hpfs_i(dir)->i_dno, (char *) name, len, NULL, &qbh);
+        de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, NULL, &qbh);
 
         /*
          * This is not really a bailout, just means file not found.
@@ -250,7 +251,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
         hpfs_result = hpfs_i(result);
         if (!de->directory) hpfs_result->i_parent_dir = dir->i_ino;
 
-        hpfs_decide_conv(result, (char *)name, len);
+        hpfs_decide_conv(result, name, len);
 
         if (de->has_acl || de->has_xtd_perm) if (!(dir->i_sb->s_flags & MS_RDONLY)) {
                 hpfs_error(result->i_sb, "ACLs or XPERM found. This is probably HPFS386. This driver doesn't support it now. Send me some info on these structures");
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index fe83c2b7d2d8..9b2ffadfc8c4 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -158,7 +158,8 @@ static void set_last_pointer(struct super_block *s, struct dnode *d, dnode_secno
 
 /* Add an entry to dnode and don't care if it grows over 2048 bytes */
 
-struct hpfs_dirent *hpfs_add_de(struct super_block *s, struct dnode *d, unsigned char *name,
+struct hpfs_dirent *hpfs_add_de(struct super_block *s, struct dnode *d,
+                                const unsigned char *name,
                                 unsigned namelen, secno down_ptr)
 {
         struct hpfs_dirent *de;
@@ -223,7 +224,7 @@ static void fix_up_ptrs(struct super_block *s, struct dnode *d)
 /* Add an entry to dnode and do dnode splitting if required */
 
 static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
-                             unsigned char *name, unsigned namelen,
+                             const unsigned char *name, unsigned namelen,
                              struct hpfs_dirent *new_de, dnode_secno down_ptr)
 {
         struct quad_buffer_head qbh, qbh1, qbh2;
@@ -231,7 +232,7 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
         dnode_secno adno, rdno;
         struct hpfs_dirent *de;
         struct hpfs_dirent nde;
-        char *nname;
+        unsigned char *nname;
         int h;
         int pos;
         struct buffer_head *bh;
@@ -305,7 +306,9 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
                 pos++;
         }
         copy_de(new_de = &nde, de);
-        memcpy(name = nname, de->name, namelen = de->namelen);
+        memcpy(nname, de->name, de->namelen);
+        name = nname;
+        namelen = de->namelen;
         for_all_poss(i, hpfs_pos_subst, ((loff_t)dno << 4) | pos, 4);
         down_ptr = adno;
         set_last_pointer(i->i_sb, ad, de->down ? de_down_pointer(de) : 0);
@@ -368,7 +371,8 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
  * I hope, now it's finally bug-free.
  */
 
-int hpfs_add_dirent(struct inode *i, unsigned char *name, unsigned namelen,
+int hpfs_add_dirent(struct inode *i,
+                    const unsigned char *name, unsigned namelen,
                     struct hpfs_dirent *new_de, int cdepth)
 {
         struct hpfs_inode_info *hpfs_inode = hpfs_i(i);
@@ -897,7 +901,8 @@ struct hpfs_dirent *map_pos_dirent(struct inode *inode, loff_t *posp,
 
 /* Find a dirent in tree */
 
-struct hpfs_dirent *map_dirent(struct inode *inode, dnode_secno dno, char *name, unsigned len,
+struct hpfs_dirent *map_dirent(struct inode *inode, dnode_secno dno,
+                               const unsigned char *name, unsigned len,
                                dnode_secno *dd, struct quad_buffer_head *qbh)
 {
         struct dnode *dnode;
@@ -988,8 +993,8 @@ void hpfs_remove_dtree(struct super_block *s, dnode_secno dno)
 struct hpfs_dirent *map_fnode_dirent(struct super_block *s, fnode_secno fno,
                                      struct fnode *f, struct quad_buffer_head *qbh)
 {
-        char *name1;
-        char *name2;
+        unsigned char *name1;
+        unsigned char *name2;
         int name1len, name2len;
         struct dnode *d;
         dnode_secno dno, downd;
diff --git a/fs/hpfs/ea.c b/fs/hpfs/ea.c
index 547a8384571f..45e53d972b42 100644
--- a/fs/hpfs/ea.c
+++ b/fs/hpfs/ea.c
@@ -62,8 +62,8 @@ static char *get_indirect_ea(struct super_block *s, int ano, secno a, int size)
         return ret;
 }
 
-static void set_indirect_ea(struct super_block *s, int ano, secno a, char *data,
-                            int size)
+static void set_indirect_ea(struct super_block *s, int ano, secno a,
+                            const char *data, int size)
 {
         hpfs_ea_write(s, a, ano, 0, size, data);
 }
@@ -186,7 +186,8 @@ char *hpfs_get_ea(struct super_block *s, struct fnode *fnode, char *key, int *si
  * This driver can't change sizes of eas ('cause I just don't need it).
  */
 
-void hpfs_set_ea(struct inode *inode, struct fnode *fnode, char *key, char *data, int size)
+void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
+                 const char *data, int size)
 {
         fnode_secno fno = inode->i_ino;
         struct super_block *s = inode->i_sb;
diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
index 701ca54c0867..97bf738cd5d6 100644
--- a/fs/hpfs/hpfs_fn.h
+++ b/fs/hpfs/hpfs_fn.h
@@ -215,7 +215,7 @@ secno hpfs_bplus_lookup(struct super_block *, struct inode *, struct bplus_heade
 secno hpfs_add_sector_to_btree(struct super_block *, secno, int, unsigned);
 void hpfs_remove_btree(struct super_block *, struct bplus_header *);
 int hpfs_ea_read(struct super_block *, secno, int, unsigned, unsigned, char *);
-int hpfs_ea_write(struct super_block *, secno, int, unsigned, unsigned, char *);
+int hpfs_ea_write(struct super_block *, secno, int, unsigned, unsigned, const char *);
 void hpfs_ea_remove(struct super_block *, secno, int, unsigned);
 void hpfs_truncate_btree(struct super_block *, secno, int, unsigned);
 void hpfs_remove_fnode(struct super_block *, fnode_secno fno);
@@ -244,13 +244,17 @@ extern const struct file_operations hpfs_dir_ops;
 
 void hpfs_add_pos(struct inode *, loff_t *);
 void hpfs_del_pos(struct inode *, loff_t *);
-struct hpfs_dirent *hpfs_add_de(struct super_block *, struct dnode *, unsigned char *, unsigned, secno);
-int hpfs_add_dirent(struct inode *, unsigned char *, unsigned, struct hpfs_dirent *, int);
+struct hpfs_dirent *hpfs_add_de(struct super_block *, struct dnode *,
+                                const unsigned char *, unsigned, secno);
+int hpfs_add_dirent(struct inode *, const unsigned char *, unsigned,
+                    struct hpfs_dirent *, int);
 int hpfs_remove_dirent(struct inode *, dnode_secno, struct hpfs_dirent *, struct quad_buffer_head *, int);
 void hpfs_count_dnodes(struct super_block *, dnode_secno, int *, int *, int *);
 dnode_secno hpfs_de_as_down_as_possible(struct super_block *, dnode_secno dno);
 struct hpfs_dirent *map_pos_dirent(struct inode *, loff_t *, struct quad_buffer_head *);
-struct hpfs_dirent *map_dirent(struct inode *, dnode_secno, char *, unsigned, dnode_secno *, struct quad_buffer_head *);
+struct hpfs_dirent *map_dirent(struct inode *, dnode_secno,
+                               const unsigned char *, unsigned, dnode_secno *,
+                               struct quad_buffer_head *);
 void hpfs_remove_dtree(struct super_block *, dnode_secno);
 struct hpfs_dirent *map_fnode_dirent(struct super_block *, fnode_secno, struct fnode *, struct quad_buffer_head *);
 
@@ -259,7 +263,8 @@ struct hpfs_dirent *map_fnode_dirent(struct super_block *, fnode_secno, struct f
 void hpfs_ea_ext_remove(struct super_block *, secno, int, unsigned);
 int hpfs_read_ea(struct super_block *, struct fnode *, char *, char *, int);
 char *hpfs_get_ea(struct super_block *, struct fnode *, char *, int *);
-void hpfs_set_ea(struct inode *, struct fnode *, char *, char *, int);
+void hpfs_set_ea(struct inode *, struct fnode *, const char *,
+                 const char *, int);
 
 /* file.c */
 
@@ -282,7 +287,7 @@ void hpfs_delete_inode(struct inode *);
 
 unsigned *hpfs_map_dnode_bitmap(struct super_block *, struct quad_buffer_head *);
 unsigned *hpfs_map_bitmap(struct super_block *, unsigned, struct quad_buffer_head *, char *);
-char *hpfs_load_code_page(struct super_block *, secno);
+unsigned char *hpfs_load_code_page(struct super_block *, secno);
 secno *hpfs_load_bitmap_directory(struct super_block *, secno bmp);
 struct fnode *hpfs_map_fnode(struct super_block *s, ino_t, struct buffer_head **);
 struct anode *hpfs_map_anode(struct super_block *s, anode_secno, struct buffer_head **);
@@ -292,12 +297,13 @@ dnode_secno hpfs_fnode_dno(struct super_block *s, ino_t ino);
 /* name.c */
 
 unsigned char hpfs_upcase(unsigned char *, unsigned char);
-int hpfs_chk_name(unsigned char *, unsigned *);
-char *hpfs_translate_name(struct super_block *, unsigned char *, unsigned, int, int);
-int hpfs_compare_names(struct super_block *, unsigned char *, unsigned, unsigned char *, unsigned, int);
-int hpfs_is_name_long(unsigned char *, unsigned);
-void hpfs_adjust_length(unsigned char *, unsigned *);
-void hpfs_decide_conv(struct inode *, unsigned char *, unsigned);
+int hpfs_chk_name(const unsigned char *, unsigned *);
+unsigned char *hpfs_translate_name(struct super_block *, unsigned char *, unsigned, int, int);
+int hpfs_compare_names(struct super_block *, const unsigned char *, unsigned,
+                       const unsigned char *, unsigned, int);
+int hpfs_is_name_long(const unsigned char *, unsigned);
+void hpfs_adjust_length(const unsigned char *, unsigned *);
+void hpfs_decide_conv(struct inode *, const unsigned char *, unsigned);
 
 /* namei.c */
 
diff --git a/fs/hpfs/inode.c b/fs/hpfs/inode.c
index fe703ae46bc7..1042a9bc97f3 100644
--- a/fs/hpfs/inode.c
+++ b/fs/hpfs/inode.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include "hpfs_fn.h"
 
 void hpfs_init_inode(struct inode *i)
@@ -46,7 +47,7 @@ void hpfs_read_inode(struct inode *i)
         struct fnode *fnode;
         struct super_block *sb = i->i_sb;
         struct hpfs_inode_info *hpfs_inode = hpfs_i(i);
-        unsigned char *ea;
+        void *ea;
         int ea_size;
 
         if (!(fnode = hpfs_map_fnode(sb, i->i_ino, &bh))) {
@@ -112,7 +113,7 @@ void hpfs_read_inode(struct inode *i)
                 }
         }
         if (fnode->dirflag) {
-                unsigned n_dnodes, n_subdirs;
+                int n_dnodes, n_subdirs;
                 i->i_mode |= S_IFDIR;
                 i->i_op = &hpfs_dir_iops;
                 i->i_fop = &hpfs_dir_ops;
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index c4724589b2eb..840d033ecee8 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -35,7 +35,7 @@ unsigned int *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
  * lowercasing table
  */
 
-char *hpfs_load_code_page(struct super_block *s, secno cps)
+unsigned char *hpfs_load_code_page(struct super_block *s, secno cps)
 {
         struct buffer_head *bh;
         secno cpds;
@@ -71,7 +71,7 @@ char *hpfs_load_code_page(struct super_block *s, secno cps)
                 brelse(bh);
                 return NULL;
         }
-        ptr = (char *)cpd + cpd->offs[cpi] + 6;
+        ptr = (unsigned char *)cpd + cpd->offs[cpi] + 6;
         if (!(cp_table = kmalloc(256, GFP_KERNEL))) {
                 printk("HPFS: out of memory for code page table\n");
                 brelse(bh);
@@ -217,7 +217,7 @@ struct dnode *hpfs_map_dnode(struct super_block *s, unsigned secno,
         if ((dnode = hpfs_map_4sectors(s, secno, qbh, DNODE_RD_AHEAD)))
                 if (hpfs_sb(s)->sb_chk) {
                         unsigned p, pp = 0;
-                        unsigned char *d = (char *)dnode;
+                        unsigned char *d = (unsigned char *)dnode;
                         int b = 0;
                         if (dnode->magic != DNODE_MAGIC) {
                                 hpfs_error(s, "bad magic on dnode %08x", secno);
diff --git a/fs/hpfs/name.c b/fs/hpfs/name.c
index 1f4a964384eb..f24736d7a439 100644
--- a/fs/hpfs/name.c
+++ b/fs/hpfs/name.c
@@ -8,16 +8,16 @@
 
 #include "hpfs_fn.h"
 
-static char *text_postfix[]={
+static const char *text_postfix[]={
 ".ASM", ".BAS", ".BAT", ".C", ".CC", ".CFG", ".CMD", ".CON", ".CPP", ".DEF",
 ".DOC", ".DPR", ".ERX", ".H", ".HPP", ".HTM", ".HTML", ".JAVA", ".LOG", ".PAS",
 ".RC", ".TEX", ".TXT", ".Y", ""};
 
-static char *text_prefix[]={
+static const char *text_prefix[]={
 "AUTOEXEC.", "CHANGES", "COPYING", "CONFIG.", "CREDITS", "FAQ", "FILE_ID.DIZ",
 "MAKEFILE", "READ.ME", "README", "TERMCAP", ""};
 
-void hpfs_decide_conv(struct inode *inode, unsigned char *name, unsigned len)
+void hpfs_decide_conv(struct inode *inode, const unsigned char *name, unsigned len)
 {
         struct hpfs_inode_info *hpfs_inode = hpfs_i(inode);
         int i;
@@ -71,7 +71,7 @@ static inline unsigned char locase(unsigned char *dir, unsigned char a)
         return dir[a];
 }
 
-int hpfs_chk_name(unsigned char *name, unsigned *len)
+int hpfs_chk_name(const unsigned char *name, unsigned *len)
 {
         int i;
         if (*len > 254) return -ENAMETOOLONG;
@@ -83,10 +83,10 @@ int hpfs_chk_name(unsigned char *name, unsigned *len)
         return 0;
 }
 
-char *hpfs_translate_name(struct super_block *s, unsigned char *from,
+unsigned char *hpfs_translate_name(struct super_block *s, unsigned char *from,
                           unsigned len, int lc, int lng)
 {
-        char *to;
+        unsigned char *to;
         int i;
         if (hpfs_sb(s)->sb_chk >= 2) if (hpfs_is_name_long(from, len) != lng) {
                 printk("HPFS: Long name flag mismatch - name ");
@@ -103,8 +103,9 @@ char *hpfs_translate_name(struct super_block *s, unsigned char *from,
         return to;
 }
 
-int hpfs_compare_names(struct super_block *s, unsigned char *n1, unsigned l1,
-                       unsigned char *n2, unsigned l2, int last)
+int hpfs_compare_names(struct super_block *s,
+                       const unsigned char *n1, unsigned l1,
+                       const unsigned char *n2, unsigned l2, int last)
 {
         unsigned l = l1 < l2 ? l1 : l2;
         unsigned i;
@@ -120,7 +121,7 @@ int hpfs_compare_names(struct super_block *s, unsigned char *n1, unsigned l1,
         return 0;
 }
 
-int hpfs_is_name_long(unsigned char *name, unsigned len)
+int hpfs_is_name_long(const unsigned char *name, unsigned len)
 {
         int i,j;
         for (i = 0; i < len && name[i] != '.'; i++)
@@ -134,7 +135,7 @@ int hpfs_is_name_long(unsigned char *name, unsigned len)
 
 /* OS/2 clears dots and spaces at the end of file name, so we have to */
 
-void hpfs_adjust_length(unsigned char *name, unsigned *len)
+void hpfs_adjust_length(const unsigned char *name, unsigned *len)
 {
         if (!*len) return;
         if (*len == 1 && name[0] == '.') return;
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 82b9c4ba9ed0..11c2b4080f65 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -11,7 +11,7 @@
 
 static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh0;
         struct buffer_head *bh;
@@ -24,7 +24,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         int r;
         struct hpfs_dirent dee;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len))) return err==-ENOENT ? -EINVAL : err;
+        if ((err = hpfs_chk_name(name, &len))) return err==-ENOENT ? -EINVAL : err;
         lock_kernel();
         err = -ENOSPC;
         fnode = hpfs_alloc_fnode(dir->i_sb, hpfs_i(dir)->i_dno, &fno, &bh);
@@ -62,7 +62,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
                 result->i_mode &= ~0222;
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail3;
         if (r == -1) {
@@ -121,7 +121,7 @@ bail:
 
 static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struct nameidata *nd)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct inode *result = NULL;
         struct buffer_head *bh;
@@ -130,7 +130,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         int r;
         struct hpfs_dirent dee;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len)))
+        if ((err = hpfs_chk_name(name, &len)))
                 return err==-ENOENT ? -EINVAL : err;
         lock_kernel();
         err = -ENOSPC;
@@ -155,7 +155,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         result->i_op = &hpfs_file_iops;
         result->i_fop = &hpfs_file_ops;
         result->i_nlink = 1;
-        hpfs_decide_conv(result, (char *)name, len);
+        hpfs_decide_conv(result, name, len);
         hpfs_i(result)->i_parent_dir = dir->i_ino;
         result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, dee.creation_date);
         result->i_ctime.tv_nsec = 0;
@@ -170,7 +170,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         hpfs_i(result)->mmu_private = 0;
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -211,7 +211,7 @@ bail:
 
 static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t rdev)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct buffer_head *bh;
         struct fnode *fnode;
@@ -220,7 +220,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         struct hpfs_dirent dee;
         struct inode *result = NULL;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len))) return err==-ENOENT ? -EINVAL : err;
+        if ((err = hpfs_chk_name(name, &len))) return err==-ENOENT ? -EINVAL : err;
         if (hpfs_sb(dir->i_sb)->sb_eas < 2) return -EPERM;
         if (!new_valid_dev(rdev))
                 return -EINVAL;
@@ -256,7 +256,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         init_special_inode(result, mode, rdev);
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -289,7 +289,7 @@ bail:
 
 static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *symlink)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct buffer_head *bh;
         struct fnode *fnode;
@@ -298,7 +298,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         struct hpfs_dirent dee;
         struct inode *result;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len))) return err==-ENOENT ? -EINVAL : err;
+        if ((err = hpfs_chk_name(name, &len))) return err==-ENOENT ? -EINVAL : err;
         lock_kernel();
         if (hpfs_sb(dir->i_sb)->sb_eas < 2) {
                 unlock_kernel();
@@ -335,7 +335,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         result->i_data.a_ops = &hpfs_symlink_aops;
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -345,7 +345,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         fnode->len = len;
         memcpy(fnode->name, name, len > 15 ? 15 : len);
         fnode->up = dir->i_ino;
-        hpfs_set_ea(result, fnode, "SYMLINK", (char *)symlink, strlen(symlink));
+        hpfs_set_ea(result, fnode, "SYMLINK", symlink, strlen(symlink));
         mark_buffer_dirty(bh);
         brelse(bh);
 
@@ -369,7 +369,7 @@ bail:
 
 static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh;
         struct hpfs_dirent *de;
@@ -381,12 +381,12 @@ static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
         int err;
 
         lock_kernel();
-        hpfs_adjust_length((char *)name, &len);
+        hpfs_adjust_length(name, &len);
 again:
         mutex_lock(&hpfs_i(inode)->i_parent_mutex);
         mutex_lock(&hpfs_i(dir)->i_mutex);
         err = -ENOENT;
-        de = map_dirent(dir, hpfs_i(dir)->i_dno, (char *)name, len, &dno, &qbh);
+        de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
         if (!de)
                 goto out;
 
@@ -413,22 +413,25 @@ again:
 
                 mutex_unlock(&hpfs_i(dir)->i_mutex);
                 mutex_unlock(&hpfs_i(inode)->i_parent_mutex);
-                d_drop(dentry);
-                spin_lock(&dentry->d_lock);
-                if (atomic_read(&dentry->d_count) > 1 ||
-                    generic_permission(inode, MAY_WRITE, NULL) ||
+                dentry_unhash(dentry);
+                if (!d_unhashed(dentry)) {
+                        dput(dentry);
+                        unlock_kernel();
+                        return -ENOSPC;
+                }
+                if (generic_permission(inode, MAY_WRITE, NULL) ||
                     !S_ISREG(inode->i_mode) ||
                     get_write_access(inode)) {
-                        spin_unlock(&dentry->d_lock);
                         d_rehash(dentry);
+                        dput(dentry);
                 } else {
                         struct iattr newattrs;
-                        spin_unlock(&dentry->d_lock);
                         /*printk("HPFS: truncating file before delete.\n");*/
                         newattrs.ia_size = 0;
                         newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
                         err = notify_change(dentry, &newattrs);
                         put_write_access(inode);
+                        dput(dentry);
                         if (!err)
                                 goto again;
                 }
@@ -451,7 +454,7 @@ out:
 
 static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh;
         struct hpfs_dirent *de;
@@ -462,12 +465,12 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
         int err;
         int r;
 
-        hpfs_adjust_length((char *)name, &len);
+        hpfs_adjust_length(name, &len);
         lock_kernel();
         mutex_lock(&hpfs_i(inode)->i_parent_mutex);
         mutex_lock(&hpfs_i(dir)->i_mutex);
         err = -ENOENT;
-        de = map_dirent(dir, hpfs_i(dir)->i_dno, (char *)name, len, &dno, &qbh);
+        de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
         if (!de)
                 goto out;
 
@@ -546,10 +549,10 @@ const struct address_space_operations hpfs_symlink_aops = {
 static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 struct inode *new_dir, struct dentry *new_dentry)
 {
-        char *old_name = (char *)old_dentry->d_name.name;
-        int old_len = old_dentry->d_name.len;
-        char *new_name = (char *)new_dentry->d_name.name;
-        int new_len = new_dentry->d_name.len;
+        const unsigned char *old_name = old_dentry->d_name.name;
+        unsigned old_len = old_dentry->d_name.len;
+        const unsigned char *new_name = new_dentry->d_name.name;
+        unsigned new_len = new_dentry->d_name.len;
         struct inode *i = old_dentry->d_inode;
         struct inode *new_inode = new_dentry->d_inode;
         struct quad_buffer_head qbh, qbh1;
@@ -560,9 +563,9 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct buffer_head *bh;
         struct fnode *fnode;
         int err;
-        if ((err = hpfs_chk_name((char *)new_name, &new_len))) return err;
+        if ((err = hpfs_chk_name(new_name, &new_len))) return err;
         err = 0;
-        hpfs_adjust_length((char *)old_name, &old_len);
+        hpfs_adjust_length(old_name, &old_len);
 
         lock_kernel();
         /* order doesn't matter, due to VFS exclusion */
@@ -579,7 +582,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 goto end1;
         }
 
-        if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, (char *)old_name, old_len, &dno, &qbh))) {
+        if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, old_name, old_len, &dno, &qbh))) {
                 hpfs_error(i->i_sb, "lookup succeeded but map dirent failed");
                 err = -ENOENT;
                 goto end1;
@@ -590,7 +593,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (new_inode) {
                 int r;
                 if ((r = hpfs_remove_dirent(old_dir, dno, dep, &qbh, 1)) != 2) {
-                        if ((nde = map_dirent(new_dir, hpfs_i(new_dir)->i_dno, (char *)new_name, new_len, NULL, &qbh1))) {
+                        if ((nde = map_dirent(new_dir, hpfs_i(new_dir)->i_dno, new_name, new_len, NULL, &qbh1))) {
                                 clear_nlink(new_inode);
                                 copy_de(nde, &de);
                                 memcpy(nde->name, new_name, new_len);
@@ -618,7 +621,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         }
         
         if (new_dir == old_dir)
-                if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, (char *)old_name, old_len, &dno, &qbh))) {
+                if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, old_name, old_len, &dno, &qbh))) {
                         hpfs_unlock_creation(i->i_sb);
                         hpfs_error(i->i_sb, "lookup succeeded but map dirent failed at #2");
                         err = -ENOENT;
@@ -648,7 +651,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 brelse(bh);
         }
         hpfs_i(i)->i_conv = hpfs_sb(i->i_sb)->sb_conv;
-        hpfs_decide_conv(i, (char *)new_name, new_len);
+        hpfs_decide_conv(i, new_name, new_len);
 end1:
         if (old_dir != new_dir)
                 mutex_unlock(&hpfs_i(new_dir)->i_mutex);
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index cadc4ce48656..aa53842c599c 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -15,6 +15,7 @@
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/bitmap.h>
+#include <linux/slab.h>
 
 /* Mark the filesystem dirty, so that chkdsk checks it when os/2 booted */
 
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index a5089a6dd67a..2e4dfa8593da 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -646,22 +646,27 @@ static const struct super_operations hppfs_sbops = {
 static int hppfs_readlink(struct dentry *dentry, char __user *buffer,
                           int buflen)
 {
-        struct dentry *proc_dentry;
-
-        proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
         return proc_dentry->d_inode->i_op->readlink(proc_dentry, buffer,
                                                     buflen);
 }
 
 static void *hppfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
-        struct dentry *proc_dentry;
-
-        proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
 
         return proc_dentry->d_inode->i_op->follow_link(proc_dentry, nd);
 }
 
+static void hppfs_put_link(struct dentry *dentry, struct nameidata *nd,
+                           void *cookie)
+{
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+
+        if (proc_dentry->d_inode->i_op->put_link)
+                proc_dentry->d_inode->i_op->put_link(proc_dentry, nd, cookie);
+}
+
 static const struct inode_operations hppfs_dir_iops = {
         .lookup         = hppfs_lookup,
 };
@@ -669,6 +674,7 @@ static const struct inode_operations hppfs_dir_iops = {
 static const struct inode_operations hppfs_link_iops = {
         .readlink       = hppfs_readlink,
         .follow_link    = hppfs_follow_link,
+        .put_link       = hppfs_put_link,
 };
 
 static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
@@ -712,7 +718,7 @@ static int hppfs_fill_super(struct super_block *sb, void *d, int silent)
         struct vfsmount *proc_mnt;
         int err = -ENOENT;
 
-        proc_mnt = do_kern_mount("proc", 0, "proc", NULL);
+        proc_mnt = mntget(current->nsproxy->pid_ns->proc_mnt);
         if (IS_ERR(proc_mnt))
                 goto out;
 
diff --git a/fs/inode.c b/fs/inode.c
index 03dfeb2e3928..407bf392e20a 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -8,7 +8,6 @@
 #include <linux/mm.h>
 #include <linux/dcache.h>
 #include <linux/init.h>
-#include <linux/quotaops.h>
 #include <linux/slab.h>
 #include <linux/writeback.h>
 #include <linux/module.h>
@@ -314,7 +313,6 @@ void clear_inode(struct inode *inode)
         BUG_ON(!(inode->i_state & I_FREEING));
         BUG_ON(inode->i_state & I_CLEAR);
         inode_sync_wait(inode);
-        vfs_dq_drop(inode);
         if (inode->i_sb->s_op->clear_inode)
                 inode->i_sb->s_op->clear_inode(inode);
         if (S_ISBLK(inode->i_mode) && inode->i_bdev)
@@ -1211,8 +1209,6 @@ void generic_delete_inode(struct inode *inode)
 
         if (op->delete_inode) {
                 void (*delete)(struct inode *) = op->delete_inode;
-                if (!is_bad_inode(inode))
-                        vfs_dq_init(inode);
                 /* Filesystems implementing their own
                  * s_op->delete_inode are required to call
                  * truncate_inode_pages and clear_inode()
diff --git a/fs/internal.h b/fs/internal.h
index e96a1667d749..8a03a5447bdf 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -70,6 +70,8 @@ extern struct vfsmount *copy_tree(struct vfsmount *, struct dentry *, int);
 
 extern void __init mnt_init(void);
 
+extern spinlock_t vfsmount_lock;
+
 /*
  * fs_struct.c
  */
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 6c751106c2e5..7faefb4da939 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -228,14 +228,23 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
 
 #ifdef CONFIG_BLOCK
 
-#define blk_to_logical(inode, blk) (blk << (inode)->i_blkbits)
-#define logical_to_blk(inode, offset) (offset >> (inode)->i_blkbits);
+static inline sector_t logical_to_blk(struct inode *inode, loff_t offset)
+{
+        return (offset >> inode->i_blkbits);
+}
+
+static inline loff_t blk_to_logical(struct inode *inode, sector_t blk)
+{
+        return (blk << inode->i_blkbits);
+}
 
 /**
  * __generic_block_fiemap - FIEMAP for block based inodes (no locking)
- * @inode - the inode to map
- * @arg - the pointer to userspace where we copy everything to
- * @get_block - the fs's get_block function
+ * @inode: the inode to map
+ * @fieinfo: the fiemap info struct that will be passed back to userspace
+ * @start: where to start mapping in the inode
+ * @len: how much space to map
+ * @get_block: the fs's get_block function
  *
  * This does FIEMAP for block based inodes.  Basically it will just loop
  * through get_block until we hit the number of extents we want to map, or we
@@ -250,58 +259,63 @@ static int ioctl_fiemap(struct file *filp, unsigned long arg)
  */
 
 int __generic_block_fiemap(struct inode *inode,
-                           struct fiemap_extent_info *fieinfo, u64 start,
-                           u64 len, get_block_t *get_block)
+                           struct fiemap_extent_info *fieinfo, loff_t start,
+                           loff_t len, get_block_t *get_block)
 {
-        struct buffer_head tmp;
-        unsigned long long start_blk;
-        long long length = 0, map_len = 0;
+        struct buffer_head map_bh;
+        sector_t start_blk, last_blk;
+        loff_t isize = i_size_read(inode);
         u64 logical = 0, phys = 0, size = 0;
         u32 flags = FIEMAP_EXTENT_MERGED;
-        int ret = 0, past_eof = 0, whole_file = 0;
+        bool past_eof = false, whole_file = false;
+        int ret = 0;
 
-        if ((ret = fiemap_check_flags(fieinfo, FIEMAP_FLAG_SYNC)))
+        ret = fiemap_check_flags(fieinfo, FIEMAP_FLAG_SYNC);
+        if (ret)
                 return ret;
 
-        start_blk = logical_to_blk(inode, start);
-
-        length = (long long)min_t(u64, len, i_size_read(inode));
-        if (length < len)
-                whole_file = 1;
+        /*
+         * Either the i_mutex or other appropriate locking needs to be held
+         * since we expect isize to not change at all through the duration of
+         * this call.
+         */
+        if (len >= isize) {
+                whole_file = true;
+                len = isize;
+        }
 
-        map_len = length;
+        start_blk = logical_to_blk(inode, start);
+        last_blk = logical_to_blk(inode, start + len - 1);
 
         do {
                 /*
                  * we set b_size to the total size we want so it will map as
                  * many contiguous blocks as possible at once
                  */
-                memset(&tmp, 0, sizeof(struct buffer_head));
-                tmp.b_size = map_len;
+                memset(&map_bh, 0, sizeof(struct buffer_head));
+                map_bh.b_size = len;
 
-                ret = get_block(inode, start_blk, &tmp, 0);
+                ret = get_block(inode, start_blk, &map_bh, 0);
                 if (ret)
                         break;
 
                 /* HOLE */
-                if (!buffer_mapped(&tmp)) {
-                        length -= blk_to_logical(inode, 1);
+                if (!buffer_mapped(&map_bh)) {
                         start_blk++;
 
                         /*
-                         * we want to handle the case where there is an
+                         * We want to handle the case where there is an
                          * allocated block at the front of the file, and then
                          * nothing but holes up to the end of the file properly,
                          * to make sure that extent at the front gets properly
                          * marked with FIEMAP_EXTENT_LAST
                          */
                         if (!past_eof &&
-                            blk_to_logical(inode, start_blk) >=
-                            blk_to_logical(inode, 0)+i_size_read(inode))
+                            blk_to_logical(inode, start_blk) >= isize)
                                 past_eof = 1;
 
                         /*
-                         * first hole after going past the EOF, this is our
+                         * First hole after going past the EOF, this is our
                          * last extent
                          */
                         if (past_eof && size) {
@@ -309,15 +323,18 @@ int __generic_block_fiemap(struct inode *inode,
                                 ret = fiemap_fill_next_extent(fieinfo, logical,
                                                               phys, size,
                                                               flags);
-                                break;
+                        } else if (size) {
+                                ret = fiemap_fill_next_extent(fieinfo, logical,
+                                                              phys, size, flags);
+                                size = 0;
                         }
 
                         /* if we have holes up to/past EOF then we're done */
-                        if (length <= 0 || past_eof)
+                        if (start_blk > last_blk || past_eof || ret)
                                 break;
                 } else {
                         /*
-                         * we have gone over the length of what we wanted to
+                         * We have gone over the length of what we wanted to
                          * map, and it wasn't the entire file, so add the extent
                          * we got last time and exit.
                          *
@@ -331,7 +348,7 @@ int __generic_block_fiemap(struct inode *inode,
                          * are good to go, just add the extent to the fieinfo
                          * and break
                          */
-                        if (length <= 0 && !whole_file) {
+                        if (start_blk > last_blk && !whole_file) {
                                 ret = fiemap_fill_next_extent(fieinfo, logical,
                                                               phys, size,
                                                               flags);
@@ -351,11 +368,10 @@ int __generic_block_fiemap(struct inode *inode,
                         }
 
                         logical = blk_to_logical(inode, start_blk);
-                        phys = blk_to_logical(inode, tmp.b_blocknr);
-                        size = tmp.b_size;
+                        phys = blk_to_logical(inode, map_bh.b_blocknr);
+                        size = map_bh.b_size;
                         flags = FIEMAP_EXTENT_MERGED;
 
-                        length -= tmp.b_size;
                         start_blk += logical_to_blk(inode, size);
 
                         /*
@@ -363,15 +379,13 @@ int __generic_block_fiemap(struct inode *inode,
                          * soon as we find a hole that the last extent we found
                          * is marked with FIEMAP_EXTENT_LAST
                          */
-                        if (!past_eof &&
-                            logical+size >=
-                            blk_to_logical(inode, 0)+i_size_read(inode))
-                                past_eof = 1;
+                        if (!past_eof && logical + size >= isize)
+                                past_eof = true;
                 }
                 cond_resched();
         } while (1);
 
-        /* if ret is 1 then we just hit the end of the extent array */
+        /* If ret is 1 then we just hit the end of the extent array */
         if (ret == 1)
                 ret = 0;
 
diff --git a/fs/ioprio.c b/fs/ioprio.c
index c7c0b28d7d21..748cfb92dcc6 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -19,6 +19,7 @@
  * See also Documentation/block/ioprio.txt
  *
  */
+#include <linux/gfp.h>
 #include <linux/kernel.h>
 #include <linux/ioprio.h>
 #include <linux/blkdev.h>
diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
index 8ba5441063be..b9ab69b3a482 100644
--- a/fs/isofs/dir.c
+++ b/fs/isofs/dir.c
@@ -11,6 +11,7 @@
  *  isofs directory handling functions
  */
 #include <linux/smp_lock.h>
+#include <linux/gfp.h>
 #include "isofs.h"
 
 int isofs_name_translate(struct iso_directory_record *de, char *new, struct inode *inode)
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index eaa831311c9c..ab438beb867c 100644
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/smp_lock.h>
+#include <linux/gfp.h>
 #include "isofs.h"
 
 /*
diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
index 4bd882548c45..ecb44c94ba8d 100644
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -17,7 +17,6 @@
 #include <linux/fs.h>
 #include <linux/jbd.h>
 #include <linux/errno.h>
-#include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/bio.h>
@@ -862,12 +861,12 @@ restart_loop:
                 /* A buffer which has been freed while still being
                  * journaled by a previous transaction may end up still
                  * being dirty here, but we want to avoid writing back
-                 * that buffer in the future now that the last use has
-                 * been committed.  That's not only a performance gain,
-                 * it also stops aliasing problems if the buffer is left
-                 * behind for writeback and gets reallocated for another
+                 * that buffer in the future after the "add to orphan"
+                 * operation been committed,  That's not only a performance
+                 * gain, it also stops aliasing problems if the buffer is
+                 * left behind for writeback and gets reallocated for another
                  * use in a different page. */
-                if (buffer_freed(bh)) {
+                if (buffer_freed(bh) && !jh->b_next_transaction) {
                         clear_buffer_freed(bh);
                         clear_buffer_jbddirty(bh);
                 }
diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
index cb1a49ae605e..54c9bc9e1b17 100644
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -20,7 +20,6 @@
 #include <linux/fs.h>
 #include <linux/jbd.h>
 #include <linux/errno.h>
-#include <linux/slab.h>
 #endif
 
 /*
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 006f9ad838a2..5ae71e75a491 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1398,7 +1398,7 @@ int journal_stop(handle_t *handle)
          * the case where our storage is so fast that it is more optimal to go
          * ahead and force a flush and wait for the transaction to be committed
          * than it is to wait for an arbitrary amount of time for new writers to
-         * join the transaction.  We acheive this by measuring how long it takes
+         * join the transaction.  We achieve this by measuring how long it takes
          * to commit a transaction, and compare it with how long this
          * transaction has been running, and if run time < commit time then we
          * sleep for the delta and commit.  This greatly helps super fast disks
@@ -1864,6 +1864,21 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
         if (!jh)
                 goto zap_buffer_no_jh;
 
+        /*
+         * We cannot remove the buffer from checkpoint lists until the
+         * transaction adding inode to orphan list (let's call it T)
+         * is committed.  Otherwise if the transaction changing the
+         * buffer would be cleaned from the journal before T is
+         * committed, a crash will cause that the correct contents of
+         * the buffer will be lost.  On the other hand we have to
+         * clear the buffer dirty bit at latest at the moment when the
+         * transaction marking the buffer as freed in the filesystem
+         * structures is committed because from that moment on the
+         * buffer can be reallocated and used by a different page.
+         * Since the block hasn't been freed yet but the inode has
+         * already been added to orphan list, it is safe for us to add
+         * the buffer to BJ_Forget list of the newest transaction.
+         */
         transaction = jh->b_transaction;
         if (transaction == NULL) {
                 /* First case: not on any transaction.  If it
@@ -1929,16 +1944,15 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                         goto zap_buffer;
                 }
                 /*
-                 * If it is committing, we simply cannot touch it.  We
-                 * can remove it's next_transaction pointer from the
-                 * running transaction if that is set, but nothing
-                 * else. */
+                 * The buffer is committing, we simply cannot touch
+                 * it. So we just set j_next_transaction to the
+                 * running transaction (if there is one) and mark
+                 * buffer as freed so that commit code knows it should
+                 * clear dirty bits when it is done with the buffer.
+                 */
                 set_buffer_freed(bh);
-                if (jh->b_next_transaction) {
-                        J_ASSERT(jh->b_next_transaction ==
-                                        journal->j_running_transaction);
-                        jh->b_next_transaction = NULL;
-                }
+                if (journal->j_running_transaction && buffer_jbddirty(bh))
+                        jh->b_next_transaction = journal->j_running_transaction;
                 journal_put_journal_head(jh);
                 spin_unlock(&journal->j_list_lock);
                 jbd_unlock_bh_state(bh);
@@ -2120,7 +2134,7 @@ void journal_file_buffer(struct journal_head *jh,
  */
 void __journal_refile_buffer(struct journal_head *jh)
 {
-        int was_dirty;
+        int was_dirty, jlist;
         struct buffer_head *bh = jh2bh(jh);
 
         J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
@@ -2142,8 +2156,13 @@ void __journal_refile_buffer(struct journal_head *jh)
         __journal_temp_unlink_buffer(jh);
         jh->b_transaction = jh->b_next_transaction;
         jh->b_next_transaction = NULL;
-        __journal_file_buffer(jh, jh->b_transaction,
-                                jh->b_modified ? BJ_Metadata : BJ_Reserved);
+        if (buffer_freed(bh))
+                jlist = BJ_Forget;
+        else if (jh->b_modified)
+                jlist = BJ_Metadata;
+        else
+                jlist = BJ_Reserved;
+        __journal_file_buffer(jh, jh->b_transaction, jlist);
         J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
 
         if (was_dirty)
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index ca0f5eb62b20..30beb11ef928 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -22,6 +22,7 @@
 #include <linux/jbd2.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
+#include <linux/blkdev.h>
 #include <trace/events/jbd2.h>
 
 /*
@@ -506,6 +507,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
         if (blocknr < journal->j_tail)
                 freed = freed + journal->j_last - journal->j_first;
 
+        trace_jbd2_cleanup_journal_tail(journal, first_tid, blocknr, freed);
         jbd_debug(1,
                   "Cleaning journal tail from %d to %d (offset %lu), "
                   "freeing %lu\n",
@@ -515,6 +517,20 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
         journal->j_tail_sequence = first_tid;
         journal->j_tail = blocknr;
         spin_unlock(&journal->j_state_lock);
+
+        /*
+         * If there is an external journal, we need to make sure that
+         * any data blocks that were recently written out --- perhaps
+         * by jbd2_log_do_checkpoint() --- are flushed out before we
+         * drop the transactions from the external journal.  It's
+         * unlikely this will be necessary, especially with a
+         * appropriately sized journal, but we need this to guarantee
+         * correctness.  Fortunately jbd2_cleanup_journal_tail()
+         * doesn't get called all that often.
+         */
+        if ((journal->j_fs_dev != journal->j_dev) &&
+            (journal->j_flags & JBD2_BARRIER))
+                blkdev_issue_flush(journal->j_fs_dev, NULL);
         if (!(journal->j_flags & JBD2_ABORT))
                 jbd2_journal_update_superblock(journal, 1);
         return 0;
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 6a10238d2c63..671da7fb7ffd 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -259,6 +259,7 @@ static int journal_submit_data_buffers(journal_t *journal,
                         ret = err;
                 spin_lock(&journal->j_list_lock);
                 J_ASSERT(jinode->i_transaction == commit_transaction);
+                commit_transaction->t_flushed_data_blocks = 1;
                 jinode->i_flags &= ~JI_COMMIT_RUNNING;
                 wake_up_bit(&jinode->i_flags, __JI_COMMIT_RUNNING);
         }
@@ -708,8 +709,17 @@ start_journal_io:
                 }
         }
 
-        /* Done it all: now write the commit record asynchronously. */
+        /* 
+         * If the journal is not located on the file system device,
+         * then we must flush the file system device before we issue
+         * the commit record
+         */
+        if (commit_transaction->t_flushed_data_blocks &&
+            (journal->j_fs_dev != journal->j_dev) &&
+            (journal->j_flags & JBD2_BARRIER))
+                blkdev_issue_flush(journal->j_fs_dev, NULL);
 
+        /* Done it all: now write the commit record asynchronously. */
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)) {
                 err = journal_submit_commit_record(journal, commit_transaction,
@@ -720,13 +730,6 @@ start_journal_io:
                         blkdev_issue_flush(journal->j_dev, NULL);
         }
 
-        /*
-         * This is the right place to wait for data buffers both for ASYNC
-         * and !ASYNC commit. If commit is ASYNC, we need to wait only after
-         * the commit block went to disk (which happens above). If commit is
-         * SYNC, we need to wait for data buffers before we start writing
-         * commit block, which happens below in such setting.
-         */
         err = journal_finish_inode_data_buffers(journal, commit_transaction);
         if (err) {
                 printk(KERN_WARNING
@@ -880,8 +883,7 @@ restart_loop:
                 spin_unlock(&journal->j_list_lock);
                 bh = jh2bh(jh);
                 jbd_lock_bh_state(bh);
-                J_ASSERT_JH(jh, jh->b_transaction == commit_transaction ||
-                        jh->b_transaction == journal->j_running_transaction);
+                J_ASSERT_JH(jh, jh->b_transaction == commit_transaction);
 
                 /*
                  * If there is undo-protected committed data against
@@ -927,12 +929,12 @@ restart_loop:
                 /* A buffer which has been freed while still being
                  * journaled by a previous transaction may end up still
                  * being dirty here, but we want to avoid writing back
-                 * that buffer in the future now that the last use has
-                 * been committed.  That's not only a performance gain,
-                 * it also stops aliasing problems if the buffer is left
-                 * behind for writeback and gets reallocated for another
+                 * that buffer in the future after the "add to orphan"
+                 * operation been committed,  That's not only a performance
+                 * gain, it also stops aliasing problems if the buffer is
+                 * left behind for writeback and gets reallocated for another
                  * use in a different page. */
-                if (buffer_freed(bh)) {
+                if (buffer_freed(bh) && !jh->b_next_transaction) {
                         clear_buffer_freed(bh);
                         clear_buffer_jbddirty(bh);
                 }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 17af879e6e9e..c03d4dce4d76 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -39,6 +39,8 @@
 #include <linux/seq_file.h>
 #include <linux/math64.h>
 #include <linux/hash.h>
+#include <linux/log2.h>
+#include <linux/vmalloc.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/jbd2.h>
@@ -93,6 +95,7 @@ EXPORT_SYMBOL(jbd2_journal_begin_ordered_truncate);
 
 static int journal_convert_superblock_v1(journal_t *, journal_superblock_t *);
 static void __journal_abort_soft (journal_t *journal, int errno);
+static int jbd2_journal_create_slab(size_t slab_size);
 
 /*
  * Helper function used to manage commit timeouts
@@ -814,7 +817,7 @@ static journal_t * journal_init_common (void)
         journal_t *journal;
         int err;
 
-        journal = kzalloc(sizeof(*journal), GFP_KERNEL|__GFP_NOFAIL);
+        journal = kzalloc(sizeof(*journal), GFP_KERNEL);
         if (!journal)
                 goto fail;
 
@@ -1248,6 +1251,13 @@ int jbd2_journal_load(journal_t *journal)
                 }
         }
 
+        /*
+         * Create a slab for this blocksize
+         */
+        err = jbd2_journal_create_slab(be32_to_cpu(sb->s_blocksize));
+        if (err)
+                return err;
+
         /* Let the recovery code check whether it needs to recover any
          * data from the journal. */
         if (jbd2_journal_recover(journal))
@@ -1807,6 +1817,127 @@ size_t journal_tag_bytes(journal_t *journal)
 }
 
 /*
+ * JBD memory management
+ *
+ * These functions are used to allocate block-sized chunks of memory
+ * used for making copies of buffer_head data.  Very often it will be
+ * page-sized chunks of data, but sometimes it will be in
+ * sub-page-size chunks.  (For example, 16k pages on Power systems
+ * with a 4k block file system.)  For blocks smaller than a page, we
+ * use a SLAB allocator.  There are slab caches for each block size,
+ * which are allocated at mount time, if necessary, and we only free
+ * (all of) the slab caches when/if the jbd2 module is unloaded.  For
+ * this reason we don't need to a mutex to protect access to
+ * jbd2_slab[] allocating or releasing memory; only in
+ * jbd2_journal_create_slab().
+ */
+#define JBD2_MAX_SLABS 8
+static struct kmem_cache *jbd2_slab[JBD2_MAX_SLABS];
+static DECLARE_MUTEX(jbd2_slab_create_sem);
+
+static const char *jbd2_slab_names[JBD2_MAX_SLABS] = {
+        "jbd2_1k", "jbd2_2k", "jbd2_4k", "jbd2_8k",
+        "jbd2_16k", "jbd2_32k", "jbd2_64k", "jbd2_128k"
+};
+
+
+static void jbd2_journal_destroy_slabs(void)
+{
+        int i;
+
+        for (i = 0; i < JBD2_MAX_SLABS; i++) {
+                if (jbd2_slab[i])
+                        kmem_cache_destroy(jbd2_slab[i]);
+                jbd2_slab[i] = NULL;
+        }
+}
+
+static int jbd2_journal_create_slab(size_t size)
+{
+        int i = order_base_2(size) - 10;
+        size_t slab_size;
+
+        if (size == PAGE_SIZE)
+                return 0;
+
+        if (i >= JBD2_MAX_SLABS)
+                return -EINVAL;
+
+        if (unlikely(i < 0))
+                i = 0;
+        down(&jbd2_slab_create_sem);
+        if (jbd2_slab[i]) {
+                up(&jbd2_slab_create_sem);
+                return 0;       /* Already created */
+        }
+
+        slab_size = 1 << (i+10);
+        jbd2_slab[i] = kmem_cache_create(jbd2_slab_names[i], slab_size,
+                                         slab_size, 0, NULL);
+        up(&jbd2_slab_create_sem);
+        if (!jbd2_slab[i]) {
+                printk(KERN_EMERG "JBD2: no memory for jbd2_slab cache\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static struct kmem_cache *get_slab(size_t size)
+{
+        int i = order_base_2(size) - 10;
+
+        BUG_ON(i >= JBD2_MAX_SLABS);
+        if (unlikely(i < 0))
+                i = 0;
+        BUG_ON(jbd2_slab[i] == 0);
+        return jbd2_slab[i];
+}
+
+void *jbd2_alloc(size_t size, gfp_t flags)
+{
+        void *ptr;
+
+        BUG_ON(size & (size-1)); /* Must be a power of 2 */
+
+        flags |= __GFP_REPEAT;
+        if (size == PAGE_SIZE)
+                ptr = (void *)__get_free_pages(flags, 0);
+        else if (size > PAGE_SIZE) {
+                int order = get_order(size);
+
+                if (order < 3)
+                        ptr = (void *)__get_free_pages(flags, order);
+                else
+                        ptr = vmalloc(size);
+        } else
+                ptr = kmem_cache_alloc(get_slab(size), flags);
+
+        /* Check alignment; SLUB has gotten this wrong in the past,
+         * and this can lead to user data corruption! */
+        BUG_ON(((unsigned long) ptr) & (size-1));
+
+        return ptr;
+}
+
+void jbd2_free(void *ptr, size_t size)
+{
+        if (size == PAGE_SIZE) {
+                free_pages((unsigned long)ptr, 0);
+                return;
+        }
+        if (size > PAGE_SIZE) {
+                int order = get_order(size);
+
+                if (order < 3)
+                        free_pages((unsigned long)ptr, order);
+                else
+                        vfree(ptr);
+                return;
+        }
+        kmem_cache_free(get_slab(size), ptr);
+};
+
+/*
  * Journal_head storage management
  */
 static struct kmem_cache *jbd2_journal_head_cache;
@@ -2204,6 +2335,7 @@ static void jbd2_journal_destroy_caches(void)
         jbd2_journal_destroy_revoke_caches();
         jbd2_journal_destroy_jbd2_journal_head_cache();
         jbd2_journal_destroy_handle_cache();
+        jbd2_journal_destroy_slabs();
 }
 
 static int __init journal_init(void)
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 73063285b13f..049281b7cb89 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -20,7 +20,6 @@
 #include <linux/fs.h>
 #include <linux/jbd2.h>
 #include <linux/errno.h>
-#include <linux/slab.h>
 #include <linux/crc32.h>
 #endif
 
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index a0512700542f..bfc70f57900f 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1727,6 +1727,21 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
         if (!jh)
                 goto zap_buffer_no_jh;
 
+        /*
+         * We cannot remove the buffer from checkpoint lists until the
+         * transaction adding inode to orphan list (let's call it T)
+         * is committed.  Otherwise if the transaction changing the
+         * buffer would be cleaned from the journal before T is
+         * committed, a crash will cause that the correct contents of
+         * the buffer will be lost.  On the other hand we have to
+         * clear the buffer dirty bit at latest at the moment when the
+         * transaction marking the buffer as freed in the filesystem
+         * structures is committed because from that moment on the
+         * buffer can be reallocated and used by a different page.
+         * Since the block hasn't been freed yet but the inode has
+         * already been added to orphan list, it is safe for us to add
+         * the buffer to BJ_Forget list of the newest transaction.
+         */
         transaction = jh->b_transaction;
         if (transaction == NULL) {
                 /* First case: not on any transaction.  If it
@@ -1783,16 +1798,15 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
         } else if (transaction == journal->j_committing_transaction) {
                 JBUFFER_TRACE(jh, "on committing transaction");
                 /*
-                 * If it is committing, we simply cannot touch it.  We
-                 * can remove it's next_transaction pointer from the
-                 * running transaction if that is set, but nothing
-                 * else. */
+                 * The buffer is committing, we simply cannot touch
+                 * it. So we just set j_next_transaction to the
+                 * running transaction (if there is one) and mark
+                 * buffer as freed so that commit code knows it should
+                 * clear dirty bits when it is done with the buffer.
+                 */
                 set_buffer_freed(bh);
-                if (jh->b_next_transaction) {
-                        J_ASSERT(jh->b_next_transaction ==
-                                        journal->j_running_transaction);
-                        jh->b_next_transaction = NULL;
-                }
+                if (journal->j_running_transaction && buffer_jbddirty(bh))
+                        jh->b_next_transaction = journal->j_running_transaction;
                 jbd2_journal_put_journal_head(jh);
                 spin_unlock(&journal->j_list_lock);
                 jbd_unlock_bh_state(bh);
@@ -1969,7 +1983,7 @@ void jbd2_journal_file_buffer(struct journal_head *jh,
  */
 void __jbd2_journal_refile_buffer(struct journal_head *jh)
 {
-        int was_dirty;
+        int was_dirty, jlist;
         struct buffer_head *bh = jh2bh(jh);
 
         J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
@@ -1991,8 +2005,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
         __jbd2_journal_temp_unlink_buffer(jh);
         jh->b_transaction = jh->b_next_transaction;
         jh->b_next_transaction = NULL;
-        __jbd2_journal_file_buffer(jh, jh->b_transaction,
-                                jh->b_modified ? BJ_Metadata : BJ_Reserved);
+        if (buffer_freed(bh))
+                jlist = BJ_Forget;
+        else if (jh->b_modified)
+                jlist = BJ_Metadata;
+        else
+                jlist = BJ_Reserved;
+        __jbd2_journal_file_buffer(jh, jh->b_transaction, jlist);
         J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
 
         if (was_dirty)
diff --git a/fs/jffs2/compr_lzo.c b/fs/jffs2/compr_lzo.c
index 90cb60d09787..cd02acafde8a 100644
--- a/fs/jffs2/compr_lzo.c
+++ b/fs/jffs2/compr_lzo.c
@@ -11,7 +11,6 @@
 
 #include <linux/kernel.h>
 #include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
 #include <linux/lzo.h>
diff --git a/fs/jffs2/compr_zlib.c b/fs/jffs2/compr_zlib.c
index cfd301a5edfc..b46661a42758 100644
--- a/fs/jffs2/compr_zlib.c
+++ b/fs/jffs2/compr_zlib.c
@@ -14,7 +14,6 @@
 #endif
 
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/zlib.h>
 #include <linux/zutil.h>
 #include "nodelist.h"
diff --git a/fs/jffs2/debug.c b/fs/jffs2/debug.c
index 5544d31c066b..ec3538413926 100644
--- a/fs/jffs2/debug.c
+++ b/fs/jffs2/debug.c
@@ -15,6 +15,7 @@
 #include <linux/crc32.h>
 #include <linux/jffs2.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include "nodelist.h"
 #include "debug.h"
 
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index b7b74e299142..e7291c161a19 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/time.h>
 #include <linux/pagemap.h>
diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index 87c6f555e1a0..af02bd138469 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -15,7 +15,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/rbtree.h>
 #include <linux/crc32.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include "nodelist.h"
 
diff --git a/fs/jffs2/nodemgmt.c b/fs/jffs2/nodemgmt.c
index 21a052915aa9..191359dde4e1 100644
--- a/fs/jffs2/nodemgmt.c
+++ b/fs/jffs2/nodemgmt.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/mtd/mtd.h>
 #include <linux/compiler.h>
 #include <linux/sched.h> /* For cond_resched() */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index e22de8397b74..d32ee9412cb9 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -567,7 +567,7 @@ static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
                         else BUG();
                 }
         }
-        list->rb_node = NULL;
+        *list = RB_ROOT;
 }
 
 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
diff --git a/fs/jffs2/symlink.c b/fs/jffs2/symlink.c
index 4ec11e8bda8c..b955626071c2 100644
--- a/fs/jffs2/symlink.c
+++ b/fs/jffs2/symlink.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/namei.h>
 #include "nodelist.h"
diff --git a/fs/jffs2/write.c b/fs/jffs2/write.c
index ca29440e9435..c819eb0e982d 100644
--- a/fs/jffs2/write.c
+++ b/fs/jffs2/write.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/fs.h>
 #include <linux/crc32.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/mtd/mtd.h>
 #include "nodelist.h"
diff --git a/fs/jfs/acl.c b/fs/jfs/acl.c
index d66477c34306..1057a4998e4e 100644
--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -19,8 +19,8 @@
  */
 
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
-#include <linux/quotaops.h>
 #include <linux/posix_acl_xattr.h>
 #include "jfs_incore.h"
 #include "jfs_txnmgr.h"
@@ -174,7 +174,7 @@ cleanup:
         return rc;
 }
 
-static int jfs_acl_chmod(struct inode *inode)
+int jfs_acl_chmod(struct inode *inode)
 {
         struct posix_acl *acl, *clone;
         int rc;
@@ -205,26 +205,3 @@ static int jfs_acl_chmod(struct inode *inode)
         posix_acl_release(clone);
         return rc;
 }
-
-int jfs_setattr(struct dentry *dentry, struct iattr *iattr)
-{
-        struct inode *inode = dentry->d_inode;
-        int rc;
-
-        rc = inode_change_ok(inode, iattr);
-        if (rc)
-                return rc;
-
-        if ((iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) ||
-            (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid)) {
-                if (vfs_dq_transfer(inode, iattr))
-                        return -EDQUOT;
-        }
-
-        rc = inode_setattr(inode, iattr);
-
-        if (!rc && (iattr->ia_valid & ATTR_MODE))
-                rc = jfs_acl_chmod(inode);
-
-        return rc;
-}
diff --git a/fs/jfs/file.c b/fs/jfs/file.c
index 2b70fa78e4a7..14ba982b3f24 100644
--- a/fs/jfs/file.c
+++ b/fs/jfs/file.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/quotaops.h>
 #include "jfs_incore.h"
 #include "jfs_inode.h"
 #include "jfs_dmap.h"
@@ -47,7 +48,7 @@ static int jfs_open(struct inode *inode, struct file *file)
 {
         int rc;
 
-        if ((rc = generic_file_open(inode, file)))
+        if ((rc = dquot_file_open(inode, file)))
                 return rc;
 
         /*
@@ -88,14 +89,40 @@ static int jfs_release(struct inode *inode, struct file *file)
         return 0;
 }
 
+int jfs_setattr(struct dentry *dentry, struct iattr *iattr)
+{
+        struct inode *inode = dentry->d_inode;
+        int rc;
+
+        rc = inode_change_ok(inode, iattr);
+        if (rc)
+                return rc;
+
+        if (iattr->ia_valid & ATTR_SIZE)
+                dquot_initialize(inode);
+        if ((iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) ||
+            (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid)) {
+                rc = dquot_transfer(inode, iattr);
+                if (rc)
+                        return rc;
+        }
+
+        rc = inode_setattr(inode, iattr);
+
+        if (!rc && (iattr->ia_valid & ATTR_MODE))
+                rc = jfs_acl_chmod(inode);
+
+        return rc;
+}
+
 const struct inode_operations jfs_file_inode_operations = {
         .truncate       = jfs_truncate,
         .setxattr       = jfs_setxattr,
         .getxattr       = jfs_getxattr,
         .listxattr      = jfs_listxattr,
         .removexattr    = jfs_removexattr,
-#ifdef CONFIG_JFS_POSIX_ACL
         .setattr        = jfs_setattr,
+#ifdef CONFIG_JFS_POSIX_ACL
         .check_acl      = jfs_check_acl,
 #endif
 };
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index b2ae190a77ba..ed9ba6fe04f5 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -22,6 +22,7 @@
 #include <linux/buffer_head.h>
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
+#include <linux/writeback.h>
 #include "jfs_incore.h"
 #include "jfs_inode.h"
 #include "jfs_filsys.h"
@@ -60,7 +61,7 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
                         inode->i_op = &page_symlink_inode_operations;
                         inode->i_mapping->a_ops = &jfs_aops;
                 } else {
-                        inode->i_op = &jfs_symlink_inode_operations;
+                        inode->i_op = &jfs_fast_symlink_inode_operations;
                         /*
                          * The inline data should be null-terminated, but
                          * don't let on-disk corruption crash the kernel
@@ -120,8 +121,10 @@ int jfs_commit_inode(struct inode *inode, int wait)
         return rc;
 }
 
-int jfs_write_inode(struct inode *inode, int wait)
+int jfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
+        int wait = wbc->sync_mode == WB_SYNC_ALL;
+
         if (test_cflag(COMMIT_Nolink, inode))
                 return 0;
         /*
@@ -146,6 +149,9 @@ void jfs_delete_inode(struct inode *inode)
 {
         jfs_info("In jfs_delete_inode, inode = 0x%p", inode);
 
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
+
         if (!is_bad_inode(inode) &&
             (JFS_IP(inode)->fileset == FILESYSTEM_I)) {
                 truncate_inode_pages(&inode->i_data, 0);
@@ -158,9 +164,9 @@ void jfs_delete_inode(struct inode *inode)
                 /*
                  * Free the inode from the quota allocation.
                  */
-                vfs_dq_init(inode);
-                vfs_dq_free_inode(inode);
-                vfs_dq_drop(inode);
+                dquot_initialize(inode);
+                dquot_free_inode(inode);
+                dquot_drop(inode);
         }
 
         clear_inode(inode);
diff --git a/fs/jfs/jfs_acl.h b/fs/jfs/jfs_acl.h
index b07bd417ef85..54e07559878d 100644
--- a/fs/jfs/jfs_acl.h
+++ b/fs/jfs/jfs_acl.h
@@ -22,7 +22,7 @@
 
 int jfs_check_acl(struct inode *, int);
 int jfs_init_acl(tid_t, struct inode *, struct inode *);
-int jfs_setattr(struct dentry *, struct iattr *);
+int jfs_acl_chmod(struct inode *inode);
 
 #else
 
@@ -32,5 +32,10 @@ static inline int jfs_init_acl(tid_t tid, struct inode *inode,
         return 0;
 }
 
+static inline int jfs_acl_chmod(struct inode *inode)
+{
+        return 0;
+}
+
 #endif
 #endif          /* _H_JFS_ACL */
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index d9b031cf69f5..9e2f6a721668 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include "jfs_incore.h"
 #include "jfs_superblock.h"
 #include "jfs_dmap.h"
@@ -195,7 +196,7 @@ int dbMount(struct inode *ipbmap)
         bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
         bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
         bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);
-        bmp->db_agheigth = le32_to_cpu(dbmp_le->dn_agheigth);
+        bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);
         bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
         bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
         bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
@@ -287,7 +288,7 @@ int dbSync(struct inode *ipbmap)
         dbmp_le->dn_maxag = cpu_to_le32(bmp->db_maxag);
         dbmp_le->dn_agpref = cpu_to_le32(bmp->db_agpref);
         dbmp_le->dn_aglevel = cpu_to_le32(bmp->db_aglevel);
-        dbmp_le->dn_agheigth = cpu_to_le32(bmp->db_agheigth);
+        dbmp_le->dn_agheight = cpu_to_le32(bmp->db_agheight);
         dbmp_le->dn_agwidth = cpu_to_le32(bmp->db_agwidth);
         dbmp_le->dn_agstart = cpu_to_le32(bmp->db_agstart);
         dbmp_le->dn_agl2size = cpu_to_le32(bmp->db_agl2size);
@@ -1440,7 +1441,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
          * tree index of this allocation group within the control page.
          */
         agperlev =
-            (1 << (L2LPERCTL - (bmp->db_agheigth << 1))) / bmp->db_agwidth;
+            (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;
         ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
 
         /* dmap control page trees fan-out by 4 and a single allocation
@@ -1459,7 +1460,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
                  * the subtree to find the leftmost leaf that describes this
                  * free space.
                  */
-                for (k = bmp->db_agheigth; k > 0; k--) {
+                for (k = bmp->db_agheight; k > 0; k--) {
                         for (n = 0, m = (ti << 2) + 1; n < 4; n++) {
                                 if (l2nb <= dcp->stree[m + n]) {
                                         ti = m + n;
@@ -3606,7 +3607,7 @@ void dbFinalizeBmap(struct inode *ipbmap)
         }
 
         /*
-         * compute db_aglevel, db_agheigth, db_width, db_agstart:
+         * compute db_aglevel, db_agheight, db_width, db_agstart:
          * an ag is covered in aglevel dmapctl summary tree,
          * at agheight level height (from leaf) with agwidth number of nodes
          * each, which starts at agstart index node of the smmary tree node
@@ -3615,9 +3616,9 @@ void dbFinalizeBmap(struct inode *ipbmap)
         bmp->db_aglevel = BMAPSZTOLEV(bmp->db_agsize);
         l2nl =
             bmp->db_agl2size - (L2BPERDMAP + bmp->db_aglevel * L2LPERCTL);
-        bmp->db_agheigth = l2nl >> 1;
-        bmp->db_agwidth = 1 << (l2nl - (bmp->db_agheigth << 1));
-        for (i = 5 - bmp->db_agheigth, bmp->db_agstart = 0, n = 1; i > 0;
+        bmp->db_agheight = l2nl >> 1;
+        bmp->db_agwidth = 1 << (l2nl - (bmp->db_agheight << 1));
+        for (i = 5 - bmp->db_agheight, bmp->db_agstart = 0, n = 1; i > 0;
              i--) {
                 bmp->db_agstart += n;
                 n <<= 2;
diff --git a/fs/jfs/jfs_dmap.h b/fs/jfs/jfs_dmap.h
index 1a6eb41569bc..6dcb906c55d8 100644
--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -210,7 +210,7 @@ struct dbmap_disk {
         __le32 dn_maxag;        /* 4: max active alloc group number     */
         __le32 dn_agpref;       /* 4: preferred alloc group (hint)      */
         __le32 dn_aglevel;      /* 4: dmapctl level holding the AG      */
-        __le32 dn_agheigth;     /* 4: height in dmapctl of the AG       */
+        __le32 dn_agheight;     /* 4: height in dmapctl of the AG       */
         __le32 dn_agwidth;      /* 4: width in dmapctl of the AG        */
         __le32 dn_agstart;      /* 4: start tree index at AG height     */
         __le32 dn_agl2size;     /* 4: l2 num of blks per alloc group    */
@@ -229,7 +229,7 @@ struct dbmap {
         int dn_maxag;           /* max active alloc group number        */
         int dn_agpref;          /* preferred alloc group (hint)         */
         int dn_aglevel;         /* dmapctl level holding the AG         */
-        int dn_agheigth;        /* height in dmapctl of the AG          */
+        int dn_agheight;        /* height in dmapctl of the AG          */
         int dn_agwidth;         /* width in dmapctl of the AG           */
         int dn_agstart;         /* start tree index at AG height        */
         int dn_agl2size;        /* l2 num of blks per alloc group       */
@@ -255,7 +255,7 @@ struct bmap {
 #define db_agsize       db_bmap.dn_agsize
 #define db_agl2size     db_bmap.dn_agl2size
 #define db_agwidth      db_bmap.dn_agwidth
-#define db_agheigth     db_bmap.dn_agheigth
+#define db_agheight     db_bmap.dn_agheight
 #define db_agstart      db_bmap.dn_agstart
 #define db_numag        db_bmap.dn_numag
 #define db_maxlevel     db_bmap.dn_maxlevel
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 925871e9887b..9197a1b0d02d 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -102,6 +102,7 @@
 
 #include <linux/fs.h>
 #include <linux/quotaops.h>
+#include <linux/slab.h>
 #include "jfs_incore.h"
 #include "jfs_superblock.h"
 #include "jfs_filsys.h"
@@ -381,10 +382,10 @@ static u32 add_index(tid_t tid, struct inode *ip, s64 bn, int slot)
                  * It's time to move the inline table to an external
                  * page and begin to build the xtree
                  */
-                if (vfs_dq_alloc_block(ip, sbi->nbperpage))
+                if (dquot_alloc_block(ip, sbi->nbperpage))
                         goto clean_up;
                 if (dbAlloc(ip, 0, sbi->nbperpage, &xaddr)) {
-                        vfs_dq_free_block(ip, sbi->nbperpage);
+                        dquot_free_block(ip, sbi->nbperpage);
                         goto clean_up;
                 }
 
@@ -408,7 +409,7 @@ static u32 add_index(tid_t tid, struct inode *ip, s64 bn, int slot)
                         memcpy(&jfs_ip->i_dirtable, temp_table,
                                sizeof (temp_table));
                         dbFree(ip, xaddr, sbi->nbperpage);
-                        vfs_dq_free_block(ip, sbi->nbperpage);
+                        dquot_free_block(ip, sbi->nbperpage);
                         goto clean_up;
                 }
                 ip->i_size = PSIZE;
@@ -1027,10 +1028,9 @@ static int dtSplitUp(tid_t tid,
                         n = xlen;
 
                 /* Allocate blocks to quota. */
-                if (vfs_dq_alloc_block(ip, n)) {
-                        rc = -EDQUOT;
+                rc = dquot_alloc_block(ip, n);
+                if (rc)
                         goto extendOut;
-                }
                 quota_allocation += n;
 
                 if ((rc = dbReAlloc(sbi->ipbmap, xaddr, (s64) xlen,
@@ -1308,7 +1308,7 @@ static int dtSplitUp(tid_t tid,
 
         /* Rollback quota allocation */
         if (rc && quota_allocation)
-                vfs_dq_free_block(ip, quota_allocation);
+                dquot_free_block(ip, quota_allocation);
 
       dtSplitUp_Exit:
 
@@ -1369,9 +1369,10 @@ static int dtSplitPage(tid_t tid, struct inode *ip, struct dtsplit * split,
                 return -EIO;
 
         /* Allocate blocks to quota. */
-        if (vfs_dq_alloc_block(ip, lengthPXD(pxd))) {
+        rc = dquot_alloc_block(ip, lengthPXD(pxd));
+        if (rc) {
                 release_metapage(rmp);
-                return -EDQUOT;
+                return rc;
         }
 
         jfs_info("dtSplitPage: ip:0x%p smp:0x%p rmp:0x%p", ip, smp, rmp);
@@ -1892,6 +1893,7 @@ static int dtSplitRoot(tid_t tid,
         struct dt_lock *dtlck;
         struct tlock *tlck;
         struct lv *lv;
+        int rc;
 
         /* get split root page */
         smp = split->mp;
@@ -1916,9 +1918,10 @@ static int dtSplitRoot(tid_t tid,
         rp = rmp->data;
 
         /* Allocate blocks to quota. */
-        if (vfs_dq_alloc_block(ip, lengthPXD(pxd))) {
+        rc = dquot_alloc_block(ip, lengthPXD(pxd));
+        if (rc) {
                 release_metapage(rmp);
-                return -EDQUOT;
+                return rc;
         }
 
         BT_MARK_DIRTY(rmp, ip);
@@ -2287,7 +2290,7 @@ static int dtDeleteUp(tid_t tid, struct inode *ip,
         xlen = lengthPXD(&fp->header.self);
 
         /* Free quota allocation. */
-        vfs_dq_free_block(ip, xlen);
+        dquot_free_block(ip, xlen);
 
         /* free/invalidate its buffer page */
         discard_metapage(fmp);
@@ -2363,7 +2366,7 @@ static int dtDeleteUp(tid_t tid, struct inode *ip,
                                 xlen = lengthPXD(&p->header.self);
 
                                 /* Free quota allocation */
-                                vfs_dq_free_block(ip, xlen);
+                                dquot_free_block(ip, xlen);
 
                                 /* free/invalidate its buffer page */
                                 discard_metapage(mp);
diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c
index 41d6045dbeb0..5d3bbd10f8db 100644
--- a/fs/jfs/jfs_extent.c
+++ b/fs/jfs/jfs_extent.c
@@ -141,10 +141,11 @@ extAlloc(struct inode *ip, s64 xlen, s64 pno, xad_t * xp, bool abnr)
         }
 
         /* Allocate blocks to quota. */
-        if (vfs_dq_alloc_block(ip, nxlen)) {
+        rc = dquot_alloc_block(ip, nxlen);
+        if (rc) {
                 dbFree(ip, nxaddr, (s64) nxlen);
                 mutex_unlock(&JFS_IP(ip)->commit_mutex);
-                return -EDQUOT;
+                return rc;
         }
 
         /* determine the value of the extent flag */
@@ -164,7 +165,7 @@ extAlloc(struct inode *ip, s64 xlen, s64 pno, xad_t * xp, bool abnr)
          */
         if (rc) {
                 dbFree(ip, nxaddr, nxlen);
-                vfs_dq_free_block(ip, nxlen);
+                dquot_free_block(ip, nxlen);
                 mutex_unlock(&JFS_IP(ip)->commit_mutex);
                 return (rc);
         }
@@ -256,10 +257,11 @@ int extRealloc(struct inode *ip, s64 nxlen, xad_t * xp, bool abnr)
                 goto exit;
 
         /* Allocat blocks to quota. */
-        if (vfs_dq_alloc_block(ip, nxlen)) {
+        rc = dquot_alloc_block(ip, nxlen);
+        if (rc) {
                 dbFree(ip, nxaddr, (s64) nxlen);
                 mutex_unlock(&JFS_IP(ip)->commit_mutex);
-                return -EDQUOT;
+                return rc;
         }
 
         delta = nxlen - xlen;
@@ -297,7 +299,7 @@ int extRealloc(struct inode *ip, s64 nxlen, xad_t * xp, bool abnr)
                 /* extend the extent */
                 if ((rc = xtExtend(0, ip, xoff + xlen, (int) nextend, 0))) {
                         dbFree(ip, xaddr + xlen, delta);
-                        vfs_dq_free_block(ip, nxlen);
+                        dquot_free_block(ip, nxlen);
                         goto exit;
                 }
         } else {
@@ -308,7 +310,7 @@ int extRealloc(struct inode *ip, s64 nxlen, xad_t * xp, bool abnr)
                  */
                 if ((rc = xtTailgate(0, ip, xoff, (int) ntail, nxaddr, 0))) {
                         dbFree(ip, nxaddr, nxlen);
-                        vfs_dq_free_block(ip, nxlen);
+                        dquot_free_block(ip, nxlen);
                         goto exit;
                 }
         }
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 0fc30407f039..f8332dc8eeb2 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -45,6 +45,7 @@
 #include <linux/buffer_head.h>
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
+#include <linux/slab.h>
 
 #include "jfs_incore.h"
 #include "jfs_inode.h"
diff --git a/fs/jfs/jfs_inode.c b/fs/jfs/jfs_inode.c
index dc0e02159ac9..829921b67765 100644
--- a/fs/jfs/jfs_inode.c
+++ b/fs/jfs/jfs_inode.c
@@ -116,10 +116,10 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
         /*
          * Allocate inode to quota.
          */
-        if (vfs_dq_alloc_inode(inode)) {
-                rc = -EDQUOT;
+        dquot_initialize(inode);
+        rc = dquot_alloc_inode(inode);
+        if (rc)
                 goto fail_drop;
-        }
 
         inode->i_mode = mode;
         /* inherit flags from parent */
@@ -162,7 +162,7 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
         return inode;
 
 fail_drop:
-        vfs_dq_drop(inode);
+        dquot_drop(inode);
         inode->i_flags |= S_NOQUOTA;
 fail_unlock:
         inode->i_nlink = 0;
diff --git a/fs/jfs/jfs_inode.h b/fs/jfs/jfs_inode.h
index 1eff7db34d63..9e6bda30a6e8 100644
--- a/fs/jfs/jfs_inode.h
+++ b/fs/jfs/jfs_inode.h
@@ -26,7 +26,7 @@ extern long jfs_ioctl(struct file *, unsigned int, unsigned long);
 extern long jfs_compat_ioctl(struct file *, unsigned int, unsigned long);
 extern struct inode *jfs_iget(struct super_block *, unsigned long);
 extern int jfs_commit_inode(struct inode *, int);
-extern int jfs_write_inode(struct inode*, int);
+extern int jfs_write_inode(struct inode *, struct writeback_control *);
 extern void jfs_delete_inode(struct inode *);
 extern void jfs_dirty_inode(struct inode *);
 extern void jfs_truncate(struct inode *);
@@ -40,6 +40,7 @@ extern struct dentry *jfs_fh_to_parent(struct super_block *sb, struct fid *fid,
         int fh_len, int fh_type);
 extern void jfs_set_inode_flags(struct inode *);
 extern int jfs_get_block(struct inode *, sector_t, struct buffer_head *, int);
+extern int jfs_setattr(struct dentry *, struct iattr *);
 
 extern const struct address_space_operations jfs_aops;
 extern const struct inode_operations jfs_dir_inode_operations;
@@ -47,5 +48,6 @@ extern const struct file_operations jfs_dir_operations;
 extern const struct inode_operations jfs_file_inode_operations;
 extern const struct file_operations jfs_file_operations;
 extern const struct inode_operations jfs_symlink_inode_operations;
+extern const struct inode_operations jfs_fast_symlink_inode_operations;
 extern const struct dentry_operations jfs_ci_dentry_operations;
 #endif                          /* _H_JFS_INODE */
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 335c4de6552d..c51af2a14516 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -70,6 +70,7 @@
 #include <linux/delay.h>
 #include <linux/mutex.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "jfs_incore.h"
 #include "jfs_filsys.h"
 #include "jfs_metapage.h"
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 07b6c5dfb4b6..48b44bd8267b 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -21,6 +21,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/bio.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/buffer_head.h>
 #include <linux/mempool.h>
diff --git a/fs/jfs/jfs_unicode.h b/fs/jfs/jfs_unicode.h
index 3fbb3a225590..8f0f02cb6ca6 100644
--- a/fs/jfs/jfs_unicode.h
+++ b/fs/jfs/jfs_unicode.h
@@ -19,6 +19,7 @@
 #ifndef _H_JFS_UNICODE
 #define _H_JFS_UNICODE
 
+#include <linux/slab.h>
 #include <asm/byteorder.h>
 #include "jfs_types.h"
 
diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
index d654a6458648..6c50871e6220 100644
--- a/fs/jfs/jfs_xtree.c
+++ b/fs/jfs/jfs_xtree.c
@@ -585,10 +585,10 @@ int xtInsert(tid_t tid,		/* transaction id */
                         hint = addressXAD(xad) + lengthXAD(xad) - 1;
                 } else
                         hint = 0;
-                if ((rc = vfs_dq_alloc_block(ip, xlen)))
+                if ((rc = dquot_alloc_block(ip, xlen)))
                         goto out;
                 if ((rc = dbAlloc(ip, hint, (s64) xlen, &xaddr))) {
-                        vfs_dq_free_block(ip, xlen);
+                        dquot_free_block(ip, xlen);
                         goto out;
                 }
         }
@@ -617,7 +617,7 @@ int xtInsert(tid_t tid,		/* transaction id */
                         /* undo data extent allocation */
                         if (*xaddrp == 0) {
                                 dbFree(ip, xaddr, (s64) xlen);
-                                vfs_dq_free_block(ip, xlen);
+                                dquot_free_block(ip, xlen);
                         }
                         return rc;
                 }
@@ -985,10 +985,9 @@ xtSplitPage(tid_t tid, struct inode *ip,
         rbn = addressPXD(pxd);
 
         /* Allocate blocks to quota. */
-        if (vfs_dq_alloc_block(ip, lengthPXD(pxd))) {
-                rc = -EDQUOT;
+        rc = dquot_alloc_block(ip, lengthPXD(pxd));
+        if (rc)
                 goto clean_up;
-        }
 
         quota_allocation += lengthPXD(pxd);
 
@@ -1195,7 +1194,7 @@ xtSplitPage(tid_t tid, struct inode *ip,
 
         /* Rollback quota allocation. */
         if (quota_allocation)
-                vfs_dq_free_block(ip, quota_allocation);
+                dquot_free_block(ip, quota_allocation);
 
         return (rc);
 }
@@ -1235,6 +1234,7 @@ xtSplitRoot(tid_t tid,
         struct pxdlist *pxdlist;
         struct tlock *tlck;
         struct xtlock *xtlck;
+        int rc;
 
         sp = &JFS_IP(ip)->i_xtroot;
 
@@ -1252,9 +1252,10 @@ xtSplitRoot(tid_t tid,
                 return -EIO;
 
         /* Allocate blocks to quota. */
-        if (vfs_dq_alloc_block(ip, lengthPXD(pxd))) {
+        rc = dquot_alloc_block(ip, lengthPXD(pxd));
+        if (rc) {
                 release_metapage(rmp);
-                return -EDQUOT;
+                return rc;
         }
 
         jfs_info("xtSplitRoot: ip:0x%p rmp:0x%p", ip, rmp);
@@ -3680,7 +3681,7 @@ s64 xtTruncate(tid_t tid, struct inode *ip, s64 newsize, int flag)
                 ip->i_size = newsize;
 
         /* update quota allocation to reflect freed blocks */
-        vfs_dq_free_block(ip, nfreed);
+        dquot_free_block(ip, nfreed);
 
         /*
          * free tlock of invalidated pages
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index c79a4270f083..a9cf8e8675be 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -85,6 +85,8 @@ static int jfs_create(struct inode *dip, struct dentry *dentry, int mode,
 
         jfs_info("jfs_create: dip:0x%p name:%s", dip, dentry->d_name.name);
 
+        dquot_initialize(dip);
+
         /*
          * search parent directory for entry/freespace
          * (dtSearch() returns parent directory page pinned)
@@ -215,6 +217,8 @@ static int jfs_mkdir(struct inode *dip, struct dentry *dentry, int mode)
 
         jfs_info("jfs_mkdir: dip:0x%p name:%s", dip, dentry->d_name.name);
 
+        dquot_initialize(dip);
+
         /* link count overflow on parent directory ? */
         if (dip->i_nlink == JFS_LINK_MAX) {
                 rc = -EMLINK;
@@ -356,7 +360,8 @@ static int jfs_rmdir(struct inode *dip, struct dentry *dentry)
         jfs_info("jfs_rmdir: dip:0x%p name:%s", dip, dentry->d_name.name);
 
         /* Init inode for quota operations. */
-        vfs_dq_init(ip);
+        dquot_initialize(dip);
+        dquot_initialize(ip);
 
         /* directory must be empty to be removed */
         if (!dtEmpty(ip)) {
@@ -483,7 +488,8 @@ static int jfs_unlink(struct inode *dip, struct dentry *dentry)
         jfs_info("jfs_unlink: dip:0x%p name:%s", dip, dentry->d_name.name);
 
         /* Init inode for quota operations. */
-        vfs_dq_init(ip);
+        dquot_initialize(dip);
+        dquot_initialize(ip);
 
         if ((rc = get_UCSname(&dname, dentry)))
                 goto out;
@@ -805,6 +811,8 @@ static int jfs_link(struct dentry *old_dentry,
         if (ip->i_nlink == 0)
                 return -ENOENT;
 
+        dquot_initialize(dir);
+
         tid = txBegin(ip->i_sb, 0);
 
         mutex_lock_nested(&JFS_IP(dir)->commit_mutex, COMMIT_MUTEX_PARENT);
@@ -896,6 +904,8 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
 
         jfs_info("jfs_symlink: dip:0x%p name:%s", dip, name);
 
+        dquot_initialize(dip);
+
         ssize = strlen(name) + 1;
 
         /*
@@ -946,7 +956,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
          */
 
         if (ssize <= IDATASIZE) {
-                ip->i_op = &jfs_symlink_inode_operations;
+                ip->i_op = &jfs_fast_symlink_inode_operations;
 
                 i_fastsymlink = JFS_IP(ip)->i_inline;
                 memcpy(i_fastsymlink, name, ssize);
@@ -968,7 +978,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
         else {
                 jfs_info("jfs_symlink: allocate extent ip:0x%p", ip);
 
-                ip->i_op = &page_symlink_inode_operations;
+                ip->i_op = &jfs_symlink_inode_operations;
                 ip->i_mapping->a_ops = &jfs_aops;
 
                 /*
@@ -1087,6 +1097,9 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         jfs_info("jfs_rename: %s %s", old_dentry->d_name.name,
                  new_dentry->d_name.name);
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         old_ip = old_dentry->d_inode;
         new_ip = new_dentry->d_inode;
 
@@ -1136,7 +1149,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         } else if (new_ip) {
                 IWRITE_LOCK(new_ip, RDWRLOCK_NORMAL);
                 /* Init inode for quota operations. */
-                vfs_dq_init(new_ip);
+                dquot_initialize(new_ip);
         }
 
         /*
@@ -1360,6 +1373,8 @@ static int jfs_mknod(struct inode *dir, struct dentry *dentry,
 
         jfs_info("jfs_mknod: %s", dentry->d_name.name);
 
+        dquot_initialize(dir);
+
         if ((rc = get_UCSname(&dname, dentry)))
                 goto out;
 
@@ -1541,8 +1556,8 @@ const struct inode_operations jfs_dir_inode_operations = {
         .getxattr       = jfs_getxattr,
         .listxattr      = jfs_listxattr,
         .removexattr    = jfs_removexattr,
-#ifdef CONFIG_JFS_POSIX_ACL
         .setattr        = jfs_setattr,
+#ifdef CONFIG_JFS_POSIX_ACL
         .check_acl      = jfs_check_acl,
 #endif
 };
diff --git a/fs/jfs/resize.c b/fs/jfs/resize.c
index 7f24a0bb08ca..1aba0039f1c9 100644
--- a/fs/jfs/resize.c
+++ b/fs/jfs/resize.c
@@ -81,6 +81,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
         struct inode *iplist[1];
         struct jfs_superblock *j_sb, *j_sb2;
         uint old_agsize;
+        int agsizechanged = 0;
         struct buffer_head *bh, *bh2;
 
         /* If the volume hasn't grown, get out now */
@@ -333,6 +334,9 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
          */
         if ((rc = dbExtendFS(ipbmap, XAddress, nblocks)))
                 goto error_out;
+
+        agsizechanged |= (bmp->db_agsize != old_agsize);
+
         /*
          * the map now has extended to cover additional nblocks:
          * dn_mapsize = oldMapsize + nblocks;
@@ -432,7 +436,7 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
          * will correctly identify the new ag);
          */
         /* if new AG size the same as old AG size, done! */
-        if (bmp->db_agsize != old_agsize) {
+        if (agsizechanged) {
                 if ((rc = diExtendFS(ipimap, ipbmap)))
                         goto error_out;
 
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index d929a822a74e..157382fa6256 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -30,6 +30,7 @@
 #include <linux/buffer_head.h>
 #include <linux/exportfs.h>
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/seq_file.h>
 #include <linux/smp_lock.h>
@@ -131,6 +132,11 @@ static void jfs_destroy_inode(struct inode *inode)
         kmem_cache_free(jfs_inode_cachep, ji);
 }
 
+static void jfs_clear_inode(struct inode *inode)
+{
+        dquot_drop(inode);
+}
+
 static int jfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
         struct jfs_sb_info *sbi = JFS_SBI(dentry->d_sb);
@@ -745,6 +751,7 @@ static const struct super_operations jfs_super_operations = {
         .dirty_inode    = jfs_dirty_inode,
         .write_inode    = jfs_write_inode,
         .delete_inode   = jfs_delete_inode,
+        .clear_inode    = jfs_clear_inode,
         .put_super      = jfs_put_super,
         .sync_fs        = jfs_sync_fs,
         .freeze_fs      = jfs_freeze,
diff --git a/fs/jfs/symlink.c b/fs/jfs/symlink.c
index 4af1a05aad0a..205b946d8e0d 100644
--- a/fs/jfs/symlink.c
+++ b/fs/jfs/symlink.c
@@ -29,9 +29,21 @@ static void *jfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         return NULL;
 }
 
-const struct inode_operations jfs_symlink_inode_operations = {
+const struct inode_operations jfs_fast_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = jfs_follow_link,
+        .setattr        = jfs_setattr,
+        .setxattr       = jfs_setxattr,
+        .getxattr       = jfs_getxattr,
+        .listxattr      = jfs_listxattr,
+        .removexattr    = jfs_removexattr,
+};
+
+const struct inode_operations jfs_symlink_inode_operations = {
+        .readlink       = generic_readlink,
+        .follow_link    = page_follow_link_light,
+        .put_link       = page_put_link,
+        .setattr        = jfs_setattr,
         .setxattr       = jfs_setxattr,
         .getxattr       = jfs_getxattr,
         .listxattr      = jfs_listxattr,
diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
index fad364548bc9..fa96bbb26343 100644
--- a/fs/jfs/xattr.c
+++ b/fs/jfs/xattr.c
@@ -21,6 +21,7 @@
 #include <linux/fs.h>
 #include <linux/xattr.h>
 #include <linux/posix_acl_xattr.h>
+#include <linux/slab.h>
 #include <linux/quotaops.h>
 #include <linux/security.h>
 #include "jfs_incore.h"
@@ -260,14 +261,14 @@ static int ea_write(struct inode *ip, struct jfs_ea_list *ealist, int size,
         nblocks = (size + (sb->s_blocksize - 1)) >> sb->s_blocksize_bits;
 
         /* Allocate new blocks to quota. */
-        if (vfs_dq_alloc_block(ip, nblocks)) {
-                return -EDQUOT;
-        }
+        rc = dquot_alloc_block(ip, nblocks);
+        if (rc)
+                return rc;
 
         rc = dbAlloc(ip, INOHINT(ip), nblocks, &blkno);
         if (rc) {
                 /*Rollback quota allocation. */
-                vfs_dq_free_block(ip, nblocks);
+                dquot_free_block(ip, nblocks);
                 return rc;
         }
 
@@ -332,7 +333,7 @@ static int ea_write(struct inode *ip, struct jfs_ea_list *ealist, int size,
 
       failed:
         /* Rollback quota allocation. */
-        vfs_dq_free_block(ip, nblocks);
+        dquot_free_block(ip, nblocks);
 
         dbFree(ip, blkno, nblocks);
         return rc;
@@ -538,7 +539,8 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)
 
         if (blocks_needed > current_blocks) {
                 /* Allocate new blocks to quota. */
-                if (vfs_dq_alloc_block(inode, blocks_needed))
+                rc = dquot_alloc_block(inode, blocks_needed);
+                if (rc)
                         return -EDQUOT;
 
                 quota_allocation = blocks_needed;
@@ -602,7 +604,7 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)
       clean_up:
         /* Rollback quota allocation */
         if (quota_allocation)
-                vfs_dq_free_block(inode, quota_allocation);
+                dquot_free_block(inode, quota_allocation);
 
         return (rc);
 }
@@ -677,7 +679,7 @@ static int ea_put(tid_t tid, struct inode *inode, struct ea_buffer *ea_buf,
 
         /* If old blocks exist, they must be removed from quota allocation. */
         if (old_blocks)
-                vfs_dq_free_block(inode, old_blocks);
+                dquot_free_block(inode, old_blocks);
 
         inode->i_ctime = CURRENT_TIME;
 
diff --git a/fs/libfs.c b/fs/libfs.c
index 6e8d17e1dc4c..ea9a6cc9b35c 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -5,6 +5,7 @@
 
 #include <linux/module.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/vfs.h>
 #include <linux/mutex.h>
@@ -338,28 +339,14 @@ int simple_readpage(struct file *file, struct page *page)
         return 0;
 }
 
-int simple_prepare_write(struct file *file, struct page *page,
-                        unsigned from, unsigned to)
-{
-        if (!PageUptodate(page)) {
-                if (to - from != PAGE_CACHE_SIZE)
-                        zero_user_segments(page,
-                                0, from,
-                                to, PAGE_CACHE_SIZE);
-        }
-        return 0;
-}
-
 int simple_write_begin(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned flags,
                         struct page **pagep, void **fsdata)
 {
         struct page *page;
         pgoff_t index;
-        unsigned from;
 
         index = pos >> PAGE_CACHE_SHIFT;
-        from = pos & (PAGE_CACHE_SIZE - 1);
 
         page = grab_cache_page_write_begin(mapping, index, flags);
         if (!page)
@@ -367,43 +354,59 @@ int simple_write_begin(struct file *file, struct address_space *mapping,
 
         *pagep = page;
 
-        return simple_prepare_write(file, page, from, from+len);
-}
+        if (!PageUptodate(page) && (len != PAGE_CACHE_SIZE)) {
+                unsigned from = pos & (PAGE_CACHE_SIZE - 1);
 
-static int simple_commit_write(struct file *file, struct page *page,
-                               unsigned from, unsigned to)
-{
-        struct inode *inode = page->mapping->host;
-        loff_t pos = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to;
-
-        if (!PageUptodate(page))
-                SetPageUptodate(page);
-        /*
-         * No need to use i_size_read() here, the i_size
-         * cannot change under us because we hold the i_mutex.
-         */
-        if (pos > inode->i_size)
-                i_size_write(inode, pos);
-        set_page_dirty(page);
+                zero_user_segments(page, 0, from, from + len, PAGE_CACHE_SIZE);
+        }
         return 0;
 }
 
+/**
+ * simple_write_end - .write_end helper for non-block-device FSes
+ * @available: See .write_end of address_space_operations
+ * @file:               "
+ * @mapping:            "
+ * @pos:                "
+ * @len:                "
+ * @copied:             "
+ * @page:               "
+ * @fsdata:             "
+ *
+ * simple_write_end does the minimum needed for updating a page after writing is
+ * done. It has the same API signature as the .write_end of
+ * address_space_operations vector. So it can just be set onto .write_end for
+ * FSes that don't need any other processing. i_mutex is assumed to be held.
+ * Block based filesystems should use generic_write_end().
+ * NOTE: Even though i_size might get updated by this function, mark_inode_dirty
+ * is not called, so a filesystem that actually does store data in .write_inode
+ * should extend on what's done here with a call to mark_inode_dirty() in the
+ * case that i_size has changed.
+ */
 int simple_write_end(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned copied,
                         struct page *page, void *fsdata)
 {
-        unsigned from = pos & (PAGE_CACHE_SIZE - 1);
+        struct inode *inode = page->mapping->host;
+        loff_t last_pos = pos + copied;
 
         /* zero the stale part of the page if we did a short copy */
         if (copied < len) {
-                void *kaddr = kmap_atomic(page, KM_USER0);
-                memset(kaddr + from + copied, 0, len - copied);
-                flush_dcache_page(page);
-                kunmap_atomic(kaddr, KM_USER0);
+                unsigned from = pos & (PAGE_CACHE_SIZE - 1);
+
+                zero_user(page, from + copied, len - copied);
         }
 
-        simple_commit_write(file, page, from, from+copied);
+        if (!PageUptodate(page))
+                SetPageUptodate(page);
+        /*
+         * No need to use i_size_read() here, the i_size
+         * cannot change under us because we hold the i_mutex.
+         */
+        if (last_pos > inode->i_size)
+                i_size_write(inode, last_pos);
 
+        set_page_dirty(page);
         unlock_page(page);
         page_cache_release(page);
 
@@ -853,7 +856,6 @@ EXPORT_SYMBOL(simple_getattr);
 EXPORT_SYMBOL(simple_link);
 EXPORT_SYMBOL(simple_lookup);
 EXPORT_SYMBOL(simple_pin_fs);
-EXPORT_UNUSED_SYMBOL(simple_prepare_write);
 EXPORT_SYMBOL(simple_readpage);
 EXPORT_SYMBOL(simple_release_fs);
 EXPORT_SYMBOL(simple_rename);
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index fc9032dc8862..64fd427c993c 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -8,6 +8,7 @@
 
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/time.h>
 #include <linux/nfs_fs.h>
 #include <linux/sunrpc/clnt.h>
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index c81249fef11f..7932c399fab4 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -8,6 +8,7 @@
 
 #include <linux/module.h>
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 4600c2037b8b..bb464d12104c 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -479,8 +479,8 @@ again:	mutex_lock(&nlm_host_mutex);
                         }
                 }
         }
-
         mutex_unlock(&nlm_host_mutex);
+        nsm_release(nsm);
 }
 
 /*
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index f956651d0f65..e3015464fbab 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -10,6 +10,7 @@
 #include <linux/utsname.h>
 #include <linux/kernel.h>
 #include <linux/ktime.h>
+#include <linux/slab.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/xprtsock.h>
@@ -349,9 +350,9 @@ retry:
  * nsm_reboot_lookup - match NLMPROC_SM_NOTIFY arguments to an nsm_handle
  * @info: pointer to NLMPROC_SM_NOTIFY arguments
  *
- * Returns a matching nsm_handle if found in the nsm cache; the returned
- * nsm_handle's reference count is bumped and sm_monitored is cleared.
- * Otherwise returns NULL if some error occurred.
+ * Returns a matching nsm_handle if found in the nsm cache. The returned
+ * nsm_handle's reference count is bumped. Otherwise returns NULL if some
+ * error occurred.
  */
 struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info)
 {
@@ -370,12 +371,6 @@ struct nsm_handle *nsm_reboot_lookup(const struct nlm_reboot *info)
         atomic_inc(&cached->sm_count);
         spin_unlock(&nsm_lock);
 
-        /*
-         * During subsequent lock activity, force a fresh
-         * notification to be set up for this host.
-         */
-        cached->sm_monitored = 0;
-
         dprintk("lockd: host %s (%s) rebooted, cnt %d\n",
                         cached->sm_name, cached->sm_addrbuf,
                         atomic_read(&cached->sm_count));
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index e50cfa3d9654..f1bacf1a0391 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -21,7 +21,6 @@
 #include <linux/errno.h>
 #include <linux/in.h>
 #include <linux/uio.h>
-#include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/smp_lock.h>
 #include <linux/mutex.h>
@@ -243,11 +242,9 @@ static int make_socks(struct svc_serv *serv)
         if (err < 0)
                 goto out_err;
 
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         err = create_lockd_family(serv, PF_INET6);
         if (err < 0 && err != -EAFNOSUPPORT)
                 goto out_err;
-#endif  /* CONFIG_IPV6 || CONFIG_IPV6_MODULE */
 
         warned = 0;
         return 0;
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index a7966eed3c17..031c6569a134 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -9,7 +9,6 @@
 
 #include <linux/types.h>
 #include <linux/time.h>
-#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/lockd/lockd.h>
 #include <linux/lockd/share.h>
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index d1001790fa9a..84055d31bfc5 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
index 56c9519d900a..0f2ab741ae7c 100644
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -9,7 +9,6 @@
 
 #include <linux/types.h>
 #include <linux/time.h>
-#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/lockd/lockd.h>
 #include <linux/lockd/share.h>
diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c
index ad478da7ca63..d0ef94cfb3da 100644
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -10,6 +10,7 @@
 #include <linux/string.h>
 #include <linux/time.h>
 #include <linux/in.h>
+#include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/clnt.h>
diff --git a/fs/locks.c b/fs/locks.c
index a8794f233bc9..ab24d49fc048 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1182,8 +1182,9 @@ int __break_lease(struct inode *inode, unsigned int mode)
         struct file_lock *fl;
         unsigned long break_time;
         int i_have_this_lease = 0;
+        int want_write = (mode & O_ACCMODE) != O_RDONLY;
 
-        new_fl = lease_alloc(NULL, mode & FMODE_WRITE ? F_WRLCK : F_RDLCK);
+        new_fl = lease_alloc(NULL, want_write ? F_WRLCK : F_RDLCK);
 
         lock_kernel();
 
@@ -1197,7 +1198,7 @@ int __break_lease(struct inode *inode, unsigned int mode)
                 if (fl->fl_owner == current->files)
                         i_have_this_lease = 1;
 
-        if (mode & FMODE_WRITE) {
+        if (want_write) {
                 /* If we want write access, we have to revoke any lease. */
                 future = F_UNLCK | F_INPROGRESS;
         } else if (flock->fl_type & F_INPROGRESS) {
@@ -1454,7 +1455,7 @@ EXPORT_SYMBOL(generic_setlease);
  *      leases held by processes on this node.
  *
  *      There is also no break_lease method; filesystems that
- *      handle their own leases shoud break leases themselves from the
+ *      handle their own leases should break leases themselves from the
  *      filesystem's open, create, and (on truncate) setattr methods.
  *
  *      Warning: the only current setlease methods exist only to disable
diff --git a/fs/logfs/Kconfig b/fs/logfs/Kconfig
new file mode 100644
index 000000000000..daf9a9b32dd3
--- /dev/null
+++ b/fs/logfs/Kconfig
@@ -0,0 +1,17 @@
+config LOGFS
+        tristate "LogFS file system (EXPERIMENTAL)"
+        depends on (MTD || BLOCK) && EXPERIMENTAL
+        select ZLIB_INFLATE
+        select ZLIB_DEFLATE
+        select CRC32
+        select BTREE
+        help
+          Flash filesystem aimed to scale efficiently to large devices.
+          In comparison to JFFS2 it offers significantly faster mount
+          times and potentially less RAM usage, although the latter has
+          not been measured yet.
+
+          In its current state it is still very experimental and should
+          not be used for other than testing purposes.
+
+          If unsure, say N.
diff --git a/fs/logfs/Makefile b/fs/logfs/Makefile
new file mode 100644
index 000000000000..4820027787ee
--- /dev/null
+++ b/fs/logfs/Makefile
@@ -0,0 +1,13 @@
+obj-$(CONFIG_LOGFS)     += logfs.o
+
+logfs-y += compr.o
+logfs-y += dir.o
+logfs-y += file.o
+logfs-y += gc.o
+logfs-y += inode.o
+logfs-y += journal.o
+logfs-y += readwrite.o
+logfs-y += segment.o
+logfs-y += super.o
+logfs-$(CONFIG_BLOCK)   += dev_bdev.o
+logfs-$(CONFIG_MTD)     += dev_mtd.o
diff --git a/fs/logfs/compr.c b/fs/logfs/compr.c
new file mode 100644
index 000000000000..44bbfd249abc
--- /dev/null
+++ b/fs/logfs/compr.c
@@ -0,0 +1,95 @@
+/*
+ * fs/logfs/compr.c     - compression routines
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/vmalloc.h>
+#include <linux/zlib.h>
+
+#define COMPR_LEVEL 3
+
+static DEFINE_MUTEX(compr_mutex);
+static struct z_stream_s stream;
+
+int logfs_compress(void *in, void *out, size_t inlen, size_t outlen)
+{
+        int err, ret;
+
+        ret = -EIO;
+        mutex_lock(&compr_mutex);
+        err = zlib_deflateInit(&stream, COMPR_LEVEL);
+        if (err != Z_OK)
+                goto error;
+
+        stream.next_in = in;
+        stream.avail_in = inlen;
+        stream.total_in = 0;
+        stream.next_out = out;
+        stream.avail_out = outlen;
+        stream.total_out = 0;
+
+        err = zlib_deflate(&stream, Z_FINISH);
+        if (err != Z_STREAM_END)
+                goto error;
+
+        err = zlib_deflateEnd(&stream);
+        if (err != Z_OK)
+                goto error;
+
+        if (stream.total_out >= stream.total_in)
+                goto error;
+
+        ret = stream.total_out;
+error:
+        mutex_unlock(&compr_mutex);
+        return ret;
+}
+
+int logfs_uncompress(void *in, void *out, size_t inlen, size_t outlen)
+{
+        int err, ret;
+
+        ret = -EIO;
+        mutex_lock(&compr_mutex);
+        err = zlib_inflateInit(&stream);
+        if (err != Z_OK)
+                goto error;
+
+        stream.next_in = in;
+        stream.avail_in = inlen;
+        stream.total_in = 0;
+        stream.next_out = out;
+        stream.avail_out = outlen;
+        stream.total_out = 0;
+
+        err = zlib_inflate(&stream, Z_FINISH);
+        if (err != Z_STREAM_END)
+                goto error;
+
+        err = zlib_inflateEnd(&stream);
+        if (err != Z_OK)
+                goto error;
+
+        ret = 0;
+error:
+        mutex_unlock(&compr_mutex);
+        return ret;
+}
+
+int __init logfs_compr_init(void)
+{
+        size_t size = max(zlib_deflate_workspacesize(),
+                        zlib_inflate_workspacesize());
+        stream.workspace = vmalloc(size);
+        if (!stream.workspace)
+                return -ENOMEM;
+        return 0;
+}
+
+void logfs_compr_exit(void)
+{
+        vfree(stream.workspace);
+}
diff --git a/fs/logfs/dev_bdev.c b/fs/logfs/dev_bdev.c
new file mode 100644
index 000000000000..243c00071f76
--- /dev/null
+++ b/fs/logfs/dev_bdev.c
@@ -0,0 +1,333 @@
+/*
+ * fs/logfs/dev_bdev.c  - Device access methods for block devices
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/bio.h>
+#include <linux/blkdev.h>
+#include <linux/buffer_head.h>
+#include <linux/gfp.h>
+
+#define PAGE_OFS(ofs) ((ofs) & (PAGE_SIZE-1))
+
+static void request_complete(struct bio *bio, int err)
+{
+        complete((struct completion *)bio->bi_private);
+}
+
+static int sync_request(struct page *page, struct block_device *bdev, int rw)
+{
+        struct bio bio;
+        struct bio_vec bio_vec;
+        struct completion complete;
+
+        bio_init(&bio);
+        bio.bi_io_vec = &bio_vec;
+        bio_vec.bv_page = page;
+        bio_vec.bv_len = PAGE_SIZE;
+        bio_vec.bv_offset = 0;
+        bio.bi_vcnt = 1;
+        bio.bi_idx = 0;
+        bio.bi_size = PAGE_SIZE;
+        bio.bi_bdev = bdev;
+        bio.bi_sector = page->index * (PAGE_SIZE >> 9);
+        init_completion(&complete);
+        bio.bi_private = &complete;
+        bio.bi_end_io = request_complete;
+
+        submit_bio(rw, &bio);
+        generic_unplug_device(bdev_get_queue(bdev));
+        wait_for_completion(&complete);
+        return test_bit(BIO_UPTODATE, &bio.bi_flags) ? 0 : -EIO;
+}
+
+static int bdev_readpage(void *_sb, struct page *page)
+{
+        struct super_block *sb = _sb;
+        struct block_device *bdev = logfs_super(sb)->s_bdev;
+        int err;
+
+        err = sync_request(page, bdev, READ);
+        if (err) {
+                ClearPageUptodate(page);
+                SetPageError(page);
+        } else {
+                SetPageUptodate(page);
+                ClearPageError(page);
+        }
+        unlock_page(page);
+        return err;
+}
+
+static DECLARE_WAIT_QUEUE_HEAD(wq);
+
+static void writeseg_end_io(struct bio *bio, int err)
+{
+        const int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
+        struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
+        struct super_block *sb = bio->bi_private;
+        struct logfs_super *super = logfs_super(sb);
+        struct page *page;
+
+        BUG_ON(!uptodate); /* FIXME: Retry io or write elsewhere */
+        BUG_ON(err);
+        BUG_ON(bio->bi_vcnt == 0);
+        do {
+                page = bvec->bv_page;
+                if (--bvec >= bio->bi_io_vec)
+                        prefetchw(&bvec->bv_page->flags);
+
+                end_page_writeback(page);
+                page_cache_release(page);
+        } while (bvec >= bio->bi_io_vec);
+        bio_put(bio);
+        if (atomic_dec_and_test(&super->s_pending_writes))
+                wake_up(&wq);
+}
+
+static int __bdev_writeseg(struct super_block *sb, u64 ofs, pgoff_t index,
+                size_t nr_pages)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        struct bio *bio;
+        struct page *page;
+        struct request_queue *q = bdev_get_queue(sb->s_bdev);
+        unsigned int max_pages = queue_max_hw_sectors(q) >> (PAGE_SHIFT - 9);
+        int i;
+
+        if (max_pages > BIO_MAX_PAGES)
+                max_pages = BIO_MAX_PAGES;
+        bio = bio_alloc(GFP_NOFS, max_pages);
+        BUG_ON(!bio);
+
+        for (i = 0; i < nr_pages; i++) {
+                if (i >= max_pages) {
+                        /* Block layer cannot split bios :( */
+                        bio->bi_vcnt = i;
+                        bio->bi_idx = 0;
+                        bio->bi_size = i * PAGE_SIZE;
+                        bio->bi_bdev = super->s_bdev;
+                        bio->bi_sector = ofs >> 9;
+                        bio->bi_private = sb;
+                        bio->bi_end_io = writeseg_end_io;
+                        atomic_inc(&super->s_pending_writes);
+                        submit_bio(WRITE, bio);
+
+                        ofs += i * PAGE_SIZE;
+                        index += i;
+                        nr_pages -= i;
+                        i = 0;
+
+                        bio = bio_alloc(GFP_NOFS, max_pages);
+                        BUG_ON(!bio);
+                }
+                page = find_lock_page(mapping, index + i);
+                BUG_ON(!page);
+                bio->bi_io_vec[i].bv_page = page;
+                bio->bi_io_vec[i].bv_len = PAGE_SIZE;
+                bio->bi_io_vec[i].bv_offset = 0;
+
+                BUG_ON(PageWriteback(page));
+                set_page_writeback(page);
+                unlock_page(page);
+        }
+        bio->bi_vcnt = nr_pages;
+        bio->bi_idx = 0;
+        bio->bi_size = nr_pages * PAGE_SIZE;
+        bio->bi_bdev = super->s_bdev;
+        bio->bi_sector = ofs >> 9;
+        bio->bi_private = sb;
+        bio->bi_end_io = writeseg_end_io;
+        atomic_inc(&super->s_pending_writes);
+        submit_bio(WRITE, bio);
+        return 0;
+}
+
+static void bdev_writeseg(struct super_block *sb, u64 ofs, size_t len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int head;
+
+        BUG_ON(super->s_flags & LOGFS_SB_FLAG_RO);
+
+        if (len == 0) {
+                /* This can happen when the object fit perfectly into a
+                 * segment, the segment gets written per sync and subsequently
+                 * closed.
+                 */
+                return;
+        }
+        head = ofs & (PAGE_SIZE - 1);
+        if (head) {
+                ofs -= head;
+                len += head;
+        }
+        len = PAGE_ALIGN(len);
+        __bdev_writeseg(sb, ofs, ofs >> PAGE_SHIFT, len >> PAGE_SHIFT);
+        generic_unplug_device(bdev_get_queue(logfs_super(sb)->s_bdev));
+}
+
+
+static void erase_end_io(struct bio *bio, int err) 
+{ 
+        const int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags); 
+        struct super_block *sb = bio->bi_private; 
+        struct logfs_super *super = logfs_super(sb); 
+
+        BUG_ON(!uptodate); /* FIXME: Retry io or write elsewhere */ 
+        BUG_ON(err); 
+        BUG_ON(bio->bi_vcnt == 0); 
+        bio_put(bio); 
+        if (atomic_dec_and_test(&super->s_pending_writes))
+                wake_up(&wq); 
+} 
+
+static int do_erase(struct super_block *sb, u64 ofs, pgoff_t index,
+                size_t nr_pages)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct bio *bio;
+        struct request_queue *q = bdev_get_queue(sb->s_bdev);
+        unsigned int max_pages = queue_max_hw_sectors(q) >> (PAGE_SHIFT - 9);
+        int i;
+
+        if (max_pages > BIO_MAX_PAGES)
+                max_pages = BIO_MAX_PAGES;
+        bio = bio_alloc(GFP_NOFS, max_pages);
+        BUG_ON(!bio);
+
+        for (i = 0; i < nr_pages; i++) {
+                if (i >= max_pages) {
+                        /* Block layer cannot split bios :( */
+                        bio->bi_vcnt = i;
+                        bio->bi_idx = 0;
+                        bio->bi_size = i * PAGE_SIZE;
+                        bio->bi_bdev = super->s_bdev;
+                        bio->bi_sector = ofs >> 9;
+                        bio->bi_private = sb;
+                        bio->bi_end_io = erase_end_io;
+                        atomic_inc(&super->s_pending_writes);
+                        submit_bio(WRITE, bio);
+
+                        ofs += i * PAGE_SIZE;
+                        index += i;
+                        nr_pages -= i;
+                        i = 0;
+
+                        bio = bio_alloc(GFP_NOFS, max_pages);
+                        BUG_ON(!bio);
+                }
+                bio->bi_io_vec[i].bv_page = super->s_erase_page;
+                bio->bi_io_vec[i].bv_len = PAGE_SIZE;
+                bio->bi_io_vec[i].bv_offset = 0;
+        }
+        bio->bi_vcnt = nr_pages;
+        bio->bi_idx = 0;
+        bio->bi_size = nr_pages * PAGE_SIZE;
+        bio->bi_bdev = super->s_bdev;
+        bio->bi_sector = ofs >> 9;
+        bio->bi_private = sb;
+        bio->bi_end_io = erase_end_io;
+        atomic_inc(&super->s_pending_writes);
+        submit_bio(WRITE, bio);
+        return 0;
+}
+
+static int bdev_erase(struct super_block *sb, loff_t to, size_t len,
+                int ensure_write)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        BUG_ON(to & (PAGE_SIZE - 1));
+        BUG_ON(len & (PAGE_SIZE - 1));
+
+        if (super->s_flags & LOGFS_SB_FLAG_RO)
+                return -EROFS;
+
+        if (ensure_write) {
+                /*
+                 * Object store doesn't care whether erases happen or not.
+                 * But for the journal they are required.  Otherwise a scan
+                 * can find an old commit entry and assume it is the current
+                 * one, travelling back in time.
+                 */
+                do_erase(sb, to, to >> PAGE_SHIFT, len >> PAGE_SHIFT);
+        }
+
+        return 0;
+}
+
+static void bdev_sync(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        wait_event(wq, atomic_read(&super->s_pending_writes) == 0);
+}
+
+static struct page *bdev_find_first_sb(struct super_block *sb, u64 *ofs)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        filler_t *filler = bdev_readpage;
+
+        *ofs = 0;
+        return read_cache_page(mapping, 0, filler, sb);
+}
+
+static struct page *bdev_find_last_sb(struct super_block *sb, u64 *ofs)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        filler_t *filler = bdev_readpage;
+        u64 pos = (super->s_bdev->bd_inode->i_size & ~0xfffULL) - 0x1000;
+        pgoff_t index = pos >> PAGE_SHIFT;
+
+        *ofs = pos;
+        return read_cache_page(mapping, index, filler, sb);
+}
+
+static int bdev_write_sb(struct super_block *sb, struct page *page)
+{
+        struct block_device *bdev = logfs_super(sb)->s_bdev;
+
+        /* Nothing special to do for block devices. */
+        return sync_request(page, bdev, WRITE);
+}
+
+static void bdev_put_device(struct super_block *sb)
+{
+        close_bdev_exclusive(logfs_super(sb)->s_bdev, FMODE_READ|FMODE_WRITE);
+}
+
+static const struct logfs_device_ops bd_devops = {
+        .find_first_sb  = bdev_find_first_sb,
+        .find_last_sb   = bdev_find_last_sb,
+        .write_sb       = bdev_write_sb,
+        .readpage       = bdev_readpage,
+        .writeseg       = bdev_writeseg,
+        .erase          = bdev_erase,
+        .sync           = bdev_sync,
+        .put_device     = bdev_put_device,
+};
+
+int logfs_get_sb_bdev(struct file_system_type *type, int flags,
+                const char *devname, struct vfsmount *mnt)
+{
+        struct block_device *bdev;
+
+        bdev = open_bdev_exclusive(devname, FMODE_READ|FMODE_WRITE, type);
+        if (IS_ERR(bdev))
+                return PTR_ERR(bdev);
+
+        if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
+                int mtdnr = MINOR(bdev->bd_dev);
+                close_bdev_exclusive(bdev, FMODE_READ|FMODE_WRITE);
+                return logfs_get_sb_mtd(type, flags, mtdnr, mnt);
+        }
+
+        return logfs_get_sb_device(type, flags, NULL, bdev, &bd_devops, mnt);
+}
diff --git a/fs/logfs/dev_mtd.c b/fs/logfs/dev_mtd.c
new file mode 100644
index 000000000000..cafb6ef2e05b
--- /dev/null
+++ b/fs/logfs/dev_mtd.c
@@ -0,0 +1,254 @@
+/*
+ * fs/logfs/dev_mtd.c   - Device access methods for MTD
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/completion.h>
+#include <linux/mount.h>
+#include <linux/sched.h>
+
+#define PAGE_OFS(ofs) ((ofs) & (PAGE_SIZE-1))
+
+static int mtd_read(struct super_block *sb, loff_t ofs, size_t len, void *buf)
+{
+        struct mtd_info *mtd = logfs_super(sb)->s_mtd;
+        size_t retlen;
+        int ret;
+
+        ret = mtd->read(mtd, ofs, len, &retlen, buf);
+        BUG_ON(ret == -EINVAL);
+        if (ret)
+                return ret;
+
+        /* Not sure if we should loop instead. */
+        if (retlen != len)
+                return -EIO;
+
+        return 0;
+}
+
+static int mtd_write(struct super_block *sb, loff_t ofs, size_t len, void *buf)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct mtd_info *mtd = super->s_mtd;
+        size_t retlen;
+        loff_t page_start, page_end;
+        int ret;
+
+        if (super->s_flags & LOGFS_SB_FLAG_RO)
+                return -EROFS;
+
+        BUG_ON((ofs >= mtd->size) || (len > mtd->size - ofs));
+        BUG_ON(ofs != (ofs >> super->s_writeshift) << super->s_writeshift);
+        BUG_ON(len > PAGE_CACHE_SIZE);
+        page_start = ofs & PAGE_CACHE_MASK;
+        page_end = PAGE_CACHE_ALIGN(ofs + len) - 1;
+        ret = mtd->write(mtd, ofs, len, &retlen, buf);
+        if (ret || (retlen != len))
+                return -EIO;
+
+        return 0;
+}
+
+/*
+ * For as long as I can remember (since about 2001) mtd->erase has been an
+ * asynchronous interface lacking the first driver to actually use the
+ * asynchronous properties.  So just to prevent the first implementor of such
+ * a thing from breaking logfs in 2350, we do the usual pointless dance to
+ * declare a completion variable and wait for completion before returning
+ * from mtd_erase().  What an excercise in futility!
+ */
+static void logfs_erase_callback(struct erase_info *ei)
+{
+        complete((struct completion *)ei->priv);
+}
+
+static int mtd_erase_mapping(struct super_block *sb, loff_t ofs, size_t len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        struct page *page;
+        pgoff_t index = ofs >> PAGE_SHIFT;
+
+        for (index = ofs >> PAGE_SHIFT; index < (ofs + len) >> PAGE_SHIFT; index++) {
+                page = find_get_page(mapping, index);
+                if (!page)
+                        continue;
+                memset(page_address(page), 0xFF, PAGE_SIZE);
+                page_cache_release(page);
+        }
+        return 0;
+}
+
+static int mtd_erase(struct super_block *sb, loff_t ofs, size_t len,
+                int ensure_write)
+{
+        struct mtd_info *mtd = logfs_super(sb)->s_mtd;
+        struct erase_info ei;
+        DECLARE_COMPLETION_ONSTACK(complete);
+        int ret;
+
+        BUG_ON(len % mtd->erasesize);
+        if (logfs_super(sb)->s_flags & LOGFS_SB_FLAG_RO)
+                return -EROFS;
+
+        memset(&ei, 0, sizeof(ei));
+        ei.mtd = mtd;
+        ei.addr = ofs;
+        ei.len = len;
+        ei.callback = logfs_erase_callback;
+        ei.priv = (long)&complete;
+        ret = mtd->erase(mtd, &ei);
+        if (ret)
+                return -EIO;
+
+        wait_for_completion(&complete);
+        if (ei.state != MTD_ERASE_DONE)
+                return -EIO;
+        return mtd_erase_mapping(sb, ofs, len);
+}
+
+static void mtd_sync(struct super_block *sb)
+{
+        struct mtd_info *mtd = logfs_super(sb)->s_mtd;
+
+        if (mtd->sync)
+                mtd->sync(mtd);
+}
+
+static int mtd_readpage(void *_sb, struct page *page)
+{
+        struct super_block *sb = _sb;
+        int err;
+
+        err = mtd_read(sb, page->index << PAGE_SHIFT, PAGE_SIZE,
+                        page_address(page));
+        if (err == -EUCLEAN) {
+                err = 0;
+                /* FIXME: force GC this segment */
+        }
+        if (err) {
+                ClearPageUptodate(page);
+                SetPageError(page);
+        } else {
+                SetPageUptodate(page);
+                ClearPageError(page);
+        }
+        unlock_page(page);
+        return err;
+}
+
+static struct page *mtd_find_first_sb(struct super_block *sb, u64 *ofs)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        filler_t *filler = mtd_readpage;
+        struct mtd_info *mtd = super->s_mtd;
+
+        if (!mtd->block_isbad)
+                return NULL;
+
+        *ofs = 0;
+        while (mtd->block_isbad(mtd, *ofs)) {
+                *ofs += mtd->erasesize;
+                if (*ofs >= mtd->size)
+                        return NULL;
+        }
+        BUG_ON(*ofs & ~PAGE_MASK);
+        return read_cache_page(mapping, *ofs >> PAGE_SHIFT, filler, sb);
+}
+
+static struct page *mtd_find_last_sb(struct super_block *sb, u64 *ofs)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        filler_t *filler = mtd_readpage;
+        struct mtd_info *mtd = super->s_mtd;
+
+        if (!mtd->block_isbad)
+                return NULL;
+
+        *ofs = mtd->size - mtd->erasesize;
+        while (mtd->block_isbad(mtd, *ofs)) {
+                *ofs -= mtd->erasesize;
+                if (*ofs <= 0)
+                        return NULL;
+        }
+        *ofs = *ofs + mtd->erasesize - 0x1000;
+        BUG_ON(*ofs & ~PAGE_MASK);
+        return read_cache_page(mapping, *ofs >> PAGE_SHIFT, filler, sb);
+}
+
+static int __mtd_writeseg(struct super_block *sb, u64 ofs, pgoff_t index,
+                size_t nr_pages)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        struct page *page;
+        int i, err;
+
+        for (i = 0; i < nr_pages; i++) {
+                page = find_lock_page(mapping, index + i);
+                BUG_ON(!page);
+
+                err = mtd_write(sb, page->index << PAGE_SHIFT, PAGE_SIZE,
+                                page_address(page));
+                unlock_page(page);
+                page_cache_release(page);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+static void mtd_writeseg(struct super_block *sb, u64 ofs, size_t len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int head;
+
+        if (super->s_flags & LOGFS_SB_FLAG_RO)
+                return;
+
+        if (len == 0) {
+                /* This can happen when the object fit perfectly into a
+                 * segment, the segment gets written per sync and subsequently
+                 * closed.
+                 */
+                return;
+        }
+        head = ofs & (PAGE_SIZE - 1);
+        if (head) {
+                ofs -= head;
+                len += head;
+        }
+        len = PAGE_ALIGN(len);
+        __mtd_writeseg(sb, ofs, ofs >> PAGE_SHIFT, len >> PAGE_SHIFT);
+}
+
+static void mtd_put_device(struct super_block *sb)
+{
+        put_mtd_device(logfs_super(sb)->s_mtd);
+}
+
+static const struct logfs_device_ops mtd_devops = {
+        .find_first_sb  = mtd_find_first_sb,
+        .find_last_sb   = mtd_find_last_sb,
+        .readpage       = mtd_readpage,
+        .writeseg       = mtd_writeseg,
+        .erase          = mtd_erase,
+        .sync           = mtd_sync,
+        .put_device     = mtd_put_device,
+};
+
+int logfs_get_sb_mtd(struct file_system_type *type, int flags,
+                int mtdnr, struct vfsmount *mnt)
+{
+        struct mtd_info *mtd;
+        const struct logfs_device_ops *devops = &mtd_devops;
+
+        mtd = get_mtd_device(NULL, mtdnr);
+        return logfs_get_sb_device(type, flags, mtd, NULL, devops, mnt);
+}
diff --git a/fs/logfs/dir.c b/fs/logfs/dir.c
new file mode 100644
index 000000000000..2396a85c0f55
--- /dev/null
+++ b/fs/logfs/dir.c
@@ -0,0 +1,827 @@
+/*
+ * fs/logfs/dir.c       - directory-related code
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/slab.h>
+
+/*
+ * Atomic dir operations
+ *
+ * Directory operations are by default not atomic.  Dentries and Inodes are
+ * created/removed/altered in seperate operations.  Therefore we need to do
+ * a small amount of journaling.
+ *
+ * Create, link, mkdir, mknod and symlink all share the same function to do
+ * the work: __logfs_create.  This function works in two atomic steps:
+ * 1. allocate inode (remember in journal)
+ * 2. allocate dentry (clear journal)
+ *
+ * As we can only get interrupted between the two, when the inode we just
+ * created is simply stored in the anchor.  On next mount, if we were
+ * interrupted, we delete the inode.  From a users point of view the
+ * operation never happened.
+ *
+ * Unlink and rmdir also share the same function: unlink.  Again, this
+ * function works in two atomic steps
+ * 1. remove dentry (remember inode in journal)
+ * 2. unlink inode (clear journal)
+ *
+ * And again, on the next mount, if we were interrupted, we delete the inode.
+ * From a users point of view the operation succeeded.
+ *
+ * Rename is the real pain to deal with, harder than all the other methods
+ * combined.  Depending on the circumstances we can run into three cases.
+ * A "target rename" where the target dentry already existed, a "local
+ * rename" where both parent directories are identical or a "cross-directory
+ * rename" in the remaining case.
+ *
+ * Local rename is atomic, as the old dentry is simply rewritten with a new
+ * name.
+ *
+ * Cross-directory rename works in two steps, similar to __logfs_create and
+ * logfs_unlink:
+ * 1. Write new dentry (remember old dentry in journal)
+ * 2. Remove old dentry (clear journal)
+ *
+ * Here we remember a dentry instead of an inode.  On next mount, if we were
+ * interrupted, we delete the dentry.  From a users point of view, the
+ * operation succeeded.
+ *
+ * Target rename works in three atomic steps:
+ * 1. Attach old inode to new dentry (remember old dentry and new inode)
+ * 2. Remove old dentry (still remember the new inode)
+ * 3. Remove victim inode
+ *
+ * Here we remember both an inode an a dentry.  If we get interrupted
+ * between steps 1 and 2, we delete both the dentry and the inode.  If
+ * we get interrupted between steps 2 and 3, we delete just the inode.
+ * In either case, the remaining objects are deleted on next mount.  From
+ * a users point of view, the operation succeeded.
+ */
+
+static int write_dir(struct inode *dir, struct logfs_disk_dentry *dd,
+                loff_t pos)
+{
+        return logfs_inode_write(dir, dd, sizeof(*dd), pos, WF_LOCK, NULL);
+}
+
+static int write_inode(struct inode *inode)
+{
+        return __logfs_write_inode(inode, WF_LOCK);
+}
+
+static s64 dir_seek_data(struct inode *inode, s64 pos)
+{
+        s64 new_pos = logfs_seek_data(inode, pos);
+
+        return max(pos, new_pos - 1);
+}
+
+static int beyond_eof(struct inode *inode, loff_t bix)
+{
+        loff_t pos = bix << inode->i_sb->s_blocksize_bits;
+        return pos >= i_size_read(inode);
+}
+
+/*
+ * Prime value was chosen to be roughly 256 + 26.  r5 hash uses 11,
+ * so short names (len <= 9) don't even occupy the complete 32bit name
+ * space.  A prime >256 ensures short names quickly spread the 32bit
+ * name space.  Add about 26 for the estimated amount of information
+ * of each character and pick a prime nearby, preferrably a bit-sparse
+ * one.
+ */
+static u32 hash_32(const char *s, int len, u32 seed)
+{
+        u32 hash = seed;
+        int i;
+
+        for (i = 0; i < len; i++)
+                hash = hash * 293 + s[i];
+        return hash;
+}
+
+/*
+ * We have to satisfy several conflicting requirements here.  Small
+ * directories should stay fairly compact and not require too many
+ * indirect blocks.  The number of possible locations for a given hash
+ * should be small to make lookup() fast.  And we should try hard not
+ * to overflow the 32bit name space or nfs and 32bit host systems will
+ * be unhappy.
+ *
+ * So we use the following scheme.  First we reduce the hash to 0..15
+ * and try a direct block.  If that is occupied we reduce the hash to
+ * 16..255 and try an indirect block.  Same for 2x and 3x indirect
+ * blocks.  Lastly we reduce the hash to 0x800_0000 .. 0xffff_ffff,
+ * but use buckets containing eight entries instead of a single one.
+ *
+ * Using 16 entries should allow for a reasonable amount of hash
+ * collisions, so the 32bit name space can be packed fairly tight
+ * before overflowing.  Oh and currently we don't overflow but return
+ * and error.
+ *
+ * How likely are collisions?  Doing the appropriate math is beyond me
+ * and the Bronstein textbook.  But running a test program to brute
+ * force collisions for a couple of days showed that on average the
+ * first collision occurs after 598M entries, with 290M being the
+ * smallest result.  Obviously 21 entries could already cause a
+ * collision if all entries are carefully chosen.
+ */
+static pgoff_t hash_index(u32 hash, int round)
+{
+        u32 i0_blocks = I0_BLOCKS;
+        u32 i1_blocks = I1_BLOCKS;
+        u32 i2_blocks = I2_BLOCKS;
+        u32 i3_blocks = I3_BLOCKS;
+
+        switch (round) {
+        case 0:
+                return hash % i0_blocks;
+        case 1:
+                return i0_blocks + hash % (i1_blocks - i0_blocks);
+        case 2:
+                return i1_blocks + hash % (i2_blocks - i1_blocks);
+        case 3:
+                return i2_blocks + hash % (i3_blocks - i2_blocks);
+        case 4 ... 19:
+                return i3_blocks + 16 * (hash % (((1<<31) - i3_blocks) / 16))
+                        + round - 4;
+        }
+        BUG();
+}
+
+static struct page *logfs_get_dd_page(struct inode *dir, struct dentry *dentry)
+{
+        struct qstr *name = &dentry->d_name;
+        struct page *page;
+        struct logfs_disk_dentry *dd;
+        u32 hash = hash_32(name->name, name->len, 0);
+        pgoff_t index;
+        int round;
+
+        if (name->len > LOGFS_MAX_NAMELEN)
+                return ERR_PTR(-ENAMETOOLONG);
+
+        for (round = 0; round < 20; round++) {
+                index = hash_index(hash, round);
+
+                if (beyond_eof(dir, index))
+                        return NULL;
+                if (!logfs_exist_block(dir, index))
+                        continue;
+                page = read_cache_page(dir->i_mapping, index,
+                                (filler_t *)logfs_readpage, NULL);
+                if (IS_ERR(page))
+                        return page;
+                dd = kmap_atomic(page, KM_USER0);
+                BUG_ON(dd->namelen == 0);
+
+                if (name->len != be16_to_cpu(dd->namelen) ||
+                                memcmp(name->name, dd->name, name->len)) {
+                        kunmap_atomic(dd, KM_USER0);
+                        page_cache_release(page);
+                        continue;
+                }
+
+                kunmap_atomic(dd, KM_USER0);
+                return page;
+        }
+        return NULL;
+}
+
+static int logfs_remove_inode(struct inode *inode)
+{
+        int ret;
+
+        inode->i_nlink--;
+        ret = write_inode(inode);
+        LOGFS_BUG_ON(ret, inode->i_sb);
+        return ret;
+}
+
+static void abort_transaction(struct inode *inode, struct logfs_transaction *ta)
+{
+        if (logfs_inode(inode)->li_block)
+                logfs_inode(inode)->li_block->ta = NULL;
+        kfree(ta);
+}
+
+static int logfs_unlink(struct inode *dir, struct dentry *dentry)
+{
+        struct logfs_super *super = logfs_super(dir->i_sb);
+        struct inode *inode = dentry->d_inode;
+        struct logfs_transaction *ta;
+        struct page *page;
+        pgoff_t index;
+        int ret;
+
+        ta = kzalloc(sizeof(*ta), GFP_KERNEL);
+        if (!ta)
+                return -ENOMEM;
+
+        ta->state = UNLINK_1;
+        ta->ino = inode->i_ino;
+
+        inode->i_ctime = dir->i_ctime = dir->i_mtime = CURRENT_TIME;
+
+        page = logfs_get_dd_page(dir, dentry);
+        if (!page) {
+                kfree(ta);
+                return -ENOENT;
+        }
+        if (IS_ERR(page)) {
+                kfree(ta);
+                return PTR_ERR(page);
+        }
+        index = page->index;
+        page_cache_release(page);
+
+        mutex_lock(&super->s_dirop_mutex);
+        logfs_add_transaction(dir, ta);
+
+        ret = logfs_delete(dir, index, NULL);
+        if (!ret)
+                ret = write_inode(dir);
+
+        if (ret) {
+                abort_transaction(dir, ta);
+                printk(KERN_ERR"LOGFS: unable to delete inode\n");
+                goto out;
+        }
+
+        ta->state = UNLINK_2;
+        logfs_add_transaction(inode, ta);
+        ret = logfs_remove_inode(inode);
+out:
+        mutex_unlock(&super->s_dirop_mutex);
+        return ret;
+}
+
+static inline int logfs_empty_dir(struct inode *dir)
+{
+        u64 data;
+
+        data = logfs_seek_data(dir, 0) << dir->i_sb->s_blocksize_bits;
+        return data >= i_size_read(dir);
+}
+
+static int logfs_rmdir(struct inode *dir, struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if (!logfs_empty_dir(inode))
+                return -ENOTEMPTY;
+
+        return logfs_unlink(dir, dentry);
+}
+
+/* FIXME: readdir currently has it's own dir_walk code.  I don't see a good
+ * way to combine the two copies */
+#define IMPLICIT_NODES 2
+static int __logfs_readdir(struct file *file, void *buf, filldir_t filldir)
+{
+        struct inode *dir = file->f_dentry->d_inode;
+        loff_t pos = file->f_pos - IMPLICIT_NODES;
+        struct page *page;
+        struct logfs_disk_dentry *dd;
+        int full;
+
+        BUG_ON(pos < 0);
+        for (;; pos++) {
+                if (beyond_eof(dir, pos))
+                        break;
+                if (!logfs_exist_block(dir, pos)) {
+                        /* deleted dentry */
+                        pos = dir_seek_data(dir, pos);
+                        continue;
+                }
+                page = read_cache_page(dir->i_mapping, pos,
+                                (filler_t *)logfs_readpage, NULL);
+                if (IS_ERR(page))
+                        return PTR_ERR(page);
+                dd = kmap(page);
+                BUG_ON(dd->namelen == 0);
+
+                full = filldir(buf, (char *)dd->name, be16_to_cpu(dd->namelen),
+                                pos, be64_to_cpu(dd->ino), dd->type);
+                kunmap(page);
+                page_cache_release(page);
+                if (full)
+                        break;
+        }
+
+        file->f_pos = pos + IMPLICIT_NODES;
+        return 0;
+}
+
+static int logfs_readdir(struct file *file, void *buf, filldir_t filldir)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        ino_t pino = parent_ino(file->f_dentry);
+        int err;
+
+        if (file->f_pos < 0)
+                return -EINVAL;
+
+        if (file->f_pos == 0) {
+                if (filldir(buf, ".", 1, 1, inode->i_ino, DT_DIR) < 0)
+                        return 0;
+                file->f_pos++;
+        }
+        if (file->f_pos == 1) {
+                if (filldir(buf, "..", 2, 2, pino, DT_DIR) < 0)
+                        return 0;
+                file->f_pos++;
+        }
+
+        err = __logfs_readdir(file, buf, filldir);
+        return err;
+}
+
+static void logfs_set_name(struct logfs_disk_dentry *dd, struct qstr *name)
+{
+        dd->namelen = cpu_to_be16(name->len);
+        memcpy(dd->name, name->name, name->len);
+}
+
+static struct dentry *logfs_lookup(struct inode *dir, struct dentry *dentry,
+                struct nameidata *nd)
+{
+        struct page *page;
+        struct logfs_disk_dentry *dd;
+        pgoff_t index;
+        u64 ino = 0;
+        struct inode *inode;
+
+        page = logfs_get_dd_page(dir, dentry);
+        if (IS_ERR(page))
+                return ERR_CAST(page);
+        if (!page) {
+                d_add(dentry, NULL);
+                return NULL;
+        }
+        index = page->index;
+        dd = kmap_atomic(page, KM_USER0);
+        ino = be64_to_cpu(dd->ino);
+        kunmap_atomic(dd, KM_USER0);
+        page_cache_release(page);
+
+        inode = logfs_iget(dir->i_sb, ino);
+        if (IS_ERR(inode)) {
+                printk(KERN_ERR"LogFS: Cannot read inode #%llx for dentry (%lx, %lx)n",
+                                ino, dir->i_ino, index);
+                return ERR_CAST(inode);
+        }
+        return d_splice_alias(inode, dentry);
+}
+
+static void grow_dir(struct inode *dir, loff_t index)
+{
+        index = (index + 1) << dir->i_sb->s_blocksize_bits;
+        if (i_size_read(dir) < index)
+                i_size_write(dir, index);
+}
+
+static int logfs_write_dir(struct inode *dir, struct dentry *dentry,
+                struct inode *inode)
+{
+        struct page *page;
+        struct logfs_disk_dentry *dd;
+        u32 hash = hash_32(dentry->d_name.name, dentry->d_name.len, 0);
+        pgoff_t index;
+        int round, err;
+
+        for (round = 0; round < 20; round++) {
+                index = hash_index(hash, round);
+
+                if (logfs_exist_block(dir, index))
+                        continue;
+                page = find_or_create_page(dir->i_mapping, index, GFP_KERNEL);
+                if (!page)
+                        return -ENOMEM;
+
+                dd = kmap_atomic(page, KM_USER0);
+                memset(dd, 0, sizeof(*dd));
+                dd->ino = cpu_to_be64(inode->i_ino);
+                dd->type = logfs_type(inode);
+                logfs_set_name(dd, &dentry->d_name);
+                kunmap_atomic(dd, KM_USER0);
+
+                err = logfs_write_buf(dir, page, WF_LOCK);
+                unlock_page(page);
+                page_cache_release(page);
+                if (!err)
+                        grow_dir(dir, index);
+                return err;
+        }
+        /* FIXME: Is there a better return value?  In most cases neither
+         * the filesystem nor the directory are full.  But we have had
+         * too many collisions for this particular hash and no fallback.
+         */
+        return -ENOSPC;
+}
+
+static int __logfs_create(struct inode *dir, struct dentry *dentry,
+                struct inode *inode, const char *dest, long destlen)
+{
+        struct logfs_super *super = logfs_super(dir->i_sb);
+        struct logfs_inode *li = logfs_inode(inode);
+        struct logfs_transaction *ta;
+        int ret;
+
+        ta = kzalloc(sizeof(*ta), GFP_KERNEL);
+        if (!ta)
+                return -ENOMEM;
+
+        ta->state = CREATE_1;
+        ta->ino = inode->i_ino;
+        mutex_lock(&super->s_dirop_mutex);
+        logfs_add_transaction(inode, ta);
+
+        if (dest) {
+                /* symlink */
+                ret = logfs_inode_write(inode, dest, destlen, 0, WF_LOCK, NULL);
+                if (!ret)
+                        ret = write_inode(inode);
+        } else {
+                /* creat/mkdir/mknod */
+                ret = write_inode(inode);
+        }
+        if (ret) {
+                abort_transaction(inode, ta);
+                li->li_flags |= LOGFS_IF_STILLBORN;
+                /* FIXME: truncate symlink */
+                inode->i_nlink--;
+                iput(inode);
+                goto out;
+        }
+
+        ta->state = CREATE_2;
+        logfs_add_transaction(dir, ta);
+        ret = logfs_write_dir(dir, dentry, inode);
+        /* sync directory */
+        if (!ret)
+                ret = write_inode(dir);
+
+        if (ret) {
+                logfs_del_transaction(dir, ta);
+                ta->state = CREATE_2;
+                logfs_add_transaction(inode, ta);
+                logfs_remove_inode(inode);
+                iput(inode);
+                goto out;
+        }
+        d_instantiate(dentry, inode);
+out:
+        mutex_unlock(&super->s_dirop_mutex);
+        return ret;
+}
+
+static int logfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+        struct inode *inode;
+
+        /*
+         * FIXME: why do we have to fill in S_IFDIR, while the mode is
+         * correct for mknod, creat, etc.?  Smells like the vfs *should*
+         * do it for us but for some reason fails to do so.
+         */
+        inode = logfs_new_inode(dir, S_IFDIR | mode);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+
+        inode->i_op = &logfs_dir_iops;
+        inode->i_fop = &logfs_dir_fops;
+
+        return __logfs_create(dir, dentry, inode, NULL, 0);
+}
+
+static int logfs_create(struct inode *dir, struct dentry *dentry, int mode,
+                struct nameidata *nd)
+{
+        struct inode *inode;
+
+        inode = logfs_new_inode(dir, mode);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+
+        inode->i_op = &logfs_reg_iops;
+        inode->i_fop = &logfs_reg_fops;
+        inode->i_mapping->a_ops = &logfs_reg_aops;
+
+        return __logfs_create(dir, dentry, inode, NULL, 0);
+}
+
+static int logfs_mknod(struct inode *dir, struct dentry *dentry, int mode,
+                dev_t rdev)
+{
+        struct inode *inode;
+
+        if (dentry->d_name.len > LOGFS_MAX_NAMELEN)
+                return -ENAMETOOLONG;
+
+        inode = logfs_new_inode(dir, mode);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+
+        init_special_inode(inode, mode, rdev);
+
+        return __logfs_create(dir, dentry, inode, NULL, 0);
+}
+
+static int logfs_symlink(struct inode *dir, struct dentry *dentry,
+                const char *target)
+{
+        struct inode *inode;
+        size_t destlen = strlen(target) + 1;
+
+        if (destlen > dir->i_sb->s_blocksize)
+                return -ENAMETOOLONG;
+
+        inode = logfs_new_inode(dir, S_IFLNK | 0777);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+
+        inode->i_op = &logfs_symlink_iops;
+        inode->i_mapping->a_ops = &logfs_reg_aops;
+
+        return __logfs_create(dir, dentry, inode, target, destlen);
+}
+
+static int logfs_permission(struct inode *inode, int mask)
+{
+        return generic_permission(inode, mask, NULL);
+}
+
+static int logfs_link(struct dentry *old_dentry, struct inode *dir,
+                struct dentry *dentry)
+{
+        struct inode *inode = old_dentry->d_inode;
+
+        if (inode->i_nlink >= LOGFS_LINK_MAX)
+                return -EMLINK;
+
+        inode->i_ctime = dir->i_ctime = dir->i_mtime = CURRENT_TIME;
+        atomic_inc(&inode->i_count);
+        inode->i_nlink++;
+        mark_inode_dirty_sync(inode);
+
+        return __logfs_create(dir, dentry, inode, NULL, 0);
+}
+
+static int logfs_get_dd(struct inode *dir, struct dentry *dentry,
+                struct logfs_disk_dentry *dd, loff_t *pos)
+{
+        struct page *page;
+        void *map;
+
+        page = logfs_get_dd_page(dir, dentry);
+        if (IS_ERR(page))
+                return PTR_ERR(page);
+        *pos = page->index;
+        map = kmap_atomic(page, KM_USER0);
+        memcpy(dd, map, sizeof(*dd));
+        kunmap_atomic(map, KM_USER0);
+        page_cache_release(page);
+        return 0;
+}
+
+static int logfs_delete_dd(struct inode *dir, loff_t pos)
+{
+        /*
+         * Getting called with pos somewhere beyond eof is either a goofup
+         * within this file or means someone maliciously edited the
+         * (crc-protected) journal.
+         */
+        BUG_ON(beyond_eof(dir, pos));
+        dir->i_ctime = dir->i_mtime = CURRENT_TIME;
+        log_dir(" Delete dentry (%lx, %llx)\n", dir->i_ino, pos);
+        return logfs_delete(dir, pos, NULL);
+}
+
+/*
+ * Cross-directory rename, target does not exist.  Just a little nasty.
+ * Create a new dentry in the target dir, then remove the old dentry,
+ * all the while taking care to remember our operation in the journal.
+ */
+static int logfs_rename_cross(struct inode *old_dir, struct dentry *old_dentry,
+                              struct inode *new_dir, struct dentry *new_dentry)
+{
+        struct logfs_super *super = logfs_super(old_dir->i_sb);
+        struct logfs_disk_dentry dd;
+        struct logfs_transaction *ta;
+        loff_t pos;
+        int err;
+
+        /* 1. locate source dd */
+        err = logfs_get_dd(old_dir, old_dentry, &dd, &pos);
+        if (err)
+                return err;
+
+        ta = kzalloc(sizeof(*ta), GFP_KERNEL);
+        if (!ta)
+                return -ENOMEM;
+
+        ta->state = CROSS_RENAME_1;
+        ta->dir = old_dir->i_ino;
+        ta->pos = pos;
+
+        /* 2. write target dd */
+        mutex_lock(&super->s_dirop_mutex);
+        logfs_add_transaction(new_dir, ta);
+        err = logfs_write_dir(new_dir, new_dentry, old_dentry->d_inode);
+        if (!err)
+                err = write_inode(new_dir);
+
+        if (err) {
+                super->s_rename_dir = 0;
+                super->s_rename_pos = 0;
+                abort_transaction(new_dir, ta);
+                goto out;
+        }
+
+        /* 3. remove source dd */
+        ta->state = CROSS_RENAME_2;
+        logfs_add_transaction(old_dir, ta);
+        err = logfs_delete_dd(old_dir, pos);
+        if (!err)
+                err = write_inode(old_dir);
+        LOGFS_BUG_ON(err, old_dir->i_sb);
+out:
+        mutex_unlock(&super->s_dirop_mutex);
+        return err;
+}
+
+static int logfs_replace_inode(struct inode *dir, struct dentry *dentry,
+                struct logfs_disk_dentry *dd, struct inode *inode)
+{
+        loff_t pos;
+        int err;
+
+        err = logfs_get_dd(dir, dentry, dd, &pos);
+        if (err)
+                return err;
+        dd->ino = cpu_to_be64(inode->i_ino);
+        dd->type = logfs_type(inode);
+
+        err = write_dir(dir, dd, pos);
+        if (err)
+                return err;
+        log_dir("Replace dentry (%lx, %llx) %s -> %llx\n", dir->i_ino, pos,
+                        dd->name, be64_to_cpu(dd->ino));
+        return write_inode(dir);
+}
+
+/* Target dentry exists - the worst case.  We need to attach the source
+ * inode to the target dentry, then remove the orphaned target inode and
+ * source dentry.
+ */
+static int logfs_rename_target(struct inode *old_dir, struct dentry *old_dentry,
+                               struct inode *new_dir, struct dentry *new_dentry)
+{
+        struct logfs_super *super = logfs_super(old_dir->i_sb);
+        struct inode *old_inode = old_dentry->d_inode;
+        struct inode *new_inode = new_dentry->d_inode;
+        int isdir = S_ISDIR(old_inode->i_mode);
+        struct logfs_disk_dentry dd;
+        struct logfs_transaction *ta;
+        loff_t pos;
+        int err;
+
+        BUG_ON(isdir != S_ISDIR(new_inode->i_mode));
+        if (isdir) {
+                if (!logfs_empty_dir(new_inode))
+                        return -ENOTEMPTY;
+        }
+
+        /* 1. locate source dd */
+        err = logfs_get_dd(old_dir, old_dentry, &dd, &pos);
+        if (err)
+                return err;
+
+        ta = kzalloc(sizeof(*ta), GFP_KERNEL);
+        if (!ta)
+                return -ENOMEM;
+
+        ta->state = TARGET_RENAME_1;
+        ta->dir = old_dir->i_ino;
+        ta->pos = pos;
+        ta->ino = new_inode->i_ino;
+
+        /* 2. attach source inode to target dd */
+        mutex_lock(&super->s_dirop_mutex);
+        logfs_add_transaction(new_dir, ta);
+        err = logfs_replace_inode(new_dir, new_dentry, &dd, old_inode);
+        if (err) {
+                super->s_rename_dir = 0;
+                super->s_rename_pos = 0;
+                super->s_victim_ino = 0;
+                abort_transaction(new_dir, ta);
+                goto out;
+        }
+
+        /* 3. remove source dd */
+        ta->state = TARGET_RENAME_2;
+        logfs_add_transaction(old_dir, ta);
+        err = logfs_delete_dd(old_dir, pos);
+        if (!err)
+                err = write_inode(old_dir);
+        LOGFS_BUG_ON(err, old_dir->i_sb);
+
+        /* 4. remove target inode */
+        ta->state = TARGET_RENAME_3;
+        logfs_add_transaction(new_inode, ta);
+        err = logfs_remove_inode(new_inode);
+
+out:
+        mutex_unlock(&super->s_dirop_mutex);
+        return err;
+}
+
+static int logfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+                        struct inode *new_dir, struct dentry *new_dentry)
+{
+        if (new_dentry->d_inode)
+                return logfs_rename_target(old_dir, old_dentry,
+                                           new_dir, new_dentry);
+        return logfs_rename_cross(old_dir, old_dentry, new_dir, new_dentry);
+}
+
+/* No locking done here, as this is called before .get_sb() returns. */
+int logfs_replay_journal(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *inode;
+        u64 ino, pos;
+        int err;
+
+        if (super->s_victim_ino) {
+                /* delete victim inode */
+                ino = super->s_victim_ino;
+                printk(KERN_INFO"LogFS: delete unmapped inode #%llx\n", ino);
+                inode = logfs_iget(sb, ino);
+                if (IS_ERR(inode))
+                        goto fail;
+
+                LOGFS_BUG_ON(i_size_read(inode) > 0, sb);
+                super->s_victim_ino = 0;
+                err = logfs_remove_inode(inode);
+                iput(inode);
+                if (err) {
+                        super->s_victim_ino = ino;
+                        goto fail;
+                }
+        }
+        if (super->s_rename_dir) {
+                /* delete old dd from rename */
+                ino = super->s_rename_dir;
+                pos = super->s_rename_pos;
+                printk(KERN_INFO"LogFS: delete unbacked dentry (%llx, %llx)\n",
+                                ino, pos);
+                inode = logfs_iget(sb, ino);
+                if (IS_ERR(inode))
+                        goto fail;
+
+                super->s_rename_dir = 0;
+                super->s_rename_pos = 0;
+                err = logfs_delete_dd(inode, pos);
+                iput(inode);
+                if (err) {
+                        super->s_rename_dir = ino;
+                        super->s_rename_pos = pos;
+                        goto fail;
+                }
+        }
+        return 0;
+fail:
+        LOGFS_BUG(sb);
+        return -EIO;
+}
+
+const struct inode_operations logfs_symlink_iops = {
+        .readlink       = generic_readlink,
+        .follow_link    = page_follow_link_light,
+};
+
+const struct inode_operations logfs_dir_iops = {
+        .create         = logfs_create,
+        .link           = logfs_link,
+        .lookup         = logfs_lookup,
+        .mkdir          = logfs_mkdir,
+        .mknod          = logfs_mknod,
+        .rename         = logfs_rename,
+        .rmdir          = logfs_rmdir,
+        .permission     = logfs_permission,
+        .symlink        = logfs_symlink,
+        .unlink         = logfs_unlink,
+};
+const struct file_operations logfs_dir_fops = {
+        .fsync          = logfs_fsync,
+        .ioctl          = logfs_ioctl,
+        .readdir        = logfs_readdir,
+        .read           = generic_read_dir,
+};
diff --git a/fs/logfs/file.c b/fs/logfs/file.c
new file mode 100644
index 000000000000..370f367a933e
--- /dev/null
+++ b/fs/logfs/file.c
@@ -0,0 +1,263 @@
+/*
+ * fs/logfs/file.c      - prepare_write, commit_write and friends
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/sched.h>
+#include <linux/writeback.h>
+
+static int logfs_write_begin(struct file *file, struct address_space *mapping,
+                loff_t pos, unsigned len, unsigned flags,
+                struct page **pagep, void **fsdata)
+{
+        struct inode *inode = mapping->host;
+        struct page *page;
+        pgoff_t index = pos >> PAGE_CACHE_SHIFT;
+
+        page = grab_cache_page_write_begin(mapping, index, flags);
+        if (!page)
+                return -ENOMEM;
+        *pagep = page;
+
+        if ((len == PAGE_CACHE_SIZE) || PageUptodate(page))
+                return 0;
+        if ((pos & PAGE_CACHE_MASK) >= i_size_read(inode)) {
+                unsigned start = pos & (PAGE_CACHE_SIZE - 1);
+                unsigned end = start + len;
+
+                /* Reading beyond i_size is simple: memset to zero */
+                zero_user_segments(page, 0, start, end, PAGE_CACHE_SIZE);
+                return 0;
+        }
+        return logfs_readpage_nolock(page);
+}
+
+static int logfs_write_end(struct file *file, struct address_space *mapping,
+                loff_t pos, unsigned len, unsigned copied, struct page *page,
+                void *fsdata)
+{
+        struct inode *inode = mapping->host;
+        pgoff_t index = page->index;
+        unsigned start = pos & (PAGE_CACHE_SIZE - 1);
+        unsigned end = start + copied;
+        int ret = 0;
+
+        BUG_ON(PAGE_CACHE_SIZE != inode->i_sb->s_blocksize);
+        BUG_ON(page->index > I3_BLOCKS);
+
+        if (copied < len) {
+                /*
+                 * Short write of a non-initialized paged.  Just tell userspace
+                 * to retry the entire page.
+                 */
+                if (!PageUptodate(page)) {
+                        copied = 0;
+                        goto out;
+                }
+        }
+        if (copied == 0)
+                goto out; /* FIXME: do we need to update inode? */
+
+        if (i_size_read(inode) < (index << PAGE_CACHE_SHIFT) + end) {
+                i_size_write(inode, (index << PAGE_CACHE_SHIFT) + end);
+                mark_inode_dirty_sync(inode);
+        }
+
+        SetPageUptodate(page);
+        if (!PageDirty(page)) {
+                if (!get_page_reserve(inode, page))
+                        __set_page_dirty_nobuffers(page);
+                else
+                        ret = logfs_write_buf(inode, page, WF_LOCK);
+        }
+out:
+        unlock_page(page);
+        page_cache_release(page);
+        return ret ? ret : copied;
+}
+
+int logfs_readpage(struct file *file, struct page *page)
+{
+        int ret;
+
+        ret = logfs_readpage_nolock(page);
+        unlock_page(page);
+        return ret;
+}
+
+/* Clear the page's dirty flag in the radix tree. */
+/* TODO: mucking with PageWriteback is silly.  Add a generic function to clear
+ * the dirty bit from the radix tree for filesystems that don't have to wait
+ * for page writeback to finish (i.e. any compressing filesystem).
+ */
+static void clear_radix_tree_dirty(struct page *page)
+{
+        BUG_ON(PagePrivate(page) || page->private);
+        set_page_writeback(page);
+        end_page_writeback(page);
+}
+
+static int __logfs_writepage(struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        int err;
+
+        err = logfs_write_buf(inode, page, WF_LOCK);
+        if (err)
+                set_page_dirty(page);
+        else
+                clear_radix_tree_dirty(page);
+        unlock_page(page);
+        return err;
+}
+
+static int logfs_writepage(struct page *page, struct writeback_control *wbc)
+{
+        struct inode *inode = page->mapping->host;
+        loff_t i_size = i_size_read(inode);
+        pgoff_t end_index = i_size >> PAGE_CACHE_SHIFT;
+        unsigned offset;
+        u64 bix;
+        level_t level;
+
+        log_file("logfs_writepage(%lx, %lx, %p)\n", inode->i_ino, page->index,
+                        page);
+
+        logfs_unpack_index(page->index, &bix, &level);
+
+        /* Indirect blocks are never truncated */
+        if (level != 0)
+                return __logfs_writepage(page);
+
+        /*
+         * TODO: everything below is a near-verbatim copy of nobh_writepage().
+         * The relevant bits should be factored out after logfs is merged.
+         */
+
+        /* Is the page fully inside i_size? */
+        if (bix < end_index)
+                return __logfs_writepage(page);
+
+         /* Is the page fully outside i_size? (truncate in progress) */
+        offset = i_size & (PAGE_CACHE_SIZE-1);
+        if (bix > end_index || offset == 0) {
+                unlock_page(page);
+                return 0; /* don't care */
+        }
+
+        /*
+         * The page straddles i_size.  It must be zeroed out on each and every
+         * writepage invokation because it may be mmapped.  "A file is mapped
+         * in multiples of the page size.  For a file that is not a multiple of
+         * the  page size, the remaining memory is zeroed when mapped, and
+         * writes to that region are not written out to the file."
+         */
+        zero_user_segment(page, offset, PAGE_CACHE_SIZE);
+        return __logfs_writepage(page);
+}
+
+static void logfs_invalidatepage(struct page *page, unsigned long offset)
+{
+        move_page_to_btree(page);
+        BUG_ON(PagePrivate(page) || page->private);
+}
+
+static int logfs_releasepage(struct page *page, gfp_t only_xfs_uses_this)
+{
+        return 0; /* None of these are easy to release */
+}
+
+
+int logfs_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+                unsigned long arg)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        unsigned int oldflags, flags;
+        int err;
+
+        switch (cmd) {
+        case FS_IOC_GETFLAGS:
+                flags = li->li_flags & LOGFS_FL_USER_VISIBLE;
+                return put_user(flags, (int __user *)arg);
+        case FS_IOC_SETFLAGS:
+                if (IS_RDONLY(inode))
+                        return -EROFS;
+
+                if (!is_owner_or_cap(inode))
+                        return -EACCES;
+
+                err = get_user(flags, (int __user *)arg);
+                if (err)
+                        return err;
+
+                mutex_lock(&inode->i_mutex);
+                oldflags = li->li_flags;
+                flags &= LOGFS_FL_USER_MODIFIABLE;
+                flags |= oldflags & ~LOGFS_FL_USER_MODIFIABLE;
+                li->li_flags = flags;
+                mutex_unlock(&inode->i_mutex);
+
+                inode->i_ctime = CURRENT_TIME;
+                mark_inode_dirty_sync(inode);
+                return 0;
+
+        default:
+                return -ENOTTY;
+        }
+}
+
+int logfs_fsync(struct file *file, struct dentry *dentry, int datasync)
+{
+        struct super_block *sb = dentry->d_inode->i_sb;
+        struct logfs_super *super = logfs_super(sb);
+
+        /* FIXME: write anchor */
+        super->s_devops->sync(sb);
+        return 0;
+}
+
+static int logfs_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        struct inode *inode = dentry->d_inode;
+        int err = 0;
+
+        if (attr->ia_valid & ATTR_SIZE)
+                err = logfs_truncate(inode, attr->ia_size);
+        attr->ia_valid &= ~ATTR_SIZE;
+
+        if (!err)
+                err = inode_change_ok(inode, attr);
+        if (!err)
+                err = inode_setattr(inode, attr);
+        return err;
+}
+
+const struct inode_operations logfs_reg_iops = {
+        .setattr        = logfs_setattr,
+};
+
+const struct file_operations logfs_reg_fops = {
+        .aio_read       = generic_file_aio_read,
+        .aio_write      = generic_file_aio_write,
+        .fsync          = logfs_fsync,
+        .ioctl          = logfs_ioctl,
+        .llseek         = generic_file_llseek,
+        .mmap           = generic_file_readonly_mmap,
+        .open           = generic_file_open,
+        .read           = do_sync_read,
+        .write          = do_sync_write,
+};
+
+const struct address_space_operations logfs_reg_aops = {
+        .invalidatepage = logfs_invalidatepage,
+        .readpage       = logfs_readpage,
+        .releasepage    = logfs_releasepage,
+        .set_page_dirty = __set_page_dirty_nobuffers,
+        .writepage      = logfs_writepage,
+        .writepages     = generic_writepages,
+        .write_begin    = logfs_write_begin,
+        .write_end      = logfs_write_end,
+};
diff --git a/fs/logfs/gc.c b/fs/logfs/gc.c
new file mode 100644
index 000000000000..76c242fbe1b0
--- /dev/null
+++ b/fs/logfs/gc.c
@@ -0,0 +1,739 @@
+/*
+ * fs/logfs/gc.c        - garbage collection code
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/sched.h>
+#include <linux/slab.h>
+
+/*
+ * Wear leveling needs to kick in when the difference between low erase
+ * counts and high erase counts gets too big.  A good value for "too big"
+ * may be somewhat below 10% of maximum erase count for the device.
+ * Why not 397, to pick a nice round number with no specific meaning? :)
+ *
+ * WL_RATELIMIT is the minimum time between two wear level events.  A huge
+ * number of segments may fulfil the requirements for wear leveling at the
+ * same time.  If that happens we don't want to cause a latency from hell,
+ * but just gently pick one segment every so often and minimize overhead.
+ */
+#define WL_DELTA 397
+#define WL_RATELIMIT 100
+#define MAX_OBJ_ALIASES 2600
+#define SCAN_RATIO 512  /* number of scanned segments per gc'd segment */
+#define LIST_SIZE 64    /* base size of candidate lists */
+#define SCAN_ROUNDS 128 /* maximum number of complete medium scans */
+#define SCAN_ROUNDS_HIGH 4 /* maximum number of higher-level scans */
+
+static int no_free_segments(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        return super->s_free_list.count;
+}
+
+/* journal has distance -1, top-most ifile layer distance 0 */
+static u8 root_distance(struct super_block *sb, gc_level_t __gc_level)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u8 gc_level = (__force u8)__gc_level;
+
+        switch (gc_level) {
+        case 0: /* fall through */
+        case 1: /* fall through */
+        case 2: /* fall through */
+        case 3:
+                /* file data or indirect blocks */
+                return super->s_ifile_levels + super->s_iblock_levels - gc_level;
+        case 6: /* fall through */
+        case 7: /* fall through */
+        case 8: /* fall through */
+        case 9:
+                /* inode file data or indirect blocks */
+                return super->s_ifile_levels - (gc_level - 6);
+        default:
+                printk(KERN_ERR"LOGFS: segment of unknown level %x found\n",
+                                gc_level);
+                WARN_ON(1);
+                return super->s_ifile_levels + super->s_iblock_levels;
+        }
+}
+
+static int segment_is_reserved(struct super_block *sb, u32 segno)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area;
+        void *reserved;
+        int i;
+
+        /* Some segments are reserved.  Just pretend they were all valid */
+        reserved = btree_lookup32(&super->s_reserved_segments, segno);
+        if (reserved)
+                return 1;
+
+        /* Currently open segments */
+        for_each_area(i) {
+                area = super->s_area[i];
+                if (area->a_is_open && area->a_segno == segno)
+                        return 1;
+        }
+
+        return 0;
+}
+
+static void logfs_mark_segment_bad(struct super_block *sb, u32 segno)
+{
+        BUG();
+}
+
+/*
+ * Returns the bytes consumed by valid objects in this segment.  Object headers
+ * are counted, the segment header is not.
+ */
+static u32 logfs_valid_bytes(struct super_block *sb, u32 segno, u32 *ec,
+                gc_level_t *gc_level)
+{
+        struct logfs_segment_entry se;
+        u32 ec_level;
+
+        logfs_get_segment_entry(sb, segno, &se);
+        if (se.ec_level == cpu_to_be32(BADSEG) ||
+                        se.valid == cpu_to_be32(RESERVED))
+                return RESERVED;
+
+        ec_level = be32_to_cpu(se.ec_level);
+        *ec = ec_level >> 4;
+        *gc_level = GC_LEVEL(ec_level & 0xf);
+        return be32_to_cpu(se.valid);
+}
+
+static void logfs_cleanse_block(struct super_block *sb, u64 ofs, u64 ino,
+                u64 bix, gc_level_t gc_level)
+{
+        struct inode *inode;
+        int err, cookie;
+
+        inode = logfs_safe_iget(sb, ino, &cookie);
+        err = logfs_rewrite_block(inode, bix, ofs, gc_level, 0);
+        BUG_ON(err);
+        logfs_safe_iput(inode, cookie);
+}
+
+static u32 logfs_gc_segment(struct super_block *sb, u32 segno, u8 dist)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_segment_header sh;
+        struct logfs_object_header oh;
+        u64 ofs, ino, bix;
+        u32 seg_ofs, logical_segno, cleaned = 0;
+        int err, len, valid;
+        gc_level_t gc_level;
+
+        LOGFS_BUG_ON(segment_is_reserved(sb, segno), sb);
+
+        btree_insert32(&super->s_reserved_segments, segno, (void *)1, GFP_NOFS);
+        err = wbuf_read(sb, dev_ofs(sb, segno, 0), sizeof(sh), &sh);
+        BUG_ON(err);
+        gc_level = GC_LEVEL(sh.level);
+        logical_segno = be32_to_cpu(sh.segno);
+        if (sh.crc != logfs_crc32(&sh, sizeof(sh), 4)) {
+                logfs_mark_segment_bad(sb, segno);
+                cleaned = -1;
+                goto out;
+        }
+
+        for (seg_ofs = LOGFS_SEGMENT_HEADERSIZE;
+                        seg_ofs + sizeof(oh) < super->s_segsize; ) {
+                ofs = dev_ofs(sb, logical_segno, seg_ofs);
+                err = wbuf_read(sb, dev_ofs(sb, segno, seg_ofs), sizeof(oh),
+                                &oh);
+                BUG_ON(err);
+
+                if (!memchr_inv(&oh, 0xff, sizeof(oh)))
+                        break;
+
+                if (oh.crc != logfs_crc32(&oh, sizeof(oh) - 4, 4)) {
+                        logfs_mark_segment_bad(sb, segno);
+                        cleaned = super->s_segsize - 1;
+                        goto out;
+                }
+
+                ino = be64_to_cpu(oh.ino);
+                bix = be64_to_cpu(oh.bix);
+                len = sizeof(oh) + be16_to_cpu(oh.len);
+                valid = logfs_is_valid_block(sb, ofs, ino, bix, gc_level);
+                if (valid == 1) {
+                        logfs_cleanse_block(sb, ofs, ino, bix, gc_level);
+                        cleaned += len;
+                } else if (valid == 2) {
+                        /* Will be invalid upon journal commit */
+                        cleaned += len;
+                }
+                seg_ofs += len;
+        }
+out:
+        btree_remove32(&super->s_reserved_segments, segno);
+        return cleaned;
+}
+
+static struct gc_candidate *add_list(struct gc_candidate *cand,
+                struct candidate_list *list)
+{
+        struct rb_node **p = &list->rb_tree.rb_node;
+        struct rb_node *parent = NULL;
+        struct gc_candidate *cur;
+        int comp;
+
+        cand->list = list;
+        while (*p) {
+                parent = *p;
+                cur = rb_entry(parent, struct gc_candidate, rb_node);
+
+                if (list->sort_by_ec)
+                        comp = cand->erase_count < cur->erase_count;
+                else
+                        comp = cand->valid < cur->valid;
+
+                if (comp)
+                        p = &parent->rb_left;
+                else
+                        p = &parent->rb_right;
+        }
+        rb_link_node(&cand->rb_node, parent, p);
+        rb_insert_color(&cand->rb_node, &list->rb_tree);
+
+        if (list->count <= list->maxcount) {
+                list->count++;
+                return NULL;
+        }
+        cand = rb_entry(rb_last(&list->rb_tree), struct gc_candidate, rb_node);
+        rb_erase(&cand->rb_node, &list->rb_tree);
+        cand->list = NULL;
+        return cand;
+}
+
+static void remove_from_list(struct gc_candidate *cand)
+{
+        struct candidate_list *list = cand->list;
+
+        rb_erase(&cand->rb_node, &list->rb_tree);
+        list->count--;
+}
+
+static void free_candidate(struct super_block *sb, struct gc_candidate *cand)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        btree_remove32(&super->s_cand_tree, cand->segno);
+        kfree(cand);
+}
+
+u32 get_best_cand(struct super_block *sb, struct candidate_list *list, u32 *ec)
+{
+        struct gc_candidate *cand;
+        u32 segno;
+
+        BUG_ON(list->count == 0);
+
+        cand = rb_entry(rb_first(&list->rb_tree), struct gc_candidate, rb_node);
+        remove_from_list(cand);
+        segno = cand->segno;
+        if (ec)
+                *ec = cand->erase_count;
+        free_candidate(sb, cand);
+        return segno;
+}
+
+/*
+ * We have several lists to manage segments with.  The reserve_list is used to
+ * deal with bad blocks.  We try to keep the best (lowest ec) segments on this
+ * list.
+ * The free_list contains free segments for normal usage.  It usually gets the
+ * second pick after the reserve_list.  But when the free_list is running short
+ * it is more important to keep the free_list full than to keep a reserve.
+ *
+ * Segments that are not free are put onto a per-level low_list.  If we have
+ * to run garbage collection, we pick a candidate from there.  All segments on
+ * those lists should have at least some free space so GC will make progress.
+ *
+ * And last we have the ec_list, which is used to pick segments for wear
+ * leveling.
+ *
+ * If all appropriate lists are full, we simply free the candidate and forget
+ * about that segment for a while.  We have better candidates for each purpose.
+ */
+static void __add_candidate(struct super_block *sb, struct gc_candidate *cand)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u32 full = super->s_segsize - LOGFS_SEGMENT_RESERVE;
+
+        if (cand->valid == 0) {
+                /* 100% free segments */
+                log_gc_noisy("add reserve segment %x (ec %x) at %llx\n",
+                                cand->segno, cand->erase_count,
+                                dev_ofs(sb, cand->segno, 0));
+                cand = add_list(cand, &super->s_reserve_list);
+                if (cand) {
+                        log_gc_noisy("add free segment %x (ec %x) at %llx\n",
+                                        cand->segno, cand->erase_count,
+                                        dev_ofs(sb, cand->segno, 0));
+                        cand = add_list(cand, &super->s_free_list);
+                }
+        } else {
+                /* good candidates for Garbage Collection */
+                if (cand->valid < full)
+                        cand = add_list(cand, &super->s_low_list[cand->dist]);
+                /* good candidates for wear leveling,
+                 * segments that were recently written get ignored */
+                if (cand)
+                        cand = add_list(cand, &super->s_ec_list);
+        }
+        if (cand)
+                free_candidate(sb, cand);
+}
+
+static int add_candidate(struct super_block *sb, u32 segno, u32 valid, u32 ec,
+                u8 dist)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct gc_candidate *cand;
+
+        cand = kmalloc(sizeof(*cand), GFP_NOFS);
+        if (!cand)
+                return -ENOMEM;
+
+        cand->segno = segno;
+        cand->valid = valid;
+        cand->erase_count = ec;
+        cand->dist = dist;
+
+        btree_insert32(&super->s_cand_tree, segno, cand, GFP_NOFS);
+        __add_candidate(sb, cand);
+        return 0;
+}
+
+static void remove_segment_from_lists(struct super_block *sb, u32 segno)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct gc_candidate *cand;
+
+        cand = btree_lookup32(&super->s_cand_tree, segno);
+        if (cand) {
+                remove_from_list(cand);
+                free_candidate(sb, cand);
+        }
+}
+
+static void scan_segment(struct super_block *sb, u32 segno)
+{
+        u32 valid, ec = 0;
+        gc_level_t gc_level = 0;
+        u8 dist;
+
+        if (segment_is_reserved(sb, segno))
+                return;
+
+        remove_segment_from_lists(sb, segno);
+        valid = logfs_valid_bytes(sb, segno, &ec, &gc_level);
+        if (valid == RESERVED)
+                return;
+
+        dist = root_distance(sb, gc_level);
+        add_candidate(sb, segno, valid, ec, dist);
+}
+
+static struct gc_candidate *first_in_list(struct candidate_list *list)
+{
+        if (list->count == 0)
+                return NULL;
+        return rb_entry(rb_first(&list->rb_tree), struct gc_candidate, rb_node);
+}
+
+/*
+ * Find the best segment for garbage collection.  Main criterion is
+ * the segment requiring the least effort to clean.  Secondary
+ * criterion is to GC on the lowest level available.
+ *
+ * So we search the least effort segment on the lowest level first,
+ * then move up and pick another segment iff is requires significantly
+ * less effort.  Hence the LOGFS_MAX_OBJECTSIZE in the comparison.
+ */
+static struct gc_candidate *get_candidate(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i, max_dist;
+        struct gc_candidate *cand = NULL, *this;
+
+        max_dist = min(no_free_segments(sb), LOGFS_NO_AREAS);
+
+        for (i = max_dist; i >= 0; i--) {
+                this = first_in_list(&super->s_low_list[i]);
+                if (!this)
+                        continue;
+                if (!cand)
+                        cand = this;
+                if (this->valid + LOGFS_MAX_OBJECTSIZE <= cand->valid)
+                        cand = this;
+        }
+        return cand;
+}
+
+static int __logfs_gc_once(struct super_block *sb, struct gc_candidate *cand)
+{
+        struct logfs_super *super = logfs_super(sb);
+        gc_level_t gc_level;
+        u32 cleaned, valid, segno, ec;
+        u8 dist;
+
+        if (!cand) {
+                log_gc("GC attempted, but no candidate found\n");
+                return 0;
+        }
+
+        segno = cand->segno;
+        dist = cand->dist;
+        valid = logfs_valid_bytes(sb, segno, &ec, &gc_level);
+        free_candidate(sb, cand);
+        log_gc("GC segment #%02x at %llx, %x required, %x free, %x valid, %llx free\n",
+                        segno, (u64)segno << super->s_segshift,
+                        dist, no_free_segments(sb), valid,
+                        super->s_free_bytes);
+        cleaned = logfs_gc_segment(sb, segno, dist);
+        log_gc("GC segment #%02x complete - now %x valid\n", segno,
+                        valid - cleaned);
+        BUG_ON(cleaned != valid);
+        return 1;
+}
+
+static int logfs_gc_once(struct super_block *sb)
+{
+        struct gc_candidate *cand;
+
+        cand = get_candidate(sb);
+        if (cand)
+                remove_from_list(cand);
+        return __logfs_gc_once(sb, cand);
+}
+
+/* returns 1 if a wrap occurs, 0 otherwise */
+static int logfs_scan_some(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u32 segno;
+        int i, ret = 0;
+
+        segno = super->s_sweeper;
+        for (i = SCAN_RATIO; i > 0; i--) {
+                segno++;
+                if (segno >= super->s_no_segs) {
+                        segno = 0;
+                        ret = 1;
+                        /* Break out of the loop.  We want to read a single
+                         * block from the segment size on next invocation if
+                         * SCAN_RATIO is set to match block size
+                         */
+                        break;
+                }
+
+                scan_segment(sb, segno);
+        }
+        super->s_sweeper = segno;
+        return ret;
+}
+
+/*
+ * In principle, this function should loop forever, looking for GC candidates
+ * and moving data.  LogFS is designed in such a way that this loop is
+ * guaranteed to terminate.
+ *
+ * Limiting the loop to some iterations serves purely to catch cases when
+ * these guarantees have failed.  An actual endless loop is an obvious bug
+ * and should be reported as such.
+ */
+static void __logfs_gc_pass(struct super_block *sb, int target)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_block *block;
+        int round, progress, last_progress = 0;
+
+        /*
+         * Doing too many changes to the segfile at once would result
+         * in a large number of aliases.  Write the journal before
+         * things get out of hand.
+         */
+        if (super->s_shadow_tree.no_shadowed_segments >= MAX_OBJ_ALIASES)
+                logfs_write_anchor(sb);
+
+        if (no_free_segments(sb) >= target &&
+                        super->s_no_object_aliases < MAX_OBJ_ALIASES)
+                return;
+
+        log_gc("__logfs_gc_pass(%x)\n", target);
+        for (round = 0; round < SCAN_ROUNDS; ) {
+                if (no_free_segments(sb) >= target)
+                        goto write_alias;
+
+                /* Sync in-memory state with on-medium state in case they
+                 * diverged */
+                logfs_write_anchor(sb);
+                round += logfs_scan_some(sb);
+                if (no_free_segments(sb) >= target)
+                        goto write_alias;
+                progress = logfs_gc_once(sb);
+                if (progress)
+                        last_progress = round;
+                else if (round - last_progress > 2)
+                        break;
+                continue;
+
+                /*
+                 * The goto logic is nasty, I just don't know a better way to
+                 * code it.  GC is supposed to ensure two things:
+                 * 1. Enough free segments are available.
+                 * 2. The number of aliases is bounded.
+                 * When 1. is achieved, we take a look at 2. and write back
+                 * some alias-containing blocks, if necessary.  However, after
+                 * each such write we need to go back to 1., as writes can
+                 * consume free segments.
+                 */
+write_alias:
+                if (super->s_no_object_aliases < MAX_OBJ_ALIASES)
+                        return;
+                if (list_empty(&super->s_object_alias)) {
+                        /* All aliases are still in btree */
+                        return;
+                }
+                log_gc("Write back one alias\n");
+                block = list_entry(super->s_object_alias.next,
+                                struct logfs_block, alias_list);
+                block->ops->write_block(block);
+                /*
+                 * To round off the nasty goto logic, we reset round here.  It
+                 * is a safety-net for GC not making any progress and limited
+                 * to something reasonably small.  If incremented it for every
+                 * single alias, the loop could terminate rather quickly.
+                 */
+                round = 0;
+        }
+        LOGFS_BUG(sb);
+}
+
+static int wl_ratelimit(struct super_block *sb, u64 *next_event)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        if (*next_event < super->s_gec) {
+                *next_event = super->s_gec + WL_RATELIMIT;
+                return 0;
+        }
+        return 1;
+}
+
+static void logfs_wl_pass(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct gc_candidate *wl_cand, *free_cand;
+
+        if (wl_ratelimit(sb, &super->s_wl_gec_ostore))
+                return;
+
+        wl_cand = first_in_list(&super->s_ec_list);
+        if (!wl_cand)
+                return;
+        free_cand = first_in_list(&super->s_free_list);
+        if (!free_cand)
+                return;
+
+        if (wl_cand->erase_count < free_cand->erase_count + WL_DELTA) {
+                remove_from_list(wl_cand);
+                __logfs_gc_once(sb, wl_cand);
+        }
+}
+
+/*
+ * The journal needs wear leveling as well.  But moving the journal is an
+ * expensive operation so we try to avoid it as much as possible.  And if we
+ * have to do it, we move the whole journal, not individual segments.
+ *
+ * Ratelimiting is not strictly necessary here, it mainly serves to avoid the
+ * calculations.  First we check whether moving the journal would be a
+ * significant improvement.  That means that a) the current journal segments
+ * have more wear than the future journal segments and b) the current journal
+ * segments have more wear than normal ostore segments.
+ * Rationale for b) is that we don't have to move the journal if it is aging
+ * less than the ostore, even if the reserve segments age even less (they are
+ * excluded from wear leveling, after all).
+ * Next we check that the superblocks have less wear than the journal.  Since
+ * moving the journal requires writing the superblocks, we have to protect the
+ * superblocks even more than the journal.
+ *
+ * Also we double the acceptable wear difference, compared to ostore wear
+ * leveling.  Journal data is read and rewritten rapidly, comparatively.  So
+ * soft errors have much less time to accumulate and we allow the journal to
+ * be a bit worse than the ostore.
+ */
+static void logfs_journal_wl_pass(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct gc_candidate *cand;
+        u32 min_journal_ec = -1, max_reserve_ec = 0;
+        int i;
+
+        if (wl_ratelimit(sb, &super->s_wl_gec_journal))
+                return;
+
+        if (super->s_reserve_list.count < super->s_no_journal_segs) {
+                /* Reserve is not full enough to move complete journal */
+                return;
+        }
+
+        journal_for_each(i)
+                if (super->s_journal_seg[i])
+                        min_journal_ec = min(min_journal_ec,
+                                        super->s_journal_ec[i]);
+        cand = rb_entry(rb_first(&super->s_free_list.rb_tree),
+                        struct gc_candidate, rb_node);
+        max_reserve_ec = cand->erase_count;
+        for (i = 0; i < 2; i++) {
+                struct logfs_segment_entry se;
+                u32 segno = seg_no(sb, super->s_sb_ofs[i]);
+                u32 ec;
+
+                logfs_get_segment_entry(sb, segno, &se);
+                ec = be32_to_cpu(se.ec_level) >> 4;
+                max_reserve_ec = max(max_reserve_ec, ec);
+        }
+
+        if (min_journal_ec > max_reserve_ec + 2 * WL_DELTA) {
+                do_logfs_journal_wl_pass(sb);
+        }
+}
+
+void logfs_gc_pass(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        //BUG_ON(mutex_trylock(&logfs_super(sb)->s_w_mutex));
+        /* Write journal before free space is getting saturated with dirty
+         * objects.
+         */
+        if (super->s_dirty_used_bytes + super->s_dirty_free_bytes
+                        + LOGFS_MAX_OBJECTSIZE >= super->s_free_bytes)
+                logfs_write_anchor(sb);
+        __logfs_gc_pass(sb, super->s_total_levels);
+        logfs_wl_pass(sb);
+        logfs_journal_wl_pass(sb);
+}
+
+static int check_area(struct super_block *sb, int i)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area = super->s_area[i];
+        struct logfs_object_header oh;
+        u32 segno = area->a_segno;
+        u32 ofs = area->a_used_bytes;
+        __be32 crc;
+        int err;
+
+        if (!area->a_is_open)
+                return 0;
+
+        for (ofs = area->a_used_bytes;
+             ofs <= super->s_segsize - sizeof(oh);
+             ofs += (u32)be16_to_cpu(oh.len) + sizeof(oh)) {
+                err = wbuf_read(sb, dev_ofs(sb, segno, ofs), sizeof(oh), &oh);
+                if (err)
+                        return err;
+
+                if (!memchr_inv(&oh, 0xff, sizeof(oh)))
+                        break;
+
+                crc = logfs_crc32(&oh, sizeof(oh) - 4, 4);
+                if (crc != oh.crc) {
+                        printk(KERN_INFO "interrupted header at %llx\n",
+                                        dev_ofs(sb, segno, ofs));
+                        return 0;
+                }
+        }
+        if (ofs != area->a_used_bytes) {
+                printk(KERN_INFO "%x bytes unaccounted data found at %llx\n",
+                                ofs - area->a_used_bytes,
+                                dev_ofs(sb, segno, area->a_used_bytes));
+                area->a_used_bytes = ofs;
+        }
+        return 0;
+}
+
+int logfs_check_areas(struct super_block *sb)
+{
+        int i, err;
+
+        for_each_area(i) {
+                err = check_area(sb, i);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+static void logfs_init_candlist(struct candidate_list *list, int maxcount,
+                int sort_by_ec)
+{
+        list->count = 0;
+        list->maxcount = maxcount;
+        list->sort_by_ec = sort_by_ec;
+        list->rb_tree = RB_ROOT;
+}
+
+int logfs_init_gc(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i;
+
+        btree_init_mempool32(&super->s_cand_tree, super->s_btree_pool);
+        logfs_init_candlist(&super->s_free_list, LIST_SIZE + SCAN_RATIO, 1);
+        logfs_init_candlist(&super->s_reserve_list,
+                        super->s_bad_seg_reserve, 1);
+        for_each_area(i)
+                logfs_init_candlist(&super->s_low_list[i], LIST_SIZE, 0);
+        logfs_init_candlist(&super->s_ec_list, LIST_SIZE, 1);
+        return 0;
+}
+
+static void logfs_cleanup_list(struct super_block *sb,
+                struct candidate_list *list)
+{
+        struct gc_candidate *cand;
+
+        while (list->count) {
+                cand = rb_entry(list->rb_tree.rb_node, struct gc_candidate,
+                                rb_node);
+                remove_from_list(cand);
+                free_candidate(sb, cand);
+        }
+        BUG_ON(list->rb_tree.rb_node);
+}
+
+void logfs_cleanup_gc(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i;
+
+        if (!super->s_free_list.count)
+                return;
+
+        /*
+         * FIXME: The btree may still contain a single empty node.  So we
+         * call the grim visitor to clean up that mess.  Btree code should
+         * do it for us, really.
+         */
+        btree_grim_visitor32(&super->s_cand_tree, 0, NULL);
+        logfs_cleanup_list(sb, &super->s_free_list);
+        logfs_cleanup_list(sb, &super->s_reserve_list);
+        for_each_area(i)
+                logfs_cleanup_list(sb, &super->s_low_list[i]);
+        logfs_cleanup_list(sb, &super->s_ec_list);
+}
diff --git a/fs/logfs/inode.c b/fs/logfs/inode.c
new file mode 100644
index 000000000000..14ed27274da2
--- /dev/null
+++ b/fs/logfs/inode.c
@@ -0,0 +1,418 @@
+/*
+ * fs/logfs/inode.c     - inode handling code
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/slab.h>
+#include <linux/writeback.h>
+#include <linux/backing-dev.h>
+
+/*
+ * How soon to reuse old inode numbers?  LogFS doesn't store deleted inodes
+ * on the medium.  It therefore also lacks a method to store the previous
+ * generation number for deleted inodes.  Instead a single generation number
+ * is stored which will be used for new inodes.  Being just a 32bit counter,
+ * this can obvious wrap relatively quickly.  So we only reuse inodes if we
+ * know that a fair number of inodes can be created before we have to increment
+ * the generation again - effectively adding some bits to the counter.
+ * But being too aggressive here means we keep a very large and very sparse
+ * inode file, wasting space on indirect blocks.
+ * So what is a good value?  Beats me.  64k seems moderately bad on both
+ * fronts, so let's use that for now...
+ *
+ * NFS sucks, as everyone already knows.
+ */
+#define INOS_PER_WRAP (0x10000)
+
+/*
+ * Logfs' requirement to read inodes for garbage collection makes life a bit
+ * harder.  GC may have to read inodes that are in I_FREEING state, when they
+ * are being written out - and waiting for GC to make progress, naturally.
+ *
+ * So we cannot just call iget() or some variant of it, but first have to check
+ * wether the inode in question might be in I_FREEING state.  Therefore we
+ * maintain our own per-sb list of "almost deleted" inodes and check against
+ * that list first.  Normally this should be at most 1-2 entries long.
+ *
+ * Also, inodes have logfs-specific reference counting on top of what the vfs
+ * does.  When .destroy_inode is called, normally the reference count will drop
+ * to zero and the inode gets deleted.  But if GC accessed the inode, its
+ * refcount will remain nonzero and final deletion will have to wait.
+ *
+ * As a result we have two sets of functions to get/put inodes:
+ * logfs_safe_iget/logfs_safe_iput      - safe to call from GC context
+ * logfs_iget/iput                      - normal version
+ */
+static struct kmem_cache *logfs_inode_cache;
+
+static DEFINE_SPINLOCK(logfs_inode_lock);
+
+static void logfs_inode_setops(struct inode *inode)
+{
+        switch (inode->i_mode & S_IFMT) {
+        case S_IFDIR:
+                inode->i_op = &logfs_dir_iops;
+                inode->i_fop = &logfs_dir_fops;
+                inode->i_mapping->a_ops = &logfs_reg_aops;
+                break;
+        case S_IFREG:
+                inode->i_op = &logfs_reg_iops;
+                inode->i_fop = &logfs_reg_fops;
+                inode->i_mapping->a_ops = &logfs_reg_aops;
+                break;
+        case S_IFLNK:
+                inode->i_op = &logfs_symlink_iops;
+                inode->i_mapping->a_ops = &logfs_reg_aops;
+                break;
+        case S_IFSOCK:  /* fall through */
+        case S_IFBLK:   /* fall through */
+        case S_IFCHR:   /* fall through */
+        case S_IFIFO:
+                init_special_inode(inode, inode->i_mode, inode->i_rdev);
+                break;
+        default:
+                BUG();
+        }
+}
+
+static struct inode *__logfs_iget(struct super_block *sb, ino_t ino)
+{
+        struct inode *inode = iget_locked(sb, ino);
+        int err;
+
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+        if (!(inode->i_state & I_NEW))
+                return inode;
+
+        err = logfs_read_inode(inode);
+        if (err || inode->i_nlink == 0) {
+                /* inode->i_nlink == 0 can be true when called from
+                 * block validator */
+                /* set i_nlink to 0 to prevent caching */
+                inode->i_nlink = 0;
+                logfs_inode(inode)->li_flags |= LOGFS_IF_ZOMBIE;
+                iget_failed(inode);
+                if (!err)
+                        err = -ENOENT;
+                return ERR_PTR(err);
+        }
+
+        logfs_inode_setops(inode);
+        unlock_new_inode(inode);
+        return inode;
+}
+
+struct inode *logfs_iget(struct super_block *sb, ino_t ino)
+{
+        BUG_ON(ino == LOGFS_INO_MASTER);
+        BUG_ON(ino == LOGFS_INO_SEGFILE);
+        return __logfs_iget(sb, ino);
+}
+
+/*
+ * is_cached is set to 1 if we hand out a cached inode, 0 otherwise.
+ * this allows logfs_iput to do the right thing later
+ */
+struct inode *logfs_safe_iget(struct super_block *sb, ino_t ino, int *is_cached)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_inode *li;
+
+        if (ino == LOGFS_INO_MASTER)
+                return super->s_master_inode;
+        if (ino == LOGFS_INO_SEGFILE)
+                return super->s_segfile_inode;
+
+        spin_lock(&logfs_inode_lock);
+        list_for_each_entry(li, &super->s_freeing_list, li_freeing_list)
+                if (li->vfs_inode.i_ino == ino) {
+                        li->li_refcount++;
+                        spin_unlock(&logfs_inode_lock);
+                        *is_cached = 1;
+                        return &li->vfs_inode;
+                }
+        spin_unlock(&logfs_inode_lock);
+
+        *is_cached = 0;
+        return __logfs_iget(sb, ino);
+}
+
+static void __logfs_destroy_inode(struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        BUG_ON(li->li_block);
+        list_del(&li->li_freeing_list);
+        kmem_cache_free(logfs_inode_cache, li);
+}
+
+static void logfs_destroy_inode(struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        BUG_ON(list_empty(&li->li_freeing_list));
+        spin_lock(&logfs_inode_lock);
+        li->li_refcount--;
+        if (li->li_refcount == 0)
+                __logfs_destroy_inode(inode);
+        spin_unlock(&logfs_inode_lock);
+}
+
+void logfs_safe_iput(struct inode *inode, int is_cached)
+{
+        if (inode->i_ino == LOGFS_INO_MASTER)
+                return;
+        if (inode->i_ino == LOGFS_INO_SEGFILE)
+                return;
+
+        if (is_cached) {
+                logfs_destroy_inode(inode);
+                return;
+        }
+
+        iput(inode);
+}
+
+static void logfs_init_inode(struct super_block *sb, struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        int i;
+
+        li->li_flags    = 0;
+        li->li_height   = 0;
+        li->li_used_bytes = 0;
+        li->li_block    = NULL;
+        inode->i_uid    = 0;
+        inode->i_gid    = 0;
+        inode->i_size   = 0;
+        inode->i_blocks = 0;
+        inode->i_ctime  = CURRENT_TIME;
+        inode->i_mtime  = CURRENT_TIME;
+        inode->i_nlink  = 1;
+        INIT_LIST_HEAD(&li->li_freeing_list);
+
+        for (i = 0; i < LOGFS_EMBEDDED_FIELDS; i++)
+                li->li_data[i] = 0;
+
+        return;
+}
+
+static struct inode *logfs_alloc_inode(struct super_block *sb)
+{
+        struct logfs_inode *li;
+
+        li = kmem_cache_alloc(logfs_inode_cache, GFP_NOFS);
+        if (!li)
+                return NULL;
+        logfs_init_inode(sb, &li->vfs_inode);
+        return &li->vfs_inode;
+}
+
+/*
+ * In logfs inodes are written to an inode file.  The inode file, like any
+ * other file, is managed with a inode.  The inode file's inode, aka master
+ * inode, requires special handling in several respects.  First, it cannot be
+ * written to the inode file, so it is stored in the journal instead.
+ *
+ * Secondly, this inode cannot be written back and destroyed before all other
+ * inodes have been written.  The ordering is important.  Linux' VFS is happily
+ * unaware of the ordering constraint and would ordinarily destroy the master
+ * inode at umount time while other inodes are still in use and dirty.  Not
+ * good.
+ *
+ * So logfs makes sure the master inode is not written until all other inodes
+ * have been destroyed.  Sadly, this method has another side-effect.  The VFS
+ * will notice one remaining inode and print a frightening warning message.
+ * Worse, it is impossible to judge whether such a warning was caused by the
+ * master inode or any other inodes have leaked as well.
+ *
+ * Our attempt of solving this is with logfs_new_meta_inode() below.  Its
+ * purpose is to create a new inode that will not trigger the warning if such
+ * an inode is still in use.  An ugly hack, no doubt.  Suggections for
+ * improvement are welcome.
+ */
+struct inode *logfs_new_meta_inode(struct super_block *sb, u64 ino)
+{
+        struct inode *inode;
+
+        inode = logfs_alloc_inode(sb);
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+
+        inode->i_mode = S_IFREG;
+        inode->i_ino = ino;
+        inode->i_sb = sb;
+
+        /* This is a blatant copy of alloc_inode code.  We'd need alloc_inode
+         * to be nonstatic, alas. */
+        {
+                struct address_space * const mapping = &inode->i_data;
+
+                mapping->a_ops = &logfs_reg_aops;
+                mapping->host = inode;
+                mapping->flags = 0;
+                mapping_set_gfp_mask(mapping, GFP_NOFS);
+                mapping->assoc_mapping = NULL;
+                mapping->backing_dev_info = &default_backing_dev_info;
+                inode->i_mapping = mapping;
+                inode->i_nlink = 1;
+        }
+
+        return inode;
+}
+
+struct inode *logfs_read_meta_inode(struct super_block *sb, u64 ino)
+{
+        struct inode *inode;
+        int err;
+
+        inode = logfs_new_meta_inode(sb, ino);
+        if (IS_ERR(inode))
+                return inode;
+
+        err = logfs_read_inode(inode);
+        if (err) {
+                destroy_meta_inode(inode);
+                return ERR_PTR(err);
+        }
+        logfs_inode_setops(inode);
+        return inode;
+}
+
+static int logfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        int ret;
+        long flags = WF_LOCK;
+
+        /* Can only happen if creat() failed.  Safe to skip. */
+        if (logfs_inode(inode)->li_flags & LOGFS_IF_STILLBORN)
+                return 0;
+
+        ret = __logfs_write_inode(inode, flags);
+        LOGFS_BUG_ON(ret, inode->i_sb);
+        return ret;
+}
+
+void destroy_meta_inode(struct inode *inode)
+{
+        if (inode) {
+                if (inode->i_data.nrpages)
+                        truncate_inode_pages(&inode->i_data, 0);
+                logfs_clear_inode(inode);
+                kmem_cache_free(logfs_inode_cache, logfs_inode(inode));
+        }
+}
+
+/* called with inode_lock held */
+static void logfs_drop_inode(struct inode *inode)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+        struct logfs_inode *li = logfs_inode(inode);
+
+        spin_lock(&logfs_inode_lock);
+        list_move(&li->li_freeing_list, &super->s_freeing_list);
+        spin_unlock(&logfs_inode_lock);
+        generic_drop_inode(inode);
+}
+
+static void logfs_set_ino_generation(struct super_block *sb,
+                struct inode *inode)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u64 ino;
+
+        mutex_lock(&super->s_journal_mutex);
+        ino = logfs_seek_hole(super->s_master_inode, super->s_last_ino);
+        super->s_last_ino = ino;
+        super->s_inos_till_wrap--;
+        if (super->s_inos_till_wrap < 0) {
+                super->s_last_ino = LOGFS_RESERVED_INOS;
+                super->s_generation++;
+                super->s_inos_till_wrap = INOS_PER_WRAP;
+        }
+        inode->i_ino = ino;
+        inode->i_generation = super->s_generation;
+        mutex_unlock(&super->s_journal_mutex);
+}
+
+struct inode *logfs_new_inode(struct inode *dir, int mode)
+{
+        struct super_block *sb = dir->i_sb;
+        struct inode *inode;
+
+        inode = new_inode(sb);
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+
+        logfs_init_inode(sb, inode);
+
+        /* inherit parent flags */
+        logfs_inode(inode)->li_flags |=
+                logfs_inode(dir)->li_flags & LOGFS_FL_INHERITED;
+
+        inode->i_mode = mode;
+        logfs_set_ino_generation(sb, inode);
+
+        inode->i_uid = current_fsuid();
+        inode->i_gid = current_fsgid();
+        if (dir->i_mode & S_ISGID) {
+                inode->i_gid = dir->i_gid;
+                if (S_ISDIR(mode))
+                        inode->i_mode |= S_ISGID;
+        }
+
+        logfs_inode_setops(inode);
+        insert_inode_hash(inode);
+
+        return inode;
+}
+
+static void logfs_init_once(void *_li)
+{
+        struct logfs_inode *li = _li;
+        int i;
+
+        li->li_flags = 0;
+        li->li_used_bytes = 0;
+        li->li_refcount = 1;
+        for (i = 0; i < LOGFS_EMBEDDED_FIELDS; i++)
+                li->li_data[i] = 0;
+        inode_init_once(&li->vfs_inode);
+}
+
+static int logfs_sync_fs(struct super_block *sb, int wait)
+{
+        /* FIXME: write anchor */
+        logfs_super(sb)->s_devops->sync(sb);
+        return 0;
+}
+
+const struct super_operations logfs_super_operations = {
+        .alloc_inode    = logfs_alloc_inode,
+        .clear_inode    = logfs_clear_inode,
+        .delete_inode   = logfs_delete_inode,
+        .destroy_inode  = logfs_destroy_inode,
+        .drop_inode     = logfs_drop_inode,
+        .write_inode    = logfs_write_inode,
+        .statfs         = logfs_statfs,
+        .sync_fs        = logfs_sync_fs,
+};
+
+int logfs_init_inode_cache(void)
+{
+        logfs_inode_cache = kmem_cache_create("logfs_inode_cache",
+                        sizeof(struct logfs_inode), 0, SLAB_RECLAIM_ACCOUNT,
+                        logfs_init_once);
+        if (!logfs_inode_cache)
+                return -ENOMEM;
+        return 0;
+}
+
+void logfs_destroy_inode_cache(void)
+{
+        kmem_cache_destroy(logfs_inode_cache);
+}
diff --git a/fs/logfs/journal.c b/fs/logfs/journal.c
new file mode 100644
index 000000000000..fb0a613f885b
--- /dev/null
+++ b/fs/logfs/journal.c
@@ -0,0 +1,898 @@
+/*
+ * fs/logfs/journal.c   - journal handling code
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ */
+#include "logfs.h"
+#include <linux/slab.h>
+
+static void logfs_calc_free(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u64 reserve, no_segs = super->s_no_segs;
+        s64 free;
+        int i;
+
+        /* superblock segments */
+        no_segs -= 2;
+        super->s_no_journal_segs = 0;
+        /* journal */
+        journal_for_each(i)
+                if (super->s_journal_seg[i]) {
+                        no_segs--;
+                        super->s_no_journal_segs++;
+                }
+
+        /* open segments plus one extra per level for GC */
+        no_segs -= 2 * super->s_total_levels;
+
+        free = no_segs * (super->s_segsize - LOGFS_SEGMENT_RESERVE);
+        free -= super->s_used_bytes;
+        /* just a bit extra */
+        free -= super->s_total_levels * 4096;
+
+        /* Bad blocks are 'paid' for with speed reserve - the filesystem
+         * simply gets slower as bad blocks accumulate.  Until the bad blocks
+         * exceed the speed reserve - then the filesystem gets smaller.
+         */
+        reserve = super->s_bad_segments + super->s_bad_seg_reserve;
+        reserve *= super->s_segsize - LOGFS_SEGMENT_RESERVE;
+        reserve = max(reserve, super->s_speed_reserve);
+        free -= reserve;
+        if (free < 0)
+                free = 0;
+
+        super->s_free_bytes = free;
+}
+
+static void reserve_sb_and_journal(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct btree_head32 *head = &super->s_reserved_segments;
+        int i, err;
+
+        err = btree_insert32(head, seg_no(sb, super->s_sb_ofs[0]), (void *)1,
+                        GFP_KERNEL);
+        BUG_ON(err);
+
+        err = btree_insert32(head, seg_no(sb, super->s_sb_ofs[1]), (void *)1,
+                        GFP_KERNEL);
+        BUG_ON(err);
+
+        journal_for_each(i) {
+                if (!super->s_journal_seg[i])
+                        continue;
+                err = btree_insert32(head, super->s_journal_seg[i], (void *)1,
+                                GFP_KERNEL);
+                BUG_ON(err);
+        }
+}
+
+static void read_dynsb(struct super_block *sb,
+                struct logfs_je_dynsb *dynsb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        super->s_gec            = be64_to_cpu(dynsb->ds_gec);
+        super->s_sweeper        = be64_to_cpu(dynsb->ds_sweeper);
+        super->s_victim_ino     = be64_to_cpu(dynsb->ds_victim_ino);
+        super->s_rename_dir     = be64_to_cpu(dynsb->ds_rename_dir);
+        super->s_rename_pos     = be64_to_cpu(dynsb->ds_rename_pos);
+        super->s_used_bytes     = be64_to_cpu(dynsb->ds_used_bytes);
+        super->s_generation     = be32_to_cpu(dynsb->ds_generation);
+}
+
+static void read_anchor(struct super_block *sb,
+                struct logfs_je_anchor *da)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *inode = super->s_master_inode;
+        struct logfs_inode *li = logfs_inode(inode);
+        int i;
+
+        super->s_last_ino = be64_to_cpu(da->da_last_ino);
+        li->li_flags    = 0;
+        li->li_height   = da->da_height;
+        i_size_write(inode, be64_to_cpu(da->da_size));
+        li->li_used_bytes = be64_to_cpu(da->da_used_bytes);
+
+        for (i = 0; i < LOGFS_EMBEDDED_FIELDS; i++)
+                li->li_data[i] = be64_to_cpu(da->da_data[i]);
+}
+
+static void read_erasecount(struct super_block *sb,
+                struct logfs_je_journal_ec *ec)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i;
+
+        journal_for_each(i)
+                super->s_journal_ec[i] = be32_to_cpu(ec->ec[i]);
+}
+
+static int read_area(struct super_block *sb, struct logfs_je_area *a)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area = super->s_area[a->gc_level];
+        u64 ofs;
+        u32 writemask = ~(super->s_writesize - 1);
+
+        if (a->gc_level >= LOGFS_NO_AREAS)
+                return -EIO;
+        if (a->vim != VIM_DEFAULT)
+                return -EIO; /* TODO: close area and continue */
+
+        area->a_used_bytes = be32_to_cpu(a->used_bytes);
+        area->a_written_bytes = area->a_used_bytes & writemask;
+        area->a_segno = be32_to_cpu(a->segno);
+        if (area->a_segno)
+                area->a_is_open = 1;
+
+        ofs = dev_ofs(sb, area->a_segno, area->a_written_bytes);
+        if (super->s_writesize > 1)
+                logfs_buf_recover(area, ofs, a + 1, super->s_writesize);
+        else
+                logfs_buf_recover(area, ofs, NULL, 0);
+        return 0;
+}
+
+static void *unpack(void *from, void *to)
+{
+        struct logfs_journal_header *jh = from;
+        void *data = from + sizeof(struct logfs_journal_header);
+        int err;
+        size_t inlen, outlen;
+
+        inlen = be16_to_cpu(jh->h_len);
+        outlen = be16_to_cpu(jh->h_datalen);
+
+        if (jh->h_compr == COMPR_NONE)
+                memcpy(to, data, inlen);
+        else {
+                err = logfs_uncompress(data, to, inlen, outlen);
+                BUG_ON(err);
+        }
+        return to;
+}
+
+static int __read_je_header(struct super_block *sb, u64 ofs,
+                struct logfs_journal_header *jh)
+{
+        struct logfs_super *super = logfs_super(sb);
+        size_t bufsize = max_t(size_t, sb->s_blocksize, super->s_writesize)
+                + MAX_JOURNAL_HEADER;
+        u16 type, len, datalen;
+        int err;
+
+        /* read header only */
+        err = wbuf_read(sb, ofs, sizeof(*jh), jh);
+        if (err)
+                return err;
+        type = be16_to_cpu(jh->h_type);
+        len = be16_to_cpu(jh->h_len);
+        datalen = be16_to_cpu(jh->h_datalen);
+        if (len > sb->s_blocksize)
+                return -EIO;
+        if ((type < JE_FIRST) || (type > JE_LAST))
+                return -EIO;
+        if (datalen > bufsize)
+                return -EIO;
+        return 0;
+}
+
+static int __read_je_payload(struct super_block *sb, u64 ofs,
+                struct logfs_journal_header *jh)
+{
+        u16 len;
+        int err;
+
+        len = be16_to_cpu(jh->h_len);
+        err = wbuf_read(sb, ofs + sizeof(*jh), len, jh + 1);
+        if (err)
+                return err;
+        if (jh->h_crc != logfs_crc32(jh, len + sizeof(*jh), 4)) {
+                /* Old code was confused.  It forgot about the header length
+                 * and stopped calculating the crc 16 bytes before the end
+                 * of data - ick!
+                 * FIXME: Remove this hack once the old code is fixed.
+                 */
+                if (jh->h_crc == logfs_crc32(jh, len, 4))
+                        WARN_ON_ONCE(1);
+                else
+                        return -EIO;
+        }
+        return 0;
+}
+
+/*
+ * jh needs to be large enough to hold the complete entry, not just the header
+ */
+static int __read_je(struct super_block *sb, u64 ofs,
+                struct logfs_journal_header *jh)
+{
+        int err;
+
+        err = __read_je_header(sb, ofs, jh);
+        if (err)
+                return err;
+        return __read_je_payload(sb, ofs, jh);
+}
+
+static int read_je(struct super_block *sb, u64 ofs)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_journal_header *jh = super->s_compressed_je;
+        void *scratch = super->s_je;
+        u16 type, datalen;
+        int err;
+
+        err = __read_je(sb, ofs, jh);
+        if (err)
+                return err;
+        type = be16_to_cpu(jh->h_type);
+        datalen = be16_to_cpu(jh->h_datalen);
+
+        switch (type) {
+        case JE_DYNSB:
+                read_dynsb(sb, unpack(jh, scratch));
+                break;
+        case JE_ANCHOR:
+                read_anchor(sb, unpack(jh, scratch));
+                break;
+        case JE_ERASECOUNT:
+                read_erasecount(sb, unpack(jh, scratch));
+                break;
+        case JE_AREA:
+                read_area(sb, unpack(jh, scratch));
+                break;
+        case JE_OBJ_ALIAS:
+                err = logfs_load_object_aliases(sb, unpack(jh, scratch),
+                                datalen);
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return -EIO;
+        }
+        return err;
+}
+
+static int logfs_read_segment(struct super_block *sb, u32 segno)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_journal_header *jh = super->s_compressed_je;
+        u64 ofs, seg_ofs = dev_ofs(sb, segno, 0);
+        u32 h_ofs, last_ofs = 0;
+        u16 len, datalen, last_len = 0;
+        int i, err;
+
+        /* search for most recent commit */
+        for (h_ofs = 0; h_ofs < super->s_segsize; h_ofs += sizeof(*jh)) {
+                ofs = seg_ofs + h_ofs;
+                err = __read_je_header(sb, ofs, jh);
+                if (err)
+                        continue;
+                if (jh->h_type != cpu_to_be16(JE_COMMIT))
+                        continue;
+                err = __read_je_payload(sb, ofs, jh);
+                if (err)
+                        continue;
+                len = be16_to_cpu(jh->h_len);
+                datalen = be16_to_cpu(jh->h_datalen);
+                if ((datalen > sizeof(super->s_je_array)) ||
+                                (datalen % sizeof(__be64)))
+                        continue;
+                last_ofs = h_ofs;
+                last_len = datalen;
+                h_ofs += ALIGN(len, sizeof(*jh)) - sizeof(*jh);
+        }
+        /* read commit */
+        if (last_ofs == 0)
+                return -ENOENT;
+        ofs = seg_ofs + last_ofs;
+        log_journal("Read commit from %llx\n", ofs);
+        err = __read_je(sb, ofs, jh);
+        BUG_ON(err); /* We should have caught it in the scan loop already */
+        if (err)
+                return err;
+        /* uncompress */
+        unpack(jh, super->s_je_array);
+        super->s_no_je = last_len / sizeof(__be64);
+        /* iterate over array */
+        for (i = 0; i < super->s_no_je; i++) {
+                err = read_je(sb, be64_to_cpu(super->s_je_array[i]));
+                if (err)
+                        return err;
+        }
+        super->s_journal_area->a_segno = segno;
+        return 0;
+}
+
+static u64 read_gec(struct super_block *sb, u32 segno)
+{
+        struct logfs_segment_header sh;
+        __be32 crc;
+        int err;
+
+        if (!segno)
+                return 0;
+        err = wbuf_read(sb, dev_ofs(sb, segno, 0), sizeof(sh), &sh);
+        if (err)
+                return 0;
+        crc = logfs_crc32(&sh, sizeof(sh), 4);
+        if (crc != sh.crc) {
+                WARN_ON(sh.gec != cpu_to_be64(0xffffffffffffffffull));
+                /* Most likely it was just erased */
+                return 0;
+        }
+        return be64_to_cpu(sh.gec);
+}
+
+static int logfs_read_journal(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u64 gec[LOGFS_JOURNAL_SEGS], max;
+        u32 segno;
+        int i, max_i;
+
+        max = 0;
+        max_i = -1;
+        journal_for_each(i) {
+                segno = super->s_journal_seg[i];
+                gec[i] = read_gec(sb, super->s_journal_seg[i]);
+                if (gec[i] > max) {
+                        max = gec[i];
+                        max_i = i;
+                }
+        }
+        if (max_i == -1)
+                return -EIO;
+        /* FIXME: Try older segments in case of error */
+        return logfs_read_segment(sb, super->s_journal_seg[max_i]);
+}
+
+/*
+ * First search the current segment (outer loop), then pick the next segment
+ * in the array, skipping any zero entries (inner loop).
+ */
+static void journal_get_free_segment(struct logfs_area *area)
+{
+        struct logfs_super *super = logfs_super(area->a_sb);
+        int i;
+
+        journal_for_each(i) {
+                if (area->a_segno != super->s_journal_seg[i])
+                        continue;
+
+                do {
+                        i++;
+                        if (i == LOGFS_JOURNAL_SEGS)
+                                i = 0;
+                } while (!super->s_journal_seg[i]);
+
+                area->a_segno = super->s_journal_seg[i];
+                area->a_erase_count = ++(super->s_journal_ec[i]);
+                log_journal("Journal now at %x (ec %x)\n", area->a_segno,
+                                area->a_erase_count);
+                return;
+        }
+        BUG();
+}
+
+static void journal_get_erase_count(struct logfs_area *area)
+{
+        /* erase count is stored globally and incremented in
+         * journal_get_free_segment() - nothing to do here */
+}
+
+static int journal_erase_segment(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        union {
+                struct logfs_segment_header sh;
+                unsigned char c[ALIGN(sizeof(struct logfs_segment_header), 16)];
+        } u;
+        u64 ofs;
+        int err;
+
+        err = logfs_erase_segment(sb, area->a_segno, 1);
+        if (err)
+                return err;
+
+        memset(&u, 0, sizeof(u));
+        u.sh.pad = 0;
+        u.sh.type = SEG_JOURNAL;
+        u.sh.level = 0;
+        u.sh.segno = cpu_to_be32(area->a_segno);
+        u.sh.ec = cpu_to_be32(area->a_erase_count);
+        u.sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
+        u.sh.crc = logfs_crc32(&u.sh, sizeof(u.sh), 4);
+
+        /* This causes a bug in segment.c.  Not yet. */
+        //logfs_set_segment_erased(sb, area->a_segno, area->a_erase_count, 0);
+
+        ofs = dev_ofs(sb, area->a_segno, 0);
+        area->a_used_bytes = sizeof(u);
+        logfs_buf_write(area, ofs, &u, sizeof(u));
+        return 0;
+}
+
+static size_t __logfs_write_header(struct logfs_super *super,
+                struct logfs_journal_header *jh, size_t len, size_t datalen,
+                u16 type, u8 compr)
+{
+        jh->h_len       = cpu_to_be16(len);
+        jh->h_type      = cpu_to_be16(type);
+        jh->h_datalen   = cpu_to_be16(datalen);
+        jh->h_compr     = compr;
+        jh->h_pad[0]    = 'H';
+        jh->h_pad[1]    = 'E';
+        jh->h_pad[2]    = 'A';
+        jh->h_pad[3]    = 'D';
+        jh->h_pad[4]    = 'R';
+        jh->h_crc       = logfs_crc32(jh, len + sizeof(*jh), 4);
+        return ALIGN(len, 16) + sizeof(*jh);
+}
+
+static size_t logfs_write_header(struct logfs_super *super,
+                struct logfs_journal_header *jh, size_t datalen, u16 type)
+{
+        size_t len = datalen;
+
+        return __logfs_write_header(super, jh, len, datalen, type, COMPR_NONE);
+}
+
+static inline size_t logfs_journal_erasecount_size(struct logfs_super *super)
+{
+        return LOGFS_JOURNAL_SEGS * sizeof(__be32);
+}
+
+static void *logfs_write_erasecount(struct super_block *sb, void *_ec,
+                u16 *type, size_t *len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_je_journal_ec *ec = _ec;
+        int i;
+
+        journal_for_each(i)
+                ec->ec[i] = cpu_to_be32(super->s_journal_ec[i]);
+        *type = JE_ERASECOUNT;
+        *len = logfs_journal_erasecount_size(super);
+        return ec;
+}
+
+static void account_shadow(void *_shadow, unsigned long _sb, u64 ignore,
+                size_t ignore2)
+{
+        struct logfs_shadow *shadow = _shadow;
+        struct super_block *sb = (void *)_sb;
+        struct logfs_super *super = logfs_super(sb);
+
+        /* consume new space */
+        super->s_free_bytes       -= shadow->new_len;
+        super->s_used_bytes       += shadow->new_len;
+        super->s_dirty_used_bytes -= shadow->new_len;
+
+        /* free up old space */
+        super->s_free_bytes       += shadow->old_len;
+        super->s_used_bytes       -= shadow->old_len;
+        super->s_dirty_free_bytes -= shadow->old_len;
+
+        logfs_set_segment_used(sb, shadow->old_ofs, -shadow->old_len);
+        logfs_set_segment_used(sb, shadow->new_ofs, shadow->new_len);
+
+        log_journal("account_shadow(%llx, %llx, %x) %llx->%llx %x->%x\n",
+                        shadow->ino, shadow->bix, shadow->gc_level,
+                        shadow->old_ofs, shadow->new_ofs,
+                        shadow->old_len, shadow->new_len);
+        mempool_free(shadow, super->s_shadow_pool);
+}
+
+static void account_shadows(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *inode = super->s_master_inode;
+        struct logfs_inode *li = logfs_inode(inode);
+        struct shadow_tree *tree = &super->s_shadow_tree;
+
+        btree_grim_visitor64(&tree->new, (unsigned long)sb, account_shadow);
+        btree_grim_visitor64(&tree->old, (unsigned long)sb, account_shadow);
+        btree_grim_visitor32(&tree->segment_map, 0, NULL);
+        tree->no_shadowed_segments = 0;
+
+        if (li->li_block) {
+                /*
+                 * We never actually use the structure, when attached to the
+                 * master inode.  But it is easier to always free it here than
+                 * to have checks in several places elsewhere when allocating
+                 * it.
+                 */
+                li->li_block->ops->free_block(sb, li->li_block);
+        }
+        BUG_ON((s64)li->li_used_bytes < 0);
+}
+
+static void *__logfs_write_anchor(struct super_block *sb, void *_da,
+                u16 *type, size_t *len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_je_anchor *da = _da;
+        struct inode *inode = super->s_master_inode;
+        struct logfs_inode *li = logfs_inode(inode);
+        int i;
+
+        da->da_height   = li->li_height;
+        da->da_last_ino = cpu_to_be64(super->s_last_ino);
+        da->da_size     = cpu_to_be64(i_size_read(inode));
+        da->da_used_bytes = cpu_to_be64(li->li_used_bytes);
+        for (i = 0; i < LOGFS_EMBEDDED_FIELDS; i++)
+                da->da_data[i] = cpu_to_be64(li->li_data[i]);
+        *type = JE_ANCHOR;
+        *len = sizeof(*da);
+        return da;
+}
+
+static void *logfs_write_dynsb(struct super_block *sb, void *_dynsb,
+                u16 *type, size_t *len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_je_dynsb *dynsb = _dynsb;
+
+        dynsb->ds_gec           = cpu_to_be64(super->s_gec);
+        dynsb->ds_sweeper       = cpu_to_be64(super->s_sweeper);
+        dynsb->ds_victim_ino    = cpu_to_be64(super->s_victim_ino);
+        dynsb->ds_rename_dir    = cpu_to_be64(super->s_rename_dir);
+        dynsb->ds_rename_pos    = cpu_to_be64(super->s_rename_pos);
+        dynsb->ds_used_bytes    = cpu_to_be64(super->s_used_bytes);
+        dynsb->ds_generation    = cpu_to_be32(super->s_generation);
+        *type = JE_DYNSB;
+        *len = sizeof(*dynsb);
+        return dynsb;
+}
+
+static void write_wbuf(struct super_block *sb, struct logfs_area *area,
+                void *wbuf)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        u64 ofs;
+        pgoff_t index;
+        int page_ofs;
+        struct page *page;
+
+        ofs = dev_ofs(sb, area->a_segno,
+                        area->a_used_bytes & ~(super->s_writesize - 1));
+        index = ofs >> PAGE_SHIFT;
+        page_ofs = ofs & (PAGE_SIZE - 1);
+
+        page = find_lock_page(mapping, index);
+        BUG_ON(!page);
+        memcpy(wbuf, page_address(page) + page_ofs, super->s_writesize);
+        unlock_page(page);
+}
+
+static void *logfs_write_area(struct super_block *sb, void *_a,
+                u16 *type, size_t *len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area = super->s_area[super->s_sum_index];
+        struct logfs_je_area *a = _a;
+
+        a->vim = VIM_DEFAULT;
+        a->gc_level = super->s_sum_index;
+        a->used_bytes = cpu_to_be32(area->a_used_bytes);
+        a->segno = cpu_to_be32(area->a_segno);
+        if (super->s_writesize > 1)
+                write_wbuf(sb, area, a + 1);
+
+        *type = JE_AREA;
+        *len = sizeof(*a) + super->s_writesize;
+        return a;
+}
+
+static void *logfs_write_commit(struct super_block *sb, void *h,
+                u16 *type, size_t *len)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        *type = JE_COMMIT;
+        *len = super->s_no_je * sizeof(__be64);
+        return super->s_je_array;
+}
+
+static size_t __logfs_write_je(struct super_block *sb, void *buf, u16 type,
+                size_t len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        void *header = super->s_compressed_je;
+        void *data = header + sizeof(struct logfs_journal_header);
+        ssize_t compr_len, pad_len;
+        u8 compr = COMPR_ZLIB;
+
+        if (len == 0)
+                return logfs_write_header(super, header, 0, type);
+
+        BUG_ON(len > sb->s_blocksize);
+        compr_len = logfs_compress(buf, data, len, sb->s_blocksize);
+        if (compr_len < 0 || type == JE_ANCHOR) {
+                memcpy(data, buf, len);
+                compr_len = len;
+                compr = COMPR_NONE;
+        }
+
+        pad_len = ALIGN(compr_len, 16);
+        memset(data + compr_len, 0, pad_len - compr_len);
+
+        return __logfs_write_header(super, header, compr_len, len, type, compr);
+}
+
+static s64 logfs_get_free_bytes(struct logfs_area *area, size_t *bytes,
+                int must_pad)
+{
+        u32 writesize = logfs_super(area->a_sb)->s_writesize;
+        s32 ofs;
+        int ret;
+
+        ret = logfs_open_area(area, *bytes);
+        if (ret)
+                return -EAGAIN;
+
+        ofs = area->a_used_bytes;
+        area->a_used_bytes += *bytes;
+
+        if (must_pad) {
+                area->a_used_bytes = ALIGN(area->a_used_bytes, writesize);
+                *bytes = area->a_used_bytes - ofs;
+        }
+
+        return dev_ofs(area->a_sb, area->a_segno, ofs);
+}
+
+static int logfs_write_je_buf(struct super_block *sb, void *buf, u16 type,
+                size_t buf_len)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area = super->s_journal_area;
+        struct logfs_journal_header *jh = super->s_compressed_je;
+        size_t len;
+        int must_pad = 0;
+        s64 ofs;
+
+        len = __logfs_write_je(sb, buf, type, buf_len);
+        if (jh->h_type == cpu_to_be16(JE_COMMIT))
+                must_pad = 1;
+
+        ofs = logfs_get_free_bytes(area, &len, must_pad);
+        if (ofs < 0)
+                return ofs;
+        logfs_buf_write(area, ofs, super->s_compressed_je, len);
+        BUG_ON(super->s_no_je >= MAX_JOURNAL_ENTRIES);
+        super->s_je_array[super->s_no_je++] = cpu_to_be64(ofs);
+        return 0;
+}
+
+static int logfs_write_je(struct super_block *sb,
+                void* (*write)(struct super_block *sb, void *scratch,
+                        u16 *type, size_t *len))
+{
+        void *buf;
+        size_t len;
+        u16 type;
+
+        buf = write(sb, logfs_super(sb)->s_je, &type, &len);
+        return logfs_write_je_buf(sb, buf, type, len);
+}
+
+int write_alias_journal(struct super_block *sb, u64 ino, u64 bix,
+                level_t level, int child_no, __be64 val)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_obj_alias *oa = super->s_je;
+        int err = 0, fill = super->s_je_fill;
+
+        log_aliases("logfs_write_obj_aliases #%x(%llx, %llx, %x, %x) %llx\n",
+                        fill, ino, bix, level, child_no, be64_to_cpu(val));
+        oa[fill].ino = cpu_to_be64(ino);
+        oa[fill].bix = cpu_to_be64(bix);
+        oa[fill].val = val;
+        oa[fill].level = (__force u8)level;
+        oa[fill].child_no = cpu_to_be16(child_no);
+        fill++;
+        if (fill >= sb->s_blocksize / sizeof(*oa)) {
+                err = logfs_write_je_buf(sb, oa, JE_OBJ_ALIAS, sb->s_blocksize);
+                fill = 0;
+        }
+
+        super->s_je_fill = fill;
+        return err;
+}
+
+static int logfs_write_obj_aliases(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int err;
+
+        log_journal("logfs_write_obj_aliases: %d aliases to write\n",
+                        super->s_no_object_aliases);
+        super->s_je_fill = 0;
+        err = logfs_write_obj_aliases_pagecache(sb);
+        if (err)
+                return err;
+
+        if (super->s_je_fill)
+                err = logfs_write_je_buf(sb, super->s_je, JE_OBJ_ALIAS,
+                                super->s_je_fill
+                                * sizeof(struct logfs_obj_alias));
+        return err;
+}
+
+/*
+ * Write all journal entries.  The goto logic ensures that all journal entries
+ * are written whenever a new segment is used.  It is ugly and potentially a
+ * bit wasteful, but robustness is more important.  With this we can *always*
+ * erase all journal segments except the one containing the most recent commit.
+ */
+void logfs_write_anchor(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area = super->s_journal_area;
+        int i, err;
+
+        if (!(super->s_flags & LOGFS_SB_FLAG_DIRTY))
+                return;
+        super->s_flags &= ~LOGFS_SB_FLAG_DIRTY;
+
+        BUG_ON(super->s_flags & LOGFS_SB_FLAG_SHUTDOWN);
+        mutex_lock(&super->s_journal_mutex);
+
+        /* Do this first or suffer corruption */
+        logfs_sync_segments(sb);
+        account_shadows(sb);
+
+again:
+        super->s_no_je = 0;
+        for_each_area(i) {
+                if (!super->s_area[i]->a_is_open)
+                        continue;
+                super->s_sum_index = i;
+                err = logfs_write_je(sb, logfs_write_area);
+                if (err)
+                        goto again;
+        }
+        err = logfs_write_obj_aliases(sb);
+        if (err)
+                goto again;
+        err = logfs_write_je(sb, logfs_write_erasecount);
+        if (err)
+                goto again;
+        err = logfs_write_je(sb, __logfs_write_anchor);
+        if (err)
+                goto again;
+        err = logfs_write_je(sb, logfs_write_dynsb);
+        if (err)
+                goto again;
+        /*
+         * Order is imperative.  First we sync all writes, including the
+         * non-committed journal writes.  Then we write the final commit and
+         * sync the current journal segment.
+         * There is a theoretical bug here.  Syncing the journal segment will
+         * write a number of journal entries and the final commit.  All these
+         * are written in a single operation.  If the device layer writes the
+         * data back-to-front, the commit will precede the other journal
+         * entries, leaving a race window.
+         * Two fixes are possible.  Preferred is to fix the device layer to
+         * ensure writes happen front-to-back.  Alternatively we can insert
+         * another logfs_sync_area() super->s_devops->sync() combo before
+         * writing the commit.
+         */
+        /*
+         * On another subject, super->s_devops->sync is usually not necessary.
+         * Unless called from sys_sync or friends, a barrier would suffice.
+         */
+        super->s_devops->sync(sb);
+        err = logfs_write_je(sb, logfs_write_commit);
+        if (err)
+                goto again;
+        log_journal("Write commit to %llx\n",
+                        be64_to_cpu(super->s_je_array[super->s_no_je - 1]));
+        logfs_sync_area(area);
+        BUG_ON(area->a_used_bytes != area->a_written_bytes);
+        super->s_devops->sync(sb);
+
+        mutex_unlock(&super->s_journal_mutex);
+        return;
+}
+
+void do_logfs_journal_wl_pass(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_area *area = super->s_journal_area;
+        struct btree_head32 *head = &super->s_reserved_segments;
+        u32 segno, ec;
+        int i, err;
+
+        log_journal("Journal requires wear-leveling.\n");
+        /* Drop old segments */
+        journal_for_each(i)
+                if (super->s_journal_seg[i]) {
+                        btree_remove32(head, super->s_journal_seg[i]);
+                        logfs_set_segment_unreserved(sb,
+                                        super->s_journal_seg[i],
+                                        super->s_journal_ec[i]);
+                        super->s_journal_seg[i] = 0;
+                        super->s_journal_ec[i] = 0;
+                }
+        /* Get new segments */
+        for (i = 0; i < super->s_no_journal_segs; i++) {
+                segno = get_best_cand(sb, &super->s_reserve_list, &ec);
+                super->s_journal_seg[i] = segno;
+                super->s_journal_ec[i] = ec;
+                logfs_set_segment_reserved(sb, segno);
+                err = btree_insert32(head, segno, (void *)1, GFP_KERNEL);
+                BUG_ON(err); /* mempool should prevent this */
+                err = logfs_erase_segment(sb, segno, 1);
+                BUG_ON(err); /* FIXME: remount-ro would be nicer */
+        }
+        /* Manually move journal_area */
+        freeseg(sb, area->a_segno);
+        area->a_segno = super->s_journal_seg[0];
+        area->a_is_open = 0;
+        area->a_used_bytes = 0;
+        /* Write journal */
+        logfs_write_anchor(sb);
+        /* Write superblocks */
+        err = logfs_write_sb(sb);
+        BUG_ON(err);
+}
+
+static const struct logfs_area_ops journal_area_ops = {
+        .get_free_segment       = journal_get_free_segment,
+        .get_erase_count        = journal_get_erase_count,
+        .erase_segment          = journal_erase_segment,
+};
+
+int logfs_init_journal(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        size_t bufsize = max_t(size_t, sb->s_blocksize, super->s_writesize)
+                + MAX_JOURNAL_HEADER;
+        int ret = -ENOMEM;
+
+        mutex_init(&super->s_journal_mutex);
+        btree_init_mempool32(&super->s_reserved_segments, super->s_btree_pool);
+
+        super->s_je = kzalloc(bufsize, GFP_KERNEL);
+        if (!super->s_je)
+                return ret;
+
+        super->s_compressed_je = kzalloc(bufsize, GFP_KERNEL);
+        if (!super->s_compressed_je)
+                return ret;
+
+        super->s_master_inode = logfs_new_meta_inode(sb, LOGFS_INO_MASTER);
+        if (IS_ERR(super->s_master_inode))
+                return PTR_ERR(super->s_master_inode);
+
+        ret = logfs_read_journal(sb);
+        if (ret)
+                return -EIO;
+
+        reserve_sb_and_journal(sb);
+        logfs_calc_free(sb);
+
+        super->s_journal_area->a_ops = &journal_area_ops;
+        return 0;
+}
+
+void logfs_cleanup_journal(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        btree_grim_visitor32(&super->s_reserved_segments, 0, NULL);
+        destroy_meta_inode(super->s_master_inode);
+        super->s_master_inode = NULL;
+
+        kfree(super->s_compressed_je);
+        kfree(super->s_je);
+}
diff --git a/fs/logfs/logfs.h b/fs/logfs/logfs.h
new file mode 100644
index 000000000000..0a3df1a0c936
--- /dev/null
+++ b/fs/logfs/logfs.h
@@ -0,0 +1,736 @@
+/*
+ * fs/logfs/logfs.h
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ *
+ * Private header for logfs.
+ */
+#ifndef FS_LOGFS_LOGFS_H
+#define FS_LOGFS_LOGFS_H
+
+#undef __CHECK_ENDIAN__
+#define __CHECK_ENDIAN__
+
+#include <linux/btree.h>
+#include <linux/crc32.h>
+#include <linux/fs.h>
+#include <linux/kernel.h>
+#include <linux/mempool.h>
+#include <linux/pagemap.h>
+#include <linux/mtd/mtd.h>
+#include "logfs_abi.h"
+
+#define LOGFS_DEBUG_SUPER       (0x0001)
+#define LOGFS_DEBUG_SEGMENT     (0x0002)
+#define LOGFS_DEBUG_JOURNAL     (0x0004)
+#define LOGFS_DEBUG_DIR         (0x0008)
+#define LOGFS_DEBUG_FILE        (0x0010)
+#define LOGFS_DEBUG_INODE       (0x0020)
+#define LOGFS_DEBUG_READWRITE   (0x0040)
+#define LOGFS_DEBUG_GC          (0x0080)
+#define LOGFS_DEBUG_GC_NOISY    (0x0100)
+#define LOGFS_DEBUG_ALIASES     (0x0200)
+#define LOGFS_DEBUG_BLOCKMOVE   (0x0400)
+#define LOGFS_DEBUG_ALL         (0xffffffff)
+
+#define LOGFS_DEBUG             (0x01)
+/*
+ * To enable specific log messages, simply define LOGFS_DEBUG to match any
+ * or all of the above.
+ */
+#ifndef LOGFS_DEBUG
+#define LOGFS_DEBUG             (0)
+#endif
+
+#define log_cond(cond, fmt, arg...) do {        \
+        if (cond)                               \
+                printk(KERN_DEBUG fmt, ##arg);  \
+} while (0)
+
+#define log_super(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_SUPER, fmt, ##arg)
+#define log_segment(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_SEGMENT, fmt, ##arg)
+#define log_journal(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_JOURNAL, fmt, ##arg)
+#define log_dir(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_DIR, fmt, ##arg)
+#define log_file(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_FILE, fmt, ##arg)
+#define log_inode(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_INODE, fmt, ##arg)
+#define log_readwrite(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_READWRITE, fmt, ##arg)
+#define log_gc(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_GC, fmt, ##arg)
+#define log_gc_noisy(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_GC_NOISY, fmt, ##arg)
+#define log_aliases(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_ALIASES, fmt, ##arg)
+#define log_blockmove(fmt, arg...) \
+        log_cond(LOGFS_DEBUG & LOGFS_DEBUG_BLOCKMOVE, fmt, ##arg)
+
+#define PG_pre_locked           PG_owner_priv_1
+#define PagePreLocked(page)     test_bit(PG_pre_locked, &(page)->flags)
+#define SetPagePreLocked(page)  set_bit(PG_pre_locked, &(page)->flags)
+#define ClearPagePreLocked(page) clear_bit(PG_pre_locked, &(page)->flags)
+
+/* FIXME: This should really be somewhere in the 64bit area. */
+#define LOGFS_LINK_MAX          (1<<30)
+
+/* Read-only filesystem */
+#define LOGFS_SB_FLAG_RO        0x0001
+#define LOGFS_SB_FLAG_DIRTY     0x0002
+#define LOGFS_SB_FLAG_OBJ_ALIAS 0x0004
+#define LOGFS_SB_FLAG_SHUTDOWN  0x0008
+
+/* Write Control Flags */
+#define WF_LOCK                 0x01 /* take write lock */
+#define WF_WRITE                0x02 /* write block */
+#define WF_DELETE               0x04 /* delete old block */
+
+typedef u8 __bitwise level_t;
+typedef u8 __bitwise gc_level_t;
+
+#define LEVEL(level) ((__force level_t)(level))
+#define GC_LEVEL(gc_level) ((__force gc_level_t)(gc_level))
+
+#define SUBLEVEL(level) ( (void)((level) == LEVEL(1)),  \
+                (__force level_t)((__force u8)(level) - 1) )
+
+/**
+ * struct logfs_area - area management information
+ *
+ * @a_sb:                       the superblock this area belongs to
+ * @a_is_open:                  1 if the area is currently open, else 0
+ * @a_segno:                    segment number of area
+ * @a_written_bytes:            number of bytes already written back
+ * @a_used_bytes:               number of used bytes
+ * @a_ops:                      area operations (either journal or ostore)
+ * @a_erase_count:              erase count
+ * @a_level:                    GC level
+ */
+struct logfs_area { /* a segment open for writing */
+        struct super_block *a_sb;
+        int     a_is_open;
+        u32     a_segno;
+        u32     a_written_bytes;
+        u32     a_used_bytes;
+        const struct logfs_area_ops *a_ops;
+        u32     a_erase_count;
+        gc_level_t a_level;
+};
+
+/**
+ * struct logfs_area_ops - area operations
+ *
+ * @get_free_segment:           fill area->ofs with the offset of a free segment
+ * @get_erase_count:            fill area->erase_count (needs area->ofs)
+ * @erase_segment:              erase and setup segment
+ */
+struct logfs_area_ops {
+        void    (*get_free_segment)(struct logfs_area *area);
+        void    (*get_erase_count)(struct logfs_area *area);
+        int     (*erase_segment)(struct logfs_area *area);
+};
+
+/**
+ * struct logfs_device_ops - device access operations
+ *
+ * @readpage:                   read one page (mm page)
+ * @writeseg:                   write one segment.  may be a partial segment
+ * @erase:                      erase one segment
+ * @read:                       read from the device
+ * @erase:                      erase part of the device
+ */
+struct logfs_device_ops {
+        struct page *(*find_first_sb)(struct super_block *sb, u64 *ofs);
+        struct page *(*find_last_sb)(struct super_block *sb, u64 *ofs);
+        int (*write_sb)(struct super_block *sb, struct page *page);
+        int (*readpage)(void *_sb, struct page *page);
+        void (*writeseg)(struct super_block *sb, u64 ofs, size_t len);
+        int (*erase)(struct super_block *sb, loff_t ofs, size_t len,
+                        int ensure_write);
+        void (*sync)(struct super_block *sb);
+        void (*put_device)(struct super_block *sb);
+};
+
+/**
+ * struct candidate_list - list of similar candidates
+ */
+struct candidate_list {
+        struct rb_root rb_tree;
+        int count;
+        int maxcount;
+        int sort_by_ec;
+};
+
+/**
+ * struct gc_candidate - "candidate" segment to be garbage collected next
+ *
+ * @list:                       list (either free of low)
+ * @segno:                      segment number
+ * @valid:                      number of valid bytes
+ * @erase_count:                erase count of segment
+ * @dist:                       distance from tree root
+ *
+ * Candidates can be on two lists.  The free list contains electees rather
+ * than candidates - segments that no longer contain any valid data.  The
+ * low list contains candidates to be picked for GC.  It should be kept
+ * short.  It is not required to always pick a perfect candidate.  In the
+ * worst case GC will have to move more data than absolutely necessary.
+ */
+struct gc_candidate {
+        struct rb_node rb_node;
+        struct candidate_list *list;
+        u32     segno;
+        u32     valid;
+        u32     erase_count;
+        u8      dist;
+};
+
+/**
+ * struct logfs_journal_entry - temporary structure used during journal scan
+ *
+ * @used:
+ * @version:                    normalized version
+ * @len:                        length
+ * @offset:                     offset
+ */
+struct logfs_journal_entry {
+        int used;
+        s16 version;
+        u16 len;
+        u16 datalen;
+        u64 offset;
+};
+
+enum transaction_state {
+        CREATE_1 = 1,
+        CREATE_2,
+        UNLINK_1,
+        UNLINK_2,
+        CROSS_RENAME_1,
+        CROSS_RENAME_2,
+        TARGET_RENAME_1,
+        TARGET_RENAME_2,
+        TARGET_RENAME_3
+};
+
+/**
+ * struct logfs_transaction - essential fields to support atomic dirops
+ *
+ * @ino:                        target inode
+ * @dir:                        inode of directory containing dentry
+ * @pos:                        pos of dentry in directory
+ */
+struct logfs_transaction {
+        enum transaction_state state;
+        u64      ino;
+        u64      dir;
+        u64      pos;
+};
+
+/**
+ * struct logfs_shadow - old block in the shadow of a not-yet-committed new one
+ * @old_ofs:                    offset of old block on medium
+ * @new_ofs:                    offset of new block on medium
+ * @ino:                        inode number
+ * @bix:                        block index
+ * @old_len:                    size of old block, including header
+ * @new_len:                    size of new block, including header
+ * @level:                      block level
+ */
+struct logfs_shadow {
+        u64 old_ofs;
+        u64 new_ofs;
+        u64 ino;
+        u64 bix;
+        int old_len;
+        int new_len;
+        gc_level_t gc_level;
+};
+
+/**
+ * struct shadow_tree
+ * @new:                        shadows where old_ofs==0, indexed by new_ofs
+ * @old:                        shadows where old_ofs!=0, indexed by old_ofs
+ * @segment_map:                bitfield of segments containing shadows
+ * @no_shadowed_segment:        number of segments containing shadows
+ */
+struct shadow_tree {
+        struct btree_head64 new;
+        struct btree_head64 old;
+        struct btree_head32 segment_map;
+        int no_shadowed_segments;
+};
+
+struct object_alias_item {
+        struct list_head list;
+        __be64 val;
+        int child_no;
+};
+
+/**
+ * struct logfs_block - contains any block state
+ * @type:                       indirect block or inode
+ * @full:                       number of fully populated children
+ * @partial:                    number of partially populated children
+ *
+ * Most blocks are directly represented by page cache pages.  But when a block
+ * becomes dirty, is part of a transaction, contains aliases or is otherwise
+ * special, a struct logfs_block is allocated to track the additional state.
+ * Inodes are very similar to indirect blocks, so they can also get one of
+ * these structures added when appropriate.
+ */
+#define BLOCK_INDIRECT  1       /* Indirect block */
+#define BLOCK_INODE     2       /* Inode */
+struct logfs_block_ops;
+struct logfs_block {
+        struct list_head alias_list;
+        struct list_head item_list;
+        struct super_block *sb;
+        u64 ino;
+        u64 bix;
+        level_t level;
+        struct page *page;
+        struct inode *inode;
+        struct logfs_transaction *ta;
+        unsigned long alias_map[LOGFS_BLOCK_FACTOR / BITS_PER_LONG];
+        struct logfs_block_ops *ops;
+        int full;
+        int partial;
+        int reserved_bytes;
+};
+
+typedef int write_alias_t(struct super_block *sb, u64 ino, u64 bix,
+                level_t level, int child_no, __be64 val);
+struct logfs_block_ops {
+        void    (*write_block)(struct logfs_block *block);
+        void    (*free_block)(struct super_block *sb, struct logfs_block*block);
+        int     (*write_alias)(struct super_block *sb,
+                        struct logfs_block *block,
+                        write_alias_t *write_one_alias);
+};
+
+#define MAX_JOURNAL_ENTRIES 256
+
+struct logfs_super {
+        struct mtd_info *s_mtd;                 /* underlying device */
+        struct block_device *s_bdev;            /* underlying device */
+        const struct logfs_device_ops *s_devops;/* device access */
+        struct inode    *s_master_inode;        /* inode file */
+        struct inode    *s_segfile_inode;       /* segment file */
+        struct inode *s_mapping_inode;          /* device mapping */
+        atomic_t s_pending_writes;              /* outstanting bios */
+        long     s_flags;
+        mempool_t *s_btree_pool;                /* for btree nodes */
+        mempool_t *s_alias_pool;                /* aliases in segment.c */
+        u64      s_feature_incompat;
+        u64      s_feature_ro_compat;
+        u64      s_feature_compat;
+        u64      s_feature_flags;
+        u64      s_sb_ofs[2];
+        struct page *s_erase_page;              /* for dev_bdev.c */
+        /* alias.c fields */
+        struct btree_head32 s_segment_alias;    /* remapped segments */
+        int      s_no_object_aliases;
+        struct list_head s_object_alias;        /* remapped objects */
+        struct btree_head128 s_object_alias_tree; /* remapped objects */
+        struct mutex s_object_alias_mutex;
+        /* dir.c fields */
+        struct mutex s_dirop_mutex;             /* for creat/unlink/rename */
+        u64      s_victim_ino;                  /* used for atomic dir-ops */
+        u64      s_rename_dir;                  /* source directory ino */
+        u64      s_rename_pos;                  /* position of source dd */
+        /* gc.c fields */
+        long     s_segsize;                     /* size of a segment */
+        int      s_segshift;                    /* log2 of segment size */
+        long     s_segmask;                     /* 1 << s_segshift - 1 */
+        long     s_no_segs;                     /* segments on device */
+        long     s_no_journal_segs;             /* segments used for journal */
+        long     s_no_blocks;                   /* blocks per segment */
+        long     s_writesize;                   /* minimum write size */
+        int      s_writeshift;                  /* log2 of write size */
+        u64      s_size;                        /* filesystem size */
+        struct logfs_area *s_area[LOGFS_NO_AREAS];      /* open segment array */
+        u64      s_gec;                         /* global erase count */
+        u64      s_wl_gec_ostore;               /* time of last wl event */
+        u64      s_wl_gec_journal;              /* time of last wl event */
+        u64      s_sweeper;                     /* current sweeper pos */
+        u8       s_ifile_levels;                /* max level of ifile */
+        u8       s_iblock_levels;               /* max level of regular files */
+        u8       s_data_levels;                 /* # of segments to leaf block*/
+        u8       s_total_levels;                /* sum of above three */
+        struct btree_head32 s_cand_tree;        /* all candidates */
+        struct candidate_list s_free_list;      /* 100% free segments */
+        struct candidate_list s_reserve_list;   /* Bad segment reserve */
+        struct candidate_list s_low_list[LOGFS_NO_AREAS];/* good candidates */
+        struct candidate_list s_ec_list;        /* wear level candidates */
+        struct btree_head32 s_reserved_segments;/* sb, journal, bad, etc. */
+        /* inode.c fields */
+        u64      s_last_ino;                    /* highest ino used */
+        long     s_inos_till_wrap;
+        u32      s_generation;                  /* i_generation for new files */
+        struct list_head s_freeing_list;        /* inodes being freed */
+        /* journal.c fields */
+        struct mutex s_journal_mutex;
+        void    *s_je;                          /* journal entry to compress */
+        void    *s_compressed_je;               /* block to write to journal */
+        u32      s_journal_seg[LOGFS_JOURNAL_SEGS]; /* journal segments */
+        u32      s_journal_ec[LOGFS_JOURNAL_SEGS]; /* journal erasecounts */
+        u64      s_last_version;
+        struct logfs_area *s_journal_area;      /* open journal segment */
+        __be64  s_je_array[MAX_JOURNAL_ENTRIES];
+        int     s_no_je;
+
+        int      s_sum_index;                   /* for the 12 summaries */
+        struct shadow_tree s_shadow_tree;
+        int      s_je_fill;                     /* index of current je */
+        /* readwrite.c fields */
+        struct mutex s_write_mutex;
+        int      s_lock_count;
+        mempool_t *s_block_pool;                /* struct logfs_block pool */
+        mempool_t *s_shadow_pool;               /* struct logfs_shadow pool */
+        /*
+         * Space accounting:
+         * - s_used_bytes specifies space used to store valid data objects.
+         * - s_dirty_used_bytes is space used to store non-committed data
+         *   objects.  Those objects have already been written themselves,
+         *   but they don't become valid until all indirect blocks up to the
+         *   journal have been written as well.
+         * - s_dirty_free_bytes is space used to store the old copy of a
+         *   replaced object, as long as the replacement is non-committed.
+         *   In other words, it is the amount of space freed when all dirty
+         *   blocks are written back.
+         * - s_free_bytes is the amount of free space available for any
+         *   purpose.
+         * - s_root_reserve is the amount of free space available only to
+         *   the root user.  Non-privileged users can no longer write once
+         *   this watermark has been reached.
+         * - s_speed_reserve is space which remains unused to speed up
+         *   garbage collection performance.
+         * - s_dirty_pages is the space reserved for currently dirty pages.
+         *   It is a pessimistic estimate, so some/most will get freed on
+         *   page writeback.
+         *
+         * s_used_bytes + s_free_bytes + s_speed_reserve = total usable size
+         */
+        u64      s_free_bytes;
+        u64      s_used_bytes;
+        u64      s_dirty_free_bytes;
+        u64      s_dirty_used_bytes;
+        u64      s_root_reserve;
+        u64      s_speed_reserve;
+        u64      s_dirty_pages;
+        /* Bad block handling:
+         * - s_bad_seg_reserve is a number of segments usually kept
+         *   free.  When encountering bad blocks, the affected segment's data
+         *   is _temporarily_ moved to a reserved segment.
+         * - s_bad_segments is the number of known bad segments.
+         */
+        u32      s_bad_seg_reserve;
+        u32      s_bad_segments;
+};
+
+/**
+ * struct logfs_inode - in-memory inode
+ *
+ * @vfs_inode:                  struct inode
+ * @li_data:                    data pointers
+ * @li_used_bytes:              number of used bytes
+ * @li_freeing_list:            used to track inodes currently being freed
+ * @li_flags:                   inode flags
+ * @li_refcount:                number of internal (GC-induced) references
+ */
+struct logfs_inode {
+        struct inode vfs_inode;
+        u64     li_data[LOGFS_EMBEDDED_FIELDS];
+        u64     li_used_bytes;
+        struct list_head li_freeing_list;
+        struct logfs_block *li_block;
+        u32     li_flags;
+        u8      li_height;
+        int     li_refcount;
+};
+
+#define journal_for_each(__i) for (__i = 0; __i < LOGFS_JOURNAL_SEGS; __i++)
+#define for_each_area(__i) for (__i = 0; __i < LOGFS_NO_AREAS; __i++)
+#define for_each_area_down(__i) for (__i = LOGFS_NO_AREAS - 1; __i >= 0; __i--)
+
+/* compr.c */
+int logfs_compress(void *in, void *out, size_t inlen, size_t outlen);
+int logfs_uncompress(void *in, void *out, size_t inlen, size_t outlen);
+int __init logfs_compr_init(void);
+void logfs_compr_exit(void);
+
+/* dev_bdev.c */
+#ifdef CONFIG_BLOCK
+int logfs_get_sb_bdev(struct file_system_type *type, int flags,
+                const char *devname, struct vfsmount *mnt);
+#else
+static inline int logfs_get_sb_bdev(struct file_system_type *type, int flags,
+                const char *devname, struct vfsmount *mnt)
+{
+        return -ENODEV;
+}
+#endif
+
+/* dev_mtd.c */
+#ifdef CONFIG_MTD
+int logfs_get_sb_mtd(struct file_system_type *type, int flags,
+                int mtdnr, struct vfsmount *mnt);
+#else
+static inline int logfs_get_sb_mtd(struct file_system_type *type, int flags,
+                int mtdnr, struct vfsmount *mnt)
+{
+        return -ENODEV;
+}
+#endif
+
+/* dir.c */
+extern const struct inode_operations logfs_symlink_iops;
+extern const struct inode_operations logfs_dir_iops;
+extern const struct file_operations logfs_dir_fops;
+int logfs_replay_journal(struct super_block *sb);
+
+/* file.c */
+extern const struct inode_operations logfs_reg_iops;
+extern const struct file_operations logfs_reg_fops;
+extern const struct address_space_operations logfs_reg_aops;
+int logfs_readpage(struct file *file, struct page *page);
+int logfs_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+                unsigned long arg);
+int logfs_fsync(struct file *file, struct dentry *dentry, int datasync);
+
+/* gc.c */
+u32 get_best_cand(struct super_block *sb, struct candidate_list *list, u32 *ec);
+void logfs_gc_pass(struct super_block *sb);
+int logfs_check_areas(struct super_block *sb);
+int logfs_init_gc(struct super_block *sb);
+void logfs_cleanup_gc(struct super_block *sb);
+
+/* inode.c */
+extern const struct super_operations logfs_super_operations;
+struct inode *logfs_iget(struct super_block *sb, ino_t ino);
+struct inode *logfs_safe_iget(struct super_block *sb, ino_t ino, int *cookie);
+void logfs_safe_iput(struct inode *inode, int cookie);
+struct inode *logfs_new_inode(struct inode *dir, int mode);
+struct inode *logfs_new_meta_inode(struct super_block *sb, u64 ino);
+struct inode *logfs_read_meta_inode(struct super_block *sb, u64 ino);
+int logfs_init_inode_cache(void);
+void logfs_destroy_inode_cache(void);
+void destroy_meta_inode(struct inode *inode);
+void logfs_set_blocks(struct inode *inode, u64 no);
+/* these logically belong into inode.c but actually reside in readwrite.c */
+int logfs_read_inode(struct inode *inode);
+int __logfs_write_inode(struct inode *inode, long flags);
+void logfs_delete_inode(struct inode *inode);
+void logfs_clear_inode(struct inode *inode);
+
+/* journal.c */
+void logfs_write_anchor(struct super_block *sb);
+int logfs_init_journal(struct super_block *sb);
+void logfs_cleanup_journal(struct super_block *sb);
+int write_alias_journal(struct super_block *sb, u64 ino, u64 bix,
+                level_t level, int child_no, __be64 val);
+void do_logfs_journal_wl_pass(struct super_block *sb);
+
+/* readwrite.c */
+pgoff_t logfs_pack_index(u64 bix, level_t level);
+void logfs_unpack_index(pgoff_t index, u64 *bix, level_t *level);
+int logfs_inode_write(struct inode *inode, const void *buf, size_t count,
+                loff_t bix, long flags, struct shadow_tree *shadow_tree);
+int logfs_readpage_nolock(struct page *page);
+int logfs_write_buf(struct inode *inode, struct page *page, long flags);
+int logfs_delete(struct inode *inode, pgoff_t index,
+                struct shadow_tree *shadow_tree);
+int logfs_rewrite_block(struct inode *inode, u64 bix, u64 ofs,
+                gc_level_t gc_level, long flags);
+int logfs_is_valid_block(struct super_block *sb, u64 ofs, u64 ino, u64 bix,
+                gc_level_t gc_level);
+int logfs_truncate(struct inode *inode, u64 size);
+u64 logfs_seek_hole(struct inode *inode, u64 bix);
+u64 logfs_seek_data(struct inode *inode, u64 bix);
+int logfs_open_segfile(struct super_block *sb);
+int logfs_init_rw(struct super_block *sb);
+void logfs_cleanup_rw(struct super_block *sb);
+void logfs_add_transaction(struct inode *inode, struct logfs_transaction *ta);
+void logfs_del_transaction(struct inode *inode, struct logfs_transaction *ta);
+void logfs_write_block(struct logfs_block *block, long flags);
+int logfs_write_obj_aliases_pagecache(struct super_block *sb);
+void logfs_get_segment_entry(struct super_block *sb, u32 segno,
+                struct logfs_segment_entry *se);
+void logfs_set_segment_used(struct super_block *sb, u64 ofs, int increment);
+void logfs_set_segment_erased(struct super_block *sb, u32 segno, u32 ec,
+                gc_level_t gc_level);
+void logfs_set_segment_reserved(struct super_block *sb, u32 segno);
+void logfs_set_segment_unreserved(struct super_block *sb, u32 segno, u32 ec);
+struct logfs_block *__alloc_block(struct super_block *sb,
+                u64 ino, u64 bix, level_t level);
+void __free_block(struct super_block *sb, struct logfs_block *block);
+void btree_write_block(struct logfs_block *block);
+void initialize_block_counters(struct page *page, struct logfs_block *block,
+                __be64 *array, int page_is_empty);
+int logfs_exist_block(struct inode *inode, u64 bix);
+int get_page_reserve(struct inode *inode, struct page *page);
+extern struct logfs_block_ops indirect_block_ops;
+
+/* segment.c */
+int logfs_erase_segment(struct super_block *sb, u32 ofs, int ensure_erase);
+int wbuf_read(struct super_block *sb, u64 ofs, size_t len, void *buf);
+int logfs_segment_read(struct inode *inode, struct page *page, u64 ofs, u64 bix,
+                level_t level);
+int logfs_segment_write(struct inode *inode, struct page *page,
+                struct logfs_shadow *shadow);
+int logfs_segment_delete(struct inode *inode, struct logfs_shadow *shadow);
+int logfs_load_object_aliases(struct super_block *sb,
+                struct logfs_obj_alias *oa, int count);
+void move_page_to_btree(struct page *page);
+int logfs_init_mapping(struct super_block *sb);
+void logfs_sync_area(struct logfs_area *area);
+void logfs_sync_segments(struct super_block *sb);
+void freeseg(struct super_block *sb, u32 segno);
+
+/* area handling */
+int logfs_init_areas(struct super_block *sb);
+void logfs_cleanup_areas(struct super_block *sb);
+int logfs_open_area(struct logfs_area *area, size_t bytes);
+void __logfs_buf_write(struct logfs_area *area, u64 ofs, void *buf, size_t len,
+                int use_filler);
+
+static inline void logfs_buf_write(struct logfs_area *area, u64 ofs,
+                void *buf, size_t len)
+{
+        __logfs_buf_write(area, ofs, buf, len, 0);
+}
+
+static inline void logfs_buf_recover(struct logfs_area *area, u64 ofs,
+                void *buf, size_t len)
+{
+        __logfs_buf_write(area, ofs, buf, len, 1);
+}
+
+/* super.c */
+struct page *emergency_read_begin(struct address_space *mapping, pgoff_t index);
+void emergency_read_end(struct page *page);
+void logfs_crash_dump(struct super_block *sb);
+void *memchr_inv(const void *s, int c, size_t n);
+int logfs_statfs(struct dentry *dentry, struct kstatfs *stats);
+int logfs_get_sb_device(struct file_system_type *type, int flags,
+                struct mtd_info *mtd, struct block_device *bdev,
+                const struct logfs_device_ops *devops, struct vfsmount *mnt);
+int logfs_check_ds(struct logfs_disk_super *ds);
+int logfs_write_sb(struct super_block *sb);
+
+static inline struct logfs_super *logfs_super(struct super_block *sb)
+{
+        return sb->s_fs_info;
+}
+
+static inline struct logfs_inode *logfs_inode(struct inode *inode)
+{
+        return container_of(inode, struct logfs_inode, vfs_inode);
+}
+
+static inline void logfs_set_ro(struct super_block *sb)
+{
+        logfs_super(sb)->s_flags |= LOGFS_SB_FLAG_RO;
+}
+
+#define LOGFS_BUG(sb) do {                                      \
+        struct super_block *__sb = sb;                          \
+        logfs_crash_dump(__sb);                                 \
+        logfs_super(__sb)->s_flags |= LOGFS_SB_FLAG_RO;         \
+        BUG();                                                  \
+} while (0)
+
+#define LOGFS_BUG_ON(condition, sb) \
+        do { if (unlikely(condition)) LOGFS_BUG((sb)); } while (0)
+
+static inline __be32 logfs_crc32(void *data, size_t len, size_t skip)
+{
+        return cpu_to_be32(crc32(~0, data+skip, len-skip));
+}
+
+static inline u8 logfs_type(struct inode *inode)
+{
+        return (inode->i_mode >> 12) & 15;
+}
+
+static inline pgoff_t logfs_index(struct super_block *sb, u64 pos)
+{
+        return pos >> sb->s_blocksize_bits;
+}
+
+static inline u64 dev_ofs(struct super_block *sb, u32 segno, u32 ofs)
+{
+        return ((u64)segno << logfs_super(sb)->s_segshift) + ofs;
+}
+
+static inline u32 seg_no(struct super_block *sb, u64 ofs)
+{
+        return ofs >> logfs_super(sb)->s_segshift;
+}
+
+static inline u32 seg_ofs(struct super_block *sb, u64 ofs)
+{
+        return ofs & logfs_super(sb)->s_segmask;
+}
+
+static inline u64 seg_align(struct super_block *sb, u64 ofs)
+{
+        return ofs & ~logfs_super(sb)->s_segmask;
+}
+
+static inline struct logfs_block *logfs_block(struct page *page)
+{
+        return (void *)page->private;
+}
+
+static inline level_t shrink_level(gc_level_t __level)
+{
+        u8 level = (__force u8)__level;
+
+        if (level >= LOGFS_MAX_LEVELS)
+                level -= LOGFS_MAX_LEVELS;
+        return (__force level_t)level;
+}
+
+static inline gc_level_t expand_level(u64 ino, level_t __level)
+{
+        u8 level = (__force u8)__level;
+
+        if (ino == LOGFS_INO_MASTER) {
+                /* ifile has seperate areas */
+                level += LOGFS_MAX_LEVELS;
+        }
+        return (__force gc_level_t)level;
+}
+
+static inline int logfs_block_shift(struct super_block *sb, level_t level)
+{
+        level = shrink_level((__force gc_level_t)level);
+        return (__force int)level * (sb->s_blocksize_bits - 3);
+}
+
+static inline u64 logfs_block_mask(struct super_block *sb, level_t level)
+{
+        return ~0ull << logfs_block_shift(sb, level);
+}
+
+static inline struct logfs_area *get_area(struct super_block *sb,
+                gc_level_t gc_level)
+{
+        return logfs_super(sb)->s_area[(__force u8)gc_level];
+}
+
+static inline void logfs_mempool_destroy(mempool_t *pool)
+{
+        if (pool)
+                mempool_destroy(pool);
+}
+
+#endif
diff --git a/fs/logfs/logfs_abi.h b/fs/logfs/logfs_abi.h
new file mode 100644
index 000000000000..f674725663fe
--- /dev/null
+++ b/fs/logfs/logfs_abi.h
@@ -0,0 +1,629 @@
+/*
+ * fs/logfs/logfs_abi.h
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ *
+ * Public header for logfs.
+ */
+#ifndef FS_LOGFS_LOGFS_ABI_H
+#define FS_LOGFS_LOGFS_ABI_H
+
+/* For out-of-kernel compiles */
+#ifndef BUILD_BUG_ON
+#define BUILD_BUG_ON(condition) /**/
+#endif
+
+#define SIZE_CHECK(type, size)                                  \
+static inline void check_##type(void)                           \
+{                                                               \
+        BUILD_BUG_ON(sizeof(struct type) != (size));            \
+}
+
+/*
+ * Throughout the logfs code, we're constantly dealing with blocks at
+ * various positions or offsets.  To remove confusion, we stricly
+ * distinguish between a "position" - the logical position within a
+ * file and an "offset" - the physical location within the device.
+ *
+ * Any usage of the term offset for a logical location or position for
+ * a physical one is a bug and should get fixed.
+ */
+
+/*
+ * Block are allocated in one of several segments depending on their
+ * level.  The following levels are used:
+ *  0   - regular data block
+ *  1   - i1 indirect blocks
+ *  2   - i2 indirect blocks
+ *  3   - i3 indirect blocks
+ *  4   - i4 indirect blocks
+ *  5   - i5 indirect blocks
+ *  6   - ifile data blocks
+ *  7   - ifile i1 indirect blocks
+ *  8   - ifile i2 indirect blocks
+ *  9   - ifile i3 indirect blocks
+ * 10   - ifile i4 indirect blocks
+ * 11   - ifile i5 indirect blocks
+ * Potential levels to be used in the future:
+ * 12   - gc recycled blocks, long-lived data
+ * 13   - replacement blocks, short-lived data
+ *
+ * Levels 1-11 are necessary for robust gc operations and help seperate
+ * short-lived metadata from longer-lived file data.  In the future,
+ * file data should get seperated into several segments based on simple
+ * heuristics.  Old data recycled during gc operation is expected to be
+ * long-lived.  New data is of uncertain life expectancy.  New data
+ * used to replace older blocks in existing files is expected to be
+ * short-lived.
+ */
+
+
+/* Magic numbers.  64bit for superblock, 32bit for statfs f_type */
+#define LOGFS_MAGIC             0x7a3a8e5cb9d5bf67ull
+#define LOGFS_MAGIC_U32         0xc97e8168u
+
+/*
+ * Various blocksize related macros.  Blocksize is currently fixed at 4KiB.
+ * Sooner or later that should become configurable and the macros replaced
+ * by something superblock-dependent.  Pointers in indirect blocks are and
+ * will remain 64bit.
+ *
+ * LOGFS_BLOCKSIZE      - self-explaining
+ * LOGFS_BLOCK_FACTOR   - number of pointers per indirect block
+ * LOGFS_BLOCK_BITS     - log2 of LOGFS_BLOCK_FACTOR, used for shifts
+ */
+#define LOGFS_BLOCKSIZE         (4096ull)
+#define LOGFS_BLOCK_FACTOR      (LOGFS_BLOCKSIZE / sizeof(u64))
+#define LOGFS_BLOCK_BITS        (9)
+
+/*
+ * Number of blocks at various levels of indirection.  There are 16 direct
+ * block pointers plus a single indirect pointer.
+ */
+#define I0_BLOCKS               (16)
+#define I1_BLOCKS               LOGFS_BLOCK_FACTOR
+#define I2_BLOCKS               (LOGFS_BLOCK_FACTOR * I1_BLOCKS)
+#define I3_BLOCKS               (LOGFS_BLOCK_FACTOR * I2_BLOCKS)
+#define I4_BLOCKS               (LOGFS_BLOCK_FACTOR * I3_BLOCKS)
+#define I5_BLOCKS               (LOGFS_BLOCK_FACTOR * I4_BLOCKS)
+
+#define INDIRECT_INDEX          I0_BLOCKS
+#define LOGFS_EMBEDDED_FIELDS   (I0_BLOCKS + 1)
+
+/*
+ * Sizes at which files require another level of indirection.  Files smaller
+ * than LOGFS_EMBEDDED_SIZE can be completely stored in the inode itself,
+ * similar like ext2 fast symlinks.
+ *
+ * Data at a position smaller than LOGFS_I0_SIZE is accessed through the
+ * direct pointers, else through the 1x indirect pointer and so forth.
+ */
+#define LOGFS_EMBEDDED_SIZE     (LOGFS_EMBEDDED_FIELDS * sizeof(u64))
+#define LOGFS_I0_SIZE           (I0_BLOCKS * LOGFS_BLOCKSIZE)
+#define LOGFS_I1_SIZE           (I1_BLOCKS * LOGFS_BLOCKSIZE)
+#define LOGFS_I2_SIZE           (I2_BLOCKS * LOGFS_BLOCKSIZE)
+#define LOGFS_I3_SIZE           (I3_BLOCKS * LOGFS_BLOCKSIZE)
+#define LOGFS_I4_SIZE           (I4_BLOCKS * LOGFS_BLOCKSIZE)
+#define LOGFS_I5_SIZE           (I5_BLOCKS * LOGFS_BLOCKSIZE)
+
+/*
+ * Each indirect block pointer must have this flag set, if all block pointers
+ * behind it are set, i.e. there is no hole hidden in the shadow of this
+ * indirect block pointer.
+ */
+#define LOGFS_FULLY_POPULATED (1ULL << 63)
+#define pure_ofs(ofs) (ofs & ~LOGFS_FULLY_POPULATED)
+
+/*
+ * LogFS needs to seperate data into levels.  Each level is defined as the
+ * maximal possible distance from the master inode (inode of the inode file).
+ * Data blocks reside on level 0, 1x indirect block on level 1, etc.
+ * Inodes reside on level 6, indirect blocks for the inode file on levels 7-11.
+ * This effort is necessary to guarantee garbage collection to always make
+ * progress.
+ *
+ * LOGFS_MAX_INDIRECT is the maximal indirection through indirect blocks,
+ * LOGFS_MAX_LEVELS is one more for the actual data level of a file.  It is
+ * the maximal number of levels for one file.
+ * LOGFS_NO_AREAS is twice that, as the inode file and regular files are
+ * effectively stacked on top of each other.
+ */
+#define LOGFS_MAX_INDIRECT      (5)
+#define LOGFS_MAX_LEVELS        (LOGFS_MAX_INDIRECT + 1)
+#define LOGFS_NO_AREAS          (2 * LOGFS_MAX_LEVELS)
+
+/* Maximum size of filenames */
+#define LOGFS_MAX_NAMELEN       (255)
+
+/* Number of segments in the primary journal. */
+#define LOGFS_JOURNAL_SEGS      (16)
+
+/* Maximum number of free/erased/etc. segments in journal entries */
+#define MAX_CACHED_SEGS         (64)
+
+
+/*
+ * LOGFS_OBJECT_HEADERSIZE is the size of a single header in the object store,
+ * LOGFS_MAX_OBJECTSIZE the size of the largest possible object, including
+ * its header,
+ * LOGFS_SEGMENT_RESERVE is the amount of space reserved for each segment for
+ * its segment header and the padded space at the end when no further objects
+ * fit.
+ */
+#define LOGFS_OBJECT_HEADERSIZE (0x1c)
+#define LOGFS_SEGMENT_HEADERSIZE (0x18)
+#define LOGFS_MAX_OBJECTSIZE    (LOGFS_OBJECT_HEADERSIZE + LOGFS_BLOCKSIZE)
+#define LOGFS_SEGMENT_RESERVE   \
+        (LOGFS_SEGMENT_HEADERSIZE + LOGFS_MAX_OBJECTSIZE - 1)
+
+/*
+ * Segment types:
+ * SEG_SUPER    - Data or indirect block
+ * SEG_JOURNAL  - Inode
+ * SEG_OSTORE   - Dentry
+ */
+enum {
+        SEG_SUPER       = 0x01,
+        SEG_JOURNAL     = 0x02,
+        SEG_OSTORE      = 0x03,
+};
+
+/**
+ * struct logfs_segment_header - per-segment header in the ostore
+ *
+ * @crc:                        crc32 of header (there is no data)
+ * @pad:                        unused, must be 0
+ * @type:                       segment type, see above
+ * @level:                      GC level for all objects in this segment
+ * @segno:                      segment number
+ * @ec:                         erase count for this segment
+ * @gec:                        global erase count at time of writing
+ */
+struct logfs_segment_header {
+        __be32  crc;
+        __be16  pad;
+        __u8    type;
+        __u8    level;
+        __be32  segno;
+        __be32  ec;
+        __be64  gec;
+};
+
+SIZE_CHECK(logfs_segment_header, LOGFS_SEGMENT_HEADERSIZE);
+
+#define LOGFS_FEATURES_INCOMPAT         (0ull)
+#define LOGFS_FEATURES_RO_COMPAT        (0ull)
+#define LOGFS_FEATURES_COMPAT           (0ull)
+
+/**
+ * struct logfs_disk_super - on-medium superblock
+ *
+ * @ds_magic:                   magic number, must equal LOGFS_MAGIC
+ * @ds_crc:                     crc32 of structure starting with the next field
+ * @ds_ifile_levels:            maximum number of levels for ifile
+ * @ds_iblock_levels:           maximum number of levels for regular files
+ * @ds_data_levels:             number of seperate levels for data
+ * @pad0:                       reserved, must be 0
+ * @ds_feature_incompat:        incompatible filesystem features
+ * @ds_feature_ro_compat:       read-only compatible filesystem features
+ * @ds_feature_compat:          compatible filesystem features
+ * @ds_flags:                   flags
+ * @ds_segment_shift:           log2 of segment size
+ * @ds_block_shift:             log2 of block size
+ * @ds_write_shift:             log2 of write size
+ * @pad1:                       reserved, must be 0
+ * @ds_journal_seg:             segments used by primary journal
+ * @ds_root_reserve:            bytes reserved for the superuser
+ * @ds_speed_reserve:           bytes reserved to speed up GC
+ * @ds_bad_seg_reserve:         number of segments reserved to handle bad blocks
+ * @pad2:                       reserved, must be 0
+ * @pad3:                       reserved, must be 0
+ *
+ * Contains only read-only fields.  Read-write fields like the amount of used
+ * space is tracked in the dynamic superblock, which is stored in the journal.
+ */
+struct logfs_disk_super {
+        struct logfs_segment_header ds_sh;
+        __be64  ds_magic;
+
+        __be32  ds_crc;
+        __u8    ds_ifile_levels;
+        __u8    ds_iblock_levels;
+        __u8    ds_data_levels;
+        __u8    ds_segment_shift;
+        __u8    ds_block_shift;
+        __u8    ds_write_shift;
+        __u8    pad0[6];
+
+        __be64  ds_filesystem_size;
+        __be32  ds_segment_size;
+        __be32  ds_bad_seg_reserve;
+
+        __be64  ds_feature_incompat;
+        __be64  ds_feature_ro_compat;
+
+        __be64  ds_feature_compat;
+        __be64  ds_feature_flags;
+
+        __be64  ds_root_reserve;
+        __be64  ds_speed_reserve;
+
+        __be32  ds_journal_seg[LOGFS_JOURNAL_SEGS];
+
+        __be64  ds_super_ofs[2];
+        __be64  pad3[8];
+};
+
+SIZE_CHECK(logfs_disk_super, 256);
+
+/*
+ * Object types:
+ * OBJ_BLOCK    - Data or indirect block
+ * OBJ_INODE    - Inode
+ * OBJ_DENTRY   - Dentry
+ */
+enum {
+        OBJ_BLOCK       = 0x04,
+        OBJ_INODE       = 0x05,
+        OBJ_DENTRY      = 0x06,
+};
+
+/**
+ * struct logfs_object_header - per-object header in the ostore
+ *
+ * @crc:                        crc32 of header, excluding data_crc
+ * @len:                        length of data
+ * @type:                       object type, see above
+ * @compr:                      compression type
+ * @ino:                        inode number
+ * @bix:                        block index
+ * @data_crc:                   crc32 of payload
+ */
+struct logfs_object_header {
+        __be32  crc;
+        __be16  len;
+        __u8    type;
+        __u8    compr;
+        __be64  ino;
+        __be64  bix;
+        __be32  data_crc;
+} __attribute__((packed));
+
+SIZE_CHECK(logfs_object_header, LOGFS_OBJECT_HEADERSIZE);
+
+/*
+ * Reserved inode numbers:
+ * LOGFS_INO_MASTER     - master inode (for inode file)
+ * LOGFS_INO_ROOT       - root directory
+ * LOGFS_INO_SEGFILE    - per-segment used bytes and erase count
+ */
+enum {
+        LOGFS_INO_MAPPING       = 0x00,
+        LOGFS_INO_MASTER        = 0x01,
+        LOGFS_INO_ROOT          = 0x02,
+        LOGFS_INO_SEGFILE       = 0x03,
+        LOGFS_RESERVED_INOS     = 0x10,
+};
+
+/*
+ * Inode flags.  High bits should never be written to the medium.  They are
+ * reserved for in-memory usage.
+ * Low bits should either remain in sync with the corresponding FS_*_FL or
+ * reuse slots that obviously don't make sense for logfs.
+ *
+ * LOGFS_IF_DIRTY       Inode must be written back
+ * LOGFS_IF_ZOMBIE      Inode has been deleted
+ * LOGFS_IF_STILLBORN   -ENOSPC happened when creating inode
+ */
+#define LOGFS_IF_COMPRESSED     0x00000004 /* == FS_COMPR_FL */
+#define LOGFS_IF_DIRTY          0x20000000
+#define LOGFS_IF_ZOMBIE         0x40000000
+#define LOGFS_IF_STILLBORN      0x80000000
+
+/* Flags available to chattr */
+#define LOGFS_FL_USER_VISIBLE   (LOGFS_IF_COMPRESSED)
+#define LOGFS_FL_USER_MODIFIABLE (LOGFS_IF_COMPRESSED)
+/* Flags inherited from parent directory on file/directory creation */
+#define LOGFS_FL_INHERITED      (LOGFS_IF_COMPRESSED)
+
+/**
+ * struct logfs_disk_inode - on-medium inode
+ *
+ * @di_mode:                    file mode
+ * @di_pad:                     reserved, must be 0
+ * @di_flags:                   inode flags, see above
+ * @di_uid:                     user id
+ * @di_gid:                     group id
+ * @di_ctime:                   change time
+ * @di_mtime:                   modify time
+ * @di_refcount:                reference count (aka nlink or link count)
+ * @di_generation:              inode generation, for nfs
+ * @di_used_bytes:              number of bytes used
+ * @di_size:                    file size
+ * @di_data:                    data pointers
+ */
+struct logfs_disk_inode {
+        __be16  di_mode;
+        __u8    di_height;
+        __u8    di_pad;
+        __be32  di_flags;
+        __be32  di_uid;
+        __be32  di_gid;
+
+        __be64  di_ctime;
+        __be64  di_mtime;
+
+        __be64  di_atime;
+        __be32  di_refcount;
+        __be32  di_generation;
+
+        __be64  di_used_bytes;
+        __be64  di_size;
+
+        __be64  di_data[LOGFS_EMBEDDED_FIELDS];
+};
+
+SIZE_CHECK(logfs_disk_inode, 200);
+
+#define INODE_POINTER_OFS \
+        (offsetof(struct logfs_disk_inode, di_data) / sizeof(__be64))
+#define INODE_USED_OFS \
+        (offsetof(struct logfs_disk_inode, di_used_bytes) / sizeof(__be64))
+#define INODE_SIZE_OFS \
+        (offsetof(struct logfs_disk_inode, di_size) / sizeof(__be64))
+#define INODE_HEIGHT_OFS        (0)
+
+/**
+ * struct logfs_disk_dentry - on-medium dentry structure
+ *
+ * @ino:                        inode number
+ * @namelen:                    length of file name
+ * @type:                       file type, identical to bits 12..15 of mode
+ * @name:                       file name
+ */
+/* FIXME: add 6 bytes of padding to remove the __packed */
+struct logfs_disk_dentry {
+        __be64  ino;
+        __be16  namelen;
+        __u8    type;
+        __u8    name[LOGFS_MAX_NAMELEN];
+} __attribute__((packed));
+
+SIZE_CHECK(logfs_disk_dentry, 266);
+
+#define RESERVED                0xffffffff
+#define BADSEG                  0xffffffff
+/**
+ * struct logfs_segment_entry - segment file entry
+ *
+ * @ec_level:                   erase count and level
+ * @valid:                      number of valid bytes
+ *
+ * Segment file contains one entry for every segment.  ec_level contains the
+ * erasecount in the upper 28 bits and the level in the lower 4 bits.  An
+ * ec_level of BADSEG (-1) identifies bad segments.  valid contains the number
+ * of valid bytes or RESERVED (-1 again) if the segment is used for either the
+ * superblock or the journal, or when the segment is bad.
+ */
+struct logfs_segment_entry {
+        __be32  ec_level;
+        __be32  valid;
+};
+
+SIZE_CHECK(logfs_segment_entry, 8);
+
+/**
+ * struct logfs_journal_header - header for journal entries (JEs)
+ *
+ * @h_crc:                      crc32 of journal entry
+ * @h_len:                      length of compressed journal entry,
+ *                              not including header
+ * @h_datalen:                  length of uncompressed data
+ * @h_type:                     JE type
+ * @h_compr:                    compression type
+ * @h_pad:                      reserved
+ */
+struct logfs_journal_header {
+        __be32  h_crc;
+        __be16  h_len;
+        __be16  h_datalen;
+        __be16  h_type;
+        __u8    h_compr;
+        __u8    h_pad[5];
+};
+
+SIZE_CHECK(logfs_journal_header, 16);
+
+/*
+ * Life expectency of data.
+ * VIM_DEFAULT          - default vim
+ * VIM_SEGFILE          - for segment file only - very short-living
+ * VIM_GC               - GC'd data - likely long-living
+ */
+enum logfs_vim {
+        VIM_DEFAULT     = 0,
+        VIM_SEGFILE     = 1,
+};
+
+/**
+ * struct logfs_je_area - wbuf header
+ *
+ * @segno:                      segment number of area
+ * @used_bytes:                 number of bytes already used
+ * @gc_level:                   GC level
+ * @vim:                        life expectancy of data
+ *
+ * "Areas" are segments currently being used for writing.  There is at least
+ * one area per GC level.  Several may be used to seperate long-living from
+ * short-living data.  If an area with unknown vim is encountered, it can
+ * simply be closed.
+ * The write buffer immediately follow this header.
+ */
+struct logfs_je_area {
+        __be32  segno;
+        __be32  used_bytes;
+        __u8    gc_level;
+        __u8    vim;
+} __attribute__((packed));
+
+SIZE_CHECK(logfs_je_area, 10);
+
+#define MAX_JOURNAL_HEADER \
+        (sizeof(struct logfs_journal_header) + sizeof(struct logfs_je_area))
+
+/**
+ * struct logfs_je_dynsb - dynamic superblock
+ *
+ * @ds_gec:                     global erase count
+ * @ds_sweeper:                 current position of GC "sweeper"
+ * @ds_rename_dir:              source directory ino (see dir.c documentation)
+ * @ds_rename_pos:              position of source dd (see dir.c documentation)
+ * @ds_victim_ino:              victims of incomplete dir operation (see dir.c)
+ * @ds_victim_ino:              parent inode of victim (see dir.c)
+ * @ds_used_bytes:              number of used bytes
+ */
+struct logfs_je_dynsb {
+        __be64  ds_gec;
+        __be64  ds_sweeper;
+
+        __be64  ds_rename_dir;
+        __be64  ds_rename_pos;
+
+        __be64  ds_victim_ino;
+        __be64  ds_victim_parent; /* XXX */
+
+        __be64  ds_used_bytes;
+        __be32  ds_generation;
+        __be32  pad;
+};
+
+SIZE_CHECK(logfs_je_dynsb, 64);
+
+/**
+ * struct logfs_je_anchor - anchor of filesystem tree, aka master inode
+ *
+ * @da_size:                    size of inode file
+ * @da_last_ino:                last created inode
+ * @da_used_bytes:              number of bytes used
+ * @da_data:                    data pointers
+ */
+struct logfs_je_anchor {
+        __be64  da_size;
+        __be64  da_last_ino;
+
+        __be64  da_used_bytes;
+        u8      da_height;
+        u8      pad[7];
+
+        __be64  da_data[LOGFS_EMBEDDED_FIELDS];
+};
+
+SIZE_CHECK(logfs_je_anchor, 168);
+
+/**
+ * struct logfs_je_spillout - spillout entry (from 1st to 2nd journal)
+ *
+ * @so_segment:                 segments used for 2nd journal
+ *
+ * Length of the array is given by h_len field in the header.
+ */
+struct logfs_je_spillout {
+        __be64  so_segment[0];
+};
+
+SIZE_CHECK(logfs_je_spillout, 0);
+
+/**
+ * struct logfs_je_journal_ec - erase counts for all journal segments
+ *
+ * @ec:                         erase count
+ *
+ * Length of the array is given by h_len field in the header.
+ */
+struct logfs_je_journal_ec {
+        __be32  ec[0];
+};
+
+SIZE_CHECK(logfs_je_journal_ec, 0);
+
+/**
+ * struct logfs_je_free_segments - list of free segmetns with erase count
+ */
+struct logfs_je_free_segments {
+        __be32  segno;
+        __be32  ec;
+};
+
+SIZE_CHECK(logfs_je_free_segments, 8);
+
+/**
+ * struct logfs_seg_alias - list of segment aliases
+ */
+struct logfs_seg_alias {
+        __be32  old_segno;
+        __be32  new_segno;
+};
+
+SIZE_CHECK(logfs_seg_alias, 8);
+
+/**
+ * struct logfs_obj_alias - list of object aliases
+ */
+struct logfs_obj_alias {
+        __be64  ino;
+        __be64  bix;
+        __be64  val;
+        u8      level;
+        u8      pad[5];
+        __be16  child_no;
+};
+
+SIZE_CHECK(logfs_obj_alias, 32);
+
+/**
+ * Compression types.
+ *
+ * COMPR_NONE   - uncompressed
+ * COMPR_ZLIB   - compressed with zlib
+ */
+enum {
+        COMPR_NONE      = 0,
+        COMPR_ZLIB      = 1,
+};
+
+/*
+ * Journal entries come in groups of 16.  First group contains unique
+ * entries, next groups contain one entry per level
+ *
+ * JE_FIRST     - smallest possible journal entry number
+ *
+ * JEG_BASE     - base group, containing unique entries
+ * JE_COMMIT    - commit entry, validates all previous entries
+ * JE_DYNSB     - dynamic superblock, anything that ought to be in the
+ *                superblock but cannot because it is read-write data
+ * JE_ANCHOR    - anchor aka master inode aka inode file's inode
+ * JE_ERASECOUNT  erasecounts for all journal segments
+ * JE_SPILLOUT  - unused
+ * JE_SEG_ALIAS - aliases segments
+ * JE_AREA      - area description
+ *
+ * JE_LAST      - largest possible journal entry number
+ */
+enum {
+        JE_FIRST        = 0x01,
+
+        JEG_BASE        = 0x00,
+        JE_COMMIT       = 0x02,
+        JE_DYNSB        = 0x03,
+        JE_ANCHOR       = 0x04,
+        JE_ERASECOUNT   = 0x05,
+        JE_SPILLOUT     = 0x06,
+        JE_OBJ_ALIAS    = 0x0d,
+        JE_AREA         = 0x0e,
+
+        JE_LAST         = 0x0e,
+};
+
+#endif
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
new file mode 100644
index 000000000000..3159db6958e5
--- /dev/null
+++ b/fs/logfs/readwrite.c
@@ -0,0 +1,2267 @@
+/*
+ * fs/logfs/readwrite.c
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ *
+ *
+ * Actually contains five sets of very similar functions:
+ * read         read blocks from a file
+ * seek_hole    find next hole
+ * seek_data    find next data block
+ * valid        check whether a block still belongs to a file
+ * write        write blocks to a file
+ * delete       delete a block (for directories and ifile)
+ * rewrite      move existing blocks of a file to a new location (gc helper)
+ * truncate     truncate a file
+ */
+#include "logfs.h"
+#include <linux/sched.h>
+#include <linux/slab.h>
+
+static u64 adjust_bix(u64 bix, level_t level)
+{
+        switch (level) {
+        case 0:
+                return bix;
+        case LEVEL(1):
+                return max_t(u64, bix, I0_BLOCKS);
+        case LEVEL(2):
+                return max_t(u64, bix, I1_BLOCKS);
+        case LEVEL(3):
+                return max_t(u64, bix, I2_BLOCKS);
+        case LEVEL(4):
+                return max_t(u64, bix, I3_BLOCKS);
+        case LEVEL(5):
+                return max_t(u64, bix, I4_BLOCKS);
+        default:
+                WARN_ON(1);
+                return bix;
+        }
+}
+
+static inline u64 maxbix(u8 height)
+{
+        return 1ULL << (LOGFS_BLOCK_BITS * height);
+}
+
+/**
+ * The inode address space is cut in two halves.  Lower half belongs to data
+ * pages, upper half to indirect blocks.  If the high bit (INDIRECT_BIT) is
+ * set, the actual block index (bix) and level can be derived from the page
+ * index.
+ *
+ * The lowest three bits of the block index are set to 0 after packing and
+ * unpacking.  Since the lowest n bits (9 for 4KiB blocksize) are ignored
+ * anyway this is harmless.
+ */
+#define ARCH_SHIFT      (BITS_PER_LONG - 32)
+#define INDIRECT_BIT    (0x80000000UL << ARCH_SHIFT)
+#define LEVEL_SHIFT     (28 + ARCH_SHIFT)
+static inline pgoff_t first_indirect_block(void)
+{
+        return INDIRECT_BIT | (1ULL << LEVEL_SHIFT);
+}
+
+pgoff_t logfs_pack_index(u64 bix, level_t level)
+{
+        pgoff_t index;
+
+        BUG_ON(bix >= INDIRECT_BIT);
+        if (level == 0)
+                return bix;
+
+        index  = INDIRECT_BIT;
+        index |= (__force long)level << LEVEL_SHIFT;
+        index |= bix >> ((__force u8)level * LOGFS_BLOCK_BITS);
+        return index;
+}
+
+void logfs_unpack_index(pgoff_t index, u64 *bix, level_t *level)
+{
+        u8 __level;
+
+        if (!(index & INDIRECT_BIT)) {
+                *bix = index;
+                *level = 0;
+                return;
+        }
+
+        __level = (index & ~INDIRECT_BIT) >> LEVEL_SHIFT;
+        *level = LEVEL(__level);
+        *bix = (index << (__level * LOGFS_BLOCK_BITS)) & ~INDIRECT_BIT;
+        *bix = adjust_bix(*bix, *level);
+        return;
+}
+#undef ARCH_SHIFT
+#undef INDIRECT_BIT
+#undef LEVEL_SHIFT
+
+/*
+ * Time is stored as nanoseconds since the epoch.
+ */
+static struct timespec be64_to_timespec(__be64 betime)
+{
+        return ns_to_timespec(be64_to_cpu(betime));
+}
+
+static __be64 timespec_to_be64(struct timespec tsp)
+{
+        return cpu_to_be64((u64)tsp.tv_sec * NSEC_PER_SEC + tsp.tv_nsec);
+}
+
+static void logfs_disk_to_inode(struct logfs_disk_inode *di, struct inode*inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        int i;
+
+        inode->i_mode   = be16_to_cpu(di->di_mode);
+        li->li_height   = di->di_height;
+        li->li_flags    = be32_to_cpu(di->di_flags);
+        inode->i_uid    = be32_to_cpu(di->di_uid);
+        inode->i_gid    = be32_to_cpu(di->di_gid);
+        inode->i_size   = be64_to_cpu(di->di_size);
+        logfs_set_blocks(inode, be64_to_cpu(di->di_used_bytes));
+        inode->i_atime  = be64_to_timespec(di->di_atime);
+        inode->i_ctime  = be64_to_timespec(di->di_ctime);
+        inode->i_mtime  = be64_to_timespec(di->di_mtime);
+        inode->i_nlink  = be32_to_cpu(di->di_refcount);
+        inode->i_generation = be32_to_cpu(di->di_generation);
+
+        switch (inode->i_mode & S_IFMT) {
+        case S_IFSOCK:  /* fall through */
+        case S_IFBLK:   /* fall through */
+        case S_IFCHR:   /* fall through */
+        case S_IFIFO:
+                inode->i_rdev = be64_to_cpu(di->di_data[0]);
+                break;
+        case S_IFDIR:   /* fall through */
+        case S_IFREG:   /* fall through */
+        case S_IFLNK:
+                for (i = 0; i < LOGFS_EMBEDDED_FIELDS; i++)
+                        li->li_data[i] = be64_to_cpu(di->di_data[i]);
+                break;
+        default:
+                BUG();
+        }
+}
+
+static void logfs_inode_to_disk(struct inode *inode, struct logfs_disk_inode*di)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        int i;
+
+        di->di_mode     = cpu_to_be16(inode->i_mode);
+        di->di_height   = li->li_height;
+        di->di_pad      = 0;
+        di->di_flags    = cpu_to_be32(li->li_flags);
+        di->di_uid      = cpu_to_be32(inode->i_uid);
+        di->di_gid      = cpu_to_be32(inode->i_gid);
+        di->di_size     = cpu_to_be64(i_size_read(inode));
+        di->di_used_bytes = cpu_to_be64(li->li_used_bytes);
+        di->di_atime    = timespec_to_be64(inode->i_atime);
+        di->di_ctime    = timespec_to_be64(inode->i_ctime);
+        di->di_mtime    = timespec_to_be64(inode->i_mtime);
+        di->di_refcount = cpu_to_be32(inode->i_nlink);
+        di->di_generation = cpu_to_be32(inode->i_generation);
+
+        switch (inode->i_mode & S_IFMT) {
+        case S_IFSOCK:  /* fall through */
+        case S_IFBLK:   /* fall through */
+        case S_IFCHR:   /* fall through */
+        case S_IFIFO:
+                di->di_data[0] = cpu_to_be64(inode->i_rdev);
+                break;
+        case S_IFDIR:   /* fall through */
+        case S_IFREG:   /* fall through */
+        case S_IFLNK:
+                for (i = 0; i < LOGFS_EMBEDDED_FIELDS; i++)
+                        di->di_data[i] = cpu_to_be64(li->li_data[i]);
+                break;
+        default:
+                BUG();
+        }
+}
+
+static void __logfs_set_blocks(struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct logfs_inode *li = logfs_inode(inode);
+
+        inode->i_blocks = ULONG_MAX;
+        if (li->li_used_bytes >> sb->s_blocksize_bits < ULONG_MAX)
+                inode->i_blocks = ALIGN(li->li_used_bytes, 512) >> 9;
+}
+
+void logfs_set_blocks(struct inode *inode, u64 bytes)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        li->li_used_bytes = bytes;
+        __logfs_set_blocks(inode);
+}
+
+static void prelock_page(struct super_block *sb, struct page *page, int lock)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        BUG_ON(!PageLocked(page));
+        if (lock) {
+                BUG_ON(PagePreLocked(page));
+                SetPagePreLocked(page);
+        } else {
+                /* We are in GC path. */
+                if (PagePreLocked(page))
+                        super->s_lock_count++;
+                else
+                        SetPagePreLocked(page);
+        }
+}
+
+static void preunlock_page(struct super_block *sb, struct page *page, int lock)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        BUG_ON(!PageLocked(page));
+        if (lock)
+                ClearPagePreLocked(page);
+        else {
+                /* We are in GC path. */
+                BUG_ON(!PagePreLocked(page));
+                if (super->s_lock_count)
+                        super->s_lock_count--;
+                else
+                        ClearPagePreLocked(page);
+        }
+}
+
+/*
+ * Logfs is prone to an AB-BA deadlock where one task tries to acquire
+ * s_write_mutex with a locked page and GC tries to get that page while holding
+ * s_write_mutex.
+ * To solve this issue logfs will ignore the page lock iff the page in question
+ * is waiting for s_write_mutex.  We annotate this fact by setting PG_pre_locked
+ * in addition to PG_locked.
+ */
+static void logfs_get_wblocks(struct super_block *sb, struct page *page,
+                int lock)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        if (page)
+                prelock_page(sb, page, lock);
+
+        if (lock) {
+                mutex_lock(&super->s_write_mutex);
+                logfs_gc_pass(sb);
+                /* FIXME: We also have to check for shadowed space
+                 * and mempool fill grade */
+        }
+}
+
+static void logfs_put_wblocks(struct super_block *sb, struct page *page,
+                int lock)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        if (page)
+                preunlock_page(sb, page, lock);
+        /* Order matters - we must clear PG_pre_locked before releasing
+         * s_write_mutex or we could race against another task. */
+        if (lock)
+                mutex_unlock(&super->s_write_mutex);
+}
+
+static struct page *logfs_get_read_page(struct inode *inode, u64 bix,
+                level_t level)
+{
+        return find_or_create_page(inode->i_mapping,
+                        logfs_pack_index(bix, level), GFP_NOFS);
+}
+
+static void logfs_put_read_page(struct page *page)
+{
+        unlock_page(page);
+        page_cache_release(page);
+}
+
+static void logfs_lock_write_page(struct page *page)
+{
+        int loop = 0;
+
+        while (unlikely(!trylock_page(page))) {
+                if (loop++ > 0x1000) {
+                        /* Has been observed once so far... */
+                        printk(KERN_ERR "stack at %p\n", &loop);
+                        BUG();
+                }
+                if (PagePreLocked(page)) {
+                        /* Holder of page lock is waiting for us, it
+                         * is safe to use this page. */
+                        break;
+                }
+                /* Some other process has this page locked and has
+                 * nothing to do with us.  Wait for it to finish.
+                 */
+                schedule();
+        }
+        BUG_ON(!PageLocked(page));
+}
+
+static struct page *logfs_get_write_page(struct inode *inode, u64 bix,
+                level_t level)
+{
+        struct address_space *mapping = inode->i_mapping;
+        pgoff_t index = logfs_pack_index(bix, level);
+        struct page *page;
+        int err;
+
+repeat:
+        page = find_get_page(mapping, index);
+        if (!page) {
+                page = __page_cache_alloc(GFP_NOFS);
+                if (!page)
+                        return NULL;
+                err = add_to_page_cache_lru(page, mapping, index, GFP_NOFS);
+                if (unlikely(err)) {
+                        page_cache_release(page);
+                        if (err == -EEXIST)
+                                goto repeat;
+                        return NULL;
+                }
+        } else logfs_lock_write_page(page);
+        BUG_ON(!PageLocked(page));
+        return page;
+}
+
+static void logfs_unlock_write_page(struct page *page)
+{
+        if (!PagePreLocked(page))
+                unlock_page(page);
+}
+
+static void logfs_put_write_page(struct page *page)
+{
+        logfs_unlock_write_page(page);
+        page_cache_release(page);
+}
+
+static struct page *logfs_get_page(struct inode *inode, u64 bix, level_t level,
+                int rw)
+{
+        if (rw == READ)
+                return logfs_get_read_page(inode, bix, level);
+        else
+                return logfs_get_write_page(inode, bix, level);
+}
+
+static void logfs_put_page(struct page *page, int rw)
+{
+        if (rw == READ)
+                logfs_put_read_page(page);
+        else
+                logfs_put_write_page(page);
+}
+
+static unsigned long __get_bits(u64 val, int skip, int no)
+{
+        u64 ret = val;
+
+        ret >>= skip * no;
+        ret <<= 64 - no;
+        ret >>= 64 - no;
+        return ret;
+}
+
+static unsigned long get_bits(u64 val, level_t skip)
+{
+        return __get_bits(val, (__force int)skip, LOGFS_BLOCK_BITS);
+}
+
+static inline void init_shadow_tree(struct super_block *sb,
+                struct shadow_tree *tree)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        btree_init_mempool64(&tree->new, super->s_btree_pool);
+        btree_init_mempool64(&tree->old, super->s_btree_pool);
+}
+
+static void indirect_write_block(struct logfs_block *block)
+{
+        struct page *page;
+        struct inode *inode;
+        int ret;
+
+        page = block->page;
+        inode = page->mapping->host;
+        logfs_lock_write_page(page);
+        ret = logfs_write_buf(inode, page, 0);
+        logfs_unlock_write_page(page);
+        /*
+         * This needs some rework.  Unless you want your filesystem to run
+         * completely synchronously (you don't), the filesystem will always
+         * report writes as 'successful' before the actual work has been
+         * done.  The actual work gets done here and this is where any errors
+         * will show up.  And there isn't much we can do about it, really.
+         *
+         * Some attempts to fix the errors (move from bad blocks, retry io,...)
+         * have already been done, so anything left should be either a broken
+         * device or a bug somewhere in logfs itself.  Being relatively new,
+         * the odds currently favor a bug, so for now the line below isn't
+         * entirely tasteles.
+         */
+        BUG_ON(ret);
+}
+
+static void inode_write_block(struct logfs_block *block)
+{
+        struct inode *inode;
+        int ret;
+
+        inode = block->inode;
+        if (inode->i_ino == LOGFS_INO_MASTER)
+                logfs_write_anchor(inode->i_sb);
+        else {
+                ret = __logfs_write_inode(inode, 0);
+                /* see indirect_write_block comment */
+                BUG_ON(ret);
+        }
+}
+
+/*
+ * This silences a false, yet annoying gcc warning.  I hate it when my editor
+ * jumps into bitops.h each time I recompile this file.
+ * TODO: Complain to gcc folks about this and upgrade compiler.
+ */
+static unsigned long fnb(const unsigned long *addr,
+                unsigned long size, unsigned long offset)
+{
+        return find_next_bit(addr, size, offset);
+}
+
+static __be64 inode_val0(struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        u64 val;
+
+        /*
+         * Explicit shifting generates good code, but must match the format
+         * of the structure.  Add some paranoia just in case.
+         */
+        BUILD_BUG_ON(offsetof(struct logfs_disk_inode, di_mode) != 0);
+        BUILD_BUG_ON(offsetof(struct logfs_disk_inode, di_height) != 2);
+        BUILD_BUG_ON(offsetof(struct logfs_disk_inode, di_flags) != 4);
+
+        val =   (u64)inode->i_mode << 48 |
+                (u64)li->li_height << 40 |
+                (u64)li->li_flags;
+        return cpu_to_be64(val);
+}
+
+static int inode_write_alias(struct super_block *sb,
+                struct logfs_block *block, write_alias_t *write_one_alias)
+{
+        struct inode *inode = block->inode;
+        struct logfs_inode *li = logfs_inode(inode);
+        unsigned long pos;
+        u64 ino , bix;
+        __be64 val;
+        level_t level;
+        int err;
+
+        for (pos = 0; ; pos++) {
+                pos = fnb(block->alias_map, LOGFS_BLOCK_FACTOR, pos);
+                if (pos >= LOGFS_EMBEDDED_FIELDS + INODE_POINTER_OFS)
+                        return 0;
+
+                switch (pos) {
+                case INODE_HEIGHT_OFS:
+                        val = inode_val0(inode);
+                        break;
+                case INODE_USED_OFS:
+                        val = cpu_to_be64(li->li_used_bytes);;
+                        break;
+                case INODE_SIZE_OFS:
+                        val = cpu_to_be64(i_size_read(inode));
+                        break;
+                case INODE_POINTER_OFS ... INODE_POINTER_OFS + LOGFS_EMBEDDED_FIELDS - 1:
+                        val = cpu_to_be64(li->li_data[pos - INODE_POINTER_OFS]);
+                        break;
+                default:
+                        BUG();
+                }
+
+                ino = LOGFS_INO_MASTER;
+                bix = inode->i_ino;
+                level = LEVEL(0);
+                err = write_one_alias(sb, ino, bix, level, pos, val);
+                if (err)
+                        return err;
+        }
+}
+
+static int indirect_write_alias(struct super_block *sb,
+                struct logfs_block *block, write_alias_t *write_one_alias)
+{
+        unsigned long pos;
+        struct page *page = block->page;
+        u64 ino , bix;
+        __be64 *child, val;
+        level_t level;
+        int err;
+
+        for (pos = 0; ; pos++) {
+                pos = fnb(block->alias_map, LOGFS_BLOCK_FACTOR, pos);
+                if (pos >= LOGFS_BLOCK_FACTOR)
+                        return 0;
+
+                ino = page->mapping->host->i_ino;
+                logfs_unpack_index(page->index, &bix, &level);
+                child = kmap_atomic(page, KM_USER0);
+                val = child[pos];
+                kunmap_atomic(child, KM_USER0);
+                err = write_one_alias(sb, ino, bix, level, pos, val);
+                if (err)
+                        return err;
+        }
+}
+
+int logfs_write_obj_aliases_pagecache(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_block *block;
+        int err;
+
+        list_for_each_entry(block, &super->s_object_alias, alias_list) {
+                err = block->ops->write_alias(sb, block, write_alias_journal);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+void __free_block(struct super_block *sb, struct logfs_block *block)
+{
+        BUG_ON(!list_empty(&block->item_list));
+        list_del(&block->alias_list);
+        mempool_free(block, logfs_super(sb)->s_block_pool);
+}
+
+static void inode_free_block(struct super_block *sb, struct logfs_block *block)
+{
+        struct inode *inode = block->inode;
+
+        logfs_inode(inode)->li_block = NULL;
+        __free_block(sb, block);
+}
+
+static void indirect_free_block(struct super_block *sb,
+                struct logfs_block *block)
+{
+        ClearPagePrivate(block->page);
+        block->page->private = 0;
+        __free_block(sb, block);
+}
+
+
+static struct logfs_block_ops inode_block_ops = {
+        .write_block = inode_write_block,
+        .free_block = inode_free_block,
+        .write_alias = inode_write_alias,
+};
+
+struct logfs_block_ops indirect_block_ops = {
+        .write_block = indirect_write_block,
+        .free_block = indirect_free_block,
+        .write_alias = indirect_write_alias,
+};
+
+struct logfs_block *__alloc_block(struct super_block *sb,
+                u64 ino, u64 bix, level_t level)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_block *block;
+
+        block = mempool_alloc(super->s_block_pool, GFP_NOFS);
+        memset(block, 0, sizeof(*block));
+        INIT_LIST_HEAD(&block->alias_list);
+        INIT_LIST_HEAD(&block->item_list);
+        block->sb = sb;
+        block->ino = ino;
+        block->bix = bix;
+        block->level = level;
+        return block;
+}
+
+static void alloc_inode_block(struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct logfs_block *block;
+
+        if (li->li_block)
+                return;
+
+        block = __alloc_block(inode->i_sb, LOGFS_INO_MASTER, inode->i_ino, 0);
+        block->inode = inode;
+        li->li_block = block;
+        block->ops = &inode_block_ops;
+}
+
+void initialize_block_counters(struct page *page, struct logfs_block *block,
+                __be64 *array, int page_is_empty)
+{
+        u64 ptr;
+        int i, start;
+
+        block->partial = 0;
+        block->full = 0;
+        start = 0;
+        if (page->index < first_indirect_block()) {
+                /* Counters are pointless on level 0 */
+                return;
+        }
+        if (page->index == first_indirect_block()) {
+                /* Skip unused pointers */
+                start = I0_BLOCKS;
+                block->full = I0_BLOCKS;
+        }
+        if (!page_is_empty) {
+                for (i = start; i < LOGFS_BLOCK_FACTOR; i++) {
+                        ptr = be64_to_cpu(array[i]);
+                        if (ptr)
+                                block->partial++;
+                        if (ptr & LOGFS_FULLY_POPULATED)
+                                block->full++;
+                }
+        }
+}
+
+static void alloc_data_block(struct inode *inode, struct page *page)
+{
+        struct logfs_block *block;
+        u64 bix;
+        level_t level;
+
+        if (PagePrivate(page))
+                return;
+
+        logfs_unpack_index(page->index, &bix, &level);
+        block = __alloc_block(inode->i_sb, inode->i_ino, bix, level);
+        block->page = page;
+        SetPagePrivate(page);
+        page->private = (unsigned long)block;
+        block->ops = &indirect_block_ops;
+}
+
+static void alloc_indirect_block(struct inode *inode, struct page *page,
+                int page_is_empty)
+{
+        struct logfs_block *block;
+        __be64 *array;
+
+        if (PagePrivate(page))
+                return;
+
+        alloc_data_block(inode, page);
+
+        block = logfs_block(page);
+        array = kmap_atomic(page, KM_USER0);
+        initialize_block_counters(page, block, array, page_is_empty);
+        kunmap_atomic(array, KM_USER0);
+}
+
+static void block_set_pointer(struct page *page, int index, u64 ptr)
+{
+        struct logfs_block *block = logfs_block(page);
+        __be64 *array;
+        u64 oldptr;
+
+        BUG_ON(!block);
+        array = kmap_atomic(page, KM_USER0);
+        oldptr = be64_to_cpu(array[index]);
+        array[index] = cpu_to_be64(ptr);
+        kunmap_atomic(array, KM_USER0);
+        SetPageUptodate(page);
+
+        block->full += !!(ptr & LOGFS_FULLY_POPULATED)
+                - !!(oldptr & LOGFS_FULLY_POPULATED);
+        block->partial += !!ptr - !!oldptr;
+}
+
+static u64 block_get_pointer(struct page *page, int index)
+{
+        __be64 *block;
+        u64 ptr;
+
+        block = kmap_atomic(page, KM_USER0);
+        ptr = be64_to_cpu(block[index]);
+        kunmap_atomic(block, KM_USER0);
+        return ptr;
+}
+
+static int logfs_read_empty(struct page *page)
+{
+        zero_user_segment(page, 0, PAGE_CACHE_SIZE);
+        return 0;
+}
+
+static int logfs_read_direct(struct inode *inode, struct page *page)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        pgoff_t index = page->index;
+        u64 block;
+
+        block = li->li_data[index];
+        if (!block)
+                return logfs_read_empty(page);
+
+        return logfs_segment_read(inode, page, block, index, 0);
+}
+
+static int logfs_read_loop(struct inode *inode, struct page *page,
+                int rw_context)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        u64 bix, bofs = li->li_data[INDIRECT_INDEX];
+        level_t level, target_level;
+        int ret;
+        struct page *ipage;
+
+        logfs_unpack_index(page->index, &bix, &target_level);
+        if (!bofs)
+                return logfs_read_empty(page);
+
+        if (bix >= maxbix(li->li_height))
+                return logfs_read_empty(page);
+
+        for (level = LEVEL(li->li_height);
+                        (__force u8)level > (__force u8)target_level;
+                        level = SUBLEVEL(level)){
+                ipage = logfs_get_page(inode, bix, level, rw_context);
+                if (!ipage)
+                        return -ENOMEM;
+
+                ret = logfs_segment_read(inode, ipage, bofs, bix, level);
+                if (ret) {
+                        logfs_put_read_page(ipage);
+                        return ret;
+                }
+
+                bofs = block_get_pointer(ipage, get_bits(bix, SUBLEVEL(level)));
+                logfs_put_page(ipage, rw_context);
+                if (!bofs)
+                        return logfs_read_empty(page);
+        }
+
+        return logfs_segment_read(inode, page, bofs, bix, 0);
+}
+
+static int logfs_read_block(struct inode *inode, struct page *page,
+                int rw_context)
+{
+        pgoff_t index = page->index;
+
+        if (index < I0_BLOCKS)
+                return logfs_read_direct(inode, page);
+        return logfs_read_loop(inode, page, rw_context);
+}
+
+static int logfs_exist_loop(struct inode *inode, u64 bix)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        u64 bofs = li->li_data[INDIRECT_INDEX];
+        level_t level;
+        int ret;
+        struct page *ipage;
+
+        if (!bofs)
+                return 0;
+        if (bix >= maxbix(li->li_height))
+                return 0;
+
+        for (level = LEVEL(li->li_height); level != 0; level = SUBLEVEL(level)) {
+                ipage = logfs_get_read_page(inode, bix, level);
+                if (!ipage)
+                        return -ENOMEM;
+
+                ret = logfs_segment_read(inode, ipage, bofs, bix, level);
+                if (ret) {
+                        logfs_put_read_page(ipage);
+                        return ret;
+                }
+
+                bofs = block_get_pointer(ipage, get_bits(bix, SUBLEVEL(level)));
+                logfs_put_read_page(ipage);
+                if (!bofs)
+                        return 0;
+        }
+
+        return 1;
+}
+
+int logfs_exist_block(struct inode *inode, u64 bix)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        if (bix < I0_BLOCKS)
+                return !!li->li_data[bix];
+        return logfs_exist_loop(inode, bix);
+}
+
+static u64 seek_holedata_direct(struct inode *inode, u64 bix, int data)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        for (; bix < I0_BLOCKS; bix++)
+                if (data ^ (li->li_data[bix] == 0))
+                        return bix;
+        return I0_BLOCKS;
+}
+
+static u64 seek_holedata_loop(struct inode *inode, u64 bix, int data)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        __be64 *rblock;
+        u64 increment, bofs = li->li_data[INDIRECT_INDEX];
+        level_t level;
+        int ret, slot;
+        struct page *page;
+
+        BUG_ON(!bofs);
+
+        for (level = LEVEL(li->li_height); level != 0; level = SUBLEVEL(level)) {
+                increment = 1 << (LOGFS_BLOCK_BITS * ((__force u8)level-1));
+                page = logfs_get_read_page(inode, bix, level);
+                if (!page)
+                        return bix;
+
+                ret = logfs_segment_read(inode, page, bofs, bix, level);
+                if (ret) {
+                        logfs_put_read_page(page);
+                        return bix;
+                }
+
+                slot = get_bits(bix, SUBLEVEL(level));
+                rblock = kmap_atomic(page, KM_USER0);
+                while (slot < LOGFS_BLOCK_FACTOR) {
+                        if (data && (rblock[slot] != 0))
+                                break;
+                        if (!data && !(be64_to_cpu(rblock[slot]) & LOGFS_FULLY_POPULATED))
+                                break;
+                        slot++;
+                        bix += increment;
+                        bix &= ~(increment - 1);
+                }
+                if (slot >= LOGFS_BLOCK_FACTOR) {
+                        kunmap_atomic(rblock, KM_USER0);
+                        logfs_put_read_page(page);
+                        return bix;
+                }
+                bofs = be64_to_cpu(rblock[slot]);
+                kunmap_atomic(rblock, KM_USER0);
+                logfs_put_read_page(page);
+                if (!bofs) {
+                        BUG_ON(data);
+                        return bix;
+                }
+        }
+        return bix;
+}
+
+/**
+ * logfs_seek_hole - find next hole starting at a given block index
+ * @inode:              inode to search in
+ * @bix:                block index to start searching
+ *
+ * Returns next hole.  If the file doesn't contain any further holes, the
+ * block address next to eof is returned instead.
+ */
+u64 logfs_seek_hole(struct inode *inode, u64 bix)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        if (bix < I0_BLOCKS) {
+                bix = seek_holedata_direct(inode, bix, 0);
+                if (bix < I0_BLOCKS)
+                        return bix;
+        }
+
+        if (!li->li_data[INDIRECT_INDEX])
+                return bix;
+        else if (li->li_data[INDIRECT_INDEX] & LOGFS_FULLY_POPULATED)
+                bix = maxbix(li->li_height);
+        else {
+                bix = seek_holedata_loop(inode, bix, 0);
+                if (bix < maxbix(li->li_height))
+                        return bix;
+                /* Should not happen anymore.  But if some port writes semi-
+                 * corrupt images (as this one used to) we might run into it.
+                 */
+                WARN_ON_ONCE(bix == maxbix(li->li_height));
+        }
+
+        return bix;
+}
+
+static u64 __logfs_seek_data(struct inode *inode, u64 bix)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        if (bix < I0_BLOCKS) {
+                bix = seek_holedata_direct(inode, bix, 1);
+                if (bix < I0_BLOCKS)
+                        return bix;
+        }
+
+        if (bix < maxbix(li->li_height)) {
+                if (!li->li_data[INDIRECT_INDEX])
+                        bix = maxbix(li->li_height);
+                else
+                        return seek_holedata_loop(inode, bix, 1);
+        }
+
+        return bix;
+}
+
+/**
+ * logfs_seek_data - find next data block after a given block index
+ * @inode:              inode to search in
+ * @bix:                block index to start searching
+ *
+ * Returns next data block.  If the file doesn't contain any further data
+ * blocks, the last block in the file is returned instead.
+ */
+u64 logfs_seek_data(struct inode *inode, u64 bix)
+{
+        struct super_block *sb = inode->i_sb;
+        u64 ret, end;
+
+        ret = __logfs_seek_data(inode, bix);
+        end = i_size_read(inode) >> sb->s_blocksize_bits;
+        if (ret >= end)
+                ret = max(bix, end);
+        return ret;
+}
+
+static int logfs_is_valid_direct(struct logfs_inode *li, u64 bix, u64 ofs)
+{
+        return pure_ofs(li->li_data[bix]) == ofs;
+}
+
+static int __logfs_is_valid_loop(struct inode *inode, u64 bix,
+                u64 ofs, u64 bofs)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        level_t level;
+        int ret;
+        struct page *page;
+
+        for (level = LEVEL(li->li_height); level != 0; level = SUBLEVEL(level)){
+                page = logfs_get_write_page(inode, bix, level);
+                BUG_ON(!page);
+
+                ret = logfs_segment_read(inode, page, bofs, bix, level);
+                if (ret) {
+                        logfs_put_write_page(page);
+                        return 0;
+                }
+
+                bofs = block_get_pointer(page, get_bits(bix, SUBLEVEL(level)));
+                logfs_put_write_page(page);
+                if (!bofs)
+                        return 0;
+
+                if (pure_ofs(bofs) == ofs)
+                        return 1;
+        }
+        return 0;
+}
+
+static int logfs_is_valid_loop(struct inode *inode, u64 bix, u64 ofs)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        u64 bofs = li->li_data[INDIRECT_INDEX];
+
+        if (!bofs)
+                return 0;
+
+        if (bix >= maxbix(li->li_height))
+                return 0;
+
+        if (pure_ofs(bofs) == ofs)
+                return 1;
+
+        return __logfs_is_valid_loop(inode, bix, ofs, bofs);
+}
+
+static int __logfs_is_valid_block(struct inode *inode, u64 bix, u64 ofs)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        if ((inode->i_nlink == 0) && atomic_read(&inode->i_count) == 1)
+                return 0;
+
+        if (bix < I0_BLOCKS)
+                return logfs_is_valid_direct(li, bix, ofs);
+        return logfs_is_valid_loop(inode, bix, ofs);
+}
+
+/**
+ * logfs_is_valid_block - check whether this block is still valid
+ *
+ * @sb  - superblock
+ * @ofs - block physical offset
+ * @ino - block inode number
+ * @bix - block index
+ * @level - block level
+ *
+ * Returns 0 if the block is invalid, 1 if it is valid and 2 if it will
+ * become invalid once the journal is written.
+ */
+int logfs_is_valid_block(struct super_block *sb, u64 ofs, u64 ino, u64 bix,
+                gc_level_t gc_level)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *inode;
+        int ret, cookie;
+
+        /* Umount closes a segment with free blocks remaining.  Those
+         * blocks are by definition invalid. */
+        if (ino == -1)
+                return 0;
+
+        LOGFS_BUG_ON((u64)(u_long)ino != ino, sb);
+
+        inode = logfs_safe_iget(sb, ino, &cookie);
+        if (IS_ERR(inode))
+                goto invalid;
+
+        ret = __logfs_is_valid_block(inode, bix, ofs);
+        logfs_safe_iput(inode, cookie);
+        if (ret)
+                return ret;
+
+invalid:
+        /* Block is nominally invalid, but may still sit in the shadow tree,
+         * waiting for a journal commit.
+         */
+        if (btree_lookup64(&super->s_shadow_tree.old, ofs))
+                return 2;
+        return 0;
+}
+
+int logfs_readpage_nolock(struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        int ret = -EIO;
+
+        ret = logfs_read_block(inode, page, READ);
+
+        if (ret) {
+                ClearPageUptodate(page);
+                SetPageError(page);
+        } else {
+                SetPageUptodate(page);
+                ClearPageError(page);
+        }
+        flush_dcache_page(page);
+
+        return ret;
+}
+
+static int logfs_reserve_bytes(struct inode *inode, int bytes)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+        u64 available = super->s_free_bytes + super->s_dirty_free_bytes
+                        - super->s_dirty_used_bytes - super->s_dirty_pages;
+
+        if (!bytes)
+                return 0;
+
+        if (available < bytes)
+                return -ENOSPC;
+
+        if (available < bytes + super->s_root_reserve &&
+                        !capable(CAP_SYS_RESOURCE))
+                return -ENOSPC;
+
+        return 0;
+}
+
+int get_page_reserve(struct inode *inode, struct page *page)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+        int ret;
+
+        if (logfs_block(page) && logfs_block(page)->reserved_bytes)
+                return 0;
+
+        logfs_get_wblocks(inode->i_sb, page, WF_LOCK);
+        ret = logfs_reserve_bytes(inode, 6 * LOGFS_MAX_OBJECTSIZE);
+        if (!ret) {
+                alloc_data_block(inode, page);
+                logfs_block(page)->reserved_bytes += 6 * LOGFS_MAX_OBJECTSIZE;
+                super->s_dirty_pages += 6 * LOGFS_MAX_OBJECTSIZE;
+        }
+        logfs_put_wblocks(inode->i_sb, page, WF_LOCK);
+        return ret;
+}
+
+/*
+ * We are protected by write lock.  Push victims up to superblock level
+ * and release transaction when appropriate.
+ */
+/* FIXME: This is currently called from the wrong spots. */
+static void logfs_handle_transaction(struct inode *inode,
+                struct logfs_transaction *ta)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+
+        if (!ta)
+                return;
+        logfs_inode(inode)->li_block->ta = NULL;
+
+        if (inode->i_ino != LOGFS_INO_MASTER) {
+                BUG(); /* FIXME: Yes, this needs more thought */
+                /* just remember the transaction until inode is written */
+                //BUG_ON(logfs_inode(inode)->li_transaction);
+                //logfs_inode(inode)->li_transaction = ta;
+                return;
+        }
+
+        switch (ta->state) {
+        case CREATE_1: /* fall through */
+        case UNLINK_1:
+                BUG_ON(super->s_victim_ino);
+                super->s_victim_ino = ta->ino;
+                break;
+        case CREATE_2: /* fall through */
+        case UNLINK_2:
+                BUG_ON(super->s_victim_ino != ta->ino);
+                super->s_victim_ino = 0;
+                /* transaction ends here - free it */
+                kfree(ta);
+                break;
+        case CROSS_RENAME_1:
+                BUG_ON(super->s_rename_dir);
+                BUG_ON(super->s_rename_pos);
+                super->s_rename_dir = ta->dir;
+                super->s_rename_pos = ta->pos;
+                break;
+        case CROSS_RENAME_2:
+                BUG_ON(super->s_rename_dir != ta->dir);
+                BUG_ON(super->s_rename_pos != ta->pos);
+                super->s_rename_dir = 0;
+                super->s_rename_pos = 0;
+                kfree(ta);
+                break;
+        case TARGET_RENAME_1:
+                BUG_ON(super->s_rename_dir);
+                BUG_ON(super->s_rename_pos);
+                BUG_ON(super->s_victim_ino);
+                super->s_rename_dir = ta->dir;
+                super->s_rename_pos = ta->pos;
+                super->s_victim_ino = ta->ino;
+                break;
+        case TARGET_RENAME_2:
+                BUG_ON(super->s_rename_dir != ta->dir);
+                BUG_ON(super->s_rename_pos != ta->pos);
+                BUG_ON(super->s_victim_ino != ta->ino);
+                super->s_rename_dir = 0;
+                super->s_rename_pos = 0;
+                break;
+        case TARGET_RENAME_3:
+                BUG_ON(super->s_rename_dir);
+                BUG_ON(super->s_rename_pos);
+                BUG_ON(super->s_victim_ino != ta->ino);
+                super->s_victim_ino = 0;
+                kfree(ta);
+                break;
+        default:
+                BUG();
+        }
+}
+
+/*
+ * Not strictly a reservation, but rather a check that we still have enough
+ * space to satisfy the write.
+ */
+static int logfs_reserve_blocks(struct inode *inode, int blocks)
+{
+        return logfs_reserve_bytes(inode, blocks * LOGFS_MAX_OBJECTSIZE);
+}
+
+struct write_control {
+        u64 ofs;
+        long flags;
+};
+
+static struct logfs_shadow *alloc_shadow(struct inode *inode, u64 bix,
+                level_t level, u64 old_ofs)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+        struct logfs_shadow *shadow;
+
+        shadow = mempool_alloc(super->s_shadow_pool, GFP_NOFS);
+        memset(shadow, 0, sizeof(*shadow));
+        shadow->ino = inode->i_ino;
+        shadow->bix = bix;
+        shadow->gc_level = expand_level(inode->i_ino, level);
+        shadow->old_ofs = old_ofs & ~LOGFS_FULLY_POPULATED;
+        return shadow;
+}
+
+static void free_shadow(struct inode *inode, struct logfs_shadow *shadow)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+
+        mempool_free(shadow, super->s_shadow_pool);
+}
+
+static void mark_segment(struct shadow_tree *tree, u32 segno)
+{
+        int err;
+
+        if (!btree_lookup32(&tree->segment_map, segno)) {
+                err = btree_insert32(&tree->segment_map, segno, (void *)1,
+                                GFP_NOFS);
+                BUG_ON(err);
+                tree->no_shadowed_segments++;
+        }
+}
+
+/**
+ * fill_shadow_tree - Propagate shadow tree changes due to a write
+ * @inode:      Inode owning the page
+ * @page:       Struct page that was written
+ * @shadow:     Shadow for the current write
+ *
+ * Writes in logfs can result in two semi-valid objects.  The old object
+ * is still valid as long as it can be reached by following pointers on
+ * the medium.  Only when writes propagate all the way up to the journal
+ * has the new object safely replaced the old one.
+ *
+ * To handle this problem, a struct logfs_shadow is used to represent
+ * every single write.  It is attached to the indirect block, which is
+ * marked dirty.  When the indirect block is written, its shadows are
+ * handed up to the next indirect block (or inode).  Untimately they
+ * will reach the master inode and be freed upon journal commit.
+ *
+ * This function handles a single step in the propagation.  It adds the
+ * shadow for the current write to the tree, along with any shadows in
+ * the page's tree, in case it was an indirect block.  If a page is
+ * written, the inode parameter is left NULL, if an inode is written,
+ * the page parameter is left NULL.
+ */
+static void fill_shadow_tree(struct inode *inode, struct page *page,
+                struct logfs_shadow *shadow)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+        struct logfs_block *block = logfs_block(page);
+        struct shadow_tree *tree = &super->s_shadow_tree;
+
+        if (PagePrivate(page)) {
+                if (block->alias_map)
+                        super->s_no_object_aliases -= bitmap_weight(
+                                        block->alias_map, LOGFS_BLOCK_FACTOR);
+                logfs_handle_transaction(inode, block->ta);
+                block->ops->free_block(inode->i_sb, block);
+        }
+        if (shadow) {
+                if (shadow->old_ofs)
+                        btree_insert64(&tree->old, shadow->old_ofs, shadow,
+                                        GFP_NOFS);
+                else
+                        btree_insert64(&tree->new, shadow->new_ofs, shadow,
+                                        GFP_NOFS);
+
+                super->s_dirty_used_bytes += shadow->new_len;
+                super->s_dirty_free_bytes += shadow->old_len;
+                mark_segment(tree, shadow->old_ofs >> super->s_segshift);
+                mark_segment(tree, shadow->new_ofs >> super->s_segshift);
+        }
+}
+
+static void logfs_set_alias(struct super_block *sb, struct logfs_block *block,
+                long child_no)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        if (block->inode && block->inode->i_ino == LOGFS_INO_MASTER) {
+                /* Aliases in the master inode are pointless. */
+                return;
+        }
+
+        if (!test_bit(child_no, block->alias_map)) {
+                set_bit(child_no, block->alias_map);
+                super->s_no_object_aliases++;
+        }
+        list_move_tail(&block->alias_list, &super->s_object_alias);
+}
+
+/*
+ * Object aliases can and often do change the size and occupied space of a
+ * file.  So not only do we have to change the pointers, we also have to
+ * change inode->i_size and li->li_used_bytes.  Which is done by setting
+ * another two object aliases for the inode itself.
+ */
+static void set_iused(struct inode *inode, struct logfs_shadow *shadow)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        if (shadow->new_len == shadow->old_len)
+                return;
+
+        alloc_inode_block(inode);
+        li->li_used_bytes += shadow->new_len - shadow->old_len;
+        __logfs_set_blocks(inode);
+        logfs_set_alias(inode->i_sb, li->li_block, INODE_USED_OFS);
+        logfs_set_alias(inode->i_sb, li->li_block, INODE_SIZE_OFS);
+}
+
+static int logfs_write_i0(struct inode *inode, struct page *page,
+                struct write_control *wc)
+{
+        struct logfs_shadow *shadow;
+        u64 bix;
+        level_t level;
+        int full, err = 0;
+
+        logfs_unpack_index(page->index, &bix, &level);
+        if (wc->ofs == 0)
+                if (logfs_reserve_blocks(inode, 1))
+                        return -ENOSPC;
+
+        shadow = alloc_shadow(inode, bix, level, wc->ofs);
+        if (wc->flags & WF_WRITE)
+                err = logfs_segment_write(inode, page, shadow);
+        if (wc->flags & WF_DELETE)
+                logfs_segment_delete(inode, shadow);
+        if (err) {
+                free_shadow(inode, shadow);
+                return err;
+        }
+
+        set_iused(inode, shadow);
+        full = 1;
+        if (level != 0) {
+                alloc_indirect_block(inode, page, 0);
+                full = logfs_block(page)->full == LOGFS_BLOCK_FACTOR;
+        }
+        fill_shadow_tree(inode, page, shadow);
+        wc->ofs = shadow->new_ofs;
+        if (wc->ofs && full)
+                wc->ofs |= LOGFS_FULLY_POPULATED;
+        return 0;
+}
+
+static int logfs_write_direct(struct inode *inode, struct page *page,
+                long flags)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct write_control wc = {
+                .ofs = li->li_data[page->index],
+                .flags = flags,
+        };
+        int err;
+
+        alloc_inode_block(inode);
+
+        err = logfs_write_i0(inode, page, &wc);
+        if (err)
+                return err;
+
+        li->li_data[page->index] = wc.ofs;
+        logfs_set_alias(inode->i_sb, li->li_block,
+                        page->index + INODE_POINTER_OFS);
+        return 0;
+}
+
+static int ptr_change(u64 ofs, struct page *page)
+{
+        struct logfs_block *block = logfs_block(page);
+        int empty0, empty1, full0, full1;
+
+        empty0 = ofs == 0;
+        empty1 = block->partial == 0;
+        if (empty0 != empty1)
+                return 1;
+
+        /* The !! is necessary to shrink result to int */
+        full0 = !!(ofs & LOGFS_FULLY_POPULATED);
+        full1 = block->full == LOGFS_BLOCK_FACTOR;
+        if (full0 != full1)
+                return 1;
+        return 0;
+}
+
+static int __logfs_write_rec(struct inode *inode, struct page *page,
+                struct write_control *this_wc,
+                pgoff_t bix, level_t target_level, level_t level)
+{
+        int ret, page_empty = 0;
+        int child_no = get_bits(bix, SUBLEVEL(level));
+        struct page *ipage;
+        struct write_control child_wc = {
+                .flags = this_wc->flags,
+        };
+
+        ipage = logfs_get_write_page(inode, bix, level);
+        if (!ipage)
+                return -ENOMEM;
+
+        if (this_wc->ofs) {
+                ret = logfs_segment_read(inode, ipage, this_wc->ofs, bix, level);
+                if (ret)
+                        goto out;
+        } else if (!PageUptodate(ipage)) {
+                page_empty = 1;
+                logfs_read_empty(ipage);
+        }
+
+        child_wc.ofs = block_get_pointer(ipage, child_no);
+
+        if ((__force u8)level-1 > (__force u8)target_level)
+                ret = __logfs_write_rec(inode, page, &child_wc, bix,
+                                target_level, SUBLEVEL(level));
+        else
+                ret = logfs_write_i0(inode, page, &child_wc);
+
+        if (ret)
+                goto out;
+
+        alloc_indirect_block(inode, ipage, page_empty);
+        block_set_pointer(ipage, child_no, child_wc.ofs);
+        /* FIXME: first condition seems superfluous */
+        if (child_wc.ofs || logfs_block(ipage)->partial)
+                this_wc->flags |= WF_WRITE;
+        /* the condition on this_wc->ofs ensures that we won't consume extra
+         * space for indirect blocks in the future, which we cannot reserve */
+        if (!this_wc->ofs || ptr_change(this_wc->ofs, ipage))
+                ret = logfs_write_i0(inode, ipage, this_wc);
+        else
+                logfs_set_alias(inode->i_sb, logfs_block(ipage), child_no);
+out:
+        logfs_put_write_page(ipage);
+        return ret;
+}
+
+static int logfs_write_rec(struct inode *inode, struct page *page,
+                pgoff_t bix, level_t target_level, long flags)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct write_control wc = {
+                .ofs = li->li_data[INDIRECT_INDEX],
+                .flags = flags,
+        };
+        int ret;
+
+        alloc_inode_block(inode);
+
+        if (li->li_height > (__force u8)target_level)
+                ret = __logfs_write_rec(inode, page, &wc, bix, target_level,
+                                LEVEL(li->li_height));
+        else
+                ret = logfs_write_i0(inode, page, &wc);
+        if (ret)
+                return ret;
+
+        if (li->li_data[INDIRECT_INDEX] != wc.ofs) {
+                li->li_data[INDIRECT_INDEX] = wc.ofs;
+                logfs_set_alias(inode->i_sb, li->li_block,
+                                INDIRECT_INDEX + INODE_POINTER_OFS);
+        }
+        return ret;
+}
+
+void logfs_add_transaction(struct inode *inode, struct logfs_transaction *ta)
+{
+        alloc_inode_block(inode);
+        logfs_inode(inode)->li_block->ta = ta;
+}
+
+void logfs_del_transaction(struct inode *inode, struct logfs_transaction *ta)
+{
+        struct logfs_block *block = logfs_inode(inode)->li_block;
+
+        if (block && block->ta)
+                block->ta = NULL;
+}
+
+static int grow_inode(struct inode *inode, u64 bix, level_t level)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        u8 height = (__force u8)level;
+        struct page *page;
+        struct write_control wc = {
+                .flags = WF_WRITE,
+        };
+        int err;
+
+        BUG_ON(height > 5 || li->li_height > 5);
+        while (height > li->li_height || bix >= maxbix(li->li_height)) {
+                page = logfs_get_write_page(inode, I0_BLOCKS + 1,
+                                LEVEL(li->li_height + 1));
+                if (!page)
+                        return -ENOMEM;
+                logfs_read_empty(page);
+                alloc_indirect_block(inode, page, 1);
+                block_set_pointer(page, 0, li->li_data[INDIRECT_INDEX]);
+                err = logfs_write_i0(inode, page, &wc);
+                logfs_put_write_page(page);
+                if (err)
+                        return err;
+                li->li_data[INDIRECT_INDEX] = wc.ofs;
+                wc.ofs = 0;
+                li->li_height++;
+                logfs_set_alias(inode->i_sb, li->li_block, INODE_HEIGHT_OFS);
+        }
+        return 0;
+}
+
+static int __logfs_write_buf(struct inode *inode, struct page *page, long flags)
+{
+        struct logfs_super *super = logfs_super(inode->i_sb);
+        pgoff_t index = page->index;
+        u64 bix;
+        level_t level;
+        int err;
+
+        flags |= WF_WRITE | WF_DELETE;
+        inode->i_ctime = inode->i_mtime = CURRENT_TIME;
+
+        logfs_unpack_index(index, &bix, &level);
+        if (logfs_block(page) && logfs_block(page)->reserved_bytes)
+                super->s_dirty_pages -= logfs_block(page)->reserved_bytes;
+
+        if (index < I0_BLOCKS)
+                return logfs_write_direct(inode, page, flags);
+
+        bix = adjust_bix(bix, level);
+        err = grow_inode(inode, bix, level);
+        if (err)
+                return err;
+        return logfs_write_rec(inode, page, bix, level, flags);
+}
+
+int logfs_write_buf(struct inode *inode, struct page *page, long flags)
+{
+        struct super_block *sb = inode->i_sb;
+        int ret;
+
+        logfs_get_wblocks(sb, page, flags & WF_LOCK);
+        ret = __logfs_write_buf(inode, page, flags);
+        logfs_put_wblocks(sb, page, flags & WF_LOCK);
+        return ret;
+}
+
+static int __logfs_delete(struct inode *inode, struct page *page)
+{
+        long flags = WF_DELETE;
+
+        inode->i_ctime = inode->i_mtime = CURRENT_TIME;
+
+        if (page->index < I0_BLOCKS)
+                return logfs_write_direct(inode, page, flags);
+        return logfs_write_rec(inode, page, page->index, 0, flags);
+}
+
+int logfs_delete(struct inode *inode, pgoff_t index,
+                struct shadow_tree *shadow_tree)
+{
+        struct super_block *sb = inode->i_sb;
+        struct page *page;
+        int ret;
+
+        page = logfs_get_read_page(inode, index, 0);
+        if (!page)
+                return -ENOMEM;
+
+        logfs_get_wblocks(sb, page, 1);
+        ret = __logfs_delete(inode, page);
+        logfs_put_wblocks(sb, page, 1);
+
+        logfs_put_read_page(page);
+
+        return ret;
+}
+
+int logfs_rewrite_block(struct inode *inode, u64 bix, u64 ofs,
+                gc_level_t gc_level, long flags)
+{
+        level_t level = shrink_level(gc_level);
+        struct page *page;
+        int err;
+
+        page = logfs_get_write_page(inode, bix, level);
+        if (!page)
+                return -ENOMEM;
+
+        err = logfs_segment_read(inode, page, ofs, bix, level);
+        if (!err) {
+                if (level != 0)
+                        alloc_indirect_block(inode, page, 0);
+                err = logfs_write_buf(inode, page, flags);
+                if (!err && shrink_level(gc_level) == 0) {
+                        /* Rewrite cannot mark the inode dirty but has to
+                         * write it immediatly.
+                         * Q: Can't we just create an alias for the inode
+                         * instead?  And if not, why not?
+                         */
+                        if (inode->i_ino == LOGFS_INO_MASTER)
+                                logfs_write_anchor(inode->i_sb);
+                        else {
+                                err = __logfs_write_inode(inode, flags);
+                        }
+                }
+        }
+        logfs_put_write_page(page);
+        return err;
+}
+
+static int truncate_data_block(struct inode *inode, struct page *page,
+                u64 ofs, struct logfs_shadow *shadow, u64 size)
+{
+        loff_t pageofs = page->index << inode->i_sb->s_blocksize_bits;
+        u64 bix;
+        level_t level;
+        int err;
+
+        /* Does truncation happen within this page? */
+        if (size <= pageofs || size - pageofs >= PAGE_SIZE)
+                return 0;
+
+        logfs_unpack_index(page->index, &bix, &level);
+        BUG_ON(level != 0);
+
+        err = logfs_segment_read(inode, page, ofs, bix, level);
+        if (err)
+                return err;
+
+        zero_user_segment(page, size - pageofs, PAGE_CACHE_SIZE);
+        return logfs_segment_write(inode, page, shadow);
+}
+
+static int logfs_truncate_i0(struct inode *inode, struct page *page,
+                struct write_control *wc, u64 size)
+{
+        struct logfs_shadow *shadow;
+        u64 bix;
+        level_t level;
+        int err = 0;
+
+        logfs_unpack_index(page->index, &bix, &level);
+        BUG_ON(level != 0);
+        shadow = alloc_shadow(inode, bix, level, wc->ofs);
+
+        err = truncate_data_block(inode, page, wc->ofs, shadow, size);
+        if (err) {
+                free_shadow(inode, shadow);
+                return err;
+        }
+
+        logfs_segment_delete(inode, shadow);
+        set_iused(inode, shadow);
+        fill_shadow_tree(inode, page, shadow);
+        wc->ofs = shadow->new_ofs;
+        return 0;
+}
+
+static int logfs_truncate_direct(struct inode *inode, u64 size)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct write_control wc;
+        struct page *page;
+        int e;
+        int err;
+
+        alloc_inode_block(inode);
+
+        for (e = I0_BLOCKS - 1; e >= 0; e--) {
+                if (size > (e+1) * LOGFS_BLOCKSIZE)
+                        break;
+
+                wc.ofs = li->li_data[e];
+                if (!wc.ofs)
+                        continue;
+
+                page = logfs_get_write_page(inode, e, 0);
+                if (!page)
+                        return -ENOMEM;
+                err = logfs_segment_read(inode, page, wc.ofs, e, 0);
+                if (err) {
+                        logfs_put_write_page(page);
+                        return err;
+                }
+                err = logfs_truncate_i0(inode, page, &wc, size);
+                logfs_put_write_page(page);
+                if (err)
+                        return err;
+
+                li->li_data[e] = wc.ofs;
+        }
+        return 0;
+}
+
+/* FIXME: these need to become per-sb once we support different blocksizes */
+static u64 __logfs_step[] = {
+        1,
+        I1_BLOCKS,
+        I2_BLOCKS,
+        I3_BLOCKS,
+};
+
+static u64 __logfs_start_index[] = {
+        I0_BLOCKS,
+        I1_BLOCKS,
+        I2_BLOCKS,
+        I3_BLOCKS
+};
+
+static inline u64 logfs_step(level_t level)
+{
+        return __logfs_step[(__force u8)level];
+}
+
+static inline u64 logfs_factor(u8 level)
+{
+        return __logfs_step[level] * LOGFS_BLOCKSIZE;
+}
+
+static inline u64 logfs_start_index(level_t level)
+{
+        return __logfs_start_index[(__force u8)level];
+}
+
+static void logfs_unpack_raw_index(pgoff_t index, u64 *bix, level_t *level)
+{
+        logfs_unpack_index(index, bix, level);
+        if (*bix <= logfs_start_index(SUBLEVEL(*level)))
+                *bix = 0;
+}
+
+static int __logfs_truncate_rec(struct inode *inode, struct page *ipage,
+                struct write_control *this_wc, u64 size)
+{
+        int truncate_happened = 0;
+        int e, err = 0;
+        u64 bix, child_bix, next_bix;
+        level_t level;
+        struct page *page;
+        struct write_control child_wc = { /* FIXME: flags */ };
+
+        logfs_unpack_raw_index(ipage->index, &bix, &level);
+        err = logfs_segment_read(inode, ipage, this_wc->ofs, bix, level);
+        if (err)
+                return err;
+
+        for (e = LOGFS_BLOCK_FACTOR - 1; e >= 0; e--) {
+                child_bix = bix + e * logfs_step(SUBLEVEL(level));
+                next_bix = child_bix + logfs_step(SUBLEVEL(level));
+                if (size > next_bix * LOGFS_BLOCKSIZE)
+                        break;
+
+                child_wc.ofs = pure_ofs(block_get_pointer(ipage, e));
+                if (!child_wc.ofs)
+                        continue;
+
+                page = logfs_get_write_page(inode, child_bix, SUBLEVEL(level));
+                if (!page)
+                        return -ENOMEM;
+
+                if ((__force u8)level > 1)
+                        err = __logfs_truncate_rec(inode, page, &child_wc, size);
+                else
+                        err = logfs_truncate_i0(inode, page, &child_wc, size);
+                logfs_put_write_page(page);
+                if (err)
+                        return err;
+
+                truncate_happened = 1;
+                alloc_indirect_block(inode, ipage, 0);
+                block_set_pointer(ipage, e, child_wc.ofs);
+        }
+
+        if (!truncate_happened) {
+                printk("ineffectual truncate (%lx, %lx, %llx)\n", inode->i_ino, ipage->index, size);
+                return 0;
+        }
+
+        this_wc->flags = WF_DELETE;
+        if (logfs_block(ipage)->partial)
+                this_wc->flags |= WF_WRITE;
+
+        return logfs_write_i0(inode, ipage, this_wc);
+}
+
+static int logfs_truncate_rec(struct inode *inode, u64 size)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct write_control wc = {
+                .ofs = li->li_data[INDIRECT_INDEX],
+        };
+        struct page *page;
+        int err;
+
+        alloc_inode_block(inode);
+
+        if (!wc.ofs)
+                return 0;
+
+        page = logfs_get_write_page(inode, 0, LEVEL(li->li_height));
+        if (!page)
+                return -ENOMEM;
+
+        err = __logfs_truncate_rec(inode, page, &wc, size);
+        logfs_put_write_page(page);
+        if (err)
+                return err;
+
+        if (li->li_data[INDIRECT_INDEX] != wc.ofs)
+                li->li_data[INDIRECT_INDEX] = wc.ofs;
+        return 0;
+}
+
+static int __logfs_truncate(struct inode *inode, u64 size)
+{
+        int ret;
+
+        if (size >= logfs_factor(logfs_inode(inode)->li_height))
+                return 0;
+
+        ret = logfs_truncate_rec(inode, size);
+        if (ret)
+                return ret;
+
+        return logfs_truncate_direct(inode, size);
+}
+
+/*
+ * Truncate, by changing the segment file, can consume a fair amount
+ * of resources.  So back off from time to time and do some GC.
+ * 8 or 2048 blocks should be well within safety limits even if
+ * every single block resided in a different segment.
+ */
+#define TRUNCATE_STEP   (8 * 1024 * 1024)
+int logfs_truncate(struct inode *inode, u64 target)
+{
+        struct super_block *sb = inode->i_sb;
+        u64 size = i_size_read(inode);
+        int err = 0;
+
+        size = ALIGN(size, TRUNCATE_STEP);
+        while (size > target) {
+                if (size > TRUNCATE_STEP)
+                        size -= TRUNCATE_STEP;
+                else
+                        size = 0;
+                if (size < target)
+                        size = target;
+
+                logfs_get_wblocks(sb, NULL, 1);
+                err = __logfs_truncate(inode, target);
+                if (!err)
+                        err = __logfs_write_inode(inode, 0);
+                logfs_put_wblocks(sb, NULL, 1);
+        }
+
+        if (!err)
+                err = vmtruncate(inode, target);
+
+        /* I don't trust error recovery yet. */
+        WARN_ON(err);
+        return err;
+}
+
+static void move_page_to_inode(struct inode *inode, struct page *page)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct logfs_block *block = logfs_block(page);
+
+        if (!block)
+                return;
+
+        log_blockmove("move_page_to_inode(%llx, %llx, %x)\n",
+                        block->ino, block->bix, block->level);
+        BUG_ON(li->li_block);
+        block->ops = &inode_block_ops;
+        block->inode = inode;
+        li->li_block = block;
+
+        block->page = NULL;
+        page->private = 0;
+        ClearPagePrivate(page);
+}
+
+static void move_inode_to_page(struct page *page, struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+        struct logfs_block *block = li->li_block;
+
+        if (!block)
+                return;
+
+        log_blockmove("move_inode_to_page(%llx, %llx, %x)\n",
+                        block->ino, block->bix, block->level);
+        BUG_ON(PagePrivate(page));
+        block->ops = &indirect_block_ops;
+        block->page = page;
+        page->private = (unsigned long)block;
+        SetPagePrivate(page);
+
+        block->inode = NULL;
+        li->li_block = NULL;
+}
+
+int logfs_read_inode(struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *master_inode = super->s_master_inode;
+        struct page *page;
+        struct logfs_disk_inode *di;
+        u64 ino = inode->i_ino;
+
+        if (ino << sb->s_blocksize_bits > i_size_read(master_inode))
+                return -ENODATA;
+        if (!logfs_exist_block(master_inode, ino))
+                return -ENODATA;
+
+        page = read_cache_page(master_inode->i_mapping, ino,
+                        (filler_t *)logfs_readpage, NULL);
+        if (IS_ERR(page))
+                return PTR_ERR(page);
+
+        di = kmap_atomic(page, KM_USER0);
+        logfs_disk_to_inode(di, inode);
+        kunmap_atomic(di, KM_USER0);
+        move_page_to_inode(inode, page);
+        page_cache_release(page);
+        return 0;
+}
+
+/* Caller must logfs_put_write_page(page); */
+static struct page *inode_to_page(struct inode *inode)
+{
+        struct inode *master_inode = logfs_super(inode->i_sb)->s_master_inode;
+        struct logfs_disk_inode *di;
+        struct page *page;
+
+        BUG_ON(inode->i_ino == LOGFS_INO_MASTER);
+
+        page = logfs_get_write_page(master_inode, inode->i_ino, 0);
+        if (!page)
+                return NULL;
+
+        di = kmap_atomic(page, KM_USER0);
+        logfs_inode_to_disk(inode, di);
+        kunmap_atomic(di, KM_USER0);
+        move_inode_to_page(page, inode);
+        return page;
+}
+
+/* Cheaper version of write_inode.  All changes are concealed in
+ * aliases, which are moved back.  No write to the medium happens.
+ */
+void logfs_clear_inode(struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct logfs_inode *li = logfs_inode(inode);
+        struct logfs_block *block = li->li_block;
+        struct page *page;
+
+        /* Only deleted files may be dirty at this point */
+        BUG_ON(inode->i_state & I_DIRTY && inode->i_nlink);
+        if (!block)
+                return;
+        if ((logfs_super(sb)->s_flags & LOGFS_SB_FLAG_SHUTDOWN)) {
+                block->ops->free_block(inode->i_sb, block);
+                return;
+        }
+
+        BUG_ON(inode->i_ino < LOGFS_RESERVED_INOS);
+        page = inode_to_page(inode);
+        BUG_ON(!page); /* FIXME: Use emergency page */
+        logfs_put_write_page(page);
+}
+
+static int do_write_inode(struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct inode *master_inode = logfs_super(sb)->s_master_inode;
+        loff_t size = (inode->i_ino + 1) << inode->i_sb->s_blocksize_bits;
+        struct page *page;
+        int err;
+
+        BUG_ON(inode->i_ino == LOGFS_INO_MASTER);
+        /* FIXME: lock inode */
+
+        if (i_size_read(master_inode) < size)
+                i_size_write(master_inode, size);
+
+        /* TODO: Tell vfs this inode is clean now */
+
+        page = inode_to_page(inode);
+        if (!page)
+                return -ENOMEM;
+
+        /* FIXME: transaction is part of logfs_block now.  Is that enough? */
+        err = logfs_write_buf(master_inode, page, 0);
+        logfs_put_write_page(page);
+        return err;
+}
+
+static void logfs_mod_segment_entry(struct super_block *sb, u32 segno,
+                int write,
+                void (*change_se)(struct logfs_segment_entry *, long),
+                long arg)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *inode;
+        struct page *page;
+        struct logfs_segment_entry *se;
+        pgoff_t page_no;
+        int child_no;
+
+        page_no = segno >> (sb->s_blocksize_bits - 3);
+        child_no = segno & ((sb->s_blocksize >> 3) - 1);
+
+        inode = super->s_segfile_inode;
+        page = logfs_get_write_page(inode, page_no, 0);
+        BUG_ON(!page); /* FIXME: We need some reserve page for this case */
+        if (!PageUptodate(page))
+                logfs_read_block(inode, page, WRITE);
+
+        if (write)
+                alloc_indirect_block(inode, page, 0);
+        se = kmap_atomic(page, KM_USER0);
+        change_se(se + child_no, arg);
+        if (write) {
+                logfs_set_alias(sb, logfs_block(page), child_no);
+                BUG_ON((int)be32_to_cpu(se[child_no].valid) > super->s_segsize);
+        }
+        kunmap_atomic(se, KM_USER0);
+
+        logfs_put_write_page(page);
+}
+
+static void __get_segment_entry(struct logfs_segment_entry *se, long _target)
+{
+        struct logfs_segment_entry *target = (void *)_target;
+
+        *target = *se;
+}
+
+void logfs_get_segment_entry(struct super_block *sb, u32 segno,
+                struct logfs_segment_entry *se)
+{
+        logfs_mod_segment_entry(sb, segno, 0, __get_segment_entry, (long)se);
+}
+
+static void __set_segment_used(struct logfs_segment_entry *se, long increment)
+{
+        u32 valid;
+
+        valid = be32_to_cpu(se->valid);
+        valid += increment;
+        se->valid = cpu_to_be32(valid);
+}
+
+void logfs_set_segment_used(struct super_block *sb, u64 ofs, int increment)
+{
+        struct logfs_super *super = logfs_super(sb);
+        u32 segno = ofs >> super->s_segshift;
+
+        if (!increment)
+                return;
+
+        logfs_mod_segment_entry(sb, segno, 1, __set_segment_used, increment);
+}
+
+static void __set_segment_erased(struct logfs_segment_entry *se, long ec_level)
+{
+        se->ec_level = cpu_to_be32(ec_level);
+}
+
+void logfs_set_segment_erased(struct super_block *sb, u32 segno, u32 ec,
+                gc_level_t gc_level)
+{
+        u32 ec_level = ec << 4 | (__force u8)gc_level;
+
+        logfs_mod_segment_entry(sb, segno, 1, __set_segment_erased, ec_level);
+}
+
+static void __set_segment_reserved(struct logfs_segment_entry *se, long ignore)
+{
+        se->valid = cpu_to_be32(RESERVED);
+}
+
+void logfs_set_segment_reserved(struct super_block *sb, u32 segno)
+{
+        logfs_mod_segment_entry(sb, segno, 1, __set_segment_reserved, 0);
+}
+
+static void __set_segment_unreserved(struct logfs_segment_entry *se,
+                long ec_level)
+{
+        se->valid = 0;
+        se->ec_level = cpu_to_be32(ec_level);
+}
+
+void logfs_set_segment_unreserved(struct super_block *sb, u32 segno, u32 ec)
+{
+        u32 ec_level = ec << 4;
+
+        logfs_mod_segment_entry(sb, segno, 1, __set_segment_unreserved,
+                        ec_level);
+}
+
+int __logfs_write_inode(struct inode *inode, long flags)
+{
+        struct super_block *sb = inode->i_sb;
+        int ret;
+
+        logfs_get_wblocks(sb, NULL, flags & WF_LOCK);
+        ret = do_write_inode(inode);
+        logfs_put_wblocks(sb, NULL, flags & WF_LOCK);
+        return ret;
+}
+
+static int do_delete_inode(struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct inode *master_inode = logfs_super(sb)->s_master_inode;
+        struct page *page;
+        int ret;
+
+        page = logfs_get_write_page(master_inode, inode->i_ino, 0);
+        if (!page)
+                return -ENOMEM;
+
+        move_inode_to_page(page, inode);
+
+        logfs_get_wblocks(sb, page, 1);
+        ret = __logfs_delete(master_inode, page);
+        logfs_put_wblocks(sb, page, 1);
+
+        logfs_put_write_page(page);
+        return ret;
+}
+
+/*
+ * ZOMBIE inodes have already been deleted before and should remain dead,
+ * if it weren't for valid checking.  No need to kill them again here.
+ */
+void logfs_delete_inode(struct inode *inode)
+{
+        struct logfs_inode *li = logfs_inode(inode);
+
+        if (!(li->li_flags & LOGFS_IF_ZOMBIE)) {
+                li->li_flags |= LOGFS_IF_ZOMBIE;
+                if (i_size_read(inode) > 0)
+                        logfs_truncate(inode, 0);
+                do_delete_inode(inode);
+        }
+        truncate_inode_pages(&inode->i_data, 0);
+        clear_inode(inode);
+}
+
+void btree_write_block(struct logfs_block *block)
+{
+        struct inode *inode;
+        struct page *page;
+        int err, cookie;
+
+        inode = logfs_safe_iget(block->sb, block->ino, &cookie);
+        page = logfs_get_write_page(inode, block->bix, block->level);
+
+        err = logfs_readpage_nolock(page);
+        BUG_ON(err);
+        BUG_ON(!PagePrivate(page));
+        BUG_ON(logfs_block(page) != block);
+        err = __logfs_write_buf(inode, page, 0);
+        BUG_ON(err);
+        BUG_ON(PagePrivate(page) || page->private);
+
+        logfs_put_write_page(page);
+        logfs_safe_iput(inode, cookie);
+}
+
+/**
+ * logfs_inode_write - write inode or dentry objects
+ *
+ * @inode:              parent inode (ifile or directory)
+ * @buf:                object to write (inode or dentry)
+ * @n:                  object size
+ * @_pos:               object number (file position in blocks/objects)
+ * @flags:              write flags
+ * @lock:               0 if write lock is already taken, 1 otherwise
+ * @shadow_tree:        shadow below this inode
+ *
+ * FIXME: All caller of this put a 200-300 byte variable on the stack,
+ * only to call here and do a memcpy from that stack variable.  A good
+ * example of wasted performance and stack space.
+ */
+int logfs_inode_write(struct inode *inode, const void *buf, size_t count,
+                loff_t bix, long flags, struct shadow_tree *shadow_tree)
+{
+        loff_t pos = bix << inode->i_sb->s_blocksize_bits;
+        int err;
+        struct page *page;
+        void *pagebuf;
+
+        BUG_ON(pos & (LOGFS_BLOCKSIZE-1));
+        BUG_ON(count > LOGFS_BLOCKSIZE);
+        page = logfs_get_write_page(inode, bix, 0);
+        if (!page)
+                return -ENOMEM;
+
+        pagebuf = kmap_atomic(page, KM_USER0);
+        memcpy(pagebuf, buf, count);
+        flush_dcache_page(page);
+        kunmap_atomic(pagebuf, KM_USER0);
+
+        if (i_size_read(inode) < pos + LOGFS_BLOCKSIZE)
+                i_size_write(inode, pos + LOGFS_BLOCKSIZE);
+
+        err = logfs_write_buf(inode, page, flags);
+        logfs_put_write_page(page);
+        return err;
+}
+
+int logfs_open_segfile(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *inode;
+
+        inode = logfs_read_meta_inode(sb, LOGFS_INO_SEGFILE);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+        super->s_segfile_inode = inode;
+        return 0;
+}
+
+int logfs_init_rw(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int min_fill = 3 * super->s_no_blocks;
+
+        INIT_LIST_HEAD(&super->s_object_alias);
+        mutex_init(&super->s_write_mutex);
+        super->s_block_pool = mempool_create_kmalloc_pool(min_fill,
+                        sizeof(struct logfs_block));
+        super->s_shadow_pool = mempool_create_kmalloc_pool(min_fill,
+                        sizeof(struct logfs_shadow));
+        return 0;
+}
+
+void logfs_cleanup_rw(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        destroy_meta_inode(super->s_segfile_inode);
+        logfs_mempool_destroy(super->s_block_pool);
+        logfs_mempool_destroy(super->s_shadow_pool);
+}
diff --git a/fs/logfs/segment.c b/fs/logfs/segment.c
new file mode 100644
index 000000000000..f77ce2b470ba
--- /dev/null
+++ b/fs/logfs/segment.c
@@ -0,0 +1,930 @@
+/*
+ * fs/logfs/segment.c   - Handling the Object Store
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ *
+ * Object store or ostore makes up the complete device with exception of
+ * the superblock and journal areas.  Apart from its own metadata it stores
+ * three kinds of objects: inodes, dentries and blocks, both data and indirect.
+ */
+#include "logfs.h"
+#include <linux/slab.h>
+
+static int logfs_mark_segment_bad(struct super_block *sb, u32 segno)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct btree_head32 *head = &super->s_reserved_segments;
+        int err;
+
+        err = btree_insert32(head, segno, (void *)1, GFP_NOFS);
+        if (err)
+                return err;
+        logfs_super(sb)->s_bad_segments++;
+        /* FIXME: write to journal */
+        return 0;
+}
+
+int logfs_erase_segment(struct super_block *sb, u32 segno, int ensure_erase)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        super->s_gec++;
+
+        return super->s_devops->erase(sb, (u64)segno << super->s_segshift,
+                        super->s_segsize, ensure_erase);
+}
+
+static s64 logfs_get_free_bytes(struct logfs_area *area, size_t bytes)
+{
+        s32 ofs;
+
+        logfs_open_area(area, bytes);
+
+        ofs = area->a_used_bytes;
+        area->a_used_bytes += bytes;
+        BUG_ON(area->a_used_bytes >= logfs_super(area->a_sb)->s_segsize);
+
+        return dev_ofs(area->a_sb, area->a_segno, ofs);
+}
+
+static struct page *get_mapping_page(struct super_block *sb, pgoff_t index,
+                int use_filler)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        filler_t *filler = super->s_devops->readpage;
+        struct page *page;
+
+        BUG_ON(mapping_gfp_mask(mapping) & __GFP_FS);
+        if (use_filler)
+                page = read_cache_page(mapping, index, filler, sb);
+        else {
+                page = find_or_create_page(mapping, index, GFP_NOFS);
+                unlock_page(page);
+        }
+        return page;
+}
+
+void __logfs_buf_write(struct logfs_area *area, u64 ofs, void *buf, size_t len,
+                int use_filler)
+{
+        pgoff_t index = ofs >> PAGE_SHIFT;
+        struct page *page;
+        long offset = ofs & (PAGE_SIZE-1);
+        long copylen;
+
+        /* Only logfs_wbuf_recover may use len==0 */
+        BUG_ON(!len && !use_filler);
+        do {
+                copylen = min((ulong)len, PAGE_SIZE - offset);
+
+                page = get_mapping_page(area->a_sb, index, use_filler);
+                SetPageUptodate(page);
+                BUG_ON(!page); /* FIXME: reserve a pool */
+                memcpy(page_address(page) + offset, buf, copylen);
+                SetPagePrivate(page);
+                page_cache_release(page);
+
+                buf += copylen;
+                len -= copylen;
+                offset = 0;
+                index++;
+        } while (len);
+}
+
+static void pad_partial_page(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        struct page *page;
+        u64 ofs = dev_ofs(sb, area->a_segno, area->a_used_bytes);
+        pgoff_t index = ofs >> PAGE_SHIFT;
+        long offset = ofs & (PAGE_SIZE-1);
+        u32 len = PAGE_SIZE - offset;
+
+        if (len % PAGE_SIZE) {
+                page = get_mapping_page(sb, index, 0);
+                BUG_ON(!page); /* FIXME: reserve a pool */
+                memset(page_address(page) + offset, 0xff, len);
+                SetPagePrivate(page);
+                page_cache_release(page);
+        }
+}
+
+static void pad_full_pages(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        struct logfs_super *super = logfs_super(sb);
+        u64 ofs = dev_ofs(sb, area->a_segno, area->a_used_bytes);
+        u32 len = super->s_segsize - area->a_used_bytes;
+        pgoff_t index = PAGE_CACHE_ALIGN(ofs) >> PAGE_CACHE_SHIFT;
+        pgoff_t no_indizes = len >> PAGE_CACHE_SHIFT;
+        struct page *page;
+
+        while (no_indizes) {
+                page = get_mapping_page(sb, index, 0);
+                BUG_ON(!page); /* FIXME: reserve a pool */
+                SetPageUptodate(page);
+                memset(page_address(page), 0xff, PAGE_CACHE_SIZE);
+                SetPagePrivate(page);
+                page_cache_release(page);
+                index++;
+                no_indizes--;
+        }
+}
+
+/*
+ * bdev_writeseg will write full pages.  Memset the tail to prevent data leaks.
+ * Also make sure we allocate (and memset) all pages for final writeout.
+ */
+static void pad_wbuf(struct logfs_area *area, int final)
+{
+        pad_partial_page(area);
+        if (final)
+                pad_full_pages(area);
+}
+
+/*
+ * We have to be careful with the alias tree.  Since lookup is done by bix,
+ * it needs to be normalized, so 14, 15, 16, etc. all match when dealing with
+ * indirect blocks.  So always use it through accessor functions.
+ */
+static void *alias_tree_lookup(struct super_block *sb, u64 ino, u64 bix,
+                level_t level)
+{
+        struct btree_head128 *head = &logfs_super(sb)->s_object_alias_tree;
+        pgoff_t index = logfs_pack_index(bix, level);
+
+        return btree_lookup128(head, ino, index);
+}
+
+static int alias_tree_insert(struct super_block *sb, u64 ino, u64 bix,
+                level_t level, void *val)
+{
+        struct btree_head128 *head = &logfs_super(sb)->s_object_alias_tree;
+        pgoff_t index = logfs_pack_index(bix, level);
+
+        return btree_insert128(head, ino, index, val, GFP_NOFS);
+}
+
+static int btree_write_alias(struct super_block *sb, struct logfs_block *block,
+                write_alias_t *write_one_alias)
+{
+        struct object_alias_item *item;
+        int err;
+
+        list_for_each_entry(item, &block->item_list, list) {
+                err = write_alias_journal(sb, block->ino, block->bix,
+                                block->level, item->child_no, item->val);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+static struct logfs_block_ops btree_block_ops = {
+        .write_block    = btree_write_block,
+        .free_block     = __free_block,
+        .write_alias    = btree_write_alias,
+};
+
+int logfs_load_object_aliases(struct super_block *sb,
+                struct logfs_obj_alias *oa, int count)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_block *block;
+        struct object_alias_item *item;
+        u64 ino, bix;
+        level_t level;
+        int i, err;
+
+        super->s_flags |= LOGFS_SB_FLAG_OBJ_ALIAS;
+        count /= sizeof(*oa);
+        for (i = 0; i < count; i++) {
+                item = mempool_alloc(super->s_alias_pool, GFP_NOFS);
+                if (!item)
+                        return -ENOMEM;
+                memset(item, 0, sizeof(*item));
+
+                super->s_no_object_aliases++;
+                item->val = oa[i].val;
+                item->child_no = be16_to_cpu(oa[i].child_no);
+
+                ino = be64_to_cpu(oa[i].ino);
+                bix = be64_to_cpu(oa[i].bix);
+                level = LEVEL(oa[i].level);
+
+                log_aliases("logfs_load_object_aliases(%llx, %llx, %x, %x) %llx\n",
+                                ino, bix, level, item->child_no,
+                                be64_to_cpu(item->val));
+                block = alias_tree_lookup(sb, ino, bix, level);
+                if (!block) {
+                        block = __alloc_block(sb, ino, bix, level);
+                        block->ops = &btree_block_ops;
+                        err = alias_tree_insert(sb, ino, bix, level, block);
+                        BUG_ON(err); /* mempool empty */
+                }
+                if (test_and_set_bit(item->child_no, block->alias_map)) {
+                        printk(KERN_ERR"LogFS: Alias collision detected\n");
+                        return -EIO;
+                }
+                list_move_tail(&block->alias_list, &super->s_object_alias);
+                list_add(&item->list, &block->item_list);
+        }
+        return 0;
+}
+
+static void kill_alias(void *_block, unsigned long ignore0,
+                u64 ignore1, u64 ignore2, size_t ignore3)
+{
+        struct logfs_block *block = _block;
+        struct super_block *sb = block->sb;
+        struct logfs_super *super = logfs_super(sb);
+        struct object_alias_item *item;
+
+        while (!list_empty(&block->item_list)) {
+                item = list_entry(block->item_list.next, typeof(*item), list);
+                list_del(&item->list);
+                mempool_free(item, super->s_alias_pool);
+        }
+        block->ops->free_block(sb, block);
+}
+
+static int obj_type(struct inode *inode, level_t level)
+{
+        if (level == 0) {
+                if (S_ISDIR(inode->i_mode))
+                        return OBJ_DENTRY;
+                if (inode->i_ino == LOGFS_INO_MASTER)
+                        return OBJ_INODE;
+        }
+        return OBJ_BLOCK;
+}
+
+static int obj_len(struct super_block *sb, int obj_type)
+{
+        switch (obj_type) {
+        case OBJ_DENTRY:
+                return sizeof(struct logfs_disk_dentry);
+        case OBJ_INODE:
+                return sizeof(struct logfs_disk_inode);
+        case OBJ_BLOCK:
+                return sb->s_blocksize;
+        default:
+                BUG();
+        }
+}
+
+static int __logfs_segment_write(struct inode *inode, void *buf,
+                struct logfs_shadow *shadow, int type, int len, int compr)
+{
+        struct logfs_area *area;
+        struct super_block *sb = inode->i_sb;
+        s64 ofs;
+        struct logfs_object_header h;
+        int acc_len;
+
+        if (shadow->gc_level == 0)
+                acc_len = len;
+        else
+                acc_len = obj_len(sb, type);
+
+        area = get_area(sb, shadow->gc_level);
+        ofs = logfs_get_free_bytes(area, len + LOGFS_OBJECT_HEADERSIZE);
+        LOGFS_BUG_ON(ofs <= 0, sb);
+        /*
+         * Order is important.  logfs_get_free_bytes(), by modifying the
+         * segment file, may modify the content of the very page we're about
+         * to write now.  Which is fine, as long as the calculated crc and
+         * written data still match.  So do the modifications _before_
+         * calculating the crc.
+         */
+
+        h.len   = cpu_to_be16(len);
+        h.type  = type;
+        h.compr = compr;
+        h.ino   = cpu_to_be64(inode->i_ino);
+        h.bix   = cpu_to_be64(shadow->bix);
+        h.crc   = logfs_crc32(&h, sizeof(h) - 4, 4);
+        h.data_crc = logfs_crc32(buf, len, 0);
+
+        logfs_buf_write(area, ofs, &h, sizeof(h));
+        logfs_buf_write(area, ofs + LOGFS_OBJECT_HEADERSIZE, buf, len);
+
+        shadow->new_ofs = ofs;
+        shadow->new_len = acc_len + LOGFS_OBJECT_HEADERSIZE;
+
+        return 0;
+}
+
+static s64 logfs_segment_write_compress(struct inode *inode, void *buf,
+                struct logfs_shadow *shadow, int type, int len)
+{
+        struct super_block *sb = inode->i_sb;
+        void *compressor_buf = logfs_super(sb)->s_compressed_je;
+        ssize_t compr_len;
+        int ret;
+
+        mutex_lock(&logfs_super(sb)->s_journal_mutex);
+        compr_len = logfs_compress(buf, compressor_buf, len, len);
+
+        if (compr_len >= 0) {
+                ret = __logfs_segment_write(inode, compressor_buf, shadow,
+                                type, compr_len, COMPR_ZLIB);
+        } else {
+                ret = __logfs_segment_write(inode, buf, shadow, type, len,
+                                COMPR_NONE);
+        }
+        mutex_unlock(&logfs_super(sb)->s_journal_mutex);
+        return ret;
+}
+
+/**
+ * logfs_segment_write - write data block to object store
+ * @inode:              inode containing data
+ *
+ * Returns an errno or zero.
+ */
+int logfs_segment_write(struct inode *inode, struct page *page,
+                struct logfs_shadow *shadow)
+{
+        struct super_block *sb = inode->i_sb;
+        struct logfs_super *super = logfs_super(sb);
+        int do_compress, type, len;
+        int ret;
+        void *buf;
+
+        super->s_flags |= LOGFS_SB_FLAG_DIRTY;
+        BUG_ON(super->s_flags & LOGFS_SB_FLAG_SHUTDOWN);
+        do_compress = logfs_inode(inode)->li_flags & LOGFS_IF_COMPRESSED;
+        if (shadow->gc_level != 0) {
+                /* temporarily disable compression for indirect blocks */
+                do_compress = 0;
+        }
+
+        type = obj_type(inode, shrink_level(shadow->gc_level));
+        len = obj_len(sb, type);
+        buf = kmap(page);
+        if (do_compress)
+                ret = logfs_segment_write_compress(inode, buf, shadow, type,
+                                len);
+        else
+                ret = __logfs_segment_write(inode, buf, shadow, type, len,
+                                COMPR_NONE);
+        kunmap(page);
+
+        log_segment("logfs_segment_write(%llx, %llx, %x) %llx->%llx %x->%x\n",
+                        shadow->ino, shadow->bix, shadow->gc_level,
+                        shadow->old_ofs, shadow->new_ofs,
+                        shadow->old_len, shadow->new_len);
+        /* this BUG_ON did catch a locking bug.  useful */
+        BUG_ON(!(shadow->new_ofs & (super->s_segsize - 1)));
+        return ret;
+}
+
+int wbuf_read(struct super_block *sb, u64 ofs, size_t len, void *buf)
+{
+        pgoff_t index = ofs >> PAGE_SHIFT;
+        struct page *page;
+        long offset = ofs & (PAGE_SIZE-1);
+        long copylen;
+
+        while (len) {
+                copylen = min((ulong)len, PAGE_SIZE - offset);
+
+                page = get_mapping_page(sb, index, 1);
+                if (IS_ERR(page))
+                        return PTR_ERR(page);
+                memcpy(buf, page_address(page) + offset, copylen);
+                page_cache_release(page);
+
+                buf += copylen;
+                len -= copylen;
+                offset = 0;
+                index++;
+        }
+        return 0;
+}
+
+/*
+ * The "position" of indirect blocks is ambiguous.  It can be the position
+ * of any data block somewhere behind this indirect block.  So we need to
+ * normalize the positions through logfs_block_mask() before comparing.
+ */
+static int check_pos(struct super_block *sb, u64 pos1, u64 pos2, level_t level)
+{
+        return  (pos1 & logfs_block_mask(sb, level)) !=
+                (pos2 & logfs_block_mask(sb, level));
+}
+
+#if 0
+static int read_seg_header(struct super_block *sb, u64 ofs,
+                struct logfs_segment_header *sh)
+{
+        __be32 crc;
+        int err;
+
+        err = wbuf_read(sb, ofs, sizeof(*sh), sh);
+        if (err)
+                return err;
+        crc = logfs_crc32(sh, sizeof(*sh), 4);
+        if (crc != sh->crc) {
+                printk(KERN_ERR"LOGFS: header crc error at %llx: expected %x, "
+                                "got %x\n", ofs, be32_to_cpu(sh->crc),
+                                be32_to_cpu(crc));
+                return -EIO;
+        }
+        return 0;
+}
+#endif
+
+static int read_obj_header(struct super_block *sb, u64 ofs,
+                struct logfs_object_header *oh)
+{
+        __be32 crc;
+        int err;
+
+        err = wbuf_read(sb, ofs, sizeof(*oh), oh);
+        if (err)
+                return err;
+        crc = logfs_crc32(oh, sizeof(*oh) - 4, 4);
+        if (crc != oh->crc) {
+                printk(KERN_ERR"LOGFS: header crc error at %llx: expected %x, "
+                                "got %x\n", ofs, be32_to_cpu(oh->crc),
+                                be32_to_cpu(crc));
+                return -EIO;
+        }
+        return 0;
+}
+
+static void move_btree_to_page(struct inode *inode, struct page *page,
+                __be64 *data)
+{
+        struct super_block *sb = inode->i_sb;
+        struct logfs_super *super = logfs_super(sb);
+        struct btree_head128 *head = &super->s_object_alias_tree;
+        struct logfs_block *block;
+        struct object_alias_item *item, *next;
+
+        if (!(super->s_flags & LOGFS_SB_FLAG_OBJ_ALIAS))
+                return;
+
+        block = btree_remove128(head, inode->i_ino, page->index);
+        if (!block)
+                return;
+
+        log_blockmove("move_btree_to_page(%llx, %llx, %x)\n",
+                        block->ino, block->bix, block->level);
+        list_for_each_entry_safe(item, next, &block->item_list, list) {
+                data[item->child_no] = item->val;
+                list_del(&item->list);
+                mempool_free(item, super->s_alias_pool);
+        }
+        block->page = page;
+        SetPagePrivate(page);
+        page->private = (unsigned long)block;
+        block->ops = &indirect_block_ops;
+        initialize_block_counters(page, block, data, 0);
+}
+
+/*
+ * This silences a false, yet annoying gcc warning.  I hate it when my editor
+ * jumps into bitops.h each time I recompile this file.
+ * TODO: Complain to gcc folks about this and upgrade compiler.
+ */
+static unsigned long fnb(const unsigned long *addr,
+                unsigned long size, unsigned long offset)
+{
+        return find_next_bit(addr, size, offset);
+}
+
+void move_page_to_btree(struct page *page)
+{
+        struct logfs_block *block = logfs_block(page);
+        struct super_block *sb = block->sb;
+        struct logfs_super *super = logfs_super(sb);
+        struct object_alias_item *item;
+        unsigned long pos;
+        __be64 *child;
+        int err;
+
+        if (super->s_flags & LOGFS_SB_FLAG_SHUTDOWN) {
+                block->ops->free_block(sb, block);
+                return;
+        }
+        log_blockmove("move_page_to_btree(%llx, %llx, %x)\n",
+                        block->ino, block->bix, block->level);
+        super->s_flags |= LOGFS_SB_FLAG_OBJ_ALIAS;
+
+        for (pos = 0; ; pos++) {
+                pos = fnb(block->alias_map, LOGFS_BLOCK_FACTOR, pos);
+                if (pos >= LOGFS_BLOCK_FACTOR)
+                        break;
+
+                item = mempool_alloc(super->s_alias_pool, GFP_NOFS);
+                BUG_ON(!item); /* mempool empty */
+                memset(item, 0, sizeof(*item));
+
+                child = kmap_atomic(page, KM_USER0);
+                item->val = child[pos];
+                kunmap_atomic(child, KM_USER0);
+                item->child_no = pos;
+                list_add(&item->list, &block->item_list);
+        }
+        block->page = NULL;
+        ClearPagePrivate(page);
+        page->private = 0;
+        block->ops = &btree_block_ops;
+        err = alias_tree_insert(block->sb, block->ino, block->bix, block->level,
+                        block);
+        BUG_ON(err); /* mempool empty */
+        ClearPageUptodate(page);
+}
+
+static int __logfs_segment_read(struct inode *inode, void *buf,
+                u64 ofs, u64 bix, level_t level)
+{
+        struct super_block *sb = inode->i_sb;
+        void *compressor_buf = logfs_super(sb)->s_compressed_je;
+        struct logfs_object_header oh;
+        __be32 crc;
+        u16 len;
+        int err, block_len;
+
+        block_len = obj_len(sb, obj_type(inode, level));
+        err = read_obj_header(sb, ofs, &oh);
+        if (err)
+                goto out_err;
+
+        err = -EIO;
+        if (be64_to_cpu(oh.ino) != inode->i_ino
+                        || check_pos(sb, be64_to_cpu(oh.bix), bix, level)) {
+                printk(KERN_ERR"LOGFS: (ino, bix) don't match at %llx: "
+                                "expected (%lx, %llx), got (%llx, %llx)\n",
+                                ofs, inode->i_ino, bix,
+                                be64_to_cpu(oh.ino), be64_to_cpu(oh.bix));
+                goto out_err;
+        }
+
+        len = be16_to_cpu(oh.len);
+
+        switch (oh.compr) {
+        case COMPR_NONE:
+                err = wbuf_read(sb, ofs + LOGFS_OBJECT_HEADERSIZE, len, buf);
+                if (err)
+                        goto out_err;
+                crc = logfs_crc32(buf, len, 0);
+                if (crc != oh.data_crc) {
+                        printk(KERN_ERR"LOGFS: uncompressed data crc error at "
+                                        "%llx: expected %x, got %x\n", ofs,
+                                        be32_to_cpu(oh.data_crc),
+                                        be32_to_cpu(crc));
+                        goto out_err;
+                }
+                break;
+        case COMPR_ZLIB:
+                mutex_lock(&logfs_super(sb)->s_journal_mutex);
+                err = wbuf_read(sb, ofs + LOGFS_OBJECT_HEADERSIZE, len,
+                                compressor_buf);
+                if (err) {
+                        mutex_unlock(&logfs_super(sb)->s_journal_mutex);
+                        goto out_err;
+                }
+                crc = logfs_crc32(compressor_buf, len, 0);
+                if (crc != oh.data_crc) {
+                        printk(KERN_ERR"LOGFS: compressed data crc error at "
+                                        "%llx: expected %x, got %x\n", ofs,
+                                        be32_to_cpu(oh.data_crc),
+                                        be32_to_cpu(crc));
+                        mutex_unlock(&logfs_super(sb)->s_journal_mutex);
+                        goto out_err;
+                }
+                err = logfs_uncompress(compressor_buf, buf, len, block_len);
+                mutex_unlock(&logfs_super(sb)->s_journal_mutex);
+                if (err) {
+                        printk(KERN_ERR"LOGFS: uncompress error at %llx\n", ofs);
+                        goto out_err;
+                }
+                break;
+        default:
+                LOGFS_BUG(sb);
+                err = -EIO;
+                goto out_err;
+        }
+        return 0;
+
+out_err:
+        logfs_set_ro(sb);
+        printk(KERN_ERR"LOGFS: device is read-only now\n");
+        LOGFS_BUG(sb);
+        return err;
+}
+
+/**
+ * logfs_segment_read - read data block from object store
+ * @inode:              inode containing data
+ * @buf:                data buffer
+ * @ofs:                physical data offset
+ * @bix:                block index
+ * @level:              block level
+ *
+ * Returns 0 on success or a negative errno.
+ */
+int logfs_segment_read(struct inode *inode, struct page *page,
+                u64 ofs, u64 bix, level_t level)
+{
+        int err;
+        void *buf;
+
+        if (PageUptodate(page))
+                return 0;
+
+        ofs &= ~LOGFS_FULLY_POPULATED;
+
+        buf = kmap(page);
+        err = __logfs_segment_read(inode, buf, ofs, bix, level);
+        if (!err) {
+                move_btree_to_page(inode, page, buf);
+                SetPageUptodate(page);
+        }
+        kunmap(page);
+        log_segment("logfs_segment_read(%lx, %llx, %x) %llx (%d)\n",
+                        inode->i_ino, bix, level, ofs, err);
+        return err;
+}
+
+int logfs_segment_delete(struct inode *inode, struct logfs_shadow *shadow)
+{
+        struct super_block *sb = inode->i_sb;
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_object_header h;
+        u16 len;
+        int err;
+
+        super->s_flags |= LOGFS_SB_FLAG_DIRTY;
+        BUG_ON(super->s_flags & LOGFS_SB_FLAG_SHUTDOWN);
+        BUG_ON(shadow->old_ofs & LOGFS_FULLY_POPULATED);
+        if (!shadow->old_ofs)
+                return 0;
+
+        log_segment("logfs_segment_delete(%llx, %llx, %x) %llx->%llx %x->%x\n",
+                        shadow->ino, shadow->bix, shadow->gc_level,
+                        shadow->old_ofs, shadow->new_ofs,
+                        shadow->old_len, shadow->new_len);
+        err = read_obj_header(sb, shadow->old_ofs, &h);
+        LOGFS_BUG_ON(err, sb);
+        LOGFS_BUG_ON(be64_to_cpu(h.ino) != inode->i_ino, sb);
+        LOGFS_BUG_ON(check_pos(sb, shadow->bix, be64_to_cpu(h.bix),
+                                shrink_level(shadow->gc_level)), sb);
+
+        if (shadow->gc_level == 0)
+                len = be16_to_cpu(h.len);
+        else
+                len = obj_len(sb, h.type);
+        shadow->old_len = len + sizeof(h);
+        return 0;
+}
+
+void freeseg(struct super_block *sb, u32 segno)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping = super->s_mapping_inode->i_mapping;
+        struct page *page;
+        u64 ofs, start, end;
+
+        start = dev_ofs(sb, segno, 0);
+        end = dev_ofs(sb, segno + 1, 0);
+        for (ofs = start; ofs < end; ofs += PAGE_SIZE) {
+                page = find_get_page(mapping, ofs >> PAGE_SHIFT);
+                if (!page)
+                        continue;
+                ClearPagePrivate(page);
+                page_cache_release(page);
+        }
+}
+
+int logfs_open_area(struct logfs_area *area, size_t bytes)
+{
+        struct super_block *sb = area->a_sb;
+        struct logfs_super *super = logfs_super(sb);
+        int err, closed = 0;
+
+        if (area->a_is_open && area->a_used_bytes + bytes <= super->s_segsize)
+                return 0;
+
+        if (area->a_is_open) {
+                u64 ofs = dev_ofs(sb, area->a_segno, area->a_written_bytes);
+                u32 len = super->s_segsize - area->a_written_bytes;
+
+                log_gc("logfs_close_area(%x)\n", area->a_segno);
+                pad_wbuf(area, 1);
+                super->s_devops->writeseg(area->a_sb, ofs, len);
+                freeseg(sb, area->a_segno);
+                closed = 1;
+        }
+
+        area->a_used_bytes = 0;
+        area->a_written_bytes = 0;
+again:
+        area->a_ops->get_free_segment(area);
+        area->a_ops->get_erase_count(area);
+
+        log_gc("logfs_open_area(%x, %x)\n", area->a_segno, area->a_level);
+        err = area->a_ops->erase_segment(area);
+        if (err) {
+                printk(KERN_WARNING "LogFS: Error erasing segment %x\n",
+                                area->a_segno);
+                logfs_mark_segment_bad(sb, area->a_segno);
+                goto again;
+        }
+        area->a_is_open = 1;
+        return closed;
+}
+
+void logfs_sync_area(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        struct logfs_super *super = logfs_super(sb);
+        u64 ofs = dev_ofs(sb, area->a_segno, area->a_written_bytes);
+        u32 len = (area->a_used_bytes - area->a_written_bytes);
+
+        if (super->s_writesize)
+                len &= ~(super->s_writesize - 1);
+        if (len == 0)
+                return;
+        pad_wbuf(area, 0);
+        super->s_devops->writeseg(sb, ofs, len);
+        area->a_written_bytes += len;
+}
+
+void logfs_sync_segments(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i;
+
+        for_each_area(i)
+                logfs_sync_area(super->s_area[i]);
+}
+
+/*
+ * Pick a free segment to be used for this area.  Effectively takes a
+ * candidate from the free list (not really a candidate anymore).
+ */
+static void ostore_get_free_segment(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        struct logfs_super *super = logfs_super(sb);
+
+        if (super->s_free_list.count == 0) {
+                printk(KERN_ERR"LOGFS: ran out of free segments\n");
+                LOGFS_BUG(sb);
+        }
+
+        area->a_segno = get_best_cand(sb, &super->s_free_list, NULL);
+}
+
+static void ostore_get_erase_count(struct logfs_area *area)
+{
+        struct logfs_segment_entry se;
+        u32 ec_level;
+
+        logfs_get_segment_entry(area->a_sb, area->a_segno, &se);
+        BUG_ON(se.ec_level == cpu_to_be32(BADSEG) ||
+                        se.valid == cpu_to_be32(RESERVED));
+
+        ec_level = be32_to_cpu(se.ec_level);
+        area->a_erase_count = (ec_level >> 4) + 1;
+}
+
+static int ostore_erase_segment(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        struct logfs_segment_header sh;
+        u64 ofs;
+        int err;
+
+        err = logfs_erase_segment(sb, area->a_segno, 0);
+        if (err)
+                return err;
+
+        sh.pad = 0;
+        sh.type = SEG_OSTORE;
+        sh.level = (__force u8)area->a_level;
+        sh.segno = cpu_to_be32(area->a_segno);
+        sh.ec = cpu_to_be32(area->a_erase_count);
+        sh.gec = cpu_to_be64(logfs_super(sb)->s_gec);
+        sh.crc = logfs_crc32(&sh, sizeof(sh), 4);
+
+        logfs_set_segment_erased(sb, area->a_segno, area->a_erase_count,
+                        area->a_level);
+
+        ofs = dev_ofs(sb, area->a_segno, 0);
+        area->a_used_bytes = sizeof(sh);
+        logfs_buf_write(area, ofs, &sh, sizeof(sh));
+        return 0;
+}
+
+static const struct logfs_area_ops ostore_area_ops = {
+        .get_free_segment       = ostore_get_free_segment,
+        .get_erase_count        = ostore_get_erase_count,
+        .erase_segment          = ostore_erase_segment,
+};
+
+static void free_area(struct logfs_area *area)
+{
+        if (area)
+                freeseg(area->a_sb, area->a_segno);
+        kfree(area);
+}
+
+static struct logfs_area *alloc_area(struct super_block *sb)
+{
+        struct logfs_area *area;
+
+        area = kzalloc(sizeof(*area), GFP_KERNEL);
+        if (!area)
+                return NULL;
+
+        area->a_sb = sb;
+        return area;
+}
+
+static void map_invalidatepage(struct page *page, unsigned long l)
+{
+        BUG();
+}
+
+static int map_releasepage(struct page *page, gfp_t g)
+{
+        /* Don't release these pages */
+        return 0;
+}
+
+static const struct address_space_operations mapping_aops = {
+        .invalidatepage = map_invalidatepage,
+        .releasepage    = map_releasepage,
+        .set_page_dirty = __set_page_dirty_nobuffers,
+};
+
+int logfs_init_mapping(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct address_space *mapping;
+        struct inode *inode;
+
+        inode = logfs_new_meta_inode(sb, LOGFS_INO_MAPPING);
+        if (IS_ERR(inode))
+                return PTR_ERR(inode);
+        super->s_mapping_inode = inode;
+        mapping = inode->i_mapping;
+        mapping->a_ops = &mapping_aops;
+        /* Would it be possible to use __GFP_HIGHMEM as well? */
+        mapping_set_gfp_mask(mapping, GFP_NOFS);
+        return 0;
+}
+
+int logfs_init_areas(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i = -1;
+
+        super->s_alias_pool = mempool_create_kmalloc_pool(600,
+                        sizeof(struct object_alias_item));
+        if (!super->s_alias_pool)
+                return -ENOMEM;
+
+        super->s_journal_area = alloc_area(sb);
+        if (!super->s_journal_area)
+                goto err;
+
+        for_each_area(i) {
+                super->s_area[i] = alloc_area(sb);
+                if (!super->s_area[i])
+                        goto err;
+                super->s_area[i]->a_level = GC_LEVEL(i);
+                super->s_area[i]->a_ops = &ostore_area_ops;
+        }
+        btree_init_mempool128(&super->s_object_alias_tree,
+                        super->s_btree_pool);
+        return 0;
+
+err:
+        for (i--; i >= 0; i--)
+                free_area(super->s_area[i]);
+        free_area(super->s_journal_area);
+        logfs_mempool_destroy(super->s_alias_pool);
+        return -ENOMEM;
+}
+
+void logfs_cleanup_areas(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int i;
+
+        btree_grim_visitor128(&super->s_object_alias_tree, 0, kill_alias);
+        for_each_area(i)
+                free_area(super->s_area[i]);
+        free_area(super->s_journal_area);
+        destroy_meta_inode(super->s_mapping_inode);
+}
diff --git a/fs/logfs/super.c b/fs/logfs/super.c
new file mode 100644
index 000000000000..5866ee6e1327
--- /dev/null
+++ b/fs/logfs/super.c
@@ -0,0 +1,657 @@
+/*
+ * fs/logfs/super.c
+ *
+ * As should be obvious for Linux kernel code, license is GPLv2
+ *
+ * Copyright (c) 2005-2008 Joern Engel <joern@logfs.org>
+ *
+ * Generally contains mount/umount code and also serves as a dump area for
+ * any functions that don't fit elsewhere and neither justify a file of their
+ * own.
+ */
+#include "logfs.h"
+#include <linux/bio.h>
+#include <linux/slab.h>
+#include <linux/blkdev.h>
+#include <linux/mtd/mtd.h>
+#include <linux/statfs.h>
+#include <linux/buffer_head.h>
+
+static DEFINE_MUTEX(emergency_mutex);
+static struct page *emergency_page;
+
+struct page *emergency_read_begin(struct address_space *mapping, pgoff_t index)
+{
+        filler_t *filler = (filler_t *)mapping->a_ops->readpage;
+        struct page *page;
+        int err;
+
+        page = read_cache_page(mapping, index, filler, NULL);
+        if (page)
+                return page;
+
+        /* No more pages available, switch to emergency page */
+        printk(KERN_INFO"Logfs: Using emergency page\n");
+        mutex_lock(&emergency_mutex);
+        err = filler(NULL, emergency_page);
+        if (err) {
+                mutex_unlock(&emergency_mutex);
+                printk(KERN_EMERG"Logfs: Error reading emergency page\n");
+                return ERR_PTR(err);
+        }
+        return emergency_page;
+}
+
+void emergency_read_end(struct page *page)
+{
+        if (page == emergency_page)
+                mutex_unlock(&emergency_mutex);
+        else
+                page_cache_release(page);
+}
+
+static void dump_segfile(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_segment_entry se;
+        u32 segno;
+
+        for (segno = 0; segno < super->s_no_segs; segno++) {
+                logfs_get_segment_entry(sb, segno, &se);
+                printk("%3x: %6x %8x", segno, be32_to_cpu(se.ec_level),
+                                be32_to_cpu(se.valid));
+                if (++segno < super->s_no_segs) {
+                        logfs_get_segment_entry(sb, segno, &se);
+                        printk(" %6x %8x", be32_to_cpu(se.ec_level),
+                                        be32_to_cpu(se.valid));
+                }
+                if (++segno < super->s_no_segs) {
+                        logfs_get_segment_entry(sb, segno, &se);
+                        printk(" %6x %8x", be32_to_cpu(se.ec_level),
+                                        be32_to_cpu(se.valid));
+                }
+                if (++segno < super->s_no_segs) {
+                        logfs_get_segment_entry(sb, segno, &se);
+                        printk(" %6x %8x", be32_to_cpu(se.ec_level),
+                                        be32_to_cpu(se.valid));
+                }
+                printk("\n");
+        }
+}
+
+/*
+ * logfs_crash_dump - dump debug information to device
+ *
+ * The LogFS superblock only occupies part of a segment.  This function will
+ * write as much debug information as it can gather into the spare space.
+ */
+void logfs_crash_dump(struct super_block *sb)
+{
+        dump_segfile(sb);
+}
+
+/*
+ * TODO: move to lib/string.c
+ */
+/**
+ * memchr_inv - Find a character in an area of memory.
+ * @s: The memory area
+ * @c: The byte to search for
+ * @n: The size of the area.
+ *
+ * returns the address of the first character other than @c, or %NULL
+ * if the whole buffer contains just @c.
+ */
+void *memchr_inv(const void *s, int c, size_t n)
+{
+        const unsigned char *p = s;
+        while (n-- != 0)
+                if ((unsigned char)c != *p++)
+                        return (void *)(p - 1);
+
+        return NULL;
+}
+
+/*
+ * FIXME: There should be a reserve for root, similar to ext2.
+ */
+int logfs_statfs(struct dentry *dentry, struct kstatfs *stats)
+{
+        struct super_block *sb = dentry->d_sb;
+        struct logfs_super *super = logfs_super(sb);
+
+        stats->f_type           = LOGFS_MAGIC_U32;
+        stats->f_bsize          = sb->s_blocksize;
+        stats->f_blocks         = super->s_size >> LOGFS_BLOCK_BITS >> 3;
+        stats->f_bfree          = super->s_free_bytes >> sb->s_blocksize_bits;
+        stats->f_bavail         = super->s_free_bytes >> sb->s_blocksize_bits;
+        stats->f_files          = 0;
+        stats->f_ffree          = 0;
+        stats->f_namelen        = LOGFS_MAX_NAMELEN;
+        return 0;
+}
+
+static int logfs_sb_set(struct super_block *sb, void *_super)
+{
+        struct logfs_super *super = _super;
+
+        sb->s_fs_info = super;
+        sb->s_mtd = super->s_mtd;
+        sb->s_bdev = super->s_bdev;
+        if (sb->s_bdev)
+                sb->s_bdi = &bdev_get_queue(sb->s_bdev)->backing_dev_info;
+        if (sb->s_mtd)
+                sb->s_bdi = sb->s_mtd->backing_dev_info;
+        return 0;
+}
+
+static int logfs_sb_test(struct super_block *sb, void *_super)
+{
+        struct logfs_super *super = _super;
+        struct mtd_info *mtd = super->s_mtd;
+
+        if (mtd && sb->s_mtd == mtd)
+                return 1;
+        if (super->s_bdev && sb->s_bdev == super->s_bdev)
+                return 1;
+        return 0;
+}
+
+static void set_segment_header(struct logfs_segment_header *sh, u8 type,
+                u8 level, u32 segno, u32 ec)
+{
+        sh->pad = 0;
+        sh->type = type;
+        sh->level = level;
+        sh->segno = cpu_to_be32(segno);
+        sh->ec = cpu_to_be32(ec);
+        sh->gec = cpu_to_be64(segno);
+        sh->crc = logfs_crc32(sh, LOGFS_SEGMENT_HEADERSIZE, 4);
+}
+
+static void logfs_write_ds(struct super_block *sb, struct logfs_disk_super *ds,
+                u32 segno, u32 ec)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_segment_header *sh = &ds->ds_sh;
+        int i;
+
+        memset(ds, 0, sizeof(*ds));
+        set_segment_header(sh, SEG_SUPER, 0, segno, ec);
+
+        ds->ds_ifile_levels     = super->s_ifile_levels;
+        ds->ds_iblock_levels    = super->s_iblock_levels;
+        ds->ds_data_levels      = super->s_data_levels; /* XXX: Remove */
+        ds->ds_segment_shift    = super->s_segshift;
+        ds->ds_block_shift      = sb->s_blocksize_bits;
+        ds->ds_write_shift      = super->s_writeshift;
+        ds->ds_filesystem_size  = cpu_to_be64(super->s_size);
+        ds->ds_segment_size     = cpu_to_be32(super->s_segsize);
+        ds->ds_bad_seg_reserve  = cpu_to_be32(super->s_bad_seg_reserve);
+        ds->ds_feature_incompat = cpu_to_be64(super->s_feature_incompat);
+        ds->ds_feature_ro_compat= cpu_to_be64(super->s_feature_ro_compat);
+        ds->ds_feature_compat   = cpu_to_be64(super->s_feature_compat);
+        ds->ds_feature_flags    = cpu_to_be64(super->s_feature_flags);
+        ds->ds_root_reserve     = cpu_to_be64(super->s_root_reserve);
+        ds->ds_speed_reserve    = cpu_to_be64(super->s_speed_reserve);
+        journal_for_each(i)
+                ds->ds_journal_seg[i] = cpu_to_be32(super->s_journal_seg[i]);
+        ds->ds_magic            = cpu_to_be64(LOGFS_MAGIC);
+        ds->ds_crc = logfs_crc32(ds, sizeof(*ds),
+                        LOGFS_SEGMENT_HEADERSIZE + 12);
+}
+
+static int write_one_sb(struct super_block *sb,
+                struct page *(*find_sb)(struct super_block *sb, u64 *ofs))
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_disk_super *ds;
+        struct logfs_segment_entry se;
+        struct page *page;
+        u64 ofs;
+        u32 ec, segno;
+        int err;
+
+        page = find_sb(sb, &ofs);
+        if (!page)
+                return -EIO;
+        ds = page_address(page);
+        segno = seg_no(sb, ofs);
+        logfs_get_segment_entry(sb, segno, &se);
+        ec = be32_to_cpu(se.ec_level) >> 4;
+        ec++;
+        logfs_set_segment_erased(sb, segno, ec, 0);
+        logfs_write_ds(sb, ds, segno, ec);
+        err = super->s_devops->write_sb(sb, page);
+        page_cache_release(page);
+        return err;
+}
+
+int logfs_write_sb(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int err;
+
+        /* First superblock */
+        err = write_one_sb(sb, super->s_devops->find_first_sb);
+        if (err)
+                return err;
+
+        /* Last superblock */
+        err = write_one_sb(sb, super->s_devops->find_last_sb);
+        if (err)
+                return err;
+        return 0;
+}
+
+static int ds_cmp(const void *ds0, const void *ds1)
+{
+        size_t len = sizeof(struct logfs_disk_super);
+
+        /* We know the segment headers differ, so ignore them */
+        len -= LOGFS_SEGMENT_HEADERSIZE;
+        ds0 += LOGFS_SEGMENT_HEADERSIZE;
+        ds1 += LOGFS_SEGMENT_HEADERSIZE;
+        return memcmp(ds0, ds1, len);
+}
+
+static int logfs_recover_sb(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct logfs_disk_super _ds0, *ds0 = &_ds0;
+        struct logfs_disk_super _ds1, *ds1 = &_ds1;
+        int err, valid0, valid1;
+
+        /* read first superblock */
+        err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
+        if (err)
+                return err;
+        /* read last superblock */
+        err = wbuf_read(sb, super->s_sb_ofs[1], sizeof(*ds1), ds1);
+        if (err)
+                return err;
+        valid0 = logfs_check_ds(ds0) == 0;
+        valid1 = logfs_check_ds(ds1) == 0;
+
+        if (!valid0 && valid1) {
+                printk(KERN_INFO"First superblock is invalid - fixing.\n");
+                return write_one_sb(sb, super->s_devops->find_first_sb);
+        }
+        if (valid0 && !valid1) {
+                printk(KERN_INFO"Last superblock is invalid - fixing.\n");
+                return write_one_sb(sb, super->s_devops->find_last_sb);
+        }
+        if (valid0 && valid1 && ds_cmp(ds0, ds1)) {
+                printk(KERN_INFO"Superblocks don't match - fixing.\n");
+                return logfs_write_sb(sb);
+        }
+        /* If neither is valid now, something's wrong.  Didn't we properly
+         * check them before?!? */
+        BUG_ON(!valid0 && !valid1);
+        return 0;
+}
+
+static int logfs_make_writeable(struct super_block *sb)
+{
+        int err;
+
+        err = logfs_open_segfile(sb);
+        if (err)
+                return err;
+
+        /* Repair any broken superblock copies */
+        err = logfs_recover_sb(sb);
+        if (err)
+                return err;
+
+        /* Check areas for trailing unaccounted data */
+        err = logfs_check_areas(sb);
+        if (err)
+                return err;
+
+        /* Do one GC pass before any data gets dirtied */
+        logfs_gc_pass(sb);
+
+        /* after all initializations are done, replay the journal
+         * for rw-mounts, if necessary */
+        err = logfs_replay_journal(sb);
+        if (err)
+                return err;
+
+        return 0;
+}
+
+static int logfs_get_sb_final(struct super_block *sb, struct vfsmount *mnt)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct inode *rootdir;
+        int err;
+
+        /* root dir */
+        rootdir = logfs_iget(sb, LOGFS_INO_ROOT);
+        if (IS_ERR(rootdir))
+                goto fail;
+
+        sb->s_root = d_alloc_root(rootdir);
+        if (!sb->s_root)
+                goto fail2;
+
+        super->s_erase_page = alloc_pages(GFP_KERNEL, 0);
+        if (!super->s_erase_page)
+                goto fail2;
+        memset(page_address(super->s_erase_page), 0xFF, PAGE_SIZE);
+
+        /* FIXME: check for read-only mounts */
+        err = logfs_make_writeable(sb);
+        if (err)
+                goto fail3;
+
+        log_super("LogFS: Finished mounting\n");
+        simple_set_mnt(mnt, sb);
+        return 0;
+
+fail3:
+        __free_page(super->s_erase_page);
+fail2:
+        iput(rootdir);
+fail:
+        iput(logfs_super(sb)->s_master_inode);
+        return -EIO;
+}
+
+int logfs_check_ds(struct logfs_disk_super *ds)
+{
+        struct logfs_segment_header *sh = &ds->ds_sh;
+
+        if (ds->ds_magic != cpu_to_be64(LOGFS_MAGIC))
+                return -EINVAL;
+        if (sh->crc != logfs_crc32(sh, LOGFS_SEGMENT_HEADERSIZE, 4))
+                return -EINVAL;
+        if (ds->ds_crc != logfs_crc32(ds, sizeof(*ds),
+                                LOGFS_SEGMENT_HEADERSIZE + 12))
+                return -EINVAL;
+        return 0;
+}
+
+static struct page *find_super_block(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct page *first, *last;
+
+        first = super->s_devops->find_first_sb(sb, &super->s_sb_ofs[0]);
+        if (!first || IS_ERR(first))
+                return NULL;
+        last = super->s_devops->find_last_sb(sb, &super->s_sb_ofs[1]);
+        if (!last || IS_ERR(first)) {
+                page_cache_release(first);
+                return NULL;
+        }
+
+        if (!logfs_check_ds(page_address(first))) {
+                page_cache_release(last);
+                return first;
+        }
+
+        /* First one didn't work, try the second superblock */
+        if (!logfs_check_ds(page_address(last))) {
+                page_cache_release(first);
+                return last;
+        }
+
+        /* Neither worked, sorry folks */
+        page_cache_release(first);
+        page_cache_release(last);
+        return NULL;
+}
+
+static int __logfs_read_sb(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+        struct page *page;
+        struct logfs_disk_super *ds;
+        int i;
+
+        page = find_super_block(sb);
+        if (!page)
+                return -EIO;
+
+        ds = page_address(page);
+        super->s_size = be64_to_cpu(ds->ds_filesystem_size);
+        super->s_root_reserve = be64_to_cpu(ds->ds_root_reserve);
+        super->s_speed_reserve = be64_to_cpu(ds->ds_speed_reserve);
+        super->s_bad_seg_reserve = be32_to_cpu(ds->ds_bad_seg_reserve);
+        super->s_segsize = 1 << ds->ds_segment_shift;
+        super->s_segmask = (1 << ds->ds_segment_shift) - 1;
+        super->s_segshift = ds->ds_segment_shift;
+        sb->s_blocksize = 1 << ds->ds_block_shift;
+        sb->s_blocksize_bits = ds->ds_block_shift;
+        super->s_writesize = 1 << ds->ds_write_shift;
+        super->s_writeshift = ds->ds_write_shift;
+        super->s_no_segs = super->s_size >> super->s_segshift;
+        super->s_no_blocks = super->s_segsize >> sb->s_blocksize_bits;
+        super->s_feature_incompat = be64_to_cpu(ds->ds_feature_incompat);
+        super->s_feature_ro_compat = be64_to_cpu(ds->ds_feature_ro_compat);
+        super->s_feature_compat = be64_to_cpu(ds->ds_feature_compat);
+        super->s_feature_flags = be64_to_cpu(ds->ds_feature_flags);
+
+        journal_for_each(i)
+                super->s_journal_seg[i] = be32_to_cpu(ds->ds_journal_seg[i]);
+
+        super->s_ifile_levels = ds->ds_ifile_levels;
+        super->s_iblock_levels = ds->ds_iblock_levels;
+        super->s_data_levels = ds->ds_data_levels;
+        super->s_total_levels = super->s_ifile_levels + super->s_iblock_levels
+                + super->s_data_levels;
+        page_cache_release(page);
+        return 0;
+}
+
+static int logfs_read_sb(struct super_block *sb, int read_only)
+{
+        struct logfs_super *super = logfs_super(sb);
+        int ret;
+
+        super->s_btree_pool = mempool_create(32, btree_alloc, btree_free, NULL);
+        if (!super->s_btree_pool)
+                return -ENOMEM;
+
+        btree_init_mempool64(&super->s_shadow_tree.new, super->s_btree_pool);
+        btree_init_mempool64(&super->s_shadow_tree.old, super->s_btree_pool);
+        btree_init_mempool32(&super->s_shadow_tree.segment_map,
+                        super->s_btree_pool);
+
+        ret = logfs_init_mapping(sb);
+        if (ret)
+                return ret;
+
+        ret = __logfs_read_sb(sb);
+        if (ret)
+                return ret;
+
+        if (super->s_feature_incompat & ~LOGFS_FEATURES_INCOMPAT)
+                return -EIO;
+        if ((super->s_feature_ro_compat & ~LOGFS_FEATURES_RO_COMPAT) &&
+                        !read_only)
+                return -EIO;
+
+        mutex_init(&super->s_dirop_mutex);
+        mutex_init(&super->s_object_alias_mutex);
+        INIT_LIST_HEAD(&super->s_freeing_list);
+
+        ret = logfs_init_rw(sb);
+        if (ret)
+                return ret;
+
+        ret = logfs_init_areas(sb);
+        if (ret)
+                return ret;
+
+        ret = logfs_init_gc(sb);
+        if (ret)
+                return ret;
+
+        ret = logfs_init_journal(sb);
+        if (ret)
+                return ret;
+
+        return 0;
+}
+
+static void logfs_kill_sb(struct super_block *sb)
+{
+        struct logfs_super *super = logfs_super(sb);
+
+        log_super("LogFS: Start unmounting\n");
+        /* Alias entries slow down mount, so evict as many as possible */
+        sync_filesystem(sb);
+        logfs_write_anchor(sb);
+
+        /*
+         * From this point on alias entries are simply dropped - and any
+         * writes to the object store are considered bugs.
+         */
+        super->s_flags |= LOGFS_SB_FLAG_SHUTDOWN;
+        log_super("LogFS: Now in shutdown\n");
+        generic_shutdown_super(sb);
+
+        BUG_ON(super->s_dirty_used_bytes || super->s_dirty_free_bytes);
+
+        logfs_cleanup_gc(sb);
+        logfs_cleanup_journal(sb);
+        logfs_cleanup_areas(sb);
+        logfs_cleanup_rw(sb);
+        if (super->s_erase_page)
+                __free_page(super->s_erase_page);
+        super->s_devops->put_device(sb);
+        logfs_mempool_destroy(super->s_btree_pool);
+        logfs_mempool_destroy(super->s_alias_pool);
+        kfree(super);
+        log_super("LogFS: Finished unmounting\n");
+}
+
+int logfs_get_sb_device(struct file_system_type *type, int flags,
+                struct mtd_info *mtd, struct block_device *bdev,
+                const struct logfs_device_ops *devops, struct vfsmount *mnt)
+{
+        struct logfs_super *super;
+        struct super_block *sb;
+        int err = -ENOMEM;
+        static int mount_count;
+
+        log_super("LogFS: Start mount %x\n", mount_count++);
+        super = kzalloc(sizeof(*super), GFP_KERNEL);
+        if (!super)
+                goto err0;
+
+        super->s_mtd    = mtd;
+        super->s_bdev   = bdev;
+        err = -EINVAL;
+        sb = sget(type, logfs_sb_test, logfs_sb_set, super);
+        if (IS_ERR(sb))
+                goto err0;
+
+        if (sb->s_root) {
+                /* Device is already in use */
+                err = 0;
+                simple_set_mnt(mnt, sb);
+                goto err0;
+        }
+
+        super->s_devops = devops;
+
+        /*
+         * sb->s_maxbytes is limited to 8TB.  On 32bit systems, the page cache
+         * only covers 16TB and the upper 8TB are used for indirect blocks.
+         * On 64bit system we could bump up the limit, but that would make
+         * the filesystem incompatible with 32bit systems.
+         */
+        sb->s_maxbytes  = (1ull << 43) - 1;
+        sb->s_op        = &logfs_super_operations;
+        sb->s_flags     = flags | MS_NOATIME;
+
+        err = logfs_read_sb(sb, sb->s_flags & MS_RDONLY);
+        if (err)
+                goto err1;
+
+        sb->s_flags |= MS_ACTIVE;
+        err = logfs_get_sb_final(sb, mnt);
+        if (err)
+                goto err1;
+        return 0;
+
+err1:
+        deactivate_locked_super(sb);
+        return err;
+err0:
+        kfree(super);
+        //devops->put_device(sb);
+        return err;
+}
+
+static int logfs_get_sb(struct file_system_type *type, int flags,
+                const char *devname, void *data, struct vfsmount *mnt)
+{
+        ulong mtdnr;
+
+        if (!devname)
+                return logfs_get_sb_bdev(type, flags, devname, mnt);
+        if (strncmp(devname, "mtd", 3))
+                return logfs_get_sb_bdev(type, flags, devname, mnt);
+
+        {
+                char *garbage;
+                mtdnr = simple_strtoul(devname+3, &garbage, 0);
+                if (*garbage)
+                        return -EINVAL;
+        }
+
+        return logfs_get_sb_mtd(type, flags, mtdnr, mnt);
+}
+
+static struct file_system_type logfs_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "logfs",
+        .get_sb         = logfs_get_sb,
+        .kill_sb        = logfs_kill_sb,
+        .fs_flags       = FS_REQUIRES_DEV,
+
+};
+
+static int __init logfs_init(void)
+{
+        int ret;
+
+        emergency_page = alloc_pages(GFP_KERNEL, 0);
+        if (!emergency_page)
+                return -ENOMEM;
+
+        ret = logfs_compr_init();
+        if (ret)
+                goto out1;
+
+        ret = logfs_init_inode_cache();
+        if (ret)
+                goto out2;
+
+        return register_filesystem(&logfs_fs_type);
+out2:
+        logfs_compr_exit();
+out1:
+        __free_pages(emergency_page, 0);
+        return ret;
+}
+
+static void __exit logfs_exit(void)
+{
+        unregister_filesystem(&logfs_fs_type);
+        logfs_destroy_inode_cache();
+        logfs_compr_exit();
+        __free_pages(emergency_page, 0);
+}
+
+module_init(logfs_init);
+module_exit(logfs_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Joern Engel <joern@logfs.org>");
+MODULE_DESCRIPTION("scalable flash filesystem");
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 74ea82d72164..756f8c93780c 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -17,8 +17,10 @@
 #include <linux/init.h>
 #include <linux/highuid.h>
 #include <linux/vfs.h>
+#include <linux/writeback.h>
 
-static int minix_write_inode(struct inode * inode, int wait);
+static int minix_write_inode(struct inode *inode,
+                struct writeback_control *wbc);
 static int minix_statfs(struct dentry *dentry, struct kstatfs *buf);
 static int minix_remount (struct super_block * sb, int * flags, char * data);
 
@@ -552,7 +554,7 @@ static struct buffer_head * V2_minix_update_inode(struct inode * inode)
         return bh;
 }
 
-static int minix_write_inode(struct inode *inode, int wait)
+static int minix_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int err = 0;
         struct buffer_head *bh;
@@ -563,7 +565,7 @@ static int minix_write_inode(struct inode *inode, int wait)
                 bh = V2_minix_update_inode(inode);
         if (!bh)
                 return -EIO;
-        if (wait && buffer_dirty(bh)) {
+        if (wbc->sync_mode == WB_SYNC_ALL && buffer_dirty(bh)) {
                 sync_dirty_buffer(bh);
                 if (buffer_req(bh) && !buffer_uptodate(bh)) {
                         printk("IO error syncing minix inode [%s:%08lx]\n",
diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
index 82d6554b02fe..282e15ad8cd8 100644
--- a/fs/minix/itree_v1.c
+++ b/fs/minix/itree_v1.c
@@ -1,4 +1,5 @@
 #include <linux/buffer_head.h>
+#include <linux/slab.h>
 #include "minix.h"
 
 enum {DEPTH = 3, DIRECT = 7};   /* Only double indirect */
diff --git a/fs/mpage.c b/fs/mpage.c
index 42381bd6543b..fd56ca2ea556 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -16,6 +16,7 @@
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/kdev_t.h>
+#include <linux/gfp.h>
 #include <linux/bio.h>
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
@@ -561,7 +562,7 @@ page_is_mapped:
         if (page->index >= end_index) {
                 /*
                  * The page straddles i_size.  It must be zeroed out on each
-                 * and every writepage invokation because it may be mmapped.
+                 * and every writepage invocation because it may be mmapped.
                  * "A file is mapped in multiples of the page size.  For a file
                  * that is not a multiple of the page size, the remaining memory
                  * is zeroed when mapped, and writes to that region are not
diff --git a/fs/namei.c b/fs/namei.c
index 68921d9b5302..a7dce91a7e42 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -19,7 +19,6 @@
 #include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/namei.h>
-#include <linux/quotaops.h>
 #include <linux/pagemap.h>
 #include <linux/fsnotify.h>
 #include <linux/personality.h>
@@ -232,6 +231,7 @@ int generic_permission(struct inode *inode, int mask,
         /*
          * Searching includes executable on directories, else just read.
          */
+        mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
         if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
                 if (capable(CAP_DAC_READ_SEARCH))
                         return 0;
@@ -497,8 +497,6 @@ static int link_path_walk(const char *, struct nameidata *);
 
 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
 {
-        int res = 0;
-        char *name;
         if (IS_ERR(link))
                 goto fail;
 
@@ -509,22 +507,7 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l
                 path_get(&nd->root);
         }
 
-        res = link_path_walk(link, nd);
-        if (nd->depth || res || nd->last_type!=LAST_NORM)
-                return res;
-        /*
-         * If it is an iterative symlinks resolution in open_namei() we
-         * have to copy the last component. And all that crap because of
-         * bloody create() on broken symlinks. Furrfu...
-         */
-        name = __getname();
-        if (unlikely(!name)) {
-                path_put(&nd->path);
-                return -ENOMEM;
-        }
-        strcpy(name, nd->last.name);
-        nd->last.name = name;
-        return 0;
+        return link_path_walk(link, nd);
 fail:
         path_put(&nd->path);
         return PTR_ERR(link);
@@ -546,10 +529,10 @@ static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
         nd->path.dentry = path->dentry;
 }
 
-static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
+static __always_inline int
+__do_follow_link(struct path *path, struct nameidata *nd, void **p)
 {
         int error;
-        void *cookie;
         struct dentry *dentry = path->dentry;
 
         touch_atime(path->mnt, dentry);
@@ -560,9 +543,10 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
                 dget(dentry);
         }
         mntget(path->mnt);
-        cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
-        error = PTR_ERR(cookie);
-        if (!IS_ERR(cookie)) {
+        nd->last_type = LAST_BIND;
+        *p = dentry->d_inode->i_op->follow_link(dentry, nd);
+        error = PTR_ERR(*p);
+        if (!IS_ERR(*p)) {
                 char *s = nd_get_link(nd);
                 error = 0;
                 if (s)
@@ -572,8 +556,6 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
                         if (error)
                                 path_put(&nd->path);
                 }
-                if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, nd, cookie);
         }
         return error;
 }
@@ -587,6 +569,7 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
  */
 static inline int do_follow_link(struct path *path, struct nameidata *nd)
 {
+        void *cookie;
         int err = -ELOOP;
         if (current->link_count >= MAX_NESTED_LINKS)
                 goto loop;
@@ -600,7 +583,9 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
         current->link_count++;
         current->total_link_count++;
         nd->depth++;
-        err = __do_follow_link(path, nd);
+        err = __do_follow_link(path, nd, &cookie);
+        if (!IS_ERR(cookie) && path->dentry->d_inode->i_op->put_link)
+                path->dentry->d_inode->i_op->put_link(path->dentry, nd, cookie);
         path_put(path);
         current->link_count--;
         nd->depth--;
@@ -687,33 +672,20 @@ static __always_inline void follow_dotdot(struct nameidata *nd)
         set_root(nd);
 
         while(1) {
-                struct vfsmount *parent;
                 struct dentry *old = nd->path.dentry;
 
                 if (nd->path.dentry == nd->root.dentry &&
                     nd->path.mnt == nd->root.mnt) {
                         break;
                 }
-                spin_lock(&dcache_lock);
                 if (nd->path.dentry != nd->path.mnt->mnt_root) {
-                        nd->path.dentry = dget(nd->path.dentry->d_parent);
-                        spin_unlock(&dcache_lock);
+                        /* rare case of legitimate dget_parent()... */
+                        nd->path.dentry = dget_parent(nd->path.dentry);
                         dput(old);
                         break;
                 }
-                spin_unlock(&dcache_lock);
-                spin_lock(&vfsmount_lock);
-                parent = nd->path.mnt->mnt_parent;
-                if (parent == nd->path.mnt) {
-                        spin_unlock(&vfsmount_lock);
+                if (!follow_up(&nd->path))
                         break;
-                }
-                mntget(parent);
-                nd->path.dentry = dget(nd->path.mnt->mnt_mountpoint);
-                spin_unlock(&vfsmount_lock);
-                dput(old);
-                mntput(nd->path.mnt);
-                nd->path.mnt = parent;
         }
         follow_mount(&nd->path);
 }
@@ -821,6 +793,17 @@ fail:
 }
 
 /*
+ * This is a temporary kludge to deal with "automount" symlinks; proper
+ * solution is to trigger them on follow_mount(), so that do_lookup()
+ * would DTRT.  To be killed before 2.6.34-final.
+ */
+static inline int follow_on_final(struct inode *inode, unsigned lookup_flags)
+{
+        return inode && unlikely(inode->i_op->follow_link) &&
+                ((lookup_flags & LOOKUP_FOLLOW) || S_ISDIR(inode->i_mode));
+}
+
+/*
  * Name resolution.
  * This is the basic name resolution function, turning a pathname into
  * the final dentry. We expect 'base' to be positive and a directory.
@@ -940,8 +923,7 @@ last_component:
                 if (err)
                         break;
                 inode = next.dentry->d_inode;
-                if ((lookup_flags & LOOKUP_FOLLOW)
-                    && inode && inode->i_op->follow_link) {
+                if (follow_on_final(inode, lookup_flags)) {
                         err = do_follow_link(&next, nd);
                         if (err)
                                 goto return_err;
@@ -1335,7 +1317,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
                 return -ENOENT;
 
         BUG_ON(victim->d_parent->d_inode != dir);
-        audit_inode_child(victim->d_name.name, victim, dir);
+        audit_inode_child(victim, dir);
 
         error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
         if (error)
@@ -1376,22 +1358,6 @@ static inline int may_create(struct inode *dir, struct dentry *child)
         return inode_permission(dir, MAY_WRITE | MAY_EXEC);
 }
 
-/* 
- * O_DIRECTORY translates into forcing a directory lookup.
- */
-static inline int lookup_flags(unsigned int f)
-{
-        unsigned long retval = LOOKUP_FOLLOW;
-
-        if (f & O_NOFOLLOW)
-                retval &= ~LOOKUP_FOLLOW;
-        
-        if (f & O_DIRECTORY)
-                retval |= LOOKUP_DIRECTORY;
-
-        return retval;
-}
-
 /*
  * p1 and p2 should be directories on the same fs.
  */
@@ -1449,7 +1415,6 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
         error = security_inode_create(dir, dentry, mode);
         if (error)
                 return error;
-        vfs_dq_init(dir);
         error = dir->i_op->create(dir, dentry, mode, nd);
         if (!error)
                 fsnotify_create(dir, dentry);
@@ -1491,7 +1456,7 @@ int may_open(struct path *path, int acc_mode, int flag)
          * An append-only file must be opened in append mode for writing.
          */
         if (IS_APPEND(inode)) {
-                if  ((flag & FMODE_WRITE) && !(flag & O_APPEND))
+                if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
                         return -EPERM;
                 if (flag & O_TRUNC)
                         return -EPERM;
@@ -1535,7 +1500,7 @@ static int handle_truncate(struct path *path)
  * what get passed to sys_open().
  */
 static int __open_namei_create(struct nameidata *nd, struct path *path,
-                                int flag, int mode)
+                                int open_flag, int mode)
 {
         int error;
         struct dentry *dir = nd->path.dentry;
@@ -1553,7 +1518,7 @@ out_unlock:
         if (error)
                 return error;
         /* Don't check for write permission, don't truncate */
-        return may_open(&nd->path, 0, flag & ~O_TRUNC);
+        return may_open(&nd->path, 0, open_flag & ~O_TRUNC);
 }
 
 /*
@@ -1591,125 +1556,133 @@ static int open_will_truncate(int flag, struct inode *inode)
         return (flag & O_TRUNC);
 }
 
-/*
- * Note that the low bits of the passed in "open_flag"
- * are not the same as in the local variable "flag". See
- * open_to_namei_flags() for more details.
- */
-struct file *do_filp_open(int dfd, const char *pathname,
-                int open_flag, int mode, int acc_mode)
+static struct file *finish_open(struct nameidata *nd,
+                                int open_flag, int acc_mode)
 {
         struct file *filp;
-        struct nameidata nd;
-        int error;
-        struct path path, save;
-        struct dentry *dir;
-        int count = 0;
         int will_truncate;
-        int flag = open_to_namei_flags(open_flag);
+        int error;
 
+        will_truncate = open_will_truncate(open_flag, nd->path.dentry->d_inode);
+        if (will_truncate) {
+                error = mnt_want_write(nd->path.mnt);
+                if (error)
+                        goto exit;
+        }
+        error = may_open(&nd->path, acc_mode, open_flag);
+        if (error) {
+                if (will_truncate)
+                        mnt_drop_write(nd->path.mnt);
+                goto exit;
+        }
+        filp = nameidata_to_filp(nd);
+        if (!IS_ERR(filp)) {
+                error = ima_file_check(filp, acc_mode);
+                if (error) {
+                        fput(filp);
+                        filp = ERR_PTR(error);
+                }
+        }
+        if (!IS_ERR(filp)) {
+                if (will_truncate) {
+                        error = handle_truncate(&nd->path);
+                        if (error) {
+                                fput(filp);
+                                filp = ERR_PTR(error);
+                        }
+                }
+        }
         /*
-         * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
-         * check for O_DSYNC if the need any syncing at all we enforce it's
-         * always set instead of having to deal with possibly weird behaviour
-         * for malicious applications setting only __O_SYNC.
+         * It is now safe to drop the mnt write
+         * because the filp has had a write taken
+         * on its behalf.
          */
-        if (open_flag & __O_SYNC)
-                open_flag |= O_DSYNC;
-
-        if (!acc_mode)
-                acc_mode = MAY_OPEN | ACC_MODE(flag);
+        if (will_truncate)
+                mnt_drop_write(nd->path.mnt);
+        return filp;
 
-        /* O_TRUNC implies we need access checks for write permissions */
-        if (flag & O_TRUNC)
-                acc_mode |= MAY_WRITE;
+exit:
+        if (!IS_ERR(nd->intent.open.file))
+                release_open_intent(nd);
+        path_put(&nd->path);
+        return ERR_PTR(error);
+}
 
-        /* Allow the LSM permission hook to distinguish append 
-           access from general write access. */
-        if (flag & O_APPEND)
-                acc_mode |= MAY_APPEND;
+static struct file *do_last(struct nameidata *nd, struct path *path,
+                            int open_flag, int acc_mode,
+                            int mode, const char *pathname)
+{
+        struct dentry *dir = nd->path.dentry;
+        struct file *filp;
+        int error = -EISDIR;
 
-        /*
-         * The simplest case - just a plain lookup.
-         */
-        if (!(flag & O_CREAT)) {
-                filp = get_empty_filp();
-
-                if (filp == NULL)
-                        return ERR_PTR(-ENFILE);
-                nd.intent.open.file = filp;
-                filp->f_flags = open_flag;
-                nd.intent.open.flags = flag;
-                nd.intent.open.create_mode = 0;
-                error = do_path_lookup(dfd, pathname,
-                                        lookup_flags(flag)|LOOKUP_OPEN, &nd);
-                if (IS_ERR(nd.intent.open.file)) {
-                        if (error == 0) {
-                                error = PTR_ERR(nd.intent.open.file);
-                                path_put(&nd.path);
+        switch (nd->last_type) {
+        case LAST_DOTDOT:
+                follow_dotdot(nd);
+                dir = nd->path.dentry;
+                if (nd->path.mnt->mnt_sb->s_type->fs_flags & FS_REVAL_DOT) {
+                        if (!dir->d_op->d_revalidate(dir, nd)) {
+                                error = -ESTALE;
+                                goto exit;
                         }
-                } else if (error)
-                        release_open_intent(&nd);
-                if (error)
-                        return ERR_PTR(error);
+                }
+                /* fallthrough */
+        case LAST_DOT:
+        case LAST_ROOT:
+                if (open_flag & O_CREAT)
+                        goto exit;
+                /* fallthrough */
+        case LAST_BIND:
+                audit_inode(pathname, dir);
                 goto ok;
         }
 
-        /*
-         * Create - we need to know the parent.
-         */
-        error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
-        if (error)
-                return ERR_PTR(error);
-        error = path_walk(pathname, &nd);
-        if (error) {
-                if (nd.root.mnt)
-                        path_put(&nd.root);
-                return ERR_PTR(error);
+        /* trailing slashes? */
+        if (nd->last.name[nd->last.len]) {
+                if (open_flag & O_CREAT)
+                        goto exit;
+                nd->flags |= LOOKUP_DIRECTORY;
         }
-        if (unlikely(!audit_dummy_context()))
-                audit_inode(pathname, nd.path.dentry);
 
-        /*
-         * We have the parent and last component. First of all, check
-         * that we are not asked to creat(2) an obvious directory - that
-         * will not do.
-         */
-        error = -EISDIR;
-        if (nd.last_type != LAST_NORM || nd.last.name[nd.last.len])
-                goto exit_parent;
+        /* just plain open? */
+        if (!(open_flag & O_CREAT)) {
+                error = do_lookup(nd, &nd->last, path);
+                if (error)
+                        goto exit;
+                error = -ENOENT;
+                if (!path->dentry->d_inode)
+                        goto exit_dput;
+                if (path->dentry->d_inode->i_op->follow_link)
+                        return NULL;
+                error = -ENOTDIR;
+                if (nd->flags & LOOKUP_DIRECTORY) {
+                        if (!path->dentry->d_inode->i_op->lookup)
+                                goto exit_dput;
+                }
+                path_to_nameidata(path, nd);
+                audit_inode(pathname, nd->path.dentry);
+                goto ok;
+        }
 
-        error = -ENFILE;
-        filp = get_empty_filp();
-        if (filp == NULL)
-                goto exit_parent;
-        nd.intent.open.file = filp;
-        filp->f_flags = open_flag;
-        nd.intent.open.flags = flag;
-        nd.intent.open.create_mode = mode;
-        dir = nd.path.dentry;
-        nd.flags &= ~LOOKUP_PARENT;
-        nd.flags |= LOOKUP_CREATE | LOOKUP_OPEN;
-        if (flag & O_EXCL)
-                nd.flags |= LOOKUP_EXCL;
+        /* OK, it's O_CREAT */
         mutex_lock(&dir->d_inode->i_mutex);
-        path.dentry = lookup_hash(&nd);
-        path.mnt = nd.path.mnt;
 
-do_last:
-        error = PTR_ERR(path.dentry);
-        if (IS_ERR(path.dentry)) {
+        path->dentry = lookup_hash(nd);
+        path->mnt = nd->path.mnt;
+
+        error = PTR_ERR(path->dentry);
+        if (IS_ERR(path->dentry)) {
                 mutex_unlock(&dir->d_inode->i_mutex);
                 goto exit;
         }
 
-        if (IS_ERR(nd.intent.open.file)) {
-                error = PTR_ERR(nd.intent.open.file);
+        if (IS_ERR(nd->intent.open.file)) {
+                error = PTR_ERR(nd->intent.open.file);
                 goto exit_mutex_unlock;
         }
 
         /* Negative dentry, just create the file */
-        if (!path.dentry->d_inode) {
+        if (!path->dentry->d_inode) {
                 /*
                  * This write is needed to ensure that a
                  * ro->rw transition does not occur between
@@ -1717,21 +1690,18 @@ do_last:
                  * a permanent write count is taken through
                  * the 'struct file' in nameidata_to_filp().
                  */
-                error = mnt_want_write(nd.path.mnt);
+                error = mnt_want_write(nd->path.mnt);
                 if (error)
                         goto exit_mutex_unlock;
-                error = __open_namei_create(&nd, &path, flag, mode);
+                error = __open_namei_create(nd, path, open_flag, mode);
                 if (error) {
-                        mnt_drop_write(nd.path.mnt);
+                        mnt_drop_write(nd->path.mnt);
                         goto exit;
                 }
-                filp = nameidata_to_filp(&nd);
-                mnt_drop_write(nd.path.mnt);
-                if (nd.root.mnt)
-                        path_put(&nd.root);
+                filp = nameidata_to_filp(nd);
+                mnt_drop_write(nd->path.mnt);
                 if (!IS_ERR(filp)) {
-                        error = ima_path_check(&filp->f_path, filp->f_mode &
-                                       (MAY_READ | MAY_WRITE | MAY_EXEC));
+                        error = ima_file_check(filp, acc_mode);
                         if (error) {
                                 fput(filp);
                                 filp = ERR_PTR(error);
@@ -1744,157 +1714,182 @@ do_last:
          * It already exists.
          */
         mutex_unlock(&dir->d_inode->i_mutex);
-        audit_inode(pathname, path.dentry);
+        audit_inode(pathname, path->dentry);
 
         error = -EEXIST;
-        if (flag & O_EXCL)
+        if (open_flag & O_EXCL)
                 goto exit_dput;
 
-        if (__follow_mount(&path)) {
+        if (__follow_mount(path)) {
                 error = -ELOOP;
-                if (flag & O_NOFOLLOW)
+                if (open_flag & O_NOFOLLOW)
                         goto exit_dput;
         }
 
         error = -ENOENT;
-        if (!path.dentry->d_inode)
+        if (!path->dentry->d_inode)
                 goto exit_dput;
-        if (path.dentry->d_inode->i_op->follow_link)
-                goto do_link;
 
-        path_to_nameidata(&path, &nd);
+        if (path->dentry->d_inode->i_op->follow_link)
+                return NULL;
+
+        path_to_nameidata(path, nd);
         error = -EISDIR;
-        if (S_ISDIR(path.dentry->d_inode->i_mode))
+        if (S_ISDIR(path->dentry->d_inode->i_mode))
                 goto exit;
 ok:
-        /*
-         * Consider:
-         * 1. may_open() truncates a file
-         * 2. a rw->ro mount transition occurs
-         * 3. nameidata_to_filp() fails due to
-         *    the ro mount.
-         * That would be inconsistent, and should
-         * be avoided. Taking this mnt write here
-         * ensures that (2) can not occur.
-         */
-        will_truncate = open_will_truncate(flag, nd.path.dentry->d_inode);
-        if (will_truncate) {
-                error = mnt_want_write(nd.path.mnt);
-                if (error)
-                        goto exit;
-        }
-        error = may_open(&nd.path, acc_mode, flag);
-        if (error) {
-                if (will_truncate)
-                        mnt_drop_write(nd.path.mnt);
-                goto exit;
-        }
-        filp = nameidata_to_filp(&nd);
-        if (!IS_ERR(filp)) {
-                error = ima_path_check(&filp->f_path, filp->f_mode &
-                               (MAY_READ | MAY_WRITE | MAY_EXEC));
-                if (error) {
-                        fput(filp);
-                        filp = ERR_PTR(error);
-                }
-        }
-        if (!IS_ERR(filp)) {
-                if (acc_mode & MAY_WRITE)
-                        vfs_dq_init(nd.path.dentry->d_inode);
-
-                if (will_truncate) {
-                        error = handle_truncate(&nd.path);
-                        if (error) {
-                                fput(filp);
-                                filp = ERR_PTR(error);
-                        }
-                }
-        }
-        /*
-         * It is now safe to drop the mnt write
-         * because the filp has had a write taken
-         * on its behalf.
-         */
-        if (will_truncate)
-                mnt_drop_write(nd.path.mnt);
-        if (nd.root.mnt)
-                path_put(&nd.root);
+        filp = finish_open(nd, open_flag, acc_mode);
         return filp;
 
 exit_mutex_unlock:
         mutex_unlock(&dir->d_inode->i_mutex);
 exit_dput:
-        path_put_conditional(&path, &nd);
+        path_put_conditional(path, nd);
 exit:
-        if (!IS_ERR(nd.intent.open.file))
-                release_open_intent(&nd);
-exit_parent:
-        if (nd.root.mnt)
-                path_put(&nd.root);
-        path_put(&nd.path);
+        if (!IS_ERR(nd->intent.open.file))
+                release_open_intent(nd);
+        path_put(&nd->path);
         return ERR_PTR(error);
+}
+
+/*
+ * Note that the low bits of the passed in "open_flag"
+ * are not the same as in the local variable "flag". See
+ * open_to_namei_flags() for more details.
+ */
+struct file *do_filp_open(int dfd, const char *pathname,
+                int open_flag, int mode, int acc_mode)
+{
+        struct file *filp;
+        struct nameidata nd;
+        int error;
+        struct path path;
+        int count = 0;
+        int flag = open_to_namei_flags(open_flag);
+        int force_reval = 0;
+
+        if (!(open_flag & O_CREAT))
+                mode = 0;
 
-do_link:
-        error = -ELOOP;
-        if (flag & O_NOFOLLOW)
-                goto exit_dput;
         /*
-         * This is subtle. Instead of calling do_follow_link() we do the
-         * thing by hands. The reason is that this way we have zero link_count
-         * and path_walk() (called from ->follow_link) honoring LOOKUP_PARENT.
-         * After that we have the parent and last component, i.e.
-         * we are in the same situation as after the first path_walk().
-         * Well, almost - if the last component is normal we get its copy
-         * stored in nd->last.name and we will have to putname() it when we
-         * are done. Procfs-like symlinks just set LAST_BIND.
+         * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
+         * check for O_DSYNC if the need any syncing at all we enforce it's
+         * always set instead of having to deal with possibly weird behaviour
+         * for malicious applications setting only __O_SYNC.
          */
-        nd.flags |= LOOKUP_PARENT;
-        error = security_inode_follow_link(path.dentry, &nd);
+        if (open_flag & __O_SYNC)
+                open_flag |= O_DSYNC;
+
+        if (!acc_mode)
+                acc_mode = MAY_OPEN | ACC_MODE(open_flag);
+
+        /* O_TRUNC implies we need access checks for write permissions */
+        if (open_flag & O_TRUNC)
+                acc_mode |= MAY_WRITE;
+
+        /* Allow the LSM permission hook to distinguish append 
+           access from general write access. */
+        if (open_flag & O_APPEND)
+                acc_mode |= MAY_APPEND;
+
+        /* find the parent */
+reval:
+        error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
         if (error)
-                goto exit_dput;
-        save = nd.path;
-        path_get(&save);
-        error = __do_follow_link(&path, &nd);
-        if (error == -ESTALE) {
-                /* nd.path had been dropped */
-                nd.path = save;
-                path_get(&nd.path);
+                return ERR_PTR(error);
+        if (force_reval)
                 nd.flags |= LOOKUP_REVAL;
-                error = __do_follow_link(&path, &nd);
-        }
-        path_put(&save);
-        path_put(&path);
+
+        current->total_link_count = 0;
+        error = link_path_walk(pathname, &nd);
         if (error) {
-                /* Does someone understand code flow here? Or it is only
-                 * me so stupid? Anathema to whoever designed this non-sense
-                 * with "intent.open".
-                 */
-                release_open_intent(&nd);
-                if (nd.root.mnt)
-                        path_put(&nd.root);
-                return ERR_PTR(error);
+                filp = ERR_PTR(error);
+                goto out;
         }
+        if (unlikely(!audit_dummy_context()) && (open_flag & O_CREAT))
+                audit_inode(pathname, nd.path.dentry);
+
+        /*
+         * We have the parent and last component.
+         */
+
+        error = -ENFILE;
+        filp = get_empty_filp();
+        if (filp == NULL)
+                goto exit_parent;
+        nd.intent.open.file = filp;
+        filp->f_flags = open_flag;
+        nd.intent.open.flags = flag;
+        nd.intent.open.create_mode = mode;
         nd.flags &= ~LOOKUP_PARENT;
-        if (nd.last_type == LAST_BIND)
-                goto ok;
-        error = -EISDIR;
-        if (nd.last_type != LAST_NORM)
-                goto exit;
-        if (nd.last.name[nd.last.len]) {
-                __putname(nd.last.name);
-                goto exit;
+        nd.flags |= LOOKUP_OPEN;
+        if (open_flag & O_CREAT) {
+                nd.flags |= LOOKUP_CREATE;
+                if (open_flag & O_EXCL)
+                        nd.flags |= LOOKUP_EXCL;
+        }
+        if (open_flag & O_DIRECTORY)
+                nd.flags |= LOOKUP_DIRECTORY;
+        filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname);
+        while (unlikely(!filp)) { /* trailing symlink */
+                struct path holder;
+                struct inode *inode = path.dentry->d_inode;
+                void *cookie;
+                error = -ELOOP;
+                /* S_ISDIR part is a temporary automount kludge */
+                if ((open_flag & O_NOFOLLOW) && !S_ISDIR(inode->i_mode))
+                        goto exit_dput;
+                if (count++ == 32)
+                        goto exit_dput;
+                /*
+                 * This is subtle. Instead of calling do_follow_link() we do
+                 * the thing by hands. The reason is that this way we have zero
+                 * link_count and path_walk() (called from ->follow_link)
+                 * honoring LOOKUP_PARENT.  After that we have the parent and
+                 * last component, i.e. we are in the same situation as after
+                 * the first path_walk().  Well, almost - if the last component
+                 * is normal we get its copy stored in nd->last.name and we will
+                 * have to putname() it when we are done. Procfs-like symlinks
+                 * just set LAST_BIND.
+                 */
+                nd.flags |= LOOKUP_PARENT;
+                error = security_inode_follow_link(path.dentry, &nd);
+                if (error)
+                        goto exit_dput;
+                error = __do_follow_link(&path, &nd, &cookie);
+                if (unlikely(error)) {
+                        /* nd.path had been dropped */
+                        if (!IS_ERR(cookie) && inode->i_op->put_link)
+                                inode->i_op->put_link(path.dentry, &nd, cookie);
+                        path_put(&path);
+                        release_open_intent(&nd);
+                        filp = ERR_PTR(error);
+                        goto out;
+                }
+                holder = path;
+                nd.flags &= ~LOOKUP_PARENT;
+                filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname);
+                if (inode->i_op->put_link)
+                        inode->i_op->put_link(holder.dentry, &nd, cookie);
+                path_put(&holder);
         }
-        error = -ELOOP;
-        if (count++==32) {
-                __putname(nd.last.name);
-                goto exit;
+out:
+        if (nd.root.mnt)
+                path_put(&nd.root);
+        if (filp == ERR_PTR(-ESTALE) && !force_reval) {
+                force_reval = 1;
+                goto reval;
         }
-        dir = nd.path.dentry;
-        mutex_lock(&dir->d_inode->i_mutex);
-        path.dentry = lookup_hash(&nd);
-        path.mnt = nd.path.mnt;
-        __putname(nd.last.name);
-        goto do_last;
+        return filp;
+
+exit_dput:
+        path_put_conditional(&path, &nd);
+        if (!IS_ERR(nd.intent.open.file))
+                release_open_intent(&nd);
+exit_parent:
+        path_put(&nd.path);
+        filp = ERR_PTR(error);
+        goto out;
 }
 
 /**
@@ -1988,7 +1983,6 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
         if (error)
                 return error;
 
-        vfs_dq_init(dir);
         error = dir->i_op->mknod(dir, dentry, mode, dev);
         if (!error)
                 fsnotify_create(dir, dentry);
@@ -2087,7 +2081,6 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         if (error)
                 return error;
 
-        vfs_dq_init(dir);
         error = dir->i_op->mkdir(dir, dentry, mode);
         if (!error)
                 fsnotify_mkdir(dir, dentry);
@@ -2173,8 +2166,6 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
         if (!dir->i_op->rmdir)
                 return -EPERM;
 
-        vfs_dq_init(dir);
-
         mutex_lock(&dentry->d_inode->i_mutex);
         dentry_unhash(dentry);
         if (d_mountpoint(dentry))
@@ -2260,15 +2251,16 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
         if (!dir->i_op->unlink)
                 return -EPERM;
 
-        vfs_dq_init(dir);
-
         mutex_lock(&dentry->d_inode->i_mutex);
         if (d_mountpoint(dentry))
                 error = -EBUSY;
         else {
                 error = security_inode_unlink(dir, dentry);
-                if (!error)
+                if (!error) {
                         error = dir->i_op->unlink(dir, dentry);
+                        if (!error)
+                                dentry->d_inode->i_flags |= S_DEAD;
+                }
         }
         mutex_unlock(&dentry->d_inode->i_mutex);
 
@@ -2371,7 +2363,6 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
         if (error)
                 return error;
 
-        vfs_dq_init(dir);
         error = dir->i_op->symlink(dir, dentry, oldname);
         if (!error)
                 fsnotify_create(dir, dentry);
@@ -2455,7 +2446,6 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
                 return error;
 
         mutex_lock(&inode->i_mutex);
-        vfs_dq_init(dir);
         error = dir->i_op->link(old_dentry, dir, new_dentry);
         mutex_unlock(&inode->i_mutex);
         if (!error)
@@ -2556,7 +2546,7 @@ SYSCALL_DEFINE2(link, const char __user *, oldname, const char __user *, newname
  *      e) conversion from fhandle to dentry may come in the wrong moment - when
  *         we are removing the target. Solution: we will have to grab ->i_mutex
  *         in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
- *         ->i_mutex on parents, which works but leads to some truely excessive
+ *         ->i_mutex on parents, which works but leads to some truly excessive
  *         locking].
  */
 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
@@ -2621,6 +2611,8 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
         else
                 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
         if (!error) {
+                if (target)
+                        target->i_flags |= S_DEAD;
                 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
                         d_move(old_dentry, new_dentry);
         }
@@ -2654,20 +2646,15 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (!old_dir->i_op->rename)
                 return -EPERM;
 
-        vfs_dq_init(old_dir);
-        vfs_dq_init(new_dir);
-
         old_name = fsnotify_oldname_init(old_dentry->d_name.name);
 
         if (is_dir)
                 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
         else
                 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
-        if (!error) {
-                const char *new_name = old_dentry->d_name.name;
-                fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
+        if (!error)
+                fsnotify_move(old_dir, new_dir, old_name, is_dir,
                               new_dentry->d_inode, old_dentry);
-        }
         fsnotify_oldname_free(old_name);
 
         return error;
diff --git a/fs/namespace.c b/fs/namespace.c
index 7d70d63ceb29..8174c8ab5c70 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -573,7 +573,7 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
                         mnt->mnt_master = old;
                         CLEAR_MNT_SHARED(mnt);
                 } else if (!(flag & CL_PRIVATE)) {
-                        if ((flag & CL_PROPAGATION) || IS_MNT_SHARED(old))
+                        if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
                                 list_add(&mnt->mnt_share, &old->mnt_share);
                         if (IS_MNT_SLAVE(old))
                                 list_add(&mnt->mnt_slave, &old->mnt_slave);
@@ -737,6 +737,21 @@ static void m_stop(struct seq_file *m, void *v)
         up_read(&namespace_sem);
 }
 
+int mnt_had_events(struct proc_mounts *p)
+{
+        struct mnt_namespace *ns = p->ns;
+        int res = 0;
+
+        spin_lock(&vfsmount_lock);
+        if (p->event != ns->event) {
+                p->event = ns->event;
+                res = 1;
+        }
+        spin_unlock(&vfsmount_lock);
+
+        return res;
+}
+
 struct proc_fs_info {
         int flag;
         const char *str;
@@ -965,10 +980,12 @@ EXPORT_SYMBOL(may_umount_tree);
 int may_umount(struct vfsmount *mnt)
 {
         int ret = 1;
+        down_read(&namespace_sem);
         spin_lock(&vfsmount_lock);
         if (propagate_mount_busy(mnt, 2))
                 ret = 0;
         spin_unlock(&vfsmount_lock);
+        up_read(&namespace_sem);
         return ret;
 }
 
@@ -1119,8 +1136,15 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
 {
         struct path path;
         int retval;
+        int lookup_flags = 0;
+
+        if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
+                return -EINVAL;
+
+        if (!(flags & UMOUNT_NOFOLLOW))
+                lookup_flags |= LOOKUP_FOLLOW;
 
-        retval = user_path(name, &path);
+        retval = user_path_at(AT_FDCWD, name, lookup_flags, &path);
         if (retval)
                 goto out;
         retval = -EINVAL;
@@ -1244,6 +1268,21 @@ void drop_collected_mounts(struct vfsmount *mnt)
         release_mounts(&umount_list);
 }
 
+int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
+                   struct vfsmount *root)
+{
+        struct vfsmount *mnt;
+        int res = f(root, arg);
+        if (res)
+                return res;
+        list_for_each_entry(mnt, &root->mnt_list, mnt_list) {
+                res = f(mnt, arg);
+                if (res)
+                        return res;
+        }
+        return 0;
+}
+
 static void cleanup_group_ids(struct vfsmount *mnt, struct vfsmount *end)
 {
         struct vfsmount *p;
@@ -1352,12 +1391,12 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt,
         if (err)
                 goto out_cleanup_ids;
 
+        spin_lock(&vfsmount_lock);
+
         if (IS_MNT_SHARED(dest_mnt)) {
                 for (p = source_mnt; p; p = next_mnt(p, source_mnt))
                         set_mnt_shared(p);
         }
-
-        spin_lock(&vfsmount_lock);
         if (parent_path) {
                 detach_mnt(source_mnt, parent_path);
                 attach_mnt(source_mnt, path);
@@ -1534,8 +1573,12 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
                 err = change_mount_flags(path->mnt, flags);
         else
                 err = do_remount_sb(sb, flags, data, 0);
-        if (!err)
+        if (!err) {
+                spin_lock(&vfsmount_lock);
+                mnt_flags |= path->mnt->mnt_flags & MNT_PROPAGATION_MASK;
                 path->mnt->mnt_flags = mnt_flags;
+                spin_unlock(&vfsmount_lock);
+        }
         up_write(&sb->s_umount);
         if (!err) {
                 security_sb_post_remount(path->mnt, flags, data);
@@ -1665,6 +1708,8 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path,
 {
         int err;
 
+        mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL);
+
         down_write(&namespace_sem);
         /* Something was mounted here while we slept */
         while (d_mountpoint(path->dentry) &&
@@ -2306,17 +2351,13 @@ void __init mnt_init(void)
 
 void put_mnt_ns(struct mnt_namespace *ns)
 {
-        struct vfsmount *root;
         LIST_HEAD(umount_list);
 
-        if (!atomic_dec_and_lock(&ns->count, &vfsmount_lock))
+        if (!atomic_dec_and_test(&ns->count))
                 return;
-        root = ns->root;
-        ns->root = NULL;
-        spin_unlock(&vfsmount_lock);
         down_write(&namespace_sem);
         spin_lock(&vfsmount_lock);
-        umount_tree(root, 0, &umount_list);
+        umount_tree(ns->root, 0, &umount_list);
         spin_unlock(&vfsmount_lock);
         up_write(&namespace_sem);
         release_mounts(&umount_list);
diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
index b8b5b30d53f0..7edfcd4d5e52 100644
--- a/fs/ncpfs/dir.c
+++ b/fs/ncpfs/dir.c
@@ -15,7 +15,6 @@
 #include <linux/errno.h>
 #include <linux/stat.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
 #include <asm/uaccess.h>
diff --git a/fs/ncpfs/file.c b/fs/ncpfs/file.c
index 6a7d901f1936..1daabb90e0a5 100644
--- a/fs/ncpfs/file.c
+++ b/fs/ncpfs/file.c
@@ -15,7 +15,6 @@
 #include <linux/fcntl.h>
 #include <linux/stat.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
index cf98da1be23e..fa3385154023 100644
--- a/fs/ncpfs/inode.c
+++ b/fs/ncpfs/inode.c
@@ -526,10 +526,15 @@ static int ncp_fill_super(struct super_block *sb, void *raw_data, int silent)
         sb->s_blocksize_bits = 10;
         sb->s_magic = NCP_SUPER_MAGIC;
         sb->s_op = &ncp_sops;
+        sb->s_bdi = &server->bdi;
 
         server = NCP_SBP(sb);
         memset(server, 0, sizeof(*server));
 
+        error = bdi_setup_and_register(&server->bdi, "ncpfs", BDI_CAP_MAP_COPY);
+        if (error)
+                goto out_bdi;
+
         server->ncp_filp = ncp_filp;
         server->ncp_sock = sock;
         
@@ -719,6 +724,8 @@ out_fput2:
         if (server->info_filp)
                 fput(server->info_filp);
 out_fput:
+        bdi_destroy(&server->bdi);
+out_bdi:
         /* 23/12/1998 Marcin Dalecki <dalecki@cs.net.pl>:
          * 
          * The previously used put_filp(ncp_filp); was bogous, since
@@ -756,6 +763,7 @@ static void ncp_put_super(struct super_block *sb)
         kill_pid(server->m.wdog_pid, SIGTERM, 1);
         put_pid(server->m.wdog_pid);
 
+        bdi_destroy(&server->bdi);
         kfree(server->priv.data);
         kfree(server->auth.object_name);
         vfree(server->rxbuf);
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
index ec8f45f12e05..60a5e2864ea8 100644
--- a/fs/ncpfs/ioctl.c
+++ b/fs/ncpfs/ioctl.c
@@ -15,6 +15,7 @@
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/mount.h>
+#include <linux/slab.h>
 #include <linux/highuid.h>
 #include <linux/smp_lock.h>
 #include <linux/vmalloc.h>
diff --git a/fs/ncpfs/mmap.c b/fs/ncpfs/mmap.c
index 15458decdb8a..56f5b3a0e1ee 100644
--- a/fs/ncpfs/mmap.c
+++ b/fs/ncpfs/mmap.c
@@ -9,12 +9,12 @@
 #include <linux/stat.h>
 #include <linux/time.h>
 #include <linux/kernel.h>
+#include <linux/gfp.h>
 #include <linux/mm.h>
 #include <linux/shm.h>
 #include <linux/errno.h>
 #include <linux/mman.h>
 #include <linux/string.h>
-#include <linux/slab.h>
 #include <linux/fcntl.h>
 #include <linux/ncp_fs.h>
 
diff --git a/fs/ncpfs/sock.c b/fs/ncpfs/sock.c
index e37df8d5fe70..c7ff6c700a6e 100644
--- a/fs/ncpfs/sock.c
+++ b/fs/ncpfs/sock.c
@@ -21,6 +21,7 @@
 #include <linux/mm.h>
 #include <linux/netdevice.h>
 #include <linux/signal.h>
+#include <linux/slab.h>
 #include <net/scm.h>
 #include <net/sock.h>
 #include <linux/ipx.h>
diff --git a/fs/ncpfs/symlink.c b/fs/ncpfs/symlink.c
index e3d26c1bd105..c634fd17b337 100644
--- a/fs/ncpfs/symlink.c
+++ b/fs/ncpfs/symlink.c
@@ -27,6 +27,7 @@
 #include <linux/fs.h>
 #include <linux/ncp_fs.h>
 #include <linux/time.h>
+#include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/stat.h>
 #include "ncplib_kernel.h"
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 59e5673b4597..a43d07e7b924 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -95,8 +95,7 @@ config ROOT_NFS
           Most people say N here.
 
 config NFS_FSCACHE
-        bool "Provide NFS client caching support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        bool "Provide NFS client caching support"
         depends on NFS_FS=m && FSCACHE || NFS_FS=y && FSCACHE=y
         help
           Say Y here if you want NFS data to be cached locally on disc through
diff --git a/fs/nfs/cache_lib.c b/fs/nfs/cache_lib.c
index b4ffd0146ea6..84690319e625 100644
--- a/fs/nfs/cache_lib.c
+++ b/fs/nfs/cache_lib.c
@@ -10,6 +10,7 @@
 #include <linux/moduleparam.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/cache.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 73ab220354df..36dfdae95123 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -118,7 +118,6 @@ nfs4_callback_up(struct svc_serv *serv)
         dprintk("NFS: Callback listener port = %u (af %u)\n",
                         nfs_callback_tcpport, PF_INET);
 
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         ret = svc_create_xprt(serv, "tcp", PF_INET6,
                                 nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
         if (ret > 0) {
@@ -129,7 +128,6 @@ nfs4_callback_up(struct svc_serv *serv)
                 ret = 0;
         else
                 goto out_err;
-#endif  /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
 
         return svc_prepare_thread(serv, &serv->sv_pools[0]);
 
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index d4036be0b589..85a7cfd1b8dd 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -119,6 +119,14 @@ struct cb_recallanyargs {
 };
 
 extern unsigned nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy);
+
+struct cb_recallslotargs {
+        struct sockaddr *crsa_addr;
+        uint32_t        crsa_target_max_slots;
+};
+extern unsigned nfs4_callback_recallslot(struct cb_recallslotargs *args,
+                                          void *dummy);
+
 #endif /* CONFIG_NFS_V4_1 */
 
 extern __be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index defa9b4c470e..a08770a7e857 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -7,6 +7,7 @@
  */
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include "nfs4_fs.h"
 #include "callback.h"
 #include "delegation.h"
@@ -143,44 +144,49 @@ int nfs41_validate_delegation_stateid(struct nfs_delegation *delegation, const n
  * Return success if the sequenceID is one more than what we last saw on
  * this slot, accounting for wraparound.  Increments the slot's sequence.
  *
- * We don't yet implement a duplicate request cache, so at this time
- * we will log replays, and process them as if we had not seen them before,
- * but we don't bump the sequence in the slot.  Not too worried about it,
+ * We don't yet implement a duplicate request cache, instead we set the
+ * back channel ca_maxresponsesize_cached to zero. This is OK for now
  * since we only currently implement idempotent callbacks anyway.
  *
  * We have a single slot backchannel at this time, so we don't bother
  * checking the used_slots bit array on the table.  The lower layer guarantees
  * a single outstanding callback request at a time.
  */
-static int
-validate_seqid(struct nfs4_slot_table *tbl, u32 slotid, u32 seqid)
+static __be32
+validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
 {
         struct nfs4_slot *slot;
 
         dprintk("%s enter. slotid %d seqid %d\n",
-                __func__, slotid, seqid);
+                __func__, args->csa_slotid, args->csa_sequenceid);
 
-        if (slotid > NFS41_BC_MAX_CALLBACKS)
+        if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
                 return htonl(NFS4ERR_BADSLOT);
 
-        slot = tbl->slots + slotid;
+        slot = tbl->slots + args->csa_slotid;
         dprintk("%s slot table seqid: %d\n", __func__, slot->seq_nr);
 
         /* Normal */
-        if (likely(seqid == slot->seq_nr + 1)) {
+        if (likely(args->csa_sequenceid == slot->seq_nr + 1)) {
                 slot->seq_nr++;
                 return htonl(NFS4_OK);
         }
 
         /* Replay */
-        if (seqid == slot->seq_nr) {
-                dprintk("%s seqid %d is a replay - no DRC available\n",
-                        __func__, seqid);
-                return htonl(NFS4_OK);
+        if (args->csa_sequenceid == slot->seq_nr) {
+                dprintk("%s seqid %d is a replay\n",
+                        __func__, args->csa_sequenceid);
+                /* Signal process_op to set this error on next op */
+                if (args->csa_cachethis == 0)
+                        return htonl(NFS4ERR_RETRY_UNCACHED_REP);
+
+                /* The ca_maxresponsesize_cached is 0 with no DRC */
+                else if (args->csa_cachethis == 1)
+                        return htonl(NFS4ERR_REP_TOO_BIG_TO_CACHE);
         }
 
         /* Wraparound */
-        if (seqid == 1 && (slot->seq_nr + 1) == 0) {
+        if (args->csa_sequenceid == 1 && (slot->seq_nr + 1) == 0) {
                 slot->seq_nr = 1;
                 return htonl(NFS4_OK);
         }
@@ -225,27 +231,87 @@ validate_seqid(struct nfs4_slot_table *tbl, u32 slotid, u32 seqid)
         return NULL;
 }
 
-/* FIXME: referring calls should be processed */
-unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
+/*
+ * For each referring call triple, check the session's slot table for
+ * a match.  If the slot is in use and the sequence numbers match, the
+ * client is still waiting for a response to the original request.
+ */
+static bool referring_call_exists(struct nfs_client *clp,
+                                  uint32_t nrclists,
+                                  struct referring_call_list *rclists)
+{
+        bool status = 0;
+        int i, j;
+        struct nfs4_session *session;
+        struct nfs4_slot_table *tbl;
+        struct referring_call_list *rclist;
+        struct referring_call *ref;
+
+        /*
+         * XXX When client trunking is implemented, this becomes
+         * a session lookup from within the loop
+         */
+        session = clp->cl_session;
+        tbl = &session->fc_slot_table;
+
+        for (i = 0; i < nrclists; i++) {
+                rclist = &rclists[i];
+                if (memcmp(session->sess_id.data,
+                           rclist->rcl_sessionid.data,
+                           NFS4_MAX_SESSIONID_LEN) != 0)
+                        continue;
+
+                for (j = 0; j < rclist->rcl_nrefcalls; j++) {
+                        ref = &rclist->rcl_refcalls[j];
+
+                        dprintk("%s: sessionid %x:%x:%x:%x sequenceid %u "
+                                "slotid %u\n", __func__,
+                                ((u32 *)&rclist->rcl_sessionid.data)[0],
+                                ((u32 *)&rclist->rcl_sessionid.data)[1],
+                                ((u32 *)&rclist->rcl_sessionid.data)[2],
+                                ((u32 *)&rclist->rcl_sessionid.data)[3],
+                                ref->rc_sequenceid, ref->rc_slotid);
+
+                        spin_lock(&tbl->slot_tbl_lock);
+                        status = (test_bit(ref->rc_slotid, tbl->used_slots) &&
+                                  tbl->slots[ref->rc_slotid].seq_nr ==
+                                        ref->rc_sequenceid);
+                        spin_unlock(&tbl->slot_tbl_lock);
+                        if (status)
+                                goto out;
+                }
+        }
+
+out:
+        return status;
+}
+
+__be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                                 struct cb_sequenceres *res)
 {
         struct nfs_client *clp;
-        int i, status;
-
-        for (i = 0; i < args->csa_nrclists; i++)
-                kfree(args->csa_rclists[i].rcl_refcalls);
-        kfree(args->csa_rclists);
+        int i;
+        __be32 status;
 
         status = htonl(NFS4ERR_BADSESSION);
         clp = find_client_with_session(args->csa_addr, 4, &args->csa_sessionid);
         if (clp == NULL)
                 goto out;
 
-        status = validate_seqid(&clp->cl_session->bc_slot_table,
-                                args->csa_slotid, args->csa_sequenceid);
+        status = validate_seqid(&clp->cl_session->bc_slot_table, args);
         if (status)
                 goto out_putclient;
 
+        /*
+         * Check for pending referring calls.  If a match is found, a
+         * related callback was received before the response to the original
+         * call.
+         */
+        if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists)) {
+                status = htonl(NFS4ERR_DELAY);
+                goto out_putclient;
+        }
+
         memcpy(&res->csr_sessionid, &args->csa_sessionid,
                sizeof(res->csr_sessionid));
         res->csr_sequenceid = args->csa_sequenceid;
@@ -256,15 +322,23 @@ unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
 out_putclient:
         nfs_put_client(clp);
 out:
-        dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
-        res->csr_status = status;
-        return res->csr_status;
+        for (i = 0; i < args->csa_nrclists; i++)
+                kfree(args->csa_rclists[i].rcl_refcalls);
+        kfree(args->csa_rclists);
+
+        if (status == htonl(NFS4ERR_RETRY_UNCACHED_REP))
+                res->csr_status = 0;
+        else
+                res->csr_status = status;
+        dprintk("%s: exit with status = %d res->csr_status %d\n", __func__,
+                ntohl(status), ntohl(res->csr_status));
+        return status;
 }
 
-unsigned nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy)
+__be32 nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy)
 {
         struct nfs_client *clp;
-        int status;
+        __be32 status;
         fmode_t flags = 0;
 
         status = htonl(NFS4ERR_OP_NOT_IN_SESSION);
@@ -289,4 +363,40 @@ out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
         return status;
 }
+
+/* Reduce the fore channel's max_slots to the target value */
+__be32 nfs4_callback_recallslot(struct cb_recallslotargs *args, void *dummy)
+{
+        struct nfs_client *clp;
+        struct nfs4_slot_table *fc_tbl;
+        __be32 status;
+
+        status = htonl(NFS4ERR_OP_NOT_IN_SESSION);
+        clp = nfs_find_client(args->crsa_addr, 4);
+        if (clp == NULL)
+                goto out;
+
+        dprintk("NFS: CB_RECALL_SLOT request from %s target max slots %d\n",
+                rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR),
+                args->crsa_target_max_slots);
+
+        fc_tbl = &clp->cl_session->fc_slot_table;
+
+        status = htonl(NFS4ERR_BAD_HIGH_SLOT);
+        if (args->crsa_target_max_slots > fc_tbl->max_slots ||
+            args->crsa_target_max_slots < 1)
+                goto out_putclient;
+
+        status = htonl(NFS4_OK);
+        if (args->crsa_target_max_slots == fc_tbl->max_slots)
+                goto out_putclient;
+
+        fc_tbl->target_max_slots = args->crsa_target_max_slots;
+        nfs41_handle_recall_slot(clp);
+out_putclient:
+        nfs_put_client(clp);    /* balance nfs_find_client */
+out:
+        dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
+        return status;
+}
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 8e1a2511c8be..05af212f0edf 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -9,6 +9,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include "nfs4_fs.h"
 #include "callback.h"
 
@@ -24,10 +25,14 @@
 #define CB_OP_SEQUENCE_RES_MAXSZ        (CB_OP_HDR_RES_MAXSZ + \
                                         4 + 1 + 3)
 #define CB_OP_RECALLANY_RES_MAXSZ       (CB_OP_HDR_RES_MAXSZ)
+#define CB_OP_RECALLSLOT_RES_MAXSZ      (CB_OP_HDR_RES_MAXSZ)
 #endif /* CONFIG_NFS_V4_1 */
 
 #define NFSDBG_FACILITY NFSDBG_CALLBACK
 
+/* Internal error code */
+#define NFS4ERR_RESOURCE_HDR    11050
+
 typedef __be32 (*callback_process_op_t)(void *, void *);
 typedef __be32 (*callback_decode_arg_t)(struct svc_rqst *, struct xdr_stream *, void *);
 typedef __be32 (*callback_encode_res_t)(struct svc_rqst *, struct xdr_stream *, void *);
@@ -173,7 +178,7 @@ static __be32 decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
         __be32 *p;
         p = read_buf(xdr, 4);
         if (unlikely(p == NULL))
-                return htonl(NFS4ERR_RESOURCE);
+                return htonl(NFS4ERR_RESOURCE_HDR);
         *op = ntohl(*p);
         return 0;
 }
@@ -215,10 +220,10 @@ out:
 
 #if defined(CONFIG_NFS_V4_1)
 
-static unsigned decode_sessionid(struct xdr_stream *xdr,
+static __be32 decode_sessionid(struct xdr_stream *xdr,
                                  struct nfs4_sessionid *sid)
 {
-        uint32_t *p;
+        __be32 *p;
         int len = NFS4_MAX_SESSIONID_LEN;
 
         p = read_buf(xdr, len);
@@ -229,12 +234,12 @@ static unsigned decode_sessionid(struct xdr_stream *xdr,
         return 0;
 }
 
-static unsigned decode_rc_list(struct xdr_stream *xdr,
+static __be32 decode_rc_list(struct xdr_stream *xdr,
                                struct referring_call_list *rc_list)
 {
-        uint32_t *p;
+        __be32 *p;
         int i;
-        unsigned status;
+        __be32 status;
 
         status = decode_sessionid(xdr, &rc_list->rcl_sessionid);
         if (status)
@@ -267,13 +272,13 @@ out:
         return status;
 }
 
-static unsigned decode_cb_sequence_args(struct svc_rqst *rqstp,
+static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
                                         struct xdr_stream *xdr,
                                         struct cb_sequenceargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
         int i;
-        unsigned status;
+        __be32 status;
 
         status = decode_sessionid(xdr, &args->csa_sessionid);
         if (status)
@@ -327,11 +332,11 @@ out_free:
         goto out;
 }
 
-static unsigned decode_recallany_args(struct svc_rqst *rqstp,
+static __be32 decode_recallany_args(struct svc_rqst *rqstp,
                                       struct xdr_stream *xdr,
                                       struct cb_recallanyargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
 
         args->craa_addr = svc_addr(rqstp);
         p = read_buf(xdr, 4);
@@ -346,6 +351,20 @@ static unsigned decode_recallany_args(struct svc_rqst *rqstp,
         return 0;
 }
 
+static __be32 decode_recallslot_args(struct svc_rqst *rqstp,
+                                        struct xdr_stream *xdr,
+                                        struct cb_recallslotargs *args)
+{
+        __be32 *p;
+
+        args->crsa_addr = svc_addr(rqstp);
+        p = read_buf(xdr, 4);
+        if (unlikely(p == NULL))
+                return htonl(NFS4ERR_BADXDR);
+        args->crsa_target_max_slots = ntohl(*p++);
+        return 0;
+}
+
 #endif /* CONFIG_NFS_V4_1 */
 
 static __be32 encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
@@ -465,7 +484,7 @@ static __be32 encode_op_hdr(struct xdr_stream *xdr, uint32_t op, __be32 res)
         
         p = xdr_reserve_space(xdr, 8);
         if (unlikely(p == NULL))
-                return htonl(NFS4ERR_RESOURCE);
+                return htonl(NFS4ERR_RESOURCE_HDR);
         *p++ = htonl(op);
         *p = res;
         return 0;
@@ -499,10 +518,10 @@ out:
 
 #if defined(CONFIG_NFS_V4_1)
 
-static unsigned encode_sessionid(struct xdr_stream *xdr,
+static __be32 encode_sessionid(struct xdr_stream *xdr,
                                  const struct nfs4_sessionid *sid)
 {
-        uint32_t *p;
+        __be32 *p;
         int len = NFS4_MAX_SESSIONID_LEN;
 
         p = xdr_reserve_space(xdr, len);
@@ -513,11 +532,11 @@ static unsigned encode_sessionid(struct xdr_stream *xdr,
         return 0;
 }
 
-static unsigned encode_cb_sequence_res(struct svc_rqst *rqstp,
+static __be32 encode_cb_sequence_res(struct svc_rqst *rqstp,
                                        struct xdr_stream *xdr,
                                        const struct cb_sequenceres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         unsigned status = res->csr_status;
 
         if (unlikely(status != 0))
@@ -554,6 +573,7 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
         case OP_CB_RECALL:
         case OP_CB_SEQUENCE:
         case OP_CB_RECALL_ANY:
+        case OP_CB_RECALL_SLOT:
                 *op = &callback_ops[op_nr];
                 break;
 
@@ -562,7 +582,6 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
         case OP_CB_NOTIFY:
         case OP_CB_PUSH_DELEG:
         case OP_CB_RECALLABLE_OBJ_AVAIL:
-        case OP_CB_RECALL_SLOT:
         case OP_CB_WANTS_CANCELLED:
         case OP_CB_NOTIFY_LOCK:
                 return htonl(NFS4ERR_NOTSUPP);
@@ -602,20 +621,18 @@ preprocess_nfs4_op(unsigned int op_nr, struct callback_op **op)
 static __be32 process_op(uint32_t minorversion, int nop,
                 struct svc_rqst *rqstp,
                 struct xdr_stream *xdr_in, void *argp,
-                struct xdr_stream *xdr_out, void *resp)
+                struct xdr_stream *xdr_out, void *resp, int* drc_status)
 {
         struct callback_op *op = &callback_ops[0];
-        unsigned int op_nr = OP_CB_ILLEGAL;
+        unsigned int op_nr;
         __be32 status;
         long maxlen;
         __be32 res;
 
         dprintk("%s: start\n", __func__);
         status = decode_op_hdr(xdr_in, &op_nr);
-        if (unlikely(status)) {
-                status = htonl(NFS4ERR_OP_ILLEGAL);
-                goto out;
-        }
+        if (unlikely(status))
+                return status;
 
         dprintk("%s: minorversion=%d nop=%d op_nr=%u\n",
                 __func__, minorversion, nop, op_nr);
@@ -624,19 +641,32 @@ static __be32 process_op(uint32_t minorversion, int nop,
                                 preprocess_nfs4_op(op_nr, &op);
         if (status == htonl(NFS4ERR_OP_ILLEGAL))
                 op_nr = OP_CB_ILLEGAL;
-out:
+        if (status)
+                goto encode_hdr;
+
+        if (*drc_status) {
+                status = *drc_status;
+                goto encode_hdr;
+        }
+
         maxlen = xdr_out->end - xdr_out->p;
         if (maxlen > 0 && maxlen < PAGE_SIZE) {
-                if (likely(status == 0 && op->decode_args != NULL))
-                        status = op->decode_args(rqstp, xdr_in, argp);
-                if (likely(status == 0 && op->process_op != NULL))
+                status = op->decode_args(rqstp, xdr_in, argp);
+                if (likely(status == 0))
                         status = op->process_op(argp, resp);
         } else
                 status = htonl(NFS4ERR_RESOURCE);
 
+        /* Only set by OP_CB_SEQUENCE processing */
+        if (status == htonl(NFS4ERR_RETRY_UNCACHED_REP)) {
+                *drc_status = status;
+                status = 0;
+        }
+
+encode_hdr:
         res = encode_op_hdr(xdr_out, op_nr, status);
-        if (status == 0)
-                status = res;
+        if (unlikely(res))
+                return res;
         if (op->encode_res != NULL && status == 0)
                 status = op->encode_res(rqstp, xdr_out, resp);
         dprintk("%s: done, status = %d\n", __func__, ntohl(status));
@@ -652,7 +682,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
         struct cb_compound_hdr_res hdr_res = { NULL };
         struct xdr_stream xdr_in, xdr_out;
         __be32 *p;
-        __be32 status;
+        __be32 status, drc_status = 0;
         unsigned int nops = 0;
 
         dprintk("%s: start\n", __func__);
@@ -672,11 +702,18 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
                 return rpc_system_err;
 
         while (status == 0 && nops != hdr_arg.nops) {
-                status = process_op(hdr_arg.minorversion, nops,
-                                    rqstp, &xdr_in, argp, &xdr_out, resp);
+                status = process_op(hdr_arg.minorversion, nops, rqstp,
+                                    &xdr_in, argp, &xdr_out, resp, &drc_status);
                 nops++;
         }
 
+        /* Buffer overflow in decode_ops_hdr or encode_ops_hdr. Return
+        * resource error in cb_compound status without returning op */
+        if (unlikely(status == htonl(NFS4ERR_RESOURCE_HDR))) {
+                status = htonl(NFS4ERR_RESOURCE);
+                nops--;
+        }
+
         *hdr_res.status = status;
         *hdr_res.nops = htonl(nops);
         dprintk("%s: done, status = %u\n", __func__, ntohl(status));
@@ -713,6 +750,11 @@ static struct callback_op callback_ops[] = {
                 .decode_args = (callback_decode_arg_t)decode_recallany_args,
                 .res_maxsize = CB_OP_RECALLANY_RES_MAXSZ,
         },
+        [OP_CB_RECALL_SLOT] = {
+                .process_op = (callback_process_op_t)nfs4_callback_recallslot,
+                .decode_args = (callback_decode_arg_t)decode_recallslot_args,
+                .res_maxsize = CB_OP_RECALLSLOT_RES_MAXSZ,
+        },
 #endif /* CONFIG_NFS_V4_1 */
 };
 
@@ -741,6 +783,7 @@ struct svc_version nfs4_callback_version1 = {
         .vs_proc = nfs4_callback_procedures1,
         .vs_xdrsize = NFS4_CALLBACK_XDRSIZE,
         .vs_dispatch = NULL,
+        .vs_hidden = 1,
 };
 
 struct svc_version nfs4_callback_version4 = {
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index ee77713ce68b..a8766c4ef2e0 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -35,6 +35,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/nfs_xdr.h>
 #include <linux/sunrpc/bc_xprt.h>
@@ -164,30 +165,7 @@ error_0:
         return ERR_PTR(err);
 }
 
-static void nfs4_shutdown_client(struct nfs_client *clp)
-{
-#ifdef CONFIG_NFS_V4
-        if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
-                nfs4_kill_renewd(clp);
-        BUG_ON(!RB_EMPTY_ROOT(&clp->cl_state_owners));
-        if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
-                nfs_idmap_delete(clp);
-
-        rpc_destroy_wait_queue(&clp->cl_rpcwaitq);
-#endif
-}
-
-/*
- * Destroy the NFS4 callback service
- */
-static void nfs4_destroy_callback(struct nfs_client *clp)
-{
 #ifdef CONFIG_NFS_V4
-        if (__test_and_clear_bit(NFS_CS_CALLBACK, &clp->cl_res_state))
-                nfs_callback_down(clp->cl_minorversion);
-#endif /* CONFIG_NFS_V4 */
-}
-
 /*
  * Clears/puts all minor version specific parts from an nfs_client struct
  * reverting it to minorversion 0.
@@ -202,9 +180,33 @@ static void nfs4_clear_client_minor_version(struct nfs_client *clp)
 
         clp->cl_call_sync = _nfs4_call_sync;
 #endif /* CONFIG_NFS_V4_1 */
+}
+
+/*
+ * Destroy the NFS4 callback service
+ */
+static void nfs4_destroy_callback(struct nfs_client *clp)
+{
+        if (__test_and_clear_bit(NFS_CS_CALLBACK, &clp->cl_res_state))
+                nfs_callback_down(clp->cl_minorversion);
+}
 
+static void nfs4_shutdown_client(struct nfs_client *clp)
+{
+        if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
+                nfs4_kill_renewd(clp);
+        nfs4_clear_client_minor_version(clp);
         nfs4_destroy_callback(clp);
+        if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
+                nfs_idmap_delete(clp);
+
+        rpc_destroy_wait_queue(&clp->cl_rpcwaitq);
+}
+#else
+static void nfs4_shutdown_client(struct nfs_client *clp)
+{
 }
+#endif /* CONFIG_NFS_V4 */
 
 /*
  * Destroy a shared client record
@@ -213,7 +215,6 @@ static void nfs_free_client(struct nfs_client *clp)
 {
         dprintk("--> nfs_free_client(%u)\n", clp->rpc_ops->version);
 
-        nfs4_clear_client_minor_version(clp);
         nfs4_shutdown_client(clp);
 
         nfs_fscache_release_client_cookie(clp);
@@ -1293,7 +1294,8 @@ static int nfs4_init_server(struct nfs_server *server,
 
         /* Initialise the client representation from the mount data */
         server->flags = data->flags;
-        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR;
+        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR|
+                NFS_CAP_POSIX_LOCK;
         server->options = data->options;
 
         /* Get a client record */
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 2563bebc4c67..15671245c6ee 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -10,6 +10,7 @@
 #include <linux/kthread.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 944b627ec6e1..69e7b8140122 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -71,4 +71,10 @@ static inline int nfs_inode_return_delegation(struct inode *inode)
 }
 #endif
 
+static inline int nfs_have_delegated_attributes(struct inode *inode)
+{
+        return nfs_have_delegation(inode, FMODE_READ) &&
+                !(NFS_I(inode)->cache_validity & NFS_INO_REVAL_FORCED);
+}
+
 #endif
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2c5ace4f00a7..be46f26c9a56 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -560,7 +560,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         desc->entry = &my_entry;
 
         nfs_block_sillyrename(dentry);
-        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping(inode, filp->f_mapping);
         if (res < 0)
                 goto out;
 
@@ -1025,12 +1025,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
+                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
-                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 goto out;
@@ -1615,6 +1615,7 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 goto out;
 
                         new_dentry = dentry;
+                        rehash = NULL;
                         new_inode = NULL;
                 }
         }
@@ -1788,7 +1789,7 @@ static int nfs_access_get_cached(struct inode *inode, struct rpc_cred *cred, str
         cache = nfs_access_search_rbtree(inode, cred);
         if (cache == NULL)
                 goto out;
-        if (!nfs_have_delegation(inode, FMODE_READ) &&
+        if (!nfs_have_delegated_attributes(inode) &&
             !time_in_range_open(jiffies, cache->jiffies, cache->jiffies + nfsi->attrtimeo))
                 goto out_stale;
         res->jiffies = cache->jiffies;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index e1d415e97849..ad4cd31d6050 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -44,6 +44,7 @@
 #include <linux/file.h>
 #include <linux/pagemap.h>
 #include <linux/kref.h>
+#include <linux/slab.h>
 
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
@@ -342,6 +343,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.eof = 0;
                 data->res.count = bytes;
+                nfs_fattr_init(&data->fattr);
                 msg.rpc_argp = &data->args;
                 msg.rpc_resp = &data->res;
 
@@ -575,6 +577,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
         data->res.count = 0;
         data->res.fattr = &data->fattr;
         data->res.verf = &data->verf;
+        nfs_fattr_init(&data->fattr);
 
         NFS_PROTO(data->inode)->commit_setup(data, &msg);
 
@@ -766,6 +769,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.count = bytes;
                 data->res.verf = &data->verf;
+                nfs_fattr_init(&data->fattr);
 
                 task_setup_data.task = &data->task;
                 task_setup_data.callback_data = data;
diff --git a/fs/nfs/dns_resolve.c b/fs/nfs/dns_resolve.c
index 95e1ca765d47..76fd235d0024 100644
--- a/fs/nfs/dns_resolve.c
+++ b/fs/nfs/dns_resolve.c
@@ -9,6 +9,7 @@
 #include <linux/hash.h>
 #include <linux/string.h>
 #include <linux/kmod.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/socket.h>
 #include <linux/seq_file.h>
@@ -36,6 +37,19 @@ struct nfs_dns_ent {
 };
 
 
+static void nfs_dns_ent_update(struct cache_head *cnew,
+                struct cache_head *ckey)
+{
+        struct nfs_dns_ent *new;
+        struct nfs_dns_ent *key;
+
+        new = container_of(cnew, struct nfs_dns_ent, h);
+        key = container_of(ckey, struct nfs_dns_ent, h);
+
+        memcpy(&new->addr, &key->addr, key->addrlen);
+        new->addrlen = key->addrlen;
+}
+
 static void nfs_dns_ent_init(struct cache_head *cnew,
                 struct cache_head *ckey)
 {
@@ -49,8 +63,7 @@ static void nfs_dns_ent_init(struct cache_head *cnew,
         new->hostname = kstrndup(key->hostname, key->namelen, GFP_KERNEL);
         if (new->hostname) {
                 new->namelen = key->namelen;
-                memcpy(&new->addr, &key->addr, key->addrlen);
-                new->addrlen = key->addrlen;
+                nfs_dns_ent_update(cnew, ckey);
         } else {
                 new->namelen = 0;
                 new->addrlen = 0;
@@ -234,7 +247,7 @@ static struct cache_detail nfs_dns_resolve = {
         .cache_show = nfs_dns_show,
         .match = nfs_dns_match,
         .init = nfs_dns_ent_init,
-        .update = nfs_dns_ent_init,
+        .update = nfs_dns_ent_update,
         .alloc = nfs_dns_ent_alloc,
 };
 
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 6b891328f332..8d965bddb87e 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -24,9 +24,9 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/aio.h>
+#include <linux/gfp.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -123,11 +123,11 @@ nfs_file_open(struct inode *inode, struct file *filp)
                         filp->f_path.dentry->d_parent->d_name.name,
                         filp->f_path.dentry->d_name.name);
 
+        nfs_inc_stats(inode, NFSIOS_VFSOPEN);
         res = nfs_check_flags(filp->f_flags);
         if (res)
                 return res;
 
-        nfs_inc_stats(inode, NFSIOS_VFSOPEN);
         res = nfs_open(inode, filp);
         return res;
 }
@@ -237,9 +237,9 @@ nfs_file_flush(struct file *file, fl_owner_t id)
                         dentry->d_parent->d_name.name,
                         dentry->d_name.name);
 
+        nfs_inc_stats(inode, NFSIOS_VFSFLUSH);
         if ((file->f_mode & FMODE_WRITE) == 0)
                 return 0;
-        nfs_inc_stats(inode, NFSIOS_VFSFLUSH);
 
         /* Flush writes to the server and return any errors */
         return nfs_do_fsync(ctx, inode);
@@ -262,9 +262,11 @@ nfs_file_read(struct kiocb *iocb, const struct iovec *iov,
                 (unsigned long) count, (unsigned long) pos);
 
         result = nfs_revalidate_mapping(inode, iocb->ki_filp->f_mapping);
-        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, count);
-        if (!result)
+        if (!result) {
                 result = generic_file_aio_read(iocb, iov, nr_segs, pos);
+                if (result > 0)
+                        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, result);
+        }
         return result;
 }
 
@@ -282,8 +284,11 @@ nfs_file_splice_read(struct file *filp, loff_t *ppos,
                 (unsigned long) count, (unsigned long long) *ppos);
 
         res = nfs_revalidate_mapping(inode, filp->f_mapping);
-        if (!res)
+        if (!res) {
                 res = generic_file_splice_read(filp, ppos, pipe, count, flags);
+                if (res > 0)
+                        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, res);
+        }
         return res;
 }
 
@@ -486,6 +491,9 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
 {
         dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
 
+        /* Only do I/O if gfp is a superset of GFP_KERNEL */
+        if ((gfp & GFP_KERNEL) == GFP_KERNEL)
+                nfs_wb_page(page->mapping->host, page);
         /* If PagePrivate() is set, then the page is not freeable */
         if (PagePrivate(page))
                 return 0;
@@ -594,6 +602,7 @@ static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
 {
         struct dentry * dentry = iocb->ki_filp->f_path.dentry;
         struct inode * inode = dentry->d_inode;
+        unsigned long written = 0;
         ssize_t result;
         size_t count = iov_length(iov, nr_segs);
 
@@ -620,14 +629,18 @@ static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
         if (!count)
                 goto out;
 
-        nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, count);
         result = generic_file_aio_write(iocb, iov, nr_segs, pos);
+        if (result > 0)
+                written = result;
+
         /* Return error values for O_DSYNC and IS_SYNC() */
         if (result >= 0 && nfs_need_sync_write(iocb->ki_filp, inode)) {
                 int err = nfs_do_fsync(nfs_file_open_context(iocb->ki_filp), inode);
                 if (err < 0)
                         result = err;
         }
+        if (result > 0)
+                nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
 out:
         return result;
 
@@ -642,6 +655,7 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
 {
         struct dentry *dentry = filp->f_path.dentry;
         struct inode *inode = dentry->d_inode;
+        unsigned long written = 0;
         ssize_t ret;
 
         dprintk("NFS splice_write(%s/%s, %lu@%llu)\n",
@@ -652,14 +666,17 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
          * The combination of splice and an O_APPEND destination is disallowed.
          */
 
-        nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, count);
-
         ret = generic_file_splice_write(pipe, filp, ppos, count, flags);
+        if (ret > 0)
+                written = ret;
+
         if (ret >= 0 && nfs_need_sync_write(filp, inode)) {
                 int err = nfs_do_fsync(nfs_file_open_context(filp), inode);
                 if (err < 0)
                         ret = err;
         }
+        if (ret > 0)
+                nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
         return ret;
 }
 
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index fa588006588d..a6b16ed93229 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -17,6 +17,7 @@
 #include <linux/nfs_fs_sb.h>
 #include <linux/in6.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include "internal.h"
 #include "iostat.h"
@@ -354,12 +355,11 @@ void nfs_fscache_reset_inode_cookie(struct inode *inode)
  */
 int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 {
-        struct nfs_inode *nfsi = NFS_I(page->mapping->host);
-        struct fscache_cookie *cookie = nfsi->fscache;
-
-        BUG_ON(!cookie);
-
         if (PageFsCache(page)) {
+                struct nfs_inode *nfsi = NFS_I(page->mapping->host);
+                struct fscache_cookie *cookie = nfsi->fscache;
+
+                BUG_ON(!cookie);
                 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                          cookie, page, nfsi);
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index faa091865ad0..50a56edca0b5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -36,6 +36,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/nfs_xdr.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -97,22 +98,6 @@ u64 nfs_compat_user_ino64(u64 fileid)
         return ino;
 }
 
-int nfs_write_inode(struct inode *inode, int sync)
-{
-        int ret;
-
-        if (sync) {
-                ret = filemap_fdatawait(inode->i_mapping);
-                if (ret == 0)
-                        ret = nfs_commit_inode(inode, FLUSH_SYNC);
-        } else
-                ret = nfs_commit_inode(inode, 0);
-        if (ret >= 0)
-                return 0;
-        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        return ret;
-}
-
 void nfs_clear_inode(struct inode *inode)
 {
         /*
@@ -130,16 +115,12 @@ void nfs_clear_inode(struct inode *inode)
  */
 int nfs_sync_mapping(struct address_space *mapping)
 {
-        int ret;
+        int ret = 0;
 
-        if (mapping->nrpages == 0)
-                return 0;
-        unmap_mapping_range(mapping, 0, 0, 0);
-        ret = filemap_write_and_wait(mapping);
-        if (ret != 0)
-                goto out;
-        ret = nfs_wb_all(mapping->host);
-out:
+        if (mapping->nrpages != 0) {
+                unmap_mapping_range(mapping, 0, 0, 0);
+                ret = nfs_wb_all(mapping->host);
+        }
         return ret;
 }
 
@@ -511,17 +492,11 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
         int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
         int err;
 
-        /*
-         * Flush out writes to the server in order to update c/mtime.
-         *
-         * Hold the i_mutex to suspend application writes temporarily;
-         * this prevents long-running writing applications from blocking
-         * nfs_wb_nocommit.
-         */
+        /* Flush out writes to the server in order to update c/mtime.  */
         if (S_ISREG(inode->i_mode)) {
-                mutex_lock(&inode->i_mutex);
-                nfs_wb_nocommit(inode);
-                mutex_unlock(&inode->i_mutex);
+                err = filemap_write_and_wait(inode->i_mapping);
+                if (err)
+                        goto out;
         }
 
         /*
@@ -545,6 +520,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
                 generic_fillattr(inode, stat);
                 stat->ino = nfs_compat_user_ino64(NFS_FILEID(inode));
         }
+out:
         return err;
 }
 
@@ -574,14 +550,14 @@ void nfs_close_context(struct nfs_open_context *ctx, int is_sync)
         nfs_revalidate_inode(server, inode);
 }
 
-static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, struct dentry *dentry, struct rpc_cred *cred)
+static struct nfs_open_context *alloc_nfs_open_context(struct path *path, struct rpc_cred *cred)
 {
         struct nfs_open_context *ctx;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (ctx != NULL) {
-                ctx->path.dentry = dget(dentry);
-                ctx->path.mnt = mntget(mnt);
+                ctx->path = *path;
+                path_get(&ctx->path);
                 ctx->cred = get_rpccred(cred);
                 ctx->state = NULL;
                 ctx->lockowner = current->files;
@@ -620,11 +596,6 @@ void put_nfs_open_context(struct nfs_open_context *ctx)
         __put_nfs_open_context(ctx, 0);
 }
 
-static void put_nfs_open_context_sync(struct nfs_open_context *ctx)
-{
-        __put_nfs_open_context(ctx, 1);
-}
-
 /*
  * Ensure that mmap has a recent RPC credential for use when writing out
  * shared pages
@@ -652,10 +623,10 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c
         list_for_each_entry(pos, &nfsi->open_files, list) {
                 if (cred != NULL && pos->cred != cred)
                         continue;
-                if ((pos->mode & mode) == mode) {
-                        ctx = get_nfs_open_context(pos);
-                        break;
-                }
+                if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode)
+                        continue;
+                ctx = get_nfs_open_context(pos);
+                break;
         }
         spin_unlock(&inode->i_lock);
         return ctx;
@@ -671,7 +642,7 @@ static void nfs_file_clear_open_context(struct file *filp)
                 spin_lock(&inode->i_lock);
                 list_move_tail(&ctx->list, &NFS_I(inode)->open_files);
                 spin_unlock(&inode->i_lock);
-                put_nfs_open_context_sync(ctx);
+                __put_nfs_open_context(ctx, filp->f_flags & O_DIRECT ? 0 : 1);
         }
 }
 
@@ -686,7 +657,7 @@ int nfs_open(struct inode *inode, struct file *filp)
         cred = rpc_lookup_cred();
         if (IS_ERR(cred))
                 return PTR_ERR(cred);
-        ctx = alloc_nfs_open_context(filp->f_path.mnt, filp->f_path.dentry, cred);
+        ctx = alloc_nfs_open_context(&filp->f_path, cred);
         put_rpccred(cred);
         if (ctx == NULL)
                 return -ENOMEM;
@@ -759,7 +730,7 @@ int nfs_attribute_timeout(struct inode *inode)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
 
-        if (nfs_have_delegation(inode, FMODE_READ))
+        if (nfs_have_delegated_attributes(inode))
                 return 0;
         return !time_in_range_open(jiffies, nfsi->read_cache_jiffies, nfsi->read_cache_jiffies + nfsi->attrtimeo);
 }
@@ -779,7 +750,7 @@ int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
         return __nfs_revalidate_inode(server, inode);
 }
 
-static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
+static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         
@@ -800,49 +771,10 @@ static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_spa
         return 0;
 }
 
-static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
-{
-        int ret = 0;
-
-        mutex_lock(&inode->i_mutex);
-        if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_DATA) {
-                ret = nfs_sync_mapping(mapping);
-                if (ret == 0)
-                        ret = nfs_invalidate_mapping_nolock(inode, mapping);
-        }
-        mutex_unlock(&inode->i_mutex);
-        return ret;
-}
-
-/**
- * nfs_revalidate_mapping_nolock - Revalidate the pagecache
- * @inode - pointer to host inode
- * @mapping - pointer to mapping
- */
-int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
-{
-        struct nfs_inode *nfsi = NFS_I(inode);
-        int ret = 0;
-
-        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
-                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-                if (ret < 0)
-                        goto out;
-        }
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-                ret = nfs_invalidate_mapping_nolock(inode, mapping);
-out:
-        return ret;
-}
-
 /**
  * nfs_revalidate_mapping - Revalidate the pagecache
  * @inode - pointer to host inode
  * @mapping - pointer to mapping
- *
- * This version of the function will take the inode->i_mutex and attempt to
- * flush out all dirty data if it needs to invalidate the page cache.
  */
 int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
@@ -1261,8 +1193,10 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 
         if (fattr->valid & NFS_ATTR_FATTR_MODE) {
                 if ((inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO)) {
+                        umode_t newmode = inode->i_mode & S_IFMT;
+                        newmode |= fattr->mode & S_IALLUGO;
+                        inode->i_mode = newmode;
                         invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-                        inode->i_mode = fattr->mode;
                 }
         } else if (server->caps & NFS_CAP_MODE)
                 invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
@@ -1418,6 +1352,7 @@ static void init_once(void *foo)
         INIT_LIST_HEAD(&nfsi->access_cache_inode_lru);
         INIT_RADIX_TREE(&nfsi->nfs_page_tree, GFP_ATOMIC);
         nfsi->npages = 0;
+        nfsi->ncommit = 0;
         atomic_set(&nfsi->silly_count, 1);
         INIT_HLIST_HEAD(&nfsi->silly_list);
         init_waitqueue_head(&nfsi->waitqueue);
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 29e464d23b32..11f82f03c5de 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -211,7 +211,7 @@ extern int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask);
 extern struct workqueue_struct *nfsiod_workqueue;
 extern struct inode *nfs_alloc_inode(struct super_block *sb);
 extern void nfs_destroy_inode(struct inode *);
-extern int nfs_write_inode(struct inode *,int);
+extern int nfs_write_inode(struct inode *, struct writeback_control *);
 extern void nfs_clear_inode(struct inode *);
 #ifdef CONFIG_NFS_V4
 extern void nfs4_clear_inode(struct inode *);
diff --git a/fs/nfs/iostat.h b/fs/nfs/iostat.h
index 46d779abafd3..1d8d5c813b01 100644
--- a/fs/nfs/iostat.h
+++ b/fs/nfs/iostat.h
@@ -57,12 +57,12 @@ static inline void nfs_add_fscache_stats(struct inode *inode,
 }
 #endif
 
-static inline struct nfs_iostats *nfs_alloc_iostats(void)
+static inline struct nfs_iostats __percpu *nfs_alloc_iostats(void)
 {
         return alloc_percpu(struct nfs_iostats);
 }
 
-static inline void nfs_free_iostats(struct nfs_iostats *stats)
+static inline void nfs_free_iostats(struct nfs_iostats __percpu *stats)
 {
         if (stats != NULL)
                 free_percpu(stats);
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 0adefc40cc89..59047f8d7d72 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -120,7 +120,7 @@ static struct {
         { .status = MNT3ERR_INVAL,              .errno = -EINVAL,       },
         { .status = MNT3ERR_NAMETOOLONG,        .errno = -ENAMETOOLONG, },
         { .status = MNT3ERR_NOTSUPP,            .errno = -ENOTSUPP,     },
-        { .status = MNT3ERR_SERVERFAULT,        .errno = -ESERVERFAULT, },
+        { .status = MNT3ERR_SERVERFAULT,        .errno = -EREMOTEIO,    },
 };
 
 struct mountres {
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 40c766782891..7888cf36022d 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/dcache.h>
+#include <linux/gfp.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nfs_fs.h>
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index 5e078b222b4e..81cf14257916 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -12,7 +12,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -699,7 +698,7 @@ static struct {
         { NFSERR_BAD_COOKIE,    -EBADCOOKIE     },
         { NFSERR_NOTSUPP,       -ENOTSUPP       },
         { NFSERR_TOOSMALL,      -ETOOSMALL      },
-        { NFSERR_SERVERFAULT,   -ESERVERFAULT   },
+        { NFSERR_SERVERFAULT,   -EREMOTEIO      },
         { NFSERR_BADTYPE,       -EBADTYPE       },
         { NFSERR_JUKEBOX,       -EJUKEBOX       },
         { -1,                   -EIO            }
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index bac60515a4b3..d150ae0c5ecd 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -1,4 +1,5 @@
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/nfs.h>
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 3f8881d1a050..e701002694e5 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
+#include <linux/slab.h>
 #include <linux/nfs.h>
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
@@ -22,14 +23,14 @@
 
 #define NFSDBG_FACILITY         NFSDBG_PROC
 
-/* A wrapper to handle the EJUKEBOX error message */
+/* A wrapper to handle the EJUKEBOX and EKEYEXPIRED error messages */
 static int
 nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 {
         int res;
         do {
                 res = rpc_call_sync(clnt, msg, flags);
-                if (res != -EJUKEBOX)
+                if (res != -EJUKEBOX && res != -EKEYEXPIRED)
                         break;
                 schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
                 res = -ERESTARTSYS;
@@ -42,9 +43,10 @@ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 static int
 nfs3_async_handle_jukebox(struct rpc_task *task, struct inode *inode)
 {
-        if (task->tk_status != -EJUKEBOX)
+        if (task->tk_status != -EJUKEBOX && task->tk_status != -EKEYEXPIRED)
                 return 0;
-        nfs_inc_stats(inode, NFSIOS_DELAY);
+        if (task->tk_status == -EJUKEBOX)
+                nfs_inc_stats(inode, NFSIOS_DELAY);
         task->tk_status = 0;
         rpc_restart_call(task);
         rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 5fe5492fbd29..56a86f6ac8b5 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -9,7 +9,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 865265bdca03..a187200a7aac 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -46,6 +46,7 @@ enum nfs4_client_state {
         NFS4CLNT_DELEGRETURN,
         NFS4CLNT_SESSION_RESET,
         NFS4CLNT_SESSION_DRAINING,
+        NFS4CLNT_RECALL_SLOT,
 };
 
 /*
@@ -146,6 +147,7 @@ enum {
         NFS_O_RDWR_STATE,               /* OPEN stateid has read/write state */
         NFS_STATE_RECLAIM_REBOOT,       /* OPEN stateid server rebooted */
         NFS_STATE_RECLAIM_NOGRACE,      /* OPEN stateid needs to recover state */
+        NFS_STATE_POSIX_LOCKS,          /* Posix locks are supported */
 };
 
 struct nfs4_state {
@@ -277,7 +279,9 @@ extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
 extern void nfs4_schedule_state_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
 extern int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state);
+extern int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state);
 extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
+extern void nfs41_handle_recall_slot(struct nfs_client *clp);
 extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
 extern int nfs4_set_lock_state(struct nfs4_state *state, struct file_lock *fl);
 extern void nfs4_copy_stateid(nfs4_stateid *, struct nfs4_state *, fl_owner_t);
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index fa3408f20112..f071d12c613b 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -11,6 +11,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/vfs.h>
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 198d51d17c13..638067007c65 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -39,6 +39,7 @@
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs.h>
 #include <linux/nfs4.h>
@@ -249,19 +250,15 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                         if (state == NULL)
                                 break;
                         nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                 case -NFS4ERR_STALE_STATEID:
-                case -NFS4ERR_EXPIRED:
-                        nfs4_schedule_state_recovery(clp);
-                        ret = nfs4_wait_clnt_recover(clp);
-                        if (ret == 0)
-                                exception->retry = 1;
-#if !defined(CONFIG_NFS_V4_1)
-                        break;
-#else /* !defined(CONFIG_NFS_V4_1) */
-                        if (!nfs4_has_session(server->nfs_client))
+                        if (state == NULL)
                                 break;
-                        /* FALLTHROUGH */
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
+                case -NFS4ERR_EXPIRED:
+                        goto do_state_recovery;
+#if defined(CONFIG_NFS_V4_1)
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
                 case -NFS4ERR_BAD_HIGH_SLOT:
@@ -274,7 +271,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                         nfs4_schedule_state_recovery(clp);
                         exception->retry = 1;
                         break;
-#endif /* !defined(CONFIG_NFS_V4_1) */
+#endif /* defined(CONFIG_NFS_V4_1) */
                 case -NFS4ERR_FILE_OPEN:
                         if (exception->timeout > HZ) {
                                 /* We have retried a decent amount, time to
@@ -285,6 +282,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                         }
                 case -NFS4ERR_GRACE:
                 case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                         ret = nfs4_delay(server->client, &exception->timeout);
                         if (ret != 0)
                                 break;
@@ -293,6 +291,12 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
         }
         /* We failed to handle the error */
         return nfs4_map_errors(ret);
+do_state_recovery:
+        nfs4_schedule_state_recovery(clp);
+        ret = nfs4_wait_clnt_recover(clp);
+        if (ret == 0)
+                exception->retry = 1;
+        return ret;
 }
 
 
@@ -416,7 +420,8 @@ static void nfs41_sequence_done(struct nfs_client *clp,
                         clp->cl_last_renewal = timestamp;
                 spin_unlock(&clp->cl_lock);
                 /* Check sequence flags */
-                nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
+                if (atomic_read(&clp->cl_count) > 1)
+                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
         }
 out:
         /* The session may be reset by one of the error handlers. */
@@ -722,8 +727,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct path *path,
         p->o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
         if (p->o_arg.seqid == NULL)
                 goto err_free;
-        p->path.mnt = mntget(path->mnt);
-        p->path.dentry = dget(path->dentry);
+        path_get(path);
+        p->path = *path;
         p->dir = parent;
         p->owner = sp;
         atomic_inc(&sp->so_count);
@@ -1161,7 +1166,7 @@ static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state
         int err;
         do {
                 err = _nfs4_do_open_reclaim(ctx, state);
-                if (err != -NFS4ERR_DELAY)
+                if (err != -NFS4ERR_DELAY && err != -EKEYEXPIRED)
                         break;
                 nfs4_handle_exception(server, err, &exception);
         } while (exception.retry);
@@ -1518,6 +1523,8 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
                 nfs_post_op_update_inode(dir, o_res->dir_attr);
         } else
                 nfs_refresh_inode(dir, o_res->dir_attr);
+        if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
+                server->caps &= ~NFS_CAP_POSIX_LOCK;
         if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
                 status = _nfs4_proc_open_confirm(data);
                 if (status != 0)
@@ -1580,6 +1587,7 @@ static int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state
                         goto out;
                 case -NFS4ERR_GRACE:
                 case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                         nfs4_handle_exception(server, err, &exception);
                         err = 0;
                 }
@@ -1658,6 +1666,8 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
         status = PTR_ERR(state);
         if (IS_ERR(state))
                 goto err_opendata_put;
+        if (server->caps & NFS_CAP_POSIX_LOCK)
+                set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
         nfs4_opendata_put(opendata);
         nfs4_put_state_owner(sp);
         *res = state;
@@ -1940,8 +1950,8 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
         calldata->res.seqid = calldata->arg.seqid;
         calldata->res.server = server;
         calldata->res.seq_res.sr_slotid = NFS4_MAX_SLOT_TABLE;
-        calldata->path.mnt = mntget(path->mnt);
-        calldata->path.dentry = dget(path->dentry);
+        path_get(path);
+        calldata->path = *path;
 
         msg.rpc_argp = &calldata->arg,
         msg.rpc_resp = &calldata->res,
@@ -2060,8 +2070,7 @@ nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags, st
                         case -EDQUOT:
                         case -ENOSPC:
                         case -EROFS:
-                                lookup_instantiate_filp(nd, (struct dentry *)state, NULL);
-                                return 1;
+                                return PTR_ERR(state);
                         default:
                                 goto out_drop;
                 }
@@ -3141,10 +3150,19 @@ static void nfs4_proc_commit_setup(struct nfs_write_data *data, struct rpc_messa
  * nfs4_proc_async_renew(): This is not one of the nfs_rpc_ops; it is a special
  * standalone procedure for queueing an asynchronous RENEW.
  */
+static void nfs4_renew_release(void *data)
+{
+        struct nfs_client *clp = data;
+
+        if (atomic_read(&clp->cl_count) > 1)
+                nfs4_schedule_state_renewal(clp);
+        nfs_put_client(clp);
+}
+
 static void nfs4_renew_done(struct rpc_task *task, void *data)
 {
-        struct nfs_client *clp = (struct nfs_client *)task->tk_msg.rpc_argp;
-        unsigned long timestamp = (unsigned long)data;
+        struct nfs_client *clp = data;
+        unsigned long timestamp = task->tk_start;
 
         if (task->tk_status < 0) {
                 /* Unless we're shutting down, schedule state recovery! */
@@ -3160,6 +3178,7 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
 
 static const struct rpc_call_ops nfs4_renew_ops = {
         .rpc_call_done = nfs4_renew_done,
+        .rpc_release = nfs4_renew_release,
 };
 
 int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
@@ -3170,8 +3189,10 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
                 .rpc_cred       = cred,
         };
 
+        if (!atomic_inc_not_zero(&clp->cl_count))
+                return -EIO;
         return rpc_call_async(clp->cl_rpcclient, &msg, RPC_TASK_SOFT,
-                        &nfs4_renew_ops, (void *)jiffies);
+                        &nfs4_renew_ops, clp);
 }
 
 int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
@@ -3422,15 +3443,14 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                         if (state == NULL)
                                 break;
                         nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                 case -NFS4ERR_STALE_STATEID:
+                        if (state == NULL)
+                                break;
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_EXPIRED:
-                        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
-                        nfs4_schedule_state_recovery(clp);
-                        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
-                                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
-                        task->tk_status = 0;
-                        return -EAGAIN;
+                        goto do_state_recovery;
 #if defined(CONFIG_NFS_V4_1)
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
@@ -3449,6 +3469,7 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                         if (server)
                                 nfs_inc_server_stats(server, NFSIOS_DELAY);
                 case -NFS4ERR_GRACE:
+                case -EKEYEXPIRED:
                         rpc_delay(task, NFS4_POLL_RETRY_MAX);
                         task->tk_status = 0;
                         return -EAGAIN;
@@ -3458,6 +3479,13 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
         }
         task->tk_status = nfs4_map_errors(task->tk_status);
         return 0;
+do_state_recovery:
+        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+        nfs4_schedule_state_recovery(clp);
+        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
+                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
+        task->tk_status = 0;
+        return -EAGAIN;
 }
 
 static int
@@ -3554,6 +3582,7 @@ int nfs4_proc_setclientid_confirm(struct nfs_client *clp, struct rpc_cred *cred)
                         case -NFS4ERR_RESOURCE:
                                 /* The IBM lawyers misread another document! */
                         case -NFS4ERR_DELAY:
+                        case -EKEYEXPIRED:
                                 err = nfs4_delay(clp->cl_rpcclient, &timeout);
                 }
         } while (err == 0);
@@ -4088,6 +4117,28 @@ static const struct rpc_call_ops nfs4_recover_lock_ops = {
         .rpc_release = nfs4_lock_release,
 };
 
+static void nfs4_handle_setlk_error(struct nfs_server *server, struct nfs4_lock_state *lsp, int new_lock_owner, int error)
+{
+        struct nfs_client *clp = server->nfs_client;
+        struct nfs4_state *state = lsp->ls_state;
+
+        switch (error) {
+        case -NFS4ERR_ADMIN_REVOKED:
+        case -NFS4ERR_BAD_STATEID:
+        case -NFS4ERR_EXPIRED:
+                if (new_lock_owner != 0 ||
+                   (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_nograce(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+                break;
+        case -NFS4ERR_STALE_STATEID:
+                if (new_lock_owner != 0 ||
+                    (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+        };
+}
+
 static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *fl, int recovery_type)
 {
         struct nfs4_lockdata *data;
@@ -4126,6 +4177,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
         ret = nfs4_wait_for_completion_rpc_task(task);
         if (ret == 0) {
                 ret = data->rpc_status;
+                if (ret)
+                        nfs4_handle_setlk_error(data->server, data->lsp,
+                                        data->arg.new_lock_owner, ret);
         } else
                 data->cancelled = 1;
         rpc_put_task(task);
@@ -4144,7 +4198,7 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
                 if (test_bit(NFS_DELEGATED_STATE, &state->flags) != 0)
                         return 0;
                 err = _nfs4_do_setlk(state, F_SETLK, request, NFS_LOCK_RECLAIM);
-                if (err != -NFS4ERR_DELAY)
+                if (err != -NFS4ERR_DELAY && err != -EKEYEXPIRED)
                         break;
                 nfs4_handle_exception(server, err, &exception);
         } while (exception.retry);
@@ -4169,6 +4223,7 @@ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request
                         goto out;
                 case -NFS4ERR_GRACE:
                 case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                         nfs4_handle_exception(server, err, &exception);
                         err = 0;
                 }
@@ -4181,8 +4236,11 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
 {
         struct nfs_inode *nfsi = NFS_I(state->inode);
         unsigned char fl_flags = request->fl_flags;
-        int status;
+        int status = -ENOLCK;
 
+        if ((fl_flags & FL_POSIX) &&
+                        !test_bit(NFS_STATE_POSIX_LOCKS, &state->flags))
+                goto out;
         /* Is this a delegated open? */
         status = nfs4_set_lock_state(state, request);
         if (status != 0)
@@ -4317,6 +4375,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                                 err = 0;
                                 goto out;
                         case -NFS4ERR_DELAY:
+                        case -EKEYEXPIRED:
                                 break;
                 }
                 err = nfs4_handle_exception(server, err, &exception);
@@ -4462,7 +4521,7 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
 
                 status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
 
-                if (status != NFS4ERR_CLID_INUSE)
+                if (status != -NFS4ERR_CLID_INUSE)
                         break;
 
                 if (signalled())
@@ -4516,6 +4575,7 @@ static void nfs4_get_lease_time_done(struct rpc_task *task, void *calldata)
         switch (task->tk_status) {
         case -NFS4ERR_DELAY:
         case -NFS4ERR_GRACE:
+        case -EKEYEXPIRED:
                 dprintk("%s Retry: tk_status %d\n", __func__, task->tk_status);
                 rpc_delay(task, NFS4_POLL_RETRY_MIN);
                 task->tk_status = 0;
@@ -4573,26 +4633,32 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
 /*
  * Reset a slot table
  */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, int max_slots,
-                int old_max_slots, int ivalue)
+static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
+                                 int ivalue)
 {
+        struct nfs4_slot *new = NULL;
         int i;
         int ret = 0;
 
-        dprintk("--> %s: max_reqs=%u, tbl %p\n", __func__, max_slots, tbl);
+        dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
+                max_reqs, tbl->max_slots);
 
-        /*
-         * Until we have dynamic slot table adjustment, insist
-         * upon the same slot table size
-         */
-        if (max_slots != old_max_slots) {
-                dprintk("%s reset slot table does't match old\n",
-                        __func__);
-                ret = -EINVAL; /*XXX NFS4ERR_REQ_TOO_BIG ? */
-                goto out;
+        /* Does the newly negotiated max_reqs match the existing slot table? */
+        if (max_reqs != tbl->max_slots) {
+                ret = -ENOMEM;
+                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
+                              GFP_KERNEL);
+                if (!new)
+                        goto out;
+                ret = 0;
+                kfree(tbl->slots);
         }
         spin_lock(&tbl->slot_tbl_lock);
-        for (i = 0; i < max_slots; ++i)
+        if (new) {
+                tbl->slots = new;
+                tbl->max_slots = max_reqs;
+        }
+        for (i = 0; i < tbl->max_slots; ++i)
                 tbl->slots[i].seq_nr = ivalue;
         spin_unlock(&tbl->slot_tbl_lock);
         dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
@@ -4610,16 +4676,12 @@ static int nfs4_reset_slot_tables(struct nfs4_session *session)
         int status;
 
         status = nfs4_reset_slot_table(&session->fc_slot_table,
-                        session->fc_attrs.max_reqs,
-                        session->fc_slot_table.max_slots,
-                        1);
+                        session->fc_attrs.max_reqs, 1);
         if (status)
                 return status;
 
         status = nfs4_reset_slot_table(&session->bc_slot_table,
-                        session->bc_attrs.max_reqs,
-                        session->bc_slot_table.max_slots,
-                        0);
+                        session->bc_attrs.max_reqs, 0);
         return status;
 }
 
@@ -4760,16 +4822,14 @@ static void nfs4_init_channel_attrs(struct nfs41_create_session_args *args)
         args->fc_attrs.headerpadsz = 0;
         args->fc_attrs.max_rqst_sz = mxrqst_sz;
         args->fc_attrs.max_resp_sz = mxresp_sz;
-        args->fc_attrs.max_resp_sz_cached = mxresp_sz;
         args->fc_attrs.max_ops = NFS4_MAX_OPS;
         args->fc_attrs.max_reqs = session->clp->cl_rpcclient->cl_xprt->max_reqs;
 
         dprintk("%s: Fore Channel : max_rqst_sz=%u max_resp_sz=%u "
-                "max_resp_sz_cached=%u max_ops=%u max_reqs=%u\n",
+                "max_ops=%u max_reqs=%u\n",
                 __func__,
                 args->fc_attrs.max_rqst_sz, args->fc_attrs.max_resp_sz,
-                args->fc_attrs.max_resp_sz_cached, args->fc_attrs.max_ops,
-                args->fc_attrs.max_reqs);
+                args->fc_attrs.max_ops, args->fc_attrs.max_reqs);
 
         /* Back channel attributes */
         args->bc_attrs.headerpadsz = 0;
@@ -4978,7 +5038,16 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
                                        &res, args.sa_cache_this, 1);
 }
 
-void nfs41_sequence_call_done(struct rpc_task *task, void *data)
+static void nfs41_sequence_release(void *data)
+{
+        struct nfs_client *clp = (struct nfs_client *)data;
+
+        if (atomic_read(&clp->cl_count) > 1)
+                nfs4_schedule_state_renewal(clp);
+        nfs_put_client(clp);
+}
+
+static void nfs41_sequence_call_done(struct rpc_task *task, void *data)
 {
         struct nfs_client *clp = (struct nfs_client *)data;
 
@@ -4986,6 +5055,8 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
 
         if (task->tk_status < 0) {
                 dprintk("%s ERROR %d\n", __func__, task->tk_status);
+                if (atomic_read(&clp->cl_count) == 1)
+                        goto out;
 
                 if (_nfs4_async_handle_error(task, NULL, clp, NULL)
                                                                 == -EAGAIN) {
@@ -4994,7 +5065,7 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
                 }
         }
         dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
-
+out:
         kfree(task->tk_msg.rpc_argp);
         kfree(task->tk_msg.rpc_resp);
 
@@ -5019,6 +5090,7 @@ static void nfs41_sequence_prepare(struct rpc_task *task, void *data)
 static const struct rpc_call_ops nfs41_sequence_ops = {
         .rpc_call_done = nfs41_sequence_call_done,
         .rpc_call_prepare = nfs41_sequence_prepare,
+        .rpc_release = nfs41_sequence_release,
 };
 
 static int nfs41_proc_async_sequence(struct nfs_client *clp,
@@ -5031,12 +5103,14 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp,
                 .rpc_cred = cred,
         };
 
+        if (!atomic_inc_not_zero(&clp->cl_count))
+                return -EIO;
         args = kzalloc(sizeof(*args), GFP_KERNEL);
-        if (!args)
-                return -ENOMEM;
         res = kzalloc(sizeof(*res), GFP_KERNEL);
-        if (!res) {
+        if (!args || !res) {
                 kfree(args);
+                kfree(res);
+                nfs_put_client(clp);
                 return -ENOMEM;
         }
         res->sr_slotid = NFS4_MAX_SLOT_TABLE;
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index 0156c01c212c..d87f10327b72 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -36,11 +36,6 @@
  * as an rpc_task, not a real kernel thread, so it always runs in rpciod's
  * context.  There is one renewd per nfs_server.
  *
- * TODO: If the send queue gets backlogged (e.g., if the server goes down),
- * we will keep filling the queue with periodic RENEW requests.  We need a
- * mechanism for ensuring that if renewd successfully sends off a request,
- * then it only wakes up when the request is finished.  Maybe use the
- * child task framework of the RPC layer?
  */
 
 #include <linux/mm.h>
@@ -63,7 +58,7 @@ nfs4_renew_state(struct work_struct *work)
         struct nfs_client *clp =
                 container_of(work, struct nfs_client, cl_renewd.work);
         struct rpc_cred *cred;
-        long lease, timeout;
+        long lease;
         unsigned long last, now;
 
         ops = nfs4_state_renewal_ops[clp->cl_minorversion];
@@ -75,7 +70,6 @@ nfs4_renew_state(struct work_struct *work)
         lease = clp->cl_lease_time;
         last = clp->cl_last_renewal;
         now = jiffies;
-        timeout = (2 * lease) / 3 + (long)last - (long)now;
         /* Are we close to a lease timeout? */
         if (time_after(now, last + lease/3)) {
                 cred = ops->get_state_renewal_cred_locked(clp);
@@ -90,19 +84,15 @@ nfs4_renew_state(struct work_struct *work)
                         /* Queue an asynchronous RENEW. */
                         ops->sched_state_renewal(clp, cred);
                         put_rpccred(cred);
+                        goto out_exp;
                 }
-                timeout = (2 * lease) / 3;
-                spin_lock(&clp->cl_lock);
-        } else
+        } else {
                 dprintk("%s: failed to call renewd. Reason: lease not expired \n",
                                 __func__);
-        if (timeout < 5 * HZ)    /* safeguard */
-                timeout = 5 * HZ;
-        dprintk("%s: requeueing work. Lease period = %ld\n",
-                        __func__, (timeout + HZ - 1) / HZ);
-        cancel_delayed_work(&clp->cl_renewd);
-        schedule_delayed_work(&clp->cl_renewd, timeout);
-        spin_unlock(&clp->cl_lock);
+                spin_unlock(&clp->cl_lock);
+        }
+        nfs4_schedule_state_renewal(clp);
+out_exp:
         nfs_expire_unreferenced_delegations(clp);
 out:
         dprintk("%s: done\n", __func__);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6d263ed79e92..6c5ed51f105e 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -901,7 +901,7 @@ void nfs4_schedule_state_recovery(struct nfs_client *clp)
         nfs4_schedule_state_manager(clp);
 }
 
-static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
+int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
 
         set_bit(NFS_STATE_RECLAIM_REBOOT, &state->flags);
@@ -1249,26 +1249,65 @@ static int nfs4_reclaim_lease(struct nfs_client *clp)
 }
 
 #ifdef CONFIG_NFS_V4_1
+void nfs41_handle_recall_slot(struct nfs_client *clp)
+{
+        set_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+        nfs4_schedule_state_recovery(clp);
+}
+
+static void nfs4_reset_all_state(struct nfs_client *clp)
+{
+        if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
+                clp->cl_boot_time = CURRENT_TIME;
+                nfs4_state_start_reclaim_nograce(clp);
+                nfs4_schedule_state_recovery(clp);
+        }
+}
+
+static void nfs41_handle_server_reboot(struct nfs_client *clp)
+{
+        if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
+                nfs4_state_start_reclaim_reboot(clp);
+                nfs4_schedule_state_recovery(clp);
+        }
+}
+
+static void nfs41_handle_state_revoked(struct nfs_client *clp)
+{
+        /* Temporary */
+        nfs4_reset_all_state(clp);
+}
+
+static void nfs41_handle_recallable_state_revoked(struct nfs_client *clp)
+{
+        /* This will need to handle layouts too */
+        nfs_expire_all_delegations(clp);
+}
+
+static void nfs41_handle_cb_path_down(struct nfs_client *clp)
+{
+        nfs_expire_all_delegations(clp);
+        if (test_and_set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) == 0)
+                nfs4_schedule_state_recovery(clp);
+}
+
 void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
 {
         if (!flags)
                 return;
-        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED) {
-                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                nfs4_state_start_reclaim_reboot(clp);
-                nfs4_schedule_state_recovery(clp);
-        } else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
+        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
+                nfs41_handle_server_reboot(clp);
+        else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
                             SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
                             SEQ4_STATUS_ADMIN_STATE_REVOKED |
-                            SEQ4_STATUS_RECALLABLE_STATE_REVOKED |
-                            SEQ4_STATUS_LEASE_MOVED)) {
-                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                nfs4_state_start_reclaim_nograce(clp);
-                nfs4_schedule_state_recovery(clp);
-        } else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
+                            SEQ4_STATUS_LEASE_MOVED))
+                nfs41_handle_state_revoked(clp);
+        else if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
+                nfs41_handle_recallable_state_revoked(clp);
+        else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
                             SEQ4_STATUS_BACKCHANNEL_FAULT |
                             SEQ4_STATUS_CB_PATH_DOWN_SESSION))
-                nfs_expire_all_delegations(clp);
+                nfs41_handle_cb_path_down(clp);
 }
 
 static int nfs4_reset_session(struct nfs_client *clp)
@@ -1285,23 +1324,52 @@ static int nfs4_reset_session(struct nfs_client *clp)
 
         memset(clp->cl_session->sess_id.data, 0, NFS4_MAX_SESSIONID_LEN);
         status = nfs4_proc_create_session(clp);
-        if (status)
+        if (status) {
                 status = nfs4_recovery_handle_error(clp, status);
+                goto out;
+        }
+        /* create_session negotiated new slot table */
+        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
 
-out:
-        /*
-         * Let the state manager reestablish state
-         */
-        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) &&
-            status == 0)
+         /* Let the state manager reestablish state */
+        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
                 nfs41_setup_state_renewal(clp);
-
+out:
         return status;
 }
 
+static int nfs4_recall_slot(struct nfs_client *clp)
+{
+        struct nfs4_slot_table *fc_tbl = &clp->cl_session->fc_slot_table;
+        struct nfs4_channel_attrs *fc_attrs = &clp->cl_session->fc_attrs;
+        struct nfs4_slot *new, *old;
+        int i;
+
+        nfs4_begin_drain_session(clp);
+        new = kmalloc(fc_tbl->target_max_slots * sizeof(struct nfs4_slot),
+                      GFP_KERNEL);
+        if (!new)
+                return -ENOMEM;
+
+        spin_lock(&fc_tbl->slot_tbl_lock);
+        for (i = 0; i < fc_tbl->target_max_slots; i++)
+                new[i].seq_nr = fc_tbl->slots[i].seq_nr;
+        old = fc_tbl->slots;
+        fc_tbl->slots = new;
+        fc_tbl->max_slots = fc_tbl->target_max_slots;
+        fc_tbl->target_max_slots = 0;
+        fc_attrs->max_reqs = fc_tbl->max_slots;
+        spin_unlock(&fc_tbl->slot_tbl_lock);
+
+        kfree(old);
+        nfs4_end_drain_session(clp);
+        return 0;
+}
+
 #else /* CONFIG_NFS_V4_1 */
 static int nfs4_reset_session(struct nfs_client *clp) { return 0; }
 static int nfs4_end_drain_session(struct nfs_client *clp) { return 0; }
+static int nfs4_recall_slot(struct nfs_client *clp) { return 0; }
 #endif /* CONFIG_NFS_V4_1 */
 
 /* Set NFS4CLNT_LEASE_EXPIRED for all v4.0 errors and for recoverable errors
@@ -1314,6 +1382,7 @@ static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
                 case -NFS4ERR_DELAY:
                 case -NFS4ERR_CLID_INUSE:
                 case -EAGAIN:
+                case -EKEYEXPIRED:
                         break;
 
                 case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
@@ -1397,6 +1466,15 @@ static void nfs4_state_manager(struct nfs_client *clp)
                         nfs_client_return_marked_delegations(clp);
                         continue;
                 }
+                /* Recall session slots */
+                if (test_and_clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state)
+                   && nfs4_has_session(clp)) {
+                        status = nfs4_recall_slot(clp);
+                        if (status < 0)
+                                goto out_error;
+                        continue;
+                }
+
 
                 nfs4_clear_state_manager_bit(clp);
                 /* Did we race with an attempt to give us more work? */
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index e437fd6a819f..38f3b582e7c2 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -38,7 +38,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -1578,6 +1577,14 @@ static void encode_create_session(struct xdr_stream *xdr,
         char machine_name[NFS4_MAX_MACHINE_NAME_LEN];
         uint32_t len;
         struct nfs_client *clp = args->client;
+        u32 max_resp_sz_cached;
+
+        /*
+         * Assumes OPEN is the biggest non-idempotent compound.
+         * 2 is the verifier.
+         */
+        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE +
+                              RPC_MAX_AUTH_SIZE + 2) * XDR_UNIT;
 
         len = scnprintf(machine_name, sizeof(machine_name), "%s",
                         clp->cl_ipaddr);
@@ -1592,7 +1599,7 @@ static void encode_create_session(struct xdr_stream *xdr,
         *p++ = cpu_to_be32(args->fc_attrs.headerpadsz); /* header padding size */
         *p++ = cpu_to_be32(args->fc_attrs.max_rqst_sz); /* max req size */
         *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz); /* max resp size */
-        *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz_cached);  /* Max resp sz cached */
+        *p++ = cpu_to_be32(max_resp_sz_cached);         /* Max resp sz cached */
         *p++ = cpu_to_be32(args->fc_attrs.max_ops);     /* max operations */
         *p++ = cpu_to_be32(args->fc_attrs.max_reqs);    /* max requests */
         *p++ = cpu_to_be32(0);                          /* rdmachannel_attrs */
@@ -4631,7 +4638,7 @@ static int decode_sequence(struct xdr_stream *xdr,
          * If the server returns different values for sessionID, slotID or
          * sequence number, the server is looney tunes.
          */
-        status = -ESERVERFAULT;
+        status = -EREMOTEIO;
 
         if (memcmp(id.data, res->sr_session->sess_id.data,
                    NFS4_MAX_SESSIONID_LEN)) {
@@ -5544,6 +5551,8 @@ static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, __be32 *p, struct nf
         if (status != 0)
                 goto out;
         status = decode_delegreturn(&xdr);
+        if (status != 0)
+                goto out;
         decode_getfattr(&xdr, res->fattr, res->server,
                         !RPC_IS_ASYNC(rqstp->rq_task));
 out:
@@ -5774,7 +5783,7 @@ static struct {
         { NFS4ERR_BAD_COOKIE,   -EBADCOOKIE     },
         { NFS4ERR_NOTSUPP,      -ENOTSUPP       },
         { NFS4ERR_TOOSMALL,     -ETOOSMALL      },
-        { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
+        { NFS4ERR_SERVERFAULT,  -EREMOTEIO      },
         { NFS4ERR_BADTYPE,      -EBADTYPE       },
         { NFS4ERR_LOCKED,       -EAGAIN         },
         { NFS4ERR_SYMLINK,      -ELOOP          },
@@ -5801,7 +5810,7 @@ nfs4_stat_to_errno(int stat)
         }
         if (stat <= 10000 || stat > 10100) {
                 /* The server is looney tunes. */
-                return -ESERVERFAULT;
+                return -EREMOTEIO;
         }
         /* If we cannot translate the error, the recovery routines should
          * handle it.
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index e2975939126a..29d9d36cd5f4 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -112,12 +112,10 @@ void nfs_unlock_request(struct nfs_page *req)
  */
 int nfs_set_page_tag_locked(struct nfs_page *req)
 {
-        struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
-
         if (!nfs_lock_request_dontget(req))
                 return 0;
         if (req->wb_page != NULL)
-                radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+                radix_tree_tag_set(&NFS_I(req->wb_context->path.dentry->d_inode)->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
         return 1;
 }
 
@@ -126,10 +124,10 @@ int nfs_set_page_tag_locked(struct nfs_page *req)
  */
 void nfs_clear_page_tag_locked(struct nfs_page *req)
 {
-        struct inode *inode = req->wb_context->path.dentry->d_inode;
-        struct nfs_inode *nfsi = NFS_I(inode);
-
         if (req->wb_page != NULL) {
+                struct inode *inode = req->wb_context->path.dentry->d_inode;
+                struct nfs_inode *nfsi = NFS_I(inode);
+
                 spin_lock(&inode->i_lock);
                 radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
                 nfs_unlock_request(req);
@@ -142,16 +140,22 @@ void nfs_clear_page_tag_locked(struct nfs_page *req)
  * nfs_clear_request - Free up all resources allocated to the request
  * @req:
  *
- * Release page resources associated with a write request after it
- * has completed.
+ * Release page and open context resources associated with a read/write
+ * request after it has completed.
  */
 void nfs_clear_request(struct nfs_page *req)
 {
         struct page *page = req->wb_page;
+        struct nfs_open_context *ctx = req->wb_context;
+
         if (page != NULL) {
                 page_cache_release(page);
                 req->wb_page = NULL;
         }
+        if (ctx != NULL) {
+                put_nfs_open_context(ctx);
+                req->wb_context = NULL;
+        }
 }
 
 
@@ -165,9 +169,8 @@ static void nfs_free_request(struct kref *kref)
 {
         struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
 
-        /* Release struct file or cached credential */
+        /* Release struct file and open context */
         nfs_clear_request(req);
-        put_nfs_open_context(req->wb_context);
         nfs_page_free(req);
 }
 
@@ -176,6 +179,12 @@ void nfs_release_request(struct nfs_page *req)
         kref_put(&req->wb_kref, nfs_free_request);
 }
 
+static int nfs_wait_bit_uninterruptible(void *word)
+{
+        io_schedule();
+        return 0;
+}
+
 /**
  * nfs_wait_on_request - Wait for a request to complete.
  * @req: request to wait upon.
@@ -186,14 +195,9 @@ void nfs_release_request(struct nfs_page *req)
 int
 nfs_wait_on_request(struct nfs_page *req)
 {
-        int ret = 0;
-
-        if (!test_bit(PG_BUSY, &req->wb_flags))
-                goto out;
-        ret = out_of_line_wait_on_bit(&req->wb_flags, PG_BUSY,
-                        nfs_wait_bit_killable, TASK_KILLABLE);
-out:
-        return ret;
+        return wait_on_bit(&req->wb_flags, PG_BUSY,
+                        nfs_wait_bit_uninterruptible,
+                        TASK_UNINTERRUPTIBLE);
 }
 
 /**
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index ef583854d8d0..0288be80444f 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -29,7 +29,6 @@
 
 #include <linux/types.h>
 #include <linux/param.h>
-#include <linux/slab.h>
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/errno.h>
@@ -47,6 +46,39 @@
 #define NFSDBG_FACILITY         NFSDBG_PROC
 
 /*
+ * wrapper to handle the -EKEYEXPIRED error message. This should generally
+ * only happen if using krb5 auth and a user's TGT expires. NFSv2 doesn't
+ * support the NFSERR_JUKEBOX error code, but we handle this situation in the
+ * same way that we handle that error with NFSv3.
+ */
+static int
+nfs_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
+{
+        int res;
+        do {
+                res = rpc_call_sync(clnt, msg, flags);
+                if (res != -EKEYEXPIRED)
+                        break;
+                schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
+                res = -ERESTARTSYS;
+        } while (!fatal_signal_pending(current));
+        return res;
+}
+
+#define rpc_call_sync(clnt, msg, flags) nfs_rpc_wrapper(clnt, msg, flags)
+
+static int
+nfs_async_handle_expired_key(struct rpc_task *task)
+{
+        if (task->tk_status != -EKEYEXPIRED)
+                return 0;
+        task->tk_status = 0;
+        rpc_restart_call(task);
+        rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
+        return 1;
+}
+
+/*
  * Bare-bones access to getattr: this is for nfs_read_super.
  */
 static int
@@ -307,6 +339,8 @@ nfs_proc_unlink_setup(struct rpc_message *msg, struct inode *dir)
 
 static int nfs_proc_unlink_done(struct rpc_task *task, struct inode *dir)
 {
+        if (nfs_async_handle_expired_key(task))
+                return 0;
         nfs_mark_for_revalidate(dir);
         return 1;
 }
@@ -560,6 +594,9 @@ nfs_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
 
 static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
 {
+        if (nfs_async_handle_expired_key(task))
+                return -EAGAIN;
+
         nfs_invalidate_atime(data->inode);
         if (task->tk_status >= 0) {
                 nfs_refresh_inode(data->inode, data->res.fattr);
@@ -579,6 +616,9 @@ static void nfs_proc_read_setup(struct nfs_read_data *data, struct rpc_message *
 
 static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
 {
+        if (nfs_async_handle_expired_key(task))
+                return -EAGAIN;
+
         if (task->tk_status >= 0)
                 nfs_post_op_update_inode_force_wcc(data->inode, data->res.fattr);
         return 0;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ce907efc5508..e01637240eeb 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -48,6 +48,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/netdevice.h>
 #include <linux/nfs_xdr.h>
@@ -243,6 +244,7 @@ static int  nfs_show_stats(struct seq_file *, struct vfsmount *);
 static int nfs_get_sb(struct file_system_type *, int, const char *, void *, struct vfsmount *);
 static int nfs_xdev_get_sb(struct file_system_type *fs_type,
                 int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt);
+static void nfs_put_super(struct super_block *);
 static void nfs_kill_super(struct super_block *);
 static int nfs_remount(struct super_block *sb, int *flags, char *raw_data);
 
@@ -266,6 +268,7 @@ static const struct super_operations nfs_sops = {
         .alloc_inode    = nfs_alloc_inode,
         .destroy_inode  = nfs_destroy_inode,
         .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
         .statfs         = nfs_statfs,
         .clear_inode    = nfs_clear_inode,
         .umount_begin   = nfs_umount_begin,
@@ -335,6 +338,7 @@ static const struct super_operations nfs4_sops = {
         .alloc_inode    = nfs_alloc_inode,
         .destroy_inode  = nfs_destroy_inode,
         .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
         .statfs         = nfs_statfs,
         .clear_inode    = nfs4_clear_inode,
         .umount_begin   = nfs_umount_begin,
@@ -2211,7 +2215,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2253,11 +2257,25 @@ out_err_nosb:
 error_splat_root:
         dput(mntroot);
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         goto out;
 }
 
 /*
+ * Ensure that we unregister the bdi before kill_anon_super
+ * releases the device name
+ */
+static void nfs_put_super(struct super_block *s)
+{
+        struct nfs_server *server = NFS_SB(s);
+
+        bdi_unregister(&server->backing_dev_info);
+}
+
+/*
  * Destroy an NFS2/3 superblock
  */
 static void nfs_kill_super(struct super_block *s)
@@ -2265,7 +2283,6 @@ static void nfs_kill_super(struct super_block *s)
         struct nfs_server *server = NFS_SB(s);
 
         kill_anon_super(s);
-        bdi_unregister(&server->backing_dev_info);
         nfs_fscache_release_super_cookie(s);
         nfs_free_server(server);
 }
@@ -2313,7 +2330,7 @@ static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2350,6 +2367,9 @@ out_err_noserver:
         return error;
 
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         dprintk("<-- nfs_xdev_get_sb() = %d [splat]\n", error);
         return error;
@@ -2565,7 +2585,7 @@ static int nfs4_remote_get_sb(struct file_system_type *fs_type,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2603,6 +2623,9 @@ out_free:
 error_splat_root:
         dput(mntroot);
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         goto out;
 }
@@ -2798,7 +2821,7 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2834,6 +2857,9 @@ out_err_noserver:
         return error;
 
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         dprintk("<-- nfs4_xdev_get_sb() = %d [splat]\n", error);
         return error;
@@ -2880,7 +2906,7 @@ static int nfs4_remote_referral_get_sb(struct file_system_type *fs_type,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2916,6 +2942,9 @@ out_err_noserver:
         return error;
 
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         dprintk("<-- nfs4_referral_get_sb() = %d [splat]\n", error);
         return error;
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 412738dbfbc7..05c9e02f4153 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -19,7 +19,6 @@
 #include <linux/pagemap.h>
 #include <linux/stat.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/namei.h>
 
@@ -50,7 +49,7 @@ static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         struct page *page;
         void *err;
 
-        err = ERR_PTR(nfs_revalidate_mapping_nolock(inode, inode->i_mapping));
+        err = ERR_PTR(nfs_revalidate_mapping(inode, inode->i_mapping));
         if (err)
                 goto read_failed;
         page = read_cache_page(&inode->i_data, 0,
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index 70e1fbbaaeab..ad4d2e787b20 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -15,8 +15,10 @@
 
 #include "callback.h"
 
+#ifdef CONFIG_NFS_V4
 static const int nfs_set_port_min = 0;
 static const int nfs_set_port_max = 65535;
+#endif
 static struct ctl_table_header *nfs_callback_sysctl_table;
 
 static ctl_table nfs_cb_sysctls[] = {
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index d171696017f4..de38d63aa920 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -201,6 +201,7 @@ static int nfs_set_page_writeback(struct page *page)
                 struct inode *inode = page->mapping->host;
                 struct nfs_server *nfss = NFS_SERVER(inode);
 
+                page_cache_get(page);
                 if (atomic_long_inc_return(&nfss->writeback) >
                                 NFS_CONGESTION_ON_THRESH) {
                         set_bdi_congested(&nfss->backing_dev_info,
@@ -216,6 +217,7 @@ static void nfs_end_page_writeback(struct page *page)
         struct nfs_server *nfss = NFS_SERVER(inode);
 
         end_page_writeback(page);
+        page_cache_release(page);
         if (atomic_long_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH)
                 clear_bdi_congested(&nfss->backing_dev_info, BLK_RW_ASYNC);
 }
@@ -421,6 +423,7 @@ static void
 nfs_mark_request_dirty(struct nfs_page *req)
 {
         __set_page_dirty_nobuffers(req->wb_page);
+        __mark_inode_dirty(req->wb_page->mapping->host, I_DIRTY_DATASYNC);
 }
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
@@ -438,6 +441,7 @@ nfs_mark_request_commit(struct nfs_page *req)
         radix_tree_tag_set(&nfsi->nfs_page_tree,
                         req->wb_index,
                         NFS_PAGE_TAG_COMMIT);
+        nfsi->ncommit++;
         spin_unlock(&inode->i_lock);
         inc_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
         inc_bdi_stat(req->wb_page->mapping->backing_dev_info, BDI_RECLAIMABLE);
@@ -501,57 +505,6 @@ int nfs_reschedule_unstable_write(struct nfs_page *req)
 }
 #endif
 
-/*
- * Wait for a request to complete.
- *
- * Interruptible by fatal signals only.
- */
-static int nfs_wait_on_requests_locked(struct inode *inode, pgoff_t idx_start, unsigned int npages)
-{
-        struct nfs_inode *nfsi = NFS_I(inode);
-        struct nfs_page *req;
-        pgoff_t idx_end, next;
-        unsigned int            res = 0;
-        int                     error;
-
-        if (npages == 0)
-                idx_end = ~0;
-        else
-                idx_end = idx_start + npages - 1;
-
-        next = idx_start;
-        while (radix_tree_gang_lookup_tag(&nfsi->nfs_page_tree, (void **)&req, next, 1, NFS_PAGE_TAG_LOCKED)) {
-                if (req->wb_index > idx_end)
-                        break;
-
-                next = req->wb_index + 1;
-                BUG_ON(!NFS_WBACK_BUSY(req));
-
-                kref_get(&req->wb_kref);
-                spin_unlock(&inode->i_lock);
-                error = nfs_wait_on_request(req);
-                nfs_release_request(req);
-                spin_lock(&inode->i_lock);
-                if (error < 0)
-                        return error;
-                res++;
-        }
-        return res;
-}
-
-static void nfs_cancel_commit_list(struct list_head *head)
-{
-        struct nfs_page *req;
-
-        while(!list_empty(head)) {
-                req = nfs_list_entry(head->next);
-                nfs_list_remove_request(req);
-                nfs_clear_request_commit(req);
-                nfs_inode_remove_request(req);
-                nfs_unlock_request(req);
-        }
-}
-
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
 static int
 nfs_need_commit(struct nfs_inode *nfsi)
@@ -573,11 +526,17 @@ static int
 nfs_scan_commit(struct inode *inode, struct list_head *dst, pgoff_t idx_start, unsigned int npages)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
+        int ret;
 
         if (!nfs_need_commit(nfsi))
                 return 0;
 
-        return nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
+        ret = nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
+        if (ret > 0)
+                nfsi->ncommit -= ret;
+        if (nfs_need_commit(NFS_I(inode)))
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+        return ret;
 }
 #else
 static inline int nfs_need_commit(struct nfs_inode *nfsi)
@@ -642,9 +601,10 @@ static struct nfs_page *nfs_try_to_update_request(struct inode *inode,
                 spin_lock(&inode->i_lock);
         }
 
-        if (nfs_clear_request_commit(req))
-                radix_tree_tag_clear(&NFS_I(inode)->nfs_page_tree,
-                                req->wb_index, NFS_PAGE_TAG_COMMIT);
+        if (nfs_clear_request_commit(req) &&
+                        radix_tree_tag_clear(&NFS_I(inode)->nfs_page_tree,
+                                req->wb_index, NFS_PAGE_TAG_COMMIT) != NULL)
+                NFS_I(inode)->ncommit--;
 
         /* Okay, the request matches. Update the region */
         if (offset < req->wb_offset) {
@@ -703,9 +663,11 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
         req = nfs_setup_write_request(ctx, page, offset, count);
         if (IS_ERR(req))
                 return PTR_ERR(req);
+        nfs_mark_request_dirty(req);
         /* Update file length */
         nfs_grow_file(page, offset, count);
         nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
+        nfs_mark_request_dirty(req);
         nfs_clear_page_tag_locked(req);
         return 0;
 }
@@ -782,8 +744,6 @@ int nfs_updatepage(struct file *file, struct page *page,
         status = nfs_writepage_setup(ctx, page, offset, count);
         if (status < 0)
                 nfs_set_pageerror(page);
-        else
-                __set_page_dirty_nobuffers(page);
 
         dprintk("NFS:       nfs_updatepage returns %d (isize %lld)\n",
                         status, (long long)i_size_read(inode));
@@ -792,13 +752,12 @@ int nfs_updatepage(struct file *file, struct page *page,
 
 static void nfs_writepage_release(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
 
-        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req)) {
-                nfs_end_page_writeback(req->wb_page);
+        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req))
                 nfs_inode_remove_request(req);
-        } else
-                nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 
 static int flush_task_priority(int how)
@@ -822,7 +781,6 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 int how)
 {
         struct inode *inode = req->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
         int priority = flush_task_priority(how);
         struct rpc_task *task;
         struct rpc_message msg = {
@@ -837,9 +795,10 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 .callback_ops = call_ops,
                 .callback_data = data,
                 .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                 .priority = priority,
         };
+        int ret = 0;
 
         /* Set up the RPC argument and reply structs
          * NB: take care not to mess about with data->commit et al. */
@@ -878,10 +837,18 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 (unsigned long long)data->args.offset);
 
         task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task))
-                return PTR_ERR(task);
+        if (IS_ERR(task)) {
+                ret = PTR_ERR(task);
+                goto out;
+        }
+        if (how & FLUSH_SYNC) {
+                ret = rpc_wait_for_completion_task(task);
+                if (ret == 0)
+                        ret = task->tk_status;
+        }
         rpc_put_task(task);
-        return 0;
+out:
+        return ret;
 }
 
 /* If a nfs_flush_* function fails, it should remove reqs from @head and
@@ -890,9 +857,11 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
  */
 static void nfs_redirty_request(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
+
         nfs_mark_request_dirty(req);
-        nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 
 /*
@@ -1127,16 +1096,15 @@ static void nfs_writeback_release_full(void *calldata)
                 if (nfs_write_need_commit(data)) {
                         memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
                         nfs_mark_request_commit(req);
-                        nfs_end_page_writeback(page);
                         dprintk(" marked for commit\n");
                         goto next;
                 }
                 dprintk(" OK\n");
 remove_request:
-                nfs_end_page_writeback(page);
                 nfs_inode_remove_request(req);
         next:
                 nfs_clear_page_tag_locked(req);
+                nfs_end_page_writeback(page);
         }
         nfs_writedata_release(calldata);
 }
@@ -1233,7 +1201,7 @@ int nfs_writeback_done(struct rpc_task *task, struct nfs_write_data *data)
 
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-void nfs_commitdata_release(void *data)
+static void nfs_commitdata_release(void *data)
 {
         struct nfs_write_data *wdata = data;
 
@@ -1250,7 +1218,6 @@ static int nfs_commit_rpcsetup(struct list_head *head,
 {
         struct nfs_page *first = nfs_list_entry(head->next);
         struct inode *inode = first->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
         int priority = flush_task_priority(how);
         struct rpc_task *task;
         struct rpc_message msg = {
@@ -1265,7 +1232,7 @@ static int nfs_commit_rpcsetup(struct list_head *head,
                 .callback_ops = &nfs_commit_ops,
                 .callback_data = data,
                 .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                 .priority = priority,
         };
 
@@ -1295,6 +1262,8 @@ static int nfs_commit_rpcsetup(struct list_head *head,
         task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
+        if (how & FLUSH_SYNC)
+                rpc_wait_for_completion_task(task);
         rpc_put_task(task);
         return 0;
 }
@@ -1391,7 +1360,7 @@ static const struct rpc_call_ops nfs_commit_ops = {
         .rpc_release = nfs_commit_release,
 };
 
-int nfs_commit_inode(struct inode *inode, int how)
+static int nfs_commit_inode(struct inode *inode, int how)
 {
         LIST_HEAD(head);
         int res;
@@ -1406,92 +1375,51 @@ int nfs_commit_inode(struct inode *inode, int how)
         }
         return res;
 }
-#else
-static inline int nfs_commit_list(struct inode *inode, struct list_head *head, int how)
-{
-        return 0;
-}
-#endif
 
-long nfs_sync_mapping_wait(struct address_space *mapping, struct writeback_control *wbc, int how)
+static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
-        struct inode *inode = mapping->host;
-        pgoff_t idx_start, idx_end;
-        unsigned int npages = 0;
-        LIST_HEAD(head);
-        int nocommit = how & FLUSH_NOCOMMIT;
-        long pages, ret;
-
-        /* FIXME */
-        if (wbc->range_cyclic)
-                idx_start = 0;
-        else {
-                idx_start = wbc->range_start >> PAGE_CACHE_SHIFT;
-                idx_end = wbc->range_end >> PAGE_CACHE_SHIFT;
-                if (idx_end > idx_start) {
-                        pgoff_t l_npages = 1 + idx_end - idx_start;
-                        npages = l_npages;
-                        if (sizeof(npages) != sizeof(l_npages) &&
-                                        (pgoff_t)npages != l_npages)
-                                npages = 0;
+        struct nfs_inode *nfsi = NFS_I(inode);
+        int flags = FLUSH_SYNC;
+        int ret = 0;
+
+        /* Don't commit yet if this is a non-blocking flush and there are
+         * lots of outstanding writes for this mapping.
+         */
+        if (wbc->sync_mode == WB_SYNC_NONE &&
+            nfsi->ncommit <= (nfsi->npages >> 1))
+                goto out_mark_dirty;
+
+        if (wbc->nonblocking || wbc->for_background)
+                flags = 0;
+        ret = nfs_commit_inode(inode, flags);
+        if (ret >= 0) {
+                if (wbc->sync_mode == WB_SYNC_NONE) {
+                        if (ret < wbc->nr_to_write)
+                                wbc->nr_to_write -= ret;
+                        else
+                                wbc->nr_to_write = 0;
                 }
+                return 0;
         }
-        how &= ~FLUSH_NOCOMMIT;
-        spin_lock(&inode->i_lock);
-        do {
-                ret = nfs_wait_on_requests_locked(inode, idx_start, npages);
-                if (ret != 0)
-                        continue;
-                if (nocommit)
-                        break;
-                pages = nfs_scan_commit(inode, &head, idx_start, npages);
-                if (pages == 0)
-                        break;
-                if (how & FLUSH_INVALIDATE) {
-                        spin_unlock(&inode->i_lock);
-                        nfs_cancel_commit_list(&head);
-                        ret = pages;
-                        spin_lock(&inode->i_lock);
-                        continue;
-                }
-                pages += nfs_scan_commit(inode, &head, 0, 0);
-                spin_unlock(&inode->i_lock);
-                ret = nfs_commit_list(inode, &head, how);
-                spin_lock(&inode->i_lock);
-
-        } while (ret >= 0);
-        spin_unlock(&inode->i_lock);
+out_mark_dirty:
+        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
         return ret;
 }
-
-static int __nfs_write_mapping(struct address_space *mapping, struct writeback_control *wbc, int how)
+#else
+static int nfs_commit_inode(struct inode *inode, int how)
 {
-        int ret;
-
-        ret = nfs_writepages(mapping, wbc);
-        if (ret < 0)
-                goto out;
-        ret = nfs_sync_mapping_wait(mapping, wbc, how);
-        if (ret < 0)
-                goto out;
         return 0;
-out:
-        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
-        return ret;
 }
 
-/* Two pass sync: first using WB_SYNC_NONE, then WB_SYNC_ALL */
-static int nfs_write_mapping(struct address_space *mapping, int how)
+static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
-        struct writeback_control wbc = {
-                .bdi = mapping->backing_dev_info,
-                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
-                .range_start = 0,
-                .range_end = LLONG_MAX,
-        };
+        return 0;
+}
+#endif
 
-        return __nfs_write_mapping(mapping, &wbc, how);
+int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return nfs_commit_unstable_pages(inode, wbc);
 }
 
 /*
@@ -1499,37 +1427,26 @@ static int nfs_write_mapping(struct address_space *mapping, int how)
  */
 int nfs_wb_all(struct inode *inode)
 {
-        return nfs_write_mapping(inode->i_mapping, 0);
-}
+        struct writeback_control wbc = {
+                .sync_mode = WB_SYNC_ALL,
+                .nr_to_write = LONG_MAX,
+                .range_start = 0,
+                .range_end = LLONG_MAX,
+        };
 
-int nfs_wb_nocommit(struct inode *inode)
-{
-        return nfs_write_mapping(inode->i_mapping, FLUSH_NOCOMMIT);
+        return sync_inode(inode, &wbc);
 }
 
 int nfs_wb_page_cancel(struct inode *inode, struct page *page)
 {
         struct nfs_page *req;
-        loff_t range_start = page_offset(page);
-        loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
-        struct writeback_control wbc = {
-                .bdi = page->mapping->backing_dev_info,
-                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
-                .range_start = range_start,
-                .range_end = range_end,
-        };
         int ret = 0;
 
         BUG_ON(!PageLocked(page));
         for (;;) {
                 req = nfs_page_find_request(page);
                 if (req == NULL)
-                        goto out;
-                if (test_bit(PG_CLEAN, &req->wb_flags)) {
-                        nfs_release_request(req);
                         break;
-                }
                 if (nfs_lock_request_dontget(req)) {
                         nfs_inode_remove_request(req);
                         /*
@@ -1541,55 +1458,56 @@ int nfs_wb_page_cancel(struct inode *inode, struct page *page)
                         break;
                 }
                 ret = nfs_wait_on_request(req);
+                nfs_release_request(req);
                 if (ret < 0)
-                        goto out;
+                        break;
         }
-        if (!PagePrivate(page))
-                return 0;
-        ret = nfs_sync_mapping_wait(page->mapping, &wbc, FLUSH_INVALIDATE);
-out:
         return ret;
 }
 
-static int nfs_wb_page_priority(struct inode *inode, struct page *page,
-                                int how)
+/*
+ * Write back all requests on one page - we do this before reading it.
+ */
+int nfs_wb_page(struct inode *inode, struct page *page)
 {
         loff_t range_start = page_offset(page);
         loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
         struct writeback_control wbc = {
-                .bdi = page->mapping->backing_dev_info,
                 .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
+                .nr_to_write = 0,
                 .range_start = range_start,
                 .range_end = range_end,
         };
+        struct nfs_page *req;
+        int need_commit;
         int ret;
 
-        do {
+        while(PagePrivate(page)) {
                 if (clear_page_dirty_for_io(page)) {
                         ret = nfs_writepage_locked(page, &wbc);
                         if (ret < 0)
                                 goto out_error;
-                } else if (!PagePrivate(page))
+                }
+                req = nfs_find_and_lock_request(page);
+                if (!req)
                         break;
-                ret = nfs_sync_mapping_wait(page->mapping, &wbc, how);
-                if (ret < 0)
+                if (IS_ERR(req)) {
+                        ret = PTR_ERR(req);
                         goto out_error;
-        } while (PagePrivate(page));
+                }
+                need_commit = test_bit(PG_CLEAN, &req->wb_flags);
+                nfs_clear_page_tag_locked(req);
+                if (need_commit) {
+                        ret = nfs_commit_inode(inode, FLUSH_SYNC);
+                        if (ret < 0)
+                                goto out_error;
+                }
+        }
         return 0;
 out_error:
-        __mark_inode_dirty(inode, I_DIRTY_PAGES);
         return ret;
 }
 
-/*
- * Write back all requests on one page - we do this before reading it.
- */
-int nfs_wb_page(struct inode *inode, struct page* page)
-{
-        return nfs_wb_page_priority(inode, page, FLUSH_STABLE);
-}
-
 #ifdef CONFIG_MIGRATION
 int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
                 struct page *page)
@@ -1597,8 +1515,7 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
         struct nfs_page *req;
         int ret;
 
-        if (PageFsCache(page))
-                nfs_fscache_release_page(page, GFP_KERNEL);
+        nfs_fscache_release_page(page, GFP_KERNEL);
 
         req = nfs_find_and_lock_request(page);
         ret = PTR_ERR(req);
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 04133aacb1e5..fc1c52571c03 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -22,6 +22,7 @@
 
 #include <linux/module.h>
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/sunrpc/xdr.h>
 #include <linux/nfsacl.h>
 #include <linux/nfs3.h>
diff --git a/fs/nfsctl.c b/fs/nfsctl.c
index d3854d94b7cf..bf9cbd242ddd 100644
--- a/fs/nfsctl.c
+++ b/fs/nfsctl.c
@@ -36,10 +36,9 @@ static struct file *do_open(char *name, int flags)
                 return ERR_PTR(error);
 
         if (flags == O_RDWR)
-                error = may_open(&nd.path, MAY_READ|MAY_WRITE,
-                                           FMODE_READ|FMODE_WRITE);
+                error = may_open(&nd.path, MAY_READ|MAY_WRITE, flags);
         else
-                error = may_open(&nd.path, MAY_WRITE, FMODE_WRITE);
+                error = may_open(&nd.path, MAY_WRITE, flags);
 
         if (!error)
                 return dentry_open(nd.path.dentry, nd.path.mnt, flags,
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index c487810a2366..872a5ef550c7 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -12,6 +12,7 @@
  * Copyright (C) 1995, 1996 Olaf Kirch, <okir@monad.swb.de>
  */
 
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/module.h>
 #include <linux/exportfs.h>
@@ -1316,19 +1317,11 @@ rqst_exp_parent(struct svc_rqst *rqstp, struct path *path)
 
 static struct svc_export *find_fsidzero_export(struct svc_rqst *rqstp)
 {
-        struct svc_export *exp;
         u32 fsidv[2];
 
         mk_fsid(FSID_NUM, fsidv, 0, 0, 0, NULL);
 
-        exp = rqst_exp_find(rqstp, FSID_NUM, fsidv);
-        /*
-         * We shouldn't have accepting an nfsv4 request at all if we
-         * don't have a pseudoexport!:
-         */
-        if (IS_ERR(exp) && PTR_ERR(exp) == -ENOENT)
-                exp = ERR_PTR(-ESERVERFAULT);
-        return exp;
+        return rqst_exp_find(rqstp, FSID_NUM, fsidv);
 }
 
 /*
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index f20589d2ae27..6aa5590c3679 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -7,6 +7,7 @@
 #include "nfsd.h"
 /* FIXME: nfsacl.h is a broken header */
 #include <linux/nfsacl.h>
+#include <linux/gfp.h>
 #include "cache.h"
 #include "xdr3.h"
 #include "vfs.h"
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index e0c4846bad92..a596e9d987e4 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -7,6 +7,7 @@
 #include "nfsd.h"
 /* FIXME: nfsacl.h is a broken header */
 #include <linux/nfsacl.h>
+#include <linux/gfp.h>
 #include "cache.h"
 #include "xdr3.h"
 #include "vfs.h"
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 88150685df34..e48052615159 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -34,6 +34,7 @@
  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <linux/slab.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs4_acl.h>
 
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index c6eed2a3b093..7e32bd394e86 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -32,6 +32,7 @@
  */
 
 #include <linux/sunrpc/clnt.h>
+#include <linux/slab.h>
 #include "nfsd.h"
 #include "state.h"
 
@@ -525,6 +526,8 @@ static struct rpc_cred *callback_cred;
 
 int set_callback_cred(void)
 {
+        if (callback_cred)
+                return 0;
         callback_cred = rpc_lookup_machine_cred();
         if (!callback_cred)
                 return -ENOMEM;
@@ -542,7 +545,8 @@ void do_probe_callback(struct nfs4_client *clp)
         };
         int status;
 
-        status = rpc_call_async(cb->cb_client, &msg, RPC_TASK_SOFT,
+        status = rpc_call_async(cb->cb_client, &msg,
+                                RPC_TASK_SOFT | RPC_TASK_SOFTCONN,
                                 &nfsd4_cb_probe_ops, (void *)clp);
         if (status) {
                 warn_no_callback_path(clp, status);
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index 6e2983b27f3c..c78dbf493424 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -36,6 +36,7 @@
 #include <linux/nfsd_idmap.h>
 #include <linux/seq_file.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 /*
  * Cache entry
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 37514c469846..2ab9e8501bfe 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -33,6 +33,7 @@
  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <linux/file.h>
+#include <linux/slab.h>
 
 #include "cache.h"
 #include "xdr4.h"
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 5a754f7b71ed..7a9ae3254a4b 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -32,6 +32,7 @@
 */
 
 #include <linux/file.h>
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/crypto.h>
 #include <linux/sched.h>
@@ -119,9 +120,7 @@ out_no_tfm:
 static void
 nfsd4_sync_rec_dir(void)
 {
-        mutex_lock(&rec_dir.dentry->d_inode->i_mutex);
-        nfsd_sync_dir(rec_dir.dentry);
-        mutex_unlock(&rec_dir.dentry->d_inode->i_mutex);
+        vfs_fsync(NULL, rec_dir.dentry, 0);
 }
 
 int
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index f19ed866c95f..6a8fedaa4f55 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -34,6 +34,7 @@
 
 #include <linux/file.h>
 #include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/swap.h>
 #include <linux/sunrpc/svcauth_gss.h>
@@ -1998,7 +1999,9 @@ nfs4_file_downgrade(struct file *filp, unsigned int share_access)
 {
         if (share_access & NFS4_SHARE_ACCESS_WRITE) {
                 drop_file_write_access(filp);
+                spin_lock(&filp->f_lock);
                 filp->f_mode = (filp->f_mode | FMODE_READ) & ~FMODE_WRITE;
+                spin_unlock(&filp->f_lock);
         }
 }
 
@@ -2480,8 +2483,10 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
         }
         memcpy(&open->op_stateid, &stp->st_stateid, sizeof(stateid_t));
 
-        if (nfsd4_has_session(&resp->cstate))
+        if (nfsd4_has_session(&resp->cstate)) {
                 open->op_stateowner->so_confirmed = 1;
+                nfsd4_create_clid_dir(open->op_stateowner->so_client);
+        }
 
         /*
         * Attempt to hand out a delegation. No error return, because the
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index a8587e90fd5a..34ccf815ea8a 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -40,6 +40,7 @@
  * at the end of nfs4svc_decode_compoundargs.
  */
 
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/statfs.h>
 #include <linux/utsname.h>
@@ -160,10 +161,10 @@ static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
         argp->p = page_address(argp->pagelist[0]);
         argp->pagelist++;
         if (argp->pagelen < PAGE_SIZE) {
-                argp->end = p + (argp->pagelen>>2);
+                argp->end = argp->p + (argp->pagelen>>2);
                 argp->pagelen = 0;
         } else {
-                argp->end = p + (PAGE_SIZE>>2);
+                argp->end = argp->p + (PAGE_SIZE>>2);
                 argp->pagelen -= PAGE_SIZE;
         }
         memcpy(((char*)p)+avail, argp->p, (nbytes - avail));
@@ -1425,16 +1426,16 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
                         argp->p = page_address(argp->pagelist[0]);
                         argp->pagelist++;
                         if (argp->pagelen < PAGE_SIZE) {
-                                argp->end = p + (argp->pagelen>>2);
+                                argp->end = argp->p + (argp->pagelen>>2);
                                 argp->pagelen = 0;
                         } else {
-                                argp->end = p + (PAGE_SIZE>>2);
+                                argp->end = argp->p + (PAGE_SIZE>>2);
                                 argp->pagelen -= PAGE_SIZE;
                         }
                 }
                 op->opnum = ntohl(*argp->p++);
 
-                if (op->opnum >= OP_ACCESS && op->opnum < ops->nops)
+                if (op->opnum >= FIRST_NFS4_OP && op->opnum <= LAST_NFS4_OP)
                         op->status = ops->decoders[op->opnum](argp, &op->u);
                 else {
                         op->opnum = OP_ILLEGAL;
@@ -1528,7 +1529,7 @@ static void write_cinfo(__be32 **p, struct nfsd4_change_info *c)
         } } while (0);
 
 /* Encode as an array of strings the string given with components
- * seperated @sep.
+ * separated @sep.
  */
 static __be32 nfsd4_encode_components(char sep, char *components,
                                    __be32 **pp, int *buflen)
@@ -2121,9 +2122,15 @@ out_acl:
                  * and this is the root of a cross-mounted filesystem.
                  */
                 if (ignore_crossmnt == 0 &&
-                    exp->ex_path.mnt->mnt_root->d_inode == dentry->d_inode) {
-                        err = vfs_getattr(exp->ex_path.mnt->mnt_parent,
-                                exp->ex_path.mnt->mnt_mountpoint, &stat);
+                    dentry == exp->ex_path.mnt->mnt_root) {
+                        struct path path = exp->ex_path;
+                        path_get(&path);
+                        while (follow_up(&path)) {
+                                if (path.dentry != path.mnt->mnt_root)
+                                        break;
+                        }
+                        err = vfs_getattr(path.mnt, path.dentry, &stat);
+                        path_put(&path);
                         if (err)
                                 goto out_nfserr;
                 }
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index da08560c4818..4666a209678a 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -8,6 +8,8 @@
  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  */
 
+#include <linux/slab.h>
+
 #include "nfsd.h"
 #include "cache.h"
 
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 2604c3e70ea5..e3591073098f 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -4,6 +4,7 @@
  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
  */
 
+#include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
 
@@ -988,6 +989,7 @@ static ssize_t __write_ports_delfd(char *buf)
 static ssize_t __write_ports_addxprt(char *buf)
 {
         char transport[16];
+        struct svc_xprt *xprt;
         int port, err;
 
         if (sscanf(buf, "%15s %4u", transport, &port) != 2)
@@ -1002,13 +1004,24 @@ static ssize_t __write_ports_addxprt(char *buf)
 
         err = svc_create_xprt(nfsd_serv, transport,
                                 PF_INET, port, SVC_SOCK_ANONYMOUS);
-        if (err < 0) {
-                /* Give a reasonable perror msg for bad transport string */
-                if (err == -ENOENT)
-                        err = -EPROTONOSUPPORT;
-                return err;
-        }
+        if (err < 0)
+                goto out_err;
+
+        err = svc_create_xprt(nfsd_serv, transport,
+                                PF_INET6, port, SVC_SOCK_ANONYMOUS);
+        if (err < 0 && err != -EAFNOSUPPORT)
+                goto out_close;
         return 0;
+out_close:
+        xprt = svc_find_xprt(nfsd_serv, transport, PF_INET, port);
+        if (xprt != NULL) {
+                svc_close_xprt(xprt);
+                svc_xprt_put(xprt);
+        }
+out_err:
+        /* Decrease the count, but don't shut down the service */
+        nfsd_serv->sv_nrthreads--;
+        return err;
 }
 
 /*
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7c2e337d05af..6dd5f1970e01 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -20,13 +20,15 @@
 #include <linux/fcntl.h>
 #include <linux/namei.h>
 #include <linux/delay.h>
-#include <linux/quotaops.h>
 #include <linux/fsnotify.h>
 #include <linux/posix_acl_xattr.h>
 #include <linux/xattr.h>
 #include <linux/jhash.h>
 #include <linux/ima.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
+#include <linux/exportfs.h>
+#include <linux/writeback.h>
 
 #ifdef CONFIG_NFSD_V3
 #include "xdr3.h"
@@ -271,6 +273,32 @@ out:
         return err;
 }
 
+/*
+ * Commit metadata changes to stable storage.
+ */
+static int
+commit_metadata(struct svc_fh *fhp)
+{
+        struct inode *inode = fhp->fh_dentry->d_inode;
+        const struct export_operations *export_ops = inode->i_sb->s_export_op;
+        int error = 0;
+
+        if (!EX_ISSYNC(fhp->fh_export))
+                return 0;
+
+        if (export_ops->commit_metadata) {
+                error = export_ops->commit_metadata(inode);
+        } else {
+                struct writeback_control wbc = {
+                        .sync_mode = WB_SYNC_ALL,
+                        .nr_to_write = 0, /* metadata only */
+                };
+
+                error = sync_inode(inode, &wbc);
+        }
+
+        return error;
+}
 
 /*
  * Set various file attributes.
@@ -361,7 +389,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                  * If we are changing the size of the file, then
                  * we need to break all leases.
                  */
-                host_err = break_lease(inode, FMODE_WRITE | O_NONBLOCK);
+                host_err = break_lease(inode, O_WRONLY | O_NONBLOCK);
                 if (host_err == -EWOULDBLOCK)
                         host_err = -ETIMEDOUT;
                 if (host_err) /* ENOMEM or EWOULDBLOCK */
@@ -377,7 +405,6 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                         put_write_access(inode);
                         goto out_nfserr;
                 }
-                vfs_dq_init(inode);
         }
 
         /* sanitize the mode change */
@@ -734,7 +761,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
          * Check to see if there are any leases on this file.
          * This may block while leases are broken.
          */
-        host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? FMODE_WRITE : 0));
+        host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
         if (host_err == -EWOULDBLOCK)
                 host_err = -ETIMEDOUT;
         if (host_err) /* NOMEM or WOULDBLOCK */
@@ -745,13 +772,13 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                         flags = O_RDWR|O_LARGEFILE;
                 else
                         flags = O_WRONLY|O_LARGEFILE;
-
-                vfs_dq_init(inode);
         }
         *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt),
                             flags, current_cred());
         if (IS_ERR(*filp))
                 host_err = PTR_ERR(*filp);
+        else
+                host_err = ima_file_check(*filp, access);
 out_nfserr:
         err = nfserrno(host_err);
 out:
@@ -769,46 +796,6 @@ nfsd_close(struct file *filp)
 }
 
 /*
- * Sync a file
- * As this calls fsync (not fdatasync) there is no need for a write_inode
- * after it.
- */
-static inline int nfsd_dosync(struct file *filp, struct dentry *dp,
-                              const struct file_operations *fop)
-{
-        struct inode *inode = dp->d_inode;
-        int (*fsync) (struct file *, struct dentry *, int);
-        int err;
-
-        err = filemap_fdatawrite(inode->i_mapping);
-        if (err == 0 && fop && (fsync = fop->fsync))
-                err = fsync(filp, dp, 0);
-        if (err == 0)
-                err = filemap_fdatawait(inode->i_mapping);
-
-        return err;
-}
-
-static int
-nfsd_sync(struct file *filp)
-{
-        int err;
-        struct inode *inode = filp->f_path.dentry->d_inode;
-        dprintk("nfsd: sync file %s\n", filp->f_path.dentry->d_name.name);
-        mutex_lock(&inode->i_mutex);
-        err=nfsd_dosync(filp, filp->f_path.dentry, filp->f_op);
-        mutex_unlock(&inode->i_mutex);
-
-        return err;
-}
-
-int
-nfsd_sync_dir(struct dentry *dp)
-{
-        return nfsd_dosync(NULL, dp, dp->d_inode->i_fop);
-}
-
-/*
  * Obtain the readahead parameters for the file
  * specified by (dev, ino).
  */
@@ -1011,7 +998,7 @@ static int wait_for_concurrent_writes(struct file *file)
 
         if (inode->i_state & I_DIRTY) {
                 dprintk("nfsd: write sync %d\n", task_pid_nr(current));
-                err = nfsd_sync(file);
+                err = vfs_fsync(file, file->f_path.dentry, 0);
         }
         last_ino = inode->i_ino;
         last_dev = inode->i_sb->s_dev;
@@ -1159,8 +1146,9 @@ out:
 #ifdef CONFIG_NFSD_V3
 /*
  * Commit all pending writes to stable storage.
- * Strictly speaking, we could sync just the indicated file region here,
- * but there's currently no way we can ask the VFS to do so.
+ *
+ * Note: we only guarantee that data that lies within the range specified
+ * by the 'offset' and 'count' parameters will be synced.
  *
  * Unfortunately we cannot lock the file to make sure we return full WCC
  * data to the client, as locking happens lower down in the filesystem.
@@ -1170,23 +1158,32 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
                loff_t offset, unsigned long count)
 {
         struct file     *file;
-        __be32          err;
+        loff_t          end = LLONG_MAX;
+        __be32          err = nfserr_inval;
 
-        if ((u64)count > ~(u64)offset)
-                return nfserr_inval;
+        if (offset < 0)
+                goto out;
+        if (count != 0) {
+                end = offset + (loff_t)count - 1;
+                if (end < offset)
+                        goto out;
+        }
 
         err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_WRITE, &file);
         if (err)
-                return err;
+                goto out;
         if (EX_ISSYNC(fhp->fh_export)) {
-                if (file->f_op && file->f_op->fsync) {
-                        err = nfserrno(nfsd_sync(file));
-                } else {
+                int err2 = vfs_fsync_range(file, file->f_path.dentry,
+                                offset, end, 0);
+
+                if (err2 != -EINVAL)
+                        err = nfserrno(err2);
+                else
                         err = nfserr_notsupp;
-                }
         }
 
         nfsd_close(file);
+out:
         return err;
 }
 #endif /* CONFIG_NFSD_V3 */
@@ -1339,12 +1336,14 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 goto out_nfserr;
         }
 
-        if (EX_ISSYNC(fhp->fh_export)) {
-                err = nfserrno(nfsd_sync_dir(dentry));
-                write_inode_now(dchild->d_inode, 1);
-        }
+        err = nfsd_create_setattr(rqstp, resfhp, iap);
 
-        err2 = nfsd_create_setattr(rqstp, resfhp, iap);
+        /*
+         * nfsd_setattr already committed the child.  Transactional filesystems
+         * had a chance to commit changes for both parent and child
+         * simultaneously making the following commit_metadata a noop.
+         */
+        err2 = nfserrno(commit_metadata(fhp));
         if (err2)
                 err = err2;
         mnt_drop_write(fhp->fh_export->ex_path.mnt);
@@ -1376,7 +1375,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         struct dentry   *dentry, *dchild = NULL;
         struct inode    *dirp;
         __be32          err;
-        __be32          err2;
         int             host_err;
         __u32           v_mtime=0, v_atime=0;
 
@@ -1471,11 +1469,6 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (created)
                 *created = 1;
 
-        if (EX_ISSYNC(fhp->fh_export)) {
-                err = nfserrno(nfsd_sync_dir(dentry));
-                /* setattr will sync the child (or not) */
-        }
-
         nfsd_check_ignore_resizing(iap);
 
         if (createmode == NFS3_CREATE_EXCLUSIVE) {
@@ -1490,9 +1483,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         }
 
  set_attr:
-        err2 = nfsd_create_setattr(rqstp, resfhp, iap);
-        if (err2)
-                err = err2;
+        err = nfsd_create_setattr(rqstp, resfhp, iap);
+
+        /*
+         * nfsd_setattr already committed the child (and possibly also the parent).
+         */
+        if (!err)
+                err = nfserrno(commit_metadata(fhp));
 
         mnt_drop_write(fhp->fh_export->ex_path.mnt);
         /*
@@ -1607,12 +1604,9 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 }
         } else
                 host_err = vfs_symlink(dentry->d_inode, dnew, path);
-
-        if (!host_err) {
-                if (EX_ISSYNC(fhp->fh_export))
-                        host_err = nfsd_sync_dir(dentry);
-        }
         err = nfserrno(host_err);
+        if (!err)
+                err = nfserrno(commit_metadata(fhp));
         fh_unlock(fhp);
 
         mnt_drop_write(fhp->fh_export->ex_path.mnt);
@@ -1674,11 +1668,9 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
         }
         host_err = vfs_link(dold, dirp, dnew);
         if (!host_err) {
-                if (EX_ISSYNC(ffhp->fh_export)) {
-                        err = nfserrno(nfsd_sync_dir(ddir));
-                        write_inode_now(dest, 1);
-                }
-                err = 0;
+                err = nfserrno(commit_metadata(ffhp));
+                if (!err)
+                        err = nfserrno(commit_metadata(tfhp));
         } else {
                 if (host_err == -EXDEV && rqstp->rq_vers == 2)
                         err = nfserr_acces;
@@ -1774,10 +1766,10 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
                 goto out_dput_new;
 
         host_err = vfs_rename(fdir, odentry, tdir, ndentry);
-        if (!host_err && EX_ISSYNC(tfhp->fh_export)) {
-                host_err = nfsd_sync_dir(tdentry);
+        if (!host_err) {
+                host_err = commit_metadata(tfhp);
                 if (!host_err)
-                        host_err = nfsd_sync_dir(fdentry);
+                        host_err = commit_metadata(ffhp);
         }
 
         mnt_drop_write(ffhp->fh_export->ex_path.mnt);
@@ -1858,12 +1850,9 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
 
         dput(rdentry);
 
-        if (host_err)
-                goto out_drop;
-        if (EX_ISSYNC(fhp->fh_export))
-                host_err = nfsd_sync_dir(dentry);
+        if (!host_err)
+                host_err = commit_metadata(fhp);
 
-out_drop:
         mnt_drop_write(fhp->fh_export->ex_path.mnt);
 out_nfserr:
         err = nfserrno(host_err);
@@ -2130,7 +2119,6 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
          */
         path.mnt = exp->ex_path.mnt;
         path.dentry = dentry;
-        err = ima_path_check(&path, acc & (MAY_READ | MAY_WRITE | MAY_EXEC));
 nfsd_out:
         return err? nfserrno(err) : 0;
 }
diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
index 3f959f1879d8..7cfb87e692da 100644
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -26,6 +26,7 @@
 #include <linux/buffer_head.h>
 #include <linux/fs.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 #include "mdt.h"
 #include "alloc.h"
 
@@ -425,7 +426,7 @@ void nilfs_palloc_abort_alloc_entry(struct inode *inode,
         bitmap = bitmap_kaddr + bh_offset(req->pr_bitmap_bh);
         if (!nilfs_clear_bit_atomic(nilfs_mdt_bgl_lock(inode, group),
                                     group_offset, bitmap))
-                printk(KERN_WARNING "%s: entry numer %llu already freed\n",
+                printk(KERN_WARNING "%s: entry number %llu already freed\n",
                        __func__, (unsigned long long)req->pr_entry_nr);
 
         nilfs_palloc_group_desc_add_entries(inode, group, desc, 1);
diff --git a/fs/nilfs2/alloc.h b/fs/nilfs2/alloc.h
index f4543ac4f560..5cccf874d692 100644
--- a/fs/nilfs2/alloc.h
+++ b/fs/nilfs2/alloc.h
@@ -42,7 +42,7 @@ void *nilfs_palloc_block_get_entry(const struct inode *, __u64,
                                    const struct buffer_head *, void *);
 
 /**
- * nilfs_palloc_req - persistent alloctor request and reply
+ * nilfs_palloc_req - persistent allocator request and reply
  * @pr_entry_nr: entry number (vblocknr or inode number)
  * @pr_desc_bh: buffer head of the buffer containing block group descriptors
  * @pr_bitmap_bh: buffer head of the buffer containing a block group bitmap
diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
index f4a14ea2ed9c..effdbdbe6c11 100644
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -417,8 +417,8 @@ __u64 nilfs_bmap_data_get_key(const struct nilfs_bmap *bmap,
 
         key = page_index(bh->b_page) << (PAGE_CACHE_SHIFT -
                                          bmap->b_inode->i_blkbits);
-        for (pbh = page_buffers(bh->b_page); pbh != bh;
-             pbh = pbh->b_this_page, key++);
+        for (pbh = page_buffers(bh->b_page); pbh != bh; pbh = pbh->b_this_page)
+                key++;
 
         return key;
 }
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 471e269536ae..447ce47a3306 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -27,6 +27,7 @@
 #include <linux/buffer_head.h>
 #include <linux/mm.h>
 #include <linux/backing-dev.h>
+#include <linux/gfp.h>
 #include "nilfs.h"
 #include "mdt.h"
 #include "dat.h"
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 7cdd98b8d514..76c38e3e19d2 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1879,7 +1879,7 @@ static int nilfs_btree_propagate_v(struct nilfs_btree *btree,
                                    struct nilfs_btree_path *path,
                                    int level, struct buffer_head *bh)
 {
-        int maxlevel, ret;
+        int maxlevel = 0, ret;
         struct nilfs_btree_node *parent;
         struct inode *dat = nilfs_bmap_get_dat(&btree->bt_bmap);
         __u64 ptr;
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index d5ad54e204a5..18737818db63 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -328,19 +328,24 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                         tnicps += nicps;
                         nilfs_mdt_mark_buffer_dirty(cp_bh);
                         nilfs_mdt_mark_dirty(cpfile);
-                        if (!nilfs_cpfile_is_in_first(cpfile, cno) &&
-                            (count = nilfs_cpfile_block_sub_valid_checkpoints(
-                                    cpfile, cp_bh, kaddr, nicps)) == 0) {
-                                /* make hole */
-                                kunmap_atomic(kaddr, KM_USER0);
-                                brelse(cp_bh);
-                                ret = nilfs_cpfile_delete_checkpoint_block(
-                                        cpfile, cno);
-                                if (ret == 0)
-                                        continue;
-                                printk(KERN_ERR "%s: cannot delete block\n",
-                                       __func__);
-                                break;
+                        if (!nilfs_cpfile_is_in_first(cpfile, cno)) {
+                                count =
+                                  nilfs_cpfile_block_sub_valid_checkpoints(
+                                                cpfile, cp_bh, kaddr, nicps);
+                                if (count == 0) {
+                                        /* make hole */
+                                        kunmap_atomic(kaddr, KM_USER0);
+                                        brelse(cp_bh);
+                                        ret =
+                                          nilfs_cpfile_delete_checkpoint_block(
+                                                                   cpfile, cno);
+                                        if (ret == 0)
+                                                continue;
+                                        printk(KERN_ERR
+                                               "%s: cannot delete block\n",
+                                               __func__);
+                                        break;
+                                }
                         }
                 }
 
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index 187dd07ba86c..013146755683 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -288,7 +288,7 @@ int nilfs_dat_mark_dirty(struct inode *dat, __u64 vblocknr)
  * @vblocknrs and @nitems.
  *
  * Return Value: On success, 0 is returned. On error, one of the following
- * nagative error codes is returned.
+ * negative error codes is returned.
  *
  * %-EIO - I/O error.
  *
@@ -388,8 +388,7 @@ int nilfs_dat_translate(struct inode *dat, __u64 vblocknr, sector_t *blocknrp)
                 ret = -ENOENT;
                 goto out;
         }
-        if (blocknrp != NULL)
-                *blocknrp = blocknr;
+        *blocknrp = blocknr;
 
  out:
         kunmap_atomic(kaddr, KM_USER0);
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 76d803e060a9..85c89dfc71f0 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -224,7 +224,7 @@ fail:
  * len <= NILFS_NAME_LEN and de != NULL are guaranteed by caller.
  */
 static int
-nilfs_match(int len, const char * const name, struct nilfs_dir_entry *de)
+nilfs_match(int len, const unsigned char *name, struct nilfs_dir_entry *de)
 {
         if (len != de->name_len)
                 return 0;
@@ -349,11 +349,11 @@ done:
  * Entry is guaranteed to be valid.
  */
 struct nilfs_dir_entry *
-nilfs_find_entry(struct inode *dir, struct dentry *dentry,
+nilfs_find_entry(struct inode *dir, const struct qstr *qstr,
                  struct page **res_page)
 {
-        const char *name = dentry->d_name.name;
-        int namelen = dentry->d_name.len;
+        const unsigned char *name = qstr->name;
+        int namelen = qstr->len;
         unsigned reclen = NILFS_DIR_REC_LEN(namelen);
         unsigned long start, n;
         unsigned long npages = dir_pages(dir);
@@ -396,7 +396,7 @@ nilfs_find_entry(struct inode *dir, struct dentry *dentry,
                 /* next page is past the blocks we've got */
                 if (unlikely(n > (dir->i_blocks >> (PAGE_CACHE_SHIFT - 9)))) {
                         nilfs_error(dir->i_sb, __func__,
-                               "dir %lu size %lld exceeds block cout %llu",
+                               "dir %lu size %lld exceeds block count %llu",
                                dir->i_ino, dir->i_size,
                                (unsigned long long)dir->i_blocks);
                         goto out;
@@ -424,13 +424,13 @@ struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p)
         return de;
 }
 
-ino_t nilfs_inode_by_name(struct inode *dir, struct dentry *dentry)
+ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)
 {
         ino_t res = 0;
         struct nilfs_dir_entry *de;
         struct page *page;
 
-        de = nilfs_find_entry(dir, dentry, &page);
+        de = nilfs_find_entry(dir, qstr, &page);
         if (de) {
                 res = le64_to_cpu(de->inode);
                 kunmap(page);
@@ -465,7 +465,7 @@ void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de,
 int nilfs_add_link(struct dentry *dentry, struct inode *inode)
 {
         struct inode *dir = dentry->d_parent->d_inode;
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         int namelen = dentry->d_name.len;
         unsigned chunk_size = nilfs_chunk_size(dir);
         unsigned reclen = NILFS_DIR_REC_LEN(namelen);
diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index d369ac718277..236753df5cdf 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -51,11 +51,11 @@ static int nilfs_direct_lookup(const struct nilfs_bmap *bmap,
         struct nilfs_direct *direct;
         __u64 ptr;
 
-        direct = (struct nilfs_direct *)bmap;
-        if ((key > NILFS_DIRECT_KEY_MAX) ||
-            (level != 1) ||     /* XXX: use macro for level 1 */
-            ((ptr = nilfs_direct_get_ptr(direct, key)) ==
-             NILFS_BMAP_INVALID_PTR))
+        direct = (struct nilfs_direct *)bmap;  /* XXX: use macro for level 1 */
+        if (key > NILFS_DIRECT_KEY_MAX || level != 1)
+                return -ENOENT;
+        ptr = nilfs_direct_get_ptr(direct, key);
+        if (ptr == NILFS_BMAP_INVALID_PTR)
                 return -ENOENT;
 
         if (ptrp != NULL)
@@ -73,9 +73,10 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *bmap,
         sector_t blocknr;
         int ret, cnt;
 
-        if (key > NILFS_DIRECT_KEY_MAX ||
-            (ptr = nilfs_direct_get_ptr(direct, key)) ==
-            NILFS_BMAP_INVALID_PTR)
+        if (key > NILFS_DIRECT_KEY_MAX)
+                return -ENOENT;
+        ptr = nilfs_direct_get_ptr(direct, key);
+        if (ptr == NILFS_BMAP_INVALID_PTR)
                 return -ENOENT;
 
         if (NILFS_BMAP_USE_VBN(bmap)) {
diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c
index e16a6664dfa2..145f03cd7d3e 100644
--- a/fs/nilfs2/gcinode.c
+++ b/fs/nilfs2/gcinode.c
@@ -28,10 +28,10 @@
  * gcinodes), and this file provides lookup function of the dummy
  * inodes and their buffer read function.
  *
- * Since NILFS2 keeps up multiple checkpoints/snapshots accross GC, it
+ * Since NILFS2 keeps up multiple checkpoints/snapshots across GC, it
  * has to treat blocks that belong to a same file but have different
  * checkpoint numbers.  To avoid interference among generations, dummy
- * inodes are managed separatly from actual inodes, and their lookup
+ * inodes are managed separately from actual inodes, and their lookup
  * function (nilfs_gc_iget) is designed to be specified with a
  * checkpoint number argument as well as an inode number.
  *
@@ -45,6 +45,7 @@
 #include <linux/buffer_head.h>
 #include <linux/mpage.h>
 #include <linux/hash.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 #include "nilfs.h"
 #include "page.h"
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 7868cc122ac7..0957b58f909d 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -22,6 +22,7 @@
  */
 
 #include <linux/buffer_head.h>
+#include <linux/gfp.h>
 #include <linux/mpage.h>
 #include <linux/writeback.h>
 #include <linux/uio.h>
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index f6af76042d80..f90a33d9a5b0 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -23,9 +23,11 @@
 #include <linux/fs.h>
 #include <linux/wait.h>
 #include <linux/smp_lock.h>     /* lock_kernel(), unlock_kernel() */
+#include <linux/slab.h>
 #include <linux/capability.h>   /* capable() */
 #include <linux/uaccess.h>      /* copy_from_user(), copy_to_user() */
 #include <linux/vmalloc.h>
+#include <linux/mount.h>        /* mnt_want_write(), mnt_drop_write() */
 #include <linux/nilfs2_fs.h>
 #include "nilfs.h"
 #include "segment.h"
@@ -107,20 +109,28 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
+
+        ret = mnt_want_write(filp->f_path.mnt);
+        if (ret)
+                return ret;
+
+        ret = -EFAULT;
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
-                return -EFAULT;
+                goto out;
 
         mutex_lock(&nilfs->ns_mount_mutex);
+
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
-        if (unlikely(ret < 0)) {
+        if (unlikely(ret < 0))
                 nilfs_transaction_abort(inode->i_sb);
-                mutex_unlock(&nilfs->ns_mount_mutex);
-                return ret;
-        }
-        nilfs_transaction_commit(inode->i_sb); /* never fails */
+        else
+                nilfs_transaction_commit(inode->i_sb); /* never fails */
+
         mutex_unlock(&nilfs->ns_mount_mutex);
+out:
+        mnt_drop_write(filp->f_path.mnt);
         return ret;
 }
 
@@ -135,16 +145,23 @@ nilfs_ioctl_delete_checkpoint(struct inode *inode, struct file *filp,
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
+
+        ret = mnt_want_write(filp->f_path.mnt);
+        if (ret)
+                return ret;
+
+        ret = -EFAULT;
         if (copy_from_user(&cno, argp, sizeof(cno)))
-                return -EFAULT;
+                goto out;
 
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_delete_checkpoint(cpfile, cno);
-        if (unlikely(ret < 0)) {
+        if (unlikely(ret < 0))
                 nilfs_transaction_abort(inode->i_sb);
-                return ret;
-        }
-        nilfs_transaction_commit(inode->i_sb); /* never fails */
+        else
+                nilfs_transaction_commit(inode->i_sb); /* never fails */
+out:
+        mnt_drop_write(filp->f_path.mnt);
         return ret;
 }
 
@@ -480,7 +497,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                                       unsigned int cmd, void __user *argp)
 {
         struct nilfs_argv argv[5];
-        const static size_t argsz[5] = {
+        static const size_t argsz[5] = {
                 sizeof(struct nilfs_vdesc),
                 sizeof(struct nilfs_period),
                 sizeof(__u64),
@@ -496,12 +513,19 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        ret = mnt_want_write(filp->f_path.mnt);
+        if (ret)
+                return ret;
+
+        ret = -EFAULT;
         if (copy_from_user(argv, argp, sizeof(argv)))
-                return -EFAULT;
+                goto out;
 
+        ret = -EINVAL;
         nsegs = argv[4].v_nmembs;
         if (argv[4].v_size != argsz[4])
-                return -EINVAL;
+                goto out;
+
         /*
          * argv[4] points to segment numbers this ioctl cleans.  We
          * use kmalloc() for its buffer because memory used for the
@@ -509,9 +533,10 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
          */
         kbufs[4] = memdup_user((void __user *)(unsigned long)argv[4].v_base,
                                nsegs * sizeof(__u64));
-        if (IS_ERR(kbufs[4]))
-                return PTR_ERR(kbufs[4]);
-
+        if (IS_ERR(kbufs[4])) {
+                ret = PTR_ERR(kbufs[4]);
+                goto out;
+        }
         nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
 
         for (n = 0; n < 4; n++) {
@@ -563,10 +588,12 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                 nilfs_remove_all_gcinode(nilfs);
         clear_nilfs_gc_running(nilfs);
 
- out_free:
+out_free:
         while (--n >= 0)
                 vfree(kbufs[n]);
         kfree(kbufs[4]);
+out:
+        mnt_drop_write(filp->f_path.mnt);
         return ret;
 }
 
@@ -575,13 +602,17 @@ static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
 {
         __u64 cno;
         int ret;
+        struct the_nilfs *nilfs;
 
         ret = nilfs_construct_segment(inode->i_sb);
         if (ret < 0)
                 return ret;
 
         if (argp != NULL) {
-                cno = NILFS_SB(inode->i_sb)->s_nilfs->ns_cno - 1;
+                nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+                down_read(&nilfs->ns_segctor_sem);
+                cno = nilfs->ns_cno - 1;
+                up_read(&nilfs->ns_segctor_sem);
                 if (copy_to_user(argp, &cno, sizeof(cno)))
                         return -EFAULT;
         }
@@ -618,7 +649,7 @@ static int nilfs_ioctl_get_info(struct inode *inode, struct file *filp,
 long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct inode *inode = filp->f_dentry->d_inode;
-        void __user *argp = (void * __user *)arg;
+        void __user *argp = (void __user *)arg;
 
         switch (cmd) {
         case NILFS_IOCTL_CHANGE_CPMODE:
diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c
index 06713ffcc7f2..024be8c35bb6 100644
--- a/fs/nilfs2/mdt.c
+++ b/fs/nilfs2/mdt.c
@@ -26,6 +26,7 @@
 #include <linux/writeback.h>
 #include <linux/backing-dev.h>
 #include <linux/swap.h>
+#include <linux/slab.h>
 #include "nilfs.h"
 #include "segment.h"
 #include "page.h"
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index 07ba838ef089..ad6ed2cf19b4 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -67,7 +67,7 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         if (dentry->d_name.len > NILFS_NAME_LEN)
                 return ERR_PTR(-ENAMETOOLONG);
 
-        ino = nilfs_inode_by_name(dir, dentry);
+        ino = nilfs_inode_by_name(dir, &dentry->d_name);
         inode = NULL;
         if (ino) {
                 inode = nilfs_iget(dir->i_sb, ino);
@@ -81,10 +81,7 @@ struct dentry *nilfs_get_parent(struct dentry *child)
 {
         unsigned long ino;
         struct inode *inode;
-        struct dentry dotdot;
-
-        dotdot.d_name.name = "..";
-        dotdot.d_name.len = 2;
+        struct qstr dotdot = {.name = "..", .len = 2};
 
         ino = nilfs_inode_by_name(child->d_inode, &dotdot);
         if (!ino)
@@ -296,7 +293,7 @@ static int nilfs_do_unlink(struct inode *dir, struct dentry *dentry)
         int err;
 
         err = -ENOENT;
-        de = nilfs_find_entry(dir, dentry, &page);
+        de = nilfs_find_entry(dir, &dentry->d_name, &page);
         if (!de)
                 goto out;
 
@@ -389,7 +386,7 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 return err;
 
         err = -ENOENT;
-        old_de = nilfs_find_entry(old_dir, old_dentry, &old_page);
+        old_de = nilfs_find_entry(old_dir, &old_dentry->d_name, &old_page);
         if (!old_de)
                 goto out;
 
@@ -409,7 +406,7 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         goto out_dir;
 
                 err = -ENOENT;
-                new_de = nilfs_find_entry(new_dir, new_dentry, &new_page);
+                new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, &new_page);
                 if (!new_de)
                         goto out_dir;
                 inc_nlink(old_inode);
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 4da6f67e9a91..8723e5bfd071 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -217,10 +217,10 @@ static inline int nilfs_init_acl(struct inode *inode, struct inode *dir)
 
 /* dir.c */
 extern int nilfs_add_link(struct dentry *, struct inode *);
-extern ino_t nilfs_inode_by_name(struct inode *, struct dentry *);
+extern ino_t nilfs_inode_by_name(struct inode *, const struct qstr *);
 extern int nilfs_make_empty(struct inode *, struct inode *);
 extern struct nilfs_dir_entry *
-nilfs_find_entry(struct inode *, struct dentry *, struct page **);
+nilfs_find_entry(struct inode *, const struct qstr *, struct page **);
 extern int nilfs_delete_entry(struct nilfs_dir_entry *, struct page *);
 extern int nilfs_empty_dir(struct inode *);
 extern struct nilfs_dir_entry *nilfs_dotdot(struct inode *, struct page **);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index a2692bbc7b50..8de3e1e48130 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -29,6 +29,7 @@
 #include <linux/list.h>
 #include <linux/highmem.h>
 #include <linux/pagevec.h>
+#include <linux/gfp.h>
 #include "nilfs.h"
 #include "page.h"
 #include "mdt.h"
@@ -292,7 +293,7 @@ void nilfs_free_private_page(struct page *page)
  * @src: source page
  * @copy_dirty: flag whether to copy dirty states on the page's buffer heads.
  *
- * This fuction is for both data pages and btnode pages.  The dirty flag
+ * This function is for both data pages and btnode pages.  The dirty flag
  * should be treated by caller.  The page must not be under i/o.
  * Both src and dst page must be locked
  */
@@ -388,7 +389,7 @@ repeat:
 }
 
 /**
- * nilfs_copy_back_pages -- copy back pages to orignal cache from shadow cache
+ * nilfs_copy_back_pages -- copy back pages to original cache from shadow cache
  * @dmap: destination page cache
  * @smap: source page cache
  *
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index c9c96c7825dc..ba43146f3c30 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -23,6 +23,7 @@
 #include <linux/buffer_head.h>
 #include <linux/blkdev.h>
 #include <linux/swap.h>
+#include <linux/slab.h>
 #include <linux/crc32.h>
 #include "nilfs.h"
 #include "segment.h"
@@ -39,7 +40,6 @@ enum {
         NILFS_SEG_FAIL_IO,
         NILFS_SEG_FAIL_MAGIC,
         NILFS_SEG_FAIL_SEQ,
-        NILFS_SEG_FAIL_CHECKSUM_SEGSUM,
         NILFS_SEG_FAIL_CHECKSUM_SUPER_ROOT,
         NILFS_SEG_FAIL_CHECKSUM_FULL,
         NILFS_SEG_FAIL_CONSISTENCY,
@@ -71,10 +71,6 @@ static int nilfs_warn_segment_error(int err)
                 printk(KERN_WARNING
                        "NILFS warning: Sequence number mismatch\n");
                 break;
-        case NILFS_SEG_FAIL_CHECKSUM_SEGSUM:
-                printk(KERN_WARNING
-                       "NILFS warning: Checksum error in segment summary\n");
-                break;
         case NILFS_SEG_FAIL_CHECKSUM_SUPER_ROOT:
                 printk(KERN_WARNING
                        "NILFS warning: Checksum error in super root\n");
@@ -206,19 +202,15 @@ int nilfs_read_super_root_block(struct super_block *sb, sector_t sr_block,
  * @pseg_start: start disk block number of partial segment
  * @seg_seq: sequence number requested
  * @ssi: pointer to nilfs_segsum_info struct to store information
- * @full_check: full check flag
- *              (0: only checks segment summary CRC, 1: data CRC)
  */
 static int
 load_segment_summary(struct nilfs_sb_info *sbi, sector_t pseg_start,
-                     u64 seg_seq, struct nilfs_segsum_info *ssi,
-                     int full_check)
+                     u64 seg_seq, struct nilfs_segsum_info *ssi)
 {
         struct buffer_head *bh_sum;
         struct nilfs_segment_summary *sum;
-        unsigned long offset, nblock;
-        u64 check_bytes;
-        u32 crc, crc_sum;
+        unsigned long nblock;
+        u32 crc;
         int ret = NILFS_SEG_FAIL_IO;
 
         bh_sum = sb_bread(sbi->s_super, pseg_start);
@@ -237,34 +229,24 @@ load_segment_summary(struct nilfs_sb_info *sbi, sector_t pseg_start,
                 ret = NILFS_SEG_FAIL_SEQ;
                 goto failed;
         }
-        if (full_check) {
-                offset = sizeof(sum->ss_datasum);
-                check_bytes =
-                        ((u64)ssi->nblocks << sbi->s_super->s_blocksize_bits);
-                nblock = ssi->nblocks;
-                crc_sum = le32_to_cpu(sum->ss_datasum);
-                ret = NILFS_SEG_FAIL_CHECKSUM_FULL;
-        } else { /* only checks segment summary */
-                offset = sizeof(sum->ss_datasum) + sizeof(sum->ss_sumsum);
-                check_bytes = ssi->sumbytes;
-                nblock = ssi->nsumblk;
-                crc_sum = le32_to_cpu(sum->ss_sumsum);
-                ret = NILFS_SEG_FAIL_CHECKSUM_SEGSUM;
-        }
 
+        nblock = ssi->nblocks;
         if (unlikely(nblock == 0 ||
                      nblock > sbi->s_nilfs->ns_blocks_per_segment)) {
                 /* This limits the number of blocks read in the CRC check */
                 ret = NILFS_SEG_FAIL_CONSISTENCY;
                 goto failed;
         }
-        if (calc_crc_cont(sbi, bh_sum, &crc, offset, check_bytes,
+        if (calc_crc_cont(sbi, bh_sum, &crc, sizeof(sum->ss_datasum),
+                          ((u64)nblock << sbi->s_super->s_blocksize_bits),
                           pseg_start, nblock)) {
                 ret = NILFS_SEG_FAIL_IO;
                 goto failed;
         }
-        if (crc == crc_sum)
+        if (crc == le32_to_cpu(sum->ss_datasum))
                 ret = 0;
+        else
+                ret = NILFS_SEG_FAIL_CHECKSUM_FULL;
  failed:
         brelse(bh_sum);
  out:
@@ -598,7 +580,7 @@ static int nilfs_do_roll_forward(struct the_nilfs *nilfs,
 
         while (segnum != ri->ri_segnum || pseg_start <= ri->ri_pseg_start) {
 
-                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi, 1);
+                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi);
                 if (ret) {
                         if (ret == NILFS_SEG_FAIL_IO) {
                                 err = -EIO;
@@ -821,7 +803,7 @@ int nilfs_search_super_root(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi,
 
         for (;;) {
                 /* Load segment summary */
-                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi, 1);
+                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi);
                 if (ret) {
                         if (ret == NILFS_SEG_FAIL_IO)
                                 goto failed;
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 645c78656aa0..17851f77f739 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -25,6 +25,7 @@
 #include <linux/writeback.h>
 #include <linux/crc32.h>
 #include <linux/backing-dev.h>
+#include <linux/slab.h>
 #include "page.h"
 #include "segbuf.h"
 
@@ -32,7 +33,7 @@
 struct nilfs_write_info {
         struct the_nilfs       *nilfs;
         struct bio             *bio;
-        int                     start, end; /* The region to be submitted */
+        int                     start, end; /* The region to be submitted */
         int                     rest_blocks;
         int                     max_pages;
         int                     nr_vecs;
@@ -40,6 +41,11 @@ struct nilfs_write_info {
 };
 
 
+static int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
+                              struct the_nilfs *nilfs);
+static int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf);
+
+
 static struct kmem_cache *nilfs_segbuf_cachep;
 
 static void nilfs_segbuf_init_once(void *obj)
@@ -169,7 +175,7 @@ int nilfs_segbuf_reset(struct nilfs_segment_buffer *segbuf, unsigned flags,
 }
 
 /*
- * Setup segument summary
+ * Setup segment summary
  */
 void nilfs_segbuf_fill_in_segsum(struct nilfs_segment_buffer *segbuf)
 {
@@ -302,17 +308,30 @@ void nilfs_truncate_logs(struct list_head *logs,
         }
 }
 
+int nilfs_write_logs(struct list_head *logs, struct the_nilfs *nilfs)
+{
+        struct nilfs_segment_buffer *segbuf;
+        int ret = 0;
+
+        list_for_each_entry(segbuf, logs, sb_list) {
+                ret = nilfs_segbuf_write(segbuf, nilfs);
+                if (ret)
+                        break;
+        }
+        return ret;
+}
+
 int nilfs_wait_on_logs(struct list_head *logs)
 {
         struct nilfs_segment_buffer *segbuf;
-        int err;
+        int err, ret = 0;
 
         list_for_each_entry(segbuf, logs, sb_list) {
                 err = nilfs_segbuf_wait(segbuf);
-                if (err)
-                        return err;
+                if (err && !ret)
+                        ret = err;
         }
-        return 0;
+        return ret;
 }
 
 /*
@@ -452,8 +471,8 @@ static int nilfs_segbuf_submit_bh(struct nilfs_segment_buffer *segbuf,
  *
  * %-ENOMEM - Insufficient memory available.
  */
-int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
-                       struct the_nilfs *nilfs)
+static int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
+                              struct the_nilfs *nilfs)
 {
         struct nilfs_write_info wi;
         struct buffer_head *bh;
@@ -496,7 +515,7 @@ int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
  *
  * %-EIO - I/O error
  */
-int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf)
+static int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf)
 {
         int err = 0;
 
diff --git a/fs/nilfs2/segbuf.h b/fs/nilfs2/segbuf.h
index 6af1630fb401..94dfd3517bc0 100644
--- a/fs/nilfs2/segbuf.h
+++ b/fs/nilfs2/segbuf.h
@@ -166,13 +166,10 @@ nilfs_segbuf_add_file_buffer(struct nilfs_segment_buffer *segbuf,
         segbuf->sb_sum.nfileblk++;
 }
 
-int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
-                       struct the_nilfs *nilfs);
-int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf);
-
 void nilfs_clear_logs(struct list_head *logs);
 void nilfs_truncate_logs(struct list_head *logs,
                          struct nilfs_segment_buffer *last);
+int nilfs_write_logs(struct list_head *logs, struct the_nilfs *nilfs);
 int nilfs_wait_on_logs(struct list_head *logs);
 
 static inline void nilfs_destroy_logs(struct list_head *logs)
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 17584c524486..6a7dbd8451db 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -32,6 +32,7 @@
 #include <linux/kthread.h>
 #include <linux/crc32.h>
 #include <linux/pagevec.h>
+#include <linux/slab.h>
 #include "nilfs.h"
 #include "btnode.h"
 #include "page.h"
@@ -141,7 +142,7 @@ int nilfs_init_transaction_cache(void)
 }
 
 /**
- * nilfs_detroy_transaction_cache - destroy the cache for transaction info
+ * nilfs_destroy_transaction_cache - destroy the cache for transaction info
  *
  * nilfs_destroy_transaction_cache() frees the slab cache for the struct
  * nilfs_transaction_info.
@@ -201,7 +202,7 @@ static int nilfs_prepare_segment_lock(struct nilfs_transaction_info *ti)
  * This function allocates a nilfs_transaction_info struct to keep context
  * information on it.  It is initialized and hooked onto the current task in
  * the outermost call.  If a pre-allocated struct is given to @ti, it is used
- * instead; othewise a new struct is assigned from a slab.
+ * instead; otherwise a new struct is assigned from a slab.
  *
  * When @vacancy_check flag is set, this function will check the amount of
  * free space, and will wait for the GC to reclaim disk space if low capacity.
@@ -1510,6 +1511,12 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
                 if (mode != SC_LSEG_SR || sci->sc_stage.scnt < NILFS_ST_CPFILE)
                         break;
 
+                nilfs_clear_logs(&sci->sc_segbufs);
+
+                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
+                if (unlikely(err))
+                        return err;
+
                 if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
                         err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
                                                         sci->sc_freesegs,
@@ -1517,12 +1524,6 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
                                                         NULL);
                         WARN_ON(err); /* do not happen */
                 }
-                nilfs_clear_logs(&sci->sc_segbufs);
-
-                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
-                if (unlikely(err))
-                        return err;
-
                 nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
                 sci->sc_stage = prev_stage;
         }
@@ -1764,14 +1765,9 @@ static int nilfs_segctor_prepare_write(struct nilfs_sc_info *sci,
 static int nilfs_segctor_write(struct nilfs_sc_info *sci,
                                struct the_nilfs *nilfs)
 {
-        struct nilfs_segment_buffer *segbuf;
-        int ret = 0;
+        int ret;
 
-        list_for_each_entry(segbuf, &sci->sc_segbufs, sb_list) {
-                ret = nilfs_segbuf_write(segbuf, nilfs);
-                if (ret)
-                        break;
-        }
+        ret = nilfs_write_logs(&sci->sc_segbufs, nilfs);
         list_splice_tail_init(&sci->sc_segbufs, &sci->sc_write_logs);
         return ret;
 }
@@ -1902,8 +1898,7 @@ static void nilfs_segctor_abort_construction(struct nilfs_sc_info *sci,
 
         list_splice_tail_init(&sci->sc_write_logs, &logs);
         ret = nilfs_wait_on_logs(&logs);
-        if (ret)
-                nilfs_abort_logs(&logs, NULL, sci->sc_super_root, ret);
+        nilfs_abort_logs(&logs, NULL, sci->sc_super_root, ret ? : err);
 
         list_splice_tail_init(&sci->sc_segbufs, &logs);
         nilfs_cancel_segusage(&logs, nilfs->ns_sufile);
@@ -1937,8 +1932,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
 {
         struct nilfs_segment_buffer *segbuf;
         struct page *bd_page = NULL, *fs_page = NULL;
-        struct nilfs_sb_info *sbi = sci->sc_sbi;
-        struct the_nilfs *nilfs = sbi->s_nilfs;
+        struct the_nilfs *nilfs = sci->sc_sbi->s_nilfs;
         int update_sr = (sci->sc_super_root != NULL);
 
         list_for_each_entry(segbuf, &sci->sc_write_logs, sb_list) {
@@ -2020,7 +2014,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
         if (update_sr) {
                 nilfs_set_last_segment(nilfs, segbuf->sb_pseg_start,
                                        segbuf->sb_sum.seg_seq, nilfs->ns_cno++);
-                sbi->s_super->s_dirt = 1;
+                set_nilfs_sb_dirty(nilfs);
 
                 clear_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags);
                 clear_bit(NILFS_SC_DIRTY, &sci->sc_flags);
@@ -2220,7 +2214,7 @@ static int nilfs_segctor_do_construct(struct nilfs_sc_info *sci, int mode)
 }
 
 /**
- * nilfs_secgtor_start_timer - set timer of background write
+ * nilfs_segctor_start_timer - set timer of background write
  * @sci: nilfs_sc_info
  *
  * If the timer has already been set, it ignores the new request.
@@ -2425,43 +2419,43 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode,
         return err;
 }
 
-struct nilfs_segctor_req {
-        int mode;
-        __u32 seq_accepted;
-        int sc_err;  /* construction failure */
-        int sb_err;  /* super block writeback failure */
-};
-
 #define FLUSH_FILE_BIT  (0x1) /* data file only */
 #define FLUSH_DAT_BIT   (1 << NILFS_DAT_INO) /* DAT only */
 
-static void nilfs_segctor_accept(struct nilfs_sc_info *sci,
-                                 struct nilfs_segctor_req *req)
+/**
+ * nilfs_segctor_accept - record accepted sequence count of log-write requests
+ * @sci: segment constructor object
+ */
+static void nilfs_segctor_accept(struct nilfs_sc_info *sci)
 {
-        req->sc_err = req->sb_err = 0;
         spin_lock(&sci->sc_state_lock);
-        req->seq_accepted = sci->sc_seq_request;
+        sci->sc_seq_accepted = sci->sc_seq_request;
         spin_unlock(&sci->sc_state_lock);
 
         if (sci->sc_timer)
                 del_timer_sync(sci->sc_timer);
 }
 
-static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
-                                 struct nilfs_segctor_req *req)
+/**
+ * nilfs_segctor_notify - notify the result of request to caller threads
+ * @sci: segment constructor object
+ * @mode: mode of log forming
+ * @err: error code to be notified
+ */
+static void nilfs_segctor_notify(struct nilfs_sc_info *sci, int mode, int err)
 {
         /* Clear requests (even when the construction failed) */
         spin_lock(&sci->sc_state_lock);
 
-        if (req->mode == SC_LSEG_SR) {
+        if (mode == SC_LSEG_SR) {
                 sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
-                sci->sc_seq_done = req->seq_accepted;
-                nilfs_segctor_wakeup(sci, req->sc_err ? : req->sb_err);
+                sci->sc_seq_done = sci->sc_seq_accepted;
+                nilfs_segctor_wakeup(sci, err);
                 sci->sc_flush_request = 0;
         } else {
-                if (req->mode == SC_FLUSH_FILE)
+                if (mode == SC_FLUSH_FILE)
                         sci->sc_flush_request &= ~FLUSH_FILE_BIT;
-                else if (req->mode == SC_FLUSH_DAT)
+                else if (mode == SC_FLUSH_DAT)
                         sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
                 /* re-enable timer if checkpoint creation was not done */
@@ -2472,30 +2466,37 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
         spin_unlock(&sci->sc_state_lock);
 }
 
-static int nilfs_segctor_construct(struct nilfs_sc_info *sci,
-                                   struct nilfs_segctor_req *req)
+/**
+ * nilfs_segctor_construct - form logs and write them to disk
+ * @sci: segment constructor object
+ * @mode: mode of log forming
+ */
+static int nilfs_segctor_construct(struct nilfs_sc_info *sci, int mode)
 {
         struct nilfs_sb_info *sbi = sci->sc_sbi;
         struct the_nilfs *nilfs = sbi->s_nilfs;
         int err = 0;
 
+        nilfs_segctor_accept(sci);
+
         if (nilfs_discontinued(nilfs))
-                req->mode = SC_LSEG_SR;
-        if (!nilfs_segctor_confirm(sci)) {
-                err = nilfs_segctor_do_construct(sci, req->mode);
-                req->sc_err = err;
-        }
+                mode = SC_LSEG_SR;
+        if (!nilfs_segctor_confirm(sci))
+                err = nilfs_segctor_do_construct(sci, mode);
+
         if (likely(!err)) {
-                if (req->mode != SC_FLUSH_DAT)
+                if (mode != SC_FLUSH_DAT)
                         atomic_set(&nilfs->ns_ndirtyblks, 0);
                 if (test_bit(NILFS_SC_SUPER_ROOT, &sci->sc_flags) &&
                     nilfs_discontinued(nilfs)) {
                         down_write(&nilfs->ns_sem);
-                        req->sb_err = nilfs_commit_super(sbi,
-                                        nilfs_altsb_need_update(nilfs));
+                        err = nilfs_commit_super(
+                                sbi, nilfs_altsb_need_update(nilfs));
                         up_write(&nilfs->ns_sem);
                 }
         }
+
+        nilfs_segctor_notify(sci, mode, err);
         return err;
 }
 
@@ -2526,7 +2527,6 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
         struct nilfs_sc_info *sci = NILFS_SC(sbi);
         struct the_nilfs *nilfs = sbi->s_nilfs;
         struct nilfs_transaction_info ti;
-        struct nilfs_segctor_req req = { .mode = SC_LSEG_SR };
         int err;
 
         if (unlikely(!sci))
@@ -2547,10 +2547,8 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
         list_splice_tail_init(&nilfs->ns_gc_inodes, &sci->sc_gc_inodes);
 
         for (;;) {
-                nilfs_segctor_accept(sci, &req);
-                err = nilfs_segctor_construct(sci, &req);
+                err = nilfs_segctor_construct(sci, SC_LSEG_SR);
                 nilfs_remove_written_gcinodes(nilfs, &sci->sc_gc_inodes);
-                nilfs_segctor_notify(sci, &req);
 
                 if (likely(!err))
                         break;
@@ -2560,6 +2558,16 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule_timeout(sci->sc_interval);
         }
+        if (nilfs_test_opt(sbi, DISCARD)) {
+                int ret = nilfs_discard_segments(nilfs, sci->sc_freesegs,
+                                                 sci->sc_nfreesegs);
+                if (ret) {
+                        printk(KERN_WARNING
+                               "NILFS warning: error %d on discard request, "
+                               "turning discards off for the device\n", ret);
+                        nilfs_clear_opt(sbi, DISCARD);
+                }
+        }
 
  out_unlock:
         sci->sc_freesegs = NULL;
@@ -2573,13 +2581,9 @@ static void nilfs_segctor_thread_construct(struct nilfs_sc_info *sci, int mode)
 {
         struct nilfs_sb_info *sbi = sci->sc_sbi;
         struct nilfs_transaction_info ti;
-        struct nilfs_segctor_req req = { .mode = mode };
 
         nilfs_transaction_lock(sbi, &ti, 0);
-
-        nilfs_segctor_accept(sci, &req);
-        nilfs_segctor_construct(sci, &req);
-        nilfs_segctor_notify(sci, &req);
+        nilfs_segctor_construct(sci, mode);
 
         /*
          * Unclosed segment should be retried.  We do this using sc_timer.
@@ -2635,6 +2639,7 @@ static int nilfs_segctor_flush_mode(struct nilfs_sc_info *sci)
 static int nilfs_segctor_thread(void *arg)
 {
         struct nilfs_sc_info *sci = (struct nilfs_sc_info *)arg;
+        struct the_nilfs *nilfs = sci->sc_sbi->s_nilfs;
         struct timer_list timer;
         int timeout = 0;
 
@@ -2680,7 +2685,6 @@ static int nilfs_segctor_thread(void *arg)
         } else {
                 DEFINE_WAIT(wait);
                 int should_sleep = 1;
-                struct the_nilfs *nilfs;
 
                 prepare_to_wait(&sci->sc_wait_daemon, &wait,
                                 TASK_INTERRUPTIBLE);
@@ -2701,8 +2705,8 @@ static int nilfs_segctor_thread(void *arg)
                 finish_wait(&sci->sc_wait_daemon, &wait);
                 timeout = ((sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
                            time_after_eq(jiffies, sci->sc_timer->expires));
-                nilfs = sci->sc_sbi->s_nilfs;
-                if (sci->sc_super->s_dirt && nilfs_sb_need_update(nilfs))
+
+                if (nilfs_sb_dirty(nilfs) && nilfs_sb_need_update(nilfs))
                         set_nilfs_discontinued(nilfs);
         }
         goto loop;
@@ -2797,12 +2801,9 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci)
         do {
                 struct nilfs_sb_info *sbi = sci->sc_sbi;
                 struct nilfs_transaction_info ti;
-                struct nilfs_segctor_req req = { .mode = SC_LSEG_SR };
 
                 nilfs_transaction_lock(sbi, &ti, 0);
-                nilfs_segctor_accept(sci, &req);
-                ret = nilfs_segctor_construct(sci, &req);
-                nilfs_segctor_notify(sci, &req);
+                ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
                 nilfs_transaction_unlock(sbi);
 
         } while (ret && retrycount-- > 0);
@@ -2829,7 +2830,7 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
                 || sci->sc_seq_request != sci->sc_seq_done);
         spin_unlock(&sci->sc_state_lock);
 
-        if (flag || nilfs_segctor_confirm(sci))
+        if (flag || !nilfs_segctor_confirm(sci))
                 nilfs_segctor_write_out(sci);
 
         WARN_ON(!list_empty(&sci->sc_copied_buffers));
@@ -2853,7 +2854,7 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
  * @sbi: nilfs_sb_info
  *
  * nilfs_attach_segment_constructor() allocates a struct nilfs_sc_info,
- * initilizes it, and starts the segment constructor.
+ * initializes it, and starts the segment constructor.
  *
  * Return Value: On success, 0 is returned. On error, one of the following
  * negative error code is returned.
@@ -2865,8 +2866,15 @@ int nilfs_attach_segment_constructor(struct nilfs_sb_info *sbi)
         struct the_nilfs *nilfs = sbi->s_nilfs;
         int err;
 
-        /* Each field of nilfs_segctor is cleared through the initialization
-           of super-block info */
+        if (NILFS_SC(sbi)) {
+                /*
+                 * This happens if the filesystem was remounted
+                 * read/write after nilfs_error degenerated it into a
+                 * read-only mount.
+                 */
+                nilfs_detach_segment_constructor(sbi);
+        }
+
         sbi->s_sc_info = nilfs_segctor_new(sbi);
         if (!sbi->s_sc_info)
                 return -ENOMEM;
diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index 3d3ab2f9864c..82dfd6a686b9 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h
@@ -30,7 +30,7 @@
 #include "sb.h"
 
 /**
- * struct nilfs_recovery_info - Recovery infomation
+ * struct nilfs_recovery_info - Recovery information
  * @ri_need_recovery: Recovery status
  * @ri_super_root: Block number of the last super root
  * @ri_ri_cno: Number of the last checkpoint
@@ -71,7 +71,7 @@ struct nilfs_recovery_info {
  */
 struct nilfs_cstage {
         int                     scnt;
-        unsigned                flags;
+        unsigned                flags;
         struct nilfs_inode_info *dirty_file_ptr;
         struct nilfs_inode_info *gc_inode_ptr;
 };
@@ -116,6 +116,7 @@ struct nilfs_segsum_pointer {
  * @sc_wait_daemon: Daemon wait queue
  * @sc_wait_task: Start/end wait queue to control segctord task
  * @sc_seq_request: Request counter
+ * @sc_seq_accept: Accepted request count
  * @sc_seq_done: Completion counter
  * @sc_sync: Request of explicit sync operation
  * @sc_interval: Timeout value of background construction
@@ -169,6 +170,7 @@ struct nilfs_sc_info {
         wait_queue_head_t       sc_wait_task;
 
         __u32                   sc_seq_request;
+        __u32                   sc_seq_accepted;
         __u32                   sc_seq_done;
 
         int                     sc_sync;
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index b6c36d0cc331..3c6cc6005c2e 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -18,7 +18,7 @@
  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  * Written by Koji Sato <koji@osrg.net>.
- * Rivised by Ryusuke Konishi <ryusuke@osrg.net>.
+ * Revised by Ryusuke Konishi <ryusuke@osrg.net>.
  */
 
 #include <linux/kernel.h>
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 8173faee31e6..0cdbc5e7655a 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -96,9 +96,6 @@ void nilfs_error(struct super_block *sb, const char *function,
         if (!(sb->s_flags & MS_RDONLY)) {
                 struct the_nilfs *nilfs = sbi->s_nilfs;
 
-                if (!nilfs_test_opt(sbi, ERRORS_CONT))
-                        nilfs_detach_segment_constructor(sbi);
-
                 down_write(&nilfs->ns_sem);
                 if (!(nilfs->ns_mount_state & NILFS_ERROR_FS)) {
                         nilfs->ns_mount_state |= NILFS_ERROR_FS;
@@ -301,7 +298,7 @@ int nilfs_commit_super(struct nilfs_sb_info *sbi, int dupsb)
                 memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
                 nilfs->ns_sbwtime[1] = t;
         }
-        sbi->s_super->s_dirt = 0;
+        clear_nilfs_sb_dirty(nilfs);
         return nilfs_sync_super(sbi, dupsb);
 }
 
@@ -345,7 +342,7 @@ static int nilfs_sync_fs(struct super_block *sb, int wait)
                 err = nilfs_construct_segment(sb);
 
         down_write(&nilfs->ns_sem);
-        if (sb->s_dirt)
+        if (nilfs_sb_dirty(nilfs))
                 nilfs_commit_super(sbi, 1);
         up_write(&nilfs->ns_sem);
 
@@ -439,7 +436,7 @@ static int nilfs_statfs(struct dentry *dentry, struct kstatfs *buf)
         /*
          * Compute the overhead
          *
-         * When distributing meta data blocks outside semgent structure,
+         * When distributing meta data blocks outside segment structure,
          * We must count them as the overhead.
          */
         overhead = 0;
@@ -481,6 +478,8 @@ static int nilfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_printf(seq, ",order=strict");
         if (nilfs_test_opt(sbi, NORECOVERY))
                 seq_printf(seq, ",norecovery");
+        if (nilfs_test_opt(sbi, DISCARD))
+                seq_printf(seq, ",discard");
 
         return 0;
 }
@@ -550,7 +549,7 @@ static const struct export_operations nilfs_export_ops = {
 enum {
         Opt_err_cont, Opt_err_panic, Opt_err_ro,
         Opt_nobarrier, Opt_snapshot, Opt_order, Opt_norecovery,
-        Opt_err,
+        Opt_discard, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -561,6 +560,7 @@ static match_table_t tokens = {
         {Opt_snapshot, "cp=%u"},
         {Opt_order, "order=%s"},
         {Opt_norecovery, "norecovery"},
+        {Opt_discard, "discard"},
         {Opt_err, NULL}
 };
 
@@ -614,6 +614,9 @@ static int parse_options(char *options, struct super_block *sb)
                 case Opt_norecovery:
                         nilfs_set_opt(sbi, NORECOVERY);
                         break;
+                case Opt_discard:
+                        nilfs_set_opt(sbi, DISCARD);
+                        break;
                 default:
                         printk(KERN_ERR
                                "NILFS: Unrecognized mount option \"%s\"\n", p);
@@ -863,7 +866,7 @@ static int nilfs_remount(struct super_block *sb, int *flags, char *data)
         if ((*flags & MS_RDONLY) &&
             sbi->s_snapshot_cno != old_opts.snapshot_cno) {
                 printk(KERN_WARNING "NILFS (device %s): couldn't "
-                       "remount to a different snapshot. \n",
+                       "remount to a different snapshot.\n",
                        sb->s_id);
                 err = -EINVAL;
                 goto restore_opts;
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 6241e1722efc..33871f7e4f01 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -386,7 +386,7 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs,
 
         nilfs->ns_blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment);
         if (nilfs->ns_blocks_per_segment < NILFS_SEG_MIN_BLOCKS) {
-                printk(KERN_ERR "NILFS: too short segment. \n");
+                printk(KERN_ERR "NILFS: too short segment.\n");
                 return -EINVAL;
         }
 
@@ -646,6 +646,44 @@ int init_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi, char *data)
         goto out;
 }
 
+int nilfs_discard_segments(struct the_nilfs *nilfs, __u64 *segnump,
+                            size_t nsegs)
+{
+        sector_t seg_start, seg_end;
+        sector_t start = 0, nblocks = 0;
+        unsigned int sects_per_block;
+        __u64 *sn;
+        int ret = 0;
+
+        sects_per_block = (1 << nilfs->ns_blocksize_bits) /
+                bdev_logical_block_size(nilfs->ns_bdev);
+        for (sn = segnump; sn < segnump + nsegs; sn++) {
+                nilfs_get_segment_range(nilfs, *sn, &seg_start, &seg_end);
+
+                if (!nblocks) {
+                        start = seg_start;
+                        nblocks = seg_end - seg_start + 1;
+                } else if (start + nblocks == seg_start) {
+                        nblocks += seg_end - seg_start + 1;
+                } else {
+                        ret = blkdev_issue_discard(nilfs->ns_bdev,
+                                                   start * sects_per_block,
+                                                   nblocks * sects_per_block,
+                                                   GFP_NOFS,
+                                                   DISCARD_FL_BARRIER);
+                        if (ret < 0)
+                                return ret;
+                        nblocks = 0;
+                }
+        }
+        if (nblocks)
+                ret = blkdev_issue_discard(nilfs->ns_bdev,
+                                           start * sects_per_block,
+                                           nblocks * sects_per_block,
+                                           GFP_NOFS, DISCARD_FL_BARRIER);
+        return ret;
+}
+
 int nilfs_count_free_blocks(struct the_nilfs *nilfs, sector_t *nblocks)
 {
         struct inode *dat = nilfs_dat_inode(nilfs);
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 589786e33464..1ab974533697 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -29,6 +29,7 @@
 #include <linux/fs.h>
 #include <linux/blkdev.h>
 #include <linux/backing-dev.h>
+#include <linux/slab.h>
 #include "sb.h"
 
 /* the_nilfs struct */
@@ -38,6 +39,7 @@ enum {
                                    the latest checkpoint was loaded */
         THE_NILFS_DISCONTINUED, /* 'next' pointer chain has broken */
         THE_NILFS_GC_RUNNING,   /* gc process is running */
+        THE_NILFS_SB_DIRTY,     /* super block is dirty */
 };
 
 /**
@@ -197,6 +199,7 @@ THE_NILFS_FNS(INIT, init)
 THE_NILFS_FNS(LOADED, loaded)
 THE_NILFS_FNS(DISCONTINUED, discontinued)
 THE_NILFS_FNS(GC_RUNNING, gc_running)
+THE_NILFS_FNS(SB_DIRTY, sb_dirty)
 
 /* Minimum interval of periodical update of superblocks (in seconds) */
 #define NILFS_SB_FREQ           10
@@ -221,6 +224,7 @@ struct the_nilfs *find_or_create_nilfs(struct block_device *);
 void put_nilfs(struct the_nilfs *);
 int init_nilfs(struct the_nilfs *, struct nilfs_sb_info *, char *);
 int load_nilfs(struct the_nilfs *, struct nilfs_sb_info *);
+int nilfs_discard_segments(struct the_nilfs *, __u64 *, size_t);
 int nilfs_count_free_blocks(struct the_nilfs *, sector_t *);
 struct nilfs_sb_info *nilfs_find_sbinfo(struct the_nilfs *, int, __u64);
 int nilfs_checkpoint_is_mounted(struct the_nilfs *, __u64, int);
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 037e878e03fc..fcc2f064af83 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -18,6 +18,7 @@
 
 #include <linux/dcache.h>
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/srcu.h>
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 3165d85aada2..0399bcbe09c8 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -87,7 +87,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
-#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/writeback.h> /* for inode_lock */
 
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index c9ee67b442e1..1afb0a10229f 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -121,7 +121,7 @@ static int idr_callback(int id, void *p, void *data)
         if (warned)
                 return 0;
 
-        warned = false;
+        warned = true;
         entry = p;
         ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
 
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 8271cf05c957..472cdf29ef82 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -29,14 +29,12 @@
 #include <linux/init.h> /* module_init */
 #include <linux/inotify.h>
 #include <linux/kernel.h> /* roundup() */
-#include <linux/magic.h> /* superblock magic number */
-#include <linux/mount.h> /* mntget */
 #include <linux/namei.h> /* LOOKUP_FOLLOW */
-#include <linux/path.h> /* struct path */
 #include <linux/sched.h> /* struct user */
 #include <linux/slab.h> /* struct kmem_cache */
 #include <linux/syscalls.h>
 #include <linux/types.h>
+#include <linux/anon_inodes.h>
 #include <linux/uaccess.h>
 #include <linux/poll.h>
 #include <linux/wait.h>
@@ -45,8 +43,6 @@
 
 #include <asm/ioctls.h>
 
-static struct vfsmount *inotify_mnt __read_mostly;
-
 /* these are configurable via /proc/sys/fs/inotify/ */
 static int inotify_max_user_instances __read_mostly;
 static int inotify_max_queued_events __read_mostly;
@@ -552,7 +548,7 @@ retry:
 
         spin_lock(&group->inotify_data.idr_lock);
         ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
-                                group->inotify_data.last_wd,
+                                group->inotify_data.last_wd+1,
                                 &tmp_ientry->wd);
         spin_unlock(&group->inotify_data.idr_lock);
         if (ret) {
@@ -632,7 +628,7 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
 
         spin_lock_init(&group->inotify_data.idr_lock);
         idr_init(&group->inotify_data.idr);
-        group->inotify_data.last_wd = 1;
+        group->inotify_data.last_wd = 0;
         group->inotify_data.user = user;
         group->inotify_data.fa = NULL;
 
@@ -645,9 +641,7 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
 {
         struct fsnotify_group *group;
         struct user_struct *user;
-        struct file *filp;
-        struct path path;
-        int fd, ret;
+        int ret;
 
         /* Check the IN_* constants for consistency.  */
         BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
@@ -656,10 +650,6 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
         if (flags & ~(IN_CLOEXEC | IN_NONBLOCK))
                 return -EINVAL;
 
-        fd = get_unused_fd_flags(flags & O_CLOEXEC);
-        if (fd < 0)
-                return fd;
-
         user = get_current_user();
         if (unlikely(atomic_read(&user->inotify_devs) >=
                         inotify_max_user_instances)) {
@@ -676,27 +666,14 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
 
         atomic_inc(&user->inotify_devs);
 
-        path.mnt = inotify_mnt;
-        path.dentry = inotify_mnt->mnt_root;
-        path_get(&path);
-        filp = alloc_file(&path, FMODE_READ, &inotify_fops);
-        if (!filp)
-                goto Enfile;
+        ret = anon_inode_getfd("inotify", &inotify_fops, group,
+                                  O_RDONLY | flags);
+        if (ret >= 0)
+                return ret;
 
-        filp->f_flags = O_RDONLY | (flags & O_NONBLOCK);
-        filp->private_data = group;
-
-        fd_install(fd, filp);
-
-        return fd;
-
-Enfile:
-        ret = -ENFILE;
-        path_put(&path);
         atomic_dec(&user->inotify_devs);
 out_free_uid:
         free_uid(user);
-        put_unused_fd(fd);
         return ret;
 }
 
@@ -783,20 +760,6 @@ out:
         return ret;
 }
 
-static int
-inotify_get_sb(struct file_system_type *fs_type, int flags,
-               const char *dev_name, void *data, struct vfsmount *mnt)
-{
-        return get_sb_pseudo(fs_type, "inotify", NULL,
-                        INOTIFYFS_SUPER_MAGIC, mnt);
-}
-
-static struct file_system_type inotify_fs_type = {
-    .name       = "inotifyfs",
-    .get_sb     = inotify_get_sb,
-    .kill_sb    = kill_anon_super,
-};
-
 /*
  * inotify_user_setup - Our initialization function.  Note that we cannnot return
  * error because we have compiled-in VFS hooks.  So an (unlikely) failure here
@@ -804,16 +767,6 @@ static struct file_system_type inotify_fs_type = {
  */
 static int __init inotify_user_setup(void)
 {
-        int ret;
-
-        ret = register_filesystem(&inotify_fs_type);
-        if (unlikely(ret))
-                panic("inotify: register_filesystem returned %d!\n", ret);
-
-        inotify_mnt = kern_mount(&inotify_fs_type);
-        if (IS_ERR(inotify_mnt))
-                panic("inotify: kern_mount ret %ld!\n", PTR_ERR(inotify_mnt));
-
         inotify_inode_mark_cachep = KMEM_CACHE(inotify_inode_mark_entry, SLAB_PANIC);
         event_priv_cachep = KMEM_CACHE(inotify_event_private_data, SLAB_PANIC);
 
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
deleted file mode 100644
index 37c11e194372..000000000000
--- a/fs/ntfs/ChangeLog
+++ /dev/null
@@ -1,1702 +0,0 @@
-ToDo/Notes:
-        - Find and fix bugs.
-        - The only places in the kernel where a file is resized are
-          ntfs_file_write*() and ntfs_truncate() for both of which i_mutex is
-          held.  Just have to be careful in read-/writepage and other helpers
-          not running under i_mutex that we play nice.  Also need to be careful
-          with initialized_size extension in ntfs_file_write*() and writepage.
-          UPDATE: The only things that need to be checked are the compressed
-          write and the other attribute resize/write cases like index
-          attributes, etc.  For now none of these are implemented so are safe.
-        - Implement filling in of holes in aops.c::ntfs_writepage() and its
-          helpers.
-        - Implement mft.c::sync_mft_mirror_umount().  We currently will just
-          leave the volume dirty on umount if the final iput(vol->mft_ino)
-          causes a write of any mirrored mft records due to the mft mirror
-          inode having been discarded already.  Whether this can actually ever
-          happen is unclear however so it is worth waiting until someone hits
-          the problem.
-
-2.1.29 - Fix a deadlock at mount time.
-
-        - During mount the VFS holds s_umount lock on the superblock.  So when
-          we try to empty the journal $LogFile contents by calling
-          ntfs_attr_set() when the machine does not have much memory and the
-          journal is large ntfs_attr_set() results in the VM trying to balance
-          dirty pages which in turn tries to that the s_umount lock and thus we
-          get a deadlock.  The solution is to not use ntfs_attr_set() and
-          instead do the zeroing by hand at the block level rather than page
-          cache level.
-        - Fix sparse warnings.
-
-2.1.28 - Fix a deadlock.
-
-        - Fix deadlock in fs/ntfs/inode.c::ntfs_put_inode().  Thanks to Sergey
-          Vlasov for the report and detailed analysis of the deadlock.  The fix
-          involved getting rid of ntfs_put_inode() altogether and hence NTFS no
-          longer has a ->put_inode super operation.
-
-2.1.27 - Various bug fixes and cleanups.
-
-        - Fix two compiler warnings on Alpha.  Thanks to Andrew Morton for
-          reporting them.
-        - Fix an (innocent) off-by-one error in the runlist code.
-        - Fix a buggette in an "should be impossible" case handling where we
-          continued the attribute lookup loop instead of aborting it.
-        - Use buffer_migrate_page() for the ->migratepage function of all ntfs
-          address space operations.
-        - Fix comparison of $MFT and $MFTMirr to not bail out when there are
-          unused, invalid mft records which are the same in both $MFT and
-          $MFTMirr.
-        - Add support for sparse files which have a compression unit of 0.
-        - Remove all the make_bad_inode() calls.  This should only be called
-          from read inode and new inode code paths.
-        - Limit name length in fs/ntfs/unistr.c::ntfs_nlstoucs() to maximum
-          allowed by NTFS, i.e. 255 Unicode characters, not including the
-          terminating NULL (which is not stored on disk).
-        - Improve comments on file attribute flags in fs/ntfs/layout.h.
-        - Fix a bug in fs/ntfs/inode.c::ntfs_read_locked_index_inode() where we
-          forgot to update a temporary variable so loading index inodes which
-          have an index allocation attribute failed.
-        - Add a missing call to flush_dcache_mft_record_page() in
-          fs/ntfs/inode.c::ntfs_write_inode().
-        - Handle the recently introduced -ENAMETOOLONG return value from
-          fs/ntfs/unistr.c::ntfs_nlstoucs() in fs/ntfs/namei.c::ntfs_lookup().
-        - Semaphore to mutex conversion.  (Ingo Molnar)
-
-2.1.26 - Minor bug fixes and updates.
-
-        - Fix a potential overflow in file.c where a cast to s64 was missing in
-          a left shift of a page index.
-        - The struct inode has had its i_sem semaphore changed to a mutex named
-          i_mutex.
-        - We have struct kmem_cache now so use it instead of the typedef
-          kmem_cache_t.  (Pekka Enberg)
-        - Implement support for sector sizes above 512 bytes (up to the maximum
-          supported by NTFS which is 4096 bytes).
-        - Do more detailed reporting of why we cannot mount read-write by
-          special casing the VOLUME_MODIFIED_BY_CHKDSK flag.
-        - Miscellaneous updates to layout.h.
-        - Cope with attribute list attribute having invalid flags.  Windows
-          copes with this and even chkdsk does not detect or fix this so we
-          have to cope with it, too.  Thanks to Pawel Kot for reporting the
-          problem.
-
-2.1.25 - (Almost) fully implement write(2) and truncate(2).
-
-        - Change ntfs_map_runlist_nolock(), ntfs_attr_find_vcn_nolock() and
-          {__,}ntfs_cluster_free() to also take an optional attribute search
-          context as argument.  This allows calling these functions with the
-          mft record mapped.  Update all callers.
-        - Fix potential deadlock in ntfs_mft_data_extend_allocation_nolock()
-          error handling by passing in the active search context when calling
-          ntfs_cluster_free().
-        - Change ntfs_cluster_alloc() to take an extra boolean parameter
-          specifying whether the cluster are being allocated to extend an
-          attribute or to fill a hole.
-        - Change ntfs_attr_make_non_resident() to call ntfs_cluster_alloc()
-          with @is_extension set to TRUE and remove the runlist terminator
-          fixup code as this is now done by ntfs_cluster_alloc().
-        - Change ntfs_attr_make_non_resident to take the attribute value size
-          as an extra parameter.  This is needed since we need to know the size
-          before we can map the mft record and our callers always know it.  The
-          reason we cannot simply read the size from the vfs inode i_size is
-          that this is not necessarily uptodate.  This happens when
-          ntfs_attr_make_non_resident() is called in the ->truncate call path.
-        - Fix ntfs_attr_make_non_resident() to update the vfs inode i_blocks
-          which is zero for a resident attribute but should no longer be zero
-          once the attribute is non-resident as it then has real clusters
-          allocated.
-        - Add fs/ntfs/attrib.[hc]::ntfs_attr_extend_allocation(), a function to
-          extend the allocation of an attributes.  Optionally, the data size,
-          but not the initialized size can be extended, too.
-        - Implement fs/ntfs/inode.[hc]::ntfs_truncate().  It only supports
-          uncompressed and unencrypted files and it never creates sparse files
-          at least for the moment (making a file sparse requires us to modify
-          its directory entries and we do not support directory operations at
-          the moment).  Also, support for highly fragmented files, i.e. ones
-          whose data attribute is split across multiple extents, is severly
-          limited.  When such a case is encountered, EOPNOTSUPP is returned.
-        - Enable ATTR_SIZE attribute changes in ntfs_setattr().  This completes
-          the initial implementation of file truncation.  Now both open(2)ing
-          a file with the O_TRUNC flag and the {,f}truncate(2) system calls
-          will resize a file appropriately.  The limitations are that only
-          uncompressed and unencrypted files are supported.  Also, there is
-          only very limited support for highly fragmented files (the ones whose
-          $DATA attribute is split into multiple attribute extents).
-        - In attrib.c::ntfs_attr_set() call balance_dirty_pages_ratelimited()
-          and cond_resched() in the main loop as we could be dirtying a lot of
-          pages and this ensures we play nice with the VM and the system as a
-          whole.
-        - Implement file operations ->write, ->aio_write, ->writev for regular
-          files.  This replaces the old use of generic_file_write(), et al and
-          the address space operations ->prepare_write and ->commit_write.
-          This means that both sparse and non-sparse (unencrypted and
-          uncompressed) files can now be extended using the normal write(2)
-          code path.  There are two limitations at present and these are that
-          we never create sparse files and that we only have limited support
-          for highly fragmented files, i.e. ones whose data attribute is split
-          across multiple extents.   When such a case is encountered,
-          EOPNOTSUPP is returned.
-        - $EA attributes can be both resident and non-resident.
-        - Use %z for size_t to fix compilation warnings.  (Andrew Morton)
-        - Fix compilation warnings with gcc-4.0.2 on SUSE 10.0.
-        - Document extended attribute ($EA) NEED_EA flag.  (Based on libntfs
-          patch by Yura Pakhuchiy.)
-
-2.1.24 - Lots of bug fixes and support more clean journal states.
-
-        - Support journals ($LogFile) which have been modified by chkdsk.  This
-          means users can boot into Windows after we marked the volume dirty.
-          The Windows boot will run chkdsk and then reboot.  The user can then
-          immediately boot into Linux rather than having to do a full Windows
-          boot first before rebooting into Linux and we will recognize such a
-          journal and empty it as it is clean by definition.  Note, this only
-          works if chkdsk left the journal in an obviously clean state.
-        - Support journals ($LogFile) with only one restart page as well as
-          journals with two different restart pages.  We sanity check both and
-          either use the only sane one or the more recent one of the two in the
-          case that both are valid.
-        - Add fs/ntfs/malloc.h::ntfs_malloc_nofs_nofail() which is analogous to
-          ntfs_malloc_nofs() but it performs allocations with __GFP_NOFAIL and
-          hence cannot fail.
-        - Use ntfs_malloc_nofs_nofail() in the two critical regions in
-          fs/ntfs/runlist.c::ntfs_runlists_merge().  This means we no longer
-          need to panic() if the allocation fails as it now cannot fail.
-        - Fix two nasty runlist merging bugs that had gone unnoticed so far.
-          Thanks to Stefano Picerno for the bug report.
-        - Remove two bogus BUG_ON()s from fs/ntfs/mft.c.
-        - Fix handling of valid but empty mapping pairs array in
-          fs/ntfs/runlist.c::ntfs_mapping_pairs_decompress().
-        - Report unrepresentable inodes during ntfs_readdir() as KERN_WARNING
-          messages and include the inode number.  Thanks to Yura Pakhuchiy for
-          pointing this out.
-        - Change ntfs_rl_truncate_nolock() to throw away the runlist if the new
-          length is zero.
-        - Add runlist.[hc]::ntfs_rl_punch_nolock() which punches a caller
-          specified hole into a runlist.
-        - Fix a bug in fs/ntfs/index.c::ntfs_index_lookup().  When the returned
-          index entry is in the index root, we forgot to set the @ir pointer in
-          the index context.  Thanks to Yura Pakhuchiy for finding this bug.
-        - Remove bogus setting of PageError in ntfs_read_compressed_block().
-        - Add fs/ntfs/attrib.[hc]::ntfs_resident_attr_value_resize().
-        - Fix a bug in ntfs_map_runlist_nolock() where we forgot to protect
-          access to the allocated size in the ntfs inode with the size lock.
-        - Fix ntfs_attr_vcn_to_lcn_nolock() and ntfs_attr_find_vcn_nolock() to
-          return LCN_ENOENT when there is no runlist and the allocated size is
-          zero.
-        - Fix load_attribute_list() to handle the case of a NULL runlist.
-        - Fix handling of sparse attributes in ntfs_attr_make_non_resident().
-        - Add BUG() checks to ntfs_attr_make_non_resident() and ntfs_attr_set()
-          to ensure that these functions are never called for compressed or
-          encrypted attributes.
-        - Fix cluster (de)allocators to work when the runlist is NULL and more
-          importantly to take a locked runlist rather than them locking it
-          which leads to lock reversal.
-        - Truncate {a,c,m}time to the ntfs supported time granularity when
-          updating the times in the inode in ntfs_setattr().
-        - Fixup handling of sparse, compressed, and encrypted attributes in
-          fs/ntfs/inode.c::ntfs_read_locked_{,attr_,index_}inode(),
-          fs/ntfs/aops.c::ntfs_{read,write}page().
-        - Make ntfs_write_block() not instantiate sparse blocks if they contain
-          only zeroes.
-        - Optimize fs/ntfs/aops.c::ntfs_write_block() by extending the page
-          lock protection over the buffer submission for i/o which allows the
-          removal of the get_bh()/put_bh() pairs for each buffer.
-        - Fix fs/ntfs/aops.c::ntfs_{read,write}_block() to handle the case
-          where a concurrent truncate has truncated the runlist under our feet.
-        - Fix page_has_buffers()/page_buffers() handling in fs/ntfs/aops.c.
-        - In fs/ntfs/aops.c::ntfs_end_buffer_async_read(), use a bit spin lock
-          in the first buffer head instead of a driver global spin lock to
-          improve scalability.
-        - Minor fix to error handling and error message display in
-          fs/ntfs/aops.c::ntfs_prepare_nonresident_write().
-        - Change the mount options {u,f,d}mask to always parse the number as
-          an octal number to conform to how chmod(1) works, too.  Thanks to
-          Giuseppe Bilotta and Horst von Brand for pointing out the errors of
-          my ways.
-        - Fix various bugs in the runlist merging code.  (Based on libntfs
-          changes by Richard Russon.)
-        - Fix sparse warnings that have crept in over time.
-        - Change ntfs_cluster_free() to require a write locked runlist on entry
-          since we otherwise get into a lock reversal deadlock if a read locked
-          runlist is passed in. In the process also change it to take an ntfs
-          inode instead of a vfs inode as parameter.
-        - Fix the definition of the CHKD ntfs record magic.  It had an off by
-          two error causing it to be CHKB instead of CHKD.
-        - Fix a stupid bug in __ntfs_bitmap_set_bits_in_run() which caused the
-          count to become negative and hence we had a wild memset() scribbling
-          all over the system's ram.
-
-2.1.23 - Implement extension of resident files and make writing safe as well as
-         many bug fixes, cleanups, and enhancements...
-
-        - Add printk rate limiting for ntfs_warning() and ntfs_error() when
-          compiled without debug.  This avoids a possible denial of service
-          attack.  Thanks to Carl-Daniel Hailfinger from SuSE for pointing this
-          out.
-        - Fix compilation warnings on ia64.  (Randy Dunlap)
-        - Use i_size_{read,write}() instead of reading i_size by hand and cache
-          the value where apropriate.
-        - Add size_lock to the ntfs_inode structure.  This is an rw spinlock
-          and it locks against access to the inode sizes.  Note, ->size_lock
-          is also accessed from irq context so you must use the _irqsave and
-          _irqrestore lock and unlock functions, respectively.  Protect all
-          accesses to allocated_size, initialized_size, and compressed_size.
-        - Minor optimization to fs/ntfs/super.c::ntfs_statfs() and its helpers.
-        - Implement extension of resident files in the regular file write code
-          paths (fs/ntfs/aops.c::ntfs_{prepare,commit}_write()).  At present
-          this only works until the data attribute becomes too big for the mft
-          record after which we abort the write returning -EOPNOTSUPP from
-          ntfs_prepare_write().
-        - Add disable_sparse mount option together with a per volume sparse
-          enable bit which is set appropriately and a per inode sparse disable
-          bit which is preset on some system file inodes as appropriate.
-        - Enforce that sparse support is disabled on NTFS volumes pre 3.0.
-        - Fix a bug in fs/ntfs/runlist.c::ntfs_mapping_pairs_decompress() in
-          the creation of the unmapped runlist element for the base attribute
-          extent.
-        - Split ntfs_map_runlist() into ntfs_map_runlist() and a non-locking
-          helper ntfs_map_runlist_nolock() which is used by ntfs_map_runlist().
-          This allows us to map runlist fragments with the runlist lock already
-          held without having to drop and reacquire it around the call.  Adapt
-          all callers.
-        - Change ntfs_find_vcn() to ntfs_find_vcn_nolock() which takes a locked
-          runlist.  This allows us to find runlist elements with the runlist
-          lock already held without having to drop and reacquire it around the
-          call.  Adapt all callers.
-        - Change time to u64 in time.h::ntfs2utc() as it otherwise generates a
-          warning in the do_div() call on sparc32.  Thanks to Meelis Roos for
-          the report and analysis of the warning.
-        - Fix a nasty runlist merge bug when merging two holes.
-        - Set the ntfs_inode->allocated_size to the real allocated size in the
-          mft record for resident attributes (fs/ntfs/inode.c).
-        - Small readability cleanup to use "a" instead of "ctx->attr"
-          everywhere (fs/ntfs/inode.c).
-        - Make fs/ntfs/namei.c::ntfs_get_{parent,dentry} static and move the
-          definition of ntfs_export_ops from fs/ntfs/super.c to namei.c.  Also,
-          declare ntfs_export_ops in fs/ntfs/ntfs.h.
-        - Correct sparse file handling.  The compressed values need to be
-          checked and set in the ntfs inode as done for compressed files and
-          the compressed size needs to be used for vfs inode->i_blocks instead
-          of the allocated size, again, as done for compressed files.
-        - Add AT_EA in addition to AT_DATA to whitelist for being allowed to be
-          non-resident in fs/ntfs/attrib.c::ntfs_attr_can_be_non_resident().
-        - Add fs/ntfs/attrib.c::ntfs_attr_vcn_to_lcn_nolock() used by the new
-          write code.
-        - Fix bug in fs/ntfs/attrib.c::ntfs_find_vcn_nolock() where after
-          dropping the read lock and taking the write lock we were not checking
-          whether someone else did not already do the work we wanted to do.
-        - Rename fs/ntfs/attrib.c::ntfs_find_vcn_nolock() to
-          ntfs_attr_find_vcn_nolock() and update all callers.
-        - Add fs/ntfs/attrib.[hc]::ntfs_attr_make_non_resident().
-        - Fix sign of various error return values to be negative in
-          fs/ntfs/lcnalloc.c.
-        - Modify ->readpage and ->writepage (fs/ntfs/aops.c) so they detect and
-          handle the case where an attribute is converted from resident to
-          non-resident by a concurrent file write.
-        - Remove checks for NULL before calling kfree() since kfree() does the
-          checking itself.  (Jesper Juhl)
-        - Some utilities modify the boot sector but do not update the checksum.
-          Thus, relax the checking in fs/ntfs/super.c::is_boot_sector_ntfs() to
-          only emit a warning when the checksum is incorrect rather than
-          refusing the mount.  Thanks to Bernd Casimir for pointing this
-          problem out.
-        - Update attribute definition handling.
-        - Add NTFS_MAX_CLUSTER_SIZE and NTFS_MAX_PAGES_PER_CLUSTER constants.
-        - Use NTFS_MAX_CLUSTER_SIZE in super.c instead of hard coding 0x10000.
-        - Use MAX_BUF_PER_PAGE instead of variable sized array allocation for
-          better code generation and one less sparse warning in fs/ntfs/aops.c.
-        - Remove spurious void pointer casts from fs/ntfs/.  (Pekka Enberg)
-        - Use C99 style structure initialization after memory allocation where
-          possible (fs/ntfs/{attrib.c,index.c,super.c}).  Thanks to Al Viro and
-          Pekka Enberg.
-        - Stamp the transaction log ($UsnJrnl), aka user space journal, if it
-          is active on the volume and we are mounting read-write or remounting
-          from read-only to read-write.
-        - Fix a bug in address space operations error recovery code paths where
-          if the runlist was not mapped at all and a mapping error occured we
-          would leave the runlist locked on exit to the function so that the
-          next access to the same file would try to take the lock and deadlock.
-        - Detect the case when Windows has been suspended to disk on the volume
-          to be mounted and if this is the case do not allow (re)mounting
-          read-write.  This is done by parsing hiberfil.sys if present.
-        - Fix several occurences of a bug where we would perform 'var & ~const'
-          with a 64-bit variable and a int, i.e. 32-bit, constant.  This causes
-          the higher order 32-bits of the 64-bit variable to be zeroed.  To fix
-          this cast the 'const' to the same 64-bit type as 'var'.
-        - Change the runlist terminator of the newly allocated cluster(s) to
-          LCN_ENOENT in ntfs_attr_make_non_resident().  Otherwise the runlist
-          code gets confused.
-        - Add an extra parameter @last_vcn to ntfs_get_size_for_mapping_pairs()
-          and ntfs_mapping_pairs_build() to allow the runlist encoding to be
-          partial which is desirable when filling holes in sparse attributes.
-          Update all callers.
-        - Change ntfs_map_runlist_nolock() to only decompress the mapping pairs
-          if the requested vcn is inside it.  Otherwise we get into problems
-          when we try to map an out of bounds vcn because we then try to map
-          the already mapped runlist fragment which causes
-          ntfs_mapping_pairs_decompress() to fail and return error.  Update
-          ntfs_attr_find_vcn_nolock() accordingly.
-        - Fix a nasty deadlock that appeared in recent kernels.
-          The situation: VFS inode X on a mounted ntfs volume is dirty.  For
-          same inode X, the ntfs_inode is dirty and thus corresponding on-disk
-          inode, i.e. mft record, which is in a dirty PAGE_CACHE_PAGE belonging
-          to the table of inodes, i.e. $MFT, inode 0.
-          What happens:
-          Process 1: sys_sync()/umount()/whatever...  calls
-          __sync_single_inode() for $MFT -> do_writepages() -> write_page for
-          the dirty page containing the on-disk inode X, the page is now locked
-          -> ntfs_write_mst_block() which clears PageUptodate() on the page to
-          prevent anyone else getting hold of it whilst it does the write out.
-          This is necessary as the on-disk inode needs "fixups" applied before
-          the write to disk which are removed again after the write and
-          PageUptodate is then set again.  It then analyses the page looking
-          for dirty on-disk inodes and when it finds one it calls
-          ntfs_may_write_mft_record() to see if it is safe to write this
-          on-disk inode.  This then calls ilookup5() to check if the
-          corresponding VFS inode is in icache().  This in turn calls ifind()
-          which waits on the inode lock via wait_on_inode whilst holding the
-          global inode_lock.
-          Process 2: pdflush results in a call to __sync_single_inode for the
-          same VFS inode X on the ntfs volume.  This locks the inode (I_LOCK)
-          then calls write-inode -> ntfs_write_inode -> map_mft_record() ->
-          read_cache_page() for the page (in page cache of table of inodes
-          $MFT, inode 0) containing the on-disk inode.  This page has
-          PageUptodate() clear because of Process 1 (see above) so
-          read_cache_page() blocks when it tries to take the page lock for the
-          page so it can call ntfs_read_page().
-          Thus Process 1 is holding the page lock on the page containing the
-          on-disk inode X and it is waiting on the inode X to be unlocked in
-          ifind() so it can write the page out and then unlock the page.
-          And Process 2 is holding the inode lock on inode X and is waiting for
-          the page to be unlocked so it can call ntfs_readpage() or discover
-          that Process 1 set PageUptodate() again and use the page.
-          Thus we have a deadlock due to ifind() waiting on the inode lock.
-          The solution: The fix is to use the newly introduced
-          ilookup5_nowait() which does not wait on the inode's lock and hence
-          avoids the deadlock.  This is safe as we do not care about the VFS
-          inode and only use the fact that it is in the VFS inode cache and the
-          fact that the vfs and ntfs inodes are one struct in memory to find
-          the ntfs inode in memory if present.  Also, the ntfs inode has its
-          own locking so it does not matter if the vfs inode is locked.
-        - Fix bug in mft record writing where we forgot to set the device in
-          the buffers when mapping them after the VM had discarded them.
-          Thanks to Martin MOKREJÅ for the bug report.
-
-2.1.22 - Many bug and race fixes and error handling improvements.
-
-        - Improve error handling in fs/ntfs/inode.c::ntfs_truncate().
-        - Change fs/ntfs/inode.c::ntfs_truncate() to return an error code
-          instead of void and provide a helper ntfs_truncate_vfs() for the
-          vfs ->truncate method.
-        - Add a new ntfs inode flag NInoTruncateFailed() and modify
-          fs/ntfs/inode.c::ntfs_truncate() to set and clear it appropriately.
-        - Fix min_size and max_size definitions in ATTR_DEF structure in
-          fs/ntfs/layout.h to be signed.
-        - Add attribute definition handling helpers to fs/ntfs/attrib.[hc]:
-          ntfs_attr_size_bounds_check(), ntfs_attr_can_be_non_resident(), and
-          ntfs_attr_can_be_resident(), which in turn use the new private helper
-          ntfs_attr_find_in_attrdef().
-        - In fs/ntfs/aops.c::mark_ntfs_record_dirty(), take the
-          mapping->private_lock around the dirtying of the buffer heads
-          analagous to the way it is done in __set_page_dirty_buffers().
-        - Ensure the mft record size does not exceed the PAGE_CACHE_SIZE at
-          mount time as this cannot work with the current implementation.
-        - Check for location of attribute name and improve error handling in
-          general in fs/ntfs/inode.c::ntfs_read_locked_inode() and friends.
-        - In fs/ntfs/aops.c::ntfs_writepage(), if the page is fully outside
-          i_size, i.e. race with truncate, invalidate the buffers on the page
-          so that they become freeable and hence the page does not leak.
-        - Remove unused function fs/ntfs/runlist.c::ntfs_rl_merge().  (Adrian
-          Bunk)
-        - Fix stupid bug in fs/ntfs/attrib.c::ntfs_attr_find() that resulted in
-          a NULL pointer dereference in the error code path when a corrupt
-          attribute was found.  (Thanks to Domen Puncer for the bug report.)
-        - Add MODULE_VERSION() to fs/ntfs/super.c.
-        - Make several functions and variables static.  (Adrian Bunk)
-        - Modify fs/ntfs/aops.c::mark_ntfs_record_dirty() so it allocates
-          buffers for the page if they are not present and then marks the
-          buffers belonging to the ntfs record dirty.  This causes the buffers
-          to become busy and hence they are safe from removal until the page
-          has been written out.
-        - Fix stupid bug in fs/ntfs/attrib.c::ntfs_external_attr_find() in the
-          error handling code path that resulted in a BUG() due to trying to
-          unmap an extent mft record when the mapping of it had failed and it
-          thus was not mapped.  (Thanks to Ken MacFerrin for the bug report.)
-        - Drop the runlist lock after the vcn has been read in
-          fs/ntfs/lcnalloc.c::__ntfs_cluster_free().
-        - Rewrite handling of multi sector transfer errors.  We now do not set
-          PageError() when such errors are detected in the async i/o handler
-          fs/ntfs/aops.c::ntfs_end_buffer_async_read().  All users of mst
-          protected attributes now check the magic of each ntfs record as they
-          use it and act appropriately.  This has the effect of making errors
-          granular per ntfs record rather than per page which solves the case
-          where we cannot access any of the ntfs records in a page when a
-          single one of them had an mst error.  (Thanks to Ken MacFerrin for
-          the bug report.)
-        - Fix error handling in fs/ntfs/quota.c::ntfs_mark_quotas_out_of_date()
-          where we failed to release i_mutex on the $Quota/$Q attribute inode.
-        - Fix bug in handling of bad inodes in fs/ntfs/namei.c::ntfs_lookup().
-        - Add mapping of unmapped buffers to all remaining code paths, i.e.
-          fs/ntfs/aops.c::ntfs_write_mst_block(), mft.c::ntfs_sync_mft_mirror(),
-          and write_mft_record_nolock().  From now on we require that the
-          complete runlist for the mft mirror is always mapped into memory.
-        - Add creation of buffers to fs/ntfs/mft.c::ntfs_sync_mft_mirror().
-        - Improve error handling in fs/ntfs/aops.c::ntfs_{read,write}_block().
-        - Cleanup fs/ntfs/aops.c::ntfs_{read,write}page() since we know that a
-          resident attribute will be smaller than a page which makes the code
-          simpler.  Also make the code more tolerant to concurrent ->truncate.
-
-2.1.21 - Fix some races and bugs, rewrite mft write code, add mft allocator.
-
-        - Implement extent mft record deallocation
-          fs/ntfs/mft.c::ntfs_extent_mft_record_free().
-        - Splitt runlist related functions off from attrib.[hc] to runlist.[hc].
-        - Add vol->mft_data_pos and initialize it at mount time.
-        - Rename init_runlist() to ntfs_init_runlist(), ntfs_vcn_to_lcn() to
-          ntfs_rl_vcn_to_lcn(), decompress_mapping_pairs() to
-          ntfs_mapping_pairs_decompress(), ntfs_merge_runlists() to
-          ntfs_runlists_merge() and adapt all callers.
-        - Add fs/ntfs/runlist.[hc]::ntfs_get_nr_significant_bytes(),
-          ntfs_get_size_for_mapping_pairs(), ntfs_write_significant_bytes(),
-          and ntfs_mapping_pairs_build(), adapted from libntfs.
-        - Make fs/ntfs/lcnalloc.c::ntfs_cluster_free_from_rl_nolock() not
-          static and add a declaration for it to lcnalloc.h.
-        - Add fs/ntfs/lcnalloc.h::ntfs_cluster_free_from_rl() which is a static
-          inline wrapper for ntfs_cluster_free_from_rl_nolock() which takes the
-          cluster bitmap lock for the duration of the call.
-        - Add fs/ntfs/attrib.[hc]::ntfs_attr_record_resize().
-        - Implement the equivalent of memset() for an ntfs attribute in
-          fs/ntfs/attrib.[hc]::ntfs_attr_set() and switch
-          fs/ntfs/logfile.c::ntfs_empty_logfile() to using it.
-        - Remove unnecessary casts from LCN_* constants.
-        - Implement fs/ntfs/runlist.c::ntfs_rl_truncate_nolock().
-        - Add MFT_RECORD_OLD as a copy of MFT_RECORD in fs/ntfs/layout.h and
-          change MFT_RECORD to contain the NTFS 3.1+ specific fields.
-        - Add a helper function fs/ntfs/aops.c::mark_ntfs_record_dirty() which
-          marks all buffers belonging to an ntfs record dirty, followed by
-          marking the page the ntfs record is in dirty and also marking the vfs
-          inode containing the ntfs record dirty (I_DIRTY_PAGES).
-        - Switch fs/ntfs/index.h::ntfs_index_entry_mark_dirty() to using the
-          new helper fs/ntfs/aops.c::mark_ntfs_record_dirty() and remove the no
-          longer needed fs/ntfs/index.[hc]::__ntfs_index_entry_mark_dirty().
-        - Move ntfs_{un,}map_page() from ntfs.h to aops.h and fix resulting
-          include errors.
-        - Move the typedefs for runlist_element and runlist from types.h to
-          runlist.h and fix resulting include errors.
-        - Remove unused {__,}format_mft_record() from fs/ntfs/mft.c.
-        - Modify fs/ntfs/mft.c::__mark_mft_record_dirty() to use the helper
-          mark_ntfs_record_dirty() which also changes the behaviour in that we
-          now set the buffers belonging to the mft record dirty as well as the
-          page itself.
-        - Update fs/ntfs/mft.c::write_mft_record_nolock() and sync_mft_mirror()
-          to cope with the fact that there now are dirty buffers in mft pages.
-        - Update fs/ntfs/inode.c::ntfs_write_inode() to also use the helper
-          mark_ntfs_record_dirty() and thus to set the buffers belonging to the
-          mft record dirty as well as the page itself.
-        - Fix compiler warnings on x86-64 in fs/ntfs/dir.c.  (Randy Dunlap,
-          slightly modified by me)
-        - Add fs/ntfs/mft.c::try_map_mft_record() which fails with -EALREADY if
-          the mft record is already locked and otherwise behaves the same way
-          as fs/ntfs/mft.c::map_mft_record().
-        - Modify fs/ntfs/mft.c::write_mft_record_nolock() so that it only
-          writes the mft record if the buffers belonging to it are dirty.
-          Otherwise we assume that it was written out by other means already.
-        - Attempting to write outside initialized size is _not_ a bug so remove
-          the bug check from fs/ntfs/aops.c::ntfs_write_mst_block().  It is in
-          fact required to write outside initialized size when preparing to
-          extend the initialized size.
-        - Map the page instead of using page_address() before writing to it in
-          fs/ntfs/aops.c::ntfs_mft_writepage().
-        - Provide exclusion between opening an inode / mapping an mft record
-          and accessing the mft record in fs/ntfs/mft.c::ntfs_mft_writepage()
-          by setting the page not uptodate throughout ntfs_mft_writepage().
-        - Clear the page uptodate flag in fs/ntfs/aops.c::ntfs_write_mst_block()
-          to ensure noone can see the page whilst the mst fixups are applied.
-        - Add the helper fs/ntfs/mft.c::ntfs_may_write_mft_record() which
-          checks if an mft record may be written out safely obtaining any
-          necessary locks in the process.  This is used by
-          fs/ntfs/aops.c::ntfs_write_mst_block().
-        - Modify fs/ntfs/aops.c::ntfs_write_mst_block() to also work for
-          writing mft records and improve its error handling in the process.
-          Now if any of the records in the page fail to be written out, all
-          other records will be written out instead of aborting completely.
-        - Remove ntfs_mft_aops and update all users to use ntfs_mst_aops.
-        - Modify fs/ntfs/inode.c::ntfs_read_locked_inode() to set the
-          ntfs_mst_aops for all inodes which are NInoMstProtected() and
-          ntfs_aops for all other inodes.
-        - Rename fs/ntfs/mft.c::sync_mft_mirror{,_umount}() to
-          ntfs_sync_mft_mirror{,_umount}() and change their parameters so they
-          no longer require an ntfs inode to be present.  Update all callers.
-        - Cleanup the error handling in fs/ntfs/mft.c::ntfs_sync_mft_mirror().
-        - Clear the page uptodate flag in fs/ntfs/mft.c::ntfs_sync_mft_mirror()
-          to ensure noone can see the page whilst the mst fixups are applied.
-        - Remove the no longer needed fs/ntfs/mft.c::ntfs_mft_writepage() and
-          fs/ntfs/mft.c::try_map_mft_record().
-        - Fix callers of fs/ntfs/aops.c::mark_ntfs_record_dirty() to call it
-          with the ntfs inode which contains the page rather than the ntfs
-          inode the mft record of which is in the page.
-        - Fix race condition in fs/ntfs/inode.c::ntfs_put_inode() by moving the
-          index inode bitmap inode release code from there to
-          fs/ntfs/inode.c::ntfs_clear_big_inode().  (Thanks to Christoph
-          Hellwig for spotting this.)
-        - Fix race condition in fs/ntfs/inode.c::ntfs_put_inode() by taking the
-          inode semaphore around the code that sets ni->itype.index.bmp_ino to
-          NULL and reorganize the code to optimize it a bit.  (Thanks to
-          Christoph Hellwig for spotting this.)
-        - Modify fs/ntfs/aops.c::mark_ntfs_record_dirty() to no longer take the
-          ntfs inode as a parameter as this is confusing and misleading and the
-          needed ntfs inode is available via NTFS_I(page->mapping->host).
-          Adapt all callers to this change.
-        - Modify fs/ntfs/mft.c::write_mft_record_nolock() and
-          fs/ntfs/aops.c::ntfs_write_mst_block() to only check the dirty state
-          of the first buffer in a record and to take this as the ntfs record
-          dirty state.  We cannot look at the dirty state for subsequent
-          buffers because we might be racing with
-          fs/ntfs/aops.c::mark_ntfs_record_dirty().
-        - Move the static inline ntfs_init_big_inode() from fs/ntfs/inode.c to
-          inode.h and make fs/ntfs/inode.c::__ntfs_init_inode() non-static and
-          add a declaration for it to inode.h.  Fix some compilation issues
-          that resulted due to #includes and header file interdependencies.
-        - Simplify setup of i_mode in fs/ntfs/inode.c::ntfs_read_locked_inode().
-        - Add helpers fs/ntfs/layout.h::MK_MREF() and MK_LE_MREF().
-        - Modify fs/ntfs/mft.c::map_extent_mft_record() to only verify the mft
-          record sequence number if it is specified (i.e. not zero).
-        - Add fs/ntfs/mft.[hc]::ntfs_mft_record_alloc() and various helper
-          functions used by it.
-        - Update Documentation/filesystems/ntfs.txt with instructions on how to
-          use the Device-Mapper driver with NTFS ftdisk/LDM raid.  This removes
-          the linear raid problem with the Software RAID / MD driver when one
-          or more of the devices has an odd number of sectors.
-
-2.1.20 - Fix two stupid bugs introduced in 2.1.18 release.
-
-        - Fix stupid bug in fs/ntfs/attrib.c::ntfs_attr_reinit_search_ctx()
-          where we did not clear ctx->al_entry but it was still set due to
-          changes in ntfs_attr_lookup() and ntfs_external_attr_find() in
-          particular.
-        - Fix another stupid bug in fs/ntfs/attrib.c::ntfs_external_attr_find()
-          where we forgot to unmap the extent mft record when we had finished
-          enumerating an attribute which caused a bug check to trigger when the
-          VFS calls ->clear_inode.
-
-2.1.19 - Many cleanups, improvements, and a minor bug fix.
-
-        - Update ->setattr (fs/ntfs/inode.c::ntfs_setattr()) to refuse to
-          change the uid, gid, and mode of an inode as we do not support NTFS
-          ACLs yet.
-        - Remove BKL use from ntfs_setattr() syncing up with the rest of the
-          kernel.
-        - Get rid of the ugly transparent union in fs/ntfs/dir.c::ntfs_readdir()
-          and ntfs_filldir() as per suggestion from Al Viro.
-        - Change '\0' and L'\0' to simply 0 as per advice from Linus Torvalds.
-        - Update ->truncate (fs/ntfs/inode.c::ntfs_truncate()) to check if the
-          inode size has changed and to only output an error if so.
-        - Rename fs/ntfs/attrib.h::attribute_value_length() to ntfs_attr_size().
-        - Add le{16,32,64} as well as sle{16,32,64} data types to
-          fs/ntfs/types.h.
-        - Change ntfschar to be le16 instead of u16 in fs/ntfs/types.h.
-        - Add le versions of VCN, LCN, and LSN called leVCN, leLCN, and leLSN,
-          respectively, to fs/ntfs/types.h.
-        - Update endianness conversion macros in fs/ntfs/endian.h to use the
-          new types as appropriate.
-        - Do proper type casting when using sle64_to_cpup() in fs/ntfs/dir.c
-          and index.c.
-        - Add leMFT_REF data type to fs/ntfs/layout.h.
-        - Update all NTFS header files with the new little endian data types.
-          Affected files are fs/ntfs/layout.h, logfile.h, and time.h.
-        - Do proper type casting when using ntfs_is_*_recordp() in
-          fs/ntfs/logfile.c, mft.c, and super.c. 
-        - Fix all the sparse bitwise warnings.  Had to change all the typedef
-          enums storing little endian values to simple enums plus a typedef for
-          the datatype to make sparse happy.
-        - Fix a bug found by the new sparse bitwise warnings where the default
-          upcase table was defined as a pointer to wchar_t rather than ntfschar
-          in fs/ntfs/ntfs.h and super.c.
-        - Change {const_,}cpu_to_le{16,32}(0) to just 0 as suggested by Al Viro.
-
-2.1.18 - Fix scheduling latencies at mount time as well as an endianness bug.
-
-        - Remove vol->nr_mft_records as it was pretty meaningless and optimize
-          the calculation of total/free inodes as used by statfs().
-        - Fix scheduling latencies in ntfs_fill_super() by dropping the BKL
-          because the code itself is using the ntfs_lock semaphore which
-          provides safe locking.  (Ingo Molnar)
-        - Fix a potential bug in fs/ntfs/mft.c::map_extent_mft_record() that
-          could occur in the future for when we start closing/freeing extent
-          inodes if we don't set base_ni->ext.extent_ntfs_inos to NULL after
-          we free it.
-        - Rename {find,lookup}_attr() to ntfs_attr_{find,lookup}() as well as
-          find_external_attr() to ntfs_external_attr_find() to cleanup the
-          namespace a bit and to be more consistent with libntfs.
-        - Rename {{re,}init,get,put}_attr_search_ctx() to
-          ntfs_attr_{{re,}init,get,put}_search_ctx() as well as the type
-          attr_search_context to ntfs_attr_search_ctx.
-        - Force use of ntfs_attr_find() in ntfs_attr_lookup() when searching
-          for the attribute list attribute itself.
-        - Fix endianness bug in ntfs_external_attr_find().
-        - Change ntfs_{external_,}attr_find() to return 0 on success, -ENOENT
-          if the attribute is not found, and -EIO on real error.  In the case
-          of -ENOENT, the search context is updated to describe the attribute
-          before which the attribute being searched for would need to be
-          inserted if such an action were to be desired and in the case of
-          ntfs_external_attr_find() the search context is also updated to
-          indicate the attribute list entry before which the attribute list
-          entry of the attribute being searched for would need to be inserted
-          if such an action were to be desired.  Also make ntfs_find_attr()
-          static and remove its prototype from attrib.h as it is not used
-          anywhere other than attrib.c.  Update ntfs_attr_lookup() and all
-          callers of ntfs_{external,}attr_{find,lookup}() for the new return
-          values.
-        - Minor cleanup of fs/ntfs/inode.c::ntfs_init_locked_inode().
-
-2.1.17 - Fix bugs in mount time error code paths and other updates.
-
-        - Implement bitmap modification code (fs/ntfs/bitmap.[hc]).  This
-          includes functions to set/clear a single bit or a run of bits.
-        - Add fs/ntfs/attrib.[hc]::ntfs_find_vcn() which returns the locked
-          runlist element containing a particular vcn.  It also takes care of
-          mapping any needed runlist fragments.
-        - Implement cluster (de-)allocation code (fs/ntfs/lcnalloc.[hc]).
-        - Load attribute definition table from $AttrDef at mount time.
-        - Fix bugs in mount time error code paths involving (de)allocation of
-          the default and volume upcase tables.
-        - Remove ntfs_nr_mounts as it is no longer used.
-
-2.1.16 - Implement access time updates, file sync, async io, and read/writev.
-
-        - Add support for readv/writev and aio_read/aio_write (fs/ntfs/file.c).
-          This is done by setting the appropriate file operations pointers to
-          the generic helper functions provided by mm/filemap.c.
-        - Implement fsync, fdatasync, and msync both for files (fs/ntfs/file.c)
-          and directories (fs/ntfs/dir.c).
-        - Add support for {a,m,c}time updates to inode.c::ntfs_write_inode().
-          Note, except for the root directory and any other system files opened
-          by the user, the system files will not have their access times
-          updated as they are only accessed at the inode level an hence the
-          file level functions which cause the times to be updated are never
-          invoked.
-
-2.1.15 - Invalidate quotas when (re)mounting read-write.
-
-        - Add new element itype.index.collation_rule to the ntfs inode
-          structure and set it appropriately in ntfs_read_locked_inode().
-        - Implement a new inode type "index" to allow efficient access to the
-          indices found in various system files and adapt inode handling
-          accordingly (fs/ntfs/inode.[hc]).  An index inode is essentially an
-          attribute inode (NInoAttr() is true) with an attribute type of
-          AT_INDEX_ALLOCATION.  As such, it is no longer allowed to call
-          ntfs_attr_iget() with an attribute type of AT_INDEX_ALLOCATION as
-          there would be no way to distinguish between normal attribute inodes
-          and index inodes.  The function to obtain an index inode is
-          ntfs_index_iget() and it uses the helper function
-          ntfs_read_locked_index_inode().  Note, we do not overload
-          ntfs_attr_iget() as indices consist of multiple attributes so using
-          ntfs_attr_iget() to obtain an index inode would be confusing.
-        - Ensure that there is no overflow when doing page->index <<
-          PAGE_CACHE_SHIFT by casting page->index to s64 in fs/ntfs/aops.c.
-        - Use atomic kmap instead of kmap() in fs/ntfs/aops.c::ntfs_read_page()
-          and ntfs_read_block().
-        - Use case sensitive attribute lookups instead of case insensitive ones.
-        - Lock all page cache pages belonging to mst protected attributes while
-          accessing them to ensure we never see corrupt data while the page is
-          under writeout.
-        - Add framework for generic ntfs collation (fs/ntfs/collation.[hc]).
-          We have ntfs_is_collation_rule_supported() to check if the collation
-          rule you want to use is supported and ntfs_collation() which actually
-          collates two data items.  We currently only support COLLATION_BINARY
-          and COLLATION_NTOFS_ULONG but support for other collation rules will
-          be added as the need arises.
-        - Add a new type, ntfs_index_context, to allow retrieval of an index
-          entry using the corresponding index key.  To get an index context,
-          use ntfs_index_ctx_get() and to release it, use ntfs_index_ctx_put().
-          This also adds a new slab cache for the index contexts.  To lookup a
-          key in an index inode, use ntfs_index_lookup().  After modifying an
-          index entry, call ntfs_index_entry_flush_dcache_page() followed by
-          ntfs_index_entry_mark_dirty() to ensure the changes are written out
-          to disk.  For details see fs/ntfs/index.[hc].  Note, at present, if
-          an index entry is in the index allocation attribute rather than the
-          index root attribute it will not be written out (you will get a
-          warning message about discarded changes instead).
-        - Load the quota file ($Quota) and check if quota tracking is enabled
-          and if so, mark the quotas out of date.  This causes windows to
-          rescan the volume on boot and update all quota entries.
-        - Add a set_page_dirty address space operation for ntfs_m[fs]t_aops.
-          It is simply set to __set_page_dirty_nobuffers() to make sure that
-          running set_page_dirty() on a page containing mft/ntfs records will
-          not affect the dirty state of the page buffers.
-        - Add fs/ntfs/index.c::__ntfs_index_entry_mark_dirty() which sets all
-          buffers that are inside the ntfs record in the page dirty after which
-          it sets the page dirty.  This allows ->writepage to only write the
-          dirty index records rather than having to write all the records in
-          the page.  Modify fs/ntfs/index.h::ntfs_index_entry_mark_dirty() to
-          use this rather than __set_page_dirty_nobuffers().
-        - Implement fs/ntfs/aops.c::ntfs_write_mst_block() which enables the
-          writing of page cache pages belonging to mst protected attributes
-          like the index allocation attribute in directory indices and other
-          indices like $Quota/$Q, etc.  This means that the quota is now marked
-          out of date on all volumes rather than only on ones where the quota
-          defaults entry is in the index root attribute of the $Quota/$Q index.
-
-2.1.14 - Fix an NFSd caused deadlock reported by several users.
-
-        - Modify fs/ntfs/ntfs_readdir() to copy the index root attribute value
-          to a buffer so that we can put the search context and unmap the mft
-          record before calling the filldir() callback.  We need to do this
-          because of NFSd which calls ->lookup() from its filldir callback()
-          and this causes NTFS to deadlock as ntfs_lookup() maps the mft record
-          of the directory and since ntfs_readdir() has got it mapped already
-          ntfs_lookup() deadlocks.
-
-2.1.13 - Enable overwriting of resident files and housekeeping of system files.
-
-        - Implement writing of mft records (fs/ntfs/mft.[hc]), which includes
-          keeping the mft mirror in sync with the mft when mirrored mft records
-          are written.  The functions are write_mft_record{,_nolock}().  The
-          implementation is quite rudimentary for now with lots of things not
-          implemented yet but I am not sure any of them can actually occur so
-          I will wait for people to hit each one and only then implement it.
-        - Commit open system inodes at umount time.  This should make it
-          virtually impossible for sync_mft_mirror_umount() to ever be needed.
-        - Implement ->write_inode (fs/ntfs/inode.c::ntfs_write_inode()) for the
-          ntfs super operations.  This gives us inode writing via the VFS inode
-          dirty code paths.  Note:  Access time updates are not implemented yet.
-        - Implement fs/ntfs/mft.[hc]::{,__}mark_mft_record_dirty() and make
-          fs/ntfs/aops.c::ntfs_writepage() and ntfs_commit_write() use it, thus
-          finally enabling resident file overwrite!  (-8  This also includes a
-          placeholder for ->writepage (ntfs_mft_writepage()), which for now
-          just redirties the page and returns.  Also, at umount time, we for
-          now throw away all mft data page cache pages after the last call to
-          ntfs_commit_inode() in the hope that all inodes will have been
-          written out by then and hence no dirty (meta)data will be lost.  We
-          also check for this case and emit an error message telling the user
-          to run chkdsk.
-        - Use set_page_writeback() and end_page_writeback() in the resident
-          attribute code path of fs/ntfs/aops.c::ntfs_writepage() otherwise
-          the radix-tree tag PAGECACHE_TAG_DIRTY remains set even though the
-          page is clean.
-        - Implement ntfs_mft_writepage() so it now checks if any of the mft
-          records in the page are dirty and if so redirties the page and
-          returns.  Otherwise it just returns (after doing set_page_writeback(),
-          unlock_page(), end_page_writeback() or the radix-tree tag
-          PAGECACHE_TAG_DIRTY remains set even though the page is clean), thus
-          alowing the VM to do with the page as it pleases.  Also, at umount
-          time, now only throw away dirty mft (meta)data pages if dirty inodes
-          are present and ask the user to email us if they see this happening.
-        - Add functions ntfs_{clear,set}_volume_flags(), to modify the volume
-          information flags (fs/ntfs/super.c).
-        - Mark the volume dirty when (re)mounting read-write and mark it clean
-          when unmounting or remounting read-only.  If any volume errors are
-          found, the volume is left marked dirty to force chkdsk to run.
-        - Add code to set the NT4 compatibility flag when (re)mounting
-          read-write for newer NTFS versions but leave it commented out for now
-          since we do not make any modifications that are NTFS 1.2 specific yet
-          and since setting this flag breaks Captive-NTFS which is not nice.
-          This code must be enabled once we start writing NTFS 1.2 specific
-          changes otherwise Windows NTFS driver might crash / cause corruption.
-
-2.1.12 - Fix the second fix to the decompression engine and some cleanups.
-
-        - Add a new address space operations struct, ntfs_mst_aops, for mst
-          protected attributes.  This is because the default ntfs_aops do not
-          make sense with mst protected data and were they to write anything to
-          such an attribute they would cause data corruption so we provide
-          ntfs_mst_aops which does not have any write related operations set.
-        - Cleanup dirty ntfs inode handling (fs/ntfs/inode.[hc]) which also
-          includes an adapted ntfs_commit_inode() and an implementation of
-          ntfs_write_inode() which for now just cleans dirty inodes without
-          writing them (it does emit a warning that this is happening).
-        - Undo the second decompression engine fix (see 2.1.9 release ChangeLog
-          entry) as it was only fixing a theoretical bug but at the same time
-          it badly broke the handling of sparse and uncompressed compression
-          blocks.
-
-2.1.11 - Driver internal cleanups.
-
-        - Only build logfile.o if building the driver with read-write support.
-        - Really final white space cleanups.
-        - Use generic_ffs() instead of ffs() in logfile.c which allows the
-          log_page_size variable to be optimized by gcc into a constant.
-        - Rename uchar_t to ntfschar everywhere as uchar_t is unsigned 1-byte
-          char as defined by POSIX and as found on some systems.
-
-2.1.10 - Force read-only (re)mounting of volumes with unsupported volume flags.
-
-        - Finish off the white space cleanups (remove trailing spaces, etc).
-        - Clean up ntfs_fill_super() and ntfs_read_inode_mount() by removing
-          the kludges around the first iget().  Instead of (re)setting ->s_op
-          we have the $MFT inode set up by explicit new_inode() / set ->i_ino /
-          insert_inode_hash() / call ntfs_read_inode_mount() directly.  This
-          kills the need for second super_operations and allows to return error
-          from ntfs_read_inode_mount() without resorting to ugly "poisoning"
-          tricks.  (Al Viro)
-        - Force read-only (re)mounting if any of the following bits are set in
-          the volume information flags:
-                VOLUME_IS_DIRTY, VOLUME_RESIZE_LOG_FILE,
-                VOLUME_UPGRADE_ON_MOUNT, VOLUME_DELETE_USN_UNDERWAY,
-                VOLUME_REPAIR_OBJECT_ID, VOLUME_MODIFIED_BY_CHKDSK
-          To make this easier we define VOLUME_MUST_MOUNT_RO_MASK with all the
-          above bits set so the test is made easy.
-
-2.1.9 - Fix two bugs in decompression engine.
-
-        - Fix a bug where we would not always detect that we have reached the
-          end of a compression block because we were ending at minus one byte
-          which is effectively the same as being at the end.  The fix is to
-          check whether the uncompressed buffer has been fully filled and if so
-          we assume we have reached the end of the compression block.  A big
-          thank you to Marcin Gibuła for the bug report, the assistance in
-          tracking down the bug and testing the fix.
-        - Fix a possible bug where when a compressed read is truncated to the
-          end of the file, the offset inside the last page was not truncated.
-
-2.1.8 - Handle $MFT mirror and $LogFile, improve time handling, and cleanups.
-
-        - Use get_bh() instead of manual atomic_inc() in fs/ntfs/compress.c.
-        - Modify fs/ntfs/time.c::ntfs2utc(), get_current_ntfs_time(), and
-          utc2ntfs() to work with struct timespec instead of time_t on the
-          Linux UTC time side thus preserving the full precision of the NTFS
-          time and only loosing up to 99 nano-seconds in the Linux UTC time.
-        - Move fs/ntfs/time.c to fs/ntfs/time.h and make the time functions
-          static inline.
-        - Remove unused ntfs_dirty_inode().
-        - Cleanup super operations declaration in fs/ntfs/super.c.
-        - Wrap flush_dcache_mft_record_page() in #ifdef NTFS_RW.
-        - Add NInoTestSetFoo() and NInoTestClearFoo() macro magic to
-          fs/ntfs/inode.h and use it to declare NInoTest{Set,Clear}Dirty.
-        - Move typedefs for ntfs_attr and test_t from fs/ntfs/inode.c to
-          fs/ntfs/inode.h so they can be used elsewhere.
-        - Determine the mft mirror size as the number of mirrored mft records
-          and store it in ntfs_volume->mftmirr_size (fs/ntfs/super.c).
-        - Load the mft mirror at mount time and compare the mft records stored
-          in it to the ones in the mft.  Force a read-only mount if the two do
-          not match (fs/ntfs/super.c).
-        - Fix type casting related warnings on 64-bit architectures.  Thanks
-          to Meelis Roos for reporting them.
-        - Move %L to %ll as %L is floating point and %ll is integer which is
-          what we want.
-        - Read the journal ($LogFile) and determine if the volume has been
-          shutdown cleanly and force a read-only mount if not (fs/ntfs/super.c
-          and fs/ntfs/logfile.c).  This is a little bit of a crude check in
-          that we only look at the restart areas and not at the actual log
-          records so that there will be a very small number of cases where we
-          think that a volume is dirty when in fact it is clean.  This should
-          only affect volumes that have not been shutdown cleanly and did not
-          have any pending, non-check-pointed i/o.
-        - If the $LogFile indicates a clean shutdown and a read-write (re)mount
-          is requested, empty $LogFile by overwriting it with 0xff bytes to
-          ensure that Windows cannot cause data corruption by replaying a stale
-          journal after Linux has written to the volume.
-
-2.1.7 - Enable NFS exporting of mounted NTFS volumes.
-
-        - Set i_generation in the VFS inode from the seq_no of the NTFS inode.
-        - Make ntfs_lookup() NFS export safe, i.e. use d_splice_alias(), etc.
-        - Implement ->get_dentry() in fs/ntfs/namei.c::ntfs_get_dentry() as the
-          default doesn't allow inode number 0 which is a valid inode on NTFS
-          and even if it did allow that it uses iget() instead of ntfs_iget()
-          which makes it useless for us.
-        - Implement ->get_parent() in fs/ntfs/namei.c::ntfs_get_parent() as the
-          default just returns -EACCES which is not very useful.
-        - Define export operations (->s_export_op) for NTFS (ntfs_export_ops)
-          and set them up in the super block at mount time (super.c) this
-          allows mounted NTFS volumes to be exported via NFS.
-        - Add missing return -EOPNOTSUPP; in
-          fs/ntfs/aops.c::ntfs_commit_nonresident_write().
-        - Enforce no atime and no dir atime updates at mount/remount time as
-          they are not implemented yet anyway.
-        - Move a few assignments in fs/ntfs/attrib.c::load_attribute_list() to
-          after a NULL check.  Thanks to Dave Jones for pointing this out.
-
-2.1.6 - Fix minor bug in handling of compressed directories.
-
-        - Fix bug in handling of compressed directories.  A compressed
-          directory is not really compressed so when we set the ->i_blocks
-          field of a compressed directory inode we were setting it from the
-          non-existing field ni->itype.compressed.size which gave random
-          results...  For directories we now always use ni->allocated_size.
-
-2.1.5 - Fix minor bug in attribute list attribute handling.
-
-        - Fix bug in attribute list handling.  Actually it is not as much a bug
-          as too much protection in that we were not allowing attribute lists
-          which waste space on disk while Windows XP clearly allows it and in
-          fact creates such attribute lists so our driver was failing.
-        - Update NTFS documentation ready for 2.6 kernel release.
-
-2.1.4 - Reduce compiler requirements.
-
-        - Remove all uses of unnamed structs and unions in the driver to make
-          old and newer gcc versions happy. Makes it a bit uglier IMO but at
-          least people will stop hassling me about it.
-
-2.1.3 - Important bug fixes in corner cases.
-
-        - super.c::parse_ntfs_boot_sector(): Correct the check for 64-bit
-          clusters. (Philipp Thomas)
-        - attrib.c::load_attribute_list(): Fix bug when initialized_size is a
-          multiple of the block_size but not the cluster size. (Szabolcs
-          Szakacsits)
-
-2.1.2 - Important bug fixes aleviating the hangs in statfs.
-
-        - Fix buggy free cluster and free inode determination logic.
-
-2.1.1 - Minor updates.
-
-        - Add handling for initialized_size != data_size in compressed files.
-        - Reduce function local stack usage from 0x3d4 bytes to just noise in
-          fs/ntfs/upcase.c. (Randy Dunlap)
-        - Remove compiler warnings for newer gcc.
-        - Pages are no longer kmapped by mm/filemap.c::generic_file_write()
-          around calls to ->{prepare,commit}_write.  Adapt NTFS appropriately
-          in fs/ntfs/aops.c::ntfs_prepare_nonresident_write() by using
-          kmap_atomic(KM_USER0).
-
-2.1.0 - First steps towards write support: implement file overwrite.
-
-        - Add configuration option for developmental write support with an
-          appropriately scary configuration help text.
-        - Initial implementation of fs/ntfs/aops.c::ntfs_writepage() and its
-          helper fs/ntfs/aops.c::ntfs_write_block(). This enables mmap(2) based
-          overwriting of existing files on ntfs. Note: Resident files are
-          only written into memory, and not written out to disk at present, so
-          avoid writing to files smaller than about 1kiB.
-        - Initial implementation of fs/ntfs/aops.c::ntfs_prepare_write(), its
-          helper fs/ntfs/aops.c::ntfs_prepare_nonresident_write() and their
-          counterparts, fs/ntfs/aops.c::ntfs_commit_write(), and
-          fs/ntfs/aops.c::ntfs_commit_nonresident_write(), respectively. Also,
-          add generic_file_write() to the ntfs file operations (fs/ntfs/file.c).
-          This enables write(2) based overwriting of existing files on ntfs.
-          Note: As with mmap(2) based overwriting, resident files are only
-          written into memory, and not written out to disk at present, so avoid
-          writing to files smaller than about 1kiB.
-        - Implement ->truncate (fs/ntfs/inode.c::ntfs_truncate()) and
-          ->setattr() (fs/ntfs/inode.c::ntfs_setattr()) inode operations for
-          files with the purpose of intercepting and aborting all i_size
-          changes which we do not support yet. ntfs_truncate() actually only
-          emits a warning message but AFAICS our interception of i_size changes
-          elsewhere means ntfs_truncate() never gets called for i_size changes.
-          It is only called from generic_file_write() when we fail in
-          ntfs_prepare_{,nonresident_}write() in order to discard any
-          instantiated buffers beyond i_size. Thus i_size is not actually
-          changed so our warning message is enough. Unfortunately it is not
-          possible to easily determine if i_size is being changed or not hence
-          we just emit an appropriately worded error message.
-
-2.0.25 - Small bug fixes and cleanups.
-
-        - Unlock the page in an out of memory error code path in
-          fs/ntfs/aops.c::ntfs_read_block().
-        - If fs/ntfs/aops.c::ntfs_read_page() is called on an uptodate page,
-          just unlock the page and return. (This can happen due to ->writepage
-          clearing PageUptodate() during write out of MstProtected()
-          attributes.
-        - Remove leaked write code again.
-
-2.0.24 - Cleanups.
-
-        - Treat BUG_ON() as ASSERT() not VERIFY(), i.e. do not use side effects
-          inside BUG_ON(). (Adam J. Richter)
-        - Split logical OR expressions inside BUG_ON() into individual BUG_ON()
-          calls for improved debugging. (Adam J. Richter)
-        - Add errors flag to the ntfs volume state, accessed via
-          NVol{,Set,Clear}Errors(vol).
-        - Do not allow read-write remounts of read-only volumes with errors.
-        - Clarify comment for ntfs file operation sendfile which was added by
-          Christoph Hellwig a while ago (just using generic_file_sendfile())
-          to say that ntfs ->sendfile is only used for the case where the
-          source data is on the ntfs partition and the destination is
-          somewhere else, i.e. nothing we need to concern ourselves with.
-        - Add generic_file_write() as our ntfs file write operation.
-
-2.0.23 - Major bug fixes (races, deadlocks, non-i386 architectures).
-
-        - Massive internal locking changes to mft record locking. Fixes lock
-          recursion and replaces the mrec_lock read/write semaphore with a
-          mutex. Also removes the now superfluous mft_count. This fixes several
-          race conditions and deadlocks, especially in the future write code.
-        - Fix ntfs over loopback for compressed files by adding an
-          optimization barrier. (gcc was screwing up otherwise ?)
-        - Miscellaneous cleanups all over the code and a fix or two in error
-          handling code paths.
-        Thanks go to Christoph Hellwig for pointing out the following two:
-        - Remove now unused function fs/ntfs/malloc.h::vmalloc_nofs().
-        - Fix ntfs_free() for ia64 and parisc by checking for VMALLOC_END, too.
-
-2.0.22 - Cleanups, mainly to ntfs_readdir(), and use C99 initializers.
-
-        - Change fs/ntfs/dir.c::ntfs_reddir() to only read/write ->f_pos once
-          at entry/exit respectively.
-        - Use C99 initializers for structures.
-        - Remove unused variable blocks from fs/ntfs/aops.c::ntfs_read_block().
-
-2.0.21 - Check for, and refuse to work with too large files/directories/volumes.
-
-        - Limit volume size at mount time to 2TiB on architectures where
-          unsigned long is 32-bits (fs/ntfs/super.c::parse_ntfs_boot_sector()).
-          This is the most we can do without overflowing the 32-bit limit of
-          the block device size imposed on us by sb_bread() and sb_getblk()
-          for the time being.
-        - Limit file/directory size at open() time to 16TiB on architectures
-          where unsigned long is 32-bits (fs/ntfs/file.c::ntfs_file_open() and
-          fs/ntfs/dir.c::ntfs_dir_open()). This is the most we can do without
-          overflowing the page cache page index.
-
-2.0.20 - Support non-resident directory index bitmaps, fix page leak in readdir.
-
-        - Move the directory index bitmap to use an attribute inode instead of
-          having special fields for it inside the ntfs inode structure. This
-          means that the index bitmaps now use the page cache for i/o, too,
-          and also as a side effect we get support for non-resident index
-          bitmaps for free.
-        - Simplify/cleanup error handling in fs/ntfs/dir.c::ntfs_readdir() and
-          fix a page leak that manifested itself in some cases.
-        - Add fs/ntfs/inode.c::ntfs_put_inode(), which we need to release the
-          index bitmap inode on the final iput().
-
-2.0.19 - Fix race condition, improvements, and optimizations in i/o interface.
-
-        - Apply block optimization added to fs/ntfs/aops.c::ntfs_read_block()
-          to fs/ntfs/compress.c::ntfs_file_read_compressed_block() as well.
-        - Drop the "file" from ntfs_file_read_compressed_block().
-        - Rename fs/ntfs/aops.c::ntfs_enb_buffer_read_async() to
-          ntfs_end_buffer_async_read() (more like the fs/buffer.c counterpart).
-        - Update ntfs_end_buffer_async_read() with the improved logic from
-          its updated counterpart fs/buffer.c::end_buffer_async_read(). Apply
-          further logic improvements to better determine when we set PageError.
-        - Update submission of buffers in fs/ntfs/aops.c::ntfs_read_block() to
-          check for the buffers being uptodate first in line with the updated
-          fs/buffer.c::block_read_full_page(). This plugs a small race
-          condition.
-
-2.0.18 - Fix race condition in reading of compressed files.
-
-        - There was a narrow window between checking a buffer head for being
-          uptodate and locking it in ntfs_file_read_compressed_block(). We now
-          lock the buffer and then check whether it is uptodate or not.
-
-2.0.17 - Cleanups and optimizations - shrinking the ToDo list.
-
-        - Modify fs/ntfs/inode.c::ntfs_read_locked_inode() to return an error
-          code and update callers, i.e. ntfs_iget(), to pass that error code
-          up instead of just using -EIO.
-        - Modifications to super.c to ensure that both mount and remount
-          cannot set any write related options when the driver is compiled
-          read-only.
-        - Optimize block resolution in fs/ntfs/aops.c::ntfs_read_block() to
-          cache the current runlist element. This should improve performance
-          when reading very large and/or very fragmented data.
-
-2.0.16 - Convert access to $MFT/$BITMAP to attribute inode API.
-
-        - Fix a stupid bug introduced in 2.0.15 where we were unmapping the
-          wrong inode in fs/ntfs/inode.c::ntfs_attr_iget().
-        - Fix debugging check in fs/ntfs/aops.c::ntfs_read_block().
-        - Convert $MFT/$BITMAP access to attribute inode API and remove all
-          remnants of the ugly mftbmp address space and operations hack. This
-          means we finally have only one readpage function as well as only one
-          async io completion handler. Yey! The mft bitmap is now just an
-          attribute inode and is accessed from vol->mftbmp_ino just as if it
-          were a normal file. Fake inodes rule. (-:
-
-2.0.15 - Fake inodes based attribute i/o via the pagecache, fixes and cleanups.
-
-        - Fix silly bug in fs/ntfs/super.c::parse_options() which was causing
-          remounts to fail when the partition had an entry in /etc/fstab and
-          the entry specified the nls= option.
-        - Apply same macro magic used in fs/ntfs/inode.h to fs/ntfs/volume.h to
-          expand all the helper functions NVolFoo(), NVolSetFoo(), and
-          NVolClearFoo().
-        - Move copyright statement from driver initialisation message to
-          module description (fs/super.c). This makes the initialisation
-          message fit on one line and fits in better with rest of kernel.
-        - Update fs/ntfs/attrib.c::map_run_list() to work on both real and
-          attribute inodes, and both for files and directories.
-        - Implement fake attribute inodes allowing all attribute i/o to go via
-          the page cache and to use all the normal vfs/mm functionality:
-          - Add ntfs_attr_iget() and its helper ntfs_read_locked_attr_inode()
-            to fs/ntfs/inode.c.
-          - Add needed cleanup code to ntfs_clear_big_inode().
-        - Merge address space operations for files and directories (aops.c),
-          now just have ntfs_aops:
-          - Rename:
-                end_buffer_read_attr_async() -> ntfs_end_buffer_read_async(),
-                ntfs_attr_read_block()       -> ntfs_read_block(),
-                ntfs_file_read_page()        -> ntfs_readpage().
-          - Rewrite fs/ntfs/aops.c::ntfs_readpage() to work on both real and
-            attribute inodes, and both for files and directories.
-          - Remove obsolete fs/ntfs/aops.c::ntfs_mst_readpage().
-
-2.0.14 - Run list merging code cleanup, minor locking changes, typo fixes.
-
-        - Change fs/ntfs/super.c::ntfs_statfs() to not rely on BKL by moving
-          the locking out of super.c::get_nr_free_mft_records() and taking and
-          dropping the mftbmp_lock rw_semaphore in ntfs_statfs() itself.
-        - Bring attribute runlist merging code (fs/ntfs/attrib.c) in sync with
-          current userspace ntfs library code. This means that if a merge
-          fails the original runlists are always left unmodified instead of
-          being silently corrupted.
-        - Misc typo fixes.
-
-2.0.13 - Use iget5_locked() in preparation for fake inodes and small cleanups.
-
-        - Remove nr_mft_bits and the now superfluous union with nr_mft_records
-          from ntfs_volume structure.
-        - Remove nr_lcn_bits and the now superfluous union with nr_clusters
-          from ntfs_volume structure.
-        - Use iget5_locked() and friends instead of conventional iget(). Wrap
-          the call in fs/ntfs/inode.c::ntfs_iget() and update callers of iget()
-          to use ntfs_iget(). Leave only one iget() call at mount time so we
-          don't need an ntfs_iget_mount().
-        - Change fs/ntfs/inode.c::ntfs_new_extent_inode() to take mft_no as an
-          additional argument.
-
-2.0.12 - Initial cleanup of address space operations following 2.0.11 changes.
-
-        - Merge fs/ntfs/aops.c::end_buffer_read_mst_async() and
-          fs/ntfs/aops.c::end_buffer_read_file_async() into one function
-          fs/ntfs/aops.c::end_buffer_read_attr_async() using NInoMstProtected()
-          to determine whether to apply mst fixups or not.
-        - Above change allows merging fs/ntfs/aops.c::ntfs_file_read_block()
-          and fs/ntfs/aops.c::ntfs_mst_readpage() into one function
-          fs/ntfs/aops.c::ntfs_attr_read_block(). Also, create a tiny wrapper
-          fs/ntfs/aops.c::ntfs_mst_readpage() to transform the parameters from
-          the VFS readpage function prototype to the ntfs_attr_read_block()
-          function prototype.
-
-2.0.11 - Initial preparations for fake inode based attribute i/o.
-
-        - Move definition of ntfs_inode_state_bits to fs/ntfs/inode.h and
-          do some macro magic (adapted from include/linux/buffer_head.h) to
-          expand all the helper functions NInoFoo(), NInoSetFoo(), and
-          NInoClearFoo().
-        - Add new flag to ntfs_inode_state_bits: NI_Sparse.
-        - Add new fields to ntfs_inode structure to allow use of fake inodes
-          for attribute i/o: type, name, name_len. Also add new state bits:
-          NI_Attr, which, if set, indicates the inode is a fake inode, and
-          NI_MstProtected, which, if set, indicates the attribute uses multi
-          sector transfer protection, i.e. fixups need to be applied after
-          reads and before/after writes.
-        - Rename fs/ntfs/inode.c::ntfs_{new,clear,destroy}_inode() to
-          ntfs_{new,clear,destroy}_extent_inode() and update callers.
-        - Use ntfs_clear_extent_inode() in fs/ntfs/inode.c::__ntfs_clear_inode()
-          instead of ntfs_destroy_extent_inode().
-        - Cleanup memory deallocations in {__,}ntfs_clear_{,big_}inode().
-        - Make all operations on ntfs inode state bits use the NIno* functions.
-        - Set up the new ntfs inode fields and state bits in
-          fs/ntfs/inode.c::ntfs_read_inode() and add appropriate cleanup of
-          allocated memory to __ntfs_clear_inode().
-        - Cleanup ntfs_inode structure a bit for better ordering of elements
-          w.r.t. their size to allow better packing of the structure in memory.
-
-2.0.10 - There can only be 2^32 - 1 inodes on an NTFS volume.
-
-        - Add check at mount time to verify that the number of inodes on the
-          volume does not exceed 2^32 - 1, which is the maximum allowed for
-          NTFS according to Microsoft.
-        - Change mft_no member of ntfs_inode structure to be unsigned long.
-          Update all users. This makes ntfs_inode->mft_no just a copy of struct
-          inode->i_ino. But we can't just always use struct inode->i_ino and
-          remove mft_no because extent inodes do not have an attached struct
-          inode.
-
-2.0.9 - Decompression engine now uses a single buffer and other cleanups.
-
-        - Change decompression engine to use a single buffer protected by a
-          spin lock instead of per-CPU buffers. (Rusty Russell)
-        - Do not update cb_pos when handling a partial final page during
-          decompression of a sparse compression block, as the value is later
-          reset without being read/used. (Rusty Russell)
-        - Switch to using the new KM_BIO_SRC_IRQ for atomic kmap()s. (Andrew
-          Morton)
-        - Change buffer size in ntfs_readdir()/ntfs_filldir() to use
-          NLS_MAX_CHARSET_SIZE which makes the buffers almost 1kiB each but
-          it also makes everything safer so it is a good thing.
-        - Miscellaneous minor cleanups to comments.
-
-2.0.8 - Major updates for handling of case sensitivity and dcache aliasing.
-
-        Big thanks go to Al Viro and other inhabitants of #kernel for investing
-        their time to discuss the case sensitivity and dcache aliasing issues.
-
-        - Remove unused source file fs/ntfs/attraops.c.
-        - Remove show_inodes mount option(s), thus dropping support for
-          displaying of short file names.
-        - Remove deprecated mount option posix.
-        - Restore show_sys_files mount option.
-        - Add new mount option case_sensitive, to determine if the driver
-          treats file names as case sensitive or not. If case sensitive, create
-          file names in the POSIX namespace. Otherwise create file names in the
-          LONG/WIN32 namespace. Note, files remain accessible via their short
-          file name, if it exists.
-        - Remove really dumb logic bug in boot sector recovery code.
-        - Fix dcache aliasing issues wrt short/long file names via changes
-          to fs/ntfs/dir.c::ntfs_lookup_inode_by_name() and
-          fs/ntfs/namei.c::ntfs_lookup():
-          - Add additional argument to ntfs_lookup_inode_by_name() in which we
-            return information about the matching file name if the case is not
-            matching or the match is a short file name. See comments above the
-            function definition for details.
-          - Change ntfs_lookup() to only create dcache entries for the correctly
-            cased file name and only for the WIN32 namespace counterpart of DOS
-            namespace file names. This ensures we have only one dentry per
-            directory and also removes all dcache aliasing issues between short
-            and long file names once we add write support. See comments above
-            function for details.
-        - Fix potential 1 byte overflow in fs/ntfs/unistr.c::ntfs_ucstonls().
-
-2.0.7 - Minor cleanups and updates for changes in core kernel code.
-
-        - Remove much of the NULL struct element initializers.
-        - Various updates to make compatible with recent kernels.
-        - Remove defines of MAX_BUF_PER_PAGE and include linux/buffer_head.h
-          in fs/ntfs/ntfs.h instead.
-        - Remove no longer needed KERNEL_VERSION checks. We are now in the
-          kernel proper so they are no longer needed.
-
-2.0.6 - Major bugfix to make compatible with other kernel changes.
-
-        - Initialize the mftbmp address space properly now that there are more
-          fields in the struct address_space. This was leading to hangs and
-          oopses on umount since 2.5.12 because of changes to other parts of
-          the kernel. We probably want a kernel generic init_address_space()
-          function...
-        - Drop BKL from ntfs_readdir() after consultation with Al Viro. The
-          only caller of ->readdir() is vfs_readdir() which holds i_mutex
-          during the call, and i_mutex is sufficient protection against changes
-          in the directory inode (including ->i_size).
-        - Use generic_file_llseek() for directories (as opposed to
-          default_llseek()) as this downs i_mutex instead of the BKL which is
-          what we now need for exclusion against ->f_pos changes considering we
-          no longer take the BKL in ntfs_readdir().
-
-2.0.5 - Major bugfix. Buffer overflow in extent inode handling.
-
-        - No need to set old blocksize in super.c::ntfs_fill_super() as the
-          VFS does so via invocation of deactivate_super() calling
-          fs->fill_super() calling block_kill_super() which does it.
-        - BKL moved from VFS into dir.c::ntfs_readdir(). (Linus Torvalds)
-          -> Do we really need it? I don't think so as we have exclusion on
-          the directory ntfs_inode rw_semaphore mrec_lock. We mmight have to
-          move the ->f_pos accesses under the mrec_lock though. Check this...
-        - Fix really, really, really stupid buffer overflow in extent inode
-          handling in mft.c::map_extent_mft_record().
-
-2.0.4 - Cleanups and updates for kernel 2.5.11.
-
-        - Add documentation on how to use the MD driver to be able to use NTFS
-          stripe and volume sets in Linux and generally cleanup documentation
-          a bit.
-        Remove all uses of kdev_t in favour of struct block_device *:
-        - Change compress.c::ntfs_file_read_compressed_block() to use
-          sb_getblk() instead of getblk().
-        - Change super.c::ntfs_fill_super() to use bdev_hardsect_size() instead
-          of get_hardsect_size().
-        - No need to get old blocksize in super.c::ntfs_fill_super() as
-          fs/super.c::get_sb_bdev() already does this.
-        - Set bh->b_bdev instead of bh->b_dev throughout aops.c.
-
-2.0.3 - Small bug fixes, cleanups, and performance improvements.
-
-        - Remove some dead code from mft.c.
-        - Optimize readpage and read_block functions throughout aops.c so that
-          only initialized blocks are read. Non-initialized ones have their
-          buffer head mapped, zeroed, and set up to date, without scheduling
-          any i/o. Thanks to Al Viro for advice on how to avoid the device i/o.
-        Thanks go to Andrew Morton for spotting the below:
-        - Fix buglet in allocate_compression_buffers() error code path.
-        - Call flush_dcache_page() after modifying page cache page contents in
-          ntfs_file_readpage().
-        - Check for existence of page buffers throughout aops.c before calling
-          create_empty_buffers(). This happens when an I/O error occurs and the
-          read is retried. (It also happens once writing is implemented so that
-          needed doing anyway but I had left it for later...)
-        - Don't BUG_ON() uptodate and/or mapped buffers throughout aops.c in
-          readpage and read_block functions. Reasoning same as above (i.e. I/O
-          error retries and future write code paths.)
-
-2.0.2 - Minor updates and cleanups.
-
-        - Cleanup: rename mst.c::__post_read_mst_fixup to post_write_mst_fixup
-          and cleanup the code a bit, removing the unused size parameter.
-        - Change default fmask to 0177 and update documentation.
-        - Change attrib.c::get_attr_search_ctx() to return the search context
-          directly instead of taking the address of a pointer. A return value
-          of NULL means the allocation failed. Updated all callers
-          appropriately.
-        - Update to 2.5.9 kernel (preserving backwards compatibility) by
-          replacing all occurences of page->buffers with page_buffers(page).
-        - Fix minor bugs in runlist merging, also minor cleanup.
-        - Updates to bootsector layout and mft mirror contents descriptions.
-        - Small bug fix in error detection in unistr.c and some cleanups.
-        - Grow name buffer allocations in unistr.c in aligned mutlipled of 64
-          bytes.
-
-2.0.1 - Minor updates.
-
-        - Make default umask correspond to documentation.
-        - Improve documentation.
-        - Set default mode to include execute bit. The {u,f,d}mask can be used
-          to take it away if desired. This allows binaries to be executed from
-          a mounted ntfs partition.
-
-2.0.0 - New version number. Remove TNG from the name. Now in the kernel.
-
-        - Add kill_super, just keeping up with the vfs changes in the kernel.
-        - Repeat some changes from tng-0.0.8 that somehow got lost on the way
-          from the CVS import into BitKeeper.
-        - Begin to implement proper handling of allocated_size vs
-          initialized_size vs data_size (i.e. i_size). Done are
-          mft.c::ntfs_mft_readpage(), aops.c::end_buffer_read_index_async(),
-          and attrib.c::load_attribute_list().
-        - Lock the runlist in attrib.c::load_attribute_list() while using it.
-        - Fix memory leak in ntfs_file_read_compressed_block() and generally
-          clean up compress.c a little, removing some uncommented/unused debug
-          code.
-        - Tidy up dir.c a little bit.
-        - Don't bother getting the runlist in inode.c::ntfs_read_inode().
-        - Merge mft.c::ntfs_mft_readpage() and aops.c::ntfs_index_readpage()
-          creating aops.c::ntfs_mst_readpage(), improving the handling of
-          holes and overflow in the process and implementing the correct
-          equivalent of ntfs_file_get_block() in ntfs_mst_readpage() itself.
-          I am aiming for correctness at the moment. Modularisation can come
-          later.
-        - Rename aops.c::end_buffer_read_index_async() to
-          end_buffer_read_mst_async() and optimize the overflow checking and
-          handling.
-        - Use the host of the mftbmp address space mapping to hold the ntfs
-          volume. This is needed so the async i/o completion handler can
-          retrieve a pointer to the volume. Hopefully this will not cause
-          problems elsewhere in the kernel... Otherwise will need to use a
-          fake inode.
-        - Complete implementation of proper handling of allocated_size vs
-          initialized_size vs data_size (i.e. i_size) in whole driver.
-          Basically aops.c is now completely rewritten.
-        - Change NTFS driver name to just NTFS and set version number to 2.0.0
-          to make a clear distinction from the old driver which is still on
-          version 1.1.22.
-
-tng-0.0.8 - 08/03/2002 - Now using BitKeeper, http://linux-ntfs.bkbits.net/
-
-        - Replace bdevname(sb->s_dev) with sb->s_id.
-        - Remove now superfluous new-line characters in all callers of
-          ntfs_debug().
-        - Apply kludge in ntfs_read_inode(), setting i_nlink to 1 for
-          directories. Without this the "find" utility gets very upset which is
-          fair enough as Linux/Unix do not support directory hard links.
-        - Further runlist merging work. (Richard Russon)
-        - Backwards compatibility for gcc-2.95. (Richard Russon)
-        - Update to kernel 2.5.5-pre1 and rediff the now tiny patch.
-        - Convert to new filesystem declaration using ->ntfs_get_sb() and
-          replacing ntfs_read_super() with ntfs_fill_super().
-        - Set s_maxbytes to MAX_LFS_FILESIZE to avoid page cache page index
-          overflow on 32-bit architectures.
-        - Cleanup upcase loading code to use ntfs_(un)map_page().
-        - Disable/reenable preemtion in critical sections of compession engine.
-        - Replace device size determination in ntfs_fill_super() with
-          sb->s_bdev->bd_inode->i_size (in bytes) and remove now superfluous
-          function super.c::get_nr_blocks().
-        - Implement a mount time option (show_inodes) allowing choice of which
-          types of inode names readdir() returns and modify ntfs_filldir()
-          accordingly. There are several parameters to show_inodes:
-                system: system files
-                win32:  long file names (including POSIX file names) [DEFAULT]
-                long:   same as win32
-                dos:    short file names only (excluding POSIX file names)
-                short:  same as dos
-                posix:  same as both win32 and dos
-                all:    all file names
-          Note that the options are additive, i.e. specifying:
-                -o show_inodes=system,show_inodes=win32,show_inodes=dos
-          is the same as specifying:
-                -o show_inodes=all
-          Note that the "posix" and "all" options will show all directory
-          names, BUT the link count on each directory inode entry is set to 1,
-          due to Linux not supporting directory hard links. This may well
-          confuse some userspace applications, since the directory names will
-          have the same inode numbers. Thus it is NOT advisable to use the
-          "posix" or "all" options. We provide them only for completeness sake.
-        - Add copies of allocated_size, initialized_size, and compressed_size to
-          the ntfs inode structure and set them up in
-          inode.c::ntfs_read_inode(). These reflect the unnamed data attribute
-          for files and the index allocation attribute for directories.
-        - Add copies of allocated_size and initialized_size to ntfs inode for
-          $BITMAP attribute of large directories and set them up in
-          inode.c::ntfs_read_inode().
-        - Add copies of allocated_size and initialized_size to ntfs volume for
-          $BITMAP attribute of $MFT and set them up in
-          super.c::load_system_files().
-        - Parse deprecated ntfs driver options (iocharset, show_sys_files,
-          posix, and utf8) and tell user what the new options to use are. Note
-          we still do support them but they will be removed with kernel 2.7.x.
-        - Change all occurences of integer long long printf formatting to hex
-          as printk() will not support long long integer format if/when the
-          div64 patch goes into the kernel.
-        - Make slab caches have stable names and change the names to what they
-          were intended to be. These changes are required/made possible by the
-          new slab cache name handling which removes the length limitation by
-          requiring the caller of kmem_cache_create() to supply a stable name
-          which is then referenced but not copied.
-        - Rename run_list structure to run_list_element and create a new
-          run_list structure containing a pointer to a run_list_element
-          structure and a read/write semaphore. Adapt all users of runlists
-          to new scheme and take and release the lock as needed. This fixes a
-          nasty race as the run_list changes even when inodes are locked for
-          reading and even when the inode isn't locked at all, so we really
-          needed the serialization. We use a semaphore rather than a spinlock
-          as memory allocations can sleep and doing everything GFP_ATOMIC
-          would be silly.
-        - Cleanup read_inode() removing all code checking for lowest_vcn != 0.
-          This can never happen due to the nature of lookup_attr() and how we
-          support attribute lists. If it did happen it would imply the inode
-          being corrupt.
-        - Check for lowest_vcn != 0 in ntfs_read_inode() and mark the inode as
-          bad if found.
-        - Update to 2.5.6-pre2 changes in struct address_space.
-        - Use parent_ino() when accessing d_parent inode number in dir.c.
-        - Import Sourceforge CVS repository into BitKeeper repository:
-                http://linux-ntfs.bkbits.net/ntfs-tng-2.5
-        - Update fs/Makefile, fs/Config.help, fs/Config.in, and
-          Documentation/filesystems/ntfs.txt for NTFS TNG.
-        - Create kernel configuration option controlling whether debugging
-          is enabled or not.
-        - Add the required export of end_buffer_io_sync() from the patches
-          directory to the kernel code.
-        - Update inode.c::ntfs_show_options() with show_inodes mount option.
-        - Update errors mount option.
-
-tng-0.0.7 - 13/02/2002 - The driver is now feature complete for read-only!
-
-        - Cleanup mft.c and it's debug/error output in particular. Fix a minor
-          bug in mapping of extent inodes. Update all the comments to fit all
-          the recent code changes.
-        - Modify vcn_to_lcn() to cope with entirely unmapped runlists.
-        - Cleanups in compress.c, mostly comments and folding help.
-        - Implement attrib.c::map_run_list() as a generic helper.
-        - Make compress.c::ntfs_file_read_compressed_block() use map_run_list()
-          thus making code shorter and enabling attribute list support.
-        - Cleanup incorrect use of [su]64 with %L printf format specifier in
-          all source files. Type casts to [unsigned] long long added to correct
-          the mismatches (important for architectures which have long long not
-          being 64 bits).
-        - Merge async io completion handlers for directory indexes and $MFT
-          data into one by setting the index_block_size{_bits} of the ntfs
-          inode for $MFT to the mft_record_size{_bits} of the ntfs_volume.
-        - Cleanup aops.c, update comments.
-        - Make ntfs_file_get_block() use map_run_list() so all files now
-          support attribute lists.
-        - Make ntfs_dir_readpage() almost verbatim copy of
-          block_read_full_page() by using ntfs_file_get_block() with only real
-          difference being the use of our own async io completion handler
-          rather than the default one, thus reducing the amount of code and
-          automatically enabling attribute list support for directory indices.
-        - Fix bug in load_attribute_list() - forgot to call brelse in error
-          code path.
-        - Change parameters to find_attr() and lookup_attr(). We no longer
-          pass in the upcase table and its length. These can be gotten from
-          ctx->ntfs_ino->vol->upcase{_len}. Update all callers.
-        - Cleanups in attrib.c.
-        - Implement merging of runlists, attrib.c::merge_run_lists() and its
-          helpers. (Richard Russon)
-        - Attribute lists part 2, attribute extents and multi part runlists:
-          enable proper support for LCN_RL_NOT_MAPPED and automatic mapping of
-          further runlist parts via attrib.c::map_run_list().
-        - Tiny endianness bug fix in decompress_mapping_pairs().
-
-tng-0.0.6 - Encrypted directories, bug fixes, cleanups, debugging enhancements.
-
-        - Enable encrypted directories. (Their index root is marked encrypted
-          to indicate that new files in that directory should be created
-          encrypted.)
-        - Fix bug in NInoBmpNonResident() macro. (Cut and paste error.)
-        - Enable $Extend system directory. Most (if not all) extended system
-          files do not have unnamed data attributes so ntfs_read_inode() had to
-          special case them but that is ok, as the special casing recovery
-          happens inside an error code path so there is zero slow down in the
-          normal fast path. The special casing is done by introducing a new
-          function inode.c::ntfs_is_extended_system_file() which checks if any
-          of the hard links in the inode point to $Extend as being their parent
-          directory and if they do we assume this is an extended system file.
-        - Create a sysctl/proc interface to allow {dis,en}abling of debug output
-          when compiled with -DDEBUG. Default is debug messages to be disabled.
-          To enable them, one writes a non-zero value to /proc/sys/fs/ntfs-debug
-          (if /proc is enabled) or uses sysctl(2) to effect the same (if sysctl
-          interface is enabled). Inspired by old ntfs driver.
-        - Add debug_msgs insmod/kernel boot parameter to set whether debug
-          messages are {dis,en}abled. This is useful to enable debug messages
-          during ntfs initialization and is the only way to activate debugging
-          when the sysctl interface is not enabled.
-        - Cleanup debug output in various places.
-        - Remove all dollar signs ($) from the source (except comments) to
-          enable compilation on architectures whose gcc compiler does not
-          support dollar signs in the names of variables/constants. Attribute
-          types now start with AT_ instead of $ and $I30 is now just I30.
-        - Cleanup ntfs_lookup() and add consistency check of sequence numbers.
-        - Load complete runlist for $MFT/$BITMAP during mount and cleanup
-          access functions. This means we now cope with $MFT/$BITMAP being
-          spread accross several mft records.
-        - Disable modification of mft_zone_multiplier on remount. We can always
-          reenable this later on if we really want to, but we will need to make
-          sure we readjust the mft_zone size / layout accordingly.
-
-tng-0.0.5 - Modernize for 2.5.x and further in line-ing with Al Viro's comments.
-
-        - Use sb_set_blocksize() instead of set_blocksize() and verify the
-          return value.
-        - Use sb_bread() instead of bread() throughout.
-        - Add index_vcn_size{_bits} to ntfs_inode structure to store the size
-          of a directory index block vcn. Apply resulting simplifications in
-          dir.c everywhere.
-        - Fix a small bug somewhere (but forgot what it was).
-        - Change ntfs_{debug,error,warning} to enable gcc to do type checking
-          on the printf-format parameter list and fix bugs reported by gcc
-          as a result. (Richard Russon)
-        - Move inode allocation strategy to Al's new stuff but maintain the
-          divorce of ntfs_inode from struct inode. To achieve this we have two
-          separate slab caches, one for big ntfs inodes containing a struct
-          inode and pure ntfs inodes and at the same time fix some faulty
-          error code paths in ntfs_read_inode().
-        - Show mount options in proc (inode.c::ntfs_show_options()).
-
-tng-0.0.4 - Big changes, getting in line with Al Viro's comments.
-
-        - Modified (un)map_mft_record functions to be common for read and write
-          case. To specify which is which, added extra parameter at front of
-          parameter list. Pass either READ or WRITE to this, each has the
-          obvious meaning.
-        - General cleanups to allow for easier folding in vi.
-        - attrib.c::decompress_mapping_pairs() now accepts the old runlist
-          argument, and invokes attrib.c::merge_run_lists() to merge the old
-          and the new runlists.
-        - Removed attrib.c::find_first_attr().
-        - Implemented loading of attribute list and complete runlist for $MFT.
-          This means we now cope with $MFT being spread across several mft
-          records.
-        - Adapt to 2.5.2-pre9 and the changed create_empty_buffers() syntax.
-        - Adapt major/minor/kdev_t/[bk]devname stuff to new 2.5.x kernels.
-        - Make ntfs_volume be allocated via kmalloc() instead of using a slab
-          cache. There are too little ntfs_volume structures at any one time
-          to justify a private slab cache.
-        - Fix bogus kmap() use in async io completion. Now use kmap_atomic().
-          Use KM_BIO_IRQ on advice from IRC/kernel...
-        - Use ntfs_map_page() in map_mft_record() and create ->readpage method
-          for reading $MFT (ntfs_mft_readpage). In the process create dedicated
-          address space operations (ntfs_mft_aops) for $MFT inode mapping. Also
-          removed the now superfluous exports from the kernel core patch.
-        - Fix a bug where kfree() was used instead of ntfs_free().
-        - Change map_mft_record() to take ntfs_inode as argument instead of
-          vfs inode. Dito for unmap_mft_record(). Adapt all callers.
-        - Add pointer to ntfs_volume to ntfs_inode.
-        - Add mft record number and sequence number to ntfs_inode. Stop using
-          i_ino and i_generation for in-driver purposes.
-        - Implement attrib.c::merge_run_lists(). (Richard Russon)
-        - Remove use of proper inodes by extent inodes. Move i_ino and
-          i_generation to ntfs_inode to do this. Apply simplifications that
-          result and remove iget_no_wait(), etc.
-        - Pass ntfs_inode everywhere in the driver (used to be struct inode).
-        - Add reference counting in ntfs_inode for the ntfs inode itself and
-          for the mapped mft record.
-        - Extend mft record mapping so we can (un)map extent mft records (new
-          functions (un)map_extent_mft_record), and so mappings are reference
-          counted and don't have to happen twice if already mapped - just ref
-          count increases.
-        - Add -o iocharset as alias to -o nls for backwards compatibility.
-        - The latest core patch is now tiny. In fact just a single additional
-          export is necessary over the base kernel.
-
-tng-0.0.3 - Cleanups, enhancements, bug fixes.
-
-        - Work on attrib.c::decompress_mapping_pairs() to detect base extents
-          and setup the runlist appropriately using knowledge provided by the
-          sizes in the base attribute record.
-        - Balance the get_/put_attr_search_ctx() calls so we don't leak memory
-          any more.
-        - Introduce ntfs_malloc_nofs() and ntfs_free() to allocate/free a single
-          page or use vmalloc depending on the amount of memory requested.
-        - Cleanup error output. The __FUNCTION__ "(): " is now added
-          automatically. Introduced a new header file debug.h to support this
-          and also moved ntfs_debug() function into it.
-        - Make reading of compressed files more intelligent and especially get
-          rid of the vmalloc_nofs() from readpage(). This now uses per CPU
-          buffers (allocated at first mount with cluster size <= 4kiB and
-          deallocated on last umount with cluster size <= 4kiB), and
-          asynchronous io for the compressed data using a list of buffer heads.
-          Er, we use synchronous io as async io only works on whole pages
-          covered by buffers and not on individual buffer heads...
-        - Bug fix for reading compressed files with sparse compression blocks.
-
-tng-0.0.2 - Now handles larger/fragmented/compressed volumes/files/dirs.
-
-        - Fixed handling of directories when cluster size exceeds index block
-          size.
-        - Hide DOS only name space directory entries from readdir() but allow
-          them in lookup(). This should fix the problem that Linux doesn't
-          support directory hard links, while still allowing access to entries
-          via their short file name. This also has the benefit of mimicking
-          what Windows users are used to, so it is the ideal solution.
-        - Implemented sync_page everywhere so no more hangs in D state when
-          waiting for a page.
-        - Stop using bforget() in favour of brelse().
-        - Stop locking buffers unnecessarily.
-        - Implemented compressed files (inode->mapping contains uncompressed
-          data, raw compressed data is currently bread() into a vmalloc()ed
-          memory buffer).
-        - Enable compressed directories. (Their index root is marked compressed
-          to indicate that new files in that directory should be created
-          compressed.)
-        - Use vsnprintf rather than vsprintf in the ntfs_error and ntfs_warning
-          functions. (Thanks to Will Dyson for pointing this out.)
-        - Moved the ntfs_inode and ntfs_volume (the former ntfs_inode_info and
-          ntfs_sb_info) out of the common inode and super_block structures and
-          started using the generic_ip and generic_sbp pointers instead. This
-          makes ntfs entirely private with respect to the kernel tree.
-        - Detect compiler version and abort with error message if gcc less than
-          2.96 is used.
-        - Fix bug in name comparison function in unistr.c.
-        - Implement attribute lists part 1, the infrastructure: search contexts
-          and operations, find_external_attr(), lookup_attr()) and make the
-          code use the infrastructure.
-        - Fix stupid buffer overflow bug that became apparent on larger run
-          list containing attributes.
-        - Fix bugs in readdir() that became apparent on larger directories.
-
-        The driver is now really useful and survives the test
-                find . -type f -exec md5sum "{}" \;
-        without any error messages on a over 1GiB sized partition with >16k
-        files on it, including compressed files and directories and many files
-        and directories with attribute lists.
-
-tng-0.0.1 - The first useful version.
-
-        - Added ntfs_lookup().
-        - Added default upcase generation and handling.
-        - Added compile options to be shown on module init.
-        - Many bug fixes that were "hidden" before.
-        - Update to latest kernel.
-        - Added ntfs_readdir().
-        - Added file operations for mmap(), read(), open() and llseek(). We just
-          use the generic ones. The whole point of going through implementing
-          readpage() methods and where possible get_block() call backs is that
-          this allows us to make use of the generic high level methods provided
-          by the kernel.
-
-        The driver is now actually useful! Yey. (-: It undoubtedly has got bugs
-        though and it doesn't implement accesssing compressed files yet. Also,
-        accessing files with attribute list attributes is not implemented yet
-        either. But for small or simple filesystems it should work and allow
-        you to list directories, use stat on directory entries and the file
-        system, open, read, mmap and llseek around in files. A big mile stone
-        has been reached!
-
-tng-0.0.0 - Initial version tag.
-
-        Initial driver implementation. The driver can mount and umount simple
-        NTFS filesystems (i.e. ones without attribute lists in the system
-        files). If the mount fails there might be problems in the error handling
-        code paths, so be warned. Otherwise it seems to be loading the system
-        files nicely and the mft record read mapping/unmapping seems to be
-        working nicely, too. Proof of inode metadata in the page cache and non-
-        resident file unnamed stream data in the page cache concepts is thus
-        complete.
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index cfce53cb65d7..c3c2c7ac9020 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -23,6 +23,7 @@
 
 #include <linux/errno.h>
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/swap.h>
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index 50d3b0c258e3..f5094ee224c1 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -22,6 +22,7 @@
 
 #include <linux/buffer_head.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/writeback.h>
 
diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index 08f7530e9341..6551c7cbad92 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -25,6 +25,7 @@
 #include <linux/buffer_head.h>
 #include <linux/blkdev.h>
 #include <linux/vmalloc.h>
+#include <linux/slab.h>
 
 #include "attrib.h"
 #include "inode.h"
diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
index 5a9e34475e37..fe44d3feee4a 100644
--- a/fs/ntfs/dir.c
+++ b/fs/ntfs/dir.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/buffer_head.h>
+#include <linux/slab.h>
 
 #include "dir.h"
 #include "aops.h"
@@ -1545,7 +1546,7 @@ static int ntfs_dir_fsync(struct file *filp, struct dentry *dentry,
                 write_inode_now(bmp_vi, !datasync);
                 iput(bmp_vi);
         }
-        ret = ntfs_write_inode(vi, 1);
+        ret = __ntfs_write_inode(vi, 1);
         write_inode_now(vi, !datasync);
         err = sync_blockdev(vi->i_sb->s_bdev);
         if (unlikely(err && !ret))
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index 43179ddd336f..8804f093ba75 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -20,6 +20,7 @@
  */
 
 #include <linux/buffer_head.h>
+#include <linux/gfp.h>
 #include <linux/pagemap.h>
 #include <linux/pagevec.h>
 #include <linux/sched.h>
@@ -2182,7 +2183,7 @@ static int ntfs_file_fsync(struct file *filp, struct dentry *dentry,
         ntfs_debug("Entering for inode 0x%lx.", vi->i_ino);
         BUG_ON(S_ISDIR(vi->i_mode));
         if (!datasync || !NInoNonResident(NTFS_I(vi)))
-                ret = ntfs_write_inode(vi, 1);
+                ret = __ntfs_write_inode(vi, 1);
         write_inode_now(vi, !datasync);
         /*
          * NOTE: If we were to use mapping->private_list (see ext2 and
diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c
index 2194eff49743..096c135691ae 100644
--- a/fs/ntfs/index.c
+++ b/fs/ntfs/index.c
@@ -19,6 +19,8 @@
  * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#include <linux/slab.h>
+
 #include "aops.h"
 #include "collate.h"
 #include "debug.h"
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index dc2505abb6d7..4b57fb1eac2a 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -2957,7 +2957,7 @@ out:
  *
  * Return 0 on success and -errno on error.
  */
-int ntfs_write_inode(struct inode *vi, int sync)
+int __ntfs_write_inode(struct inode *vi, int sync)
 {
         sle64 nt;
         ntfs_inode *ni = NTFS_I(vi);
diff --git a/fs/ntfs/inode.h b/fs/ntfs/inode.h
index 117eaf8032a3..9a113544605d 100644
--- a/fs/ntfs/inode.h
+++ b/fs/ntfs/inode.h
@@ -307,12 +307,12 @@ extern void ntfs_truncate_vfs(struct inode *vi);
 
 extern int ntfs_setattr(struct dentry *dentry, struct iattr *attr);
 
-extern int ntfs_write_inode(struct inode *vi, int sync);
+extern int __ntfs_write_inode(struct inode *vi, int sync);
 
 static inline void ntfs_commit_inode(struct inode *vi)
 {
         if (!is_bad_inode(vi))
-                ntfs_write_inode(vi, 1);
+                __ntfs_write_inode(vi, 1);
         return;
 }
 
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 1caa0ef0b2bb..b572b6727181 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/buffer_head.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 
 #include "attrib.h"
diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index 2ca00153b6ec..358273e59ade 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -23,6 +23,7 @@
 #include <linux/dcache.h>
 #include <linux/exportfs.h>
 #include <linux/security.h>
+#include <linux/slab.h>
 
 #include "attrib.h"
 #include "debug.h"
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 80b04770e8e9..0de1db6cddbf 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -31,6 +31,7 @@
 #include <linux/vfs.h>
 #include <linux/moduleparam.h>
 #include <linux/smp_lock.h>
+#include <linux/bitmap.h>
 
 #include "sysctl.h"
 #include "logfile.h"
@@ -39,6 +40,7 @@
 #include "dir.h"
 #include "debug.h"
 #include "index.h"
+#include "inode.h"
 #include "aops.h"
 #include "layout.h"
 #include "malloc.h"
@@ -2457,7 +2459,6 @@ static void ntfs_put_super(struct super_block *sb)
 static s64 get_nr_free_clusters(ntfs_volume *vol)
 {
         s64 nr_free = vol->nr_clusters;
-        u32 *kaddr;
         struct address_space *mapping = vol->lcnbmp_ino->i_mapping;
         struct page *page;
         pgoff_t index, max_index;
@@ -2476,7 +2477,8 @@ static s64 get_nr_free_clusters(ntfs_volume *vol)
         ntfs_debug("Reading $Bitmap, max_index = 0x%lx, max_size = 0x%lx.",
                         max_index, PAGE_CACHE_SIZE / 4);
         for (index = 0; index < max_index; index++) {
-                unsigned int i;
+                unsigned long *kaddr;
+
                 /*
                  * Read the page from page cache, getting it from backing store
                  * if necessary, and increment the use count.
@@ -2489,16 +2491,16 @@ static s64 get_nr_free_clusters(ntfs_volume *vol)
                         nr_free -= PAGE_CACHE_SIZE * 8;
                         continue;
                 }
-                kaddr = (u32*)kmap_atomic(page, KM_USER0);
+                kaddr = kmap_atomic(page, KM_USER0);
                 /*
-                 * For each 4 bytes, subtract the number of set bits. If this
+                 * Subtract the number of set bits. If this
                  * is the last page and it is partial we don't really care as
                  * it just means we do a little extra work but it won't affect
                  * the result as all out of range bytes are set to zero by
                  * ntfs_readpage().
                  */
-                for (i = 0; i < PAGE_CACHE_SIZE / 4; i++)
-                        nr_free -= (s64)hweight32(kaddr[i]);
+                nr_free -= bitmap_weight(kaddr,
+                                        PAGE_CACHE_SIZE * BITS_PER_BYTE);
                 kunmap_atomic(kaddr, KM_USER0);
                 page_cache_release(page);
         }
@@ -2537,7 +2539,6 @@ static s64 get_nr_free_clusters(ntfs_volume *vol)
 static unsigned long __get_nr_free_mft_records(ntfs_volume *vol,
                 s64 nr_free, const pgoff_t max_index)
 {
-        u32 *kaddr;
         struct address_space *mapping = vol->mftbmp_ino->i_mapping;
         struct page *page;
         pgoff_t index;
@@ -2547,7 +2548,8 @@ static unsigned long __get_nr_free_mft_records(ntfs_volume *vol,
         ntfs_debug("Reading $MFT/$BITMAP, max_index = 0x%lx, max_size = "
                         "0x%lx.", max_index, PAGE_CACHE_SIZE / 4);
         for (index = 0; index < max_index; index++) {
-                unsigned int i;
+                unsigned long *kaddr;
+
                 /*
                  * Read the page from page cache, getting it from backing store
                  * if necessary, and increment the use count.
@@ -2560,16 +2562,16 @@ static unsigned long __get_nr_free_mft_records(ntfs_volume *vol,
                         nr_free -= PAGE_CACHE_SIZE * 8;
                         continue;
                 }
-                kaddr = (u32*)kmap_atomic(page, KM_USER0);
+                kaddr = kmap_atomic(page, KM_USER0);
                 /*
-                 * For each 4 bytes, subtract the number of set bits. If this
+                 * Subtract the number of set bits. If this
                  * is the last page and it is partial we don't really care as
                  * it just means we do a little extra work but it won't affect
                  * the result as all out of range bytes are set to zero by
                  * ntfs_readpage().
                  */
-                for (i = 0; i < PAGE_CACHE_SIZE / 4; i++)
-                        nr_free -= (s64)hweight32(kaddr[i]);
+                nr_free -= bitmap_weight(kaddr,
+                                        PAGE_CACHE_SIZE * BITS_PER_BYTE);
                 kunmap_atomic(kaddr, KM_USER0);
                 page_cache_release(page);
         }
@@ -2662,6 +2664,13 @@ static int ntfs_statfs(struct dentry *dentry, struct kstatfs *sfs)
         return 0;
 }
 
+#ifdef NTFS_RW
+static int ntfs_write_inode(struct inode *vi, struct writeback_control *wbc)
+{
+        return __ntfs_write_inode(vi, wbc->sync_mode == WB_SYNC_ALL);
+}
+#endif
+
 /**
  * The complete super operations.
  */
diff --git a/fs/ocfs2/Makefile b/fs/ocfs2/Makefile
index 600d2d2ade11..791c0886c060 100644
--- a/fs/ocfs2/Makefile
+++ b/fs/ocfs2/Makefile
@@ -46,6 +46,7 @@ ocfs2_stackglue-objs := stackglue.o
 ocfs2_stack_o2cb-objs := stack_o2cb.o
 ocfs2_stack_user-objs := stack_user.o
 
+obj-$(CONFIG_OCFS2_FS) += dlmfs/
 # cluster/ is always needed when OCFS2_FS for masklog support
 obj-$(CONFIG_OCFS2_FS) += cluster/
 obj-$(CONFIG_OCFS2_FS_O2CB) += dlm/
diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
index 0501974bedd0..e13fc9e8fcdc 100644
--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -21,6 +21,7 @@
 
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 
 #define MLOG_MASK_PREFIX ML_INODE
@@ -30,6 +31,8 @@
 #include "alloc.h"
 #include "dlmglue.h"
 #include "file.h"
+#include "inode.h"
+#include "journal.h"
 #include "ocfs2_fs.h"
 
 #include "xattr.h"
@@ -166,6 +169,60 @@ static struct posix_acl *ocfs2_get_acl(struct inode *inode, int type)
 }
 
 /*
+ * Helper function to set i_mode in memory and disk. Some call paths
+ * will not have di_bh or a journal handle to pass, in which case it
+ * will create it's own.
+ */
+static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh,
+                              handle_t *handle, umode_t new_mode)
+{
+        int ret, commit_handle = 0;
+        struct ocfs2_dinode *di;
+
+        if (di_bh == NULL) {
+                ret = ocfs2_read_inode_block(inode, &di_bh);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
+        } else
+                get_bh(di_bh);
+
+        if (handle == NULL) {
+                handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb),
+                                           OCFS2_INODE_UPDATE_CREDITS);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        mlog_errno(ret);
+                        goto out_brelse;
+                }
+
+                commit_handle = 1;
+        }
+
+        di = (struct ocfs2_dinode *)di_bh->b_data;
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        inode->i_mode = new_mode;
+        di->i_mode = cpu_to_le16(inode->i_mode);
+
+        ocfs2_journal_dirty(handle, di_bh);
+
+out_commit:
+        if (commit_handle)
+                ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
+out_brelse:
+        brelse(di_bh);
+out:
+        return ret;
+}
+
+/*
  * Set the access or default ACL of an inode.
  */
 static int ocfs2_set_acl(handle_t *handle,
@@ -193,9 +250,14 @@ static int ocfs2_set_acl(handle_t *handle,
                         if (ret < 0)
                                 return ret;
                         else {
-                                inode->i_mode = mode;
                                 if (ret == 0)
                                         acl = NULL;
+
+                                ret = ocfs2_acl_set_mode(inode, di_bh,
+                                                         handle, mode);
+                                if (ret)
+                                        return ret;
+
                         }
                 }
                 break;
@@ -283,6 +345,7 @@ int ocfs2_init_acl(handle_t *handle,
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct posix_acl *acl = NULL;
         int ret = 0;
+        mode_t mode;
 
         if (!S_ISLNK(inode->i_mode)) {
                 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
@@ -291,12 +354,17 @@ int ocfs2_init_acl(handle_t *handle,
                         if (IS_ERR(acl))
                                 return PTR_ERR(acl);
                 }
-                if (!acl)
-                        inode->i_mode &= ~current_umask();
+                if (!acl) {
+                        mode = inode->i_mode & ~current_umask();
+                        ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
+                        if (ret) {
+                                mlog_errno(ret);
+                                goto cleanup;
+                        }
+                }
         }
         if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) {
                 struct posix_acl *clone;
-                mode_t mode;
 
                 if (S_ISDIR(inode->i_mode)) {
                         ret = ocfs2_set_acl(handle, inode, di_bh,
@@ -313,7 +381,7 @@ int ocfs2_init_acl(handle_t *handle,
                 mode = inode->i_mode;
                 ret = posix_acl_create_masq(clone, &mode);
                 if (ret >= 0) {
-                        inode->i_mode = mode;
+                        ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
                         if (ret > 0) {
                                 ret = ocfs2_set_acl(handle, inode,
                                                     di_bh, ACL_TYPE_ACCESS,
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index d17bdc718f74..9f8bd913c51e 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1050,7 +1050,8 @@ static int ocfs2_create_new_meta_bhs(handle_t *handle,
                         strcpy(eb->h_signature, OCFS2_EXTENT_BLOCK_SIGNATURE);
                         eb->h_blkno = cpu_to_le64(first_blkno);
                         eb->h_fs_generation = cpu_to_le32(osb->fs_generation);
-                        eb->h_suballoc_slot = cpu_to_le16(osb->slot_num);
+                        eb->h_suballoc_slot =
+                                cpu_to_le16(meta_ac->ac_alloc_slot);
                         eb->h_suballoc_bit = cpu_to_le16(suballoc_bit_start);
                         eb->h_list.l_count =
                                 cpu_to_le16(ocfs2_extent_recs_per_eb(osb->sb));
@@ -5712,7 +5713,7 @@ int ocfs2_remove_btree_range(struct inode *inode,
                 goto out;
         }
 
-        vfs_dq_free_space_nodirty(inode,
+        dquot_free_space_nodirty(inode,
                                   ocfs2_clusters_to_bytes(inode->i_sb, len));
 
         ret = ocfs2_remove_extent(handle, et, cpos, len, meta_ac, dealloc);
@@ -6037,7 +6038,7 @@ static void ocfs2_truncate_log_worker(struct work_struct *work)
         if (status < 0)
                 mlog_errno(status);
         else
-                ocfs2_init_inode_steal_slot(osb);
+                ocfs2_init_steal_slots(osb);
 
         mlog_exit(status);
 }
@@ -6935,7 +6936,7 @@ static int ocfs2_do_truncate(struct ocfs2_super *osb,
                 goto bail;
         }
 
-        vfs_dq_free_space_nodirty(inode,
+        dquot_free_space_nodirty(inode,
                         ocfs2_clusters_to_bytes(osb->sb, clusters_to_del));
         spin_lock(&OCFS2_I(inode)->ip_lock);
         OCFS2_I(inode)->ip_clusters = le32_to_cpu(fe->i_clusters) -
@@ -7300,11 +7301,10 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
                 unsigned int page_end;
                 u64 phys;
 
-                if (vfs_dq_alloc_space_nodirty(inode,
-                                       ocfs2_clusters_to_bytes(osb->sb, 1))) {
-                        ret = -EDQUOT;
+                ret = dquot_alloc_space_nodirty(inode,
+                                       ocfs2_clusters_to_bytes(osb->sb, 1));
+                if (ret)
                         goto out_commit;
-                }
                 did_quota = 1;
 
                 ret = ocfs2_claim_clusters(osb, handle, data_ac, 1, &bit_off,
@@ -7380,7 +7380,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 
 out_commit:
         if (ret < 0 && did_quota)
-                vfs_dq_free_space_nodirty(inode,
+                dquot_free_space_nodirty(inode,
                                           ocfs2_clusters_to_bytes(osb->sb, 1));
 
         ocfs2_commit_trans(osb, handle);
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 3dae4a13f6e4..21441ddb5506 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -577,8 +577,9 @@ static int ocfs2_direct_IO_get_blocks(struct inode *inode, sector_t iblock,
                 goto bail;
         }
 
-        /* We should already CoW the refcounted extent. */
-        BUG_ON(ext_flags & OCFS2_EXT_REFCOUNTED);
+        /* We should already CoW the refcounted extent in case of create. */
+        BUG_ON(create && (ext_flags & OCFS2_EXT_REFCOUNTED));
+
         /*
          * get_more_blocks() expects us to describe a hole by clearing
          * the mapped bit on bh_result().
@@ -599,7 +600,7 @@ bail:
         return ret;
 }
 
-/* 
+/*
  * ocfs2_dio_end_io is called by the dio core when a dio is finished.  We're
  * particularly interested in the aio/dio case.  Like the core uses
  * i_alloc_sem, we use the rw_lock DLM lock to protect io on one node from
@@ -670,7 +671,7 @@ static ssize_t ocfs2_direct_IO(int rw,
 
         ret = blockdev_direct_IO_no_locking(rw, iocb, inode,
                                             inode->i_sb->s_bdev, iov, offset,
-                                            nr_segs, 
+                                            nr_segs,
                                             ocfs2_direct_IO_get_blocks,
                                             ocfs2_dio_end_io);
 
@@ -1763,10 +1764,11 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
 
         wc->w_handle = handle;
 
-        if (clusters_to_alloc && vfs_dq_alloc_space_nodirty(inode,
-                        ocfs2_clusters_to_bytes(osb->sb, clusters_to_alloc))) {
-                ret = -EDQUOT;
-                goto out_commit;
+        if (clusters_to_alloc) {
+                ret = dquot_alloc_space_nodirty(inode,
+                        ocfs2_clusters_to_bytes(osb->sb, clusters_to_alloc));
+                if (ret)
+                        goto out_commit;
         }
         /*
          * We don't want this to fail in ocfs2_write_end(), so do it
@@ -1809,7 +1811,7 @@ success:
         return 0;
 out_quota:
         if (clusters_to_alloc)
-                vfs_dq_free_space(inode,
+                dquot_free_space(inode,
                           ocfs2_clusters_to_bytes(osb->sb, clusters_to_alloc));
 out_commit:
         ocfs2_commit_trans(osb, handle);
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index d43d34a1dd31..ecebb2276790 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -25,7 +25,6 @@
 
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 
 #include <cluster/masklog.h>
@@ -368,7 +367,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
         }
         ocfs2_metadata_cache_io_unlock(ci);
 
-        mlog(ML_BH_IO, "block=(%llu), nr=(%d), cached=%s, flags=0x%x\n", 
+        mlog(ML_BH_IO, "block=(%llu), nr=(%d), cached=%s, flags=0x%x\n",
              (unsigned long long)block, nr,
              ((flags & OCFS2_BH_IGNORE_CACHE) || ignore_cache) ? "no" : "yes",
              flags);
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index eda5b8bcddd5..41d5f1f92d56 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -34,6 +34,7 @@
 #include <linux/crc32.h>
 #include <linux/time.h>
 #include <linux/debugfs.h>
+#include <linux/slab.h>
 
 #include "heartbeat.h"
 #include "tcp.h"
@@ -78,7 +79,7 @@ static struct o2hb_callback *hbcall_from_type(enum o2hb_callback_type type);
 
 unsigned int o2hb_dead_threshold = O2HB_DEFAULT_DEAD_THRESHOLD;
 
-/* Only sets a new threshold if there are no active regions. 
+/* Only sets a new threshold if there are no active regions.
  *
  * No locking or otherwise interesting code is required for reading
  * o2hb_dead_threshold as it can't change once regions are active and
@@ -170,7 +171,7 @@ static void o2hb_write_timeout(struct work_struct *work)
 
         mlog(ML_ERROR, "Heartbeat write timeout to device %s after %u "
              "milliseconds\n", reg->hr_dev_name,
-             jiffies_to_msecs(jiffies - reg->hr_last_timeout_start)); 
+             jiffies_to_msecs(jiffies - reg->hr_last_timeout_start));
         o2quo_disk_timeout();
 }
 
@@ -624,7 +625,7 @@ static int o2hb_check_slot(struct o2hb_region *reg,
              "seq %llu last %llu changed %u equal %u\n",
              slot->ds_node_num, (long long)slot->ds_last_generation,
              le32_to_cpu(hb_block->hb_cksum),
-             (unsigned long long)le64_to_cpu(hb_block->hb_seq), 
+             (unsigned long long)le64_to_cpu(hb_block->hb_seq),
              (unsigned long long)slot->ds_last_time, slot->ds_changed_samples,
              slot->ds_equal_samples);
 
diff --git a/fs/ocfs2/cluster/masklog.c b/fs/ocfs2/cluster/masklog.c
index 1cd2934de615..3bb928a2bf7d 100644
--- a/fs/ocfs2/cluster/masklog.c
+++ b/fs/ocfs2/cluster/masklog.c
@@ -112,6 +112,7 @@ static struct mlog_attribute mlog_attrs[MLOG_MAX_BITS] = {
         define_mask(XATTR),
         define_mask(QUOTA),
         define_mask(REFCOUNT),
+        define_mask(BASTS),
         define_mask(ERROR),
         define_mask(NOTICE),
         define_mask(KTHREAD),
@@ -135,7 +136,7 @@ static ssize_t mlog_store(struct kobject *obj, struct attribute *attr,
         return mlog_mask_store(mlog_attr->mask, buf, count);
 }
 
-static struct sysfs_ops mlog_attr_ops = {
+static const struct sysfs_ops mlog_attr_ops = {
         .show  = mlog_show,
         .store = mlog_store,
 };
diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
index 9b4d11726cf2..3dfddbec32f2 100644
--- a/fs/ocfs2/cluster/masklog.h
+++ b/fs/ocfs2/cluster/masklog.h
@@ -114,6 +114,7 @@
 #define ML_XATTR        0x0000000020000000ULL /* ocfs2 extended attributes */
 #define ML_QUOTA        0x0000000040000000ULL /* ocfs2 quota operations */
 #define ML_REFCOUNT     0x0000000080000000ULL /* refcount tree operations */
+#define ML_BASTS        0x0000001000000000ULL /* dlmglue asts and basts */
 /* bits that are infrequently given and frequently matched in the high word */
 #define ML_ERROR        0x0000000100000000ULL /* sent to KERN_ERR */
 #define ML_NOTICE       0x0000000200000000ULL /* setn to KERN_NOTICE */
@@ -194,9 +195,9 @@ extern struct mlog_bits mlog_and_bits, mlog_not_bits;
  * previous token if args expands to nothing.
  */
 #define __mlog_printk(level, fmt, args...)                              \
-        printk(level "(%u,%lu):%s:%d " fmt, task_pid_nr(current),       \
-               __mlog_cpu_guess, __PRETTY_FUNCTION__, __LINE__ ,        \
-               ##args)
+        printk(level "(%s,%u,%lu):%s:%d " fmt, current->comm,           \
+               task_pid_nr(current), __mlog_cpu_guess,                  \
+               __PRETTY_FUNCTION__, __LINE__ , ##args)
 
 #define mlog(mask, fmt, args...) do {                                   \
         u64 __m = MLOG_MASK_PREFIX | (mask);                            \
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index c81142e3ef84..ed0c9f367fed 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -19,6 +19,7 @@
  * Boston, MA 021110-1307, USA.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/configfs.h>
diff --git a/fs/ocfs2/cluster/quorum.c b/fs/ocfs2/cluster/quorum.c
index 639024033fce..cf3e16696216 100644
--- a/fs/ocfs2/cluster/quorum.c
+++ b/fs/ocfs2/cluster/quorum.c
@@ -44,7 +44,6 @@
  * and if they're the last, they fire off the decision.
  */
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/reboot.h>
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 334f231a422c..73e743eea2c8 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -72,9 +72,9 @@
 
 #include "tcp_internal.h"
 
-#define SC_NODEF_FMT "node %s (num %u) at %u.%u.%u.%u:%u"
+#define SC_NODEF_FMT "node %s (num %u) at %pI4:%u"
 #define SC_NODEF_ARGS(sc) sc->sc_node->nd_name, sc->sc_node->nd_num,    \
-                          NIPQUAD(sc->sc_node->nd_ipv4_address),        \
+                          &sc->sc_node->nd_ipv4_address,                \
                           ntohs(sc->sc_node->nd_ipv4_port)
 
 /*
@@ -485,7 +485,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
         }
 
         if (was_valid && !valid) {
-                printk(KERN_INFO "o2net: no longer connected to "
+                printk(KERN_NOTICE "o2net: no longer connected to "
                        SC_NODEF_FMT "\n", SC_NODEF_ARGS(old_sc));
                 o2net_complete_nodes_nsw(nn);
         }
@@ -493,7 +493,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
         if (!was_valid && valid) {
                 o2quo_conn_up(o2net_num_from_nn(nn));
                 cancel_delayed_work(&nn->nn_connect_expired);
-                printk(KERN_INFO "o2net: %s " SC_NODEF_FMT "\n",
+                printk(KERN_NOTICE "o2net: %s " SC_NODEF_FMT "\n",
                        o2nm_this_node() > sc->sc_node->nd_num ?
                                 "connected to" : "accepted connection from",
                        SC_NODEF_ARGS(sc));
@@ -930,7 +930,7 @@ static void o2net_sendpage(struct o2net_sock_container *sc,
                         cond_resched();
                         continue;
                 }
-                mlog(ML_ERROR, "sendpage of size %zu to " SC_NODEF_FMT 
+                mlog(ML_ERROR, "sendpage of size %zu to " SC_NODEF_FMT
                      " failed with %zd\n", size, SC_NODEF_ARGS(sc), ret);
                 o2net_ensure_shutdown(nn, sc, 0);
                 break;
@@ -1476,14 +1476,14 @@ static void o2net_idle_timer(unsigned long data)
 
         do_gettimeofday(&now);
 
-        printk(KERN_INFO "o2net: connection to " SC_NODEF_FMT " has been idle for %u.%u "
+        printk(KERN_NOTICE "o2net: connection to " SC_NODEF_FMT " has been idle for %u.%u "
              "seconds, shutting it down.\n", SC_NODEF_ARGS(sc),
                      o2net_idle_timeout() / 1000,
                      o2net_idle_timeout() % 1000);
         mlog(ML_NOTICE, "here are some times that might help debug the "
              "situation: (tmr %ld.%ld now %ld.%ld dr %ld.%ld adv "
              "%ld.%ld:%ld.%ld func (%08x:%u) %ld.%ld:%ld.%ld)\n",
-             sc->sc_tv_timer.tv_sec, (long) sc->sc_tv_timer.tv_usec, 
+             sc->sc_tv_timer.tv_sec, (long) sc->sc_tv_timer.tv_usec,
              now.tv_sec, (long) now.tv_usec,
              sc->sc_tv_data_ready.tv_sec, (long) sc->sc_tv_data_ready.tv_usec,
              sc->sc_tv_advance_start.tv_sec,
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 8d58cfe410b1..96fa7ebc530c 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -32,10 +32,10 @@
  * on their number */
 #define O2NET_QUORUM_DELAY_MS   ((o2hb_dead_threshold + 2) * O2HB_REGION_TIMEOUT_MS)
 
-/* 
+/*
  * This version number represents quite a lot, unfortunately.  It not
  * only represents the raw network message protocol on the wire but also
- * locking semantics of the file system using the protocol.  It should 
+ * locking semantics of the file system using the protocol.  It should
  * be somewhere else, I'm sure, but right now it isn't.
  *
  * With version 11, we separate out the filesystem locking portion.  The
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 28c3ec238796..efd77d071c80 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -2439,7 +2439,7 @@ static int ocfs2_dx_dir_attach_index(struct ocfs2_super *osb,
         dx_root = (struct ocfs2_dx_root_block *)dx_root_bh->b_data;
         memset(dx_root, 0, osb->sb->s_blocksize);
         strcpy(dx_root->dr_signature, OCFS2_DX_ROOT_SIGNATURE);
-        dx_root->dr_suballoc_slot = cpu_to_le16(osb->slot_num);
+        dx_root->dr_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         dx_root->dr_suballoc_bit = cpu_to_le16(dr_suballoc_bit);
         dx_root->dr_fs_generation = cpu_to_le32(osb->fs_generation);
         dx_root->dr_blkno = cpu_to_le64(dr_blkno);
@@ -2964,12 +2964,10 @@ static int ocfs2_expand_inline_dir(struct inode *dir, struct buffer_head *di_bh,
                 goto out;
         }
 
-        if (vfs_dq_alloc_space_nodirty(dir,
-                                ocfs2_clusters_to_bytes(osb->sb,
-                                                        alloc + dx_alloc))) {
-                ret = -EDQUOT;
+        ret = dquot_alloc_space_nodirty(dir,
+                ocfs2_clusters_to_bytes(osb->sb, alloc + dx_alloc));
+        if (ret)
                 goto out_commit;
-        }
         did_quota = 1;
 
         if (ocfs2_supports_indexed_dirs(osb) && !dx_inline) {
@@ -3178,7 +3176,7 @@ static int ocfs2_expand_inline_dir(struct inode *dir, struct buffer_head *di_bh,
 
 out_commit:
         if (ret < 0 && did_quota)
-                vfs_dq_free_space_nodirty(dir, bytes_allocated);
+                dquot_free_space_nodirty(dir, bytes_allocated);
 
         ocfs2_commit_trans(osb, handle);
 
@@ -3221,11 +3219,10 @@ static int ocfs2_do_extend_dir(struct super_block *sb,
         if (extend) {
                 u32 offset = OCFS2_I(dir)->ip_clusters;
 
-                if (vfs_dq_alloc_space_nodirty(dir,
-                                        ocfs2_clusters_to_bytes(sb, 1))) {
-                        status = -EDQUOT;
+                status = dquot_alloc_space_nodirty(dir,
+                                        ocfs2_clusters_to_bytes(sb, 1));
+                if (status)
                         goto bail;
-                }
                 did_quota = 1;
 
                 status = ocfs2_add_inode_data(OCFS2_SB(sb), dir, &offset,
@@ -3254,7 +3251,7 @@ static int ocfs2_do_extend_dir(struct super_block *sb,
         status = 0;
 bail:
         if (did_quota && status < 0)
-                vfs_dq_free_space_nodirty(dir, ocfs2_clusters_to_bytes(sb, 1));
+                dquot_free_space_nodirty(dir, ocfs2_clusters_to_bytes(sb, 1));
         mlog_exit(status);
         return status;
 }
@@ -3889,11 +3886,10 @@ static int ocfs2_dx_dir_rebalance(struct ocfs2_super *osb, struct inode *dir,
                 goto out;
         }
 
-        if (vfs_dq_alloc_space_nodirty(dir,
-                                       ocfs2_clusters_to_bytes(dir->i_sb, 1))) {
-                ret = -EDQUOT;
+        ret = dquot_alloc_space_nodirty(dir,
+                                       ocfs2_clusters_to_bytes(dir->i_sb, 1));
+        if (ret)
                 goto out_commit;
-        }
         did_quota = 1;
 
         ret = ocfs2_journal_access_dl(handle, INODE_CACHE(dir), dx_leaf_bh,
@@ -3983,7 +3979,7 @@ static int ocfs2_dx_dir_rebalance(struct ocfs2_super *osb, struct inode *dir,
 
 out_commit:
         if (ret < 0 && did_quota)
-                vfs_dq_free_space_nodirty(dir,
+                dquot_free_space_nodirty(dir,
                                 ocfs2_clusters_to_bytes(dir->i_sb, 1));
 
         ocfs2_commit_trans(osb, handle);
@@ -4165,11 +4161,10 @@ static int ocfs2_expand_inline_dx_root(struct inode *dir,
                 goto out;
         }
 
-        if (vfs_dq_alloc_space_nodirty(dir,
-                                       ocfs2_clusters_to_bytes(osb->sb, 1))) {
-                ret = -EDQUOT;
+        ret = dquot_alloc_space_nodirty(dir,
+                                       ocfs2_clusters_to_bytes(osb->sb, 1));
+        if (ret)
                 goto out_commit;
-        }
         did_quota = 1;
 
         /*
@@ -4229,7 +4224,7 @@ static int ocfs2_expand_inline_dx_root(struct inode *dir,
 
 out_commit:
         if (ret < 0 && did_quota)
-                vfs_dq_free_space_nodirty(dir,
+                dquot_free_space_nodirty(dir,
                                           ocfs2_clusters_to_bytes(dir->i_sb, 1));
 
         ocfs2_commit_trans(osb, handle);
diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile
index 190361375700..dcebf0d920fa 100644
--- a/fs/ocfs2/dlm/Makefile
+++ b/fs/ocfs2/dlm/Makefile
@@ -1,8 +1,7 @@
 EXTRA_CFLAGS += -Ifs/ocfs2
 
-obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o ocfs2_dlmfs.o
+obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o
 
 ocfs2_dlm-objs := dlmdomain.o dlmdebug.o dlmthread.o dlmrecovery.o \
         dlmmaster.o dlmast.o dlmconvert.o dlmlock.o dlmunlock.o dlmver.o
 
-ocfs2_dlmfs-objs := userdlm.o dlmfs.o dlmfsver.o
diff --git a/fs/ocfs2/dlm/dlmapi.h b/fs/ocfs2/dlm/dlmapi.h
index b5786a787fab..3cfa114aa391 100644
--- a/fs/ocfs2/dlm/dlmapi.h
+++ b/fs/ocfs2/dlm/dlmapi.h
@@ -95,7 +95,7 @@ const char *dlm_errname(enum dlm_status err);
                 mlog(ML_ERROR, "dlm status = %s\n", dlm_errname((st))); \
 } while (0)
 
-#define DLM_LKSB_UNUSED1           0x01  
+#define DLM_LKSB_UNUSED1           0x01
 #define DLM_LKSB_PUT_LVB           0x02
 #define DLM_LKSB_GET_LVB           0x04
 #define DLM_LKSB_UNUSED2           0x08
diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
index 01cf8cc3d286..a795eb91f4ea 100644
--- a/fs/ocfs2/dlm/dlmast.c
+++ b/fs/ocfs2/dlm/dlmast.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
@@ -123,7 +122,7 @@ static void __dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock)
                 dlm_lock_put(lock);
                 /* free up the reserved bast that we are cancelling.
                  * guaranteed that this will not be the last reserved
-                 * ast because *both* an ast and a bast were reserved 
+                 * ast because *both* an ast and a bast were reserved
                  * to get to this point.  the res->spinlock will not be
                  * taken here */
                 dlm_lockres_release_ast(dlm, res);
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index ca96bce50e18..90803b47cd8c 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
@@ -396,7 +395,7 @@ static enum dlm_status dlm_send_remote_convert_request(struct dlm_ctxt *dlm,
                         /* instead of logging the same network error over
                          * and over, sleep here and wait for the heartbeat
                          * to notice the node is dead.  times out after 5s. */
-                        dlm_wait_for_node_death(dlm, res->owner, 
+                        dlm_wait_for_node_death(dlm, res->owner,
                                                 DLM_NODE_DEATH_WAIT_MAX);
                         ret = DLM_RECOVERING;
                         mlog(0, "node %u died so returning DLM_RECOVERING "
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index 42b0bad7a612..0cd24cf54396 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -102,7 +102,7 @@ void __dlm_print_one_lock_resource(struct dlm_lock_resource *res)
         assert_spin_locked(&res->spinlock);
 
         stringify_lockname(res->lockname.name, res->lockname.len,
-                           buf, sizeof(buf) - 1);
+                           buf, sizeof(buf));
         printk("lockres: %s, owner=%u, state=%u\n",
                buf, res->owner, res->state);
         printk("  last used: %lu, refcnt: %u, on purge list: %s\n",
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 0334000676d3..988c9055fd4e 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -816,7 +816,7 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
         }
 
         /* Once the dlm ctxt is marked as leaving then we don't want
-         * to be put in someone's domain map. 
+         * to be put in someone's domain map.
          * Also, explicitly disallow joining at certain troublesome
          * times (ie. during recovery). */
         if (dlm && dlm->dlm_state != DLM_CTXT_LEAVING) {
diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
index 437698e9465f..733337772671 100644
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -269,7 +269,7 @@ static enum dlm_status dlmlock_remote(struct dlm_ctxt *dlm,
                 }
                 dlm_revert_pending_lock(res, lock);
                 dlm_lock_put(lock);
-        } else if (dlm_is_recovery_lock(res->lockname.name, 
+        } else if (dlm_is_recovery_lock(res->lockname.name,
                                         res->lockname.len)) {
                 /* special case for the $RECOVERY lock.
                  * there will never be an AST delivered to put
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 03ccf9a7b1f4..9289b4357d27 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -366,7 +366,7 @@ void dlm_hb_event_notify_attached(struct dlm_ctxt *dlm, int idx, int node_up)
         struct dlm_master_list_entry *mle;
 
         assert_spin_locked(&dlm->spinlock);
-        
+
         list_for_each_entry(mle, &dlm->mle_hb_events, hb_events) {
                 if (node_up)
                         dlm_mle_node_up(dlm, mle, NULL, idx);
@@ -833,7 +833,7 @@ lookup:
                 __dlm_insert_mle(dlm, mle);
 
                 /* still holding the dlm spinlock, check the recovery map
-                 * to see if there are any nodes that still need to be 
+                 * to see if there are any nodes that still need to be
                  * considered.  these will not appear in the mle nodemap
                  * but they might own this lockres.  wait on them. */
                 bit = find_next_bit(dlm->recovery_map, O2NM_MAX_NODES, 0);
@@ -883,7 +883,7 @@ redo_request:
                                 msleep(500);
                         }
                         continue;
-                } 
+                }
 
                 dlm_kick_recovery_thread(dlm);
                 msleep(1000);
@@ -939,8 +939,8 @@ wait:
                      res->lockname.name, blocked);
                 if (++tries > 20) {
                         mlog(ML_ERROR, "%s:%.*s: spinning on "
-                             "dlm_wait_for_lock_mastery, blocked=%d\n", 
-                             dlm->name, res->lockname.len, 
+                             "dlm_wait_for_lock_mastery, blocked=%d\n",
+                             dlm->name, res->lockname.len,
                              res->lockname.name, blocked);
                         dlm_print_one_lock_resource(res);
                         dlm_print_one_mle(mle);
@@ -1029,7 +1029,7 @@ recheck:
                 ret = dlm_restart_lock_mastery(dlm, res, mle, *blocked);
                 b = (mle->type == DLM_MLE_BLOCK);
                 if ((*blocked && !b) || (!*blocked && b)) {
-                        mlog(0, "%s:%.*s: status change: old=%d new=%d\n", 
+                        mlog(0, "%s:%.*s: status change: old=%d new=%d\n",
                              dlm->name, res->lockname.len, res->lockname.name,
                              *blocked, b);
                         *blocked = b;
@@ -1602,7 +1602,7 @@ send_response:
                 }
                 mlog(0, "%u is the owner of %.*s, cleaning everyone else\n",
                              dlm->node_num, res->lockname.len, res->lockname.name);
-                ret = dlm_dispatch_assert_master(dlm, res, 0, request->node_idx, 
+                ret = dlm_dispatch_assert_master(dlm, res, 0, request->node_idx,
                                                  DLM_ASSERT_MASTER_MLE_CLEANUP);
                 if (ret < 0) {
                         mlog(ML_ERROR, "failed to dispatch assert master work\n");
@@ -1701,7 +1701,7 @@ again:
 
                 if (r & DLM_ASSERT_RESPONSE_REASSERT) {
                         mlog(0, "%.*s: node %u create mles on other "
-                             "nodes and requests a re-assert\n", 
+                             "nodes and requests a re-assert\n",
                              namelen, lockname, to);
                         reassert = 1;
                 }
@@ -1812,7 +1812,7 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
                                 spin_unlock(&dlm->master_lock);
                                 spin_unlock(&dlm->spinlock);
                                 goto done;
-                        }       
+                        }
                 }
         }
         spin_unlock(&dlm->master_lock);
@@ -1875,7 +1875,6 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
 ok:
                 spin_unlock(&res->spinlock);
         }
-        spin_unlock(&dlm->spinlock);
 
         // mlog(0, "woo!  got an assert_master from node %u!\n",
         //           assert->node_idx);
@@ -1883,7 +1882,7 @@ ok:
                 int extra_ref = 0;
                 int nn = -1;
                 int rr, err = 0;
-                
+
                 spin_lock(&mle->spinlock);
                 if (mle->type == DLM_MLE_BLOCK || mle->type == DLM_MLE_MIGRATION)
                         extra_ref = 1;
@@ -1891,7 +1890,7 @@ ok:
                         /* MASTER mle: if any bits set in the response map
                          * then the calling node needs to re-assert to clear
                          * up nodes that this node contacted */
-                        while ((nn = find_next_bit (mle->response_map, O2NM_MAX_NODES, 
+                        while ((nn = find_next_bit (mle->response_map, O2NM_MAX_NODES,
                                                     nn+1)) < O2NM_MAX_NODES) {
                                 if (nn != dlm->node_num && nn != assert->node_idx)
                                         master_request = 1;
@@ -1926,7 +1925,6 @@ ok:
                 /* master is known, detach if not already detached.
                  * ensures that only one assert_master call will happen
                  * on this mle. */
-                spin_lock(&dlm->spinlock);
                 spin_lock(&dlm->master_lock);
 
                 rr = atomic_read(&mle->mle_refs.refcount);
@@ -1959,7 +1957,6 @@ ok:
                         __dlm_put_mle(mle);
                 }
                 spin_unlock(&dlm->master_lock);
-                spin_unlock(&dlm->spinlock);
         } else if (res) {
                 if (res->owner != assert->node_idx) {
                         mlog(0, "assert_master from %u, but current "
@@ -1967,6 +1964,7 @@ ok:
                              res->owner, namelen, name);
                 }
         }
+        spin_unlock(&dlm->spinlock);
 
 done:
         ret = 0;
@@ -2002,7 +2000,7 @@ kill:
         __dlm_print_one_lock_resource(res);
         spin_unlock(&res->spinlock);
         spin_unlock(&dlm->spinlock);
-        *ret_data = (void *)res; 
+        *ret_data = (void *)res;
         dlm_put(dlm);
         return -EINVAL;
 }
@@ -2040,10 +2038,10 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
         item->u.am.request_from = request_from;
         item->u.am.flags = flags;
 
-        if (ignore_higher) 
-                mlog(0, "IGNORE HIGHER: %.*s\n", res->lockname.len, 
+        if (ignore_higher)
+                mlog(0, "IGNORE HIGHER: %.*s\n", res->lockname.len,
                      res->lockname.name);
-                
+
         spin_lock(&dlm->work_lock);
         list_add_tail(&item->list, &dlm->work_list);
         spin_unlock(&dlm->work_lock);
@@ -2133,7 +2131,7 @@ put:
  * think that $RECOVERY is currently mastered by a dead node.  If so,
  * we wait a short time to allow that node to get notified by its own
  * heartbeat stack, then check again.  All $RECOVERY lock resources
- * mastered by dead nodes are purged when the hearbeat callback is 
+ * mastered by dead nodes are purged when the hearbeat callback is
  * fired, so we can know for sure that it is safe to continue once
  * the node returns a live node or no node.  */
 static int dlm_pre_master_reco_lockres(struct dlm_ctxt *dlm,
@@ -2174,7 +2172,7 @@ static int dlm_pre_master_reco_lockres(struct dlm_ctxt *dlm,
                                 ret = -EAGAIN;
                         }
                         spin_unlock(&dlm->spinlock);
-                        mlog(0, "%s: reco lock master is %u\n", dlm->name, 
+                        mlog(0, "%s: reco lock master is %u\n", dlm->name,
                              master);
                         break;
                 }
@@ -2602,7 +2600,7 @@ fail:
 
                         mlog(0, "%s:%.*s: timed out during migration\n",
                              dlm->name, res->lockname.len, res->lockname.name);
-                        /* avoid hang during shutdown when migrating lockres 
+                        /* avoid hang during shutdown when migrating lockres
                          * to a node which also goes down */
                         if (dlm_is_node_dead(dlm, target)) {
                                 mlog(0, "%s:%.*s: expected migration "
@@ -2738,7 +2736,7 @@ static int dlm_migration_can_proceed(struct dlm_ctxt *dlm,
         can_proceed = !!(res->state & DLM_LOCK_RES_MIGRATING);
         spin_unlock(&res->spinlock);
 
-        /* target has died, so make the caller break out of the 
+        /* target has died, so make the caller break out of the
          * wait_event, but caller must recheck the domain_map */
         spin_lock(&dlm->spinlock);
         if (!test_bit(mig_target, dlm->domain_map))
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 2f9e4e19a4f2..b4f99de2caf3 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -310,7 +310,7 @@ static int dlm_recovery_thread(void *data)
         mlog(0, "dlm thread running for %s...\n", dlm->name);
 
         while (!kthread_should_stop()) {
-                if (dlm_joined(dlm)) {
+                if (dlm_domain_fully_joined(dlm)) {
                         status = dlm_do_recovery(dlm);
                         if (status == -EAGAIN) {
                                 /* do not sleep, recheck immediately. */
@@ -1050,7 +1050,7 @@ static void dlm_move_reco_locks_to_list(struct dlm_ctxt *dlm,
                                 if (lock->ml.node == dead_node) {
                                         mlog(0, "AHA! there was "
                                              "a $RECOVERY lock for dead "
-                                             "node %u (%s)!\n", 
+                                             "node %u (%s)!\n",
                                              dead_node, dlm->name);
                                         list_del_init(&lock->list);
                                         dlm_lock_put(lock);
@@ -1164,6 +1164,39 @@ static void dlm_init_migratable_lockres(struct dlm_migratable_lockres *mres,
         mres->master = master;
 }
 
+static void dlm_prepare_lvb_for_migration(struct dlm_lock *lock,
+                                          struct dlm_migratable_lockres *mres,
+                                          int queue)
+{
+        if (!lock->lksb)
+               return;
+
+        /* Ignore lvb in all locks in the blocked list */
+        if (queue == DLM_BLOCKED_LIST)
+                return;
+
+        /* Only consider lvbs in locks with granted EX or PR lock levels */
+        if (lock->ml.type != LKM_EXMODE && lock->ml.type != LKM_PRMODE)
+                return;
+
+        if (dlm_lvb_is_empty(mres->lvb)) {
+                memcpy(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN);
+                return;
+        }
+
+        /* Ensure the lvb copied for migration matches in other valid locks */
+        if (!memcmp(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN))
+                return;
+
+        mlog(ML_ERROR, "Mismatched lvb in lock cookie=%u:%llu, name=%.*s, "
+             "node=%u\n",
+             dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
+             dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
+             lock->lockres->lockname.len, lock->lockres->lockname.name,
+             lock->ml.node);
+        dlm_print_one_lock_resource(lock->lockres);
+        BUG();
+}
 
 /* returns 1 if this lock fills the network structure,
  * 0 otherwise */
@@ -1181,20 +1214,7 @@ static int dlm_add_lock_to_array(struct dlm_lock *lock,
         ml->list = queue;
         if (lock->lksb) {
                 ml->flags = lock->lksb->flags;
-                /* send our current lvb */
-                if (ml->type == LKM_EXMODE ||
-                    ml->type == LKM_PRMODE) {
-                        /* if it is already set, this had better be a PR
-                         * and it has to match */
-                        if (!dlm_lvb_is_empty(mres->lvb) &&
-                            (ml->type == LKM_EXMODE ||
-                             memcmp(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN))) {
-                                mlog(ML_ERROR, "mismatched lvbs!\n");
-                                dlm_print_one_lock_resource(lock->lockres);
-                                BUG();
-                        }
-                        memcpy(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN);
-                }
+                dlm_prepare_lvb_for_migration(lock, mres, queue);
         }
         ml->node = lock->ml.node;
         mres->num_locks++;
@@ -1730,6 +1750,7 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
         struct dlm_lock *lock = NULL;
         u8 from = O2NM_MAX_NODES;
         unsigned int added = 0;
+        __be64 c;
 
         mlog(0, "running %d locks for this lockres\n", mres->num_locks);
         for (i=0; i<mres->num_locks; i++) {
@@ -1777,19 +1798,48 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                         /* lock is always created locally first, and
                          * destroyed locally last.  it must be on the list */
                         if (!lock) {
-                                __be64 c = ml->cookie;
-                                mlog(ML_ERROR, "could not find local lock "
-                                               "with cookie %u:%llu!\n",
+                                c = ml->cookie;
+                                mlog(ML_ERROR, "Could not find local lock "
+                                               "with cookie %u:%llu, node %u, "
+                                               "list %u, flags 0x%x, type %d, "
+                                               "conv %d, highest blocked %d\n",
                                      dlm_get_lock_cookie_node(be64_to_cpu(c)),
-                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)));
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     ml->node, ml->list, ml->flags, ml->type,
+                                     ml->convert_type, ml->highest_blocked);
+                                __dlm_print_one_lock_resource(res);
+                                BUG();
+                        }
+
+                        if (lock->ml.node != ml->node) {
+                                c = lock->ml.cookie;
+                                mlog(ML_ERROR, "Mismatched node# in lock "
+                                     "cookie %u:%llu, name %.*s, node %u\n",
+                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     res->lockname.len, res->lockname.name,
+                                     lock->ml.node);
+                                c = ml->cookie;
+                                mlog(ML_ERROR, "Migrate lock cookie %u:%llu, "
+                                     "node %u, list %u, flags 0x%x, type %d, "
+                                     "conv %d, highest blocked %d\n",
+                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     ml->node, ml->list, ml->flags, ml->type,
+                                     ml->convert_type, ml->highest_blocked);
                                 __dlm_print_one_lock_resource(res);
                                 BUG();
                         }
-                        BUG_ON(lock->ml.node != ml->node);
 
                         if (tmpq != queue) {
-                                mlog(0, "lock was on %u instead of %u for %.*s\n",
-                                     j, ml->list, res->lockname.len, res->lockname.name);
+                                c = ml->cookie;
+                                mlog(0, "Lock cookie %u:%llu was on list %u "
+                                     "instead of list %u for %.*s\n",
+                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     j, ml->list, res->lockname.len,
+                                     res->lockname.name);
+                                __dlm_print_one_lock_resource(res);
                                 spin_unlock(&res->spinlock);
                                 continue;
                         }
@@ -1839,7 +1889,7 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                                  * the lvb. */
                                 memcpy(res->lvb, mres->lvb, DLM_LVB_LEN);
                         } else {
-                                /* otherwise, the node is sending its 
+                                /* otherwise, the node is sending its
                                  * most recent valid lvb info */
                                 BUG_ON(ml->type != LKM_EXMODE &&
                                        ml->type != LKM_PRMODE);
@@ -1886,7 +1936,7 @@ skip_lvb:
                 spin_lock(&res->spinlock);
                 list_for_each_entry(lock, queue, list) {
                         if (lock->ml.cookie == ml->cookie) {
-                                __be64 c = lock->ml.cookie;
+                                c = lock->ml.cookie;
                                 mlog(ML_ERROR, "%s:%.*s: %u:%llu: lock already "
                                      "exists on this lockres!\n", dlm->name,
                                      res->lockname.len, res->lockname.name,
@@ -2114,7 +2164,7 @@ static void dlm_revalidate_lvb(struct dlm_ctxt *dlm,
         assert_spin_locked(&res->spinlock);
 
         if (res->owner == dlm->node_num)
-                /* if this node owned the lockres, and if the dead node 
+                /* if this node owned the lockres, and if the dead node
                  * had an EX when he died, blank out the lvb */
                 search_node = dead_node;
         else {
@@ -2152,7 +2202,7 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
 
         /* this node is the lockres master:
          * 1) remove any stale locks for the dead node
-         * 2) if the dead node had an EX when he died, blank out the lvb 
+         * 2) if the dead node had an EX when he died, blank out the lvb
          */
         assert_spin_locked(&dlm->spinlock);
         assert_spin_locked(&res->spinlock);
@@ -2193,7 +2243,12 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
                 mlog(0, "%s:%.*s: freed %u locks for dead node %u, "
                      "dropping ref from lockres\n", dlm->name,
                      res->lockname.len, res->lockname.name, freed, dead_node);
-                BUG_ON(!test_bit(dead_node, res->refmap));
+                if(!test_bit(dead_node, res->refmap)) {
+                        mlog(ML_ERROR, "%s:%.*s: freed %u locks for dead node %u, "
+                             "but ref was not set\n", dlm->name,
+                             res->lockname.len, res->lockname.name, freed, dead_node);
+                        __dlm_print_one_lock_resource(res);
+                }
                 dlm_lockres_clear_refmap_bit(dead_node, res);
         } else if (test_bit(dead_node, res->refmap)) {
                 mlog(0, "%s:%.*s: dead node %u had a ref, but had "
@@ -2260,7 +2315,7 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
                                 }
                                 spin_unlock(&res->spinlock);
                                 continue;
-                        }                       
+                        }
                         spin_lock(&res->spinlock);
                         /* zero the lvb if necessary */
                         dlm_revalidate_lvb(dlm, res, dead_node);
@@ -2411,7 +2466,7 @@ static void dlm_reco_unlock_ast(void *astdata, enum dlm_status st)
  * this function on each node racing to become the recovery
  * master will not stop attempting this until either:
  * a) this node gets the EX (and becomes the recovery master),
- * or b) dlm->reco.new_master gets set to some nodenum 
+ * or b) dlm->reco.new_master gets set to some nodenum
  * != O2NM_INVALID_NODE_NUM (another node will do the reco).
  * so each time a recovery master is needed, the entire cluster
  * will sync at this point.  if the new master dies, that will
@@ -2424,7 +2479,7 @@ static int dlm_pick_recovery_master(struct dlm_ctxt *dlm)
 
         mlog(0, "starting recovery of %s at %lu, dead=%u, this=%u\n",
              dlm->name, jiffies, dlm->reco.dead_node, dlm->node_num);
-again:  
+again:
         memset(&lksb, 0, sizeof(lksb));
 
         ret = dlmlock(dlm, LKM_EXMODE, &lksb, LKM_NOQUEUE|LKM_RECOVERY,
@@ -2437,8 +2492,8 @@ again:
         if (ret == DLM_NORMAL) {
                 mlog(0, "dlm=%s dlmlock says I got it (this=%u)\n",
                      dlm->name, dlm->node_num);
-                
-                /* got the EX lock.  check to see if another node 
+
+                /* got the EX lock.  check to see if another node
                  * just became the reco master */
                 if (dlm_reco_master_ready(dlm)) {
                         mlog(0, "%s: got reco EX lock, but %u will "
@@ -2451,12 +2506,12 @@ again:
                         /* see if recovery was already finished elsewhere */
                         spin_lock(&dlm->spinlock);
                         if (dlm->reco.dead_node == O2NM_INVALID_NODE_NUM) {
-                                status = -EINVAL;       
+                                status = -EINVAL;
                                 mlog(0, "%s: got reco EX lock, but "
                                      "node got recovered already\n", dlm->name);
                                 if (dlm->reco.new_master != O2NM_INVALID_NODE_NUM) {
                                         mlog(ML_ERROR, "%s: new master is %u "
-                                             "but no dead node!\n", 
+                                             "but no dead node!\n",
                                              dlm->name, dlm->reco.new_master);
                                         BUG();
                                 }
@@ -2468,7 +2523,7 @@ again:
                  * set the master and send the messages to begin recovery */
                 if (!status) {
                         mlog(0, "%s: dead=%u, this=%u, sending "
-                             "begin_reco now\n", dlm->name, 
+                             "begin_reco now\n", dlm->name,
                              dlm->reco.dead_node, dlm->node_num);
                         status = dlm_send_begin_reco_message(dlm,
                                       dlm->reco.dead_node);
@@ -2501,7 +2556,7 @@ again:
                 mlog(0, "dlm=%s dlmlock says another node got it (this=%u)\n",
                      dlm->name, dlm->node_num);
                 /* another node is master. wait on
-                 * reco.new_master != O2NM_INVALID_NODE_NUM 
+                 * reco.new_master != O2NM_INVALID_NODE_NUM
                  * for at most one second */
                 wait_event_timeout(dlm->dlm_reco_thread_wq,
                                          dlm_reco_master_ready(dlm),
@@ -2589,7 +2644,13 @@ retry:
                              "begin reco msg (%d)\n", dlm->name, nodenum, ret);
                         ret = 0;
                 }
-                if (ret == -EAGAIN) {
+
+                /*
+                 * Prior to commit aad1b15310b9bcd59fa81ab8f2b1513b59553ea8,
+                 * dlm_begin_reco_handler() returned EAGAIN and not -EAGAIN.
+                 * We are handling both for compatibility reasons.
+                 */
+                if (ret == -EAGAIN || ret == EAGAIN) {
                         mlog(0, "%s: trying to start recovery of node "
                              "%u, but node %u is waiting for last recovery "
                              "to complete, backoff for a bit\n", dlm->name,
@@ -2599,7 +2660,7 @@ retry:
                 }
                 if (ret < 0) {
                         struct dlm_lock_resource *res;
-                        /* this is now a serious problem, possibly ENOMEM 
+                        /* this is now a serious problem, possibly ENOMEM
                          * in the network stack.  must retry */
                         mlog_errno(ret);
                         mlog(ML_ERROR, "begin reco of dlm %s to node %u "
@@ -2612,7 +2673,7 @@ retry:
                         } else {
                                 mlog(ML_ERROR, "recovery lock not found\n");
                         }
-                        /* sleep for a bit in hopes that we can avoid 
+                        /* sleep for a bit in hopes that we can avoid
                          * another ENOMEM */
                         msleep(100);
                         goto retry;
@@ -2664,7 +2725,7 @@ int dlm_begin_reco_handler(struct o2net_msg *msg, u32 len, void *data,
         }
         if (dlm->reco.dead_node != O2NM_INVALID_NODE_NUM) {
                 mlog(ML_NOTICE, "%s: dead_node previously set to %u, "
-                     "node %u changing it to %u\n", dlm->name, 
+                     "node %u changing it to %u\n", dlm->name,
                      dlm->reco.dead_node, br->node_idx, br->dead_node);
         }
         dlm_set_reco_master(dlm, br->node_idx);
@@ -2730,8 +2791,8 @@ stage2:
                 if (ret < 0) {
                         mlog_errno(ret);
                         if (dlm_is_host_down(ret)) {
-                                /* this has no effect on this recovery 
-                                 * session, so set the status to zero to 
+                                /* this has no effect on this recovery
+                                 * session, so set the status to zero to
                                  * finish out the last recovery */
                                 mlog(ML_ERROR, "node %u went down after this "
                                      "node finished recovery.\n", nodenum);
@@ -2768,7 +2829,7 @@ int dlm_finalize_reco_handler(struct o2net_msg *msg, u32 len, void *data,
         mlog(0, "%s: node %u finalizing recovery stage%d of "
              "node %u (%u:%u)\n", dlm->name, fr->node_idx, stage,
              fr->dead_node, dlm->reco.dead_node, dlm->reco.new_master);
- 
+
         spin_lock(&dlm->spinlock);
 
         if (dlm->reco.new_master != fr->node_idx) {
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 52ec020ea78b..11a6d1fd1d35 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 00f53b2aea76..b47c1b92b82b 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
@@ -190,8 +189,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                         actions &= ~(DLM_UNLOCK_REMOVE_LOCK|
                                      DLM_UNLOCK_REGRANT_LOCK|
                                      DLM_UNLOCK_CLEAR_CONVERT_TYPE);
-                } else if (status == DLM_RECOVERING || 
-                           status == DLM_MIGRATING || 
+                } else if (status == DLM_RECOVERING ||
+                           status == DLM_MIGRATING ||
                            status == DLM_FORWARD) {
                         /* must clear the actions because this unlock
                          * is about to be retried.  cannot free or do
@@ -661,14 +660,14 @@ retry:
         if (call_ast) {
                 mlog(0, "calling unlockast(%p, %d)\n", data, status);
                 if (is_master) {
-                        /* it is possible that there is one last bast 
+                        /* it is possible that there is one last bast
                          * pending.  make sure it is flushed, then
                          * call the unlockast.
                          * not an issue if this is a mastered remotely,
                          * since this lock has been removed from the
                          * lockres queues and cannot be found. */
                         dlm_kick_thread(dlm, NULL);
-                        wait_event(dlm->ast_wq, 
+                        wait_event(dlm->ast_wq,
                                    dlm_lock_basts_flushed(dlm, lock));
                 }
                 (*unlockast)(data, status);
diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile
new file mode 100644
index 000000000000..df69b4856d0d
--- /dev/null
+++ b/fs/ocfs2/dlmfs/Makefile
@@ -0,0 +1,5 @@
+EXTRA_CFLAGS += -Ifs/ocfs2
+
+obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o
+
+ocfs2_dlmfs-objs := userdlm.o dlmfs.o dlmfsver.o
diff --git a/fs/ocfs2/dlm/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
index 02bf17808bdc..1b0de157a08c 100644
--- a/fs/ocfs2/dlm/dlmfs.c
+++ b/fs/ocfs2/dlmfs/dlmfs.c
@@ -43,24 +43,17 @@
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/backing-dev.h>
+#include <linux/poll.h>
 
 #include <asm/uaccess.h>
 
-
-#include "cluster/nodemanager.h"
-#include "cluster/heartbeat.h"
-#include "cluster/tcp.h"
-
-#include "dlmapi.h"
-
+#include "stackglue.h"
 #include "userdlm.h"
-
 #include "dlmfsver.h"
 
 #define MLOG_MASK_PREFIX ML_DLMFS
 #include "cluster/masklog.h"
 
-#include "ocfs2_lockingver.h"
 
 static const struct super_operations dlmfs_ops;
 static const struct file_operations dlmfs_file_operations;
@@ -71,15 +64,46 @@ static struct kmem_cache *dlmfs_inode_cache;
 
 struct workqueue_struct *user_dlm_worker;
 
+
+
 /*
- * This is the userdlmfs locking protocol version.
+ * These are the ABI capabilities of dlmfs.
+ *
+ * Over time, dlmfs has added some features that were not part of the
+ * initial ABI.  Unfortunately, some of these features are not detectable
+ * via standard usage.  For example, Linux's default poll always returns
+ * POLLIN, so there is no way for a caller of poll(2) to know when dlmfs
+ * added poll support.  Instead, we provide this list of new capabilities.
+ *
+ * Capabilities is a read-only attribute.  We do it as a module parameter
+ * so we can discover it whether dlmfs is built in, loaded, or even not
+ * loaded.
  *
- * See fs/ocfs2/dlmglue.c for more details on locking versions.
+ * The ABI features are local to this machine's dlmfs mount.  This is
+ * distinct from the locking protocol, which is concerned with inter-node
+ * interaction.
+ *
+ * Capabilities:
+ * - bast       : POLLIN against the file descriptor of a held lock
+ *                signifies a bast fired on the lock.
  */
-static const struct dlm_protocol_version user_locking_protocol = {
-        .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
-        .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
-};
+#define DLMFS_CAPABILITIES "bast stackglue"
+extern int param_set_dlmfs_capabilities(const char *val,
+                                        struct kernel_param *kp)
+{
+        printk(KERN_ERR "%s: readonly parameter\n", kp->name);
+        return -EINVAL;
+}
+static int param_get_dlmfs_capabilities(char *buffer,
+                                        struct kernel_param *kp)
+{
+        return strlcpy(buffer, DLMFS_CAPABILITIES,
+                       strlen(DLMFS_CAPABILITIES) + 1);
+}
+module_param_call(capabilities, param_set_dlmfs_capabilities,
+                  param_get_dlmfs_capabilities, NULL, 0444);
+MODULE_PARM_DESC(capabilities, DLMFS_CAPABILITIES);
+
 
 /*
  * decodes a set of open flags into a valid lock level and a set of flags.
@@ -179,13 +203,46 @@ static int dlmfs_file_release(struct inode *inode,
         return 0;
 }
 
+/*
+ * We do ->setattr() just to override size changes.  Our size is the size
+ * of the LVB and nothing else.
+ */
+static int dlmfs_file_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        int error;
+        struct inode *inode = dentry->d_inode;
+
+        attr->ia_valid &= ~ATTR_SIZE;
+        error = inode_change_ok(inode, attr);
+        if (!error)
+                error = inode_setattr(inode, attr);
+
+        return error;
+}
+
+static unsigned int dlmfs_file_poll(struct file *file, poll_table *wait)
+{
+        int event = 0;
+        struct inode *inode = file->f_path.dentry->d_inode;
+        struct dlmfs_inode_private *ip = DLMFS_I(inode);
+
+        poll_wait(file, &ip->ip_lockres.l_event, wait);
+
+        spin_lock(&ip->ip_lockres.l_lock);
+        if (ip->ip_lockres.l_flags & USER_LOCK_BLOCKED)
+                event = POLLIN | POLLRDNORM;
+        spin_unlock(&ip->ip_lockres.l_lock);
+
+        return event;
+}
+
 static ssize_t dlmfs_file_read(struct file *filp,
                                char __user *buf,
                                size_t count,
                                loff_t *ppos)
 {
         int bytes_left;
-        ssize_t readlen;
+        ssize_t readlen, got;
         char *lvb_buf;
         struct inode *inode = filp->f_path.dentry->d_inode;
 
@@ -211,9 +268,13 @@ static ssize_t dlmfs_file_read(struct file *filp,
         if (!lvb_buf)
                 return -ENOMEM;
 
-        user_dlm_read_lvb(inode, lvb_buf, readlen);
-        bytes_left = __copy_to_user(buf, lvb_buf, readlen);
-        readlen -= bytes_left;
+        got = user_dlm_read_lvb(inode, lvb_buf, readlen);
+        if (got) {
+                BUG_ON(got != readlen);
+                bytes_left = __copy_to_user(buf, lvb_buf, readlen);
+                readlen -= bytes_left;
+        } else
+                readlen = 0;
 
         kfree(lvb_buf);
 
@@ -272,7 +333,7 @@ static void dlmfs_init_once(void *foo)
         struct dlmfs_inode_private *ip =
                 (struct dlmfs_inode_private *) foo;
 
-        ip->ip_dlm = NULL;
+        ip->ip_conn = NULL;
         ip->ip_parent = NULL;
 
         inode_init_once(&ip->ip_vfs_inode);
@@ -314,14 +375,14 @@ static void dlmfs_clear_inode(struct inode *inode)
                 goto clear_fields;
         }
 
-        mlog(0, "we're a directory, ip->ip_dlm = 0x%p\n", ip->ip_dlm);
+        mlog(0, "we're a directory, ip->ip_conn = 0x%p\n", ip->ip_conn);
         /* we must be a directory. If required, lets unregister the
          * dlm context now. */
-        if (ip->ip_dlm)
-                user_dlm_unregister_context(ip->ip_dlm);
+        if (ip->ip_conn)
+                user_dlm_unregister(ip->ip_conn);
 clear_fields:
         ip->ip_parent = NULL;
-        ip->ip_dlm = NULL;
+        ip->ip_conn = NULL;
 }
 
 static struct backing_dev_info dlmfs_backing_dev_info = {
@@ -371,7 +432,7 @@ static struct inode *dlmfs_get_inode(struct inode *parent,
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
 
         ip = DLMFS_I(inode);
-        ip->ip_dlm = DLMFS_I(parent)->ip_dlm;
+        ip->ip_conn = DLMFS_I(parent)->ip_conn;
 
         switch (mode & S_IFMT) {
         default:
@@ -425,13 +486,12 @@ static int dlmfs_mkdir(struct inode * dir,
         struct inode *inode = NULL;
         struct qstr *domain = &dentry->d_name;
         struct dlmfs_inode_private *ip;
-        struct dlm_ctxt *dlm;
-        struct dlm_protocol_version proto = user_locking_protocol;
+        struct ocfs2_cluster_connection *conn;
 
         mlog(0, "mkdir %.*s\n", domain->len, domain->name);
 
         /* verify that we have a proper domain */
-        if (domain->len >= O2NM_MAX_NAME_LEN) {
+        if (domain->len >= GROUP_NAME_MAX) {
                 status = -EINVAL;
                 mlog(ML_ERROR, "invalid domain name for directory.\n");
                 goto bail;
@@ -446,14 +506,14 @@ static int dlmfs_mkdir(struct inode * dir,
 
         ip = DLMFS_I(inode);
 
-        dlm = user_dlm_register_context(domain, &proto);
-        if (IS_ERR(dlm)) {
-                status = PTR_ERR(dlm);
+        conn = user_dlm_register(domain);
+        if (IS_ERR(conn)) {
+                status = PTR_ERR(conn);
                 mlog(ML_ERROR, "Error %d could not register domain \"%.*s\"\n",
                      status, domain->len, domain->name);
                 goto bail;
         }
-        ip->ip_dlm = dlm;
+        ip->ip_conn = conn;
 
         inc_nlink(dir);
         d_instantiate(dentry, inode);
@@ -549,6 +609,7 @@ static int dlmfs_fill_super(struct super_block * sb,
 static const struct file_operations dlmfs_file_operations = {
         .open           = dlmfs_file_open,
         .release        = dlmfs_file_release,
+        .poll           = dlmfs_file_poll,
         .read           = dlmfs_file_read,
         .write          = dlmfs_file_write,
 };
@@ -576,6 +637,7 @@ static const struct super_operations dlmfs_ops = {
 
 static const struct inode_operations dlmfs_file_inode_operations = {
         .getattr        = simple_getattr,
+        .setattr        = dlmfs_file_setattr,
 };
 
 static int dlmfs_get_sb(struct file_system_type *fs_type,
@@ -620,6 +682,7 @@ static int __init init_dlmfs_fs(void)
         }
         cleanup_worker = 1;
 
+        user_dlm_set_locking_protocol();
         status = register_filesystem(&dlmfs_fs_type);
 bail:
         if (status) {
diff --git a/fs/ocfs2/dlm/dlmfsver.c b/fs/ocfs2/dlmfs/dlmfsver.c
index a733b3321f83..a733b3321f83 100644
--- a/fs/ocfs2/dlm/dlmfsver.c
+++ b/fs/ocfs2/dlmfs/dlmfsver.c
diff --git a/fs/ocfs2/dlm/dlmfsver.h b/fs/ocfs2/dlmfs/dlmfsver.h
index f35eadbed25c..f35eadbed25c 100644
--- a/fs/ocfs2/dlm/dlmfsver.h
+++ b/fs/ocfs2/dlmfs/dlmfsver.h
diff --git a/fs/ocfs2/dlm/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c
index 4cb1d3dae250..0499e3fb7bdb 100644
--- a/fs/ocfs2/dlm/userdlm.c
+++ b/fs/ocfs2/dlmfs/userdlm.c
@@ -34,18 +34,19 @@
 #include <linux/types.h>
 #include <linux/crc32.h>
 
-
-#include "cluster/nodemanager.h"
-#include "cluster/heartbeat.h"
-#include "cluster/tcp.h"
-
-#include "dlmapi.h"
-
+#include "ocfs2_lockingver.h"
+#include "stackglue.h"
 #include "userdlm.h"
 
 #define MLOG_MASK_PREFIX ML_DLMFS
 #include "cluster/masklog.h"
 
+
+static inline struct user_lock_res *user_lksb_to_lock_res(struct ocfs2_dlm_lksb *lksb)
+{
+        return container_of(lksb, struct user_lock_res, l_lksb);
+}
+
 static inline int user_check_wait_flag(struct user_lock_res *lockres,
                                        int flag)
 {
@@ -73,15 +74,15 @@ static inline void user_wait_on_blocked_lock(struct user_lock_res *lockres)
 }
 
 /* I heart container_of... */
-static inline struct dlm_ctxt *
-dlm_ctxt_from_user_lockres(struct user_lock_res *lockres)
+static inline struct ocfs2_cluster_connection *
+cluster_connection_from_user_lockres(struct user_lock_res *lockres)
 {
         struct dlmfs_inode_private *ip;
 
         ip = container_of(lockres,
                           struct dlmfs_inode_private,
                           ip_lockres);
-        return ip->ip_dlm;
+        return ip->ip_conn;
 }
 
 static struct inode *
@@ -103,9 +104,9 @@ static inline void user_recover_from_dlm_error(struct user_lock_res *lockres)
 }
 
 #define user_log_dlm_error(_func, _stat, _lockres) do {                 \
-        mlog(ML_ERROR, "Dlm error \"%s\" while calling %s on "          \
-                "resource %.*s: %s\n", dlm_errname(_stat), _func,       \
-                _lockres->l_namelen, _lockres->l_name, dlm_errmsg(_stat)); \
+        mlog(ML_ERROR, "Dlm error %d while calling %s on "              \
+                "resource %.*s\n", _stat, _func,                        \
+                _lockres->l_namelen, _lockres->l_name);                 \
 } while (0)
 
 /* WARNING: This function lives in a world where the only three lock
@@ -113,34 +114,35 @@ static inline void user_recover_from_dlm_error(struct user_lock_res *lockres)
  * lock types are added. */
 static inline int user_highest_compat_lock_level(int level)
 {
-        int new_level = LKM_EXMODE;
+        int new_level = DLM_LOCK_EX;
 
-        if (level == LKM_EXMODE)
-                new_level = LKM_NLMODE;
-        else if (level == LKM_PRMODE)
-                new_level = LKM_PRMODE;
+        if (level == DLM_LOCK_EX)
+                new_level = DLM_LOCK_NL;
+        else if (level == DLM_LOCK_PR)
+                new_level = DLM_LOCK_PR;
         return new_level;
 }
 
-static void user_ast(void *opaque)
+static void user_ast(struct ocfs2_dlm_lksb *lksb)
 {
-        struct user_lock_res *lockres = opaque;
-        struct dlm_lockstatus *lksb;
+        struct user_lock_res *lockres = user_lksb_to_lock_res(lksb);
+        int status;
 
-        mlog(0, "AST fired for lockres %.*s\n", lockres->l_namelen,
-             lockres->l_name);
+        mlog(ML_BASTS, "AST fired for lockres %.*s, level %d => %d\n",
+             lockres->l_namelen, lockres->l_name, lockres->l_level,
+             lockres->l_requested);
 
         spin_lock(&lockres->l_lock);
 
-        lksb = &(lockres->l_lksb);
-        if (lksb->status != DLM_NORMAL) {
+        status = ocfs2_dlm_lock_status(&lockres->l_lksb);
+        if (status) {
                 mlog(ML_ERROR, "lksb status value of %u on lockres %.*s\n",
-                     lksb->status, lockres->l_namelen, lockres->l_name);
+                     status, lockres->l_namelen, lockres->l_name);
                 spin_unlock(&lockres->l_lock);
                 return;
         }
 
-        mlog_bug_on_msg(lockres->l_requested == LKM_IVMODE,
+        mlog_bug_on_msg(lockres->l_requested == DLM_LOCK_IV,
                         "Lockres %.*s, requested ivmode. flags 0x%x\n",
                         lockres->l_namelen, lockres->l_name, lockres->l_flags);
 
@@ -148,13 +150,13 @@ static void user_ast(void *opaque)
         if (lockres->l_requested < lockres->l_level) {
                 if (lockres->l_requested <=
                     user_highest_compat_lock_level(lockres->l_blocking)) {
-                        lockres->l_blocking = LKM_NLMODE;
+                        lockres->l_blocking = DLM_LOCK_NL;
                         lockres->l_flags &= ~USER_LOCK_BLOCKED;
                 }
         }
 
         lockres->l_level = lockres->l_requested;
-        lockres->l_requested = LKM_IVMODE;
+        lockres->l_requested = DLM_LOCK_IV;
         lockres->l_flags |= USER_LOCK_ATTACHED;
         lockres->l_flags &= ~USER_LOCK_BUSY;
 
@@ -193,11 +195,11 @@ static void __user_dlm_cond_queue_lockres(struct user_lock_res *lockres)
                 return;
 
         switch (lockres->l_blocking) {
-        case LKM_EXMODE:
+        case DLM_LOCK_EX:
                 if (!lockres->l_ex_holders && !lockres->l_ro_holders)
                         queue = 1;
                 break;
-        case LKM_PRMODE:
+        case DLM_LOCK_PR:
                 if (!lockres->l_ex_holders)
                         queue = 1;
                 break;
@@ -209,12 +211,12 @@ static void __user_dlm_cond_queue_lockres(struct user_lock_res *lockres)
                 __user_dlm_queue_lockres(lockres);
 }
 
-static void user_bast(void *opaque, int level)
+static void user_bast(struct ocfs2_dlm_lksb *lksb, int level)
 {
-        struct user_lock_res *lockres = opaque;
+        struct user_lock_res *lockres = user_lksb_to_lock_res(lksb);
 
-        mlog(0, "Blocking AST fired for lockres %.*s. Blocking level %d\n",
-             lockres->l_namelen, lockres->l_name, level);
+        mlog(ML_BASTS, "BAST fired for lockres %.*s, blocking %d, level %d\n",
+             lockres->l_namelen, lockres->l_name, level, lockres->l_level);
 
         spin_lock(&lockres->l_lock);
         lockres->l_flags |= USER_LOCK_BLOCKED;
@@ -227,15 +229,15 @@ static void user_bast(void *opaque, int level)
         wake_up(&lockres->l_event);
 }
 
-static void user_unlock_ast(void *opaque, enum dlm_status status)
+static void user_unlock_ast(struct ocfs2_dlm_lksb *lksb, int status)
 {
-        struct user_lock_res *lockres = opaque;
+        struct user_lock_res *lockres = user_lksb_to_lock_res(lksb);
 
-        mlog(0, "UNLOCK AST called on lock %.*s\n", lockres->l_namelen,
-             lockres->l_name);
+        mlog(ML_BASTS, "UNLOCK AST fired for lockres %.*s, flags 0x%x\n",
+             lockres->l_namelen, lockres->l_name, lockres->l_flags);
 
-        if (status != DLM_NORMAL && status != DLM_CANCELGRANT)
-                mlog(ML_ERROR, "Dlm returns status %d\n", status);
+        if (status)
+                mlog(ML_ERROR, "dlm returns status %d\n", status);
 
         spin_lock(&lockres->l_lock);
         /* The teardown flag gets set early during the unlock process,
@@ -243,7 +245,7 @@ static void user_unlock_ast(void *opaque, enum dlm_status status)
          * for a concurrent cancel. */
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN
             && !(lockres->l_flags & USER_LOCK_IN_CANCEL)) {
-                lockres->l_level = LKM_IVMODE;
+                lockres->l_level = DLM_LOCK_IV;
         } else if (status == DLM_CANCELGRANT) {
                 /* We tried to cancel a convert request, but it was
                  * already granted. Don't clear the busy flag - the
@@ -254,7 +256,7 @@ static void user_unlock_ast(void *opaque, enum dlm_status status)
         } else {
                 BUG_ON(!(lockres->l_flags & USER_LOCK_IN_CANCEL));
                 /* Cancel succeeded, we want to re-queue */
-                lockres->l_requested = LKM_IVMODE; /* cancel an
+                lockres->l_requested = DLM_LOCK_IV; /* cancel an
                                                     * upconvert
                                                     * request. */
                 lockres->l_flags &= ~USER_LOCK_IN_CANCEL;
@@ -271,6 +273,21 @@ out_noclear:
         wake_up(&lockres->l_event);
 }
 
+/*
+ * This is the userdlmfs locking protocol version.
+ *
+ * See fs/ocfs2/dlmglue.c for more details on locking versions.
+ */
+static struct ocfs2_locking_protocol user_dlm_lproto = {
+        .lp_max_version = {
+                .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
+                .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
+        },
+        .lp_lock_ast            = user_ast,
+        .lp_blocking_ast        = user_bast,
+        .lp_unlock_ast          = user_unlock_ast,
+};
+
 static inline void user_dlm_drop_inode_ref(struct user_lock_res *lockres)
 {
         struct inode *inode;
@@ -283,10 +300,10 @@ static void user_dlm_unblock_lock(struct work_struct *work)
         int new_level, status;
         struct user_lock_res *lockres =
                 container_of(work, struct user_lock_res, l_work);
-        struct dlm_ctxt *dlm = dlm_ctxt_from_user_lockres(lockres);
+        struct ocfs2_cluster_connection *conn =
+                cluster_connection_from_user_lockres(lockres);
 
-        mlog(0, "processing lockres %.*s\n", lockres->l_namelen,
-             lockres->l_name);
+        mlog(0, "lockres %.*s\n", lockres->l_namelen, lockres->l_name);
 
         spin_lock(&lockres->l_lock);
 
@@ -304,17 +321,23 @@ static void user_dlm_unblock_lock(struct work_struct *work)
          * flag, and finally we might get another bast which re-queues
          * us before our ast for the downconvert is called. */
         if (!(lockres->l_flags & USER_LOCK_BLOCKED)) {
+                mlog(ML_BASTS, "lockres %.*s USER_LOCK_BLOCKED\n",
+                     lockres->l_namelen, lockres->l_name);
                 spin_unlock(&lockres->l_lock);
                 goto drop_ref;
         }
 
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
+                mlog(ML_BASTS, "lockres %.*s USER_LOCK_IN_TEARDOWN\n",
+                     lockres->l_namelen, lockres->l_name);
                 spin_unlock(&lockres->l_lock);
                 goto drop_ref;
         }
 
         if (lockres->l_flags & USER_LOCK_BUSY) {
                 if (lockres->l_flags & USER_LOCK_IN_CANCEL) {
+                        mlog(ML_BASTS, "lockres %.*s USER_LOCK_IN_CANCEL\n",
+                             lockres->l_namelen, lockres->l_name);
                         spin_unlock(&lockres->l_lock);
                         goto drop_ref;
                 }
@@ -322,32 +345,31 @@ static void user_dlm_unblock_lock(struct work_struct *work)
                 lockres->l_flags |= USER_LOCK_IN_CANCEL;
                 spin_unlock(&lockres->l_lock);
 
-                status = dlmunlock(dlm,
-                                   &lockres->l_lksb,
-                                   LKM_CANCEL,
-                                   user_unlock_ast,
-                                   lockres);
-                if (status != DLM_NORMAL)
-                        user_log_dlm_error("dlmunlock", status, lockres);
+                status = ocfs2_dlm_unlock(conn, &lockres->l_lksb,
+                                          DLM_LKF_CANCEL);
+                if (status)
+                        user_log_dlm_error("ocfs2_dlm_unlock", status, lockres);
                 goto drop_ref;
         }
 
         /* If there are still incompat holders, we can exit safely
          * without worrying about re-queueing this lock as that will
          * happen on the last call to user_cluster_unlock. */
-        if ((lockres->l_blocking == LKM_EXMODE)
+        if ((lockres->l_blocking == DLM_LOCK_EX)
             && (lockres->l_ex_holders || lockres->l_ro_holders)) {
                 spin_unlock(&lockres->l_lock);
-                mlog(0, "can't downconvert for ex: ro = %u, ex = %u\n",
-                        lockres->l_ro_holders, lockres->l_ex_holders);
+                mlog(ML_BASTS, "lockres %.*s, EX/PR Holders %u,%u\n",
+                     lockres->l_namelen, lockres->l_name,
+                     lockres->l_ex_holders, lockres->l_ro_holders);
                 goto drop_ref;
         }
 
-        if ((lockres->l_blocking == LKM_PRMODE)
+        if ((lockres->l_blocking == DLM_LOCK_PR)
             && lockres->l_ex_holders) {
                 spin_unlock(&lockres->l_lock);
-                mlog(0, "can't downconvert for pr: ex = %u\n",
-                        lockres->l_ex_holders);
+                mlog(ML_BASTS, "lockres %.*s, EX Holders %u\n",
+                     lockres->l_namelen, lockres->l_name,
+                     lockres->l_ex_holders);
                 goto drop_ref;
         }
 
@@ -355,22 +377,17 @@ static void user_dlm_unblock_lock(struct work_struct *work)
         new_level = user_highest_compat_lock_level(lockres->l_blocking);
         lockres->l_requested = new_level;
         lockres->l_flags |= USER_LOCK_BUSY;
-        mlog(0, "Downconvert lock from %d to %d\n",
-                lockres->l_level, new_level);
+        mlog(ML_BASTS, "lockres %.*s, downconvert %d => %d\n",
+             lockres->l_namelen, lockres->l_name, lockres->l_level, new_level);
         spin_unlock(&lockres->l_lock);
 
         /* need lock downconvert request now... */
-        status = dlmlock(dlm,
-                         new_level,
-                         &lockres->l_lksb,
-                         LKM_CONVERT|LKM_VALBLK,
-                         lockres->l_name,
-                         lockres->l_namelen,
-                         user_ast,
-                         lockres,
-                         user_bast);
-        if (status != DLM_NORMAL) {
-                user_log_dlm_error("dlmlock", status, lockres);
+        status = ocfs2_dlm_lock(conn, new_level, &lockres->l_lksb,
+                                DLM_LKF_CONVERT|DLM_LKF_VALBLK,
+                                lockres->l_name,
+                                lockres->l_namelen);
+        if (status) {
+                user_log_dlm_error("ocfs2_dlm_lock", status, lockres);
                 user_recover_from_dlm_error(lockres);
         }
 
@@ -382,10 +399,10 @@ static inline void user_dlm_inc_holders(struct user_lock_res *lockres,
                                         int level)
 {
         switch(level) {
-        case LKM_EXMODE:
+        case DLM_LOCK_EX:
                 lockres->l_ex_holders++;
                 break;
-        case LKM_PRMODE:
+        case DLM_LOCK_PR:
                 lockres->l_ro_holders++;
                 break;
         default:
@@ -410,20 +427,19 @@ int user_dlm_cluster_lock(struct user_lock_res *lockres,
                           int lkm_flags)
 {
         int status, local_flags;
-        struct dlm_ctxt *dlm = dlm_ctxt_from_user_lockres(lockres);
+        struct ocfs2_cluster_connection *conn =
+                cluster_connection_from_user_lockres(lockres);
 
-        if (level != LKM_EXMODE &&
-            level != LKM_PRMODE) {
+        if (level != DLM_LOCK_EX &&
+            level != DLM_LOCK_PR) {
                 mlog(ML_ERROR, "lockres %.*s: invalid request!\n",
                      lockres->l_namelen, lockres->l_name);
                 status = -EINVAL;
                 goto bail;
         }
 
-        mlog(0, "lockres %.*s: asking for %s lock, passed flags = 0x%x\n",
-             lockres->l_namelen, lockres->l_name,
-             (level == LKM_EXMODE) ? "LKM_EXMODE" : "LKM_PRMODE",
-             lkm_flags);
+        mlog(ML_BASTS, "lockres %.*s, level %d, flags = 0x%x\n",
+             lockres->l_namelen, lockres->l_name, level, lkm_flags);
 
 again:
         if (signal_pending(current)) {
@@ -457,35 +473,26 @@ again:
         }
 
         if (level > lockres->l_level) {
-                local_flags = lkm_flags | LKM_VALBLK;
-                if (lockres->l_level != LKM_IVMODE)
-                        local_flags |= LKM_CONVERT;
+                local_flags = lkm_flags | DLM_LKF_VALBLK;
+                if (lockres->l_level != DLM_LOCK_IV)
+                        local_flags |= DLM_LKF_CONVERT;
 
                 lockres->l_requested = level;
                 lockres->l_flags |= USER_LOCK_BUSY;
                 spin_unlock(&lockres->l_lock);
 
-                BUG_ON(level == LKM_IVMODE);
-                BUG_ON(level == LKM_NLMODE);
+                BUG_ON(level == DLM_LOCK_IV);
+                BUG_ON(level == DLM_LOCK_NL);
 
                 /* call dlm_lock to upgrade lock now */
-                status = dlmlock(dlm,
-                                 level,
-                                 &lockres->l_lksb,
-                                 local_flags,
-                                 lockres->l_name,
-                                 lockres->l_namelen,
-                                 user_ast,
-                                 lockres,
-                                 user_bast);
-                if (status != DLM_NORMAL) {
-                        if ((lkm_flags & LKM_NOQUEUE) &&
-                            (status == DLM_NOTQUEUED))
-                                status = -EAGAIN;
-                        else {
-                                user_log_dlm_error("dlmlock", status, lockres);
-                                status = -EINVAL;
-                        }
+                status = ocfs2_dlm_lock(conn, level, &lockres->l_lksb,
+                                        local_flags, lockres->l_name,
+                                        lockres->l_namelen);
+                if (status) {
+                        if ((lkm_flags & DLM_LKF_NOQUEUE) &&
+                            (status != -EAGAIN))
+                                user_log_dlm_error("ocfs2_dlm_lock",
+                                                   status, lockres);
                         user_recover_from_dlm_error(lockres);
                         goto bail;
                 }
@@ -506,11 +513,11 @@ static inline void user_dlm_dec_holders(struct user_lock_res *lockres,
                                         int level)
 {
         switch(level) {
-        case LKM_EXMODE:
+        case DLM_LOCK_EX:
                 BUG_ON(!lockres->l_ex_holders);
                 lockres->l_ex_holders--;
                 break;
-        case LKM_PRMODE:
+        case DLM_LOCK_PR:
                 BUG_ON(!lockres->l_ro_holders);
                 lockres->l_ro_holders--;
                 break;
@@ -522,8 +529,8 @@ static inline void user_dlm_dec_holders(struct user_lock_res *lockres,
 void user_dlm_cluster_unlock(struct user_lock_res *lockres,
                              int level)
 {
-        if (level != LKM_EXMODE &&
-            level != LKM_PRMODE) {
+        if (level != DLM_LOCK_EX &&
+            level != DLM_LOCK_PR) {
                 mlog(ML_ERROR, "lockres %.*s: invalid request!\n",
                      lockres->l_namelen, lockres->l_name);
                 return;
@@ -540,33 +547,40 @@ void user_dlm_write_lvb(struct inode *inode,
                         unsigned int len)
 {
         struct user_lock_res *lockres = &DLMFS_I(inode)->ip_lockres;
-        char *lvb = lockres->l_lksb.lvb;
+        char *lvb;
 
         BUG_ON(len > DLM_LVB_LEN);
 
         spin_lock(&lockres->l_lock);
 
-        BUG_ON(lockres->l_level < LKM_EXMODE);
+        BUG_ON(lockres->l_level < DLM_LOCK_EX);
+        lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
         memcpy(lvb, val, len);
 
         spin_unlock(&lockres->l_lock);
 }
 
-void user_dlm_read_lvb(struct inode *inode,
-                       char *val,
-                       unsigned int len)
+ssize_t user_dlm_read_lvb(struct inode *inode,
+                          char *val,
+                          unsigned int len)
 {
         struct user_lock_res *lockres = &DLMFS_I(inode)->ip_lockres;
-        char *lvb = lockres->l_lksb.lvb;
+        char *lvb;
+        ssize_t ret = len;
 
         BUG_ON(len > DLM_LVB_LEN);
 
         spin_lock(&lockres->l_lock);
 
-        BUG_ON(lockres->l_level < LKM_PRMODE);
-        memcpy(val, lvb, len);
+        BUG_ON(lockres->l_level < DLM_LOCK_PR);
+        if (ocfs2_dlm_lvb_valid(&lockres->l_lksb)) {
+                lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
+                memcpy(val, lvb, len);
+        } else
+                ret = 0;
 
         spin_unlock(&lockres->l_lock);
+        return ret;
 }
 
 void user_dlm_lock_res_init(struct user_lock_res *lockres,
@@ -576,9 +590,9 @@ void user_dlm_lock_res_init(struct user_lock_res *lockres,
 
         spin_lock_init(&lockres->l_lock);
         init_waitqueue_head(&lockres->l_event);
-        lockres->l_level = LKM_IVMODE;
-        lockres->l_requested = LKM_IVMODE;
-        lockres->l_blocking = LKM_IVMODE;
+        lockres->l_level = DLM_LOCK_IV;
+        lockres->l_requested = DLM_LOCK_IV;
+        lockres->l_blocking = DLM_LOCK_IV;
 
         /* should have been checked before getting here. */
         BUG_ON(dentry->d_name.len >= USER_DLM_LOCK_ID_MAX_LEN);
@@ -592,9 +606,10 @@ void user_dlm_lock_res_init(struct user_lock_res *lockres,
 int user_dlm_destroy_lock(struct user_lock_res *lockres)
 {
         int status = -EBUSY;
-        struct dlm_ctxt *dlm = dlm_ctxt_from_user_lockres(lockres);
+        struct ocfs2_cluster_connection *conn =
+                cluster_connection_from_user_lockres(lockres);
 
-        mlog(0, "asked to destroy %.*s\n", lockres->l_namelen, lockres->l_name);
+        mlog(ML_BASTS, "lockres %.*s\n", lockres->l_namelen, lockres->l_name);
 
         spin_lock(&lockres->l_lock);
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
@@ -627,14 +642,9 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
         lockres->l_flags |= USER_LOCK_BUSY;
         spin_unlock(&lockres->l_lock);
 
-        status = dlmunlock(dlm,
-                           &lockres->l_lksb,
-                           LKM_VALBLK,
-                           user_unlock_ast,
-                           lockres);
-        if (status != DLM_NORMAL) {
-                user_log_dlm_error("dlmunlock", status, lockres);
-                status = -EINVAL;
+        status = ocfs2_dlm_unlock(conn, &lockres->l_lksb, DLM_LKF_VALBLK);
+        if (status) {
+                user_log_dlm_error("ocfs2_dlm_unlock", status, lockres);
                 goto bail;
         }
 
@@ -645,32 +655,34 @@ bail:
         return status;
 }
 
-struct dlm_ctxt *user_dlm_register_context(struct qstr *name,
-                                           struct dlm_protocol_version *proto)
+static void user_dlm_recovery_handler_noop(int node_num,
+                                           void *recovery_data)
 {
-        struct dlm_ctxt *dlm;
-        u32 dlm_key;
-        char *domain;
-
-        domain = kmalloc(name->len + 1, GFP_NOFS);
-        if (!domain) {
-                mlog_errno(-ENOMEM);
-                return ERR_PTR(-ENOMEM);
-        }
+        /* We ignore recovery events */
+        return;
+}
 
-        dlm_key = crc32_le(0, name->name, name->len);
+void user_dlm_set_locking_protocol(void)
+{
+        ocfs2_stack_glue_set_max_proto_version(&user_dlm_lproto.lp_max_version);
+}
 
-        snprintf(domain, name->len + 1, "%.*s", name->len, name->name);
+struct ocfs2_cluster_connection *user_dlm_register(struct qstr *name)
+{
+        int rc;
+        struct ocfs2_cluster_connection *conn;
 
-        dlm = dlm_register_domain(domain, dlm_key, proto);
-        if (IS_ERR(dlm))
-                mlog_errno(PTR_ERR(dlm));
+        rc = ocfs2_cluster_connect_agnostic(name->name, name->len,
+                                            &user_dlm_lproto,
+                                            user_dlm_recovery_handler_noop,
+                                            NULL, &conn);
+        if (rc)
+                mlog_errno(rc);
 
-        kfree(domain);
-        return dlm;
+        return rc ? ERR_PTR(rc) : conn;
 }
 
-void user_dlm_unregister_context(struct dlm_ctxt *dlm)
+void user_dlm_unregister(struct ocfs2_cluster_connection *conn)
 {
-        dlm_unregister_domain(dlm);
+        ocfs2_cluster_disconnect(conn, 0);
 }
diff --git a/fs/ocfs2/dlm/userdlm.h b/fs/ocfs2/dlmfs/userdlm.h
index 0c3cc03c61fa..3b42d79531d7 100644
--- a/fs/ocfs2/dlm/userdlm.h
+++ b/fs/ocfs2/dlmfs/userdlm.h
@@ -57,7 +57,7 @@ struct user_lock_res {
         int                      l_level;
         unsigned int             l_ro_holders;
         unsigned int             l_ex_holders;
-        struct dlm_lockstatus    l_lksb;
+        struct ocfs2_dlm_lksb    l_lksb;
 
         int                      l_requested;
         int                      l_blocking;
@@ -80,15 +80,15 @@ void user_dlm_cluster_unlock(struct user_lock_res *lockres,
 void user_dlm_write_lvb(struct inode *inode,
                         const char *val,
                         unsigned int len);
-void user_dlm_read_lvb(struct inode *inode,
-                       char *val,
-                       unsigned int len);
-struct dlm_ctxt *user_dlm_register_context(struct qstr *name,
-                                           struct dlm_protocol_version *proto);
-void user_dlm_unregister_context(struct dlm_ctxt *dlm);
+ssize_t user_dlm_read_lvb(struct inode *inode,
+                          char *val,
+                          unsigned int len);
+struct ocfs2_cluster_connection *user_dlm_register(struct qstr *name);
+void user_dlm_unregister(struct ocfs2_cluster_connection *conn);
+void user_dlm_set_locking_protocol(void);
 
 struct dlmfs_inode_private {
-        struct dlm_ctxt             *ip_dlm;
+        struct ocfs2_cluster_connection *ip_conn;
 
         struct user_lock_res ip_lockres; /* unused for directories. */
         struct inode         *ip_parent;
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index c5e4a49e3a12..50c4ee805da4 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -297,6 +297,11 @@ static inline int ocfs2_is_inode_lock(struct ocfs2_lock_res *lockres)
                 lockres->l_type == OCFS2_LOCK_TYPE_OPEN;
 }
 
+static inline struct ocfs2_lock_res *ocfs2_lksb_to_lock_res(struct ocfs2_dlm_lksb *lksb)
+{
+        return container_of(lksb, struct ocfs2_lock_res, l_lksb);
+}
+
 static inline struct inode *ocfs2_lock_res_inode(struct ocfs2_lock_res *lockres)
 {
         BUG_ON(!ocfs2_is_inode_lock(lockres));
@@ -875,6 +880,14 @@ static inline void ocfs2_generic_handle_convert_action(struct ocfs2_lock_res *lo
                 lockres_or_flags(lockres, OCFS2_LOCK_NEEDS_REFRESH);
 
         lockres->l_level = lockres->l_requested;
+
+        /*
+         * We set the OCFS2_LOCK_UPCONVERT_FINISHING flag before clearing
+         * the OCFS2_LOCK_BUSY flag to prevent the dc thread from
+         * downconverting the lock before the upconvert has fully completed.
+         */
+        lockres_or_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
+
         lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
 
         mlog_exit_void();
@@ -907,8 +920,6 @@ static int ocfs2_generic_handle_bast(struct ocfs2_lock_res *lockres,
 
         assert_spin_locked(&lockres->l_lock);
 
-        lockres_or_flags(lockres, OCFS2_LOCK_BLOCKED);
-
         if (level > lockres->l_blocking) {
                 /* only schedule a downconvert if we haven't already scheduled
                  * one that goes low enough to satisfy the level we're
@@ -921,6 +932,13 @@ static int ocfs2_generic_handle_bast(struct ocfs2_lock_res *lockres,
                 lockres->l_blocking = level;
         }
 
+        mlog(ML_BASTS, "lockres %s, block %d, level %d, l_block %d, dwn %d\n",
+             lockres->l_name, level, lockres->l_level, lockres->l_blocking,
+             needs_downconvert);
+
+        if (needs_downconvert)
+                lockres_or_flags(lockres, OCFS2_LOCK_BLOCKED);
+
         mlog_exit(needs_downconvert);
         return needs_downconvert;
 }
@@ -1031,18 +1049,17 @@ static unsigned int lockres_set_pending(struct ocfs2_lock_res *lockres)
         return lockres->l_pending_gen;
 }
 
-
-static void ocfs2_blocking_ast(void *opaque, int level)
+static void ocfs2_blocking_ast(struct ocfs2_dlm_lksb *lksb, int level)
 {
-        struct ocfs2_lock_res *lockres = opaque;
+        struct ocfs2_lock_res *lockres = ocfs2_lksb_to_lock_res(lksb);
         struct ocfs2_super *osb = ocfs2_get_lockres_osb(lockres);
         int needs_downconvert;
         unsigned long flags;
 
         BUG_ON(level <= DLM_LOCK_NL);
 
-        mlog(0, "BAST fired for lockres %s, blocking %d, level %d type %s\n",
-             lockres->l_name, level, lockres->l_level,
+        mlog(ML_BASTS, "BAST fired for lockres %s, blocking %d, level %d, "
+             "type %s\n", lockres->l_name, level, lockres->l_level,
              ocfs2_lock_type_string(lockres->l_type));
 
         /*
@@ -1063,9 +1080,9 @@ static void ocfs2_blocking_ast(void *opaque, int level)
         ocfs2_wake_downconvert_thread(osb);
 }
 
-static void ocfs2_locking_ast(void *opaque)
+static void ocfs2_locking_ast(struct ocfs2_dlm_lksb *lksb)
 {
-        struct ocfs2_lock_res *lockres = opaque;
+        struct ocfs2_lock_res *lockres = ocfs2_lksb_to_lock_res(lksb);
         struct ocfs2_super *osb = ocfs2_get_lockres_osb(lockres);
         unsigned long flags;
         int status;
@@ -1086,6 +1103,10 @@ static void ocfs2_locking_ast(void *opaque)
                 return;
         }
 
+        mlog(ML_BASTS, "AST fired for lockres %s, action %d, unlock %d, "
+             "level %d => %d\n", lockres->l_name, lockres->l_action,
+             lockres->l_unlock_action, lockres->l_level, lockres->l_requested);
+
         switch(lockres->l_action) {
         case OCFS2_AST_ATTACH:
                 ocfs2_generic_handle_attach_action(lockres);
@@ -1098,8 +1119,8 @@ static void ocfs2_locking_ast(void *opaque)
                 ocfs2_generic_handle_downconvert_action(lockres);
                 break;
         default:
-                mlog(ML_ERROR, "lockres %s: ast fired with invalid action: %u "
-                     "lockres flags = 0x%lx, unlock action: %u\n",
+                mlog(ML_ERROR, "lockres %s: AST fired with invalid action: %u, "
+                     "flags 0x%lx, unlock: %u\n",
                      lockres->l_name, lockres->l_action, lockres->l_flags,
                      lockres->l_unlock_action);
                 BUG();
@@ -1125,6 +1146,88 @@ out:
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 }
 
+static void ocfs2_unlock_ast(struct ocfs2_dlm_lksb *lksb, int error)
+{
+        struct ocfs2_lock_res *lockres = ocfs2_lksb_to_lock_res(lksb);
+        unsigned long flags;
+
+        mlog_entry_void();
+
+        mlog(ML_BASTS, "UNLOCK AST fired for lockres %s, action = %d\n",
+             lockres->l_name, lockres->l_unlock_action);
+
+        spin_lock_irqsave(&lockres->l_lock, flags);
+        if (error) {
+                mlog(ML_ERROR, "Dlm passes error %d for lock %s, "
+                     "unlock_action %d\n", error, lockres->l_name,
+                     lockres->l_unlock_action);
+                spin_unlock_irqrestore(&lockres->l_lock, flags);
+                mlog_exit_void();
+                return;
+        }
+
+        switch(lockres->l_unlock_action) {
+        case OCFS2_UNLOCK_CANCEL_CONVERT:
+                mlog(0, "Cancel convert success for %s\n", lockres->l_name);
+                lockres->l_action = OCFS2_AST_INVALID;
+                /* Downconvert thread may have requeued this lock, we
+                 * need to wake it. */
+                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
+                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
+                break;
+        case OCFS2_UNLOCK_DROP_LOCK:
+                lockres->l_level = DLM_LOCK_IV;
+                break;
+        default:
+                BUG();
+        }
+
+        lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
+        lockres->l_unlock_action = OCFS2_UNLOCK_INVALID;
+        wake_up(&lockres->l_event);
+        spin_unlock_irqrestore(&lockres->l_lock, flags);
+
+        mlog_exit_void();
+}
+
+/*
+ * This is the filesystem locking protocol.  It provides the lock handling
+ * hooks for the underlying DLM.  It has a maximum version number.
+ * The version number allows interoperability with systems running at
+ * the same major number and an equal or smaller minor number.
+ *
+ * Whenever the filesystem does new things with locks (adds or removes a
+ * lock, orders them differently, does different things underneath a lock),
+ * the version must be changed.  The protocol is negotiated when joining
+ * the dlm domain.  A node may join the domain if its major version is
+ * identical to all other nodes and its minor version is greater than
+ * or equal to all other nodes.  When its minor version is greater than
+ * the other nodes, it will run at the minor version specified by the
+ * other nodes.
+ *
+ * If a locking change is made that will not be compatible with older
+ * versions, the major number must be increased and the minor version set
+ * to zero.  If a change merely adds a behavior that can be disabled when
+ * speaking to older versions, the minor version must be increased.  If a
+ * change adds a fully backwards compatible change (eg, LVB changes that
+ * are just ignored by older versions), the version does not need to be
+ * updated.
+ */
+static struct ocfs2_locking_protocol lproto = {
+        .lp_max_version = {
+                .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
+                .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
+        },
+        .lp_lock_ast            = ocfs2_locking_ast,
+        .lp_blocking_ast        = ocfs2_blocking_ast,
+        .lp_unlock_ast          = ocfs2_unlock_ast,
+};
+
+void ocfs2_set_locking_protocol(void)
+{
+        ocfs2_stack_glue_set_max_proto_version(&lproto.lp_max_version);
+}
+
 static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
                                                 int convert)
 {
@@ -1133,6 +1236,7 @@ static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
         mlog_entry_void();
         spin_lock_irqsave(&lockres->l_lock, flags);
         lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
+        lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
         if (convert)
                 lockres->l_action = OCFS2_AST_INVALID;
         else
@@ -1179,8 +1283,7 @@ static int ocfs2_lock_create(struct ocfs2_super *osb,
                              &lockres->l_lksb,
                              dlm_flags,
                              lockres->l_name,
-                             OCFS2_LOCK_ID_MAX_LEN - 1,
-                             lockres);
+                             OCFS2_LOCK_ID_MAX_LEN - 1);
         lockres_clear_pending(lockres, gen, osb);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_lock", ret, lockres);
@@ -1323,13 +1426,13 @@ static int __ocfs2_cluster_lock(struct ocfs2_super *osb,
 again:
         wait = 0;
 
+        spin_lock_irqsave(&lockres->l_lock, flags);
+
         if (catch_signals && signal_pending(current)) {
                 ret = -ERESTARTSYS;
-                goto out;
+                goto unlock;
         }
 
-        spin_lock_irqsave(&lockres->l_lock, flags);
-
         mlog_bug_on_msg(lockres->l_flags & OCFS2_LOCK_FREEING,
                         "Cluster lock called on freeing lockres %s! flags "
                         "0x%lx\n", lockres->l_name, lockres->l_flags);
@@ -1346,6 +1449,25 @@ again:
                 goto unlock;
         }
 
+        if (lockres->l_flags & OCFS2_LOCK_UPCONVERT_FINISHING) {
+                /*
+                 * We've upconverted. If the lock now has a level we can
+                 * work with, we take it. If, however, the lock is not at the
+                 * required level, we go thru the full cycle. One way this could
+                 * happen is if a process requesting an upconvert to PR is
+                 * closely followed by another requesting upconvert to an EX.
+                 * If the process requesting EX lands here, we want it to
+                 * continue attempting to upconvert and let the process
+                 * requesting PR take the lock.
+                 * If multiple processes request upconvert to PR, the first one
+                 * here will take the lock. The others will have to go thru the
+                 * OCFS2_LOCK_BLOCKED check to ensure that there is no pending
+                 * downconvert request.
+                 */
+                if (level <= lockres->l_level)
+                        goto update_holders;
+        }
+
         if (lockres->l_flags & OCFS2_LOCK_BLOCKED &&
             !ocfs2_may_continue_on_blocked_lock(lockres, level)) {
                 /* is the lock is currently blocked on behalf of
@@ -1383,7 +1505,7 @@ again:
                 BUG_ON(level == DLM_LOCK_IV);
                 BUG_ON(level == DLM_LOCK_NL);
 
-                mlog(0, "lock %s, convert from %d to level = %d\n",
+                mlog(ML_BASTS, "lockres %s, convert from %d to %d\n",
                      lockres->l_name, lockres->l_level, level);
 
                 /* call dlm_lock to upgrade lock now */
@@ -1392,8 +1514,7 @@ again:
                                      &lockres->l_lksb,
                                      lkm_flags,
                                      lockres->l_name,
-                                     OCFS2_LOCK_ID_MAX_LEN - 1,
-                                     lockres);
+                                     OCFS2_LOCK_ID_MAX_LEN - 1);
                 lockres_clear_pending(lockres, gen, osb);
                 if (ret) {
                         if (!(lkm_flags & DLM_LKF_NOQUEUE) ||
@@ -1416,11 +1537,14 @@ again:
                 goto again;
         }
 
+update_holders:
         /* Ok, if we get here then we're good to go. */
         ocfs2_inc_holders(lockres, level);
 
         ret = 0;
 unlock:
+        lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
+
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 out:
         /*
@@ -1757,7 +1881,7 @@ out:
  * ocfs2_file_lock() and ocfs2_file_unlock() map to a single pair of
  * flock() calls. The locking approach this requires is sufficiently
  * different from all other cluster lock types that we implement a
- * seperate path to the "low-level" dlm calls. In particular:
+ * separate path to the "low-level" dlm calls. In particular:
  *
  * - No optimization of lock levels is done - we take at exactly
  *   what's been requested.
@@ -1827,8 +1951,7 @@ int ocfs2_file_lock(struct file *file, int ex, int trylock)
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 
         ret = ocfs2_dlm_lock(osb->cconn, level, &lockres->l_lksb, lkm_flags,
-                             lockres->l_name, OCFS2_LOCK_ID_MAX_LEN - 1,
-                             lockres);
+                             lockres->l_name, OCFS2_LOCK_ID_MAX_LEN - 1);
         if (ret) {
                 if (!trylock || (ret != -EAGAIN)) {
                         ocfs2_log_dlm_error("ocfs2_dlm_lock", ret, lockres);
@@ -2957,7 +3080,7 @@ int ocfs2_dlm_init(struct ocfs2_super *osb)
         status = ocfs2_cluster_connect(osb->osb_cluster_stack,
                                        osb->uuid_str,
                                        strlen(osb->uuid_str),
-                                       ocfs2_do_node_down, osb,
+                                       &lproto, ocfs2_do_node_down, osb,
                                        &conn);
         if (status) {
                 mlog_errno(status);
@@ -3024,50 +3147,6 @@ void ocfs2_dlm_shutdown(struct ocfs2_super *osb,
         mlog_exit_void();
 }
 
-static void ocfs2_unlock_ast(void *opaque, int error)
-{
-        struct ocfs2_lock_res *lockres = opaque;
-        unsigned long flags;
-
-        mlog_entry_void();
-
-        mlog(0, "UNLOCK AST called on lock %s, action = %d\n", lockres->l_name,
-             lockres->l_unlock_action);
-
-        spin_lock_irqsave(&lockres->l_lock, flags);
-        if (error) {
-                mlog(ML_ERROR, "Dlm passes error %d for lock %s, "
-                     "unlock_action %d\n", error, lockres->l_name,
-                     lockres->l_unlock_action);
-                spin_unlock_irqrestore(&lockres->l_lock, flags);
-                mlog_exit_void();
-                return;
-        }
-
-        switch(lockres->l_unlock_action) {
-        case OCFS2_UNLOCK_CANCEL_CONVERT:
-                mlog(0, "Cancel convert success for %s\n", lockres->l_name);
-                lockres->l_action = OCFS2_AST_INVALID;
-                /* Downconvert thread may have requeued this lock, we
-                 * need to wake it. */
-                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
-                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
-                break;
-        case OCFS2_UNLOCK_DROP_LOCK:
-                lockres->l_level = DLM_LOCK_IV;
-                break;
-        default:
-                BUG();
-        }
-
-        lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
-        lockres->l_unlock_action = OCFS2_UNLOCK_INVALID;
-        wake_up(&lockres->l_event);
-        spin_unlock_irqrestore(&lockres->l_lock, flags);
-
-        mlog_exit_void();
-}
-
 static int ocfs2_drop_lock(struct ocfs2_super *osb,
                            struct ocfs2_lock_res *lockres)
 {
@@ -3135,8 +3214,7 @@ static int ocfs2_drop_lock(struct ocfs2_super *osb,
 
         mlog(0, "lock %s\n", lockres->l_name);
 
-        ret = ocfs2_dlm_unlock(osb->cconn, &lockres->l_lksb, lkm_flags,
-                               lockres);
+        ret = ocfs2_dlm_unlock(osb->cconn, &lockres->l_lksb, lkm_flags);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_unlock", ret, lockres);
                 mlog(ML_ERROR, "lockres flags: %lu\n", lockres->l_flags);
@@ -3155,7 +3233,7 @@ out:
 /* Mark the lockres as being dropped. It will no longer be
  * queued if blocking, but we still may have to wait on it
  * being dequeued from the downconvert thread before we can consider
- * it safe to drop. 
+ * it safe to drop.
  *
  * You can *not* attempt to call cluster_lock on this lockres anymore. */
 void ocfs2_mark_lockres_freeing(struct ocfs2_lock_res *lockres)
@@ -3244,13 +3322,20 @@ static unsigned int ocfs2_prepare_downconvert(struct ocfs2_lock_res *lockres,
         BUG_ON(lockres->l_blocking <= DLM_LOCK_NL);
 
         if (lockres->l_level <= new_level) {
-                mlog(ML_ERROR, "lockres->l_level (%d) <= new_level (%d)\n",
-                     lockres->l_level, new_level);
+                mlog(ML_ERROR, "lockres %s, lvl %d <= %d, blcklst %d, mask %d, "
+                     "type %d, flags 0x%lx, hold %d %d, act %d %d, req %d, "
+                     "block %d, pgen %d\n", lockres->l_name, lockres->l_level,
+                     new_level, list_empty(&lockres->l_blocked_list),
+                     list_empty(&lockres->l_mask_waiters), lockres->l_type,
+                     lockres->l_flags, lockres->l_ro_holders,
+                     lockres->l_ex_holders, lockres->l_action,
+                     lockres->l_unlock_action, lockres->l_requested,
+                     lockres->l_blocking, lockres->l_pending_gen);
                 BUG();
         }
 
-        mlog(0, "lock %s, new_level = %d, l_blocking = %d\n",
-             lockres->l_name, new_level, lockres->l_blocking);
+        mlog(ML_BASTS, "lockres %s, level %d => %d, blocking %d\n",
+             lockres->l_name, lockres->l_level, new_level, lockres->l_blocking);
 
         lockres->l_action = OCFS2_AST_DOWNCONVERT;
         lockres->l_requested = new_level;
@@ -3269,6 +3354,9 @@ static int ocfs2_downconvert_lock(struct ocfs2_super *osb,
 
         mlog_entry_void();
 
+        mlog(ML_BASTS, "lockres %s, level %d => %d\n", lockres->l_name,
+             lockres->l_level, new_level);
+
         if (lvb)
                 dlm_flags |= DLM_LKF_VALBLK;
 
@@ -3277,8 +3365,7 @@ static int ocfs2_downconvert_lock(struct ocfs2_super *osb,
                              &lockres->l_lksb,
                              dlm_flags,
                              lockres->l_name,
-                             OCFS2_LOCK_ID_MAX_LEN - 1,
-                             lockres);
+                             OCFS2_LOCK_ID_MAX_LEN - 1);
         lockres_clear_pending(lockres, generation, osb);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_lock", ret, lockres);
@@ -3299,14 +3386,12 @@ static int ocfs2_prepare_cancel_convert(struct ocfs2_super *osb,
         assert_spin_locked(&lockres->l_lock);
 
         mlog_entry_void();
-        mlog(0, "lock %s\n", lockres->l_name);
 
         if (lockres->l_unlock_action == OCFS2_UNLOCK_CANCEL_CONVERT) {
                 /* If we're already trying to cancel a lock conversion
                  * then just drop the spinlock and allow the caller to
                  * requeue this lock. */
-
-                mlog(0, "Lockres %s, skip convert\n", lockres->l_name);
+                mlog(ML_BASTS, "lockres %s, skip convert\n", lockres->l_name);
                 return 0;
         }
 
@@ -3321,6 +3406,8 @@ static int ocfs2_prepare_cancel_convert(struct ocfs2_super *osb,
                         "lock %s, invalid flags: 0x%lx\n",
                         lockres->l_name, lockres->l_flags);
 
+        mlog(ML_BASTS, "lockres %s\n", lockres->l_name);
+
         return 1;
 }
 
@@ -3330,16 +3417,15 @@ static int ocfs2_cancel_convert(struct ocfs2_super *osb,
         int ret;
 
         mlog_entry_void();
-        mlog(0, "lock %s\n", lockres->l_name);
 
         ret = ocfs2_dlm_unlock(osb->cconn, &lockres->l_lksb,
-                               DLM_LKF_CANCEL, lockres);
+                               DLM_LKF_CANCEL);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_unlock", ret, lockres);
                 ocfs2_recover_from_dlm_error(lockres, 0);
         }
 
-        mlog(0, "lock %s return from ocfs2_dlm_unlock\n", lockres->l_name);
+        mlog(ML_BASTS, "lockres %s\n", lockres->l_name);
 
         mlog_exit(ret);
         return ret;
@@ -3352,6 +3438,7 @@ static int ocfs2_unblock_lock(struct ocfs2_super *osb,
         unsigned long flags;
         int blocking;
         int new_level;
+        int level;
         int ret = 0;
         int set_lvb = 0;
         unsigned int gen;
@@ -3360,9 +3447,17 @@ static int ocfs2_unblock_lock(struct ocfs2_super *osb,
 
         spin_lock_irqsave(&lockres->l_lock, flags);
 
-        BUG_ON(!(lockres->l_flags & OCFS2_LOCK_BLOCKED));
-
 recheck:
+        /*
+         * Is it still blocking? If not, we have no more work to do.
+         */
+        if (!(lockres->l_flags & OCFS2_LOCK_BLOCKED)) {
+                BUG_ON(lockres->l_blocking != DLM_LOCK_NL);
+                spin_unlock_irqrestore(&lockres->l_lock, flags);
+                ret = 0;
+                goto leave;
+        }
+
         if (lockres->l_flags & OCFS2_LOCK_BUSY) {
                 /* XXX
                  * This is a *big* race.  The OCFS2_LOCK_PENDING flag
@@ -3387,8 +3482,11 @@ recheck:
                  * at the same time they set OCFS2_DLM_BUSY.  They must
                  * clear OCFS2_DLM_PENDING after dlm_lock() returns.
                  */
-                if (lockres->l_flags & OCFS2_LOCK_PENDING)
+                if (lockres->l_flags & OCFS2_LOCK_PENDING) {
+                        mlog(ML_BASTS, "lockres %s, ReQ: Pending\n",
+                             lockres->l_name);
                         goto leave_requeue;
+                }
 
                 ctl->requeue = 1;
                 ret = ocfs2_prepare_cancel_convert(osb, lockres);
@@ -3401,31 +3499,70 @@ recheck:
                 goto leave;
         }
 
+        /*
+         * This prevents livelocks. OCFS2_LOCK_UPCONVERT_FINISHING flag is
+         * set when the ast is received for an upconvert just before the
+         * OCFS2_LOCK_BUSY flag is cleared. Now if the fs received a bast
+         * on the heels of the ast, we want to delay the downconvert just
+         * enough to allow the up requestor to do its task. Because this
+         * lock is in the blocked queue, the lock will be downconverted
+         * as soon as the requestor is done with the lock.
+         */
+        if (lockres->l_flags & OCFS2_LOCK_UPCONVERT_FINISHING)
+                goto leave_requeue;
+
+        /*
+         * How can we block and yet be at NL?  We were trying to upconvert
+         * from NL and got canceled.  The code comes back here, and now
+         * we notice and clear BLOCKING.
+         */
+        if (lockres->l_level == DLM_LOCK_NL) {
+                BUG_ON(lockres->l_ex_holders || lockres->l_ro_holders);
+                mlog(ML_BASTS, "lockres %s, Aborting dc\n", lockres->l_name);
+                lockres->l_blocking = DLM_LOCK_NL;
+                lockres_clear_flags(lockres, OCFS2_LOCK_BLOCKED);
+                spin_unlock_irqrestore(&lockres->l_lock, flags);
+                goto leave;
+        }
+
         /* if we're blocking an exclusive and we have *any* holders,
          * then requeue. */
         if ((lockres->l_blocking == DLM_LOCK_EX)
-            && (lockres->l_ex_holders || lockres->l_ro_holders))
+            && (lockres->l_ex_holders || lockres->l_ro_holders)) {
+                mlog(ML_BASTS, "lockres %s, ReQ: EX/PR Holders %u,%u\n",
+                     lockres->l_name, lockres->l_ex_holders,
+                     lockres->l_ro_holders);
                 goto leave_requeue;
+        }
 
         /* If it's a PR we're blocking, then only
          * requeue if we've got any EX holders */
         if (lockres->l_blocking == DLM_LOCK_PR &&
-            lockres->l_ex_holders)
+            lockres->l_ex_holders) {
+                mlog(ML_BASTS, "lockres %s, ReQ: EX Holders %u\n",
+                     lockres->l_name, lockres->l_ex_holders);
                 goto leave_requeue;
+        }
 
         /*
          * Can we get a lock in this state if the holder counts are
          * zero? The meta data unblock code used to check this.
          */
         if ((lockres->l_ops->flags & LOCK_TYPE_REQUIRES_REFRESH)
-            && (lockres->l_flags & OCFS2_LOCK_REFRESHING))
+            && (lockres->l_flags & OCFS2_LOCK_REFRESHING)) {
+                mlog(ML_BASTS, "lockres %s, ReQ: Lock Refreshing\n",
+                     lockres->l_name);
                 goto leave_requeue;
+        }
 
         new_level = ocfs2_highest_compat_lock_level(lockres->l_blocking);
 
         if (lockres->l_ops->check_downconvert
-            && !lockres->l_ops->check_downconvert(lockres, new_level))
+            && !lockres->l_ops->check_downconvert(lockres, new_level)) {
+                mlog(ML_BASTS, "lockres %s, ReQ: Checkpointing\n",
+                     lockres->l_name);
                 goto leave_requeue;
+        }
 
         /* If we get here, then we know that there are no more
          * incompatible holders (and anyone asking for an incompatible
@@ -3438,17 +3575,24 @@ recheck:
          * may sleep, so we save off a copy of what we're blocking as
          * it may change while we're not holding the spin lock. */
         blocking = lockres->l_blocking;
+        level = lockres->l_level;
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 
         ctl->unblock_action = lockres->l_ops->downconvert_worker(lockres, blocking);
 
-        if (ctl->unblock_action == UNBLOCK_STOP_POST)
+        if (ctl->unblock_action == UNBLOCK_STOP_POST) {
+                mlog(ML_BASTS, "lockres %s, UNBLOCK_STOP_POST\n",
+                     lockres->l_name);
                 goto leave;
+        }
 
         spin_lock_irqsave(&lockres->l_lock, flags);
-        if (blocking != lockres->l_blocking) {
+        if ((blocking != lockres->l_blocking) || (level != lockres->l_level)) {
                 /* If this changed underneath us, then we can't drop
                  * it just yet. */
+                mlog(ML_BASTS, "lockres %s, block=%d:%d, level=%d:%d, "
+                     "Recheck\n", lockres->l_name, blocking,
+                     lockres->l_blocking, level, lockres->l_level);
                 goto recheck;
         }
 
@@ -3843,45 +3987,6 @@ void ocfs2_refcount_unlock(struct ocfs2_refcount_tree *ref_tree, int ex)
                 ocfs2_cluster_unlock(osb, lockres, level);
 }
 
-/*
- * This is the filesystem locking protocol.  It provides the lock handling
- * hooks for the underlying DLM.  It has a maximum version number.
- * The version number allows interoperability with systems running at
- * the same major number and an equal or smaller minor number.
- *
- * Whenever the filesystem does new things with locks (adds or removes a
- * lock, orders them differently, does different things underneath a lock),
- * the version must be changed.  The protocol is negotiated when joining
- * the dlm domain.  A node may join the domain if its major version is
- * identical to all other nodes and its minor version is greater than
- * or equal to all other nodes.  When its minor version is greater than
- * the other nodes, it will run at the minor version specified by the
- * other nodes.
- *
- * If a locking change is made that will not be compatible with older
- * versions, the major number must be increased and the minor version set
- * to zero.  If a change merely adds a behavior that can be disabled when
- * speaking to older versions, the minor version must be increased.  If a
- * change adds a fully backwards compatible change (eg, LVB changes that
- * are just ignored by older versions), the version does not need to be
- * updated.
- */
-static struct ocfs2_locking_protocol lproto = {
-        .lp_max_version = {
-                .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
-                .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
-        },
-        .lp_lock_ast            = ocfs2_locking_ast,
-        .lp_blocking_ast        = ocfs2_blocking_ast,
-        .lp_unlock_ast          = ocfs2_unlock_ast,
-};
-
-void ocfs2_set_locking_protocol(void)
-{
-        ocfs2_stack_glue_set_locking_protocol(&lproto);
-}
-
-
 static void ocfs2_process_blocked_lock(struct ocfs2_super *osb,
                                        struct ocfs2_lock_res *lockres)
 {
@@ -3898,7 +4003,7 @@ static void ocfs2_process_blocked_lock(struct ocfs2_super *osb,
         BUG_ON(!lockres);
         BUG_ON(!lockres->l_ops);
 
-        mlog(0, "lockres %s blocked.\n", lockres->l_name);
+        mlog(ML_BASTS, "lockres %s blocked\n", lockres->l_name);
 
         /* Detect whether a lock has been marked as going away while
          * the downconvert thread was processing other things. A lock can
@@ -3921,7 +4026,7 @@ unqueue:
         } else
                 ocfs2_schedule_blocked_lock(osb, lockres);
 
-        mlog(0, "lockres %s, requeue = %s.\n", lockres->l_name,
+        mlog(ML_BASTS, "lockres %s, requeue = %s.\n", lockres->l_name,
              ctl.requeue ? "yes" : "no");
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 
@@ -3943,7 +4048,7 @@ static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
                 /* Do not schedule a lock for downconvert when it's on
                  * the way to destruction - any nodes wanting access
                  * to the resource will get it soon. */
-                mlog(0, "Lockres %s won't be scheduled: flags 0x%lx\n",
+                mlog(ML_BASTS, "lockres %s won't be scheduled: flags 0x%lx\n",
                      lockres->l_name, lockres->l_flags);
                 return;
         }
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 15713cbb865c..19ad145d2af3 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -239,7 +239,7 @@ static int ocfs2_encode_fh(struct dentry *dentry, u32 *fh_in, int *max_len,
                 mlog(0, "Encoding parent: blkno: %llu, generation: %u\n",
                      (unsigned long long)blkno, generation);
         }
-        
+
         *max_len = len;
 
 bail:
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index d35a27f4523e..09e3fdfa6d33 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -24,6 +24,7 @@
 
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/fiemap.h>
 
@@ -192,7 +193,7 @@ static int ocfs2_try_to_merge_extent_map(struct ocfs2_extent_map_item *emi,
                 emi->ei_clusters += ins->ei_clusters;
                 return 1;
         } else if ((ins->ei_phys + ins->ei_clusters) == emi->ei_phys &&
-                   (ins->ei_cpos + ins->ei_clusters) == emi->ei_phys &&
+                   (ins->ei_cpos + ins->ei_clusters) == emi->ei_cpos &&
                    ins->ei_flags == emi->ei_flags) {
                 emi->ei_phys = ins->ei_phys;
                 emi->ei_cpos = ins->ei_cpos;
@@ -453,7 +454,7 @@ static int ocfs2_get_clusters_nocache(struct inode *inode,
         if (i == -1) {
                 /*
                  * Holes can be larger than the maximum size of an
-                 * extent, so we return their lengths in a seperate
+                 * extent, so we return their lengths in a separate
                  * field.
                  */
                 if (hole_len) {
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 3d30a1c974a8..17947dc8341e 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -107,6 +107,9 @@ static int ocfs2_file_open(struct inode *inode, struct file *file)
         mlog_entry("(0x%p, 0x%p, '%.*s')\n", inode, file,
                    file->f_path.dentry->d_name.len, file->f_path.dentry->d_name.name);
 
+        if (file->f_mode & FMODE_WRITE)
+                dquot_initialize(inode);
+
         spin_lock(&oi->ip_lock);
 
         /* Check that the inode hasn't been wiped from disk by another
@@ -629,11 +632,10 @@ restart_all:
         }
 
 restarted_transaction:
-        if (vfs_dq_alloc_space_nodirty(inode, ocfs2_clusters_to_bytes(osb->sb,
-            clusters_to_add))) {
-                status = -EDQUOT;
+        status = dquot_alloc_space_nodirty(inode,
+                        ocfs2_clusters_to_bytes(osb->sb, clusters_to_add));
+        if (status)
                 goto leave;
-        }
         did_quota = 1;
 
         /* reserve a write to the file entry early on - that we if we
@@ -674,7 +676,7 @@ restarted_transaction:
         clusters_to_add -= (OCFS2_I(inode)->ip_clusters - prev_clusters);
         spin_unlock(&OCFS2_I(inode)->ip_lock);
         /* Release unused quota reservation */
-        vfs_dq_free_space(inode,
+        dquot_free_space(inode,
                         ocfs2_clusters_to_bytes(osb->sb, clusters_to_add));
         did_quota = 0;
 
@@ -710,7 +712,7 @@ restarted_transaction:
 
 leave:
         if (status < 0 && did_quota)
-                vfs_dq_free_space(inode,
+                dquot_free_space(inode,
                         ocfs2_clusters_to_bytes(osb->sb, clusters_to_add));
         if (handle) {
                 ocfs2_commit_trans(osb, handle);
@@ -749,7 +751,7 @@ static int ocfs2_write_zero_page(struct inode *inode,
         int ret;
 
         offset = (size & (PAGE_CACHE_SIZE-1)); /* Within page */
-        /* ugh.  in prepare/commit_write, if from==to==start of block, we 
+        /* ugh.  in prepare/commit_write, if from==to==start of block, we
         ** skip the prepare.  make sure we never send an offset for the start
         ** of a block
         */
@@ -978,6 +980,8 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
 
         size_change = S_ISREG(inode->i_mode) && attr->ia_valid & ATTR_SIZE;
         if (size_change) {
+                dquot_initialize(inode);
+
                 status = ocfs2_rw_lock(inode, 1);
                 if (status < 0) {
                         mlog_errno(status);
@@ -993,10 +997,9 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         if (size_change && attr->ia_size != i_size_read(inode)) {
-                if (attr->ia_size > sb->s_maxbytes) {
-                        status = -EFBIG;
+                status = inode_newsize_ok(inode, attr->ia_size);
+                if (status)
                         goto bail_unlock;
-                }
 
                 if (i_size_read(inode) > attr->ia_size) {
                         if (ocfs2_should_order_data(inode)) {
@@ -1021,7 +1024,7 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
                 /*
                  * Gather pointers to quota structures so that allocation /
                  * freeing of quota structures happens here and not inside
-                 * vfs_dq_transfer() where we have problems with lock ordering
+                 * dquot_transfer() where we have problems with lock ordering
                  */
                 if (attr->ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid
                     && OCFS2_HAS_RO_COMPAT_FEATURE(sb,
@@ -1054,7 +1057,7 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
                         mlog_errno(status);
                         goto bail_unlock;
                 }
-                status = vfs_dq_transfer(inode, attr) ? -EDQUOT : 0;
+                status = dquot_transfer(inode, attr);
                 if (status < 0)
                         goto bail_commit;
         } else {
@@ -1772,13 +1775,14 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                                          loff_t *ppos,
                                          size_t count,
                                          int appending,
-                                         int *direct_io)
+                                         int *direct_io,
+                                         int *has_refcount)
 {
         int ret = 0, meta_level = 0;
         struct inode *inode = dentry->d_inode;
         loff_t saved_pos, end;
 
-        /* 
+        /*
          * We start with a read level meta lock and only jump to an ex
          * if we need to make modifications here.
          */
@@ -1833,6 +1837,10 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                                                                saved_pos,
                                                                count,
                                                                &meta_level);
+                        if (has_refcount)
+                                *has_refcount = 1;
+                        if (direct_io)
+                                *direct_io = 0;
                 }
 
                 if (ret < 0) {
@@ -1899,7 +1907,7 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                                     loff_t pos)
 {
         int ret, direct_io, appending, rw_level, have_alloc_sem  = 0;
-        int can_do_direct;
+        int can_do_direct, has_refcount = 0;
         ssize_t written = 0;
         size_t ocount;          /* original count */
         size_t count;           /* after file limit checks */
@@ -1942,7 +1950,7 @@ relock:
         can_do_direct = direct_io;
         ret = ocfs2_prepare_inode_for_write(file->f_path.dentry, ppos,
                                             iocb->ki_left, appending,
-                                            &can_do_direct);
+                                            &can_do_direct, &has_refcount);
         if (ret < 0) {
                 mlog_errno(ret);
                 goto out;
@@ -2006,14 +2014,16 @@ out_dio:
         /* buffered aio wouldn't have proper lock coverage today */
         BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
 
-        if ((file->f_flags & O_DSYNC && !direct_io) || IS_SYNC(inode)) {
+        if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+            ((file->f_flags & O_DIRECT) && has_refcount)) {
                 ret = filemap_fdatawrite_range(file->f_mapping, pos,
                                                pos + count - 1);
                 if (ret < 0)
                         written = ret;
 
                 if (!ret && (old_size != i_size_read(inode) ||
-                    old_clusters != OCFS2_I(inode)->ip_clusters)) {
+                    old_clusters != OCFS2_I(inode)->ip_clusters ||
+                    has_refcount)) {
                         ret = jbd2_journal_force_commit(osb->journal->j_journal);
                         if (ret < 0)
                                 written = ret;
@@ -2024,7 +2034,7 @@ out_dio:
                                                       pos + count - 1);
         }
 
-        /* 
+        /*
          * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
          * function pointer which is called when o_direct io completes so that
          * it can unlock our rw lock.  (it's the clustered equivalent of
@@ -2034,7 +2044,7 @@ out_dio:
          * async dio is going to do it in the future or an end_io after an
          * error has already done it.
          */
-        if (ret == -EIOCBQUEUED || !ocfs2_iocb_is_rw_locked(iocb)) {
+        if ((ret == -EIOCBQUEUED) || (!ocfs2_iocb_is_rw_locked(iocb))) {
                 rw_level = -1;
                 have_alloc_sem = 0;
         }
@@ -2062,7 +2072,7 @@ static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
         int ret;
 
         ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, &sd->pos,
-                                            sd->total_len, 0, NULL);
+                                            sd->total_len, 0, NULL, NULL);
         if (ret < 0) {
                 mlog_errno(ret);
                 return ret;
@@ -2189,7 +2199,7 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
                 goto bail;
         }
 
-        /* 
+        /*
          * buffered reads protect themselves in ->readpage().  O_DIRECT reads
          * need locks to protect pending reads from racing with truncate.
          */
@@ -2211,10 +2221,10 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
          * We're fine letting folks race truncates and extending
          * writes with read across the cluster, just like they can
          * locally. Hence no rw_lock during read.
-         * 
+         *
          * Take and drop the meta data lock to update inode fields
          * like i_size. This allows the checks down below
-         * generic_file_aio_read() a chance of actually working. 
+         * generic_file_aio_read() a chance of actually working.
          */
         ret = ocfs2_inode_lock_atime(inode, filp->f_vfsmnt, &lock_level);
         if (ret < 0) {
@@ -2239,7 +2249,7 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
 bail:
         if (have_alloc_sem)
                 up_read(&inode->i_alloc_sem);
-        if (rw_level != -1) 
+        if (rw_level != -1)
                 ocfs2_rw_unlock(inode, rw_level);
         mlog_exit(ret);
 
diff --git a/fs/ocfs2/heartbeat.c b/fs/ocfs2/heartbeat.c
index c6e7213db868..1aa863dd901f 100644
--- a/fs/ocfs2/heartbeat.c
+++ b/fs/ocfs2/heartbeat.c
@@ -26,7 +26,6 @@
 
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 
 #define MLOG_MASK_PREFIX ML_SUPER
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 0297fb8982b8..07cc8bb68b6d 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -25,7 +25,6 @@
 
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
@@ -475,7 +474,7 @@ static int ocfs2_read_locked_inode(struct inode *inode,
         if (args->fi_flags & OCFS2_FI_FLAG_ORPHAN_RECOVERY) {
                 status = ocfs2_try_open_lock(inode, 0);
                 if (status) {
-                        make_bad_inode(inode);  
+                        make_bad_inode(inode);
                         return status;
                 }
         }
@@ -665,7 +664,7 @@ static int ocfs2_remove_inode(struct inode *inode,
         }
 
         ocfs2_remove_from_cache(INODE_CACHE(inode), di_bh);
-        vfs_dq_free_inode(inode);
+        dquot_free_inode(inode);
 
         status = ocfs2_free_dinode(handle, inode_alloc_inode,
                                    inode_alloc_bh, di);
@@ -684,7 +683,7 @@ bail:
         return status;
 }
 
-/* 
+/*
  * Serialize with orphan dir recovery. If the process doing
  * recovery on this orphan dir does an iget() with the dir
  * i_mutex held, we'll deadlock here. Instead we detect this
@@ -891,6 +890,21 @@ static int ocfs2_query_inode_wipe(struct inode *inode,
         /* Do some basic inode verification... */
         di = (struct ocfs2_dinode *) di_bh->b_data;
         if (!(di->i_flags & cpu_to_le32(OCFS2_ORPHANED_FL))) {
+                /*
+                 * Inodes in the orphan dir must have ORPHANED_FL.  The only
+                 * inodes that come back out of the orphan dir are reflink
+                 * targets. A reflink target may be moved out of the orphan
+                 * dir between the time we scan the directory and the time we
+                 * process it. This would lead to HAS_REFCOUNT_FL being set but
+                 * ORPHANED_FL not.
+                 */
+                if (di->i_dyn_features & cpu_to_le16(OCFS2_HAS_REFCOUNT_FL)) {
+                        mlog(0, "Reflinked inode %llu is no longer orphaned.  "
+                             "it shouldn't be deleted\n",
+                             (unsigned long long)oi->ip_blkno);
+                        goto bail;
+                }
+
                 /* for lack of a better error? */
                 status = -EEXIST;
                 mlog(ML_ERROR,
@@ -971,6 +985,8 @@ void ocfs2_delete_inode(struct inode *inode)
                 goto bail;
         }
 
+        dquot_initialize(inode);
+
         if (!ocfs2_inode_is_valid_to_delete(inode)) {
                 /* It's probably not necessary to truncate_inode_pages
                  * here but we do it for safety anyway (it will most
@@ -1087,6 +1103,8 @@ void ocfs2_clear_inode(struct inode *inode)
         mlog_bug_on_msg(OCFS2_SB(inode->i_sb) == NULL,
                         "Inode=%lu\n", inode->i_ino);
 
+        dquot_drop(inode);
+
         /* To preven remote deletes we hold open lock before, now it
          * is time to unlock PR and EX open locks. */
         ocfs2_open_unlock(inode);
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 31fbb0619510..7d9d9c132cef 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -7,6 +7,7 @@
 
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <linux/compat.h>
 
 #define MLOG_MASK_PREFIX ML_INODE
 #include <cluster/masklog.h>
@@ -181,6 +182,10 @@ long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 #ifdef CONFIG_COMPAT
 long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 {
+        bool preserve;
+        struct reflink_arguments args;
+        struct inode *inode = file->f_path.dentry->d_inode;
+
         switch (cmd) {
         case OCFS2_IOC32_GETFLAGS:
                 cmd = OCFS2_IOC_GETFLAGS;
@@ -195,8 +200,15 @@ long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg)
         case OCFS2_IOC_GROUP_EXTEND:
         case OCFS2_IOC_GROUP_ADD:
         case OCFS2_IOC_GROUP_ADD64:
-        case OCFS2_IOC_REFLINK:
                 break;
+        case OCFS2_IOC_REFLINK:
+                if (copy_from_user(&args, (struct reflink_arguments *)arg,
+                                   sizeof(args)))
+                        return -EFAULT;
+                preserve = (args.preserve != 0);
+
+                return ocfs2_reflink_ioctl(inode, compat_ptr(args.old_path),
+                                           compat_ptr(args.new_path), preserve);
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/fs/ocfs2/ioctl.h b/fs/ocfs2/ioctl.h
index cf9a5ee30fef..0cd5323bd3f0 100644
--- a/fs/ocfs2/ioctl.h
+++ b/fs/ocfs2/ioctl.h
@@ -7,10 +7,10 @@
  *
  */
 
-#ifndef OCFS2_IOCTL_H
-#define OCFS2_IOCTL_H
+#ifndef OCFS2_IOCTL_PROTO_H
+#define OCFS2_IOCTL_PROTO_H
 
 long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
 long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg);
 
-#endif /* OCFS2_IOCTL_H */
+#endif /* OCFS2_IOCTL_PROTO_H */
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index bf34c491ae96..9336c60e3a36 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -2034,7 +2034,7 @@ static int ocfs2_queue_orphans(struct ocfs2_super *osb,
                 status = -ENOENT;
                 mlog_errno(status);
                 return status;
-        }       
+        }
 
         mutex_lock(&orphan_dir_inode->i_mutex);
         status = ocfs2_inode_lock(orphan_dir_inode, NULL, 0);
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index ac10f83edb95..c983715d8d8c 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -476,7 +476,7 @@ out_mutex:
 
 out:
         if (!status)
-                ocfs2_init_inode_steal_slot(osb);
+                ocfs2_init_steal_slots(osb);
         mlog_exit(status);
         return status;
 }
@@ -872,8 +872,10 @@ static int ocfs2_sync_local_to_main(struct ocfs2_super *osb,
                              (unsigned long long)la_start_blk,
                              (unsigned long long)blkno);
 
-                        status = ocfs2_free_clusters(handle, main_bm_inode,
-                                                     main_bm_bh, blkno, count);
+                        status = ocfs2_release_clusters(handle,
+                                                        main_bm_inode,
+                                                        main_bm_bh, blkno,
+                                                        count);
                         if (status < 0) {
                                 mlog_errno(status);
                                 goto bail;
@@ -984,8 +986,7 @@ static int ocfs2_local_alloc_reserve_for_window(struct ocfs2_super *osb,
         }
 
 retry_enospc:
-        (*ac)->ac_bits_wanted = osb->local_alloc_bits;
-
+        (*ac)->ac_bits_wanted = osb->local_alloc_default_bits;
         status = ocfs2_reserve_cluster_bitmap_bits(osb, *ac);
         if (status == -ENOSPC) {
                 if (ocfs2_recalc_la_window(osb, OCFS2_LA_EVENT_ENOSPC) ==
@@ -1061,6 +1062,7 @@ retry_enospc:
                     OCFS2_LA_DISABLED)
                         goto bail;
 
+                ac->ac_bits_wanted = osb->local_alloc_default_bits;
                 status = ocfs2_claim_clusters(osb, handle, ac,
                                               osb->local_alloc_bits,
                                               &cluster_off,
diff --git a/fs/ocfs2/locks.c b/fs/ocfs2/locks.c
index 544ac6245175..b5cb3ede9408 100644
--- a/fs/ocfs2/locks.c
+++ b/fs/ocfs2/locks.c
@@ -133,7 +133,7 @@ int ocfs2_lock(struct file *file, int cmd, struct file_lock *fl)
 
         if (!(fl->fl_flags & FL_POSIX))
                 return -ENOLCK;
-        if (__mandatory_lock(inode))
+        if (__mandatory_lock(inode) && fl->fl_type != F_UNLCK)
                 return -ENOLCK;
 
         return ocfs2_plock(osb->cconn, OCFS2_I(inode)->ip_blkno, file, cmd, fl);
diff --git a/fs/ocfs2/mmap.c b/fs/ocfs2/mmap.c
index 39737613424a..7898bd3a99f5 100644
--- a/fs/ocfs2/mmap.c
+++ b/fs/ocfs2/mmap.c
@@ -25,7 +25,6 @@
 
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
 #include <linux/uio.h>
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 50fb26a6a5f5..b1eb50ae4097 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -84,7 +84,7 @@ static int ocfs2_prepare_orphan_dir(struct ocfs2_super *osb,
 static int ocfs2_orphan_add(struct ocfs2_super *osb,
                             handle_t *handle,
                             struct inode *inode,
-                            struct ocfs2_dinode *fe,
+                            struct buffer_head *fe_bh,
                             char *name,
                             struct ocfs2_dir_lookup_result *lookup,
                             struct inode *orphan_dir_inode);
@@ -212,7 +212,7 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, int mode)
         } else
                 inode->i_gid = current_fsgid();
         inode->i_mode = mode;
-        vfs_dq_init(inode);
+        dquot_initialize(inode);
         return inode;
 }
 
@@ -244,6 +244,8 @@ static int ocfs2_mknod(struct inode *dir,
                    (unsigned long)dev, dentry->d_name.len,
                    dentry->d_name.name);
 
+        dquot_initialize(dir);
+
         /* get our super block */
         osb = OCFS2_SB(dir->i_sb);
 
@@ -348,13 +350,9 @@ static int ocfs2_mknod(struct inode *dir,
                 goto leave;
         }
 
-        /* We don't use standard VFS wrapper because we don't want vfs_dq_init
-         * to be called. */
-        if (sb_any_quota_active(osb->sb) &&
-            osb->sb->dq_op->alloc_inode(inode, 1) == NO_QUOTA) {
-                status = -EDQUOT;
+        status = dquot_alloc_inode(inode);
+        if (status)
                 goto leave;
-        }
         did_quota_inode = 1;
 
         mlog_entry("(0x%p, 0x%p, %d, %lu, '%.*s')\n", dir, dentry,
@@ -431,7 +429,7 @@ static int ocfs2_mknod(struct inode *dir,
         status = 0;
 leave:
         if (status < 0 && did_quota_inode)
-                vfs_dq_free_inode(inode);
+                dquot_free_inode(inode);
         if (handle)
                 ocfs2_commit_trans(osb, handle);
 
@@ -636,6 +634,8 @@ static int ocfs2_link(struct dentry *old_dentry,
         if (S_ISDIR(inode->i_mode))
                 return -EPERM;
 
+        dquot_initialize(dir);
+
         err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
         if (err < 0) {
                 if (err != -ENOENT)
@@ -791,6 +791,8 @@ static int ocfs2_unlink(struct inode *dir,
         mlog_entry("(0x%p, 0x%p, '%.*s')\n", dir, dentry,
                    dentry->d_name.len, dentry->d_name.name);
 
+        dquot_initialize(dir);
+
         BUG_ON(dentry->d_parent->d_inode != dir);
 
         mlog(0, "ino = %llu\n", (unsigned long long)OCFS2_I(inode)->ip_blkno);
@@ -877,7 +879,7 @@ static int ocfs2_unlink(struct inode *dir,
         fe = (struct ocfs2_dinode *) fe_bh->b_data;
 
         if (inode_is_unlinkable(inode)) {
-                status = ocfs2_orphan_add(osb, handle, inode, fe, orphan_name,
+                status = ocfs2_orphan_add(osb, handle, inode, fe_bh, orphan_name,
                                           &orphan_insert, orphan_dir);
                 if (status < 0) {
                         mlog_errno(status);
@@ -1051,6 +1053,9 @@ static int ocfs2_rename(struct inode *old_dir,
                    old_dentry->d_name.len, old_dentry->d_name.name,
                    new_dentry->d_name.len, new_dentry->d_name.name);
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         osb = OCFS2_SB(old_dir->i_sb);
 
         if (new_inode) {
@@ -1295,7 +1300,7 @@ static int ocfs2_rename(struct inode *old_dir,
                 if (S_ISDIR(new_inode->i_mode) ||
                     (ocfs2_read_links_count(newfe) == 1)) {
                         status = ocfs2_orphan_add(osb, handle, new_inode,
-                                                  newfe, orphan_name,
+                                                  newfe_bh, orphan_name,
                                                   &orphan_insert, orphan_dir);
                         if (status < 0) {
                                 mlog_errno(status);
@@ -1599,6 +1604,8 @@ static int ocfs2_symlink(struct inode *dir,
         mlog_entry("(0x%p, 0x%p, symname='%s' actual='%.*s')\n", dir,
                    dentry, symname, dentry->d_name.len, dentry->d_name.name);
 
+        dquot_initialize(dir);
+
         sb = dir->i_sb;
         osb = OCFS2_SB(sb);
 
@@ -1688,13 +1695,9 @@ static int ocfs2_symlink(struct inode *dir,
                 goto bail;
         }
 
-        /* We don't use standard VFS wrapper because we don't want vfs_dq_init
-         * to be called. */
-        if (sb_any_quota_active(osb->sb) &&
-            osb->sb->dq_op->alloc_inode(inode, 1) == NO_QUOTA) {
-                status = -EDQUOT;
+        status = dquot_alloc_inode(inode);
+        if (status)
                 goto bail;
-        }
         did_quota_inode = 1;
 
         mlog_entry("(0x%p, 0x%p, %d, '%.*s')\n", dir, dentry,
@@ -1716,11 +1719,10 @@ static int ocfs2_symlink(struct inode *dir,
                 u32 offset = 0;
 
                 inode->i_op = &ocfs2_symlink_inode_operations;
-                if (vfs_dq_alloc_space_nodirty(inode,
-                    ocfs2_clusters_to_bytes(osb->sb, 1))) {
-                        status = -EDQUOT;
+                status = dquot_alloc_space_nodirty(inode,
+                    ocfs2_clusters_to_bytes(osb->sb, 1));
+                if (status)
                         goto bail;
-                }
                 did_quota = 1;
                 status = ocfs2_add_inode_data(osb, inode, &offset, 1, 0,
                                               new_fe_bh,
@@ -1788,10 +1790,10 @@ static int ocfs2_symlink(struct inode *dir,
         d_instantiate(dentry, inode);
 bail:
         if (status < 0 && did_quota)
-                vfs_dq_free_space_nodirty(inode,
+                dquot_free_space_nodirty(inode,
                                         ocfs2_clusters_to_bytes(osb->sb, 1));
         if (status < 0 && did_quota_inode)
-                vfs_dq_free_inode(inode);
+                dquot_free_inode(inode);
         if (handle)
                 ocfs2_commit_trans(osb, handle);
 
@@ -1909,7 +1911,7 @@ leave:
 static int ocfs2_orphan_add(struct ocfs2_super *osb,
                             handle_t *handle,
                             struct inode *inode,
-                            struct ocfs2_dinode *fe,
+                            struct buffer_head *fe_bh,
                             char *name,
                             struct ocfs2_dir_lookup_result *lookup,
                             struct inode *orphan_dir_inode)
@@ -1917,6 +1919,7 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
         struct buffer_head *orphan_dir_bh = NULL;
         int status = 0;
         struct ocfs2_dinode *orphan_fe;
+        struct ocfs2_dinode *fe = (struct ocfs2_dinode *) fe_bh->b_data;
 
         mlog_entry("(inode->i_ino = %lu)\n", inode->i_ino);
 
@@ -1957,6 +1960,21 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
                 goto leave;
         }
 
+        /*
+         * We're going to journal the change of i_flags and i_orphaned_slot.
+         * It's safe anyway, though some callers may duplicate the journaling.
+         * Journaling within the func just make the logic look more
+         * straightforward.
+         */
+        status = ocfs2_journal_access_di(handle,
+                                         INODE_CACHE(inode),
+                                         fe_bh,
+                                         OCFS2_JOURNAL_ACCESS_WRITE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto leave;
+        }
+
         le32_add_cpu(&fe->i_flags, OCFS2_ORPHANED_FL);
 
         /* Record which orphan dir our inode now resides
@@ -1964,6 +1982,8 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
          * dir to lock. */
         fe->i_orphaned_slot = cpu_to_le16(osb->slot_num);
 
+        ocfs2_journal_dirty(handle, fe_bh);
+
         mlog(0, "Inode %llu orphaned in slot %d\n",
              (unsigned long long)OCFS2_I(inode)->ip_blkno, osb->slot_num);
 
@@ -2099,13 +2119,9 @@ int ocfs2_create_inode_in_orphan(struct inode *dir,
                 goto leave;
         }
 
-        /* We don't use standard VFS wrapper because we don't want vfs_dq_init
-         * to be called. */
-        if (sb_any_quota_active(osb->sb) &&
-            osb->sb->dq_op->alloc_inode(inode, 1) == NO_QUOTA) {
-                status = -EDQUOT;
+        status = dquot_alloc_inode(inode);
+        if (status)
                 goto leave;
-        }
         did_quota_inode = 1;
 
         inode->i_nlink = 0;
@@ -2125,7 +2141,7 @@ int ocfs2_create_inode_in_orphan(struct inode *dir,
         }
 
         di = (struct ocfs2_dinode *)new_di_bh->b_data;
-        status = ocfs2_orphan_add(osb, handle, inode, di, orphan_name,
+        status = ocfs2_orphan_add(osb, handle, inode, new_di_bh, orphan_name,
                                   &orphan_insert, orphan_dir);
         if (status < 0) {
                 mlog_errno(status);
@@ -2140,7 +2156,7 @@ int ocfs2_create_inode_in_orphan(struct inode *dir,
         insert_inode_hash(inode);
 leave:
         if (status < 0 && did_quota_inode)
-                vfs_dq_free_inode(inode);
+                dquot_free_inode(inode);
         if (handle)
                 ocfs2_commit_trans(osb, handle);
 
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 9362eea7424b..adf5e2ebc2c4 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -42,6 +42,7 @@
 
 #include "ocfs2_fs.h"
 #include "ocfs2_lockid.h"
+#include "ocfs2_ioctl.h"
 
 /* For struct ocfs2_blockcheck_stats */
 #include "blockcheck.h"
@@ -136,6 +137,10 @@ enum ocfs2_unlock_action {
 #define OCFS2_LOCK_PENDING       (0x00000400) /* This lockres is pending a
                                                  call to dlm_lock.  Only
                                                  exists with BUSY set. */
+#define OCFS2_LOCK_UPCONVERT_FINISHING (0x00000800) /* blocks the dc thread
+                                                     * from downconverting
+                                                     * before the upconvert
+                                                     * has completed */
 
 struct ocfs2_lock_res_ops;
 
@@ -155,7 +160,7 @@ struct ocfs2_lock_res {
         int                      l_level;
         unsigned int             l_ro_holders;
         unsigned int             l_ex_holders;
-        union ocfs2_dlm_lksb     l_lksb;
+        struct ocfs2_dlm_lksb    l_lksb;
 
         /* used from AST/BAST funcs. */
         enum ocfs2_ast_action    l_action;
@@ -301,7 +306,9 @@ struct ocfs2_super
         u32 s_next_generation;
         unsigned long osb_flags;
         s16 s_inode_steal_slot;
+        s16 s_meta_steal_slot;
         atomic_t s_num_inodes_stolen;
+        atomic_t s_num_meta_stolen;
 
         unsigned long s_mount_opt;
         unsigned int s_atime_quantum;
@@ -756,35 +763,18 @@ static inline unsigned int ocfs2_megabytes_to_clusters(struct super_block *sb,
         return megs << (20 - OCFS2_SB(sb)->s_clustersize_bits);
 }
 
-static inline void ocfs2_init_inode_steal_slot(struct ocfs2_super *osb)
+static inline void _ocfs2_set_bit(unsigned int bit, unsigned long *bitmap)
 {
-        spin_lock(&osb->osb_lock);
-        osb->s_inode_steal_slot = OCFS2_INVALID_SLOT;
-        spin_unlock(&osb->osb_lock);
-        atomic_set(&osb->s_num_inodes_stolen, 0);
+        ext2_set_bit(bit, bitmap);
 }
+#define ocfs2_set_bit(bit, addr) _ocfs2_set_bit((bit), (unsigned long *)(addr))
 
-static inline void ocfs2_set_inode_steal_slot(struct ocfs2_super *osb,
-                                              s16 slot)
+static inline void _ocfs2_clear_bit(unsigned int bit, unsigned long *bitmap)
 {
-        spin_lock(&osb->osb_lock);
-        osb->s_inode_steal_slot = slot;
-        spin_unlock(&osb->osb_lock);
-}
-
-static inline s16 ocfs2_get_inode_steal_slot(struct ocfs2_super *osb)
-{
-        s16 slot;
-
-        spin_lock(&osb->osb_lock);
-        slot = osb->s_inode_steal_slot;
-        spin_unlock(&osb->osb_lock);
-
-        return slot;
+        ext2_clear_bit(bit, bitmap);
 }
+#define ocfs2_clear_bit(bit, addr) _ocfs2_clear_bit((bit), (unsigned long *)(addr))
 
-#define ocfs2_set_bit ext2_set_bit
-#define ocfs2_clear_bit ext2_clear_bit
 #define ocfs2_test_bit ext2_test_bit
 #define ocfs2_find_next_zero_bit ext2_find_next_zero_bit
 #define ocfs2_find_next_bit ext2_find_next_bit
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 1a1a679e51b5..bb37218a7978 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -254,63 +254,6 @@
                                                  * refcount tree */
 
 /*
- * ioctl commands
- */
-#define OCFS2_IOC_GETFLAGS      _IOR('f', 1, long)
-#define OCFS2_IOC_SETFLAGS      _IOW('f', 2, long)
-#define OCFS2_IOC32_GETFLAGS    _IOR('f', 1, int)
-#define OCFS2_IOC32_SETFLAGS    _IOW('f', 2, int)
-
-/*
- * Space reservation / allocation / free ioctls and argument structure
- * are designed to be compatible with XFS.
- *
- * ALLOCSP* and FREESP* are not and will never be supported, but are
- * included here for completeness.
- */
-struct ocfs2_space_resv {
-        __s16           l_type;
-        __s16           l_whence;
-        __s64           l_start;
-        __s64           l_len;          /* len == 0 means until end of file */
-        __s32           l_sysid;
-        __u32           l_pid;
-        __s32           l_pad[4];       /* reserve area                     */
-};
-
-#define OCFS2_IOC_ALLOCSP               _IOW ('X', 10, struct ocfs2_space_resv)
-#define OCFS2_IOC_FREESP                _IOW ('X', 11, struct ocfs2_space_resv)
-#define OCFS2_IOC_RESVSP                _IOW ('X', 40, struct ocfs2_space_resv)
-#define OCFS2_IOC_UNRESVSP      _IOW ('X', 41, struct ocfs2_space_resv)
-#define OCFS2_IOC_ALLOCSP64     _IOW ('X', 36, struct ocfs2_space_resv)
-#define OCFS2_IOC_FREESP64      _IOW ('X', 37, struct ocfs2_space_resv)
-#define OCFS2_IOC_RESVSP64      _IOW ('X', 42, struct ocfs2_space_resv)
-#define OCFS2_IOC_UNRESVSP64    _IOW ('X', 43, struct ocfs2_space_resv)
-
-/* Used to pass group descriptor data when online resize is done */
-struct ocfs2_new_group_input {
-        __u64 group;            /* Group descriptor's blkno. */
-        __u32 clusters;         /* Total number of clusters in this group */
-        __u32 frees;            /* Total free clusters in this group */
-        __u16 chain;            /* Chain for this group */
-        __u16 reserved1;
-        __u32 reserved2;
-};
-
-#define OCFS2_IOC_GROUP_EXTEND  _IOW('o', 1, int)
-#define OCFS2_IOC_GROUP_ADD     _IOW('o', 2,struct ocfs2_new_group_input)
-#define OCFS2_IOC_GROUP_ADD64   _IOW('o', 3,struct ocfs2_new_group_input)
-
-/* Used to pass 2 file names to reflink. */
-struct reflink_arguments {
-        __u64 old_path;
-        __u64 new_path;
-        __u64 preserve;
-};
-#define OCFS2_IOC_REFLINK       _IOW('o', 4, struct reflink_arguments)
-
-
-/*
  * Journal Flags (ocfs2_dinode.id1.journal1.i_flags)
  */
 #define OCFS2_JOURNAL_DIRTY_FL  (0x00000001)    /* Journal needs recovery */
@@ -1417,9 +1360,16 @@ static inline int ocfs2_fast_symlink_chars(int blocksize)
         return blocksize - offsetof(struct ocfs2_dinode, id2.i_symlink);
 }
 
-static inline int ocfs2_max_inline_data(int blocksize)
+static inline int ocfs2_max_inline_data_with_xattr(int blocksize,
+                                                   struct ocfs2_dinode *di)
 {
-        return blocksize - offsetof(struct ocfs2_dinode, id2.i_data.id_data);
+        if (di && (di->i_dyn_features & OCFS2_INLINE_XATTR_FL))
+                return blocksize -
+                        offsetof(struct ocfs2_dinode, id2.i_data.id_data) -
+                        di->i_xattr_inline_size;
+        else
+                return blocksize -
+                        offsetof(struct ocfs2_dinode, id2.i_data.id_data);
 }
 
 static inline int ocfs2_extent_recs_per_inode(int blocksize)
diff --git a/fs/ocfs2/ocfs2_ioctl.h b/fs/ocfs2/ocfs2_ioctl.h
new file mode 100644
index 000000000000..2d3420af1a83
--- /dev/null
+++ b/fs/ocfs2/ocfs2_ioctl.h
@@ -0,0 +1,79 @@
+/* -*- mode: c; c-basic-offset: 8; -*-
+ * vim: noexpandtab sw=8 ts=8 sts=0:
+ *
+ * ocfs2_ioctl.h
+ *
+ * Defines OCFS2 ioctls.
+ *
+ * Copyright (C) 2010 Oracle.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License, version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef OCFS2_IOCTL_H
+#define OCFS2_IOCTL_H
+
+/*
+ * ioctl commands
+ */
+#define OCFS2_IOC_GETFLAGS      _IOR('f', 1, long)
+#define OCFS2_IOC_SETFLAGS      _IOW('f', 2, long)
+#define OCFS2_IOC32_GETFLAGS    _IOR('f', 1, int)
+#define OCFS2_IOC32_SETFLAGS    _IOW('f', 2, int)
+
+/*
+ * Space reservation / allocation / free ioctls and argument structure
+ * are designed to be compatible with XFS.
+ *
+ * ALLOCSP* and FREESP* are not and will never be supported, but are
+ * included here for completeness.
+ */
+struct ocfs2_space_resv {
+        __s16           l_type;
+        __s16           l_whence;
+        __s64           l_start;
+        __s64           l_len;          /* len == 0 means until end of file */
+        __s32           l_sysid;
+        __u32           l_pid;
+        __s32           l_pad[4];       /* reserve area                     */
+};
+
+#define OCFS2_IOC_ALLOCSP               _IOW ('X', 10, struct ocfs2_space_resv)
+#define OCFS2_IOC_FREESP                _IOW ('X', 11, struct ocfs2_space_resv)
+#define OCFS2_IOC_RESVSP                _IOW ('X', 40, struct ocfs2_space_resv)
+#define OCFS2_IOC_UNRESVSP      _IOW ('X', 41, struct ocfs2_space_resv)
+#define OCFS2_IOC_ALLOCSP64     _IOW ('X', 36, struct ocfs2_space_resv)
+#define OCFS2_IOC_FREESP64      _IOW ('X', 37, struct ocfs2_space_resv)
+#define OCFS2_IOC_RESVSP64      _IOW ('X', 42, struct ocfs2_space_resv)
+#define OCFS2_IOC_UNRESVSP64    _IOW ('X', 43, struct ocfs2_space_resv)
+
+/* Used to pass group descriptor data when online resize is done */
+struct ocfs2_new_group_input {
+        __u64 group;            /* Group descriptor's blkno. */
+        __u32 clusters;         /* Total number of clusters in this group */
+        __u32 frees;            /* Total free clusters in this group */
+        __u16 chain;            /* Chain for this group */
+        __u16 reserved1;
+        __u32 reserved2;
+};
+
+#define OCFS2_IOC_GROUP_EXTEND  _IOW('o', 1, int)
+#define OCFS2_IOC_GROUP_ADD     _IOW('o', 2,struct ocfs2_new_group_input)
+#define OCFS2_IOC_GROUP_ADD64   _IOW('o', 3,struct ocfs2_new_group_input)
+
+/* Used to pass 2 file names to reflink. */
+struct reflink_arguments {
+        __u64 old_path;
+        __u64 new_path;
+        __u64 preserve;
+};
+#define OCFS2_IOC_REFLINK       _IOW('o', 4, struct reflink_arguments)
+
+#endif /* OCFS2_IOCTL_H */
diff --git a/fs/ocfs2/ocfs2_lockingver.h b/fs/ocfs2/ocfs2_lockingver.h
index 82d5eeac0fff..2e45c8d2ea7e 100644
--- a/fs/ocfs2/ocfs2_lockingver.h
+++ b/fs/ocfs2/ocfs2_lockingver.h
@@ -23,6 +23,8 @@
 /*
  * The protocol version for ocfs2 cluster locking.  See dlmglue.c for
  * more details.
+ *
+ * 1.0 - Initial locking version from ocfs2 1.4.
  */
 #define OCFS2_LOCKING_PROTOCOL_MAJOR 1
 #define OCFS2_LOCKING_PROTOCOL_MINOR 0
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index b437dc0c4cad..ab42a74c7539 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -3,6 +3,7 @@
  */
 #include <linux/spinlock.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/quota.h>
 #include <linux/quotaops.h>
 #include <linux/dqblk_qtree.h>
@@ -851,13 +852,6 @@ static void ocfs2_destroy_dquot(struct dquot *dquot)
 }
 
 const struct dquot_operations ocfs2_quota_operations = {
-        .initialize     = dquot_initialize,
-        .drop           = dquot_drop,
-        .alloc_space    = dquot_alloc_space,
-        .alloc_inode    = dquot_alloc_inode,
-        .free_space     = dquot_free_space,
-        .free_inode     = dquot_free_inode,
-        .transfer       = dquot_transfer,
         .write_dquot    = ocfs2_write_dquot,
         .acquire_dquot  = ocfs2_acquire_dquot,
         .release_dquot  = ocfs2_release_dquot,
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 21f9e71223ca..9ad49305f450 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -3,6 +3,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/quota.h>
 #include <linux/quotaops.h>
 #include <linux/module.h>
@@ -457,7 +458,7 @@ static int ocfs2_recover_local_quota_file(struct inode *lqinode,
                         break;
                 }
                 dchunk = (struct ocfs2_local_disk_chunk *)hbh->b_data;
-                for_each_bit(bit, rchunk->rc_bitmap, ol_chunk_entries(sb)) {
+                for_each_set_bit(bit, rchunk->rc_bitmap, ol_chunk_entries(sb)) {
                         qbh = NULL;
                         status = ocfs2_read_quota_block(lqinode,
                                                 ol_dqblk_block(sb, chunk, bit),
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 74db2be75dd6..bd96f6c7877e 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -37,7 +37,6 @@
 
 #include <linux/bio.h>
 #include <linux/blkdev.h>
-#include <linux/gfp.h>
 #include <linux/slab.h>
 #include <linux/writeback.h>
 #include <linux/pagevec.h>
@@ -626,7 +625,7 @@ static int ocfs2_create_refcount_tree(struct inode *inode,
         rb = (struct ocfs2_refcount_block *)new_bh->b_data;
         memset(rb, 0, inode->i_sb->s_blocksize);
         strcpy((void *)rb, OCFS2_REFCOUNT_BLOCK_SIGNATURE);
-        rb->rf_suballoc_slot = cpu_to_le16(osb->slot_num);
+        rb->rf_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         rb->rf_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         rb->rf_fs_generation = cpu_to_le32(osb->fs_generation);
         rb->rf_blkno = cpu_to_le64(first_blkno);
@@ -1330,7 +1329,7 @@ static int ocfs2_expand_inline_ref_root(handle_t *handle,
         memcpy(new_bh->b_data, ref_root_bh->b_data, sb->s_blocksize);
 
         new_rb = (struct ocfs2_refcount_block *)new_bh->b_data;
-        new_rb->rf_suballoc_slot = cpu_to_le16(OCFS2_SB(sb)->slot_num);
+        new_rb->rf_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         new_rb->rf_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         new_rb->rf_blkno = cpu_to_le64(blkno);
         new_rb->rf_cpos = cpu_to_le32(0);
@@ -1576,7 +1575,7 @@ static int ocfs2_new_leaf_refcount_block(handle_t *handle,
         new_rb = (struct ocfs2_refcount_block *)new_bh->b_data;
         memset(new_rb, 0, sb->s_blocksize);
         strcpy((void *)new_rb, OCFS2_REFCOUNT_BLOCK_SIGNATURE);
-        new_rb->rf_suballoc_slot = cpu_to_le16(OCFS2_SB(sb)->slot_num);
+        new_rb->rf_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         new_rb->rf_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         new_rb->rf_fs_generation = cpu_to_le32(OCFS2_SB(sb)->fs_generation);
         new_rb->rf_blkno = cpu_to_le64(blkno);
@@ -2945,7 +2944,7 @@ static int ocfs2_duplicate_clusters_by_page(handle_t *handle,
 
         while (offset < end) {
                 page_index = offset >> PAGE_CACHE_SHIFT;
-                map_end = (page_index + 1) << PAGE_CACHE_SHIFT;
+                map_end = ((loff_t)page_index + 1) << PAGE_CACHE_SHIFT;
                 if (map_end > end)
                         map_end = end;
 
@@ -2957,8 +2956,12 @@ static int ocfs2_duplicate_clusters_by_page(handle_t *handle,
 
                 page = grab_cache_page(mapping, page_index);
 
-                /* This page can't be dirtied before we CoW it out. */
-                BUG_ON(PageDirty(page));
+                /*
+                 * In case PAGE_CACHE_SIZE <= CLUSTER_SIZE, This page
+                 * can't be dirtied before we CoW it out.
+                 */
+                if (PAGE_CACHE_SIZE <= OCFS2_SB(sb)->s_clustersize)
+                        BUG_ON(PageDirty(page));
 
                 if (!PageUptodate(page)) {
                         ret = block_read_full_page(page, ocfs2_get_block);
@@ -3170,7 +3173,7 @@ static int ocfs2_cow_sync_writeback(struct super_block *sb,
 
         while (offset < end) {
                 page_index = offset >> PAGE_CACHE_SHIFT;
-                map_end = (page_index + 1) << PAGE_CACHE_SHIFT;
+                map_end = ((loff_t)page_index + 1) << PAGE_CACHE_SHIFT;
                 if (map_end > end)
                         map_end = end;
 
@@ -4071,6 +4074,7 @@ static int ocfs2_complete_reflink(struct inode *s_inode,
         OCFS2_I(t_inode)->ip_dyn_features = OCFS2_I(s_inode)->ip_dyn_features;
         spin_unlock(&OCFS2_I(t_inode)->ip_lock);
         i_size_write(t_inode, size);
+        t_inode->i_blocks = s_inode->i_blocks;
 
         di->i_xattr_inline_size = s_di->i_xattr_inline_size;
         di->i_clusters = s_di->i_clusters;
@@ -4386,7 +4390,7 @@ static int ocfs2_vfs_reflink(struct dentry *old_dentry, struct inode *dir,
         }
 
         mutex_lock(&inode->i_mutex);
-        vfs_dq_init(dir);
+        dquot_initialize(dir);
         error = ocfs2_reflink(old_dentry, dir, new_dentry, preserve);
         mutex_unlock(&inode->i_mutex);
         if (!error)
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index e49c41050264..0d3049f696c5 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -19,6 +19,7 @@
 
 #include <linux/kernel.h>
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 
 /* Needed for AOP_TRUNCATED_PAGE in mlog_errno() */
@@ -161,24 +162,23 @@ static int dlm_status_to_errno(enum dlm_status status)
 
 static void o2dlm_lock_ast_wrapper(void *astarg)
 {
-        BUG_ON(o2cb_stack.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
 
-        o2cb_stack.sp_proto->lp_lock_ast(astarg);
+        lksb->lksb_conn->cc_proto->lp_lock_ast(lksb);
 }
 
 static void o2dlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(o2cb_stack.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
 
-        o2cb_stack.sp_proto->lp_blocking_ast(astarg, level);
+        lksb->lksb_conn->cc_proto->lp_blocking_ast(lksb, level);
 }
 
 static void o2dlm_unlock_ast_wrapper(void *astarg, enum dlm_status status)
 {
+        struct ocfs2_dlm_lksb *lksb = astarg;
         int error = dlm_status_to_errno(status);
 
-        BUG_ON(o2cb_stack.sp_proto == NULL);
-
         /*
          * In o2dlm, you can get both the lock_ast() for the lock being
          * granted and the unlock_ast() for the CANCEL failing.  A
@@ -193,16 +193,15 @@ static void o2dlm_unlock_ast_wrapper(void *astarg, enum dlm_status status)
         if (status == DLM_CANCELGRANT)
                 return;
 
-        o2cb_stack.sp_proto->lp_unlock_ast(astarg, error);
+        lksb->lksb_conn->cc_proto->lp_unlock_ast(lksb, error);
 }
 
 static int o2cb_dlm_lock(struct ocfs2_cluster_connection *conn,
                          int mode,
-                         union ocfs2_dlm_lksb *lksb,
+                         struct ocfs2_dlm_lksb *lksb,
                          u32 flags,
                          void *name,
-                         unsigned int namelen,
-                         void *astarg)
+                         unsigned int namelen)
 {
         enum dlm_status status;
         int o2dlm_mode = mode_to_o2dlm(mode);
@@ -211,28 +210,27 @@ static int o2cb_dlm_lock(struct ocfs2_cluster_connection *conn,
 
         status = dlmlock(conn->cc_lockspace, o2dlm_mode, &lksb->lksb_o2dlm,
                          o2dlm_flags, name, namelen,
-                         o2dlm_lock_ast_wrapper, astarg,
+                         o2dlm_lock_ast_wrapper, lksb,
                          o2dlm_blocking_ast_wrapper);
         ret = dlm_status_to_errno(status);
         return ret;
 }
 
 static int o2cb_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                           union ocfs2_dlm_lksb *lksb,
-                           u32 flags,
-                           void *astarg)
+                           struct ocfs2_dlm_lksb *lksb,
+                           u32 flags)
 {
         enum dlm_status status;
         int o2dlm_flags = flags_to_o2dlm(flags);
         int ret;
 
         status = dlmunlock(conn->cc_lockspace, &lksb->lksb_o2dlm,
-                           o2dlm_flags, o2dlm_unlock_ast_wrapper, astarg);
+                           o2dlm_flags, o2dlm_unlock_ast_wrapper, lksb);
         ret = dlm_status_to_errno(status);
         return ret;
 }
 
-static int o2cb_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
+static int o2cb_dlm_lock_status(struct ocfs2_dlm_lksb *lksb)
 {
         return dlm_status_to_errno(lksb->lksb_o2dlm.status);
 }
@@ -242,17 +240,17 @@ static int o2cb_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
  * contents, it will zero out the LVB.  Thus the caller can always trust
  * the contents.
  */
-static int o2cb_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb)
+static int o2cb_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb)
 {
         return 1;
 }
 
-static void *o2cb_dlm_lvb(union ocfs2_dlm_lksb *lksb)
+static void *o2cb_dlm_lvb(struct ocfs2_dlm_lksb *lksb)
 {
         return (void *)(lksb->lksb_o2dlm.lvb);
 }
 
-static void o2cb_dump_lksb(union ocfs2_dlm_lksb *lksb)
+static void o2cb_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 {
         dlm_print_one_lock(lksb->lksb_o2dlm.lockid);
 }
@@ -277,10 +275,10 @@ static int o2cb_cluster_connect(struct ocfs2_cluster_connection *conn)
         u32 dlm_key;
         struct dlm_ctxt *dlm;
         struct o2dlm_private *priv;
-        struct dlm_protocol_version dlm_version;
+        struct dlm_protocol_version fs_version;
 
         BUG_ON(conn == NULL);
-        BUG_ON(o2cb_stack.sp_proto == NULL);
+        BUG_ON(conn->cc_proto == NULL);
 
         /* for now we only have one cluster/node, make sure we see it
          * in the heartbeat universe */
@@ -304,18 +302,18 @@ static int o2cb_cluster_connect(struct ocfs2_cluster_connection *conn)
         /* used by the dlm code to make message headers unique, each
          * node in this domain must agree on this. */
         dlm_key = crc32_le(0, conn->cc_name, conn->cc_namelen);
-        dlm_version.pv_major = conn->cc_version.pv_major;
-        dlm_version.pv_minor = conn->cc_version.pv_minor;
+        fs_version.pv_major = conn->cc_version.pv_major;
+        fs_version.pv_minor = conn->cc_version.pv_minor;
 
-        dlm = dlm_register_domain(conn->cc_name, dlm_key, &dlm_version);
+        dlm = dlm_register_domain(conn->cc_name, dlm_key, &fs_version);
         if (IS_ERR(dlm)) {
                 rc = PTR_ERR(dlm);
                 mlog_errno(rc);
                 goto out_free;
         }
 
-        conn->cc_version.pv_major = dlm_version.pv_major;
-        conn->cc_version.pv_minor = dlm_version.pv_minor;
+        conn->cc_version.pv_major = fs_version.pv_major;
+        conn->cc_version.pv_minor = fs_version.pv_minor;
         conn->cc_lockspace = dlm;
 
         dlm_register_eviction_cb(dlm, &priv->op_eviction_cb);
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index da78a2a334fd..2dc57bca0688 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -21,11 +21,11 @@
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/reboot.h>
 #include <asm/uaccess.h>
 
-#include "ocfs2.h"  /* For struct ocfs2_lock_res */
 #include "stackglue.h"
 
 #include <linux/dlm_plock.h>
@@ -63,8 +63,8 @@
  * negotiated by the client.  The client negotiates based on the maximum
  * version advertised in /sys/fs/ocfs2/max_locking_protocol.  The major
  * number from the "SETV" message must match
- * ocfs2_user_plugin.sp_proto->lp_max_version.pv_major, and the minor number
- * must be less than or equal to ...->lp_max_version.pv_minor.
+ * ocfs2_user_plugin.sp_max_proto.pv_major, and the minor number
+ * must be less than or equal to ...sp_max_version.pv_minor.
  *
  * Once this information has been set, mounts will be allowed.  From this
  * point on, the "DOWN" message can be sent for node down notification.
@@ -401,7 +401,7 @@ static int ocfs2_control_do_setversion_msg(struct file *file,
         char *ptr = NULL;
         struct ocfs2_control_private *p = file->private_data;
         struct ocfs2_protocol_version *max =
-                &ocfs2_user_plugin.sp_proto->lp_max_version;
+                &ocfs2_user_plugin.sp_max_proto;
 
         if (ocfs2_control_get_handshake_state(file) !=
             OCFS2_CONTROL_HANDSHAKE_PROTOCOL)
@@ -664,18 +664,10 @@ static void ocfs2_control_exit(void)
                        -rc);
 }
 
-static struct dlm_lksb *fsdlm_astarg_to_lksb(void *astarg)
-{
-        struct ocfs2_lock_res *res = astarg;
-        return &res->l_lksb.lksb_fsdlm;
-}
-
 static void fsdlm_lock_ast_wrapper(void *astarg)
 {
-        struct dlm_lksb *lksb = fsdlm_astarg_to_lksb(astarg);
-        int status = lksb->sb_status;
-
-        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
+        int status = lksb->lksb_fsdlm.sb_status;
 
         /*
          * For now we're punting on the issue of other non-standard errors
@@ -688,25 +680,24 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
          */
 
         if (status == -DLM_EUNLOCK || status == -DLM_ECANCEL)
-                ocfs2_user_plugin.sp_proto->lp_unlock_ast(astarg, 0);
+                lksb->lksb_conn->cc_proto->lp_unlock_ast(lksb, 0);
         else
-                ocfs2_user_plugin.sp_proto->lp_lock_ast(astarg);
+                lksb->lksb_conn->cc_proto->lp_lock_ast(lksb);
 }
 
 static void fsdlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
 
-        ocfs2_user_plugin.sp_proto->lp_blocking_ast(astarg, level);
+        lksb->lksb_conn->cc_proto->lp_blocking_ast(lksb, level);
 }
 
 static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
                          int mode,
-                         union ocfs2_dlm_lksb *lksb,
+                         struct ocfs2_dlm_lksb *lksb,
                          u32 flags,
                          void *name,
-                         unsigned int namelen,
-                         void *astarg)
+                         unsigned int namelen)
 {
         int ret;
 
@@ -716,36 +707,35 @@ static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
 
         ret = dlm_lock(conn->cc_lockspace, mode, &lksb->lksb_fsdlm,
                        flags|DLM_LKF_NODLCKWT, name, namelen, 0,
-                       fsdlm_lock_ast_wrapper, astarg,
+                       fsdlm_lock_ast_wrapper, lksb,
                        fsdlm_blocking_ast_wrapper);
         return ret;
 }
 
 static int user_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                           union ocfs2_dlm_lksb *lksb,
-                           u32 flags,
-                           void *astarg)
+                           struct ocfs2_dlm_lksb *lksb,
+                           u32 flags)
 {
         int ret;
 
         ret = dlm_unlock(conn->cc_lockspace, lksb->lksb_fsdlm.sb_lkid,
-                         flags, &lksb->lksb_fsdlm, astarg);
+                         flags, &lksb->lksb_fsdlm, lksb);
         return ret;
 }
 
-static int user_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
+static int user_dlm_lock_status(struct ocfs2_dlm_lksb *lksb)
 {
         return lksb->lksb_fsdlm.sb_status;
 }
 
-static int user_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb)
+static int user_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb)
 {
         int invalid = lksb->lksb_fsdlm.sb_flags & DLM_SBF_VALNOTVALID;
 
         return !invalid;
 }
 
-static void *user_dlm_lvb(union ocfs2_dlm_lksb *lksb)
+static void *user_dlm_lvb(struct ocfs2_dlm_lksb *lksb)
 {
         if (!lksb->lksb_fsdlm.sb_lvbptr)
                 lksb->lksb_fsdlm.sb_lvbptr = (char *)lksb +
@@ -753,7 +743,7 @@ static void *user_dlm_lvb(union ocfs2_dlm_lksb *lksb)
         return (void *)(lksb->lksb_fsdlm.sb_lvbptr);
 }
 
-static void user_dlm_dump_lksb(union ocfs2_dlm_lksb *lksb)
+static void user_dlm_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 {
 }
 
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index f3df0baa9a48..39abf89697ed 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -36,7 +36,7 @@
 #define OCFS2_STACK_PLUGIN_USER         "user"
 #define OCFS2_MAX_HB_CTL_PATH           256
 
-static struct ocfs2_locking_protocol *lproto;
+static struct ocfs2_protocol_version locking_max_version;
 static DEFINE_SPINLOCK(ocfs2_stack_lock);
 static LIST_HEAD(ocfs2_stack_list);
 static char cluster_stack_name[OCFS2_STACK_LABEL_LEN + 1];
@@ -176,7 +176,7 @@ int ocfs2_stack_glue_register(struct ocfs2_stack_plugin *plugin)
         spin_lock(&ocfs2_stack_lock);
         if (!ocfs2_stack_lookup(plugin->sp_name)) {
                 plugin->sp_count = 0;
-                plugin->sp_proto = lproto;
+                plugin->sp_max_proto = locking_max_version;
                 list_add(&plugin->sp_list, &ocfs2_stack_list);
                 printk(KERN_INFO "ocfs2: Registered cluster interface %s\n",
                        plugin->sp_name);
@@ -213,77 +213,76 @@ void ocfs2_stack_glue_unregister(struct ocfs2_stack_plugin *plugin)
 }
 EXPORT_SYMBOL_GPL(ocfs2_stack_glue_unregister);
 
-void ocfs2_stack_glue_set_locking_protocol(struct ocfs2_locking_protocol *proto)
+void ocfs2_stack_glue_set_max_proto_version(struct ocfs2_protocol_version *max_proto)
 {
         struct ocfs2_stack_plugin *p;
 
-        BUG_ON(proto == NULL);
-
         spin_lock(&ocfs2_stack_lock);
-        BUG_ON(active_stack != NULL);
+        if (memcmp(max_proto, &locking_max_version,
+                   sizeof(struct ocfs2_protocol_version))) {
+                BUG_ON(locking_max_version.pv_major != 0);
 
-        lproto = proto;
-        list_for_each_entry(p, &ocfs2_stack_list, sp_list) {
-                p->sp_proto = lproto;
+                locking_max_version = *max_proto;
+                list_for_each_entry(p, &ocfs2_stack_list, sp_list) {
+                        p->sp_max_proto = locking_max_version;
+                }
         }
-
         spin_unlock(&ocfs2_stack_lock);
 }
-EXPORT_SYMBOL_GPL(ocfs2_stack_glue_set_locking_protocol);
+EXPORT_SYMBOL_GPL(ocfs2_stack_glue_set_max_proto_version);
 
 
 /*
- * The ocfs2_dlm_lock() and ocfs2_dlm_unlock() functions take
- * "struct ocfs2_lock_res *astarg" instead of "void *astarg" because the
- * underlying stack plugins need to pilfer the lksb off of the lock_res.
- * If some other structure needs to be passed as an astarg, the plugins
- * will need to be given a different avenue to the lksb.
+ * The ocfs2_dlm_lock() and ocfs2_dlm_unlock() functions take no argument
+ * for the ast and bast functions.  They will pass the lksb to the ast
+ * and bast.  The caller can wrap the lksb with their own structure to
+ * get more information.
  */
 int ocfs2_dlm_lock(struct ocfs2_cluster_connection *conn,
                    int mode,
-                   union ocfs2_dlm_lksb *lksb,
+                   struct ocfs2_dlm_lksb *lksb,
                    u32 flags,
                    void *name,
-                   unsigned int namelen,
-                   struct ocfs2_lock_res *astarg)
+                   unsigned int namelen)
 {
-        BUG_ON(lproto == NULL);
-
+        if (!lksb->lksb_conn)
+                lksb->lksb_conn = conn;
+        else
+                BUG_ON(lksb->lksb_conn != conn);
         return active_stack->sp_ops->dlm_lock(conn, mode, lksb, flags,
-                                              name, namelen, astarg);
+                                              name, namelen);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lock);
 
 int ocfs2_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                     union ocfs2_dlm_lksb *lksb,
-                     u32 flags,
-                     struct ocfs2_lock_res *astarg)
+                     struct ocfs2_dlm_lksb *lksb,
+                     u32 flags)
 {
-        BUG_ON(lproto == NULL);
+        BUG_ON(lksb->lksb_conn == NULL);
 
-        return active_stack->sp_ops->dlm_unlock(conn, lksb, flags, astarg);
+        return active_stack->sp_ops->dlm_unlock(conn, lksb, flags);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_unlock);
 
-int ocfs2_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
+int ocfs2_dlm_lock_status(struct ocfs2_dlm_lksb *lksb)
 {
         return active_stack->sp_ops->lock_status(lksb);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lock_status);
 
-int ocfs2_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb)
+int ocfs2_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb)
 {
         return active_stack->sp_ops->lvb_valid(lksb);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lvb_valid);
 
-void *ocfs2_dlm_lvb(union ocfs2_dlm_lksb *lksb)
+void *ocfs2_dlm_lvb(struct ocfs2_dlm_lksb *lksb)
 {
         return active_stack->sp_ops->lock_lvb(lksb);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lvb);
 
-void ocfs2_dlm_dump_lksb(union ocfs2_dlm_lksb *lksb)
+void ocfs2_dlm_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 {
         active_stack->sp_ops->dump_lksb(lksb);
 }
@@ -312,6 +311,7 @@ EXPORT_SYMBOL_GPL(ocfs2_plock);
 int ocfs2_cluster_connect(const char *stack_name,
                           const char *group,
                           int grouplen,
+                          struct ocfs2_locking_protocol *lproto,
                           void (*recovery_handler)(int node_num,
                                                    void *recovery_data),
                           void *recovery_data,
@@ -329,6 +329,12 @@ int ocfs2_cluster_connect(const char *stack_name,
                 goto out;
         }
 
+        if (memcmp(&lproto->lp_max_version, &locking_max_version,
+                   sizeof(struct ocfs2_protocol_version))) {
+                rc = -EINVAL;
+                goto out;
+        }
+
         new_conn = kzalloc(sizeof(struct ocfs2_cluster_connection),
                            GFP_KERNEL);
         if (!new_conn) {
@@ -341,6 +347,7 @@ int ocfs2_cluster_connect(const char *stack_name,
         new_conn->cc_recovery_handler = recovery_handler;
         new_conn->cc_recovery_data = recovery_data;
 
+        new_conn->cc_proto = lproto;
         /* Start the new connection at our maximum compatibility level */
         new_conn->cc_version = lproto->lp_max_version;
 
@@ -366,6 +373,24 @@ out:
 }
 EXPORT_SYMBOL_GPL(ocfs2_cluster_connect);
 
+/* The caller will ensure all nodes have the same cluster stack */
+int ocfs2_cluster_connect_agnostic(const char *group,
+                                   int grouplen,
+                                   struct ocfs2_locking_protocol *lproto,
+                                   void (*recovery_handler)(int node_num,
+                                                            void *recovery_data),
+                                   void *recovery_data,
+                                   struct ocfs2_cluster_connection **conn)
+{
+        char *stack_name = NULL;
+
+        if (cluster_stack_name[0])
+                stack_name = cluster_stack_name;
+        return ocfs2_cluster_connect(stack_name, group, grouplen, lproto,
+                                     recovery_handler, recovery_data, conn);
+}
+EXPORT_SYMBOL_GPL(ocfs2_cluster_connect_agnostic);
+
 /* If hangup_pending is 0, the stack driver will be dropped */
 int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
                              int hangup_pending)
@@ -453,10 +478,10 @@ static ssize_t ocfs2_max_locking_protocol_show(struct kobject *kobj,
         ssize_t ret = 0;
 
         spin_lock(&ocfs2_stack_lock);
-        if (lproto)
+        if (locking_max_version.pv_major)
                 ret = snprintf(buf, PAGE_SIZE, "%u.%u\n",
-                               lproto->lp_max_version.pv_major,
-                               lproto->lp_max_version.pv_minor);
+                               locking_max_version.pv_major,
+                               locking_max_version.pv_minor);
         spin_unlock(&ocfs2_stack_lock);
 
         return ret;
@@ -685,7 +710,10 @@ static int __init ocfs2_stack_glue_init(void)
 
 static void __exit ocfs2_stack_glue_exit(void)
 {
-        lproto = NULL;
+        memset(&locking_max_version, 0,
+               sizeof(struct ocfs2_protocol_version));
+        locking_max_version.pv_major = 0;
+        locking_max_version.pv_minor = 0;
         ocfs2_sysfs_exit();
         if (ocfs2_table_header)
                 unregister_sysctl_table(ocfs2_table_header);
diff --git a/fs/ocfs2/stackglue.h b/fs/ocfs2/stackglue.h
index 03a44d60eac9..8ce7398ae1d2 100644
--- a/fs/ocfs2/stackglue.h
+++ b/fs/ocfs2/stackglue.h
@@ -56,17 +56,6 @@ struct ocfs2_protocol_version {
 };
 
 /*
- * The ocfs2_locking_protocol defines the handlers called on ocfs2's behalf.
- */
-struct ocfs2_locking_protocol {
-        struct ocfs2_protocol_version lp_max_version;
-        void (*lp_lock_ast)(void *astarg);
-        void (*lp_blocking_ast)(void *astarg, int level);
-        void (*lp_unlock_ast)(void *astarg, int error);
-};
-
-
-/*
  * The dlm_lockstatus struct includes lvb space, but the dlm_lksb struct only
  * has a pointer to separately allocated lvb space.  This struct exists only to
  * include in the lksb union to make space for a combined dlm_lksb and lvb.
@@ -81,12 +70,27 @@ struct fsdlm_lksb_plus_lvb {
  * size of the union is known.  Lock status structures are embedded in
  * ocfs2 inodes.
  */
-union ocfs2_dlm_lksb {
-        struct dlm_lockstatus lksb_o2dlm;
-        struct dlm_lksb lksb_fsdlm;
-        struct fsdlm_lksb_plus_lvb padding;
+struct ocfs2_cluster_connection;
+struct ocfs2_dlm_lksb {
+         union {
+                 struct dlm_lockstatus lksb_o2dlm;
+                 struct dlm_lksb lksb_fsdlm;
+                 struct fsdlm_lksb_plus_lvb padding;
+         };
+         struct ocfs2_cluster_connection *lksb_conn;
+};
+
+/*
+ * The ocfs2_locking_protocol defines the handlers called on ocfs2's behalf.
+ */
+struct ocfs2_locking_protocol {
+        struct ocfs2_protocol_version lp_max_version;
+        void (*lp_lock_ast)(struct ocfs2_dlm_lksb *lksb);
+        void (*lp_blocking_ast)(struct ocfs2_dlm_lksb *lksb, int level);
+        void (*lp_unlock_ast)(struct ocfs2_dlm_lksb *lksb, int error);
 };
 
+
 /*
  * A cluster connection.  Mostly opaque to ocfs2, the connection holds
  * state for the underlying stack.  ocfs2 does use cc_version to determine
@@ -96,6 +100,7 @@ struct ocfs2_cluster_connection {
         char cc_name[GROUP_NAME_MAX];
         int cc_namelen;
         struct ocfs2_protocol_version cc_version;
+        struct ocfs2_locking_protocol *cc_proto;
         void (*cc_recovery_handler)(int node_num, void *recovery_data);
         void *cc_recovery_data;
         void *cc_lockspace;
@@ -155,27 +160,29 @@ struct ocfs2_stack_operations {
          *
          * ast and bast functions are not part of the call because the
          * stack will likely want to wrap ast and bast calls before passing
-         * them to stack->sp_proto.
+         * them to stack->sp_proto.  There is no astarg.  The lksb will
+         * be passed back to the ast and bast functions.  The caller can
+         * use this to find their object.
          */
         int (*dlm_lock)(struct ocfs2_cluster_connection *conn,
                         int mode,
-                        union ocfs2_dlm_lksb *lksb,
+                        struct ocfs2_dlm_lksb *lksb,
                         u32 flags,
                         void *name,
-                        unsigned int namelen,
-                        void *astarg);
+                        unsigned int namelen);
 
         /*
          * Call the underlying dlm unlock function.  The ->dlm_unlock()
          * function should convert the flags as appropriate.
          *
          * The unlock ast is not passed, as the stack will want to wrap
-         * it before calling stack->sp_proto->lp_unlock_ast().
+         * it before calling stack->sp_proto->lp_unlock_ast().  There is
+         * no astarg.  The lksb will be passed back to the unlock ast
+         * function.  The caller can use this to find their object.
          */
         int (*dlm_unlock)(struct ocfs2_cluster_connection *conn,
-                          union ocfs2_dlm_lksb *lksb,
-                          u32 flags,
-                          void *astarg);
+                          struct ocfs2_dlm_lksb *lksb,
+                          u32 flags);
 
         /*
          * Return the status of the current lock status block.  The fs
@@ -183,17 +190,17 @@ struct ocfs2_stack_operations {
          * callback pulls out the stack-specific lksb, converts the status
          * to a proper errno, and returns it.
          */
-        int (*lock_status)(union ocfs2_dlm_lksb *lksb);
+        int (*lock_status)(struct ocfs2_dlm_lksb *lksb);
 
         /*
          * Return non-zero if the LVB is valid.
          */
-        int (*lvb_valid)(union ocfs2_dlm_lksb *lksb);
+        int (*lvb_valid)(struct ocfs2_dlm_lksb *lksb);
 
         /*
          * Pull the lvb pointer off of the stack-specific lksb.
          */
-        void *(*lock_lvb)(union ocfs2_dlm_lksb *lksb);
+        void *(*lock_lvb)(struct ocfs2_dlm_lksb *lksb);
 
         /*
          * Cluster-aware posix locks
@@ -210,7 +217,7 @@ struct ocfs2_stack_operations {
          * This is an optoinal debugging hook.  If provided, the
          * stack can dump debugging information about this lock.
          */
-        void (*dump_lksb)(union ocfs2_dlm_lksb *lksb);
+        void (*dump_lksb)(struct ocfs2_dlm_lksb *lksb);
 };
 
 /*
@@ -226,7 +233,7 @@ struct ocfs2_stack_plugin {
         /* These are managed by the stackglue code. */
         struct list_head sp_list;
         unsigned int sp_count;
-        struct ocfs2_locking_protocol *sp_proto;
+        struct ocfs2_protocol_version sp_max_proto;
 };
 
 
@@ -234,10 +241,22 @@ struct ocfs2_stack_plugin {
 int ocfs2_cluster_connect(const char *stack_name,
                           const char *group,
                           int grouplen,
+                          struct ocfs2_locking_protocol *lproto,
                           void (*recovery_handler)(int node_num,
                                                    void *recovery_data),
                           void *recovery_data,
                           struct ocfs2_cluster_connection **conn);
+/*
+ * Used by callers that don't store their stack name.  They must ensure
+ * all nodes have the same stack.
+ */
+int ocfs2_cluster_connect_agnostic(const char *group,
+                                   int grouplen,
+                                   struct ocfs2_locking_protocol *lproto,
+                                   void (*recovery_handler)(int node_num,
+                                                            void *recovery_data),
+                                   void *recovery_data,
+                                   struct ocfs2_cluster_connection **conn);
 int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
                              int hangup_pending);
 void ocfs2_cluster_hangup(const char *group, int grouplen);
@@ -246,26 +265,24 @@ int ocfs2_cluster_this_node(unsigned int *node);
 struct ocfs2_lock_res;
 int ocfs2_dlm_lock(struct ocfs2_cluster_connection *conn,
                    int mode,
-                   union ocfs2_dlm_lksb *lksb,
+                   struct ocfs2_dlm_lksb *lksb,
                    u32 flags,
                    void *name,
-                   unsigned int namelen,
-                   struct ocfs2_lock_res *astarg);
+                   unsigned int namelen);
 int ocfs2_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                     union ocfs2_dlm_lksb *lksb,
-                     u32 flags,
-                     struct ocfs2_lock_res *astarg);
+                     struct ocfs2_dlm_lksb *lksb,
+                     u32 flags);
 
-int ocfs2_dlm_lock_status(union ocfs2_dlm_lksb *lksb);
-int ocfs2_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb);
-void *ocfs2_dlm_lvb(union ocfs2_dlm_lksb *lksb);
-void ocfs2_dlm_dump_lksb(union ocfs2_dlm_lksb *lksb);
+int ocfs2_dlm_lock_status(struct ocfs2_dlm_lksb *lksb);
+int ocfs2_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb);
+void *ocfs2_dlm_lvb(struct ocfs2_dlm_lksb *lksb);
+void ocfs2_dlm_dump_lksb(struct ocfs2_dlm_lksb *lksb);
 
 int ocfs2_stack_supports_plocks(void);
 int ocfs2_plock(struct ocfs2_cluster_connection *conn, u64 ino,
                 struct file *file, int cmd, struct file_lock *fl);
 
-void ocfs2_stack_glue_set_locking_protocol(struct ocfs2_locking_protocol *proto);
+void ocfs2_stack_glue_set_max_proto_version(struct ocfs2_protocol_version *max_proto);
 
 
 /* Used by stack plugins */
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index c30b644d9572..19ba00f28547 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -51,7 +51,7 @@
 #define ALLOC_NEW_GROUP                 0x1
 #define ALLOC_GROUPS_FROM_GLOBAL        0x2
 
-#define OCFS2_MAX_INODES_TO_STEAL       1024
+#define OCFS2_MAX_TO_STEAL              1024
 
 static inline void ocfs2_debug_bg(struct ocfs2_group_desc *bg);
 static inline void ocfs2_debug_suballoc_inode(struct ocfs2_dinode *fe);
@@ -95,13 +95,6 @@ static inline int ocfs2_block_group_set_bits(handle_t *handle,
                                              struct buffer_head *group_bh,
                                              unsigned int bit_off,
                                              unsigned int num_bits);
-static inline int ocfs2_block_group_clear_bits(handle_t *handle,
-                                               struct inode *alloc_inode,
-                                               struct ocfs2_group_desc *bg,
-                                               struct buffer_head *group_bh,
-                                               unsigned int bit_off,
-                                               unsigned int num_bits);
-
 static int ocfs2_relink_block_group(handle_t *handle,
                                     struct inode *alloc_inode,
                                     struct buffer_head *fe_bh,
@@ -152,7 +145,7 @@ static u32 ocfs2_bits_per_group(struct ocfs2_chain_list *cl)
 
 #define do_error(fmt, ...)                                              \
         do{                                                             \
-                if (clean_error)                                        \
+                if (resize)                                     \
                         mlog(ML_ERROR, fmt "\n", ##__VA_ARGS__);        \
                 else                                                    \
                         ocfs2_error(sb, fmt, ##__VA_ARGS__);            \
@@ -160,7 +153,7 @@ static u32 ocfs2_bits_per_group(struct ocfs2_chain_list *cl)
 
 static int ocfs2_validate_gd_self(struct super_block *sb,
                                   struct buffer_head *bh,
-                                  int clean_error)
+                                  int resize)
 {
         struct ocfs2_group_desc *gd = (struct ocfs2_group_desc *)bh->b_data;
 
@@ -211,7 +204,7 @@ static int ocfs2_validate_gd_self(struct super_block *sb,
 static int ocfs2_validate_gd_parent(struct super_block *sb,
                                     struct ocfs2_dinode *di,
                                     struct buffer_head *bh,
-                                    int clean_error)
+                                    int resize)
 {
         unsigned int max_bits;
         struct ocfs2_group_desc *gd = (struct ocfs2_group_desc *)bh->b_data;
@@ -233,8 +226,11 @@ static int ocfs2_validate_gd_parent(struct super_block *sb,
                 return -EINVAL;
         }
 
-        if (le16_to_cpu(gd->bg_chain) >=
-            le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) {
+        /* In resize, we may meet the case bg_chain == cl_next_free_rec. */
+        if ((le16_to_cpu(gd->bg_chain) >
+             le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) ||
+            ((le16_to_cpu(gd->bg_chain) ==
+             le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) && !resize)) {
                 do_error("Group descriptor #%llu has bad chain %u",
                          (unsigned long long)bh->b_blocknr,
                          le16_to_cpu(gd->bg_chain));
@@ -637,12 +633,113 @@ bail:
         return status;
 }
 
+static void ocfs2_init_inode_steal_slot(struct ocfs2_super *osb)
+{
+        spin_lock(&osb->osb_lock);
+        osb->s_inode_steal_slot = OCFS2_INVALID_SLOT;
+        spin_unlock(&osb->osb_lock);
+        atomic_set(&osb->s_num_inodes_stolen, 0);
+}
+
+static void ocfs2_init_meta_steal_slot(struct ocfs2_super *osb)
+{
+        spin_lock(&osb->osb_lock);
+        osb->s_meta_steal_slot = OCFS2_INVALID_SLOT;
+        spin_unlock(&osb->osb_lock);
+        atomic_set(&osb->s_num_meta_stolen, 0);
+}
+
+void ocfs2_init_steal_slots(struct ocfs2_super *osb)
+{
+        ocfs2_init_inode_steal_slot(osb);
+        ocfs2_init_meta_steal_slot(osb);
+}
+
+static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type)
+{
+        spin_lock(&osb->osb_lock);
+        if (type == INODE_ALLOC_SYSTEM_INODE)
+                osb->s_inode_steal_slot = slot;
+        else if (type == EXTENT_ALLOC_SYSTEM_INODE)
+                osb->s_meta_steal_slot = slot;
+        spin_unlock(&osb->osb_lock);
+}
+
+static int __ocfs2_get_steal_slot(struct ocfs2_super *osb, int type)
+{
+        int slot = OCFS2_INVALID_SLOT;
+
+        spin_lock(&osb->osb_lock);
+        if (type == INODE_ALLOC_SYSTEM_INODE)
+                slot = osb->s_inode_steal_slot;
+        else if (type == EXTENT_ALLOC_SYSTEM_INODE)
+                slot = osb->s_meta_steal_slot;
+        spin_unlock(&osb->osb_lock);
+
+        return slot;
+}
+
+static int ocfs2_get_inode_steal_slot(struct ocfs2_super *osb)
+{
+        return __ocfs2_get_steal_slot(osb, INODE_ALLOC_SYSTEM_INODE);
+}
+
+static int ocfs2_get_meta_steal_slot(struct ocfs2_super *osb)
+{
+        return __ocfs2_get_steal_slot(osb, EXTENT_ALLOC_SYSTEM_INODE);
+}
+
+static int ocfs2_steal_resource(struct ocfs2_super *osb,
+                                struct ocfs2_alloc_context *ac,
+                                int type)
+{
+        int i, status = -ENOSPC;
+        int slot = __ocfs2_get_steal_slot(osb, type);
+
+        /* Start to steal resource from the first slot after ours. */
+        if (slot == OCFS2_INVALID_SLOT)
+                slot = osb->slot_num + 1;
+
+        for (i = 0; i < osb->max_slots; i++, slot++) {
+                if (slot == osb->max_slots)
+                        slot = 0;
+
+                if (slot == osb->slot_num)
+                        continue;
+
+                status = ocfs2_reserve_suballoc_bits(osb, ac,
+                                                     type,
+                                                     (u32)slot, NULL,
+                                                     NOT_ALLOC_NEW_GROUP);
+                if (status >= 0) {
+                        __ocfs2_set_steal_slot(osb, slot, type);
+                        break;
+                }
+
+                ocfs2_free_ac_resource(ac);
+        }
+
+        return status;
+}
+
+static int ocfs2_steal_inode(struct ocfs2_super *osb,
+                             struct ocfs2_alloc_context *ac)
+{
+        return ocfs2_steal_resource(osb, ac, INODE_ALLOC_SYSTEM_INODE);
+}
+
+static int ocfs2_steal_meta(struct ocfs2_super *osb,
+                            struct ocfs2_alloc_context *ac)
+{
+        return ocfs2_steal_resource(osb, ac, EXTENT_ALLOC_SYSTEM_INODE);
+}
+
 int ocfs2_reserve_new_metadata_blocks(struct ocfs2_super *osb,
                                       int blocks,
                                       struct ocfs2_alloc_context **ac)
 {
         int status;
-        u32 slot;
+        int slot = ocfs2_get_meta_steal_slot(osb);
 
         *ac = kzalloc(sizeof(struct ocfs2_alloc_context), GFP_KERNEL);
         if (!(*ac)) {
@@ -653,12 +750,34 @@ int ocfs2_reserve_new_metadata_blocks(struct ocfs2_super *osb,
 
         (*ac)->ac_bits_wanted = blocks;
         (*ac)->ac_which = OCFS2_AC_USE_META;
-        slot = osb->slot_num;
         (*ac)->ac_group_search = ocfs2_block_group_search;
 
+        if (slot != OCFS2_INVALID_SLOT &&
+                atomic_read(&osb->s_num_meta_stolen) < OCFS2_MAX_TO_STEAL)
+                goto extent_steal;
+
+        atomic_set(&osb->s_num_meta_stolen, 0);
         status = ocfs2_reserve_suballoc_bits(osb, (*ac),
                                              EXTENT_ALLOC_SYSTEM_INODE,
-                                             slot, NULL, ALLOC_NEW_GROUP);
+                                             (u32)osb->slot_num, NULL,
+                                             ALLOC_NEW_GROUP);
+
+
+        if (status >= 0) {
+                status = 0;
+                if (slot != OCFS2_INVALID_SLOT)
+                        ocfs2_init_meta_steal_slot(osb);
+                goto bail;
+        } else if (status < 0 && status != -ENOSPC) {
+                mlog_errno(status);
+                goto bail;
+        }
+
+        ocfs2_free_ac_resource(*ac);
+
+extent_steal:
+        status = ocfs2_steal_meta(osb, *ac);
+        atomic_inc(&osb->s_num_meta_stolen);
         if (status < 0) {
                 if (status != -ENOSPC)
                         mlog_errno(status);
@@ -685,43 +804,11 @@ int ocfs2_reserve_new_metadata(struct ocfs2_super *osb,
                                         ac);
 }
 
-static int ocfs2_steal_inode_from_other_nodes(struct ocfs2_super *osb,
-                                              struct ocfs2_alloc_context *ac)
-{
-        int i, status = -ENOSPC;
-        s16 slot = ocfs2_get_inode_steal_slot(osb);
-
-        /* Start to steal inodes from the first slot after ours. */
-        if (slot == OCFS2_INVALID_SLOT)
-                slot = osb->slot_num + 1;
-
-        for (i = 0; i < osb->max_slots; i++, slot++) {
-                if (slot == osb->max_slots)
-                        slot = 0;
-
-                if (slot == osb->slot_num)
-                        continue;
-
-                status = ocfs2_reserve_suballoc_bits(osb, ac,
-                                                     INODE_ALLOC_SYSTEM_INODE,
-                                                     slot, NULL,
-                                                     NOT_ALLOC_NEW_GROUP);
-                if (status >= 0) {
-                        ocfs2_set_inode_steal_slot(osb, slot);
-                        break;
-                }
-
-                ocfs2_free_ac_resource(ac);
-        }
-
-        return status;
-}
-
 int ocfs2_reserve_new_inode(struct ocfs2_super *osb,
                             struct ocfs2_alloc_context **ac)
 {
         int status;
-        s16 slot = ocfs2_get_inode_steal_slot(osb);
+        int slot = ocfs2_get_inode_steal_slot(osb);
         u64 alloc_group;
 
         *ac = kzalloc(sizeof(struct ocfs2_alloc_context), GFP_KERNEL);
@@ -754,14 +841,14 @@ int ocfs2_reserve_new_inode(struct ocfs2_super *osb,
          * need to check our slots to see whether there is some space for us.
          */
         if (slot != OCFS2_INVALID_SLOT &&
-            atomic_read(&osb->s_num_inodes_stolen) < OCFS2_MAX_INODES_TO_STEAL)
+            atomic_read(&osb->s_num_inodes_stolen) < OCFS2_MAX_TO_STEAL)
                 goto inode_steal;
 
         atomic_set(&osb->s_num_inodes_stolen, 0);
         alloc_group = osb->osb_inode_alloc_group;
         status = ocfs2_reserve_suballoc_bits(osb, *ac,
                                              INODE_ALLOC_SYSTEM_INODE,
-                                             osb->slot_num,
+                                             (u32)osb->slot_num,
                                              &alloc_group,
                                              ALLOC_NEW_GROUP |
                                              ALLOC_GROUPS_FROM_GLOBAL);
@@ -789,7 +876,7 @@ int ocfs2_reserve_new_inode(struct ocfs2_super *osb,
         ocfs2_free_ac_resource(*ac);
 
 inode_steal:
-        status = ocfs2_steal_inode_from_other_nodes(osb, *ac);
+        status = ocfs2_steal_inode(osb, *ac);
         atomic_inc(&osb->s_num_inodes_stolen);
         if (status < 0) {
                 if (status != -ENOSPC)
@@ -1884,18 +1971,18 @@ int ocfs2_claim_clusters(struct ocfs2_super *osb,
                                       bits_wanted, cluster_start, num_clusters);
 }
 
-static inline int ocfs2_block_group_clear_bits(handle_t *handle,
-                                               struct inode *alloc_inode,
-                                               struct ocfs2_group_desc *bg,
-                                               struct buffer_head *group_bh,
-                                               unsigned int bit_off,
-                                               unsigned int num_bits)
+static int ocfs2_block_group_clear_bits(handle_t *handle,
+                                        struct inode *alloc_inode,
+                                        struct ocfs2_group_desc *bg,
+                                        struct buffer_head *group_bh,
+                                        unsigned int bit_off,
+                                        unsigned int num_bits,
+                                        void (*undo_fn)(unsigned int bit,
+                                                        unsigned long *bmap))
 {
         int status;
         unsigned int tmp;
-        int journal_type = OCFS2_JOURNAL_ACCESS_WRITE;
         struct ocfs2_group_desc *undo_bg = NULL;
-        int cluster_bitmap = 0;
 
         mlog_entry_void();
 
@@ -1905,20 +1992,18 @@ static inline int ocfs2_block_group_clear_bits(handle_t *handle,
 
         mlog(0, "off = %u, num = %u\n", bit_off, num_bits);
 
-        if (ocfs2_is_cluster_bitmap(alloc_inode))
-                journal_type = OCFS2_JOURNAL_ACCESS_UNDO;
-
+        BUG_ON(undo_fn && !ocfs2_is_cluster_bitmap(alloc_inode));
         status = ocfs2_journal_access_gd(handle, INODE_CACHE(alloc_inode),
-                                         group_bh, journal_type);
+                                         group_bh,
+                                         undo_fn ?
+                                         OCFS2_JOURNAL_ACCESS_UNDO :
+                                         OCFS2_JOURNAL_ACCESS_WRITE);
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
         }
 
-        if (ocfs2_is_cluster_bitmap(alloc_inode))
-                cluster_bitmap = 1;
-
-        if (cluster_bitmap) {
+        if (undo_fn) {
                 jbd_lock_bh_state(group_bh);
                 undo_bg = (struct ocfs2_group_desc *)
                                         bh2jh(group_bh)->b_committed_data;
@@ -1929,13 +2014,13 @@ static inline int ocfs2_block_group_clear_bits(handle_t *handle,
         while(tmp--) {
                 ocfs2_clear_bit((bit_off + tmp),
                                 (unsigned long *) bg->bg_bitmap);
-                if (cluster_bitmap)
-                        ocfs2_set_bit(bit_off + tmp,
-                                      (unsigned long *) undo_bg->bg_bitmap);
+                if (undo_fn)
+                        undo_fn(bit_off + tmp,
+                                (unsigned long *) undo_bg->bg_bitmap);
         }
         le16_add_cpu(&bg->bg_free_bits_count, num_bits);
 
-        if (cluster_bitmap)
+        if (undo_fn)
                 jbd_unlock_bh_state(group_bh);
 
         status = ocfs2_journal_dirty(handle, group_bh);
@@ -1948,12 +2033,14 @@ bail:
 /*
  * expects the suballoc inode to already be locked.
  */
-int ocfs2_free_suballoc_bits(handle_t *handle,
-                             struct inode *alloc_inode,
-                             struct buffer_head *alloc_bh,
-                             unsigned int start_bit,
-                             u64 bg_blkno,
-                             unsigned int count)
+static int _ocfs2_free_suballoc_bits(handle_t *handle,
+                                     struct inode *alloc_inode,
+                                     struct buffer_head *alloc_bh,
+                                     unsigned int start_bit,
+                                     u64 bg_blkno,
+                                     unsigned int count,
+                                     void (*undo_fn)(unsigned int bit,
+                                                     unsigned long *bitmap))
 {
         int status = 0;
         u32 tmp_used;
@@ -1988,7 +2075,7 @@ int ocfs2_free_suballoc_bits(handle_t *handle,
 
         status = ocfs2_block_group_clear_bits(handle, alloc_inode,
                                               group, group_bh,
-                                              start_bit, count);
+                                              start_bit, count, undo_fn);
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
@@ -2019,6 +2106,17 @@ bail:
         return status;
 }
 
+int ocfs2_free_suballoc_bits(handle_t *handle,
+                             struct inode *alloc_inode,
+                             struct buffer_head *alloc_bh,
+                             unsigned int start_bit,
+                             u64 bg_blkno,
+                             unsigned int count)
+{
+        return _ocfs2_free_suballoc_bits(handle, alloc_inode, alloc_bh,
+                                         start_bit, bg_blkno, count, NULL);
+}
+
 int ocfs2_free_dinode(handle_t *handle,
                       struct inode *inode_alloc_inode,
                       struct buffer_head *inode_alloc_bh,
@@ -2032,11 +2130,13 @@ int ocfs2_free_dinode(handle_t *handle,
                                         inode_alloc_bh, bit, bg_blkno, 1);
 }
 
-int ocfs2_free_clusters(handle_t *handle,
-                       struct inode *bitmap_inode,
-                       struct buffer_head *bitmap_bh,
-                       u64 start_blk,
-                       unsigned int num_clusters)
+static int _ocfs2_free_clusters(handle_t *handle,
+                                struct inode *bitmap_inode,
+                                struct buffer_head *bitmap_bh,
+                                u64 start_blk,
+                                unsigned int num_clusters,
+                                void (*undo_fn)(unsigned int bit,
+                                                unsigned long *bitmap))
 {
         int status;
         u16 bg_start_bit;
@@ -2063,9 +2163,9 @@ int ocfs2_free_clusters(handle_t *handle,
         mlog(0, "bg_blkno = %llu, bg_start_bit = %u\n",
              (unsigned long long)bg_blkno, bg_start_bit);
 
-        status = ocfs2_free_suballoc_bits(handle, bitmap_inode, bitmap_bh,
-                                          bg_start_bit, bg_blkno,
-                                          num_clusters);
+        status = _ocfs2_free_suballoc_bits(handle, bitmap_inode, bitmap_bh,
+                                           bg_start_bit, bg_blkno,
+                                           num_clusters, undo_fn);
         if (status < 0) {
                 mlog_errno(status);
                 goto out;
@@ -2079,6 +2179,32 @@ out:
         return status;
 }
 
+int ocfs2_free_clusters(handle_t *handle,
+                        struct inode *bitmap_inode,
+                        struct buffer_head *bitmap_bh,
+                        u64 start_blk,
+                        unsigned int num_clusters)
+{
+        return _ocfs2_free_clusters(handle, bitmap_inode, bitmap_bh,
+                                    start_blk, num_clusters,
+                                    _ocfs2_set_bit);
+}
+
+/*
+ * Give never-used clusters back to the global bitmap.  We don't need
+ * to protect these bits in the undo buffer.
+ */
+int ocfs2_release_clusters(handle_t *handle,
+                           struct inode *bitmap_inode,
+                           struct buffer_head *bitmap_bh,
+                           u64 start_blk,
+                           unsigned int num_clusters)
+{
+        return _ocfs2_free_clusters(handle, bitmap_inode, bitmap_bh,
+                                    start_blk, num_clusters,
+                                    _ocfs2_clear_bit);
+}
+
 static inline void ocfs2_debug_bg(struct ocfs2_group_desc *bg)
 {
         printk("Block Group:\n");
diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h
index 8c9a78a43164..e0f46df357e6 100644
--- a/fs/ocfs2/suballoc.h
+++ b/fs/ocfs2/suballoc.h
@@ -56,6 +56,7 @@ struct ocfs2_alloc_context {
                                  is the same as ~0 - unlimited */
 };
 
+void ocfs2_init_steal_slots(struct ocfs2_super *osb);
 void ocfs2_free_alloc_context(struct ocfs2_alloc_context *ac);
 static inline int ocfs2_alloc_context_bits_left(struct ocfs2_alloc_context *ac)
 {
@@ -126,6 +127,11 @@ int ocfs2_free_clusters(handle_t *handle,
                         struct buffer_head *bitmap_bh,
                         u64 start_blk,
                         unsigned int num_clusters);
+int ocfs2_release_clusters(handle_t *handle,
+                           struct inode *bitmap_inode,
+                           struct buffer_head *bitmap_bh,
+                           u64 start_blk,
+                           unsigned int num_clusters);
 
 static inline u64 ocfs2_which_suballoc_group(u64 block, unsigned int bit)
 {
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 26069917a9f5..dee03197a494 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -69,6 +69,7 @@
 #include "xattr.h"
 #include "quota.h"
 #include "refcounttree.h"
+#include "suballoc.h"
 
 #include "buffer_head_io.h"
 
@@ -301,9 +302,12 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
 
         spin_lock(&osb->osb_lock);
         out += snprintf(buf + out, len - out,
-                        "%10s => Slot: %d  NumStolen: %d\n", "Steal",
+                        "%10s => InodeSlot: %d  StolenInodes: %d, "
+                        "MetaSlot: %d  StolenMeta: %d\n", "Steal",
                         osb->s_inode_steal_slot,
-                        atomic_read(&osb->s_num_inodes_stolen));
+                        atomic_read(&osb->s_num_inodes_stolen),
+                        osb->s_meta_steal_slot,
+                        atomic_read(&osb->s_num_meta_stolen));
         spin_unlock(&osb->osb_lock);
 
         out += snprintf(buf + out, len - out, "OrphanScan => ");
@@ -1062,7 +1066,7 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
                                      "file system, but write access is "
                                      "unavailable.\n");
                         else
-                                mlog_errno(status);                     
+                                mlog_errno(status);
                         goto read_super_error;
                 }
 
@@ -1997,7 +2001,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
         osb->blocked_lock_count = 0;
         spin_lock_init(&osb->osb_lock);
         spin_lock_init(&osb->osb_xattr_lock);
-        ocfs2_init_inode_steal_slot(osb);
+        ocfs2_init_steal_slots(osb);
 
         atomic_set(&osb->alloc_stats.moves, 0);
         atomic_set(&osb->alloc_stats.local_data, 0);
diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
index 49b133ccbf11..32499d213fc4 100644
--- a/fs/ocfs2/symlink.c
+++ b/fs/ocfs2/symlink.c
@@ -137,20 +137,20 @@ static void *ocfs2_fast_follow_link(struct dentry *dentry,
         }
 
         memcpy(link, target, len);
-        nd_set_link(nd, link);
 
 bail:
+        nd_set_link(nd, status ? ERR_PTR(status) : link);
         brelse(bh);
 
         mlog_exit(status);
-        return status ? ERR_PTR(status) : link;
+        return NULL;
 }
 
 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
-        char *link = cookie;
-
-        kfree(link);
+        char *link = nd_get_link(nd);
+        if (!IS_ERR(link))
+                kfree(link);
 }
 
 const struct inode_operations ocfs2_symlink_inode_operations = {
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index 40e53702948c..bfe7190cdbf1 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -25,7 +25,6 @@
 
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 
 #define MLOG_MASK_PREFIX ML_INODE
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index c61369342a27..a0a120e82b97 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -267,8 +267,8 @@ static int ocfs2_buffer_cached(struct ocfs2_caching_info *ci,
 }
 
 /* Warning: even if it returns true, this does *not* guarantee that
- * the block is stored in our inode metadata cache. 
- * 
+ * the block is stored in our inode metadata cache.
+ *
  * This can be called under lock_buffer()
  */
 int ocfs2_buffer_uptodate(struct ocfs2_caching_info *ci,
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 8fc6fb071c6d..3e7773089b96 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -116,10 +116,11 @@ static struct xattr_handler *ocfs2_xattr_handler_map[OCFS2_XATTR_MAX] = {
 };
 
 struct ocfs2_xattr_info {
-        int name_index;
-        const char *name;
-        const void *value;
-        size_t value_len;
+        int             xi_name_index;
+        const char      *xi_name;
+        int             xi_name_len;
+        const void      *xi_value;
+        size_t          xi_value_len;
 };
 
 struct ocfs2_xattr_search {
@@ -137,6 +138,115 @@ struct ocfs2_xattr_search {
         int not_found;
 };
 
+/* Operations on struct ocfs2_xa_entry */
+struct ocfs2_xa_loc;
+struct ocfs2_xa_loc_operations {
+        /*
+         * Journal functions
+         */
+        int (*xlo_journal_access)(handle_t *handle, struct ocfs2_xa_loc *loc,
+                                  int type);
+        void (*xlo_journal_dirty)(handle_t *handle, struct ocfs2_xa_loc *loc);
+
+        /*
+         * Return a pointer to the appropriate buffer in loc->xl_storage
+         * at the given offset from loc->xl_header.
+         */
+        void *(*xlo_offset_pointer)(struct ocfs2_xa_loc *loc, int offset);
+
+        /* Can we reuse the existing entry for the new value? */
+        int (*xlo_can_reuse)(struct ocfs2_xa_loc *loc,
+                             struct ocfs2_xattr_info *xi);
+
+        /* How much space is needed for the new value? */
+        int (*xlo_check_space)(struct ocfs2_xa_loc *loc,
+                               struct ocfs2_xattr_info *xi);
+
+        /*
+         * Return the offset of the first name+value pair.  This is
+         * the start of our downward-filling free space.
+         */
+        int (*xlo_get_free_start)(struct ocfs2_xa_loc *loc);
+
+        /*
+         * Remove the name+value at this location.  Do whatever is
+         * appropriate with the remaining name+value pairs.
+         */
+        void (*xlo_wipe_namevalue)(struct ocfs2_xa_loc *loc);
+
+        /* Fill xl_entry with a new entry */
+        void (*xlo_add_entry)(struct ocfs2_xa_loc *loc, u32 name_hash);
+
+        /* Add name+value storage to an entry */
+        void (*xlo_add_namevalue)(struct ocfs2_xa_loc *loc, int size);
+
+        /*
+         * Initialize the value buf's access and bh fields for this entry.
+         * ocfs2_xa_fill_value_buf() will handle the xv pointer.
+         */
+        void (*xlo_fill_value_buf)(struct ocfs2_xa_loc *loc,
+                                   struct ocfs2_xattr_value_buf *vb);
+};
+
+/*
+ * Describes an xattr entry location.  This is a memory structure
+ * tracking the on-disk structure.
+ */
+struct ocfs2_xa_loc {
+        /* This xattr belongs to this inode */
+        struct inode *xl_inode;
+
+        /* The ocfs2_xattr_header inside the on-disk storage. Not NULL. */
+        struct ocfs2_xattr_header *xl_header;
+
+        /* Bytes from xl_header to the end of the storage */
+        int xl_size;
+
+        /*
+         * The ocfs2_xattr_entry this location describes.  If this is
+         * NULL, this location describes the on-disk structure where it
+         * would have been.
+         */
+        struct ocfs2_xattr_entry *xl_entry;
+
+        /*
+         * Internal housekeeping
+         */
+
+        /* Buffer(s) containing this entry */
+        void *xl_storage;
+
+        /* Operations on the storage backing this location */
+        const struct ocfs2_xa_loc_operations *xl_ops;
+};
+
+/*
+ * Convenience functions to calculate how much space is needed for a
+ * given name+value pair
+ */
+static int namevalue_size(int name_len, uint64_t value_len)
+{
+        if (value_len > OCFS2_XATTR_INLINE_SIZE)
+                return OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
+        else
+                return OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_SIZE(value_len);
+}
+
+static int namevalue_size_xi(struct ocfs2_xattr_info *xi)
+{
+        return namevalue_size(xi->xi_name_len, xi->xi_value_len);
+}
+
+static int namevalue_size_xe(struct ocfs2_xattr_entry *xe)
+{
+        u64 value_len = le64_to_cpu(xe->xe_value_size);
+
+        BUG_ON((value_len > OCFS2_XATTR_INLINE_SIZE) &&
+               ocfs2_xattr_is_local(xe));
+        return namevalue_size(xe->xe_name_len, value_len);
+}
+
+
 static int ocfs2_xattr_bucket_get_name_value(struct super_block *sb,
                                              struct ocfs2_xattr_header *xh,
                                              int index,
@@ -212,14 +322,6 @@ static inline u16 ocfs2_blocks_per_xattr_bucket(struct super_block *sb)
         return OCFS2_XATTR_BUCKET_SIZE / (1 << sb->s_blocksize_bits);
 }
 
-static inline u16 ocfs2_xattr_max_xe_in_bucket(struct super_block *sb)
-{
-        u16 len = sb->s_blocksize -
-                 offsetof(struct ocfs2_xattr_header, xh_entries);
-
-        return len / sizeof(struct ocfs2_xattr_entry);
-}
-
 #define bucket_blkno(_b) ((_b)->bu_bhs[0]->b_blocknr)
 #define bucket_block(_b, _n) ((_b)->bu_bhs[(_n)]->b_data)
 #define bucket_xh(_b) ((struct ocfs2_xattr_header *)bucket_block((_b), 0))
@@ -463,35 +565,22 @@ static u32 ocfs2_xattr_name_hash(struct inode *inode,
         return hash;
 }
 
-/*
- * ocfs2_xattr_hash_entry()
- *
- * Compute the hash of an extended attribute.
- */
-static void ocfs2_xattr_hash_entry(struct inode *inode,
-                                   struct ocfs2_xattr_header *header,
-                                   struct ocfs2_xattr_entry *entry)
+static int ocfs2_xattr_entry_real_size(int name_len, size_t value_len)
 {
-        u32 hash = 0;
-        char *name = (char *)header + le16_to_cpu(entry->xe_name_offset);
-
-        hash = ocfs2_xattr_name_hash(inode, name, entry->xe_name_len);
-        entry->xe_name_hash = cpu_to_le32(hash);
-
-        return;
+        return namevalue_size(name_len, value_len) +
+                sizeof(struct ocfs2_xattr_entry);
 }
 
-static int ocfs2_xattr_entry_real_size(int name_len, size_t value_len)
+static int ocfs2_xi_entry_usage(struct ocfs2_xattr_info *xi)
 {
-        int size = 0;
-
-        if (value_len <= OCFS2_XATTR_INLINE_SIZE)
-                size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_SIZE(value_len);
-        else
-                size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
-        size += sizeof(struct ocfs2_xattr_entry);
+        return namevalue_size_xi(xi) +
+                sizeof(struct ocfs2_xattr_entry);
+}
 
-        return size;
+static int ocfs2_xe_entry_usage(struct ocfs2_xattr_entry *xe)
+{
+        return namevalue_size_xe(xe) +
+                sizeof(struct ocfs2_xattr_entry);
 }
 
 int ocfs2_calc_security_init(struct inode *dir,
@@ -1308,452 +1397,897 @@ out:
         return ret;
 }
 
-static int ocfs2_xattr_cleanup(struct inode *inode,
-                               handle_t *handle,
-                               struct ocfs2_xattr_info *xi,
-                               struct ocfs2_xattr_search *xs,
-                               struct ocfs2_xattr_value_buf *vb,
-                               size_t offs)
+static int ocfs2_xa_check_space_helper(int needed_space, int free_start,
+                                       int num_entries)
 {
-        int ret = 0;
-        size_t name_len = strlen(xi->name);
-        void *val = xs->base + offs;
-        size_t size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
+        int free_space;
 
-        ret = vb->vb_access(handle, INODE_CACHE(inode), vb->vb_bh,
-                            OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-        /* Decrease xattr count */
-        le16_add_cpu(&xs->header->xh_count, -1);
-        /* Remove the xattr entry and tree root which has already be set*/
-        memset((void *)xs->here, 0, sizeof(struct ocfs2_xattr_entry));
-        memset(val, 0, size);
+        if (!needed_space)
+                return 0;
 
-        ret = ocfs2_journal_dirty(handle, vb->vb_bh);
-        if (ret < 0)
-                mlog_errno(ret);
-out:
-        return ret;
+        free_space = free_start -
+                sizeof(struct ocfs2_xattr_header) -
+                (num_entries * sizeof(struct ocfs2_xattr_entry)) -
+                OCFS2_XATTR_HEADER_GAP;
+        if (free_space < 0)
+                return -EIO;
+        if (free_space < needed_space)
+                return -ENOSPC;
+
+        return 0;
 }
 
-static int ocfs2_xattr_update_entry(struct inode *inode,
-                                    handle_t *handle,
-                                    struct ocfs2_xattr_info *xi,
-                                    struct ocfs2_xattr_search *xs,
-                                    struct ocfs2_xattr_value_buf *vb,
-                                    size_t offs)
+static int ocfs2_xa_journal_access(handle_t *handle, struct ocfs2_xa_loc *loc,
+                                   int type)
 {
-        int ret;
+        return loc->xl_ops->xlo_journal_access(handle, loc, type);
+}
 
-        ret = vb->vb_access(handle, INODE_CACHE(inode), vb->vb_bh,
-                            OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
+static void ocfs2_xa_journal_dirty(handle_t *handle, struct ocfs2_xa_loc *loc)
+{
+        loc->xl_ops->xlo_journal_dirty(handle, loc);
+}
 
-        xs->here->xe_name_offset = cpu_to_le16(offs);
-        xs->here->xe_value_size = cpu_to_le64(xi->value_len);
-        if (xi->value_len <= OCFS2_XATTR_INLINE_SIZE)
-                ocfs2_xattr_set_local(xs->here, 1);
-        else
-                ocfs2_xattr_set_local(xs->here, 0);
-        ocfs2_xattr_hash_entry(inode, xs->header, xs->here);
+/* Give a pointer into the storage for the given offset */
+static void *ocfs2_xa_offset_pointer(struct ocfs2_xa_loc *loc, int offset)
+{
+        BUG_ON(offset >= loc->xl_size);
+        return loc->xl_ops->xlo_offset_pointer(loc, offset);
+}
 
-        ret = ocfs2_journal_dirty(handle, vb->vb_bh);
-        if (ret < 0)
-                mlog_errno(ret);
-out:
-        return ret;
+/*
+ * Wipe the name+value pair and allow the storage to reclaim it.  This
+ * must be followed by either removal of the entry or a call to
+ * ocfs2_xa_add_namevalue().
+ */
+static void ocfs2_xa_wipe_namevalue(struct ocfs2_xa_loc *loc)
+{
+        loc->xl_ops->xlo_wipe_namevalue(loc);
 }
 
 /*
- * ocfs2_xattr_set_value_outside()
- *
- * Set large size value in B tree.
+ * Find lowest offset to a name+value pair.  This is the start of our
+ * downward-growing free space.
  */
-static int ocfs2_xattr_set_value_outside(struct inode *inode,
-                                         struct ocfs2_xattr_info *xi,
-                                         struct ocfs2_xattr_search *xs,
-                                         struct ocfs2_xattr_set_ctxt *ctxt,
-                                         struct ocfs2_xattr_value_buf *vb,
-                                         size_t offs)
+static int ocfs2_xa_get_free_start(struct ocfs2_xa_loc *loc)
 {
-        size_t name_len = strlen(xi->name);
-        void *val = xs->base + offs;
-        struct ocfs2_xattr_value_root *xv = NULL;
-        size_t size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
-        int ret = 0;
+        return loc->xl_ops->xlo_get_free_start(loc);
+}
 
-        memset(val, 0, size);
-        memcpy(val, xi->name, name_len);
-        xv = (struct ocfs2_xattr_value_root *)
-                (val + OCFS2_XATTR_SIZE(name_len));
-        xv->xr_clusters = 0;
-        xv->xr_last_eb_blk = 0;
-        xv->xr_list.l_tree_depth = 0;
-        xv->xr_list.l_count = cpu_to_le16(1);
-        xv->xr_list.l_next_free_rec = 0;
-        vb->vb_xv = xv;
-
-        ret = ocfs2_xattr_value_truncate(inode, vb, xi->value_len, ctxt);
-        if (ret < 0) {
-                mlog_errno(ret);
-                return ret;
+/* Can we reuse loc->xl_entry for xi? */
+static int ocfs2_xa_can_reuse_entry(struct ocfs2_xa_loc *loc,
+                                    struct ocfs2_xattr_info *xi)
+{
+        return loc->xl_ops->xlo_can_reuse(loc, xi);
+}
+
+/* How much free space is needed to set the new value */
+static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc,
+                                struct ocfs2_xattr_info *xi)
+{
+        return loc->xl_ops->xlo_check_space(loc, xi);
+}
+
+static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+{
+        loc->xl_ops->xlo_add_entry(loc, name_hash);
+        loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash);
+        /*
+         * We can't leave the new entry's xe_name_offset at zero or
+         * add_namevalue() will go nuts.  We set it to the size of our
+         * storage so that it can never be less than any other entry.
+         */
+        loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size);
+}
+
+static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc,
+                                   struct ocfs2_xattr_info *xi)
+{
+        int size = namevalue_size_xi(xi);
+        int nameval_offset;
+        char *nameval_buf;
+
+        loc->xl_ops->xlo_add_namevalue(loc, size);
+        loc->xl_entry->xe_value_size = cpu_to_le64(xi->xi_value_len);
+        loc->xl_entry->xe_name_len = xi->xi_name_len;
+        ocfs2_xattr_set_type(loc->xl_entry, xi->xi_name_index);
+        ocfs2_xattr_set_local(loc->xl_entry,
+                              xi->xi_value_len <= OCFS2_XATTR_INLINE_SIZE);
+
+        nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        nameval_buf = ocfs2_xa_offset_pointer(loc, nameval_offset);
+        memset(nameval_buf, 0, size);
+        memcpy(nameval_buf, xi->xi_name, xi->xi_name_len);
+}
+
+static void ocfs2_xa_fill_value_buf(struct ocfs2_xa_loc *loc,
+                                    struct ocfs2_xattr_value_buf *vb)
+{
+        int nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        int name_size = OCFS2_XATTR_SIZE(loc->xl_entry->xe_name_len);
+
+        /* Value bufs are for value trees */
+        BUG_ON(ocfs2_xattr_is_local(loc->xl_entry));
+        BUG_ON(namevalue_size_xe(loc->xl_entry) !=
+               (name_size + OCFS2_XATTR_ROOT_SIZE));
+
+        loc->xl_ops->xlo_fill_value_buf(loc, vb);
+        vb->vb_xv =
+                (struct ocfs2_xattr_value_root *)ocfs2_xa_offset_pointer(loc,
+                                                        nameval_offset +
+                                                        name_size);
+}
+
+static int ocfs2_xa_block_journal_access(handle_t *handle,
+                                         struct ocfs2_xa_loc *loc, int type)
+{
+        struct buffer_head *bh = loc->xl_storage;
+        ocfs2_journal_access_func access;
+
+        if (loc->xl_size == (bh->b_size -
+                             offsetof(struct ocfs2_xattr_block,
+                                      xb_attrs.xb_header)))
+                access = ocfs2_journal_access_xb;
+        else
+                access = ocfs2_journal_access_di;
+        return access(handle, INODE_CACHE(loc->xl_inode), bh, type);
+}
+
+static void ocfs2_xa_block_journal_dirty(handle_t *handle,
+                                         struct ocfs2_xa_loc *loc)
+{
+        struct buffer_head *bh = loc->xl_storage;
+
+        ocfs2_journal_dirty(handle, bh);
+}
+
+static void *ocfs2_xa_block_offset_pointer(struct ocfs2_xa_loc *loc,
+                                           int offset)
+{
+        return (char *)loc->xl_header + offset;
+}
+
+static int ocfs2_xa_block_can_reuse(struct ocfs2_xa_loc *loc,
+                                    struct ocfs2_xattr_info *xi)
+{
+        /*
+         * Block storage is strict.  If the sizes aren't exact, we will
+         * remove the old one and reinsert the new.
+         */
+        return namevalue_size_xe(loc->xl_entry) ==
+                namevalue_size_xi(xi);
+}
+
+static int ocfs2_xa_block_get_free_start(struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        int i, count = le16_to_cpu(xh->xh_count);
+        int offset, free_start = loc->xl_size;
+
+        for (i = 0; i < count; i++) {
+                offset = le16_to_cpu(xh->xh_entries[i].xe_name_offset);
+                if (offset < free_start)
+                        free_start = offset;
         }
-        ret = ocfs2_xattr_update_entry(inode, ctxt->handle, xi, xs, vb, offs);
-        if (ret < 0) {
-                mlog_errno(ret);
-                return ret;
+
+        return free_start;
+}
+
+static int ocfs2_xa_block_check_space(struct ocfs2_xa_loc *loc,
+                                      struct ocfs2_xattr_info *xi)
+{
+        int count = le16_to_cpu(loc->xl_header->xh_count);
+        int free_start = ocfs2_xa_get_free_start(loc);
+        int needed_space = ocfs2_xi_entry_usage(xi);
+
+        /*
+         * Block storage will reclaim the original entry before inserting
+         * the new value, so we only need the difference.  If the new
+         * entry is smaller than the old one, we don't need anything.
+         */
+        if (loc->xl_entry) {
+                /* Don't need space if we're reusing! */
+                if (ocfs2_xa_can_reuse_entry(loc, xi))
+                        needed_space = 0;
+                else
+                        needed_space -= ocfs2_xe_entry_usage(loc->xl_entry);
         }
-        ret = __ocfs2_xattr_set_value_outside(inode, ctxt->handle, vb,
-                                              xi->value, xi->value_len);
-        if (ret < 0)
-                mlog_errno(ret);
+        if (needed_space < 0)
+                needed_space = 0;
+        return ocfs2_xa_check_space_helper(needed_space, free_start, count);
+}
 
-        return ret;
+/*
+ * Block storage for xattrs keeps the name+value pairs compacted.  When
+ * we remove one, we have to shift any that preceded it towards the end.
+ */
+static void ocfs2_xa_block_wipe_namevalue(struct ocfs2_xa_loc *loc)
+{
+        int i, offset;
+        int namevalue_offset, first_namevalue_offset, namevalue_size;
+        struct ocfs2_xattr_entry *entry = loc->xl_entry;
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        int count = le16_to_cpu(xh->xh_count);
+
+        namevalue_offset = le16_to_cpu(entry->xe_name_offset);
+        namevalue_size = namevalue_size_xe(entry);
+        first_namevalue_offset = ocfs2_xa_get_free_start(loc);
+
+        /* Shift the name+value pairs */
+        memmove((char *)xh + first_namevalue_offset + namevalue_size,
+                (char *)xh + first_namevalue_offset,
+                namevalue_offset - first_namevalue_offset);
+        memset((char *)xh + first_namevalue_offset, 0, namevalue_size);
+
+        /* Now tell xh->xh_entries about it */
+        for (i = 0; i < count; i++) {
+                offset = le16_to_cpu(xh->xh_entries[i].xe_name_offset);
+                if (offset <= namevalue_offset)
+                        le16_add_cpu(&xh->xh_entries[i].xe_name_offset,
+                                     namevalue_size);
+        }
+
+        /*
+         * Note that we don't update xh_free_start or xh_name_value_len
+         * because they're not used in block-stored xattrs.
+         */
+}
+
+static void ocfs2_xa_block_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+{
+        int count = le16_to_cpu(loc->xl_header->xh_count);
+        loc->xl_entry = &(loc->xl_header->xh_entries[count]);
+        le16_add_cpu(&loc->xl_header->xh_count, 1);
+        memset(loc->xl_entry, 0, sizeof(struct ocfs2_xattr_entry));
+}
+
+static void ocfs2_xa_block_add_namevalue(struct ocfs2_xa_loc *loc, int size)
+{
+        int free_start = ocfs2_xa_get_free_start(loc);
+
+        loc->xl_entry->xe_name_offset = cpu_to_le16(free_start - size);
+}
+
+static void ocfs2_xa_block_fill_value_buf(struct ocfs2_xa_loc *loc,
+                                          struct ocfs2_xattr_value_buf *vb)
+{
+        struct buffer_head *bh = loc->xl_storage;
+
+        if (loc->xl_size == (bh->b_size -
+                             offsetof(struct ocfs2_xattr_block,
+                                      xb_attrs.xb_header)))
+                vb->vb_access = ocfs2_journal_access_xb;
+        else
+                vb->vb_access = ocfs2_journal_access_di;
+        vb->vb_bh = bh;
 }
 
 /*
- * ocfs2_xattr_set_entry_local()
- *
- * Set, replace or remove extended attribute in local.
+ * Operations for xattrs stored in blocks.  This includes inline inode
+ * storage and unindexed ocfs2_xattr_blocks.
  */
-static void ocfs2_xattr_set_entry_local(struct inode *inode,
-                                        struct ocfs2_xattr_info *xi,
-                                        struct ocfs2_xattr_search *xs,
-                                        struct ocfs2_xattr_entry *last,
-                                        size_t min_offs)
+static const struct ocfs2_xa_loc_operations ocfs2_xa_block_loc_ops = {
+        .xlo_journal_access     = ocfs2_xa_block_journal_access,
+        .xlo_journal_dirty      = ocfs2_xa_block_journal_dirty,
+        .xlo_offset_pointer     = ocfs2_xa_block_offset_pointer,
+        .xlo_check_space        = ocfs2_xa_block_check_space,
+        .xlo_can_reuse          = ocfs2_xa_block_can_reuse,
+        .xlo_get_free_start     = ocfs2_xa_block_get_free_start,
+        .xlo_wipe_namevalue     = ocfs2_xa_block_wipe_namevalue,
+        .xlo_add_entry          = ocfs2_xa_block_add_entry,
+        .xlo_add_namevalue      = ocfs2_xa_block_add_namevalue,
+        .xlo_fill_value_buf     = ocfs2_xa_block_fill_value_buf,
+};
+
+static int ocfs2_xa_bucket_journal_access(handle_t *handle,
+                                          struct ocfs2_xa_loc *loc, int type)
 {
-        size_t name_len = strlen(xi->name);
-        int i;
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
 
-        if (xi->value && xs->not_found) {
-                /* Insert the new xattr entry. */
-                le16_add_cpu(&xs->header->xh_count, 1);
-                ocfs2_xattr_set_type(last, xi->name_index);
-                ocfs2_xattr_set_local(last, 1);
-                last->xe_name_len = name_len;
-        } else {
-                void *first_val;
-                void *val;
-                size_t offs, size;
-
-                first_val = xs->base + min_offs;
-                offs = le16_to_cpu(xs->here->xe_name_offset);
-                val = xs->base + offs;
-
-                if (le64_to_cpu(xs->here->xe_value_size) >
-                    OCFS2_XATTR_INLINE_SIZE)
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_ROOT_SIZE;
+        return ocfs2_xattr_bucket_journal_access(handle, bucket, type);
+}
+
+static void ocfs2_xa_bucket_journal_dirty(handle_t *handle,
+                                          struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+
+        ocfs2_xattr_bucket_journal_dirty(handle, bucket);
+}
+
+static void *ocfs2_xa_bucket_offset_pointer(struct ocfs2_xa_loc *loc,
+                                            int offset)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+        int block, block_offset;
+
+        /* The header is at the front of the bucket */
+        block = offset >> loc->xl_inode->i_sb->s_blocksize_bits;
+        block_offset = offset % loc->xl_inode->i_sb->s_blocksize;
+
+        return bucket_block(bucket, block) + block_offset;
+}
+
+static int ocfs2_xa_bucket_can_reuse(struct ocfs2_xa_loc *loc,
+                                     struct ocfs2_xattr_info *xi)
+{
+        return namevalue_size_xe(loc->xl_entry) >=
+                namevalue_size_xi(xi);
+}
+
+static int ocfs2_xa_bucket_get_free_start(struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+        return le16_to_cpu(bucket_xh(bucket)->xh_free_start);
+}
+
+static int ocfs2_bucket_align_free_start(struct super_block *sb,
+                                         int free_start, int size)
+{
+        /*
+         * We need to make sure that the name+value pair fits within
+         * one block.
+         */
+        if (((free_start - size) >> sb->s_blocksize_bits) !=
+            ((free_start - 1) >> sb->s_blocksize_bits))
+                free_start -= free_start % sb->s_blocksize;
+
+        return free_start;
+}
+
+static int ocfs2_xa_bucket_check_space(struct ocfs2_xa_loc *loc,
+                                       struct ocfs2_xattr_info *xi)
+{
+        int rc;
+        int count = le16_to_cpu(loc->xl_header->xh_count);
+        int free_start = ocfs2_xa_get_free_start(loc);
+        int needed_space = ocfs2_xi_entry_usage(xi);
+        int size = namevalue_size_xi(xi);
+        struct super_block *sb = loc->xl_inode->i_sb;
+
+        /*
+         * Bucket storage does not reclaim name+value pairs it cannot
+         * reuse.  They live as holes until the bucket fills, and then
+         * the bucket is defragmented.  However, the bucket can reclaim
+         * the ocfs2_xattr_entry.
+         */
+        if (loc->xl_entry) {
+                /* Don't need space if we're reusing! */
+                if (ocfs2_xa_can_reuse_entry(loc, xi))
+                        needed_space = 0;
                 else
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xs->here->xe_value_size));
-
-                if (xi->value && size == OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_SIZE(xi->value_len)) {
-                        /* The old and the new value have the
-                           same size. Just replace the value. */
-                        ocfs2_xattr_set_local(xs->here, 1);
-                        xs->here->xe_value_size = cpu_to_le64(xi->value_len);
-                        /* Clear value bytes. */
-                        memset(val + OCFS2_XATTR_SIZE(name_len),
-                               0,
-                               OCFS2_XATTR_SIZE(xi->value_len));
-                        memcpy(val + OCFS2_XATTR_SIZE(name_len),
-                               xi->value,
-                               xi->value_len);
-                        return;
-                }
-                /* Remove the old name+value. */
-                memmove(first_val + size, first_val, val - first_val);
-                memset(first_val, 0, size);
-                xs->here->xe_name_hash = 0;
-                xs->here->xe_name_offset = 0;
-                ocfs2_xattr_set_local(xs->here, 1);
-                xs->here->xe_value_size = 0;
-
-                min_offs += size;
-
-                /* Adjust all value offsets. */
-                last = xs->header->xh_entries;
-                for (i = 0 ; i < le16_to_cpu(xs->header->xh_count); i++) {
-                        size_t o = le16_to_cpu(last->xe_name_offset);
-
-                        if (o < offs)
-                                last->xe_name_offset = cpu_to_le16(o + size);
-                        last += 1;
-                }
+                        needed_space -= sizeof(struct ocfs2_xattr_entry);
+        }
+        BUG_ON(needed_space < 0);
 
-                if (!xi->value) {
-                        /* Remove the old entry. */
-                        last -= 1;
-                        memmove(xs->here, xs->here + 1,
-                                (void *)last - (void *)xs->here);
-                        memset(last, 0, sizeof(struct ocfs2_xattr_entry));
-                        le16_add_cpu(&xs->header->xh_count, -1);
-                }
+        if (free_start < size) {
+                if (needed_space)
+                        return -ENOSPC;
+        } else {
+                /*
+                 * First we check if it would fit in the first place.
+                 * Below, we align the free start to a block.  This may
+                 * slide us below the minimum gap.  By checking unaligned
+                 * first, we avoid that error.
+                 */
+                rc = ocfs2_xa_check_space_helper(needed_space, free_start,
+                                                 count);
+                if (rc)
+                        return rc;
+                free_start = ocfs2_bucket_align_free_start(sb, free_start,
+                                                           size);
         }
-        if (xi->value) {
-                /* Insert the new name+value. */
-                size_t size = OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_SIZE(xi->value_len);
-                void *val = xs->base + min_offs - size;
+        return ocfs2_xa_check_space_helper(needed_space, free_start, count);
+}
+
+static void ocfs2_xa_bucket_wipe_namevalue(struct ocfs2_xa_loc *loc)
+{
+        le16_add_cpu(&loc->xl_header->xh_name_value_len,
+                     -namevalue_size_xe(loc->xl_entry));
+}
 
-                xs->here->xe_name_offset = cpu_to_le16(min_offs - size);
-                memset(val, 0, size);
-                memcpy(val, xi->name, name_len);
-                memcpy(val + OCFS2_XATTR_SIZE(name_len),
-                       xi->value,
-                       xi->value_len);
-                xs->here->xe_value_size = cpu_to_le64(xi->value_len);
-                ocfs2_xattr_set_local(xs->here, 1);
-                ocfs2_xattr_hash_entry(inode, xs->header, xs->here);
+static void ocfs2_xa_bucket_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+{
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        int count = le16_to_cpu(xh->xh_count);
+        int low = 0, high = count - 1, tmp;
+        struct ocfs2_xattr_entry *tmp_xe;
+
+        /*
+         * We keep buckets sorted by name_hash, so we need to find
+         * our insert place.
+         */
+        while (low <= high && count) {
+                tmp = (low + high) / 2;
+                tmp_xe = &xh->xh_entries[tmp];
+
+                if (name_hash > le32_to_cpu(tmp_xe->xe_name_hash))
+                        low = tmp + 1;
+                else if (name_hash < le32_to_cpu(tmp_xe->xe_name_hash))
+                        high = tmp - 1;
+                else {
+                        low = tmp;
+                        break;
+                }
         }
 
-        return;
+        if (low != count)
+                memmove(&xh->xh_entries[low + 1],
+                        &xh->xh_entries[low],
+                        ((count - low) * sizeof(struct ocfs2_xattr_entry)));
+
+        le16_add_cpu(&xh->xh_count, 1);
+        loc->xl_entry = &xh->xh_entries[low];
+        memset(loc->xl_entry, 0, sizeof(struct ocfs2_xattr_entry));
+}
+
+static void ocfs2_xa_bucket_add_namevalue(struct ocfs2_xa_loc *loc, int size)
+{
+        int free_start = ocfs2_xa_get_free_start(loc);
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        struct super_block *sb = loc->xl_inode->i_sb;
+        int nameval_offset;
+
+        free_start = ocfs2_bucket_align_free_start(sb, free_start, size);
+        nameval_offset = free_start - size;
+        loc->xl_entry->xe_name_offset = cpu_to_le16(nameval_offset);
+        xh->xh_free_start = cpu_to_le16(nameval_offset);
+        le16_add_cpu(&xh->xh_name_value_len, size);
+
+}
+
+static void ocfs2_xa_bucket_fill_value_buf(struct ocfs2_xa_loc *loc,
+                                           struct ocfs2_xattr_value_buf *vb)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+        struct super_block *sb = loc->xl_inode->i_sb;
+        int nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        int size = namevalue_size_xe(loc->xl_entry);
+        int block_offset = nameval_offset >> sb->s_blocksize_bits;
+
+        /* Values are not allowed to straddle block boundaries */
+        BUG_ON(block_offset !=
+               ((nameval_offset + size - 1) >> sb->s_blocksize_bits));
+        /* We expect the bucket to be filled in */
+        BUG_ON(!bucket->bu_bhs[block_offset]);
+
+        vb->vb_access = ocfs2_journal_access;
+        vb->vb_bh = bucket->bu_bhs[block_offset];
+}
+
+/* Operations for xattrs stored in buckets. */
+static const struct ocfs2_xa_loc_operations ocfs2_xa_bucket_loc_ops = {
+        .xlo_journal_access     = ocfs2_xa_bucket_journal_access,
+        .xlo_journal_dirty      = ocfs2_xa_bucket_journal_dirty,
+        .xlo_offset_pointer     = ocfs2_xa_bucket_offset_pointer,
+        .xlo_check_space        = ocfs2_xa_bucket_check_space,
+        .xlo_can_reuse          = ocfs2_xa_bucket_can_reuse,
+        .xlo_get_free_start     = ocfs2_xa_bucket_get_free_start,
+        .xlo_wipe_namevalue     = ocfs2_xa_bucket_wipe_namevalue,
+        .xlo_add_entry          = ocfs2_xa_bucket_add_entry,
+        .xlo_add_namevalue      = ocfs2_xa_bucket_add_namevalue,
+        .xlo_fill_value_buf     = ocfs2_xa_bucket_fill_value_buf,
+};
+
+static unsigned int ocfs2_xa_value_clusters(struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_value_buf vb;
+
+        if (ocfs2_xattr_is_local(loc->xl_entry))
+                return 0;
+
+        ocfs2_xa_fill_value_buf(loc, &vb);
+        return le32_to_cpu(vb.vb_xv->xr_clusters);
+}
+
+static int ocfs2_xa_value_truncate(struct ocfs2_xa_loc *loc, u64 bytes,
+                                   struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int trunc_rc, access_rc;
+        struct ocfs2_xattr_value_buf vb;
+
+        ocfs2_xa_fill_value_buf(loc, &vb);
+        trunc_rc = ocfs2_xattr_value_truncate(loc->xl_inode, &vb, bytes,
+                                              ctxt);
+
+        /*
+         * The caller of ocfs2_xa_value_truncate() has already called
+         * ocfs2_xa_journal_access on the loc.  However, The truncate code
+         * calls ocfs2_extend_trans().  This may commit the previous
+         * transaction and open a new one.  If this is a bucket, truncate
+         * could leave only vb->vb_bh set up for journaling.  Meanwhile,
+         * the caller is expecting to dirty the entire bucket.  So we must
+         * reset the journal work.  We do this even if truncate has failed,
+         * as it could have failed after committing the extend.
+         */
+        access_rc = ocfs2_xa_journal_access(ctxt->handle, loc,
+                                            OCFS2_JOURNAL_ACCESS_WRITE);
+
+        /* Errors in truncate take precedence */
+        return trunc_rc ? trunc_rc : access_rc;
+}
+
+static void ocfs2_xa_remove_entry(struct ocfs2_xa_loc *loc)
+{
+        int index, count;
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        struct ocfs2_xattr_entry *entry = loc->xl_entry;
+
+        ocfs2_xa_wipe_namevalue(loc);
+        loc->xl_entry = NULL;
+
+        le16_add_cpu(&xh->xh_count, -1);
+        count = le16_to_cpu(xh->xh_count);
+
+        /*
+         * Only zero out the entry if there are more remaining.  This is
+         * important for an empty bucket, as it keeps track of the
+         * bucket's hash value.  It doesn't hurt empty block storage.
+         */
+        if (count) {
+                index = ((char *)entry - (char *)&xh->xh_entries) /
+                        sizeof(struct ocfs2_xattr_entry);
+                memmove(&xh->xh_entries[index], &xh->xh_entries[index + 1],
+                        (count - index) * sizeof(struct ocfs2_xattr_entry));
+                memset(&xh->xh_entries[count], 0,
+                       sizeof(struct ocfs2_xattr_entry));
+        }
 }
 
 /*
- * ocfs2_xattr_set_entry()
+ * If we have a problem adjusting the size of an external value during
+ * ocfs2_xa_prepare_entry() or ocfs2_xa_remove(), we may have an xattr
+ * in an intermediate state.  For example, the value may be partially
+ * truncated.
+ *
+ * If the value tree hasn't changed, the extend/truncate went nowhere.
+ * We have nothing to do.  The caller can treat it as a straight error.
  *
- * Set extended attribute entry into inode or block.
+ * If the value tree got partially truncated, we now have a corrupted
+ * extended attribute.  We're going to wipe its entry and leak the
+ * clusters.  Better to leak some storage than leave a corrupt entry.
  *
- * If extended attribute value size > OCFS2_XATTR_INLINE_SIZE,
- * We first insert tree root(ocfs2_xattr_value_root) with set_entry_local(),
- * then set value in B tree with set_value_outside().
+ * If the value tree grew, it obviously didn't grow enough for the
+ * new entry.  We're not going to try and reclaim those clusters either.
+ * If there was already an external value there (orig_clusters != 0),
+ * the new clusters are attached safely and we can just leave the old
+ * value in place.  If there was no external value there, we remove
+ * the entry.
+ *
+ * This way, the xattr block we store in the journal will be consistent.
+ * If the size change broke because of the journal, no changes will hit
+ * disk anyway.
  */
-static int ocfs2_xattr_set_entry(struct inode *inode,
-                                 struct ocfs2_xattr_info *xi,
-                                 struct ocfs2_xattr_search *xs,
-                                 struct ocfs2_xattr_set_ctxt *ctxt,
-                                 int flag)
-{
-        struct ocfs2_xattr_entry *last;
-        struct ocfs2_inode_info *oi = OCFS2_I(inode);
-        struct ocfs2_dinode *di = (struct ocfs2_dinode *)xs->inode_bh->b_data;
-        size_t min_offs = xs->end - xs->base, name_len = strlen(xi->name);
-        size_t size_l = 0;
-        handle_t *handle = ctxt->handle;
-        int free, i, ret;
-        struct ocfs2_xattr_info xi_l = {
-                .name_index = xi->name_index,
-                .name = xi->name,
-                .value = xi->value,
-                .value_len = xi->value_len,
-        };
-        struct ocfs2_xattr_value_buf vb = {
-                .vb_bh = xs->xattr_bh,
-                .vb_access = ocfs2_journal_access_di,
-        };
+static void ocfs2_xa_cleanup_value_truncate(struct ocfs2_xa_loc *loc,
+                                            const char *what,
+                                            unsigned int orig_clusters)
+{
+        unsigned int new_clusters = ocfs2_xa_value_clusters(loc);
+        char *nameval_buf = ocfs2_xa_offset_pointer(loc,
+                                le16_to_cpu(loc->xl_entry->xe_name_offset));
+
+        if (new_clusters < orig_clusters) {
+                mlog(ML_ERROR,
+                     "Partial truncate while %s xattr %.*s.  Leaking "
+                     "%u clusters and removing the entry\n",
+                     what, loc->xl_entry->xe_name_len, nameval_buf,
+                     orig_clusters - new_clusters);
+                ocfs2_xa_remove_entry(loc);
+        } else if (!orig_clusters) {
+                mlog(ML_ERROR,
+                     "Unable to allocate an external value for xattr "
+                     "%.*s safely.  Leaking %u clusters and removing the "
+                     "entry\n",
+                     loc->xl_entry->xe_name_len, nameval_buf,
+                     new_clusters - orig_clusters);
+                ocfs2_xa_remove_entry(loc);
+        } else if (new_clusters > orig_clusters)
+                mlog(ML_ERROR,
+                     "Unable to grow xattr %.*s safely.  %u new clusters "
+                     "have been added, but the value will not be "
+                     "modified\n",
+                     loc->xl_entry->xe_name_len, nameval_buf,
+                     new_clusters - orig_clusters);
+}
+
+static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc,
+                           struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        unsigned int orig_clusters;
+
+        if (!ocfs2_xattr_is_local(loc->xl_entry)) {
+                orig_clusters = ocfs2_xa_value_clusters(loc);
+                rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+                if (rc) {
+                        mlog_errno(rc);
+                        /*
+                         * Since this is remove, we can return 0 if
+                         * ocfs2_xa_cleanup_value_truncate() is going to
+                         * wipe the entry anyway.  So we check the
+                         * cluster count as well.
+                         */
+                        if (orig_clusters != ocfs2_xa_value_clusters(loc))
+                                rc = 0;
+                        ocfs2_xa_cleanup_value_truncate(loc, "removing",
+                                                        orig_clusters);
+                        if (rc)
+                                goto out;
+                }
+        }
 
-        if (!(flag & OCFS2_INLINE_XATTR_FL)) {
-                BUG_ON(xs->xattr_bh == xs->inode_bh);
-                vb.vb_access = ocfs2_journal_access_xb;
-        } else
-                BUG_ON(xs->xattr_bh != xs->inode_bh);
+        ocfs2_xa_remove_entry(loc);
 
-        /* Compute min_offs, last and free space. */
-        last = xs->header->xh_entries;
+out:
+        return rc;
+}
 
-        for (i = 0 ; i < le16_to_cpu(xs->header->xh_count); i++) {
-                size_t offs = le16_to_cpu(last->xe_name_offset);
-                if (offs < min_offs)
-                        min_offs = offs;
-                last += 1;
-        }
+static void ocfs2_xa_install_value_root(struct ocfs2_xa_loc *loc)
+{
+        int name_size = OCFS2_XATTR_SIZE(loc->xl_entry->xe_name_len);
+        char *nameval_buf;
 
-        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
-        if (free < 0)
-                return -EIO;
+        nameval_buf = ocfs2_xa_offset_pointer(loc,
+                                le16_to_cpu(loc->xl_entry->xe_name_offset));
+        memcpy(nameval_buf + name_size, &def_xv, OCFS2_XATTR_ROOT_SIZE);
+}
 
-        if (!xs->not_found) {
-                size_t size = 0;
-                if (ocfs2_xattr_is_local(xs->here))
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xs->here->xe_value_size));
-                else
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_ROOT_SIZE;
-                free += (size + sizeof(struct ocfs2_xattr_entry));
-        }
-        /* Check free space in inode or block */
-        if (xi->value && xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
-                if (free < sizeof(struct ocfs2_xattr_entry) +
-                           OCFS2_XATTR_SIZE(name_len) +
-                           OCFS2_XATTR_ROOT_SIZE) {
-                        ret = -ENOSPC;
-                        goto out;
+/*
+ * Take an existing entry and make it ready for the new value.  This
+ * won't allocate space, but it may free space.  It should be ready for
+ * ocfs2_xa_prepare_entry() to finish the work.
+ */
+static int ocfs2_xa_reuse_entry(struct ocfs2_xa_loc *loc,
+                                struct ocfs2_xattr_info *xi,
+                                struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        int name_size = OCFS2_XATTR_SIZE(xi->xi_name_len);
+        unsigned int orig_clusters;
+        char *nameval_buf;
+        int xe_local = ocfs2_xattr_is_local(loc->xl_entry);
+        int xi_local = xi->xi_value_len <= OCFS2_XATTR_INLINE_SIZE;
+
+        BUG_ON(OCFS2_XATTR_SIZE(loc->xl_entry->xe_name_len) !=
+               name_size);
+
+        nameval_buf = ocfs2_xa_offset_pointer(loc,
+                                le16_to_cpu(loc->xl_entry->xe_name_offset));
+        if (xe_local) {
+                memset(nameval_buf + name_size, 0,
+                       namevalue_size_xe(loc->xl_entry) - name_size);
+                if (!xi_local)
+                        ocfs2_xa_install_value_root(loc);
+        } else {
+                orig_clusters = ocfs2_xa_value_clusters(loc);
+                if (xi_local) {
+                        rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+                        if (rc < 0)
+                                mlog_errno(rc);
+                        else
+                                memset(nameval_buf + name_size, 0,
+                                       namevalue_size_xe(loc->xl_entry) -
+                                       name_size);
+                } else if (le64_to_cpu(loc->xl_entry->xe_value_size) >
+                           xi->xi_value_len) {
+                        rc = ocfs2_xa_value_truncate(loc, xi->xi_value_len,
+                                                     ctxt);
+                        if (rc < 0)
+                                mlog_errno(rc);
                 }
-                size_l = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
-                xi_l.value = (void *)&def_xv;
-                xi_l.value_len = OCFS2_XATTR_ROOT_SIZE;
-        } else if (xi->value) {
-                if (free < sizeof(struct ocfs2_xattr_entry) +
-                           OCFS2_XATTR_SIZE(name_len) +
-                           OCFS2_XATTR_SIZE(xi->value_len)) {
-                        ret = -ENOSPC;
+
+                if (rc) {
+                        ocfs2_xa_cleanup_value_truncate(loc, "reusing",
+                                                        orig_clusters);
                         goto out;
                 }
         }
 
-        if (!xs->not_found) {
-                /* For existing extended attribute */
-                size_t size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xs->here->xe_value_size));
-                size_t offs = le16_to_cpu(xs->here->xe_name_offset);
-                void *val = xs->base + offs;
+        loc->xl_entry->xe_value_size = cpu_to_le64(xi->xi_value_len);
+        ocfs2_xattr_set_local(loc->xl_entry, xi_local);
 
-                if (ocfs2_xattr_is_local(xs->here) && size == size_l) {
-                        /* Replace existing local xattr with tree root */
-                        ret = ocfs2_xattr_set_value_outside(inode, xi, xs,
-                                                            ctxt, &vb, offs);
-                        if (ret < 0)
-                                mlog_errno(ret);
-                        goto out;
-                } else if (!ocfs2_xattr_is_local(xs->here)) {
-                        /* For existing xattr which has value outside */
-                        vb.vb_xv = (struct ocfs2_xattr_value_root *)
-                                (val + OCFS2_XATTR_SIZE(name_len));
+out:
+        return rc;
+}
 
-                        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
-                                /*
-                                 * If new value need set outside also,
-                                 * first truncate old value to new value,
-                                 * then set new value with set_value_outside().
-                                 */
-                                ret = ocfs2_xattr_value_truncate(inode,
-                                                                 &vb,
-                                                                 xi->value_len,
-                                                                 ctxt);
-                                if (ret < 0) {
-                                        mlog_errno(ret);
-                                        goto out;
-                                }
+/*
+ * Prepares loc->xl_entry to receive the new xattr.  This includes
+ * properly setting up the name+value pair region.  If loc->xl_entry
+ * already exists, it will take care of modifying it appropriately.
+ *
+ * Note that this modifies the data.  You did journal_access already,
+ * right?
+ */
+static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc,
+                                  struct ocfs2_xattr_info *xi,
+                                  u32 name_hash,
+                                  struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        unsigned int orig_clusters;
+        __le64 orig_value_size = 0;
 
-                                ret = ocfs2_xattr_update_entry(inode,
-                                                               handle,
-                                                               xi,
-                                                               xs,
-                                                               &vb,
-                                                               offs);
-                                if (ret < 0) {
-                                        mlog_errno(ret);
-                                        goto out;
-                                }
+        rc = ocfs2_xa_check_space(loc, xi);
+        if (rc)
+                goto out;
 
-                                ret = __ocfs2_xattr_set_value_outside(inode,
-                                                                handle,
-                                                                &vb,
-                                                                xi->value,
-                                                                xi->value_len);
-                                if (ret < 0)
-                                        mlog_errno(ret);
+        if (loc->xl_entry) {
+                if (ocfs2_xa_can_reuse_entry(loc, xi)) {
+                        orig_value_size = loc->xl_entry->xe_value_size;
+                        rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
+                        if (rc)
+                                goto out;
+                        goto alloc_value;
+                }
+
+                if (!ocfs2_xattr_is_local(loc->xl_entry)) {
+                        orig_clusters = ocfs2_xa_value_clusters(loc);
+                        rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+                        if (rc) {
+                                mlog_errno(rc);
+                                ocfs2_xa_cleanup_value_truncate(loc,
+                                                                "overwriting",
+                                                                orig_clusters);
                                 goto out;
-                        } else {
-                                /*
-                                 * If new value need set in local,
-                                 * just trucate old value to zero.
-                                 */
-                                 ret = ocfs2_xattr_value_truncate(inode,
-                                                                  &vb,
-                                                                  0,
-                                                                  ctxt);
-                                if (ret < 0)
-                                        mlog_errno(ret);
                         }
                 }
+                ocfs2_xa_wipe_namevalue(loc);
+        } else
+                ocfs2_xa_add_entry(loc, name_hash);
+
+        /*
+         * If we get here, we have a blank entry.  Fill it.  We grow our
+         * name+value pair back from the end.
+         */
+        ocfs2_xa_add_namevalue(loc, xi);
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
+                ocfs2_xa_install_value_root(loc);
+
+alloc_value:
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
+                orig_clusters = ocfs2_xa_value_clusters(loc);
+                rc = ocfs2_xa_value_truncate(loc, xi->xi_value_len, ctxt);
+                if (rc < 0) {
+                        /*
+                         * If we tried to grow an existing external value,
+                         * ocfs2_xa_cleanuP-value_truncate() is going to
+                         * let it stand.  We have to restore its original
+                         * value size.
+                         */
+                        loc->xl_entry->xe_value_size = orig_value_size;
+                        ocfs2_xa_cleanup_value_truncate(loc, "growing",
+                                                        orig_clusters);
+                        mlog_errno(rc);
+                }
         }
 
-        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), xs->inode_bh,
+out:
+        return rc;
+}
+
+/*
+ * Store the value portion of the name+value pair.  This will skip
+ * values that are stored externally.  Their tree roots were set up
+ * by ocfs2_xa_prepare_entry().
+ */
+static int ocfs2_xa_store_value(struct ocfs2_xa_loc *loc,
+                                struct ocfs2_xattr_info *xi,
+                                struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        int nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        int name_size = OCFS2_XATTR_SIZE(xi->xi_name_len);
+        char *nameval_buf;
+        struct ocfs2_xattr_value_buf vb;
+
+        nameval_buf = ocfs2_xa_offset_pointer(loc, nameval_offset);
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
+                ocfs2_xa_fill_value_buf(loc, &vb);
+                rc = __ocfs2_xattr_set_value_outside(loc->xl_inode,
+                                                     ctxt->handle, &vb,
+                                                     xi->xi_value,
+                                                     xi->xi_value_len);
+        } else
+                memcpy(nameval_buf + name_size, xi->xi_value, xi->xi_value_len);
+
+        return rc;
+}
+
+static int ocfs2_xa_set(struct ocfs2_xa_loc *loc,
+                        struct ocfs2_xattr_info *xi,
+                        struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int ret;
+        u32 name_hash = ocfs2_xattr_name_hash(loc->xl_inode, xi->xi_name,
+                                              xi->xi_name_len);
+
+        ret = ocfs2_xa_journal_access(ctxt->handle, loc,
                                       OCFS2_JOURNAL_ACCESS_WRITE);
         if (ret) {
                 mlog_errno(ret);
                 goto out;
         }
 
-        if (!(flag & OCFS2_INLINE_XATTR_FL)) {
-                ret = vb.vb_access(handle, INODE_CACHE(inode), vb.vb_bh,
-                                   OCFS2_JOURNAL_ACCESS_WRITE);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-        }
-
         /*
-         * Set value in local, include set tree root in local.
-         * This is the first step for value size >INLINE_SIZE.
+         * From here on out, everything is going to modify the buffer a
+         * little.  Errors are going to leave the xattr header in a
+         * sane state.  Thus, even with errors we dirty the sucker.
          */
-        ocfs2_xattr_set_entry_local(inode, &xi_l, xs, last, min_offs);
 
-        if (!(flag & OCFS2_INLINE_XATTR_FL)) {
-                ret = ocfs2_journal_dirty(handle, xs->xattr_bh);
-                if (ret < 0) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+        /* Don't worry, we are never called with !xi_value and !xl_entry */
+        if (!xi->xi_value) {
+                ret = ocfs2_xa_remove(loc, ctxt);
+                goto out_dirty;
         }
 
-        if (!(oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL) &&
-            (flag & OCFS2_INLINE_XATTR_FL)) {
-                struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-                unsigned int xattrsize = osb->s_xattr_inline_size;
-
-                /*
-                 * Adjust extent record count or inline data size
-                 * to reserve space for extended attribute.
-                 */
-                if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
-                        struct ocfs2_inline_data *idata = &di->id2.i_data;
-                        le16_add_cpu(&idata->id_count, -xattrsize);
-                } else if (!(ocfs2_inode_is_fast_symlink(inode))) {
-                        struct ocfs2_extent_list *el = &di->id2.i_list;
-                        le16_add_cpu(&el->l_count, -(xattrsize /
-                                        sizeof(struct ocfs2_extent_rec)));
-                }
-                di->i_xattr_inline_size = cpu_to_le16(xattrsize);
+        ret = ocfs2_xa_prepare_entry(loc, xi, name_hash, ctxt);
+        if (ret) {
+                if (ret != -ENOSPC)
+                        mlog_errno(ret);
+                goto out_dirty;
         }
-        /* Update xattr flag */
-        spin_lock(&oi->ip_lock);
-        oi->ip_dyn_features |= flag;
-        di->i_dyn_features = cpu_to_le16(oi->ip_dyn_features);
-        spin_unlock(&oi->ip_lock);
 
-        ret = ocfs2_journal_dirty(handle, xs->inode_bh);
-        if (ret < 0)
+        ret = ocfs2_xa_store_value(loc, xi, ctxt);
+        if (ret)
                 mlog_errno(ret);
 
-        if (!ret && xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
-                /*
-                 * Set value outside in B tree.
-                 * This is the second step for value size > INLINE_SIZE.
-                 */
-                size_t offs = le16_to_cpu(xs->here->xe_name_offset);
-                ret = ocfs2_xattr_set_value_outside(inode, xi, xs, ctxt,
-                                                    &vb, offs);
-                if (ret < 0) {
-                        int ret2;
+out_dirty:
+        ocfs2_xa_journal_dirty(ctxt->handle, loc);
 
-                        mlog_errno(ret);
-                        /*
-                         * If set value outside failed, we have to clean
-                         * the junk tree root we have already set in local.
-                         */
-                        ret2 = ocfs2_xattr_cleanup(inode, ctxt->handle,
-                                                   xi, xs, &vb, offs);
-                        if (ret2 < 0)
-                                mlog_errno(ret2);
-                }
-        }
 out:
         return ret;
 }
 
+static void ocfs2_init_dinode_xa_loc(struct ocfs2_xa_loc *loc,
+                                     struct inode *inode,
+                                     struct buffer_head *bh,
+                                     struct ocfs2_xattr_entry *entry)
+{
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
+
+        BUG_ON(!(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_XATTR_FL));
+
+        loc->xl_inode = inode;
+        loc->xl_ops = &ocfs2_xa_block_loc_ops;
+        loc->xl_storage = bh;
+        loc->xl_entry = entry;
+        loc->xl_size = le16_to_cpu(di->i_xattr_inline_size);
+        loc->xl_header =
+                (struct ocfs2_xattr_header *)(bh->b_data + bh->b_size -
+                                              loc->xl_size);
+}
+
+static void ocfs2_init_xattr_block_xa_loc(struct ocfs2_xa_loc *loc,
+                                          struct inode *inode,
+                                          struct buffer_head *bh,
+                                          struct ocfs2_xattr_entry *entry)
+{
+        struct ocfs2_xattr_block *xb =
+                (struct ocfs2_xattr_block *)bh->b_data;
+
+        BUG_ON(le16_to_cpu(xb->xb_flags) & OCFS2_XATTR_INDEXED);
+
+        loc->xl_inode = inode;
+        loc->xl_ops = &ocfs2_xa_block_loc_ops;
+        loc->xl_storage = bh;
+        loc->xl_header = &(xb->xb_attrs.xb_header);
+        loc->xl_entry = entry;
+        loc->xl_size = bh->b_size - offsetof(struct ocfs2_xattr_block,
+                                             xb_attrs.xb_header);
+}
+
+static void ocfs2_init_xattr_bucket_xa_loc(struct ocfs2_xa_loc *loc,
+                                           struct ocfs2_xattr_bucket *bucket,
+                                           struct ocfs2_xattr_entry *entry)
+{
+        loc->xl_inode = bucket->bu_inode;
+        loc->xl_ops = &ocfs2_xa_bucket_loc_ops;
+        loc->xl_storage = bucket;
+        loc->xl_header = bucket_xh(bucket);
+        loc->xl_entry = entry;
+        loc->xl_size = OCFS2_XATTR_BUCKET_SIZE;
+}
+
 /*
  * In xattr remove, if it is stored outside and refcounted, we may have
  * the chance to split the refcount tree. So need the allocators.
@@ -2149,6 +2683,55 @@ static int ocfs2_xattr_ibody_find(struct inode *inode,
         return 0;
 }
 
+static int ocfs2_xattr_ibody_init(struct inode *inode,
+                                  struct buffer_head *di_bh,
+                                  struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int ret;
+        struct ocfs2_inode_info *oi = OCFS2_I(inode);
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
+        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+        unsigned int xattrsize = osb->s_xattr_inline_size;
+
+        if (!ocfs2_xattr_has_space_inline(inode, di)) {
+                ret = -ENOSPC;
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(ctxt->handle, INODE_CACHE(inode), di_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        /*
+         * Adjust extent record count or inline data size
+         * to reserve space for extended attribute.
+         */
+        if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                struct ocfs2_inline_data *idata = &di->id2.i_data;
+                le16_add_cpu(&idata->id_count, -xattrsize);
+        } else if (!(ocfs2_inode_is_fast_symlink(inode))) {
+                struct ocfs2_extent_list *el = &di->id2.i_list;
+                le16_add_cpu(&el->l_count, -(xattrsize /
+                                             sizeof(struct ocfs2_extent_rec)));
+        }
+        di->i_xattr_inline_size = cpu_to_le16(xattrsize);
+
+        spin_lock(&oi->ip_lock);
+        oi->ip_dyn_features |= OCFS2_INLINE_XATTR_FL|OCFS2_HAS_XATTR_FL;
+        di->i_dyn_features = cpu_to_le16(oi->ip_dyn_features);
+        spin_unlock(&oi->ip_lock);
+
+        ret = ocfs2_journal_dirty(ctxt->handle, di_bh);
+        if (ret < 0)
+                mlog_errno(ret);
+
+out:
+        return ret;
+}
+
 /*
  * ocfs2_xattr_ibody_set()
  *
@@ -2160,9 +2743,10 @@ static int ocfs2_xattr_ibody_set(struct inode *inode,
                                  struct ocfs2_xattr_search *xs,
                                  struct ocfs2_xattr_set_ctxt *ctxt)
 {
+        int ret;
         struct ocfs2_inode_info *oi = OCFS2_I(inode);
         struct ocfs2_dinode *di = (struct ocfs2_dinode *)xs->inode_bh->b_data;
-        int ret;
+        struct ocfs2_xa_loc loc;
 
         if (inode->i_sb->s_blocksize == OCFS2_MIN_BLOCKSIZE)
                 return -ENOSPC;
@@ -2175,8 +2759,25 @@ static int ocfs2_xattr_ibody_set(struct inode *inode,
                 }
         }
 
-        ret = ocfs2_xattr_set_entry(inode, xi, xs, ctxt,
-                                (OCFS2_INLINE_XATTR_FL | OCFS2_HAS_XATTR_FL));
+        if (!(oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL)) {
+                ret = ocfs2_xattr_ibody_init(inode, xs->inode_bh, ctxt);
+                if (ret) {
+                        if (ret != -ENOSPC)
+                                mlog_errno(ret);
+                        goto out;
+                }
+        }
+
+        ocfs2_init_dinode_xa_loc(&loc, inode, xs->inode_bh,
+                                 xs->not_found ? NULL : xs->here);
+        ret = ocfs2_xa_set(&loc, xi, ctxt);
+        if (ret) {
+                if (ret != -ENOSPC)
+                        mlog_errno(ret);
+                goto out;
+        }
+        xs->here = loc.xl_entry;
+
 out:
         up_write(&oi->ip_alloc_sem);
 
@@ -2236,12 +2837,11 @@ cleanup:
         return ret;
 }
 
-static int ocfs2_create_xattr_block(handle_t *handle,
-                                    struct inode *inode,
+static int ocfs2_create_xattr_block(struct inode *inode,
                                     struct buffer_head *inode_bh,
-                                    struct ocfs2_alloc_context *meta_ac,
-                                    struct buffer_head **ret_bh,
-                                    int indexed)
+                                    struct ocfs2_xattr_set_ctxt *ctxt,
+                                    int indexed,
+                                    struct buffer_head **ret_bh)
 {
         int ret;
         u16 suballoc_bit_start;
@@ -2252,14 +2852,14 @@ static int ocfs2_create_xattr_block(handle_t *handle,
         struct buffer_head *new_bh = NULL;
         struct ocfs2_xattr_block *xblk;
 
-        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), inode_bh,
-                                      OCFS2_JOURNAL_ACCESS_CREATE);
+        ret = ocfs2_journal_access_di(ctxt->handle, INODE_CACHE(inode),
+                                      inode_bh, OCFS2_JOURNAL_ACCESS_CREATE);
         if (ret < 0) {
                 mlog_errno(ret);
                 goto end;
         }
 
-        ret = ocfs2_claim_metadata(osb, handle, meta_ac, 1,
+        ret = ocfs2_claim_metadata(osb, ctxt->handle, ctxt->meta_ac, 1,
                                    &suballoc_bit_start, &num_got,
                                    &first_blkno);
         if (ret < 0) {
@@ -2270,7 +2870,7 @@ static int ocfs2_create_xattr_block(handle_t *handle,
         new_bh = sb_getblk(inode->i_sb, first_blkno);
         ocfs2_set_new_buffer_uptodate(INODE_CACHE(inode), new_bh);
 
-        ret = ocfs2_journal_access_xb(handle, INODE_CACHE(inode),
+        ret = ocfs2_journal_access_xb(ctxt->handle, INODE_CACHE(inode),
                                       new_bh,
                                       OCFS2_JOURNAL_ACCESS_CREATE);
         if (ret < 0) {
@@ -2282,11 +2882,10 @@ static int ocfs2_create_xattr_block(handle_t *handle,
         xblk = (struct ocfs2_xattr_block *)new_bh->b_data;
         memset(xblk, 0, inode->i_sb->s_blocksize);
         strcpy((void *)xblk, OCFS2_XATTR_BLOCK_SIGNATURE);
-        xblk->xb_suballoc_slot = cpu_to_le16(osb->slot_num);
+        xblk->xb_suballoc_slot = cpu_to_le16(ctxt->meta_ac->ac_alloc_slot);
         xblk->xb_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         xblk->xb_fs_generation = cpu_to_le32(osb->fs_generation);
         xblk->xb_blkno = cpu_to_le64(first_blkno);
-
         if (indexed) {
                 struct ocfs2_xattr_tree_root *xr = &xblk->xb_attrs.xb_root;
                 xr->xt_clusters = cpu_to_le32(1);
@@ -2297,14 +2896,17 @@ static int ocfs2_create_xattr_block(handle_t *handle,
                 xr->xt_list.l_next_free_rec = cpu_to_le16(1);
                 xblk->xb_flags = cpu_to_le16(OCFS2_XATTR_INDEXED);
         }
+        ocfs2_journal_dirty(ctxt->handle, new_bh);
 
-        ret = ocfs2_journal_dirty(handle, new_bh);
-        if (ret < 0) {
-                mlog_errno(ret);
-                goto end;
-        }
+        /* Add it to the inode */
         di->i_xattr_loc = cpu_to_le64(first_blkno);
-        ocfs2_journal_dirty(handle, inode_bh);
+
+        spin_lock(&OCFS2_I(inode)->ip_lock);
+        OCFS2_I(inode)->ip_dyn_features |= OCFS2_HAS_XATTR_FL;
+        di->i_dyn_features = cpu_to_le16(OCFS2_I(inode)->ip_dyn_features);
+        spin_unlock(&OCFS2_I(inode)->ip_lock);
+
+        ocfs2_journal_dirty(ctxt->handle, inode_bh);
 
         *ret_bh = new_bh;
         new_bh = NULL;
@@ -2326,13 +2928,13 @@ static int ocfs2_xattr_block_set(struct inode *inode,
                                  struct ocfs2_xattr_set_ctxt *ctxt)
 {
         struct buffer_head *new_bh = NULL;
-        handle_t *handle = ctxt->handle;
         struct ocfs2_xattr_block *xblk = NULL;
         int ret;
+        struct ocfs2_xa_loc loc;
 
         if (!xs->xattr_bh) {
-                ret = ocfs2_create_xattr_block(handle, inode, xs->inode_bh,
-                                               ctxt->meta_ac, &new_bh, 0);
+                ret = ocfs2_create_xattr_block(inode, xs->inode_bh, ctxt,
+                                               0, &new_bh);
                 if (ret) {
                         mlog_errno(ret);
                         goto end;
@@ -2348,21 +2950,25 @@ static int ocfs2_xattr_block_set(struct inode *inode,
                 xblk = (struct ocfs2_xattr_block *)xs->xattr_bh->b_data;
 
         if (!(le16_to_cpu(xblk->xb_flags) & OCFS2_XATTR_INDEXED)) {
-                /* Set extended attribute into external block */
-                ret = ocfs2_xattr_set_entry(inode, xi, xs, ctxt,
-                                            OCFS2_HAS_XATTR_FL);
-                if (!ret || ret != -ENOSPC)
-                        goto end;
+                ocfs2_init_xattr_block_xa_loc(&loc, inode, xs->xattr_bh,
+                                              xs->not_found ? NULL : xs->here);
 
-                ret = ocfs2_xattr_create_index_block(inode, xs, ctxt);
-                if (ret)
+                ret = ocfs2_xa_set(&loc, xi, ctxt);
+                if (!ret)
+                        xs->here = loc.xl_entry;
+                else if (ret != -ENOSPC)
                         goto end;
+                else {
+                        ret = ocfs2_xattr_create_index_block(inode, xs, ctxt);
+                        if (ret)
+                                goto end;
+                }
         }
 
-        ret = ocfs2_xattr_set_entry_index_block(inode, xi, xs, ctxt);
+        if (le16_to_cpu(xblk->xb_flags) & OCFS2_XATTR_INDEXED)
+                ret = ocfs2_xattr_set_entry_index_block(inode, xi, xs, ctxt);
 
 end:
-
         return ret;
 }
 
@@ -2371,7 +2977,6 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
                                        struct ocfs2_xattr_info *xi,
                                        struct ocfs2_xattr_search *xs)
 {
-        u64 value_size;
         struct ocfs2_xattr_entry *last;
         int free, i;
         size_t min_offs = xs->end - xs->base;
@@ -2394,13 +2999,7 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
 
         BUG_ON(!xs->not_found);
 
-        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE)
-                value_size = OCFS2_XATTR_ROOT_SIZE;
-        else
-                value_size = OCFS2_XATTR_SIZE(xi->value_len);
-
-        if (free >= sizeof(struct ocfs2_xattr_entry) +
-                   OCFS2_XATTR_SIZE(strlen(xi->name)) + value_size)
+        if (free >= (sizeof(struct ocfs2_xattr_entry) + namevalue_size_xi(xi)))
                 return 1;
 
         return 0;
@@ -2424,7 +3023,7 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
         char *base = NULL;
         int name_offset, name_len = 0;
         u32 new_clusters = ocfs2_clusters_for_bytes(inode->i_sb,
-                                                    xi->value_len);
+                                                    xi->xi_value_len);
         u64 value_size;
 
         /*
@@ -2432,14 +3031,14 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
          * No matter whether we replace an old one or add a new one,
          * we need this for writing.
          */
-        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE)
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
                 credits += new_clusters *
                            ocfs2_clusters_to_blocks(inode->i_sb, 1);
 
         if (xis->not_found && xbs->not_found) {
                 credits += ocfs2_blocks_per_xattr_bucket(inode->i_sb);
 
-                if (xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
+                if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
                         clusters_add += new_clusters;
                         credits += ocfs2_calc_extend_credits(inode->i_sb,
                                                         &def_xv.xv.xr_list,
@@ -2484,7 +3083,7 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
          * The credits for removing the value tree will be extended
          * by ocfs2_remove_extent itself.
          */
-        if (!xi->value) {
+        if (!xi->xi_value) {
                 if (!ocfs2_xattr_is_local(xe))
                         credits += ocfs2_remove_extent_credits(inode->i_sb);
 
@@ -2514,7 +3113,7 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
                 }
         }
 
-        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
                 /* the new values will be stored outside. */
                 u32 old_clusters = 0;
 
@@ -2547,9 +3146,10 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
                  * value, we don't need any allocation, otherwise we have
                  * to guess metadata allocation.
                  */
-                if ((ocfs2_xattr_is_local(xe) && value_size >= xi->value_len) ||
+                if ((ocfs2_xattr_is_local(xe) &&
+                     (value_size >= xi->xi_value_len)) ||
                     (!ocfs2_xattr_is_local(xe) &&
-                     OCFS2_XATTR_ROOT_SIZE >= xi->value_len))
+                     OCFS2_XATTR_ROOT_SIZE >= xi->xi_value_len))
                         goto out;
         }
 
@@ -2639,7 +3239,7 @@ static int ocfs2_init_xattr_set_ctxt(struct inode *inode,
 
         meta_add += extra_meta;
         mlog(0, "Set xattr %s, reserve meta blocks = %d, clusters = %d, "
-             "credits = %d\n", xi->name, meta_add, clusters_add, *credits);
+             "credits = %d\n", xi->xi_name, meta_add, clusters_add, *credits);
 
         if (meta_add) {
                 ret = ocfs2_reserve_new_metadata_blocks(osb, meta_add,
@@ -2679,7 +3279,7 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
 {
         int ret = 0, credits, old_found;
 
-        if (!xi->value) {
+        if (!xi->xi_value) {
                 /* Remove existing extended attribute */
                 if (!xis->not_found)
                         ret = ocfs2_xattr_ibody_set(inode, xi, xis, ctxt);
@@ -2693,8 +3293,8 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
                          * If succeed and that extended attribute existing in
                          * external block, then we will remove it.
                          */
-                        xi->value = NULL;
-                        xi->value_len = 0;
+                        xi->xi_value = NULL;
+                        xi->xi_value_len = 0;
 
                         old_found = xis->not_found;
                         xis->not_found = -ENODATA;
@@ -2722,8 +3322,8 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
                 } else if (ret == -ENOSPC) {
                         if (di->i_xattr_loc && !xbs->xattr_bh) {
                                 ret = ocfs2_xattr_block_find(inode,
-                                                             xi->name_index,
-                                                             xi->name, xbs);
+                                                             xi->xi_name_index,
+                                                             xi->xi_name, xbs);
                                 if (ret)
                                         goto out;
 
@@ -2762,8 +3362,8 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
                                  * If succeed and that extended attribute
                                  * existing in inode, we will remove it.
                                  */
-                                xi->value = NULL;
-                                xi->value_len = 0;
+                                xi->xi_value = NULL;
+                                xi->xi_value_len = 0;
                                 xbs->not_found = -ENODATA;
                                 ret = ocfs2_calc_xattr_set_need(inode,
                                                                 di,
@@ -2829,10 +3429,11 @@ int ocfs2_xattr_set_handle(handle_t *handle,
         int ret;
 
         struct ocfs2_xattr_info xi = {
-                .name_index = name_index,
-                .name = name,
-                .value = value,
-                .value_len = value_len,
+                .xi_name_index = name_index,
+                .xi_name = name,
+                .xi_name_len = strlen(name),
+                .xi_value = value,
+                .xi_value_len = value_len,
         };
 
         struct ocfs2_xattr_search xis = {
@@ -2912,10 +3513,11 @@ int ocfs2_xattr_set(struct inode *inode,
         struct ocfs2_refcount_tree *ref_tree = NULL;
 
         struct ocfs2_xattr_info xi = {
-                .name_index = name_index,
-                .name = name,
-                .value = value,
-                .value_len = value_len,
+                .xi_name_index = name_index,
+                .xi_name = name,
+                .xi_name_len = strlen(name),
+                .xi_value = value,
+                .xi_value_len = value_len,
         };
 
         struct ocfs2_xattr_search xis = {
@@ -3759,7 +4361,7 @@ static int ocfs2_defrag_xattr_bucket(struct inode *inode,
                                      struct ocfs2_xattr_bucket *bucket)
 {
         int ret, i;
-        size_t end, offset, len, value_len;
+        size_t end, offset, len;
         struct ocfs2_xattr_header *xh;
         char *entries, *buf, *bucket_buf = NULL;
         u64 blkno = bucket_blkno(bucket);
@@ -3813,12 +4415,7 @@ static int ocfs2_defrag_xattr_bucket(struct inode *inode,
         end = OCFS2_XATTR_BUCKET_SIZE;
         for (i = 0; i < le16_to_cpu(xh->xh_count); i++, xe++) {
                 offset = le16_to_cpu(xe->xe_name_offset);
-                if (ocfs2_xattr_is_local(xe))
-                        value_len = OCFS2_XATTR_SIZE(
-                                        le64_to_cpu(xe->xe_value_size));
-                else
-                        value_len = OCFS2_XATTR_ROOT_SIZE;
-                len = OCFS2_XATTR_SIZE(xe->xe_name_len) + value_len;
+                len = namevalue_size_xe(xe);
 
                 /*
                  * We must make sure that the name/value pair
@@ -4007,7 +4604,7 @@ static int ocfs2_divide_xattr_bucket(struct inode *inode,
                                     int new_bucket_head)
 {
         int ret, i;
-        int count, start, len, name_value_len = 0, xe_len, name_offset = 0;
+        int count, start, len, name_value_len = 0, name_offset = 0;
         struct ocfs2_xattr_bucket *s_bucket = NULL, *t_bucket = NULL;
         struct ocfs2_xattr_header *xh;
         struct ocfs2_xattr_entry *xe;
@@ -4098,13 +4695,7 @@ static int ocfs2_divide_xattr_bucket(struct inode *inode,
         name_value_len = 0;
         for (i = 0; i < start; i++) {
                 xe = &xh->xh_entries[i];
-                xe_len = OCFS2_XATTR_SIZE(xe->xe_name_len);
-                if (ocfs2_xattr_is_local(xe))
-                        xe_len +=
-                           OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        xe_len += OCFS2_XATTR_ROOT_SIZE;
-                name_value_len += xe_len;
+                name_value_len += namevalue_size_xe(xe);
                 if (le16_to_cpu(xe->xe_name_offset) < name_offset)
                         name_offset = le16_to_cpu(xe->xe_name_offset);
         }
@@ -4134,12 +4725,6 @@ static int ocfs2_divide_xattr_bucket(struct inode *inode,
         xh->xh_free_start = cpu_to_le16(OCFS2_XATTR_BUCKET_SIZE);
         for (i = 0; i < le16_to_cpu(xh->xh_count); i++) {
                 xe = &xh->xh_entries[i];
-                xe_len = OCFS2_XATTR_SIZE(xe->xe_name_len);
-                if (ocfs2_xattr_is_local(xe))
-                        xe_len +=
-                           OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        xe_len += OCFS2_XATTR_ROOT_SIZE;
                 if (le16_to_cpu(xe->xe_name_offset) <
                     le16_to_cpu(xh->xh_free_start))
                         xh->xh_free_start = xe->xe_name_offset;
@@ -4751,195 +5336,6 @@ static inline char *ocfs2_xattr_bucket_get_val(struct inode *inode,
 }
 
 /*
- * Handle the normal xattr set, including replace, delete and new.
- *
- * Note: "local" indicates the real data's locality. So we can't
- * just its bucket locality by its length.
- */
-static void ocfs2_xattr_set_entry_normal(struct inode *inode,
-                                         struct ocfs2_xattr_info *xi,
-                                         struct ocfs2_xattr_search *xs,
-                                         u32 name_hash,
-                                         int local)
-{
-        struct ocfs2_xattr_entry *last, *xe;
-        int name_len = strlen(xi->name);
-        struct ocfs2_xattr_header *xh = xs->header;
-        u16 count = le16_to_cpu(xh->xh_count), start;
-        size_t blocksize = inode->i_sb->s_blocksize;
-        char *val;
-        size_t offs, size, new_size;
-
-        last = &xh->xh_entries[count];
-        if (!xs->not_found) {
-                xe = xs->here;
-                offs = le16_to_cpu(xe->xe_name_offset);
-                if (ocfs2_xattr_is_local(xe))
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(OCFS2_XATTR_ROOT_SIZE);
-
-                /*
-                 * If the new value will be stored outside, xi->value has been
-                 * initalized as an empty ocfs2_xattr_value_root, and the same
-                 * goes with xi->value_len, so we can set new_size safely here.
-                 * See ocfs2_xattr_set_in_bucket.
-                 */
-                new_size = OCFS2_XATTR_SIZE(name_len) +
-                           OCFS2_XATTR_SIZE(xi->value_len);
-
-                le16_add_cpu(&xh->xh_name_value_len, -size);
-                if (xi->value) {
-                        if (new_size > size)
-                                goto set_new_name_value;
-
-                        /* Now replace the old value with new one. */
-                        if (local)
-                                xe->xe_value_size = cpu_to_le64(xi->value_len);
-                        else
-                                xe->xe_value_size = 0;
-
-                        val = ocfs2_xattr_bucket_get_val(inode,
-                                                         xs->bucket, offs);
-                        memset(val + OCFS2_XATTR_SIZE(name_len), 0,
-                               size - OCFS2_XATTR_SIZE(name_len));
-                        if (OCFS2_XATTR_SIZE(xi->value_len) > 0)
-                                memcpy(val + OCFS2_XATTR_SIZE(name_len),
-                                       xi->value, xi->value_len);
-
-                        le16_add_cpu(&xh->xh_name_value_len, new_size);
-                        ocfs2_xattr_set_local(xe, local);
-                        return;
-                } else {
-                        /*
-                         * Remove the old entry if there is more than one.
-                         * We don't remove the last entry so that we can
-                         * use it to indicate the hash value of the empty
-                         * bucket.
-                         */
-                        last -= 1;
-                        le16_add_cpu(&xh->xh_count, -1);
-                        if (xh->xh_count) {
-                                memmove(xe, xe + 1,
-                                        (void *)last - (void *)xe);
-                                memset(last, 0,
-                                       sizeof(struct ocfs2_xattr_entry));
-                        } else
-                                xh->xh_free_start =
-                                        cpu_to_le16(OCFS2_XATTR_BUCKET_SIZE);
-
-                        return;
-                }
-        } else {
-                /* find a new entry for insert. */
-                int low = 0, high = count - 1, tmp;
-                struct ocfs2_xattr_entry *tmp_xe;
-
-                while (low <= high && count) {
-                        tmp = (low + high) / 2;
-                        tmp_xe = &xh->xh_entries[tmp];
-
-                        if (name_hash > le32_to_cpu(tmp_xe->xe_name_hash))
-                                low = tmp + 1;
-                        else if (name_hash <
-                                 le32_to_cpu(tmp_xe->xe_name_hash))
-                                high = tmp - 1;
-                        else {
-                                low = tmp;
-                                break;
-                        }
-                }
-
-                xe = &xh->xh_entries[low];
-                if (low != count)
-                        memmove(xe + 1, xe, (void *)last - (void *)xe);
-
-                le16_add_cpu(&xh->xh_count, 1);
-                memset(xe, 0, sizeof(struct ocfs2_xattr_entry));
-                xe->xe_name_hash = cpu_to_le32(name_hash);
-                xe->xe_name_len = name_len;
-                ocfs2_xattr_set_type(xe, xi->name_index);
-        }
-
-set_new_name_value:
-        /* Insert the new name+value. */
-        size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_SIZE(xi->value_len);
-
-        /*
-         * We must make sure that the name/value pair
-         * exists in the same block.
-         */
-        offs = le16_to_cpu(xh->xh_free_start);
-        start = offs - size;
-
-        if (start >> inode->i_sb->s_blocksize_bits !=
-            (offs - 1) >> inode->i_sb->s_blocksize_bits) {
-                offs = offs - offs % blocksize;
-                xh->xh_free_start = cpu_to_le16(offs);
-        }
-
-        val = ocfs2_xattr_bucket_get_val(inode, xs->bucket, offs - size);
-        xe->xe_name_offset = cpu_to_le16(offs - size);
-
-        memset(val, 0, size);
-        memcpy(val, xi->name, name_len);
-        memcpy(val + OCFS2_XATTR_SIZE(name_len), xi->value, xi->value_len);
-
-        xe->xe_value_size = cpu_to_le64(xi->value_len);
-        ocfs2_xattr_set_local(xe, local);
-        xs->here = xe;
-        le16_add_cpu(&xh->xh_free_start, -size);
-        le16_add_cpu(&xh->xh_name_value_len, size);
-
-        return;
-}
-
-/*
- * Set the xattr entry in the specified bucket.
- * The bucket is indicated by xs->bucket and it should have the enough
- * space for the xattr insertion.
- */
-static int ocfs2_xattr_set_entry_in_bucket(struct inode *inode,
-                                           handle_t *handle,
-                                           struct ocfs2_xattr_info *xi,
-                                           struct ocfs2_xattr_search *xs,
-                                           u32 name_hash,
-                                           int local)
-{
-        int ret;
-        u64 blkno;
-
-        mlog(0, "Set xattr entry len = %lu index = %d in bucket %llu\n",
-             (unsigned long)xi->value_len, xi->name_index,
-             (unsigned long long)bucket_blkno(xs->bucket));
-
-        if (!xs->bucket->bu_bhs[1]) {
-                blkno = bucket_blkno(xs->bucket);
-                ocfs2_xattr_bucket_relse(xs->bucket);
-                ret = ocfs2_read_xattr_bucket(xs->bucket, blkno);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-        }
-
-        ret = ocfs2_xattr_bucket_journal_access(handle, xs->bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret < 0) {
-                mlog_errno(ret);
-                goto out;
-        }
-
-        ocfs2_xattr_set_entry_normal(inode, xi, xs, name_hash, local);
-        ocfs2_xattr_bucket_journal_dirty(handle, xs->bucket);
-
-out:
-        return ret;
-}
-
-/*
  * Truncate the specified xe_off entry in xattr bucket.
  * bucket is indicated by header_bh and len is the new length.
  * Both the ocfs2_xattr_value_root and the entry will be updated here.
@@ -5009,66 +5405,6 @@ out:
         return ret;
 }
 
-static int ocfs2_xattr_bucket_value_truncate_xs(struct inode *inode,
-                                        struct ocfs2_xattr_search *xs,
-                                        int len,
-                                        struct ocfs2_xattr_set_ctxt *ctxt)
-{
-        int ret, offset;
-        struct ocfs2_xattr_entry *xe = xs->here;
-        struct ocfs2_xattr_header *xh = (struct ocfs2_xattr_header *)xs->base;
-
-        BUG_ON(!xs->bucket->bu_bhs[0] || !xe || ocfs2_xattr_is_local(xe));
-
-        offset = xe - xh->xh_entries;
-        ret = ocfs2_xattr_bucket_value_truncate(inode, xs->bucket,
-                                                offset, len, ctxt);
-        if (ret)
-                mlog_errno(ret);
-
-        return ret;
-}
-
-static int ocfs2_xattr_bucket_set_value_outside(struct inode *inode,
-                                                handle_t *handle,
-                                                struct ocfs2_xattr_search *xs,
-                                                char *val,
-                                                int value_len)
-{
-        int ret, offset, block_off;
-        struct ocfs2_xattr_value_root *xv;
-        struct ocfs2_xattr_entry *xe = xs->here;
-        struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
-        void *base;
-        struct ocfs2_xattr_value_buf vb = {
-                .vb_access = ocfs2_journal_access,
-        };
-
-        BUG_ON(!xs->base || !xe || ocfs2_xattr_is_local(xe));
-
-        ret = ocfs2_xattr_bucket_get_name_value(inode->i_sb, xh,
-                                                xe - xh->xh_entries,
-                                                &block_off,
-                                                &offset);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-
-        base = bucket_block(xs->bucket, block_off);
-        xv = (struct ocfs2_xattr_value_root *)(base + offset +
-                 OCFS2_XATTR_SIZE(xe->xe_name_len));
-
-        vb.vb_xv = xv;
-        vb.vb_bh = xs->bucket->bu_bhs[block_off];
-        ret = __ocfs2_xattr_set_value_outside(inode, handle,
-                                              &vb, val, value_len);
-        if (ret)
-                mlog_errno(ret);
-out:
-        return ret;
-}
-
 static int ocfs2_rm_xattr_cluster(struct inode *inode,
                                   struct buffer_head *root_bh,
                                   u64 blkno,
@@ -5167,128 +5503,6 @@ out:
         return ret;
 }
 
-static void ocfs2_xattr_bucket_remove_xs(struct inode *inode,
-                                         handle_t *handle,
-                                         struct ocfs2_xattr_search *xs)
-{
-        struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
-        struct ocfs2_xattr_entry *last = &xh->xh_entries[
-                                                le16_to_cpu(xh->xh_count) - 1];
-        int ret = 0;
-
-        ret = ocfs2_xattr_bucket_journal_access(handle, xs->bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                return;
-        }
-
-        /* Remove the old entry. */
-        memmove(xs->here, xs->here + 1,
-                (void *)last - (void *)xs->here);
-        memset(last, 0, sizeof(struct ocfs2_xattr_entry));
-        le16_add_cpu(&xh->xh_count, -1);
-
-        ocfs2_xattr_bucket_journal_dirty(handle, xs->bucket);
-}
-
-/*
- * Set the xattr name/value in the bucket specified in xs.
- *
- * As the new value in xi may be stored in the bucket or in an outside cluster,
- * we divide the whole process into 3 steps:
- * 1. insert name/value in the bucket(ocfs2_xattr_set_entry_in_bucket)
- * 2. truncate of the outside cluster(ocfs2_xattr_bucket_value_truncate_xs)
- * 3. Set the value to the outside cluster(ocfs2_xattr_bucket_set_value_outside)
- * 4. If the clusters for the new outside value can't be allocated, we need
- *    to free the xattr we allocated in set.
- */
-static int ocfs2_xattr_set_in_bucket(struct inode *inode,
-                                     struct ocfs2_xattr_info *xi,
-                                     struct ocfs2_xattr_search *xs,
-                                     struct ocfs2_xattr_set_ctxt *ctxt)
-{
-        int ret, local = 1;
-        size_t value_len;
-        char *val = (char *)xi->value;
-        struct ocfs2_xattr_entry *xe = xs->here;
-        u32 name_hash = ocfs2_xattr_name_hash(inode, xi->name,
-                                              strlen(xi->name));
-
-        if (!xs->not_found && !ocfs2_xattr_is_local(xe)) {
-                /*
-                 * We need to truncate the xattr storage first.
-                 *
-                 * If both the old and new value are stored to
-                 * outside block, we only need to truncate
-                 * the storage and then set the value outside.
-                 *
-                 * If the new value should be stored within block,
-                 * we should free all the outside block first and
-                 * the modification to the xattr block will be done
-                 * by following steps.
-                 */
-                if (xi->value_len > OCFS2_XATTR_INLINE_SIZE)
-                        value_len = xi->value_len;
-                else
-                        value_len = 0;
-
-                ret = ocfs2_xattr_bucket_value_truncate_xs(inode, xs,
-                                                           value_len,
-                                                           ctxt);
-                if (ret)
-                        goto out;
-
-                if (value_len)
-                        goto set_value_outside;
-        }
-
-        value_len = xi->value_len;
-        /* So we have to handle the inside block change now. */
-        if (value_len > OCFS2_XATTR_INLINE_SIZE) {
-                /*
-                 * If the new value will be stored outside of block,
-                 * initalize a new empty value root and insert it first.
-                 */
-                local = 0;
-                xi->value = &def_xv;
-                xi->value_len = OCFS2_XATTR_ROOT_SIZE;
-        }
-
-        ret = ocfs2_xattr_set_entry_in_bucket(inode, ctxt->handle, xi, xs,
-                                              name_hash, local);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-
-        if (value_len <= OCFS2_XATTR_INLINE_SIZE)
-                goto out;
-
-        /* allocate the space now for the outside block storage. */
-        ret = ocfs2_xattr_bucket_value_truncate_xs(inode, xs,
-                                                   value_len, ctxt);
-        if (ret) {
-                mlog_errno(ret);
-
-                if (xs->not_found) {
-                        /*
-                         * We can't allocate enough clusters for outside
-                         * storage and we have allocated xattr already,
-                         * so need to remove it.
-                         */
-                        ocfs2_xattr_bucket_remove_xs(inode, ctxt->handle, xs);
-                }
-                goto out;
-        }
-
-set_value_outside:
-        ret = ocfs2_xattr_bucket_set_value_outside(inode, ctxt->handle,
-                                                   xs, val, value_len);
-out:
-        return ret;
-}
-
 /*
  * check whether the xattr bucket is filled up with the same hash value.
  * If we want to insert the xattr with the same hash, return -ENOSPC.
@@ -5317,156 +5531,116 @@ static int ocfs2_check_xattr_bucket_collision(struct inode *inode,
         return 0;
 }
 
-static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
-                                             struct ocfs2_xattr_info *xi,
-                                             struct ocfs2_xattr_search *xs,
-                                             struct ocfs2_xattr_set_ctxt *ctxt)
+/*
+ * Try to set the entry in the current bucket.  If we fail, the caller
+ * will handle getting us another bucket.
+ */
+static int ocfs2_xattr_set_entry_bucket(struct inode *inode,
+                                        struct ocfs2_xattr_info *xi,
+                                        struct ocfs2_xattr_search *xs,
+                                        struct ocfs2_xattr_set_ctxt *ctxt)
 {
-        struct ocfs2_xattr_header *xh;
-        struct ocfs2_xattr_entry *xe;
-        u16 count, header_size, xh_free_start;
-        int free, max_free, need, old;
-        size_t value_size = 0, name_len = strlen(xi->name);
-        size_t blocksize = inode->i_sb->s_blocksize;
-        int ret, allocation = 0;
-
-        mlog_entry("Set xattr %s in xattr index block\n", xi->name);
-
-try_again:
-        xh = xs->header;
-        count = le16_to_cpu(xh->xh_count);
-        xh_free_start = le16_to_cpu(xh->xh_free_start);
-        header_size = sizeof(struct ocfs2_xattr_header) +
-                        count * sizeof(struct ocfs2_xattr_entry);
-        max_free = OCFS2_XATTR_BUCKET_SIZE - header_size -
-                le16_to_cpu(xh->xh_name_value_len) - OCFS2_XATTR_HEADER_GAP;
-
-        mlog_bug_on_msg(header_size > blocksize, "bucket %llu has header size "
-                        "of %u which exceed block size\n",
-                        (unsigned long long)bucket_blkno(xs->bucket),
-                        header_size);
+        int ret;
+        struct ocfs2_xa_loc loc;
 
-        if (xi->value && xi->value_len > OCFS2_XATTR_INLINE_SIZE)
-                value_size = OCFS2_XATTR_ROOT_SIZE;
-        else if (xi->value)
-                value_size = OCFS2_XATTR_SIZE(xi->value_len);
+        mlog_entry("Set xattr %s in xattr bucket\n", xi->xi_name);
 
-        if (xs->not_found)
-                need = sizeof(struct ocfs2_xattr_entry) +
-                        OCFS2_XATTR_SIZE(name_len) + value_size;
-        else {
-                need = value_size + OCFS2_XATTR_SIZE(name_len);
+        ocfs2_init_xattr_bucket_xa_loc(&loc, xs->bucket,
+                                       xs->not_found ? NULL : xs->here);
+        ret = ocfs2_xa_set(&loc, xi, ctxt);
+        if (!ret) {
+                xs->here = loc.xl_entry;
+                goto out;
+        }
+        if (ret != -ENOSPC) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                /*
-                 * We only replace the old value if the new length is smaller
-                 * than the old one. Otherwise we will allocate new space in the
-                 * bucket to store it.
-                 */
-                xe = xs->here;
-                if (ocfs2_xattr_is_local(xe))
-                        old = OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        old = OCFS2_XATTR_SIZE(OCFS2_XATTR_ROOT_SIZE);
+        /* Ok, we need space.  Let's try defragmenting the bucket. */
+        ret = ocfs2_defrag_xattr_bucket(inode, ctxt->handle,
+                                        xs->bucket);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                if (old >= value_size)
-                        need = 0;
+        ret = ocfs2_xa_set(&loc, xi, ctxt);
+        if (!ret) {
+                xs->here = loc.xl_entry;
+                goto out;
         }
+        if (ret != -ENOSPC)
+                mlog_errno(ret);
 
-        free = xh_free_start - header_size - OCFS2_XATTR_HEADER_GAP;
-        /*
-         * We need to make sure the new name/value pair
-         * can exist in the same block.
-         */
-        if (xh_free_start % blocksize < need)
-                free -= xh_free_start % blocksize;
-
-        mlog(0, "xs->not_found = %d, in xattr bucket %llu: free = %d, "
-             "need = %d, max_free = %d, xh_free_start = %u, xh_name_value_len ="
-             " %u\n", xs->not_found,
-             (unsigned long long)bucket_blkno(xs->bucket),
-             free, need, max_free, le16_to_cpu(xh->xh_free_start),
-             le16_to_cpu(xh->xh_name_value_len));
-
-        if (free < need ||
-            (xs->not_found &&
-             count == ocfs2_xattr_max_xe_in_bucket(inode->i_sb))) {
-                if (need <= max_free &&
-                    count < ocfs2_xattr_max_xe_in_bucket(inode->i_sb)) {
-                        /*
-                         * We can create the space by defragment. Since only the
-                         * name/value will be moved, the xe shouldn't be changed
-                         * in xs.
-                         */
-                        ret = ocfs2_defrag_xattr_bucket(inode, ctxt->handle,
-                                                        xs->bucket);
-                        if (ret) {
-                                mlog_errno(ret);
-                                goto out;
-                        }
 
-                        xh_free_start = le16_to_cpu(xh->xh_free_start);
-                        free = xh_free_start - header_size
-                                - OCFS2_XATTR_HEADER_GAP;
-                        if (xh_free_start % blocksize < need)
-                                free -= xh_free_start % blocksize;
+out:
+        mlog_exit(ret);
+        return ret;
+}
 
-                        if (free >= need)
-                                goto xattr_set;
+static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
+                                             struct ocfs2_xattr_info *xi,
+                                             struct ocfs2_xattr_search *xs,
+                                             struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int ret;
 
-                        mlog(0, "Can't get enough space for xattr insert by "
-                             "defragment. Need %u bytes, but we have %d, so "
-                             "allocate new bucket for it.\n", need, free);
-                }
+        mlog_entry("Set xattr %s in xattr index block\n", xi->xi_name);
 
-                /*
-                 * We have to add new buckets or clusters and one
-                 * allocation should leave us enough space for insert.
-                 */
-                BUG_ON(allocation);
+        ret = ocfs2_xattr_set_entry_bucket(inode, xi, xs, ctxt);
+        if (!ret)
+                goto out;
+        if (ret != -ENOSPC) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                /*
-                 * We do not allow for overlapping ranges between buckets. And
-                 * the maximum number of collisions we will allow for then is
-                 * one bucket's worth, so check it here whether we need to
-                 * add a new bucket for the insert.
-                 */
-                ret = ocfs2_check_xattr_bucket_collision(inode,
-                                                         xs->bucket,
-                                                         xi->name);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+        /* Ack, need more space.  Let's try to get another bucket! */
 
-                ret = ocfs2_add_new_xattr_bucket(inode,
-                                                 xs->xattr_bh,
+        /*
+         * We do not allow for overlapping ranges between buckets. And
+         * the maximum number of collisions we will allow for then is
+         * one bucket's worth, so check it here whether we need to
+         * add a new bucket for the insert.
+         */
+        ret = ocfs2_check_xattr_bucket_collision(inode,
                                                  xs->bucket,
-                                                 ctxt);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+                                                 xi->xi_name);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                /*
-                 * ocfs2_add_new_xattr_bucket() will have updated
-                 * xs->bucket if it moved, but it will not have updated
-                 * any of the other search fields.  Thus, we drop it and
-                 * re-search.  Everything should be cached, so it'll be
-                 * quick.
-                 */
-                ocfs2_xattr_bucket_relse(xs->bucket);
-                ret = ocfs2_xattr_index_block_find(inode, xs->xattr_bh,
-                                                   xi->name_index,
-                                                   xi->name, xs);
-                if (ret && ret != -ENODATA)
-                        goto out;
-                xs->not_found = ret;
-                allocation = 1;
-                goto try_again;
+        ret = ocfs2_add_new_xattr_bucket(inode,
+                                         xs->xattr_bh,
+                                         xs->bucket,
+                                         ctxt);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
         }
 
-xattr_set:
-        ret = ocfs2_xattr_set_in_bucket(inode, xi, xs, ctxt);
+        /*
+         * ocfs2_add_new_xattr_bucket() will have updated
+         * xs->bucket if it moved, but it will not have updated
+         * any of the other search fields.  Thus, we drop it and
+         * re-search.  Everything should be cached, so it'll be
+         * quick.
+         */
+        ocfs2_xattr_bucket_relse(xs->bucket);
+        ret = ocfs2_xattr_index_block_find(inode, xs->xattr_bh,
+                                           xi->xi_name_index,
+                                           xi->xi_name, xs);
+        if (ret && ret != -ENODATA)
+                goto out;
+        xs->not_found = ret;
+
+        /* Ok, we have a new bucket, let's try again */
+        ret = ocfs2_xattr_set_entry_bucket(inode, xi, xs, ctxt);
+        if (ret && (ret != -ENOSPC))
+                mlog_errno(ret);
+
 out:
         mlog_exit(ret);
         return ret;
@@ -5678,7 +5852,7 @@ static int ocfs2_prepare_refcount_xattr(struct inode *inode,
          * refcount tree, and make the original extent become 3. So we will need
          * 2 * cluster more extent recs at most.
          */
-        if (!xi->value || xi->value_len <= OCFS2_XATTR_INLINE_SIZE) {
+        if (!xi->xi_value || xi->xi_value_len <= OCFS2_XATTR_INLINE_SIZE) {
 
                 ret = ocfs2_refcounted_xattr_delete_need(inode,
                                                          &(*ref_tree)->rf_ci,
@@ -6354,33 +6528,33 @@ static int ocfs2_create_empty_xattr_block(struct inode *inode,
                                           int indexed)
 {
         int ret;
-        handle_t *handle;
-        struct ocfs2_alloc_context *meta_ac;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+        struct ocfs2_xattr_set_ctxt ctxt;
 
-        ret = ocfs2_reserve_new_metadata_blocks(osb, 1, &meta_ac);
+        memset(&ctxt, 0, sizeof(ctxt));
+        ret = ocfs2_reserve_new_metadata_blocks(osb, 1, &ctxt.meta_ac);
         if (ret < 0) {
                 mlog_errno(ret);
                 return ret;
         }
 
-        handle = ocfs2_start_trans(osb, OCFS2_XATTR_BLOCK_CREATE_CREDITS);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
+        ctxt.handle = ocfs2_start_trans(osb, OCFS2_XATTR_BLOCK_CREATE_CREDITS);
+        if (IS_ERR(ctxt.handle)) {
+                ret = PTR_ERR(ctxt.handle);
                 mlog_errno(ret);
                 goto out;
         }
 
         mlog(0, "create new xattr block for inode %llu, index = %d\n",
              (unsigned long long)fe_bh->b_blocknr, indexed);
-        ret = ocfs2_create_xattr_block(handle, inode, fe_bh,
-                                       meta_ac, ret_bh, indexed);
+        ret = ocfs2_create_xattr_block(inode, fe_bh, &ctxt, indexed,
+                                       ret_bh);
         if (ret)
                 mlog_errno(ret);
 
-        ocfs2_commit_trans(osb, handle);
+        ocfs2_commit_trans(osb, ctxt.handle);
 out:
-        ocfs2_free_alloc_context(meta_ac);
+        ocfs2_free_alloc_context(ctxt.meta_ac);
         return ret;
 }
 
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index f3b7c1541f3a..c82af6acc2e7 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -6,11 +6,13 @@
 #include <linux/version.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/parser.h>
 #include <linux/buffer_head.h>
 #include <linux/vmalloc.h>
+#include <linux/writeback.h>
 #include <linux/crc-itu-t.h>
 #include "omfs.h"
 
@@ -89,7 +91,7 @@ static void omfs_update_checksums(struct omfs_inode *oi)
         oi->i_head.h_check_xor = xor;
 }
 
-static int omfs_write_inode(struct inode *inode, int wait)
+static int __omfs_write_inode(struct inode *inode, int wait)
 {
         struct omfs_inode *oi;
         struct omfs_sb_info *sbi = OMFS_SB(inode->i_sb);
@@ -162,9 +164,14 @@ out:
         return ret;
 }
 
+static int omfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __omfs_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int omfs_sync_inode(struct inode *inode)
 {
-        return omfs_write_inode(inode, 1);
+        return __omfs_write_inode(inode, 1);
 }
 
 /*
diff --git a/fs/open.c b/fs/open.c
index 040cef72bc00..74e5cd9f718e 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -8,10 +8,8 @@
 #include <linux/mm.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
-#include <linux/quotaops.h>
 #include <linux/fsnotify.h>
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/namei.h>
 #include <linux/backing-dev.h>
@@ -21,6 +19,7 @@
 #include <linux/mount.h>
 #include <linux/vfs.h>
 #include <linux/fcntl.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/fs.h>
 #include <linux/personality.h>
@@ -271,17 +270,15 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
          * Make sure that there are no leases.  get_write_access() protects
          * against the truncate racing with a lease-granting setlease().
          */
-        error = break_lease(inode, FMODE_WRITE);
+        error = break_lease(inode, O_WRONLY);
         if (error)
                 goto put_write_and_out;
 
         error = locks_verify_truncate(inode, NULL, length);
         if (!error)
                 error = security_path_truncate(&path, length, 0);
-        if (!error) {
-                vfs_dq_init(inode);
+        if (!error)
                 error = do_truncate(path.dentry, length, 0, NULL);
-        }
 
 put_write_and_out:
         put_write_access(inode);
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 64bc8998ac9a..e238ab23a9e7 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/kmod.h>
 #include <linux/ctype.h>
 #include <linux/genhd.h>
@@ -412,9 +413,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
         pdev = part_to_dev(p);
 
         p->start_sect = start;
-        p->alignment_offset = queue_sector_alignment_offset(disk->queue, start);
-        p->discard_alignment = queue_sector_discard_alignment(disk->queue,
-                                                              start);
+        p->alignment_offset =
+                queue_limit_alignment_offset(&disk->queue->limits, start);
+        p->discard_alignment =
+                queue_limit_discard_alignment(&disk->queue->limits, start);
         p->nr_sects = len;
         p->partno = partno;
         p->policy = get_disk_ro(disk);
diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
index 49cfd5f54238..91babdae7587 100644
--- a/fs/partitions/efi.c
+++ b/fs/partitions/efi.c
@@ -95,6 +95,7 @@
  ************************************************************/
 #include <linux/crc32.h>
 #include <linux/math64.h>
+#include <linux/slab.h>
 #include "check.h"
 #include "efi.h"
 
diff --git a/fs/partitions/msdos.c b/fs/partitions/msdos.c
index 0028d2ef0662..90be97f1f5a8 100644
--- a/fs/partitions/msdos.c
+++ b/fs/partitions/msdos.c
@@ -31,14 +31,17 @@
  */
 #include <asm/unaligned.h>
 
-#define SYS_IND(p)      (get_unaligned(&p->sys_ind))
-#define NR_SECTS(p)     ({ __le32 __a = get_unaligned(&p->nr_sects);    \
-                                le32_to_cpu(__a); \
-                        })
+#define SYS_IND(p)      get_unaligned(&p->sys_ind)
 
-#define START_SECT(p)   ({ __le32 __a = get_unaligned(&p->start_sect);  \
-                                le32_to_cpu(__a); \
-                        })
+static inline sector_t nr_sects(struct partition *p)
+{
+        return (sector_t)get_unaligned_le32(&p->nr_sects);
+}
+
+static inline sector_t start_sect(struct partition *p)
+{
+        return (sector_t)get_unaligned_le32(&p->start_sect);
+}
 
 static inline int is_extended_partition(struct partition *p)
 {
@@ -104,13 +107,13 @@ static int aix_magic_present(unsigned char *p, struct block_device *bdev)
 
 static void
 parse_extended(struct parsed_partitions *state, struct block_device *bdev,
-                        u32 first_sector, u32 first_size)
+                        sector_t first_sector, sector_t first_size)
 {
         struct partition *p;
         Sector sect;
         unsigned char *data;
-        u32 this_sector, this_size;
-        int sector_size = bdev_logical_block_size(bdev) / 512;
+        sector_t this_sector, this_size;
+        sector_t sector_size = bdev_logical_block_size(bdev) / 512;
         int loopct = 0;         /* number of links followed
                                    without finding a data partition */
         int i;
@@ -145,14 +148,14 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
                  * First process the data partition(s)
                  */
                 for (i=0; i<4; i++, p++) {
-                        u32 offs, size, next;
-                        if (!NR_SECTS(p) || is_extended_partition(p))
+                        sector_t offs, size, next;
+                        if (!nr_sects(p) || is_extended_partition(p))
                                 continue;
 
                         /* Check the 3rd and 4th entries -
                            these sometimes contain random garbage */
-                        offs = START_SECT(p)*sector_size;
-                        size = NR_SECTS(p)*sector_size;
+                        offs = start_sect(p)*sector_size;
+                        size = nr_sects(p)*sector_size;
                         next = this_sector + offs;
                         if (i >= 2) {
                                 if (offs + size > this_size)
@@ -179,13 +182,13 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
                  */
                 p -= 4;
                 for (i=0; i<4; i++, p++)
-                        if (NR_SECTS(p) && is_extended_partition(p))
+                        if (nr_sects(p) && is_extended_partition(p))
                                 break;
                 if (i == 4)
                         goto done;       /* nothing left to do */
 
-                this_sector = first_sector + START_SECT(p) * sector_size;
-                this_size = NR_SECTS(p) * sector_size;
+                this_sector = first_sector + start_sect(p) * sector_size;
+                this_size = nr_sects(p) * sector_size;
                 put_dev_sector(sect);
         }
 done:
@@ -197,7 +200,7 @@ done:
 
 static void
 parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
-                        u32 offset, u32 size, int origin)
+                        sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_SOLARIS_X86_PARTITION
         Sector sect;
@@ -244,7 +247,7 @@ parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
  */
 static void
 parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin, char *flavour,
+                sector_t offset, sector_t size, int origin, char *flavour,
                 int max_partitions)
 {
         Sector sect;
@@ -263,7 +266,7 @@ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
         if (le16_to_cpu(l->d_npartitions) < max_partitions)
                 max_partitions = le16_to_cpu(l->d_npartitions);
         for (p = l->d_partitions; p - l->d_partitions < max_partitions; p++) {
-                u32 bsd_start, bsd_size;
+                sector_t bsd_start, bsd_size;
 
                 if (state->next == state->limit)
                         break;
@@ -290,7 +293,7 @@ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
 
 static void
 parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_BSD_DISKLABEL
         parse_bsd(state, bdev, offset, size, origin,
@@ -300,7 +303,7 @@ parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
 
 static void
 parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_BSD_DISKLABEL
         parse_bsd(state, bdev, offset, size, origin,
@@ -310,7 +313,7 @@ parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
 
 static void
 parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_BSD_DISKLABEL
         parse_bsd(state, bdev, offset, size, origin,
@@ -324,7 +327,7 @@ parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
  */
 static void
 parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_UNIXWARE_DISKLABEL
         Sector sect;
@@ -348,7 +351,8 @@ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
 
                 if (p->s_label != UNIXWARE_FS_UNUSED)
                         put_partition(state, state->next++,
-                                                START_SECT(p), NR_SECTS(p));
+                                      le32_to_cpu(p->start_sect),
+                                      le32_to_cpu(p->nr_sects));
                 p++;
         }
         put_dev_sector(sect);
@@ -363,7 +367,7 @@ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
  */
 static void
 parse_minix(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_MINIX_SUBPARTITION
         Sector sect;
@@ -390,7 +394,7 @@ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
                         /* add each partition in use */
                         if (SYS_IND(p) == MINIX_PARTITION)
                                 put_partition(state, state->next++,
-                                              START_SECT(p), NR_SECTS(p));
+                                              start_sect(p), nr_sects(p));
                 }
                 printk(" >\n");
         }
@@ -401,7 +405,7 @@ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
 static struct {
         unsigned char id;
         void (*parse)(struct parsed_partitions *, struct block_device *,
-                        u32, u32, int);
+                        sector_t, sector_t, int);
 } subtypes[] = {
         {FREEBSD_PARTITION, parse_freebsd},
         {NETBSD_PARTITION, parse_netbsd},
@@ -415,7 +419,7 @@ static struct {
  
 int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
 {
-        int sector_size = bdev_logical_block_size(bdev) / 512;
+        sector_t sector_size = bdev_logical_block_size(bdev) / 512;
         Sector sect;
         unsigned char *data;
         struct partition *p;
@@ -483,14 +487,21 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
 
         state->next = 5;
         for (slot = 1 ; slot <= 4 ; slot++, p++) {
-                u32 start = START_SECT(p)*sector_size;
-                u32 size = NR_SECTS(p)*sector_size;
+                sector_t start = start_sect(p)*sector_size;
+                sector_t size = nr_sects(p)*sector_size;
                 if (!size)
                         continue;
                 if (is_extended_partition(p)) {
-                        /* prevent someone doing mkfs or mkswap on an
-                           extended partition, but leave room for LILO */
-                        put_partition(state, slot, start, size == 1 ? 1 : 2);
+                        /*
+                         * prevent someone doing mkfs or mkswap on an
+                         * extended partition, but leave room for LILO
+                         * FIXME: this uses one logical sector for > 512b
+                         * sector, although it may not be enough/proper.
+                         */
+                        sector_t n = 2;
+                        n = min(size, max(sector_size, n));
+                        put_partition(state, slot, start, n);
+
                         printk(" <");
                         parse_extended(state, bdev, start, size);
                         printk(" >");
@@ -513,7 +524,7 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
                 unsigned char id = SYS_IND(p);
                 int n;
 
-                if (!NR_SECTS(p))
+                if (!nr_sects(p))
                         continue;
 
                 for (n = 0; subtypes[n].parse && id != subtypes[n].id; n++)
@@ -521,8 +532,8 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
 
                 if (!subtypes[n].parse)
                         continue;
-                subtypes[n].parse(state, bdev, START_SECT(p)*sector_size,
-                                                NR_SECTS(p)*sector_size, slot);
+                subtypes[n].parse(state, bdev, start_sect(p)*sector_size,
+                                                nr_sects(p)*sector_size, slot);
         }
         put_dev_sector(sect);
         return 1;
diff --git a/fs/pnode.c b/fs/pnode.c
index 8d5f392ec3d3..5cc564a83149 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -86,7 +86,7 @@ static int do_make_slave(struct vfsmount *mnt)
 
         /*
          * slave 'mnt' to a peer mount that has the
-         * same root dentry. If none is available than
+         * same root dentry. If none is available then
          * slave it to anything that is available.
          */
         while ((peer_mnt = next_peer(peer_mnt)) != mnt &&
@@ -147,6 +147,11 @@ void change_mnt_propagation(struct vfsmount *mnt, int type)
  * get the next mount in the propagation tree.
  * @m: the mount seen last
  * @origin: the original mount from where the tree walk initiated
+ *
+ * Note that peer groups form contiguous segments of slave lists.
+ * We rely on that in get_source() to be able to find out if
+ * vfsmount found while iterating with propagation_next() is
+ * a peer of one we'd found earlier.
  */
 static struct vfsmount *propagation_next(struct vfsmount *m,
                                          struct vfsmount *origin)
@@ -186,10 +191,6 @@ static struct vfsmount *get_source(struct vfsmount *dest,
 {
         struct vfsmount *p_last_src = NULL;
         struct vfsmount *p_last_dest = NULL;
-        *type = CL_PROPAGATION;
-
-        if (IS_MNT_SHARED(dest))
-                *type |= CL_MAKE_SHARED;
 
         while (last_dest != dest->mnt_master) {
                 p_last_dest = last_dest;
@@ -202,13 +203,18 @@ static struct vfsmount *get_source(struct vfsmount *dest,
                 do {
                         p_last_dest = next_peer(p_last_dest);
                 } while (IS_MNT_NEW(p_last_dest));
+                /* is that a peer of the earlier? */
+                if (dest == p_last_dest) {
+                        *type = CL_MAKE_SHARED;
+                        return p_last_src;
+                }
         }
-
-        if (dest != p_last_dest) {
-                *type |= CL_SLAVE;
-                return last_src;
-        } else
-                return p_last_src;
+        /* slave of the earlier, then */
+        *type = CL_SLAVE;
+        /* beginning of peer group among the slaves? */
+        if (IS_MNT_SHARED(dest))
+                *type |= CL_MAKE_SHARED;
+        return last_src;
 }
 
 /*
diff --git a/fs/pnode.h b/fs/pnode.h
index 958665d662af..1ea4ae1efcd3 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -21,12 +21,11 @@
 #define CL_SLAVE                0x02
 #define CL_COPY_ALL             0x04
 #define CL_MAKE_SHARED          0x08
-#define CL_PROPAGATION          0x10
-#define CL_PRIVATE              0x20
+#define CL_PRIVATE              0x10
 
 static inline void set_mnt_shared(struct vfsmount *mnt)
 {
-        mnt->mnt_flags &= ~MNT_PNODE_MASK;
+        mnt->mnt_flags &= ~MNT_SHARED_MASK;
         mnt->mnt_flags |= MNT_SHARED;
 }
 
diff --git a/fs/proc/array.c b/fs/proc/array.c
index f560325c444f..e51f2ec2c5e5 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -68,7 +68,6 @@
 #include <linux/hugetlb.h>
 #include <linux/pagemap.h>
 #include <linux/swap.h>
-#include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/signal.h>
 #include <linux/highmem.h>
@@ -270,8 +269,10 @@ static inline void task_sig(struct seq_file *m, struct task_struct *p)
                 blocked = p->blocked;
                 collect_sigign_sigcatch(p, &ignored, &caught);
                 num_threads = atomic_read(&p->signal->count);
+                rcu_read_lock();  /* FIXME: is this correct? */
                 qsize = atomic_read(&__task_cred(p)->user->sigpending);
-                qlim = p->signal->rlim[RLIMIT_SIGPENDING].rlim_cur;
+                rcu_read_unlock();
+                qlim = task_rlimit(p, RLIMIT_SIGPENDING);
                 unlock_task_sighand(p, &flags);
         }
 
@@ -327,94 +328,6 @@ static inline void task_context_switch_counts(struct seq_file *m,
                         p->nivcsw);
 }
 
-#ifdef CONFIG_MMU
-
-struct stack_stats {
-        struct vm_area_struct *vma;
-        unsigned long   startpage;
-        unsigned long   usage;
-};
-
-static int stack_usage_pte_range(pmd_t *pmd, unsigned long addr,
-                                unsigned long end, struct mm_walk *walk)
-{
-        struct stack_stats *ss = walk->private;
-        struct vm_area_struct *vma = ss->vma;
-        pte_t *pte, ptent;
-        spinlock_t *ptl;
-        int ret = 0;
-
-        pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
-        for (; addr != end; pte++, addr += PAGE_SIZE) {
-                ptent = *pte;
-
-#ifdef CONFIG_STACK_GROWSUP
-                if (pte_present(ptent) || is_swap_pte(ptent))
-                        ss->usage = addr - ss->startpage + PAGE_SIZE;
-#else
-                if (pte_present(ptent) || is_swap_pte(ptent)) {
-                        ss->usage = ss->startpage - addr + PAGE_SIZE;
-                        pte++;
-                        ret = 1;
-                        break;
-                }
-#endif
-        }
-        pte_unmap_unlock(pte - 1, ptl);
-        cond_resched();
-        return ret;
-}
-
-static inline unsigned long get_stack_usage_in_bytes(struct vm_area_struct *vma,
-                                struct task_struct *task)
-{
-        struct stack_stats ss;
-        struct mm_walk stack_walk = {
-                .pmd_entry = stack_usage_pte_range,
-                .mm = vma->vm_mm,
-                .private = &ss,
-        };
-
-        if (!vma->vm_mm || is_vm_hugetlb_page(vma))
-                return 0;
-
-        ss.vma = vma;
-        ss.startpage = task->stack_start & PAGE_MASK;
-        ss.usage = 0;
-
-#ifdef CONFIG_STACK_GROWSUP
-        walk_page_range(KSTK_ESP(task) & PAGE_MASK, vma->vm_end,
-                &stack_walk);
-#else
-        walk_page_range(vma->vm_start, (KSTK_ESP(task) & PAGE_MASK) + PAGE_SIZE,
-                &stack_walk);
-#endif
-        return ss.usage;
-}
-
-static inline void task_show_stack_usage(struct seq_file *m,
-                                                struct task_struct *task)
-{
-        struct vm_area_struct   *vma;
-        struct mm_struct        *mm = get_task_mm(task);
-
-        if (mm) {
-                down_read(&mm->mmap_sem);
-                vma = find_vma(mm, task->stack_start);
-                if (vma)
-                        seq_printf(m, "Stack usage:\t%lu kB\n",
-                                get_stack_usage_in_bytes(vma, task) >> 10);
-
-                up_read(&mm->mmap_sem);
-                mmput(mm);
-        }
-}
-#else
-static void task_show_stack_usage(struct seq_file *m, struct task_struct *task)
-{
-}
-#endif          /* CONFIG_MMU */
-
 static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
 {
         seq_printf(m, "Cpus_allowed:\t");
@@ -445,7 +358,6 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
         task_show_regs(m, task);
 #endif
         task_context_switch_counts(m, task);
-        task_show_stack_usage(m, task);
         return 0;
 }
 
@@ -507,7 +419,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                 cutime = sig->cutime;
                 cstime = sig->cstime;
                 cgtime = sig->cgtime;
-                rsslim = sig->rlim[RLIMIT_RSS].rlim_cur;
+                rsslim = ACCESS_ONCE(sig->rlim[RLIMIT_RSS].rlim_cur);
 
                 /* add up live thread stats at the group level */
                 if (whole) {
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 18d5cc62d8ed..8418fcc0a6ab 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -81,6 +81,7 @@
 #include <linux/elf.h>
 #include <linux/pid_namespace.h>
 #include <linux/fs_struct.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 /* NOTE:
@@ -442,12 +443,13 @@ static const struct file_operations proc_lstats_operations = {
 unsigned long badness(struct task_struct *p, unsigned long uptime);
 static int proc_oom_score(struct task_struct *task, char *buffer)
 {
-        unsigned long points;
+        unsigned long points = 0;
         struct timespec uptime;
 
         do_posix_clock_monotonic_gettime(&uptime);
         read_lock(&tasklist_lock);
-        points = badness(task->group_leader, uptime.tv_sec);
+        if (pid_alive(task))
+                points = badness(task, uptime.tv_sec);
         read_unlock(&tasklist_lock);
         return sprintf(buffer, "%lu\n", points);
 }
@@ -647,17 +649,11 @@ static int mounts_release(struct inode *inode, struct file *file)
 static unsigned mounts_poll(struct file *file, poll_table *wait)
 {
         struct proc_mounts *p = file->private_data;
-        struct mnt_namespace *ns = p->ns;
         unsigned res = POLLIN | POLLRDNORM;
 
-        poll_wait(file, &ns->poll, wait);
-
-        spin_lock(&vfsmount_lock);
-        if (p->event != ns->event) {
-                p->event = ns->event;
+        poll_wait(file, &p->ns->poll, wait);
+        if (mnt_had_events(p))
                 res |= POLLERR | POLLPRI;
-        }
-        spin_unlock(&vfsmount_lock);
 
         return res;
 }
@@ -1095,8 +1091,12 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
         if (!capable(CAP_AUDIT_CONTROL))
                 return -EPERM;
 
-        if (current != pid_task(proc_pid(inode), PIDTYPE_PID))
+        rcu_read_lock();
+        if (current != pid_task(proc_pid(inode), PIDTYPE_PID)) {
+                rcu_read_unlock();
                 return -EPERM;
+        }
+        rcu_read_unlock();
 
         if (count >= PAGE_SIZE)
                 count = PAGE_SIZE - 1;
@@ -1419,7 +1419,6 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
                 goto out;
 
         error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-        nd->last_type = LAST_BIND;
 out:
         return ERR_PTR(error);
 }
@@ -2370,16 +2369,30 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct pid_namespace *ns = dentry->d_sb->s_fs_info;
         pid_t tgid = task_tgid_nr_ns(current, ns);
-        char tmp[PROC_NUMBUF];
-        if (!tgid)
-                return ERR_PTR(-ENOENT);
-        sprintf(tmp, "%d", task_tgid_nr_ns(current, ns));
-        return ERR_PTR(vfs_follow_link(nd,tmp));
+        char *name = ERR_PTR(-ENOENT);
+        if (tgid) {
+                name = __getname();
+                if (!name)
+                        name = ERR_PTR(-ENOMEM);
+                else
+                        sprintf(name, "%d", tgid);
+        }
+        nd_set_link(nd, name);
+        return NULL;
+}
+
+static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
+                                void *cookie)
+{
+        char *s = nd_get_link(nd);
+        if (!IS_ERR(s))
+                __putname(s);
 }
 
 static const struct inode_operations proc_self_inode_operations = {
         .readlink       = proc_self_readlink,
         .follow_link    = proc_self_follow_link,
+        .put_link       = proc_self_put_link,
 };
 
 /*
@@ -2896,7 +2909,7 @@ out_no_task:
  */
 static const struct pid_entry tid_base_stuff[] = {
         DIR("fd",        S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
-        DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fd_operations),
+        DIR("fdinfo",    S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
         REG("environ",   S_IRUSR, proc_environ_operations),
         INF("auxv",      S_IRUSR, proc_pid_auxv),
         ONE("status",    S_IRUGO, proc_pid_status),
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 480cb1065eec..43c127490606 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -13,6 +13,7 @@
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/init.h>
 #include <linux/idr.h>
@@ -291,19 +292,17 @@ static const struct inode_operations proc_file_inode_operations = {
  * returns the struct proc_dir_entry for "/proc/tty/driver", and
  * returns "serial" in residual.
  */
-static int xlate_proc_name(const char *name,
-                           struct proc_dir_entry **ret, const char **residual)
+static int __xlate_proc_name(const char *name, struct proc_dir_entry **ret,
+                             const char **residual)
 {
         const char              *cp = name, *next;
         struct proc_dir_entry   *de;
         int                     len;
-        int                     rtn = 0;
 
         de = *ret;
         if (!de)
                 de = &proc_root;
 
-        spin_lock(&proc_subdir_lock);
         while (1) {
                 next = strchr(cp, '/');
                 if (!next)
@@ -315,16 +314,25 @@ static int xlate_proc_name(const char *name,
                                 break;
                 }
                 if (!de) {
-                        rtn = -ENOENT;
-                        goto out;
+                        WARN(1, "name '%s'\n", name);
+                        return -ENOENT;
                 }
                 cp += len + 1;
         }
         *residual = cp;
         *ret = de;
-out:
+        return 0;
+}
+
+static int xlate_proc_name(const char *name, struct proc_dir_entry **ret,
+                           const char **residual)
+{
+        int rv;
+
+        spin_lock(&proc_subdir_lock);
+        rv = __xlate_proc_name(name, ret, residual);
         spin_unlock(&proc_subdir_lock);
-        return rtn;
+        return rv;
 }
 
 static DEFINE_IDA(proc_inum_ida);
@@ -662,6 +670,7 @@ struct proc_dir_entry *proc_symlink(const char *name,
         }
         return ent;
 }
+EXPORT_SYMBOL(proc_symlink);
 
 struct proc_dir_entry *proc_mkdir_mode(const char *name, mode_t mode,
                 struct proc_dir_entry *parent)
@@ -700,6 +709,7 @@ struct proc_dir_entry *proc_mkdir(const char *name,
 {
         return proc_mkdir_mode(name, S_IRUGO | S_IXUGO, parent);
 }
+EXPORT_SYMBOL(proc_mkdir);
 
 struct proc_dir_entry *create_proc_entry(const char *name, mode_t mode,
                                          struct proc_dir_entry *parent)
@@ -728,6 +738,7 @@ struct proc_dir_entry *create_proc_entry(const char *name, mode_t mode,
         }
         return ent;
 }
+EXPORT_SYMBOL(create_proc_entry);
 
 struct proc_dir_entry *proc_create_data(const char *name, mode_t mode,
                                         struct proc_dir_entry *parent,
@@ -762,6 +773,7 @@ out_free:
 out:
         return NULL;
 }
+EXPORT_SYMBOL(proc_create_data);
 
 static void free_proc_entry(struct proc_dir_entry *de)
 {
@@ -793,11 +805,13 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
         const char *fn = name;
         int len;
 
-        if (xlate_proc_name(name, &parent, &fn) != 0)
+        spin_lock(&proc_subdir_lock);
+        if (__xlate_proc_name(name, &parent, &fn) != 0) {
+                spin_unlock(&proc_subdir_lock);
                 return;
+        }
         len = strlen(fn);
 
-        spin_lock(&proc_subdir_lock);
         for (p = &parent->subdir; *p; p=&(*p)->next ) {
                 if (proc_match(len, fn, *p)) {
                         de = *p;
@@ -807,8 +821,10 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
                 }
         }
         spin_unlock(&proc_subdir_lock);
-        if (!de)
+        if (!de) {
+                WARN(1, "name '%s'\n", name);
                 return;
+        }
 
         spin_lock(&de->pde_unload_lock);
         /*
@@ -853,3 +869,4 @@ continue_removing:
                         de->parent->name, de->name, de->subdir->name);
         pde_put(de);
 }
+EXPORT_SYMBOL(remove_proc_entry);
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 445a02bcaab3..d35b23238fb1 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/smp_lock.h>
 #include <linux/sysctl.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index a44a7897fd4d..19979a2ce272 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -19,6 +19,7 @@
 #include <linux/highmem.h>
 #include <linux/bootmem.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <linux/list.h>
@@ -490,7 +491,7 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                 }
                 read_unlock(&kclist_lock);
 
-                if (m == NULL) {
+                if (&m->list == &kclist_head) {
                         if (clear_user(buffer, tsz))
                                 return -EFAULT;
                 } else if (is_vmalloc_or_module_addr((void *)start)) {
diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
index 7ca78346d3f0..cfe90a48a6e8 100644
--- a/fs/proc/kmsg.c
+++ b/fs/proc/kmsg.c
@@ -12,37 +12,37 @@
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
 #include <linux/fs.h>
+#include <linux/syslog.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
 extern wait_queue_head_t log_wait;
 
-extern int do_syslog(int type, char __user *bug, int count);
-
 static int kmsg_open(struct inode * inode, struct file * file)
 {
-        return do_syslog(1,NULL,0);
+        return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
 }
 
 static int kmsg_release(struct inode * inode, struct file * file)
 {
-        (void) do_syslog(0,NULL,0);
+        (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
         return 0;
 }
 
 static ssize_t kmsg_read(struct file *file, char __user *buf,
                          size_t count, loff_t *ppos)
 {
-        if ((file->f_flags & O_NONBLOCK) && !do_syslog(9, NULL, 0))
+        if ((file->f_flags & O_NONBLOCK) &&
+            !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
                 return -EAGAIN;
-        return do_syslog(2, buf, count);
+        return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
 }
 
 static unsigned int kmsg_poll(struct file *file, poll_table *wait)
 {
         poll_wait(file, &log_wait, wait);
-        if (do_syslog(9, NULL, 0))
+        if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
                 return POLLIN | POLLRDNORM;
         return 0;
 }
diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
index 9fe7d7ebe115..b1822dde55c2 100644
--- a/fs/proc/nommu.c
+++ b/fs/proc/nommu.c
@@ -21,7 +21,6 @@
 #include <linux/mmzone.h>
 #include <linux/pagemap.h>
 #include <linux/swap.h>
-#include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/seq_file.h>
 #include <linux/hugetlb.h>
diff --git a/fs/proc/proc_devtree.c b/fs/proc/proc_devtree.c
index 123257bb356b..ce94801f48ca 100644
--- a/fs/proc/proc_devtree.c
+++ b/fs/proc/proc_devtree.c
@@ -10,16 +10,20 @@
 #include <linux/seq_file.h>
 #include <linux/stat.h>
 #include <linux/string.h>
+#include <linux/of.h>
+#include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/prom.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
-#ifndef HAVE_ARCH_DEVTREE_FIXUPS
 static inline void set_node_proc_entry(struct device_node *np,
                                        struct proc_dir_entry *de)
 {
-}
+#ifdef HAVE_ARCH_DEVTREE_FIXUPS
+        np->pde = de;
 #endif
+}
 
 static struct proc_dir_entry *proc_device_tree;
 
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 04d1270f1c38..9020ac15baaa 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -14,6 +14,7 @@
 #include <linux/time.h>
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/module.h>
diff --git a/fs/proc/root.c b/fs/proc/root.c
index b080b791d9e3..757c069f2a65 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -220,9 +220,3 @@ void pid_ns_release_proc(struct pid_namespace *ns)
 {
         mntput(ns->proc_mnt);
 }
-
-EXPORT_SYMBOL(proc_symlink);
-EXPORT_SYMBOL(proc_mkdir);
-EXPORT_SYMBOL(create_proc_entry);
-EXPORT_SYMBOL(proc_create_data);
-EXPORT_SYMBOL(remove_proc_entry);
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index b9b7aad2003d..bf31b03fc275 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -1,6 +1,5 @@
 #include <linux/cpumask.h>
 #include <linux/fs.h>
-#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/kernel_stat.h>
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 47c03f4336b8..070553427dd5 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -4,6 +4,7 @@
 #include <linux/seq_file.h>
 #include <linux/highmem.h>
 #include <linux/ptrace.h>
+#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/mempolicy.h>
 #include <linux/swap.h>
@@ -16,7 +17,7 @@
 
 void task_mem(struct seq_file *m, struct mm_struct *mm)
 {
-        unsigned long data, text, lib;
+        unsigned long data, text, lib, swap;
         unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss;
 
         /*
@@ -36,6 +37,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
         data = mm->total_vm - mm->shared_vm - mm->stack_vm;
         text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK)) >> 10;
         lib = (mm->exec_vm << (PAGE_SHIFT-10)) - text;
+        swap = get_mm_counter(mm, MM_SWAPENTS);
         seq_printf(m,
                 "VmPeak:\t%8lu kB\n"
                 "VmSize:\t%8lu kB\n"
@@ -46,7 +48,8 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
                 "VmStk:\t%8lu kB\n"
                 "VmExe:\t%8lu kB\n"
                 "VmLib:\t%8lu kB\n"
-                "VmPTE:\t%8lu kB\n",
+                "VmPTE:\t%8lu kB\n"
+                "VmSwap:\t%8lu kB\n",
                 hiwater_vm << (PAGE_SHIFT-10),
                 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
                 mm->locked_vm << (PAGE_SHIFT-10),
@@ -54,7 +57,8 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
                 total_rss << (PAGE_SHIFT-10),
                 data << (PAGE_SHIFT-10),
                 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
-                (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
+                (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
+                swap << (PAGE_SHIFT-10));
 }
 
 unsigned long task_vsize(struct mm_struct *mm)
@@ -65,11 +69,11 @@ unsigned long task_vsize(struct mm_struct *mm)
 int task_statm(struct mm_struct *mm, int *shared, int *text,
                int *data, int *resident)
 {
-        *shared = get_mm_counter(mm, file_rss);
+        *shared = get_mm_counter(mm, MM_FILEPAGES);
         *text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK))
                                                                 >> PAGE_SHIFT;
         *data = mm->total_vm - mm->shared_vm;
-        *resident = *shared + get_mm_counter(mm, anon_rss);
+        *resident = *shared + get_mm_counter(mm, MM_ANONPAGES);
         return mm->total_vm;
 }
 
@@ -361,12 +365,11 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                 if (!pte_present(ptent))
                         continue;
 
-                mss->resident += PAGE_SIZE;
-
                 page = vm_normal_page(vma, addr, ptent);
                 if (!page)
                         continue;
 
+                mss->resident += PAGE_SIZE;
                 /* Accumulate the size in pages that have been accessed. */
                 if (pte_young(ptent) || PageReferenced(page))
                         mss->referenced += PAGE_SIZE;
@@ -404,6 +407,7 @@ static int show_smap(struct seq_file *m, void *v)
 
         memset(&mss, 0, sizeof mss);
         mss.vma = vma;
+        /* mmap_sem is held in m_start */
         if (vma->vm_mm && !is_vm_hugetlb_page(vma))
                 walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
 
@@ -550,7 +554,8 @@ const struct file_operations proc_clear_refs_operations = {
 };
 
 struct pagemapread {
-        u64 __user *out, *end;
+        int pos, len;
+        u64 *buffer;
 };
 
 #define PM_ENTRY_BYTES      sizeof(u64)
@@ -573,10 +578,8 @@ struct pagemapread {
 static int add_to_pagemap(unsigned long addr, u64 pfn,
                           struct pagemapread *pm)
 {
-        if (put_user(pfn, pm->out))
-                return -EFAULT;
-        pm->out++;
-        if (pm->out >= pm->end)
+        pm->buffer[pm->pos++] = pfn;
+        if (pm->pos >= pm->len)
                 return PM_END_OF_BUFFER;
         return 0;
 }
@@ -659,31 +662,18 @@ static u64 huge_pte_to_pagemap_entry(pte_t pte, int offset)
         return pme;
 }
 
-static int pagemap_hugetlb_range(pte_t *pte, unsigned long addr,
-                                 unsigned long end, struct mm_walk *walk)
+/* This function walks within one hugetlb entry in the single call */
+static int pagemap_hugetlb_range(pte_t *pte, unsigned long hmask,
+                                 unsigned long addr, unsigned long end,
+                                 struct mm_walk *walk)
 {
-        struct vm_area_struct *vma;
         struct pagemapread *pm = walk->private;
-        struct hstate *hs = NULL;
         int err = 0;
+        u64 pfn;
 
-        vma = find_vma(walk->mm, addr);
-        if (vma)
-                hs = hstate_vma(vma);
         for (; addr != end; addr += PAGE_SIZE) {
-                u64 pfn = PM_NOT_PRESENT;
-
-                if (vma && (addr >= vma->vm_end)) {
-                        vma = find_vma(walk->mm, addr);
-                        if (vma)
-                                hs = hstate_vma(vma);
-                }
-
-                if (vma && (vma->vm_start <= addr) && is_vm_hugetlb_page(vma)) {
-                        /* calculate pfn of the "raw" page in the hugepage. */
-                        int offset = (addr & ~huge_page_mask(hs)) >> PAGE_SHIFT;
-                        pfn = huge_pte_to_pagemap_entry(*pte, offset);
-                }
+                int offset = (addr & ~hmask) >> PAGE_SHIFT;
+                pfn = huge_pte_to_pagemap_entry(*pte, offset);
                 err = add_to_pagemap(addr, pfn, pm);
                 if (err)
                         return err;
@@ -718,21 +708,20 @@ static int pagemap_hugetlb_range(pte_t *pte, unsigned long addr,
  * determine which areas of memory are actually mapped and llseek to
  * skip over unmapped regions.
  */
+#define PAGEMAP_WALK_SIZE       (PMD_SIZE)
 static ssize_t pagemap_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
 {
         struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
-        struct page **pages, *page;
-        unsigned long uaddr, uend;
         struct mm_struct *mm;
         struct pagemapread pm;
-        int pagecount;
         int ret = -ESRCH;
         struct mm_walk pagemap_walk = {};
         unsigned long src;
         unsigned long svpfn;
         unsigned long start_vaddr;
         unsigned long end_vaddr;
+        int copied = 0;
 
         if (!task)
                 goto out;
@@ -755,35 +744,12 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
         if (!mm)
                 goto out_task;
 
-
-        uaddr = (unsigned long)buf & PAGE_MASK;
-        uend = (unsigned long)(buf + count);
-        pagecount = (PAGE_ALIGN(uend) - uaddr) / PAGE_SIZE;
-        ret = 0;
-        if (pagecount == 0)
-                goto out_mm;
-        pages = kcalloc(pagecount, sizeof(struct page *), GFP_KERNEL);
+        pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
+        pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
         ret = -ENOMEM;
-        if (!pages)
+        if (!pm.buffer)
                 goto out_mm;
 
-        down_read(&current->mm->mmap_sem);
-        ret = get_user_pages(current, current->mm, uaddr, pagecount,
-                             1, 0, pages, NULL);
-        up_read(&current->mm->mmap_sem);
-
-        if (ret < 0)
-                goto out_free;
-
-        if (ret != pagecount) {
-                pagecount = ret;
-                ret = -EFAULT;
-                goto out_pages;
-        }
-
-        pm.out = (u64 __user *)buf;
-        pm.end = (u64 __user *)(buf + count);
-
         pagemap_walk.pmd_entry = pagemap_pte_range;
         pagemap_walk.pte_hole = pagemap_pte_hole;
         pagemap_walk.hugetlb_entry = pagemap_hugetlb_range;
@@ -805,23 +771,36 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
          * user buffer is tracked in "pm", and the walk
          * will stop when we hit the end of the buffer.
          */
-        ret = walk_page_range(start_vaddr, end_vaddr, &pagemap_walk);
-        if (ret == PM_END_OF_BUFFER)
-                ret = 0;
-        /* don't need mmap_sem for these, but this looks cleaner */
-        *ppos += (char __user *)pm.out - buf;
-        if (!ret)
-                ret = (char __user *)pm.out - buf;
-
-out_pages:
-        for (; pagecount; pagecount--) {
-                page = pages[pagecount-1];
-                if (!PageReserved(page))
-                        SetPageDirty(page);
-                page_cache_release(page);
+        ret = 0;
+        while (count && (start_vaddr < end_vaddr)) {
+                int len;
+                unsigned long end;
+
+                pm.pos = 0;
+                end = start_vaddr + PAGEMAP_WALK_SIZE;
+                /* overflow ? */
+                if (end < start_vaddr || end > end_vaddr)
+                        end = end_vaddr;
+                down_read(&mm->mmap_sem);
+                ret = walk_page_range(start_vaddr, end, &pagemap_walk);
+                up_read(&mm->mmap_sem);
+                start_vaddr = end;
+
+                len = min(count, PM_ENTRY_BYTES * pm.pos);
+                if (copy_to_user(buf, pm.buffer, len)) {
+                        ret = -EFAULT;
+                        goto out_free;
+                }
+                copied += len;
+                buf += len;
+                count -= len;
         }
+        *ppos += copied;
+        if (!ret || ret == PM_END_OF_BUFFER)
+                ret = copied;
+
 out_free:
-        kfree(pages);
+        kfree(pm.buffer);
 out_mm:
         mmput(mm);
 out_task:
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 5d9fd64ef81a..46d4b5d72bd3 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -5,6 +5,7 @@
 #include <linux/fs_struct.h>
 #include <linux/mount.h>
 #include <linux/ptrace.h>
+#include <linux/slab.h>
 #include <linux/seq_file.h>
 #include "internal.h"
 
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 0872afa58d39..9fbc99ec799a 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -12,6 +12,7 @@
 #include <linux/user.h>
 #include <linux/elf.h>
 #include <linux/elfcore.h>
+#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/bootmem.h>
 #include <linux/init.h>
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index ebf3440d28ca..277575ddc05c 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -201,7 +201,8 @@ static const char *qnx4_checkroot(struct super_block *sb)
                                 rootdir = (struct qnx4_inode_entry *) (bh->b_data + i * QNX4_DIR_ENTRY_SIZE);
                                 if (rootdir->di_fname != NULL) {
                                         QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
-                                        if (!strncmp(rootdir->di_fname, QNX4_BMNAME, sizeof QNX4_BMNAME)) {
+                                        if (!strcmp(rootdir->di_fname,
+                                                    QNX4_BMNAME)) {
                                                 found = 1;
                                                 qnx4_sb(sb)->BitMap = kmalloc( sizeof( struct qnx4_inode_entry ), GFP_KERNEL );
                                                 if (!qnx4_sb(sb)->BitMap) {
diff --git a/fs/quota/Kconfig b/fs/quota/Kconfig
index efc02ebb8c70..3e21b1e2ad3a 100644
--- a/fs/quota/Kconfig
+++ b/fs/quota/Kconfig
@@ -33,6 +33,14 @@ config PRINT_QUOTA_WARNING
           Note that this behavior is currently deprecated and may go away in
           future. Please use notification via netlink socket instead.
 
+config QUOTA_DEBUG
+        bool "Additional quota sanity checks"
+        depends on QUOTA
+        default n
+        help
+          If you say Y here, quota subsystem will perform some additional
+          sanity checks of quota internal structures. If unsure, say N.
+
 # Generic support for tree structured quota files. Selected when needed.
 config QUOTA_TREE
          tristate
@@ -59,3 +67,8 @@ config QUOTACTL
         bool
         depends on XFS_QUOTA || QUOTA
         default y
+
+config QUOTACTL_COMPAT
+        bool
+        depends on QUOTACTL && COMPAT_FOR_U64_ALIGNMENT
+        default y
diff --git a/fs/quota/Makefile b/fs/quota/Makefile
index 68d4f6dc0578..5f9e9e276af0 100644
--- a/fs/quota/Makefile
+++ b/fs/quota/Makefile
@@ -3,3 +3,5 @@ obj-$(CONFIG_QFMT_V1)		+= quota_v1.o
 obj-$(CONFIG_QFMT_V2)           += quota_v2.o
 obj-$(CONFIG_QUOTA_TREE)        += quota_tree.o
 obj-$(CONFIG_QUOTACTL)          += quota.o
+obj-$(CONFIG_QUOTACTL_COMPAT)   += compat.o
+obj-$(CONFIG_QUOTA_NETLINK_INTERFACE)   += netlink.o
diff --git a/fs/quota/compat.c b/fs/quota/compat.c
new file mode 100644
index 000000000000..fb1892fe3e56
--- /dev/null
+++ b/fs/quota/compat.c
@@ -0,0 +1,118 @@
+
+#include <linux/syscalls.h>
+#include <linux/compat.h>
+#include <linux/quotaops.h>
+
+/*
+ * This code works only for 32 bit quota tools over 64 bit OS (x86_64, ia64)
+ * and is necessary due to alignment problems.
+ */
+struct compat_if_dqblk {
+        compat_u64 dqb_bhardlimit;
+        compat_u64 dqb_bsoftlimit;
+        compat_u64 dqb_curspace;
+        compat_u64 dqb_ihardlimit;
+        compat_u64 dqb_isoftlimit;
+        compat_u64 dqb_curinodes;
+        compat_u64 dqb_btime;
+        compat_u64 dqb_itime;
+        compat_uint_t dqb_valid;
+};
+
+/* XFS structures */
+struct compat_fs_qfilestat {
+        compat_u64 dqb_bhardlimit;
+        compat_u64 qfs_nblks;
+        compat_uint_t qfs_nextents;
+};
+
+struct compat_fs_quota_stat {
+        __s8            qs_version;
+        __u16           qs_flags;
+        __s8            qs_pad;
+        struct compat_fs_qfilestat      qs_uquota;
+        struct compat_fs_qfilestat      qs_gquota;
+        compat_uint_t   qs_incoredqs;
+        compat_int_t    qs_btimelimit;
+        compat_int_t    qs_itimelimit;
+        compat_int_t    qs_rtbtimelimit;
+        __u16           qs_bwarnlimit;
+        __u16           qs_iwarnlimit;
+};
+
+asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,
+                                                qid_t id, void __user *addr)
+{
+        unsigned int cmds;
+        struct if_dqblk __user *dqblk;
+        struct compat_if_dqblk __user *compat_dqblk;
+        struct fs_quota_stat __user *fsqstat;
+        struct compat_fs_quota_stat __user *compat_fsqstat;
+        compat_uint_t data;
+        u16 xdata;
+        long ret;
+
+        cmds = cmd >> SUBCMDSHIFT;
+
+        switch (cmds) {
+        case Q_GETQUOTA:
+                dqblk = compat_alloc_user_space(sizeof(struct if_dqblk));
+                compat_dqblk = addr;
+                ret = sys_quotactl(cmd, special, id, dqblk);
+                if (ret)
+                        break;
+                if (copy_in_user(compat_dqblk, dqblk, sizeof(*compat_dqblk)) ||
+                        get_user(data, &dqblk->dqb_valid) ||
+                        put_user(data, &compat_dqblk->dqb_valid))
+                        ret = -EFAULT;
+                break;
+        case Q_SETQUOTA:
+                dqblk = compat_alloc_user_space(sizeof(struct if_dqblk));
+                compat_dqblk = addr;
+                ret = -EFAULT;
+                if (copy_in_user(dqblk, compat_dqblk, sizeof(*compat_dqblk)) ||
+                        get_user(data, &compat_dqblk->dqb_valid) ||
+                        put_user(data, &dqblk->dqb_valid))
+                        break;
+                ret = sys_quotactl(cmd, special, id, dqblk);
+                break;
+        case Q_XGETQSTAT:
+                fsqstat = compat_alloc_user_space(sizeof(struct fs_quota_stat));
+                compat_fsqstat = addr;
+                ret = sys_quotactl(cmd, special, id, fsqstat);
+                if (ret)
+                        break;
+                ret = -EFAULT;
+                /* Copying qs_version, qs_flags, qs_pad */
+                if (copy_in_user(compat_fsqstat, fsqstat,
+                        offsetof(struct compat_fs_quota_stat, qs_uquota)))
+                        break;
+                /* Copying qs_uquota */
+                if (copy_in_user(&compat_fsqstat->qs_uquota,
+                        &fsqstat->qs_uquota,
+                        sizeof(compat_fsqstat->qs_uquota)) ||
+                        get_user(data, &fsqstat->qs_uquota.qfs_nextents) ||
+                        put_user(data, &compat_fsqstat->qs_uquota.qfs_nextents))
+                        break;
+                /* Copying qs_gquota */
+                if (copy_in_user(&compat_fsqstat->qs_gquota,
+                        &fsqstat->qs_gquota,
+                        sizeof(compat_fsqstat->qs_gquota)) ||
+                        get_user(data, &fsqstat->qs_gquota.qfs_nextents) ||
+                        put_user(data, &compat_fsqstat->qs_gquota.qfs_nextents))
+                        break;
+                /* Copying the rest */
+                if (copy_in_user(&compat_fsqstat->qs_incoredqs,
+                        &fsqstat->qs_incoredqs,
+                        sizeof(struct compat_fs_quota_stat) -
+                        offsetof(struct compat_fs_quota_stat, qs_incoredqs)) ||
+                        get_user(xdata, &fsqstat->qs_iwarnlimit) ||
+                        put_user(xdata, &compat_fsqstat->qs_iwarnlimit))
+                        break;
+                ret = 0;
+                break;
+        default:
+                ret = sys_quotactl(cmd, special, id, addr);
+        }
+        return ret;
+}
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index dea86abdf2e7..788b5802a7ce 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -80,8 +80,6 @@
 
 #include <asm/uaccess.h>
 
-#define __DQUOT_PARANOIA
-
 /*
  * There are three quota SMP locks. dq_list_lock protects all lists with quotas
  * and quota formats, dqstats structure containing statistics about the lists
@@ -100,9 +98,13 @@
  *
  * Any operation working on dquots via inode pointers must hold dqptr_sem.  If
  * operation is just reading pointers from inode (or not using them at all) the
- * read lock is enough. If pointers are altered function must hold write lock
- * (these locking rules also apply for S_NOQUOTA flag in the inode - note that
- * for altering the flag i_mutex is also needed).
+ * read lock is enough. If pointers are altered function must hold write lock.
+ * Special care needs to be taken about S_NOQUOTA inode flag (marking that
+ * inode is a quota file). Functions adding pointers from inode to dquots have
+ * to check this flag under dqptr_sem and then (if S_NOQUOTA is not set) they
+ * have to do all pointer modifications before dropping dqptr_sem. This makes
+ * sure they cannot race with quotaon which first sets S_NOQUOTA flag and
+ * then drops all pointers to dquots from an inode.
  *
  * Each dquot has its dq_lock mutex. Locked dquots might not be referenced
  * from inodes (dquot_alloc_space() and such don't check the dq_lock).
@@ -225,6 +227,9 @@ static struct hlist_head *dquot_hash;
 struct dqstats dqstats;
 EXPORT_SYMBOL(dqstats);
 
+static qsize_t inode_get_rsv_space(struct inode *inode);
+static void __dquot_initialize(struct inode *inode, int type);
+
 static inline unsigned int
 hashfn(const struct super_block *sb, unsigned int id, int type)
 {
@@ -564,7 +569,7 @@ out:
 }
 EXPORT_SYMBOL(dquot_scan_active);
 
-int vfs_quota_sync(struct super_block *sb, int type)
+int vfs_quota_sync(struct super_block *sb, int type, int wait)
 {
         struct list_head *dirty;
         struct dquot *dquot;
@@ -609,6 +614,33 @@ int vfs_quota_sync(struct super_block *sb, int type)
         spin_unlock(&dq_list_lock);
         mutex_unlock(&dqopt->dqonoff_mutex);
 
+        if (!wait || (sb_dqopt(sb)->flags & DQUOT_QUOTA_SYS_FILE))
+                return 0;
+
+        /* This is not very clever (and fast) but currently I don't know about
+         * any other simple way of getting quota data to disk and we must get
+         * them there for userspace to be visible... */
+        if (sb->s_op->sync_fs)
+                sb->s_op->sync_fs(sb, 1);
+        sync_blockdev(sb->s_bdev);
+
+        /*
+         * Now when everything is written we can discard the pagecache so
+         * that userspace sees the changes.
+         */
+        mutex_lock(&sb_dqopt(sb)->dqonoff_mutex);
+        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+                if (type != -1 && cnt != type)
+                        continue;
+                if (!sb_has_quota_active(sb, cnt))
+                        continue;
+                mutex_lock_nested(&sb_dqopt(sb)->files[cnt]->i_mutex,
+                                  I_MUTEX_QUOTA);
+                truncate_inode_pages(&sb_dqopt(sb)->files[cnt]->i_data, 0);
+                mutex_unlock(&sb_dqopt(sb)->files[cnt]->i_mutex);
+        }
+        mutex_unlock(&sb_dqopt(sb)->dqonoff_mutex);
+
         return 0;
 }
 EXPORT_SYMBOL(vfs_quota_sync);
@@ -661,7 +693,7 @@ void dqput(struct dquot *dquot)
 
         if (!dquot)
                 return;
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
         if (!atomic_read(&dquot->dq_count)) {
                 printk("VFS: dqput: trying to free free dquot\n");
                 printk("VFS: device %s, dquot of %s %d\n",
@@ -714,7 +746,7 @@ we_slept:
                 goto we_slept;
         }
         atomic_dec(&dquot->dq_count);
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
         /* sanity check */
         BUG_ON(!list_empty(&dquot->dq_free));
 #endif
@@ -811,7 +843,7 @@ we_slept:
                 dquot = NULL;
                 goto out;
         }
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
         BUG_ON(!dquot->dq_sb);  /* Has somebody invalidated entry under us? */
 #endif
 out:
@@ -840,11 +872,18 @@ static int dqinit_needed(struct inode *inode, int type)
 static void add_dquot_ref(struct super_block *sb, int type)
 {
         struct inode *inode, *old_inode = NULL;
+#ifdef CONFIG_QUOTA_DEBUG
+        int reserved = 0;
+#endif
 
         spin_lock(&inode_lock);
         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                 if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
                         continue;
+#ifdef CONFIG_QUOTA_DEBUG
+                if (unlikely(inode_get_rsv_space(inode) > 0))
+                        reserved = 1;
+#endif
                 if (!atomic_read(&inode->i_writecount))
                         continue;
                 if (!dqinit_needed(inode, type))
@@ -854,7 +893,7 @@ static void add_dquot_ref(struct super_block *sb, int type)
                 spin_unlock(&inode_lock);
 
                 iput(old_inode);
-                sb->dq_op->initialize(inode, type);
+                __dquot_initialize(inode, type);
                 /* We hold a reference to 'inode' so it couldn't have been
                  * removed from s_inodes list while we dropped the inode_lock.
                  * We cannot iput the inode now as we can be holding the last
@@ -865,6 +904,14 @@ static void add_dquot_ref(struct super_block *sb, int type)
         }
         spin_unlock(&inode_lock);
         iput(old_inode);
+
+#ifdef CONFIG_QUOTA_DEBUG
+        if (reserved) {
+                printk(KERN_WARNING "VFS (%s): Writes happened before quota"
+                        " was turned on thus quota information is probably "
+                        "inconsistent. Please run quotacheck(8).\n", sb->s_id);
+        }
+#endif
 }
 
 /*
@@ -891,7 +938,7 @@ static int remove_inode_dquot_ref(struct inode *inode, int type,
         inode->i_dquot[type] = NULL;
         if (dquot) {
                 if (dqput_blocks(dquot)) {
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
                         if (atomic_read(&dquot->dq_count) != 1)
                                 printk(KERN_WARNING "VFS: Adding dquot with dq_count %d to dispose list.\n", atomic_read(&dquot->dq_count));
 #endif
@@ -978,10 +1025,12 @@ static inline void dquot_resv_space(struct dquot *dquot, qsize_t number)
 /*
  * Claim reserved quota space
  */
-static void dquot_claim_reserved_space(struct dquot *dquot,
-                                                qsize_t number)
+static void dquot_claim_reserved_space(struct dquot *dquot, qsize_t number)
 {
-        WARN_ON(dquot->dq_dqb.dqb_rsvspace < number);
+        if (dquot->dq_dqb.dqb_rsvspace < number) {
+                WARN_ON_ONCE(1);
+                number = dquot->dq_dqb.dqb_rsvspace;
+        }
         dquot->dq_dqb.dqb_curspace += number;
         dquot->dq_dqb.dqb_rsvspace -= number;
 }
@@ -989,7 +1038,12 @@ static void dquot_claim_reserved_space(struct dquot *dquot,
 static inline
 void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
 {
-        dquot->dq_dqb.dqb_rsvspace -= number;
+        if (dquot->dq_dqb.dqb_rsvspace >= number)
+                dquot->dq_dqb.dqb_rsvspace -= number;
+        else {
+                WARN_ON_ONCE(1);
+                dquot->dq_dqb.dqb_rsvspace = 0;
+        }
 }
 
 static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
@@ -1131,13 +1185,13 @@ static int check_idq(struct dquot *dquot, qsize_t inodes, char *warntype)
         *warntype = QUOTA_NL_NOWARN;
         if (!sb_has_quota_limits_enabled(dquot->dq_sb, dquot->dq_type) ||
             test_bit(DQ_FAKE_B, &dquot->dq_flags))
-                return QUOTA_OK;
+                return 0;
 
         if (dquot->dq_dqb.dqb_ihardlimit &&
             newinodes > dquot->dq_dqb.dqb_ihardlimit &&
             !ignore_hardlimit(dquot)) {
                 *warntype = QUOTA_NL_IHARDWARN;
-                return NO_QUOTA;
+                return -EDQUOT;
         }
 
         if (dquot->dq_dqb.dqb_isoftlimit &&
@@ -1146,7 +1200,7 @@ static int check_idq(struct dquot *dquot, qsize_t inodes, char *warntype)
             get_seconds() >= dquot->dq_dqb.dqb_itime &&
             !ignore_hardlimit(dquot)) {
                 *warntype = QUOTA_NL_ISOFTLONGWARN;
-                return NO_QUOTA;
+                return -EDQUOT;
         }
 
         if (dquot->dq_dqb.dqb_isoftlimit &&
@@ -1157,7 +1211,7 @@ static int check_idq(struct dquot *dquot, qsize_t inodes, char *warntype)
                     sb_dqopt(dquot->dq_sb)->info[dquot->dq_type].dqi_igrace;
         }
 
-        return QUOTA_OK;
+        return 0;
 }
 
 /* needs dq_data_lock */
@@ -1169,7 +1223,7 @@ static int check_bdq(struct dquot *dquot, qsize_t space, int prealloc, char *war
         *warntype = QUOTA_NL_NOWARN;
         if (!sb_has_quota_limits_enabled(sb, dquot->dq_type) ||
             test_bit(DQ_FAKE_B, &dquot->dq_flags))
-                return QUOTA_OK;
+                return 0;
 
         tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace
                 + space;
@@ -1179,7 +1233,7 @@ static int check_bdq(struct dquot *dquot, qsize_t space, int prealloc, char *war
             !ignore_hardlimit(dquot)) {
                 if (!prealloc)
                         *warntype = QUOTA_NL_BHARDWARN;
-                return NO_QUOTA;
+                return -EDQUOT;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1189,7 +1243,7 @@ static int check_bdq(struct dquot *dquot, qsize_t space, int prealloc, char *war
             !ignore_hardlimit(dquot)) {
                 if (!prealloc)
                         *warntype = QUOTA_NL_BSOFTLONGWARN;
-                return NO_QUOTA;
+                return -EDQUOT;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1205,10 +1259,10 @@ static int check_bdq(struct dquot *dquot, qsize_t space, int prealloc, char *war
                          * We don't allow preallocation to exceed softlimit so exceeding will
                          * be always printed
                          */
-                        return NO_QUOTA;
+                        return -EDQUOT;
         }
 
-        return QUOTA_OK;
+        return 0;
 }
 
 static int info_idq_free(struct dquot *dquot, qsize_t inodes)
@@ -1242,25 +1296,32 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space)
                 return QUOTA_NL_BHARDBELOW;
         return QUOTA_NL_NOWARN;
 }
+
 /*
- *      Initialize quota pointers in inode
- *      We do things in a bit complicated way but by that we avoid calling
- *      dqget() and thus filesystem callbacks under dqptr_sem.
+ * Initialize quota pointers in inode
+ *
+ * We do things in a bit complicated way but by that we avoid calling
+ * dqget() and thus filesystem callbacks under dqptr_sem.
+ *
+ * It is better to call this function outside of any transaction as it
+ * might need a lot of space in journal for dquot structure allocation.
  */
-int dquot_initialize(struct inode *inode, int type)
+static void __dquot_initialize(struct inode *inode, int type)
 {
         unsigned int id = 0;
-        int cnt, ret = 0;
-        struct dquot *got[MAXQUOTAS] = { NULL, NULL };
+        int cnt;
+        struct dquot *got[MAXQUOTAS];
         struct super_block *sb = inode->i_sb;
+        qsize_t rsv;
 
         /* First test before acquiring mutex - solves deadlocks when we
          * re-enter the quota code and are already holding the mutex */
-        if (IS_NOQUOTA(inode))
-                return 0;
+        if (!sb_any_quota_active(inode->i_sb) || IS_NOQUOTA(inode))
+                return;
 
         /* First get references to structures we might need. */
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+                got[cnt] = NULL;
                 if (type != -1 && cnt != type)
                         continue;
                 switch (cnt) {
@@ -1275,7 +1336,6 @@ int dquot_initialize(struct inode *inode, int type)
         }
 
         down_write(&sb_dqopt(sb)->dqptr_sem);
-        /* Having dqptr_sem we know NOQUOTA flags can't be altered... */
         if (IS_NOQUOTA(inode))
                 goto out_err;
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
@@ -1287,20 +1347,31 @@ int dquot_initialize(struct inode *inode, int type)
                 if (!inode->i_dquot[cnt]) {
                         inode->i_dquot[cnt] = got[cnt];
                         got[cnt] = NULL;
+                        /*
+                         * Make quota reservation system happy if someone
+                         * did a write before quota was turned on
+                         */
+                        rsv = inode_get_rsv_space(inode);
+                        if (unlikely(rsv))
+                                dquot_resv_space(inode->i_dquot[cnt], rsv);
                 }
         }
 out_err:
         up_write(&sb_dqopt(sb)->dqptr_sem);
         /* Drop unused references */
         dqput_all(got);
-        return ret;
+}
+
+void dquot_initialize(struct inode *inode)
+{
+        __dquot_initialize(inode, -1);
 }
 EXPORT_SYMBOL(dquot_initialize);
 
 /*
  *      Release all quotas referenced by inode
  */
-int dquot_drop(struct inode *inode)
+static void __dquot_drop(struct inode *inode)
 {
         int cnt;
         struct dquot *put[MAXQUOTAS];
@@ -1312,32 +1383,31 @@ int dquot_drop(struct inode *inode)
         }
         up_write(&sb_dqopt(inode->i_sb)->dqptr_sem);
         dqput_all(put);
-        return 0;
 }
-EXPORT_SYMBOL(dquot_drop);
 
-/* Wrapper to remove references to quota structures from inode */
-void vfs_dq_drop(struct inode *inode)
-{
-        /* Here we can get arbitrary inode from clear_inode() so we have
-         * to be careful. OTOH we don't need locking as quota operations
-         * are allowed to change only at mount time */
-        if (!IS_NOQUOTA(inode) && inode->i_sb && inode->i_sb->dq_op
-            && inode->i_sb->dq_op->drop) {
-                int cnt;
-                /* Test before calling to rule out calls from proc and such
-                 * where we are not allowed to block. Note that this is
-                 * actually reliable test even without the lock - the caller
-                 * must assure that nobody can come after the DQUOT_DROP and
-                 * add quota pointers back anyway */
-                for (cnt = 0; cnt < MAXQUOTAS; cnt++)
-                        if (inode->i_dquot[cnt])
-                                break;
-                if (cnt < MAXQUOTAS)
-                        inode->i_sb->dq_op->drop(inode);
-        }
-}
-EXPORT_SYMBOL(vfs_dq_drop);
+void dquot_drop(struct inode *inode)
+{
+        int cnt;
+
+        if (IS_NOQUOTA(inode))
+                return;
+
+        /*
+         * Test before calling to rule out calls from proc and such
+         * where we are not allowed to block. Note that this is
+         * actually reliable test even without the lock - the caller
+         * must assure that nobody can come after the DQUOT_DROP and
+         * add quota pointers back anyway.
+         */
+        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+                if (inode->i_dquot[cnt])
+                        break;
+        }
+
+        if (cnt < MAXQUOTAS)
+                __dquot_drop(inode);
+}
+EXPORT_SYMBOL(dquot_drop);
 
 /*
  * inode_reserved_space is managed internally by quota, and protected by
@@ -1351,32 +1421,37 @@ static qsize_t *inode_reserved_space(struct inode * inode)
         return inode->i_sb->dq_op->get_reserved_space(inode);
 }
 
-static void inode_add_rsv_space(struct inode *inode, qsize_t number)
+void inode_add_rsv_space(struct inode *inode, qsize_t number)
 {
         spin_lock(&inode->i_lock);
         *inode_reserved_space(inode) += number;
         spin_unlock(&inode->i_lock);
 }
+EXPORT_SYMBOL(inode_add_rsv_space);
 
-
-static void inode_claim_rsv_space(struct inode *inode, qsize_t number)
+void inode_claim_rsv_space(struct inode *inode, qsize_t number)
 {
         spin_lock(&inode->i_lock);
         *inode_reserved_space(inode) -= number;
         __inode_add_bytes(inode, number);
         spin_unlock(&inode->i_lock);
 }
+EXPORT_SYMBOL(inode_claim_rsv_space);
 
-static void inode_sub_rsv_space(struct inode *inode, qsize_t number)
+void inode_sub_rsv_space(struct inode *inode, qsize_t number)
 {
         spin_lock(&inode->i_lock);
         *inode_reserved_space(inode) -= number;
         spin_unlock(&inode->i_lock);
 }
+EXPORT_SYMBOL(inode_sub_rsv_space);
 
 static qsize_t inode_get_rsv_space(struct inode *inode)
 {
         qsize_t ret;
+
+        if (!inode->i_sb->dq_op->get_reserved_space)
+                return 0;
         spin_lock(&inode->i_lock);
         ret = *inode_reserved_space(inode);
         spin_unlock(&inode->i_lock);
@@ -1401,38 +1476,34 @@ static void inode_decr_space(struct inode *inode, qsize_t number, int reserve)
 }
 
 /*
- * Following four functions update i_blocks+i_bytes fields and
- * quota information (together with appropriate checks)
- * NOTE: We absolutely rely on the fact that caller dirties
- * the inode (usually macros in quotaops.h care about this) and
- * holds a handle for the current transaction so that dquot write and
- * inode write go into the same transaction.
+ * This functions updates i_blocks+i_bytes fields and quota information
+ * (together with appropriate checks).
+ *
+ * NOTE: We absolutely rely on the fact that caller dirties the inode
+ * (usually helpers in quotaops.h care about this) and holds a handle for
+ * the current transaction so that dquot write and inode write go into the
+ * same transaction.
  */
 
 /*
  * This operation can block, but only after everything is updated
  */
 int __dquot_alloc_space(struct inode *inode, qsize_t number,
-                        int warn, int reserve)
+                int warn, int reserve)
 {
-        int cnt, ret = QUOTA_OK;
+        int cnt, ret = 0;
         char warntype[MAXQUOTAS];
 
         /*
          * First test before acquiring mutex - solves deadlocks when we
          * re-enter the quota code and are already holding the mutex
          */
-        if (IS_NOQUOTA(inode)) {
+        if (!sb_any_quota_active(inode->i_sb) || IS_NOQUOTA(inode)) {
                 inode_incr_space(inode, number, reserve);
                 goto out;
         }
 
         down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        if (IS_NOQUOTA(inode)) {
-                inode_incr_space(inode, number, reserve);
-                goto out_unlock;
-        }
-
         for (cnt = 0; cnt < MAXQUOTAS; cnt++)
                 warntype[cnt] = QUOTA_NL_NOWARN;
 
@@ -1440,9 +1511,9 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number,
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 if (!inode->i_dquot[cnt])
                         continue;
-                if (check_bdq(inode->i_dquot[cnt], number, warn, warntype+cnt)
-                    == NO_QUOTA) {
-                        ret = NO_QUOTA;
+                ret = check_bdq(inode->i_dquot[cnt], number, !warn,
+                                warntype+cnt);
+                if (ret) {
                         spin_unlock(&dq_data_lock);
                         goto out_flush_warn;
                 }
@@ -1463,61 +1534,45 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number,
         mark_all_dquot_dirty(inode->i_dquot);
 out_flush_warn:
         flush_warnings(inode->i_dquot, warntype);
-out_unlock:
         up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
 out:
         return ret;
 }
-
-int dquot_alloc_space(struct inode *inode, qsize_t number, int warn)
-{
-        return __dquot_alloc_space(inode, number, warn, 0);
-}
-EXPORT_SYMBOL(dquot_alloc_space);
-
-int dquot_reserve_space(struct inode *inode, qsize_t number, int warn)
-{
-        return __dquot_alloc_space(inode, number, warn, 1);
-}
-EXPORT_SYMBOL(dquot_reserve_space);
+EXPORT_SYMBOL(__dquot_alloc_space);
 
 /*
  * This operation can block, but only after everything is updated
  */
-int dquot_alloc_inode(const struct inode *inode, qsize_t number)
+int dquot_alloc_inode(const struct inode *inode)
 {
-        int cnt, ret = NO_QUOTA;
+        int cnt, ret = 0;
         char warntype[MAXQUOTAS];
 
         /* First test before acquiring mutex - solves deadlocks when we
          * re-enter the quota code and are already holding the mutex */
-        if (IS_NOQUOTA(inode))
-                return QUOTA_OK;
+        if (!sb_any_quota_active(inode->i_sb) || IS_NOQUOTA(inode))
+                return 0;
         for (cnt = 0; cnt < MAXQUOTAS; cnt++)
                 warntype[cnt] = QUOTA_NL_NOWARN;
         down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        if (IS_NOQUOTA(inode)) {
-                up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-                return QUOTA_OK;
-        }
         spin_lock(&dq_data_lock);
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 if (!inode->i_dquot[cnt])
                         continue;
-                if (check_idq(inode->i_dquot[cnt], number, warntype+cnt)
-                    == NO_QUOTA)
+                ret = check_idq(inode->i_dquot[cnt], 1, warntype + cnt);
+                if (ret)
                         goto warn_put_all;
         }
 
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 if (!inode->i_dquot[cnt])
                         continue;
-                dquot_incr_inodes(inode->i_dquot[cnt], number);
+                dquot_incr_inodes(inode->i_dquot[cnt], 1);
         }
-        ret = QUOTA_OK;
+
 warn_put_all:
         spin_unlock(&dq_data_lock);
-        if (ret == QUOTA_OK)
+        if (ret == 0)
                 mark_all_dquot_dirty(inode->i_dquot);
         flush_warnings(inode->i_dquot, warntype);
         up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
@@ -1525,23 +1580,19 @@ warn_put_all:
 }
 EXPORT_SYMBOL(dquot_alloc_inode);
 
-int dquot_claim_space(struct inode *inode, qsize_t number)
+/*
+ * Convert in-memory reserved quotas to real consumed quotas
+ */
+int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
 {
         int cnt;
-        int ret = QUOTA_OK;
 
-        if (IS_NOQUOTA(inode)) {
+        if (!sb_any_quota_active(inode->i_sb) || IS_NOQUOTA(inode)) {
                 inode_claim_rsv_space(inode, number);
-                goto out;
+                return 0;
         }
 
         down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        if (IS_NOQUOTA(inode))  {
-                up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-                inode_claim_rsv_space(inode, number);
-                goto out;
-        }
-
         spin_lock(&dq_data_lock);
         /* Claim reserved quotas to allocated quotas */
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
@@ -1554,33 +1605,26 @@ int dquot_claim_space(struct inode *inode, qsize_t number)
         spin_unlock(&dq_data_lock);
         mark_all_dquot_dirty(inode->i_dquot);
         up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-out:
-        return ret;
+        return 0;
 }
-EXPORT_SYMBOL(dquot_claim_space);
+EXPORT_SYMBOL(dquot_claim_space_nodirty);
 
 /*
  * This operation can block, but only after everything is updated
  */
-int __dquot_free_space(struct inode *inode, qsize_t number, int reserve)
+void __dquot_free_space(struct inode *inode, qsize_t number, int reserve)
 {
         unsigned int cnt;
         char warntype[MAXQUOTAS];
 
         /* First test before acquiring mutex - solves deadlocks when we
          * re-enter the quota code and are already holding the mutex */
-        if (IS_NOQUOTA(inode)) {
-out_sub:
+        if (!sb_any_quota_active(inode->i_sb) || IS_NOQUOTA(inode)) {
                 inode_decr_space(inode, number, reserve);
-                return QUOTA_OK;
+                return;
         }
 
         down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        /* Now recheck reliably when holding dqptr_sem */
-        if (IS_NOQUOTA(inode)) {
-                up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-                goto out_sub;
-        }
         spin_lock(&dq_data_lock);
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 if (!inode->i_dquot[cnt])
@@ -1600,56 +1644,34 @@ out_sub:
 out_unlock:
         flush_warnings(inode->i_dquot, warntype);
         up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        return QUOTA_OK;
-}
-
-int dquot_free_space(struct inode *inode, qsize_t number)
-{
-        return  __dquot_free_space(inode, number, 0);
-}
-EXPORT_SYMBOL(dquot_free_space);
-
-/*
- * Release reserved quota space
- */
-void dquot_release_reserved_space(struct inode *inode, qsize_t number)
-{
-        __dquot_free_space(inode, number, 1);
-
 }
-EXPORT_SYMBOL(dquot_release_reserved_space);
+EXPORT_SYMBOL(__dquot_free_space);
 
 /*
  * This operation can block, but only after everything is updated
  */
-int dquot_free_inode(const struct inode *inode, qsize_t number)
+void dquot_free_inode(const struct inode *inode)
 {
         unsigned int cnt;
         char warntype[MAXQUOTAS];
 
         /* First test before acquiring mutex - solves deadlocks when we
          * re-enter the quota code and are already holding the mutex */
-        if (IS_NOQUOTA(inode))
-                return QUOTA_OK;
+        if (!sb_any_quota_active(inode->i_sb) || IS_NOQUOTA(inode))
+                return;
 
         down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        /* Now recheck reliably when holding dqptr_sem */
-        if (IS_NOQUOTA(inode)) {
-                up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-                return QUOTA_OK;
-        }
         spin_lock(&dq_data_lock);
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 if (!inode->i_dquot[cnt])
                         continue;
-                warntype[cnt] = info_idq_free(inode->i_dquot[cnt], number);
-                dquot_decr_inodes(inode->i_dquot[cnt], number);
+                warntype[cnt] = info_idq_free(inode->i_dquot[cnt], 1);
+                dquot_decr_inodes(inode->i_dquot[cnt], 1);
         }
         spin_unlock(&dq_data_lock);
         mark_all_dquot_dirty(inode->i_dquot);
         flush_warnings(inode->i_dquot, warntype);
         up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        return QUOTA_OK;
 }
 EXPORT_SYMBOL(dquot_free_inode);
 
@@ -1659,37 +1681,31 @@ EXPORT_SYMBOL(dquot_free_inode);
  * This operation can block, but only after everything is updated
  * A transaction must be started when entering this function.
  */
-int dquot_transfer(struct inode *inode, struct iattr *iattr)
+static int __dquot_transfer(struct inode *inode, qid_t *chid, unsigned long mask)
 {
         qsize_t space, cur_space;
         qsize_t rsv_space = 0;
         struct dquot *transfer_from[MAXQUOTAS];
         struct dquot *transfer_to[MAXQUOTAS];
-        int cnt, ret = QUOTA_OK;
-        int chuid = iattr->ia_valid & ATTR_UID && inode->i_uid != iattr->ia_uid,
-            chgid = iattr->ia_valid & ATTR_GID && inode->i_gid != iattr->ia_gid;
+        int cnt, ret = 0;
         char warntype_to[MAXQUOTAS];
         char warntype_from_inodes[MAXQUOTAS], warntype_from_space[MAXQUOTAS];
 
         /* First test before acquiring mutex - solves deadlocks when we
          * re-enter the quota code and are already holding the mutex */
         if (IS_NOQUOTA(inode))
-                return QUOTA_OK;
+                return 0;
         /* Initialize the arrays */
         for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
                 transfer_from[cnt] = NULL;
                 transfer_to[cnt] = NULL;
                 warntype_to[cnt] = QUOTA_NL_NOWARN;
         }
-        if (chuid)
-                transfer_to[USRQUOTA] = dqget(inode->i_sb, iattr->ia_uid,
-                                              USRQUOTA);
-        if (chgid)
-                transfer_to[GRPQUOTA] = dqget(inode->i_sb, iattr->ia_gid,
-                                              GRPQUOTA);
-
+        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+                if (mask & (1 << cnt))
+                        transfer_to[cnt] = dqget(inode->i_sb, chid[cnt], cnt);
+        }
         down_write(&sb_dqopt(inode->i_sb)->dqptr_sem);
-        /* Now recheck reliably when holding dqptr_sem */
         if (IS_NOQUOTA(inode)) {        /* File without quota accounting? */
                 up_write(&sb_dqopt(inode->i_sb)->dqptr_sem);
                 goto put_all;
@@ -1703,9 +1719,11 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr)
                 if (!transfer_to[cnt])
                         continue;
                 transfer_from[cnt] = inode->i_dquot[cnt];
-                if (check_idq(transfer_to[cnt], 1, warntype_to + cnt) ==
-                    NO_QUOTA || check_bdq(transfer_to[cnt], space, 0,
-                    warntype_to + cnt) == NO_QUOTA)
+                ret = check_idq(transfer_to[cnt], 1, warntype_to + cnt);
+                if (ret)
+                        goto over_quota;
+                ret = check_bdq(transfer_to[cnt], space, 0, warntype_to + cnt);
+                if (ret)
                         goto over_quota;
         }
 
@@ -1759,22 +1777,32 @@ over_quota:
         /* Clear dquot pointers we don't want to dqput() */
         for (cnt = 0; cnt < MAXQUOTAS; cnt++)
                 transfer_from[cnt] = NULL;
-        ret = NO_QUOTA;
         goto warn_put_all;
 }
-EXPORT_SYMBOL(dquot_transfer);
 
-/* Wrapper for transferring ownership of an inode */
-int vfs_dq_transfer(struct inode *inode, struct iattr *iattr)
+/* Wrapper for transferring ownership of an inode for uid/gid only
+ * Called from FSXXX_setattr()
+ */
+int dquot_transfer(struct inode *inode, struct iattr *iattr)
 {
+        qid_t chid[MAXQUOTAS];
+        unsigned long mask = 0;
+
+        if (iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) {
+                mask |= 1 << USRQUOTA;
+                chid[USRQUOTA] = iattr->ia_uid;
+        }
+        if (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid) {
+                mask |= 1 << GRPQUOTA;
+                chid[GRPQUOTA] = iattr->ia_gid;
+        }
         if (sb_any_quota_active(inode->i_sb) && !IS_NOQUOTA(inode)) {
-                vfs_dq_init(inode);
-                if (inode->i_sb->dq_op->transfer(inode, iattr) == NO_QUOTA)
-                        return 1;
+                dquot_initialize(inode);
+                return __dquot_transfer(inode, chid, mask);
         }
         return 0;
 }
-EXPORT_SYMBOL(vfs_dq_transfer);
+EXPORT_SYMBOL(dquot_transfer);
 
 /*
  * Write info of quota file to disk
@@ -1795,13 +1823,6 @@ EXPORT_SYMBOL(dquot_commit_info);
  * Definitions of diskquota operations.
  */
 const struct dquot_operations dquot_operations = {
-        .initialize     = dquot_initialize,
-        .drop           = dquot_drop,
-        .alloc_space    = dquot_alloc_space,
-        .alloc_inode    = dquot_alloc_inode,
-        .free_space     = dquot_free_space,
-        .free_inode     = dquot_free_inode,
-        .transfer       = dquot_transfer,
         .write_dquot    = dquot_commit,
         .acquire_dquot  = dquot_acquire,
         .release_dquot  = dquot_release,
@@ -1812,6 +1833,20 @@ const struct dquot_operations dquot_operations = {
 };
 
 /*
+ * Generic helper for ->open on filesystems supporting disk quotas.
+ */
+int dquot_file_open(struct inode *inode, struct file *file)
+{
+        int error;
+
+        error = generic_file_open(inode, file);
+        if (!error && (file->f_mode & FMODE_WRITE))
+                dquot_initialize(inode);
+        return error;
+}
+EXPORT_SYMBOL(dquot_file_open);
+
+/*
  * Turn quota off on a device. type == -1 ==> quotaoff for all types (umount)
  */
 int vfs_quota_disable(struct super_block *sb, int type, unsigned int flags)
@@ -1990,11 +2025,13 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
         }
 
         if (!(dqopt->flags & DQUOT_QUOTA_SYS_FILE)) {
-                /* As we bypass the pagecache we must now flush the inode so
-                 * that we see all the changes from userspace... */
-                write_inode_now(inode, 1);
-                /* And now flush the block cache so that kernel sees the
-                 * changes */
+                /* As we bypass the pagecache we must now flush all the
+                 * dirty data and invalidate caches so that kernel sees
+                 * changes from userspace. It is not enough to just flush
+                 * the quota file since if blocksize < pagesize, invalidation
+                 * of the cache could fail because of other unrelated dirty
+                 * data */
+                sync_filesystem(sb);
                 invalidate_bdev(sb->s_bdev);
         }
         mutex_lock(&dqopt->dqonoff_mutex);
@@ -2007,14 +2044,16 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id,
                 /* We don't want quota and atime on quota files (deadlocks
                  * possible) Also nobody should write to the file - we use
                  * special IO operations which ignore the immutable bit. */
-                down_write(&dqopt->dqptr_sem);
                 mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
                 oldflags = inode->i_flags & (S_NOATIME | S_IMMUTABLE |
                                              S_NOQUOTA);
                 inode->i_flags |= S_NOQUOTA | S_NOATIME | S_IMMUTABLE;
                 mutex_unlock(&inode->i_mutex);
-                up_write(&dqopt->dqptr_sem);
-                sb->dq_op->drop(inode);
+                /*
+                 * When S_NOQUOTA is set, remove dquot references as no more
+                 * references can be added
+                 */
+                __dquot_drop(inode);
         }
 
         error = -EIO;
@@ -2050,14 +2089,12 @@ out_file_init:
         iput(inode);
 out_lock:
         if (oldflags != -1) {
-                down_write(&dqopt->dqptr_sem);
                 mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
                 /* Set the flags back (in the case of accidental quotaon()
                  * on a wrong file we don't want to mess up the flags) */
                 inode->i_flags &= ~(S_NOATIME | S_NOQUOTA | S_IMMUTABLE);
                 inode->i_flags |= oldflags;
                 mutex_unlock(&inode->i_mutex);
-                up_write(&dqopt->dqptr_sem);
         }
         mutex_unlock(&dqopt->dqonoff_mutex);
 out_fmt:
@@ -2289,34 +2326,34 @@ static int do_set_dqblk(struct dquot *dquot, struct if_dqblk *di)
         if (di->dqb_valid & QIF_SPACE) {
                 dm->dqb_curspace = di->dqb_curspace - dm->dqb_rsvspace;
                 check_blim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_BLIMITS) {
                 dm->dqb_bsoftlimit = qbtos(di->dqb_bsoftlimit);
                 dm->dqb_bhardlimit = qbtos(di->dqb_bhardlimit);
                 check_blim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_INODES) {
                 dm->dqb_curinodes = di->dqb_curinodes;
                 check_ilim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_ILIMITS) {
                 dm->dqb_isoftlimit = di->dqb_isoftlimit;
                 dm->dqb_ihardlimit = di->dqb_ihardlimit;
                 check_ilim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_BTIME) {
                 dm->dqb_btime = di->dqb_btime;
                 check_blim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_ITIME) {
                 dm->dqb_itime = di->dqb_itime;
                 check_ilim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
         }
 
         if (check_blim) {
diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
new file mode 100644
index 000000000000..d67908b407d9
--- /dev/null
+++ b/fs/quota/netlink.c
@@ -0,0 +1,96 @@
+
+#include <linux/cred.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/quotaops.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <net/netlink.h>
+#include <net/genetlink.h>
+
+/* Netlink family structure for quota */
+static struct genl_family quota_genl_family = {
+        .id = GENL_ID_GENERATE,
+        .hdrsize = 0,
+        .name = "VFS_DQUOT",
+        .version = 1,
+        .maxattr = QUOTA_NL_A_MAX,
+};
+
+/**
+ * quota_send_warning - Send warning to userspace about exceeded quota
+ * @type: The quota type: USRQQUOTA, GRPQUOTA,...
+ * @id: The user or group id of the quota that was exceeded
+ * @dev: The device on which the fs is mounted (sb->s_dev)
+ * @warntype: The type of the warning: QUOTA_NL_...
+ *
+ * This can be used by filesystems (including those which don't use
+ * dquot) to send a message to userspace relating to quota limits.
+ *
+ */
+
+void quota_send_warning(short type, unsigned int id, dev_t dev,
+                        const char warntype)
+{
+        static atomic_t seq;
+        struct sk_buff *skb;
+        void *msg_head;
+        int ret;
+        int msg_size = 4 * nla_total_size(sizeof(u32)) +
+                       2 * nla_total_size(sizeof(u64));
+
+        /* We have to allocate using GFP_NOFS as we are called from a
+         * filesystem performing write and thus further recursion into
+         * the fs to free some data could cause deadlocks. */
+        skb = genlmsg_new(msg_size, GFP_NOFS);
+        if (!skb) {
+                printk(KERN_ERR
+                  "VFS: Not enough memory to send quota warning.\n");
+                return;
+        }
+        msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
+                        &quota_genl_family, 0, QUOTA_NL_C_WARNING);
+        if (!msg_head) {
+                printk(KERN_ERR
+                  "VFS: Cannot store netlink header in quota warning.\n");
+                goto err_out;
+        }
+        ret = nla_put_u32(skb, QUOTA_NL_A_QTYPE, type);
+        if (ret)
+                goto attr_err_out;
+        ret = nla_put_u64(skb, QUOTA_NL_A_EXCESS_ID, id);
+        if (ret)
+                goto attr_err_out;
+        ret = nla_put_u32(skb, QUOTA_NL_A_WARNING, warntype);
+        if (ret)
+                goto attr_err_out;
+        ret = nla_put_u32(skb, QUOTA_NL_A_DEV_MAJOR, MAJOR(dev));
+        if (ret)
+                goto attr_err_out;
+        ret = nla_put_u32(skb, QUOTA_NL_A_DEV_MINOR, MINOR(dev));
+        if (ret)
+                goto attr_err_out;
+        ret = nla_put_u64(skb, QUOTA_NL_A_CAUSED_ID, current_uid());
+        if (ret)
+                goto attr_err_out;
+        genlmsg_end(skb, msg_head);
+
+        genlmsg_multicast(skb, 0, quota_genl_family.id, GFP_NOFS);
+        return;
+attr_err_out:
+        printk(KERN_ERR "VFS: Not enough space to compose quota message!\n");
+err_out:
+        kfree_skb(skb);
+}
+EXPORT_SYMBOL(quota_send_warning);
+
+static int __init quota_init(void)
+{
+        if (genl_register_family(&quota_genl_family) != 0)
+                printk(KERN_ERR
+                       "VFS: Failed to create quota netlink interface.\n");
+        return 0;
+};
+
+module_init(quota_init);
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index ee91e2756950..95388f9b7356 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -10,7 +10,6 @@
 #include <linux/slab.h>
 #include <asm/current.h>
 #include <asm/uaccess.h>
-#include <linux/compat.h>
 #include <linux/kernel.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
@@ -18,220 +17,205 @@
 #include <linux/capability.h>
 #include <linux/quotaops.h>
 #include <linux/types.h>
-#include <net/netlink.h>
-#include <net/genetlink.h>
+#include <linux/writeback.h>
 
-/* Check validity of generic quotactl commands */
-static int generic_quotactl_valid(struct super_block *sb, int type, int cmd,
-                                  qid_t id)
+static int check_quotactl_permission(struct super_block *sb, int type, int cmd,
+                                     qid_t id)
 {
-        if (type >= MAXQUOTAS)
-                return -EINVAL;
-        if (!sb && cmd != Q_SYNC)
-                return -ENODEV;
-        /* Is operation supported? */
-        if (sb && !sb->s_qcop)
-                return -ENOSYS;
-
         switch (cmd) {
-                case Q_GETFMT:
-                        break;
-                case Q_QUOTAON:
-                        if (!sb->s_qcop->quota_on)
-                                return -ENOSYS;
-                        break;
-                case Q_QUOTAOFF:
-                        if (!sb->s_qcop->quota_off)
-                                return -ENOSYS;
-                        break;
-                case Q_SETINFO:
-                        if (!sb->s_qcop->set_info)
-                                return -ENOSYS;
-                        break;
-                case Q_GETINFO:
-                        if (!sb->s_qcop->get_info)
-                                return -ENOSYS;
-                        break;
-                case Q_SETQUOTA:
-                        if (!sb->s_qcop->set_dqblk)
-                                return -ENOSYS;
-                        break;
-                case Q_GETQUOTA:
-                        if (!sb->s_qcop->get_dqblk)
-                                return -ENOSYS;
-                        break;
-                case Q_SYNC:
-                        if (sb && !sb->s_qcop->quota_sync)
-                                return -ENOSYS;
+        /* these commands do not require any special privilegues */
+        case Q_GETFMT:
+        case Q_SYNC:
+        case Q_GETINFO:
+        case Q_XGETQSTAT:
+        case Q_XQUOTASYNC:
+                break;
+        /* allow to query information for dquots we "own" */
+        case Q_GETQUOTA:
+        case Q_XGETQUOTA:
+                if ((type == USRQUOTA && current_euid() == id) ||
+                    (type == GRPQUOTA && in_egroup_p(id)))
                         break;
-                default:
-                        return -EINVAL;
+                /*FALLTHROUGH*/
+        default:
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
         }
 
-        /* Is quota turned on for commands which need it? */
-        switch (cmd) {
-                case Q_GETFMT:
-                case Q_GETINFO:
-                case Q_SETINFO:
-                case Q_SETQUOTA:
-                case Q_GETQUOTA:
-                        /* This is just an informative test so we are satisfied
-                         * without the lock */
-                        if (!sb_has_quota_active(sb, type))
-                                return -ESRCH;
-        }
+        return security_quotactl(cmd, type, id, sb);
+}
 
-        /* Check privileges */
-        if (cmd == Q_GETQUOTA) {
-                if (((type == USRQUOTA && current_euid() != id) ||
-                     (type == GRPQUOTA && !in_egroup_p(id))) &&
-                    !capable(CAP_SYS_ADMIN))
-                        return -EPERM;
+static int quota_sync_all(int type)
+{
+        struct super_block *sb;
+        int ret;
+
+        if (type >= MAXQUOTAS)
+                return -EINVAL;
+        ret = security_quotactl(Q_SYNC, type, 0, NULL);
+        if (ret)
+                return ret;
+
+        spin_lock(&sb_lock);
+restart:
+        list_for_each_entry(sb, &super_blocks, s_list) {
+                if (!sb->s_qcop || !sb->s_qcop->quota_sync)
+                        continue;
+
+                sb->s_count++;
+                spin_unlock(&sb_lock);
+                down_read(&sb->s_umount);
+                if (sb->s_root)
+                        sb->s_qcop->quota_sync(sb, type, 1);
+                up_read(&sb->s_umount);
+                spin_lock(&sb_lock);
+                if (__put_super_and_need_restart(sb))
+                        goto restart;
         }
-        else if (cmd != Q_GETFMT && cmd != Q_SYNC && cmd != Q_GETINFO)
-                if (!capable(CAP_SYS_ADMIN))
-                        return -EPERM;
+        spin_unlock(&sb_lock);
 
         return 0;
 }
 
-/* Check validity of XFS Quota Manager commands */
-static int xqm_quotactl_valid(struct super_block *sb, int type, int cmd,
-                              qid_t id)
+static int quota_quotaon(struct super_block *sb, int type, int cmd, qid_t id,
+                         void __user *addr)
 {
-        if (type >= XQM_MAXQUOTAS)
-                return -EINVAL;
-        if (!sb)
-                return -ENODEV;
-        if (!sb->s_qcop)
-                return -ENOSYS;
+        char *pathname;
+        int ret = -ENOSYS;
+
+        pathname = getname(addr);
+        if (IS_ERR(pathname))
+                return PTR_ERR(pathname);
+        if (sb->s_qcop->quota_on)
+                ret = sb->s_qcop->quota_on(sb, type, id, pathname, 0);
+        putname(pathname);
+        return ret;
+}
 
-        switch (cmd) {
-                case Q_XQUOTAON:
-                case Q_XQUOTAOFF:
-                case Q_XQUOTARM:
-                        if (!sb->s_qcop->set_xstate)
-                                return -ENOSYS;
-                        break;
-                case Q_XGETQSTAT:
-                        if (!sb->s_qcop->get_xstate)
-                                return -ENOSYS;
-                        break;
-                case Q_XSETQLIM:
-                        if (!sb->s_qcop->set_xquota)
-                                return -ENOSYS;
-                        break;
-                case Q_XGETQUOTA:
-                        if (!sb->s_qcop->get_xquota)
-                                return -ENOSYS;
-                        break;
-                case Q_XQUOTASYNC:
-                        if (!sb->s_qcop->quota_sync)
-                                return -ENOSYS;
-                        break;
-                default:
-                        return -EINVAL;
-        }
+static int quota_getfmt(struct super_block *sb, int type, void __user *addr)
+{
+        __u32 fmt;
 
-        /* Check privileges */
-        if (cmd == Q_XGETQUOTA) {
-                if (((type == XQM_USRQUOTA && current_euid() != id) ||
-                     (type == XQM_GRPQUOTA && !in_egroup_p(id))) &&
-                     !capable(CAP_SYS_ADMIN))
-                        return -EPERM;
-        } else if (cmd != Q_XGETQSTAT && cmd != Q_XQUOTASYNC) {
-                if (!capable(CAP_SYS_ADMIN))
-                        return -EPERM;
+        down_read(&sb_dqopt(sb)->dqptr_sem);
+        if (!sb_has_quota_active(sb, type)) {
+                up_read(&sb_dqopt(sb)->dqptr_sem);
+                return -ESRCH;
         }
+        fmt = sb_dqopt(sb)->info[type].dqi_format->qf_fmt_id;
+        up_read(&sb_dqopt(sb)->dqptr_sem);
+        if (copy_to_user(addr, &fmt, sizeof(fmt)))
+                return -EFAULT;
+        return 0;
+}
 
+static int quota_getinfo(struct super_block *sb, int type, void __user *addr)
+{
+        struct if_dqinfo info;
+        int ret;
+
+        if (!sb_has_quota_active(sb, type))
+                return -ESRCH;
+        if (!sb->s_qcop->get_info)
+                return -ENOSYS;
+        ret = sb->s_qcop->get_info(sb, type, &info);
+        if (!ret && copy_to_user(addr, &info, sizeof(info)))
+                return -EFAULT;
+        return ret;
+}
+
+static int quota_setinfo(struct super_block *sb, int type, void __user *addr)
+{
+        struct if_dqinfo info;
+
+        if (copy_from_user(&info, addr, sizeof(info)))
+                return -EFAULT;
+        if (!sb_has_quota_active(sb, type))
+                return -ESRCH;
+        if (!sb->s_qcop->set_info)
+                return -ENOSYS;
+        return sb->s_qcop->set_info(sb, type, &info);
+}
+
+static int quota_getquota(struct super_block *sb, int type, qid_t id,
+                          void __user *addr)
+{
+        struct if_dqblk idq;
+        int ret;
+
+        if (!sb_has_quota_active(sb, type))
+                return -ESRCH;
+        if (!sb->s_qcop->get_dqblk)
+                return -ENOSYS;
+        ret = sb->s_qcop->get_dqblk(sb, type, id, &idq);
+        if (ret)
+                return ret;
+        if (copy_to_user(addr, &idq, sizeof(idq)))
+                return -EFAULT;
         return 0;
 }
 
-static int check_quotactl_valid(struct super_block *sb, int type, int cmd,
-                                qid_t id)
+static int quota_setquota(struct super_block *sb, int type, qid_t id,
+                          void __user *addr)
 {
-        int error;
-
-        if (XQM_COMMAND(cmd))
-                error = xqm_quotactl_valid(sb, type, cmd, id);
-        else
-                error = generic_quotactl_valid(sb, type, cmd, id);
-        if (!error)
-                error = security_quotactl(cmd, type, id, sb);
-        return error;
+        struct if_dqblk idq;
+
+        if (copy_from_user(&idq, addr, sizeof(idq)))
+                return -EFAULT;
+        if (!sb_has_quota_active(sb, type))
+                return -ESRCH;
+        if (!sb->s_qcop->set_dqblk)
+                return -ENOSYS;
+        return sb->s_qcop->set_dqblk(sb, type, id, &idq);
 }
 
-#ifdef CONFIG_QUOTA
-void sync_quota_sb(struct super_block *sb, int type)
+static int quota_setxstate(struct super_block *sb, int cmd, void __user *addr)
 {
-        int cnt;
+        __u32 flags;
 
-        if (!sb->s_qcop->quota_sync)
-                return;
+        if (copy_from_user(&flags, addr, sizeof(flags)))
+                return -EFAULT;
+        if (!sb->s_qcop->set_xstate)
+                return -ENOSYS;
+        return sb->s_qcop->set_xstate(sb, flags, cmd);
+}
 
-        sb->s_qcop->quota_sync(sb, type);
+static int quota_getxstate(struct super_block *sb, void __user *addr)
+{
+        struct fs_quota_stat fqs;
+        int ret;
 
-        if (sb_dqopt(sb)->flags & DQUOT_QUOTA_SYS_FILE)
-                return;
-        /* This is not very clever (and fast) but currently I don't know about
-         * any other simple way of getting quota data to disk and we must get
-         * them there for userspace to be visible... */
-        if (sb->s_op->sync_fs)
-                sb->s_op->sync_fs(sb, 1);
-        sync_blockdev(sb->s_bdev);
+        if (!sb->s_qcop->get_xstate)
+                return -ENOSYS;
+        ret = sb->s_qcop->get_xstate(sb, &fqs);
+        if (!ret && copy_to_user(addr, &fqs, sizeof(fqs)))
+                return -EFAULT;
+        return ret;
+}
 
-        /*
-         * Now when everything is written we can discard the pagecache so
-         * that userspace sees the changes.
-         */
-        mutex_lock(&sb_dqopt(sb)->dqonoff_mutex);
-        for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-                if (type != -1 && cnt != type)
-                        continue;
-                if (!sb_has_quota_active(sb, cnt))
-                        continue;
-                mutex_lock_nested(&sb_dqopt(sb)->files[cnt]->i_mutex,
-                                  I_MUTEX_QUOTA);
-                truncate_inode_pages(&sb_dqopt(sb)->files[cnt]->i_data, 0);
-                mutex_unlock(&sb_dqopt(sb)->files[cnt]->i_mutex);
-        }
-        mutex_unlock(&sb_dqopt(sb)->dqonoff_mutex);
+static int quota_setxquota(struct super_block *sb, int type, qid_t id,
+                           void __user *addr)
+{
+        struct fs_disk_quota fdq;
+
+        if (copy_from_user(&fdq, addr, sizeof(fdq)))
+                return -EFAULT;
+        if (!sb->s_qcop->set_xquota)
+                return -ENOSYS;
+        return sb->s_qcop->set_xquota(sb, type, id, &fdq);
 }
-#endif
 
-static void sync_dquots(int type)
+static int quota_getxquota(struct super_block *sb, int type, qid_t id,
+                           void __user *addr)
 {
-        struct super_block *sb;
-        int cnt;
+        struct fs_disk_quota fdq;
+        int ret;
 
-        spin_lock(&sb_lock);
-restart:
-        list_for_each_entry(sb, &super_blocks, s_list) {
-                /* This test just improves performance so it needn't be
-                 * reliable... */
-                for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-                        if (type != -1 && type != cnt)
-                                continue;
-                        if (!sb_has_quota_active(sb, cnt))
-                                continue;
-                        if (!info_dirty(&sb_dqopt(sb)->info[cnt]) &&
-                           list_empty(&sb_dqopt(sb)->info[cnt].dqi_dirty_list))
-                                continue;
-                        break;
-                }
-                if (cnt == MAXQUOTAS)
-                        continue;
-                sb->s_count++;
-                spin_unlock(&sb_lock);
-                down_read(&sb->s_umount);
-                if (sb->s_root)
-                        sync_quota_sb(sb, type);
-                up_read(&sb->s_umount);
-                spin_lock(&sb_lock);
-                if (__put_super_and_need_restart(sb))
-                        goto restart;
-        }
-        spin_unlock(&sb_lock);
+        if (!sb->s_qcop->get_xquota)
+                return -ENOSYS;
+        ret = sb->s_qcop->get_xquota(sb, type, id, &fdq);
+        if (!ret && copy_to_user(addr, &fdq, sizeof(fdq)))
+                return -EFAULT;
+        return ret;
 }
 
 /* Copy parameters and call proper function */
@@ -240,117 +224,55 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
 {
         int ret;
 
+        if (type >= (XQM_COMMAND(cmd) ? XQM_MAXQUOTAS : MAXQUOTAS))
+                return -EINVAL;
+        if (!sb->s_qcop)
+                return -ENOSYS;
+
+        ret = check_quotactl_permission(sb, type, cmd, id);
+        if (ret < 0)
+                return ret;
+
         switch (cmd) {
-                case Q_QUOTAON: {
-                        char *pathname;
-
-                        pathname = getname(addr);
-                        if (IS_ERR(pathname))
-                                return PTR_ERR(pathname);
-                        ret = sb->s_qcop->quota_on(sb, type, id, pathname, 0);
-                        putname(pathname);
-                        return ret;
-                }
-                case Q_QUOTAOFF:
-                        return sb->s_qcop->quota_off(sb, type, 0);
-
-                case Q_GETFMT: {
-                        __u32 fmt;
-
-                        down_read(&sb_dqopt(sb)->dqptr_sem);
-                        if (!sb_has_quota_active(sb, type)) {
-                                up_read(&sb_dqopt(sb)->dqptr_sem);
-                                return -ESRCH;
-                        }
-                        fmt = sb_dqopt(sb)->info[type].dqi_format->qf_fmt_id;
-                        up_read(&sb_dqopt(sb)->dqptr_sem);
-                        if (copy_to_user(addr, &fmt, sizeof(fmt)))
-                                return -EFAULT;
-                        return 0;
-                }
-                case Q_GETINFO: {
-                        struct if_dqinfo info;
-
-                        ret = sb->s_qcop->get_info(sb, type, &info);
-                        if (ret)
-                                return ret;
-                        if (copy_to_user(addr, &info, sizeof(info)))
-                                return -EFAULT;
-                        return 0;
-                }
-                case Q_SETINFO: {
-                        struct if_dqinfo info;
-
-                        if (copy_from_user(&info, addr, sizeof(info)))
-                                return -EFAULT;
-                        return sb->s_qcop->set_info(sb, type, &info);
-                }
-                case Q_GETQUOTA: {
-                        struct if_dqblk idq;
-
-                        ret = sb->s_qcop->get_dqblk(sb, type, id, &idq);
-                        if (ret)
-                                return ret;
-                        if (copy_to_user(addr, &idq, sizeof(idq)))
-                                return -EFAULT;
-                        return 0;
-                }
-                case Q_SETQUOTA: {
-                        struct if_dqblk idq;
-
-                        if (copy_from_user(&idq, addr, sizeof(idq)))
-                                return -EFAULT;
-                        return sb->s_qcop->set_dqblk(sb, type, id, &idq);
-                }
-                case Q_SYNC:
-                        if (sb)
-                                sync_quota_sb(sb, type);
-                        else
-                                sync_dquots(type);
-                        return 0;
-
-                case Q_XQUOTAON:
-                case Q_XQUOTAOFF:
-                case Q_XQUOTARM: {
-                        __u32 flags;
-
-                        if (copy_from_user(&flags, addr, sizeof(flags)))
-                                return -EFAULT;
-                        return sb->s_qcop->set_xstate(sb, flags, cmd);
-                }
-                case Q_XGETQSTAT: {
-                        struct fs_quota_stat fqs;
-                
-                        if ((ret = sb->s_qcop->get_xstate(sb, &fqs)))
-                                return ret;
-                        if (copy_to_user(addr, &fqs, sizeof(fqs)))
-                                return -EFAULT;
-                        return 0;
-                }
-                case Q_XSETQLIM: {
-                        struct fs_disk_quota fdq;
-
-                        if (copy_from_user(&fdq, addr, sizeof(fdq)))
-                                return -EFAULT;
-                       return sb->s_qcop->set_xquota(sb, type, id, &fdq);
-                }
-                case Q_XGETQUOTA: {
-                        struct fs_disk_quota fdq;
-
-                        ret = sb->s_qcop->get_xquota(sb, type, id, &fdq);
-                        if (ret)
-                                return ret;
-                        if (copy_to_user(addr, &fdq, sizeof(fdq)))
-                                return -EFAULT;
-                        return 0;
-                }
-                case Q_XQUOTASYNC:
-                        return sb->s_qcop->quota_sync(sb, type);
-                /* We never reach here unless validity check is broken */
-                default:
-                        BUG();
+        case Q_QUOTAON:
+                return quota_quotaon(sb, type, cmd, id, addr);
+        case Q_QUOTAOFF:
+                if (!sb->s_qcop->quota_off)
+                        return -ENOSYS;
+                return sb->s_qcop->quota_off(sb, type, 0);
+        case Q_GETFMT:
+                return quota_getfmt(sb, type, addr);
+        case Q_GETINFO:
+                return quota_getinfo(sb, type, addr);
+        case Q_SETINFO:
+                return quota_setinfo(sb, type, addr);
+        case Q_GETQUOTA:
+                return quota_getquota(sb, type, id, addr);
+        case Q_SETQUOTA:
+                return quota_setquota(sb, type, id, addr);
+        case Q_SYNC:
+                if (!sb->s_qcop->quota_sync)
+                        return -ENOSYS;
+                return sb->s_qcop->quota_sync(sb, type, 1);
+        case Q_XQUOTAON:
+        case Q_XQUOTAOFF:
+        case Q_XQUOTARM:
+                return quota_setxstate(sb, cmd, addr);
+        case Q_XGETQSTAT:
+                return quota_getxstate(sb, addr);
+        case Q_XSETQLIM:
+                return quota_setxquota(sb, type, id, addr);
+        case Q_XGETQUOTA:
+                return quota_getxquota(sb, type, id, addr);
+        case Q_XQUOTASYNC:
+                /* caller already holds s_umount */
+                if (sb->s_flags & MS_RDONLY)
+                        return -EROFS;
+                writeback_inodes_sb(sb);
+                return 0;
+        default:
+                return -EINVAL;
         }
-        return 0;
 }
 
 /*
@@ -397,224 +319,23 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
         cmds = cmd >> SUBCMDSHIFT;
         type = cmd & SUBCMDMASK;
 
-        if (cmds != Q_SYNC || special) {
-                sb = quotactl_block(special);
-                if (IS_ERR(sb))
-                        return PTR_ERR(sb);
+        /*
+         * As a special case Q_SYNC can be called without a specific device.
+         * It will iterate all superblocks that have quota enabled and call
+         * the sync action on each of them.
+         */
+        if (!special) {
+                if (cmds == Q_SYNC)
+                        return quota_sync_all(type);
+                return -ENODEV;
         }
 
-        ret = check_quotactl_valid(sb, type, cmds, id);
-        if (ret >= 0)
-                ret = do_quotactl(sb, type, cmds, id, addr);
-        if (sb)
-                drop_super(sb);
+        sb = quotactl_block(special);
+        if (IS_ERR(sb))
+                return PTR_ERR(sb);
 
-        return ret;
-}
-
-#if defined(CONFIG_COMPAT_FOR_U64_ALIGNMENT)
-/*
- * This code works only for 32 bit quota tools over 64 bit OS (x86_64, ia64)
- * and is necessary due to alignment problems.
- */
-struct compat_if_dqblk {
-        compat_u64 dqb_bhardlimit;
-        compat_u64 dqb_bsoftlimit;
-        compat_u64 dqb_curspace;
-        compat_u64 dqb_ihardlimit;
-        compat_u64 dqb_isoftlimit;
-        compat_u64 dqb_curinodes;
-        compat_u64 dqb_btime;
-        compat_u64 dqb_itime;
-        compat_uint_t dqb_valid;
-};
-
-/* XFS structures */
-struct compat_fs_qfilestat {
-        compat_u64 dqb_bhardlimit;
-        compat_u64 qfs_nblks;
-        compat_uint_t qfs_nextents;
-};
-
-struct compat_fs_quota_stat {
-        __s8            qs_version;
-        __u16           qs_flags;
-        __s8            qs_pad;
-        struct compat_fs_qfilestat      qs_uquota;
-        struct compat_fs_qfilestat      qs_gquota;
-        compat_uint_t   qs_incoredqs;
-        compat_int_t    qs_btimelimit;
-        compat_int_t    qs_itimelimit;
-        compat_int_t    qs_rtbtimelimit;
-        __u16           qs_bwarnlimit;
-        __u16           qs_iwarnlimit;
-};
-
-asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,
-                                                qid_t id, void __user *addr)
-{
-        unsigned int cmds;
-        struct if_dqblk __user *dqblk;
-        struct compat_if_dqblk __user *compat_dqblk;
-        struct fs_quota_stat __user *fsqstat;
-        struct compat_fs_quota_stat __user *compat_fsqstat;
-        compat_uint_t data;
-        u16 xdata;
-        long ret;
+        ret = do_quotactl(sb, type, cmds, id, addr);
 
-        cmds = cmd >> SUBCMDSHIFT;
-
-        switch (cmds) {
-        case Q_GETQUOTA:
-                dqblk = compat_alloc_user_space(sizeof(struct if_dqblk));
-                compat_dqblk = addr;
-                ret = sys_quotactl(cmd, special, id, dqblk);
-                if (ret)
-                        break;
-                if (copy_in_user(compat_dqblk, dqblk, sizeof(*compat_dqblk)) ||
-                        get_user(data, &dqblk->dqb_valid) ||
-                        put_user(data, &compat_dqblk->dqb_valid))
-                        ret = -EFAULT;
-                break;
-        case Q_SETQUOTA:
-                dqblk = compat_alloc_user_space(sizeof(struct if_dqblk));
-                compat_dqblk = addr;
-                ret = -EFAULT;
-                if (copy_in_user(dqblk, compat_dqblk, sizeof(*compat_dqblk)) ||
-                        get_user(data, &compat_dqblk->dqb_valid) ||
-                        put_user(data, &dqblk->dqb_valid))
-                        break;
-                ret = sys_quotactl(cmd, special, id, dqblk);
-                break;
-        case Q_XGETQSTAT:
-                fsqstat = compat_alloc_user_space(sizeof(struct fs_quota_stat));
-                compat_fsqstat = addr;
-                ret = sys_quotactl(cmd, special, id, fsqstat);
-                if (ret)
-                        break;
-                ret = -EFAULT;
-                /* Copying qs_version, qs_flags, qs_pad */
-                if (copy_in_user(compat_fsqstat, fsqstat,
-                        offsetof(struct compat_fs_quota_stat, qs_uquota)))
-                        break;
-                /* Copying qs_uquota */
-                if (copy_in_user(&compat_fsqstat->qs_uquota,
-                        &fsqstat->qs_uquota,
-                        sizeof(compat_fsqstat->qs_uquota)) ||
-                        get_user(data, &fsqstat->qs_uquota.qfs_nextents) ||
-                        put_user(data, &compat_fsqstat->qs_uquota.qfs_nextents))
-                        break;
-                /* Copying qs_gquota */
-                if (copy_in_user(&compat_fsqstat->qs_gquota,
-                        &fsqstat->qs_gquota,
-                        sizeof(compat_fsqstat->qs_gquota)) ||
-                        get_user(data, &fsqstat->qs_gquota.qfs_nextents) ||
-                        put_user(data, &compat_fsqstat->qs_gquota.qfs_nextents))
-                        break;
-                /* Copying the rest */
-                if (copy_in_user(&compat_fsqstat->qs_incoredqs,
-                        &fsqstat->qs_incoredqs,
-                        sizeof(struct compat_fs_quota_stat) -
-                        offsetof(struct compat_fs_quota_stat, qs_incoredqs)) ||
-                        get_user(xdata, &fsqstat->qs_iwarnlimit) ||
-                        put_user(xdata, &compat_fsqstat->qs_iwarnlimit))
-                        break;
-                ret = 0;
-                break;
-        default:
-                ret = sys_quotactl(cmd, special, id, addr);
-        }
+        drop_super(sb);
         return ret;
 }
-#endif
-
-
-#ifdef CONFIG_QUOTA_NETLINK_INTERFACE
-
-/* Netlink family structure for quota */
-static struct genl_family quota_genl_family = {
-        .id = GENL_ID_GENERATE,
-        .hdrsize = 0,
-        .name = "VFS_DQUOT",
-        .version = 1,
-        .maxattr = QUOTA_NL_A_MAX,
-};
-
-/**
- * quota_send_warning - Send warning to userspace about exceeded quota
- * @type: The quota type: USRQQUOTA, GRPQUOTA,...
- * @id: The user or group id of the quota that was exceeded
- * @dev: The device on which the fs is mounted (sb->s_dev)
- * @warntype: The type of the warning: QUOTA_NL_...
- *
- * This can be used by filesystems (including those which don't use
- * dquot) to send a message to userspace relating to quota limits.
- *
- */
-
-void quota_send_warning(short type, unsigned int id, dev_t dev,
-                        const char warntype)
-{
-        static atomic_t seq;
-        struct sk_buff *skb;
-        void *msg_head;
-        int ret;
-        int msg_size = 4 * nla_total_size(sizeof(u32)) +
-                       2 * nla_total_size(sizeof(u64));
-
-        /* We have to allocate using GFP_NOFS as we are called from a
-         * filesystem performing write and thus further recursion into
-         * the fs to free some data could cause deadlocks. */
-        skb = genlmsg_new(msg_size, GFP_NOFS);
-        if (!skb) {
-                printk(KERN_ERR
-                  "VFS: Not enough memory to send quota warning.\n");
-                return;
-        }
-        msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
-                        &quota_genl_family, 0, QUOTA_NL_C_WARNING);
-        if (!msg_head) {
-                printk(KERN_ERR
-                  "VFS: Cannot store netlink header in quota warning.\n");
-                goto err_out;
-        }
-        ret = nla_put_u32(skb, QUOTA_NL_A_QTYPE, type);
-        if (ret)
-                goto attr_err_out;
-        ret = nla_put_u64(skb, QUOTA_NL_A_EXCESS_ID, id);
-        if (ret)
-                goto attr_err_out;
-        ret = nla_put_u32(skb, QUOTA_NL_A_WARNING, warntype);
-        if (ret)
-                goto attr_err_out;
-        ret = nla_put_u32(skb, QUOTA_NL_A_DEV_MAJOR, MAJOR(dev));
-        if (ret)
-                goto attr_err_out;
-        ret = nla_put_u32(skb, QUOTA_NL_A_DEV_MINOR, MINOR(dev));
-        if (ret)
-                goto attr_err_out;
-        ret = nla_put_u64(skb, QUOTA_NL_A_CAUSED_ID, current_uid());
-        if (ret)
-                goto attr_err_out;
-        genlmsg_end(skb, msg_head);
-
-        genlmsg_multicast(skb, 0, quota_genl_family.id, GFP_NOFS);
-        return;
-attr_err_out:
-        printk(KERN_ERR "VFS: Not enough space to compose quota message!\n");
-err_out:
-        kfree_skb(skb);
-}
-EXPORT_SYMBOL(quota_send_warning);
-
-static int __init quota_init(void)
-{
-        if (genl_register_family(&quota_genl_family) != 0)
-                printk(KERN_ERR
-                       "VFS: Failed to create quota netlink interface.\n");
-        return 0;
-};
-
-module_init(quota_init);
-#endif
-
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 2efc57173fd7..5ea4ad81a429 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -21,6 +21,7 @@
 #include <linux/pagevec.h>
 #include <linux/mman.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include "internal.h"
@@ -123,30 +124,6 @@ add_error:
 
 /*****************************************************************************/
 /*
- * check that file shrinkage doesn't leave any VMAs dangling in midair
- */
-static int ramfs_nommu_check_mappings(struct inode *inode,
-                                      size_t newsize, size_t size)
-{
-        struct vm_area_struct *vma;
-        struct prio_tree_iter iter;
-
-        /* search for VMAs that fall within the dead zone */
-        vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
-                              newsize >> PAGE_SHIFT,
-                              (size + PAGE_SIZE - 1) >> PAGE_SHIFT
-                              ) {
-                /* found one - only interested if it's shared out of the page
-                 * cache */
-                if (vma->vm_flags & VM_SHARED)
-                        return -ETXTBSY; /* not quite true, but near enough */
-        }
-
-        return 0;
-}
-
-/*****************************************************************************/
-/*
  *
  */
 static int ramfs_nommu_resize(struct inode *inode, loff_t newsize, loff_t size)
@@ -164,7 +141,7 @@ static int ramfs_nommu_resize(struct inode *inode, loff_t newsize, loff_t size)
 
         /* check that a decrease in size doesn't cut off any shared mappings */
         if (newsize < size) {
-                ret = ramfs_nommu_check_mappings(inode, newsize, size);
+                ret = nommu_shrink_inode_mappings(inode, size, newsize);
                 if (ret < 0)
                         return ret;
         }
diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c
index a6090aa1a7c1..c94853473ca9 100644
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -35,6 +35,7 @@
 #include <linux/sched.h>
 #include <linux/parser.h>
 #include <linux/magic.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
diff --git a/fs/read_write.c b/fs/read_write.c
index b7f4a1f94d48..113386d6fd2d 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -258,6 +258,7 @@ ssize_t do_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *pp
         init_sync_kiocb(&kiocb, filp);
         kiocb.ki_pos = *ppos;
         kiocb.ki_left = len;
+        kiocb.ki_nbytes = len;
 
         for (;;) {
                 ret = filp->f_op->aio_read(&kiocb, &iov, 1, kiocb.ki_pos);
@@ -313,6 +314,7 @@ ssize_t do_sync_write(struct file *filp, const char __user *buf, size_t len, lof
         init_sync_kiocb(&kiocb, filp);
         kiocb.ki_pos = *ppos;
         kiocb.ki_left = len;
+        kiocb.ki_nbytes = len;
 
         for (;;) {
                 ret = filp->f_op->aio_write(&kiocb, &iov, 1, kiocb.ki_pos);
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index 685495707181..483442e66ed6 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -169,7 +169,7 @@ static int scan_bitmap_block(struct reiserfs_transaction_handle *th,
                         return 0;       // No free blocks in this bitmap
                 }
 
-                /* search for a first zero bit -- beggining of a window */
+                /* search for a first zero bit -- beginning of a window */
                 *beg = reiserfs_find_next_zero_le_bit
                     ((unsigned long *)(bh->b_data), boundary, *beg);
 
@@ -425,7 +425,7 @@ static void _reiserfs_free_block(struct reiserfs_transaction_handle *th,
 
         journal_mark_dirty(th, s, sbh);
         if (for_unformatted)
-                vfs_dq_free_block_nodirty(inode, 1);
+                dquot_free_block_nodirty(inode, 1);
 }
 
 void reiserfs_free_block(struct reiserfs_transaction_handle *th,
@@ -1049,7 +1049,7 @@ static inline int blocknrs_and_prealloc_arrays_from_search_start
                                amount_needed, hint->inode->i_uid);
 #endif
                 quota_ret =
-                    vfs_dq_alloc_block_nodirty(hint->inode, amount_needed);
+                    dquot_alloc_block_nodirty(hint->inode, amount_needed);
                 if (quota_ret)  /* Quota exceeded? */
                         return QUOTA_EXCEEDED;
                 if (hint->preallocate && hint->prealloc_size) {
@@ -1058,7 +1058,7 @@ static inline int blocknrs_and_prealloc_arrays_from_search_start
                                        "reiserquota: allocating (prealloc) %d blocks id=%u",
                                        hint->prealloc_size, hint->inode->i_uid);
 #endif
-                        quota_ret = vfs_dq_prealloc_block_nodirty(hint->inode,
+                        quota_ret = dquot_prealloc_block_nodirty(hint->inode,
                                                          hint->prealloc_size);
                         if (quota_ret)
                                 hint->preallocate = hint->prealloc_size = 0;
@@ -1092,7 +1092,7 @@ static inline int blocknrs_and_prealloc_arrays_from_search_start
                                                hint->inode->i_uid);
 #endif
                                 /* Free not allocated blocks */
-                                vfs_dq_free_block_nodirty(hint->inode,
+                                dquot_free_block_nodirty(hint->inode,
                                         amount_needed + hint->prealloc_size -
                                         nr_allocated);
                         }
@@ -1125,7 +1125,7 @@ static inline int blocknrs_and_prealloc_arrays_from_search_start
                                REISERFS_I(hint->inode)->i_prealloc_count,
                                hint->inode->i_uid);
 #endif
-                vfs_dq_free_block_nodirty(hint->inode, amount_needed +
+                dquot_free_block_nodirty(hint->inode, amount_needed +
                                          hint->prealloc_size - nr_allocated -
                                          REISERFS_I(hint->inode)->
                                          i_prealloc_count);
@@ -1277,7 +1277,10 @@ int reiserfs_init_bitmap_cache(struct super_block *sb)
         struct reiserfs_bitmap_info *bitmap;
         unsigned int bmap_nr = reiserfs_bmap_count(sb);
 
+        /* Avoid lock recursion in fault case */
+        reiserfs_write_unlock(sb);
         bitmap = vmalloc(sizeof(*bitmap) * bmap_nr);
+        reiserfs_write_lock(sb);
         if (bitmap == NULL)
                 return -ENOMEM;
 
diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index c094f58c7448..07930449a958 100644
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -8,6 +8,7 @@
 #include <linux/reiserfs_fs.h>
 #include <linux/stat.h>
 #include <linux/buffer_head.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 extern const struct reiserfs_key MIN_KEY;
@@ -45,8 +46,6 @@ static inline bool is_privroot_deh(struct dentry *dir,
                                    struct reiserfs_de_head *deh)
 {
         struct dentry *privroot = REISERFS_SB(dir->d_sb)->priv_root;
-        if (reiserfs_expose_privroot(dir->d_sb))
-                return 0;
         return (dir == dir->d_parent && privroot->d_inode &&
                 deh->deh_objectid == INODE_PKEY(privroot->d_inode)->k_objectid);
 }
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index da2dba082e2d..1d9c12714c5c 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -289,7 +289,7 @@ const struct file_operations reiserfs_file_operations = {
         .compat_ioctl = reiserfs_compat_ioctl,
 #endif
         .mmap = reiserfs_file_mmap,
-        .open = generic_file_open,
+        .open = dquot_file_open,
         .release = reiserfs_file_release,
         .fsync = reiserfs_sync_file,
         .aio_read = generic_file_aio_read,
diff --git a/fs/reiserfs/fix_node.c b/fs/reiserfs/fix_node.c
index 6591cb21edf6..1e4250bc3a6f 100644
--- a/fs/reiserfs/fix_node.c
+++ b/fs/reiserfs/fix_node.c
@@ -35,6 +35,7 @@
  **/
 
 #include <linux/time.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/buffer_head.h>
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 290ae38fca8a..dc2c65e04853 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -11,6 +11,7 @@
 #include <linux/smp_lock.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <linux/buffer_head.h>
@@ -31,11 +32,15 @@ void reiserfs_delete_inode(struct inode *inode)
             JOURNAL_PER_BALANCE_CNT * 2 +
             2 * REISERFS_QUOTA_INIT_BLOCKS(inode->i_sb);
         struct reiserfs_transaction_handle th;
+        int depth;
         int err;
 
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
+
         truncate_inode_pages(&inode->i_data, 0);
 
-        reiserfs_write_lock(inode->i_sb);
+        depth = reiserfs_write_lock_once(inode->i_sb);
 
         /* The = 0 happens when we abort creating a new inode for some reason like lack of space.. */
         if (!(inode->i_state & I_NEW) && INODE_PKEY(inode)->k_objectid != 0) {  /* also handles bad_inode case */
@@ -53,7 +58,7 @@ void reiserfs_delete_inode(struct inode *inode)
                  * after delete_object so that quota updates go into the same transaction as
                  * stat data deletion */
                 if (!err) 
-                        vfs_dq_free_inode(inode);
+                        dquot_free_inode(inode);
 
                 if (journal_end(&th, inode->i_sb, jbegin_count))
                         goto out;
@@ -74,7 +79,7 @@ void reiserfs_delete_inode(struct inode *inode)
       out:
         clear_inode(inode);     /* note this must go after the journal_end to prevent deadlock */
         inode->i_blocks = 0;
-        reiserfs_write_unlock(inode->i_sb);
+        reiserfs_write_unlock_once(inode->i_sb, depth);
 }
 
 static void _make_cpu_key(struct cpu_key *key, int version, __u32 dirid,
@@ -1496,9 +1501,11 @@ struct inode *reiserfs_iget(struct super_block *s, const struct cpu_key *key)
 
         args.objectid = key->on_disk_key.k_objectid;
         args.dirid = key->on_disk_key.k_dir_id;
+        reiserfs_write_unlock(s);
         inode = iget5_locked(s, key->on_disk_key.k_objectid,
                              reiserfs_find_actor, reiserfs_init_locked_inode,
                              (void *)(&args));
+        reiserfs_write_lock(s);
         if (!inode)
                 return ERR_PTR(-ENOMEM);
 
@@ -1612,7 +1619,7 @@ int reiserfs_encode_fh(struct dentry *dentry, __u32 * data, int *lenp,
 ** to properly mark inodes for datasync and such, but only actually
 ** does something when called for a synchronous update.
 */
-int reiserfs_write_inode(struct inode *inode, int do_sync)
+int reiserfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct reiserfs_transaction_handle th;
         int jbegin_count = 1;
@@ -1624,7 +1631,7 @@ int reiserfs_write_inode(struct inode *inode, int do_sync)
          ** inode needs to reach disk for safety, and they can safely be
          ** ignored because the altered inode has already been logged.
          */
-        if (do_sync && !(current->flags & PF_MEMALLOC)) {
+        if (wbc->sync_mode == WB_SYNC_ALL && !(current->flags & PF_MEMALLOC)) {
                 reiserfs_write_lock(inode->i_sb);
                 if (!journal_begin(&th, inode->i_sb, jbegin_count)) {
                         reiserfs_update_sd(&th, inode);
@@ -1762,10 +1769,10 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
 
         BUG_ON(!th->t_trans_id);
 
-        if (vfs_dq_alloc_inode(inode)) {
-                err = -EDQUOT;
+        dquot_initialize(inode);
+        err = dquot_alloc_inode(inode);
+        if (err)
                 goto out_end_trans;
-        }
         if (!dir->i_nlink) {
                 err = -EPERM;
                 goto out_bad_inode;
@@ -1956,12 +1963,12 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
         INODE_PKEY(inode)->k_objectid = 0;
 
         /* Quota change must be inside a transaction for journaling */
-        vfs_dq_free_inode(inode);
+        dquot_free_inode(inode);
 
       out_end_trans:
         journal_end(th, th->t_super, th->t_blocks_allocated);
         /* Drop can be outside and it needs more credits so it's better to have it outside */
-        vfs_dq_drop(inode);
+        dquot_drop(inode);
         inode->i_flags |= S_NOQUOTA;
         make_bad_inode(inode);
 
@@ -3061,14 +3068,17 @@ static ssize_t reiserfs_direct_IO(int rw, struct kiocb *iocb,
 int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = dentry->d_inode;
-        int error;
         unsigned int ia_valid;
+        int depth;
+        int error;
 
         /* must be turned off for recursive notify_change calls */
         ia_valid = attr->ia_valid &= ~(ATTR_KILL_SUID|ATTR_KILL_SGID);
 
-        reiserfs_write_lock(inode->i_sb);
+        depth = reiserfs_write_lock_once(inode->i_sb);
         if (attr->ia_valid & ATTR_SIZE) {
+                dquot_initialize(inode);
+
                 /* version 2 items will be caught by the s_maxbytes check
                  ** done for us in vmtruncate
                  */
@@ -3130,8 +3140,7 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
                                                   jbegin_count);
                                 if (error)
                                         goto out;
-                                error =
-                                    vfs_dq_transfer(inode, attr) ? -EDQUOT : 0;
+                                error = dquot_transfer(inode, attr);
                                 if (error) {
                                         journal_end(&th, inode->i_sb,
                                                     jbegin_count);
@@ -3148,8 +3157,17 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
                                     journal_end(&th, inode->i_sb, jbegin_count);
                         }
                 }
-                if (!error)
+                if (!error) {
+                        /*
+                         * Relax the lock here, as it might truncate the
+                         * inode pages and wait for inode pages locks.
+                         * To release such page lock, the owner needs the
+                         * reiserfs lock
+                         */
+                        reiserfs_write_unlock_once(inode->i_sb, depth);
                         error = inode_setattr(inode, attr);
+                        depth = reiserfs_write_lock_once(inode->i_sb);
+                }
         }
 
         if (!error && reiserfs_posixacl(inode->i_sb)) {
@@ -3158,7 +3176,8 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
       out:
-        reiserfs_write_unlock(inode->i_sb);
+        reiserfs_write_unlock_once(inode->i_sb, depth);
+
         return error;
 }
 
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index ace77451ceb1..f53505de0712 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -104,9 +104,10 @@ setflags_out:
                 err = put_user(inode->i_generation, (int __user *)arg);
                 break;
         case REISERFS_IOC_SETVERSION:
-                if (!is_owner_or_cap(inode))
+                if (!is_owner_or_cap(inode)) {
                         err = -EPERM;
                         break;
+                }
                 err = mnt_want_write(filp->f_path.mnt);
                 if (err)
                         break;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 2f8a7e7b8dab..19fbc810e8e7 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -50,6 +50,7 @@
 #include <linux/blkdev.h>
 #include <linux/backing-dev.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 
@@ -2009,10 +2010,11 @@ static int do_journal_release(struct reiserfs_transaction_handle *th,
                 destroy_workqueue(commit_wq);
                 commit_wq = NULL;
         }
-        reiserfs_write_lock(sb);
 
         free_journal_ram(sb);
 
+        reiserfs_write_lock(sb);
+
         return 0;
 }
 
@@ -2216,6 +2218,15 @@ static int journal_read_transaction(struct super_block *sb,
                 brelse(d_bh);
                 return 1;
         }
+
+        if (bdev_read_only(sb->s_bdev)) {
+                reiserfs_warning(sb, "clm-2076",
+                                 "device is readonly, unable to replay log");
+                brelse(c_bh);
+                brelse(d_bh);
+                return -EROFS;
+        }
+
         trans_id = get_desc_trans_id(desc);
         /* now we know we've got a good transaction, and it was inside the valid time ranges */
         log_blocks = kmalloc(get_desc_trans_len(desc) *
@@ -2458,12 +2469,6 @@ static int journal_read(struct super_block *sb)
                 goto start_log_replay;
         }
 
-        if (continue_replay && bdev_read_only(sb->s_bdev)) {
-                reiserfs_warning(sb, "clm-2076",
-                                 "device is readonly, unable to replay log");
-                return -1;
-        }
-
         /* ok, there are transactions that need to be replayed.  start with the first log block, find
          ** all the valid transactions, and pick out the oldest.
          */
@@ -2758,11 +2763,18 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
         struct reiserfs_journal *journal;
         struct reiserfs_journal_list *jl;
         char b[BDEVNAME_SIZE];
+        int ret;
 
+        /*
+         * Unlock here to avoid various RECLAIM-FS-ON <-> IN-RECLAIM-FS
+         * dependency inversion warnings.
+         */
+        reiserfs_write_unlock(sb);
         journal = SB_JOURNAL(sb) = vmalloc(sizeof(struct reiserfs_journal));
         if (!journal) {
                 reiserfs_warning(sb, "journal-1256",
                                  "unable to get memory for journal structure");
+                reiserfs_write_lock(sb);
                 return 1;
         }
         memset(journal, 0, sizeof(struct reiserfs_journal));
@@ -2771,10 +2783,12 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
         INIT_LIST_HEAD(&journal->j_working_list);
         INIT_LIST_HEAD(&journal->j_journal_list);
         journal->j_persistent_trans = 0;
-        if (reiserfs_allocate_list_bitmaps(sb,
-                                           journal->j_list_bitmap,
-                                           reiserfs_bmap_count(sb)))
+        ret = reiserfs_allocate_list_bitmaps(sb, journal->j_list_bitmap,
+                                           reiserfs_bmap_count(sb));
+        reiserfs_write_lock(sb);
+        if (ret)
                 goto free_and_return;
+
         allocate_bitmap_nodes(sb);
 
         /* reserved for journal area support */
@@ -2903,7 +2917,9 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
         journal->j_mount_id = 10;
         journal->j_state = 0;
         atomic_set(&(journal->j_jlock), 0);
+        reiserfs_write_unlock(sb);
         journal->j_cnode_free_list = allocate_cnodes(num_cnodes);
+        reiserfs_write_lock(sb);
         journal->j_cnode_free_orig = journal->j_cnode_free_list;
         journal->j_cnode_free = journal->j_cnode_free_list ? num_cnodes : 0;
         journal->j_cnode_used = 0;
diff --git a/fs/reiserfs/lock.c b/fs/reiserfs/lock.c
index ee2cfc0fd8a7..b87aa2c1afc1 100644
--- a/fs/reiserfs/lock.c
+++ b/fs/reiserfs/lock.c
@@ -86,3 +86,12 @@ void reiserfs_check_lock_depth(struct super_block *sb, char *caller)
                 reiserfs_panic(sb, "%s called without kernel lock held %d",
                                caller);
 }
+
+#ifdef CONFIG_REISERFS_CHECK
+void reiserfs_lock_check_recursive(struct super_block *sb)
+{
+        struct reiserfs_sb_info *sb_i = REISERFS_SB(sb);
+
+        WARN_ONCE((sb_i->lock_depth > 0), "Unwanted recursive reiserfs lock!\n");
+}
+#endif
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index e296ff72a6cc..d0c43cb99ffc 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -13,6 +13,7 @@
 
 #include <linux/time.h>
 #include <linux/bitops.h>
+#include <linux/slab.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/reiserfs_acl.h>
 #include <linux/reiserfs_xattr.h>
@@ -546,7 +547,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
 */
 static int drop_new_inode(struct inode *inode)
 {
-        vfs_dq_drop(inode);
+        dquot_drop(inode);
         make_bad_inode(inode);
         inode->i_flags |= S_NOQUOTA;
         iput(inode);
@@ -554,7 +555,7 @@ static int drop_new_inode(struct inode *inode)
 }
 
 /* utility function that does setup for reiserfs_new_inode.
-** vfs_dq_init needs lots of credits so it's better to have it
+** dquot_initialize needs lots of credits so it's better to have it
 ** outside of a transaction, so we had to pull some bits of
 ** reiserfs_new_inode out into this func.
 */
@@ -577,7 +578,7 @@ static int new_inode_init(struct inode *inode, struct inode *dir, int mode)
         } else {
                 inode->i_gid = current_fsgid();
         }
-        vfs_dq_init(inode);
+        dquot_initialize(inode);
         return 0;
 }
 
@@ -594,6 +595,8 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, int mode,
         struct reiserfs_transaction_handle th;
         struct reiserfs_security_handle security;
 
+        dquot_initialize(dir);
+
         if (!(inode = new_inode(dir->i_sb))) {
                 return -ENOMEM;
         }
@@ -666,6 +669,8 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, int mode,
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
+        dquot_initialize(dir);
+
         if (!(inode = new_inode(dir->i_sb))) {
                 return -ENOMEM;
         }
@@ -739,6 +744,8 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
             2 * (REISERFS_QUOTA_INIT_BLOCKS(dir->i_sb) +
                  REISERFS_QUOTA_TRANS_BLOCKS(dir->i_sb));
 
+        dquot_initialize(dir);
+
 #ifdef DISPLACE_NEW_PACKING_LOCALITIES
         /* set flag that new packing locality created and new blocks for the content     * of that directory are not displaced yet */
         REISERFS_I(dir)->new_packing_locality = 1;
@@ -842,6 +849,8 @@ static int reiserfs_rmdir(struct inode *dir, struct dentry *dentry)
             JOURNAL_PER_BALANCE_CNT * 2 + 2 +
             4 * REISERFS_QUOTA_TRANS_BLOCKS(dir->i_sb);
 
+        dquot_initialize(dir);
+
         reiserfs_write_lock(dir->i_sb);
         retval = journal_begin(&th, dir->i_sb, jbegin_count);
         if (retval)
@@ -921,6 +930,9 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
         struct reiserfs_transaction_handle th;
         int jbegin_count;
         unsigned long savelink;
+        int depth;
+
+        dquot_initialize(dir);
 
         inode = dentry->d_inode;
 
@@ -932,7 +944,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
             JOURNAL_PER_BALANCE_CNT * 2 + 2 +
             4 * REISERFS_QUOTA_TRANS_BLOCKS(dir->i_sb);
 
-        reiserfs_write_lock(dir->i_sb);
+        depth = reiserfs_write_lock_once(dir->i_sb);
         retval = journal_begin(&th, dir->i_sb, jbegin_count);
         if (retval)
                 goto out_unlink;
@@ -993,7 +1005,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
 
         retval = journal_end(&th, dir->i_sb, jbegin_count);
         reiserfs_check_path(&path);
-        reiserfs_write_unlock(dir->i_sb);
+        reiserfs_write_unlock_once(dir->i_sb, depth);
         return retval;
 
       end_unlink:
@@ -1003,7 +1015,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
         if (err)
                 retval = err;
       out_unlink:
-        reiserfs_write_unlock(dir->i_sb);
+        reiserfs_write_unlock_once(dir->i_sb, depth);
         return retval;
 }
 
@@ -1023,6 +1035,8 @@ static int reiserfs_symlink(struct inode *parent_dir,
             2 * (REISERFS_QUOTA_INIT_BLOCKS(parent_dir->i_sb) +
                  REISERFS_QUOTA_TRANS_BLOCKS(parent_dir->i_sb));
 
+        dquot_initialize(parent_dir);
+
         if (!(inode = new_inode(parent_dir->i_sb))) {
                 return -ENOMEM;
         }
@@ -1110,6 +1124,8 @@ static int reiserfs_link(struct dentry *old_dentry, struct inode *dir,
             JOURNAL_PER_BALANCE_CNT * 3 +
             2 * REISERFS_QUOTA_TRANS_BLOCKS(dir->i_sb);
 
+        dquot_initialize(dir);
+
         reiserfs_write_lock(dir->i_sb);
         if (inode->i_nlink >= REISERFS_LINK_MAX) {
                 //FIXME: sd_nlink is 32 bit for new files
@@ -1234,6 +1250,9 @@ static int reiserfs_rename(struct inode *old_dir, struct dentry *old_dentry,
             JOURNAL_PER_BALANCE_CNT * 3 + 5 +
             4 * REISERFS_QUOTA_TRANS_BLOCKS(old_dir->i_sb);
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         old_inode = old_dentry->d_inode;
         new_dentry_inode = new_dentry->d_inode;
 
diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index 5fa7118f04e1..313d39d639eb 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -1299,7 +1299,7 @@ int reiserfs_delete_item(struct reiserfs_transaction_handle *th,
                        "reiserquota delete_item(): freeing %u, id=%u type=%c",
                        quota_cut_bytes, inode->i_uid, head2type(&s_ih));
 #endif
-        vfs_dq_free_space_nodirty(inode, quota_cut_bytes);
+        dquot_free_space_nodirty(inode, quota_cut_bytes);
 
         /* Return deleted body length */
         return ret_value;
@@ -1383,7 +1383,7 @@ void reiserfs_delete_solid_item(struct reiserfs_transaction_handle *th,
                                                quota_cut_bytes, inode->i_uid,
                                                key2type(key));
 #endif
-                                vfs_dq_free_space_nodirty(inode,
+                                dquot_free_space_nodirty(inode,
                                                          quota_cut_bytes);
                         }
                         break;
@@ -1733,7 +1733,7 @@ int reiserfs_cut_from_item(struct reiserfs_transaction_handle *th,
                        "reiserquota cut_from_item(): freeing %u id=%u type=%c",
                        quota_cut_bytes, inode->i_uid, '?');
 #endif
-        vfs_dq_free_space_nodirty(inode, quota_cut_bytes);
+        dquot_free_space_nodirty(inode, quota_cut_bytes);
         return ret_value;
 }
 
@@ -1968,9 +1968,10 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
                        key2type(&(key->on_disk_key)));
 #endif
 
-        if (vfs_dq_alloc_space_nodirty(inode, pasted_size)) {
+        retval = dquot_alloc_space_nodirty(inode, pasted_size);
+        if (retval) {
                 pathrelse(search_path);
-                return -EDQUOT;
+                return retval;
         }
         init_tb_struct(th, &s_paste_balance, th->t_super, search_path,
                        pasted_size);
@@ -2024,7 +2025,7 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
                        pasted_size, inode->i_uid,
                        key2type(&(key->on_disk_key)));
 #endif
-        vfs_dq_free_space_nodirty(inode, pasted_size);
+        dquot_free_space_nodirty(inode, pasted_size);
         return retval;
 }
 
@@ -2062,9 +2063,10 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
 #endif
                 /* We can't dirty inode here. It would be immediately written but
                  * appropriate stat item isn't inserted yet... */
-                if (vfs_dq_alloc_space_nodirty(inode, quota_bytes)) {
+                retval = dquot_alloc_space_nodirty(inode, quota_bytes);
+                if (retval) {
                         pathrelse(path);
-                        return -EDQUOT;
+                        return retval;
                 }
         }
         init_tb_struct(th, &s_ins_balance, th->t_super, path,
@@ -2113,6 +2115,6 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
                        quota_bytes, inode->i_uid, head2type(ih));
 #endif
         if (inode)
-                vfs_dq_free_space_nodirty(inode, quota_bytes);
+                dquot_free_space_nodirty(inode, quota_bytes);
         return retval;
 }
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index b4a7dd03bdb9..59125fb36d42 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/time.h>
 #include <asm/uaccess.h>
@@ -246,7 +247,7 @@ static int finish_unfinished(struct super_block *s)
                         retval = remove_save_link_only(s, &save_link_key, 0);
                         continue;
                 }
-                vfs_dq_init(inode);
+                dquot_initialize(inode);
 
                 if (truncate && S_ISDIR(inode->i_mode)) {
                         /* We got a truncate request for a dir which is impossible.
@@ -578,6 +579,11 @@ out:
         reiserfs_write_unlock_once(inode->i_sb, lock_depth);
 }
 
+static void reiserfs_clear_inode(struct inode *inode)
+{
+        dquot_drop(inode);
+}
+
 #ifdef CONFIG_QUOTA
 static ssize_t reiserfs_quota_write(struct super_block *, int, const char *,
                                     size_t, loff_t);
@@ -590,6 +596,7 @@ static const struct super_operations reiserfs_sops = {
         .destroy_inode = reiserfs_destroy_inode,
         .write_inode = reiserfs_write_inode,
         .dirty_inode = reiserfs_dirty_inode,
+        .clear_inode = reiserfs_clear_inode,
         .delete_inode = reiserfs_delete_inode,
         .put_super = reiserfs_put_super,
         .write_super = reiserfs_write_super,
@@ -616,13 +623,6 @@ static int reiserfs_write_info(struct super_block *, int);
 static int reiserfs_quota_on(struct super_block *, int, int, char *, int);
 
 static const struct dquot_operations reiserfs_quota_operations = {
-        .initialize = dquot_initialize,
-        .drop = dquot_drop,
-        .alloc_space = dquot_alloc_space,
-        .alloc_inode = dquot_alloc_inode,
-        .free_space = dquot_free_space,
-        .free_inode = dquot_free_inode,
-        .transfer = dquot_transfer,
         .write_dquot = reiserfs_write_dquot,
         .acquire_dquot = reiserfs_acquire_dquot,
         .release_dquot = reiserfs_release_dquot,
@@ -1619,10 +1619,8 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
         save_mount_options(s, data);
 
         sbi = kzalloc(sizeof(struct reiserfs_sb_info), GFP_KERNEL);
-        if (!sbi) {
-                errval = -ENOMEM;
-                goto error_alloc;
-        }
+        if (!sbi)
+                return -ENOMEM;
         s->s_fs_info = sbi;
         /* Set default values for options: non-aggressive tails, RO on errors */
         REISERFS_SB(s)->s_mount_opt |= (1 << REISERFS_SMALLTAIL);
@@ -1879,12 +1877,12 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
         return (0);
 
 error:
-        reiserfs_write_unlock(s);
-error_alloc:
         if (jinit_done) {       /* kill the commit thread, free journal ram */
                 journal_release_error(NULL, s);
         }
 
+        reiserfs_write_unlock(s);
+
         reiserfs_free_bitmap_cache(s);
         if (SB_BUFFER_WITH_SB(s))
                 brelse(SB_BUFFER_WITH_SB(s));
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index 8c7033a8b67e..e7cc00e636dc 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -38,6 +38,7 @@
 #include <linux/dcache.h>
 #include <linux/namei.h>
 #include <linux/errno.h>
+#include <linux/gfp.h>
 #include <linux/fs.h>
 #include <linux/file.h>
 #include <linux/pagemap.h>
@@ -61,7 +62,6 @@
 static int xattr_create(struct inode *dir, struct dentry *dentry, int mode)
 {
         BUG_ON(!mutex_is_locked(&dir->i_mutex));
-        vfs_dq_init(dir);
         return dir->i_op->create(dir, dentry, mode, NULL);
 }
 #endif
@@ -69,7 +69,6 @@ static int xattr_create(struct inode *dir, struct dentry *dentry, int mode)
 static int xattr_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 {
         BUG_ON(!mutex_is_locked(&dir->i_mutex));
-        vfs_dq_init(dir);
         return dir->i_op->mkdir(dir, dentry, mode);
 }
 
@@ -81,9 +80,9 @@ static int xattr_unlink(struct inode *dir, struct dentry *dentry)
 {
         int error;
         BUG_ON(!mutex_is_locked(&dir->i_mutex));
-        vfs_dq_init(dir);
 
-        mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_CHILD);
+        reiserfs_mutex_lock_nested_safe(&dentry->d_inode->i_mutex,
+                                        I_MUTEX_CHILD, dir->i_sb);
         error = dir->i_op->unlink(dir, dentry);
         mutex_unlock(&dentry->d_inode->i_mutex);
 
@@ -96,9 +95,9 @@ static int xattr_rmdir(struct inode *dir, struct dentry *dentry)
 {
         int error;
         BUG_ON(!mutex_is_locked(&dir->i_mutex));
-        vfs_dq_init(dir);
 
-        mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_CHILD);
+        reiserfs_mutex_lock_nested_safe(&dentry->d_inode->i_mutex,
+                                        I_MUTEX_CHILD, dir->i_sb);
         dentry_unhash(dentry);
         error = dir->i_op->rmdir(dir, dentry);
         if (!error)
@@ -235,16 +234,22 @@ static int reiserfs_for_each_xattr(struct inode *inode,
         if (IS_PRIVATE(inode) || get_inode_sd_version(inode) == STAT_DATA_V1)
                 return 0;
 
+        reiserfs_write_unlock(inode->i_sb);
         dir = open_xa_dir(inode, XATTR_REPLACE);
         if (IS_ERR(dir)) {
                 err = PTR_ERR(dir);
+                reiserfs_write_lock(inode->i_sb);
                 goto out;
         } else if (!dir->d_inode) {
                 err = 0;
+                reiserfs_write_lock(inode->i_sb);
                 goto out_dir;
         }
 
         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_XATTR);
+
+        reiserfs_write_lock(inode->i_sb);
+
         buf.xadir = dir;
         err = reiserfs_readdir_dentry(dir, &buf, fill_with_dentries, &pos);
         while ((err == 0 || err == -ENOSPC) && buf.count) {
@@ -283,8 +288,9 @@ static int reiserfs_for_each_xattr(struct inode *inode,
                 err = journal_begin(&th, inode->i_sb, blocks);
                 if (!err) {
                         int jerror;
-                        mutex_lock_nested(&dir->d_parent->d_inode->i_mutex,
-                                          I_MUTEX_XATTR);
+                        reiserfs_mutex_lock_nested_safe(
+                                          &dir->d_parent->d_inode->i_mutex,
+                                          I_MUTEX_XATTR, inode->i_sb);
                         err = action(dir, data);
                         jerror = journal_end(&th, inode->i_sb, blocks);
                         mutex_unlock(&dir->d_parent->d_inode->i_mutex);
@@ -443,7 +449,9 @@ static int lookup_and_delete_xattr(struct inode *inode, const char *name)
         }
 
         if (dentry->d_inode) {
+                reiserfs_write_lock(inode->i_sb);
                 err = xattr_unlink(xadir->d_inode, dentry);
+                reiserfs_write_unlock(inode->i_sb);
                 update_ctime(inode);
         }
 
@@ -477,15 +485,24 @@ reiserfs_xattr_set_handle(struct reiserfs_transaction_handle *th,
         if (get_inode_sd_version(inode) == STAT_DATA_V1)
                 return -EOPNOTSUPP;
 
-        if (!buffer)
-                return lookup_and_delete_xattr(inode, name);
+        reiserfs_write_unlock(inode->i_sb);
+
+        if (!buffer) {
+                err = lookup_and_delete_xattr(inode, name);
+                reiserfs_write_lock(inode->i_sb);
+                return err;
+        }
 
         dentry = xattr_lookup(inode, name, flags);
-        if (IS_ERR(dentry))
+        if (IS_ERR(dentry)) {
+                reiserfs_write_lock(inode->i_sb);
                 return PTR_ERR(dentry);
+        }
 
         down_write(&REISERFS_I(inode)->i_xattr_sem);
 
+        reiserfs_write_lock(inode->i_sb);
+
         xahash = xattr_hash(buffer, buffer_size);
         while (buffer_pos < buffer_size || buffer_pos == 0) {
                 size_t chunk;
@@ -537,11 +554,15 @@ reiserfs_xattr_set_handle(struct reiserfs_transaction_handle *th,
         if (!err && new_size < i_size_read(dentry->d_inode)) {
                 struct iattr newattrs = {
                         .ia_ctime = current_fs_time(inode->i_sb),
-                        .ia_size = buffer_size,
+                        .ia_size = new_size,
                         .ia_valid = ATTR_SIZE | ATTR_CTIME,
                 };
+
+                reiserfs_write_unlock(inode->i_sb);
                 mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_XATTR);
                 down_write(&dentry->d_inode->i_alloc_sem);
+                reiserfs_write_lock(inode->i_sb);
+
                 err = reiserfs_setattr(dentry, &newattrs);
                 up_write(&dentry->d_inode->i_alloc_sem);
                 mutex_unlock(&dentry->d_inode->i_mutex);
@@ -952,21 +973,13 @@ int reiserfs_permission(struct inode *inode, int mask)
         return generic_permission(inode, mask, NULL);
 }
 
-/* This will catch lookups from the fs root to .reiserfs_priv */
-static int
-xattr_lookup_poison(struct dentry *dentry, struct qstr *q1, struct qstr *name)
+static int xattr_hide_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
-        struct dentry *priv_root = REISERFS_SB(dentry->d_sb)->priv_root;
-        if (container_of(q1, struct dentry, d_name) == priv_root)
-                return -ENOENT;
-        if (q1->len == name->len &&
-                   !memcmp(q1->name, name->name, name->len))
-                return 0;
-        return 1;
+        return -EPERM;
 }
 
 static const struct dentry_operations xattr_lookup_poison_ops = {
-        .d_compare = xattr_lookup_poison,
+        .d_revalidate = xattr_hide_revalidate,
 };
 
 int reiserfs_lookup_privroot(struct super_block *s)
@@ -980,8 +993,7 @@ int reiserfs_lookup_privroot(struct super_block *s)
                                 strlen(PRIVROOT_NAME));
         if (!IS_ERR(dentry)) {
                 REISERFS_SB(s)->priv_root = dentry;
-                if (!reiserfs_expose_privroot(s))
-                        s->s_root->d_op = &xattr_lookup_poison_ops;
+                dentry->d_op = &xattr_lookup_poison_ops;
                 if (dentry->d_inode)
                         dentry->d_inode->i_flags |= S_PRIVATE;
         } else
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index cc32e6ada67b..9cdb759645a9 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -5,6 +5,7 @@
 #include <linux/errno.h>
 #include <linux/pagemap.h>
 #include <linux/xattr.h>
+#include <linux/slab.h>
 #include <linux/posix_acl_xattr.h>
 #include <linux/reiserfs_xattr.h>
 #include <linux/reiserfs_acl.h>
@@ -455,7 +456,9 @@ int reiserfs_acl_chmod(struct inode *inode)
                 return 0;
         }
 
+        reiserfs_write_unlock(inode->i_sb);
         acl = reiserfs_get_acl(inode, ACL_TYPE_ACCESS);
+        reiserfs_write_lock(inode->i_sb);
         if (!acl)
                 return 0;
         if (IS_ERR(acl))
diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
index d8b5bfcbdd30..7271a477c041 100644
--- a/fs/reiserfs/xattr_security.c
+++ b/fs/reiserfs/xattr_security.c
@@ -3,6 +3,7 @@
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/xattr.h>
+#include <linux/slab.h>
 #include <linux/reiserfs_xattr.h>
 #include <linux/security.h>
 #include <asm/uaccess.h>
@@ -76,7 +77,7 @@ int reiserfs_security_init(struct inode *dir, struct inode *inode,
                 return error;
         }
 
-        if (sec->length) {
+        if (sec->length && reiserfs_xattrs_initialized(inode->i_sb)) {
                 blocks = reiserfs_xattr_jcreate_nblocks(inode) +
                          reiserfs_xattr_nblocks(inode, sec->length);
                 /* We don't want to count the directories twice if we have
diff --git a/fs/romfs/super.c b/fs/romfs/super.c
index c117fa80d1e9..42d213546894 100644
--- a/fs/romfs/super.c
+++ b/fs/romfs/super.c
@@ -544,6 +544,7 @@ error:
 error_rsb_inval:
         ret = -EINVAL;
 error_rsb:
+        kfree(rsb);
         return ret;
 }
 
diff --git a/fs/select.c b/fs/select.c
index fd38ce2e32e3..500a669f7790 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -691,6 +691,23 @@ SYSCALL_DEFINE6(pselect6, int, n, fd_set __user *, inp, fd_set __user *, outp,
 }
 #endif /* HAVE_SET_RESTORE_SIGMASK */
 
+#ifdef __ARCH_WANT_SYS_OLD_SELECT
+struct sel_arg_struct {
+        unsigned long n;
+        fd_set __user *inp, *outp, *exp;
+        struct timeval __user *tvp;
+};
+
+SYSCALL_DEFINE1(old_select, struct sel_arg_struct __user *, arg)
+{
+        struct sel_arg_struct a;
+
+        if (copy_from_user(&a, arg, sizeof(a)))
+                return -EFAULT;
+        return sys_select(a.n, a.inp, a.outp, a.exp, a.tvp);
+}
+#endif
+
 struct poll_list {
         struct poll_list *next;
         int len;
@@ -821,7 +838,7 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
         struct poll_list *walk = head;
         unsigned long todo = nfds;
 
-        if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+        if (nfds > rlimit(RLIMIT_NOFILE))
                 return -EINVAL;
 
         len = min_t(unsigned int, nfds, N_STACK_PPS);
diff --git a/fs/seq_file.c b/fs/seq_file.c
index eae7d9dbf3ff..e1f437be6c3c 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -674,7 +674,6 @@ struct list_head *seq_list_start(struct list_head *head, loff_t pos)
 
         return NULL;
 }
-
 EXPORT_SYMBOL(seq_list_start);
 
 struct list_head *seq_list_start_head(struct list_head *head, loff_t pos)
@@ -684,7 +683,6 @@ struct list_head *seq_list_start_head(struct list_head *head, loff_t pos)
 
         return seq_list_start(head, pos - 1);
 }
-
 EXPORT_SYMBOL(seq_list_start_head);
 
 struct list_head *seq_list_next(void *v, struct list_head *head, loff_t *ppos)
@@ -695,5 +693,131 @@ struct list_head *seq_list_next(void *v, struct list_head *head, loff_t *ppos)
         ++*ppos;
         return lh == head ? NULL : lh;
 }
-
 EXPORT_SYMBOL(seq_list_next);
+
+/**
+ * seq_hlist_start - start an iteration of a hlist
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start().
+ */
+struct hlist_node *seq_hlist_start(struct hlist_head *head, loff_t pos)
+{
+        struct hlist_node *node;
+
+        hlist_for_each(node, head)
+                if (pos-- == 0)
+                        return node;
+        return NULL;
+}
+EXPORT_SYMBOL(seq_hlist_start);
+
+/**
+ * seq_hlist_start_head - start an iteration of a hlist
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start(). Call this function if you want to
+ * print a header at the top of the output.
+ */
+struct hlist_node *seq_hlist_start_head(struct hlist_head *head, loff_t pos)
+{
+        if (!pos)
+                return SEQ_START_TOKEN;
+
+        return seq_hlist_start(head, pos - 1);
+}
+EXPORT_SYMBOL(seq_hlist_start_head);
+
+/**
+ * seq_hlist_next - move to the next position of the hlist
+ * @v:    the current iterator
+ * @head: the head of the hlist
+ * @ppos: the current position
+ *
+ * Called at seq_file->op->next().
+ */
+struct hlist_node *seq_hlist_next(void *v, struct hlist_head *head,
+                                  loff_t *ppos)
+{
+        struct hlist_node *node = v;
+
+        ++*ppos;
+        if (v == SEQ_START_TOKEN)
+                return head->first;
+        else
+                return node->next;
+}
+EXPORT_SYMBOL(seq_hlist_next);
+
+/**
+ * seq_hlist_start_rcu - start an iteration of a hlist protected by RCU
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start().
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+struct hlist_node *seq_hlist_start_rcu(struct hlist_head *head,
+                                       loff_t pos)
+{
+        struct hlist_node *node;
+
+        __hlist_for_each_rcu(node, head)
+                if (pos-- == 0)
+                        return node;
+        return NULL;
+}
+EXPORT_SYMBOL(seq_hlist_start_rcu);
+
+/**
+ * seq_hlist_start_head_rcu - start an iteration of a hlist protected by RCU
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start(). Call this function if you want to
+ * print a header at the top of the output.
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+struct hlist_node *seq_hlist_start_head_rcu(struct hlist_head *head,
+                                            loff_t pos)
+{
+        if (!pos)
+                return SEQ_START_TOKEN;
+
+        return seq_hlist_start_rcu(head, pos - 1);
+}
+EXPORT_SYMBOL(seq_hlist_start_head_rcu);
+
+/**
+ * seq_hlist_next_rcu - move to the next position of the hlist protected by RCU
+ * @v:    the current iterator
+ * @head: the head of the hlist
+ * @ppos: the current position
+ *
+ * Called at seq_file->op->next().
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+struct hlist_node *seq_hlist_next_rcu(void *v,
+                                      struct hlist_head *head,
+                                      loff_t *ppos)
+{
+        struct hlist_node *node = v;
+
+        ++*ppos;
+        if (v == SEQ_START_TOKEN)
+                return rcu_dereference(head->first);
+        else
+                return rcu_dereference(node->next);
+}
+EXPORT_SYMBOL(seq_hlist_next_rcu);
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 1dabe4ee02fe..f329849ce3c0 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/list.h>
diff --git a/fs/smbfs/file.c b/fs/smbfs/file.c
index 92d5e8ffb639..dbf6548bbf06 100644
--- a/fs/smbfs/file.c
+++ b/fs/smbfs/file.c
@@ -13,7 +13,6 @@
 #include <linux/fcntl.h>
 #include <linux/stat.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/smp_lock.h>
 #include <linux/net.h>
diff --git a/fs/smbfs/inode.c b/fs/smbfs/inode.c
index 1c4c8f089970..dfa1d67f8fca 100644
--- a/fs/smbfs/inode.c
+++ b/fs/smbfs/inode.c
@@ -479,6 +479,7 @@ smb_put_super(struct super_block *sb)
         if (server->conn_pid)
                 kill_pid(server->conn_pid, SIGTERM, 1);
 
+        bdi_destroy(&server->bdi);
         kfree(server->ops);
         smb_unload_nls(server);
         sb->s_fs_info = NULL;
@@ -525,6 +526,11 @@ static int smb_fill_super(struct super_block *sb, void *raw_data, int silent)
         if (!server)
                 goto out_no_server;
         sb->s_fs_info = server;
+        
+        if (bdi_setup_and_register(&server->bdi, "smbfs", BDI_CAP_MAP_COPY))
+                goto out_bdi;
+
+        sb->s_bdi = &server->bdi;
 
         server->super_block = sb;
         server->mnt = NULL;
@@ -624,6 +630,8 @@ out_no_smbiod:
 out_bad_option:
         kfree(mem);
 out_no_mem:
+        bdi_destroy(&server->bdi);
+out_bdi:
         if (!server->mnt)
                 printk(KERN_ERR "smb_fill_super: allocation failure\n");
         sb->s_fs_info = NULL;
diff --git a/fs/smbfs/smbiod.c b/fs/smbfs/smbiod.c
index 6bd9b691a463..0e39a924f10a 100644
--- a/fs/smbfs/smbiod.c
+++ b/fs/smbfs/smbiod.c
@@ -12,7 +12,6 @@
 #include <linux/string.h>
 #include <linux/stat.h>
 #include <linux/errno.h>
-#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/file.h>
 #include <linux/dcache.h>
diff --git a/fs/smbfs/symlink.c b/fs/smbfs/symlink.c
index 00b2909bd469..54350b59046b 100644
--- a/fs/smbfs/symlink.c
+++ b/fs/smbfs/symlink.c
@@ -15,6 +15,7 @@
 #include <linux/pagemap.h>
 #include <linux/net.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
diff --git a/fs/splice.c b/fs/splice.c
index 39208663aaf1..9313b6124a2e 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -30,6 +30,7 @@
 #include <linux/syscalls.h>
 #include <linux/uio.h>
 #include <linux/security.h>
+#include <linux/gfp.h>
 
 /*
  * Attempt to steal a page from a pipe buffer. This should perhaps go into
diff --git a/fs/squashfs/Makefile b/fs/squashfs/Makefile
index 70e3244fa30f..df8a19ef870d 100644
--- a/fs/squashfs/Makefile
+++ b/fs/squashfs/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_SQUASHFS) += squashfs.o
 squashfs-y += block.o cache.o dir.o export.o file.o fragment.o id.o inode.o
-squashfs-y += namei.o super.o symlink.o
+squashfs-y += namei.o super.o symlink.o zlib_wrapper.o decompressor.o
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2a7960310349..653c030eb840 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -29,15 +29,14 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/mutex.h>
 #include <linux/string.h>
 #include <linux/buffer_head.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
 #include "squashfs_fs_i.h"
 #include "squashfs.h"
+#include "decompressor.h"
 
 /*
  * Read the metadata block length, this is stored in the first two
@@ -88,9 +87,8 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
         u64 cur_index = index >> msblk->devblksize_log2;
         int bytes, compressed, b = 0, k = 0, page = 0, avail;
 
-
-        bh = kcalloc((msblk->block_size >> msblk->devblksize_log2) + 1,
-                                sizeof(*bh), GFP_KERNEL);
+        bh = kcalloc(((srclength + msblk->devblksize - 1)
+                >> msblk->devblksize_log2) + 1, sizeof(*bh), GFP_KERNEL);
         if (bh == NULL)
                 return -ENOMEM;
 
@@ -153,72 +151,10 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
         }
 
         if (compressed) {
-                int zlib_err = 0, zlib_init = 0;
-
-                /*
-                 * Uncompress block.
-                 */
-
-                mutex_lock(&msblk->read_data_mutex);
-
-                msblk->stream.avail_out = 0;
-                msblk->stream.avail_in = 0;
-
-                bytes = length;
-                do {
-                        if (msblk->stream.avail_in == 0 && k < b) {
-                                avail = min(bytes, msblk->devblksize - offset);
-                                bytes -= avail;
-                                wait_on_buffer(bh[k]);
-                                if (!buffer_uptodate(bh[k]))
-                                        goto release_mutex;
-
-                                if (avail == 0) {
-                                        offset = 0;
-                                        put_bh(bh[k++]);
-                                        continue;
-                                }
-
-                                msblk->stream.next_in = bh[k]->b_data + offset;
-                                msblk->stream.avail_in = avail;
-                                offset = 0;
-                        }
-
-                        if (msblk->stream.avail_out == 0 && page < pages) {
-                                msblk->stream.next_out = buffer[page++];
-                                msblk->stream.avail_out = PAGE_CACHE_SIZE;
-                        }
-
-                        if (!zlib_init) {
-                                zlib_err = zlib_inflateInit(&msblk->stream);
-                                if (zlib_err != Z_OK) {
-                                        ERROR("zlib_inflateInit returned"
-                                                " unexpected result 0x%x,"
-                                                " srclength %d\n", zlib_err,
-                                                srclength);
-                                        goto release_mutex;
-                                }
-                                zlib_init = 1;
-                        }
-
-                        zlib_err = zlib_inflate(&msblk->stream, Z_SYNC_FLUSH);
-
-                        if (msblk->stream.avail_in == 0 && k < b)
-                                put_bh(bh[k++]);
-                } while (zlib_err == Z_OK);
-
-                if (zlib_err != Z_STREAM_END) {
-                        ERROR("zlib_inflate error, data probably corrupt\n");
-                        goto release_mutex;
-                }
-
-                zlib_err = zlib_inflateEnd(&msblk->stream);
-                if (zlib_err != Z_OK) {
-                        ERROR("zlib_inflate error, data probably corrupt\n");
-                        goto release_mutex;
-                }
-                length = msblk->stream.total_out;
-                mutex_unlock(&msblk->read_data_mutex);
+                length = squashfs_decompress(msblk, buffer, bh, b, offset,
+                         length, srclength, pages);
+                if (length < 0)
+                        goto read_failure;
         } else {
                 /*
                  * Block is uncompressed.
@@ -255,9 +191,6 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
         kfree(bh);
         return length;
 
-release_mutex:
-        mutex_unlock(&msblk->read_data_mutex);
-
 block_release:
         for (; k < b; k++)
                 put_bh(bh[k]);
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index 40c98fa6b5d6..57314bee9059 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -51,7 +51,6 @@
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/wait.h>
-#include <linux/zlib.h>
 #include <linux/pagemap.h>
 
 #include "squashfs_fs.h"
diff --git a/fs/squashfs/decompressor.c b/fs/squashfs/decompressor.c
new file mode 100644
index 000000000000..157478da6ac9
--- /dev/null
+++ b/fs/squashfs/decompressor.c
@@ -0,0 +1,68 @@
+/*
+ * Squashfs - a compressed read only filesystem for Linux
+ *
+ * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
+ * Phillip Lougher <phillip@lougher.demon.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ * decompressor.c
+ */
+
+#include <linux/types.h>
+#include <linux/mutex.h>
+#include <linux/buffer_head.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "squashfs_fs_i.h"
+#include "decompressor.h"
+#include "squashfs.h"
+
+/*
+ * This file (and decompressor.h) implements a decompressor framework for
+ * Squashfs, allowing multiple decompressors to be easily supported
+ */
+
+static const struct squashfs_decompressor squashfs_lzma_unsupported_comp_ops = {
+        NULL, NULL, NULL, LZMA_COMPRESSION, "lzma", 0
+};
+
+static const struct squashfs_decompressor squashfs_lzo_unsupported_comp_ops = {
+        NULL, NULL, NULL, LZO_COMPRESSION, "lzo", 0
+};
+
+static const struct squashfs_decompressor squashfs_unknown_comp_ops = {
+        NULL, NULL, NULL, 0, "unknown", 0
+};
+
+static const struct squashfs_decompressor *decompressor[] = {
+        &squashfs_zlib_comp_ops,
+        &squashfs_lzma_unsupported_comp_ops,
+        &squashfs_lzo_unsupported_comp_ops,
+        &squashfs_unknown_comp_ops
+};
+
+
+const struct squashfs_decompressor *squashfs_lookup_decompressor(int id)
+{
+        int i;
+
+        for (i = 0; decompressor[i]->id; i++)
+                if (id == decompressor[i]->id)
+                        break;
+
+        return decompressor[i];
+}
diff --git a/fs/squashfs/decompressor.h b/fs/squashfs/decompressor.h
new file mode 100644
index 000000000000..7425f80783f6
--- /dev/null
+++ b/fs/squashfs/decompressor.h
@@ -0,0 +1,55 @@
+#ifndef DECOMPRESSOR_H
+#define DECOMPRESSOR_H
+/*
+ * Squashfs - a compressed read only filesystem for Linux
+ *
+ * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
+ * Phillip Lougher <phillip@lougher.demon.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ * decompressor.h
+ */
+
+struct squashfs_decompressor {
+        void    *(*init)(struct squashfs_sb_info *);
+        void    (*free)(void *);
+        int     (*decompress)(struct squashfs_sb_info *, void **,
+                struct buffer_head **, int, int, int, int, int);
+        int     id;
+        char    *name;
+        int     supported;
+};
+
+static inline void *squashfs_decompressor_init(struct squashfs_sb_info *msblk)
+{
+        return msblk->decompressor->init(msblk);
+}
+
+static inline void squashfs_decompressor_free(struct squashfs_sb_info *msblk,
+        void *s)
+{
+        if (msblk->decompressor)
+                msblk->decompressor->free(s);
+}
+
+static inline int squashfs_decompress(struct squashfs_sb_info *msblk,
+        void **buffer, struct buffer_head **bh, int b, int offset, int length,
+        int srclength, int pages)
+{
+        return msblk->decompressor->decompress(msblk, buffer, bh, b, offset,
+                length, srclength, pages);
+}
+#endif
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index 566b0eaed868..12b933ac6585 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -30,7 +30,6 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
index 2b1b8fe5e037..7f93d5a9ee05 100644
--- a/fs/squashfs/export.c
+++ b/fs/squashfs/export.c
@@ -39,7 +39,6 @@
 #include <linux/vfs.h>
 #include <linux/dcache.h>
 #include <linux/exportfs.h>
-#include <linux/zlib.h>
 #include <linux/slab.h>
 
 #include "squashfs_fs.h"
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 717767d831df..a25c5060bdcb 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -47,7 +47,6 @@
 #include <linux/string.h>
 #include <linux/pagemap.h>
 #include <linux/mutex.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index b5a2c15bbbc7..7c90bbd6879d 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -36,7 +36,6 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
index 3795b837ba28..b7f64bcd2b70 100644
--- a/fs/squashfs/id.c
+++ b/fs/squashfs/id.c
@@ -34,7 +34,6 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 9101dbde39ec..49daaf669e41 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -40,7 +40,6 @@
 
 #include <linux/fs.h>
 #include <linux/vfs.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
index 9e398653b22b..5266bd8ad932 100644
--- a/fs/squashfs/namei.c
+++ b/fs/squashfs/namei.c
@@ -57,7 +57,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/dcache.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 0e9feb6adf7e..fe2587af5512 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -51,6 +51,9 @@ extern struct squashfs_cache_entry *squashfs_get_datablock(struct super_block *,
                                 u64, int);
 extern int squashfs_read_table(struct super_block *, void *, u64, int);
 
+/* decompressor.c */
+extern const struct squashfs_decompressor *squashfs_lookup_decompressor(int);
+
 /* export.c */
 extern __le64 *squashfs_read_inode_lookup_table(struct super_block *, u64,
                                 unsigned int);
@@ -71,7 +74,7 @@ extern struct inode *squashfs_iget(struct super_block *, long long,
 extern int squashfs_read_inode(struct inode *, long long);
 
 /*
- * Inodes and files operations
+ * Inodes, files and decompressor operations
  */
 
 /* dir.c */
@@ -88,3 +91,6 @@ extern const struct inode_operations squashfs_dir_inode_ops;
 
 /* symlink.c */
 extern const struct address_space_operations squashfs_symlink_aops;
+
+/* zlib_wrapper.c */
+extern const struct squashfs_decompressor squashfs_zlib_comp_ops;
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index 283daafc568e..79024245ea00 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -183,8 +183,6 @@
 #define SQUASHFS_MAX_FILE_SIZE          (1LL << \
                                         (SQUASHFS_MAX_FILE_SIZE_LOG - 2))
 
-#define SQUASHFS_MARKER_BYTE            0xff
-
 /* meta index cache */
 #define SQUASHFS_META_INDEXES   (SQUASHFS_METADATA_SIZE / sizeof(unsigned int))
 #define SQUASHFS_META_ENTRIES   127
@@ -211,7 +209,9 @@ struct meta_index {
 /*
  * definitions for structures on disk
  */
-#define ZLIB_COMPRESSION         1
+#define ZLIB_COMPRESSION        1
+#define LZMA_COMPRESSION        2
+#define LZO_COMPRESSION         3
 
 struct squashfs_super_block {
         __le32                  s_magic;
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index c8c65614dd1c..2e77dc547e25 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -52,25 +52,25 @@ struct squashfs_cache_entry {
 };
 
 struct squashfs_sb_info {
-        int                     devblksize;
-        int                     devblksize_log2;
-        struct squashfs_cache   *block_cache;
-        struct squashfs_cache   *fragment_cache;
-        struct squashfs_cache   *read_page;
-        int                     next_meta_index;
-        __le64                  *id_table;
-        __le64                  *fragment_index;
-        unsigned int            *fragment_index_2;
-        struct mutex            read_data_mutex;
-        struct mutex            meta_index_mutex;
-        struct meta_index       *meta_index;
-        z_stream                stream;
-        __le64                  *inode_lookup_table;
-        u64                     inode_table;
-        u64                     directory_table;
-        unsigned int            block_size;
-        unsigned short          block_log;
-        long long               bytes_used;
-        unsigned int            inodes;
+        const struct squashfs_decompressor      *decompressor;
+        int                                     devblksize;
+        int                                     devblksize_log2;
+        struct squashfs_cache                   *block_cache;
+        struct squashfs_cache                   *fragment_cache;
+        struct squashfs_cache                   *read_page;
+        int                                     next_meta_index;
+        __le64                                  *id_table;
+        __le64                                  *fragment_index;
+        struct mutex                            read_data_mutex;
+        struct mutex                            meta_index_mutex;
+        struct meta_index                       *meta_index;
+        void                                    *stream;
+        __le64                                  *inode_lookup_table;
+        u64                                     inode_table;
+        u64                                     directory_table;
+        unsigned int                            block_size;
+        unsigned short                          block_log;
+        long long                               bytes_used;
+        unsigned int                            inodes;
 };
 #endif
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 6c197ef53add..48b6f4a385a6 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -35,34 +35,41 @@
 #include <linux/pagemap.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/zlib.h>
 #include <linux/magic.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
 #include "squashfs_fs_i.h"
 #include "squashfs.h"
+#include "decompressor.h"
 
 static struct file_system_type squashfs_fs_type;
 static const struct super_operations squashfs_super_ops;
 
-static int supported_squashfs_filesystem(short major, short minor, short comp)
+static const struct squashfs_decompressor *supported_squashfs_filesystem(short
+        major, short minor, short id)
 {
+        const struct squashfs_decompressor *decompressor;
+
         if (major < SQUASHFS_MAJOR) {
                 ERROR("Major/Minor mismatch, older Squashfs %d.%d "
                         "filesystems are unsupported\n", major, minor);
-                return -EINVAL;
+                return NULL;
         } else if (major > SQUASHFS_MAJOR || minor > SQUASHFS_MINOR) {
                 ERROR("Major/Minor mismatch, trying to mount newer "
                         "%d.%d filesystem\n", major, minor);
                 ERROR("Please update your kernel\n");
-                return -EINVAL;
+                return NULL;
         }
 
-        if (comp != ZLIB_COMPRESSION)
-                return -EINVAL;
+        decompressor = squashfs_lookup_decompressor(id);
+        if (!decompressor->supported) {
+                ERROR("Filesystem uses \"%s\" compression. This is not "
+                        "supported\n", decompressor->name);
+                return NULL;
+        }
 
-        return 0;
+        return decompressor;
 }
 
 
@@ -87,13 +94,6 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         }
         msblk = sb->s_fs_info;
 
-        msblk->stream.workspace = kmalloc(zlib_inflate_workspacesize(),
-                GFP_KERNEL);
-        if (msblk->stream.workspace == NULL) {
-                ERROR("Failed to allocate zlib workspace\n");
-                goto failure;
-        }
-
         sblk = kzalloc(sizeof(*sblk), GFP_KERNEL);
         if (sblk == NULL) {
                 ERROR("Failed to allocate squashfs_super_block\n");
@@ -120,25 +120,25 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount;
         }
 
+        err = -EINVAL;
+
         /* Check it is a SQUASHFS superblock */
         sb->s_magic = le32_to_cpu(sblk->s_magic);
         if (sb->s_magic != SQUASHFS_MAGIC) {
                 if (!silent)
                         ERROR("Can't find a SQUASHFS superblock on %s\n",
                                                 bdevname(sb->s_bdev, b));
-                err = -EINVAL;
                 goto failed_mount;
         }
 
-        /* Check the MAJOR & MINOR versions and compression type */
-        err = supported_squashfs_filesystem(le16_to_cpu(sblk->s_major),
+        /* Check the MAJOR & MINOR versions and lookup compression type */
+        msblk->decompressor = supported_squashfs_filesystem(
+                        le16_to_cpu(sblk->s_major),
                         le16_to_cpu(sblk->s_minor),
                         le16_to_cpu(sblk->compression));
-        if (err < 0)
+        if (msblk->decompressor == NULL)
                 goto failed_mount;
 
-        err = -EINVAL;
-
         /*
          * Check if there's xattrs in the filesystem.  These are not
          * supported in this version, so warn that they will be ignored.
@@ -205,6 +205,10 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 
         err = -ENOMEM;
 
+        msblk->stream = squashfs_decompressor_init(msblk);
+        if (msblk->stream == NULL)
+                goto failed_mount;
+
         msblk->block_cache = squashfs_cache_init("metadata",
                         SQUASHFS_CACHED_BLKS, SQUASHFS_METADATA_SIZE);
         if (msblk->block_cache == NULL)
@@ -271,7 +275,8 @@ allocate_root:
 
         err = squashfs_read_inode(root, root_inode);
         if (err) {
-                iget_failed(root);
+                make_bad_inode(root);
+                iput(root);
                 goto failed_mount;
         }
         insert_inode_hash(root);
@@ -292,17 +297,16 @@ failed_mount:
         squashfs_cache_delete(msblk->block_cache);
         squashfs_cache_delete(msblk->fragment_cache);
         squashfs_cache_delete(msblk->read_page);
+        squashfs_decompressor_free(msblk, msblk->stream);
         kfree(msblk->inode_lookup_table);
         kfree(msblk->fragment_index);
         kfree(msblk->id_table);
-        kfree(msblk->stream.workspace);
         kfree(sb->s_fs_info);
         sb->s_fs_info = NULL;
         kfree(sblk);
         return err;
 
 failure:
-        kfree(msblk->stream.workspace);
         kfree(sb->s_fs_info);
         sb->s_fs_info = NULL;
         return -ENOMEM;
@@ -346,10 +350,11 @@ static void squashfs_put_super(struct super_block *sb)
                 squashfs_cache_delete(sbi->block_cache);
                 squashfs_cache_delete(sbi->fragment_cache);
                 squashfs_cache_delete(sbi->read_page);
+                squashfs_decompressor_free(sbi, sbi->stream);
                 kfree(sbi->id_table);
                 kfree(sbi->fragment_index);
                 kfree(sbi->meta_index);
-                kfree(sbi->stream.workspace);
+                kfree(sbi->inode_lookup_table);
                 kfree(sb->s_fs_info);
                 sb->s_fs_info = NULL;
         }
diff --git a/fs/squashfs/symlink.c b/fs/squashfs/symlink.c
index 83d87880aac8..32b911f4ee39 100644
--- a/fs/squashfs/symlink.c
+++ b/fs/squashfs/symlink.c
@@ -33,10 +33,8 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/kernel.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/pagemap.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
new file mode 100644
index 000000000000..7a603874e483
--- /dev/null
+++ b/fs/squashfs/zlib_wrapper.c
@@ -0,0 +1,152 @@
+/*
+ * Squashfs - a compressed read only filesystem for Linux
+ *
+ * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
+ * Phillip Lougher <phillip@lougher.demon.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ * zlib_wrapper.c
+ */
+
+
+#include <linux/mutex.h>
+#include <linux/buffer_head.h>
+#include <linux/slab.h>
+#include <linux/zlib.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "squashfs_fs_i.h"
+#include "squashfs.h"
+#include "decompressor.h"
+
+static void *zlib_init(struct squashfs_sb_info *dummy)
+{
+        z_stream *stream = kmalloc(sizeof(z_stream), GFP_KERNEL);
+        if (stream == NULL)
+                goto failed;
+        stream->workspace = kmalloc(zlib_inflate_workspacesize(),
+                GFP_KERNEL);
+        if (stream->workspace == NULL)
+                goto failed;
+
+        return stream;
+
+failed:
+        ERROR("Failed to allocate zlib workspace\n");
+        kfree(stream);
+        return NULL;
+}
+
+
+static void zlib_free(void *strm)
+{
+        z_stream *stream = strm;
+
+        if (stream)
+                kfree(stream->workspace);
+        kfree(stream);
+}
+
+
+static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
+        struct buffer_head **bh, int b, int offset, int length, int srclength,
+        int pages)
+{
+        int zlib_err = 0, zlib_init = 0;
+        int avail, bytes, k = 0, page = 0;
+        z_stream *stream = msblk->stream;
+
+        mutex_lock(&msblk->read_data_mutex);
+
+        stream->avail_out = 0;
+        stream->avail_in = 0;
+
+        bytes = length;
+        do {
+                if (stream->avail_in == 0 && k < b) {
+                        avail = min(bytes, msblk->devblksize - offset);
+                        bytes -= avail;
+                        wait_on_buffer(bh[k]);
+                        if (!buffer_uptodate(bh[k]))
+                                goto release_mutex;
+
+                        if (avail == 0) {
+                                offset = 0;
+                                put_bh(bh[k++]);
+                                continue;
+                        }
+
+                        stream->next_in = bh[k]->b_data + offset;
+                        stream->avail_in = avail;
+                        offset = 0;
+                }
+
+                if (stream->avail_out == 0 && page < pages) {
+                        stream->next_out = buffer[page++];
+                        stream->avail_out = PAGE_CACHE_SIZE;
+                }
+
+                if (!zlib_init) {
+                        zlib_err = zlib_inflateInit(stream);
+                        if (zlib_err != Z_OK) {
+                                ERROR("zlib_inflateInit returned unexpected "
+                                        "result 0x%x, srclength %d\n",
+                                        zlib_err, srclength);
+                                goto release_mutex;
+                        }
+                        zlib_init = 1;
+                }
+
+                zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
+
+                if (stream->avail_in == 0 && k < b)
+                        put_bh(bh[k++]);
+        } while (zlib_err == Z_OK);
+
+        if (zlib_err != Z_STREAM_END) {
+                ERROR("zlib_inflate error, data probably corrupt\n");
+                goto release_mutex;
+        }
+
+        zlib_err = zlib_inflateEnd(stream);
+        if (zlib_err != Z_OK) {
+                ERROR("zlib_inflate error, data probably corrupt\n");
+                goto release_mutex;
+        }
+
+        length = stream->total_out;
+        mutex_unlock(&msblk->read_data_mutex);
+        return length;
+
+release_mutex:
+        mutex_unlock(&msblk->read_data_mutex);
+
+        for (; k < b; k++)
+                put_bh(bh[k]);
+
+        return -EIO;
+}
+
+const struct squashfs_decompressor squashfs_zlib_comp_ops = {
+        .init = zlib_init,
+        .free = zlib_free,
+        .decompress = zlib_uncompress,
+        .id = ZLIB_COMPRESSION,
+        .name = "zlib",
+        .supported = 1
+};
+
diff --git a/fs/super.c b/fs/super.c
index aff046b0fe78..dc72491a19f9 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -568,7 +568,7 @@ out:
 int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
 {
         int retval;
-        int remount_rw;
+        int remount_rw, remount_ro;
 
         if (sb->s_frozen != SB_UNFROZEN)
                 return -EBUSY;
@@ -583,9 +583,12 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
         shrink_dcache_sb(sb);
         sync_filesystem(sb);
 
+        remount_ro = (flags & MS_RDONLY) && !(sb->s_flags & MS_RDONLY);
+        remount_rw = !(flags & MS_RDONLY) && (sb->s_flags & MS_RDONLY);
+
         /* If we are remounting RDONLY and current sb is read/write,
            make sure there are no rw files opened */
-        if ((flags & MS_RDONLY) && !(sb->s_flags & MS_RDONLY)) {
+        if (remount_ro) {
                 if (force)
                         mark_files_ro(sb);
                 else if (!fs_may_remount_ro(sb))
@@ -594,7 +597,6 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
                 if (retval < 0 && retval != -ENOSYS)
                         return -EBUSY;
         }
-        remount_rw = !(flags & MS_RDONLY) && (sb->s_flags & MS_RDONLY);
 
         if (sb->s_op->remount_fs) {
                 retval = sb->s_op->remount_fs(sb, &flags, data);
@@ -604,6 +606,16 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
         sb->s_flags = (sb->s_flags & ~MS_RMT_MASK) | (flags & MS_RMT_MASK);
         if (remount_rw)
                 vfs_dq_quota_on_remount(sb);
+        /*
+         * Some filesystems modify their metadata via some other path than the
+         * bdev buffer cache (eg. use a private mapping, or directories in
+         * pagecache, etc). Also file data modifications go via their own
+         * mappings. So If we try to mount readonly then copy the filesystem
+         * from bdev, we could get stale data, so invalidate it to give a best
+         * effort at coherency.
+         */
+        if (remount_ro && sb->s_bdev)
+                invalidate_bdev(sb->s_bdev);
         return 0;
 }
 
@@ -681,6 +693,7 @@ int set_anon_super(struct super_block *s, void *data)
                 return -EMFILE;
         }
         s->s_dev = MKDEV(0, dev & MINORMASK);
+        s->s_bdi = &noop_backing_dev_info;
         return 0;
 }
 
@@ -925,6 +938,9 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void
         if (!mnt)
                 goto out;
 
+        if (flags & MS_KERNMOUNT)
+                mnt->mnt_flags = MNT_INTERNAL;
+
         if (data && !(type->fs_flags & FS_BINARY_MOUNTDATA)) {
                 secdata = alloc_secdata();
                 if (!secdata)
@@ -939,10 +955,11 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void
         if (error < 0)
                 goto out_free_secdata;
         BUG_ON(!mnt->mnt_sb);
+        WARN_ON(!mnt->mnt_sb->s_bdi);
 
-        error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
-        if (error)
-                goto out_sb;
+        error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
+        if (error)
+                goto out_sb;
 
         /*
          * filesystems should never set s_maxbytes larger than MAX_LFS_FILESIZE
diff --git a/fs/sync.c b/fs/sync.c
index 418727a2a239..92b228176f7c 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -5,6 +5,7 @@
 #include <linux/kernel.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/writeback.h>
@@ -13,6 +14,7 @@
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
 #include <linux/buffer_head.h>
+#include <linux/backing-dev.h>
 #include "internal.h"
 
 #define VALID_FLAGS (SYNC_FILE_RANGE_WAIT_BEFORE|SYNC_FILE_RANGE_WRITE| \
@@ -31,17 +33,17 @@ static int __sync_filesystem(struct super_block *sb, int wait)
          * This should be safe, as we require bdi backing to actually
          * write out data in the first place
          */
-        if (!sb->s_bdi)
+        if (!sb->s_bdi || sb->s_bdi == &noop_backing_dev_info)
                 return 0;
 
-        /* Avoid doing twice syncing and cache pruning for quota sync */
-        if (!wait) {
-                writeout_quota_sb(sb, -1);
-                writeback_inodes_sb(sb);
-        } else {
-                sync_quota_sb(sb, -1);
+        if (sb->s_qcop && sb->s_qcop->quota_sync)
+                sb->s_qcop->quota_sync(sb, -1, wait);
+
+        if (wait)
                 sync_inodes_sb(sb);
-        }
+        else
+                writeback_inodes_sb(sb);
+
         if (sb->s_op->sync_fs)
                 sb->s_op->sync_fs(sb, wait);
         return __sync_blockdev(sb->s_bdev, wait);
diff --git a/fs/sysfs/bin.c b/fs/sysfs/bin.c
index a0a500af24a1..e9d293593e52 100644
--- a/fs/sysfs/bin.c
+++ b/fs/sysfs/bin.c
@@ -54,14 +54,14 @@ fill_read(struct dentry *dentry, char *buffer, loff_t off, size_t count)
         int rc;
 
         /* need attr_sd for attr, its parent for kobj */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -ENODEV;
 
         rc = -EIO;
         if (attr->read)
                 rc = attr->read(kobj, attr, buffer, off, count);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 
         return rc;
 }
@@ -125,14 +125,14 @@ flush_write(struct dentry *dentry, char *buffer, loff_t offset, size_t count)
         int rc;
 
         /* need attr_sd for attr, its parent for kobj */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -ENODEV;
 
         rc = -EIO;
         if (attr->write)
                 rc = attr->write(kobj, attr, buffer, offset, count);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 
         return rc;
 }
@@ -184,12 +184,12 @@ static void bin_vma_open(struct vm_area_struct *vma)
         if (!bb->vm_ops || !bb->vm_ops->open)
                 return;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return;
 
         bb->vm_ops->open(vma);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 }
 
 static void bin_vma_close(struct vm_area_struct *vma)
@@ -201,12 +201,12 @@ static void bin_vma_close(struct vm_area_struct *vma)
         if (!bb->vm_ops || !bb->vm_ops->close)
                 return;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return;
 
         bb->vm_ops->close(vma);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 }
 
 static int bin_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
@@ -219,12 +219,12 @@ static int bin_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         if (!bb->vm_ops || !bb->vm_ops->fault)
                 return VM_FAULT_SIGBUS;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return VM_FAULT_SIGBUS;
 
         ret = bb->vm_ops->fault(vma, vmf);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return ret;
 }
 
@@ -241,12 +241,12 @@ static int bin_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         if (!bb->vm_ops->page_mkwrite)
                 return 0;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return VM_FAULT_SIGBUS;
 
         ret = bb->vm_ops->page_mkwrite(vma, vmf);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return ret;
 }
 
@@ -261,12 +261,12 @@ static int bin_access(struct vm_area_struct *vma, unsigned long addr,
         if (!bb->vm_ops || !bb->vm_ops->access)
                 return -EINVAL;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -EINVAL;
 
         ret = bb->vm_ops->access(vma, addr, buf, len, write);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return ret;
 }
 
@@ -281,12 +281,12 @@ static int bin_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
         if (!bb->vm_ops || !bb->vm_ops->set_policy)
                 return 0;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -EINVAL;
 
         ret = bb->vm_ops->set_policy(vma, new);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return ret;
 }
 
@@ -301,12 +301,12 @@ static struct mempolicy *bin_get_policy(struct vm_area_struct *vma,
         if (!bb->vm_ops || !bb->vm_ops->get_policy)
                 return vma->vm_policy;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return vma->vm_policy;
 
         pol = bb->vm_ops->get_policy(vma, addr);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return pol;
 }
 
@@ -321,12 +321,12 @@ static int bin_migrate(struct vm_area_struct *vma, const nodemask_t *from,
         if (!bb->vm_ops || !bb->vm_ops->migrate)
                 return 0;
 
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return 0;
 
         ret = bb->vm_ops->migrate(vma, from, to, flags);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return ret;
 }
 #endif
@@ -356,7 +356,7 @@ static int mmap(struct file *file, struct vm_area_struct *vma)
 
         /* need attr_sd for attr, its parent for kobj */
         rc = -ENODEV;
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 goto out_unlock;
 
         rc = -EINVAL;
@@ -384,7 +384,7 @@ static int mmap(struct file *file, struct vm_area_struct *vma)
         bb->vm_ops = vma->vm_ops;
         vma->vm_ops = &bin_vm_ops;
 out_put:
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 out_unlock:
         mutex_unlock(&bb->mutex);
 
@@ -399,7 +399,7 @@ static int open(struct inode * inode, struct file * file)
         int error;
 
         /* binary file operations requires both @sd and its parent */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -ENODEV;
 
         error = -EACCES;
@@ -426,11 +426,11 @@ static int open(struct inode * inode, struct file * file)
         mutex_unlock(&sysfs_bin_lock);
 
         /* open succeeded, put active references */
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return 0;
 
  err_out:
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         kfree(bb);
         return error;
 }
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index f05f2303a8b8..590717861c7a 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -93,7 +93,7 @@ static void sysfs_unlink_sibling(struct sysfs_dirent *sd)
  *      RETURNS:
  *      Pointer to @sd on success, NULL on failure.
  */
-static struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
+struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
 {
         if (unlikely(!sd))
                 return NULL;
@@ -106,8 +106,10 @@ static struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
                         return NULL;
 
                 t = atomic_cmpxchg(&sd->s_active, v, v + 1);
-                if (likely(t == v))
+                if (likely(t == v)) {
+                        rwsem_acquire_read(&sd->dep_map, 0, 1, _RET_IP_);
                         return sd;
+                }
                 if (t < 0)
                         return NULL;
 
@@ -122,7 +124,7 @@ static struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
  *      Put an active reference to @sd.  This function is noop if @sd
  *      is NULL.
  */
-static void sysfs_put_active(struct sysfs_dirent *sd)
+void sysfs_put_active(struct sysfs_dirent *sd)
 {
         struct completion *cmpl;
         int v;
@@ -130,6 +132,7 @@ static void sysfs_put_active(struct sysfs_dirent *sd)
         if (unlikely(!sd))
                 return;
 
+        rwsem_release(&sd->dep_map, 1, _RET_IP_);
         v = atomic_dec_return(&sd->s_active);
         if (likely(v != SD_DEACTIVATED_BIAS))
                 return;
@@ -142,45 +145,6 @@ static void sysfs_put_active(struct sysfs_dirent *sd)
 }
 
 /**
- *      sysfs_get_active_two - get active references to sysfs_dirent and parent
- *      @sd: sysfs_dirent of interest
- *
- *      Get active reference to @sd and its parent.  Parent's active
- *      reference is grabbed first.  This function is noop if @sd is
- *      NULL.
- *
- *      RETURNS:
- *      Pointer to @sd on success, NULL on failure.
- */
-struct sysfs_dirent *sysfs_get_active_two(struct sysfs_dirent *sd)
-{
-        if (sd) {
-                if (sd->s_parent && unlikely(!sysfs_get_active(sd->s_parent)))
-                        return NULL;
-                if (unlikely(!sysfs_get_active(sd))) {
-                        sysfs_put_active(sd->s_parent);
-                        return NULL;
-                }
-        }
-        return sd;
-}
-
-/**
- *      sysfs_put_active_two - put active references to sysfs_dirent and parent
- *      @sd: sysfs_dirent of interest
- *
- *      Put active references to @sd and its parent.  This function is
- *      noop if @sd is NULL.
- */
-void sysfs_put_active_two(struct sysfs_dirent *sd)
-{
-        if (sd) {
-                sysfs_put_active(sd);
-                sysfs_put_active(sd->s_parent);
-        }
-}
-
-/**
  *      sysfs_deactivate - deactivate sysfs_dirent
  *      @sd: sysfs_dirent to deactivate
  *
@@ -192,17 +156,27 @@ static void sysfs_deactivate(struct sysfs_dirent *sd)
         int v;
 
         BUG_ON(sd->s_sibling || !(sd->s_flags & SYSFS_FLAG_REMOVED));
+
+        if (!(sysfs_type(sd) & SYSFS_ACTIVE_REF))
+                return;
+
         sd->s_sibling = (void *)&wait;
 
+        rwsem_acquire(&sd->dep_map, 0, 0, _RET_IP_);
         /* atomic_add_return() is a mb(), put_active() will always see
          * the updated sd->s_sibling.
          */
         v = atomic_add_return(SD_DEACTIVATED_BIAS, &sd->s_active);
 
-        if (v != SD_DEACTIVATED_BIAS)
+        if (v != SD_DEACTIVATED_BIAS) {
+                lock_contended(&sd->dep_map, _RET_IP_);
                 wait_for_completion(&wait);
+        }
 
         sd->s_sibling = NULL;
+
+        lock_acquired(&sd->dep_map, _RET_IP_);
+        rwsem_release(&sd->dep_map, 1, _RET_IP_);
 }
 
 static int sysfs_alloc_ino(ino_t *pino)
@@ -671,7 +645,7 @@ static struct dentry * sysfs_lookup(struct inode *dir, struct dentry *dentry,
         }
 
         /* attach dentry and inode */
-        inode = sysfs_get_inode(sd);
+        inode = sysfs_get_inode(dir->i_sb, sd);
         if (!inode) {
                 ret = ERR_PTR(-ENOMEM);
                 goto out_unlock;
@@ -827,11 +801,46 @@ static inline unsigned char dt_type(struct sysfs_dirent *sd)
         return (sd->s_mode >> 12) & 15;
 }
 
+static int sysfs_dir_release(struct inode *inode, struct file *filp)
+{
+        sysfs_put(filp->private_data);
+        return 0;
+}
+
+static struct sysfs_dirent *sysfs_dir_pos(struct sysfs_dirent *parent_sd,
+        ino_t ino, struct sysfs_dirent *pos)
+{
+        if (pos) {
+                int valid = !(pos->s_flags & SYSFS_FLAG_REMOVED) &&
+                        pos->s_parent == parent_sd &&
+                        ino == pos->s_ino;
+                sysfs_put(pos);
+                if (valid)
+                        return pos;
+        }
+        pos = NULL;
+        if ((ino > 1) && (ino < INT_MAX)) {
+                pos = parent_sd->s_dir.children;
+                while (pos && (ino > pos->s_ino))
+                        pos = pos->s_sibling;
+        }
+        return pos;
+}
+
+static struct sysfs_dirent *sysfs_dir_next_pos(struct sysfs_dirent *parent_sd,
+        ino_t ino, struct sysfs_dirent *pos)
+{
+        pos = sysfs_dir_pos(parent_sd, ino, pos);
+        if (pos)
+                pos = pos->s_sibling;
+        return pos;
+}
+
 static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
 {
         struct dentry *dentry = filp->f_path.dentry;
         struct sysfs_dirent * parent_sd = dentry->d_fsdata;
-        struct sysfs_dirent *pos;
+        struct sysfs_dirent *pos = filp->private_data;
         ino_t ino;
 
         if (filp->f_pos == 0) {
@@ -847,29 +856,31 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
                 if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
                         filp->f_pos++;
         }
-        if ((filp->f_pos > 1) && (filp->f_pos < INT_MAX)) {
-                mutex_lock(&sysfs_mutex);
-
-                /* Skip the dentries we have already reported */
-                pos = parent_sd->s_dir.children;
-                while (pos && (filp->f_pos > pos->s_ino))
-                        pos = pos->s_sibling;
-
-                for ( ; pos; pos = pos->s_sibling) {
-                        const char * name;
-                        int len;
-
-                        name = pos->s_name;
-                        len = strlen(name);
-                        filp->f_pos = ino = pos->s_ino;
+        mutex_lock(&sysfs_mutex);
+        for (pos = sysfs_dir_pos(parent_sd, filp->f_pos, pos);
+             pos;
+             pos = sysfs_dir_next_pos(parent_sd, filp->f_pos, pos)) {
+                const char * name;
+                unsigned int type;
+                int len, ret;
+
+                name = pos->s_name;
+                len = strlen(name);
+                ino = pos->s_ino;
+                type = dt_type(pos);
+                filp->f_pos = ino;
+                filp->private_data = sysfs_get(pos);
 
-                        if (filldir(dirent, name, len, filp->f_pos, ino,
-                                         dt_type(pos)) < 0)
-                                break;
-                }
-                if (!pos)
-                        filp->f_pos = INT_MAX;
                 mutex_unlock(&sysfs_mutex);
+                ret = filldir(dirent, name, len, filp->f_pos, ino, type);
+                mutex_lock(&sysfs_mutex);
+                if (ret < 0)
+                        break;
+        }
+        mutex_unlock(&sysfs_mutex);
+        if ((filp->f_pos > 1) && !pos) { /* EOF */
+                filp->f_pos = INT_MAX;
+                filp->private_data = NULL;
         }
         return 0;
 }
@@ -878,5 +889,6 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
 const struct file_operations sysfs_dir_operations = {
         .read           = generic_read_dir,
         .readdir        = sysfs_readdir,
+        .release        = sysfs_dir_release,
         .llseek         = generic_file_llseek,
 };
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index dc30d9e31683..e222b2582746 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -53,7 +53,7 @@ struct sysfs_buffer {
         size_t                  count;
         loff_t                  pos;
         char                    * page;
-        struct sysfs_ops        * ops;
+        const struct sysfs_ops  * ops;
         struct mutex            mutex;
         int                     needs_read_fill;
         int                     event;
@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
 {
         struct sysfs_dirent *attr_sd = dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-        struct sysfs_ops * ops = buffer->ops;
+        const struct sysfs_ops * ops = buffer->ops;
         int ret = 0;
         ssize_t count;
 
@@ -85,13 +85,13 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
                 return -ENOMEM;
 
         /* need attr_sd for attr and ops, its parent for kobj */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -ENODEV;
 
         buffer->event = atomic_read(&attr_sd->s_attr.open->event);
         count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 
         /*
          * The code works fine with PAGE_SIZE return but it's likely to
@@ -199,16 +199,16 @@ flush_write_buffer(struct dentry * dentry, struct sysfs_buffer * buffer, size_t
 {
         struct sysfs_dirent *attr_sd = dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-        struct sysfs_ops * ops = buffer->ops;
+        const struct sysfs_ops * ops = buffer->ops;
         int rc;
 
         /* need attr_sd for attr and ops, its parent for kobj */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -ENODEV;
 
         rc = ops->store(kobj, attr_sd->s_attr.attr, buffer->page, count);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 
         return rc;
 }
@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
         struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
         struct sysfs_buffer *buffer;
-        struct sysfs_ops *ops;
+        const struct sysfs_ops *ops;
         int error = -EACCES;
         char *p;
 
@@ -344,7 +344,7 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
                 memmove(last_sysfs_file, p, strlen(p) + 1);
 
         /* need attr_sd for attr and ops, its parent for kobj */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 return -ENODEV;
 
         /* every kobject with an attribute needs a ktype assigned */
@@ -393,13 +393,13 @@ static int sysfs_open_file(struct inode *inode, struct file *file)
                 goto err_free;
 
         /* open succeeded, put active references */
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return 0;
 
  err_free:
         kfree(buffer);
  err_out:
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
         return error;
 }
 
@@ -437,12 +437,12 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
         struct sysfs_open_dirent *od = attr_sd->s_attr.open;
 
         /* need parent for the kobj, grab both */
-        if (!sysfs_get_active_two(attr_sd))
+        if (!sysfs_get_active(attr_sd))
                 goto trigger;
 
         poll_wait(filp, &od->poll, wait);
 
-        sysfs_put_active_two(attr_sd);
+        sysfs_put_active(attr_sd);
 
         if (buffer->event != atomic_read(&od->event))
                 goto trigger;
@@ -509,6 +509,7 @@ int sysfs_add_file_mode(struct sysfs_dirent *dir_sd,
         if (!sd)
                 return -ENOMEM;
         sd->s_attr.attr = (void *)attr;
+        sysfs_dirent_init_lockdep(sd);
 
         sysfs_addrm_start(&acxt, dir_sd);
         rc = sysfs_add_one(&acxt, sd);
@@ -542,6 +543,18 @@ int sysfs_create_file(struct kobject * kobj, const struct attribute * attr)
 
 }
 
+int sysfs_create_files(struct kobject *kobj, const struct attribute **ptr)
+{
+        int err = 0;
+        int i;
+
+        for (i = 0; ptr[i] && !err; i++)
+                err = sysfs_create_file(kobj, ptr[i]);
+        if (err)
+                while (--i >= 0)
+                        sysfs_remove_file(kobj, ptr[i]);
+        return err;
+}
 
 /**
  * sysfs_add_file_to_group - add an attribute file to a pre-existing group.
@@ -614,6 +627,12 @@ void sysfs_remove_file(struct kobject * kobj, const struct attribute * attr)
         sysfs_hash_and_remove(kobj->sd, attr->name);
 }
 
+void sysfs_remove_files(struct kobject * kobj, const struct attribute **ptr)
+{
+        int i;
+        for (i = 0; ptr[i]; i++)
+                sysfs_remove_file(kobj, ptr[i]);
+}
 
 /**
  * sysfs_remove_file_from_group - remove an attribute file from a group.
@@ -732,3 +751,5 @@ EXPORT_SYMBOL_GPL(sysfs_schedule_callback);
 
 EXPORT_SYMBOL_GPL(sysfs_create_file);
 EXPORT_SYMBOL_GPL(sysfs_remove_file);
+EXPORT_SYMBOL_GPL(sysfs_remove_files);
+EXPORT_SYMBOL_GPL(sysfs_create_files);
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index 220b758523ae..a4a0a9419711 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -18,6 +18,7 @@
 #include <linux/capability.h>
 #include <linux/errno.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/xattr.h>
 #include <linux/security.h>
 #include "sysfs.h"
@@ -81,24 +82,23 @@ int sysfs_sd_setattr(struct sysfs_dirent *sd, struct iattr * iattr)
                 if (!sd_attrs)
                         return -ENOMEM;
                 sd->s_iattr = sd_attrs;
-        } else {
-                /* attributes were changed at least once in past */
-                iattrs = &sd_attrs->ia_iattr;
-
-                if (ia_valid & ATTR_UID)
-                        iattrs->ia_uid = iattr->ia_uid;
-                if (ia_valid & ATTR_GID)
-                        iattrs->ia_gid = iattr->ia_gid;
-                if (ia_valid & ATTR_ATIME)
-                        iattrs->ia_atime = iattr->ia_atime;
-                if (ia_valid & ATTR_MTIME)
-                        iattrs->ia_mtime = iattr->ia_mtime;
-                if (ia_valid & ATTR_CTIME)
-                        iattrs->ia_ctime = iattr->ia_ctime;
-                if (ia_valid & ATTR_MODE) {
-                        umode_t mode = iattr->ia_mode;
-                        iattrs->ia_mode = sd->s_mode = mode;
-                }
+        }
+        /* attributes were changed at least once in past */
+        iattrs = &sd_attrs->ia_iattr;
+
+        if (ia_valid & ATTR_UID)
+                iattrs->ia_uid = iattr->ia_uid;
+        if (ia_valid & ATTR_GID)
+                iattrs->ia_gid = iattr->ia_gid;
+        if (ia_valid & ATTR_ATIME)
+                iattrs->ia_atime = iattr->ia_atime;
+        if (ia_valid & ATTR_MTIME)
+                iattrs->ia_mtime = iattr->ia_mtime;
+        if (ia_valid & ATTR_CTIME)
+                iattrs->ia_ctime = iattr->ia_ctime;
+        if (ia_valid & ATTR_MODE) {
+                umode_t mode = iattr->ia_mode;
+                iattrs->ia_mode = sd->s_mode = mode;
         }
         return 0;
 }
@@ -112,20 +112,20 @@ int sysfs_setattr(struct dentry *dentry, struct iattr *iattr)
         if (!sd)
                 return -EINVAL;
 
+        mutex_lock(&sysfs_mutex);
         error = inode_change_ok(inode, iattr);
         if (error)
-                return error;
+                goto out;
 
         iattr->ia_valid &= ~ATTR_SIZE; /* ignore size changes */
 
         error = inode_setattr(inode, iattr);
         if (error)
-                return error;
+                goto out;
 
-        mutex_lock(&sysfs_mutex);
         error = sysfs_sd_setattr(sd, iattr);
+out:
         mutex_unlock(&sysfs_mutex);
-
         return error;
 }
 
@@ -284,6 +284,7 @@ static void sysfs_init_inode(struct sysfs_dirent *sd, struct inode *inode)
 
 /**
  *      sysfs_get_inode - get inode for sysfs_dirent
+ *      @sb: super block
  *      @sd: sysfs_dirent to allocate inode for
  *
  *      Get inode for @sd.  If such inode doesn't exist, a new inode
@@ -296,11 +297,11 @@ static void sysfs_init_inode(struct sysfs_dirent *sd, struct inode *inode)
  *      RETURNS:
  *      Pointer to allocated inode on success, NULL on failure.
  */
-struct inode * sysfs_get_inode(struct sysfs_dirent *sd)
+struct inode * sysfs_get_inode(struct super_block *sb, struct sysfs_dirent *sd)
 {
         struct inode *inode;
 
-        inode = iget_locked(sysfs_sb, sd->s_ino);
+        inode = iget_locked(sb, sd->s_ino);
         if (inode && (inode->i_state & I_NEW))
                 sysfs_init_inode(sd, inode);
 
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 49749955ccaf..776137828dca 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -18,12 +18,12 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/magic.h>
+#include <linux/slab.h>
 
 #include "sysfs.h"
 
 
 static struct vfsmount *sysfs_mount;
-struct super_block * sysfs_sb = NULL;
 struct kmem_cache *sysfs_dir_cachep;
 
 static const struct super_operations sysfs_ops = {
@@ -50,11 +50,10 @@ static int sysfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_magic = SYSFS_MAGIC;
         sb->s_op = &sysfs_ops;
         sb->s_time_gran = 1;
-        sysfs_sb = sb;
 
         /* get root inode, initialize and unlock it */
         mutex_lock(&sysfs_mutex);
-        inode = sysfs_get_inode(&sysfs_root);
+        inode = sysfs_get_inode(sb, &sysfs_root);
         mutex_unlock(&sysfs_mutex);
         if (!inode) {
                 pr_debug("sysfs: could not get root inode\n");
diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
index c5eff49fa41b..b93ec51fa7ac 100644
--- a/fs/sysfs/symlink.c
+++ b/fs/sysfs/symlink.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/mount.h>
 #include <linux/module.h>
 #include <linux/kobject.h>
@@ -123,6 +124,44 @@ void sysfs_remove_link(struct kobject * kobj, const char * name)
         sysfs_hash_and_remove(parent_sd, name);
 }
 
+/**
+ *      sysfs_rename_link - rename symlink in object's directory.
+ *      @kobj:  object we're acting for.
+ *      @targ:  object we're pointing to.
+ *      @old:   previous name of the symlink.
+ *      @new:   new name of the symlink.
+ *
+ *      A helper function for the common rename symlink idiom.
+ */
+int sysfs_rename_link(struct kobject *kobj, struct kobject *targ,
+                        const char *old, const char *new)
+{
+        struct sysfs_dirent *parent_sd, *sd = NULL;
+        int result;
+
+        if (!kobj)
+                parent_sd = &sysfs_root;
+        else
+                parent_sd = kobj->sd;
+
+        result = -ENOENT;
+        sd = sysfs_get_dirent(parent_sd, old);
+        if (!sd)
+                goto out;
+
+        result = -EINVAL;
+        if (sysfs_type(sd) != SYSFS_KOBJ_LINK)
+                goto out;
+        if (sd->s_symlink.target_sd->s_dir.kobj != targ)
+                goto out;
+
+        result = sysfs_rename(sd, parent_sd, new);
+
+out:
+        sysfs_put(sd);
+        return result;
+}
+
 static int sysfs_get_target_path(struct sysfs_dirent *parent_sd,
                                  struct sysfs_dirent *target_sd, char *path)
 {
diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index ca52e7b9d8f8..30f5a44fb5d3 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -8,6 +8,7 @@
  * This file is released under the GPLv2.
  */
 
+#include <linux/lockdep.h>
 #include <linux/fs.h>
 
 struct sysfs_open_dirent;
@@ -50,6 +51,9 @@ struct sysfs_inode_attrs {
 struct sysfs_dirent {
         atomic_t                s_count;
         atomic_t                s_active;
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map      dep_map;
+#endif
         struct sysfs_dirent     *s_parent;
         struct sysfs_dirent     *s_sibling;
         const char              *s_name;
@@ -62,8 +66,8 @@ struct sysfs_dirent {
         };
 
         unsigned int            s_flags;
+        unsigned short          s_mode;
         ino_t                   s_ino;
-        umode_t                 s_mode;
         struct sysfs_inode_attrs *s_iattr;
 };
 
@@ -75,6 +79,7 @@ struct sysfs_dirent {
 #define SYSFS_KOBJ_BIN_ATTR             0x0004
 #define SYSFS_KOBJ_LINK                 0x0008
 #define SYSFS_COPY_NAME                 (SYSFS_DIR | SYSFS_KOBJ_LINK)
+#define SYSFS_ACTIVE_REF                (SYSFS_KOBJ_ATTR | SYSFS_KOBJ_BIN_ATTR)
 
 #define SYSFS_FLAG_MASK                 ~SYSFS_TYPE_MASK
 #define SYSFS_FLAG_REMOVED              0x0200
@@ -84,6 +89,20 @@ static inline unsigned int sysfs_type(struct sysfs_dirent *sd)
         return sd->s_flags & SYSFS_TYPE_MASK;
 }
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+#define sysfs_dirent_init_lockdep(sd)                           \
+do {                                                            \
+        struct attribute *attr = sd->s_attr.attr;               \
+        struct lock_class_key *key = attr->key;                 \
+        if (!key)                                               \
+                key = &attr->skey;                              \
+                                                                \
+        lockdep_init_map(&sd->dep_map, "s_active", key, 0);     \
+} while(0)
+#else
+#define sysfs_dirent_init_lockdep(sd) do {} while(0)
+#endif
+
 /*
  * Context structure to be used while adding/removing nodes.
  */
@@ -96,7 +115,6 @@ struct sysfs_addrm_cxt {
  * mount.c
  */
 extern struct sysfs_dirent sysfs_root;
-extern struct super_block *sysfs_sb;
 extern struct kmem_cache *sysfs_dir_cachep;
 
 /*
@@ -109,8 +127,8 @@ extern const struct file_operations sysfs_dir_operations;
 extern const struct inode_operations sysfs_dir_inode_operations;
 
 struct dentry *sysfs_get_dentry(struct sysfs_dirent *sd);
-struct sysfs_dirent *sysfs_get_active_two(struct sysfs_dirent *sd);
-void sysfs_put_active_two(struct sysfs_dirent *sd);
+struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd);
+void sysfs_put_active(struct sysfs_dirent *sd);
 void sysfs_addrm_start(struct sysfs_addrm_cxt *acxt,
                        struct sysfs_dirent *parent_sd);
 int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd);
@@ -153,7 +171,7 @@ static inline void __sysfs_put(struct sysfs_dirent *sd)
 /*
  * inode.c
  */
-struct inode *sysfs_get_inode(struct sysfs_dirent *sd);
+struct inode *sysfs_get_inode(struct super_block *sb, struct sysfs_dirent *sd);
 void sysfs_delete_inode(struct inode *inode);
 int sysfs_sd_setattr(struct sysfs_dirent *sd, struct iattr *iattr);
 int sysfs_permission(struct inode *inode, int mask);
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 9824743832a7..4573734d723d 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -26,6 +26,7 @@
 #include <linux/init.h>
 #include <linux/buffer_head.h>
 #include <linux/vfs.h>
+#include <linux/writeback.h>
 #include <linux/namei.h>
 #include <asm/byteorder.h>
 #include "sysv.h"
@@ -246,7 +247,7 @@ bad_inode:
         return ERR_PTR(-EIO);
 }
 
-int sysv_write_inode(struct inode *inode, int wait)
+static int __sysv_write_inode(struct inode *inode, int wait)
 {
         struct super_block * sb = inode->i_sb;
         struct sysv_sb_info * sbi = SYSV_SB(sb);
@@ -296,9 +297,14 @@ int sysv_write_inode(struct inode *inode, int wait)
         return 0;
 }
 
+int sysv_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __sysv_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int sysv_sync_inode(struct inode *inode)
 {
-        return sysv_write_inode(inode, 1);
+        return __sysv_write_inode(inode, 1);
 }
 
 static void sysv_delete_inode(struct inode *inode)
diff --git a/fs/sysv/sysv.h b/fs/sysv/sysv.h
index 53786eb5cf60..94cb9b4d76c2 100644
--- a/fs/sysv/sysv.h
+++ b/fs/sysv/sysv.h
@@ -142,7 +142,7 @@ extern int __sysv_write_begin(struct file *file, struct address_space *mapping,
 
 /* inode.c */
 extern struct inode *sysv_iget(struct super_block *, unsigned int);
-extern int sysv_write_inode(struct inode *, int);
+extern int sysv_write_inode(struct inode *, struct writeback_control *wbc);
 extern int sysv_sync_inode(struct inode *);
 extern void sysv_set_inode(struct inode *, dev_t);
 extern int sysv_getattr(struct vfsmount *, struct dentry *, struct kstat *);
diff --git a/fs/timerfd.c b/fs/timerfd.c
index 1bfc95ad5f71..98158de91d24 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -14,6 +14,7 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/time.h>
diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
index 4775af401167..37fa7ed062d8 100644
--- a/fs/ubifs/commit.c
+++ b/fs/ubifs/commit.c
@@ -45,6 +45,7 @@
 
 #include <linux/freezer.h>
 #include <linux/kthread.h>
+#include <linux/slab.h>
 #include "ubifs.h"
 
 /**
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 90492327b383..c2a68baa782f 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -34,6 +34,7 @@
 #include <linux/moduleparam.h>
 #include <linux/debugfs.h>
 #include <linux/math64.h>
+#include <linux/slab.h>
 
 #ifdef CONFIG_UBIFS_FS_DEBUG
 
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 552fb0111fff..401e503d44a1 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -1120,7 +1120,7 @@ static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (release)
                 ubifs_release_budget(c, &ino_req);
         if (IS_SYNC(old_inode))
-                err = old_inode->i_sb->s_op->write_inode(old_inode, 1);
+                err = old_inode->i_sb->s_op->write_inode(old_inode, NULL);
         return err;
 
 out_cancel:
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 16a6444330ec..5692cf72b807 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -52,6 +52,7 @@
 #include "ubifs.h"
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 
 static int read_block(struct inode *inode, void *addr, unsigned int block,
                       struct ubifs_data_node *dn)
@@ -1011,7 +1012,7 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)
         /* Is the page fully inside @i_size? */
         if (page->index < end_index) {
                 if (page->index >= synced_i_size >> PAGE_CACHE_SHIFT) {
-                        err = inode->i_sb->s_op->write_inode(inode, 1);
+                        err = inode->i_sb->s_op->write_inode(inode, NULL);
                         if (err)
                                 goto out_unlock;
                         /*
@@ -1039,7 +1040,7 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)
         kunmap_atomic(kaddr, KM_USER0);
 
         if (i_size > synced_i_size) {
-                err = inode->i_sb->s_op->write_inode(inode, 1);
+                err = inode->i_sb->s_op->write_inode(inode, NULL);
                 if (err)
                         goto out_unlock;
         }
@@ -1242,7 +1243,7 @@ static int do_setattr(struct ubifs_info *c, struct inode *inode,
         if (release)
                 ubifs_release_budget(c, &req);
         if (IS_SYNC(inode))
-                err = inode->i_sb->s_op->write_inode(inode, 1);
+                err = inode->i_sb->s_op->write_inode(inode, NULL);
         return err;
 
 out:
@@ -1316,7 +1317,7 @@ int ubifs_fsync(struct file *file, struct dentry *dentry, int datasync)
          * the inode unless this is a 'datasync()' call.
          */
         if (!datasync || (inode->i_state & I_DIRTY_DATASYNC)) {
-                err = inode->i_sb->s_op->write_inode(inode, 1);
+                err = inode->i_sb->s_op->write_inode(inode, NULL);
                 if (err)
                         return err;
         }
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 618c2701d3a7..918d1582ca05 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -53,7 +53,9 @@
  * good, and GC takes extra care when moving them.
  */
 
+#include <linux/slab.h>
 #include <linux/pagemap.h>
+#include <linux/list_sort.h>
 #include "ubifs.h"
 
 /*
@@ -108,101 +110,6 @@ static int switch_gc_head(struct ubifs_info *c)
 }
 
 /**
- * list_sort - sort a list.
- * @priv: private data, passed to @cmp
- * @head: the list to sort
- * @cmp: the elements comparison function
- *
- * This function has been implemented by Mark J Roberts <mjr@znex.org>. It
- * implements "merge sort" which has O(nlog(n)) complexity. The list is sorted
- * in ascending order.
- *
- * The comparison function @cmp is supposed to return a negative value if @a is
- * than @b, and a positive value if @a is greater than @b. If @a and @b are
- * equivalent, then it does not matter what this function returns.
- */
-static void list_sort(void *priv, struct list_head *head,
-                      int (*cmp)(void *priv, struct list_head *a,
-                                 struct list_head *b))
-{
-        struct list_head *p, *q, *e, *list, *tail, *oldhead;
-        int insize, nmerges, psize, qsize, i;
-
-        if (list_empty(head))
-                return;
-
-        list = head->next;
-        list_del(head);
-        insize = 1;
-        for (;;) {
-                p = oldhead = list;
-                list = tail = NULL;
-                nmerges = 0;
-
-                while (p) {
-                        nmerges++;
-                        q = p;
-                        psize = 0;
-                        for (i = 0; i < insize; i++) {
-                                psize++;
-                                q = q->next == oldhead ? NULL : q->next;
-                                if (!q)
-                                        break;
-                        }
-
-                        qsize = insize;
-                        while (psize > 0 || (qsize > 0 && q)) {
-                                if (!psize) {
-                                        e = q;
-                                        q = q->next;
-                                        qsize--;
-                                        if (q == oldhead)
-                                                q = NULL;
-                                } else if (!qsize || !q) {
-                                        e = p;
-                                        p = p->next;
-                                        psize--;
-                                        if (p == oldhead)
-                                                p = NULL;
-                                } else if (cmp(priv, p, q) <= 0) {
-                                        e = p;
-                                        p = p->next;
-                                        psize--;
-                                        if (p == oldhead)
-                                                p = NULL;
-                                } else {
-                                        e = q;
-                                        q = q->next;
-                                        qsize--;
-                                        if (q == oldhead)
-                                                q = NULL;
-                                }
-                                if (tail)
-                                        tail->next = e;
-                                else
-                                        list = e;
-                                e->prev = tail;
-                                tail = e;
-                        }
-                        p = q;
-                }
-
-                tail->next = list;
-                list->prev = tail;
-
-                if (nmerges <= 1)
-                        break;
-
-                insize *= 2;
-        }
-
-        head->next = list;
-        head->prev = list->prev;
-        list->prev->next = head;
-        list->prev = head;
-}
-
-/**
  * data_nodes_cmp - compare 2 data nodes.
  * @priv: UBIFS file-system description object
  * @a: first data node
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index e589fedaf1ef..77d5cf4a7547 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -51,6 +51,7 @@
  */
 
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include "ubifs.h"
 
 /**
diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index b2792e84d245..ad7f67b827ea 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -46,6 +46,7 @@
 #include "ubifs.h"
 #include <linux/crc16.h>
 #include <linux/math64.h>
+#include <linux/slab.h>
 
 /**
  * do_calc_lpt_geom - calculate sizes for the LPT area.
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 8cbfb8248025..13cb7a4237bf 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -26,6 +26,7 @@
  */
 
 #include <linux/crc16.h>
+#include <linux/slab.h>
 #include "ubifs.h"
 
 /**
diff --git a/fs/ubifs/recovery.c b/fs/ubifs/recovery.c
index 868a55ee080f..109c6ea03bb5 100644
--- a/fs/ubifs/recovery.c
+++ b/fs/ubifs/recovery.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include "ubifs.h"
 
 /**
diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
index 57085e43320f..96cb62c8a9dd 100644
--- a/fs/ubifs/sb.c
+++ b/fs/ubifs/sb.c
@@ -27,6 +27,7 @@
  */
 
 #include "ubifs.h"
+#include <linux/slab.h>
 #include <linux/random.h>
 #include <linux/math64.h>
 
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 43f9d19a6f33..4d2f2157dd3f 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -283,7 +283,7 @@ static void ubifs_destroy_inode(struct inode *inode)
 /*
  * Note, Linux write-back code calls this without 'i_mutex'.
  */
-static int ubifs_write_inode(struct inode *inode, int wait)
+static int ubifs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int err = 0;
         struct ubifs_info *c = inode->i_sb->s_fs_info;
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index e5b1a7d00fa0..2194915220e5 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -31,6 +31,7 @@
  */
 
 #include <linux/crc32.h>
+#include <linux/slab.h>
 #include "ubifs.h"
 
 /*
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index b2d976366a46..bd2542dad014 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -28,6 +28,7 @@
 #include <linux/fs.h>
 #include <linux/err.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index 195830f47569..c74400f88fe0 100644
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -56,6 +56,7 @@
  */
 
 #include "ubifs.h"
+#include <linux/slab.h>
 #include <linux/xattr.h>
 #include <linux/posix_acl_xattr.h>
 
diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index 82372e332f08..9a9378b4eb5a 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -31,55 +31,8 @@
 #define udf_clear_bit(nr, addr) ext2_clear_bit(nr, addr)
 #define udf_set_bit(nr, addr) ext2_set_bit(nr, addr)
 #define udf_test_bit(nr, addr) ext2_test_bit(nr, addr)
-#define udf_find_first_one_bit(addr, size) find_first_one_bit(addr, size)
 #define udf_find_next_one_bit(addr, size, offset) \
-                find_next_one_bit(addr, size, offset)
-
-#define leBPL_to_cpup(x) leNUM_to_cpup(BITS_PER_LONG, x)
-#define leNUM_to_cpup(x, y) xleNUM_to_cpup(x, y)
-#define xleNUM_to_cpup(x, y) (le ## x ## _to_cpup(y))
-#define uintBPL_t uint(BITS_PER_LONG)
-#define uint(x) xuint(x)
-#define xuint(x) __le ## x
-
-static inline int find_next_one_bit(void *addr, int size, int offset)
-{
-        uintBPL_t *p = ((uintBPL_t *) addr) + (offset / BITS_PER_LONG);
-        int result = offset & ~(BITS_PER_LONG - 1);
-        unsigned long tmp;
-
-        if (offset >= size)
-                return size;
-        size -= result;
-        offset &= (BITS_PER_LONG - 1);
-        if (offset) {
-                tmp = leBPL_to_cpup(p++);
-                tmp &= ~0UL << offset;
-                if (size < BITS_PER_LONG)
-                        goto found_first;
-                if (tmp)
-                        goto found_middle;
-                size -= BITS_PER_LONG;
-                result += BITS_PER_LONG;
-        }
-        while (size & ~(BITS_PER_LONG - 1)) {
-                tmp = leBPL_to_cpup(p++);
-                if (tmp)
-                        goto found_middle;
-                result += BITS_PER_LONG;
-                size -= BITS_PER_LONG;
-        }
-        if (!size)
-                return result;
-        tmp = leBPL_to_cpup(p);
-found_first:
-        tmp &= ~0UL >> (BITS_PER_LONG - size);
-found_middle:
-        return result + ffz(~tmp);
-}
-
-#define find_first_one_bit(addr, size)\
-        find_next_one_bit((addr), (size), 0)
+                ext2_find_next_bit(addr, size, offset)
 
 static int read_block_bitmap(struct super_block *sb,
                              struct udf_bitmap *bitmap, unsigned int block,
@@ -172,9 +125,8 @@ static void udf_bitmap_free_blocks(struct super_block *sb,
 
         mutex_lock(&sbi->s_alloc_mutex);
         partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-        if (bloc->logicalBlockNum < 0 ||
-            (bloc->logicalBlockNum + count) >
-                partmap->s_partition_len) {
+        if (bloc->logicalBlockNum + count < count ||
+            (bloc->logicalBlockNum + count) > partmap->s_partition_len) {
                 udf_debug("%d < %d || %d + %d > %d\n",
                           bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
                           count, partmap->s_partition_len);
@@ -208,7 +160,7 @@ static void udf_bitmap_free_blocks(struct super_block *sb,
                                         ((char *)bh->b_data)[(bit + i) >> 3]);
                         } else {
                                 if (inode)
-                                        vfs_dq_free_block(inode, 1);
+                                        dquot_free_block(inode, 1);
                                 udf_add_free_space(sb, sbi->s_partition, 1);
                         }
                 }
@@ -260,11 +212,11 @@ static int udf_bitmap_prealloc_blocks(struct super_block *sb,
                 while (bit < (sb->s_blocksize << 3) && block_count > 0) {
                         if (!udf_test_bit(bit, bh->b_data))
                                 goto out;
-                        else if (vfs_dq_prealloc_block(inode, 1))
+                        else if (dquot_prealloc_block(inode, 1))
                                 goto out;
                         else if (!udf_clear_bit(bit, bh->b_data)) {
                                 udf_debug("bit already cleared for block %d\n", bit);
-                                vfs_dq_free_block(inode, 1);
+                                dquot_free_block(inode, 1);
                                 goto out;
                         }
                         block_count--;
@@ -390,10 +342,14 @@ got_block:
         /*
          * Check quota for allocation of this block.
          */
-        if (inode && vfs_dq_alloc_block(inode, 1)) {
-                mutex_unlock(&sbi->s_alloc_mutex);
-                *err = -EDQUOT;
-                return 0;
+        if (inode) {
+                int ret = dquot_alloc_block(inode, 1);
+
+                if (ret) {
+                        mutex_unlock(&sbi->s_alloc_mutex);
+                        *err = ret;
+                        return 0;
+                }
         }
 
         newblock = bit + (block_group << (sb->s_blocksize_bits + 3)) -
@@ -436,9 +392,8 @@ static void udf_table_free_blocks(struct super_block *sb,
 
         mutex_lock(&sbi->s_alloc_mutex);
         partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-        if (bloc->logicalBlockNum < 0 ||
-            (bloc->logicalBlockNum + count) >
-                partmap->s_partition_len) {
+        if (bloc->logicalBlockNum + count < count ||
+            (bloc->logicalBlockNum + count) > partmap->s_partition_len) {
                 udf_debug("%d < %d || %d + %d > %d\n",
                           bloc->logicalBlockNum, 0, bloc->logicalBlockNum, count,
                           partmap->s_partition_len);
@@ -449,7 +404,7 @@ static void udf_table_free_blocks(struct super_block *sb,
         /* We do this up front - There are some error conditions that
            could occure, but.. oh well */
         if (inode)
-                vfs_dq_free_block(inode, count);
+                dquot_free_block(inode, count);
         udf_add_free_space(sb, sbi->s_partition, count);
 
         start = bloc->logicalBlockNum + offset;
@@ -547,7 +502,7 @@ static void udf_table_free_blocks(struct super_block *sb,
                 }
 
                 if (epos.offset + (2 * adsize) > sb->s_blocksize) {
-                        char *sptr, *dptr;
+                        unsigned char *sptr, *dptr;
                         int loffset;
 
                         brelse(oepos.bh);
@@ -694,7 +649,7 @@ static int udf_table_prealloc_blocks(struct super_block *sb,
                 epos.offset -= adsize;
 
                 alloc_count = (elen >> sb->s_blocksize_bits);
-                if (inode && vfs_dq_prealloc_block(inode,
+                if (inode && dquot_prealloc_block(inode,
                         alloc_count > block_count ? block_count : alloc_count))
                         alloc_count = 0;
                 else if (alloc_count > block_count) {
@@ -797,12 +752,13 @@ static int udf_table_new_block(struct super_block *sb,
         newblock = goal_eloc.logicalBlockNum;
         goal_eloc.logicalBlockNum++;
         goal_elen -= sb->s_blocksize;
-
-        if (inode && vfs_dq_alloc_block(inode, 1)) {
-                brelse(goal_epos.bh);
-                mutex_unlock(&sbi->s_alloc_mutex);
-                *err = -EDQUOT;
-                return 0;
+        if (inode) {
+                *err = dquot_alloc_block(inode, 1);
+                if (*err) {
+                        brelse(goal_epos.bh);
+                        mutex_unlock(&sbi->s_alloc_mutex);
+                        return 0;
+                }
         }
 
         if (goal_elen)
diff --git a/fs/udf/dir.c b/fs/udf/dir.c
index 61d9a76a3a69..f0f2a436251e 100644
--- a/fs/udf/dir.c
+++ b/fs/udf/dir.c
@@ -45,8 +45,8 @@ static int do_udf_readdir(struct inode *dir, struct file *filp,
         int block, iblock;
         loff_t nf_pos = (filp->f_pos - 1) << 2;
         int flen;
-        char *fname = NULL;
-        char *nameptr;
+        unsigned char *fname = NULL;
+        unsigned char *nameptr;
         uint16_t liu;
         uint8_t lfi;
         loff_t size = udf_ext0_offset(dir) + dir->i_size;
diff --git a/fs/udf/file.c b/fs/udf/file.c
index f311d509b6a3..4b6a46ccbf46 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -34,6 +34,7 @@
 #include <linux/errno.h>
 #include <linux/smp_lock.h>
 #include <linux/pagemap.h>
+#include <linux/quotaops.h>
 #include <linux/buffer_head.h>
 #include <linux/aio.h>
 
@@ -207,7 +208,7 @@ const struct file_operations udf_file_operations = {
         .read                   = do_sync_read,
         .aio_read               = generic_file_aio_read,
         .ioctl                  = udf_ioctl,
-        .open                   = generic_file_open,
+        .open                   = dquot_file_open,
         .mmap                   = generic_file_mmap,
         .write                  = do_sync_write,
         .aio_write              = udf_file_aio_write,
@@ -217,6 +218,29 @@ const struct file_operations udf_file_operations = {
         .llseek                 = generic_file_llseek,
 };
 
+int udf_setattr(struct dentry *dentry, struct iattr *iattr)
+{
+        struct inode *inode = dentry->d_inode;
+        int error;
+
+        error = inode_change_ok(inode, iattr);
+        if (error)
+                return error;
+
+        if (iattr->ia_valid & ATTR_SIZE)
+                dquot_initialize(inode);
+
+        if ((iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) ||
+            (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid)) {
+                error = dquot_transfer(inode, iattr);
+                if (error)
+                        return error;
+        }
+
+        return inode_setattr(inode, iattr);
+}
+
 const struct inode_operations udf_file_inode_operations = {
-        .truncate = udf_truncate,
+        .truncate               = udf_truncate,
+        .setattr                = udf_setattr,
 };
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index c10fa39f97e2..fb68c9cd0c3e 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -36,8 +36,8 @@ void udf_free_inode(struct inode *inode)
          * Note: we must free any quota before locking the superblock,
          * as writing the quota to disk may need the lock as well.
          */
-        vfs_dq_free_inode(inode);
-        vfs_dq_drop(inode);
+        dquot_free_inode(inode);
+        dquot_drop(inode);
 
         clear_inode(inode);
 
@@ -61,7 +61,7 @@ struct inode *udf_new_inode(struct inode *dir, int mode, int *err)
         struct super_block *sb = dir->i_sb;
         struct udf_sb_info *sbi = UDF_SB(sb);
         struct inode *inode;
-        int block;
+        int block, ret;
         uint32_t start = UDF_I(dir)->i_location.logicalBlockNum;
         struct udf_inode_info *iinfo;
         struct udf_inode_info *dinfo = UDF_I(dir);
@@ -153,12 +153,14 @@ struct inode *udf_new_inode(struct inode *dir, int mode, int *err)
         insert_inode_hash(inode);
         mark_inode_dirty(inode);
 
-        if (vfs_dq_alloc_inode(inode)) {
-                vfs_dq_drop(inode);
+        dquot_initialize(inode);
+        ret = dquot_alloc_inode(inode);
+        if (ret) {
+                dquot_drop(inode);
                 inode->i_flags |= S_NOQUOTA;
                 inode->i_nlink = 0;
                 iput(inode);
-                *err = -EDQUOT;
+                *err = ret;
                 return NULL;
         }
 
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index f90231eb2916..8a3fbd177cab 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -36,6 +36,7 @@
 #include <linux/pagemap.h>
 #include <linux/buffer_head.h>
 #include <linux/writeback.h>
+#include <linux/quotaops.h>
 #include <linux/slab.h>
 #include <linux/crc-itu-t.h>
 
@@ -70,6 +71,9 @@ static int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
 
 void udf_delete_inode(struct inode *inode)
 {
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
+
         truncate_inode_pages(&inode->i_data, 0);
 
         if (is_bad_inode(inode))
@@ -102,12 +106,14 @@ void udf_clear_inode(struct inode *inode)
         if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
             inode->i_size != iinfo->i_lenExtents) {
                 printk(KERN_WARNING "UDF-fs (%s): Inode %lu (mode %o) has "
-                        "inode size %llu different from extent lenght %llu. "
+                        "inode size %llu different from extent length %llu. "
                         "Filesystem need not be standards compliant.\n",
                         inode->i_sb->s_id, inode->i_ino, inode->i_mode,
                         (unsigned long long)inode->i_size,
                         (unsigned long long)iinfo->i_lenExtents);
         }
+
+        dquot_drop(inode);
         kfree(iinfo->i_ext.i_data);
         iinfo->i_ext.i_data = NULL;
 }
@@ -1308,7 +1314,7 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
                 break;
         case ICBTAG_FILE_TYPE_SYMLINK:
                 inode->i_data.a_ops = &udf_symlink_aops;
-                inode->i_op = &page_symlink_inode_operations;
+                inode->i_op = &udf_symlink_inode_operations;
                 inode->i_mode = S_IFLNK | S_IRWXUGO;
                 break;
         case ICBTAG_FILE_TYPE_MAIN:
@@ -1373,12 +1379,12 @@ static mode_t udf_convert_permissions(struct fileEntry *fe)
         return mode;
 }
 
-int udf_write_inode(struct inode *inode, int sync)
+int udf_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int ret;
 
         lock_kernel();
-        ret = udf_update_inode(inode, sync);
+        ret = udf_update_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
         unlock_kernel();
 
         return ret;
@@ -1402,20 +1408,19 @@ static int udf_update_inode(struct inode *inode, int do_sync)
         unsigned char blocksize_bits = inode->i_sb->s_blocksize_bits;
         struct udf_inode_info *iinfo = UDF_I(inode);
 
-        bh = udf_tread(inode->i_sb,
-                        udf_get_lb_pblock(inode->i_sb,
-                                          &iinfo->i_location, 0));
+        bh = udf_tgetblk(inode->i_sb,
+                        udf_get_lb_pblock(inode->i_sb, &iinfo->i_location, 0));
         if (!bh) {
-                udf_debug("bread failure\n");
-                return -EIO;
+                udf_debug("getblk failure\n");
+                return -ENOMEM;
         }
 
-        memset(bh->b_data, 0x00, inode->i_sb->s_blocksize);
-
+        lock_buffer(bh);
+        memset(bh->b_data, 0, inode->i_sb->s_blocksize);
         fe = (struct fileEntry *)bh->b_data;
         efe = (struct extendedFileEntry *)bh->b_data;
 
-        if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_USE)) {
+        if (iinfo->i_use) {
                 struct unallocSpaceEntry *use =
                         (struct unallocSpaceEntry *)bh->b_data;
 
@@ -1423,20 +1428,18 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                 memcpy(bh->b_data + sizeof(struct unallocSpaceEntry),
                        iinfo->i_ext.i_data, inode->i_sb->s_blocksize -
                                         sizeof(struct unallocSpaceEntry));
+                use->descTag.tagIdent = cpu_to_le16(TAG_IDENT_USE);
+                use->descTag.tagLocation =
+                                cpu_to_le32(iinfo->i_location.logicalBlockNum);
                 crclen = sizeof(struct unallocSpaceEntry) +
                                 iinfo->i_lenAlloc - sizeof(struct tag);
-                use->descTag.tagLocation = cpu_to_le32(
-                                                iinfo->i_location.
-                                                        logicalBlockNum);
                 use->descTag.descCRCLength = cpu_to_le16(crclen);
                 use->descTag.descCRC = cpu_to_le16(crc_itu_t(0, (char *)use +
                                                            sizeof(struct tag),
                                                            crclen));
                 use->descTag.tagChecksum = udf_tag_checksum(&use->descTag);
 
-                mark_buffer_dirty(bh);
-                brelse(bh);
-                return err;
+                goto out;
         }
 
         if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_UID_FORGET))
@@ -1591,18 +1594,21 @@ static int udf_update_inode(struct inode *inode, int do_sync)
         fe->descTag.tagSerialNum = cpu_to_le16(sbi->s_serial_number);
         fe->descTag.tagLocation = cpu_to_le32(
                                         iinfo->i_location.logicalBlockNum);
-        crclen += iinfo->i_lenEAttr + iinfo->i_lenAlloc -
-                                                                sizeof(struct tag);
+        crclen += iinfo->i_lenEAttr + iinfo->i_lenAlloc - sizeof(struct tag);
         fe->descTag.descCRCLength = cpu_to_le16(crclen);
         fe->descTag.descCRC = cpu_to_le16(crc_itu_t(0, (char *)fe + sizeof(struct tag),
                                                   crclen));
         fe->descTag.tagChecksum = udf_tag_checksum(&fe->descTag);
 
+out:
+        set_buffer_uptodate(bh);
+        unlock_buffer(bh);
+
         /* write the data blocks */
         mark_buffer_dirty(bh);
         if (do_sync) {
                 sync_dirty_buffer(bh);
-                if (buffer_req(bh) && !buffer_uptodate(bh)) {
+                if (buffer_write_io_error(bh)) {
                         printk(KERN_WARNING "IO error syncing udf inode "
                                 "[%s:%08lx]\n", inode->i_sb->s_id,
                                 inode->i_ino);
@@ -1672,7 +1678,7 @@ int8_t udf_add_aext(struct inode *inode, struct extent_position *epos,
                 return -1;
 
         if (epos->offset + (2 * adsize) > inode->i_sb->s_blocksize) {
-                char *sptr, *dptr;
+                unsigned char *sptr, *dptr;
                 struct buffer_head *nbh;
                 int err, loffset;
                 struct kernel_lb_addr obloc = epos->block;
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index cd2115060fdc..75816025f95f 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -34,8 +34,8 @@
 #include <linux/crc-itu-t.h>
 #include <linux/exportfs.h>
 
-static inline int udf_match(int len1, const char *name1, int len2,
-                            const char *name2)
+static inline int udf_match(int len1, const unsigned char *name1, int len2,
+                            const unsigned char *name2)
 {
         if (len1 != len2)
                 return 0;
@@ -142,15 +142,15 @@ int udf_write_fi(struct inode *inode, struct fileIdentDesc *cfi,
 }
 
 static struct fileIdentDesc *udf_find_entry(struct inode *dir,
-                                            struct qstr *child,
+                                            const struct qstr *child,
                                             struct udf_fileident_bh *fibh,
                                             struct fileIdentDesc *cfi)
 {
         struct fileIdentDesc *fi = NULL;
         loff_t f_pos;
         int block, flen;
-        char *fname = NULL;
-        char *nameptr;
+        unsigned char *fname = NULL;
+        unsigned char *nameptr;
         uint8_t lfi;
         uint16_t liu;
         loff_t size;
@@ -308,7 +308,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
 {
         struct super_block *sb = dir->i_sb;
         struct fileIdentDesc *fi = NULL;
-        char *name = NULL;
+        unsigned char *name = NULL;
         int namelen;
         loff_t f_pos;
         loff_t size = udf_ext0_offset(dir) + dir->i_size;
@@ -563,6 +563,8 @@ static int udf_create(struct inode *dir, struct dentry *dentry, int mode,
         int err;
         struct udf_inode_info *iinfo;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         inode = udf_new_inode(dir, mode, &err);
         if (!inode) {
@@ -616,6 +618,8 @@ static int udf_mknod(struct inode *dir, struct dentry *dentry, int mode,
         if (!old_valid_dev(rdev))
                 return -EINVAL;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         err = -EIO;
         inode = udf_new_inode(dir, mode, &err);
@@ -662,6 +666,8 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         struct udf_inode_info *dinfo = UDF_I(dir);
         struct udf_inode_info *iinfo;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         err = -EMLINK;
         if (dir->i_nlink >= (256 << sizeof(dir->i_nlink)) - 1)
@@ -799,6 +805,8 @@ static int udf_rmdir(struct inode *dir, struct dentry *dentry)
         struct fileIdentDesc *fi, cfi;
         struct kernel_lb_addr tloc;
 
+        dquot_initialize(dir);
+
         retval = -ENOENT;
         lock_kernel();
         fi = udf_find_entry(dir, &dentry->d_name, &fibh, &cfi);
@@ -845,6 +853,8 @@ static int udf_unlink(struct inode *dir, struct dentry *dentry)
         struct fileIdentDesc cfi;
         struct kernel_lb_addr tloc;
 
+        dquot_initialize(dir);
+
         retval = -ENOENT;
         lock_kernel();
         fi = udf_find_entry(dir, &dentry->d_name, &fibh, &cfi);
@@ -885,20 +895,22 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
 {
         struct inode *inode;
         struct pathComponent *pc;
-        char *compstart;
+        const char *compstart;
         struct udf_fileident_bh fibh;
         struct extent_position epos = {};
         int eoffset, elen = 0;
         struct fileIdentDesc *fi;
         struct fileIdentDesc cfi;
-        char *ea;
+        uint8_t *ea;
         int err;
         int block;
-        char *name = NULL;
+        unsigned char *name = NULL;
         int namelen;
         struct buffer_head *bh;
         struct udf_inode_info *iinfo;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         inode = udf_new_inode(dir, S_IFLNK, &err);
         if (!inode)
@@ -913,7 +925,7 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
         iinfo = UDF_I(inode);
         inode->i_mode = S_IFLNK | S_IRWXUGO;
         inode->i_data.a_ops = &udf_symlink_aops;
-        inode->i_op = &page_symlink_inode_operations;
+        inode->i_op = &udf_symlink_inode_operations;
 
         if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
                 struct kernel_lb_addr eloc;
@@ -970,7 +982,7 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
 
                 pc = (struct pathComponent *)(ea + elen);
 
-                compstart = (char *)symname;
+                compstart = symname;
 
                 do {
                         symname++;
@@ -1069,6 +1081,8 @@ static int udf_link(struct dentry *old_dentry, struct inode *dir,
         int err;
         struct buffer_head *bh;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         if (inode->i_nlink >= (256 << sizeof(inode->i_nlink)) - 1) {
                 unlock_kernel();
@@ -1131,6 +1145,9 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct kernel_lb_addr tloc;
         struct udf_inode_info *old_iinfo = UDF_I(old_inode);
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         lock_kernel();
         ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
         if (ofi) {
@@ -1376,6 +1393,7 @@ const struct export_operations udf_export_ops = {
 const struct inode_operations udf_dir_inode_operations = {
         .lookup                         = udf_lookup,
         .create                         = udf_create,
+        .setattr                        = udf_setattr,
         .link                           = udf_link,
         .unlink                         = udf_unlink,
         .symlink                        = udf_symlink,
@@ -1384,3 +1402,9 @@ const struct inode_operations udf_dir_inode_operations = {
         .mknod                          = udf_mknod,
         .rename                         = udf_rename,
 };
+const struct inode_operations udf_symlink_inode_operations = {
+        .readlink       = generic_readlink,
+        .follow_link    = page_follow_link_light,
+        .put_link       = page_put_link,
+        .setattr        = udf_setattr,
+};
diff --git a/fs/udf/partition.c b/fs/udf/partition.c
index 4b540ee632d5..745eb209be0c 100644
--- a/fs/udf/partition.c
+++ b/fs/udf/partition.c
@@ -24,7 +24,6 @@
 
 #include <linux/fs.h>
 #include <linux/string.h>
-#include <linux/slab.h>
 #include <linux/buffer_head.h>
 
 uint32_t udf_get_pblock(struct super_block *sb, uint32_t block,
diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
index c3265e1385d4..16064787d2b7 100644
--- a/fs/udf/symlink.c
+++ b/fs/udf/symlink.c
@@ -26,18 +26,17 @@
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/stat.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include "udf_i.h"
 
-static void udf_pc_to_char(struct super_block *sb, char *from, int fromlen,
-                           char *to)
+static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+                           int fromlen, unsigned char *to)
 {
         struct pathComponent *pc;
         int elen = 0;
-        char *p = to;
+        unsigned char *p = to;
 
         while (elen < fromlen) {
                 pc = (struct pathComponent *)(from + elen);
@@ -75,9 +74,9 @@ static int udf_symlink_filler(struct file *file, struct page *page)
 {
         struct inode *inode = page->mapping->host;
         struct buffer_head *bh = NULL;
-        char *symlink;
+        unsigned char *symlink;
         int err = -EIO;
-        char *p = kmap(page);
+        unsigned char *p = kmap(page);
         struct udf_inode_info *iinfo;
 
         lock_kernel();
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 8d46f4294ee7..702a1148e702 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -76,6 +76,7 @@ extern const struct inode_operations udf_dir_inode_operations;
 extern const struct file_operations udf_dir_operations;
 extern const struct inode_operations udf_file_inode_operations;
 extern const struct file_operations udf_file_operations;
+extern const struct inode_operations udf_symlink_inode_operations;
 extern const struct address_space_operations udf_aops;
 extern const struct address_space_operations udf_adinicb_aops;
 extern const struct address_space_operations udf_symlink_aops;
@@ -131,7 +132,7 @@ extern int udf_write_fi(struct inode *inode, struct fileIdentDesc *,
 /* file.c */
 extern int udf_ioctl(struct inode *, struct file *, unsigned int,
                      unsigned long);
-
+extern int udf_setattr(struct dentry *dentry, struct iattr *iattr);
 /* inode.c */
 extern struct inode *udf_iget(struct super_block *, struct kernel_lb_addr *);
 extern int udf_sync_inode(struct inode *);
@@ -142,7 +143,7 @@ extern void udf_truncate(struct inode *);
 extern void udf_read_inode(struct inode *);
 extern void udf_delete_inode(struct inode *);
 extern void udf_clear_inode(struct inode *);
-extern int udf_write_inode(struct inode *, int);
+extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
 extern long udf_block_map(struct inode *, sector_t);
 extern int udf_extend_file(struct inode *, struct extent_position *,
                            struct kernel_long_ad *, sector_t);
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index cefa8c8913e6..d03a90b6ad69 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -24,6 +24,7 @@
 #include <linux/string.h>       /* for memset */
 #include <linux/nls.h>
 #include <linux/crc-itu-t.h>
+#include <linux/slab.h>
 
 #include "udf_sb.h"
 
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index 54c16ec95dff..5cfa4d85ccf2 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -85,7 +85,7 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
                                    "bit already cleared for fragment %u", i);
         }
         
-        vfs_dq_free_block(inode, count);
+        dquot_free_block(inode, count);
 
         
         fs32_add(sb, &ucg->cg_cs.cs_nffree, count);
@@ -195,7 +195,7 @@ do_more:
                 ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
                 if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
                         ufs_clusteracct (sb, ucpi, blkno, 1);
-                vfs_dq_free_block(inode, uspi->s_fpb);
+                dquot_free_block(inode, uspi->s_fpb);
 
                 fs32_add(sb, &ucg->cg_cs.cs_nbfree, 1);
                 uspi->cs_total.cs_nbfree++;
@@ -511,6 +511,7 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
         struct ufs_cg_private_info * ucpi;
         struct ufs_cylinder_group * ucg;
         unsigned cgno, fragno, fragoff, count, fragsize, i;
+        int ret;
         
         UFSD("ENTER, fragment %llu, oldcount %u, newcount %u\n",
              (unsigned long long)fragment, oldcount, newcount);
@@ -556,8 +557,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
                 fs32_add(sb, &ucg->cg_frsum[fragsize - count], 1);
         for (i = oldcount; i < newcount; i++)
                 ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i);
-        if (vfs_dq_alloc_block(inode, count)) {
-                *err = -EDQUOT;
+        ret = dquot_alloc_block(inode, count);
+        if (ret) {
+                *err = ret;
                 return 0;
         }
 
@@ -596,6 +598,7 @@ static u64 ufs_alloc_fragments(struct inode *inode, unsigned cgno,
         struct ufs_cylinder_group * ucg;
         unsigned oldcg, i, j, k, allocsize;
         u64 result;
+        int ret;
         
         UFSD("ENTER, ino %lu, cgno %u, goal %llu, count %u\n",
              inode->i_ino, cgno, (unsigned long long)goal, count);
@@ -664,7 +667,7 @@ cg_found:
                 for (i = count; i < uspi->s_fpb; i++)
                         ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i);
                 i = uspi->s_fpb - count;
-                vfs_dq_free_block(inode, i);
+                dquot_free_block(inode, i);
 
                 fs32_add(sb, &ucg->cg_cs.cs_nffree, i);
                 uspi->cs_total.cs_nffree += i;
@@ -676,8 +679,9 @@ cg_found:
         result = ufs_bitmap_search (sb, ucpi, goal, allocsize);
         if (result == INVBLOCK)
                 return 0;
-        if (vfs_dq_alloc_block(inode, count)) {
-                *err = -EDQUOT;
+        ret = dquot_alloc_block(inode, count);
+        if (ret) {
+                *err = ret;
                 return 0;
         }
         for (i = 0; i < count; i++)
@@ -714,6 +718,7 @@ static u64 ufs_alloccg_block(struct inode *inode,
         struct ufs_super_block_first * usb1;
         struct ufs_cylinder_group * ucg;
         u64 result, blkno;
+        int ret;
 
         UFSD("ENTER, goal %llu\n", (unsigned long long)goal);
 
@@ -747,8 +752,9 @@ gotit:
         ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
         if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
                 ufs_clusteracct (sb, ucpi, blkno, -1);
-        if (vfs_dq_alloc_block(inode, uspi->s_fpb)) {
-                *err = -EDQUOT;
+        ret = dquot_alloc_block(inode, uspi->s_fpb);
+        if (ret) {
+                *err = ret;
                 return INVBLOCK;
         }
 
diff --git a/fs/ufs/dir.c b/fs/ufs/dir.c
index 22af68f8b682..317a0d444f6b 100644
--- a/fs/ufs/dir.c
+++ b/fs/ufs/dir.c
@@ -31,7 +31,7 @@
  * len <= UFS_MAXNAMLEN and de != NULL are guaranteed by caller.
  */
 static inline int ufs_match(struct super_block *sb, int len,
-                const char * const name, struct ufs_dir_entry * de)
+                const unsigned char *name, struct ufs_dir_entry *de)
 {
         if (len != ufs_get_de_namlen(sb, de))
                 return 0;
@@ -70,7 +70,7 @@ static inline unsigned long ufs_dir_pages(struct inode *inode)
         return (inode->i_size+PAGE_CACHE_SIZE-1)>>PAGE_CACHE_SHIFT;
 }
 
-ino_t ufs_inode_by_name(struct inode *dir, struct qstr *qstr)
+ino_t ufs_inode_by_name(struct inode *dir, const struct qstr *qstr)
 {
         ino_t res = 0;
         struct ufs_dir_entry *de;
@@ -249,11 +249,11 @@ struct ufs_dir_entry *ufs_dotdot(struct inode *dir, struct page **p)
  * (as a parameter - res_dir). Page is returned mapped and unlocked.
  * Entry is guaranteed to be valid.
  */
-struct ufs_dir_entry *ufs_find_entry(struct inode *dir, struct qstr *qstr,
+struct ufs_dir_entry *ufs_find_entry(struct inode *dir, const struct qstr *qstr,
                                      struct page **res_page)
 {
         struct super_block *sb = dir->i_sb;
-        const char *name = qstr->name;
+        const unsigned char *name = qstr->name;
         int namelen = qstr->len;
         unsigned reclen = UFS_DIR_REC_LEN(namelen);
         unsigned long start, n;
@@ -313,7 +313,7 @@ found:
 int ufs_add_link(struct dentry *dentry, struct inode *inode)
 {
         struct inode *dir = dentry->d_parent->d_inode;
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         int namelen = dentry->d_name.len;
         struct super_block *sb = dir->i_sb;
         unsigned reclen = UFS_DIR_REC_LEN(namelen);
diff --git a/fs/ufs/file.c b/fs/ufs/file.c
index 73655c61240a..a8962cecde5b 100644
--- a/fs/ufs/file.c
+++ b/fs/ufs/file.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/quotaops.h>
 
 #include "ufs_fs.h"
 #include "ufs.h"
@@ -40,7 +41,7 @@ const struct file_operations ufs_file_operations = {
         .write          = do_sync_write,
         .aio_write      = generic_file_aio_write,
         .mmap           = generic_file_mmap,
-        .open           = generic_file_open,
+        .open           = dquot_file_open,
         .fsync          = simple_fsync,
         .splice_read    = generic_file_splice_read,
 };
diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
index 3527c00fef0d..230ecf608026 100644
--- a/fs/ufs/ialloc.c
+++ b/fs/ufs/ialloc.c
@@ -95,8 +95,8 @@ void ufs_free_inode (struct inode * inode)
 
         is_directory = S_ISDIR(inode->i_mode);
 
-        vfs_dq_free_inode(inode);
-        vfs_dq_drop(inode);
+        dquot_free_inode(inode);
+        dquot_drop(inode);
 
         clear_inode (inode);
 
@@ -355,9 +355,10 @@ cg_found:
 
         unlock_super (sb);
 
-        if (vfs_dq_alloc_inode(inode)) {
-                vfs_dq_drop(inode);
-                err = -EDQUOT;
+        dquot_initialize(inode);
+        err = dquot_alloc_inode(inode);
+        if (err) {
+                dquot_drop(inode);
                 goto fail_without_unlock;
         }
 
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7cf33379fd46..80b68c3702d1 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -36,6 +36,8 @@
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
+#include <linux/quotaops.h>
 
 #include "ufs_fs.h"
 #include "ufs.h"
@@ -890,11 +892,11 @@ static int ufs_update_inode(struct inode * inode, int do_sync)
         return 0;
 }
 
-int ufs_write_inode (struct inode * inode, int wait)
+int ufs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int ret;
         lock_kernel();
-        ret = ufs_update_inode (inode, wait);
+        ret = ufs_update_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
         unlock_kernel();
         return ret;
 }
@@ -908,6 +910,9 @@ void ufs_delete_inode (struct inode * inode)
 {
         loff_t old_i_size;
 
+        if (!is_bad_inode(inode))
+                dquot_initialize(inode);
+
         truncate_inode_pages(&inode->i_data, 0);
         if (is_bad_inode(inode))
                 goto no_delete;
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 4c26d9e8bc94..118556243e7a 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -30,6 +30,7 @@
 #include <linux/time.h>
 #include <linux/fs.h>
 #include <linux/smp_lock.h>
+#include <linux/quotaops.h>
 
 #include "ufs_fs.h"
 #include "ufs.h"
@@ -84,6 +85,9 @@ static int ufs_create (struct inode * dir, struct dentry * dentry, int mode,
         int err;
 
         UFSD("BEGIN\n");
+
+        dquot_initialize(dir);
+
         inode = ufs_new_inode(dir, mode);
         err = PTR_ERR(inode);
 
@@ -107,6 +111,9 @@ static int ufs_mknod (struct inode * dir, struct dentry *dentry, int mode, dev_t
 
         if (!old_valid_dev(rdev))
                 return -EINVAL;
+
+        dquot_initialize(dir);
+
         inode = ufs_new_inode(dir, mode);
         err = PTR_ERR(inode);
         if (!IS_ERR(inode)) {
@@ -131,6 +138,8 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
         if (l > sb->s_blocksize)
                 goto out_notlocked;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
         err = PTR_ERR(inode);
@@ -176,6 +185,8 @@ static int ufs_link (struct dentry * old_dentry, struct inode * dir,
                 return -EMLINK;
         }
 
+        dquot_initialize(dir);
+
         inode->i_ctime = CURRENT_TIME_SEC;
         inode_inc_link_count(inode);
         atomic_inc(&inode->i_count);
@@ -193,6 +204,8 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, int mode)
         if (dir->i_nlink >= UFS_LINK_MAX)
                 goto out;
 
+        dquot_initialize(dir);
+
         lock_kernel();
         inode_inc_link_count(dir);
 
@@ -237,6 +250,8 @@ static int ufs_unlink(struct inode *dir, struct dentry *dentry)
         struct page *page;
         int err = -ENOENT;
 
+        dquot_initialize(dir);
+
         de = ufs_find_entry(dir, &dentry->d_name, &page);
         if (!de)
                 goto out;
@@ -281,6 +296,9 @@ static int ufs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct ufs_dir_entry *old_de;
         int err = -ENOENT;
 
+        dquot_initialize(old_dir);
+        dquot_initialize(new_dir);
+
         old_de = ufs_find_entry(old_dir, &old_dentry->d_name, &old_page);
         if (!old_de)
                 goto out;
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 143c20bfb04b..14743d935a93 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -1016,6 +1016,9 @@ magic_found:
                 case UFS_FSSTABLE:
                         UFSD("fs is stable\n");
                         break;
+                case UFS_FSLOG:
+                        UFSD("fs is logging fs\n");
+                        break;
                 case UFS_FSOSF1:
                         UFSD("fs is DEC OSF/1\n");
                         break;
@@ -1432,6 +1435,11 @@ static void destroy_inodecache(void)
         kmem_cache_destroy(ufs_inode_cachep);
 }
 
+static void ufs_clear_inode(struct inode *inode)
+{
+        dquot_drop(inode);
+}
+
 #ifdef CONFIG_QUOTA
 static ssize_t ufs_quota_read(struct super_block *, int, char *,size_t, loff_t);
 static ssize_t ufs_quota_write(struct super_block *, int, const char *, size_t, loff_t);
@@ -1442,6 +1450,7 @@ static const struct super_operations ufs_super_ops = {
         .destroy_inode  = ufs_destroy_inode,
         .write_inode    = ufs_write_inode,
         .delete_inode   = ufs_delete_inode,
+        .clear_inode    = ufs_clear_inode,
         .put_super      = ufs_put_super,
         .write_super    = ufs_write_super,
         .sync_fs        = ufs_sync_fs,
diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index 41dd431ce228..d3b6270cb377 100644
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -44,6 +44,7 @@
 #include <linux/buffer_head.h>
 #include <linux/blkdev.h>
 #include <linux/sched.h>
+#include <linux/quotaops.h>
 
 #include "ufs_fs.h"
 #include "ufs.h"
@@ -517,9 +518,18 @@ static int ufs_setattr(struct dentry *dentry, struct iattr *attr)
         if (error)
                 return error;
 
+        if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
+            (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
+                error = dquot_transfer(inode, attr);
+                if (error)
+                        return error;
+        }
         if (ia_valid & ATTR_SIZE &&
             attr->ia_size != i_size_read(inode)) {
                 loff_t old_i_size = inode->i_size;
+
+                dquot_initialize(inode);
+
                 error = vmtruncate(inode, attr->ia_size);
                 if (error)
                         return error;
diff --git a/fs/ufs/ufs.h b/fs/ufs/ufs.h
index 0b4c39bc0d9e..43f9f5d5670e 100644
--- a/fs/ufs/ufs.h
+++ b/fs/ufs/ufs.h
@@ -86,9 +86,9 @@ extern void ufs_put_cylinder (struct super_block *, unsigned);
 /* dir.c */
 extern const struct inode_operations ufs_dir_inode_operations;
 extern int ufs_add_link (struct dentry *, struct inode *);
-extern ino_t ufs_inode_by_name(struct inode *, struct qstr *);
+extern ino_t ufs_inode_by_name(struct inode *, const struct qstr *);
 extern int ufs_make_empty(struct inode *, struct inode *);
-extern struct ufs_dir_entry *ufs_find_entry(struct inode *, struct qstr *, struct page **);
+extern struct ufs_dir_entry *ufs_find_entry(struct inode *, const struct qstr *, struct page **);
 extern int ufs_delete_entry(struct inode *, struct ufs_dir_entry *, struct page *);
 extern int ufs_empty_dir (struct inode *);
 extern struct ufs_dir_entry *ufs_dotdot(struct inode *, struct page **);
@@ -106,7 +106,7 @@ extern struct inode * ufs_new_inode (struct inode *, int);
 
 /* inode.c */
 extern struct inode *ufs_iget(struct super_block *, unsigned long);
-extern int ufs_write_inode (struct inode *, int);
+extern int ufs_write_inode (struct inode *, struct writeback_control *);
 extern int ufs_sync_inode (struct inode *);
 extern void ufs_delete_inode (struct inode *);
 extern struct buffer_head * ufs_bread (struct inode *, unsigned, int, int *);
diff --git a/fs/ufs/ufs_fs.h b/fs/ufs/ufs_fs.h
index 54bde1895a80..6943ec677c0b 100644
--- a/fs/ufs/ufs_fs.h
+++ b/fs/ufs/ufs_fs.h
@@ -138,6 +138,7 @@ typedef __u16 __bitwise __fs16;
 
 #define UFS_USEEFT  ((__u16)65535)
 
+/* fs_clean values */
 #define UFS_FSOK      0x7c269d38
 #define UFS_FSACTIVE  ((__s8)0x00)
 #define UFS_FSCLEAN   ((__s8)0x01)
@@ -145,6 +146,11 @@ typedef __u16 __bitwise __fs16;
 #define UFS_FSOSF1    ((__s8)0x03)      /* is this correct for DEC OSF/1? */
 #define UFS_FSBAD     ((__s8)0xff)
 
+/* Solaris-specific fs_clean values */
+#define UFS_FSSUSPEND ((__s8)0xfe)      /* temporarily suspended */
+#define UFS_FSLOG     ((__s8)0xfd)      /* logging fs */
+#define UFS_FSFIX     ((__s8)0xfc)      /* being repaired while mounted */
+
 /* From here to next blank line, s_flags for ufs_sb_info */
 /* directory entry encoding */
 #define UFS_DE_MASK             0x00000010      /* mask for the following */
@@ -227,11 +233,16 @@ typedef __u16 __bitwise __fs16;
  */
 #define ufs_cbtocylno(bno) \
         ((bno) * uspi->s_nspf / uspi->s_spc)
-#define ufs_cbtorpos(bno) \
+#define ufs_cbtorpos(bno)                                     \
+        ((UFS_SB(sb)->s_flags & UFS_CG_SUN) ?                 \
+         (((((bno) * uspi->s_nspf % uspi->s_spc) %            \
+            uspi->s_nsect) *                                  \
+           uspi->s_nrpos) / uspi->s_nsect)                    \
+         :                                                    \
         ((((bno) * uspi->s_nspf % uspi->s_spc / uspi->s_nsect \
         * uspi->s_trackskew + (bno) * uspi->s_nspf % uspi->s_spc \
         % uspi->s_nsect * uspi->s_interleave) % uspi->s_nsect \
-        * uspi->s_nrpos) / uspi->s_npsect)
+          * uspi->s_nrpos) / uspi->s_npsect))
 
 /*
  * The following macros optimize certain frequently calculated
diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
index 05ac0fe9c4d3..8d5a506c82eb 100644
--- a/fs/xattr_acl.c
+++ b/fs/xattr_acl.c
@@ -6,9 +6,9 @@
  */
 
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/posix_acl_xattr.h>
+#include <linux/gfp.h>
 
 
 /*
diff --git a/fs/xfs/Makefile b/fs/xfs/Makefile
index 56641fe52a23..b4769e40e8bc 100644
--- a/fs/xfs/Makefile
+++ b/fs/xfs/Makefile
@@ -16,7 +16,7 @@
 # Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 #
 
-EXTRA_CFLAGS +=  -I$(src) -I$(src)/linux-2.6 -funsigned-char
+EXTRA_CFLAGS +=  -I$(src) -I$(src)/linux-2.6
 
 XFS_LINUX := linux-2.6
 
@@ -105,7 +105,6 @@ xfs-y				+= $(addprefix $(XFS_LINUX)/, \
                                    xfs_globals.o \
                                    xfs_ioctl.o \
                                    xfs_iops.o \
-                                   xfs_lrw.o \
                                    xfs_super.o \
                                    xfs_sync.o \
                                    xfs_xattr.o)
diff --git a/fs/xfs/linux-2.6/kmem.c b/fs/xfs/linux-2.6/kmem.c
index 2d3f90afe5f1..666c9db48eb6 100644
--- a/fs/xfs/linux-2.6/kmem.c
+++ b/fs/xfs/linux-2.6/kmem.c
@@ -16,16 +16,33 @@
  * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 #include <linux/mm.h>
-#include <linux/vmalloc.h>
 #include <linux/highmem.h>
+#include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/blkdev.h>
 #include <linux/backing-dev.h>
 #include "time.h"
 #include "kmem.h"
 
-#define MAX_VMALLOCS    6
-#define MAX_SLAB_SIZE   0x20000
+/*
+ * Greedy allocation.  May fail and may return vmalloced memory.
+ *
+ * Must be freed using kmem_free_large.
+ */
+void *
+kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize)
+{
+        void            *ptr;
+        size_t          kmsize = maxsize;
+
+        while (!(ptr = kmem_zalloc_large(kmsize))) {
+                if ((kmsize >>= 1) <= minsize)
+                        kmsize = minsize;
+        }
+        if (ptr)
+                *size = kmsize;
+        return ptr;
+}
 
 void *
 kmem_alloc(size_t size, unsigned int __nocast flags)
@@ -34,19 +51,8 @@ kmem_alloc(size_t size, unsigned int __nocast flags)
         gfp_t   lflags = kmem_flags_convert(flags);
         void    *ptr;
 
-#ifdef DEBUG
-        if (unlikely(!(flags & KM_LARGE) && (size > PAGE_SIZE))) {
-                printk(KERN_WARNING "Large %s attempt, size=%ld\n",
-                        __func__, (long)size);
-                dump_stack();
-        }
-#endif
-
         do {
-                if (size < MAX_SLAB_SIZE || retries > MAX_VMALLOCS)
-                        ptr = kmalloc(size, lflags);
-                else
-                        ptr = __vmalloc(size, lflags, PAGE_KERNEL);
+                ptr = kmalloc(size, lflags);
                 if (ptr || (flags & (KM_MAYFAIL|KM_NOSLEEP)))
                         return ptr;
                 if (!(++retries % 100))
@@ -68,27 +74,6 @@ kmem_zalloc(size_t size, unsigned int __nocast flags)
         return ptr;
 }
 
-void *
-kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize,
-                   unsigned int __nocast flags)
-{
-        void            *ptr;
-        size_t          kmsize = maxsize;
-        unsigned int    kmflags = (flags & ~KM_SLEEP) | KM_NOSLEEP;
-
-        while (!(ptr = kmem_zalloc(kmsize, kmflags))) {
-                if ((kmsize <= minsize) && (flags & KM_NOSLEEP))
-                        break;
-                if ((kmsize >>= 1) <= minsize) {
-                        kmsize = minsize;
-                        kmflags = flags;
-                }
-        }
-        if (ptr)
-                *size = kmsize;
-        return ptr;
-}
-
 void
 kmem_free(const void *ptr)
 {
diff --git a/fs/xfs/linux-2.6/kmem.h b/fs/xfs/linux-2.6/kmem.h
index 179cbd630f69..f7c8f7a9ea6d 100644
--- a/fs/xfs/linux-2.6/kmem.h
+++ b/fs/xfs/linux-2.6/kmem.h
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/vmalloc.h>
 
 /*
  * General memory allocation interfaces
@@ -30,7 +31,6 @@
 #define KM_NOSLEEP      0x0002u
 #define KM_NOFS         0x0004u
 #define KM_MAYFAIL      0x0008u
-#define KM_LARGE        0x0010u
 
 /*
  * We use a special process flag to avoid recursive callbacks into
@@ -42,7 +42,7 @@ kmem_flags_convert(unsigned int __nocast flags)
 {
         gfp_t   lflags;
 
-        BUG_ON(flags & ~(KM_SLEEP|KM_NOSLEEP|KM_NOFS|KM_MAYFAIL|KM_LARGE));
+        BUG_ON(flags & ~(KM_SLEEP|KM_NOSLEEP|KM_NOFS|KM_MAYFAIL));
 
         if (flags & KM_NOSLEEP) {
                 lflags = GFP_ATOMIC | __GFP_NOWARN;
@@ -56,10 +56,25 @@ kmem_flags_convert(unsigned int __nocast flags)
 
 extern void *kmem_alloc(size_t, unsigned int __nocast);
 extern void *kmem_zalloc(size_t, unsigned int __nocast);
-extern void *kmem_zalloc_greedy(size_t *, size_t, size_t, unsigned int __nocast);
 extern void *kmem_realloc(const void *, size_t, size_t, unsigned int __nocast);
 extern void  kmem_free(const void *);
 
+static inline void *kmem_zalloc_large(size_t size)
+{
+        void *ptr;
+
+        ptr = vmalloc(size);
+        if (ptr)
+                memset(ptr, 0, size);
+        return ptr;
+}
+static inline void kmem_free_large(void *ptr)
+{
+        vfree(ptr);
+}
+
+extern void *kmem_zalloc_greedy(size_t *, size_t, size_t);
+
 /*
  * Zone interfaces
  */
diff --git a/fs/xfs/linux-2.6/xfs_acl.c b/fs/xfs/linux-2.6/xfs_acl.c
index 2512125dfa7c..a7bc925c4d60 100644
--- a/fs/xfs/linux-2.6/xfs_acl.c
+++ b/fs/xfs/linux-2.6/xfs_acl.c
@@ -22,6 +22,7 @@
 #include "xfs_inode.h"
 #include "xfs_vnodeops.h"
 #include "xfs_trace.h"
+#include <linux/slab.h>
 #include <linux/xattr.h>
 #include <linux/posix_acl_xattr.h>
 
@@ -106,7 +107,7 @@ xfs_get_acl(struct inode *inode, int type)
         struct posix_acl *acl;
         struct xfs_acl *xfs_acl;
         int len = sizeof(struct xfs_acl);
-        char *ea_name;
+        unsigned char *ea_name;
         int error;
 
         acl = get_cached_acl(inode, type);
@@ -133,7 +134,8 @@ xfs_get_acl(struct inode *inode, int type)
         if (!xfs_acl)
                 return ERR_PTR(-ENOMEM);
 
-        error = -xfs_attr_get(ip, ea_name, (char *)xfs_acl, &len, ATTR_ROOT);
+        error = -xfs_attr_get(ip, ea_name, (unsigned char *)xfs_acl,
+                                                        &len, ATTR_ROOT);
         if (error) {
                 /*
                  * If the attribute doesn't exist make sure we have a negative
@@ -162,7 +164,7 @@ STATIC int
 xfs_set_acl(struct inode *inode, int type, struct posix_acl *acl)
 {
         struct xfs_inode *ip = XFS_I(inode);
-        char *ea_name;
+        unsigned char *ea_name;
         int error;
 
         if (S_ISLNK(inode->i_mode))
@@ -194,7 +196,7 @@ xfs_set_acl(struct inode *inode, int type, struct posix_acl *acl)
                         (sizeof(struct xfs_acl_entry) *
                          (XFS_ACL_MAX_ENTRIES - acl->a_count));
 
-                error = -xfs_attr_set(ip, ea_name, (char *)xfs_acl,
+                error = -xfs_attr_set(ip, ea_name, (unsigned char *)xfs_acl,
                                 len, ATTR_ROOT);
 
                 kfree(xfs_acl);
@@ -251,8 +253,9 @@ xfs_set_mode(struct inode *inode, mode_t mode)
         if (mode != inode->i_mode) {
                 struct iattr iattr;
 
-                iattr.ia_valid = ATTR_MODE;
+                iattr.ia_valid = ATTR_MODE | ATTR_CTIME;
                 iattr.ia_mode = mode;
+                iattr.ia_ctime = current_fs_time(inode->i_sb);
 
                 error = -xfs_setattr(XFS_I(inode), &iattr, XFS_ATTR_NOACL);
         }
@@ -261,7 +264,7 @@ xfs_set_mode(struct inode *inode, mode_t mode)
 }
 
 static int
-xfs_acl_exists(struct inode *inode, char *name)
+xfs_acl_exists(struct inode *inode, unsigned char *name)
 {
         int len = sizeof(struct xfs_acl);
 
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 66abe36c1213..0f8b9968a803 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -39,6 +39,8 @@
 #include "xfs_iomap.h"
 #include "xfs_vnodeops.h"
 #include "xfs_trace.h"
+#include "xfs_bmap.h"
+#include <linux/gfp.h>
 #include <linux/mpage.h>
 #include <linux/pagevec.h>
 #include <linux/writeback.h>
@@ -163,14 +165,17 @@ xfs_ioend_new_eof(
 }
 
 /*
- * Update on-disk file size now that data has been written to disk.
- * The current in-memory file size is i_size.  If a write is beyond
- * eof i_new_size will be the intended file size until i_size is
- * updated.  If this write does not extend all the way to the valid
- * file size then restrict this update to the end of the write.
+ * Update on-disk file size now that data has been written to disk.  The
+ * current in-memory file size is i_size.  If a write is beyond eof i_new_size
+ * will be the intended file size until i_size is updated.  If this write does
+ * not extend all the way to the valid file size then restrict this update to
+ * the end of the write.
+ *
+ * This function does not block as blocking on the inode lock in IO completion
+ * can lead to IO completion order dependency deadlocks.. If it can't get the
+ * inode ilock it will return EAGAIN. Callers must handle this.
  */
-
-STATIC void
+STATIC int
 xfs_setfilesize(
         xfs_ioend_t             *ioend)
 {
@@ -181,16 +186,40 @@ xfs_setfilesize(
         ASSERT(ioend->io_type != IOMAP_READ);
 
         if (unlikely(ioend->io_error))
-                return;
+                return 0;
+
+        if (!xfs_ilock_nowait(ip, XFS_ILOCK_EXCL))
+                return EAGAIN;
 
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
         isize = xfs_ioend_new_eof(ioend);
         if (isize) {
                 ip->i_d.di_size = isize;
-                xfs_mark_inode_dirty_sync(ip);
+                xfs_mark_inode_dirty(ip);
         }
 
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        return 0;
+}
+
+/*
+ * Schedule IO completion handling on a xfsdatad if this was
+ * the final hold on this ioend. If we are asked to wait,
+ * flush the workqueue.
+ */
+STATIC void
+xfs_finish_ioend(
+        xfs_ioend_t     *ioend,
+        int             wait)
+{
+        if (atomic_dec_and_test(&ioend->io_remaining)) {
+                struct workqueue_struct *wq;
+
+                wq = (ioend->io_type == IOMAP_UNWRITTEN) ?
+                        xfsconvertd_workqueue : xfsdatad_workqueue;
+                queue_work(wq, &ioend->io_work);
+                if (wait)
+                        flush_workqueue(wq);
+        }
 }
 
 /*
@@ -198,11 +227,11 @@ xfs_setfilesize(
  */
 STATIC void
 xfs_end_io(
-        struct work_struct      *work)
+        struct work_struct *work)
 {
-        xfs_ioend_t             *ioend =
-                container_of(work, xfs_ioend_t, io_work);
-        struct xfs_inode        *ip = XFS_I(ioend->io_inode);
+        xfs_ioend_t     *ioend = container_of(work, xfs_ioend_t, io_work);
+        struct xfs_inode *ip = XFS_I(ioend->io_inode);
+        int             error = 0;
 
         /*
          * For unwritten extents we need to issue transactions to convert a
@@ -210,7 +239,6 @@ xfs_end_io(
          */
         if (ioend->io_type == IOMAP_UNWRITTEN &&
             likely(!ioend->io_error && !XFS_FORCED_SHUTDOWN(ip->i_mount))) {
-                int error;
 
                 error = xfs_iomap_write_unwritten(ip, ioend->io_offset,
                                                  ioend->io_size);
@@ -222,30 +250,23 @@ xfs_end_io(
          * We might have to update the on-disk file size after extending
          * writes.
          */
-        if (ioend->io_type != IOMAP_READ)
-                xfs_setfilesize(ioend);
-        xfs_destroy_ioend(ioend);
-}
-
-/*
- * Schedule IO completion handling on a xfsdatad if this was
- * the final hold on this ioend. If we are asked to wait,
- * flush the workqueue.
- */
-STATIC void
-xfs_finish_ioend(
-        xfs_ioend_t     *ioend,
-        int             wait)
-{
-        if (atomic_dec_and_test(&ioend->io_remaining)) {
-                struct workqueue_struct *wq;
-
-                wq = (ioend->io_type == IOMAP_UNWRITTEN) ?
-                        xfsconvertd_workqueue : xfsdatad_workqueue;
-                queue_work(wq, &ioend->io_work);
-                if (wait)
-                        flush_workqueue(wq);
+        if (ioend->io_type != IOMAP_READ) {
+                error = xfs_setfilesize(ioend);
+                ASSERT(!error || error == EAGAIN);
         }
+
+        /*
+         * If we didn't complete processing of the ioend, requeue it to the
+         * tail of the workqueue for another attempt later. Otherwise destroy
+         * it.
+         */
+        if (error == EAGAIN) {
+                atomic_inc(&ioend->io_remaining);
+                xfs_finish_ioend(ioend, 0);
+                /* ensure we don't spin on blocked ioends */
+                delay(1);
+        } else
+                xfs_destroy_ioend(ioend);
 }
 
 /*
@@ -341,7 +362,7 @@ xfs_submit_ioend_bio(
          * but don't update the inode size until I/O completion.
          */
         if (xfs_ioend_new_eof(ioend))
-                xfs_mark_inode_dirty_sync(XFS_I(ioend->io_inode));
+                xfs_mark_inode_dirty(XFS_I(ioend->io_inode));
 
         submit_bio(wbc->sync_mode == WB_SYNC_ALL ?
                    WRITE_SYNC_PLUG : WRITE, bio);
@@ -874,6 +895,125 @@ xfs_cluster_write(
         }
 }
 
+STATIC void
+xfs_vm_invalidatepage(
+        struct page             *page,
+        unsigned long           offset)
+{
+        trace_xfs_invalidatepage(page->mapping->host, page, offset);
+        block_invalidatepage(page, offset);
+}
+
+/*
+ * If the page has delalloc buffers on it, we need to punch them out before we
+ * invalidate the page. If we don't, we leave a stale delalloc mapping on the
+ * inode that can trip a BUG() in xfs_get_blocks() later on if a direct IO read
+ * is done on that same region - the delalloc extent is returned when none is
+ * supposed to be there.
+ *
+ * We prevent this by truncating away the delalloc regions on the page before
+ * invalidating it. Because they are delalloc, we can do this without needing a
+ * transaction. Indeed - if we get ENOSPC errors, we have to be able to do this
+ * truncation without a transaction as there is no space left for block
+ * reservation (typically why we see a ENOSPC in writeback).
+ *
+ * This is not a performance critical path, so for now just do the punching a
+ * buffer head at a time.
+ */
+STATIC void
+xfs_aops_discard_page(
+        struct page             *page)
+{
+        struct inode            *inode = page->mapping->host;
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct buffer_head      *bh, *head;
+        loff_t                  offset = page_offset(page);
+        ssize_t                 len = 1 << inode->i_blkbits;
+
+        if (!xfs_is_delayed_page(page, IOMAP_DELAY))
+                goto out_invalidate;
+
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                goto out_invalidate;
+
+        xfs_fs_cmn_err(CE_ALERT, ip->i_mount,
+                "page discard on page %p, inode 0x%llx, offset %llu.",
+                        page, ip->i_ino, offset);
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        bh = head = page_buffers(page);
+        do {
+                int             done;
+                xfs_fileoff_t   offset_fsb;
+                xfs_bmbt_irec_t imap;
+                int             nimaps = 1;
+                int             error;
+                xfs_fsblock_t   firstblock;
+                xfs_bmap_free_t flist;
+
+                if (!buffer_delay(bh))
+                        goto next_buffer;
+
+                offset_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
+
+                /*
+                 * Map the range first and check that it is a delalloc extent
+                 * before trying to unmap the range. Otherwise we will be
+                 * trying to remove a real extent (which requires a
+                 * transaction) or a hole, which is probably a bad idea...
+                 */
+                error = xfs_bmapi(NULL, ip, offset_fsb, 1,
+                                XFS_BMAPI_ENTIRE,  NULL, 0, &imap,
+                                &nimaps, NULL, NULL);
+
+                if (error) {
+                        /* something screwed, just bail */
+                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                                xfs_fs_cmn_err(CE_ALERT, ip->i_mount,
+                                "page discard failed delalloc mapping lookup.");
+                        }
+                        break;
+                }
+                if (!nimaps) {
+                        /* nothing there */
+                        goto next_buffer;
+                }
+                if (imap.br_startblock != DELAYSTARTBLOCK) {
+                        /* been converted, ignore */
+                        goto next_buffer;
+                }
+                WARN_ON(imap.br_blockcount == 0);
+
+                /*
+                 * Note: while we initialise the firstblock/flist pair, they
+                 * should never be used because blocks should never be
+                 * allocated or freed for a delalloc extent and hence we need
+                 * don't cancel or finish them after the xfs_bunmapi() call.
+                 */
+                xfs_bmap_init(&flist, &firstblock);
+                error = xfs_bunmapi(NULL, ip, offset_fsb, 1, 0, 1, &firstblock,
+                                        &flist, NULL, &done);
+
+                ASSERT(!flist.xbf_count && !flist.xbf_first);
+                if (error) {
+                        /* something screwed, just bail */
+                        if (!XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                                xfs_fs_cmn_err(CE_ALERT, ip->i_mount,
+                        "page discard unable to remove delalloc mapping.");
+                        }
+                        break;
+                }
+next_buffer:
+                offset += len;
+
+        } while ((bh = bh->b_this_page) != head);
+
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+out_invalidate:
+        xfs_vm_invalidatepage(page, 0);
+        return;
+}
+
 /*
  * Calling this without startio set means we are being asked to make a dirty
  * page ready for freeing it's buffers.  When called with startio set then
@@ -1125,7 +1265,7 @@ error:
          */
         if (err != -EAGAIN) {
                 if (!unmapped)
-                        block_invalidatepage(page, 0);
+                        xfs_aops_discard_page(page);
                 ClearPageUptodate(page);
         }
         return err;
@@ -1535,15 +1675,6 @@ xfs_vm_readpages(
         return mpage_readpages(mapping, pages, nr_pages, xfs_get_blocks);
 }
 
-STATIC void
-xfs_vm_invalidatepage(
-        struct page             *page,
-        unsigned long           offset)
-{
-        trace_xfs_invalidatepage(page->mapping->host, page, offset);
-        block_invalidatepage(page, offset);
-}
-
 const struct address_space_operations xfs_address_space_operations = {
         .readpage               = xfs_vm_readpage,
         .readpages              = xfs_vm_readpages,
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 77b8be81c769..44c2b0ef9a41 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -18,7 +18,7 @@
 #include "xfs.h"
 #include <linux/stddef.h>
 #include <linux/errno.h>
-#include <linux/slab.h>
+#include <linux/gfp.h>
 #include <linux/pagemap.h>
 #include <linux/init.h>
 #include <linux/vmalloc.h>
@@ -33,6 +33,7 @@
 #include <linux/migrate.h>
 #include <linux/backing-dev.h>
 #include <linux/freezer.h>
+#include <linux/list_sort.h>
 
 #include "xfs_sb.h"
 #include "xfs_inum.h"
@@ -76,6 +77,27 @@ struct workqueue_struct *xfsconvertd_workqueue;
 #define xfs_buf_deallocate(bp) \
         kmem_zone_free(xfs_buf_zone, (bp));
 
+static inline int
+xfs_buf_is_vmapped(
+        struct xfs_buf  *bp)
+{
+        /*
+         * Return true if the buffer is vmapped.
+         *
+         * The XBF_MAPPED flag is set if the buffer should be mapped, but the
+         * code is clever enough to know it doesn't have to map a single page,
+         * so the check has to be both for XBF_MAPPED and bp->b_page_count > 1.
+         */
+        return (bp->b_flags & XBF_MAPPED) && bp->b_page_count > 1;
+}
+
+static inline int
+xfs_buf_vmap_len(
+        struct xfs_buf  *bp)
+{
+        return (bp->b_page_count * PAGE_SIZE) - bp->b_offset;
+}
+
 /*
  *      Page Region interfaces.
  *
@@ -146,75 +168,6 @@ test_page_region(
 }
 
 /*
- *      Mapping of multi-page buffers into contiguous virtual space
- */
-
-typedef struct a_list {
-        void            *vm_addr;
-        struct a_list   *next;
-} a_list_t;
-
-static a_list_t         *as_free_head;
-static int              as_list_len;
-static DEFINE_SPINLOCK(as_lock);
-
-/*
- *      Try to batch vunmaps because they are costly.
- */
-STATIC void
-free_address(
-        void            *addr)
-{
-        a_list_t        *aentry;
-
-#ifdef CONFIG_XEN
-        /*
-         * Xen needs to be able to make sure it can get an exclusive
-         * RO mapping of pages it wants to turn into a pagetable.  If
-         * a newly allocated page is also still being vmap()ed by xfs,
-         * it will cause pagetable construction to fail.  This is a
-         * quick workaround to always eagerly unmap pages so that Xen
-         * is happy.
-         */
-        vunmap(addr);
-        return;
-#endif
-
-        aentry = kmalloc(sizeof(a_list_t), GFP_NOWAIT);
-        if (likely(aentry)) {
-                spin_lock(&as_lock);
-                aentry->next = as_free_head;
-                aentry->vm_addr = addr;
-                as_free_head = aentry;
-                as_list_len++;
-                spin_unlock(&as_lock);
-        } else {
-                vunmap(addr);
-        }
-}
-
-STATIC void
-purge_addresses(void)
-{
-        a_list_t        *aentry, *old;
-
-        if (as_free_head == NULL)
-                return;
-
-        spin_lock(&as_lock);
-        aentry = as_free_head;
-        as_free_head = NULL;
-        as_list_len = 0;
-        spin_unlock(&as_lock);
-
-        while ((old = aentry) != NULL) {
-                vunmap(aentry->vm_addr);
-                aentry = aentry->next;
-                kfree(old);
-        }
-}
-
-/*
  *      Internal xfs_buf_t object manipulation
  */
 
@@ -314,8 +267,9 @@ xfs_buf_free(
         if (bp->b_flags & (_XBF_PAGE_CACHE|_XBF_PAGES)) {
                 uint            i;
 
-                if ((bp->b_flags & XBF_MAPPED) && (bp->b_page_count > 1))
-                        free_address(bp->b_addr - bp->b_offset);
+                if (xfs_buf_is_vmapped(bp))
+                        vm_unmap_ram(bp->b_addr - bp->b_offset,
+                                        bp->b_page_count);
 
                 for (i = 0; i < bp->b_page_count; i++) {
                         struct page     *page = bp->b_pages[i];
@@ -435,10 +389,8 @@ _xfs_buf_map_pages(
                 bp->b_addr = page_address(bp->b_pages[0]) + bp->b_offset;
                 bp->b_flags |= XBF_MAPPED;
         } else if (flags & XBF_MAPPED) {
-                if (as_list_len > 64)
-                        purge_addresses();
-                bp->b_addr = vmap(bp->b_pages, bp->b_page_count,
-                                        VM_MAP, PAGE_KERNEL);
+                bp->b_addr = vm_map_ram(bp->b_pages, bp->b_page_count,
+                                        -1, PAGE_KERNEL);
                 if (unlikely(bp->b_addr == NULL))
                         return -ENOMEM;
                 bp->b_addr += bp->b_offset;
@@ -1051,22 +1003,30 @@ xfs_buf_ioerror(
 }
 
 int
-xfs_bawrite(
-        void                    *mp,
+xfs_bwrite(
+        struct xfs_mount        *mp,
         struct xfs_buf          *bp)
 {
-        trace_xfs_buf_bawrite(bp, _RET_IP_);
+        int                     iowait = (bp->b_flags & XBF_ASYNC) == 0;
+        int                     error = 0;
 
-        ASSERT(bp->b_bn != XFS_BUF_DADDR_NULL);
+        bp->b_strat = xfs_bdstrat_cb;
+        bp->b_mount = mp;
+        bp->b_flags |= XBF_WRITE;
+        if (!iowait)
+                bp->b_flags |= _XBF_RUN_QUEUES;
 
         xfs_buf_delwri_dequeue(bp);
+        xfs_buf_iostrategy(bp);
 
-        bp->b_flags &= ~(XBF_READ | XBF_DELWRI | XBF_READ_AHEAD);
-        bp->b_flags |= (XBF_WRITE | XBF_ASYNC | _XBF_RUN_QUEUES);
+        if (iowait) {
+                error = xfs_buf_iowait(bp);
+                if (error)
+                        xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
+                xfs_buf_relse(bp);
+        }
 
-        bp->b_mount = mp;
-        bp->b_strat = xfs_bdstrat_cb;
-        return xfs_bdstrat_cb(bp);
+        return error;
 }
 
 void
@@ -1085,6 +1045,126 @@ xfs_bdwrite(
         xfs_buf_delwri_queue(bp, 1);
 }
 
+/*
+ * Called when we want to stop a buffer from getting written or read.
+ * We attach the EIO error, muck with its flags, and call biodone
+ * so that the proper iodone callbacks get called.
+ */
+STATIC int
+xfs_bioerror(
+        xfs_buf_t *bp)
+{
+#ifdef XFSERRORDEBUG
+        ASSERT(XFS_BUF_ISREAD(bp) || bp->b_iodone);
+#endif
+
+        /*
+         * No need to wait until the buffer is unpinned, we aren't flushing it.
+         */
+        XFS_BUF_ERROR(bp, EIO);
+
+        /*
+         * We're calling biodone, so delete XBF_DONE flag.
+         */
+        XFS_BUF_UNREAD(bp);
+        XFS_BUF_UNDELAYWRITE(bp);
+        XFS_BUF_UNDONE(bp);
+        XFS_BUF_STALE(bp);
+
+        XFS_BUF_CLR_BDSTRAT_FUNC(bp);
+        xfs_biodone(bp);
+
+        return EIO;
+}
+
+/*
+ * Same as xfs_bioerror, except that we are releasing the buffer
+ * here ourselves, and avoiding the biodone call.
+ * This is meant for userdata errors; metadata bufs come with
+ * iodone functions attached, so that we can track down errors.
+ */
+STATIC int
+xfs_bioerror_relse(
+        struct xfs_buf  *bp)
+{
+        int64_t         fl = XFS_BUF_BFLAGS(bp);
+        /*
+         * No need to wait until the buffer is unpinned.
+         * We aren't flushing it.
+         *
+         * chunkhold expects B_DONE to be set, whether
+         * we actually finish the I/O or not. We don't want to
+         * change that interface.
+         */
+        XFS_BUF_UNREAD(bp);
+        XFS_BUF_UNDELAYWRITE(bp);
+        XFS_BUF_DONE(bp);
+        XFS_BUF_STALE(bp);
+        XFS_BUF_CLR_IODONE_FUNC(bp);
+        XFS_BUF_CLR_BDSTRAT_FUNC(bp);
+        if (!(fl & XBF_ASYNC)) {
+                /*
+                 * Mark b_error and B_ERROR _both_.
+                 * Lot's of chunkcache code assumes that.
+                 * There's no reason to mark error for
+                 * ASYNC buffers.
+                 */
+                XFS_BUF_ERROR(bp, EIO);
+                XFS_BUF_FINISH_IOWAIT(bp);
+        } else {
+                xfs_buf_relse(bp);
+        }
+
+        return EIO;
+}
+
+
+/*
+ * All xfs metadata buffers except log state machine buffers
+ * get this attached as their b_bdstrat callback function.
+ * This is so that we can catch a buffer
+ * after prematurely unpinning it to forcibly shutdown the filesystem.
+ */
+int
+xfs_bdstrat_cb(
+        struct xfs_buf  *bp)
+{
+        if (XFS_FORCED_SHUTDOWN(bp->b_mount)) {
+                trace_xfs_bdstrat_shut(bp, _RET_IP_);
+                /*
+                 * Metadata write that didn't get logged but
+                 * written delayed anyway. These aren't associated
+                 * with a transaction, and can be ignored.
+                 */
+                if (!bp->b_iodone && !XFS_BUF_ISREAD(bp))
+                        return xfs_bioerror_relse(bp);
+                else
+                        return xfs_bioerror(bp);
+        }
+
+        xfs_buf_iorequest(bp);
+        return 0;
+}
+
+/*
+ * Wrapper around bdstrat so that we can stop data from going to disk in case
+ * we are shutting down the filesystem.  Typically user data goes thru this
+ * path; one of the exceptions is the superblock.
+ */
+void
+xfsbdstrat(
+        struct xfs_mount        *mp,
+        struct xfs_buf          *bp)
+{
+        if (XFS_FORCED_SHUTDOWN(mp)) {
+                trace_xfs_bdstrat_shut(bp, _RET_IP_);
+                xfs_bioerror_relse(bp);
+                return;
+        }
+
+        xfs_buf_iorequest(bp);
+}
+
 STATIC void
 _xfs_buf_ioend(
         xfs_buf_t               *bp,
@@ -1107,6 +1187,9 @@ xfs_buf_bio_end_io(
 
         xfs_buf_ioerror(bp, -error);
 
+        if (!error && xfs_buf_is_vmapped(bp) && (bp->b_flags & XBF_READ))
+                invalidate_kernel_vmap_range(bp->b_addr, xfs_buf_vmap_len(bp));
+
         do {
                 struct page     *page = bvec->bv_page;
 
@@ -1216,6 +1299,10 @@ next_chunk:
 
 submit_io:
         if (likely(bio->bi_size)) {
+                if (xfs_buf_is_vmapped(bp)) {
+                        flush_kernel_vmap_range(bp->b_addr,
+                                                xfs_buf_vmap_len(bp));
+                }
                 submit_bio(rw, bio);
                 if (size)
                         goto next_chunk;
@@ -1296,7 +1383,7 @@ xfs_buf_iomove(
         xfs_buf_t               *bp,    /* buffer to process            */
         size_t                  boff,   /* starting buffer offset       */
         size_t                  bsize,  /* length to copy               */
-        caddr_t                 data,   /* data address                 */
+        void                    *data,  /* data address                 */
         xfs_buf_rw_t            mode)   /* read/write/zero flag         */
 {
         size_t                  bend, cpoff, csize;
@@ -1378,8 +1465,8 @@ xfs_alloc_bufhash(
 
         btp->bt_hashshift = external ? 3 : 8;   /* 8 or 256 buckets */
         btp->bt_hashmask = (1 << btp->bt_hashshift) - 1;
-        btp->bt_hash = kmem_zalloc((1 << btp->bt_hashshift) *
-                                        sizeof(xfs_bufhash_t), KM_SLEEP | KM_LARGE);
+        btp->bt_hash = kmem_zalloc_large((1 << btp->bt_hashshift) *
+                                         sizeof(xfs_bufhash_t));
         for (i = 0; i < (1 << btp->bt_hashshift); i++) {
                 spin_lock_init(&btp->bt_hash[i].bh_lock);
                 INIT_LIST_HEAD(&btp->bt_hash[i].bh_list);
@@ -1390,7 +1477,7 @@ STATIC void
 xfs_free_bufhash(
         xfs_buftarg_t           *btp)
 {
-        kmem_free(btp->bt_hash);
+        kmem_free_large(btp->bt_hash);
         btp->bt_hash = NULL;
 }
 
@@ -1595,6 +1682,11 @@ xfs_buf_delwri_queue(
                 list_del(&bp->b_list);
         }
 
+        if (list_empty(dwq)) {
+                /* start xfsbufd as it is about to have something to do */
+                wake_up_process(bp->b_target->bt_task);
+        }
+
         bp->b_flags |= _XBF_DELWRI_Q;
         list_add_tail(&bp->b_list, dwq);
         bp->b_queuetime = jiffies;
@@ -1626,6 +1718,35 @@ xfs_buf_delwri_dequeue(
         trace_xfs_buf_delwri_dequeue(bp, _RET_IP_);
 }
 
+/*
+ * If a delwri buffer needs to be pushed before it has aged out, then promote
+ * it to the head of the delwri queue so that it will be flushed on the next
+ * xfsbufd run. We do this by resetting the queuetime of the buffer to be older
+ * than the age currently needed to flush the buffer. Hence the next time the
+ * xfsbufd sees it is guaranteed to be considered old enough to flush.
+ */
+void
+xfs_buf_delwri_promote(
+        struct xfs_buf  *bp)
+{
+        struct xfs_buftarg *btp = bp->b_target;
+        long            age = xfs_buf_age_centisecs * msecs_to_jiffies(10) + 1;
+
+        ASSERT(bp->b_flags & XBF_DELWRI);
+        ASSERT(bp->b_flags & _XBF_DELWRI_Q);
+
+        /*
+         * Check the buffer age before locking the delayed write queue as we
+         * don't need to promote buffers that are already past the flush age.
+         */
+        if (bp->b_queuetime < jiffies - age)
+                return;
+        bp->b_queuetime = jiffies - age;
+        spin_lock(&btp->bt_delwrite_lock);
+        list_move(&bp->b_list, &btp->bt_delwrite_queue);
+        spin_unlock(&btp->bt_delwrite_lock);
+}
+
 STATIC void
 xfs_buf_runall_queues(
         struct workqueue_struct *queue)
@@ -1644,6 +1765,8 @@ xfsbufd_wakeup(
         list_for_each_entry(btp, &xfs_buftarg_list, bt_list) {
                 if (test_bit(XBT_FORCE_SLEEP, &btp->bt_flags))
                         continue;
+                if (list_empty(&btp->bt_delwrite_queue))
+                        continue;
                 set_bit(XBT_FORCE_FLUSH, &btp->bt_flags);
                 wake_up_process(btp->bt_task);
         }
@@ -1694,20 +1817,53 @@ xfs_buf_delwri_split(
 
 }
 
+/*
+ * Compare function is more complex than it needs to be because
+ * the return value is only 32 bits and we are doing comparisons
+ * on 64 bit values
+ */
+static int
+xfs_buf_cmp(
+        void            *priv,
+        struct list_head *a,
+        struct list_head *b)
+{
+        struct xfs_buf  *ap = container_of(a, struct xfs_buf, b_list);
+        struct xfs_buf  *bp = container_of(b, struct xfs_buf, b_list);
+        xfs_daddr_t             diff;
+
+        diff = ap->b_bn - bp->b_bn;
+        if (diff < 0)
+                return -1;
+        if (diff > 0)
+                return 1;
+        return 0;
+}
+
+void
+xfs_buf_delwri_sort(
+        xfs_buftarg_t   *target,
+        struct list_head *list)
+{
+        list_sort(NULL, list, xfs_buf_cmp);
+}
+
 STATIC int
 xfsbufd(
         void            *data)
 {
-        struct list_head tmp;
-        xfs_buftarg_t   *target = (xfs_buftarg_t *)data;
-        int             count;
-        xfs_buf_t       *bp;
+        xfs_buftarg_t   *target = (xfs_buftarg_t *)data;
 
         current->flags |= PF_MEMALLOC;
 
         set_freezable();
 
         do {
+                long    age = xfs_buf_age_centisecs * msecs_to_jiffies(10);
+                long    tout = xfs_buf_timer_centisecs * msecs_to_jiffies(10);
+                int     count = 0;
+                struct list_head tmp;
+
                 if (unlikely(freezing(current))) {
                         set_bit(XBT_FORCE_SLEEP, &target->bt_flags);
                         refrigerator();
@@ -1715,24 +1871,20 @@ xfsbufd(
                         clear_bit(XBT_FORCE_SLEEP, &target->bt_flags);
                 }
 
-                schedule_timeout_interruptible(
-                        xfs_buf_timer_centisecs * msecs_to_jiffies(10));
+                /* sleep for a long time if there is nothing to do. */
+                if (list_empty(&target->bt_delwrite_queue))
+                        tout = MAX_SCHEDULE_TIMEOUT;
+                schedule_timeout_interruptible(tout);
 
-                xfs_buf_delwri_split(target, &tmp,
-                                xfs_buf_age_centisecs * msecs_to_jiffies(10));
-
-                count = 0;
+                xfs_buf_delwri_split(target, &tmp, age);
+                list_sort(NULL, &tmp, xfs_buf_cmp);
                 while (!list_empty(&tmp)) {
-                        bp = list_entry(tmp.next, xfs_buf_t, b_list);
-                        ASSERT(target == bp->b_target);
-
+                        struct xfs_buf *bp;
+                        bp = list_first_entry(&tmp, struct xfs_buf, b_list);
                         list_del_init(&bp->b_list);
                         xfs_buf_iostrategy(bp);
                         count++;
                 }
-
-                if (as_list_len > 0)
-                        purge_addresses();
                 if (count)
                         blk_run_address_space(target->bt_mapping);
 
@@ -1751,42 +1903,45 @@ xfs_flush_buftarg(
         xfs_buftarg_t   *target,
         int             wait)
 {
-        struct list_head tmp;
-        xfs_buf_t       *bp, *n;
+        xfs_buf_t       *bp;
         int             pincount = 0;
+        LIST_HEAD(tmp_list);
+        LIST_HEAD(wait_list);
 
         xfs_buf_runall_queues(xfsconvertd_workqueue);
         xfs_buf_runall_queues(xfsdatad_workqueue);
         xfs_buf_runall_queues(xfslogd_workqueue);
 
         set_bit(XBT_FORCE_FLUSH, &target->bt_flags);
-        pincount = xfs_buf_delwri_split(target, &tmp, 0);
+        pincount = xfs_buf_delwri_split(target, &tmp_list, 0);
 
         /*
-         * Dropped the delayed write list lock, now walk the temporary list
+         * Dropped the delayed write list lock, now walk the temporary list.
+         * All I/O is issued async and then if we need to wait for completion
+         * we do that after issuing all the IO.
          */
-        list_for_each_entry_safe(bp, n, &tmp, b_list) {
+        list_sort(NULL, &tmp_list, xfs_buf_cmp);
+        while (!list_empty(&tmp_list)) {
+                bp = list_first_entry(&tmp_list, struct xfs_buf, b_list);
                 ASSERT(target == bp->b_target);
-                if (wait)
+                list_del_init(&bp->b_list);
+                if (wait) {
                         bp->b_flags &= ~XBF_ASYNC;
-                else
-                        list_del_init(&bp->b_list);
-
+                        list_add(&bp->b_list, &wait_list);
+                }
                 xfs_buf_iostrategy(bp);
         }
 
-        if (wait)
+        if (wait) {
+                /* Expedite and wait for IO to complete. */
                 blk_run_address_space(target->bt_mapping);
+                while (!list_empty(&wait_list)) {
+                        bp = list_first_entry(&wait_list, struct xfs_buf, b_list);
 
-        /*
-         * Remaining list items must be flushed before returning
-         */
-        while (!list_empty(&tmp)) {
-                bp = list_entry(tmp.next, xfs_buf_t, b_list);
-
-                list_del_init(&bp->b_list);
-                xfs_iowait(bp);
-                xfs_buf_relse(bp);
+                        list_del_init(&bp->b_list);
+                        xfs_iowait(bp);
+                        xfs_buf_relse(bp);
+                }
         }
 
         return pincount;
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index a34c7b54822d..386e7361e50e 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -232,13 +232,17 @@ extern void xfs_buf_lock(xfs_buf_t *);
 extern void xfs_buf_unlock(xfs_buf_t *);
 
 /* Buffer Read and Write Routines */
-extern int xfs_bawrite(void *mp, xfs_buf_t *bp);
+extern int xfs_bwrite(struct xfs_mount *mp, struct xfs_buf *bp);
 extern void xfs_bdwrite(void *mp, xfs_buf_t *bp);
+
+extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
+extern int xfs_bdstrat_cb(struct xfs_buf *);
+
 extern void xfs_buf_ioend(xfs_buf_t *,  int);
 extern void xfs_buf_ioerror(xfs_buf_t *, int);
 extern int xfs_buf_iorequest(xfs_buf_t *);
 extern int xfs_buf_iowait(xfs_buf_t *);
-extern void xfs_buf_iomove(xfs_buf_t *, size_t, size_t, xfs_caddr_t,
+extern void xfs_buf_iomove(xfs_buf_t *, size_t, size_t, void *,
                                 xfs_buf_rw_t);
 
 static inline int xfs_buf_iostrategy(xfs_buf_t *bp)
@@ -261,6 +265,7 @@ extern int xfs_buf_ispin(xfs_buf_t *);
 
 /* Delayed Write Buffer Routines */
 extern void xfs_buf_delwri_dequeue(xfs_buf_t *);
+extern void xfs_buf_delwri_promote(xfs_buf_t *);
 
 /* Buffer Daemon Setup Routines */
 extern int xfs_buf_init(void);
@@ -270,33 +275,19 @@ extern void xfs_buf_terminate(void);
         ({ char __b[BDEVNAME_SIZE]; bdevname((target)->bt_bdev, __b); __b; })
 
 
-#define XFS_B_ASYNC             XBF_ASYNC
-#define XFS_B_DELWRI            XBF_DELWRI
-#define XFS_B_READ              XBF_READ
-#define XFS_B_WRITE             XBF_WRITE
-#define XFS_B_STALE             XBF_STALE
-
-#define XFS_BUF_TRYLOCK         XBF_TRYLOCK
-#define XFS_INCORE_TRYLOCK      XBF_TRYLOCK
-#define XFS_BUF_LOCK            XBF_LOCK
-#define XFS_BUF_MAPPED          XBF_MAPPED
-
-#define BUF_BUSY                XBF_DONT_BLOCK
-
 #define XFS_BUF_BFLAGS(bp)      ((bp)->b_flags)
 #define XFS_BUF_ZEROFLAGS(bp)   ((bp)->b_flags &= \
                 ~(XBF_READ|XBF_WRITE|XBF_ASYNC|XBF_DELWRI|XBF_ORDERED))
 
-#define XFS_BUF_STALE(bp)       ((bp)->b_flags |= XFS_B_STALE)
-#define XFS_BUF_UNSTALE(bp)     ((bp)->b_flags &= ~XFS_B_STALE)
-#define XFS_BUF_ISSTALE(bp)     ((bp)->b_flags & XFS_B_STALE)
+#define XFS_BUF_STALE(bp)       ((bp)->b_flags |= XBF_STALE)
+#define XFS_BUF_UNSTALE(bp)     ((bp)->b_flags &= ~XBF_STALE)
+#define XFS_BUF_ISSTALE(bp)     ((bp)->b_flags & XBF_STALE)
 #define XFS_BUF_SUPER_STALE(bp) do {                            \
                                         XFS_BUF_STALE(bp);      \
                                         xfs_buf_delwri_dequeue(bp);     \
                                         XFS_BUF_DONE(bp);       \
                                 } while (0)
 
-#define XFS_BUF_MANAGE          XBF_FS_MANAGED
 #define XFS_BUF_UNMANAGE(bp)    ((bp)->b_flags &= ~XBF_FS_MANAGED)
 
 #define XFS_BUF_DELAYWRITE(bp)          ((bp)->b_flags |= XBF_DELWRI)
@@ -385,31 +376,11 @@ static inline void xfs_buf_relse(xfs_buf_t *bp)
 
 #define xfs_biomove(bp, off, len, data, rw) \
             xfs_buf_iomove((bp), (off), (len), (data), \
-                ((rw) == XFS_B_WRITE) ? XBRW_WRITE : XBRW_READ)
+                ((rw) == XBF_WRITE) ? XBRW_WRITE : XBRW_READ)
 
 #define xfs_biozero(bp, off, len) \
             xfs_buf_iomove((bp), (off), (len), NULL, XBRW_ZERO)
 
-
-static inline int XFS_bwrite(xfs_buf_t *bp)
-{
-        int     iowait = (bp->b_flags & XBF_ASYNC) == 0;
-        int     error = 0;
-
-        if (!iowait)
-                bp->b_flags |= _XBF_RUN_QUEUES;
-
-        xfs_buf_delwri_dequeue(bp);
-        xfs_buf_iostrategy(bp);
-        if (iowait) {
-                error = xfs_buf_iowait(bp);
-                xfs_buf_relse(bp);
-        }
-        return error;
-}
-
-#define XFS_bdstrat(bp) xfs_buf_iorequest(bp)
-
 #define xfs_iowait(bp)  xfs_buf_iowait(bp)
 
 #define xfs_baread(target, rablkno, ralen)  \
@@ -424,6 +395,7 @@ extern void xfs_free_buftarg(struct xfs_mount *, struct xfs_buftarg *);
 extern void xfs_wait_buftarg(xfs_buftarg_t *);
 extern int xfs_setsize_buftarg(xfs_buftarg_t *, unsigned int, unsigned int);
 extern int xfs_flush_buftarg(xfs_buftarg_t *, int);
+
 #ifdef CONFIG_KDB_MODULES
 extern struct list_head *xfs_get_buftarg_list(void);
 #endif
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index 87b8cbd23d4b..846b75aeb2ab 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -29,6 +29,7 @@
 #include "xfs_vnodeops.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_inode.h"
+#include "xfs_inode_item.h"
 
 /*
  * Note that we only accept fileids which are long enough rather than allow
@@ -215,9 +216,28 @@ xfs_fs_get_parent(
         return d_obtain_alias(VFS_I(cip));
 }
 
+STATIC int
+xfs_fs_nfs_commit_metadata(
+        struct inode            *inode)
+{
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
+        int                     error = 0;
+
+        xfs_ilock(ip, XFS_ILOCK_SHARED);
+        if (xfs_ipincount(ip)) {
+                error = _xfs_log_force_lsn(mp, ip->i_itemp->ili_last_lsn,
+                                XFS_LOG_SYNC, NULL);
+        }
+        xfs_iunlock(ip, XFS_ILOCK_SHARED);
+
+        return error;
+}
+
 const struct export_operations xfs_export_operations = {
         .encode_fh              = xfs_fs_encode_fh,
         .fh_to_dentry           = xfs_fs_fh_to_dentry,
         .fh_to_parent           = xfs_fs_fh_to_parent,
         .get_parent             = xfs_fs_get_parent,
+        .commit_metadata        = xfs_fs_nfs_commit_metadata,
 };
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index e4caeb28ce2e..42dd3bcfba6b 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -16,6 +16,7 @@
  * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 #include "xfs.h"
+#include "xfs_fs.h"
 #include "xfs_bit.h"
 #include "xfs_log.h"
 #include "xfs_inum.h"
@@ -34,52 +35,279 @@
 #include "xfs_dir2_sf.h"
 #include "xfs_dinode.h"
 #include "xfs_inode.h"
+#include "xfs_inode_item.h"
+#include "xfs_bmap.h"
 #include "xfs_error.h"
 #include "xfs_rw.h"
 #include "xfs_vnodeops.h"
 #include "xfs_da_btree.h"
 #include "xfs_ioctl.h"
+#include "xfs_trace.h"
 
 #include <linux/dcache.h>
 
 static const struct vm_operations_struct xfs_file_vm_ops;
 
-STATIC ssize_t
-xfs_file_aio_read(
-        struct kiocb            *iocb,
-        const struct iovec      *iov,
-        unsigned long           nr_segs,
-        loff_t                  pos)
+/*
+ *      xfs_iozero
+ *
+ *      xfs_iozero clears the specified range of buffer supplied,
+ *      and marks all the affected blocks as valid and modified.  If
+ *      an affected block is not allocated, it will be allocated.  If
+ *      an affected block is not completely overwritten, and is not
+ *      valid before the operation, it will be read from disk before
+ *      being partially zeroed.
+ */
+STATIC int
+xfs_iozero(
+        struct xfs_inode        *ip,    /* inode                        */
+        loff_t                  pos,    /* offset in file               */
+        size_t                  count)  /* size of data to zero         */
 {
-        struct file             *file = iocb->ki_filp;
-        int                     ioflags = 0;
+        struct page             *page;
+        struct address_space    *mapping;
+        int                     status;
 
-        BUG_ON(iocb->ki_pos != pos);
-        if (unlikely(file->f_flags & O_DIRECT))
-                ioflags |= IO_ISDIRECT;
-        if (file->f_mode & FMODE_NOCMTIME)
-                ioflags |= IO_INVIS;
-        return xfs_read(XFS_I(file->f_path.dentry->d_inode), iocb, iov,
-                                nr_segs, &iocb->ki_pos, ioflags);
+        mapping = VFS_I(ip)->i_mapping;
+        do {
+                unsigned offset, bytes;
+                void *fsdata;
+
+                offset = (pos & (PAGE_CACHE_SIZE -1)); /* Within page */
+                bytes = PAGE_CACHE_SIZE - offset;
+                if (bytes > count)
+                        bytes = count;
+
+                status = pagecache_write_begin(NULL, mapping, pos, bytes,
+                                        AOP_FLAG_UNINTERRUPTIBLE,
+                                        &page, &fsdata);
+                if (status)
+                        break;
+
+                zero_user(page, offset, bytes);
+
+                status = pagecache_write_end(NULL, mapping, pos, bytes, bytes,
+                                        page, fsdata);
+                WARN_ON(status <= 0); /* can't return less than zero! */
+                pos += bytes;
+                count -= bytes;
+                status = 0;
+        } while (count);
+
+        return (-status);
+}
+
+STATIC int
+xfs_file_fsync(
+        struct file             *file,
+        struct dentry           *dentry,
+        int                     datasync)
+{
+        struct xfs_inode        *ip = XFS_I(dentry->d_inode);
+        struct xfs_trans        *tp;
+        int                     error = 0;
+        int                     log_flushed = 0;
+
+        xfs_itrace_entry(ip);
+
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -XFS_ERROR(EIO);
+
+        xfs_iflags_clear(ip, XFS_ITRUNCATED);
+
+        /*
+         * We always need to make sure that the required inode state is safe on
+         * disk.  The inode might be clean but we still might need to force the
+         * log because of committed transactions that haven't hit the disk yet.
+         * Likewise, there could be unflushed non-transactional changes to the
+         * inode core that have to go to disk and this requires us to issue
+         * a synchronous transaction to capture these changes correctly.
+         *
+         * This code relies on the assumption that if the i_update_core field
+         * of the inode is clear and the inode is unpinned then it is clean
+         * and no action is required.
+         */
+        xfs_ilock(ip, XFS_ILOCK_SHARED);
+
+        /*
+         * First check if the VFS inode is marked dirty.  All the dirtying
+         * of non-transactional updates no goes through mark_inode_dirty*,
+         * which allows us to distinguish beteeen pure timestamp updates
+         * and i_size updates which need to be caught for fdatasync.
+         * After that also theck for the dirty state in the XFS inode, which
+         * might gets cleared when the inode gets written out via the AIL
+         * or xfs_iflush_cluster.
+         */
+        if (((dentry->d_inode->i_state & I_DIRTY_DATASYNC) ||
+            ((dentry->d_inode->i_state & I_DIRTY_SYNC) && !datasync)) &&
+            ip->i_update_core) {
+                /*
+                 * Kick off a transaction to log the inode core to get the
+                 * updates.  The sync transaction will also force the log.
+                 */
+                xfs_iunlock(ip, XFS_ILOCK_SHARED);
+                tp = xfs_trans_alloc(ip->i_mount, XFS_TRANS_FSYNC_TS);
+                error = xfs_trans_reserve(tp, 0,
+                                XFS_FSYNC_TS_LOG_RES(ip->i_mount), 0, 0, 0);
+                if (error) {
+                        xfs_trans_cancel(tp, 0);
+                        return -error;
+                }
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+
+                /*
+                 * Note - it's possible that we might have pushed ourselves out
+                 * of the way during trans_reserve which would flush the inode.
+                 * But there's no guarantee that the inode buffer has actually
+                 * gone out yet (it's delwri).  Plus the buffer could be pinned
+                 * anyway if it's part of an inode in another recent
+                 * transaction.  So we play it safe and fire off the
+                 * transaction anyway.
+                 */
+                xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
+                xfs_trans_ihold(tp, ip);
+                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+                xfs_trans_set_sync(tp);
+                error = _xfs_trans_commit(tp, 0, &log_flushed);
+
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        } else {
+                /*
+                 * Timestamps/size haven't changed since last inode flush or
+                 * inode transaction commit.  That means either nothing got
+                 * written or a transaction committed which caught the updates.
+                 * If the latter happened and the transaction hasn't hit the
+                 * disk yet, the inode will be still be pinned.  If it is,
+                 * force the log.
+                 */
+                if (xfs_ipincount(ip)) {
+                        error = _xfs_log_force_lsn(ip->i_mount,
+                                        ip->i_itemp->ili_last_lsn,
+                                        XFS_LOG_SYNC, &log_flushed);
+                }
+                xfs_iunlock(ip, XFS_ILOCK_SHARED);
+        }
+
+        if (ip->i_mount->m_flags & XFS_MOUNT_BARRIER) {
+                /*
+                 * If the log write didn't issue an ordered tag we need
+                 * to flush the disk cache for the data device now.
+                 */
+                if (!log_flushed)
+                        xfs_blkdev_issue_flush(ip->i_mount->m_ddev_targp);
+
+                /*
+                 * If this inode is on the RT dev we need to flush that
+                 * cache as well.
+                 */
+                if (XFS_IS_REALTIME_INODE(ip))
+                        xfs_blkdev_issue_flush(ip->i_mount->m_rtdev_targp);
+        }
+
+        return -error;
 }
 
 STATIC ssize_t
-xfs_file_aio_write(
+xfs_file_aio_read(
         struct kiocb            *iocb,
-        const struct iovec      *iov,
+        const struct iovec      *iovp,
         unsigned long           nr_segs,
         loff_t                  pos)
 {
         struct file             *file = iocb->ki_filp;
+        struct inode            *inode = file->f_mapping->host;
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
+        size_t                  size = 0;
+        ssize_t                 ret = 0;
         int                     ioflags = 0;
+        xfs_fsize_t             n;
+        unsigned long           seg;
+
+        XFS_STATS_INC(xs_read_calls);
 
         BUG_ON(iocb->ki_pos != pos);
+
         if (unlikely(file->f_flags & O_DIRECT))
                 ioflags |= IO_ISDIRECT;
         if (file->f_mode & FMODE_NOCMTIME)
                 ioflags |= IO_INVIS;
-        return xfs_write(XFS_I(file->f_mapping->host), iocb, iov, nr_segs,
-                                &iocb->ki_pos, ioflags);
+
+        /* START copy & waste from filemap.c */
+        for (seg = 0; seg < nr_segs; seg++) {
+                const struct iovec *iv = &iovp[seg];
+
+                /*
+                 * If any segment has a negative length, or the cumulative
+                 * length ever wraps negative then return -EINVAL.
+                 */
+                size += iv->iov_len;
+                if (unlikely((ssize_t)(size|iv->iov_len) < 0))
+                        return XFS_ERROR(-EINVAL);
+        }
+        /* END copy & waste from filemap.c */
+
+        if (unlikely(ioflags & IO_ISDIRECT)) {
+                xfs_buftarg_t   *target =
+                        XFS_IS_REALTIME_INODE(ip) ?
+                                mp->m_rtdev_targp : mp->m_ddev_targp;
+                if ((iocb->ki_pos & target->bt_smask) ||
+                    (size & target->bt_smask)) {
+                        if (iocb->ki_pos == ip->i_size)
+                                return 0;
+                        return -XFS_ERROR(EINVAL);
+                }
+        }
+
+        n = XFS_MAXIOFFSET(mp) - iocb->ki_pos;
+        if (n <= 0 || size == 0)
+                return 0;
+
+        if (n < size)
+                size = n;
+
+        if (XFS_FORCED_SHUTDOWN(mp))
+                return -EIO;
+
+        if (unlikely(ioflags & IO_ISDIRECT))
+                mutex_lock(&inode->i_mutex);
+        xfs_ilock(ip, XFS_IOLOCK_SHARED);
+
+        if (DM_EVENT_ENABLED(ip, DM_EVENT_READ) && !(ioflags & IO_INVIS)) {
+                int dmflags = FILP_DELAY_FLAG(file) | DM_SEM_FLAG_RD(ioflags);
+                int iolock = XFS_IOLOCK_SHARED;
+
+                ret = -XFS_SEND_DATA(mp, DM_EVENT_READ, ip, iocb->ki_pos, size,
+                                        dmflags, &iolock);
+                if (ret) {
+                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+                        if (unlikely(ioflags & IO_ISDIRECT))
+                                mutex_unlock(&inode->i_mutex);
+                        return ret;
+                }
+        }
+
+        if (unlikely(ioflags & IO_ISDIRECT)) {
+                if (inode->i_mapping->nrpages) {
+                        ret = -xfs_flushinval_pages(ip,
+                                        (iocb->ki_pos & PAGE_CACHE_MASK),
+                                        -1, FI_REMAPF_LOCKED);
+                }
+                mutex_unlock(&inode->i_mutex);
+                if (ret) {
+                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+                        return ret;
+                }
+        }
+
+        trace_xfs_file_read(ip, size, iocb->ki_pos, ioflags);
+
+        ret = generic_file_aio_read(iocb, iovp, nr_segs, iocb->ki_pos);
+        if (ret > 0)
+                XFS_STATS_ADD(xs_read_bytes, ret);
+
+        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+        return ret;
 }
 
 STATIC ssize_t
@@ -87,16 +315,44 @@ xfs_file_splice_read(
         struct file             *infilp,
         loff_t                  *ppos,
         struct pipe_inode_info  *pipe,
-        size_t                  len,
+        size_t                  count,
         unsigned int            flags)
 {
+        struct xfs_inode        *ip = XFS_I(infilp->f_mapping->host);
+        struct xfs_mount        *mp = ip->i_mount;
         int                     ioflags = 0;
+        ssize_t                 ret;
+
+        XFS_STATS_INC(xs_read_calls);
 
         if (infilp->f_mode & FMODE_NOCMTIME)
                 ioflags |= IO_INVIS;
 
-        return xfs_splice_read(XFS_I(infilp->f_path.dentry->d_inode),
-                                   infilp, ppos, pipe, len, flags, ioflags);
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -EIO;
+
+        xfs_ilock(ip, XFS_IOLOCK_SHARED);
+
+        if (DM_EVENT_ENABLED(ip, DM_EVENT_READ) && !(ioflags & IO_INVIS)) {
+                int iolock = XFS_IOLOCK_SHARED;
+                int error;
+
+                error = XFS_SEND_DATA(mp, DM_EVENT_READ, ip, *ppos, count,
+                                        FILP_DELAY_FLAG(infilp), &iolock);
+                if (error) {
+                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+                        return -error;
+                }
+        }
+
+        trace_xfs_file_splice_read(ip, count, *ppos, ioflags);
+
+        ret = generic_file_splice_read(infilp, ppos, pipe, count, flags);
+        if (ret > 0)
+                XFS_STATS_ADD(xs_read_bytes, ret);
+
+        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+        return ret;
 }
 
 STATIC ssize_t
@@ -104,16 +360,538 @@ xfs_file_splice_write(
         struct pipe_inode_info  *pipe,
         struct file             *outfilp,
         loff_t                  *ppos,
-        size_t                  len,
+        size_t                  count,
         unsigned int            flags)
 {
+        struct inode            *inode = outfilp->f_mapping->host;
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
+        xfs_fsize_t             isize, new_size;
         int                     ioflags = 0;
+        ssize_t                 ret;
+
+        XFS_STATS_INC(xs_write_calls);
 
         if (outfilp->f_mode & FMODE_NOCMTIME)
                 ioflags |= IO_INVIS;
 
-        return xfs_splice_write(XFS_I(outfilp->f_path.dentry->d_inode),
-                                    pipe, outfilp, ppos, len, flags, ioflags);
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -EIO;
+
+        xfs_ilock(ip, XFS_IOLOCK_EXCL);
+
+        if (DM_EVENT_ENABLED(ip, DM_EVENT_WRITE) && !(ioflags & IO_INVIS)) {
+                int iolock = XFS_IOLOCK_EXCL;
+                int error;
+
+                error = XFS_SEND_DATA(mp, DM_EVENT_WRITE, ip, *ppos, count,
+                                        FILP_DELAY_FLAG(outfilp), &iolock);
+                if (error) {
+                        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
+                        return -error;
+                }
+        }
+
+        new_size = *ppos + count;
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        if (new_size > ip->i_size)
+                ip->i_new_size = new_size;
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+
+        trace_xfs_file_splice_write(ip, count, *ppos, ioflags);
+
+        ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
+        if (ret > 0)
+                XFS_STATS_ADD(xs_write_bytes, ret);
+
+        isize = i_size_read(inode);
+        if (unlikely(ret < 0 && ret != -EFAULT && *ppos > isize))
+                *ppos = isize;
+
+        if (*ppos > ip->i_size) {
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                if (*ppos > ip->i_size)
+                        ip->i_size = *ppos;
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        }
+
+        if (ip->i_new_size) {
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                ip->i_new_size = 0;
+                if (ip->i_d.di_size > ip->i_size)
+                        ip->i_d.di_size = ip->i_size;
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        }
+        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
+        return ret;
+}
+
+/*
+ * This routine is called to handle zeroing any space in the last
+ * block of the file that is beyond the EOF.  We do this since the
+ * size is being increased without writing anything to that block
+ * and we don't want anyone to read the garbage on the disk.
+ */
+STATIC int                              /* error (positive) */
+xfs_zero_last_block(
+        xfs_inode_t     *ip,
+        xfs_fsize_t     offset,
+        xfs_fsize_t     isize)
+{
+        xfs_fileoff_t   last_fsb;
+        xfs_mount_t     *mp = ip->i_mount;
+        int             nimaps;
+        int             zero_offset;
+        int             zero_len;
+        int             error = 0;
+        xfs_bmbt_irec_t imap;
+
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
+
+        zero_offset = XFS_B_FSB_OFFSET(mp, isize);
+        if (zero_offset == 0) {
+                /*
+                 * There are no extra bytes in the last block on disk to
+                 * zero, so return.
+                 */
+                return 0;
+        }
+
+        last_fsb = XFS_B_TO_FSBT(mp, isize);
+        nimaps = 1;
+        error = xfs_bmapi(NULL, ip, last_fsb, 1, 0, NULL, 0, &imap,
+                          &nimaps, NULL, NULL);
+        if (error) {
+                return error;
+        }
+        ASSERT(nimaps > 0);
+        /*
+         * If the block underlying isize is just a hole, then there
+         * is nothing to zero.
+         */
+        if (imap.br_startblock == HOLESTARTBLOCK) {
+                return 0;
+        }
+        /*
+         * Zero the part of the last block beyond the EOF, and write it
+         * out sync.  We need to drop the ilock while we do this so we
+         * don't deadlock when the buffer cache calls back to us.
+         */
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+
+        zero_len = mp->m_sb.sb_blocksize - zero_offset;
+        if (isize + zero_len > offset)
+                zero_len = offset - isize;
+        error = xfs_iozero(ip, isize, zero_len);
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        ASSERT(error >= 0);
+        return error;
+}
+
+/*
+ * Zero any on disk space between the current EOF and the new,
+ * larger EOF.  This handles the normal case of zeroing the remainder
+ * of the last block in the file and the unusual case of zeroing blocks
+ * out beyond the size of the file.  This second case only happens
+ * with fixed size extents and when the system crashes before the inode
+ * size was updated but after blocks were allocated.  If fill is set,
+ * then any holes in the range are filled and zeroed.  If not, the holes
+ * are left alone as holes.
+ */
+
+int                                     /* error (positive) */
+xfs_zero_eof(
+        xfs_inode_t     *ip,
+        xfs_off_t       offset,         /* starting I/O offset */
+        xfs_fsize_t     isize)          /* current inode size */
+{
+        xfs_mount_t     *mp = ip->i_mount;
+        xfs_fileoff_t   start_zero_fsb;
+        xfs_fileoff_t   end_zero_fsb;
+        xfs_fileoff_t   zero_count_fsb;
+        xfs_fileoff_t   last_fsb;
+        xfs_fileoff_t   zero_off;
+        xfs_fsize_t     zero_len;
+        int             nimaps;
+        int             error = 0;
+        xfs_bmbt_irec_t imap;
+
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
+        ASSERT(offset > isize);
+
+        /*
+         * First handle zeroing the block on which isize resides.
+         * We only zero a part of that block so it is handled specially.
+         */
+        error = xfs_zero_last_block(ip, offset, isize);
+        if (error) {
+                ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
+                return error;
+        }
+
+        /*
+         * Calculate the range between the new size and the old
+         * where blocks needing to be zeroed may exist.  To get the
+         * block where the last byte in the file currently resides,
+         * we need to subtract one from the size and truncate back
+         * to a block boundary.  We subtract 1 in case the size is
+         * exactly on a block boundary.
+         */
+        last_fsb = isize ? XFS_B_TO_FSBT(mp, isize - 1) : (xfs_fileoff_t)-1;
+        start_zero_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)isize);
+        end_zero_fsb = XFS_B_TO_FSBT(mp, offset - 1);
+        ASSERT((xfs_sfiloff_t)last_fsb < (xfs_sfiloff_t)start_zero_fsb);
+        if (last_fsb == end_zero_fsb) {
+                /*
+                 * The size was only incremented on its last block.
+                 * We took care of that above, so just return.
+                 */
+                return 0;
+        }
+
+        ASSERT(start_zero_fsb <= end_zero_fsb);
+        while (start_zero_fsb <= end_zero_fsb) {
+                nimaps = 1;
+                zero_count_fsb = end_zero_fsb - start_zero_fsb + 1;
+                error = xfs_bmapi(NULL, ip, start_zero_fsb, zero_count_fsb,
+                                  0, NULL, 0, &imap, &nimaps, NULL, NULL);
+                if (error) {
+                        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
+                        return error;
+                }
+                ASSERT(nimaps > 0);
+
+                if (imap.br_state == XFS_EXT_UNWRITTEN ||
+                    imap.br_startblock == HOLESTARTBLOCK) {
+                        /*
+                         * This loop handles initializing pages that were
+                         * partially initialized by the code below this
+                         * loop. It basically zeroes the part of the page
+                         * that sits on a hole and sets the page as P_HOLE
+                         * and calls remapf if it is a mapped file.
+                         */
+                        start_zero_fsb = imap.br_startoff + imap.br_blockcount;
+                        ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
+                        continue;
+                }
+
+                /*
+                 * There are blocks we need to zero.
+                 * Drop the inode lock while we're doing the I/O.
+                 * We'll still have the iolock to protect us.
+                 */
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+
+                zero_off = XFS_FSB_TO_B(mp, start_zero_fsb);
+                zero_len = XFS_FSB_TO_B(mp, imap.br_blockcount);
+
+                if ((zero_off + zero_len) > offset)
+                        zero_len = offset - zero_off;
+
+                error = xfs_iozero(ip, zero_off, zero_len);
+                if (error) {
+                        goto out_lock;
+                }
+
+                start_zero_fsb = imap.br_startoff + imap.br_blockcount;
+                ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
+
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+        }
+
+        return 0;
+
+out_lock:
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        ASSERT(error >= 0);
+        return error;
+}
+
+STATIC ssize_t
+xfs_file_aio_write(
+        struct kiocb            *iocb,
+        const struct iovec      *iovp,
+        unsigned long           nr_segs,
+        loff_t                  pos)
+{
+        struct file             *file = iocb->ki_filp;
+        struct address_space    *mapping = file->f_mapping;
+        struct inode            *inode = mapping->host;
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
+        ssize_t                 ret = 0, error = 0;
+        int                     ioflags = 0;
+        xfs_fsize_t             isize, new_size;
+        int                     iolock;
+        int                     eventsent = 0;
+        size_t                  ocount = 0, count;
+        int                     need_i_mutex;
+
+        XFS_STATS_INC(xs_write_calls);
+
+        BUG_ON(iocb->ki_pos != pos);
+
+        if (unlikely(file->f_flags & O_DIRECT))
+                ioflags |= IO_ISDIRECT;
+        if (file->f_mode & FMODE_NOCMTIME)
+                ioflags |= IO_INVIS;
+
+        error = generic_segment_checks(iovp, &nr_segs, &ocount, VERIFY_READ);
+        if (error)
+                return error;
+
+        count = ocount;
+        if (count == 0)
+                return 0;
+
+        xfs_wait_for_freeze(mp, SB_FREEZE_WRITE);
+
+        if (XFS_FORCED_SHUTDOWN(mp))
+                return -EIO;
+
+relock:
+        if (ioflags & IO_ISDIRECT) {
+                iolock = XFS_IOLOCK_SHARED;
+                need_i_mutex = 0;
+        } else {
+                iolock = XFS_IOLOCK_EXCL;
+                need_i_mutex = 1;
+                mutex_lock(&inode->i_mutex);
+        }
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL|iolock);
+
+start:
+        error = -generic_write_checks(file, &pos, &count,
+                                        S_ISBLK(inode->i_mode));
+        if (error) {
+                xfs_iunlock(ip, XFS_ILOCK_EXCL|iolock);
+                goto out_unlock_mutex;
+        }
+
+        if ((DM_EVENT_ENABLED(ip, DM_EVENT_WRITE) &&
+            !(ioflags & IO_INVIS) && !eventsent)) {
+                int             dmflags = FILP_DELAY_FLAG(file);
+
+                if (need_i_mutex)
+                        dmflags |= DM_FLAGS_IMUX;
+
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+                error = XFS_SEND_DATA(ip->i_mount, DM_EVENT_WRITE, ip,
+                                      pos, count, dmflags, &iolock);
+                if (error) {
+                        goto out_unlock_internal;
+                }
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                eventsent = 1;
+
+                /*
+                 * The iolock was dropped and reacquired in XFS_SEND_DATA
+                 * so we have to recheck the size when appending.
+                 * We will only "goto start;" once, since having sent the
+                 * event prevents another call to XFS_SEND_DATA, which is
+                 * what allows the size to change in the first place.
+                 */
+                if ((file->f_flags & O_APPEND) && pos != ip->i_size)
+                        goto start;
+        }
+
+        if (ioflags & IO_ISDIRECT) {
+                xfs_buftarg_t   *target =
+                        XFS_IS_REALTIME_INODE(ip) ?
+                                mp->m_rtdev_targp : mp->m_ddev_targp;
+
+                if ((pos & target->bt_smask) || (count & target->bt_smask)) {
+                        xfs_iunlock(ip, XFS_ILOCK_EXCL|iolock);
+                        return XFS_ERROR(-EINVAL);
+                }
+
+                if (!need_i_mutex && (mapping->nrpages || pos > ip->i_size)) {
+                        xfs_iunlock(ip, XFS_ILOCK_EXCL|iolock);
+                        iolock = XFS_IOLOCK_EXCL;
+                        need_i_mutex = 1;
+                        mutex_lock(&inode->i_mutex);
+                        xfs_ilock(ip, XFS_ILOCK_EXCL|iolock);
+                        goto start;
+                }
+        }
+
+        new_size = pos + count;
+        if (new_size > ip->i_size)
+                ip->i_new_size = new_size;
+
+        if (likely(!(ioflags & IO_INVIS)))
+                file_update_time(file);
+
+        /*
+         * If the offset is beyond the size of the file, we have a couple
+         * of things to do. First, if there is already space allocated
+         * we need to either create holes or zero the disk or ...
+         *
+         * If there is a page where the previous size lands, we need
+         * to zero it out up to the new size.
+         */
+
+        if (pos > ip->i_size) {
+                error = xfs_zero_eof(ip, pos, ip->i_size);
+                if (error) {
+                        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+                        goto out_unlock_internal;
+                }
+        }
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+
+        /*
+         * If we're writing the file then make sure to clear the
+         * setuid and setgid bits if the process is not being run
+         * by root.  This keeps people from modifying setuid and
+         * setgid binaries.
+         */
+        error = -file_remove_suid(file);
+        if (unlikely(error))
+                goto out_unlock_internal;
+
+        /* We can write back this queue in page reclaim */
+        current->backing_dev_info = mapping->backing_dev_info;
+
+        if ((ioflags & IO_ISDIRECT)) {
+                if (mapping->nrpages) {
+                        WARN_ON(need_i_mutex == 0);
+                        error = xfs_flushinval_pages(ip,
+                                        (pos & PAGE_CACHE_MASK),
+                                        -1, FI_REMAPF_LOCKED);
+                        if (error)
+                                goto out_unlock_internal;
+                }
+
+                if (need_i_mutex) {
+                        /* demote the lock now the cached pages are gone */
+                        xfs_ilock_demote(ip, XFS_IOLOCK_EXCL);
+                        mutex_unlock(&inode->i_mutex);
+
+                        iolock = XFS_IOLOCK_SHARED;
+                        need_i_mutex = 0;
+                }
+
+                trace_xfs_file_direct_write(ip, count, iocb->ki_pos, ioflags);
+                ret = generic_file_direct_write(iocb, iovp,
+                                &nr_segs, pos, &iocb->ki_pos, count, ocount);
+
+                /*
+                 * direct-io write to a hole: fall through to buffered I/O
+                 * for completing the rest of the request.
+                 */
+                if (ret >= 0 && ret != count) {
+                        XFS_STATS_ADD(xs_write_bytes, ret);
+
+                        pos += ret;
+                        count -= ret;
+
+                        ioflags &= ~IO_ISDIRECT;
+                        xfs_iunlock(ip, iolock);
+                        goto relock;
+                }
+        } else {
+                int enospc = 0;
+                ssize_t ret2 = 0;
+
+write_retry:
+                trace_xfs_file_buffered_write(ip, count, iocb->ki_pos, ioflags);
+                ret2 = generic_file_buffered_write(iocb, iovp, nr_segs,
+                                pos, &iocb->ki_pos, count, ret);
+                /*
+                 * if we just got an ENOSPC, flush the inode now we
+                 * aren't holding any page locks and retry *once*
+                 */
+                if (ret2 == -ENOSPC && !enospc) {
+                        error = xfs_flush_pages(ip, 0, -1, 0, FI_NONE);
+                        if (error)
+                                goto out_unlock_internal;
+                        enospc = 1;
+                        goto write_retry;
+                }
+                ret = ret2;
+        }
+
+        current->backing_dev_info = NULL;
+
+        isize = i_size_read(inode);
+        if (unlikely(ret < 0 && ret != -EFAULT && iocb->ki_pos > isize))
+                iocb->ki_pos = isize;
+
+        if (iocb->ki_pos > ip->i_size) {
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                if (iocb->ki_pos > ip->i_size)
+                        ip->i_size = iocb->ki_pos;
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        }
+
+        if (ret == -ENOSPC &&
+            DM_EVENT_ENABLED(ip, DM_EVENT_NOSPACE) && !(ioflags & IO_INVIS)) {
+                xfs_iunlock(ip, iolock);
+                if (need_i_mutex)
+                        mutex_unlock(&inode->i_mutex);
+                error = XFS_SEND_NAMESP(ip->i_mount, DM_EVENT_NOSPACE, ip,
+                                DM_RIGHT_NULL, ip, DM_RIGHT_NULL, NULL, NULL,
+                                0, 0, 0); /* Delay flag intentionally  unused */
+                if (need_i_mutex)
+                        mutex_lock(&inode->i_mutex);
+                xfs_ilock(ip, iolock);
+                if (error)
+                        goto out_unlock_internal;
+                goto start;
+        }
+
+        error = -ret;
+        if (ret <= 0)
+                goto out_unlock_internal;
+
+        XFS_STATS_ADD(xs_write_bytes, ret);
+
+        /* Handle various SYNC-type writes */
+        if ((file->f_flags & O_DSYNC) || IS_SYNC(inode)) {
+                loff_t end = pos + ret - 1;
+                int error2;
+
+                xfs_iunlock(ip, iolock);
+                if (need_i_mutex)
+                        mutex_unlock(&inode->i_mutex);
+
+                error2 = filemap_write_and_wait_range(mapping, pos, end);
+                if (!error)
+                        error = error2;
+                if (need_i_mutex)
+                        mutex_lock(&inode->i_mutex);
+                xfs_ilock(ip, iolock);
+
+                error2 = -xfs_file_fsync(file, file->f_path.dentry,
+                                         (file->f_flags & __O_SYNC) ? 0 : 1);
+                if (!error)
+                        error = error2;
+        }
+
+ out_unlock_internal:
+        if (ip->i_new_size) {
+                xfs_ilock(ip, XFS_ILOCK_EXCL);
+                ip->i_new_size = 0;
+                /*
+                 * If this was a direct or synchronous I/O that failed (such
+                 * as ENOSPC) then part of the I/O may have been written to
+                 * disk before the error occured.  In this case the on-disk
+                 * file size may have been adjusted beyond the in-memory file
+                 * size and now needs to be truncated back.
+                 */
+                if (ip->i_d.di_size > ip->i_size)
+                        ip->i_d.di_size = ip->i_size;
+                xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        }
+        xfs_iunlock(ip, iolock);
+ out_unlock_mutex:
+        if (need_i_mutex)
+                mutex_unlock(&inode->i_mutex);
+        return -error;
 }
 
 STATIC int
@@ -160,28 +938,6 @@ xfs_file_release(
         return -xfs_release(XFS_I(inode));
 }
 
-/*
- * We ignore the datasync flag here because a datasync is effectively
- * identical to an fsync. That is, datasync implies that we need to write
- * only the metadata needed to be able to access the data that is written
- * if we crash after the call completes. Hence if we are writing beyond
- * EOF we have to log the inode size change as well, which makes it a
- * full fsync. If we don't write beyond EOF, the inode core will be
- * clean in memory and so we don't need to log the inode, just like
- * fsync.
- */
-STATIC int
-xfs_file_fsync(
-        struct file             *file,
-        struct dentry           *dentry,
-        int                     datasync)
-{
-        struct xfs_inode        *ip = XFS_I(dentry->d_inode);
-
-        xfs_iflags_clear(ip, XFS_ITRUNCATED);
-        return -xfs_fsync(ip);
-}
-
 STATIC int
 xfs_file_readdir(
         struct file     *filp,
@@ -203,9 +959,9 @@ xfs_file_readdir(
          *
          * Try to give it an estimate that's good enough, maybe at some
          * point we can change the ->readdir prototype to include the
-         * buffer size.
+         * buffer size.  For now we use the current glibc buffer size.
          */
-        bufsize = (size_t)min_t(loff_t, PAGE_SIZE, ip->i_d.di_size);
+        bufsize = (size_t)min_t(loff_t, 32768, ip->i_d.di_size);
 
         error = xfs_readdir(ip, dirent, bufsize,
                                 (xfs_off_t *)&filp->f_pos, filldir);
diff --git a/fs/xfs/linux-2.6/xfs_fs_subr.c b/fs/xfs/linux-2.6/xfs_fs_subr.c
index 7501b85fd860..b6918d76bc7b 100644
--- a/fs/xfs/linux-2.6/xfs_fs_subr.c
+++ b/fs/xfs/linux-2.6/xfs_fs_subr.c
@@ -79,7 +79,7 @@ xfs_flush_pages(
                 xfs_iflags_clear(ip, XFS_ITRUNCATED);
                 ret = -filemap_fdatawrite(mapping);
         }
-        if (flags & XFS_B_ASYNC)
+        if (flags & XBF_ASYNC)
                 return ret;
         ret2 = xfs_wait_on_pages(ip, first, last);
         if (!ret)
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index a034cf624437..7b26cc2fd284 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -58,6 +58,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/pagemap.h>
+#include <linux/slab.h>
 #include <linux/exportfs.h>
 
 /*
@@ -447,12 +448,12 @@ xfs_attrlist_by_handle(
 int
 xfs_attrmulti_attr_get(
         struct inode            *inode,
-        char                    *name,
-        char                    __user *ubuf,
+        unsigned char           *name,
+        unsigned char           __user *ubuf,
         __uint32_t              *len,
         __uint32_t              flags)
 {
-        char                    *kbuf;
+        unsigned char           *kbuf;
         int                     error = EFAULT;
 
         if (*len > XATTR_SIZE_MAX)
@@ -476,12 +477,12 @@ xfs_attrmulti_attr_get(
 int
 xfs_attrmulti_attr_set(
         struct inode            *inode,
-        char                    *name,
-        const char              __user *ubuf,
+        unsigned char           *name,
+        const unsigned char     __user *ubuf,
         __uint32_t              len,
         __uint32_t              flags)
 {
-        char                    *kbuf;
+        unsigned char           *kbuf;
         int                     error = EFAULT;
 
         if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
@@ -501,7 +502,7 @@ xfs_attrmulti_attr_set(
 int
 xfs_attrmulti_attr_remove(
         struct inode            *inode,
-        char                    *name,
+        unsigned char           *name,
         __uint32_t              flags)
 {
         if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
@@ -519,7 +520,7 @@ xfs_attrmulti_by_handle(
         xfs_fsop_attrmulti_handlereq_t am_hreq;
         struct dentry           *dentry;
         unsigned int            i, size;
-        char                    *attr_name;
+        unsigned char           *attr_name;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -XFS_ERROR(EPERM);
@@ -547,7 +548,7 @@ xfs_attrmulti_by_handle(
 
         error = 0;
         for (i = 0; i < am_hreq.opcount; i++) {
-                ops[i].am_error = strncpy_from_user(attr_name,
+                ops[i].am_error = strncpy_from_user((char *)attr_name,
                                 ops[i].am_attrname, MAXNAMELEN);
                 if (ops[i].am_error == 0 || ops[i].am_error == MAXNAMELEN)
                         error = -ERANGE;
@@ -1431,6 +1432,9 @@ xfs_file_ioctl(
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
 
+                if (mp->m_flags & XFS_MOUNT_RDONLY)
+                        return -XFS_ERROR(EROFS);
+
                 if (copy_from_user(&inout, arg, sizeof(inout)))
                         return -XFS_ERROR(EFAULT);
 
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.h b/fs/xfs/linux-2.6/xfs_ioctl.h
index 7bd7c6afc1eb..d56173b34a2a 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.h
+++ b/fs/xfs/linux-2.6/xfs_ioctl.h
@@ -45,23 +45,23 @@ xfs_readlink_by_handle(
 extern int
 xfs_attrmulti_attr_get(
         struct inode            *inode,
-        char                    *name,
-        char                    __user *ubuf,
+        unsigned char           *name,
+        unsigned char           __user *ubuf,
         __uint32_t              *len,
         __uint32_t              flags);
 
 extern int
-        xfs_attrmulti_attr_set(
+xfs_attrmulti_attr_set(
         struct inode            *inode,
-        char                    *name,
-        const char              __user *ubuf,
+        unsigned char           *name,
+        const unsigned char     __user *ubuf,
         __uint32_t              len,
         __uint32_t              flags);
 
 extern int
 xfs_attrmulti_attr_remove(
         struct inode            *inode,
-        char                    *name,
+        unsigned char           *name,
         __uint32_t              flags);
 
 extern struct dentry *
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index be1527b1670c..593c05b4df8d 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -18,6 +18,7 @@
 #include <linux/compat.h>
 #include <linux/ioctl.h>
 #include <linux/mount.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include "xfs.h"
 #include "xfs_fs.h"
@@ -411,7 +412,7 @@ xfs_compat_attrmulti_by_handle(
         compat_xfs_fsop_attrmulti_handlereq_t   am_hreq;
         struct dentry                           *dentry;
         unsigned int                            i, size;
-        char                                    *attr_name;
+        unsigned char                           *attr_name;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -XFS_ERROR(EPERM);
@@ -440,7 +441,7 @@ xfs_compat_attrmulti_by_handle(
 
         error = 0;
         for (i = 0; i < am_hreq.opcount; i++) {
-                ops[i].am_error = strncpy_from_user(attr_name,
+                ops[i].am_error = strncpy_from_user((char *)attr_name,
                                 compat_ptr(ops[i].am_attrname),
                                 MAXNAMELEN);
                 if (ops[i].am_error == 0 || ops[i].am_error == MAXNAMELEN)
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index 225946012d0b..e65a7937f3a4 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -56,6 +56,7 @@
 #include <linux/security.h>
 #include <linux/falloc.h>
 #include <linux/fiemap.h>
+#include <linux/slab.h>
 
 /*
  * Bring the timestamps in the XFS inode uptodate.
@@ -91,6 +92,16 @@ xfs_mark_inode_dirty_sync(
                 mark_inode_dirty_sync(inode);
 }
 
+void
+xfs_mark_inode_dirty(
+        xfs_inode_t     *ip)
+{
+        struct inode    *inode = VFS_I(ip);
+
+        if (!(inode->i_state & (I_WILL_FREE|I_FREEING|I_CLEAR)))
+                mark_inode_dirty(inode);
+}
+
 /*
  * Change the requested timestamp in the given inode.
  * We don't lock across timestamp updates, and we don't log them but
@@ -140,10 +151,10 @@ xfs_init_security(
         struct xfs_inode *ip = XFS_I(inode);
         size_t          length;
         void            *value;
-        char            *name;
+        unsigned char   *name;
         int             error;
 
-        error = security_inode_init_security(inode, dir, &name,
+        error = security_inode_init_security(inode, dir, (char **)&name,
                                              &value, &length);
         if (error) {
                 if (error == -EOPNOTSUPP)
diff --git a/fs/xfs/linux-2.6/xfs_linux.h b/fs/xfs/linux-2.6/xfs_linux.h
index 5af0c81ca1ae..facfb323a706 100644
--- a/fs/xfs/linux-2.6/xfs_linux.h
+++ b/fs/xfs/linux-2.6/xfs_linux.h
@@ -88,7 +88,6 @@
 #include <xfs_super.h>
 #include <xfs_globals.h>
 #include <xfs_fs_subr.h>
-#include <xfs_lrw.h>
 #include <xfs_buf.h>
 
 /*
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
deleted file mode 100644
index 0d32457abef1..000000000000
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ /dev/null
@@ -1,852 +0,0 @@
-/*
- * Copyright (c) 2000-2003,2005 Silicon Graphics, Inc.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-#include "xfs.h"
-#include "xfs_fs.h"
-#include "xfs_bit.h"
-#include "xfs_log.h"
-#include "xfs_inum.h"
-#include "xfs_trans.h"
-#include "xfs_sb.h"
-#include "xfs_ag.h"
-#include "xfs_dir2.h"
-#include "xfs_alloc.h"
-#include "xfs_dmapi.h"
-#include "xfs_quota.h"
-#include "xfs_mount.h"
-#include "xfs_bmap_btree.h"
-#include "xfs_alloc_btree.h"
-#include "xfs_ialloc_btree.h"
-#include "xfs_dir2_sf.h"
-#include "xfs_attr_sf.h"
-#include "xfs_dinode.h"
-#include "xfs_inode.h"
-#include "xfs_bmap.h"
-#include "xfs_btree.h"
-#include "xfs_ialloc.h"
-#include "xfs_rtalloc.h"
-#include "xfs_error.h"
-#include "xfs_itable.h"
-#include "xfs_rw.h"
-#include "xfs_attr.h"
-#include "xfs_inode_item.h"
-#include "xfs_buf_item.h"
-#include "xfs_utils.h"
-#include "xfs_iomap.h"
-#include "xfs_vnodeops.h"
-#include "xfs_trace.h"
-
-#include <linux/capability.h>
-#include <linux/writeback.h>
-
-
-/*
- *      xfs_iozero
- *
- *      xfs_iozero clears the specified range of buffer supplied,
- *      and marks all the affected blocks as valid and modified.  If
- *      an affected block is not allocated, it will be allocated.  If
- *      an affected block is not completely overwritten, and is not
- *      valid before the operation, it will be read from disk before
- *      being partially zeroed.
- */
-STATIC int
-xfs_iozero(
-        struct xfs_inode        *ip,    /* inode                        */
-        loff_t                  pos,    /* offset in file               */
-        size_t                  count)  /* size of data to zero         */
-{
-        struct page             *page;
-        struct address_space    *mapping;
-        int                     status;
-
-        mapping = VFS_I(ip)->i_mapping;
-        do {
-                unsigned offset, bytes;
-                void *fsdata;
-
-                offset = (pos & (PAGE_CACHE_SIZE -1)); /* Within page */
-                bytes = PAGE_CACHE_SIZE - offset;
-                if (bytes > count)
-                        bytes = count;
-
-                status = pagecache_write_begin(NULL, mapping, pos, bytes,
-                                        AOP_FLAG_UNINTERRUPTIBLE,
-                                        &page, &fsdata);
-                if (status)
-                        break;
-
-                zero_user(page, offset, bytes);
-
-                status = pagecache_write_end(NULL, mapping, pos, bytes, bytes,
-                                        page, fsdata);
-                WARN_ON(status <= 0); /* can't return less than zero! */
-                pos += bytes;
-                count -= bytes;
-                status = 0;
-        } while (count);
-
-        return (-status);
-}
-
-ssize_t                 /* bytes read, or (-)  error */
-xfs_read(
-        xfs_inode_t             *ip,
-        struct kiocb            *iocb,
-        const struct iovec      *iovp,
-        unsigned int            segs,
-        loff_t                  *offset,
-        int                     ioflags)
-{
-        struct file             *file = iocb->ki_filp;
-        struct inode            *inode = file->f_mapping->host;
-        xfs_mount_t             *mp = ip->i_mount;
-        size_t                  size = 0;
-        ssize_t                 ret = 0;
-        xfs_fsize_t             n;
-        unsigned long           seg;
-
-
-        XFS_STATS_INC(xs_read_calls);
-
-        /* START copy & waste from filemap.c */
-        for (seg = 0; seg < segs; seg++) {
-                const struct iovec *iv = &iovp[seg];
-
-                /*
-                 * If any segment has a negative length, or the cumulative
-                 * length ever wraps negative then return -EINVAL.
-                 */
-                size += iv->iov_len;
-                if (unlikely((ssize_t)(size|iv->iov_len) < 0))
-                        return XFS_ERROR(-EINVAL);
-        }
-        /* END copy & waste from filemap.c */
-
-        if (unlikely(ioflags & IO_ISDIRECT)) {
-                xfs_buftarg_t   *target =
-                        XFS_IS_REALTIME_INODE(ip) ?
-                                mp->m_rtdev_targp : mp->m_ddev_targp;
-                if ((*offset & target->bt_smask) ||
-                    (size & target->bt_smask)) {
-                        if (*offset == ip->i_size) {
-                                return (0);
-                        }
-                        return -XFS_ERROR(EINVAL);
-                }
-        }
-
-        n = XFS_MAXIOFFSET(mp) - *offset;
-        if ((n <= 0) || (size == 0))
-                return 0;
-
-        if (n < size)
-                size = n;
-
-        if (XFS_FORCED_SHUTDOWN(mp))
-                return -EIO;
-
-        if (unlikely(ioflags & IO_ISDIRECT))
-                mutex_lock(&inode->i_mutex);
-        xfs_ilock(ip, XFS_IOLOCK_SHARED);
-
-        if (DM_EVENT_ENABLED(ip, DM_EVENT_READ) && !(ioflags & IO_INVIS)) {
-                int dmflags = FILP_DELAY_FLAG(file) | DM_SEM_FLAG_RD(ioflags);
-                int iolock = XFS_IOLOCK_SHARED;
-
-                ret = -XFS_SEND_DATA(mp, DM_EVENT_READ, ip, *offset, size,
-                                        dmflags, &iolock);
-                if (ret) {
-                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-                        if (unlikely(ioflags & IO_ISDIRECT))
-                                mutex_unlock(&inode->i_mutex);
-                        return ret;
-                }
-        }
-
-        if (unlikely(ioflags & IO_ISDIRECT)) {
-                if (inode->i_mapping->nrpages)
-                        ret = -xfs_flushinval_pages(ip, (*offset & PAGE_CACHE_MASK),
-                                                    -1, FI_REMAPF_LOCKED);
-                mutex_unlock(&inode->i_mutex);
-                if (ret) {
-                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-                        return ret;
-                }
-        }
-
-        trace_xfs_file_read(ip, size, *offset, ioflags);
-
-        iocb->ki_pos = *offset;
-        ret = generic_file_aio_read(iocb, iovp, segs, *offset);
-        if (ret > 0)
-                XFS_STATS_ADD(xs_read_bytes, ret);
-
-        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-        return ret;
-}
-
-ssize_t
-xfs_splice_read(
-        xfs_inode_t             *ip,
-        struct file             *infilp,
-        loff_t                  *ppos,
-        struct pipe_inode_info  *pipe,
-        size_t                  count,
-        int                     flags,
-        int                     ioflags)
-{
-        xfs_mount_t             *mp = ip->i_mount;
-        ssize_t                 ret;
-
-        XFS_STATS_INC(xs_read_calls);
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
-                return -EIO;
-
-        xfs_ilock(ip, XFS_IOLOCK_SHARED);
-
-        if (DM_EVENT_ENABLED(ip, DM_EVENT_READ) && !(ioflags & IO_INVIS)) {
-                int iolock = XFS_IOLOCK_SHARED;
-                int error;
-
-                error = XFS_SEND_DATA(mp, DM_EVENT_READ, ip, *ppos, count,
-                                        FILP_DELAY_FLAG(infilp), &iolock);
-                if (error) {
-                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-                        return -error;
-                }
-        }
-
-        trace_xfs_file_splice_read(ip, count, *ppos, ioflags);
-
-        ret = generic_file_splice_read(infilp, ppos, pipe, count, flags);
-        if (ret > 0)
-                XFS_STATS_ADD(xs_read_bytes, ret);
-
-        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
-        return ret;
-}
-
-ssize_t
-xfs_splice_write(
-        xfs_inode_t             *ip,
-        struct pipe_inode_info  *pipe,
-        struct file             *outfilp,
-        loff_t                  *ppos,
-        size_t                  count,
-        int                     flags,
-        int                     ioflags)
-{
-        xfs_mount_t             *mp = ip->i_mount;
-        ssize_t                 ret;
-        struct inode            *inode = outfilp->f_mapping->host;
-        xfs_fsize_t             isize, new_size;
-
-        XFS_STATS_INC(xs_write_calls);
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
-                return -EIO;
-
-        xfs_ilock(ip, XFS_IOLOCK_EXCL);
-
-        if (DM_EVENT_ENABLED(ip, DM_EVENT_WRITE) && !(ioflags & IO_INVIS)) {
-                int iolock = XFS_IOLOCK_EXCL;
-                int error;
-
-                error = XFS_SEND_DATA(mp, DM_EVENT_WRITE, ip, *ppos, count,
-                                        FILP_DELAY_FLAG(outfilp), &iolock);
-                if (error) {
-                        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
-                        return -error;
-                }
-        }
-
-        new_size = *ppos + count;
-
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        if (new_size > ip->i_size)
-                ip->i_new_size = new_size;
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-
-        trace_xfs_file_splice_write(ip, count, *ppos, ioflags);
-
-        ret = generic_file_splice_write(pipe, outfilp, ppos, count, flags);
-        if (ret > 0)
-                XFS_STATS_ADD(xs_write_bytes, ret);
-
-        isize = i_size_read(inode);
-        if (unlikely(ret < 0 && ret != -EFAULT && *ppos > isize))
-                *ppos = isize;
-
-        if (*ppos > ip->i_size) {
-                xfs_ilock(ip, XFS_ILOCK_EXCL);
-                if (*ppos > ip->i_size)
-                        ip->i_size = *ppos;
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        }
-
-        if (ip->i_new_size) {
-                xfs_ilock(ip, XFS_ILOCK_EXCL);
-                ip->i_new_size = 0;
-                if (ip->i_d.di_size > ip->i_size)
-                        ip->i_d.di_size = ip->i_size;
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        }
-        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
-        return ret;
-}
-
-/*
- * This routine is called to handle zeroing any space in the last
- * block of the file that is beyond the EOF.  We do this since the
- * size is being increased without writing anything to that block
- * and we don't want anyone to read the garbage on the disk.
- */
-STATIC int                              /* error (positive) */
-xfs_zero_last_block(
-        xfs_inode_t     *ip,
-        xfs_fsize_t     offset,
-        xfs_fsize_t     isize)
-{
-        xfs_fileoff_t   last_fsb;
-        xfs_mount_t     *mp = ip->i_mount;
-        int             nimaps;
-        int             zero_offset;
-        int             zero_len;
-        int             error = 0;
-        xfs_bmbt_irec_t imap;
-
-        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
-
-        zero_offset = XFS_B_FSB_OFFSET(mp, isize);
-        if (zero_offset == 0) {
-                /*
-                 * There are no extra bytes in the last block on disk to
-                 * zero, so return.
-                 */
-                return 0;
-        }
-
-        last_fsb = XFS_B_TO_FSBT(mp, isize);
-        nimaps = 1;
-        error = xfs_bmapi(NULL, ip, last_fsb, 1, 0, NULL, 0, &imap,
-                          &nimaps, NULL, NULL);
-        if (error) {
-                return error;
-        }
-        ASSERT(nimaps > 0);
-        /*
-         * If the block underlying isize is just a hole, then there
-         * is nothing to zero.
-         */
-        if (imap.br_startblock == HOLESTARTBLOCK) {
-                return 0;
-        }
-        /*
-         * Zero the part of the last block beyond the EOF, and write it
-         * out sync.  We need to drop the ilock while we do this so we
-         * don't deadlock when the buffer cache calls back to us.
-         */
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-
-        zero_len = mp->m_sb.sb_blocksize - zero_offset;
-        if (isize + zero_len > offset)
-                zero_len = offset - isize;
-        error = xfs_iozero(ip, isize, zero_len);
-
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        ASSERT(error >= 0);
-        return error;
-}
-
-/*
- * Zero any on disk space between the current EOF and the new,
- * larger EOF.  This handles the normal case of zeroing the remainder
- * of the last block in the file and the unusual case of zeroing blocks
- * out beyond the size of the file.  This second case only happens
- * with fixed size extents and when the system crashes before the inode
- * size was updated but after blocks were allocated.  If fill is set,
- * then any holes in the range are filled and zeroed.  If not, the holes
- * are left alone as holes.
- */
-
-int                                     /* error (positive) */
-xfs_zero_eof(
-        xfs_inode_t     *ip,
-        xfs_off_t       offset,         /* starting I/O offset */
-        xfs_fsize_t     isize)          /* current inode size */
-{
-        xfs_mount_t     *mp = ip->i_mount;
-        xfs_fileoff_t   start_zero_fsb;
-        xfs_fileoff_t   end_zero_fsb;
-        xfs_fileoff_t   zero_count_fsb;
-        xfs_fileoff_t   last_fsb;
-        xfs_fileoff_t   zero_off;
-        xfs_fsize_t     zero_len;
-        int             nimaps;
-        int             error = 0;
-        xfs_bmbt_irec_t imap;
-
-        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
-        ASSERT(offset > isize);
-
-        /*
-         * First handle zeroing the block on which isize resides.
-         * We only zero a part of that block so it is handled specially.
-         */
-        error = xfs_zero_last_block(ip, offset, isize);
-        if (error) {
-                ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
-                return error;
-        }
-
-        /*
-         * Calculate the range between the new size and the old
-         * where blocks needing to be zeroed may exist.  To get the
-         * block where the last byte in the file currently resides,
-         * we need to subtract one from the size and truncate back
-         * to a block boundary.  We subtract 1 in case the size is
-         * exactly on a block boundary.
-         */
-        last_fsb = isize ? XFS_B_TO_FSBT(mp, isize - 1) : (xfs_fileoff_t)-1;
-        start_zero_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)isize);
-        end_zero_fsb = XFS_B_TO_FSBT(mp, offset - 1);
-        ASSERT((xfs_sfiloff_t)last_fsb < (xfs_sfiloff_t)start_zero_fsb);
-        if (last_fsb == end_zero_fsb) {
-                /*
-                 * The size was only incremented on its last block.
-                 * We took care of that above, so just return.
-                 */
-                return 0;
-        }
-
-        ASSERT(start_zero_fsb <= end_zero_fsb);
-        while (start_zero_fsb <= end_zero_fsb) {
-                nimaps = 1;
-                zero_count_fsb = end_zero_fsb - start_zero_fsb + 1;
-                error = xfs_bmapi(NULL, ip, start_zero_fsb, zero_count_fsb,
-                                  0, NULL, 0, &imap, &nimaps, NULL, NULL);
-                if (error) {
-                        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_IOLOCK_EXCL));
-                        return error;
-                }
-                ASSERT(nimaps > 0);
-
-                if (imap.br_state == XFS_EXT_UNWRITTEN ||
-                    imap.br_startblock == HOLESTARTBLOCK) {
-                        /*
-                         * This loop handles initializing pages that were
-                         * partially initialized by the code below this
-                         * loop. It basically zeroes the part of the page
-                         * that sits on a hole and sets the page as P_HOLE
-                         * and calls remapf if it is a mapped file.
-                         */
-                        start_zero_fsb = imap.br_startoff + imap.br_blockcount;
-                        ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
-                        continue;
-                }
-
-                /*
-                 * There are blocks we need to zero.
-                 * Drop the inode lock while we're doing the I/O.
-                 * We'll still have the iolock to protect us.
-                 */
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-
-                zero_off = XFS_FSB_TO_B(mp, start_zero_fsb);
-                zero_len = XFS_FSB_TO_B(mp, imap.br_blockcount);
-
-                if ((zero_off + zero_len) > offset)
-                        zero_len = offset - zero_off;
-
-                error = xfs_iozero(ip, zero_off, zero_len);
-                if (error) {
-                        goto out_lock;
-                }
-
-                start_zero_fsb = imap.br_startoff + imap.br_blockcount;
-                ASSERT(start_zero_fsb <= (end_zero_fsb + 1));
-
-                xfs_ilock(ip, XFS_ILOCK_EXCL);
-        }
-
-        return 0;
-
-out_lock:
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        ASSERT(error >= 0);
-        return error;
-}
-
-ssize_t                         /* bytes written, or (-) error */
-xfs_write(
-        struct xfs_inode        *xip,
-        struct kiocb            *iocb,
-        const struct iovec      *iovp,
-        unsigned int            nsegs,
-        loff_t                  *offset,
-        int                     ioflags)
-{
-        struct file             *file = iocb->ki_filp;
-        struct address_space    *mapping = file->f_mapping;
-        struct inode            *inode = mapping->host;
-        unsigned long           segs = nsegs;
-        xfs_mount_t             *mp;
-        ssize_t                 ret = 0, error = 0;
-        xfs_fsize_t             isize, new_size;
-        int                     iolock;
-        int                     eventsent = 0;
-        size_t                  ocount = 0, count;
-        loff_t                  pos;
-        int                     need_i_mutex;
-
-        XFS_STATS_INC(xs_write_calls);
-
-        error = generic_segment_checks(iovp, &segs, &ocount, VERIFY_READ);
-        if (error)
-                return error;
-
-        count = ocount;
-        pos = *offset;
-
-        if (count == 0)
-                return 0;
-
-        mp = xip->i_mount;
-
-        xfs_wait_for_freeze(mp, SB_FREEZE_WRITE);
-
-        if (XFS_FORCED_SHUTDOWN(mp))
-                return -EIO;
-
-relock:
-        if (ioflags & IO_ISDIRECT) {
-                iolock = XFS_IOLOCK_SHARED;
-                need_i_mutex = 0;
-        } else {
-                iolock = XFS_IOLOCK_EXCL;
-                need_i_mutex = 1;
-                mutex_lock(&inode->i_mutex);
-        }
-
-        xfs_ilock(xip, XFS_ILOCK_EXCL|iolock);
-
-start:
-        error = -generic_write_checks(file, &pos, &count,
-                                        S_ISBLK(inode->i_mode));
-        if (error) {
-                xfs_iunlock(xip, XFS_ILOCK_EXCL|iolock);
-                goto out_unlock_mutex;
-        }
-
-        if ((DM_EVENT_ENABLED(xip, DM_EVENT_WRITE) &&
-            !(ioflags & IO_INVIS) && !eventsent)) {
-                int             dmflags = FILP_DELAY_FLAG(file);
-
-                if (need_i_mutex)
-                        dmflags |= DM_FLAGS_IMUX;
-
-                xfs_iunlock(xip, XFS_ILOCK_EXCL);
-                error = XFS_SEND_DATA(xip->i_mount, DM_EVENT_WRITE, xip,
-                                      pos, count, dmflags, &iolock);
-                if (error) {
-                        goto out_unlock_internal;
-                }
-                xfs_ilock(xip, XFS_ILOCK_EXCL);
-                eventsent = 1;
-
-                /*
-                 * The iolock was dropped and reacquired in XFS_SEND_DATA
-                 * so we have to recheck the size when appending.
-                 * We will only "goto start;" once, since having sent the
-                 * event prevents another call to XFS_SEND_DATA, which is
-                 * what allows the size to change in the first place.
-                 */
-                if ((file->f_flags & O_APPEND) && pos != xip->i_size)
-                        goto start;
-        }
-
-        if (ioflags & IO_ISDIRECT) {
-                xfs_buftarg_t   *target =
-                        XFS_IS_REALTIME_INODE(xip) ?
-                                mp->m_rtdev_targp : mp->m_ddev_targp;
-
-                if ((pos & target->bt_smask) || (count & target->bt_smask)) {
-                        xfs_iunlock(xip, XFS_ILOCK_EXCL|iolock);
-                        return XFS_ERROR(-EINVAL);
-                }
-
-                if (!need_i_mutex && (mapping->nrpages || pos > xip->i_size)) {
-                        xfs_iunlock(xip, XFS_ILOCK_EXCL|iolock);
-                        iolock = XFS_IOLOCK_EXCL;
-                        need_i_mutex = 1;
-                        mutex_lock(&inode->i_mutex);
-                        xfs_ilock(xip, XFS_ILOCK_EXCL|iolock);
-                        goto start;
-                }
-        }
-
-        new_size = pos + count;
-        if (new_size > xip->i_size)
-                xip->i_new_size = new_size;
-
-        if (likely(!(ioflags & IO_INVIS)))
-                file_update_time(file);
-
-        /*
-         * If the offset is beyond the size of the file, we have a couple
-         * of things to do. First, if there is already space allocated
-         * we need to either create holes or zero the disk or ...
-         *
-         * If there is a page where the previous size lands, we need
-         * to zero it out up to the new size.
-         */
-
-        if (pos > xip->i_size) {
-                error = xfs_zero_eof(xip, pos, xip->i_size);
-                if (error) {
-                        xfs_iunlock(xip, XFS_ILOCK_EXCL);
-                        goto out_unlock_internal;
-                }
-        }
-        xfs_iunlock(xip, XFS_ILOCK_EXCL);
-
-        /*
-         * If we're writing the file then make sure to clear the
-         * setuid and setgid bits if the process is not being run
-         * by root.  This keeps people from modifying setuid and
-         * setgid binaries.
-         */
-
-        if (((xip->i_d.di_mode & S_ISUID) ||
-            ((xip->i_d.di_mode & (S_ISGID | S_IXGRP)) ==
-                (S_ISGID | S_IXGRP))) &&
-             !capable(CAP_FSETID)) {
-                error = xfs_write_clear_setuid(xip);
-                if (likely(!error))
-                        error = -file_remove_suid(file);
-                if (unlikely(error)) {
-                        goto out_unlock_internal;
-                }
-        }
-
-        /* We can write back this queue in page reclaim */
-        current->backing_dev_info = mapping->backing_dev_info;
-
-        if ((ioflags & IO_ISDIRECT)) {
-                if (mapping->nrpages) {
-                        WARN_ON(need_i_mutex == 0);
-                        error = xfs_flushinval_pages(xip,
-                                        (pos & PAGE_CACHE_MASK),
-                                        -1, FI_REMAPF_LOCKED);
-                        if (error)
-                                goto out_unlock_internal;
-                }
-
-                if (need_i_mutex) {
-                        /* demote the lock now the cached pages are gone */
-                        xfs_ilock_demote(xip, XFS_IOLOCK_EXCL);
-                        mutex_unlock(&inode->i_mutex);
-
-                        iolock = XFS_IOLOCK_SHARED;
-                        need_i_mutex = 0;
-                }
-
-                trace_xfs_file_direct_write(xip, count, *offset, ioflags);
-                ret = generic_file_direct_write(iocb, iovp,
-                                &segs, pos, offset, count, ocount);
-
-                /*
-                 * direct-io write to a hole: fall through to buffered I/O
-                 * for completing the rest of the request.
-                 */
-                if (ret >= 0 && ret != count) {
-                        XFS_STATS_ADD(xs_write_bytes, ret);
-
-                        pos += ret;
-                        count -= ret;
-
-                        ioflags &= ~IO_ISDIRECT;
-                        xfs_iunlock(xip, iolock);
-                        goto relock;
-                }
-        } else {
-                int enospc = 0;
-                ssize_t ret2 = 0;
-
-write_retry:
-                trace_xfs_file_buffered_write(xip, count, *offset, ioflags);
-                ret2 = generic_file_buffered_write(iocb, iovp, segs,
-                                pos, offset, count, ret);
-                /*
-                 * if we just got an ENOSPC, flush the inode now we
-                 * aren't holding any page locks and retry *once*
-                 */
-                if (ret2 == -ENOSPC && !enospc) {
-                        error = xfs_flush_pages(xip, 0, -1, 0, FI_NONE);
-                        if (error)
-                                goto out_unlock_internal;
-                        enospc = 1;
-                        goto write_retry;
-                }
-                ret = ret2;
-        }
-
-        current->backing_dev_info = NULL;
-
-        isize = i_size_read(inode);
-        if (unlikely(ret < 0 && ret != -EFAULT && *offset > isize))
-                *offset = isize;
-
-        if (*offset > xip->i_size) {
-                xfs_ilock(xip, XFS_ILOCK_EXCL);
-                if (*offset > xip->i_size)
-                        xip->i_size = *offset;
-                xfs_iunlock(xip, XFS_ILOCK_EXCL);
-        }
-
-        if (ret == -ENOSPC &&
-            DM_EVENT_ENABLED(xip, DM_EVENT_NOSPACE) && !(ioflags & IO_INVIS)) {
-                xfs_iunlock(xip, iolock);
-                if (need_i_mutex)
-                        mutex_unlock(&inode->i_mutex);
-                error = XFS_SEND_NAMESP(xip->i_mount, DM_EVENT_NOSPACE, xip,
-                                DM_RIGHT_NULL, xip, DM_RIGHT_NULL, NULL, NULL,
-                                0, 0, 0); /* Delay flag intentionally  unused */
-                if (need_i_mutex)
-                        mutex_lock(&inode->i_mutex);
-                xfs_ilock(xip, iolock);
-                if (error)
-                        goto out_unlock_internal;
-                goto start;
-        }
-
-        error = -ret;
-        if (ret <= 0)
-                goto out_unlock_internal;
-
-        XFS_STATS_ADD(xs_write_bytes, ret);
-
-        /* Handle various SYNC-type writes */
-        if ((file->f_flags & O_DSYNC) || IS_SYNC(inode)) {
-                loff_t end = pos + ret - 1;
-                int error2;
-
-                xfs_iunlock(xip, iolock);
-                if (need_i_mutex)
-                        mutex_unlock(&inode->i_mutex);
-
-                error2 = filemap_write_and_wait_range(mapping, pos, end);
-                if (!error)
-                        error = error2;
-                if (need_i_mutex)
-                        mutex_lock(&inode->i_mutex);
-                xfs_ilock(xip, iolock);
-
-                error2 = xfs_fsync(xip);
-                if (!error)
-                        error = error2;
-        }
-
- out_unlock_internal:
-        if (xip->i_new_size) {
-                xfs_ilock(xip, XFS_ILOCK_EXCL);
-                xip->i_new_size = 0;
-                /*
-                 * If this was a direct or synchronous I/O that failed (such
-                 * as ENOSPC) then part of the I/O may have been written to
-                 * disk before the error occured.  In this case the on-disk
-                 * file size may have been adjusted beyond the in-memory file
-                 * size and now needs to be truncated back.
-                 */
-                if (xip->i_d.di_size > xip->i_size)
-                        xip->i_d.di_size = xip->i_size;
-                xfs_iunlock(xip, XFS_ILOCK_EXCL);
-        }
-        xfs_iunlock(xip, iolock);
- out_unlock_mutex:
-        if (need_i_mutex)
-                mutex_unlock(&inode->i_mutex);
-        return -error;
-}
-
-/*
- * All xfs metadata buffers except log state machine buffers
- * get this attached as their b_bdstrat callback function.
- * This is so that we can catch a buffer
- * after prematurely unpinning it to forcibly shutdown the filesystem.
- */
-int
-xfs_bdstrat_cb(struct xfs_buf *bp)
-{
-        if (XFS_FORCED_SHUTDOWN(bp->b_mount)) {
-                trace_xfs_bdstrat_shut(bp, _RET_IP_);
-                /*
-                 * Metadata write that didn't get logged but
-                 * written delayed anyway. These aren't associated
-                 * with a transaction, and can be ignored.
-                 */
-                if (XFS_BUF_IODONE_FUNC(bp) == NULL &&
-                    (XFS_BUF_ISREAD(bp)) == 0)
-                        return (xfs_bioerror_relse(bp));
-                else
-                        return (xfs_bioerror(bp));
-        }
-
-        xfs_buf_iorequest(bp);
-        return 0;
-}
-
-/*
- * Wrapper around bdstrat so that we can stop data from going to disk in case
- * we are shutting down the filesystem.  Typically user data goes thru this
- * path; one of the exceptions is the superblock.
- */
-void
-xfsbdstrat(
-        struct xfs_mount        *mp,
-        struct xfs_buf          *bp)
-{
-        ASSERT(mp);
-        if (!XFS_FORCED_SHUTDOWN(mp)) {
-                xfs_buf_iorequest(bp);
-                return;
-        }
-
-        trace_xfs_bdstrat_shut(bp, _RET_IP_);
-        xfs_bioerror_relse(bp);
-}
-
-/*
- * If the underlying (data/log/rt) device is readonly, there are some
- * operations that cannot proceed.
- */
-int
-xfs_dev_is_read_only(
-        xfs_mount_t             *mp,
-        char                    *message)
-{
-        if (xfs_readonly_buftarg(mp->m_ddev_targp) ||
-            xfs_readonly_buftarg(mp->m_logdev_targp) ||
-            (mp->m_rtdev_targp && xfs_readonly_buftarg(mp->m_rtdev_targp))) {
-                cmn_err(CE_NOTE,
-                        "XFS: %s required on read-only device.", message);
-                cmn_err(CE_NOTE,
-                        "XFS: write access unavailable, cannot proceed.");
-                return EROFS;
-        }
-        return 0;
-}
diff --git a/fs/xfs/linux-2.6/xfs_lrw.h b/fs/xfs/linux-2.6/xfs_lrw.h
deleted file mode 100644
index d1f7789c7ffb..000000000000
--- a/fs/xfs/linux-2.6/xfs_lrw.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (c) 2000-2003,2005 Silicon Graphics, Inc.
- * All Rights Reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it would be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write the Free Software Foundation,
- * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-#ifndef __XFS_LRW_H__
-#define __XFS_LRW_H__
-
-struct xfs_mount;
-struct xfs_inode;
-struct xfs_buf;
-
-/* errors from xfsbdstrat() must be extracted from the buffer */
-extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
-extern int xfs_bdstrat_cb(struct xfs_buf *);
-extern int xfs_dev_is_read_only(struct xfs_mount *, char *);
-
-extern int xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
-
-#endif  /* __XFS_LRW_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_quotaops.c b/fs/xfs/linux-2.6/xfs_quotaops.c
index 3d4a0c84d634..1947514ce1ad 100644
--- a/fs/xfs/linux-2.6/xfs_quotaops.c
+++ b/fs/xfs/linux-2.6/xfs_quotaops.c
@@ -44,20 +44,6 @@ xfs_quota_type(int type)
 }
 
 STATIC int
-xfs_fs_quota_sync(
-        struct super_block      *sb,
-        int                     type)
-{
-        struct xfs_mount        *mp = XFS_M(sb);
-
-        if (sb->s_flags & MS_RDONLY)
-                return -EROFS;
-        if (!XFS_IS_QUOTA_RUNNING(mp))
-                return -ENOSYS;
-        return -xfs_sync_data(mp, 0);
-}
-
-STATIC int
 xfs_fs_get_xstate(
         struct super_block      *sb,
         struct fs_quota_stat    *fqs)
@@ -82,8 +68,6 @@ xfs_fs_set_xstate(
                 return -EROFS;
         if (op != Q_XQUOTARM && !XFS_IS_QUOTA_RUNNING(mp))
                 return -ENOSYS;
-        if (!capable(CAP_SYS_ADMIN))
-                return -EPERM;
 
         if (uflags & XFS_QUOTA_UDQ_ACCT)
                 flags |= XFS_UQUOTA_ACCT;
@@ -144,14 +128,11 @@ xfs_fs_set_xquota(
                 return -ENOSYS;
         if (!XFS_IS_QUOTA_ON(mp))
                 return -ESRCH;
-        if (!capable(CAP_SYS_ADMIN))
-                return -EPERM;
 
         return -xfs_qm_scall_setqlim(mp, id, xfs_quota_type(type), fdq);
 }
 
 const struct quotactl_ops xfs_quotactl_operations = {
-        .quota_sync             = xfs_fs_quota_sync,
         .get_xstate             = xfs_fs_get_xstate,
         .set_xstate             = xfs_fs_set_xstate,
         .get_xquota             = xfs_fs_get_xquota,
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 09783cc444ac..52e06b487ced 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -61,6 +61,7 @@
 
 #include <linux/namei.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/mempool.h>
 #include <linux/writeback.h>
@@ -877,12 +878,11 @@ xfsaild(
 {
         struct xfs_ail  *ailp = data;
         xfs_lsn_t       last_pushed_lsn = 0;
-        long            tout = 0;
+        long            tout = 0; /* milliseconds */
 
         while (!kthread_should_stop()) {
-                if (tout)
-                        schedule_timeout_interruptible(msecs_to_jiffies(tout));
-                tout = 1000;
+                schedule_timeout_interruptible(tout ?
+                                msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
 
                 /* swsusp */
                 try_to_freeze();
@@ -954,16 +954,14 @@ xfs_fs_destroy_inode(
         ASSERT_ALWAYS(!xfs_iflags_test(ip, XFS_IRECLAIM));
 
         /*
-         * If we have nothing to flush with this inode then complete the
-         * teardown now, otherwise delay the flush operation.
+         * We always use background reclaim here because even if the
+         * inode is clean, it still may be under IO and hence we have
+         * to take the flush lock. The background reclaim path handles
+         * this more efficiently than we can here, so simply let background
+         * reclaim tear down all inodes.
          */
-        if (!xfs_inode_clean(ip)) {
-                xfs_inode_set_reclaim_tag(ip);
-                return;
-        }
-
 out_reclaim:
-        xfs_ireclaim(ip);
+        xfs_inode_set_reclaim_tag(ip);
 }
 
 /*
@@ -1024,59 +1022,108 @@ xfs_fs_dirty_inode(
         XFS_I(inode)->i_update_core = 1;
 }
 
-/*
- * Attempt to flush the inode, this will actually fail
- * if the inode is pinned, but we dirty the inode again
- * at the point when it is unpinned after a log write,
- * since this is when the inode itself becomes flushable.
- */
+STATIC int
+xfs_log_inode(
+        struct xfs_inode        *ip)
+{
+        struct xfs_mount        *mp = ip->i_mount;
+        struct xfs_trans        *tp;
+        int                     error;
+
+        xfs_iunlock(ip, XFS_ILOCK_SHARED);
+        tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
+        error = xfs_trans_reserve(tp, 0, XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
+
+        if (error) {
+                xfs_trans_cancel(tp, 0);
+                /* we need to return with the lock hold shared */
+                xfs_ilock(ip, XFS_ILOCK_SHARED);
+                return error;
+        }
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+
+        /*
+         * Note - it's possible that we might have pushed ourselves out of the
+         * way during trans_reserve which would flush the inode.  But there's
+         * no guarantee that the inode buffer has actually gone out yet (it's
+         * delwri).  Plus the buffer could be pinned anyway if it's part of
+         * an inode in another recent transaction.  So we play it safe and
+         * fire off the transaction anyway.
+         */
+        xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
+        xfs_trans_ihold(tp, ip);
+        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+        xfs_trans_set_sync(tp);
+        error = xfs_trans_commit(tp, 0);
+        xfs_ilock_demote(ip, XFS_ILOCK_EXCL);
+
+        return error;
+}
+
 STATIC int
 xfs_fs_write_inode(
         struct inode            *inode,
-        int                     sync)
+        struct writeback_control *wbc)
 {
         struct xfs_inode        *ip = XFS_I(inode);
         struct xfs_mount        *mp = ip->i_mount;
-        int                     error = 0;
+        int                     error = EAGAIN;
 
         xfs_itrace_entry(ip);
 
         if (XFS_FORCED_SHUTDOWN(mp))
                 return XFS_ERROR(EIO);
 
-        if (sync) {
-                error = xfs_wait_on_pages(ip, 0, -1);
-                if (error)
+        if (wbc->sync_mode == WB_SYNC_ALL) {
+                /*
+                 * Make sure the inode has hit stable storage.  By using the
+                 * log and the fsync transactions we reduce the IOs we have
+                 * to do here from two (log and inode) to just the log.
+                 *
+                 * Note: We still need to do a delwri write of the inode after
+                 * this to flush it to the backing buffer so that bulkstat
+                 * works properly if this is the first time the inode has been
+                 * written.  Because we hold the ilock atomically over the
+                 * transaction commit and the inode flush we are guaranteed
+                 * that the inode is not pinned when it returns. If the flush
+                 * lock is already held, then the inode has already been
+                 * flushed once and we don't need to flush it again.  Hence
+                 * the code will only flush the inode if it isn't already
+                 * being flushed.
+                 */
+                xfs_ilock(ip, XFS_ILOCK_SHARED);
+                if (ip->i_update_core) {
+                        error = xfs_log_inode(ip);
+                        if (error)
+                                goto out_unlock;
+                }
+        } else {
+                /*
+                 * We make this non-blocking if the inode is contended, return
+                 * EAGAIN to indicate to the caller that they did not succeed.
+                 * This prevents the flush path from blocking on inodes inside
+                 * another operation right now, they get caught later by xfs_sync.
+                 */
+                if (!xfs_ilock_nowait(ip, XFS_ILOCK_SHARED))
                         goto out;
         }
 
-        /*
-         * Bypass inodes which have already been cleaned by
-         * the inode flush clustering code inside xfs_iflush
-         */
-        if (xfs_inode_clean(ip))
-                goto out;
+        if (xfs_ipincount(ip) || !xfs_iflock_nowait(ip))
+                goto out_unlock;
 
         /*
-         * We make this non-blocking if the inode is contended, return
-         * EAGAIN to indicate to the caller that they did not succeed.
-         * This prevents the flush path from blocking on inodes inside
-         * another operation right now, they get caught later by xfs_sync.
+         * Now we have the flush lock and the inode is not pinned, we can check
+         * if the inode is really clean as we know that there are no pending
+         * transaction completions, it is not waiting on the delayed write
+         * queue and there is no IO in progress.
          */
-        if (sync) {
-                xfs_ilock(ip, XFS_ILOCK_SHARED);
-                xfs_iflock(ip);
-
-                error = xfs_iflush(ip, XFS_IFLUSH_SYNC);
-        } else {
-                error = EAGAIN;
-                if (!xfs_ilock_nowait(ip, XFS_ILOCK_SHARED))
-                        goto out;
-                if (xfs_ipincount(ip) || !xfs_iflock_nowait(ip))
-                        goto out_unlock;
-
-                error = xfs_iflush(ip, XFS_IFLUSH_ASYNC_NOBLOCK);
+        if (xfs_inode_clean(ip)) {
+                xfs_ifunlock(ip);
+                error = 0;
+                goto out_unlock;
         }
+        error = xfs_iflush(ip, 0);
 
  out_unlock:
         xfs_iunlock(ip, XFS_ILOCK_SHARED);
@@ -1259,6 +1306,29 @@ xfs_fs_statfs(
         return 0;
 }
 
+STATIC void
+xfs_save_resvblks(struct xfs_mount *mp)
+{
+        __uint64_t resblks = 0;
+
+        mp->m_resblks_save = mp->m_resblks;
+        xfs_reserve_blocks(mp, &resblks, NULL);
+}
+
+STATIC void
+xfs_restore_resvblks(struct xfs_mount *mp)
+{
+        __uint64_t resblks;
+
+        if (mp->m_resblks_save) {
+                resblks = mp->m_resblks_save;
+                mp->m_resblks_save = 0;
+        } else
+                resblks = xfs_default_resblks(mp);
+
+        xfs_reserve_blocks(mp, &resblks, NULL);
+}
+
 STATIC int
 xfs_fs_remount(
         struct super_block      *sb,
@@ -1338,11 +1408,27 @@ xfs_fs_remount(
                         }
                         mp->m_update_flags = 0;
                 }
+
+                /*
+                 * Fill out the reserve pool if it is empty. Use the stashed
+                 * value if it is non-zero, otherwise go with the default.
+                 */
+                xfs_restore_resvblks(mp);
         }
 
         /* rw -> ro */
         if (!(mp->m_flags & XFS_MOUNT_RDONLY) && (*flags & MS_RDONLY)) {
+                /*
+                 * After we have synced the data but before we sync the
+                 * metadata, we need to free up the reserve block pool so that
+                 * the used block count in the superblock on disk is correct at
+                 * the end of the remount. Stash the current reserve pool size
+                 * so that if we get remounted rw, we can return it to the same
+                 * size.
+                 */
+
                 xfs_quiesce_data(mp);
+                xfs_save_resvblks(mp);
                 xfs_quiesce_attr(mp);
                 mp->m_flags |= XFS_MOUNT_RDONLY;
         }
@@ -1361,11 +1447,22 @@ xfs_fs_freeze(
 {
         struct xfs_mount        *mp = XFS_M(sb);
 
+        xfs_save_resvblks(mp);
         xfs_quiesce_attr(mp);
         return -xfs_fs_log_dummy(mp);
 }
 
 STATIC int
+xfs_fs_unfreeze(
+        struct super_block      *sb)
+{
+        struct xfs_mount        *mp = XFS_M(sb);
+
+        xfs_restore_resvblks(mp);
+        return 0;
+}
+
+STATIC int
 xfs_fs_show_options(
         struct seq_file         *m,
         struct vfsmount         *mnt)
@@ -1587,6 +1684,7 @@ static const struct super_operations xfs_super_operations = {
         .put_super              = xfs_fs_put_super,
         .sync_fs                = xfs_fs_sync_fs,
         .freeze_fs              = xfs_fs_freeze,
+        .unfreeze_fs            = xfs_fs_unfreeze,
         .statfs                 = xfs_fs_statfs,
         .remount_fs             = xfs_fs_remount,
         .show_options           = xfs_fs_show_options,
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 6fed97a8cd3e..fd9698215759 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -65,7 +65,6 @@ xfs_inode_ag_lookup(
          * as the tree is sparse and a gang lookup walks to find
          * the number of objects requested.
          */
-        read_lock(&pag->pag_ici_lock);
         if (tag == XFS_ICI_NO_TAG) {
                 nr_found = radix_tree_gang_lookup(&pag->pag_ici_root,
                                 (void **)&ip, *first_index, 1);
@@ -74,7 +73,7 @@ xfs_inode_ag_lookup(
                                 (void **)&ip, *first_index, 1, tag);
         }
         if (!nr_found)
-                goto unlock;
+                return NULL;
 
         /*
          * Update the index for the next lookup. Catch overflows
@@ -84,25 +83,20 @@ xfs_inode_ag_lookup(
          */
         *first_index = XFS_INO_TO_AGINO(mp, ip->i_ino + 1);
         if (*first_index < XFS_INO_TO_AGINO(mp, ip->i_ino))
-                goto unlock;
-
+                return NULL;
         return ip;
-
-unlock:
-        read_unlock(&pag->pag_ici_lock);
-        return NULL;
 }
 
 STATIC int
 xfs_inode_ag_walk(
         struct xfs_mount        *mp,
-        xfs_agnumber_t          ag,
+        struct xfs_perag        *pag,
         int                     (*execute)(struct xfs_inode *ip,
                                            struct xfs_perag *pag, int flags),
         int                     flags,
-        int                     tag)
+        int                     tag,
+        int                     exclusive)
 {
-        struct xfs_perag        *pag = &mp->m_perag[ag];
         uint32_t                first_index;
         int                     last_error = 0;
         int                     skipped;
@@ -114,10 +108,20 @@ restart:
                 int             error = 0;
                 xfs_inode_t     *ip;
 
+                if (exclusive)
+                        write_lock(&pag->pag_ici_lock);
+                else
+                        read_lock(&pag->pag_ici_lock);
                 ip = xfs_inode_ag_lookup(mp, pag, &first_index, tag);
-                if (!ip)
+                if (!ip) {
+                        if (exclusive)
+                                write_unlock(&pag->pag_ici_lock);
+                        else
+                                read_unlock(&pag->pag_ici_lock);
                         break;
+                }
 
+                /* execute releases pag->pag_ici_lock */
                 error = execute(ip, pag, flags);
                 if (error == EAGAIN) {
                         skipped++;
@@ -125,9 +129,8 @@ restart:
                 }
                 if (error)
                         last_error = error;
-                /*
-                 * bail out if the filesystem is corrupted.
-                 */
+
+                /* bail out if the filesystem is corrupted.  */
                 if (error == EFSCORRUPTED)
                         break;
 
@@ -137,8 +140,6 @@ restart:
                 delay(1);
                 goto restart;
         }
-
-        xfs_put_perag(mp, pag);
         return last_error;
 }
 
@@ -148,16 +149,24 @@ xfs_inode_ag_iterator(
         int                     (*execute)(struct xfs_inode *ip,
                                            struct xfs_perag *pag, int flags),
         int                     flags,
-        int                     tag)
+        int                     tag,
+        int                     exclusive)
 {
         int                     error = 0;
         int                     last_error = 0;
         xfs_agnumber_t          ag;
 
         for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
-                if (!mp->m_perag[ag].pag_ici_init)
+                struct xfs_perag        *pag;
+
+                pag = xfs_perag_get(mp, ag);
+                if (!pag->pag_ici_init) {
+                        xfs_perag_put(pag);
                         continue;
-                error = xfs_inode_ag_walk(mp, ag, execute, flags, tag);
+                }
+                error = xfs_inode_ag_walk(mp, pag, execute, flags, tag,
+                                                exclusive);
+                xfs_perag_put(pag);
                 if (error) {
                         last_error = error;
                         if (error == EFSCORRUPTED)
@@ -174,30 +183,31 @@ xfs_sync_inode_valid(
         struct xfs_perag        *pag)
 {
         struct inode            *inode = VFS_I(ip);
+        int                     error = EFSCORRUPTED;
 
         /* nothing to sync during shutdown */
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
-                read_unlock(&pag->pag_ici_lock);
-                return EFSCORRUPTED;
-        }
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                goto out_unlock;
 
-        /*
-         * If we can't get a reference on the inode, it must be in reclaim.
-         * Leave it for the reclaim code to flush. Also avoid inodes that
-         * haven't been fully initialised.
-         */
-        if (!igrab(inode)) {
-                read_unlock(&pag->pag_ici_lock);
-                return ENOENT;
-        }
-        read_unlock(&pag->pag_ici_lock);
+        /* avoid new or reclaimable inodes. Leave for reclaim code to flush */
+        error = ENOENT;
+        if (xfs_iflags_test(ip, XFS_INEW | XFS_IRECLAIMABLE | XFS_IRECLAIM))
+                goto out_unlock;
+
+        /* If we can't grab the inode, it must on it's way to reclaim. */
+        if (!igrab(inode))
+                goto out_unlock;
 
-        if (is_bad_inode(inode) || xfs_iflags_test(ip, XFS_INEW)) {
+        if (is_bad_inode(inode)) {
                 IRELE(ip);
-                return ENOENT;
+                goto out_unlock;
         }
 
-        return 0;
+        /* inode is valid */
+        error = 0;
+out_unlock:
+        read_unlock(&pag->pag_ici_lock);
+        return error;
 }
 
 STATIC int
@@ -224,7 +234,7 @@ xfs_sync_inode_data(
         }
 
         error = xfs_flush_pages(ip, 0, -1, (flags & SYNC_WAIT) ?
-                                0 : XFS_B_ASYNC, FI_NONE);
+                                0 : XBF_ASYNC, FI_NONE);
         xfs_iunlock(ip, XFS_IOLOCK_SHARED);
 
  out_wait:
@@ -260,8 +270,7 @@ xfs_sync_inode_attr(
                 goto out_unlock;
         }
 
-        error = xfs_iflush(ip, (flags & SYNC_WAIT) ?
-                           XFS_IFLUSH_SYNC : XFS_IFLUSH_DELWRI);
+        error = xfs_iflush(ip, flags);
 
  out_unlock:
         xfs_iunlock(ip, XFS_ILOCK_SHARED);
@@ -282,14 +291,11 @@ xfs_sync_data(
         ASSERT((flags & ~(SYNC_TRYLOCK|SYNC_WAIT)) == 0);
 
         error = xfs_inode_ag_iterator(mp, xfs_sync_inode_data, flags,
-                                      XFS_ICI_NO_TAG);
+                                      XFS_ICI_NO_TAG, 0);
         if (error)
                 return XFS_ERROR(error);
 
-        xfs_log_force(mp, 0,
-                      (flags & SYNC_WAIT) ?
-                       XFS_LOG_FORCE | XFS_LOG_SYNC :
-                       XFS_LOG_FORCE);
+        xfs_log_force(mp, (flags & SYNC_WAIT) ? XFS_LOG_SYNC : 0);
         return 0;
 }
 
@@ -304,7 +310,7 @@ xfs_sync_attr(
         ASSERT((flags & ~SYNC_WAIT) == 0);
 
         return xfs_inode_ag_iterator(mp, xfs_sync_inode_attr, flags,
-                                     XFS_ICI_NO_TAG);
+                                     XFS_ICI_NO_TAG, 0);
 }
 
 STATIC int
@@ -315,10 +321,6 @@ xfs_commit_dummy_trans(
         struct xfs_inode        *ip = mp->m_rootip;
         struct xfs_trans        *tp;
         int                     error;
-        int                     log_flags = XFS_LOG_FORCE;
-
-        if (flags & SYNC_WAIT)
-                log_flags |= XFS_LOG_SYNC;
 
         /*
          * Put a dummy transaction in the log to tell recovery
@@ -340,11 +342,11 @@ xfs_commit_dummy_trans(
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
 
         /* the log force ensures this transaction is pushed to disk */
-        xfs_log_force(mp, 0, log_flags);
+        xfs_log_force(mp, (flags & SYNC_WAIT) ? XFS_LOG_SYNC : 0);
         return error;
 }
 
-int
+STATIC int
 xfs_sync_fsdata(
         struct xfs_mount        *mp,
         int                     flags)
@@ -360,7 +362,7 @@ xfs_sync_fsdata(
         if (flags & SYNC_TRYLOCK) {
                 ASSERT(!(flags & SYNC_WAIT));
 
-                bp = xfs_getsb(mp, XFS_BUF_TRYLOCK);
+                bp = xfs_getsb(mp, XBF_TRYLOCK);
                 if (!bp)
                         goto out;
 
@@ -380,7 +382,7 @@ xfs_sync_fsdata(
                  * become pinned in between there and here.
                  */
                 if (XFS_BUF_ISPINNED(bp))
-                        xfs_log_force(mp, 0, XFS_LOG_FORCE);
+                        xfs_log_force(mp, 0);
         }
 
 
@@ -441,9 +443,6 @@ xfs_quiesce_data(
         xfs_sync_data(mp, SYNC_WAIT);
         xfs_qm_sync(mp, SYNC_WAIT);
 
-        /* drop inode references pinned by filestreams */
-        xfs_filestream_flush(mp);
-
         /* write superblock and hoover up shutdown errors */
         error = xfs_sync_fsdata(mp, SYNC_WAIT);
 
@@ -460,16 +459,18 @@ xfs_quiesce_fs(
 {
         int     count = 0, pincount;
 
+        xfs_reclaim_inodes(mp, 0);
         xfs_flush_buftarg(mp->m_ddev_targp, 0);
-        xfs_reclaim_inodes(mp, XFS_IFLUSH_DELWRI_ELSE_ASYNC);
 
         /*
          * This loop must run at least twice.  The first instance of the loop
          * will flush most meta data but that will generate more meta data
          * (typically directory updates).  Which then must be flushed and
-         * logged before we can write the unmount record.
+         * logged before we can write the unmount record. We also so sync
+         * reclaim of inodes to catch any that the above delwri flush skipped.
          */
         do {
+                xfs_reclaim_inodes(mp, SYNC_WAIT);
                 xfs_sync_attr(mp, SYNC_WAIT);
                 pincount = xfs_flush_buftarg(mp->m_ddev_targp, 1);
                 if (!pincount) {
@@ -568,7 +569,7 @@ xfs_flush_inodes(
         igrab(inode);
         xfs_syncd_queue_work(ip->i_mount, inode, xfs_flush_inodes_work, &completion);
         wait_for_completion(&completion);
-        xfs_log_force(ip->i_mount, (xfs_lsn_t)0, XFS_LOG_FORCE|XFS_LOG_SYNC);
+        xfs_log_force(ip->i_mount, XFS_LOG_SYNC);
 }
 
 /*
@@ -584,8 +585,8 @@ xfs_sync_worker(
         int             error;
 
         if (!(mp->m_flags & XFS_MOUNT_RDONLY)) {
-                xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE);
-                xfs_reclaim_inodes(mp, XFS_IFLUSH_DELWRI_ELSE_ASYNC);
+                xfs_log_force(mp, 0);
+                xfs_reclaim_inodes(mp, 0);
                 /* dgc: errors ignored here */
                 error = xfs_qm_sync(mp, SYNC_TRYLOCK);
                 error = xfs_sync_fsdata(mp, SYNC_TRYLOCK);
@@ -606,7 +607,8 @@ xfssyncd(
         set_freezable();
         timeleft = xfs_syncd_centisecs * msecs_to_jiffies(10);
         for (;;) {
-                timeleft = schedule_timeout_interruptible(timeleft);
+                if (list_empty(&mp->m_sync_list))
+                        timeleft = schedule_timeout_interruptible(timeleft);
                 /* swsusp */
                 try_to_freeze();
                 if (kthread_should_stop() && list_empty(&mp->m_sync_list))
@@ -626,8 +628,7 @@ xfssyncd(
                         list_add_tail(&mp->m_sync_work.w_list,
                                         &mp->m_sync_list);
                 }
-                list_for_each_entry_safe(work, n, &mp->m_sync_list, w_list)
-                        list_move(&work->w_list, &tmp);
+                list_splice_init(&mp->m_sync_list, &tmp);
                 spin_unlock(&mp->m_sync_lock);
 
                 list_for_each_entry_safe(work, n, &tmp, w_list) {
@@ -664,60 +665,6 @@ xfs_syncd_stop(
         kthread_stop(mp->m_sync_task);
 }
 
-STATIC int
-xfs_reclaim_inode(
-        xfs_inode_t     *ip,
-        int             sync_mode)
-{
-        xfs_perag_t     *pag = xfs_get_perag(ip->i_mount, ip->i_ino);
-
-        /* The hash lock here protects a thread in xfs_iget_core from
-         * racing with us on linking the inode back with a vnode.
-         * Once we have the XFS_IRECLAIM flag set it will not touch
-         * us.
-         */
-        write_lock(&pag->pag_ici_lock);
-        spin_lock(&ip->i_flags_lock);
-        if (__xfs_iflags_test(ip, XFS_IRECLAIM) ||
-            !__xfs_iflags_test(ip, XFS_IRECLAIMABLE)) {
-                spin_unlock(&ip->i_flags_lock);
-                write_unlock(&pag->pag_ici_lock);
-                return -EAGAIN;
-        }
-        __xfs_iflags_set(ip, XFS_IRECLAIM);
-        spin_unlock(&ip->i_flags_lock);
-        write_unlock(&pag->pag_ici_lock);
-        xfs_put_perag(ip->i_mount, pag);
-
-        /*
-         * If the inode is still dirty, then flush it out.  If the inode
-         * is not in the AIL, then it will be OK to flush it delwri as
-         * long as xfs_iflush() does not keep any references to the inode.
-         * We leave that decision up to xfs_iflush() since it has the
-         * knowledge of whether it's OK to simply do a delwri flush of
-         * the inode or whether we need to wait until the inode is
-         * pulled from the AIL.
-         * We get the flush lock regardless, though, just to make sure
-         * we don't free it while it is being flushed.
-         */
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        xfs_iflock(ip);
-
-        /*
-         * In the case of a forced shutdown we rely on xfs_iflush() to
-         * wait for the inode to be unpinned before returning an error.
-         */
-        if (!is_bad_inode(VFS_I(ip)) && xfs_iflush(ip, sync_mode) == 0) {
-                /* synchronize with xfs_iflush_done */
-                xfs_iflock(ip);
-                xfs_ifunlock(ip);
-        }
-
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        xfs_ireclaim(ip);
-        return 0;
-}
-
 void
 __xfs_inode_set_reclaim_tag(
         struct xfs_perag        *pag,
@@ -737,16 +684,17 @@ void
 xfs_inode_set_reclaim_tag(
         xfs_inode_t     *ip)
 {
-        xfs_mount_t     *mp = ip->i_mount;
-        xfs_perag_t     *pag = xfs_get_perag(mp, ip->i_ino);
+        struct xfs_mount *mp = ip->i_mount;
+        struct xfs_perag *pag;
 
-        read_lock(&pag->pag_ici_lock);
+        pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ip->i_ino));
+        write_lock(&pag->pag_ici_lock);
         spin_lock(&ip->i_flags_lock);
         __xfs_inode_set_reclaim_tag(pag, ip);
         __xfs_iflags_set(ip, XFS_IRECLAIMABLE);
         spin_unlock(&ip->i_flags_lock);
-        read_unlock(&pag->pag_ici_lock);
-        xfs_put_perag(mp, pag);
+        write_unlock(&pag->pag_ici_lock);
+        xfs_perag_put(pag);
 }
 
 void
@@ -759,20 +707,145 @@ __xfs_inode_clear_reclaim_tag(
                         XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
 }
 
+/*
+ * Inodes in different states need to be treated differently, and the return
+ * value of xfs_iflush is not sufficient to get this right. The following table
+ * lists the inode states and the reclaim actions necessary for non-blocking
+ * reclaim:
+ *
+ *
+ *      inode state          iflush ret         required action
+ *      ---------------      ----------         ---------------
+ *      bad                     -               reclaim
+ *      shutdown                EIO             unpin and reclaim
+ *      clean, unpinned         0               reclaim
+ *      stale, unpinned         0               reclaim
+ *      clean, pinned(*)        0               requeue
+ *      stale, pinned           EAGAIN          requeue
+ *      dirty, delwri ok        0               requeue
+ *      dirty, delwri blocked   EAGAIN          requeue
+ *      dirty, sync flush       0               reclaim
+ *
+ * (*) dgc: I don't think the clean, pinned state is possible but it gets
+ * handled anyway given the order of checks implemented.
+ *
+ * As can be seen from the table, the return value of xfs_iflush() is not
+ * sufficient to correctly decide the reclaim action here. The checks in
+ * xfs_iflush() might look like duplicates, but they are not.
+ *
+ * Also, because we get the flush lock first, we know that any inode that has
+ * been flushed delwri has had the flush completed by the time we check that
+ * the inode is clean. The clean inode check needs to be done before flushing
+ * the inode delwri otherwise we would loop forever requeuing clean inodes as
+ * we cannot tell apart a successful delwri flush and a clean inode from the
+ * return value of xfs_iflush().
+ *
+ * Note that because the inode is flushed delayed write by background
+ * writeback, the flush lock may already be held here and waiting on it can
+ * result in very long latencies. Hence for sync reclaims, where we wait on the
+ * flush lock, the caller should push out delayed write inodes first before
+ * trying to reclaim them to minimise the amount of time spent waiting. For
+ * background relaim, we just requeue the inode for the next pass.
+ *
+ * Hence the order of actions after gaining the locks should be:
+ *      bad             => reclaim
+ *      shutdown        => unpin and reclaim
+ *      pinned, delwri  => requeue
+ *      pinned, sync    => unpin
+ *      stale           => reclaim
+ *      clean           => reclaim
+ *      dirty, delwri   => flush and requeue
+ *      dirty, sync     => flush, wait and reclaim
+ */
 STATIC int
-xfs_reclaim_inode_now(
+xfs_reclaim_inode(
         struct xfs_inode        *ip,
         struct xfs_perag        *pag,
-        int                     flags)
+        int                     sync_mode)
 {
-        /* ignore if already under reclaim */
-        if (xfs_iflags_test(ip, XFS_IRECLAIM)) {
-                read_unlock(&pag->pag_ici_lock);
+        int     error = 0;
+
+        /*
+         * The radix tree lock here protects a thread in xfs_iget from racing
+         * with us starting reclaim on the inode.  Once we have the
+         * XFS_IRECLAIM flag set it will not touch us.
+         */
+        spin_lock(&ip->i_flags_lock);
+        ASSERT_ALWAYS(__xfs_iflags_test(ip, XFS_IRECLAIMABLE));
+        if (__xfs_iflags_test(ip, XFS_IRECLAIM)) {
+                /* ignore as it is already under reclaim */
+                spin_unlock(&ip->i_flags_lock);
+                write_unlock(&pag->pag_ici_lock);
                 return 0;
         }
-        read_unlock(&pag->pag_ici_lock);
+        __xfs_iflags_set(ip, XFS_IRECLAIM);
+        spin_unlock(&ip->i_flags_lock);
+        write_unlock(&pag->pag_ici_lock);
+
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        if (!xfs_iflock_nowait(ip)) {
+                if (!(sync_mode & SYNC_WAIT))
+                        goto out;
+                xfs_iflock(ip);
+        }
+
+        if (is_bad_inode(VFS_I(ip)))
+                goto reclaim;
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                xfs_iunpin_wait(ip);
+                goto reclaim;
+        }
+        if (xfs_ipincount(ip)) {
+                if (!(sync_mode & SYNC_WAIT)) {
+                        xfs_ifunlock(ip);
+                        goto out;
+                }
+                xfs_iunpin_wait(ip);
+        }
+        if (xfs_iflags_test(ip, XFS_ISTALE))
+                goto reclaim;
+        if (xfs_inode_clean(ip))
+                goto reclaim;
+
+        /* Now we have an inode that needs flushing */
+        error = xfs_iflush(ip, sync_mode);
+        if (sync_mode & SYNC_WAIT) {
+                xfs_iflock(ip);
+                goto reclaim;
+        }
+
+        /*
+         * When we have to flush an inode but don't have SYNC_WAIT set, we
+         * flush the inode out using a delwri buffer and wait for the next
+         * call into reclaim to find it in a clean state instead of waiting for
+         * it now. We also don't return errors here - if the error is transient
+         * then the next reclaim pass will flush the inode, and if the error
+         * is permanent then the next sync reclaim will reclaim the inode and
+         * pass on the error.
+         */
+        if (error && error != EAGAIN && !XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+                xfs_fs_cmn_err(CE_WARN, ip->i_mount,
+                        "inode 0x%llx background reclaim flush failed with %d",
+                        (long long)ip->i_ino, error);
+        }
+out:
+        xfs_iflags_clear(ip, XFS_IRECLAIM);
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        /*
+         * We could return EAGAIN here to make reclaim rescan the inode tree in
+         * a short while. However, this just burns CPU time scanning the tree
+         * waiting for IO to complete and xfssyncd never goes back to the idle
+         * state. Instead, return 0 to let the next scheduled background reclaim
+         * attempt to reclaim the inode again.
+         */
+        return 0;
+
+reclaim:
+        xfs_ifunlock(ip);
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        xfs_ireclaim(ip);
+        return error;
 
-        return xfs_reclaim_inode(ip, flags);
 }
 
 int
@@ -780,6 +853,6 @@ xfs_reclaim_inodes(
         xfs_mount_t     *mp,
         int             mode)
 {
-        return xfs_inode_ag_iterator(mp, xfs_reclaim_inode_now, mode,
-                                        XFS_ICI_RECLAIM_TAG);
+        return xfs_inode_ag_iterator(mp, xfs_reclaim_inode, mode,
+                                        XFS_ICI_RECLAIM_TAG, 1);
 }
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index a500b4d91835..d480c346cabb 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -37,7 +37,6 @@ void xfs_syncd_stop(struct xfs_mount *mp);
 
 int xfs_sync_attr(struct xfs_mount *mp, int flags);
 int xfs_sync_data(struct xfs_mount *mp, int flags);
-int xfs_sync_fsdata(struct xfs_mount *mp, int flags);
 
 int xfs_quiesce_data(struct xfs_mount *mp);
 void xfs_quiesce_attr(struct xfs_mount *mp);
@@ -54,6 +53,6 @@ void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag,
 int xfs_sync_inode_valid(struct xfs_inode *ip, struct xfs_perag *pag);
 int xfs_inode_ag_iterator(struct xfs_mount *mp,
         int (*execute)(struct xfs_inode *ip, struct xfs_perag *pag, int flags),
-        int flags, int tag);
+        int flags, int tag, int write_lock);
 
 #endif
diff --git a/fs/xfs/linux-2.6/xfs_trace.c b/fs/xfs/linux-2.6/xfs_trace.c
index 856eb3c8d605..5a107601e969 100644
--- a/fs/xfs/linux-2.6/xfs_trace.c
+++ b/fs/xfs/linux-2.6/xfs_trace.c
@@ -52,22 +52,6 @@
 #include "quota/xfs_dquot.h"
 
 /*
- * Format fsblock number into a static buffer & return it.
- */
-STATIC char *xfs_fmtfsblock(xfs_fsblock_t bno)
-{
-        static char rval[50];
-
-        if (bno == NULLFSBLOCK)
-                sprintf(rval, "NULLFSBLOCK");
-        else if (isnullstartblock(bno))
-                sprintf(rval, "NULLSTARTBLOCK(%lld)", startblockval(bno));
-        else
-                sprintf(rval, "%lld", (xfs_dfsbno_t)bno);
-        return rval;
-}
-
-/*
  * We include this last to have the helpers above available for the trace
  * event implementations.
  */
diff --git a/fs/xfs/linux-2.6/xfs_trace.h b/fs/xfs/linux-2.6/xfs_trace.h
index c40834bdee58..fcaa62f0799e 100644
--- a/fs/xfs/linux-2.6/xfs_trace.h
+++ b/fs/xfs/linux-2.6/xfs_trace.h
@@ -33,51 +33,82 @@ struct xfs_dquot;
 struct xlog_ticket;
 struct log;
 
-#define DEFINE_ATTR_LIST_EVENT(name) \
+DECLARE_EVENT_CLASS(xfs_attr_list_class,
+        TP_PROTO(struct xfs_attr_list_context *ctx),
+        TP_ARGS(ctx),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(u32, hashval)
+                __field(u32, blkno)
+                __field(u32, offset)
+                __field(void *, alist)
+                __field(int, bufsize)
+                __field(int, count)
+                __field(int, firstu)
+                __field(int, dupcnt)
+                __field(int, flags)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ctx->dp)->i_sb->s_dev;
+                __entry->ino = ctx->dp->i_ino;
+                __entry->hashval = ctx->cursor->hashval;
+                __entry->blkno = ctx->cursor->blkno;
+                __entry->offset = ctx->cursor->offset;
+                __entry->alist = ctx->alist;
+                __entry->bufsize = ctx->bufsize;
+                __entry->count = ctx->count;
+                __entry->firstu = ctx->firstu;
+                __entry->flags = ctx->flags;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx cursor h/b/o 0x%x/0x%x/%u dupcnt %u "
+                  "alist 0x%p size %u count %u firstu %u flags %d %s",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                   __entry->ino,
+                   __entry->hashval,
+                   __entry->blkno,
+                   __entry->offset,
+                   __entry->dupcnt,
+                   __entry->alist,
+                   __entry->bufsize,
+                   __entry->count,
+                   __entry->firstu,
+                   __entry->flags,
+                   __print_flags(__entry->flags, "|", XFS_ATTR_FLAGS)
+        )
+)
+
+#define DEFINE_PERAG_REF_EVENT(name) \
 TRACE_EVENT(name, \
-        TP_PROTO(struct xfs_attr_list_context *ctx), \
-        TP_ARGS(ctx), \
+        TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, int refcount, \
+                 unsigned long caller_ip), \
+        TP_ARGS(mp, agno, refcount, caller_ip), \
         TP_STRUCT__entry( \
                 __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(u32, hashval) \
-                __field(u32, blkno) \
-                __field(u32, offset) \
-                __field(void *, alist) \
-                __field(int, bufsize) \
-                __field(int, count) \
-                __field(int, firstu) \
-                __field(int, dupcnt) \
-                __field(int, flags) \
+                __field(xfs_agnumber_t, agno) \
+                __field(int, refcount) \
+                __field(unsigned long, caller_ip) \
         ), \
         TP_fast_assign( \
-                __entry->dev = VFS_I(ctx->dp)->i_sb->s_dev; \
-                __entry->ino = ctx->dp->i_ino; \
-                __entry->hashval = ctx->cursor->hashval; \
-                __entry->blkno = ctx->cursor->blkno; \
-                __entry->offset = ctx->cursor->offset; \
-                __entry->alist = ctx->alist; \
-                __entry->bufsize = ctx->bufsize; \
-                __entry->count = ctx->count; \
-                __entry->firstu = ctx->firstu; \
-                __entry->flags = ctx->flags; \
+                __entry->dev = mp->m_super->s_dev; \
+                __entry->agno = agno; \
+                __entry->refcount = refcount; \
+                __entry->caller_ip = caller_ip; \
         ), \
-        TP_printk("dev %d:%d ino 0x%llx cursor h/b/o 0x%x/0x%x/%u dupcnt %u " \
-                  "alist 0x%p size %u count %u firstu %u flags %d %s", \
+        TP_printk("dev %d:%d agno %u refcount %d caller %pf", \
                   MAJOR(__entry->dev), MINOR(__entry->dev), \
-                   __entry->ino, \
-                   __entry->hashval, \
-                   __entry->blkno, \
-                   __entry->offset, \
-                   __entry->dupcnt, \
-                   __entry->alist, \
-                   __entry->bufsize, \
-                   __entry->count, \
-                   __entry->firstu, \
-                   __entry->flags, \
-                   __print_flags(__entry->flags, "|", XFS_ATTR_FLAGS) \
-        ) \
-)
+                  __entry->agno, \
+                  __entry->refcount, \
+                  (char *)__entry->caller_ip) \
+);
+
+DEFINE_PERAG_REF_EVENT(xfs_perag_get)
+DEFINE_PERAG_REF_EVENT(xfs_perag_put)
+
+#define DEFINE_ATTR_LIST_EVENT(name) \
+DEFINE_EVENT(xfs_attr_list_class, name, \
+        TP_PROTO(struct xfs_attr_list_context *ctx), \
+        TP_ARGS(ctx))
 DEFINE_ATTR_LIST_EVENT(xfs_attr_list_sf);
 DEFINE_ATTR_LIST_EVENT(xfs_attr_list_sf_all);
 DEFINE_ATTR_LIST_EVENT(xfs_attr_list_leaf);
@@ -166,103 +197,111 @@ TRACE_EVENT(xfs_iext_insert,
                 __entry->caller_ip = caller_ip;
         ),
         TP_printk("dev %d:%d ino 0x%llx state %s idx %ld "
-                  "offset %lld block %s count %lld flag %d caller %pf",
+                  "offset %lld block %lld count %lld flag %d caller %pf",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->ino,
                   __print_flags(__entry->bmap_state, "|", XFS_BMAP_EXT_FLAGS),
                   (long)__entry->idx,
                   __entry->startoff,
-                  xfs_fmtfsblock(__entry->startblock),
+                  (__int64_t)__entry->startblock,
                   __entry->blockcount,
                   __entry->state,
                   (char *)__entry->caller_ip)
 );
 
+DECLARE_EVENT_CLASS(xfs_bmap_class,
+        TP_PROTO(struct xfs_inode *ip, xfs_extnum_t idx, int state,
+                 unsigned long caller_ip),
+        TP_ARGS(ip, idx, state, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(xfs_extnum_t, idx)
+                __field(xfs_fileoff_t, startoff)
+                __field(xfs_fsblock_t, startblock)
+                __field(xfs_filblks_t, blockcount)
+                __field(xfs_exntst_t, state)
+                __field(int, bmap_state)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                struct xfs_ifork        *ifp = (state & BMAP_ATTRFORK) ?
+                                                ip->i_afp : &ip->i_df;
+                struct xfs_bmbt_irec    r;
+
+                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &r);
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->idx = idx;
+                __entry->startoff = r.br_startoff;
+                __entry->startblock = r.br_startblock;
+                __entry->blockcount = r.br_blockcount;
+                __entry->state = r.br_state;
+                __entry->bmap_state = state;
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx state %s idx %ld "
+                  "offset %lld block %lld count %lld flag %d caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_flags(__entry->bmap_state, "|", XFS_BMAP_EXT_FLAGS),
+                  (long)__entry->idx,
+                  __entry->startoff,
+                  (__int64_t)__entry->startblock,
+                  __entry->blockcount,
+                  __entry->state,
+                  (char *)__entry->caller_ip)
+)
+
 #define DEFINE_BMAP_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_bmap_class, name, \
         TP_PROTO(struct xfs_inode *ip, xfs_extnum_t idx, int state, \
                  unsigned long caller_ip), \
-        TP_ARGS(ip, idx, state, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(xfs_extnum_t, idx) \
-                __field(xfs_fileoff_t, startoff) \
-                __field(xfs_fsblock_t, startblock) \
-                __field(xfs_filblks_t, blockcount) \
-                __field(xfs_exntst_t, state) \
-                __field(int, bmap_state) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                struct xfs_ifork        *ifp = (state & BMAP_ATTRFORK) ? \
-                                                ip->i_afp : &ip->i_df; \
-                struct xfs_bmbt_irec    r; \
-        \
-                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &r); \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->idx = idx; \
-                __entry->startoff = r.br_startoff; \
-                __entry->startblock = r.br_startblock; \
-                __entry->blockcount = r.br_blockcount; \
-                __entry->state = r.br_state; \
-                __entry->bmap_state = state; \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx state %s idx %ld " \
-                  "offset %lld block %s count %lld flag %d caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __print_flags(__entry->bmap_state, "|", XFS_BMAP_EXT_FLAGS), \
-                  (long)__entry->idx, \
-                  __entry->startoff, \
-                  xfs_fmtfsblock(__entry->startblock), \
-                  __entry->blockcount, \
-                  __entry->state, \
-                  (char *)__entry->caller_ip) \
-)
-
+        TP_ARGS(ip, idx, state, caller_ip))
 DEFINE_BMAP_EVENT(xfs_iext_remove);
 DEFINE_BMAP_EVENT(xfs_bmap_pre_update);
 DEFINE_BMAP_EVENT(xfs_bmap_post_update);
 DEFINE_BMAP_EVENT(xfs_extlist);
 
-#define DEFINE_BUF_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_buf *bp, unsigned long caller_ip), \
-        TP_ARGS(bp, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_daddr_t, bno) \
-                __field(size_t, buffer_length) \
-                __field(int, hold) \
-                __field(int, pincount) \
-                __field(unsigned, lockval) \
-                __field(unsigned, flags) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = bp->b_target->bt_dev; \
-                __entry->bno = bp->b_bn; \
-                __entry->buffer_length = bp->b_buffer_length; \
-                __entry->hold = atomic_read(&bp->b_hold); \
-                __entry->pincount = atomic_read(&bp->b_pin_count); \
-                __entry->lockval = xfs_buf_lock_value(bp); \
-                __entry->flags = bp->b_flags; \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d " \
-                  "lock %d flags %s caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  (unsigned long long)__entry->bno, \
-                  __entry->buffer_length, \
-                  __entry->hold, \
-                  __entry->pincount, \
-                  __entry->lockval, \
-                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS), \
-                  (void *)__entry->caller_ip) \
+DECLARE_EVENT_CLASS(xfs_buf_class,
+        TP_PROTO(struct xfs_buf *bp, unsigned long caller_ip),
+        TP_ARGS(bp, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_daddr_t, bno)
+                __field(size_t, buffer_length)
+                __field(int, hold)
+                __field(int, pincount)
+                __field(unsigned, lockval)
+                __field(unsigned, flags)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = bp->b_target->bt_dev;
+                __entry->bno = bp->b_bn;
+                __entry->buffer_length = bp->b_buffer_length;
+                __entry->hold = atomic_read(&bp->b_hold);
+                __entry->pincount = atomic_read(&bp->b_pin_count);
+                __entry->lockval = xfs_buf_lock_value(bp);
+                __entry->flags = bp->b_flags;
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
+                  "lock %d flags %s caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  (unsigned long long)__entry->bno,
+                  __entry->buffer_length,
+                  __entry->hold,
+                  __entry->pincount,
+                  __entry->lockval,
+                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS),
+                  (void *)__entry->caller_ip)
 )
+
+#define DEFINE_BUF_EVENT(name) \
+DEFINE_EVENT(xfs_buf_class, name, \
+        TP_PROTO(struct xfs_buf *bp, unsigned long caller_ip), \
+        TP_ARGS(bp, caller_ip))
 DEFINE_BUF_EVENT(xfs_buf_init);
 DEFINE_BUF_EVENT(xfs_buf_free);
 DEFINE_BUF_EVENT(xfs_buf_hold);
@@ -299,41 +338,45 @@ DEFINE_BUF_EVENT(xfs_reset_dqcounts);
 DEFINE_BUF_EVENT(xfs_inode_item_push);
 
 /* pass flags explicitly */
-#define DEFINE_BUF_FLAGS_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_buf *bp, unsigned flags, unsigned long caller_ip), \
-        TP_ARGS(bp, flags, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_daddr_t, bno) \
-                __field(size_t, buffer_length) \
-                __field(int, hold) \
-                __field(int, pincount) \
-                __field(unsigned, lockval) \
-                __field(unsigned, flags) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = bp->b_target->bt_dev; \
-                __entry->bno = bp->b_bn; \
-                __entry->buffer_length = bp->b_buffer_length; \
-                __entry->flags = flags; \
-                __entry->hold = atomic_read(&bp->b_hold); \
-                __entry->pincount = atomic_read(&bp->b_pin_count); \
-                __entry->lockval = xfs_buf_lock_value(bp); \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d " \
-                  "lock %d flags %s caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  (unsigned long long)__entry->bno, \
-                  __entry->buffer_length, \
-                  __entry->hold, \
-                  __entry->pincount, \
-                  __entry->lockval, \
-                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS), \
-                  (void *)__entry->caller_ip) \
+DECLARE_EVENT_CLASS(xfs_buf_flags_class,
+        TP_PROTO(struct xfs_buf *bp, unsigned flags, unsigned long caller_ip),
+        TP_ARGS(bp, flags, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_daddr_t, bno)
+                __field(size_t, buffer_length)
+                __field(int, hold)
+                __field(int, pincount)
+                __field(unsigned, lockval)
+                __field(unsigned, flags)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = bp->b_target->bt_dev;
+                __entry->bno = bp->b_bn;
+                __entry->buffer_length = bp->b_buffer_length;
+                __entry->flags = flags;
+                __entry->hold = atomic_read(&bp->b_hold);
+                __entry->pincount = atomic_read(&bp->b_pin_count);
+                __entry->lockval = xfs_buf_lock_value(bp);
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
+                  "lock %d flags %s caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  (unsigned long long)__entry->bno,
+                  __entry->buffer_length,
+                  __entry->hold,
+                  __entry->pincount,
+                  __entry->lockval,
+                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS),
+                  (void *)__entry->caller_ip)
 )
+
+#define DEFINE_BUF_FLAGS_EVENT(name) \
+DEFINE_EVENT(xfs_buf_flags_class, name, \
+        TP_PROTO(struct xfs_buf *bp, unsigned flags, unsigned long caller_ip), \
+        TP_ARGS(bp, flags, caller_ip))
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_find);
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_get);
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_read);
@@ -376,55 +419,58 @@ TRACE_EVENT(xfs_buf_ioerror,
                   (void *)__entry->caller_ip)
 );
 
-#define DEFINE_BUF_ITEM_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_buf_log_item *bip), \
-        TP_ARGS(bip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_daddr_t, buf_bno) \
-                __field(size_t, buf_len) \
-                __field(int, buf_hold) \
-                __field(int, buf_pincount) \
-                __field(int, buf_lockval) \
-                __field(unsigned, buf_flags) \
-                __field(unsigned, bli_recur) \
-                __field(int, bli_refcount) \
-                __field(unsigned, bli_flags) \
-                __field(void *, li_desc) \
-                __field(unsigned, li_flags) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = bip->bli_buf->b_target->bt_dev; \
-                __entry->bli_flags = bip->bli_flags; \
-                __entry->bli_recur = bip->bli_recur; \
-                __entry->bli_refcount = atomic_read(&bip->bli_refcount); \
-                __entry->buf_bno = bip->bli_buf->b_bn; \
-                __entry->buf_len = bip->bli_buf->b_buffer_length; \
-                __entry->buf_flags = bip->bli_buf->b_flags; \
-                __entry->buf_hold = atomic_read(&bip->bli_buf->b_hold); \
-                __entry->buf_pincount = \
-                        atomic_read(&bip->bli_buf->b_pin_count); \
-                __entry->buf_lockval = xfs_buf_lock_value(bip->bli_buf); \
-                __entry->li_desc = bip->bli_item.li_desc; \
-                __entry->li_flags = bip->bli_item.li_flags; \
-        ), \
-        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d " \
-                  "lock %d flags %s recur %d refcount %d bliflags %s " \
-                  "lidesc 0x%p liflags %s", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  (unsigned long long)__entry->buf_bno, \
-                  __entry->buf_len, \
-                  __entry->buf_hold, \
-                  __entry->buf_pincount, \
-                  __entry->buf_lockval, \
-                  __print_flags(__entry->buf_flags, "|", XFS_BUF_FLAGS), \
-                  __entry->bli_recur, \
-                  __entry->bli_refcount, \
-                  __print_flags(__entry->bli_flags, "|", XFS_BLI_FLAGS), \
-                  __entry->li_desc, \
-                  __print_flags(__entry->li_flags, "|", XFS_LI_FLAGS)) \
+DECLARE_EVENT_CLASS(xfs_buf_item_class,
+        TP_PROTO(struct xfs_buf_log_item *bip),
+        TP_ARGS(bip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_daddr_t, buf_bno)
+                __field(size_t, buf_len)
+                __field(int, buf_hold)
+                __field(int, buf_pincount)
+                __field(int, buf_lockval)
+                __field(unsigned, buf_flags)
+                __field(unsigned, bli_recur)
+                __field(int, bli_refcount)
+                __field(unsigned, bli_flags)
+                __field(void *, li_desc)
+                __field(unsigned, li_flags)
+        ),
+        TP_fast_assign(
+                __entry->dev = bip->bli_buf->b_target->bt_dev;
+                __entry->bli_flags = bip->bli_flags;
+                __entry->bli_recur = bip->bli_recur;
+                __entry->bli_refcount = atomic_read(&bip->bli_refcount);
+                __entry->buf_bno = bip->bli_buf->b_bn;
+                __entry->buf_len = bip->bli_buf->b_buffer_length;
+                __entry->buf_flags = bip->bli_buf->b_flags;
+                __entry->buf_hold = atomic_read(&bip->bli_buf->b_hold);
+                __entry->buf_pincount = atomic_read(&bip->bli_buf->b_pin_count);
+                __entry->buf_lockval = xfs_buf_lock_value(bip->bli_buf);
+                __entry->li_desc = bip->bli_item.li_desc;
+                __entry->li_flags = bip->bli_item.li_flags;
+        ),
+        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
+                  "lock %d flags %s recur %d refcount %d bliflags %s "
+                  "lidesc 0x%p liflags %s",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  (unsigned long long)__entry->buf_bno,
+                  __entry->buf_len,
+                  __entry->buf_hold,
+                  __entry->buf_pincount,
+                  __entry->buf_lockval,
+                  __print_flags(__entry->buf_flags, "|", XFS_BUF_FLAGS),
+                  __entry->bli_recur,
+                  __entry->bli_refcount,
+                  __print_flags(__entry->bli_flags, "|", XFS_BLI_FLAGS),
+                  __entry->li_desc,
+                  __print_flags(__entry->li_flags, "|", XFS_LI_FLAGS))
 )
+
+#define DEFINE_BUF_ITEM_EVENT(name) \
+DEFINE_EVENT(xfs_buf_item_class, name, \
+        TP_PROTO(struct xfs_buf_log_item *bip), \
+        TP_ARGS(bip))
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_size);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_size_stale);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_format);
@@ -437,6 +483,7 @@ DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unlock);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_unlock_stale);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_committed);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_push);
+DEFINE_BUF_ITEM_EVENT(xfs_buf_item_pushbuf);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_get_buf);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_get_buf_recur);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_getsb);
@@ -450,78 +497,90 @@ DEFINE_BUF_ITEM_EVENT(xfs_trans_bhold);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_bhold_release);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_binval);
 
+DECLARE_EVENT_CLASS(xfs_lock_class,
+        TP_PROTO(struct xfs_inode *ip, unsigned lock_flags,
+                 unsigned long caller_ip),
+        TP_ARGS(ip,  lock_flags, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(int, lock_flags)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->lock_flags = lock_flags;
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx flags %s caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_flags(__entry->lock_flags, "|", XFS_LOCK_FLAGS),
+                  (void *)__entry->caller_ip)
+)
+
 #define DEFINE_LOCK_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_lock_class, name, \
         TP_PROTO(struct xfs_inode *ip, unsigned lock_flags, \
                  unsigned long caller_ip), \
-        TP_ARGS(ip,  lock_flags, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(int, lock_flags) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->lock_flags = lock_flags; \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx flags %s caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __print_flags(__entry->lock_flags, "|", XFS_LOCK_FLAGS), \
-                  (void *)__entry->caller_ip) \
-)
-
+        TP_ARGS(ip,  lock_flags, caller_ip))
 DEFINE_LOCK_EVENT(xfs_ilock);
 DEFINE_LOCK_EVENT(xfs_ilock_nowait);
 DEFINE_LOCK_EVENT(xfs_ilock_demote);
 DEFINE_LOCK_EVENT(xfs_iunlock);
 
+DECLARE_EVENT_CLASS(xfs_iget_class,
+        TP_PROTO(struct xfs_inode *ip),
+        TP_ARGS(ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino)
+)
+
 #define DEFINE_IGET_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_iget_class, name, \
         TP_PROTO(struct xfs_inode *ip), \
-        TP_ARGS(ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino) \
-)
+        TP_ARGS(ip))
 DEFINE_IGET_EVENT(xfs_iget_skip);
 DEFINE_IGET_EVENT(xfs_iget_reclaim);
 DEFINE_IGET_EVENT(xfs_iget_found);
 DEFINE_IGET_EVENT(xfs_iget_alloc);
 
+DECLARE_EVENT_CLASS(xfs_inode_class,
+        TP_PROTO(struct xfs_inode *ip, unsigned long caller_ip),
+        TP_ARGS(ip, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(int, count)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->count = atomic_read(&VFS_I(ip)->i_count);
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx count %d caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __entry->count,
+                  (char *)__entry->caller_ip)
+)
+
 #define DEFINE_INODE_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_inode_class, name, \
         TP_PROTO(struct xfs_inode *ip, unsigned long caller_ip), \
-        TP_ARGS(ip, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(int, count) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->count = atomic_read(&VFS_I(ip)->i_count); \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx count %d caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __entry->count, \
-                  (char *)__entry->caller_ip) \
-)
+        TP_ARGS(ip, caller_ip))
 DEFINE_INODE_EVENT(xfs_ihold);
 DEFINE_INODE_EVENT(xfs_irele);
 /* the old xfs_itrace_entry tracer - to be replaced by s.th. in the VFS */
@@ -529,55 +588,59 @@ DEFINE_INODE_EVENT(xfs_inode);
 #define xfs_itrace_entry(ip)    \
         trace_xfs_inode(ip, _THIS_IP_)
 
-#define DEFINE_DQUOT_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_dquot *dqp), \
-        TP_ARGS(dqp), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(__be32, id) \
-                __field(unsigned, flags) \
-                __field(unsigned, nrefs) \
-                __field(unsigned long long, res_bcount) \
-                __field(unsigned long long, bcount) \
-                __field(unsigned long long, icount) \
-                __field(unsigned long long, blk_hardlimit) \
-                __field(unsigned long long, blk_softlimit) \
-                __field(unsigned long long, ino_hardlimit) \
-                __field(unsigned long long, ino_softlimit) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = dqp->q_mount->m_super->s_dev; \
-                __entry->id = dqp->q_core.d_id; \
-                __entry->flags = dqp->dq_flags; \
-                __entry->nrefs = dqp->q_nrefs; \
-                __entry->res_bcount = dqp->q_res_bcount; \
-                __entry->bcount = be64_to_cpu(dqp->q_core.d_bcount); \
-                __entry->icount = be64_to_cpu(dqp->q_core.d_icount); \
-                __entry->blk_hardlimit = \
-                        be64_to_cpu(dqp->q_core.d_blk_hardlimit); \
-                __entry->blk_softlimit = \
-                        be64_to_cpu(dqp->q_core.d_blk_softlimit); \
-                __entry->ino_hardlimit = \
-                        be64_to_cpu(dqp->q_core.d_ino_hardlimit); \
-                __entry->ino_softlimit = \
-                        be64_to_cpu(dqp->q_core.d_ino_softlimit); \
+DECLARE_EVENT_CLASS(xfs_dquot_class,
+        TP_PROTO(struct xfs_dquot *dqp),
+        TP_ARGS(dqp),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(u32, id)
+                __field(unsigned, flags)
+                __field(unsigned, nrefs)
+                __field(unsigned long long, res_bcount)
+                __field(unsigned long long, bcount)
+                __field(unsigned long long, icount)
+                __field(unsigned long long, blk_hardlimit)
+                __field(unsigned long long, blk_softlimit)
+                __field(unsigned long long, ino_hardlimit)
+                __field(unsigned long long, ino_softlimit)
         ), \
-        TP_printk("dev %d:%d id 0x%x flags %s nrefs %u res_bc 0x%llx " \
-                  "bcnt 0x%llx [hard 0x%llx | soft 0x%llx] " \
-                  "icnt 0x%llx [hard 0x%llx | soft 0x%llx]", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  be32_to_cpu(__entry->id), \
-                  __print_flags(__entry->flags, "|", XFS_DQ_FLAGS), \
-                  __entry->nrefs, \
-                  __entry->res_bcount, \
-                  __entry->bcount, \
-                  __entry->blk_hardlimit, \
-                  __entry->blk_softlimit, \
-                  __entry->icount, \
-                  __entry->ino_hardlimit, \
-                  __entry->ino_softlimit) \
+        TP_fast_assign(
+                __entry->dev = dqp->q_mount->m_super->s_dev;
+                __entry->id = be32_to_cpu(dqp->q_core.d_id);
+                __entry->flags = dqp->dq_flags;
+                __entry->nrefs = dqp->q_nrefs;
+                __entry->res_bcount = dqp->q_res_bcount;
+                __entry->bcount = be64_to_cpu(dqp->q_core.d_bcount);
+                __entry->icount = be64_to_cpu(dqp->q_core.d_icount);
+                __entry->blk_hardlimit =
+                        be64_to_cpu(dqp->q_core.d_blk_hardlimit);
+                __entry->blk_softlimit =
+                        be64_to_cpu(dqp->q_core.d_blk_softlimit);
+                __entry->ino_hardlimit =
+                        be64_to_cpu(dqp->q_core.d_ino_hardlimit);
+                __entry->ino_softlimit =
+                        be64_to_cpu(dqp->q_core.d_ino_softlimit);
+        ),
+        TP_printk("dev %d:%d id 0x%x flags %s nrefs %u res_bc 0x%llx "
+                  "bcnt 0x%llx bhardlimit 0x%llx bsoftlimit 0x%llx "
+                  "icnt 0x%llx ihardlimit 0x%llx isoftlimit 0x%llx]",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->id,
+                  __print_flags(__entry->flags, "|", XFS_DQ_FLAGS),
+                  __entry->nrefs,
+                  __entry->res_bcount,
+                  __entry->bcount,
+                  __entry->blk_hardlimit,
+                  __entry->blk_softlimit,
+                  __entry->icount,
+                  __entry->ino_hardlimit,
+                  __entry->ino_softlimit)
 )
+
+#define DEFINE_DQUOT_EVENT(name) \
+DEFINE_EVENT(xfs_dquot_class, name, \
+        TP_PROTO(struct xfs_dquot *dqp), \
+        TP_ARGS(dqp))
 DEFINE_DQUOT_EVENT(xfs_dqadjust);
 DEFINE_DQUOT_EVENT(xfs_dqshake_dirty);
 DEFINE_DQUOT_EVENT(xfs_dqshake_unlink);
@@ -610,72 +673,75 @@ DEFINE_DQUOT_EVENT(xfs_dqflush_done);
 DEFINE_IGET_EVENT(xfs_dquot_dqalloc);
 DEFINE_IGET_EVENT(xfs_dquot_dqdetach);
 
+DECLARE_EVENT_CLASS(xfs_loggrant_class,
+        TP_PROTO(struct log *log, struct xlog_ticket *tic),
+        TP_ARGS(log, tic),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(unsigned, trans_type)
+                __field(char, ocnt)
+                __field(char, cnt)
+                __field(int, curr_res)
+                __field(int, unit_res)
+                __field(unsigned int, flags)
+                __field(void *, reserve_headq)
+                __field(void *, write_headq)
+                __field(int, grant_reserve_cycle)
+                __field(int, grant_reserve_bytes)
+                __field(int, grant_write_cycle)
+                __field(int, grant_write_bytes)
+                __field(int, curr_cycle)
+                __field(int, curr_block)
+                __field(xfs_lsn_t, tail_lsn)
+        ),
+        TP_fast_assign(
+                __entry->dev = log->l_mp->m_super->s_dev;
+                __entry->trans_type = tic->t_trans_type;
+                __entry->ocnt = tic->t_ocnt;
+                __entry->cnt = tic->t_cnt;
+                __entry->curr_res = tic->t_curr_res;
+                __entry->unit_res = tic->t_unit_res;
+                __entry->flags = tic->t_flags;
+                __entry->reserve_headq = log->l_reserve_headq;
+                __entry->write_headq = log->l_write_headq;
+                __entry->grant_reserve_cycle = log->l_grant_reserve_cycle;
+                __entry->grant_reserve_bytes = log->l_grant_reserve_bytes;
+                __entry->grant_write_cycle = log->l_grant_write_cycle;
+                __entry->grant_write_bytes = log->l_grant_write_bytes;
+                __entry->curr_cycle = log->l_curr_cycle;
+                __entry->curr_block = log->l_curr_block;
+                __entry->tail_lsn = log->l_tail_lsn;
+        ),
+        TP_printk("dev %d:%d type %s t_ocnt %u t_cnt %u t_curr_res %u "
+                  "t_unit_res %u t_flags %s reserve_headq 0x%p "
+                  "write_headq 0x%p grant_reserve_cycle %d "
+                  "grant_reserve_bytes %d grant_write_cycle %d "
+                  "grant_write_bytes %d curr_cycle %d curr_block %d "
+                  "tail_cycle %d tail_block %d",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __print_symbolic(__entry->trans_type, XFS_TRANS_TYPES),
+                  __entry->ocnt,
+                  __entry->cnt,
+                  __entry->curr_res,
+                  __entry->unit_res,
+                  __print_flags(__entry->flags, "|", XLOG_TIC_FLAGS),
+                  __entry->reserve_headq,
+                  __entry->write_headq,
+                  __entry->grant_reserve_cycle,
+                  __entry->grant_reserve_bytes,
+                  __entry->grant_write_cycle,
+                  __entry->grant_write_bytes,
+                  __entry->curr_cycle,
+                  __entry->curr_block,
+                  CYCLE_LSN(__entry->tail_lsn),
+                  BLOCK_LSN(__entry->tail_lsn)
+        )
+)
 
-#define DEFINE_LOGGRANT_EVENT(tname) \
-TRACE_EVENT(tname, \
+#define DEFINE_LOGGRANT_EVENT(name) \
+DEFINE_EVENT(xfs_loggrant_class, name, \
         TP_PROTO(struct log *log, struct xlog_ticket *tic), \
-        TP_ARGS(log, tic), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(unsigned, trans_type) \
-                __field(char, ocnt) \
-                __field(char, cnt) \
-                __field(int, curr_res) \
-                __field(int, unit_res) \
-                __field(unsigned int, flags) \
-                __field(void *, reserve_headq) \
-                __field(void *, write_headq) \
-                __field(int, grant_reserve_cycle) \
-                __field(int, grant_reserve_bytes) \
-                __field(int, grant_write_cycle) \
-                __field(int, grant_write_bytes) \
-                __field(int, curr_cycle) \
-                __field(int, curr_block) \
-                __field(xfs_lsn_t, tail_lsn) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = log->l_mp->m_super->s_dev; \
-                __entry->trans_type = tic->t_trans_type; \
-                __entry->ocnt = tic->t_ocnt; \
-                __entry->cnt = tic->t_cnt; \
-                __entry->curr_res = tic->t_curr_res; \
-                __entry->unit_res = tic->t_unit_res; \
-                __entry->flags = tic->t_flags; \
-                __entry->reserve_headq = log->l_reserve_headq; \
-                __entry->write_headq = log->l_write_headq; \
-                __entry->grant_reserve_cycle = log->l_grant_reserve_cycle; \
-                __entry->grant_reserve_bytes = log->l_grant_reserve_bytes; \
-                __entry->grant_write_cycle = log->l_grant_write_cycle; \
-                __entry->grant_write_bytes = log->l_grant_write_bytes; \
-                __entry->curr_cycle = log->l_curr_cycle; \
-                __entry->curr_block = log->l_curr_block; \
-                __entry->tail_lsn = log->l_tail_lsn; \
-        ), \
-        TP_printk("dev %d:%d type %s t_ocnt %u t_cnt %u t_curr_res %u " \
-                  "t_unit_res %u t_flags %s reserve_headq 0x%p " \
-                  "write_headq 0x%p grant_reserve_cycle %d " \
-                  "grant_reserve_bytes %d grant_write_cycle %d " \
-                  "grant_write_bytes %d curr_cycle %d curr_block %d " \
-                  "tail_cycle %d tail_block %d", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __print_symbolic(__entry->trans_type, XFS_TRANS_TYPES), \
-                  __entry->ocnt, \
-                  __entry->cnt, \
-                  __entry->curr_res, \
-                  __entry->unit_res, \
-                  __print_flags(__entry->flags, "|", XLOG_TIC_FLAGS), \
-                  __entry->reserve_headq, \
-                  __entry->write_headq, \
-                  __entry->grant_reserve_cycle, \
-                  __entry->grant_reserve_bytes, \
-                  __entry->grant_write_cycle, \
-                  __entry->grant_write_bytes, \
-                  __entry->curr_cycle, \
-                  __entry->curr_block, \
-                  CYCLE_LSN(__entry->tail_lsn), \
-                  BLOCK_LSN(__entry->tail_lsn) \
-        ) \
-)
+        TP_ARGS(log, tic))
 DEFINE_LOGGRANT_EVENT(xfs_log_done_nonperm);
 DEFINE_LOGGRANT_EVENT(xfs_log_done_perm);
 DEFINE_LOGGRANT_EVENT(xfs_log_reserve);
@@ -815,7 +881,7 @@ TRACE_EVENT(name, \
         ), \
         TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx " \
                   "offset 0x%llx count %zd flags %s " \
-                  "startoff 0x%llx startblock 0x%llx blockcount 0x%llx", \
+                  "startoff 0x%llx startblock %lld blockcount 0x%llx", \
                   MAJOR(__entry->dev), MINOR(__entry->dev), \
                   __entry->ino, \
                   __entry->size, \
@@ -824,7 +890,7 @@ TRACE_EVENT(name, \
                   __entry->count, \
                   __print_flags(__entry->flags, "|", BMAPI_FLAGS), \
                   __entry->startoff, \
-                  __entry->startblock, \
+                  (__int64_t)__entry->startblock, \
                   __entry->blockcount) \
 )
 DEFINE_IOMAP_EVENT(xfs_iomap_enter);
@@ -897,28 +963,32 @@ TRACE_EVENT(xfs_itruncate_start,
                   __entry->toss_finish)
 );
 
+DECLARE_EVENT_CLASS(xfs_itrunc_class,
+        TP_PROTO(struct xfs_inode *ip, xfs_fsize_t new_size),
+        TP_ARGS(ip, new_size),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(xfs_fsize_t, size)
+                __field(xfs_fsize_t, new_size)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->size = ip->i_d.di_size;
+                __entry->new_size = new_size;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __entry->size,
+                  __entry->new_size)
+)
+
 #define DEFINE_ITRUNC_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_itrunc_class, name, \
         TP_PROTO(struct xfs_inode *ip, xfs_fsize_t new_size), \
-        TP_ARGS(ip, new_size), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(xfs_fsize_t, size) \
-                __field(xfs_fsize_t, new_size) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->size = ip->i_d.di_size; \
-                __entry->new_size = new_size; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __entry->size, \
-                  __entry->new_size) \
-)
+        TP_ARGS(ip, new_size))
 DEFINE_ITRUNC_EVENT(xfs_itruncate_finish_start);
 DEFINE_ITRUNC_EVENT(xfs_itruncate_finish_end);
 
@@ -1037,28 +1107,28 @@ TRACE_EVENT(xfs_alloc_unbusy,
 
 TRACE_EVENT(xfs_alloc_busysearch,
         TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, xfs_agblock_t agbno,
-                 xfs_extlen_t len, int found),
-        TP_ARGS(mp, agno, agbno, len, found),
+                 xfs_extlen_t len, xfs_lsn_t lsn),
+        TP_ARGS(mp, agno, agbno, len, lsn),
         TP_STRUCT__entry(
                 __field(dev_t, dev)
                 __field(xfs_agnumber_t, agno)
                 __field(xfs_agblock_t, agbno)
                 __field(xfs_extlen_t, len)
-                __field(int, found)
+                __field(xfs_lsn_t, lsn)
         ),
         TP_fast_assign(
                 __entry->dev = mp->m_super->s_dev;
                 __entry->agno = agno;
                 __entry->agbno = agbno;
                 __entry->len = len;
-                __entry->found = found;
+                __entry->lsn = lsn;
         ),
-        TP_printk("dev %d:%d agno %u agbno %u len %u %s",
+        TP_printk("dev %d:%d agno %u agbno %u len %u force lsn 0x%llx",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->agno,
                   __entry->agbno,
                   __entry->len,
-                  __print_symbolic(__entry->found, XFS_BUSY_STATES))
+                  __entry->lsn)
 );
 
 TRACE_EVENT(xfs_agf,
@@ -1152,77 +1222,80 @@ TRACE_EVENT(xfs_free_extent,
 
 );
 
-#define DEFINE_ALLOC_EVENT(name) \
-TRACE_EVENT(name, \
-        TP_PROTO(struct xfs_alloc_arg *args), \
-        TP_ARGS(args), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_agnumber_t, agno) \
-                __field(xfs_agblock_t, agbno) \
-                __field(xfs_extlen_t, minlen) \
-                __field(xfs_extlen_t, maxlen) \
-                __field(xfs_extlen_t, mod) \
-                __field(xfs_extlen_t, prod) \
-                __field(xfs_extlen_t, minleft) \
-                __field(xfs_extlen_t, total) \
-                __field(xfs_extlen_t, alignment) \
-                __field(xfs_extlen_t, minalignslop) \
-                __field(xfs_extlen_t, len) \
-                __field(short, type) \
-                __field(short, otype) \
-                __field(char, wasdel) \
-                __field(char, wasfromfl) \
-                __field(char, isfl) \
-                __field(char, userdata) \
-                __field(xfs_fsblock_t, firstblock) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = args->mp->m_super->s_dev; \
-                __entry->agno = args->agno; \
-                __entry->agbno = args->agbno; \
-                __entry->minlen = args->minlen; \
-                __entry->maxlen = args->maxlen; \
-                __entry->mod = args->mod; \
-                __entry->prod = args->prod; \
-                __entry->minleft = args->minleft; \
-                __entry->total = args->total; \
-                __entry->alignment = args->alignment; \
-                __entry->minalignslop = args->minalignslop; \
-                __entry->len = args->len; \
-                __entry->type = args->type; \
-                __entry->otype = args->otype; \
-                __entry->wasdel = args->wasdel; \
-                __entry->wasfromfl = args->wasfromfl; \
-                __entry->isfl = args->isfl; \
-                __entry->userdata = args->userdata; \
-                __entry->firstblock = args->firstblock; \
-        ), \
-        TP_printk("dev %d:%d agno %u agbno %u minlen %u maxlen %u mod %u " \
-                  "prod %u minleft %u total %u alignment %u minalignslop %u " \
-                  "len %u type %s otype %s wasdel %d wasfromfl %d isfl %d " \
-                  "userdata %d firstblock 0x%llx", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->agno, \
-                  __entry->agbno, \
-                  __entry->minlen, \
-                  __entry->maxlen, \
-                  __entry->mod, \
-                  __entry->prod, \
-                  __entry->minleft, \
-                  __entry->total, \
-                  __entry->alignment, \
-                  __entry->minalignslop, \
-                  __entry->len, \
-                  __print_symbolic(__entry->type, XFS_ALLOC_TYPES), \
-                  __print_symbolic(__entry->otype, XFS_ALLOC_TYPES), \
-                  __entry->wasdel, \
-                  __entry->wasfromfl, \
-                  __entry->isfl, \
-                  __entry->userdata, \
-                  __entry->firstblock) \
+DECLARE_EVENT_CLASS(xfs_alloc_class,
+        TP_PROTO(struct xfs_alloc_arg *args),
+        TP_ARGS(args),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_agnumber_t, agno)
+                __field(xfs_agblock_t, agbno)
+                __field(xfs_extlen_t, minlen)
+                __field(xfs_extlen_t, maxlen)
+                __field(xfs_extlen_t, mod)
+                __field(xfs_extlen_t, prod)
+                __field(xfs_extlen_t, minleft)
+                __field(xfs_extlen_t, total)
+                __field(xfs_extlen_t, alignment)
+                __field(xfs_extlen_t, minalignslop)
+                __field(xfs_extlen_t, len)
+                __field(short, type)
+                __field(short, otype)
+                __field(char, wasdel)
+                __field(char, wasfromfl)
+                __field(char, isfl)
+                __field(char, userdata)
+                __field(xfs_fsblock_t, firstblock)
+        ),
+        TP_fast_assign(
+                __entry->dev = args->mp->m_super->s_dev;
+                __entry->agno = args->agno;
+                __entry->agbno = args->agbno;
+                __entry->minlen = args->minlen;
+                __entry->maxlen = args->maxlen;
+                __entry->mod = args->mod;
+                __entry->prod = args->prod;
+                __entry->minleft = args->minleft;
+                __entry->total = args->total;
+                __entry->alignment = args->alignment;
+                __entry->minalignslop = args->minalignslop;
+                __entry->len = args->len;
+                __entry->type = args->type;
+                __entry->otype = args->otype;
+                __entry->wasdel = args->wasdel;
+                __entry->wasfromfl = args->wasfromfl;
+                __entry->isfl = args->isfl;
+                __entry->userdata = args->userdata;
+                __entry->firstblock = args->firstblock;
+        ),
+        TP_printk("dev %d:%d agno %u agbno %u minlen %u maxlen %u mod %u "
+                  "prod %u minleft %u total %u alignment %u minalignslop %u "
+                  "len %u type %s otype %s wasdel %d wasfromfl %d isfl %d "
+                  "userdata %d firstblock 0x%llx",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->agno,
+                  __entry->agbno,
+                  __entry->minlen,
+                  __entry->maxlen,
+                  __entry->mod,
+                  __entry->prod,
+                  __entry->minleft,
+                  __entry->total,
+                  __entry->alignment,
+                  __entry->minalignslop,
+                  __entry->len,
+                  __print_symbolic(__entry->type, XFS_ALLOC_TYPES),
+                  __print_symbolic(__entry->otype, XFS_ALLOC_TYPES),
+                  __entry->wasdel,
+                  __entry->wasfromfl,
+                  __entry->isfl,
+                  __entry->userdata,
+                  __entry->firstblock)
 )
 
+#define DEFINE_ALLOC_EVENT(name) \
+DEFINE_EVENT(xfs_alloc_class, name, \
+        TP_PROTO(struct xfs_alloc_arg *args), \
+        TP_ARGS(args))
 DEFINE_ALLOC_EVENT(xfs_alloc_exact_done);
 DEFINE_ALLOC_EVENT(xfs_alloc_exact_error);
 DEFINE_ALLOC_EVENT(xfs_alloc_near_nominleft);
@@ -1245,92 +1318,100 @@ DEFINE_ALLOC_EVENT(xfs_alloc_vextent_noagbp);
 DEFINE_ALLOC_EVENT(xfs_alloc_vextent_loopfailed);
 DEFINE_ALLOC_EVENT(xfs_alloc_vextent_allfailed);
 
-#define DEFINE_DIR2_TRACE(tname) \
-TRACE_EVENT(tname, \
+DECLARE_EVENT_CLASS(xfs_dir2_class,
+        TP_PROTO(struct xfs_da_args *args),
+        TP_ARGS(args),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __dynamic_array(char, name, args->namelen)
+                __field(int, namelen)
+                __field(xfs_dahash_t, hashval)
+                __field(xfs_ino_t, inumber)
+                __field(int, op_flags)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(args->dp)->i_sb->s_dev;
+                __entry->ino = args->dp->i_ino;
+                if (args->namelen)
+                        memcpy(__get_str(name), args->name, args->namelen);
+                __entry->namelen = args->namelen;
+                __entry->hashval = args->hashval;
+                __entry->inumber = args->inumber;
+                __entry->op_flags = args->op_flags;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx name %.*s namelen %d hashval 0x%x "
+                  "inumber 0x%llx op_flags %s",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __entry->namelen,
+                  __entry->namelen ? __get_str(name) : NULL,
+                  __entry->namelen,
+                  __entry->hashval,
+                  __entry->inumber,
+                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS))
+)
+
+#define DEFINE_DIR2_EVENT(name) \
+DEFINE_EVENT(xfs_dir2_class, name, \
         TP_PROTO(struct xfs_da_args *args), \
-        TP_ARGS(args), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __dynamic_array(char, name, args->namelen) \
-                __field(int, namelen) \
-                __field(xfs_dahash_t, hashval) \
-                __field(xfs_ino_t, inumber) \
-                __field(int, op_flags) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(args->dp)->i_sb->s_dev; \
-                __entry->ino = args->dp->i_ino; \
-                if (args->namelen) \
-                        memcpy(__get_str(name), args->name, args->namelen); \
-                __entry->namelen = args->namelen; \
-                __entry->hashval = args->hashval; \
-                __entry->inumber = args->inumber; \
-                __entry->op_flags = args->op_flags; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx name %.*s namelen %d hashval 0x%x " \
-                  "inumber 0x%llx op_flags %s", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __entry->namelen, \
-                  __entry->namelen ? __get_str(name) : NULL, \
-                  __entry->namelen, \
-                  __entry->hashval, \
-                  __entry->inumber, \
-                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS)) \
+        TP_ARGS(args))
+DEFINE_DIR2_EVENT(xfs_dir2_sf_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_create);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_toino4);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_toino8);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_to_block);
+DEFINE_DIR2_EVENT(xfs_dir2_block_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_block_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_block_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_block_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_block_to_sf);
+DEFINE_DIR2_EVENT(xfs_dir2_block_to_leaf);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_to_block);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_to_node);
+DEFINE_DIR2_EVENT(xfs_dir2_node_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_node_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_node_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_node_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_node_to_leaf);
+
+DECLARE_EVENT_CLASS(xfs_dir2_space_class,
+        TP_PROTO(struct xfs_da_args *args, int idx),
+        TP_ARGS(args, idx),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(int, op_flags)
+                __field(int, idx)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(args->dp)->i_sb->s_dev;
+                __entry->ino = args->dp->i_ino;
+                __entry->op_flags = args->op_flags;
+                __entry->idx = idx;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx op_flags %s index %d",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS),
+                  __entry->idx)
 )
-DEFINE_DIR2_TRACE(xfs_dir2_sf_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_create);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_toino4);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_toino8);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_to_block);
-DEFINE_DIR2_TRACE(xfs_dir2_block_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_block_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_block_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_block_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_block_to_sf);
-DEFINE_DIR2_TRACE(xfs_dir2_block_to_leaf);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_to_block);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_to_node);
-DEFINE_DIR2_TRACE(xfs_dir2_node_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_node_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_node_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_node_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_node_to_leaf);
-
-#define DEFINE_DIR2_SPACE_TRACE(tname) \
-TRACE_EVENT(tname, \
+
+#define DEFINE_DIR2_SPACE_EVENT(name) \
+DEFINE_EVENT(xfs_dir2_space_class, name, \
         TP_PROTO(struct xfs_da_args *args, int idx), \
-        TP_ARGS(args, idx), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(int, op_flags) \
-                __field(int, idx) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(args->dp)->i_sb->s_dev; \
-                __entry->ino = args->dp->i_ino; \
-                __entry->op_flags = args->op_flags; \
-                __entry->idx = idx; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx op_flags %s index %d", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS), \
-                  __entry->idx) \
-)
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_leafn_add);
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_leafn_remove);
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_grow_inode);
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_shrink_inode);
+        TP_ARGS(args, idx))
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_leafn_add);
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_leafn_remove);
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_grow_inode);
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_shrink_inode);
 
 TRACE_EVENT(xfs_dir2_leafn_moveents,
         TP_PROTO(struct xfs_da_args *args, int src_idx, int dst_idx, int count),
@@ -1361,6 +1442,59 @@ TRACE_EVENT(xfs_dir2_leafn_moveents,
                   __entry->count)
 );
 
+#define XFS_SWAPEXT_INODES \
+        { 0,    "target" }, \
+        { 1,    "temp" }
+
+#define XFS_INODE_FORMAT_STR \
+        { 0,    "invalid" }, \
+        { 1,    "local" }, \
+        { 2,    "extent" }, \
+        { 3,    "btree" }
+
+DECLARE_EVENT_CLASS(xfs_swap_extent_class,
+        TP_PROTO(struct xfs_inode *ip, int which),
+        TP_ARGS(ip, which),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(int, which)
+                __field(xfs_ino_t, ino)
+                __field(int, format)
+                __field(int, nex)
+                __field(int, max_nex)
+                __field(int, broot_size)
+                __field(int, fork_off)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->which = which;
+                __entry->ino = ip->i_ino;
+                __entry->format = ip->i_d.di_format;
+                __entry->nex = ip->i_d.di_nextents;
+                __entry->max_nex = ip->i_df.if_ext_max;
+                __entry->broot_size = ip->i_df.if_broot_bytes;
+                __entry->fork_off = XFS_IFORK_BOFF(ip);
+        ),
+        TP_printk("dev %d:%d ino 0x%llx (%s), %s format, num_extents %d, "
+                  "Max in-fork extents %d, broot size %d, fork offset %d",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_symbolic(__entry->which, XFS_SWAPEXT_INODES),
+                  __print_symbolic(__entry->format, XFS_INODE_FORMAT_STR),
+                  __entry->nex,
+                  __entry->max_nex,
+                  __entry->broot_size,
+                  __entry->fork_off)
+)
+
+#define DEFINE_SWAPEXT_EVENT(name) \
+DEFINE_EVENT(xfs_swap_extent_class, name, \
+        TP_PROTO(struct xfs_inode *ip, int which), \
+        TP_ARGS(ip, which))
+
+DEFINE_SWAPEXT_EVENT(xfs_swap_extent_before);
+DEFINE_SWAPEXT_EVENT(xfs_swap_extent_after);
+
 #endif /* _TRACE_XFS_H */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/fs/xfs/linux-2.6/xfs_xattr.c b/fs/xfs/linux-2.6/xfs_xattr.c
index 0b1878857fc3..fa01b9daba6b 100644
--- a/fs/xfs/linux-2.6/xfs_xattr.c
+++ b/fs/xfs/linux-2.6/xfs_xattr.c
@@ -45,7 +45,7 @@ xfs_xattr_get(struct dentry *dentry, const char *name,
                 value = NULL;
         }
 
-        error = -xfs_attr_get(ip, name, value, &asize, xflags);
+        error = -xfs_attr_get(ip, (unsigned char *)name, value, &asize, xflags);
         if (error)
                 return error;
         return asize;
@@ -67,8 +67,9 @@ xfs_xattr_set(struct dentry *dentry, const char *name, const void *value,
                 xflags |= ATTR_REPLACE;
 
         if (!value)
-                return -xfs_attr_remove(ip, name, xflags);
-        return -xfs_attr_set(ip, name, (void *)value, size, xflags);
+                return -xfs_attr_remove(ip, (unsigned char *)name, xflags);
+        return -xfs_attr_set(ip, (unsigned char *)name,
+                                (void *)value, size, xflags);
 }
 
 static struct xattr_handler xfs_xattr_user_handler = {
@@ -124,8 +125,13 @@ static const char *xfs_xattr_prefix(int flags)
 }
 
 static int
-xfs_xattr_put_listent(struct xfs_attr_list_context *context, int flags,
-                char *name, int namelen, int valuelen, char *value)
+xfs_xattr_put_listent(
+        struct xfs_attr_list_context *context,
+        int             flags,
+        unsigned char   *name,
+        int             namelen,
+        int             valuelen,
+        unsigned char   *value)
 {
         unsigned int prefix_len = xfs_xattr_prefix_len(flags);
         char *offset;
@@ -148,7 +154,7 @@ xfs_xattr_put_listent(struct xfs_attr_list_context *context, int flags,
         offset = (char *)context->alist + context->count;
         strncpy(offset, xfs_xattr_prefix(flags), prefix_len);
         offset += prefix_len;
-        strncpy(offset, name, namelen);                 /* real name */
+        strncpy(offset, (char *)name, namelen);                 /* real name */
         offset += namelen;
         *offset = '\0';
         context->count += prefix_len + namelen + 1;
@@ -156,8 +162,13 @@ xfs_xattr_put_listent(struct xfs_attr_list_context *context, int flags,
 }
 
 static int
-xfs_xattr_put_listent_sizes(struct xfs_attr_list_context *context, int flags,
-                char *name, int namelen, int valuelen, char *value)
+xfs_xattr_put_listent_sizes(
+        struct xfs_attr_list_context *context,
+        int             flags,
+        unsigned char   *name,
+        int             namelen,
+        int             valuelen,
+        unsigned char   *value)
 {
         context->count += xfs_xattr_prefix_len(flags) + namelen + 1;
         return 0;
diff --git a/fs/xfs/quota/xfs_dquot.c b/fs/xfs/quota/xfs_dquot.c
index d7c7eea09fc2..5f79dd78626b 100644
--- a/fs/xfs/quota/xfs_dquot.c
+++ b/fs/xfs/quota/xfs_dquot.c
@@ -1187,7 +1187,7 @@ xfs_qm_dqflush(
          * block, nada.
          */
         if (!XFS_DQ_IS_DIRTY(dqp) ||
-            (!(flags & XFS_QMOPT_SYNC) && atomic_read(&dqp->q_pincount) > 0)) {
+            (!(flags & SYNC_WAIT) && atomic_read(&dqp->q_pincount) > 0)) {
                 xfs_dqfunlock(dqp);
                 return 0;
         }
@@ -1248,23 +1248,20 @@ xfs_qm_dqflush(
          */
         if (XFS_BUF_ISPINNED(bp)) {
                 trace_xfs_dqflush_force(dqp);
-                xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE);
+                xfs_log_force(mp, 0);
         }
 
-        if (flags & XFS_QMOPT_DELWRI) {
-                xfs_bdwrite(mp, bp);
-        } else if (flags & XFS_QMOPT_ASYNC) {
-                error = xfs_bawrite(mp, bp);
-        } else {
+        if (flags & SYNC_WAIT)
                 error = xfs_bwrite(mp, bp);
-        }
+        else
+                xfs_bdwrite(mp, bp);
 
         trace_xfs_dqflush_done(dqp);
 
         /*
          * dqp is still locked, but caller is free to unlock it now.
          */
-        return (error);
+        return error;
 
 }
 
@@ -1445,7 +1442,7 @@ xfs_qm_dqpurge(
                  * We don't care about getting disk errors here. We need
                  * to purge this dquot anyway, so we go ahead regardless.
                  */
-                error = xfs_qm_dqflush(dqp, XFS_QMOPT_SYNC);
+                error = xfs_qm_dqflush(dqp, SYNC_WAIT);
                 if (error)
                         xfs_fs_cmn_err(CE_WARN, mp,
                                 "xfs_qm_dqpurge: dquot %p flush failed", dqp);
@@ -1529,25 +1526,17 @@ xfs_qm_dqflock_pushbuf_wait(
          * the flush lock when the I/O completes.
          */
         bp = xfs_incore(dqp->q_mount->m_ddev_targp, dqp->q_blkno,
-                    XFS_QI_DQCHUNKLEN(dqp->q_mount),
-                    XFS_INCORE_TRYLOCK);
-        if (bp != NULL) {
-                if (XFS_BUF_ISDELAYWRITE(bp)) {
-                        int     error;
-                        if (XFS_BUF_ISPINNED(bp)) {
-                                xfs_log_force(dqp->q_mount,
-                                              (xfs_lsn_t)0,
-                                              XFS_LOG_FORCE);
-                        }
-                        error = xfs_bawrite(dqp->q_mount, bp);
-                        if (error)
-                                xfs_fs_cmn_err(CE_WARN, dqp->q_mount,
-                                        "xfs_qm_dqflock_pushbuf_wait: "
-                                        "pushbuf error %d on dqp %p, bp %p",
-                                        error, dqp, bp);
-                } else {
-                        xfs_buf_relse(bp);
-                }
+                    XFS_QI_DQCHUNKLEN(dqp->q_mount), XBF_TRYLOCK);
+        if (!bp)
+                goto out_lock;
+
+        if (XFS_BUF_ISDELAYWRITE(bp)) {
+                if (XFS_BUF_ISPINNED(bp))
+                        xfs_log_force(dqp->q_mount, 0);
+                xfs_buf_delwri_promote(bp);
+                wake_up_process(bp->b_target->bt_task);
         }
+        xfs_buf_relse(bp);
+out_lock:
         xfs_dqflock(dqp);
 }
diff --git a/fs/xfs/quota/xfs_dquot_item.c b/fs/xfs/quota/xfs_dquot_item.c
index d0d4a9a0bbd7..4e4ee9a57194 100644
--- a/fs/xfs/quota/xfs_dquot_item.c
+++ b/fs/xfs/quota/xfs_dquot_item.c
@@ -74,11 +74,11 @@ xfs_qm_dquot_logitem_format(
 
         logvec->i_addr = (xfs_caddr_t)&logitem->qli_format;
         logvec->i_len  = sizeof(xfs_dq_logformat_t);
-        XLOG_VEC_SET_TYPE(logvec, XLOG_REG_TYPE_QFORMAT);
+        logvec->i_type = XLOG_REG_TYPE_QFORMAT;
         logvec++;
         logvec->i_addr = (xfs_caddr_t)&logitem->qli_dquot->q_core;
         logvec->i_len  = sizeof(xfs_disk_dquot_t);
-        XLOG_VEC_SET_TYPE(logvec, XLOG_REG_TYPE_DQUOT);
+        logvec->i_type = XLOG_REG_TYPE_DQUOT;
 
         ASSERT(2 == logitem->qli_item.li_desc->lid_size);
         logitem->qli_format.qlf_size = 2;
@@ -153,7 +153,7 @@ xfs_qm_dquot_logitem_push(
          * lock without sleeping, then there must not have been
          * anyone in the process of flushing the dquot.
          */
-        error = xfs_qm_dqflush(dqp, XFS_QMOPT_DELWRI);
+        error = xfs_qm_dqflush(dqp, 0);
         if (error)
                 xfs_fs_cmn_err(CE_WARN, dqp->q_mount,
                         "xfs_qm_dquot_logitem_push: push error %d on dqp %p",
@@ -190,7 +190,7 @@ xfs_qm_dqunpin_wait(
         /*
          * Give the log a push so we don't wait here too long.
          */
-        xfs_log_force(dqp->q_mount, (xfs_lsn_t)0, XFS_LOG_FORCE);
+        xfs_log_force(dqp->q_mount, 0);
         wait_event(dqp->q_pinwait, (atomic_read(&dqp->q_pincount) == 0));
 }
 
@@ -212,68 +212,31 @@ xfs_qm_dquot_logitem_pushbuf(
         xfs_dquot_t     *dqp;
         xfs_mount_t     *mp;
         xfs_buf_t       *bp;
-        uint            dopush;
 
         dqp = qip->qli_dquot;
         ASSERT(XFS_DQ_IS_LOCKED(dqp));
 
         /*
-         * The qli_pushbuf_flag keeps others from
-         * trying to duplicate our effort.
-         */
-        ASSERT(qip->qli_pushbuf_flag != 0);
-        ASSERT(qip->qli_push_owner == current_pid());
-
-        /*
          * If flushlock isn't locked anymore, chances are that the
          * inode flush completed and the inode was taken off the AIL.
          * So, just get out.
          */
         if (completion_done(&dqp->q_flush)  ||
             ((qip->qli_item.li_flags & XFS_LI_IN_AIL) == 0)) {
-                qip->qli_pushbuf_flag = 0;
                 xfs_dqunlock(dqp);
                 return;
         }
         mp = dqp->q_mount;
         bp = xfs_incore(mp->m_ddev_targp, qip->qli_format.qlf_blkno,
-                    XFS_QI_DQCHUNKLEN(mp),
-                    XFS_INCORE_TRYLOCK);
-        if (bp != NULL) {
-                if (XFS_BUF_ISDELAYWRITE(bp)) {
-                        dopush = ((qip->qli_item.li_flags & XFS_LI_IN_AIL) &&
-                                  !completion_done(&dqp->q_flush));
-                        qip->qli_pushbuf_flag = 0;
-                        xfs_dqunlock(dqp);
-
-                        if (XFS_BUF_ISPINNED(bp)) {
-                                xfs_log_force(mp, (xfs_lsn_t)0,
-                                              XFS_LOG_FORCE);
-                        }
-                        if (dopush) {
-                                int     error;
-#ifdef XFSRACEDEBUG
-                                delay_for_intr();
-                                delay(300);
-#endif
-                                error = xfs_bawrite(mp, bp);
-                                if (error)
-                                        xfs_fs_cmn_err(CE_WARN, mp,
-        "xfs_qm_dquot_logitem_pushbuf: pushbuf error %d on qip %p, bp %p",
-                                                        error, qip, bp);
-                        } else {
-                                xfs_buf_relse(bp);
-                        }
-                } else {
-                        qip->qli_pushbuf_flag = 0;
-                        xfs_dqunlock(dqp);
-                        xfs_buf_relse(bp);
-                }
+                    XFS_QI_DQCHUNKLEN(mp), XBF_TRYLOCK);
+        xfs_dqunlock(dqp);
+        if (!bp)
                 return;
-        }
+        if (XFS_BUF_ISDELAYWRITE(bp))
+                xfs_buf_delwri_promote(bp);
+        xfs_buf_relse(bp);
+        return;
 
-        qip->qli_pushbuf_flag = 0;
-        xfs_dqunlock(dqp);
 }
 
 /*
@@ -291,50 +254,24 @@ xfs_qm_dquot_logitem_trylock(
         xfs_dq_logitem_t        *qip)
 {
         xfs_dquot_t             *dqp;
-        uint                    retval;
 
         dqp = qip->qli_dquot;
         if (atomic_read(&dqp->q_pincount) > 0)
-                return (XFS_ITEM_PINNED);
+                return XFS_ITEM_PINNED;
 
         if (! xfs_qm_dqlock_nowait(dqp))
-                return (XFS_ITEM_LOCKED);
+                return XFS_ITEM_LOCKED;
 
-        retval = XFS_ITEM_SUCCESS;
         if (!xfs_dqflock_nowait(dqp)) {
                 /*
-                 * The dquot is already being flushed.  It may have been
-                 * flushed delayed write, however, and we don't want to
-                 * get stuck waiting for that to complete.  So, we want to check
-                 * to see if we can lock the dquot's buffer without sleeping.
-                 * If we can and it is marked for delayed write, then we
-                 * hold it and send it out from the push routine.  We don't
-                 * want to do that now since we might sleep in the device
-                 * strategy routine.  We also don't want to grab the buffer lock
-                 * here because we'd like not to call into the buffer cache
-                 * while holding the AIL lock.
-                 * Make sure to only return PUSHBUF if we set pushbuf_flag
-                 * ourselves.  If someone else is doing it then we don't
-                 * want to go to the push routine and duplicate their efforts.
+                 * dquot has already been flushed to the backing buffer,
+                 * leave it locked, pushbuf routine will unlock it.
                  */
-                if (qip->qli_pushbuf_flag == 0) {
-                        qip->qli_pushbuf_flag = 1;
-                        ASSERT(qip->qli_format.qlf_blkno == dqp->q_blkno);
-#ifdef DEBUG
-                        qip->qli_push_owner = current_pid();
-#endif
-                        /*
-                         * The dquot is left locked.
-                         */
-                        retval = XFS_ITEM_PUSHBUF;
-                } else {
-                        retval = XFS_ITEM_FLUSHING;
-                        xfs_dqunlock_nonotify(dqp);
-                }
+                return XFS_ITEM_PUSHBUF;
         }
 
         ASSERT(qip->qli_item.li_flags & XFS_LI_IN_AIL);
-        return (retval);
+        return XFS_ITEM_SUCCESS;
 }
 
 
@@ -467,7 +404,7 @@ xfs_qm_qoff_logitem_format(xfs_qoff_logitem_t	*qf,
 
         log_vector->i_addr = (xfs_caddr_t)&(qf->qql_format);
         log_vector->i_len = sizeof(xfs_qoff_logitem_t);
-        XLOG_VEC_SET_TYPE(log_vector, XLOG_REG_TYPE_QUOTAOFF);
+        log_vector->i_type = XLOG_REG_TYPE_QUOTAOFF;
         qf->qql_format.qf_size = 1;
 }
 
diff --git a/fs/xfs/quota/xfs_dquot_item.h b/fs/xfs/quota/xfs_dquot_item.h
index 5a632531f843..5acae2ada70b 100644
--- a/fs/xfs/quota/xfs_dquot_item.h
+++ b/fs/xfs/quota/xfs_dquot_item.h
@@ -27,10 +27,6 @@ typedef struct xfs_dq_logitem {
         xfs_log_item_t           qli_item;         /* common portion */
         struct xfs_dquot        *qli_dquot;        /* dquot ptr */
         xfs_lsn_t                qli_flush_lsn;    /* lsn at last flush */
-        unsigned short           qli_pushbuf_flag; /* 1 bit used in push_ail */
-#ifdef DEBUG
-        uint64_t                 qli_push_owner;
-#endif
         xfs_dq_logformat_t       qli_format;       /* logged structure */
 } xfs_dq_logitem_t;
 
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 9e627a8b5b0e..417e61e3d9dd 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -118,9 +118,14 @@ xfs_Gqm_init(void)
          */
         udqhash = kmem_zalloc_greedy(&hsize,
                                      XFS_QM_HASHSIZE_LOW * sizeof(xfs_dqhash_t),
-                                     XFS_QM_HASHSIZE_HIGH * sizeof(xfs_dqhash_t),
-                                     KM_SLEEP | KM_MAYFAIL | KM_LARGE);
-        gdqhash = kmem_zalloc(hsize, KM_SLEEP | KM_LARGE);
+                                     XFS_QM_HASHSIZE_HIGH * sizeof(xfs_dqhash_t));
+        if (!udqhash)
+                goto out;
+
+        gdqhash = kmem_zalloc_large(hsize);
+        if (!gdqhash)
+                goto out_free_udqhash;
+
         hsize /= sizeof(xfs_dqhash_t);
         ndquot = hsize << 8;
 
@@ -170,6 +175,11 @@ xfs_Gqm_init(void)
         mutex_init(&qcheck_lock);
 #endif
         return xqm;
+
+ out_free_udqhash:
+        kmem_free_large(udqhash);
+ out:
+        return NULL;
 }
 
 /*
@@ -189,8 +199,8 @@ xfs_qm_destroy(
                 xfs_qm_list_destroy(&(xqm->qm_usr_dqhtable[i]));
                 xfs_qm_list_destroy(&(xqm->qm_grp_dqhtable[i]));
         }
-        kmem_free(xqm->qm_usr_dqhtable);
-        kmem_free(xqm->qm_grp_dqhtable);
+        kmem_free_large(xqm->qm_usr_dqhtable);
+        kmem_free_large(xqm->qm_grp_dqhtable);
         xqm->qm_usr_dqhtable = NULL;
         xqm->qm_grp_dqhtable = NULL;
         xqm->qm_dqhashmask = 0;
@@ -219,8 +229,12 @@ xfs_qm_hold_quotafs_ref(
          */
         mutex_lock(&xfs_Gqm_lock);
 
-        if (xfs_Gqm == NULL)
+        if (!xfs_Gqm) {
                 xfs_Gqm = xfs_Gqm_init();
+                if (!xfs_Gqm)
+                        return ENOMEM;
+        }
+
         /*
          * We can keep a list of all filesystems with quotas mounted for
          * debugging and statistical purposes, but ...
@@ -436,7 +450,7 @@ xfs_qm_unmount_quotas(
 STATIC int
 xfs_qm_dqflush_all(
         xfs_mount_t     *mp,
-        int             flags)
+        int             sync_mode)
 {
         int             recl;
         xfs_dquot_t     *dqp;
@@ -472,7 +486,7 @@ again:
                  * across a disk write.
                  */
                 xfs_qm_mplist_unlock(mp);
-                error = xfs_qm_dqflush(dqp, flags);
+                error = xfs_qm_dqflush(dqp, sync_mode);
                 xfs_dqunlock(dqp);
                 if (error)
                         return error;
@@ -912,13 +926,11 @@ xfs_qm_sync(
 {
         int             recl, restarts;
         xfs_dquot_t     *dqp;
-        uint            flush_flags;
         int             error;
 
         if (!XFS_IS_QUOTA_RUNNING(mp) || !XFS_IS_QUOTA_ON(mp))
                 return 0;
 
-        flush_flags = (flags & SYNC_WAIT) ? XFS_QMOPT_SYNC : XFS_QMOPT_DELWRI;
         restarts = 0;
 
   again:
@@ -978,7 +990,7 @@ xfs_qm_sync(
                  * across a disk write
                  */
                 xfs_qm_mplist_unlock(mp);
-                error = xfs_qm_dqflush(dqp, flush_flags);
+                error = xfs_qm_dqflush(dqp, flags);
                 xfs_dqunlock(dqp);
                 if (error && XFS_FORCED_SHUTDOWN(mp))
                         return 0;       /* Need to prevent umount failure */
@@ -1782,7 +1794,7 @@ xfs_qm_quotacheck(
          * successfully.
          */
         if (!error)
-                error = xfs_qm_dqflush_all(mp, XFS_QMOPT_DELWRI);
+                error = xfs_qm_dqflush_all(mp, 0);
 
         /*
          * We can get this error if we couldn't do a dquot allocation inside
@@ -2004,7 +2016,7 @@ xfs_qm_shake_freelist(
                          * We flush it delayed write, so don't bother
                          * releasing the mplock.
                          */
-                        error = xfs_qm_dqflush(dqp, XFS_QMOPT_DELWRI);
+                        error = xfs_qm_dqflush(dqp, 0);
                         if (error) {
                                 xfs_fs_cmn_err(CE_WARN, dqp->q_mount,
                         "xfs_qm_dqflush_all: dquot %p flush failed", dqp);
@@ -2187,7 +2199,7 @@ xfs_qm_dqreclaim_one(void)
                          * We flush it delayed write, so don't bother
                          * releasing the freelist lock.
                          */
-                        error = xfs_qm_dqflush(dqp, XFS_QMOPT_DELWRI);
+                        error = xfs_qm_dqflush(dqp, 0);
                         if (error) {
                                 xfs_fs_cmn_err(CE_WARN, dqp->q_mount,
                         "xfs_qm_dqreclaim: dquot %p flush failed", dqp);
diff --git a/fs/xfs/quota/xfs_qm_bhv.c b/fs/xfs/quota/xfs_qm_bhv.c
index a5346630dfae..97b410c12794 100644
--- a/fs/xfs/quota/xfs_qm_bhv.c
+++ b/fs/xfs/quota/xfs_qm_bhv.c
@@ -59,7 +59,7 @@ xfs_fill_statvfs_from_dquot(
                 be64_to_cpu(dp->d_blk_hardlimit);
         if (limit && statp->f_blocks > limit) {
                 statp->f_blocks = limit;
-                statp->f_bfree =
+                statp->f_bfree = statp->f_bavail =
                         (statp->f_blocks > be64_to_cpu(dp->d_bcount)) ?
                          (statp->f_blocks - be64_to_cpu(dp->d_bcount)) : 0;
         }
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 71af76fe8a23..5d0ee8d492db 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -891,7 +891,7 @@ xfs_qm_dqrele_all_inodes(
         uint             flags)
 {
         ASSERT(mp->m_quotainfo);
-        xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, XFS_ICI_NO_TAG);
+        xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, XFS_ICI_NO_TAG, 0);
 }
 
 /*------------------------------------------------------------------------*/
@@ -1192,9 +1192,9 @@ xfs_qm_internalqcheck(
         if (! XFS_IS_QUOTA_ON(mp))
                 return XFS_ERROR(ESRCH);
 
-        xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE | XFS_LOG_SYNC);
+        xfs_log_force(mp, XFS_LOG_SYNC);
         XFS_bflush(mp->m_ddev_targp);
-        xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE | XFS_LOG_SYNC);
+        xfs_log_force(mp, XFS_LOG_SYNC);
         XFS_bflush(mp->m_ddev_targp);
 
         mutex_lock(&qcheck_lock);
diff --git a/fs/xfs/quota/xfs_trans_dquot.c b/fs/xfs/quota/xfs_trans_dquot.c
index 97ac9640be98..c3ab75cb1d9a 100644
--- a/fs/xfs/quota/xfs_trans_dquot.c
+++ b/fs/xfs/quota/xfs_trans_dquot.c
@@ -589,12 +589,18 @@ xfs_trans_unreserve_and_mod_dquots(
         }
 }
 
-STATIC int
-xfs_quota_error(uint flags)
+STATIC void
+xfs_quota_warn(
+        struct xfs_mount        *mp,
+        struct xfs_dquot        *dqp,
+        int                     type)
 {
-        if (flags & XFS_QMOPT_ENOSPC)
-                return ENOSPC;
-        return EDQUOT;
+        /* no warnings for project quotas - we just return ENOSPC later */
+        if (dqp->dq_flags & XFS_DQ_PROJ)
+                return;
+        quota_send_warning((dqp->dq_flags & XFS_DQ_USER) ? USRQUOTA : GRPQUOTA,
+                           be32_to_cpu(dqp->q_core.d_id), mp->m_super->s_dev,
+                           type);
 }
 
 /*
@@ -612,7 +618,6 @@ xfs_trans_dqresv(
         long            ninos,
         uint            flags)
 {
-        int             error;
         xfs_qcnt_t      hardlimit;
         xfs_qcnt_t      softlimit;
         time_t          timer;
@@ -649,7 +654,6 @@ xfs_trans_dqresv(
                 warnlimit = XFS_QI_RTBWARNLIMIT(dqp->q_mount);
                 resbcountp = &dqp->q_res_rtbcount;
         }
-        error = 0;
 
         if ((flags & XFS_QMOPT_FORCE_RES) == 0 &&
             dqp->q_core.d_id &&
@@ -667,18 +671,20 @@ xfs_trans_dqresv(
                          * nblks.
                          */
                         if (hardlimit > 0ULL &&
-                             (hardlimit <= nblks + *resbcountp)) {
-                                error = xfs_quota_error(flags);
+                            hardlimit <= nblks + *resbcountp) {
+                                xfs_quota_warn(mp, dqp, QUOTA_NL_BHARDWARN);
                                 goto error_return;
                         }
-
                         if (softlimit > 0ULL &&
-                             (softlimit <= nblks + *resbcountp)) {
+                            softlimit <= nblks + *resbcountp) {
                                 if ((timer != 0 && get_seconds() > timer) ||
                                     (warns != 0 && warns >= warnlimit)) {
-                                        error = xfs_quota_error(flags);
+                                        xfs_quota_warn(mp, dqp,
+                                                       QUOTA_NL_BSOFTLONGWARN);
                                         goto error_return;
                                 }
+
+                                xfs_quota_warn(mp, dqp, QUOTA_NL_BSOFTWARN);
                         }
                 }
                 if (ninos > 0) {
@@ -692,15 +698,19 @@ xfs_trans_dqresv(
                         softlimit = be64_to_cpu(dqp->q_core.d_ino_softlimit);
                         if (!softlimit)
                                 softlimit = q->qi_isoftlimit;
+
                         if (hardlimit > 0ULL && count >= hardlimit) {
-                                error = xfs_quota_error(flags);
+                                xfs_quota_warn(mp, dqp, QUOTA_NL_IHARDWARN);
                                 goto error_return;
-                        } else if (softlimit > 0ULL && count >= softlimit) {
-                                if ((timer != 0 && get_seconds() > timer) ||
+                        }
+                        if (softlimit > 0ULL && count >= softlimit) {
+                                if  ((timer != 0 && get_seconds() > timer) ||
                                      (warns != 0 && warns >= warnlimit)) {
-                                        error = xfs_quota_error(flags);
+                                        xfs_quota_warn(mp, dqp,
+                                                       QUOTA_NL_ISOFTLONGWARN);
                                         goto error_return;
                                 }
+                                xfs_quota_warn(mp, dqp, QUOTA_NL_ISOFTWARN);
                         }
                 }
         }
@@ -736,9 +746,14 @@ xfs_trans_dqresv(
         ASSERT(dqp->q_res_rtbcount >= be64_to_cpu(dqp->q_core.d_rtbcount));
         ASSERT(dqp->q_res_icount >= be64_to_cpu(dqp->q_core.d_icount));
 
+        xfs_dqunlock(dqp);
+        return 0;
+
 error_return:
         xfs_dqunlock(dqp);
-        return error;
+        if (flags & XFS_QMOPT_ENOSPC)
+                return ENOSPC;
+        return EDQUOT;
 }
 
 
diff --git a/fs/xfs/xfs_acl.h b/fs/xfs/xfs_acl.h
index 00fd357c3e46..d13eeba2c8f8 100644
--- a/fs/xfs/xfs_acl.h
+++ b/fs/xfs/xfs_acl.h
@@ -36,8 +36,8 @@ struct xfs_acl {
 };
 
 /* On-disk XFS extended attribute names */
-#define SGI_ACL_FILE            "SGI_ACL_FILE"
-#define SGI_ACL_DEFAULT         "SGI_ACL_DEFAULT"
+#define SGI_ACL_FILE            (unsigned char *)"SGI_ACL_FILE"
+#define SGI_ACL_DEFAULT         (unsigned char *)"SGI_ACL_DEFAULT"
 #define SGI_ACL_FILE_SIZE       (sizeof(SGI_ACL_FILE)-1)
 #define SGI_ACL_DEFAULT_SIZE    (sizeof(SGI_ACL_DEFAULT)-1)
 
diff --git a/fs/xfs/xfs_ag.h b/fs/xfs/xfs_ag.h
index 6702bd865811..b1a5a1ff88ea 100644
--- a/fs/xfs/xfs_ag.h
+++ b/fs/xfs/xfs_ag.h
@@ -187,17 +187,13 @@ typedef struct xfs_perag_busy {
 /*
  * Per-ag incore structure, copies of information in agf and agi,
  * to improve the performance of allocation group selection.
- *
- * pick sizes which fit in allocation buckets well
  */
-#if (BITS_PER_LONG == 32)
-#define XFS_PAGB_NUM_SLOTS      84
-#elif (BITS_PER_LONG == 64)
 #define XFS_PAGB_NUM_SLOTS      128
-#endif
 
-typedef struct xfs_perag
-{
+typedef struct xfs_perag {
+        struct xfs_mount *pag_mount;    /* owner filesystem */
+        xfs_agnumber_t  pag_agno;       /* AG this structure belongs to */
+        atomic_t        pag_ref;        /* perag reference count */
         char            pagf_init;      /* this agf's entry is initialized */
         char            pagi_init;      /* this agi's entry is initialized */
         char            pagf_metadata;  /* the agf is preferred to be metadata */
@@ -210,8 +206,6 @@ typedef struct xfs_perag
         __uint32_t      pagf_btreeblks; /* # of blocks held in AGF btrees */
         xfs_agino_t     pagi_freecount; /* number of free inodes */
         xfs_agino_t     pagi_count;     /* number of allocated inodes */
-        int             pagb_count;     /* pagb slots in use */
-        xfs_perag_busy_t *pagb_list;    /* unstable blocks */
 
         /*
          * Inode allocation search lookup optimisation.
@@ -230,6 +224,8 @@ typedef struct xfs_perag
         rwlock_t        pag_ici_lock;   /* incore inode lock */
         struct radix_tree_root pag_ici_root;    /* incore inode cache root */
 #endif
+        int             pagb_count;     /* pagb slots in use */
+        xfs_perag_busy_t pagb_list[XFS_PAGB_NUM_SLOTS]; /* unstable blocks */
 } xfs_perag_t;
 
 /*
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index a1c65fc6d9c4..94cddbfb2560 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1662,11 +1662,13 @@ xfs_free_ag_extent(
                 xfs_agf_t       *agf;
                 xfs_perag_t     *pag;           /* per allocation group data */
 
+                pag = xfs_perag_get(mp, agno);
+                pag->pagf_freeblks += len;
+                xfs_perag_put(pag);
+
                 agf = XFS_BUF_TO_AGF(agbp);
-                pag = &mp->m_perag[agno];
                 be32_add_cpu(&agf->agf_freeblks, len);
                 xfs_trans_agblocks_delta(tp, len);
-                pag->pagf_freeblks += len;
                 XFS_WANT_CORRUPTED_GOTO(
                         be32_to_cpu(agf->agf_freeblks) <=
                         be32_to_cpu(agf->agf_length),
@@ -1969,10 +1971,12 @@ xfs_alloc_get_freelist(
         xfs_trans_brelse(tp, agflbp);
         if (be32_to_cpu(agf->agf_flfirst) == XFS_AGFL_SIZE(mp))
                 agf->agf_flfirst = 0;
-        pag = &mp->m_perag[be32_to_cpu(agf->agf_seqno)];
+
+        pag = xfs_perag_get(mp, be32_to_cpu(agf->agf_seqno));
         be32_add_cpu(&agf->agf_flcount, -1);
         xfs_trans_agflist_delta(tp, -1);
         pag->pagf_flcount--;
+        xfs_perag_put(pag);
 
         logflags = XFS_AGF_FLFIRST | XFS_AGF_FLCOUNT;
         if (btreeblk) {
@@ -2078,7 +2082,8 @@ xfs_alloc_put_freelist(
         be32_add_cpu(&agf->agf_fllast, 1);
         if (be32_to_cpu(agf->agf_fllast) == XFS_AGFL_SIZE(mp))
                 agf->agf_fllast = 0;
-        pag = &mp->m_perag[be32_to_cpu(agf->agf_seqno)];
+
+        pag = xfs_perag_get(mp, be32_to_cpu(agf->agf_seqno));
         be32_add_cpu(&agf->agf_flcount, 1);
         xfs_trans_agflist_delta(tp, 1);
         pag->pagf_flcount++;
@@ -2089,6 +2094,7 @@ xfs_alloc_put_freelist(
                 pag->pagf_btreeblks--;
                 logflags |= XFS_AGF_BTREEBLKS;
         }
+        xfs_perag_put(pag);
 
         xfs_alloc_log_agf(tp, agbp, logflags);
 
@@ -2152,7 +2158,6 @@ xfs_read_agf(
                 xfs_trans_brelse(tp, *bpp);
                 return XFS_ERROR(EFSCORRUPTED);
         }
-
         XFS_BUF_SET_VTYPE_REF(*bpp, B_FS_AGF, XFS_AGF_REF);
         return 0;
 }
@@ -2175,7 +2180,7 @@ xfs_alloc_read_agf(
         ASSERT(agno != NULLAGNUMBER);
 
         error = xfs_read_agf(mp, tp, agno,
-                        (flags & XFS_ALLOC_FLAG_TRYLOCK) ? XFS_BUF_TRYLOCK : 0,
+                        (flags & XFS_ALLOC_FLAG_TRYLOCK) ? XBF_TRYLOCK : 0,
                         bpp);
         if (error)
                 return error;
@@ -2184,7 +2189,7 @@ xfs_alloc_read_agf(
         ASSERT(!XFS_BUF_GETERROR(*bpp));
 
         agf = XFS_BUF_TO_AGF(*bpp);
-        pag = &mp->m_perag[agno];
+        pag = xfs_perag_get(mp, agno);
         if (!pag->pagf_init) {
                 pag->pagf_freeblks = be32_to_cpu(agf->agf_freeblks);
                 pag->pagf_btreeblks = be32_to_cpu(agf->agf_btreeblks);
@@ -2195,8 +2200,8 @@ xfs_alloc_read_agf(
                 pag->pagf_levels[XFS_BTNUM_CNTi] =
                         be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNTi]);
                 spin_lock_init(&pag->pagb_lock);
-                pag->pagb_list = kmem_zalloc(XFS_PAGB_NUM_SLOTS *
-                                        sizeof(xfs_perag_busy_t), KM_SLEEP);
+                pag->pagb_count = 0;
+                memset(pag->pagb_list, 0, sizeof(pag->pagb_list));
                 pag->pagf_init = 1;
         }
 #ifdef DEBUG
@@ -2211,6 +2216,7 @@ xfs_alloc_read_agf(
                        be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNTi]));
         }
 #endif
+        xfs_perag_put(pag);
         return 0;
 }
 
@@ -2270,8 +2276,7 @@ xfs_alloc_vextent(
                  * These three force us into a single a.g.
                  */
                 args->agno = XFS_FSB_TO_AGNO(mp, args->fsbno);
-                down_read(&mp->m_peraglock);
-                args->pag = &mp->m_perag[args->agno];
+                args->pag = xfs_perag_get(mp, args->agno);
                 args->minleft = 0;
                 error = xfs_alloc_fix_freelist(args, 0);
                 args->minleft = minleft;
@@ -2280,14 +2285,12 @@ xfs_alloc_vextent(
                         goto error0;
                 }
                 if (!args->agbp) {
-                        up_read(&mp->m_peraglock);
                         trace_xfs_alloc_vextent_noagbp(args);
                         break;
                 }
                 args->agbno = XFS_FSB_TO_AGBNO(mp, args->fsbno);
                 if ((error = xfs_alloc_ag_vextent(args)))
                         goto error0;
-                up_read(&mp->m_peraglock);
                 break;
         case XFS_ALLOCTYPE_START_BNO:
                 /*
@@ -2339,9 +2342,8 @@ xfs_alloc_vextent(
                  * Loop over allocation groups twice; first time with
                  * trylock set, second time without.
                  */
-                down_read(&mp->m_peraglock);
                 for (;;) {
-                        args->pag = &mp->m_perag[args->agno];
+                        args->pag = xfs_perag_get(mp, args->agno);
                         if (no_min) args->minleft = 0;
                         error = xfs_alloc_fix_freelist(args, flags);
                         args->minleft = minleft;
@@ -2400,8 +2402,8 @@ xfs_alloc_vextent(
                                         }
                                 }
                         }
+                        xfs_perag_put(args->pag);
                 }
-                up_read(&mp->m_peraglock);
                 if (bump_rotor || (type == XFS_ALLOCTYPE_ANY_AG)) {
                         if (args->agno == sagno)
                                 mp->m_agfrotor = (mp->m_agfrotor + 1) %
@@ -2427,9 +2429,10 @@ xfs_alloc_vextent(
                         args->len);
 #endif
         }
+        xfs_perag_put(args->pag);
         return 0;
 error0:
-        up_read(&mp->m_peraglock);
+        xfs_perag_put(args->pag);
         return error;
 }
 
@@ -2454,8 +2457,7 @@ xfs_free_extent(
         args.agno = XFS_FSB_TO_AGNO(args.mp, bno);
         ASSERT(args.agno < args.mp->m_sb.sb_agcount);
         args.agbno = XFS_FSB_TO_AGBNO(args.mp, bno);
-        down_read(&args.mp->m_peraglock);
-        args.pag = &args.mp->m_perag[args.agno];
+        args.pag = xfs_perag_get(args.mp, args.agno);
         if ((error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING)))
                 goto error0;
 #ifdef DEBUG
@@ -2465,7 +2467,7 @@ xfs_free_extent(
 #endif
         error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno, len, 0);
 error0:
-        up_read(&args.mp->m_peraglock);
+        xfs_perag_put(args.pag);
         return error;
 }
 
@@ -2486,15 +2488,15 @@ xfs_alloc_mark_busy(xfs_trans_t *tp,
                     xfs_agblock_t bno,
                     xfs_extlen_t len)
 {
-        xfs_mount_t             *mp;
         xfs_perag_busy_t        *bsy;
+        struct xfs_perag        *pag;
         int                     n;
 
-        mp = tp->t_mountp;
-        spin_lock(&mp->m_perag[agno].pagb_lock);
+        pag = xfs_perag_get(tp->t_mountp, agno);
+        spin_lock(&pag->pagb_lock);
 
         /* search pagb_list for an open slot */
-        for (bsy = mp->m_perag[agno].pagb_list, n = 0;
+        for (bsy = pag->pagb_list, n = 0;
              n < XFS_PAGB_NUM_SLOTS;
              bsy++, n++) {
                 if (bsy->busy_tp == NULL) {
@@ -2502,11 +2504,11 @@ xfs_alloc_mark_busy(xfs_trans_t *tp,
                 }
         }
 
-        trace_xfs_alloc_busy(mp, agno, bno, len, n);
+        trace_xfs_alloc_busy(tp->t_mountp, agno, bno, len, n);
 
         if (n < XFS_PAGB_NUM_SLOTS) {
-                bsy = &mp->m_perag[agno].pagb_list[n];
-                mp->m_perag[agno].pagb_count++;
+                bsy = &pag->pagb_list[n];
+                pag->pagb_count++;
                 bsy->busy_start = bno;
                 bsy->busy_length = len;
                 bsy->busy_tp = tp;
@@ -2521,7 +2523,8 @@ xfs_alloc_mark_busy(xfs_trans_t *tp,
                 xfs_trans_set_sync(tp);
         }
 
-        spin_unlock(&mp->m_perag[agno].pagb_lock);
+        spin_unlock(&pag->pagb_lock);
+        xfs_perag_put(pag);
 }
 
 void
@@ -2529,24 +2532,23 @@ xfs_alloc_clear_busy(xfs_trans_t *tp,
                      xfs_agnumber_t agno,
                      int idx)
 {
-        xfs_mount_t             *mp;
+        struct xfs_perag        *pag;
         xfs_perag_busy_t        *list;
 
-        mp = tp->t_mountp;
-
-        spin_lock(&mp->m_perag[agno].pagb_lock);
-        list = mp->m_perag[agno].pagb_list;
-
         ASSERT(idx < XFS_PAGB_NUM_SLOTS);
+        pag = xfs_perag_get(tp->t_mountp, agno);
+        spin_lock(&pag->pagb_lock);
+        list = pag->pagb_list;
 
-        trace_xfs_alloc_unbusy(mp, agno, idx, list[idx].busy_tp == tp);
+        trace_xfs_alloc_unbusy(tp->t_mountp, agno, idx, list[idx].busy_tp == tp);
 
         if (list[idx].busy_tp == tp) {
                 list[idx].busy_tp = NULL;
-                mp->m_perag[agno].pagb_count--;
+                pag->pagb_count--;
         }
 
-        spin_unlock(&mp->m_perag[agno].pagb_lock);
+        spin_unlock(&pag->pagb_lock);
+        xfs_perag_put(pag);
 }
 
 
@@ -2560,46 +2562,44 @@ xfs_alloc_search_busy(xfs_trans_t *tp,
                     xfs_agblock_t bno,
                     xfs_extlen_t len)
 {
-        xfs_mount_t             *mp;
+        struct xfs_perag        *pag;
         xfs_perag_busy_t        *bsy;
         xfs_agblock_t           uend, bend;
-        xfs_lsn_t               lsn;
+        xfs_lsn_t               lsn = 0;
         int                     cnt;
 
-        mp = tp->t_mountp;
-
-        spin_lock(&mp->m_perag[agno].pagb_lock);
-        cnt = mp->m_perag[agno].pagb_count;
+        pag = xfs_perag_get(tp->t_mountp, agno);
+        spin_lock(&pag->pagb_lock);
+        cnt = pag->pagb_count;
 
+        /*
+         * search pagb_list for this slot, skipping open slots. We have to
+         * search the entire array as there may be multiple overlaps and
+         * we have to get the most recent LSN for the log force to push out
+         * all the transactions that span the range.
+         */
         uend = bno + len - 1;
-
-        /* search pagb_list for this slot, skipping open slots */
-        for (bsy = mp->m_perag[agno].pagb_list; cnt; bsy++) {
-
-                /*
-                 * (start1,length1) within (start2, length2)
-                 */
-                if (bsy->busy_tp != NULL) {
-                        bend = bsy->busy_start + bsy->busy_length - 1;
-                        if ((bno > bend) || (uend < bsy->busy_start)) {
-                                cnt--;
-                        } else {
-                                break;
-                        }
-                }
+        for (cnt = 0; cnt < pag->pagb_count; cnt++) {
+                bsy = &pag->pagb_list[cnt];
+                if (!bsy->busy_tp)
+                        continue;
+
+                bend = bsy->busy_start + bsy->busy_length - 1;
+                if (bno > bend || uend < bsy->busy_start)
+                        continue;
+
+                /* (start1,length1) within (start2, length2) */
+                if (XFS_LSN_CMP(bsy->busy_tp->t_commit_lsn, lsn) > 0)
+                        lsn = bsy->busy_tp->t_commit_lsn;
         }
-
-        trace_xfs_alloc_busysearch(mp, agno, bno, len, !!cnt);
+        spin_unlock(&pag->pagb_lock);
+        xfs_perag_put(pag);
+        trace_xfs_alloc_busysearch(tp->t_mountp, agno, bno, len, lsn);
 
         /*
          * If a block was found, force the log through the LSN of the
          * transaction that freed the block
          */
-        if (cnt) {
-                lsn = bsy->busy_tp->t_commit_lsn;
-                spin_unlock(&mp->m_perag[agno].pagb_lock);
-                xfs_log_force(mp, lsn, XFS_LOG_FORCE|XFS_LOG_SYNC);
-        } else {
-                spin_unlock(&mp->m_perag[agno].pagb_lock);
-        }
+        if (lsn)
+                xfs_log_force_lsn(tp->t_mountp, lsn, XFS_LOG_SYNC);
 }
diff --git a/fs/xfs/xfs_alloc_btree.c b/fs/xfs/xfs_alloc_btree.c
index adbd9141aea1..b726e10d2c1c 100644
--- a/fs/xfs/xfs_alloc_btree.c
+++ b/fs/xfs/xfs_alloc_btree.c
@@ -61,12 +61,14 @@ xfs_allocbt_set_root(
         struct xfs_agf          *agf = XFS_BUF_TO_AGF(agbp);
         xfs_agnumber_t          seqno = be32_to_cpu(agf->agf_seqno);
         int                     btnum = cur->bc_btnum;
+        struct xfs_perag        *pag = xfs_perag_get(cur->bc_mp, seqno);
 
         ASSERT(ptr->s != 0);
 
         agf->agf_roots[btnum] = ptr->s;
         be32_add_cpu(&agf->agf_levels[btnum], inc);
-        cur->bc_mp->m_perag[seqno].pagf_levels[btnum] += inc;
+        pag->pagf_levels[btnum] += inc;
+        xfs_perag_put(pag);
 
         xfs_alloc_log_agf(cur->bc_tp, agbp, XFS_AGF_ROOTS | XFS_AGF_LEVELS);
 }
@@ -150,6 +152,7 @@ xfs_allocbt_update_lastrec(
 {
         struct xfs_agf          *agf = XFS_BUF_TO_AGF(cur->bc_private.a.agbp);
         xfs_agnumber_t          seqno = be32_to_cpu(agf->agf_seqno);
+        struct xfs_perag        *pag;
         __be32                  len;
         int                     numrecs;
 
@@ -193,7 +196,9 @@ xfs_allocbt_update_lastrec(
         }
 
         agf->agf_longest = len;
-        cur->bc_mp->m_perag[seqno].pagf_longest = be32_to_cpu(len);
+        pag = xfs_perag_get(cur->bc_mp, seqno);
+        pag->pagf_longest = be32_to_cpu(len);
+        xfs_perag_put(pag);
         xfs_alloc_log_agf(cur->bc_tp, cur->bc_private.a.agbp, XFS_AGF_LONGEST);
 }
 
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index e953b6cfb2a8..b9c196a53c42 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -93,12 +93,12 @@ STATIC int xfs_attr_rmtval_remove(xfs_da_args_t *args);
 STATIC int
 xfs_attr_name_to_xname(
         struct xfs_name *xname,
-        const char      *aname)
+        const unsigned char *aname)
 {
         if (!aname)
                 return EINVAL;
         xname->name = aname;
-        xname->len = strlen(aname);
+        xname->len = strlen((char *)aname);
         if (xname->len >= MAXNAMELEN)
                 return EFAULT;          /* match IRIX behaviour */
 
@@ -124,7 +124,7 @@ STATIC int
 xfs_attr_get_int(
         struct xfs_inode        *ip,
         struct xfs_name         *name,
-        char                    *value,
+        unsigned char           *value,
         int                     *valuelenp,
         int                     flags)
 {
@@ -171,8 +171,8 @@ xfs_attr_get_int(
 int
 xfs_attr_get(
         xfs_inode_t     *ip,
-        const char      *name,
-        char            *value,
+        const unsigned char *name,
+        unsigned char   *value,
         int             *valuelenp,
         int             flags)
 {
@@ -197,7 +197,7 @@ xfs_attr_get(
 /*
  * Calculate how many blocks we need for the new attribute,
  */
-int
+STATIC int
 xfs_attr_calc_size(
         struct xfs_inode        *ip,
         int                     namelen,
@@ -235,8 +235,12 @@ xfs_attr_calc_size(
 }
 
 STATIC int
-xfs_attr_set_int(xfs_inode_t *dp, struct xfs_name *name,
-                char *value, int valuelen, int flags)
+xfs_attr_set_int(
+        struct xfs_inode *dp,
+        struct xfs_name *name,
+        unsigned char   *value,
+        int             valuelen,
+        int             flags)
 {
         xfs_da_args_t   args;
         xfs_fsblock_t   firstblock;
@@ -452,8 +456,8 @@ out:
 int
 xfs_attr_set(
         xfs_inode_t     *dp,
-        const char      *name,
-        char            *value,
+        const unsigned char *name,
+        unsigned char   *value,
         int             valuelen,
         int             flags)
 {
@@ -600,7 +604,7 @@ out:
 int
 xfs_attr_remove(
         xfs_inode_t     *dp,
-        const char      *name,
+        const unsigned char *name,
         int             flags)
 {
         int             error;
@@ -669,9 +673,13 @@ xfs_attr_list_int(xfs_attr_list_context_t *context)
  */
 /*ARGSUSED*/
 STATIC int
-xfs_attr_put_listent(xfs_attr_list_context_t *context, int flags,
-                     char *name, int namelen,
-                     int valuelen, char *value)
+xfs_attr_put_listent(
+        xfs_attr_list_context_t *context,
+        int             flags,
+        unsigned char   *name,
+        int             namelen,
+        int             valuelen,
+        unsigned char   *value)
 {
         struct attrlist *alist = (struct attrlist *)context->alist;
         attrlist_ent_t *aep;
@@ -1980,7 +1988,7 @@ xfs_attr_rmtval_get(xfs_da_args_t *args)
         xfs_bmbt_irec_t map[ATTR_RMTVALUE_MAPSIZE];
         xfs_mount_t *mp;
         xfs_daddr_t dblkno;
-        xfs_caddr_t dst;
+        void *dst;
         xfs_buf_t *bp;
         int nmap, error, tmp, valuelen, blkcnt, i;
         xfs_dablk_t lblkno;
@@ -2007,15 +2015,14 @@ xfs_attr_rmtval_get(xfs_da_args_t *args)
                         dblkno = XFS_FSB_TO_DADDR(mp, map[i].br_startblock);
                         blkcnt = XFS_FSB_TO_BB(mp, map[i].br_blockcount);
                         error = xfs_read_buf(mp, mp->m_ddev_targp, dblkno,
-                                             blkcnt,
-                                             XFS_BUF_LOCK | XBF_DONT_BLOCK,
+                                             blkcnt, XBF_LOCK | XBF_DONT_BLOCK,
                                              &bp);
                         if (error)
                                 return(error);
 
                         tmp = (valuelen < XFS_BUF_SIZE(bp))
                                 ? valuelen : XFS_BUF_SIZE(bp);
-                        xfs_biomove(bp, 0, tmp, dst, XFS_B_READ);
+                        xfs_biomove(bp, 0, tmp, dst, XBF_READ);
                         xfs_buf_relse(bp);
                         dst += tmp;
                         valuelen -= tmp;
@@ -2039,7 +2046,7 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
         xfs_inode_t *dp;
         xfs_bmbt_irec_t map;
         xfs_daddr_t dblkno;
-        xfs_caddr_t src;
+        void *src;
         xfs_buf_t *bp;
         xfs_dablk_t lblkno;
         int blkcnt, valuelen, nmap, error, tmp, committed;
@@ -2141,13 +2148,13 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
                 blkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
 
                 bp = xfs_buf_get(mp->m_ddev_targp, dblkno, blkcnt,
-                                 XFS_BUF_LOCK | XBF_DONT_BLOCK);
+                                 XBF_LOCK | XBF_DONT_BLOCK);
                 ASSERT(bp);
                 ASSERT(!XFS_BUF_GETERROR(bp));
 
                 tmp = (valuelen < XFS_BUF_SIZE(bp)) ? valuelen :
                                                         XFS_BUF_SIZE(bp);
-                xfs_biomove(bp, 0, tmp, src, XFS_B_WRITE);
+                xfs_biomove(bp, 0, tmp, src, XBF_WRITE);
                 if (tmp < XFS_BUF_SIZE(bp))
                         xfs_biozero(bp, tmp, XFS_BUF_SIZE(bp) - tmp);
                 if ((error = xfs_bwrite(mp, bp))) {/* GROT: NOTE: synchronous write */
@@ -2208,8 +2215,7 @@ xfs_attr_rmtval_remove(xfs_da_args_t *args)
                 /*
                  * If the "remote" value is in the cache, remove it.
                  */
-                bp = xfs_incore(mp->m_ddev_targp, dblkno, blkcnt,
-                                XFS_INCORE_TRYLOCK);
+                bp = xfs_incore(mp->m_ddev_targp, dblkno, blkcnt, XBF_TRYLOCK);
                 if (bp) {
                         XFS_BUF_STALE(bp);
                         XFS_BUF_UNDELAYWRITE(bp);
diff --git a/fs/xfs/xfs_attr.h b/fs/xfs/xfs_attr.h
index 59b410ce69a1..e920d68ef509 100644
--- a/fs/xfs/xfs_attr.h
+++ b/fs/xfs/xfs_attr.h
@@ -113,7 +113,7 @@ typedef struct attrlist_cursor_kern {
 
 
 typedef int (*put_listent_func_t)(struct xfs_attr_list_context *, int,
-                                      char *, int, int, char *);
+                              unsigned char *, int, int, unsigned char *);
 
 typedef struct xfs_attr_list_context {
         struct xfs_inode                *dp;            /* inode */
@@ -139,7 +139,6 @@ typedef struct xfs_attr_list_context {
 /*
  * Overall external interface routines.
  */
-int xfs_attr_calc_size(struct xfs_inode *, int, int, int *);
 int xfs_attr_inactive(struct xfs_inode *dp);
 int xfs_attr_rmtval_get(struct xfs_da_args *args);
 int xfs_attr_list_int(struct xfs_attr_list_context *);
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index baf41b5af756..a90ce74fc256 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -521,11 +521,11 @@ xfs_attr_shortform_to_leaf(xfs_da_args_t *args)
 
         sfe = &sf->list[0];
         for (i = 0; i < sf->hdr.count; i++) {
-                nargs.name = (char *)sfe->nameval;
+                nargs.name = sfe->nameval;
                 nargs.namelen = sfe->namelen;
-                nargs.value = (char *)&sfe->nameval[nargs.namelen];
+                nargs.value = &sfe->nameval[nargs.namelen];
                 nargs.valuelen = sfe->valuelen;
-                nargs.hashval = xfs_da_hashname((char *)sfe->nameval,
+                nargs.hashval = xfs_da_hashname(sfe->nameval,
                                                 sfe->namelen);
                 nargs.flags = XFS_ATTR_NSP_ONDISK_TO_ARGS(sfe->flags);
                 error = xfs_attr_leaf_lookup_int(bp, &nargs); /* set a->index */
@@ -612,10 +612,10 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
                 for (i = 0, sfe = &sf->list[0]; i < sf->hdr.count; i++) {
                         error = context->put_listent(context,
                                            sfe->flags,
-                                           (char *)sfe->nameval,
+                                           sfe->nameval,
                                            (int)sfe->namelen,
                                            (int)sfe->valuelen,
-                                           (char*)&sfe->nameval[sfe->namelen]);
+                                           &sfe->nameval[sfe->namelen]);
 
                         /*
                          * Either search callback finished early or
@@ -659,8 +659,8 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context)
                 }
 
                 sbp->entno = i;
-                sbp->hash = xfs_da_hashname((char *)sfe->nameval, sfe->namelen);
-                sbp->name = (char *)sfe->nameval;
+                sbp->hash = xfs_da_hashname(sfe->nameval, sfe->namelen);
+                sbp->name = sfe->nameval;
                 sbp->namelen = sfe->namelen;
                 /* These are bytes, and both on-disk, don't endian-flip */
                 sbp->valuelen = sfe->valuelen;
@@ -818,9 +818,9 @@ xfs_attr_leaf_to_shortform(xfs_dabuf_t *bp, xfs_da_args_t *args, int forkoff)
                         continue;
                 ASSERT(entry->flags & XFS_ATTR_LOCAL);
                 name_loc = xfs_attr_leaf_name_local(leaf, i);
-                nargs.name = (char *)name_loc->nameval;
+                nargs.name = name_loc->nameval;
                 nargs.namelen = name_loc->namelen;
-                nargs.value = (char *)&name_loc->nameval[nargs.namelen];
+                nargs.value = &name_loc->nameval[nargs.namelen];
                 nargs.valuelen = be16_to_cpu(name_loc->valuelen);
                 nargs.hashval = be32_to_cpu(entry->hashval);
                 nargs.flags = XFS_ATTR_NSP_ONDISK_TO_ARGS(entry->flags);
@@ -2370,10 +2370,10 @@ xfs_attr_leaf_list_int(xfs_dabuf_t *bp, xfs_attr_list_context_t *context)
 
                         retval = context->put_listent(context,
                                                 entry->flags,
-                                                (char *)name_loc->nameval,
+                                                name_loc->nameval,
                                                 (int)name_loc->namelen,
                                                 be16_to_cpu(name_loc->valuelen),
-                                                (char *)&name_loc->nameval[name_loc->namelen]);
+                                                &name_loc->nameval[name_loc->namelen]);
                         if (retval)
                                 return retval;
                 } else {
@@ -2397,15 +2397,15 @@ xfs_attr_leaf_list_int(xfs_dabuf_t *bp, xfs_attr_list_context_t *context)
                                         return retval;
                                 retval = context->put_listent(context,
                                                 entry->flags,
-                                                (char *)name_rmt->name,
+                                                name_rmt->name,
                                                 (int)name_rmt->namelen,
                                                 valuelen,
-                                                (char*)args.value);
+                                                args.value);
                                 kmem_free(args.value);
                         } else {
                                 retval = context->put_listent(context,
                                                 entry->flags,
-                                                (char *)name_rmt->name,
+                                                name_rmt->name,
                                                 (int)name_rmt->namelen,
                                                 valuelen,
                                                 NULL);
@@ -2950,7 +2950,7 @@ xfs_attr_leaf_freextent(xfs_trans_t **trans, xfs_inode_t *dp,
                                                 map.br_blockcount);
                         bp = xfs_trans_get_buf(*trans,
                                         dp->i_mount->m_ddev_targp,
-                                        dblkno, dblkcnt, XFS_BUF_LOCK);
+                                        dblkno, dblkcnt, XBF_LOCK);
                         xfs_trans_binval(*trans, bp);
                         /*
                          * Roll to next transaction.
diff --git a/fs/xfs/xfs_attr_sf.h b/fs/xfs/xfs_attr_sf.h
index 76ab7b0cbb3a..919756e3ba53 100644
--- a/fs/xfs/xfs_attr_sf.h
+++ b/fs/xfs/xfs_attr_sf.h
@@ -52,7 +52,7 @@ typedef struct xfs_attr_sf_sort {
         __uint8_t       valuelen;       /* length of value */
         __uint8_t       flags;          /* flags bits (see xfs_attr_leaf.h) */
         xfs_dahash_t    hash;           /* this entry's hash value */
-        char            *name;          /* name value, pointer into buffer */
+        unsigned char   *name;          /* name value, pointer into buffer */
 } xfs_attr_sf_sort_t;
 
 #define XFS_ATTR_SF_ENTSIZE_BYNAME(nlen,vlen)   /* space name/value uses */ \
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 98251cdc52aa..5c11e4d17010 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -2550,22 +2550,134 @@ xfs_bmap_rtalloc(
 }
 
 STATIC int
+xfs_bmap_btalloc_nullfb(
+        struct xfs_bmalloca     *ap,
+        struct xfs_alloc_arg    *args,
+        xfs_extlen_t            *blen)
+{
+        struct xfs_mount        *mp = ap->ip->i_mount;
+        struct xfs_perag        *pag;
+        xfs_agnumber_t          ag, startag;
+        int                     notinit = 0;
+        int                     error;
+
+        if (ap->userdata && xfs_inode_is_filestream(ap->ip))
+                args->type = XFS_ALLOCTYPE_NEAR_BNO;
+        else
+                args->type = XFS_ALLOCTYPE_START_BNO;
+        args->total = ap->total;
+
+        /*
+         * Search for an allocation group with a single extent large enough
+         * for the request.  If one isn't found, then adjust the minimum
+         * allocation size to the largest space found.
+         */
+        startag = ag = XFS_FSB_TO_AGNO(mp, args->fsbno);
+        if (startag == NULLAGNUMBER)
+                startag = ag = 0;
+
+        pag = xfs_perag_get(mp, ag);
+        while (*blen < ap->alen) {
+                if (!pag->pagf_init) {
+                        error = xfs_alloc_pagf_init(mp, args->tp, ag,
+                                                    XFS_ALLOC_FLAG_TRYLOCK);
+                        if (error) {
+                                xfs_perag_put(pag);
+                                return error;
+                        }
+                }
+
+                /*
+                 * See xfs_alloc_fix_freelist...
+                 */
+                if (pag->pagf_init) {
+                        xfs_extlen_t    longest;
+                        longest = xfs_alloc_longest_free_extent(mp, pag);
+                        if (*blen < longest)
+                                *blen = longest;
+                } else
+                        notinit = 1;
+
+                if (xfs_inode_is_filestream(ap->ip)) {
+                        if (*blen >= ap->alen)
+                                break;
+
+                        if (ap->userdata) {
+                                /*
+                                 * If startag is an invalid AG, we've
+                                 * come here once before and
+                                 * xfs_filestream_new_ag picked the
+                                 * best currently available.
+                                 *
+                                 * Don't continue looping, since we
+                                 * could loop forever.
+                                 */
+                                if (startag == NULLAGNUMBER)
+                                        break;
+
+                                error = xfs_filestream_new_ag(ap, &ag);
+                                xfs_perag_put(pag);
+                                if (error)
+                                        return error;
+
+                                /* loop again to set 'blen'*/
+                                startag = NULLAGNUMBER;
+                                pag = xfs_perag_get(mp, ag);
+                                continue;
+                        }
+                }
+                if (++ag == mp->m_sb.sb_agcount)
+                        ag = 0;
+                if (ag == startag)
+                        break;
+                xfs_perag_put(pag);
+                pag = xfs_perag_get(mp, ag);
+        }
+        xfs_perag_put(pag);
+
+        /*
+         * Since the above loop did a BUF_TRYLOCK, it is
+         * possible that there is space for this request.
+         */
+        if (notinit || *blen < ap->minlen)
+                args->minlen = ap->minlen;
+        /*
+         * If the best seen length is less than the request
+         * length, use the best as the minimum.
+         */
+        else if (*blen < ap->alen)
+                args->minlen = *blen;
+        /*
+         * Otherwise we've seen an extent as big as alen,
+         * use that as the minimum.
+         */
+        else
+                args->minlen = ap->alen;
+
+        /*
+         * set the failure fallback case to look in the selected
+         * AG as the stream may have moved.
+         */
+        if (xfs_inode_is_filestream(ap->ip))
+                ap->rval = args->fsbno = XFS_AGB_TO_FSB(mp, ag, 0);
+
+        return 0;
+}
+
+STATIC int
 xfs_bmap_btalloc(
         xfs_bmalloca_t  *ap)            /* bmap alloc argument struct */
 {
         xfs_mount_t     *mp;            /* mount point structure */
         xfs_alloctype_t atype = 0;      /* type for allocation routines */
         xfs_extlen_t    align;          /* minimum allocation alignment */
-        xfs_agnumber_t  ag;
         xfs_agnumber_t  fb_agno;        /* ag number of ap->firstblock */
-        xfs_agnumber_t  startag;
+        xfs_agnumber_t  ag;
         xfs_alloc_arg_t args;
         xfs_extlen_t    blen;
         xfs_extlen_t    nextminlen = 0;
-        xfs_perag_t     *pag;
         int             nullfb;         /* true if ap->firstblock isn't set */
         int             isaligned;
-        int             notinit;
         int             tryagain;
         int             error;
 
@@ -2612,102 +2724,9 @@ xfs_bmap_btalloc(
         args.firstblock = ap->firstblock;
         blen = 0;
         if (nullfb) {
-                if (ap->userdata && xfs_inode_is_filestream(ap->ip))
-                        args.type = XFS_ALLOCTYPE_NEAR_BNO;
-                else
-                        args.type = XFS_ALLOCTYPE_START_BNO;
-                args.total = ap->total;
-
-                /*
-                 * Search for an allocation group with a single extent
-                 * large enough for the request.
-                 *
-                 * If one isn't found, then adjust the minimum allocation
-                 * size to the largest space found.
-                 */
-                startag = ag = XFS_FSB_TO_AGNO(mp, args.fsbno);
-                if (startag == NULLAGNUMBER)
-                        startag = ag = 0;
-                notinit = 0;
-                down_read(&mp->m_peraglock);
-                while (blen < ap->alen) {
-                        pag = &mp->m_perag[ag];
-                        if (!pag->pagf_init &&
-                            (error = xfs_alloc_pagf_init(mp, args.tp,
-                                    ag, XFS_ALLOC_FLAG_TRYLOCK))) {
-                                up_read(&mp->m_peraglock);
-                                return error;
-                        }
-                        /*
-                         * See xfs_alloc_fix_freelist...
-                         */
-                        if (pag->pagf_init) {
-                                xfs_extlen_t    longest;
-                                longest = xfs_alloc_longest_free_extent(mp, pag);
-                                if (blen < longest)
-                                        blen = longest;
-                        } else
-                                notinit = 1;
-
-                        if (xfs_inode_is_filestream(ap->ip)) {
-                                if (blen >= ap->alen)
-                                        break;
-
-                                if (ap->userdata) {
-                                        /*
-                                         * If startag is an invalid AG, we've
-                                         * come here once before and
-                                         * xfs_filestream_new_ag picked the
-                                         * best currently available.
-                                         *
-                                         * Don't continue looping, since we
-                                         * could loop forever.
-                                         */
-                                        if (startag == NULLAGNUMBER)
-                                                break;
-
-                                        error = xfs_filestream_new_ag(ap, &ag);
-                                        if (error) {
-                                                up_read(&mp->m_peraglock);
-                                                return error;
-                                        }
-
-                                        /* loop again to set 'blen'*/
-                                        startag = NULLAGNUMBER;
-                                        continue;
-                                }
-                        }
-                        if (++ag == mp->m_sb.sb_agcount)
-                                ag = 0;
-                        if (ag == startag)
-                                break;
-                }
-                up_read(&mp->m_peraglock);
-                /*
-                 * Since the above loop did a BUF_TRYLOCK, it is
-                 * possible that there is space for this request.
-                 */
-                if (notinit || blen < ap->minlen)
-                        args.minlen = ap->minlen;
-                /*
-                 * If the best seen length is less than the request
-                 * length, use the best as the minimum.
-                 */
-                else if (blen < ap->alen)
-                        args.minlen = blen;
-                /*
-                 * Otherwise we've seen an extent as big as alen,
-                 * use that as the minimum.
-                 */
-                else
-                        args.minlen = ap->alen;
-
-                /*
-                 * set the failure fallback case to look in the selected
-                 * AG as the stream may have moved.
-                 */
-                if (xfs_inode_is_filestream(ap->ip))
-                        ap->rval = args.fsbno = XFS_AGB_TO_FSB(mp, ag, 0);
+                error = xfs_bmap_btalloc_nullfb(ap, &args, &blen);
+                if (error)
+                        return error;
         } else if (ap->low) {
                 if (xfs_inode_is_filestream(ap->ip))
                         args.type = XFS_ALLOCTYPE_FIRST_AG;
@@ -4470,7 +4489,7 @@ xfs_bmapi(
         xfs_fsblock_t   abno;           /* allocated block number */
         xfs_extlen_t    alen;           /* allocated extent length */
         xfs_fileoff_t   aoff;           /* allocated file offset */
-        xfs_bmalloca_t  bma;            /* args for xfs_bmap_alloc */
+        xfs_bmalloca_t  bma = { 0 };    /* args for xfs_bmap_alloc */
         xfs_btree_cur_t *cur;           /* bmap btree cursor */
         xfs_fileoff_t   end;            /* end of mapped file region */
         int             eof;            /* we've hit the end of extents */
diff --git a/fs/xfs/xfs_bmap_btree.c b/fs/xfs/xfs_bmap_btree.c
index 38751d5fac6f..416e47e54b83 100644
--- a/fs/xfs/xfs_bmap_btree.c
+++ b/fs/xfs/xfs_bmap_btree.c
@@ -334,7 +334,7 @@ xfs_bmbt_disk_set_allf(
 /*
  * Set all the fields in a bmap extent record from the uncompressed form.
  */
-void
+STATIC void
 xfs_bmbt_disk_set_all(
         xfs_bmbt_rec_t  *r,
         xfs_bmbt_irec_t *s)
diff --git a/fs/xfs/xfs_bmap_btree.h b/fs/xfs/xfs_bmap_btree.h
index cf07ca7c22e7..0e66c4ea0f85 100644
--- a/fs/xfs/xfs_bmap_btree.h
+++ b/fs/xfs/xfs_bmap_btree.h
@@ -223,7 +223,6 @@ extern void xfs_bmbt_set_startblock(xfs_bmbt_rec_host_t *r, xfs_fsblock_t v);
 extern void xfs_bmbt_set_startoff(xfs_bmbt_rec_host_t *r, xfs_fileoff_t v);
 extern void xfs_bmbt_set_state(xfs_bmbt_rec_host_t *r, xfs_exntst_t v);
 
-extern void xfs_bmbt_disk_set_all(xfs_bmbt_rec_t *r, xfs_bmbt_irec_t *s);
 extern void xfs_bmbt_disk_set_allf(xfs_bmbt_rec_t *r, xfs_fileoff_t o,
                         xfs_fsblock_t b, xfs_filblks_t c, xfs_exntst_t v);
 
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index 36a0992dd669..96be4b0f2496 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -977,7 +977,7 @@ xfs_btree_get_buf_block(
         xfs_daddr_t             d;
 
         /* need to sort out how callers deal with failures first */
-        ASSERT(!(flags & XFS_BUF_TRYLOCK));
+        ASSERT(!(flags & XBF_TRYLOCK));
 
         d = xfs_btree_ptr_to_daddr(cur, ptr);
         *bpp = xfs_trans_get_buf(cur->bc_tp, mp->m_ddev_targp, d,
@@ -1008,7 +1008,7 @@ xfs_btree_read_buf_block(
         int                     error;
 
         /* need to sort out how callers deal with failures first */
-        ASSERT(!(flags & XFS_BUF_TRYLOCK));
+        ASSERT(!(flags & XBF_TRYLOCK));
 
         d = xfs_btree_ptr_to_daddr(cur, ptr);
         error = xfs_trans_read_buf(mp, cur->bc_tp, mp->m_ddev_targp, d,
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index a30f7e9eb2b9..f3c49e69eab9 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -250,7 +250,7 @@ xfs_buf_item_format(
                        ((bip->bli_format.blf_map_size - 1) * sizeof(uint)));
         vecp->i_addr = (xfs_caddr_t)&bip->bli_format;
         vecp->i_len = base_size;
-        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_BFORMAT);
+        vecp->i_type = XLOG_REG_TYPE_BFORMAT;
         vecp++;
         nvecs = 1;
 
@@ -297,14 +297,14 @@ xfs_buf_item_format(
                         buffer_offset = first_bit * XFS_BLI_CHUNK;
                         vecp->i_addr = xfs_buf_offset(bp, buffer_offset);
                         vecp->i_len = nbits * XFS_BLI_CHUNK;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_BCHUNK);
+                        vecp->i_type = XLOG_REG_TYPE_BCHUNK;
                         nvecs++;
                         break;
                 } else if (next_bit != last_bit + 1) {
                         buffer_offset = first_bit * XFS_BLI_CHUNK;
                         vecp->i_addr = xfs_buf_offset(bp, buffer_offset);
                         vecp->i_len = nbits * XFS_BLI_CHUNK;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_BCHUNK);
+                        vecp->i_type = XLOG_REG_TYPE_BCHUNK;
                         nvecs++;
                         vecp++;
                         first_bit = next_bit;
@@ -316,7 +316,7 @@ xfs_buf_item_format(
                         buffer_offset = first_bit * XFS_BLI_CHUNK;
                         vecp->i_addr = xfs_buf_offset(bp, buffer_offset);
                         vecp->i_len = nbits * XFS_BLI_CHUNK;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_BCHUNK);
+                        vecp->i_type = XLOG_REG_TYPE_BCHUNK;
 /* You would think we need to bump the nvecs here too, but we do not
  * this number is used by recovery, and it gets confused by the boundary
  * split here
@@ -467,8 +467,10 @@ xfs_buf_item_unpin_remove(
 /*
  * This is called to attempt to lock the buffer associated with this
  * buf log item.  Don't sleep on the buffer lock.  If we can't get
- * the lock right away, return 0.  If we can get the lock, pull the
- * buffer from the free list, mark it busy, and return 1.
+ * the lock right away, return 0.  If we can get the lock, take a
+ * reference to the buffer. If this is a delayed write buffer that
+ * needs AIL help to be written back, invoke the pushbuf routine
+ * rather than the normal success path.
  */
 STATIC uint
 xfs_buf_item_trylock(
@@ -477,24 +479,18 @@ xfs_buf_item_trylock(
         xfs_buf_t       *bp;
 
         bp = bip->bli_buf;
-
-        if (XFS_BUF_ISPINNED(bp)) {
+        if (XFS_BUF_ISPINNED(bp))
                 return XFS_ITEM_PINNED;
-        }
-
-        if (!XFS_BUF_CPSEMA(bp)) {
+        if (!XFS_BUF_CPSEMA(bp))
                 return XFS_ITEM_LOCKED;
-        }
 
-        /*
-         * Remove the buffer from the free list.  Only do this
-         * if it's on the free list.  Private buffers like the
-         * superblock buffer are not.
-         */
+        /* take a reference to the buffer.  */
         XFS_BUF_HOLD(bp);
 
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
         trace_xfs_buf_item_trylock(bip);
+        if (XFS_BUF_ISDELAYWRITE(bp))
+                return XFS_ITEM_PUSHBUF;
         return XFS_ITEM_SUCCESS;
 }
 
@@ -626,11 +622,9 @@ xfs_buf_item_committed(
 }
 
 /*
- * This is called to asynchronously write the buffer associated with this
- * buf log item out to disk. The buffer will already have been locked by
- * a successful call to xfs_buf_item_trylock().  If the buffer still has
- * B_DELWRI set, then get it going out to disk with a call to bawrite().
- * If not, then just release the buffer.
+ * The buffer is locked, but is not a delayed write buffer. This happens
+ * if we race with IO completion and hence we don't want to try to write it
+ * again. Just release the buffer.
  */
 STATIC void
 xfs_buf_item_push(
@@ -642,17 +636,29 @@ xfs_buf_item_push(
         trace_xfs_buf_item_push(bip);
 
         bp = bip->bli_buf;
+        ASSERT(!XFS_BUF_ISDELAYWRITE(bp));
+        xfs_buf_relse(bp);
+}
 
-        if (XFS_BUF_ISDELAYWRITE(bp)) {
-                int     error;
-                error = xfs_bawrite(bip->bli_item.li_mountp, bp);
-                if (error)
-                        xfs_fs_cmn_err(CE_WARN, bip->bli_item.li_mountp,
-                        "xfs_buf_item_push: pushbuf error %d on bip %p, bp %p",
-                                        error, bip, bp);
-        } else {
-                xfs_buf_relse(bp);
-        }
+/*
+ * The buffer is locked and is a delayed write buffer. Promote the buffer
+ * in the delayed write queue as the caller knows that they must invoke
+ * the xfsbufd to get this buffer written. We have to unlock the buffer
+ * to allow the xfsbufd to write it, too.
+ */
+STATIC void
+xfs_buf_item_pushbuf(
+        xfs_buf_log_item_t      *bip)
+{
+        xfs_buf_t       *bp;
+
+        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
+        trace_xfs_buf_item_pushbuf(bip);
+
+        bp = bip->bli_buf;
+        ASSERT(XFS_BUF_ISDELAYWRITE(bp));
+        xfs_buf_delwri_promote(bp);
+        xfs_buf_relse(bp);
 }
 
 /* ARGSUSED */
@@ -677,7 +683,7 @@ static struct xfs_item_ops xfs_buf_item_ops = {
         .iop_committed  = (xfs_lsn_t(*)(xfs_log_item_t*, xfs_lsn_t))
                                         xfs_buf_item_committed,
         .iop_push       = (void(*)(xfs_log_item_t*))xfs_buf_item_push,
-        .iop_pushbuf    = NULL,
+        .iop_pushbuf    = (void(*)(xfs_log_item_t*))xfs_buf_item_pushbuf,
         .iop_committing = (void(*)(xfs_log_item_t*, xfs_lsn_t))
                                         xfs_buf_item_committing
 };
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index c0c8869115b1..0ca556b4bf31 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -1534,8 +1534,8 @@ xfs_da_hashname(const __uint8_t *name, int namelen)
 enum xfs_dacmp
 xfs_da_compname(
         struct xfs_da_args *args,
-        const char      *name,
-        int             len)
+        const unsigned char *name,
+        int             len)
 {
         return (args->namelen == len && memcmp(args->name, name, len) == 0) ?
                                         XFS_CMP_EXACT : XFS_CMP_DIFFERENT;
diff --git a/fs/xfs/xfs_da_btree.h b/fs/xfs/xfs_da_btree.h
index 30cd08f56a3a..fe9f5a8c1d2a 100644
--- a/fs/xfs/xfs_da_btree.h
+++ b/fs/xfs/xfs_da_btree.h
@@ -209,7 +209,8 @@ typedef struct xfs_da_state {
  */
 struct xfs_nameops {
         xfs_dahash_t    (*hashname)(struct xfs_name *);
-        enum xfs_dacmp  (*compname)(struct xfs_da_args *, const char *, int);
+        enum xfs_dacmp  (*compname)(struct xfs_da_args *,
+                                        const unsigned char *, int);
 };
 
 
@@ -260,7 +261,7 @@ int	xfs_da_shrink_inode(xfs_da_args_t *args, xfs_dablk_t dead_blkno,
 
 uint xfs_da_hashname(const __uint8_t *name_string, int name_length);
 enum xfs_dacmp xfs_da_compname(struct xfs_da_args *args,
-                                const char *name, int len);
+                                const unsigned char *name, int len);
 
 
 xfs_da_state_t *xfs_da_state_alloc(void);
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index d1483a4f71b8..5bba29a07812 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -45,15 +45,21 @@
 #include "xfs_vnodeops.h"
 #include "xfs_trace.h"
 
+
+static int xfs_swap_extents(
+        xfs_inode_t     *ip,    /* target inode */
+        xfs_inode_t     *tip,   /* tmp inode */
+        xfs_swapext_t   *sxp);
+
 /*
- * Syssgi interface for swapext
+ * ioctl interface for swapext
  */
 int
 xfs_swapext(
         xfs_swapext_t   *sxp)
 {
         xfs_inode_t     *ip, *tip;
-        struct file     *file, *target_file;
+        struct file     *file, *tmp_file;
         int             error = 0;
 
         /* Pull information for the target fd */
@@ -68,56 +74,138 @@ xfs_swapext(
                 goto out_put_file;
         }
 
-        target_file = fget((int)sxp->sx_fdtmp);
-        if (!target_file) {
+        tmp_file = fget((int)sxp->sx_fdtmp);
+        if (!tmp_file) {
                 error = XFS_ERROR(EINVAL);
                 goto out_put_file;
         }
 
-        if (!(target_file->f_mode & FMODE_WRITE) ||
-            (target_file->f_flags & O_APPEND)) {
+        if (!(tmp_file->f_mode & FMODE_WRITE) ||
+            (tmp_file->f_flags & O_APPEND)) {
                 error = XFS_ERROR(EBADF);
-                goto out_put_target_file;
+                goto out_put_tmp_file;
         }
 
         if (IS_SWAPFILE(file->f_path.dentry->d_inode) ||
-            IS_SWAPFILE(target_file->f_path.dentry->d_inode)) {
+            IS_SWAPFILE(tmp_file->f_path.dentry->d_inode)) {
                 error = XFS_ERROR(EINVAL);
-                goto out_put_target_file;
+                goto out_put_tmp_file;
         }
 
         ip = XFS_I(file->f_path.dentry->d_inode);
-        tip = XFS_I(target_file->f_path.dentry->d_inode);
+        tip = XFS_I(tmp_file->f_path.dentry->d_inode);
 
         if (ip->i_mount != tip->i_mount) {
                 error = XFS_ERROR(EINVAL);
-                goto out_put_target_file;
+                goto out_put_tmp_file;
         }
 
         if (ip->i_ino == tip->i_ino) {
                 error = XFS_ERROR(EINVAL);
-                goto out_put_target_file;
+                goto out_put_tmp_file;
         }
 
         if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
                 error = XFS_ERROR(EIO);
-                goto out_put_target_file;
+                goto out_put_tmp_file;
         }
 
         error = xfs_swap_extents(ip, tip, sxp);
 
- out_put_target_file:
-        fput(target_file);
+ out_put_tmp_file:
+        fput(tmp_file);
  out_put_file:
         fput(file);
  out:
         return error;
 }
 
-int
+/*
+ * We need to check that the format of the data fork in the temporary inode is
+ * valid for the target inode before doing the swap. This is not a problem with
+ * attr1 because of the fixed fork offset, but attr2 has a dynamically sized
+ * data fork depending on the space the attribute fork is taking so we can get
+ * invalid formats on the target inode.
+ *
+ * E.g. target has space for 7 extents in extent format, temp inode only has
+ * space for 6.  If we defragment down to 7 extents, then the tmp format is a
+ * btree, but when swapped it needs to be in extent format. Hence we can't just
+ * blindly swap data forks on attr2 filesystems.
+ *
+ * Note that we check the swap in both directions so that we don't end up with
+ * a corrupt temporary inode, either.
+ *
+ * Note that fixing the way xfs_fsr sets up the attribute fork in the source
+ * inode will prevent this situation from occurring, so all we do here is
+ * reject and log the attempt. basically we are putting the responsibility on
+ * userspace to get this right.
+ */
+static int
+xfs_swap_extents_check_format(
+        xfs_inode_t     *ip,    /* target inode */
+        xfs_inode_t     *tip)   /* tmp inode */
+{
+
+        /* Should never get a local format */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL ||
+            tip->i_d.di_format == XFS_DINODE_FMT_LOCAL)
+                return EINVAL;
+
+        /*
+         * if the target inode has less extents that then temporary inode then
+         * why did userspace call us?
+         */
+        if (ip->i_d.di_nextents < tip->i_d.di_nextents)
+                return EINVAL;
+
+        /*
+         * if the target inode is in extent form and the temp inode is in btree
+         * form then we will end up with the target inode in the wrong format
+         * as we already know there are less extents in the temp inode.
+         */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
+            tip->i_d.di_format == XFS_DINODE_FMT_BTREE)
+                return EINVAL;
+
+        /* Check temp in extent form to max in target */
+        if (tip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
+            XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) > ip->i_df.if_ext_max)
+                return EINVAL;
+
+        /* Check target in extent form to max in temp */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
+            XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) > tip->i_df.if_ext_max)
+                return EINVAL;
+
+        /*
+         * If we are in a btree format, check that the temp root block will fit
+         * in the target and that it has enough extents to be in btree format
+         * in the target.
+         *
+         * Note that we have to be careful to allow btree->extent conversions
+         * (a common defrag case) which will occur when the temp inode is in
+         * extent format...
+         */
+        if (tip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
+            ((XFS_IFORK_BOFF(ip) &&
+              tip->i_df.if_broot_bytes > XFS_IFORK_BOFF(ip)) ||
+             XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) <= ip->i_df.if_ext_max))
+                return EINVAL;
+
+        /* Reciprocal target->temp btree format checks */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
+            ((XFS_IFORK_BOFF(tip) &&
+              ip->i_df.if_broot_bytes > XFS_IFORK_BOFF(tip)) ||
+             XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) <= tip->i_df.if_ext_max))
+                return EINVAL;
+
+        return 0;
+}
+
+static int
 xfs_swap_extents(
-        xfs_inode_t     *ip,
-        xfs_inode_t     *tip,
+        xfs_inode_t     *ip,    /* target inode */
+        xfs_inode_t     *tip,   /* tmp inode */
         xfs_swapext_t   *sxp)
 {
         xfs_mount_t     *mp;
@@ -161,13 +249,6 @@ xfs_swap_extents(
                 goto out_unlock;
         }
 
-        /* Should never get a local format */
-        if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL ||
-            tip->i_d.di_format == XFS_DINODE_FMT_LOCAL) {
-                error = XFS_ERROR(EINVAL);
-                goto out_unlock;
-        }
-
         if (VN_CACHED(VFS_I(tip)) != 0) {
                 error = xfs_flushinval_pages(tip, 0, -1,
                                 FI_REMAPF_LOCKED);
@@ -189,13 +270,15 @@ xfs_swap_extents(
                 goto out_unlock;
         }
 
-        /*
-         * If the target has extended attributes, the tmp file
-         * must also in order to ensure the correct data fork
-         * format.
-         */
-        if ( XFS_IFORK_Q(ip) != XFS_IFORK_Q(tip) ) {
-                error = XFS_ERROR(EINVAL);
+        trace_xfs_swap_extent_before(ip, 0);
+        trace_xfs_swap_extent_before(tip, 1);
+
+        /* check inode formats now that data is flushed */
+        error = xfs_swap_extents_check_format(ip, tip);
+        if (error) {
+                xfs_fs_cmn_err(CE_NOTE, mp,
+                    "%s: inode 0x%llx format is incompatible for exchanging.",
+                                __FILE__, ip->i_ino);
                 goto out_unlock;
         }
 
@@ -276,6 +359,16 @@ xfs_swap_extents(
         *tifp = *tempifp;       /* struct copy */
 
         /*
+         * Fix the in-memory data fork values that are dependent on the fork
+         * offset in the inode. We can't assume they remain the same as attr2
+         * has dynamic fork offsets.
+         */
+        ifp->if_ext_max = XFS_IFORK_SIZE(ip, XFS_DATA_FORK) /
+                                        (uint)sizeof(xfs_bmbt_rec_t);
+        tifp->if_ext_max = XFS_IFORK_SIZE(tip, XFS_DATA_FORK) /
+                                        (uint)sizeof(xfs_bmbt_rec_t);
+
+        /*
          * Fix the on-disk inode values
          */
         tmp = (__uint64_t)ip->i_d.di_nblocks;
@@ -347,6 +440,8 @@ xfs_swap_extents(
 
         error = xfs_trans_commit(tp, XFS_TRANS_SWAPEXT);
 
+        trace_xfs_swap_extent_after(ip, 0);
+        trace_xfs_swap_extent_after(tip, 1);
 out:
         kmem_free(tempifp);
         return error;
diff --git a/fs/xfs/xfs_dfrag.h b/fs/xfs/xfs_dfrag.h
index 4f55a6306558..20bdd935c121 100644
--- a/fs/xfs/xfs_dfrag.h
+++ b/fs/xfs/xfs_dfrag.h
@@ -48,9 +48,6 @@ typedef struct xfs_swapext
  */
 int     xfs_swapext(struct xfs_swapext *sx);
 
-int     xfs_swap_extents(struct xfs_inode *ip, struct xfs_inode *tip,
-                struct xfs_swapext *sxp);
-
 #endif  /* __KERNEL__ */
 
 #endif  /* __XFS_DFRAG_H__ */
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index 93634a7e90e9..42520f041265 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -44,7 +44,7 @@
 #include "xfs_vnodeops.h"
 #include "xfs_trace.h"
 
-struct xfs_name xfs_name_dotdot = {"..", 2};
+struct xfs_name xfs_name_dotdot = { (unsigned char *)"..", 2};
 
 /*
  * ASCII case-insensitive (ie. A-Z) support for directories that was
@@ -66,8 +66,8 @@ xfs_ascii_ci_hashname(
 STATIC enum xfs_dacmp
 xfs_ascii_ci_compname(
         struct xfs_da_args *args,
-        const char      *name,
-        int             len)
+        const unsigned char *name,
+        int             len)
 {
         enum xfs_dacmp  result;
         int             i;
@@ -247,7 +247,7 @@ xfs_dir_createname(
 int
 xfs_dir_cilookup_result(
         struct xfs_da_args *args,
-        const char      *name,
+        const unsigned char *name,
         int             len)
 {
         if (args->cmpresult == XFS_CMP_DIFFERENT)
diff --git a/fs/xfs/xfs_dir2.h b/fs/xfs/xfs_dir2.h
index 1d9ef96f33aa..74a3b1057685 100644
--- a/fs/xfs/xfs_dir2.h
+++ b/fs/xfs/xfs_dir2.h
@@ -100,7 +100,7 @@ extern int xfs_dir2_isleaf(struct xfs_trans *tp, struct xfs_inode *dp,
 extern int xfs_dir2_shrink_inode(struct xfs_da_args *args, xfs_dir2_db_t db,
                                 struct xfs_dabuf *bp);
 
-extern int xfs_dir_cilookup_result(struct xfs_da_args *args, const char *name,
-                                int len);
+extern int xfs_dir_cilookup_result(struct xfs_da_args *args,
+                                const unsigned char *name, int len);
 
 #endif  /* __XFS_DIR2_H__ */
diff --git a/fs/xfs/xfs_dir2_block.c b/fs/xfs/xfs_dir2_block.c
index ddc4ecc7807f..779a267b0a84 100644
--- a/fs/xfs/xfs_dir2_block.c
+++ b/fs/xfs/xfs_dir2_block.c
@@ -57,8 +57,8 @@ static xfs_dahash_t xfs_dir_hash_dot, xfs_dir_hash_dotdot;
 void
 xfs_dir_startup(void)
 {
-        xfs_dir_hash_dot = xfs_da_hashname(".", 1);
-        xfs_dir_hash_dotdot = xfs_da_hashname("..", 2);
+        xfs_dir_hash_dot = xfs_da_hashname((unsigned char *)".", 1);
+        xfs_dir_hash_dotdot = xfs_da_hashname((unsigned char *)"..", 2);
 }
 
 /*
@@ -513,8 +513,9 @@ xfs_dir2_block_getdents(
                 /*
                  * If it didn't fit, set the final offset to here & return.
                  */
-                if (filldir(dirent, dep->name, dep->namelen, cook & 0x7fffffff,
-                            be64_to_cpu(dep->inumber), DT_UNKNOWN)) {
+                if (filldir(dirent, (char *)dep->name, dep->namelen,
+                            cook & 0x7fffffff, be64_to_cpu(dep->inumber),
+                            DT_UNKNOWN)) {
                         *offset = cook & 0x7fffffff;
                         xfs_da_brelse(NULL, bp);
                         return 0;
diff --git a/fs/xfs/xfs_dir2_leaf.c b/fs/xfs/xfs_dir2_leaf.c
index 29f484c11b3a..e2d89854ec9e 100644
--- a/fs/xfs/xfs_dir2_leaf.c
+++ b/fs/xfs/xfs_dir2_leaf.c
@@ -1081,7 +1081,7 @@ xfs_dir2_leaf_getdents(
                 dep = (xfs_dir2_data_entry_t *)ptr;
                 length = xfs_dir2_data_entsize(dep->namelen);
 
-                if (filldir(dirent, dep->name, dep->namelen,
+                if (filldir(dirent, (char *)dep->name, dep->namelen,
                             xfs_dir2_byte_to_dataptr(mp, curoff) & 0x7fffffff,
                             be64_to_cpu(dep->inumber), DT_UNKNOWN))
                         break;
diff --git a/fs/xfs/xfs_dir2_node.c b/fs/xfs/xfs_dir2_node.c
index ce6e355199b5..78fc4d9ae756 100644
--- a/fs/xfs/xfs_dir2_node.c
+++ b/fs/xfs/xfs_dir2_node.c
@@ -65,7 +65,7 @@ static int xfs_dir2_node_addname_int(xfs_da_args_t *args,
 /*
  * Log entries from a freespace block.
  */
-void
+STATIC void
 xfs_dir2_free_log_bests(
         xfs_trans_t             *tp,            /* transaction pointer */
         xfs_dabuf_t             *bp,            /* freespace buffer */
diff --git a/fs/xfs/xfs_dir2_node.h b/fs/xfs/xfs_dir2_node.h
index dde72db3d695..82dfe7147195 100644
--- a/fs/xfs/xfs_dir2_node.h
+++ b/fs/xfs/xfs_dir2_node.h
@@ -75,8 +75,6 @@ xfs_dir2_db_to_fdindex(struct xfs_mount *mp, xfs_dir2_db_t db)
         return ((db) % XFS_DIR2_MAX_FREE_BESTS(mp));
 }
 
-extern void xfs_dir2_free_log_bests(struct xfs_trans *tp, struct xfs_dabuf *bp,
-                                    int first, int last);
 extern int xfs_dir2_leaf_to_node(struct xfs_da_args *args,
                                  struct xfs_dabuf *lbp);
 extern xfs_dahash_t xfs_dir2_leafn_lasthash(struct xfs_dabuf *bp, int *count);
diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
index 9d4f17a69676..c1a5945d463a 100644
--- a/fs/xfs/xfs_dir2_sf.c
+++ b/fs/xfs/xfs_dir2_sf.c
@@ -782,7 +782,7 @@ xfs_dir2_sf_getdents(
                 }
 
                 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
-                if (filldir(dirent, sfep->name, sfep->namelen,
+                if (filldir(dirent, (char *)sfep->name, sfep->namelen,
                             off & 0x7fffffff, ino, DT_UNKNOWN)) {
                         *offset = off & 0x7fffffff;
                         return 0;
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 05a4bdd4be39..6f35ed1b39b9 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -82,7 +82,7 @@ xfs_efi_item_format(xfs_efi_log_item_t	*efip,
 
         log_vector->i_addr = (xfs_caddr_t)&(efip->efi_format);
         log_vector->i_len = size;
-        XLOG_VEC_SET_TYPE(log_vector, XLOG_REG_TYPE_EFI_FORMAT);
+        log_vector->i_type = XLOG_REG_TYPE_EFI_FORMAT;
         ASSERT(size >= sizeof(xfs_efi_log_format_t));
 }
 
@@ -406,7 +406,7 @@ xfs_efd_item_format(xfs_efd_log_item_t	*efdp,
 
         log_vector->i_addr = (xfs_caddr_t)&(efdp->efd_format);
         log_vector->i_len = size;
-        XLOG_VEC_SET_TYPE(log_vector, XLOG_REG_TYPE_EFD_FORMAT);
+        log_vector->i_type = XLOG_REG_TYPE_EFD_FORMAT;
         ASSERT(size >= sizeof(xfs_efd_log_format_t));
 }
 
diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c
index a631e1451abb..390850ee6603 100644
--- a/fs/xfs/xfs_filestream.c
+++ b/fs/xfs/xfs_filestream.c
@@ -140,6 +140,7 @@ _xfs_filestream_pick_ag(
         int             flags,
         xfs_extlen_t    minlen)
 {
+        int             streams, max_streams;
         int             err, trylock, nscan;
         xfs_extlen_t    longest, free, minfree, maxfree = 0;
         xfs_agnumber_t  ag, max_ag = NULLAGNUMBER;
@@ -155,15 +156,15 @@ _xfs_filestream_pick_ag(
         trylock = XFS_ALLOC_FLAG_TRYLOCK;
 
         for (nscan = 0; 1; nscan++) {
-
-                TRACE_AG_SCAN(mp, ag, xfs_filestream_peek_ag(mp, ag));
-
-                pag = mp->m_perag + ag;
+                pag = xfs_perag_get(mp, ag);
+                TRACE_AG_SCAN(mp, ag, atomic_read(&pag->pagf_fstrms));
 
                 if (!pag->pagf_init) {
                         err = xfs_alloc_pagf_init(mp, NULL, ag, trylock);
-                        if (err && !trylock)
+                        if (err && !trylock) {
+                                xfs_perag_put(pag);
                                 return err;
+                        }
                 }
 
                 /* Might fail sometimes during the 1st pass with trylock set. */
@@ -173,6 +174,7 @@ _xfs_filestream_pick_ag(
                 /* Keep track of the AG with the most free blocks. */
                 if (pag->pagf_freeblks > maxfree) {
                         maxfree = pag->pagf_freeblks;
+                        max_streams = atomic_read(&pag->pagf_fstrms);
                         max_ag = ag;
                 }
 
@@ -195,6 +197,8 @@ _xfs_filestream_pick_ag(
 
                         /* Break out, retaining the reference on the AG. */
                         free = pag->pagf_freeblks;
+                        streams = atomic_read(&pag->pagf_fstrms);
+                        xfs_perag_put(pag);
                         *agp = ag;
                         break;
                 }
@@ -202,6 +206,7 @@ _xfs_filestream_pick_ag(
                 /* Drop the reference on this AG, it's not usable. */
                 xfs_filestream_put_ag(mp, ag);
 next_ag:
+                xfs_perag_put(pag);
                 /* Move to the next AG, wrapping to AG 0 if necessary. */
                 if (++ag >= mp->m_sb.sb_agcount)
                         ag = 0;
@@ -229,6 +234,7 @@ next_ag:
                 if (max_ag != NULLAGNUMBER) {
                         xfs_filestream_get_ag(mp, max_ag);
                         TRACE_AG_PICK1(mp, max_ag, maxfree);
+                        streams = max_streams;
                         free = maxfree;
                         *agp = max_ag;
                         break;
@@ -240,16 +246,14 @@ next_ag:
                 return 0;
         }
 
-        TRACE_AG_PICK2(mp, startag, *agp, xfs_filestream_peek_ag(mp, *agp),
-                        free, nscan, flags);
+        TRACE_AG_PICK2(mp, startag, *agp, streams, free, nscan, flags);
 
         return 0;
 }
 
 /*
  * Set the allocation group number for a file or a directory, updating inode
- * references and per-AG references as appropriate.  Must be called with the
- * m_peraglock held in read mode.
+ * references and per-AG references as appropriate.
  */
 static int
 _xfs_filestream_update_ag(
@@ -451,20 +455,6 @@ xfs_filestream_unmount(
 }
 
 /*
- * If the mount point's m_perag array is going to be reallocated, all
- * outstanding cache entries must be flushed to avoid accessing reference count
- * addresses that have been freed.  The call to xfs_filestream_flush() must be
- * made inside the block that holds the m_peraglock in write mode to do the
- * reallocation.
- */
-void
-xfs_filestream_flush(
-        xfs_mount_t     *mp)
-{
-        xfs_mru_cache_flush(mp->m_filestream);
-}
-
-/*
  * Return the AG of the filestream the file or directory belongs to, or
  * NULLAGNUMBER otherwise.
  */
@@ -526,7 +516,6 @@ xfs_filestream_associate(
 
         mp = pip->i_mount;
         cache = mp->m_filestream;
-        down_read(&mp->m_peraglock);
 
         /*
          * We have a problem, Houston.
@@ -543,10 +532,8 @@ xfs_filestream_associate(
          *
          * So, if we can't get the iolock without sleeping then just give up
          */
-        if (!xfs_ilock_nowait(pip, XFS_IOLOCK_EXCL)) {
-                up_read(&mp->m_peraglock);
+        if (!xfs_ilock_nowait(pip, XFS_IOLOCK_EXCL))
                 return 1;
-        }
 
         /* If the parent directory is already in the cache, use its AG. */
         item = xfs_mru_cache_lookup(cache, pip->i_ino);
@@ -601,7 +588,6 @@ exit_did_pick:
 
 exit:
         xfs_iunlock(pip, XFS_IOLOCK_EXCL);
-        up_read(&mp->m_peraglock);
         return -err;
 }
 
diff --git a/fs/xfs/xfs_filestream.h b/fs/xfs/xfs_filestream.h
index 4aba67c5f64f..260f757bbc5d 100644
--- a/fs/xfs/xfs_filestream.h
+++ b/fs/xfs/xfs_filestream.h
@@ -79,12 +79,21 @@ extern ktrace_t *xfs_filestreams_trace_buf;
  * the cache that reference per-ag array elements that have since been
  * reallocated.
  */
+/*
+ * xfs_filestream_peek_ag is only used in tracing code
+ */
 static inline int
 xfs_filestream_peek_ag(
         xfs_mount_t     *mp,
         xfs_agnumber_t  agno)
 {
-        return atomic_read(&mp->m_perag[agno].pagf_fstrms);
+        struct xfs_perag *pag;
+        int             ret;
+
+        pag = xfs_perag_get(mp, agno);
+        ret = atomic_read(&pag->pagf_fstrms);
+        xfs_perag_put(pag);
+        return ret;
 }
 
 static inline int
@@ -92,7 +101,13 @@ xfs_filestream_get_ag(
         xfs_mount_t     *mp,
         xfs_agnumber_t  agno)
 {
-        return atomic_inc_return(&mp->m_perag[agno].pagf_fstrms);
+        struct xfs_perag *pag;
+        int             ret;
+
+        pag = xfs_perag_get(mp, agno);
+        ret = atomic_inc_return(&pag->pagf_fstrms);
+        xfs_perag_put(pag);
+        return ret;
 }
 
 static inline int
@@ -100,7 +115,13 @@ xfs_filestream_put_ag(
         xfs_mount_t     *mp,
         xfs_agnumber_t  agno)
 {
-        return atomic_dec_return(&mp->m_perag[agno].pagf_fstrms);
+        struct xfs_perag *pag;
+        int             ret;
+
+        pag = xfs_perag_get(mp, agno);
+        ret = atomic_dec_return(&pag->pagf_fstrms);
+        xfs_perag_put(pag);
+        return ret;
 }
 
 /* allocation selection flags */
@@ -114,7 +135,6 @@ int xfs_filestream_init(void);
 void xfs_filestream_uninit(void);
 int xfs_filestream_mount(struct xfs_mount *mp);
 void xfs_filestream_unmount(struct xfs_mount *mp);
-void xfs_filestream_flush(struct xfs_mount *mp);
 xfs_agnumber_t xfs_filestream_lookup_ag(struct xfs_inode *ip);
 int xfs_filestream_associate(struct xfs_inode *dip, struct xfs_inode *ip);
 void xfs_filestream_deassociate(struct xfs_inode *ip);
diff --git a/fs/xfs/xfs_fs.h b/fs/xfs/xfs_fs.h
index f52ac276277e..7cf7220e7d5f 100644
--- a/fs/xfs/xfs_fs.h
+++ b/fs/xfs/xfs_fs.h
@@ -292,7 +292,8 @@ typedef struct xfs_bstat {
         __s32           bs_extents;     /* number of extents            */
         __u32           bs_gen;         /* generation count             */
         __u16           bs_projid;      /* project id                   */
-        unsigned char   bs_pad[14];     /* pad space, unused            */
+        __u16           bs_forkoff;     /* inode fork offset in bytes   */
+        unsigned char   bs_pad[12];     /* pad space, unused            */
         __u32           bs_dmevmask;    /* DMIG event mask              */
         __u16           bs_dmstate;     /* DMIG state info              */
         __u16           bs_aextents;    /* attribute number of extents  */
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index a13919a6a364..37a6f62c57b6 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -167,27 +167,14 @@ xfs_growfs_data_private(
         }
         new = nb - mp->m_sb.sb_dblocks;
         oagcount = mp->m_sb.sb_agcount;
-        if (nagcount > oagcount) {
-                void *new_perag, *old_perag;
-
-                xfs_filestream_flush(mp);
-
-                new_perag = kmem_zalloc(sizeof(xfs_perag_t) * nagcount,
-                                        KM_MAYFAIL);
-                if (!new_perag)
-                        return XFS_ERROR(ENOMEM);
-
-                down_write(&mp->m_peraglock);
-                memcpy(new_perag, mp->m_perag, sizeof(xfs_perag_t) * oagcount);
-                old_perag = mp->m_perag;
-                mp->m_perag = new_perag;
-
-                mp->m_flags |= XFS_MOUNT_32BITINODES;
-                nagimax = xfs_initialize_perag(mp, nagcount);
-                up_write(&mp->m_peraglock);
 
-                kmem_free(old_perag);
+        /* allocate the new per-ag structures */
+        if (nagcount > oagcount) {
+                error = xfs_initialize_perag(mp, nagcount, &nagimax);
+                if (error)
+                        return error;
         }
+
         tp = xfs_trans_alloc(mp, XFS_TRANS_GROWFS);
         tp->t_flags |= XFS_TRANS_RESERVE;
         if ((error = xfs_trans_reserve(tp, XFS_GROWFS_SPACE_RES(mp),
@@ -196,6 +183,11 @@ xfs_growfs_data_private(
                 return error;
         }
 
+        /*
+         * Write new AG headers to disk. Non-transactional, but written
+         * synchronously so they are completed prior to the growfs transaction
+         * being logged.
+         */
         nfree = 0;
         for (agno = nagcount - 1; agno >= oagcount; agno--, new -= agsize) {
                 /*
@@ -359,6 +351,12 @@ xfs_growfs_data_private(
                         goto error0;
                 }
         }
+
+        /*
+         * Update changed superblock fields transactionally. These are not
+         * seen by the rest of the world until the transaction commit applies
+         * them atomically to the superblock.
+         */
         if (nagcount > oagcount)
                 xfs_trans_mod_sb(tp, XFS_TRANS_SB_AGCOUNT, nagcount - oagcount);
         if (nb > mp->m_sb.sb_dblocks)
@@ -369,9 +367,9 @@ xfs_growfs_data_private(
         if (dpct)
                 xfs_trans_mod_sb(tp, XFS_TRANS_SB_IMAXPCT, dpct);
         error = xfs_trans_commit(tp, 0);
-        if (error) {
+        if (error)
                 return error;
-        }
+
         /* New allocation groups fully initialized, so update mount struct */
         if (nagimax)
                 mp->m_maxagi = nagimax;
@@ -381,6 +379,8 @@ xfs_growfs_data_private(
                 mp->m_maxicount = icount << mp->m_sb.sb_inopblog;
         } else
                 mp->m_maxicount = 0;
+
+        /* update secondary superblocks. */
         for (agno = 1; agno < nagcount; agno++) {
                 error = xfs_read_buf(mp, mp->m_ddev_targp,
                                   XFS_AGB_TO_DADDR(mp, agno, XFS_SB_BLOCK(mp)),
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index cb907ba69c4c..9d884c127bb9 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -205,7 +205,7 @@ xfs_ialloc_inode_init(
                 d = XFS_AGB_TO_DADDR(mp, agno, agbno + (j * blks_per_cluster));
                 fbuf = xfs_trans_get_buf(tp, mp->m_ddev_targp, d,
                                          mp->m_bsize * blks_per_cluster,
-                                         XFS_BUF_LOCK);
+                                         XBF_LOCK);
                 ASSERT(fbuf);
                 ASSERT(!XFS_BUF_GETERROR(fbuf));
 
@@ -253,6 +253,7 @@ xfs_ialloc_ag_alloc(
         xfs_agino_t     thisino;        /* current inode number, for loop */
         int             isaligned = 0;  /* inode allocation at stripe unit */
                                         /* boundary */
+        struct xfs_perag *pag;
 
         args.tp = tp;
         args.mp = tp->t_mountp;
@@ -382,9 +383,9 @@ xfs_ialloc_ag_alloc(
         newino = XFS_OFFBNO_TO_AGINO(args.mp, args.agbno, 0);
         be32_add_cpu(&agi->agi_count, newlen);
         be32_add_cpu(&agi->agi_freecount, newlen);
-        down_read(&args.mp->m_peraglock);
-        args.mp->m_perag[agno].pagi_freecount += newlen;
-        up_read(&args.mp->m_peraglock);
+        pag = xfs_perag_get(args.mp, agno);
+        pag->pagi_freecount += newlen;
+        xfs_perag_put(pag);
         agi->agi_newino = cpu_to_be32(newino);
 
         /*
@@ -486,9 +487,8 @@ xfs_ialloc_ag_select(
          */
         agno = pagno;
         flags = XFS_ALLOC_FLAG_TRYLOCK;
-        down_read(&mp->m_peraglock);
         for (;;) {
-                pag = &mp->m_perag[agno];
+                pag = xfs_perag_get(mp, agno);
                 if (!pag->pagi_init) {
                         if (xfs_ialloc_read_agi(mp, tp, agno, &agbp)) {
                                 agbp = NULL;
@@ -527,7 +527,7 @@ xfs_ialloc_ag_select(
                                         agbp = NULL;
                                         goto nextag;
                                 }
-                                up_read(&mp->m_peraglock);
+                                xfs_perag_put(pag);
                                 return agbp;
                         }
                 }
@@ -535,22 +535,19 @@ unlock_nextag:
                 if (agbp)
                         xfs_trans_brelse(tp, agbp);
 nextag:
+                xfs_perag_put(pag);
                 /*
                  * No point in iterating over the rest, if we're shutting
                  * down.
                  */
-                if (XFS_FORCED_SHUTDOWN(mp)) {
-                        up_read(&mp->m_peraglock);
+                if (XFS_FORCED_SHUTDOWN(mp))
                         return NULL;
-                }
                 agno++;
                 if (agno >= agcount)
                         agno = 0;
                 if (agno == pagno) {
-                        if (flags == 0) {
-                                up_read(&mp->m_peraglock);
+                        if (flags == 0)
                                 return NULL;
-                        }
                         flags = 0;
                 }
         }
@@ -672,6 +669,7 @@ xfs_dialloc(
         xfs_agnumber_t  tagno;          /* testing allocation group number */
         xfs_btree_cur_t *tcur;          /* temp cursor */
         xfs_inobt_rec_incore_t trec;    /* temp inode allocation record */
+        struct xfs_perag *pag;
 
 
         if (*IO_agbp == NULL) {
@@ -771,13 +769,13 @@ nextag:
                         *inop = NULLFSINO;
                         return noroom ? ENOSPC : 0;
                 }
-                down_read(&mp->m_peraglock);
-                if (mp->m_perag[tagno].pagi_inodeok == 0) {
-                        up_read(&mp->m_peraglock);
+                pag = xfs_perag_get(mp, tagno);
+                if (pag->pagi_inodeok == 0) {
+                        xfs_perag_put(pag);
                         goto nextag;
                 }
                 error = xfs_ialloc_read_agi(mp, tp, tagno, &agbp);
-                up_read(&mp->m_peraglock);
+                xfs_perag_put(pag);
                 if (error)
                         goto nextag;
                 agi = XFS_BUF_TO_AGI(agbp);
@@ -790,6 +788,7 @@ nextag:
          */
         agno = tagno;
         *IO_agbp = NULL;
+        pag = xfs_perag_get(mp, agno);
 
  restart_pagno:
         cur = xfs_inobt_init_cursor(mp, tp, agbp, be32_to_cpu(agi->agi_seqno));
@@ -808,7 +807,6 @@ nextag:
          * If in the same AG as the parent, try to get near the parent.
          */
         if (pagno == agno) {
-                xfs_perag_t     *pag = &mp->m_perag[agno];
                 int             doneleft;       /* done, to the left */
                 int             doneright;      /* done, to the right */
                 int             searchdistance = 10;
@@ -1006,9 +1004,7 @@ alloc_inode:
                 goto error0;
         be32_add_cpu(&agi->agi_freecount, -1);
         xfs_ialloc_log_agi(tp, agbp, XFS_AGI_FREECOUNT);
-        down_read(&mp->m_peraglock);
-        mp->m_perag[tagno].pagi_freecount--;
-        up_read(&mp->m_peraglock);
+        pag->pagi_freecount--;
 
         error = xfs_check_agi_freecount(cur, agi);
         if (error)
@@ -1016,12 +1012,14 @@ alloc_inode:
 
         xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
         xfs_trans_mod_sb(tp, XFS_TRANS_SB_IFREE, -1);
+        xfs_perag_put(pag);
         *inop = ino;
         return 0;
 error1:
         xfs_btree_del_cursor(tcur, XFS_BTREE_ERROR);
 error0:
         xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
+        xfs_perag_put(pag);
         return error;
 }
 
@@ -1052,6 +1050,7 @@ xfs_difree(
         xfs_mount_t     *mp;    /* mount structure for filesystem */
         int             off;    /* offset of inode in inode chunk */
         xfs_inobt_rec_incore_t rec;     /* btree record */
+        struct xfs_perag *pag;
 
         mp = tp->t_mountp;
 
@@ -1088,9 +1087,7 @@ xfs_difree(
         /*
          * Get the allocation group header.
          */
-        down_read(&mp->m_peraglock);
         error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
-        up_read(&mp->m_peraglock);
         if (error) {
                 cmn_err(CE_WARN,
                         "xfs_difree: xfs_ialloc_read_agi() returned an error %d on %s.  Returning error.",
@@ -1157,9 +1154,9 @@ xfs_difree(
                 be32_add_cpu(&agi->agi_count, -ilen);
                 be32_add_cpu(&agi->agi_freecount, -(ilen - 1));
                 xfs_ialloc_log_agi(tp, agbp, XFS_AGI_COUNT | XFS_AGI_FREECOUNT);
-                down_read(&mp->m_peraglock);
-                mp->m_perag[agno].pagi_freecount -= ilen - 1;
-                up_read(&mp->m_peraglock);
+                pag = xfs_perag_get(mp, agno);
+                pag->pagi_freecount -= ilen - 1;
+                xfs_perag_put(pag);
                 xfs_trans_mod_sb(tp, XFS_TRANS_SB_ICOUNT, -ilen);
                 xfs_trans_mod_sb(tp, XFS_TRANS_SB_IFREE, -(ilen - 1));
 
@@ -1188,9 +1185,9 @@ xfs_difree(
                  */
                 be32_add_cpu(&agi->agi_freecount, 1);
                 xfs_ialloc_log_agi(tp, agbp, XFS_AGI_FREECOUNT);
-                down_read(&mp->m_peraglock);
-                mp->m_perag[agno].pagi_freecount++;
-                up_read(&mp->m_peraglock);
+                pag = xfs_perag_get(mp, agno);
+                pag->pagi_freecount++;
+                xfs_perag_put(pag);
                 xfs_trans_mod_sb(tp, XFS_TRANS_SB_IFREE, 1);
         }
 
@@ -1312,9 +1309,7 @@ xfs_imap(
                 xfs_buf_t       *agbp;  /* agi buffer */
                 int             i;      /* temp state */
 
-                down_read(&mp->m_peraglock);
                 error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
-                up_read(&mp->m_peraglock);
                 if (error) {
                         xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
                                         "xfs_ialloc_read_agi() returned "
@@ -1379,7 +1374,6 @@ xfs_imap(
                         XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks));
                 return XFS_ERROR(EINVAL);
         }
-
         return 0;
 }
 
@@ -1523,8 +1517,7 @@ xfs_ialloc_read_agi(
                 return error;
 
         agi = XFS_BUF_TO_AGI(*bpp);
-        pag = &mp->m_perag[agno];
-
+        pag = xfs_perag_get(mp, agno);
         if (!pag->pagi_init) {
                 pag->pagi_freecount = be32_to_cpu(agi->agi_freecount);
                 pag->pagi_count = be32_to_cpu(agi->agi_count);
@@ -1537,6 +1530,7 @@ xfs_ialloc_read_agi(
          */
         ASSERT(pag->pagi_freecount == be32_to_cpu(agi->agi_freecount) ||
                 XFS_FORCED_SHUTDOWN(mp));
+        xfs_perag_put(pag);
         return 0;
 }
 
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index fa402a6bbbcf..6845db90818f 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -73,7 +73,6 @@ xfs_inode_alloc(
         ASSERT(atomic_read(&ip->i_pincount) == 0);
         ASSERT(!spin_is_locked(&ip->i_flags_lock));
         ASSERT(completion_done(&ip->i_flush));
-        ASSERT(!rwsem_is_locked(&ip->i_iolock.mr_lock));
 
         mrlock_init(&ip->i_iolock, MRLOCK_BARRIER, "xfsio", ip->i_ino);
 
@@ -191,13 +190,12 @@ xfs_iget_cache_hit(
                 trace_xfs_iget_reclaim(ip);
 
                 /*
-                 * We need to set XFS_INEW atomically with clearing the
-                 * reclaimable tag so that we do have an indicator of the
-                 * inode still being initialized.
+                 * We need to set XFS_IRECLAIM to prevent xfs_reclaim_inode
+                 * from stomping over us while we recycle the inode.  We can't
+                 * clear the radix tree reclaimable tag yet as it requires
+                 * pag_ici_lock to be held exclusive.
                  */
-                ip->i_flags |= XFS_INEW;
-                ip->i_flags &= ~XFS_IRECLAIMABLE;
-                __xfs_inode_clear_reclaim_tag(mp, pag, ip);
+                ip->i_flags |= XFS_IRECLAIM;
 
                 spin_unlock(&ip->i_flags_lock);
                 read_unlock(&pag->pag_ici_lock);
@@ -217,7 +215,15 @@ xfs_iget_cache_hit(
                         trace_xfs_iget_reclaim(ip);
                         goto out_error;
                 }
+
+                write_lock(&pag->pag_ici_lock);
+                spin_lock(&ip->i_flags_lock);
+                ip->i_flags &= ~(XFS_IRECLAIMABLE | XFS_IRECLAIM);
+                ip->i_flags |= XFS_INEW;
+                __xfs_inode_clear_reclaim_tag(mp, pag, ip);
                 inode->i_state = I_NEW;
+                spin_unlock(&ip->i_flags_lock);
+                write_unlock(&pag->pag_ici_lock);
         } else {
                 /* If the VFS inode is being torn down, pause and try again. */
                 if (!igrab(inode)) {
@@ -375,7 +381,7 @@ xfs_iget(
                 return EINVAL;
 
         /* get the perag structure and ensure that it's inode capable */
-        pag = xfs_get_perag(mp, ino);
+        pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ino));
         if (!pag->pagi_inodeok)
                 return EINVAL;
         ASSERT(pag->pag_ici_init);
@@ -399,7 +405,7 @@ again:
                 if (error)
                         goto out_error_or_again;
         }
-        xfs_put_perag(mp, pag);
+        xfs_perag_put(pag);
 
         *ipp = ip;
 
@@ -418,7 +424,7 @@ out_error_or_again:
                 delay(1);
                 goto again;
         }
-        xfs_put_perag(mp, pag);
+        xfs_perag_put(pag);
         return error;
 }
 
@@ -489,12 +495,12 @@ xfs_ireclaim(
          * added to the tree assert that it's been there before to catch
          * problems with the inode life time early on.
          */
-        pag = xfs_get_perag(mp, ip->i_ino);
+        pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ip->i_ino));
         write_lock(&pag->pag_ici_lock);
         if (!radix_tree_delete(&pag->pag_ici_root, agino))
                 ASSERT(0);
         write_unlock(&pag->pag_ici_lock);
-        xfs_put_perag(mp, pag);
+        xfs_perag_put(pag);
 
         /*
          * Here we do an (almost) spurious inode lock in order to coordinate
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index ce278b3ae7fc..0ffd56447045 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -151,7 +151,7 @@ xfs_imap_to_bp(
                                 "an error %d on %s.  Returning error.",
                                 error, mp->m_fsname);
                 } else {
-                        ASSERT(buf_flags & XFS_BUF_TRYLOCK);
+                        ASSERT(buf_flags & XBF_TRYLOCK);
                 }
                 return error;
         }
@@ -239,7 +239,7 @@ xfs_inotobp(
         if (error)
                 return error;
 
-        error = xfs_imap_to_bp(mp, tp, &imap, &bp, XFS_BUF_LOCK, imap_flags);
+        error = xfs_imap_to_bp(mp, tp, &imap, &bp, XBF_LOCK, imap_flags);
         if (error)
                 return error;
 
@@ -285,7 +285,7 @@ xfs_itobp(
                 return error;
 
         if (!bp) {
-                ASSERT(buf_flags & XFS_BUF_TRYLOCK);
+                ASSERT(buf_flags & XBF_TRYLOCK);
                 ASSERT(tp == NULL);
                 *bpp = NULL;
                 return EAGAIN;
@@ -807,7 +807,7 @@ xfs_iread(
          * Get pointers to the on-disk inode and the buffer containing it.
          */
         error = xfs_imap_to_bp(mp, tp, &ip->i_imap, &bp,
-                               XFS_BUF_LOCK, iget_flags);
+                               XBF_LOCK, iget_flags);
         if (error)
                 return error;
         dip = (xfs_dinode_t *)xfs_buf_offset(bp, ip->i_imap.im_boffset);
@@ -1751,7 +1751,7 @@ xfs_iunlink(
                  * Here we put the head pointer into our next pointer,
                  * and then we fall through to point the head at us.
                  */
-                error = xfs_itobp(mp, tp, ip, &dip, &ibp, XFS_BUF_LOCK);
+                error = xfs_itobp(mp, tp, ip, &dip, &ibp, XBF_LOCK);
                 if (error)
                         return error;
 
@@ -1833,7 +1833,7 @@ xfs_iunlink_remove(
                  * of dealing with the buffer when there is no need to
                  * change it.
                  */
-                error = xfs_itobp(mp, tp, ip, &dip, &ibp, XFS_BUF_LOCK);
+                error = xfs_itobp(mp, tp, ip, &dip, &ibp, XBF_LOCK);
                 if (error) {
                         cmn_err(CE_WARN,
                                 "xfs_iunlink_remove: xfs_itobp()  returned an error %d on %s.  Returning error.",
@@ -1895,7 +1895,7 @@ xfs_iunlink_remove(
                  * Now last_ibp points to the buffer previous to us on
                  * the unlinked list.  Pull us from the list.
                  */
-                error = xfs_itobp(mp, tp, ip, &dip, &ibp, XFS_BUF_LOCK);
+                error = xfs_itobp(mp, tp, ip, &dip, &ibp, XBF_LOCK);
                 if (error) {
                         cmn_err(CE_WARN,
                                 "xfs_iunlink_remove: xfs_itobp()  returned an error %d on %s.  Returning error.",
@@ -1946,8 +1946,9 @@ xfs_ifree_cluster(
         xfs_inode_t             *ip, **ip_found;
         xfs_inode_log_item_t    *iip;
         xfs_log_item_t          *lip;
-        xfs_perag_t             *pag = xfs_get_perag(mp, inum);
+        struct xfs_perag        *pag;
 
+        pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, inum));
         if (mp->m_sb.sb_blocksize >= XFS_INODE_CLUSTER_SIZE(mp)) {
                 blks_per_cluster = 1;
                 ninodes = mp->m_sb.sb_inopblock;
@@ -2039,7 +2040,7 @@ xfs_ifree_cluster(
 
                 bp = xfs_trans_get_buf(tp, mp->m_ddev_targp, blkno, 
                                         mp->m_bsize * blks_per_cluster,
-                                        XFS_BUF_LOCK);
+                                        XBF_LOCK);
 
                 pre_flushed = 0;
                 lip = XFS_BUF_FSPRIVATE(bp, xfs_log_item_t *);
@@ -2088,7 +2089,7 @@ xfs_ifree_cluster(
         }
 
         kmem_free(ip_found);
-        xfs_put_perag(mp, pag);
+        xfs_perag_put(pag);
 }
 
 /*
@@ -2150,7 +2151,7 @@ xfs_ifree(
 
         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
 
-        error = xfs_itobp(ip->i_mount, tp, ip, &dip, &ibp, XFS_BUF_LOCK);
+        error = xfs_itobp(ip->i_mount, tp, ip, &dip, &ibp, XBF_LOCK);
         if (error)
                 return error;
 
@@ -2438,72 +2439,31 @@ xfs_idestroy_fork(
 }
 
 /*
- * Increment the pin count of the given buffer.
- * This value is protected by ipinlock spinlock in the mount structure.
+ * This is called to unpin an inode.  The caller must have the inode locked
+ * in at least shared mode so that the buffer cannot be subsequently pinned
+ * once someone is waiting for it to be unpinned.
  */
-void
-xfs_ipin(
-        xfs_inode_t     *ip)
-{
-        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL));
-
-        atomic_inc(&ip->i_pincount);
-}
-
-/*
- * Decrement the pin count of the given inode, and wake up
- * anyone in xfs_iwait_unpin() if the count goes to 0.  The
- * inode must have been previously pinned with a call to xfs_ipin().
- */
-void
-xfs_iunpin(
-        xfs_inode_t     *ip)
-{
-        ASSERT(atomic_read(&ip->i_pincount) > 0);
-
-        if (atomic_dec_and_test(&ip->i_pincount))
-                wake_up(&ip->i_ipin_wait);
-}
-
-/*
- * This is called to unpin an inode. It can be directed to wait or to return
- * immediately without waiting for the inode to be unpinned.  The caller must
- * have the inode locked in at least shared mode so that the buffer cannot be
- * subsequently pinned once someone is waiting for it to be unpinned.
- */
-STATIC void
-__xfs_iunpin_wait(
-        xfs_inode_t     *ip,
-        int             wait)
+static void
+xfs_iunpin_nowait(
+        struct xfs_inode        *ip)
 {
-        xfs_inode_log_item_t    *iip = ip->i_itemp;
-
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
-        if (atomic_read(&ip->i_pincount) == 0)
-                return;
 
         /* Give the log a push to start the unpinning I/O */
-        xfs_log_force(ip->i_mount, (iip && iip->ili_last_lsn) ?
-                                iip->ili_last_lsn : 0, XFS_LOG_FORCE);
-        if (wait)
-                wait_event(ip->i_ipin_wait, (atomic_read(&ip->i_pincount) == 0));
-}
+        xfs_log_force_lsn(ip->i_mount, ip->i_itemp->ili_last_lsn, 0);
 
-static inline void
-xfs_iunpin_wait(
-        xfs_inode_t     *ip)
-{
-        __xfs_iunpin_wait(ip, 1);
 }
 
-static inline void
-xfs_iunpin_nowait(
-        xfs_inode_t     *ip)
+void
+xfs_iunpin_wait(
+        struct xfs_inode        *ip)
 {
-        __xfs_iunpin_wait(ip, 0);
+        if (xfs_ipincount(ip)) {
+                xfs_iunpin_nowait(ip);
+                wait_event(ip->i_ipin_wait, (xfs_ipincount(ip) == 0));
+        }
 }
 
-
 /*
  * xfs_iextents_copy()
  *
@@ -2675,7 +2635,7 @@ xfs_iflush_cluster(
         xfs_buf_t       *bp)
 {
         xfs_mount_t             *mp = ip->i_mount;
-        xfs_perag_t             *pag = xfs_get_perag(mp, ip->i_ino);
+        struct xfs_perag        *pag;
         unsigned long           first_index, mask;
         unsigned long           inodes_per_cluster;
         int                     ilist_size;
@@ -2686,6 +2646,7 @@ xfs_iflush_cluster(
         int                     bufwasdelwri;
         int                     i;
 
+        pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ip->i_ino));
         ASSERT(pag->pagi_inodeok);
         ASSERT(pag->pag_ici_init);
 
@@ -2693,7 +2654,7 @@ xfs_iflush_cluster(
         ilist_size = inodes_per_cluster * sizeof(xfs_inode_t *);
         ilist = kmem_alloc(ilist_size, KM_MAYFAIL|KM_NOFS);
         if (!ilist)
-                return 0;
+                goto out_put;
 
         mask = ~(((XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog)) - 1);
         first_index = XFS_INO_TO_AGINO(mp, ip->i_ino) & mask;
@@ -2762,6 +2723,8 @@ xfs_iflush_cluster(
 out_free:
         read_unlock(&pag->pag_ici_lock);
         kmem_free(ilist);
+out_put:
+        xfs_perag_put(pag);
         return 0;
 
 
@@ -2805,6 +2768,7 @@ cluster_corrupt_out:
          */
         xfs_iflush_abort(iq);
         kmem_free(ilist);
+        xfs_perag_put(pag);
         return XFS_ERROR(EFSCORRUPTED);
 }
 
@@ -2827,8 +2791,6 @@ xfs_iflush(
         xfs_dinode_t            *dip;
         xfs_mount_t             *mp;
         int                     error;
-        int                     noblock = (flags == XFS_IFLUSH_ASYNC_NOBLOCK);
-        enum { INT_DELWRI = (1 << 0), INT_ASYNC = (1 << 1) };
 
         XFS_STATS_INC(xs_iflush_count);
 
@@ -2841,15 +2803,6 @@ xfs_iflush(
         mp = ip->i_mount;
 
         /*
-         * If the inode isn't dirty, then just release the inode
-         * flush lock and do nothing.
-         */
-        if (xfs_inode_clean(ip)) {
-                xfs_ifunlock(ip);
-                return 0;
-        }
-
-        /*
          * We can't flush the inode until it is unpinned, so wait for it if we
          * are allowed to block.  We know noone new can pin it, because we are
          * holding the inode lock shared and you need to hold it exclusively to
@@ -2860,7 +2813,7 @@ xfs_iflush(
          * in the same cluster are dirty, they will probably write the inode
          * out for us if they occur after the log force completes.
          */
-        if (noblock && xfs_ipincount(ip)) {
+        if (!(flags & SYNC_WAIT) && xfs_ipincount(ip)) {
                 xfs_iunpin_nowait(ip);
                 xfs_ifunlock(ip);
                 return EAGAIN;
@@ -2868,6 +2821,19 @@ xfs_iflush(
         xfs_iunpin_wait(ip);
 
         /*
+         * For stale inodes we cannot rely on the backing buffer remaining
+         * stale in cache for the remaining life of the stale inode and so
+         * xfs_itobp() below may give us a buffer that no longer contains
+         * inodes below. We have to check this after ensuring the inode is
+         * unpinned so that it is safe to reclaim the stale inode after the
+         * flush call.
+         */
+        if (xfs_iflags_test(ip, XFS_ISTALE)) {
+                xfs_ifunlock(ip);
+                return 0;
+        }
+
+        /*
          * This may have been unpinned because the filesystem is shutting
          * down forcibly. If that's the case we must not write this inode
          * to disk, because the log record didn't make it to disk!
@@ -2881,60 +2847,10 @@ xfs_iflush(
         }
 
         /*
-         * Decide how buffer will be flushed out.  This is done before
-         * the call to xfs_iflush_int because this field is zeroed by it.
-         */
-        if (iip != NULL && iip->ili_format.ilf_fields != 0) {
-                /*
-                 * Flush out the inode buffer according to the directions
-                 * of the caller.  In the cases where the caller has given
-                 * us a choice choose the non-delwri case.  This is because
-                 * the inode is in the AIL and we need to get it out soon.
-                 */
-                switch (flags) {
-                case XFS_IFLUSH_SYNC:
-                case XFS_IFLUSH_DELWRI_ELSE_SYNC:
-                        flags = 0;
-                        break;
-                case XFS_IFLUSH_ASYNC_NOBLOCK:
-                case XFS_IFLUSH_ASYNC:
-                case XFS_IFLUSH_DELWRI_ELSE_ASYNC:
-                        flags = INT_ASYNC;
-                        break;
-                case XFS_IFLUSH_DELWRI:
-                        flags = INT_DELWRI;
-                        break;
-                default:
-                        ASSERT(0);
-                        flags = 0;
-                        break;
-                }
-        } else {
-                switch (flags) {
-                case XFS_IFLUSH_DELWRI_ELSE_SYNC:
-                case XFS_IFLUSH_DELWRI_ELSE_ASYNC:
-                case XFS_IFLUSH_DELWRI:
-                        flags = INT_DELWRI;
-                        break;
-                case XFS_IFLUSH_ASYNC_NOBLOCK:
-                case XFS_IFLUSH_ASYNC:
-                        flags = INT_ASYNC;
-                        break;
-                case XFS_IFLUSH_SYNC:
-                        flags = 0;
-                        break;
-                default:
-                        ASSERT(0);
-                        flags = 0;
-                        break;
-                }
-        }
-
-        /*
          * Get the buffer containing the on-disk inode.
          */
         error = xfs_itobp(mp, NULL, ip, &dip, &bp,
-                                noblock ? XFS_BUF_TRYLOCK : XFS_BUF_LOCK);
+                                (flags & SYNC_WAIT) ? XBF_LOCK : XBF_TRYLOCK);
         if (error || !bp) {
                 xfs_ifunlock(ip);
                 return error;
@@ -2952,7 +2868,7 @@ xfs_iflush(
          * get stuck waiting in the write for too long.
          */
         if (XFS_BUF_ISPINNED(bp))
-                xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE);
+                xfs_log_force(mp, 0);
 
         /*
          * inode clustering:
@@ -2962,13 +2878,10 @@ xfs_iflush(
         if (error)
                 goto cluster_corrupt_out;
 
-        if (flags & INT_DELWRI) {
-                xfs_bdwrite(mp, bp);
-        } else if (flags & INT_ASYNC) {
-                error = xfs_bawrite(mp, bp);
-        } else {
+        if (flags & SYNC_WAIT)
                 error = xfs_bwrite(mp, bp);
-        }
+        else
+                xfs_bdwrite(mp, bp);
         return error;
 
 corrupt_out:
@@ -3003,16 +2916,6 @@ xfs_iflush_int(
         iip = ip->i_itemp;
         mp = ip->i_mount;
 
-
-        /*
-         * If the inode isn't dirty, then just release the inode
-         * flush lock and do nothing.
-         */
-        if (xfs_inode_clean(ip)) {
-                xfs_ifunlock(ip);
-                return 0;
-        }
-
         /* set *dip = inode's place in the buffer */
         dip = (xfs_dinode_t *)xfs_buf_offset(bp, ip->i_imap.im_boffset);
 
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index ec1f28c4fc4f..9965e40a4615 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -420,16 +420,6 @@ static inline void xfs_ifunlock(xfs_inode_t *ip)
 #define XFS_ILOCK_DEP(flags)    (((flags) & XFS_ILOCK_DEP_MASK) >> XFS_ILOCK_SHIFT)
 
 /*
- * Flags for xfs_iflush()
- */
-#define XFS_IFLUSH_DELWRI_ELSE_SYNC     1
-#define XFS_IFLUSH_DELWRI_ELSE_ASYNC    2
-#define XFS_IFLUSH_SYNC                 3
-#define XFS_IFLUSH_ASYNC                4
-#define XFS_IFLUSH_DELWRI               5
-#define XFS_IFLUSH_ASYNC_NOBLOCK        6
-
-/*
  * Flags for xfs_itruncate_start().
  */
 #define XFS_ITRUNC_DEFINITE     0x1
@@ -481,14 +471,14 @@ int		xfs_itruncate_finish(struct xfs_trans **, xfs_inode_t *,
 int             xfs_iunlink(struct xfs_trans *, xfs_inode_t *);
 
 void            xfs_iext_realloc(xfs_inode_t *, int, int);
-void            xfs_ipin(xfs_inode_t *);
-void            xfs_iunpin(xfs_inode_t *);
+void            xfs_iunpin_wait(xfs_inode_t *);
 int             xfs_iflush(xfs_inode_t *, uint);
 void            xfs_ichgtime(xfs_inode_t *, int);
 void            xfs_lock_inodes(xfs_inode_t **, int, uint);
 void            xfs_lock_two_inodes(xfs_inode_t *, xfs_inode_t *, uint);
 
 void            xfs_synchronize_times(xfs_inode_t *);
+void            xfs_mark_inode_dirty(xfs_inode_t *);
 void            xfs_mark_inode_dirty_sync(xfs_inode_t *);
 
 #define IHOLD(ip) \
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index f38855d21ea5..7bfea8540159 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -228,7 +228,7 @@ xfs_inode_item_format(
 
         vecp->i_addr = (xfs_caddr_t)&iip->ili_format;
         vecp->i_len  = sizeof(xfs_inode_log_format_t);
-        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IFORMAT);
+        vecp->i_type = XLOG_REG_TYPE_IFORMAT;
         vecp++;
         nvecs        = 1;
 
@@ -279,7 +279,7 @@ xfs_inode_item_format(
 
         vecp->i_addr = (xfs_caddr_t)&ip->i_d;
         vecp->i_len  = sizeof(struct xfs_icdinode);
-        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_ICORE);
+        vecp->i_type = XLOG_REG_TYPE_ICORE;
         vecp++;
         nvecs++;
         iip->ili_format.ilf_fields |= XFS_ILOG_CORE;
@@ -336,7 +336,7 @@ xfs_inode_item_format(
                                 vecp->i_addr =
                                         (char *)(ip->i_df.if_u1.if_extents);
                                 vecp->i_len = ip->i_df.if_bytes;
-                                XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IEXT);
+                                vecp->i_type = XLOG_REG_TYPE_IEXT;
                         } else
 #endif
                         {
@@ -355,7 +355,7 @@ xfs_inode_item_format(
                                 vecp->i_addr = (xfs_caddr_t)ext_buffer;
                                 vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
                                                 XFS_DATA_FORK);
-                                XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IEXT);
+                                vecp->i_type = XLOG_REG_TYPE_IEXT;
                         }
                         ASSERT(vecp->i_len <= ip->i_df.if_bytes);
                         iip->ili_format.ilf_dsize = vecp->i_len;
@@ -373,7 +373,7 @@ xfs_inode_item_format(
                         ASSERT(ip->i_df.if_broot != NULL);
                         vecp->i_addr = (xfs_caddr_t)ip->i_df.if_broot;
                         vecp->i_len = ip->i_df.if_broot_bytes;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IBROOT);
+                        vecp->i_type = XLOG_REG_TYPE_IBROOT;
                         vecp++;
                         nvecs++;
                         iip->ili_format.ilf_dsize = ip->i_df.if_broot_bytes;
@@ -399,7 +399,7 @@ xfs_inode_item_format(
                         ASSERT((ip->i_df.if_real_bytes == 0) ||
                                (ip->i_df.if_real_bytes == data_bytes));
                         vecp->i_len = (int)data_bytes;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_ILOCAL);
+                        vecp->i_type = XLOG_REG_TYPE_ILOCAL;
                         vecp++;
                         nvecs++;
                         iip->ili_format.ilf_dsize = (unsigned)data_bytes;
@@ -477,7 +477,7 @@ xfs_inode_item_format(
                         vecp->i_len = xfs_iextents_copy(ip, ext_buffer,
                                         XFS_ATTR_FORK);
 #endif
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IATTR_EXT);
+                        vecp->i_type = XLOG_REG_TYPE_IATTR_EXT;
                         iip->ili_format.ilf_asize = vecp->i_len;
                         vecp++;
                         nvecs++;
@@ -492,7 +492,7 @@ xfs_inode_item_format(
                         ASSERT(ip->i_afp->if_broot != NULL);
                         vecp->i_addr = (xfs_caddr_t)ip->i_afp->if_broot;
                         vecp->i_len = ip->i_afp->if_broot_bytes;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IATTR_BROOT);
+                        vecp->i_type = XLOG_REG_TYPE_IATTR_BROOT;
                         vecp++;
                         nvecs++;
                         iip->ili_format.ilf_asize = ip->i_afp->if_broot_bytes;
@@ -516,7 +516,7 @@ xfs_inode_item_format(
                         ASSERT((ip->i_afp->if_real_bytes == 0) ||
                                (ip->i_afp->if_real_bytes == data_bytes));
                         vecp->i_len = (int)data_bytes;
-                        XLOG_VEC_SET_TYPE(vecp, XLOG_REG_TYPE_IATTR_LOCAL);
+                        vecp->i_type = XLOG_REG_TYPE_IATTR_LOCAL;
                         vecp++;
                         nvecs++;
                         iip->ili_format.ilf_asize = (unsigned)data_bytes;
@@ -535,23 +535,23 @@ xfs_inode_item_format(
 
 /*
  * This is called to pin the inode associated with the inode log
- * item in memory so it cannot be written out.  Do this by calling
- * xfs_ipin() to bump the pin count in the inode while holding the
- * inode pin lock.
+ * item in memory so it cannot be written out.
  */
 STATIC void
 xfs_inode_item_pin(
         xfs_inode_log_item_t    *iip)
 {
         ASSERT(xfs_isilocked(iip->ili_inode, XFS_ILOCK_EXCL));
-        xfs_ipin(iip->ili_inode);
+
+        atomic_inc(&iip->ili_inode->i_pincount);
 }
 
 
 /*
  * This is called to unpin the inode associated with the inode log
  * item which was previously pinned with a call to xfs_inode_item_pin().
- * Just call xfs_iunpin() on the inode to do this.
+ *
+ * Also wake up anyone in xfs_iunpin_wait() if the count goes to 0.
  */
 /* ARGSUSED */
 STATIC void
@@ -559,7 +559,11 @@ xfs_inode_item_unpin(
         xfs_inode_log_item_t    *iip,
         int                     stale)
 {
-        xfs_iunpin(iip->ili_inode);
+        struct xfs_inode        *ip = iip->ili_inode;
+
+        ASSERT(atomic_read(&ip->i_pincount) > 0);
+        if (atomic_dec_and_test(&ip->i_pincount))
+                wake_up(&ip->i_ipin_wait);
 }
 
 /* ARGSUSED */
@@ -568,7 +572,7 @@ xfs_inode_item_unpin_remove(
         xfs_inode_log_item_t    *iip,
         xfs_trans_t             *tp)
 {
-        xfs_iunpin(iip->ili_inode);
+        xfs_inode_item_unpin(iip, 0);
 }
 
 /*
@@ -602,33 +606,20 @@ xfs_inode_item_trylock(
 
         if (!xfs_iflock_nowait(ip)) {
                 /*
-                 * If someone else isn't already trying to push the inode
-                 * buffer, we get to do it.
+                 * inode has already been flushed to the backing buffer,
+                 * leave it locked in shared mode, pushbuf routine will
+                 * unlock it.
                  */
-                if (iip->ili_pushbuf_flag == 0) {
-                        iip->ili_pushbuf_flag = 1;
-#ifdef DEBUG
-                        iip->ili_push_owner = current_pid();
-#endif
-                        /*
-                         * Inode is left locked in shared mode.
-                         * Pushbuf routine gets to unlock it.
-                         */
-                        return XFS_ITEM_PUSHBUF;
-                } else {
-                        /*
-                         * We hold the AIL lock, so we must specify the
-                         * NONOTIFY flag so that we won't double trip.
-                         */
-                        xfs_iunlock(ip, XFS_ILOCK_SHARED|XFS_IUNLOCK_NONOTIFY);
-                        return XFS_ITEM_FLUSHING;
-                }
-                /* NOTREACHED */
+                return XFS_ITEM_PUSHBUF;
         }
 
         /* Stale items should force out the iclog */
         if (ip->i_flags & XFS_ISTALE) {
                 xfs_ifunlock(ip);
+                /*
+                 * we hold the AIL lock - notify the unlock routine of this
+                 * so it doesn't try to get the lock again.
+                 */
                 xfs_iunlock(ip, XFS_ILOCK_SHARED|XFS_IUNLOCK_NONOTIFY);
                 return XFS_ITEM_PINNED;
         }
@@ -746,11 +737,8 @@ xfs_inode_item_committed(
  * This gets called by xfs_trans_push_ail(), when IOP_TRYLOCK
  * failed to get the inode flush lock but did get the inode locked SHARED.
  * Here we're trying to see if the inode buffer is incore, and if so whether it's
- * marked delayed write. If that's the case, we'll initiate a bawrite on that
- * buffer to expedite the process.
- *
- * We aren't holding the AIL lock (or the flush lock) when this gets called,
- * so it is inherently race-y.
+ * marked delayed write. If that's the case, we'll promote it and that will
+ * allow the caller to write the buffer by triggering the xfsbufd to run.
  */
 STATIC void
 xfs_inode_item_pushbuf(
@@ -759,82 +747,30 @@ xfs_inode_item_pushbuf(
         xfs_inode_t     *ip;
         xfs_mount_t     *mp;
         xfs_buf_t       *bp;
-        uint            dopush;
 
         ip = iip->ili_inode;
-
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_SHARED));
 
         /*
-         * The ili_pushbuf_flag keeps others from
-         * trying to duplicate our effort.
-         */
-        ASSERT(iip->ili_pushbuf_flag != 0);
-        ASSERT(iip->ili_push_owner == current_pid());
-
-        /*
          * If a flush is not in progress anymore, chances are that the
          * inode was taken off the AIL. So, just get out.
          */
         if (completion_done(&ip->i_flush) ||
             ((iip->ili_item.li_flags & XFS_LI_IN_AIL) == 0)) {
-                iip->ili_pushbuf_flag = 0;
                 xfs_iunlock(ip, XFS_ILOCK_SHARED);
                 return;
         }
 
         mp = ip->i_mount;
         bp = xfs_incore(mp->m_ddev_targp, iip->ili_format.ilf_blkno,
-                    iip->ili_format.ilf_len, XFS_INCORE_TRYLOCK);
-
-        if (bp != NULL) {
-                if (XFS_BUF_ISDELAYWRITE(bp)) {
-                        /*
-                         * We were racing with iflush because we don't hold
-                         * the AIL lock or the flush lock. However, at this point,
-                         * we have the buffer, and we know that it's dirty.
-                         * So, it's possible that iflush raced with us, and
-                         * this item is already taken off the AIL.
-                         * If not, we can flush it async.
-                         */
-                        dopush = ((iip->ili_item.li_flags & XFS_LI_IN_AIL) &&
-                                  !completion_done(&ip->i_flush));
-                        iip->ili_pushbuf_flag = 0;
-                        xfs_iunlock(ip, XFS_ILOCK_SHARED);
-
-                        trace_xfs_inode_item_push(bp, _RET_IP_);
+                    iip->ili_format.ilf_len, XBF_TRYLOCK);
 
-                        if (XFS_BUF_ISPINNED(bp)) {
-                                xfs_log_force(mp, (xfs_lsn_t)0,
-                                              XFS_LOG_FORCE);
-                        }
-                        if (dopush) {
-                                int     error;
-                                error = xfs_bawrite(mp, bp);
-                                if (error)
-                                        xfs_fs_cmn_err(CE_WARN, mp,
-                "xfs_inode_item_pushbuf: pushbuf error %d on iip %p, bp %p",
-                                                        error, iip, bp);
-                        } else {
-                                xfs_buf_relse(bp);
-                        }
-                } else {
-                        iip->ili_pushbuf_flag = 0;
-                        xfs_iunlock(ip, XFS_ILOCK_SHARED);
-                        xfs_buf_relse(bp);
-                }
-                return;
-        }
-        /*
-         * We have to be careful about resetting pushbuf flag too early (above).
-         * Even though in theory we can do it as soon as we have the buflock,
-         * we don't want others to be doing work needlessly. They'll come to
-         * this function thinking that pushing the buffer is their
-         * responsibility only to find that the buffer is still locked by
-         * another doing the same thing
-         */
-        iip->ili_pushbuf_flag = 0;
         xfs_iunlock(ip, XFS_ILOCK_SHARED);
+        if (!bp)
+                return;
+        if (XFS_BUF_ISDELAYWRITE(bp))
+                xfs_buf_delwri_promote(bp);
+        xfs_buf_relse(bp);
         return;
 }
 
@@ -867,10 +803,14 @@ xfs_inode_item_push(
                iip->ili_format.ilf_fields != 0);
 
         /*
-         * Write out the inode.  The completion routine ('iflush_done') will
-         * pull it from the AIL, mark it clean, unlock the flush lock.
+         * Push the inode to it's backing buffer. This will not remove the
+         * inode from the AIL - a further push will be required to trigger a
+         * buffer push. However, this allows all the dirty inodes to be pushed
+         * to the buffer before it is pushed to disk. THe buffer IO completion
+         * will pull th einode from the AIL, mark it clean and unlock the flush
+         * lock.
          */
-        (void) xfs_iflush(ip, XFS_IFLUSH_ASYNC);
+        (void) xfs_iflush(ip, 0);
         xfs_iunlock(ip, XFS_ILOCK_SHARED);
 
         return;
@@ -934,7 +874,6 @@ xfs_inode_item_init(
         /*
            We have zeroed memory. No need ...
            iip->ili_extents_buf = NULL;
-           iip->ili_pushbuf_flag = 0;
          */
 
         iip->ili_format.ilf_type = XFS_LI_INODE;
diff --git a/fs/xfs/xfs_inode_item.h b/fs/xfs/xfs_inode_item.h
index cc8df1ac7783..9a467958ecdd 100644
--- a/fs/xfs/xfs_inode_item.h
+++ b/fs/xfs/xfs_inode_item.h
@@ -144,12 +144,6 @@ typedef struct xfs_inode_log_item {
                                                       data exts */
         struct xfs_bmbt_rec     *ili_aextents_buf; /* array of logged
                                                       attr exts */
-        unsigned int            ili_pushbuf_flag;  /* one bit used in push_ail */
-
-#ifdef DEBUG
-        uint64_t                ili_push_owner;    /* one who sets pushbuf_flag
-                                                      above gets to push the buf */
-#endif
 #ifdef XFS_TRANS_DEBUG
         int                     ili_root_size;
         char                    *ili_orig_root;
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 62efab2f3839..b1b801e4a28e 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -106,6 +106,7 @@ xfs_bulkstat_one_iget(
         buf->bs_dmevmask = dic->di_dmevmask;
         buf->bs_dmstate = dic->di_dmstate;
         buf->bs_aextents = dic->di_anextents;
+        buf->bs_forkoff = XFS_IFORK_BOFF(ip);
 
         switch (dic->di_format) {
         case XFS_DINODE_FMT_DEV:
@@ -176,6 +177,7 @@ xfs_bulkstat_one_dinode(
         buf->bs_dmevmask = be32_to_cpu(dic->di_dmevmask);
         buf->bs_dmstate = be16_to_cpu(dic->di_dmstate);
         buf->bs_aextents = be16_to_cpu(dic->di_anextents);
+        buf->bs_forkoff = XFS_DFORK_BOFF(dic);
 
         switch (dic->di_format) {
         case XFS_DINODE_FMT_DEV:
@@ -408,8 +410,10 @@ xfs_bulkstat(
                 (XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog);
         nimask = ~(nicluster - 1);
         nbcluster = nicluster >> mp->m_sb.sb_inopblog;
-        irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4,
-                                   KM_SLEEP | KM_MAYFAIL | KM_LARGE);
+        irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4);
+        if (!irbuf)
+                return ENOMEM;
+
         nirbuf = irbsize / sizeof(*irbuf);
 
         /*
@@ -420,9 +424,7 @@ xfs_bulkstat(
         while (XFS_BULKSTAT_UBLEFT(ubleft) && agno < mp->m_sb.sb_agcount) {
                 cond_resched();
                 bp = NULL;
-                down_read(&mp->m_peraglock);
                 error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
-                up_read(&mp->m_peraglock);
                 if (error) {
                         /*
                          * Skip this allocation group and go to the next one.
@@ -729,7 +731,7 @@ xfs_bulkstat(
         /*
          * Done, we're either out of filesystem or space to put the data.
          */
-        kmem_free(irbuf);
+        kmem_free_large(irbuf);
         *ubcountp = ubelem;
         /*
          * Found some inodes, return them now and return the error next time.
@@ -849,9 +851,7 @@ xfs_inumbers(
         agbp = NULL;
         while (left > 0 && agno < mp->m_sb.sb_agcount) {
                 if (agbp == NULL) {
-                        down_read(&mp->m_peraglock);
                         error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
-                        up_read(&mp->m_peraglock);
                         if (error) {
                                 /*
                                  * If we can't read the AGI of this ag,
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 600b5b06aaeb..2be019136287 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -50,7 +50,6 @@ kmem_zone_t	*xfs_log_ticket_zone;
           (off) += (bytes);}
 
 /* Local miscellaneous function prototypes */
-STATIC int       xlog_bdstrat_cb(struct xfs_buf *);
 STATIC int       xlog_commit_record(xfs_mount_t *mp, xlog_ticket_t *ticket,
                                     xlog_in_core_t **, xfs_lsn_t *);
 STATIC xlog_t *  xlog_alloc_log(xfs_mount_t     *mp,
@@ -61,7 +60,7 @@ STATIC int	 xlog_space_left(xlog_t *log, int cycle, int bytes);
 STATIC int       xlog_sync(xlog_t *log, xlog_in_core_t *iclog);
 STATIC void      xlog_dealloc_log(xlog_t *log);
 STATIC int       xlog_write(xfs_mount_t *mp, xfs_log_iovec_t region[],
-                            int nentries, xfs_log_ticket_t tic,
+                            int nentries, struct xlog_ticket *tic,
                             xfs_lsn_t *start_lsn,
                             xlog_in_core_t **commit_iclog,
                             uint flags);
@@ -80,11 +79,6 @@ STATIC int  xlog_state_release_iclog(xlog_t		*log,
 STATIC void xlog_state_switch_iclogs(xlog_t             *log,
                                      xlog_in_core_t *iclog,
                                      int                eventual_size);
-STATIC int  xlog_state_sync(xlog_t                      *log,
-                            xfs_lsn_t                   lsn,
-                            uint                        flags,
-                            int                         *log_flushed);
-STATIC int  xlog_state_sync_all(xlog_t *log, uint flags, int *log_flushed);
 STATIC void xlog_state_want_sync(xlog_t *log, xlog_in_core_t *iclog);
 
 /* local functions to manipulate grant head */
@@ -249,14 +243,14 @@ xlog_tic_add_region(xlog_ticket_t *tic, uint len, uint type)
  * out when the next write occurs.
  */
 xfs_lsn_t
-xfs_log_done(xfs_mount_t        *mp,
-             xfs_log_ticket_t   xtic,
-             void               **iclog,
-             uint               flags)
+xfs_log_done(
+        struct xfs_mount        *mp,
+        struct xlog_ticket      *ticket,
+        struct xlog_in_core     **iclog,
+        uint                    flags)
 {
-        xlog_t          *log    = mp->m_log;
-        xlog_ticket_t   *ticket = (xfs_log_ticket_t) xtic;
-        xfs_lsn_t       lsn     = 0;
+        struct log              *log = mp->m_log;
+        xfs_lsn_t               lsn = 0;
 
         if (XLOG_FORCED_SHUTDOWN(log) ||
             /*
@@ -264,8 +258,7 @@ xfs_log_done(xfs_mount_t	*mp,
              * If we get an error, just continue and give back the log ticket.
              */
             (((ticket->t_flags & XLOG_TIC_INITED) == 0) &&
-             (xlog_commit_record(mp, ticket,
-                                 (xlog_in_core_t **)iclog, &lsn)))) {
+             (xlog_commit_record(mp, ticket, iclog, &lsn)))) {
                 lsn = (xfs_lsn_t) -1;
                 if (ticket->t_flags & XLOG_TIC_PERM_RESERV) {
                         flags |= XFS_LOG_REL_PERM_RESERV;
@@ -295,67 +288,8 @@ xfs_log_done(xfs_mount_t	*mp,
         }
 
         return lsn;
-}       /* xfs_log_done */
-
-
-/*
- * Force the in-core log to disk.  If flags == XFS_LOG_SYNC,
- *      the force is done synchronously.
- *
- * Asynchronous forces are implemented by setting the WANT_SYNC
- * bit in the appropriate in-core log and then returning.
- *
- * Synchronous forces are implemented with a signal variable. All callers
- * to force a given lsn to disk will wait on a the sv attached to the
- * specific in-core log.  When given in-core log finally completes its
- * write to disk, that thread will wake up all threads waiting on the
- * sv.
- */
-int
-_xfs_log_force(
-        xfs_mount_t     *mp,
-        xfs_lsn_t       lsn,
-        uint            flags,
-        int             *log_flushed)
-{
-        xlog_t          *log = mp->m_log;
-        int             dummy;
-
-        if (!log_flushed)
-                log_flushed = &dummy;
-
-        ASSERT(flags & XFS_LOG_FORCE);
-
-        XFS_STATS_INC(xs_log_force);
-
-        if (log->l_flags & XLOG_IO_ERROR)
-                return XFS_ERROR(EIO);
-        if (lsn == 0)
-                return xlog_state_sync_all(log, flags, log_flushed);
-        else
-                return xlog_state_sync(log, lsn, flags, log_flushed);
-}       /* _xfs_log_force */
-
-/*
- * Wrapper for _xfs_log_force(), to be used when caller doesn't care
- * about errors or whether the log was flushed or not. This is the normal
- * interface to use when trying to unpin items or move the log forward.
- */
-void
-xfs_log_force(
-        xfs_mount_t     *mp,
-        xfs_lsn_t       lsn,
-        uint            flags)
-{
-        int     error;
-        error = _xfs_log_force(mp, lsn, flags, NULL);
-        if (error) {
-                xfs_fs_cmn_err(CE_WARN, mp, "xfs_log_force: "
-                        "error %d returned.", error);
-        }
 }
 
-
 /*
  * Attaches a new iclog I/O completion callback routine during
  * transaction commit.  If the log is in error state, a non-zero
@@ -363,11 +297,11 @@ xfs_log_force(
  * executing the callback at an appropriate time.
  */
 int
-xfs_log_notify(xfs_mount_t        *mp,          /* mount of partition */
-               void               *iclog_hndl,  /* iclog to hang callback off */
-               xfs_log_callback_t *cb)
+xfs_log_notify(
+        struct xfs_mount        *mp,
+        struct xlog_in_core     *iclog,
+        xfs_log_callback_t      *cb)
 {
-        xlog_in_core_t    *iclog = (xlog_in_core_t *)iclog_hndl;
         int     abortflg;
 
         spin_lock(&iclog->ic_callback_lock);
@@ -381,16 +315,14 @@ xfs_log_notify(xfs_mount_t	  *mp,		/* mount of partition */
         }
         spin_unlock(&iclog->ic_callback_lock);
         return abortflg;
-}       /* xfs_log_notify */
+}
 
 int
-xfs_log_release_iclog(xfs_mount_t *mp,
-                      void        *iclog_hndl)
+xfs_log_release_iclog(
+        struct xfs_mount        *mp,
+        struct xlog_in_core     *iclog)
 {
-        xlog_t *log = mp->m_log;
-        xlog_in_core_t    *iclog = (xlog_in_core_t *)iclog_hndl;
-
-        if (xlog_state_release_iclog(log, iclog)) {
+        if (xlog_state_release_iclog(mp->m_log, iclog)) {
                 xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR);
                 return EIO;
         }
@@ -409,17 +341,18 @@ xfs_log_release_iclog(xfs_mount_t *mp,
  * reservation, we prevent over allocation problems.
  */
 int
-xfs_log_reserve(xfs_mount_t      *mp,
-                int              unit_bytes,
-                int              cnt,
-                xfs_log_ticket_t *ticket,
-                __uint8_t        client,
-                uint             flags,
-                uint             t_type)
+xfs_log_reserve(
+        struct xfs_mount        *mp,
+        int                     unit_bytes,
+        int                     cnt,
+        struct xlog_ticket      **ticket,
+        __uint8_t               client,
+        uint                    flags,
+        uint                    t_type)
 {
-        xlog_t          *log = mp->m_log;
-        xlog_ticket_t   *internal_ticket;
-        int             retval = 0;
+        struct log              *log = mp->m_log;
+        struct xlog_ticket      *internal_ticket;
+        int                     retval = 0;
 
         ASSERT(client == XFS_TRANSACTION || client == XFS_LOG);
         ASSERT((flags & XFS_LOG_NOSLEEP) == 0);
@@ -432,7 +365,7 @@ xfs_log_reserve(xfs_mount_t	 *mp,
 
         if (*ticket != NULL) {
                 ASSERT(flags & XFS_LOG_PERM_RESERV);
-                internal_ticket = (xlog_ticket_t *)*ticket;
+                internal_ticket = *ticket;
 
                 trace_xfs_log_reserve(log, internal_ticket);
 
@@ -584,7 +517,7 @@ xfs_log_unmount_write(xfs_mount_t *mp)
         xlog_in_core_t   *first_iclog;
 #endif
         xfs_log_iovec_t  reg[1];
-        xfs_log_ticket_t tic = NULL;
+        xlog_ticket_t   *tic = NULL;
         xfs_lsn_t        lsn;
         int              error;
 
@@ -602,7 +535,7 @@ xfs_log_unmount_write(xfs_mount_t *mp)
         if (mp->m_flags & XFS_MOUNT_RDONLY)
                 return 0;
 
-        error = _xfs_log_force(mp, 0, XFS_LOG_FORCE|XFS_LOG_SYNC, NULL);
+        error = _xfs_log_force(mp, XFS_LOG_SYNC, NULL);
         ASSERT(error || !(XLOG_FORCED_SHUTDOWN(log)));
 
 #ifdef DEBUG
@@ -618,7 +551,7 @@ xfs_log_unmount_write(xfs_mount_t *mp)
         if (! (XLOG_FORCED_SHUTDOWN(log))) {
                 reg[0].i_addr = (void*)&magic;
                 reg[0].i_len  = sizeof(magic);
-                XLOG_VEC_SET_TYPE(&reg[0], XLOG_REG_TYPE_UNMOUNT);
+                reg[0].i_type = XLOG_REG_TYPE_UNMOUNT;
 
                 error = xfs_log_reserve(mp, 600, 1, &tic,
                                         XFS_LOG, 0, XLOG_UNMOUNT_REC_TYPE);
@@ -721,24 +654,24 @@ xfs_log_unmount(xfs_mount_t *mp)
  * transaction occur with one call to xfs_log_write().
  */
 int
-xfs_log_write(xfs_mount_t *     mp,
-              xfs_log_iovec_t   reg[],
-              int               nentries,
-              xfs_log_ticket_t  tic,
-              xfs_lsn_t         *start_lsn)
+xfs_log_write(
+        struct xfs_mount        *mp,
+        struct xfs_log_iovec    reg[],
+        int                     nentries,
+        struct xlog_ticket      *tic,
+        xfs_lsn_t               *start_lsn)
 {
-        int     error;
-        xlog_t *log = mp->m_log;
+        struct log              *log = mp->m_log;
+        int                     error;
 
         if (XLOG_FORCED_SHUTDOWN(log))
                 return XFS_ERROR(EIO);
 
-        if ((error = xlog_write(mp, reg, nentries, tic, start_lsn, NULL, 0))) {
+        error = xlog_write(mp, reg, nentries, tic, start_lsn, NULL, 0);
+        if (error)
                 xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR);
-        }
         return error;
-}       /* xfs_log_write */
-
+}
 
 void
 xfs_log_move_tail(xfs_mount_t   *mp,
@@ -812,9 +745,16 @@ xfs_log_move_tail(xfs_mount_t	*mp,
 
 /*
  * Determine if we have a transaction that has gone to disk
- * that needs to be covered. Log activity needs to be idle (no AIL and
- * nothing in the iclogs). And, we need to be in the right state indicating
- * something has gone out.
+ * that needs to be covered. To begin the transition to the idle state
+ * firstly the log needs to be idle (no AIL and nothing in the iclogs).
+ * If we are then in a state where covering is needed, the caller is informed
+ * that dummy transactions are required to move the log into the idle state.
+ *
+ * Because this is called as part of the sync process, we should also indicate
+ * that dummy transactions should be issued in anything but the covered or
+ * idle states. This ensures that the log tail is accurately reflected in
+ * the log at the end of the sync, hence if a crash occurrs avoids replay
+ * of transactions where the metadata is already on disk.
  */
 int
 xfs_log_need_covered(xfs_mount_t *mp)
@@ -826,17 +766,24 @@ xfs_log_need_covered(xfs_mount_t *mp)
                 return 0;
 
         spin_lock(&log->l_icloglock);
-        if (((log->l_covered_state == XLOG_STATE_COVER_NEED) ||
-                (log->l_covered_state == XLOG_STATE_COVER_NEED2))
-                        && !xfs_trans_ail_tail(log->l_ailp)
-                        && xlog_iclogs_empty(log)) {
-                if (log->l_covered_state == XLOG_STATE_COVER_NEED)
-                        log->l_covered_state = XLOG_STATE_COVER_DONE;
-                else {
-                        ASSERT(log->l_covered_state == XLOG_STATE_COVER_NEED2);
-                        log->l_covered_state = XLOG_STATE_COVER_DONE2;
+        switch (log->l_covered_state) {
+        case XLOG_STATE_COVER_DONE:
+        case XLOG_STATE_COVER_DONE2:
+        case XLOG_STATE_COVER_IDLE:
+                break;
+        case XLOG_STATE_COVER_NEED:
+        case XLOG_STATE_COVER_NEED2:
+                if (!xfs_trans_ail_tail(log->l_ailp) &&
+                    xlog_iclogs_empty(log)) {
+                        if (log->l_covered_state == XLOG_STATE_COVER_NEED)
+                                log->l_covered_state = XLOG_STATE_COVER_DONE;
+                        else
+                                log->l_covered_state = XLOG_STATE_COVER_DONE2;
                 }
+                /* FALLTHRU */
+        default:
                 needed = 1;
+                break;
         }
         spin_unlock(&log->l_icloglock);
         return needed;
@@ -988,35 +935,6 @@ xlog_iodone(xfs_buf_t *bp)
 }       /* xlog_iodone */
 
 /*
- * The bdstrat callback function for log bufs. This gives us a central
- * place to trap bufs in case we get hit by a log I/O error and need to
- * shutdown. Actually, in practice, even when we didn't get a log error,
- * we transition the iclogs to IOERROR state *after* flushing all existing
- * iclogs to disk. This is because we don't want anymore new transactions to be
- * started or completed afterwards.
- */
-STATIC int
-xlog_bdstrat_cb(struct xfs_buf *bp)
-{
-        xlog_in_core_t *iclog;
-
-        iclog = XFS_BUF_FSPRIVATE(bp, xlog_in_core_t *);
-
-        if ((iclog->ic_state & XLOG_STATE_IOERROR) == 0) {
-          /* note for irix bstrat will need  struct bdevsw passed
-           * Fix the following macro if the code ever is merged
-           */
-            XFS_bdstrat(bp);
-                return 0;
-        }
-
-        XFS_BUF_ERROR(bp, EIO);
-        XFS_BUF_STALE(bp);
-        xfs_biodone(bp);
-        return XFS_ERROR(EIO);
-}
-
-/*
  * Return size of each in-core log record buffer.
  *
  * All machines get 8 x 32kB buffers by default, unless tuned otherwise.
@@ -1158,7 +1076,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
         if (!bp)
                 goto out_free_log;
         XFS_BUF_SET_IODONE_FUNC(bp, xlog_iodone);
-        XFS_BUF_SET_BDSTRAT_FUNC(bp, xlog_bdstrat_cb);
         XFS_BUF_SET_FSPRIVATE2(bp, (unsigned long)1);
         ASSERT(XFS_BUF_ISBUSY(bp));
         ASSERT(XFS_BUF_VALUSEMA(bp) <= 0);
@@ -1196,7 +1113,6 @@ xlog_alloc_log(xfs_mount_t	*mp,
                 if (!XFS_BUF_CPSEMA(bp))
                         ASSERT(0);
                 XFS_BUF_SET_IODONE_FUNC(bp, xlog_iodone);
-                XFS_BUF_SET_BDSTRAT_FUNC(bp, xlog_bdstrat_cb);
                 XFS_BUF_SET_FSPRIVATE2(bp, (unsigned long)1);
                 iclog->ic_bp = bp;
                 iclog->ic_data = bp->b_addr;
@@ -1268,7 +1184,7 @@ xlog_commit_record(xfs_mount_t  *mp,
 
         reg[0].i_addr = NULL;
         reg[0].i_len = 0;
-        XLOG_VEC_SET_TYPE(&reg[0], XLOG_REG_TYPE_COMMIT);
+        reg[0].i_type = XLOG_REG_TYPE_COMMIT;
 
         ASSERT_ALWAYS(iclog);
         if ((error = xlog_write(mp, reg, 1, ticket, commitlsnp,
@@ -1343,6 +1259,37 @@ xlog_grant_push_ail(xfs_mount_t	*mp,
             xfs_trans_ail_push(log->l_ailp, threshold_lsn);
 }       /* xlog_grant_push_ail */
 
+/*
+ * The bdstrat callback function for log bufs. This gives us a central
+ * place to trap bufs in case we get hit by a log I/O error and need to
+ * shutdown. Actually, in practice, even when we didn't get a log error,
+ * we transition the iclogs to IOERROR state *after* flushing all existing
+ * iclogs to disk. This is because we don't want anymore new transactions to be
+ * started or completed afterwards.
+ */
+STATIC int
+xlog_bdstrat(
+        struct xfs_buf          *bp)
+{
+        struct xlog_in_core     *iclog;
+
+        iclog = XFS_BUF_FSPRIVATE(bp, xlog_in_core_t *);
+        if (iclog->ic_state & XLOG_STATE_IOERROR) {
+                XFS_BUF_ERROR(bp, EIO);
+                XFS_BUF_STALE(bp);
+                xfs_biodone(bp);
+                /*
+                 * It would seem logical to return EIO here, but we rely on
+                 * the log state machine to propagate I/O errors instead of
+                 * doing it here.
+                 */
+                return 0;
+        }
+
+        bp->b_flags |= _XBF_RUN_QUEUES;
+        xfs_buf_iorequest(bp);
+        return 0;
+}
 
 /*
  * Flush out the in-core log (iclog) to the on-disk log in an asynchronous 
@@ -1462,7 +1409,7 @@ xlog_sync(xlog_t		*log,
          */
         XFS_BUF_WRITE(bp);
 
-        if ((error = XFS_bwrite(bp))) {
+        if ((error = xlog_bdstrat(bp))) {
                 xfs_ioerror_alert("xlog_sync", log->l_mp, bp,
                                   XFS_BUF_ADDR(bp));
                 return error;
@@ -1502,7 +1449,7 @@ xlog_sync(xlog_t		*log,
                 /* account for internal log which doesn't start at block #0 */
                 XFS_BUF_SET_ADDR(bp, XFS_BUF_ADDR(bp) + log->l_logBBstart);
                 XFS_BUF_WRITE(bp);
-                if ((error = XFS_bwrite(bp))) {
+                if ((error = xlog_bdstrat(bp))) {
                         xfs_ioerror_alert("xlog_sync (split)", log->l_mp,
                                           bp, XFS_BUF_ADDR(bp));
                         return error;
@@ -1707,16 +1654,16 @@ xlog_print_tic_res(xfs_mount_t *mp, xlog_ticket_t *ticket)
  *      bytes have been written out.
  */
 STATIC int
-xlog_write(xfs_mount_t *        mp,
-           xfs_log_iovec_t      reg[],
-           int                  nentries,
-           xfs_log_ticket_t     tic,
-           xfs_lsn_t            *start_lsn,
-           xlog_in_core_t       **commit_iclog,
-           uint                 flags)
+xlog_write(
+        struct xfs_mount        *mp,
+        struct xfs_log_iovec    reg[],
+        int                     nentries,
+        struct xlog_ticket      *ticket,
+        xfs_lsn_t               *start_lsn,
+        struct xlog_in_core     **commit_iclog,
+        uint                    flags)
 {
     xlog_t           *log = mp->m_log;
-    xlog_ticket_t    *ticket = (xlog_ticket_t *)tic;
     xlog_in_core_t   *iclog = NULL;  /* ptr to current in-core log */
     xlog_op_header_t *logop_head;    /* ptr to log operation header */
     __psint_t        ptr;            /* copy address into data region */
@@ -1830,7 +1777,7 @@ xlog_write(xfs_mount_t *	mp,
             default:
                 xfs_fs_cmn_err(CE_WARN, mp,
                     "Bad XFS transaction clientid 0x%x in ticket 0x%p",
-                    logop_head->oh_clientid, tic);
+                    logop_head->oh_clientid, ticket);
                 return XFS_ERROR(EIO);
             }
 
@@ -2854,7 +2801,6 @@ xlog_state_switch_iclogs(xlog_t		*log,
         log->l_iclog = iclog->ic_next;
 }       /* xlog_state_switch_iclogs */
 
-
 /*
  * Write out all data in the in-core log as of this exact moment in time.
  *
@@ -2882,11 +2828,17 @@ xlog_state_switch_iclogs(xlog_t		*log,
  *         b) when we return from flushing out this iclog, it is still
  *              not in the active nor dirty state.
  */
-STATIC int
-xlog_state_sync_all(xlog_t *log, uint flags, int *log_flushed)
+int
+_xfs_log_force(
+        struct xfs_mount        *mp,
+        uint                    flags,
+        int                     *log_flushed)
 {
-        xlog_in_core_t  *iclog;
-        xfs_lsn_t       lsn;
+        struct log              *log = mp->m_log;
+        struct xlog_in_core     *iclog;
+        xfs_lsn_t               lsn;
+
+        XFS_STATS_INC(xs_log_force);
 
         spin_lock(&log->l_icloglock);
 
@@ -2932,7 +2884,9 @@ xlog_state_sync_all(xlog_t *log, uint flags, int *log_flushed)
 
                                 if (xlog_state_release_iclog(log, iclog))
                                         return XFS_ERROR(EIO);
-                                *log_flushed = 1;
+
+                                if (log_flushed)
+                                        *log_flushed = 1;
                                 spin_lock(&log->l_icloglock);
                                 if (be64_to_cpu(iclog->ic_header.h_lsn) == lsn &&
                                     iclog->ic_state != XLOG_STATE_DIRTY)
@@ -2976,19 +2930,37 @@ maybe_sleep:
                  */
                 if (iclog->ic_state & XLOG_STATE_IOERROR)
                         return XFS_ERROR(EIO);
-                *log_flushed = 1;
-
+                if (log_flushed)
+                        *log_flushed = 1;
         } else {
 
 no_sleep:
                 spin_unlock(&log->l_icloglock);
         }
         return 0;
-}       /* xlog_state_sync_all */
+}
+
+/*
+ * Wrapper for _xfs_log_force(), to be used when caller doesn't care
+ * about errors or whether the log was flushed or not. This is the normal
+ * interface to use when trying to unpin items or move the log forward.
+ */
+void
+xfs_log_force(
+        xfs_mount_t     *mp,
+        uint            flags)
+{
+        int     error;
 
+        error = _xfs_log_force(mp, flags, NULL);
+        if (error) {
+                xfs_fs_cmn_err(CE_WARN, mp, "xfs_log_force: "
+                        "error %d returned.", error);
+        }
+}
 
 /*
- * Used by code which implements synchronous log forces.
+ * Force the in-core log to disk for a specific LSN.
  *
  * Find in-core log with lsn.
  *      If it is in the DIRTY state, just return.
@@ -2996,109 +2968,142 @@ no_sleep:
  *              state and go to sleep or return.
  *      If it is in any other state, go to sleep or return.
  *
- * If filesystem activity goes to zero, the iclog will get flushed only by
- * bdflush().
+ * Synchronous forces are implemented with a signal variable. All callers
+ * to force a given lsn to disk will wait on a the sv attached to the
+ * specific in-core log.  When given in-core log finally completes its
+ * write to disk, that thread will wake up all threads waiting on the
+ * sv.
  */
-STATIC int
-xlog_state_sync(xlog_t    *log,
-                xfs_lsn_t lsn,
-                uint      flags,
-                int       *log_flushed)
+int
+_xfs_log_force_lsn(
+        struct xfs_mount        *mp,
+        xfs_lsn_t               lsn,
+        uint                    flags,
+        int                     *log_flushed)
 {
-    xlog_in_core_t      *iclog;
-    int                 already_slept = 0;
+        struct log              *log = mp->m_log;
+        struct xlog_in_core     *iclog;
+        int                     already_slept = 0;
 
-try_again:
-    spin_lock(&log->l_icloglock);
-    iclog = log->l_iclog;
+        ASSERT(lsn != 0);
 
-    if (iclog->ic_state & XLOG_STATE_IOERROR) {
-            spin_unlock(&log->l_icloglock);
-            return XFS_ERROR(EIO);
-    }
-
-    do {
-        if (be64_to_cpu(iclog->ic_header.h_lsn) != lsn) {
-                iclog = iclog->ic_next;
-                continue;
-        }
+        XFS_STATS_INC(xs_log_force);
 
-        if (iclog->ic_state == XLOG_STATE_DIRTY) {
+try_again:
+        spin_lock(&log->l_icloglock);
+        iclog = log->l_iclog;
+        if (iclog->ic_state & XLOG_STATE_IOERROR) {
                 spin_unlock(&log->l_icloglock);
-                return 0;
+                return XFS_ERROR(EIO);
         }
 
-        if (iclog->ic_state == XLOG_STATE_ACTIVE) {
-                /*
-                 * We sleep here if we haven't already slept (e.g.
-                 * this is the first time we've looked at the correct
-                 * iclog buf) and the buffer before us is going to
-                 * be sync'ed. The reason for this is that if we
-                 * are doing sync transactions here, by waiting for
-                 * the previous I/O to complete, we can allow a few
-                 * more transactions into this iclog before we close
-                 * it down.
-                 *
-                 * Otherwise, we mark the buffer WANT_SYNC, and bump
-                 * up the refcnt so we can release the log (which drops
-                 * the ref count).  The state switch keeps new transaction
-                 * commits from using this buffer.  When the current commits
-                 * finish writing into the buffer, the refcount will drop to
-                 * zero and the buffer will go out then.
-                 */
-                if (!already_slept &&
-                    (iclog->ic_prev->ic_state & (XLOG_STATE_WANT_SYNC |
-                                                 XLOG_STATE_SYNCING))) {
-                        ASSERT(!(iclog->ic_state & XLOG_STATE_IOERROR));
-                        XFS_STATS_INC(xs_log_force_sleep);
-                        sv_wait(&iclog->ic_prev->ic_write_wait, PSWP,
-                                &log->l_icloglock, s);
-                        *log_flushed = 1;
-                        already_slept = 1;
-                        goto try_again;
-                } else {
+        do {
+                if (be64_to_cpu(iclog->ic_header.h_lsn) != lsn) {
+                        iclog = iclog->ic_next;
+                        continue;
+                }
+
+                if (iclog->ic_state == XLOG_STATE_DIRTY) {
+                        spin_unlock(&log->l_icloglock);
+                        return 0;
+                }
+
+                if (iclog->ic_state == XLOG_STATE_ACTIVE) {
+                        /*
+                         * We sleep here if we haven't already slept (e.g.
+                         * this is the first time we've looked at the correct
+                         * iclog buf) and the buffer before us is going to
+                         * be sync'ed. The reason for this is that if we
+                         * are doing sync transactions here, by waiting for
+                         * the previous I/O to complete, we can allow a few
+                         * more transactions into this iclog before we close
+                         * it down.
+                         *
+                         * Otherwise, we mark the buffer WANT_SYNC, and bump
+                         * up the refcnt so we can release the log (which
+                         * drops the ref count).  The state switch keeps new
+                         * transaction commits from using this buffer.  When
+                         * the current commits finish writing into the buffer,
+                         * the refcount will drop to zero and the buffer will
+                         * go out then.
+                         */
+                        if (!already_slept &&
+                            (iclog->ic_prev->ic_state &
+                             (XLOG_STATE_WANT_SYNC | XLOG_STATE_SYNCING))) {
+                                ASSERT(!(iclog->ic_state & XLOG_STATE_IOERROR));
+
+                                XFS_STATS_INC(xs_log_force_sleep);
+
+                                sv_wait(&iclog->ic_prev->ic_write_wait,
+                                        PSWP, &log->l_icloglock, s);
+                                if (log_flushed)
+                                        *log_flushed = 1;
+                                already_slept = 1;
+                                goto try_again;
+                        }
                         atomic_inc(&iclog->ic_refcnt);
                         xlog_state_switch_iclogs(log, iclog, 0);
                         spin_unlock(&log->l_icloglock);
                         if (xlog_state_release_iclog(log, iclog))
                                 return XFS_ERROR(EIO);
-                        *log_flushed = 1;
+                        if (log_flushed)
+                                *log_flushed = 1;
                         spin_lock(&log->l_icloglock);
                 }
-        }
 
-        if ((flags & XFS_LOG_SYNC) && /* sleep */
-            !(iclog->ic_state & (XLOG_STATE_ACTIVE | XLOG_STATE_DIRTY))) {
+                if ((flags & XFS_LOG_SYNC) && /* sleep */
+                    !(iclog->ic_state &
+                      (XLOG_STATE_ACTIVE | XLOG_STATE_DIRTY))) {
+                        /*
+                         * Don't wait on completion if we know that we've
+                         * gotten a log write error.
+                         */
+                        if (iclog->ic_state & XLOG_STATE_IOERROR) {
+                                spin_unlock(&log->l_icloglock);
+                                return XFS_ERROR(EIO);
+                        }
+                        XFS_STATS_INC(xs_log_force_sleep);
+                        sv_wait(&iclog->ic_force_wait, PSWP, &log->l_icloglock, s);
+                        /*
+                         * No need to grab the log lock here since we're
+                         * only deciding whether or not to return EIO
+                         * and the memory read should be atomic.
+                         */
+                        if (iclog->ic_state & XLOG_STATE_IOERROR)
+                                return XFS_ERROR(EIO);
 
-                /*
-                 * Don't wait on completion if we know that we've
-                 * gotten a log write error.
-                 */
-                if (iclog->ic_state & XLOG_STATE_IOERROR) {
+                        if (log_flushed)
+                                *log_flushed = 1;
+                } else {                /* just return */
                         spin_unlock(&log->l_icloglock);
-                        return XFS_ERROR(EIO);
                 }
-                XFS_STATS_INC(xs_log_force_sleep);
-                sv_wait(&iclog->ic_force_wait, PSWP, &log->l_icloglock, s);
-                /*
-                 * No need to grab the log lock here since we're
-                 * only deciding whether or not to return EIO
-                 * and the memory read should be atomic.
-                 */
-                if (iclog->ic_state & XLOG_STATE_IOERROR)
-                        return XFS_ERROR(EIO);
-                *log_flushed = 1;
-        } else {                /* just return */
-                spin_unlock(&log->l_icloglock);
-        }
-        return 0;
 
-    } while (iclog != log->l_iclog);
+                return 0;
+        } while (iclog != log->l_iclog);
 
-    spin_unlock(&log->l_icloglock);
-    return 0;
-}       /* xlog_state_sync */
+        spin_unlock(&log->l_icloglock);
+        return 0;
+}
 
+/*
+ * Wrapper for _xfs_log_force_lsn(), to be used when caller doesn't care
+ * about errors or whether the log was flushed or not. This is the normal
+ * interface to use when trying to unpin items or move the log forward.
+ */
+void
+xfs_log_force_lsn(
+        xfs_mount_t     *mp,
+        xfs_lsn_t       lsn,
+        uint            flags)
+{
+        int     error;
+
+        error = _xfs_log_force_lsn(mp, lsn, flags, NULL);
+        if (error) {
+                xfs_fs_cmn_err(CE_WARN, mp, "xfs_log_force: "
+                        "error %d returned.", error);
+        }
+}
 
 /*
  * Called when we want to mark the current iclog as being ready to sync to
@@ -3463,7 +3468,6 @@ xfs_log_force_umount(
         xlog_ticket_t   *tic;
         xlog_t          *log;
         int             retval;
-        int             dummy;
 
         log = mp->m_log;
 
@@ -3537,13 +3541,14 @@ xfs_log_force_umount(
         }
         spin_unlock(&log->l_grant_lock);
 
-        if (! (log->l_iclog->ic_state & XLOG_STATE_IOERROR)) {
+        if (!(log->l_iclog->ic_state & XLOG_STATE_IOERROR)) {
                 ASSERT(!logerror);
                 /*
                  * Force the incore logs to disk before shutting the
                  * log down completely.
                  */
-                xlog_state_sync_all(log, XFS_LOG_FORCE|XFS_LOG_SYNC, &dummy);
+                _xfs_log_force(mp, XFS_LOG_SYNC, NULL);
+
                 spin_lock(&log->l_icloglock);
                 retval = xlog_state_ioerror(log);
                 spin_unlock(&log->l_icloglock);
diff --git a/fs/xfs/xfs_log.h b/fs/xfs/xfs_log.h
index d0c9baa50b1a..97a24c7795a4 100644
--- a/fs/xfs/xfs_log.h
+++ b/fs/xfs/xfs_log.h
@@ -70,14 +70,8 @@ static inline xfs_lsn_t	_lsn_cmp(xfs_lsn_t lsn1, xfs_lsn_t lsn2)
  * Flags to xfs_log_force()
  *
  *      XFS_LOG_SYNC:   Synchronous force in-core log to disk
- *      XFS_LOG_FORCE:  Start in-core log write now.
- *      XFS_LOG_URGE:   Start write within some window of time.
- *
- * Note: Either XFS_LOG_FORCE or XFS_LOG_URGE must be set.
  */
 #define XFS_LOG_SYNC            0x1
-#define XFS_LOG_FORCE           0x2
-#define XFS_LOG_URGE            0x4
 
 #endif  /* __KERNEL__ */
 
@@ -110,16 +104,12 @@ static inline xfs_lsn_t	_lsn_cmp(xfs_lsn_t lsn1, xfs_lsn_t lsn2)
 #define XLOG_REG_TYPE_TRANSHDR          19
 #define XLOG_REG_TYPE_MAX               19
 
-#define XLOG_VEC_SET_TYPE(vecp, t) ((vecp)->i_type = (t))
-
 typedef struct xfs_log_iovec {
-        xfs_caddr_t             i_addr;         /* beginning address of region */
+        xfs_caddr_t     i_addr;         /* beginning address of region */
         int             i_len;          /* length in bytes of region */
         uint            i_type;         /* type of region */
 } xfs_log_iovec_t;
 
-typedef void* xfs_log_ticket_t;
-
 /*
  * Structure used to pass callback function and the function's argument
  * to the log manager.
@@ -134,18 +124,25 @@ typedef struct xfs_log_callback {
 #ifdef __KERNEL__
 /* Log manager interfaces */
 struct xfs_mount;
+struct xlog_in_core;
 struct xlog_ticket;
+
 xfs_lsn_t xfs_log_done(struct xfs_mount *mp,
-                       xfs_log_ticket_t ticket,
-                       void             **iclog,
+                       struct xlog_ticket *ticket,
+                       struct xlog_in_core **iclog,
                        uint             flags);
 int       _xfs_log_force(struct xfs_mount *mp,
-                         xfs_lsn_t      lsn,
                          uint           flags,
                          int            *log_forced);
 void      xfs_log_force(struct xfs_mount        *mp,
-                        xfs_lsn_t               lsn,
                         uint                    flags);
+int       _xfs_log_force_lsn(struct xfs_mount *mp,
+                             xfs_lsn_t          lsn,
+                             uint               flags,
+                             int                *log_forced);
+void      xfs_log_force_lsn(struct xfs_mount    *mp,
+                            xfs_lsn_t           lsn,
+                            uint                flags);
 int       xfs_log_mount(struct xfs_mount        *mp,
                         struct xfs_buftarg      *log_target,
                         xfs_daddr_t             start_block,
@@ -154,21 +151,21 @@ int	  xfs_log_mount_finish(struct xfs_mount *mp);
 void      xfs_log_move_tail(struct xfs_mount    *mp,
                             xfs_lsn_t           tail_lsn);
 int       xfs_log_notify(struct xfs_mount       *mp,
-                         void                   *iclog,
+                         struct xlog_in_core    *iclog,
                          xfs_log_callback_t     *callback_entry);
 int       xfs_log_release_iclog(struct xfs_mount *mp,
-                         void                    *iclog_hndl);
+                         struct xlog_in_core     *iclog);
 int       xfs_log_reserve(struct xfs_mount *mp,
                           int              length,
                           int              count,
-                          xfs_log_ticket_t *ticket,
+                          struct xlog_ticket **ticket,
                           __uint8_t        clientid,
                           uint             flags,
                           uint             t_type);
 int       xfs_log_write(struct xfs_mount *mp,
                         xfs_log_iovec_t  region[],
                         int              nentries,
-                        xfs_log_ticket_t ticket,
+                        struct xlog_ticket *ticket,
                         xfs_lsn_t        *start_lsn);
 int       xfs_log_unmount_write(struct xfs_mount *mp);
 void      xfs_log_unmount(struct xfs_mount *mp);
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index d55662db7077..fd02a18facd5 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -443,14 +443,9 @@ typedef struct log {
 
 /* common routines */
 extern xfs_lsn_t xlog_assign_tail_lsn(struct xfs_mount *mp);
-extern int       xlog_find_tail(xlog_t  *log,
-                                xfs_daddr_t *head_blk,
-                                xfs_daddr_t *tail_blk);
 extern int       xlog_recover(xlog_t *log);
 extern int       xlog_recover_finish(xlog_t *log);
 extern void      xlog_pack_data(xlog_t *log, xlog_in_core_t *iclog, int);
-extern struct xfs_buf *xlog_get_bp(xlog_t *, int);
-extern void      xlog_put_bp(struct xfs_buf *);
 
 extern kmem_zone_t      *xfs_log_ticket_zone;
 
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 69ac2e5ef20c..22e6efdc17ea 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -50,8 +50,6 @@
 
 STATIC int      xlog_find_zeroed(xlog_t *, xfs_daddr_t *);
 STATIC int      xlog_clear_stale_blocks(xlog_t *, xfs_lsn_t);
-STATIC void     xlog_recover_insert_item_backq(xlog_recover_item_t **q,
-                                               xlog_recover_item_t *item);
 #if defined(DEBUG)
 STATIC void     xlog_recover_check_summary(xlog_t *);
 #else
@@ -68,7 +66,7 @@ STATIC void	xlog_recover_check_summary(xlog_t *);
         ((bbs + (log)->l_sectbb_mask + 1) & ~(log)->l_sectbb_mask) : (bbs) )
 #define XLOG_SECTOR_ROUNDDOWN_BLKNO(log, bno)   ((bno) & ~(log)->l_sectbb_mask)
 
-xfs_buf_t *
+STATIC xfs_buf_t *
 xlog_get_bp(
         xlog_t          *log,
         int             nbblks)
@@ -88,7 +86,7 @@ xlog_get_bp(
         return xfs_buf_get_noaddr(BBTOB(nbblks), log->l_mp->m_logdev_targp);
 }
 
-void
+STATIC void
 xlog_put_bp(
         xfs_buf_t       *bp)
 {
@@ -805,7 +803,7 @@ xlog_find_head(
  * We could speed up search by using current head_blk buffer, but it is not
  * available.
  */
-int
+STATIC int
 xlog_find_tail(
         xlog_t                  *log,
         xfs_daddr_t             *head_blk,
@@ -1367,36 +1365,45 @@ xlog_clear_stale_blocks(
 
 STATIC xlog_recover_t *
 xlog_recover_find_tid(
-        xlog_recover_t          *q,
+        struct hlist_head       *head,
         xlog_tid_t              tid)
 {
-        xlog_recover_t          *p = q;
+        xlog_recover_t          *trans;
+        struct hlist_node       *n;
 
-        while (p != NULL) {
-                if (p->r_log_tid == tid)
-                    break;
-                p = p->r_next;
+        hlist_for_each_entry(trans, n, head, r_list) {
+                if (trans->r_log_tid == tid)
+                        return trans;
         }
-        return p;
+        return NULL;
 }
 
 STATIC void
-xlog_recover_put_hashq(
-        xlog_recover_t          **q,
-        xlog_recover_t          *trans)
+xlog_recover_new_tid(
+        struct hlist_head       *head,
+        xlog_tid_t              tid,
+        xfs_lsn_t               lsn)
 {
-        trans->r_next = *q;
-        *q = trans;
+        xlog_recover_t          *trans;
+
+        trans = kmem_zalloc(sizeof(xlog_recover_t), KM_SLEEP);
+        trans->r_log_tid   = tid;
+        trans->r_lsn       = lsn;
+        INIT_LIST_HEAD(&trans->r_itemq);
+
+        INIT_HLIST_NODE(&trans->r_list);
+        hlist_add_head(&trans->r_list, head);
 }
 
 STATIC void
 xlog_recover_add_item(
-        xlog_recover_item_t     **itemq)
+        struct list_head        *head)
 {
         xlog_recover_item_t     *item;
 
         item = kmem_zalloc(sizeof(xlog_recover_item_t), KM_SLEEP);
-        xlog_recover_insert_item_backq(itemq, item);
+        INIT_LIST_HEAD(&item->ri_list);
+        list_add_tail(&item->ri_list, head);
 }
 
 STATIC int
@@ -1409,8 +1416,7 @@ xlog_recover_add_to_cont_trans(
         xfs_caddr_t             ptr, old_ptr;
         int                     old_len;
 
-        item = trans->r_itemq;
-        if (item == NULL) {
+        if (list_empty(&trans->r_itemq)) {
                 /* finish copying rest of trans header */
                 xlog_recover_add_item(&trans->r_itemq);
                 ptr = (xfs_caddr_t) &trans->r_theader +
@@ -1418,7 +1424,8 @@ xlog_recover_add_to_cont_trans(
                 memcpy(ptr, dp, len); /* d, s, l */
                 return 0;
         }
-        item = item->ri_prev;
+        /* take the tail entry */
+        item = list_entry(trans->r_itemq.prev, xlog_recover_item_t, ri_list);
 
         old_ptr = item->ri_buf[item->ri_cnt-1].i_addr;
         old_len = item->ri_buf[item->ri_cnt-1].i_len;
@@ -1455,8 +1462,7 @@ xlog_recover_add_to_trans(
 
         if (!len)
                 return 0;
-        item = trans->r_itemq;
-        if (item == NULL) {
+        if (list_empty(&trans->r_itemq)) {
                 /* we need to catch log corruptions here */
                 if (*(uint *)dp != XFS_TRANS_HEADER_MAGIC) {
                         xlog_warn("XFS: xlog_recover_add_to_trans: "
@@ -1474,12 +1480,15 @@ xlog_recover_add_to_trans(
         memcpy(ptr, dp, len);
         in_f = (xfs_inode_log_format_t *)ptr;
 
-        if (item->ri_prev->ri_total != 0 &&
-             item->ri_prev->ri_total == item->ri_prev->ri_cnt) {
+        /* take the tail entry */
+        item = list_entry(trans->r_itemq.prev, xlog_recover_item_t, ri_list);
+        if (item->ri_total != 0 &&
+             item->ri_total == item->ri_cnt) {
+                /* tail item is in use, get a new one */
                 xlog_recover_add_item(&trans->r_itemq);
+                item = list_entry(trans->r_itemq.prev,
+                                        xlog_recover_item_t, ri_list);
         }
-        item = trans->r_itemq;
-        item = item->ri_prev;
 
         if (item->ri_total == 0) {              /* first region to be added */
                 if (in_f->ilf_size == 0 ||
@@ -1504,96 +1513,29 @@ xlog_recover_add_to_trans(
         return 0;
 }
 
-STATIC void
-xlog_recover_new_tid(
-        xlog_recover_t          **q,
-        xlog_tid_t              tid,
-        xfs_lsn_t               lsn)
-{
-        xlog_recover_t          *trans;
-
-        trans = kmem_zalloc(sizeof(xlog_recover_t), KM_SLEEP);
-        trans->r_log_tid   = tid;
-        trans->r_lsn       = lsn;
-        xlog_recover_put_hashq(q, trans);
-}
-
-STATIC int
-xlog_recover_unlink_tid(
-        xlog_recover_t          **q,
-        xlog_recover_t          *trans)
-{
-        xlog_recover_t          *tp;
-        int                     found = 0;
-
-        ASSERT(trans != NULL);
-        if (trans == *q) {
-                *q = (*q)->r_next;
-        } else {
-                tp = *q;
-                while (tp) {
-                        if (tp->r_next == trans) {
-                                found = 1;
-                                break;
-                        }
-                        tp = tp->r_next;
-                }
-                if (!found) {
-                        xlog_warn(
-                             "XFS: xlog_recover_unlink_tid: trans not found");
-                        ASSERT(0);
-                        return XFS_ERROR(EIO);
-                }
-                tp->r_next = tp->r_next->r_next;
-        }
-        return 0;
-}
-
-STATIC void
-xlog_recover_insert_item_backq(
-        xlog_recover_item_t     **q,
-        xlog_recover_item_t     *item)
-{
-        if (*q == NULL) {
-                item->ri_prev = item->ri_next = item;
-                *q = item;
-        } else {
-                item->ri_next           = *q;
-                item->ri_prev           = (*q)->ri_prev;
-                (*q)->ri_prev           = item;
-                item->ri_prev->ri_next  = item;
-        }
-}
-
-STATIC void
-xlog_recover_insert_item_frontq(
-        xlog_recover_item_t     **q,
-        xlog_recover_item_t     *item)
-{
-        xlog_recover_insert_item_backq(q, item);
-        *q = item;
-}
-
+/*
+ * Sort the log items in the transaction. Cancelled buffers need
+ * to be put first so they are processed before any items that might
+ * modify the buffers. If they are cancelled, then the modifications
+ * don't need to be replayed.
+ */
 STATIC int
 xlog_recover_reorder_trans(
         xlog_recover_t          *trans)
 {
-        xlog_recover_item_t     *first_item, *itemq, *itemq_next;
-        xfs_buf_log_format_t    *buf_f;
-        ushort                  flags = 0;
+        xlog_recover_item_t     *item, *n;
+        LIST_HEAD(sort_list);
 
-        first_item = itemq = trans->r_itemq;
-        trans->r_itemq = NULL;
-        do {
-                itemq_next = itemq->ri_next;
-                buf_f = (xfs_buf_log_format_t *)itemq->ri_buf[0].i_addr;
+        list_splice_init(&trans->r_itemq, &sort_list);
+        list_for_each_entry_safe(item, n, &sort_list, ri_list) {
+                xfs_buf_log_format_t    *buf_f;
 
-                switch (ITEM_TYPE(itemq)) {
+                buf_f = (xfs_buf_log_format_t *)item->ri_buf[0].i_addr;
+
+                switch (ITEM_TYPE(item)) {
                 case XFS_LI_BUF:
-                        flags = buf_f->blf_flags;
-                        if (!(flags & XFS_BLI_CANCEL)) {
-                                xlog_recover_insert_item_frontq(&trans->r_itemq,
-                                                                itemq);
+                        if (!(buf_f->blf_flags & XFS_BLI_CANCEL)) {
+                                list_move(&item->ri_list, &trans->r_itemq);
                                 break;
                         }
                 case XFS_LI_INODE:
@@ -1601,7 +1543,7 @@ xlog_recover_reorder_trans(
                 case XFS_LI_QUOTAOFF:
                 case XFS_LI_EFD:
                 case XFS_LI_EFI:
-                        xlog_recover_insert_item_backq(&trans->r_itemq, itemq);
+                        list_move_tail(&item->ri_list, &trans->r_itemq);
                         break;
                 default:
                         xlog_warn(
@@ -1609,8 +1551,8 @@ xlog_recover_reorder_trans(
                         ASSERT(0);
                         return XFS_ERROR(EIO);
                 }
-                itemq = itemq_next;
-        } while (first_item != itemq);
+        }
+        ASSERT(list_empty(&sort_list));
         return 0;
 }
 
@@ -2242,9 +2184,9 @@ xlog_recover_do_buffer_trans(
         }
 
         mp = log->l_mp;
-        buf_flags = XFS_BUF_LOCK;
+        buf_flags = XBF_LOCK;
         if (!(flags & XFS_BLI_INODE_BUF))
-                buf_flags |= XFS_BUF_MAPPED;
+                buf_flags |= XBF_MAPPED;
 
         bp = xfs_buf_read(mp->m_ddev_targp, blkno, len, buf_flags);
         if (XFS_BUF_ISERROR(bp)) {
@@ -2346,7 +2288,7 @@ xlog_recover_do_inode_trans(
         }
 
         bp = xfs_buf_read(mp->m_ddev_targp, in_f->ilf_blkno, in_f->ilf_len,
-                          XFS_BUF_LOCK);
+                          XBF_LOCK);
         if (XFS_BUF_ISERROR(bp)) {
                 xfs_ioerror_alert("xlog_recover_do..(read#2)", mp,
                                   bp, in_f->ilf_blkno);
@@ -2814,14 +2756,13 @@ xlog_recover_do_trans(
         int                     pass)
 {
         int                     error = 0;
-        xlog_recover_item_t     *item, *first_item;
+        xlog_recover_item_t     *item;
 
         error = xlog_recover_reorder_trans(trans);
         if (error)
                 return error;
 
-        first_item = item = trans->r_itemq;
-        do {
+        list_for_each_entry(item, &trans->r_itemq, ri_list) {
                 switch (ITEM_TYPE(item)) {
                 case XFS_LI_BUF:
                         error = xlog_recover_do_buffer_trans(log, item, pass);
@@ -2854,8 +2795,7 @@ xlog_recover_do_trans(
 
                 if (error)
                         return error;
-                item = item->ri_next;
-        } while (first_item != item);
+        }
 
         return 0;
 }
@@ -2869,21 +2809,18 @@ STATIC void
 xlog_recover_free_trans(
         xlog_recover_t          *trans)
 {
-        xlog_recover_item_t     *first_item, *item, *free_item;
+        xlog_recover_item_t     *item, *n;
         int                     i;
 
-        item = first_item = trans->r_itemq;
-        do {
-                free_item = item;
-                item = item->ri_next;
-                 /* Free the regions in the item. */
-                for (i = 0; i < free_item->ri_cnt; i++) {
-                        kmem_free(free_item->ri_buf[i].i_addr);
-                }
+        list_for_each_entry_safe(item, n, &trans->r_itemq, ri_list) {
+                /* Free the regions in the item. */
+                list_del(&item->ri_list);
+                for (i = 0; i < item->ri_cnt; i++)
+                        kmem_free(item->ri_buf[i].i_addr);
                 /* Free the item itself */
-                kmem_free(free_item->ri_buf);
-                kmem_free(free_item);
-        } while (first_item != item);
+                kmem_free(item->ri_buf);
+                kmem_free(item);
+        }
         /* Free the transaction recover structure */
         kmem_free(trans);
 }
@@ -2891,14 +2828,12 @@ xlog_recover_free_trans(
 STATIC int
 xlog_recover_commit_trans(
         xlog_t                  *log,
-        xlog_recover_t          **q,
         xlog_recover_t          *trans,
         int                     pass)
 {
         int                     error;
 
-        if ((error = xlog_recover_unlink_tid(q, trans)))
-                return error;
+        hlist_del(&trans->r_list);
         if ((error = xlog_recover_do_trans(log, trans, pass)))
                 return error;
         xlog_recover_free_trans(trans);                 /* no error */
@@ -2926,7 +2861,7 @@ xlog_recover_unmount_trans(
 STATIC int
 xlog_recover_process_data(
         xlog_t                  *log,
-        xlog_recover_t          *rhash[],
+        struct hlist_head       rhash[],
         xlog_rec_header_t       *rhead,
         xfs_caddr_t             dp,
         int                     pass)
@@ -2960,7 +2895,7 @@ xlog_recover_process_data(
                 }
                 tid = be32_to_cpu(ohead->oh_tid);
                 hash = XLOG_RHASH(tid);
-                trans = xlog_recover_find_tid(rhash[hash], tid);
+                trans = xlog_recover_find_tid(&rhash[hash], tid);
                 if (trans == NULL) {               /* not found; add new tid */
                         if (ohead->oh_flags & XLOG_START_TRANS)
                                 xlog_recover_new_tid(&rhash[hash], tid,
@@ -2978,7 +2913,7 @@ xlog_recover_process_data(
                         switch (flags) {
                         case XLOG_COMMIT_TRANS:
                                 error = xlog_recover_commit_trans(log,
-                                                &rhash[hash], trans, pass);
+                                                                trans, pass);
                                 break;
                         case XLOG_UNMOUNT_TRANS:
                                 error = xlog_recover_unmount_trans(trans);
@@ -3211,7 +3146,7 @@ xlog_recover_process_one_iunlink(
         /*
          * Get the on disk inode to find the next inode in the bucket.
          */
-        error = xfs_itobp(mp, NULL, ip, &dip, &ibp, XFS_BUF_LOCK);
+        error = xfs_itobp(mp, NULL, ip, &dip, &ibp, XBF_LOCK);
         if (error)
                 goto fail_iput;
 
@@ -3517,7 +3452,7 @@ xlog_do_recovery_pass(
         int                     error = 0, h_size;
         int                     bblks, split_bblks;
         int                     hblks, split_hblks, wrapped_hblks;
-        xlog_recover_t          *rhash[XLOG_RHASH_SIZE];
+        struct hlist_head       rhash[XLOG_RHASH_SIZE];
 
         ASSERT(head_blk != tail_blk);
 
@@ -3978,8 +3913,7 @@ xlog_recover_finish(
                  * case the unlink transactions would have problems
                  * pushing the EFIs out of the way.
                  */
-                xfs_log_force(log->l_mp, (xfs_lsn_t)0,
-                              (XFS_LOG_FORCE | XFS_LOG_SYNC));
+                xfs_log_force(log->l_mp, XFS_LOG_SYNC);
 
                 xlog_recover_process_iunlinks(log);
 
diff --git a/fs/xfs/xfs_log_recover.h b/fs/xfs/xfs_log_recover.h
index b22545555301..75d749207258 100644
--- a/fs/xfs/xfs_log_recover.h
+++ b/fs/xfs/xfs_log_recover.h
@@ -35,22 +35,21 @@
  * item headers are in ri_buf[0].  Additional buffers follow.
  */
 typedef struct xlog_recover_item {
-        struct xlog_recover_item *ri_next;
-        struct xlog_recover_item *ri_prev;
-        int                      ri_type;
-        int                      ri_cnt;        /* count of regions found */
-        int                      ri_total;      /* total regions */
-        xfs_log_iovec_t          *ri_buf;       /* ptr to regions buffer */
+        struct list_head        ri_list;
+        int                     ri_type;
+        int                     ri_cnt; /* count of regions found */
+        int                     ri_total;       /* total regions */
+        xfs_log_iovec_t         *ri_buf;        /* ptr to regions buffer */
 } xlog_recover_item_t;
 
 struct xlog_tid;
 typedef struct xlog_recover {
-        struct xlog_recover *r_next;
-        xlog_tid_t          r_log_tid;          /* log's transaction id */
-        xfs_trans_header_t  r_theader;          /* trans header for partial */
-        int                 r_state;            /* not needed */
-        xfs_lsn_t           r_lsn;              /* xact lsn */
-        xlog_recover_item_t *r_itemq;           /* q for items */
+        struct hlist_node       r_list;
+        xlog_tid_t              r_log_tid;      /* log's transaction id */
+        xfs_trans_header_t      r_theader;      /* trans header for partial */
+        int                     r_state;        /* not needed */
+        xfs_lsn_t               r_lsn;          /* xact lsn */
+        struct list_head        r_itemq;        /* q for items */
 } xlog_recover_t;
 
 #define ITEM_TYPE(i)    (*(ushort *)(i)->ri_buf[0].i_addr)
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index eb403b40e120..e79b56b4bca6 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -201,6 +201,38 @@ xfs_uuid_unmount(
 
 
 /*
+ * Reference counting access wrappers to the perag structures.
+ */
+struct xfs_perag *
+xfs_perag_get(struct xfs_mount *mp, xfs_agnumber_t agno)
+{
+        struct xfs_perag        *pag;
+        int                     ref = 0;
+
+        spin_lock(&mp->m_perag_lock);
+        pag = radix_tree_lookup(&mp->m_perag_tree, agno);
+        if (pag) {
+                ASSERT(atomic_read(&pag->pag_ref) >= 0);
+                /* catch leaks in the positive direction during testing */
+                ASSERT(atomic_read(&pag->pag_ref) < 1000);
+                ref = atomic_inc_return(&pag->pag_ref);
+        }
+        spin_unlock(&mp->m_perag_lock);
+        trace_xfs_perag_get(mp, agno, ref, _RET_IP_);
+        return pag;
+}
+
+void
+xfs_perag_put(struct xfs_perag *pag)
+{
+        int     ref;
+
+        ASSERT(atomic_read(&pag->pag_ref) > 0);
+        ref = atomic_dec_return(&pag->pag_ref);
+        trace_xfs_perag_put(pag->pag_mount, pag->pag_agno, ref, _RET_IP_);
+}
+
+/*
  * Free up the resources associated with a mount structure.  Assume that
  * the structure was initially zeroed, so we can tell which fields got
  * initialized.
@@ -209,13 +241,16 @@ STATIC void
 xfs_free_perag(
         xfs_mount_t     *mp)
 {
-        if (mp->m_perag) {
-                int     agno;
+        xfs_agnumber_t  agno;
+        struct xfs_perag *pag;
 
-                for (agno = 0; agno < mp->m_maxagi; agno++)
-                        if (mp->m_perag[agno].pagb_list)
-                                kmem_free(mp->m_perag[agno].pagb_list);
-                kmem_free(mp->m_perag);
+        for (agno = 0; agno < mp->m_sb.sb_agcount; agno++) {
+                spin_lock(&mp->m_perag_lock);
+                pag = radix_tree_delete(&mp->m_perag_tree, agno);
+                ASSERT(pag);
+                ASSERT(atomic_read(&pag->pag_ref) == 0);
+                spin_unlock(&mp->m_perag_lock);
+                kmem_free(pag);
         }
 }
 
@@ -389,22 +424,57 @@ xfs_initialize_perag_icache(
         }
 }
 
-xfs_agnumber_t
+int
 xfs_initialize_perag(
         xfs_mount_t     *mp,
-        xfs_agnumber_t  agcount)
+        xfs_agnumber_t  agcount,
+        xfs_agnumber_t  *maxagi)
 {
         xfs_agnumber_t  index, max_metadata;
+        xfs_agnumber_t  first_initialised = 0;
         xfs_perag_t     *pag;
         xfs_agino_t     agino;
         xfs_ino_t       ino;
         xfs_sb_t        *sbp = &mp->m_sb;
         xfs_ino_t       max_inum = XFS_MAXINUMBER_32;
+        int             error = -ENOMEM;
 
         /* Check to see if the filesystem can overflow 32 bit inodes */
         agino = XFS_OFFBNO_TO_AGINO(mp, sbp->sb_agblocks - 1, 0);
         ino = XFS_AGINO_TO_INO(mp, agcount - 1, agino);
 
+        /*
+         * Walk the current per-ag tree so we don't try to initialise AGs
+         * that already exist (growfs case). Allocate and insert all the
+         * AGs we don't find ready for initialisation.
+         */
+        for (index = 0; index < agcount; index++) {
+                pag = xfs_perag_get(mp, index);
+                if (pag) {
+                        xfs_perag_put(pag);
+                        continue;
+                }
+                if (!first_initialised)
+                        first_initialised = index;
+                pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL);
+                if (!pag)
+                        goto out_unwind;
+                if (radix_tree_preload(GFP_NOFS))
+                        goto out_unwind;
+                spin_lock(&mp->m_perag_lock);
+                if (radix_tree_insert(&mp->m_perag_tree, index, pag)) {
+                        BUG();
+                        spin_unlock(&mp->m_perag_lock);
+                        radix_tree_preload_end();
+                        error = -EEXIST;
+                        goto out_unwind;
+                }
+                pag->pag_agno = index;
+                pag->pag_mount = mp;
+                spin_unlock(&mp->m_perag_lock);
+                radix_tree_preload_end();
+        }
+
         /* Clear the mount flag if no inode can overflow 32 bits
          * on this filesystem, or if specifically requested..
          */
@@ -438,21 +508,33 @@ xfs_initialize_perag(
                         }
 
                         /* This ag is preferred for inodes */
-                        pag = &mp->m_perag[index];
+                        pag = xfs_perag_get(mp, index);
                         pag->pagi_inodeok = 1;
                         if (index < max_metadata)
                                 pag->pagf_metadata = 1;
                         xfs_initialize_perag_icache(pag);
+                        xfs_perag_put(pag);
                 }
         } else {
                 /* Setup default behavior for smaller filesystems */
                 for (index = 0; index < agcount; index++) {
-                        pag = &mp->m_perag[index];
+                        pag = xfs_perag_get(mp, index);
                         pag->pagi_inodeok = 1;
                         xfs_initialize_perag_icache(pag);
+                        xfs_perag_put(pag);
                 }
         }
-        return index;
+        if (maxagi)
+                *maxagi = index;
+        return 0;
+
+out_unwind:
+        kmem_free(pag);
+        for (; index > first_initialised; index--) {
+                pag = radix_tree_delete(&mp->m_perag_tree, index);
+                kmem_free(pag);
+        }
+        return error;
 }
 
 void
@@ -583,7 +665,7 @@ xfs_readsb(xfs_mount_t *mp, int flags)
          * access to the superblock.
          */
         sector_size = xfs_getsize_buftarg(mp->m_ddev_targp);
-        extra_flags = XFS_BUF_LOCK | XFS_BUF_MANAGE | XFS_BUF_MAPPED;
+        extra_flags = XBF_LOCK | XBF_FS_MANAGED | XBF_MAPPED;
 
         bp = xfs_buf_read(mp->m_ddev_targp, XFS_SB_DADDR, BTOBB(sector_size),
                           extra_flags);
@@ -731,12 +813,13 @@ xfs_initialize_perag_data(xfs_mount_t *mp, xfs_agnumber_t agcount)
                 error = xfs_ialloc_pagi_init(mp, NULL, index);
                 if (error)
                         return error;
-                pag = &mp->m_perag[index];
+                pag = xfs_perag_get(mp, index);
                 ifree += pag->pagi_freecount;
                 ialloc += pag->pagi_count;
                 bfree += pag->pagf_freeblks;
                 bfreelst += pag->pagf_flcount;
                 btree += pag->pagf_btreeblks;
+                xfs_perag_put(pag);
         }
         /*
          * Overwrite incore superblock counters with just-read data
@@ -1008,6 +1091,24 @@ xfs_mount_reset_sbqflags(
         return xfs_trans_commit(tp, 0);
 }
 
+__uint64_t
+xfs_default_resblks(xfs_mount_t *mp)
+{
+        __uint64_t resblks;
+
+        /*
+         * We default to 5% or 8192 fsbs of space reserved, whichever is
+         * smaller.  This is intended to cover concurrent allocation
+         * transactions when we initially hit enospc. These each require a 4
+         * block reservation. Hence by default we cover roughly 2000 concurrent
+         * allocation reservations.
+         */
+        resblks = mp->m_sb.sb_dblocks;
+        do_div(resblks, 20);
+        resblks = min_t(__uint64_t, resblks, 8192);
+        return resblks;
+}
+
 /*
  * This function does the following on an initial mount of a file system:
  *      - reads the superblock from disk and init the mount struct
@@ -1152,13 +1253,13 @@ xfs_mountfs(
         /*
          * Allocate and initialize the per-ag data.
          */
-        init_rwsem(&mp->m_peraglock);
-        mp->m_perag = kmem_zalloc(sbp->sb_agcount * sizeof(xfs_perag_t),
-                                  KM_MAYFAIL);
-        if (!mp->m_perag)
+        spin_lock_init(&mp->m_perag_lock);
+        INIT_RADIX_TREE(&mp->m_perag_tree, GFP_NOFS);
+        error = xfs_initialize_perag(mp, sbp->sb_agcount, &mp->m_maxagi);
+        if (error) {
+                cmn_err(CE_WARN, "XFS: Failed per-ag init: %d", error);
                 goto out_remove_uuid;
-
-        mp->m_maxagi = xfs_initialize_perag(mp, sbp->sb_agcount);
+        }
 
         if (!sbp->sb_logblocks) {
                 cmn_err(CE_WARN, "XFS: no log defined");
@@ -1319,17 +1420,16 @@ xfs_mountfs(
          * attr, unwritten extent conversion at ENOSPC, etc. Data allocations
          * are not allowed to use this reserved space.
          *
-         * We default to 5% or 1024 fsbs of space reserved, whichever is smaller.
          * This may drive us straight to ENOSPC on mount, but that implies
          * we were already there on the last unmount. Warn if this occurs.
          */
-        resblks = mp->m_sb.sb_dblocks;
-        do_div(resblks, 20);
-        resblks = min_t(__uint64_t, resblks, 1024);
-        error = xfs_reserve_blocks(mp, &resblks, NULL);
-        if (error)
-                cmn_err(CE_WARN, "XFS: Unable to allocate reserve blocks. "
-                                "Continuing without a reserve pool.");
+        if (!(mp->m_flags & XFS_MOUNT_RDONLY)) {
+                resblks = xfs_default_resblks(mp);
+                error = xfs_reserve_blocks(mp, &resblks, NULL);
+                if (error)
+                        cmn_err(CE_WARN, "XFS: Unable to allocate reserve "
+                                "blocks. Continuing without a reserve pool.");
+        }
 
         return 0;
 
@@ -1372,8 +1472,19 @@ xfs_unmountfs(
          * push out the iclog we will never get that unlocked. hence we
          * need to force the log first.
          */
-        xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE | XFS_LOG_SYNC);
-        xfs_reclaim_inodes(mp, XFS_IFLUSH_ASYNC);
+        xfs_log_force(mp, XFS_LOG_SYNC);
+
+        /*
+         * Do a delwri reclaim pass first so that as many dirty inodes are
+         * queued up for IO as possible. Then flush the buffers before making
+         * a synchronous path to catch all the remaining inodes are reclaimed.
+         * This makes the reclaim process as quick as possible by avoiding
+         * synchronous writeout and blocking on inodes already in the delwri
+         * state as much as possible.
+         */
+        xfs_reclaim_inodes(mp, 0);
+        XFS_bflush(mp->m_ddev_targp);
+        xfs_reclaim_inodes(mp, SYNC_WAIT);
 
         xfs_qm_unmount(mp);
 
@@ -1382,7 +1493,7 @@ xfs_unmountfs(
          * that nothing is pinned.  This is important because bflush()
          * will skip pinned buffers.
          */
-        xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE | XFS_LOG_SYNC);
+        xfs_log_force(mp, XFS_LOG_SYNC);
 
         xfs_binval(mp->m_ddev_targp);
         if (mp->m_rtdev_targp) {
@@ -1548,15 +1659,14 @@ xfs_mod_sb(xfs_trans_t *tp, __int64_t fields)
         xfs_sb_to_disk(XFS_BUF_TO_SBP(bp), &mp->m_sb, fields);
 
         /* find modified range */
+        f = (xfs_sb_field_t)xfs_highbit64((__uint64_t)fields);
+        ASSERT((1LL << f) & XFS_SB_MOD_BITS);
+        last = xfs_sb_info[f + 1].offset - 1;
 
         f = (xfs_sb_field_t)xfs_lowbit64((__uint64_t)fields);
         ASSERT((1LL << f) & XFS_SB_MOD_BITS);
         first = xfs_sb_info[f].offset;
 
-        f = (xfs_sb_field_t)xfs_highbit64((__uint64_t)fields);
-        ASSERT((1LL << f) & XFS_SB_MOD_BITS);
-        last = xfs_sb_info[f + 1].offset - 1;
-
         xfs_trans_log_buf(tp, bp, first, last);
 }
 
@@ -1620,26 +1730,30 @@ xfs_mod_incore_sb_unlocked(
                                 lcounter += rem;
                         }
                 } else {                                /* Taking blocks away */
-
                         lcounter += delta;
+                        if (lcounter >= 0) {
+                                mp->m_sb.sb_fdblocks = lcounter +
+                                                        XFS_ALLOC_SET_ASIDE(mp);
+                                return 0;
+                        }
 
-                /*
-                 * If were out of blocks, use any available reserved blocks if
-                 * were allowed to.
-                 */
+                        /*
+                         * We are out of blocks, use any available reserved
+                         * blocks if were allowed to.
+                         */
+                        if (!rsvd)
+                                return XFS_ERROR(ENOSPC);
 
-                        if (lcounter < 0) {
-                                if (rsvd) {
-                                        lcounter = (long long)mp->m_resblks_avail + delta;
-                                        if (lcounter < 0) {
-                                                return XFS_ERROR(ENOSPC);
-                                        }
-                                        mp->m_resblks_avail = lcounter;
-                                        return 0;
-                                } else {        /* not reserved */
-                                        return XFS_ERROR(ENOSPC);
-                                }
+                        lcounter = (long long)mp->m_resblks_avail + delta;
+                        if (lcounter >= 0) {
+                                mp->m_resblks_avail = lcounter;
+                                return 0;
                         }
+                        printk_once(KERN_WARNING
+                                "Filesystem \"%s\": reserve blocks depleted! "
+                                "Consider increasing reserve pool size.",
+                                mp->m_fsname);
+                        return XFS_ERROR(ENOSPC);
                 }
 
                 mp->m_sb.sb_fdblocks = lcounter + XFS_ALLOC_SET_ASIDE(mp);
@@ -1887,7 +2001,7 @@ xfs_getsb(
 
         ASSERT(mp->m_sb_bp != NULL);
         bp = mp->m_sb_bp;
-        if (flags & XFS_BUF_TRYLOCK) {
+        if (flags & XBF_TRYLOCK) {
                 if (!XFS_BUF_CPSEMA(bp)) {
                         return NULL;
                 }
@@ -1947,6 +2061,26 @@ xfs_mount_log_sb(
         return error;
 }
 
+/*
+ * If the underlying (data/log/rt) device is readonly, there are some
+ * operations that cannot proceed.
+ */
+int
+xfs_dev_is_read_only(
+        struct xfs_mount        *mp,
+        char                    *message)
+{
+        if (xfs_readonly_buftarg(mp->m_ddev_targp) ||
+            xfs_readonly_buftarg(mp->m_logdev_targp) ||
+            (mp->m_rtdev_targp && xfs_readonly_buftarg(mp->m_rtdev_targp))) {
+                cmn_err(CE_NOTE,
+                        "XFS: %s required on read-only device.", message);
+                cmn_err(CE_NOTE,
+                        "XFS: write access unavailable, cannot proceed.");
+                return EROFS;
+        }
+        return 0;
+}
 
 #ifdef HAVE_PERCPU_SB
 /*
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 1df7e4502967..4fa0bc7b983e 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -78,7 +78,8 @@ typedef int	(*xfs_send_destroy_t)(struct xfs_inode *, dm_right_t);
 typedef int     (*xfs_send_namesp_t)(dm_eventtype_t, struct xfs_mount *,
                         struct xfs_inode *, dm_right_t,
                         struct xfs_inode *, dm_right_t,
-                        const char *, const char *, mode_t, int, int);
+                        const unsigned char *, const unsigned char *,
+                        mode_t, int, int);
 typedef int     (*xfs_send_mount_t)(struct xfs_mount *, dm_right_t,
                         char *, char *);
 typedef void    (*xfs_send_unmount_t)(struct xfs_mount *, struct xfs_inode *,
@@ -207,8 +208,8 @@ typedef struct xfs_mount {
         uint                    m_ag_maxlevels; /* XFS_AG_MAXLEVELS */
         uint                    m_bm_maxlevels[2]; /* XFS_BM_MAXLEVELS */
         uint                    m_in_maxlevels; /* max inobt btree levels. */
-        struct xfs_perag        *m_perag;       /* per-ag accounting info */
-        struct rw_semaphore     m_peraglock;    /* lock for m_perag (pointer) */
+        struct radix_tree_root  m_perag_tree;   /* per-ag accounting info */
+        spinlock_t              m_perag_lock;   /* lock for m_perag_tree */
         struct mutex            m_growlock;     /* growfs mutex */
         int                     m_fixedfsid[2]; /* unchanged for life of FS */
         uint                    m_dmevmask;     /* DMI events for this FS */
@@ -224,6 +225,7 @@ typedef struct xfs_mount {
         __uint64_t              m_maxioffset;   /* maximum inode offset */
         __uint64_t              m_resblks;      /* total reserved blocks */
         __uint64_t              m_resblks_avail;/* available reserved blocks */
+        __uint64_t              m_resblks_save; /* reserved blks @ remount,ro */
         int                     m_dalign;       /* stripe unit */
         int                     m_swidth;       /* stripe width */
         int                     m_sinoalign;    /* stripe unit inode alignment */
@@ -243,7 +245,7 @@ typedef struct xfs_mount {
         struct xfs_qmops        *m_qm_ops;      /* vector of XQM ops */
         atomic_t                m_active_trans; /* number trans frozen */
 #ifdef HAVE_PERCPU_SB
-        xfs_icsb_cnts_t         *m_sb_cnts;     /* per-cpu superblock counters */
+        xfs_icsb_cnts_t __percpu *m_sb_cnts;    /* per-cpu superblock counters */
         unsigned long           m_icsb_counters; /* disabled per-cpu counters */
         struct notifier_block   m_icsb_notifier; /* hotplug cpu notifier */
         struct mutex            m_icsb_mutex;   /* balancer sync lock */
@@ -384,19 +386,10 @@ xfs_daddr_to_agbno(struct xfs_mount *mp, xfs_daddr_t d)
 }
 
 /*
- * perag get/put wrappers for eventual ref counting
+ * perag get/put wrappers for ref counting
  */
-static inline xfs_perag_t *
-xfs_get_perag(struct xfs_mount *mp, xfs_ino_t ino)
-{
-        return &mp->m_perag[XFS_INO_TO_AGNO(mp, ino)];
-}
-
-static inline void
-xfs_put_perag(struct xfs_mount *mp, xfs_perag_t *pag)
-{
-        /* nothing to see here, move along */
-}
+struct xfs_perag *xfs_perag_get(struct xfs_mount *mp, xfs_agnumber_t agno);
+void    xfs_perag_put(struct xfs_perag *pag);
 
 /*
  * Per-cpu superblock locking functions
@@ -428,6 +421,7 @@ typedef struct xfs_mod_sb {
 } xfs_mod_sb_t;
 
 extern int      xfs_log_sbcount(xfs_mount_t *, uint);
+extern __uint64_t xfs_default_resblks(xfs_mount_t *mp);
 extern int      xfs_mountfs(xfs_mount_t *mp);
 
 extern void     xfs_unmountfs(xfs_mount_t *);
@@ -442,6 +436,8 @@ extern void	xfs_freesb(xfs_mount_t *);
 extern int      xfs_fs_writable(xfs_mount_t *);
 extern int      xfs_sb_validate_fsb_count(struct xfs_sb *, __uint64_t);
 
+extern int      xfs_dev_is_read_only(struct xfs_mount *, char *);
+
 extern int      xfs_dmops_get(struct xfs_mount *);
 extern void     xfs_dmops_put(struct xfs_mount *);
 
@@ -450,7 +446,8 @@ extern struct xfs_dmops xfs_dmcore_xfs;
 #endif  /* __KERNEL__ */
 
 extern void     xfs_mod_sb(struct xfs_trans *, __int64_t);
-extern xfs_agnumber_t   xfs_initialize_perag(struct xfs_mount *, xfs_agnumber_t);
+extern int      xfs_initialize_perag(struct xfs_mount *, xfs_agnumber_t,
+                                        xfs_agnumber_t *);
 extern void     xfs_sb_from_disk(struct xfs_sb *, struct xfs_dsb *);
 extern void     xfs_sb_to_disk(struct xfs_dsb *, struct xfs_sb *, __int64_t);
 
diff --git a/fs/xfs/xfs_mru_cache.c b/fs/xfs/xfs_mru_cache.c
index 4b0613d99faa..45ce15dc5b2b 100644
--- a/fs/xfs/xfs_mru_cache.c
+++ b/fs/xfs/xfs_mru_cache.c
@@ -398,7 +398,7 @@ exit:
  * guaranteed that all the free functions for all the elements have finished
  * executing and the reaper is not running.
  */
-void
+static void
 xfs_mru_cache_flush(
         xfs_mru_cache_t         *mru)
 {
diff --git a/fs/xfs/xfs_mru_cache.h b/fs/xfs/xfs_mru_cache.h
index 5d439f34b0c9..36dd3ec8b4eb 100644
--- a/fs/xfs/xfs_mru_cache.h
+++ b/fs/xfs/xfs_mru_cache.h
@@ -42,7 +42,6 @@ void xfs_mru_cache_uninit(void);
 int xfs_mru_cache_create(struct xfs_mru_cache **mrup, unsigned int lifetime_ms,
                              unsigned int grp_count,
                              xfs_mru_cache_free_func_t free_func);
-void xfs_mru_cache_flush(xfs_mru_cache_t *mru);
 void xfs_mru_cache_destroy(struct xfs_mru_cache *mru);
 int xfs_mru_cache_insert(struct xfs_mru_cache *mru, unsigned long key,
                                 void *value);
diff --git a/fs/xfs/xfs_quota.h b/fs/xfs/xfs_quota.h
index 91bfd60f4c74..fdcab3f81dde 100644
--- a/fs/xfs/xfs_quota.h
+++ b/fs/xfs/xfs_quota.h
@@ -223,16 +223,9 @@ typedef struct xfs_qoff_logformat {
 #define XFS_QMOPT_RES_INOS      0x0800000
 
 /*
- * flags for dqflush and dqflush_all.
- */
-#define XFS_QMOPT_SYNC          0x1000000
-#define XFS_QMOPT_ASYNC         0x2000000
-#define XFS_QMOPT_DELWRI        0x4000000
-
-/*
  * flags for dqalloc.
  */
-#define XFS_QMOPT_INHERIT       0x8000000
+#define XFS_QMOPT_INHERIT       0x1000000
 
 /*
  * flags to xfs_trans_mod_dquot.
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 9e15a1185362..6be05f756d59 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -1517,6 +1517,8 @@ xfs_rtfree_range(
          */
         error = xfs_rtfind_forw(mp, tp, end, mp->m_sb.sb_rextents - 1,
                 &postblock);
+        if (error)
+                return error;
         /*
          * If there are blocks not being freed at the front of the
          * old extent, add summary data for them to be allocated.
diff --git a/fs/xfs/xfs_rw.c b/fs/xfs/xfs_rw.c
index 5aa07caea5f1..e336742a58a4 100644
--- a/fs/xfs/xfs_rw.c
+++ b/fs/xfs/xfs_rw.c
@@ -47,48 +47,6 @@
 #include "xfs_trace.h"
 
 /*
- * This is a subroutine for xfs_write() and other writers (xfs_ioctl)
- * which clears the setuid and setgid bits when a file is written.
- */
-int
-xfs_write_clear_setuid(
-        xfs_inode_t     *ip)
-{
-        xfs_mount_t     *mp;
-        xfs_trans_t     *tp;
-        int             error;
-
-        mp = ip->i_mount;
-        tp = xfs_trans_alloc(mp, XFS_TRANS_WRITEID);
-        if ((error = xfs_trans_reserve(tp, 0,
-                                      XFS_WRITEID_LOG_RES(mp),
-                                      0, 0, 0))) {
-                xfs_trans_cancel(tp, 0);
-                return error;
-        }
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
-        xfs_trans_ihold(tp, ip);
-        ip->i_d.di_mode &= ~S_ISUID;
-
-        /*
-         * Note that we don't have to worry about mandatory
-         * file locking being disabled here because we only
-         * clear the S_ISGID bit if the Group execute bit is
-         * on, but if it was on then mandatory locking wouldn't
-         * have been enabled.
-         */
-        if (ip->i_d.di_mode & S_IXGRP) {
-                ip->i_d.di_mode &= ~S_ISGID;
-        }
-        xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-        xfs_trans_set_sync(tp);
-        error = xfs_trans_commit(tp, 0);
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        return 0;
-}
-
-/*
  * Force a shutdown of the filesystem instantly while keeping
  * the filesystem consistent. We don't do an unmount here; just shutdown
  * the shop, make sure that absolutely nothing persistent happens to
@@ -153,88 +111,6 @@ xfs_do_force_shutdown(
         }
 }
 
-
-/*
- * Called when we want to stop a buffer from getting written or read.
- * We attach the EIO error, muck with its flags, and call biodone
- * so that the proper iodone callbacks get called.
- */
-int
-xfs_bioerror(
-        xfs_buf_t *bp)
-{
-
-#ifdef XFSERRORDEBUG
-        ASSERT(XFS_BUF_ISREAD(bp) || bp->b_iodone);
-#endif
-
-        /*
-         * No need to wait until the buffer is unpinned.
-         * We aren't flushing it.
-         */
-        XFS_BUF_ERROR(bp, EIO);
-        /*
-         * We're calling biodone, so delete B_DONE flag. Either way
-         * we have to call the iodone callback, and calling biodone
-         * probably is the best way since it takes care of
-         * GRIO as well.
-         */
-        XFS_BUF_UNREAD(bp);
-        XFS_BUF_UNDELAYWRITE(bp);
-        XFS_BUF_UNDONE(bp);
-        XFS_BUF_STALE(bp);
-
-        XFS_BUF_CLR_BDSTRAT_FUNC(bp);
-        xfs_biodone(bp);
-
-        return (EIO);
-}
-
-/*
- * Same as xfs_bioerror, except that we are releasing the buffer
- * here ourselves, and avoiding the biodone call.
- * This is meant for userdata errors; metadata bufs come with
- * iodone functions attached, so that we can track down errors.
- */
-int
-xfs_bioerror_relse(
-        xfs_buf_t *bp)
-{
-        int64_t fl;
-
-        ASSERT(XFS_BUF_IODONE_FUNC(bp) != xfs_buf_iodone_callbacks);
-        ASSERT(XFS_BUF_IODONE_FUNC(bp) != xlog_iodone);
-
-        fl = XFS_BUF_BFLAGS(bp);
-        /*
-         * No need to wait until the buffer is unpinned.
-         * We aren't flushing it.
-         *
-         * chunkhold expects B_DONE to be set, whether
-         * we actually finish the I/O or not. We don't want to
-         * change that interface.
-         */
-        XFS_BUF_UNREAD(bp);
-        XFS_BUF_UNDELAYWRITE(bp);
-        XFS_BUF_DONE(bp);
-        XFS_BUF_STALE(bp);
-        XFS_BUF_CLR_IODONE_FUNC(bp);
-        XFS_BUF_CLR_BDSTRAT_FUNC(bp);
-        if (!(fl & XFS_B_ASYNC)) {
-                /*
-                 * Mark b_error and B_ERROR _both_.
-                 * Lot's of chunkcache code assumes that.
-                 * There's no reason to mark error for
-                 * ASYNC buffers.
-                 */
-                XFS_BUF_ERROR(bp, EIO);
-                XFS_BUF_FINISH_IOWAIT(bp);
-        } else {
-                xfs_buf_relse(bp);
-        }
-        return (EIO);
-}
-
 /*
  * Prints out an ALERT message about I/O error.
  */
@@ -306,37 +182,6 @@ xfs_read_buf(
 }
 
 /*
- * Wrapper around bwrite() so that we can trap
- * write errors, and act accordingly.
- */
-int
-xfs_bwrite(
-        struct xfs_mount *mp,
-        struct xfs_buf   *bp)
-{
-        int     error;
-
-        /*
-         * XXXsup how does this work for quotas.
-         */
-        XFS_BUF_SET_BDSTRAT_FUNC(bp, xfs_bdstrat_cb);
-        bp->b_mount = mp;
-        XFS_BUF_WRITE(bp);
-
-        if ((error = XFS_bwrite(bp))) {
-                ASSERT(mp);
-                /*
-                 * Cannot put a buftrace here since if the buffer is not
-                 * B_HOLD then we will brelse() the buffer before returning
-                 * from bwrite and we could be tracing a buffer that has
-                 * been reused.
-                 */
-                xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR);
-        }
-        return (error);
-}
-
-/*
  * helper function to extract extent size hint from inode
  */
 xfs_extlen_t
diff --git a/fs/xfs/xfs_rw.h b/fs/xfs/xfs_rw.h
index 571f2174435c..11c41ec6ed75 100644
--- a/fs/xfs/xfs_rw.h
+++ b/fs/xfs/xfs_rw.h
@@ -39,10 +39,6 @@ xfs_fsb_to_db(struct xfs_inode *ip, xfs_fsblock_t fsb)
 /*
  * Prototypes for functions in xfs_rw.c.
  */
-extern int xfs_write_clear_setuid(struct xfs_inode *ip);
-extern int xfs_bwrite(struct xfs_mount *mp, struct xfs_buf *bp);
-extern int xfs_bioerror(struct xfs_buf *bp);
-extern int xfs_bioerror_relse(struct xfs_buf *bp);
 extern int xfs_read_buf(struct xfs_mount *mp, xfs_buftarg_t *btp,
                         xfs_daddr_t blkno, int len, uint flags,
                         struct xfs_buf **bpp);
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 237badcbac3b..f73e358bae8d 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -796,7 +796,7 @@ _xfs_trans_commit(
         int                     sync;
 #define XFS_TRANS_LOGVEC_COUNT  16
         xfs_log_iovec_t         log_vector_fast[XFS_TRANS_LOGVEC_COUNT];
-        void                    *commit_iclog;
+        struct xlog_in_core     *commit_iclog;
         int                     shutdown;
 
         commit_lsn = -1;
@@ -981,9 +981,8 @@ shut_us_down:
          */
         if (sync) {
                 if (!error) {
-                        error = _xfs_log_force(mp, commit_lsn,
-                                      XFS_LOG_FORCE | XFS_LOG_SYNC,
-                                      log_flushed);
+                        error = _xfs_log_force_lsn(mp, commit_lsn,
+                                      XFS_LOG_SYNC, log_flushed);
                 }
                 XFS_STATS_INC(xs_trans_sync);
         } else {
@@ -1121,7 +1120,7 @@ xfs_trans_fill_vecs(
         tp->t_header.th_num_items = nitems;
         log_vector->i_addr = (xfs_caddr_t)&tp->t_header;
         log_vector->i_len = sizeof(xfs_trans_header_t);
-        XLOG_VEC_SET_TYPE(log_vector, XLOG_REG_TYPE_TRANSHDR);
+        log_vector->i_type = XLOG_REG_TYPE_TRANSHDR;
 }
 
 
diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
index ca64f33c63a3..79c8bab9dfff 100644
--- a/fs/xfs/xfs_trans.h
+++ b/fs/xfs/xfs_trans.h
@@ -861,8 +861,7 @@ typedef struct xfs_item_ops {
 #define XFS_ITEM_SUCCESS        0
 #define XFS_ITEM_PINNED         1
 #define XFS_ITEM_LOCKED         2
-#define XFS_ITEM_FLUSHING       3
-#define XFS_ITEM_PUSHBUF        4
+#define XFS_ITEM_PUSHBUF        3
 
 /*
  * This structure is used to maintain a list of block ranges that have been
@@ -911,7 +910,7 @@ typedef struct xfs_trans {
         unsigned int            t_blk_res_used; /* # of resvd blocks used */
         unsigned int            t_rtx_res;      /* # of rt extents resvd */
         unsigned int            t_rtx_res_used; /* # of resvd rt extents used */
-        xfs_log_ticket_t        t_ticket;       /* log mgr ticket */
+        struct xlog_ticket      *t_ticket;      /* log mgr ticket */
         xfs_lsn_t               t_lsn;          /* log seq num of start of
                                                  * transaction. */
         xfs_lsn_t               t_commit_lsn;   /* log seq num of end of
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index 2ffc570679be..e799824f7245 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -237,14 +237,15 @@ out:
 }
 
 /*
- * Function that does the work of pushing on the AIL
+ * xfsaild_push does the work of pushing on the AIL.  Returning a timeout of
+ * zero indicates that the caller should sleep until woken.
  */
 long
 xfsaild_push(
         struct xfs_ail  *ailp,
         xfs_lsn_t       *last_lsn)
 {
-        long            tout = 1000; /* milliseconds */
+        long            tout = 0;
         xfs_lsn_t       last_pushed_lsn = *last_lsn;
         xfs_lsn_t       target =  ailp->xa_target;
         xfs_lsn_t       lsn;
@@ -252,6 +253,7 @@ xfsaild_push(
         int             flush_log, count, stuck;
         xfs_mount_t     *mp = ailp->xa_mount;
         struct xfs_ail_cursor   *cur = &ailp->xa_cursors;
+        int             push_xfsbufd = 0;
 
         spin_lock(&ailp->xa_lock);
         xfs_trans_ail_cursor_init(ailp, cur);
@@ -262,7 +264,7 @@ xfsaild_push(
                  */
                 xfs_trans_ail_cursor_done(ailp, cur);
                 spin_unlock(&ailp->xa_lock);
-                last_pushed_lsn = 0;
+                *last_lsn = 0;
                 return tout;
         }
 
@@ -279,7 +281,6 @@ xfsaild_push(
          * prevents use from spinning when we can't do anything or there is
          * lots of contention on the AIL lists.
          */
-        tout = 10;
         lsn = lip->li_lsn;
         flush_log = stuck = count = 0;
         while ((XFS_LSN_CMP(lip->li_lsn, target) < 0)) {
@@ -308,6 +309,7 @@ xfsaild_push(
                         XFS_STATS_INC(xs_push_ail_pushbuf);
                         IOP_PUSHBUF(lip);
                         last_pushed_lsn = lsn;
+                        push_xfsbufd = 1;
                         break;
 
                 case XFS_ITEM_PINNED:
@@ -322,12 +324,6 @@ xfsaild_push(
                         stuck++;
                         break;
 
-                case XFS_ITEM_FLUSHING:
-                        XFS_STATS_INC(xs_push_ail_flushing);
-                        last_pushed_lsn = lsn;
-                        stuck++;
-                        break;
-
                 default:
                         ASSERT(0);
                         break;
@@ -371,19 +367,24 @@ xfsaild_push(
                  * move forward in the AIL.
                  */
                 XFS_STATS_INC(xs_push_ail_flush);
-                xfs_log_force(mp, (xfs_lsn_t)0, XFS_LOG_FORCE);
+                xfs_log_force(mp, 0);
+        }
+
+        if (push_xfsbufd) {
+                /* we've got delayed write buffers to flush */
+                wake_up_process(mp->m_ddev_targp->bt_task);
         }
 
         if (!count) {
                 /* We're past our target or empty, so idle */
-                tout = 1000;
+                last_pushed_lsn = 0;
         } else if (XFS_LSN_CMP(lsn, target) >= 0) {
                 /*
                  * We reached the target so wait a bit longer for I/O to
                  * complete and remove pushed items from the AIL before we
                  * start the next scan from the start of the AIL.
                  */
-                tout += 20;
+                tout = 50;
                 last_pushed_lsn = 0;
         } else if ((stuck * 100) / count > 90) {
                 /*
@@ -395,11 +396,14 @@ xfsaild_push(
                  * Backoff a bit more to allow some I/O to complete before
                  * continuing from where we were.
                  */
-                tout += 10;
+                tout = 20;
+        } else {
+                /* more to do, but wait a short while before continuing */
+                tout = 10;
         }
         *last_lsn = last_pushed_lsn;
         return tout;
-}       /* xfsaild_push */
+}
 
 
 /*
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 49130628d5ef..fb586360d1c9 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -46,6 +46,65 @@ STATIC xfs_buf_t *xfs_trans_buf_item_match(xfs_trans_t *, xfs_buftarg_t *,
 STATIC xfs_buf_t *xfs_trans_buf_item_match_all(xfs_trans_t *, xfs_buftarg_t *,
                 xfs_daddr_t, int);
 
+/*
+ * Add the locked buffer to the transaction.
+ *
+ * The buffer must be locked, and it cannot be associated with any
+ * transaction.
+ *
+ * If the buffer does not yet have a buf log item associated with it,
+ * then allocate one for it.  Then add the buf item to the transaction.
+ */
+STATIC void
+_xfs_trans_bjoin(
+        struct xfs_trans        *tp,
+        struct xfs_buf          *bp,
+        int                     reset_recur)
+{
+        struct xfs_buf_log_item *bip;
+
+        ASSERT(XFS_BUF_ISBUSY(bp));
+        ASSERT(XFS_BUF_FSPRIVATE2(bp, void *) == NULL);
+
+        /*
+         * The xfs_buf_log_item pointer is stored in b_fsprivate.  If
+         * it doesn't have one yet, then allocate one and initialize it.
+         * The checks to see if one is there are in xfs_buf_item_init().
+         */
+        xfs_buf_item_init(bp, tp->t_mountp);
+        bip = XFS_BUF_FSPRIVATE(bp, xfs_buf_log_item_t *);
+        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
+        ASSERT(!(bip->bli_format.blf_flags & XFS_BLI_CANCEL));
+        ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
+        if (reset_recur)
+                bip->bli_recur = 0;
+
+        /*
+         * Take a reference for this transaction on the buf item.
+         */
+        atomic_inc(&bip->bli_refcount);
+
+        /*
+         * Get a log_item_desc to point at the new item.
+         */
+        (void) xfs_trans_add_item(tp, (xfs_log_item_t *)bip);
+
+        /*
+         * Initialize b_fsprivate2 so we can find it with incore_match()
+         * in xfs_trans_get_buf() and friends above.
+         */
+        XFS_BUF_SET_FSPRIVATE2(bp, tp);
+
+}
+
+void
+xfs_trans_bjoin(
+        struct xfs_trans        *tp,
+        struct xfs_buf          *bp)
+{
+        _xfs_trans_bjoin(tp, bp, 0);
+        trace_xfs_trans_bjoin(bp->b_fspriv);
+}
 
 /*
  * Get and lock the buffer for the caller if it is not already
@@ -75,13 +134,14 @@ xfs_trans_get_buf(xfs_trans_t	*tp,
         xfs_buf_log_item_t      *bip;
 
         if (flags == 0)
-                flags = XFS_BUF_LOCK | XFS_BUF_MAPPED;
+                flags = XBF_LOCK | XBF_MAPPED;
 
         /*
          * Default to a normal get_buf() call if the tp is NULL.
          */
         if (tp == NULL)
-                return xfs_buf_get(target_dev, blkno, len, flags | BUF_BUSY);
+                return xfs_buf_get(target_dev, blkno, len,
+                                   flags | XBF_DONT_BLOCK);
 
         /*
          * If we find the buffer in the cache with this transaction
@@ -117,54 +177,22 @@ xfs_trans_get_buf(xfs_trans_t	*tp,
         }
 
         /*
-         * We always specify the BUF_BUSY flag within a transaction so
-         * that get_buf does not try to push out a delayed write buffer
+         * We always specify the XBF_DONT_BLOCK flag within a transaction
+         * so that get_buf does not try to push out a delayed write buffer
          * which might cause another transaction to take place (if the
          * buffer was delayed alloc).  Such recursive transactions can
          * easily deadlock with our current transaction as well as cause
          * us to run out of stack space.
          */
-        bp = xfs_buf_get(target_dev, blkno, len, flags | BUF_BUSY);
+        bp = xfs_buf_get(target_dev, blkno, len, flags | XBF_DONT_BLOCK);
         if (bp == NULL) {
                 return NULL;
         }
 
         ASSERT(!XFS_BUF_GETERROR(bp));
 
-        /*
-         * The xfs_buf_log_item pointer is stored in b_fsprivate.  If
-         * it doesn't have one yet, then allocate one and initialize it.
-         * The checks to see if one is there are in xfs_buf_item_init().
-         */
-        xfs_buf_item_init(bp, tp->t_mountp);
-
-        /*
-         * Set the recursion count for the buffer within this transaction
-         * to 0.
-         */
-        bip = XFS_BUF_FSPRIVATE(bp, xfs_buf_log_item_t*);
-        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLI_CANCEL));
-        ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
-        bip->bli_recur = 0;
-
-        /*
-         * Take a reference for this transaction on the buf item.
-         */
-        atomic_inc(&bip->bli_refcount);
-
-        /*
-         * Get a log_item_desc to point at the new item.
-         */
-        (void) xfs_trans_add_item(tp, (xfs_log_item_t*)bip);
-
-        /*
-         * Initialize b_fsprivate2 so we can find it with incore_match()
-         * above.
-         */
-        XFS_BUF_SET_FSPRIVATE2(bp, tp);
-
-        trace_xfs_trans_get_buf(bip);
+        _xfs_trans_bjoin(tp, bp, 1);
+        trace_xfs_trans_get_buf(bp->b_fspriv);
         return (bp);
 }
 
@@ -209,44 +237,11 @@ xfs_trans_getsb(xfs_trans_t	*tp,
         }
 
         bp = xfs_getsb(mp, flags);
-        if (bp == NULL) {
+        if (bp == NULL)
                 return NULL;
-        }
-
-        /*
-         * The xfs_buf_log_item pointer is stored in b_fsprivate.  If
-         * it doesn't have one yet, then allocate one and initialize it.
-         * The checks to see if one is there are in xfs_buf_item_init().
-         */
-        xfs_buf_item_init(bp, mp);
-
-        /*
-         * Set the recursion count for the buffer within this transaction
-         * to 0.
-         */
-        bip = XFS_BUF_FSPRIVATE(bp, xfs_buf_log_item_t*);
-        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLI_CANCEL));
-        ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
-        bip->bli_recur = 0;
-
-        /*
-         * Take a reference for this transaction on the buf item.
-         */
-        atomic_inc(&bip->bli_refcount);
-
-        /*
-         * Get a log_item_desc to point at the new item.
-         */
-        (void) xfs_trans_add_item(tp, (xfs_log_item_t*)bip);
-
-        /*
-         * Initialize b_fsprivate2 so we can find it with incore_match()
-         * above.
-         */
-        XFS_BUF_SET_FSPRIVATE2(bp, tp);
 
-        trace_xfs_trans_getsb(bip);
+        _xfs_trans_bjoin(tp, bp, 1);
+        trace_xfs_trans_getsb(bp->b_fspriv);
         return (bp);
 }
 
@@ -290,15 +285,15 @@ xfs_trans_read_buf(
         int                     error;
 
         if (flags == 0)
-                flags = XFS_BUF_LOCK | XFS_BUF_MAPPED;
+                flags = XBF_LOCK | XBF_MAPPED;
 
         /*
          * Default to a normal get_buf() call if the tp is NULL.
          */
         if (tp == NULL) {
-                bp = xfs_buf_read(target, blkno, len, flags | BUF_BUSY);
+                bp = xfs_buf_read(target, blkno, len, flags | XBF_DONT_BLOCK);
                 if (!bp)
-                        return (flags & XFS_BUF_TRYLOCK) ?
+                        return (flags & XBF_TRYLOCK) ?
                                         EAGAIN : XFS_ERROR(ENOMEM);
 
                 if (XFS_BUF_GETERROR(bp) != 0) {
@@ -385,14 +380,14 @@ xfs_trans_read_buf(
         }
 
         /*
-         * We always specify the BUF_BUSY flag within a transaction so
-         * that get_buf does not try to push out a delayed write buffer
+         * We always specify the XBF_DONT_BLOCK flag within a transaction
+         * so that get_buf does not try to push out a delayed write buffer
          * which might cause another transaction to take place (if the
          * buffer was delayed alloc).  Such recursive transactions can
          * easily deadlock with our current transaction as well as cause
          * us to run out of stack space.
          */
-        bp = xfs_buf_read(target, blkno, len, flags | BUF_BUSY);
+        bp = xfs_buf_read(target, blkno, len, flags | XBF_DONT_BLOCK);
         if (bp == NULL) {
                 *bpp = NULL;
                 return 0;
@@ -424,40 +419,9 @@ xfs_trans_read_buf(
         if (XFS_FORCED_SHUTDOWN(mp))
                 goto shutdown_abort;
 
-        /*
-         * The xfs_buf_log_item pointer is stored in b_fsprivate.  If
-         * it doesn't have one yet, then allocate one and initialize it.
-         * The checks to see if one is there are in xfs_buf_item_init().
-         */
-        xfs_buf_item_init(bp, tp->t_mountp);
+        _xfs_trans_bjoin(tp, bp, 1);
+        trace_xfs_trans_read_buf(bp->b_fspriv);
 
-        /*
-         * Set the recursion count for the buffer within this transaction
-         * to 0.
-         */
-        bip = XFS_BUF_FSPRIVATE(bp, xfs_buf_log_item_t*);
-        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLI_CANCEL));
-        ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
-        bip->bli_recur = 0;
-
-        /*
-         * Take a reference for this transaction on the buf item.
-         */
-        atomic_inc(&bip->bli_refcount);
-
-        /*
-         * Get a log_item_desc to point at the new item.
-         */
-        (void) xfs_trans_add_item(tp, (xfs_log_item_t*)bip);
-
-        /*
-         * Initialize b_fsprivate2 so we can find it with incore_match()
-         * above.
-         */
-        XFS_BUF_SET_FSPRIVATE2(bp, tp);
-
-        trace_xfs_trans_read_buf(bip);
         *bpp = bp;
         return 0;
 
@@ -472,8 +436,8 @@ shutdown_abort:
         if (XFS_BUF_ISSTALE(bp) && XFS_BUF_ISDELAYWRITE(bp))
                 cmn_err(CE_NOTE, "about to pop assert, bp == 0x%p", bp);
 #endif
-        ASSERT((XFS_BUF_BFLAGS(bp) & (XFS_B_STALE|XFS_B_DELWRI)) !=
-                                                (XFS_B_STALE|XFS_B_DELWRI));
+        ASSERT((XFS_BUF_BFLAGS(bp) & (XBF_STALE|XBF_DELWRI)) !=
+                                     (XBF_STALE|XBF_DELWRI));
 
         trace_xfs_trans_read_buf_shut(bp, _RET_IP_);
         xfs_buf_relse(bp);
@@ -622,53 +586,6 @@ xfs_trans_brelse(xfs_trans_t	*tp,
 }
 
 /*
- * Add the locked buffer to the transaction.
- * The buffer must be locked, and it cannot be associated with any
- * transaction.
- *
- * If the buffer does not yet have a buf log item associated with it,
- * then allocate one for it.  Then add the buf item to the transaction.
- */
-void
-xfs_trans_bjoin(xfs_trans_t     *tp,
-                xfs_buf_t       *bp)
-{
-        xfs_buf_log_item_t      *bip;
-
-        ASSERT(XFS_BUF_ISBUSY(bp));
-        ASSERT(XFS_BUF_FSPRIVATE2(bp, void *) == NULL);
-
-        /*
-         * The xfs_buf_log_item pointer is stored in b_fsprivate.  If
-         * it doesn't have one yet, then allocate one and initialize it.
-         * The checks to see if one is there are in xfs_buf_item_init().
-         */
-        xfs_buf_item_init(bp, tp->t_mountp);
-        bip = XFS_BUF_FSPRIVATE(bp, xfs_buf_log_item_t *);
-        ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLI_CANCEL));
-        ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
-
-        /*
-         * Take a reference for this transaction on the buf item.
-         */
-        atomic_inc(&bip->bli_refcount);
-
-        /*
-         * Get a log_item_desc to point at the new item.
-         */
-        (void) xfs_trans_add_item(tp, (xfs_log_item_t *)bip);
-
-        /*
-         * Initialize b_fsprivate2 so we can find it with incore_match()
-         * in xfs_trans_get_buf() and friends above.
-         */
-        XFS_BUF_SET_FSPRIVATE2(bp, tp);
-
-        trace_xfs_trans_bjoin(bip);
-}
-
-/*
  * Mark the buffer as not needing to be unlocked when the buf item's
  * IOP_UNLOCK() routine is called.  The buffer must already be locked
  * and associated with the given transaction.
diff --git a/fs/xfs/xfs_types.h b/fs/xfs/xfs_types.h
index d725428c9df6..b09904555d07 100644
--- a/fs/xfs/xfs_types.h
+++ b/fs/xfs/xfs_types.h
@@ -151,8 +151,8 @@ typedef enum {
 } xfs_btnum_t;
 
 struct xfs_name {
-        const char      *name;
-        int             len;
+        const unsigned char     *name;
+        int                     len;
 };
 
 #endif  /* __XFS_TYPES_H__ */
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 6558ffd8d140..9d376be0ea38 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -70,7 +70,6 @@ xfs_setattr(
         uint                    commit_flags=0;
         uid_t                   uid=0, iuid=0;
         gid_t                   gid=0, igid=0;
-        int                     timeflags = 0;
         struct xfs_dquot        *udqp, *gdqp, *olddquot1, *olddquot2;
         int                     need_iolock = 1;
 
@@ -135,16 +134,13 @@ xfs_setattr(
         if (flags & XFS_ATTR_NOLOCK)
                 need_iolock = 0;
         if (!(mask & ATTR_SIZE)) {
-                if ((mask != (ATTR_CTIME|ATTR_ATIME|ATTR_MTIME)) ||
-                    (mp->m_flags & XFS_MOUNT_WSYNC)) {
-                        tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
-                        commit_flags = 0;
-                        if ((code = xfs_trans_reserve(tp, 0,
-                                                     XFS_ICHANGE_LOG_RES(mp), 0,
-                                                     0, 0))) {
-                                lock_flags = 0;
-                                goto error_return;
-                        }
+                tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
+                commit_flags = 0;
+                code = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp),
+                                         0, 0, 0);
+                if (code) {
+                        lock_flags = 0;
+                        goto error_return;
                 }
         } else {
                 if (DM_EVENT_ENABLED(ip, DM_EVENT_TRUNCATE) &&
@@ -260,7 +256,7 @@ xfs_setattr(
                     iattr->ia_size > ip->i_d.di_size) {
                         code = xfs_flush_pages(ip,
                                         ip->i_d.di_size, iattr->ia_size,
-                                        XFS_B_ASYNC, FI_NONE);
+                                        XBF_ASYNC, FI_NONE);
                 }
 
                 /* wait for all I/O to complete */
@@ -295,15 +291,23 @@ xfs_setattr(
                  * or we are explicitly asked to change it. This handles
                  * the semantic difference between truncate() and ftruncate()
                  * as implemented in the VFS.
+                 *
+                 * The regular truncate() case without ATTR_CTIME and ATTR_MTIME
+                 * is a special case where we need to update the times despite
+                 * not having these flags set.  For all other operations the
+                 * VFS set these flags explicitly if it wants a timestamp
+                 * update.
                  */
-                if (iattr->ia_size != ip->i_size || (mask & ATTR_CTIME))
-                        timeflags |= XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG;
+                if (iattr->ia_size != ip->i_size &&
+                    (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
+                        iattr->ia_ctime = iattr->ia_mtime =
+                                current_fs_time(inode->i_sb);
+                        mask |= ATTR_CTIME | ATTR_MTIME;
+                }
 
                 if (iattr->ia_size > ip->i_size) {
                         ip->i_d.di_size = iattr->ia_size;
                         ip->i_size = iattr->ia_size;
-                        if (!(flags & XFS_ATTR_DMI))
-                                xfs_ichgtime(ip, XFS_ICHGTIME_CHG);
                         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
                 } else if (iattr->ia_size <= ip->i_size ||
                            (iattr->ia_size == 0 && ip->i_d.di_nextents)) {
@@ -374,9 +378,6 @@ xfs_setattr(
                         ip->i_d.di_gid = gid;
                         inode->i_gid = gid;
                 }
-
-                xfs_trans_log_inode (tp, ip, XFS_ILOG_CORE);
-                timeflags |= XFS_ICHGTIME_CHG;
         }
 
         /*
@@ -393,51 +394,37 @@ xfs_setattr(
 
                 inode->i_mode &= S_IFMT;
                 inode->i_mode |= mode & ~S_IFMT;
-
-                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-                timeflags |= XFS_ICHGTIME_CHG;
         }
 
         /*
          * Change file access or modified times.
          */
-        if (mask & (ATTR_ATIME|ATTR_MTIME)) {
-                if (mask & ATTR_ATIME) {
-                        inode->i_atime = iattr->ia_atime;
-                        ip->i_d.di_atime.t_sec = iattr->ia_atime.tv_sec;
-                        ip->i_d.di_atime.t_nsec = iattr->ia_atime.tv_nsec;
-                        ip->i_update_core = 1;
-                }
-                if (mask & ATTR_MTIME) {
-                        inode->i_mtime = iattr->ia_mtime;
-                        ip->i_d.di_mtime.t_sec = iattr->ia_mtime.tv_sec;
-                        ip->i_d.di_mtime.t_nsec = iattr->ia_mtime.tv_nsec;
-                        timeflags &= ~XFS_ICHGTIME_MOD;
-                        timeflags |= XFS_ICHGTIME_CHG;
-                }
-                if (tp && (mask & (ATTR_MTIME_SET|ATTR_ATIME_SET)))
-                        xfs_trans_log_inode (tp, ip, XFS_ILOG_CORE);
+        if (mask & ATTR_ATIME) {
+                inode->i_atime = iattr->ia_atime;
+                ip->i_d.di_atime.t_sec = iattr->ia_atime.tv_sec;
+                ip->i_d.di_atime.t_nsec = iattr->ia_atime.tv_nsec;
+                ip->i_update_core = 1;
         }
-
-        /*
-         * Change file inode change time only if ATTR_CTIME set
-         * AND we have been called by a DMI function.
-         */
-
-        if ((flags & XFS_ATTR_DMI) && (mask & ATTR_CTIME)) {
+        if (mask & ATTR_CTIME) {
                 inode->i_ctime = iattr->ia_ctime;
                 ip->i_d.di_ctime.t_sec = iattr->ia_ctime.tv_sec;
                 ip->i_d.di_ctime.t_nsec = iattr->ia_ctime.tv_nsec;
                 ip->i_update_core = 1;
-                timeflags &= ~XFS_ICHGTIME_CHG;
+        }
+        if (mask & ATTR_MTIME) {
+                inode->i_mtime = iattr->ia_mtime;
+                ip->i_d.di_mtime.t_sec = iattr->ia_mtime.tv_sec;
+                ip->i_d.di_mtime.t_nsec = iattr->ia_mtime.tv_nsec;
+                ip->i_update_core = 1;
         }
 
         /*
-         * Send out timestamp changes that need to be set to the
-         * current time.  Not done when called by a DMI function.
+         * And finally, log the inode core if any attribute in it
+         * has been changed.
          */
-        if (timeflags && !(flags & XFS_ATTR_DMI))
-                xfs_ichgtime(ip, timeflags);
+        if (mask & (ATTR_UID|ATTR_GID|ATTR_MODE|
+                    ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
+                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
 
         XFS_STATS_INC(xs_ig_attrchg);
 
@@ -452,12 +439,10 @@ xfs_setattr(
          * mix so this probably isn't worth the trouble to optimize.
          */
         code = 0;
-        if (tp) {
-                if (mp->m_flags & XFS_MOUNT_WSYNC)
-                        xfs_trans_set_sync(tp);
+        if (mp->m_flags & XFS_MOUNT_WSYNC)
+                xfs_trans_set_sync(tp);
 
-                code = xfs_trans_commit(tp, commit_flags);
-        }
+        code = xfs_trans_commit(tp, commit_flags);
 
         xfs_iunlock(ip, lock_flags);
 
@@ -599,116 +584,6 @@ xfs_readlink(
 }
 
 /*
- * xfs_fsync
- *
- * This is called to sync the inode and its data out to disk.  We need to hold
- * the I/O lock while flushing the data, and the inode lock while flushing the
- * inode.  The inode lock CANNOT be held while flushing the data, so acquire
- * after we're done with that.
- */
-int
-xfs_fsync(
-        xfs_inode_t     *ip)
-{
-        xfs_trans_t     *tp;
-        int             error = 0;
-        int             log_flushed = 0, changed = 1;
-
-        xfs_itrace_entry(ip);
-
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
-                return XFS_ERROR(EIO);
-
-        /*
-         * We always need to make sure that the required inode state is safe on
-         * disk.  The inode might be clean but we still might need to force the
-         * log because of committed transactions that haven't hit the disk yet.
-         * Likewise, there could be unflushed non-transactional changes to the
-         * inode core that have to go to disk and this requires us to issue
-         * a synchronous transaction to capture these changes correctly.
-         *
-         * This code relies on the assumption that if the update_* fields
-         * of the inode are clear and the inode is unpinned then it is clean
-         * and no action is required.
-         */
-        xfs_ilock(ip, XFS_ILOCK_SHARED);
-
-        if (!ip->i_update_core) {
-                /*
-                 * Timestamps/size haven't changed since last inode flush or
-                 * inode transaction commit.  That means either nothing got
-                 * written or a transaction committed which caught the updates.
-                 * If the latter happened and the transaction hasn't hit the
-                 * disk yet, the inode will be still be pinned.  If it is,
-                 * force the log.
-                 */
-
-                xfs_iunlock(ip, XFS_ILOCK_SHARED);
-
-                if (xfs_ipincount(ip)) {
-                        error = _xfs_log_force(ip->i_mount, (xfs_lsn_t)0,
-                                      XFS_LOG_FORCE | XFS_LOG_SYNC,
-                                      &log_flushed);
-                } else {
-                        /*
-                         * If the inode is not pinned and nothing has changed
-                         * we don't need to flush the cache.
-                         */
-                        changed = 0;
-                }
-        } else  {
-                /*
-                 * Kick off a transaction to log the inode core to get the
-                 * updates.  The sync transaction will also force the log.
-                 */
-                xfs_iunlock(ip, XFS_ILOCK_SHARED);
-                tp = xfs_trans_alloc(ip->i_mount, XFS_TRANS_FSYNC_TS);
-                error = xfs_trans_reserve(tp, 0,
-                                XFS_FSYNC_TS_LOG_RES(ip->i_mount), 0, 0, 0);
-                if (error) {
-                        xfs_trans_cancel(tp, 0);
-                        return error;
-                }
-                xfs_ilock(ip, XFS_ILOCK_EXCL);
-
-                /*
-                 * Note - it's possible that we might have pushed ourselves out
-                 * of the way during trans_reserve which would flush the inode.
-                 * But there's no guarantee that the inode buffer has actually
-                 * gone out yet (it's delwri).  Plus the buffer could be pinned
-                 * anyway if it's part of an inode in another recent
-                 * transaction.  So we play it safe and fire off the
-                 * transaction anyway.
-                 */
-                xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL);
-                xfs_trans_ihold(tp, ip);
-                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-                xfs_trans_set_sync(tp);
-                error = _xfs_trans_commit(tp, 0, &log_flushed);
-
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        }
-
-        if ((ip->i_mount->m_flags & XFS_MOUNT_BARRIER) && changed) {
-                /*
-                 * If the log write didn't issue an ordered tag we need
-                 * to flush the disk cache for the data device now.
-                 */
-                if (!log_flushed)
-                        xfs_blkdev_issue_flush(ip->i_mount->m_ddev_targp);
-
-                /*
-                 * If this inode is on the RT dev we need to flush that
-                 * cache as well.
-                 */
-                if (XFS_IS_REALTIME_INODE(ip))
-                        xfs_blkdev_issue_flush(ip->i_mount->m_rtdev_targp);
-        }
-
-        return error;
-}
-
-/*
  * Flags for xfs_free_eofblocks
  */
 #define XFS_FREE_EOF_TRYLOCK    (1<<0)
@@ -1111,7 +986,7 @@ xfs_release(
                  */
                 truncated = xfs_iflags_test_and_clear(ip, XFS_ITRUNCATED);
                 if (truncated && VN_DIRTY(VFS_I(ip)) && ip->i_delayed_blks > 0)
-                        xfs_flush_pages(ip, 0, -1, XFS_B_ASYNC, FI_NONE);
+                        xfs_flush_pages(ip, 0, -1, XBF_ASYNC, FI_NONE);
         }
 
         if (ip->i_d.di_nlink != 0) {
@@ -2214,7 +2089,8 @@ xfs_symlink(
         if (DM_EVENT_ENABLED(dp, DM_EVENT_SYMLINK)) {
                 error = XFS_SEND_NAMESP(mp, DM_EVENT_SYMLINK, dp,
                                         DM_RIGHT_NULL, NULL, DM_RIGHT_NULL,
-                                        link_name->name, target_path, 0, 0, 0);
+                                        link_name->name,
+                                        (unsigned char *)target_path, 0, 0, 0);
                 if (error)
                         return error;
         }
@@ -2410,7 +2286,8 @@ std_return:
                                         dp, DM_RIGHT_NULL,
                                         error ? NULL : ip,
                                         DM_RIGHT_NULL, link_name->name,
-                                        target_path, 0, error, 0);
+                                        (unsigned char *)target_path,
+                                        0, error, 0);
         }
 
         if (!error)
diff --git a/fs/xfs/xfs_vnodeops.h b/fs/xfs/xfs_vnodeops.h
index 167a467403a5..d8dfa8d0dadd 100644
--- a/fs/xfs/xfs_vnodeops.h
+++ b/fs/xfs/xfs_vnodeops.h
@@ -21,7 +21,6 @@ int xfs_setattr(struct xfs_inode *ip, struct iattr *vap, int flags);
 #define XFS_ATTR_NOACL          0x08    /* Don't call xfs_acl_chmod */
 
 int xfs_readlink(struct xfs_inode *ip, char *link);
-int xfs_fsync(struct xfs_inode *ip);
 int xfs_release(struct xfs_inode *ip);
 int xfs_inactive(struct xfs_inode *ip);
 int xfs_lookup(struct xfs_inode *dp, struct xfs_name *name,
@@ -43,25 +42,13 @@ int xfs_change_file_space(struct xfs_inode *ip, int cmd,
 int xfs_rename(struct xfs_inode *src_dp, struct xfs_name *src_name,
                 struct xfs_inode *src_ip, struct xfs_inode *target_dp,
                 struct xfs_name *target_name, struct xfs_inode *target_ip);
-int xfs_attr_get(struct xfs_inode *ip, const char *name, char *value,
-                int *valuelenp, int flags);
-int xfs_attr_set(struct xfs_inode *dp, const char *name, char *value,
-                int valuelen, int flags);
-int xfs_attr_remove(struct xfs_inode *dp, const char *name, int flags);
+int xfs_attr_get(struct xfs_inode *ip, const unsigned char *name,
+                unsigned char *value, int *valuelenp, int flags);
+int xfs_attr_set(struct xfs_inode *dp, const unsigned char *name,
+                unsigned char *value, int valuelen, int flags);
+int xfs_attr_remove(struct xfs_inode *dp, const unsigned char *name, int flags);
 int xfs_attr_list(struct xfs_inode *dp, char *buffer, int bufsize,
                 int flags, struct attrlist_cursor_kern *cursor);
-ssize_t xfs_read(struct xfs_inode *ip, struct kiocb *iocb,
-                const struct iovec *iovp, unsigned int segs,
-                loff_t *offset, int ioflags);
-ssize_t xfs_splice_read(struct xfs_inode *ip, struct file *infilp,
-                loff_t *ppos, struct pipe_inode_info *pipe, size_t count,
-                int flags, int ioflags);
-ssize_t xfs_splice_write(struct xfs_inode *ip,
-                struct pipe_inode_info *pipe, struct file *outfilp,
-                loff_t *ppos, size_t count, int flags, int ioflags);
-ssize_t xfs_write(struct xfs_inode *xip, struct kiocb *iocb,
-                const struct iovec *iovp, unsigned int nsegs,
-                loff_t *offset, int ioflags);
 int xfs_bmap(struct xfs_inode *ip, xfs_off_t offset, ssize_t count,
                 int flags, struct xfs_iomap *iomapp, int *niomaps);
 void xfs_tosspages(struct xfs_inode *inode, xfs_off_t first,
@@ -72,4 +59,6 @@ int xfs_flush_pages(struct xfs_inode *ip, xfs_off_t first,
                 xfs_off_t last, uint64_t flags, int fiopt);
 int xfs_wait_on_pages(struct xfs_inode *ip, xfs_off_t first, xfs_off_t last);
 
+int xfs_zero_eof(struct xfs_inode *, xfs_off_t, xfs_fsize_t);
+
 #endif /* _XFS_VNODEOPS_H */