205 files changed, 5893 insertions, 4300 deletions

diff --git a/fs/adfs/adfs.h b/fs/adfs/adfs.h
index 9cc18775b832..2ff622f6f547 100644
--- a/fs/adfs/adfs.h
+++ b/fs/adfs/adfs.h
@@ -121,7 +121,7 @@ struct adfs_discmap {
 
 /* Inode stuff */
 struct inode *adfs_iget(struct super_block *sb, struct object_info *obj);
-int adfs_write_inode(struct inode *inode,int unused);
+int adfs_write_inode(struct inode *inode, struct writeback_control *wbc);
 int adfs_notify_change(struct dentry *dentry, struct iattr *attr);
 
 /* map.c */
diff --git a/fs/adfs/inode.c b/fs/adfs/inode.c
index 3f57ce4bee5d..0f5e30978135 100644
--- a/fs/adfs/inode.c
+++ b/fs/adfs/inode.c
@@ -9,6 +9,7 @@
  */
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
 #include "adfs.h"
 
 /*
@@ -360,7 +361,7 @@ out:
  * The adfs-specific inode data has already been updated by
  * adfs_notify_change()
  */
-int adfs_write_inode(struct inode *inode, int wait)
+int adfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct super_block *sb = inode->i_sb;
         struct object_info obj;
@@ -375,7 +376,7 @@ int adfs_write_inode(struct inode *inode, int wait)
         obj.attr        = ADFS_I(inode)->attr;
         obj.size        = inode->i_size;
 
-        ret = adfs_dir_update(sb, &obj, wait);
+        ret = adfs_dir_update(sb, &obj, wbc->sync_mode == WB_SYNC_ALL);
         unlock_kernel();
         return ret;
 }
diff --git a/fs/affs/affs.h b/fs/affs/affs.h
index 0e40caaba456..861dae68ac12 100644
--- a/fs/affs/affs.h
+++ b/fs/affs/affs.h
@@ -175,7 +175,8 @@ extern void			 affs_delete_inode(struct inode *inode);
 extern void                      affs_clear_inode(struct inode *inode);
 extern struct inode             *affs_iget(struct super_block *sb,
                                         unsigned long ino);
-extern int                       affs_write_inode(struct inode *inode, int);
+extern int                       affs_write_inode(struct inode *inode,
+                                        struct writeback_control *wbc);
 extern int                       affs_add_entry(struct inode *dir, struct inode *inode, struct dentry *dentry, s32 type);
 
 /* file.c */
diff --git a/fs/affs/inode.c b/fs/affs/inode.c
index 3c4ec7d864c4..c9744d771d98 100644
--- a/fs/affs/inode.c
+++ b/fs/affs/inode.c
@@ -166,7 +166,7 @@ bad_inode:
 }
 
 int
-affs_write_inode(struct inode *inode, int unused)
+affs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct super_block      *sb = inode->i_sb;
         struct buffer_head      *bh;
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 6ece2a13bf71..c54dad4e6063 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -733,7 +733,6 @@ extern int afs_write_end(struct file *file, struct address_space *mapping,
                         struct page *page, void *fsdata);
 extern int afs_writepage(struct page *, struct writeback_control *);
 extern int afs_writepages(struct address_space *, struct writeback_control *);
-extern int afs_write_inode(struct inode *, int);
 extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *);
 extern ssize_t afs_file_write(struct kiocb *, const struct iovec *,
                               unsigned long, loff_t);
diff --git a/fs/afs/super.c b/fs/afs/super.c
index e1ea1c240b6a..14f6431598ad 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -48,7 +48,6 @@ struct file_system_type afs_fs_type = {
 static const struct super_operations afs_super_ops = {
         .statfs         = afs_statfs,
         .alloc_inode    = afs_alloc_inode,
-        .write_inode    = afs_write_inode,
         .destroy_inode  = afs_destroy_inode,
         .clear_inode    = afs_clear_inode,
         .put_super      = afs_put_super,
diff --git a/fs/afs/write.c b/fs/afs/write.c
index 5e15a21dbf9f..3bed54a294d4 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -585,27 +585,6 @@ int afs_writepages(struct address_space *mapping,
 }
 
 /*
- * write an inode back
- */
-int afs_write_inode(struct inode *inode, int sync)
-{
-        struct afs_vnode *vnode = AFS_FS_I(inode);
-        int ret;
-
-        _enter("{%x:%u},", vnode->fid.vid, vnode->fid.vnode);
-
-        ret = 0;
-        if (sync) {
-                ret = filemap_fdatawait(inode->i_mapping);
-                if (ret < 0)
-                        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        }
-
-        _leave(" = %d", ret);
-        return ret;
-}
-
-/*
  * completion of write to server
  */
 void afs_pages_written_back(struct afs_vnode *vnode, struct afs_call *call)
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 0118d67221b2..3d283abf67d7 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -60,11 +60,6 @@ do {							\
                 current->pid, __func__, ##args);        \
 } while (0)
 
-struct rehash_entry {
-        struct task_struct *task;
-        struct list_head list;
-};
-
 /* Unified info structure.  This is pointed to by both the dentry and
    inode structures.  Each file in the filesystem has an instance of this
    structure.  It holds a reference to the dentry, so dentries are never
@@ -81,7 +76,6 @@ struct autofs_info {
 
         struct list_head active;
         int active_count;
-        struct list_head rehash_list;
 
         struct list_head expiring;
 
@@ -104,7 +98,6 @@ struct autofs_info {
 #define AUTOFS_INF_EXPIRING     (1<<0) /* dentry is in the process of expiring */
 #define AUTOFS_INF_MOUNTPOINT   (1<<1) /* mountpoint status for direct expire */
 #define AUTOFS_INF_PENDING      (1<<2) /* dentry pending mount */
-#define AUTOFS_INF_REHASH       (1<<3) /* dentry in transit to ->lookup() */
 
 struct autofs_wait_queue {
         wait_queue_head_t queue;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 00bf8fcb245f..c8a80dffb455 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -544,10 +544,9 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp,
                         goto out;
                 devid = new_encode_dev(path.mnt->mnt_sb->s_dev);
                 err = 0;
-                if (path.dentry->d_inode &&
-                    path.mnt->mnt_root == path.dentry) {
+                if (path.mnt->mnt_root == path.dentry) {
                         err = 1;
-                        magic = path.dentry->d_inode->i_sb->s_magic;
+                        magic = path.mnt->mnt_sb->s_magic;
                 }
         } else {
                 dev_t dev = sbi->sb->s_dev;
@@ -560,10 +559,8 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp,
 
                 err = have_submounts(path.dentry);
 
-                if (path.mnt->mnt_mountpoint != path.mnt->mnt_root) {
-                        if (follow_down(&path))
-                                magic = path.mnt->mnt_sb->s_magic;
-                }
+                if (follow_down(&path))
+                        magic = path.mnt->mnt_sb->s_magic;
         }
 
         param->ismountpoint.out.devid = devid;
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 74bc9aa6df31..a796c9417fb1 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -279,7 +279,6 @@ struct dentry *autofs4_expire_direct(struct super_block *sb,
                         root->d_mounted--;
                 }
                 ino->flags |= AUTOFS_INF_EXPIRING;
-                autofs4_add_expiring(root);
                 init_completion(&ino->expire_complete);
                 spin_unlock(&sbi->fs_lock);
                 return root;
@@ -407,7 +406,6 @@ found:
                 expired, (int)expired->d_name.len, expired->d_name.name);
         ino = autofs4_dentry_ino(expired);
         ino->flags |= AUTOFS_INF_EXPIRING;
-        autofs4_add_expiring(expired);
         init_completion(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
         spin_lock(&dcache_lock);
@@ -435,7 +433,7 @@ int autofs4_expire_wait(struct dentry *dentry)
 
                 DPRINTK("expire done status=%d", status);
 
-                if (d_unhashed(dentry) && IS_DEADDIR(dentry->d_inode))
+                if (d_unhashed(dentry))
                         return -EAGAIN;
 
                 return status;
@@ -475,7 +473,6 @@ int autofs4_expire_run(struct super_block *sb,
         spin_lock(&sbi->fs_lock);
         ino = autofs4_dentry_ino(dentry);
         ino->flags &= ~AUTOFS_INF_EXPIRING;
-        autofs4_del_expiring(dentry);
         complete_all(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
 
@@ -506,7 +503,6 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                         ino->flags &= ~AUTOFS_INF_MOUNTPOINT;
                 }
                 ino->flags &= ~AUTOFS_INF_EXPIRING;
-                autofs4_del_expiring(dentry);
                 complete_all(&ino->expire_complete);
                 spin_unlock(&sbi->fs_lock);
                 dput(dentry);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index d0a3de247458..821b2b955dac 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -49,7 +49,6 @@ struct autofs_info *autofs4_init_ino(struct autofs_info *ino,
                 ino->dentry = NULL;
                 ino->size = 0;
                 INIT_LIST_HEAD(&ino->active);
-                INIT_LIST_HEAD(&ino->rehash_list);
                 ino->active_count = 0;
                 INIT_LIST_HEAD(&ino->expiring);
                 atomic_set(&ino->count, 0);
@@ -97,63 +96,6 @@ void autofs4_free_ino(struct autofs_info *ino)
         kfree(ino);
 }
 
-/*
- * Deal with the infamous "Busy inodes after umount ..." message.
- *
- * Clean up the dentry tree. This happens with autofs if the user
- * space program goes away due to a SIGKILL, SIGSEGV etc.
- */
-static void autofs4_force_release(struct autofs_sb_info *sbi)
-{
-        struct dentry *this_parent = sbi->sb->s_root;
-        struct list_head *next;
-
-        if (!sbi->sb->s_root)
-                return;
-
-        spin_lock(&dcache_lock);
-repeat:
-        next = this_parent->d_subdirs.next;
-resume:
-        while (next != &this_parent->d_subdirs) {
-                struct dentry *dentry = list_entry(next, struct dentry, d_u.d_child);
-
-                /* Negative dentry - don`t care */
-                if (!simple_positive(dentry)) {
-                        next = next->next;
-                        continue;
-                }
-
-                if (!list_empty(&dentry->d_subdirs)) {
-                        this_parent = dentry;
-                        goto repeat;
-                }
-
-                next = next->next;
-                spin_unlock(&dcache_lock);
-
-                DPRINTK("dentry %p %.*s",
-                        dentry, (int)dentry->d_name.len, dentry->d_name.name);
-
-                dput(dentry);
-                spin_lock(&dcache_lock);
-        }
-
-        if (this_parent != sbi->sb->s_root) {
-                struct dentry *dentry = this_parent;
-
-                next = this_parent->d_u.d_child.next;
-                this_parent = this_parent->d_parent;
-                spin_unlock(&dcache_lock);
-                DPRINTK("parent dentry %p %.*s",
-                        dentry, (int)dentry->d_name.len, dentry->d_name.name);
-                dput(dentry);
-                spin_lock(&dcache_lock);
-                goto resume;
-        }
-        spin_unlock(&dcache_lock);
-}
-
 void autofs4_kill_sb(struct super_block *sb)
 {
         struct autofs_sb_info *sbi = autofs4_sbi(sb);
@@ -170,15 +112,12 @@ void autofs4_kill_sb(struct super_block *sb)
         /* Free wait queues, close pipe */
         autofs4_catatonic_mode(sbi);
 
-        /* Clean up and release dangling references */
-        autofs4_force_release(sbi);
-
         sb->s_fs_info = NULL;
         kfree(sbi);
 
 out_kill_sb:
         DPRINTK("shutting down");
-        kill_anon_super(sb);
+        kill_litter_super(sb);
 }
 
 static int autofs4_show_options(struct seq_file *m, struct vfsmount *mnt)
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 30cc9ddf4b70..a015b49891df 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -104,99 +104,6 @@ static void autofs4_del_active(struct dentry *dentry)
         return;
 }
 
-static void autofs4_add_rehash_entry(struct autofs_info *ino,
-                                     struct rehash_entry *entry)
-{
-        entry->task = current;
-        INIT_LIST_HEAD(&entry->list);
-        list_add(&entry->list, &ino->rehash_list);
-        return;
-}
-
-static void autofs4_remove_rehash_entry(struct autofs_info *ino)
-{
-        struct list_head *head = &ino->rehash_list;
-        struct rehash_entry *entry;
-        list_for_each_entry(entry, head, list) {
-                if (entry->task == current) {
-                        list_del(&entry->list);
-                        kfree(entry);
-                        break;
-                }
-        }
-        return;
-}
-
-static void autofs4_remove_rehash_entrys(struct autofs_info *ino)
-{
-        struct autofs_sb_info *sbi = ino->sbi;
-        struct rehash_entry *entry, *next;
-        struct list_head *head;
-
-        spin_lock(&sbi->fs_lock);
-        spin_lock(&sbi->lookup_lock);
-        if (!(ino->flags & AUTOFS_INF_REHASH)) {
-                spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&sbi->fs_lock);
-                return;
-        }
-        ino->flags &= ~AUTOFS_INF_REHASH;
-        head = &ino->rehash_list;
-        list_for_each_entry_safe(entry, next, head, list) {
-                list_del(&entry->list);
-                kfree(entry);
-        }
-        spin_unlock(&sbi->lookup_lock);
-        spin_unlock(&sbi->fs_lock);
-        dput(ino->dentry);
-
-        return;
-}
-
-static void autofs4_revalidate_drop(struct dentry *dentry,
-                                    struct rehash_entry *entry)
-{
-        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        /*
-         * Add to the active list so we can pick this up in
-         * ->lookup(). Also add an entry to a rehash list so
-         * we know when there are no dentrys in flight so we
-         * know when we can rehash the dentry.
-         */
-        spin_lock(&sbi->lookup_lock);
-        if (list_empty(&ino->active))
-                list_add(&ino->active, &sbi->active_list);
-        autofs4_add_rehash_entry(ino, entry);
-        spin_unlock(&sbi->lookup_lock);
-        if (!(ino->flags & AUTOFS_INF_REHASH)) {
-                ino->flags |= AUTOFS_INF_REHASH;
-                dget(dentry);
-                spin_lock(&dentry->d_lock);
-                __d_drop(dentry);
-                spin_unlock(&dentry->d_lock);
-        }
-        return;
-}
-
-static void autofs4_revalidate_rehash(struct dentry *dentry)
-{
-        struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        if (ino->flags & AUTOFS_INF_REHASH) {
-                spin_lock(&sbi->lookup_lock);
-                autofs4_remove_rehash_entry(ino);
-                if (list_empty(&ino->rehash_list)) {
-                        spin_unlock(&sbi->lookup_lock);
-                        ino->flags &= ~AUTOFS_INF_REHASH;
-                        d_rehash(dentry);
-                        dput(ino->dentry);
-                } else
-                        spin_unlock(&sbi->lookup_lock);
-        }
-        return;
-}
-
 static unsigned int autofs4_need_mount(unsigned int flags)
 {
         unsigned int res = 0;
@@ -236,7 +143,7 @@ out:
         return dcache_dir_open(inode, file);
 }
 
-static int try_to_fill_dentry(struct dentry *dentry)
+static int try_to_fill_dentry(struct dentry *dentry, int flags)
 {
         struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
         struct autofs_info *ino = autofs4_dentry_ino(dentry);
@@ -249,17 +156,55 @@ static int try_to_fill_dentry(struct dentry *dentry)
          * Wait for a pending mount, triggering one if there
          * isn't one already
          */
-        DPRINTK("waiting for mount name=%.*s",
-                 dentry->d_name.len, dentry->d_name.name);
+        if (dentry->d_inode == NULL) {
+                DPRINTK("waiting for mount name=%.*s",
+                         dentry->d_name.len, dentry->d_name.name);
 
-        status = autofs4_wait(sbi, dentry, NFY_MOUNT);
+                status = autofs4_wait(sbi, dentry, NFY_MOUNT);
 
-        DPRINTK("mount done status=%d", status);
+                DPRINTK("mount done status=%d", status);
 
-        /* Update expiry counter */
-        ino->last_used = jiffies;
+                /* Turn this into a real negative dentry? */
+                if (status == -ENOENT) {
+                        spin_lock(&sbi->fs_lock);
+                        ino->flags &= ~AUTOFS_INF_PENDING;
+                        spin_unlock(&sbi->fs_lock);
+                        return status;
+                } else if (status) {
+                        /* Return a negative dentry, but leave it "pending" */
+                        return status;
+                }
+        /* Trigger mount for path component or follow link */
+        } else if (ino->flags & AUTOFS_INF_PENDING ||
+                        autofs4_need_mount(flags) ||
+                        current->link_count) {
+                DPRINTK("waiting for mount name=%.*s",
+                        dentry->d_name.len, dentry->d_name.name);
 
-        return status;
+                spin_lock(&sbi->fs_lock);
+                ino->flags |= AUTOFS_INF_PENDING;
+                spin_unlock(&sbi->fs_lock);
+                status = autofs4_wait(sbi, dentry, NFY_MOUNT);
+
+                DPRINTK("mount done status=%d", status);
+
+                if (status) {
+                        spin_lock(&sbi->fs_lock);
+                        ino->flags &= ~AUTOFS_INF_PENDING;
+                        spin_unlock(&sbi->fs_lock);
+                        return status;
+                }
+        }
+
+        /* Initialize expiry counter after successful mount */
+        if (ino)
+                ino->last_used = jiffies;
+
+        spin_lock(&sbi->fs_lock);
+        ino->flags &= ~AUTOFS_INF_PENDING;
+        spin_unlock(&sbi->fs_lock);
+
+        return 0;
 }
 
 /* For autofs direct mounts the follow link triggers the mount */
@@ -313,16 +258,10 @@ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
          */
         if (ino->flags & AUTOFS_INF_PENDING ||
             (!d_mountpoint(dentry) && list_empty(&dentry->d_subdirs))) {
-                ino->flags |= AUTOFS_INF_PENDING;
                 spin_unlock(&dcache_lock);
                 spin_unlock(&sbi->fs_lock);
 
-                status = try_to_fill_dentry(dentry);
-
-                spin_lock(&sbi->fs_lock);
-                ino->flags &= ~AUTOFS_INF_PENDING;
-                spin_unlock(&sbi->fs_lock);
-
+                status = try_to_fill_dentry(dentry, 0);
                 if (status)
                         goto out_error;
 
@@ -361,47 +300,18 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *dir = dentry->d_parent->d_inode;
         struct autofs_sb_info *sbi = autofs4_sbi(dir->i_sb);
-        struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        struct rehash_entry *entry;
+        int oz_mode = autofs4_oz_mode(sbi);
         int flags = nd ? nd->flags : 0;
-        unsigned int mutex_aquired;
+        int status = 1;
 
-        DPRINTK("name = %.*s oz_mode = %d",
-                dentry->d_name.len, dentry->d_name.name, oz_mode);
-
-        /* Daemon never causes a mount to trigger */
-        if (autofs4_oz_mode(sbi))
-                return 1;
-
-        entry = kmalloc(sizeof(struct rehash_entry), GFP_KERNEL);
-        if (!entry)
-                return -ENOMEM;
-
-        mutex_aquired = mutex_trylock(&dir->i_mutex);
-
-        spin_lock(&sbi->fs_lock);
-        spin_lock(&dcache_lock);
         /* Pending dentry */
+        spin_lock(&sbi->fs_lock);
         if (autofs4_ispending(dentry)) {
-                int status;
-
-                /*
-                 * We can only unhash and send this to ->lookup() if
-                 * the directory mutex is held over d_revalidate() and
-                 * ->lookup(). This prevents the VFS from incorrectly
-                 * seeing the dentry as non-existent.
-                 */
-                ino->flags |= AUTOFS_INF_PENDING;
-                if (!mutex_aquired) {
-                        autofs4_revalidate_drop(dentry, entry);
-                        spin_unlock(&dcache_lock);
-                        spin_unlock(&sbi->fs_lock);
-                        return 0;
-                }
-                spin_unlock(&dcache_lock);
+                /* The daemon never causes a mount to trigger */
                 spin_unlock(&sbi->fs_lock);
-                mutex_unlock(&dir->i_mutex);
-                kfree(entry);
+
+                if (oz_mode)
+                        return 1;
 
                 /*
                  * If the directory has gone away due to an expire
@@ -415,82 +325,45 @@ static int autofs4_revalidate(struct dentry *dentry, struct nameidata *nd)
                  * A zero status is success otherwise we have a
                  * negative error code.
                  */
-                status = try_to_fill_dentry(dentry);
-
-                spin_lock(&sbi->fs_lock);
-                ino->flags &= ~AUTOFS_INF_PENDING;
-                spin_unlock(&sbi->fs_lock);
-
+                status = try_to_fill_dentry(dentry, flags);
                 if (status == 0)
                         return 1;
 
                 return status;
         }
+        spin_unlock(&sbi->fs_lock);
+
+        /* Negative dentry.. invalidate if "old" */
+        if (dentry->d_inode == NULL)
+                return 0;
 
         /* Check for a non-mountpoint directory with no contents */
+        spin_lock(&dcache_lock);
         if (S_ISDIR(dentry->d_inode->i_mode) &&
             !d_mountpoint(dentry) && list_empty(&dentry->d_subdirs)) {
                 DPRINTK("dentry=%p %.*s, emptydir",
                          dentry, dentry->d_name.len, dentry->d_name.name);
+                spin_unlock(&dcache_lock);
 
-                if (autofs4_need_mount(flags) || current->link_count) {
-                        int status;
-
-                        /*
-                         * We can only unhash and send this to ->lookup() if
-                         * the directory mutex is held over d_revalidate() and
-                         * ->lookup(). This prevents the VFS from incorrectly
-                         * seeing the dentry as non-existent.
-                         */
-                        ino->flags |= AUTOFS_INF_PENDING;
-                        if (!mutex_aquired) {
-                                autofs4_revalidate_drop(dentry, entry);
-                                spin_unlock(&dcache_lock);
-                                spin_unlock(&sbi->fs_lock);
-                                return 0;
-                        }
-                        spin_unlock(&dcache_lock);
-                        spin_unlock(&sbi->fs_lock);
-                        mutex_unlock(&dir->i_mutex);
-                        kfree(entry);
-
-                        /*
-                         * A zero status is success otherwise we have a
-                         * negative error code.
-                         */
-                        status = try_to_fill_dentry(dentry);
-
-                        spin_lock(&sbi->fs_lock);
-                        ino->flags &= ~AUTOFS_INF_PENDING;
-                        spin_unlock(&sbi->fs_lock);
+                /* The daemon never causes a mount to trigger */
+                if (oz_mode)
+                        return 1;
 
-                        if (status == 0)
-                                return 1;
+                /*
+                 * A zero status is success otherwise we have a
+                 * negative error code.
+                 */
+                status = try_to_fill_dentry(dentry, flags);
+                if (status == 0)
+                        return 1;
 
-                        return status;
-                }
+                return status;
         }
         spin_unlock(&dcache_lock);
-        spin_unlock(&sbi->fs_lock);
-
-        if (mutex_aquired)
-                mutex_unlock(&dir->i_mutex);
-
-        kfree(entry);
 
         return 1;
 }
 
-static void autofs4_free_rehash_entrys(struct autofs_info *inf)
-{
-        struct list_head *head = &inf->rehash_list;
-        struct rehash_entry *entry, *next;
-        list_for_each_entry_safe(entry, next, head, list) {
-                list_del(&entry->list);
-                kfree(entry);
-        }
-}
-
 void autofs4_dentry_release(struct dentry *de)
 {
         struct autofs_info *inf;
@@ -509,8 +382,6 @@ void autofs4_dentry_release(struct dentry *de)
                                 list_del(&inf->active);
                         if (!list_empty(&inf->expiring))
                                 list_del(&inf->expiring);
-                        if (!list_empty(&inf->rehash_list))
-                                autofs4_free_rehash_entrys(inf);
                         spin_unlock(&sbi->lookup_lock);
                 }
 
@@ -543,7 +414,6 @@ static struct dentry *autofs4_lookup_active(struct dentry *dentry)
         const unsigned char *str = name->name;
         struct list_head *p, *head;
 
-restart:
         spin_lock(&dcache_lock);
         spin_lock(&sbi->lookup_lock);
         head = &sbi->active_list;
@@ -561,19 +431,6 @@ restart:
                 if (atomic_read(&active->d_count) == 0)
                         goto next;
 
-                if (active->d_inode && IS_DEADDIR(active->d_inode)) {
-                        if (!list_empty(&ino->rehash_list)) {
-                                dget(active);
-                                spin_unlock(&active->d_lock);
-                                spin_unlock(&sbi->lookup_lock);
-                                spin_unlock(&dcache_lock);
-                                autofs4_remove_rehash_entrys(ino);
-                                dput(active);
-                                goto restart;
-                        }
-                        goto next;
-                }
-
                 qstr = &active->d_name;
 
                 if (active->d_name.hash != hash)
@@ -586,11 +443,13 @@ restart:
                 if (memcmp(qstr->name, str, len))
                         goto next;
 
-                dget(active);
-                spin_unlock(&active->d_lock);
-                spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&dcache_lock);
-                return active;
+                if (d_unhashed(active)) {
+                        dget(active);
+                        spin_unlock(&active->d_lock);
+                        spin_unlock(&sbi->lookup_lock);
+                        spin_unlock(&dcache_lock);
+                        return active;
+                }
 next:
                 spin_unlock(&active->d_lock);
         }
@@ -639,11 +498,13 @@ static struct dentry *autofs4_lookup_expiring(struct dentry *dentry)
                 if (memcmp(qstr->name, str, len))
                         goto next;
 
-                dget(expiring);
-                spin_unlock(&expiring->d_lock);
-                spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&dcache_lock);
-                return expiring;
+                if (d_unhashed(expiring)) {
+                        dget(expiring);
+                        spin_unlock(&expiring->d_lock);
+                        spin_unlock(&sbi->lookup_lock);
+                        spin_unlock(&dcache_lock);
+                        return expiring;
+                }
 next:
                 spin_unlock(&expiring->d_lock);
         }
@@ -653,48 +514,6 @@ next:
         return NULL;
 }
 
-static struct autofs_info *init_new_dentry(struct autofs_sb_info *sbi,
-                                           struct dentry *dentry, int oz_mode)
-{
-        struct autofs_info *ino;
-
-        /*
-         * Mark the dentry incomplete but don't hash it. We do this
-         * to serialize our inode creation operations (symlink and
-         * mkdir) which prevents deadlock during the callback to
-         * the daemon. Subsequent user space lookups for the same
-         * dentry are placed on the wait queue while the daemon
-         * itself is allowed passage unresticted so the create
-         * operation itself can then hash the dentry. Finally,
-         * we check for the hashed dentry and return the newly
-         * hashed dentry.
-         */
-        dentry->d_op = &autofs4_root_dentry_operations;
-
-        /*
-         * And we need to ensure that the same dentry is used for
-         * all following lookup calls until it is hashed so that
-         * the dentry flags are persistent throughout the request.
-         */
-        ino = autofs4_init_ino(NULL, sbi, 0555);
-        if (!ino)
-                return ERR_PTR(-ENOMEM);
-
-        dentry->d_fsdata = ino;
-        ino->dentry = dentry;
-
-        /*
-         * Only set the mount pending flag for new dentrys not created
-         * by the daemon.
-         */
-        if (!oz_mode)
-                ino->flags |= AUTOFS_INF_PENDING;
-
-        d_instantiate(dentry, NULL);
-
-        return ino;
-}
-
 /* Lookups in the root directory */
 static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
@@ -702,7 +521,6 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
         struct autofs_info *ino;
         struct dentry *expiring, *active;
         int oz_mode;
-        int status = 0;
 
         DPRINTK("name = %.*s",
                 dentry->d_name.len, dentry->d_name.name);
@@ -717,26 +535,44 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
         DPRINTK("pid = %u, pgrp = %u, catatonic = %d, oz_mode = %d",
                  current->pid, task_pgrp_nr(current), sbi->catatonic, oz_mode);
 
-        spin_lock(&sbi->fs_lock);
         active = autofs4_lookup_active(dentry);
         if (active) {
                 dentry = active;
                 ino = autofs4_dentry_ino(dentry);
-                /* If this came from revalidate, rehash it */
-                autofs4_revalidate_rehash(dentry);
-                spin_unlock(&sbi->fs_lock);
         } else {
-                spin_unlock(&sbi->fs_lock);
-                ino = init_new_dentry(sbi, dentry, oz_mode);
-                if (IS_ERR(ino))
-                        return (struct dentry *) ino;
-        }
+                /*
+                 * Mark the dentry incomplete but don't hash it. We do this
+                 * to serialize our inode creation operations (symlink and
+                 * mkdir) which prevents deadlock during the callback to
+                 * the daemon. Subsequent user space lookups for the same
+                 * dentry are placed on the wait queue while the daemon
+                 * itself is allowed passage unresticted so the create
+                 * operation itself can then hash the dentry. Finally,
+                 * we check for the hashed dentry and return the newly
+                 * hashed dentry.
+                 */
+                dentry->d_op = &autofs4_root_dentry_operations;
+
+                /*
+                 * And we need to ensure that the same dentry is used for
+                 * all following lookup calls until it is hashed so that
+                 * the dentry flags are persistent throughout the request.
+                 */
+                ino = autofs4_init_ino(NULL, sbi, 0555);
+                if (!ino)
+                        return ERR_PTR(-ENOMEM);
 
-        autofs4_add_active(dentry);
+                dentry->d_fsdata = ino;
+                ino->dentry = dentry;
+
+                autofs4_add_active(dentry);
+
+                d_instantiate(dentry, NULL);
+        }
 
         if (!oz_mode) {
-                expiring = autofs4_lookup_expiring(dentry);
                 mutex_unlock(&dir->i_mutex);
+                expiring = autofs4_lookup_expiring(dentry);
                 if (expiring) {
                         /*
                          * If we are racing with expire the request might not
@@ -744,22 +580,23 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
                          * so it must have been successful, so just wait for it.
                          */
                         autofs4_expire_wait(expiring);
+                        autofs4_del_expiring(expiring);
                         dput(expiring);
                 }
-                status = try_to_fill_dentry(dentry);
-                mutex_lock(&dir->i_mutex);
+
                 spin_lock(&sbi->fs_lock);
-                ino->flags &= ~AUTOFS_INF_PENDING;
+                ino->flags |= AUTOFS_INF_PENDING;
                 spin_unlock(&sbi->fs_lock);
+                if (dentry->d_op && dentry->d_op->d_revalidate)
+                        (dentry->d_op->d_revalidate)(dentry, nd);
+                mutex_lock(&dir->i_mutex);
         }
 
-        autofs4_del_active(dentry);
-
         /*
-         * If we had a mount fail, check if we had to handle
+         * If we are still pending, check if we had to handle
          * a signal. If so we can force a restart..
          */
-        if (status) {
+        if (ino->flags & AUTOFS_INF_PENDING) {
                 /* See if we were interrupted */
                 if (signal_pending(current)) {
                         sigset_t *sigset = &current->pending.signal;
@@ -771,46 +608,43 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
                             return ERR_PTR(-ERESTARTNOINTR);
                         }
                 }
-        }
-
-        /*
-         * User space can (and has done in the past) remove and re-create
-         * this directory during the callback. This can leave us with an
-         * unhashed dentry, but a successful mount!  So we need to
-         * perform another cached lookup in case the dentry now exists.
-         */
-        if (!oz_mode && !have_submounts(dentry)) {
-                struct dentry *new;
-                new = d_lookup(dentry->d_parent, &dentry->d_name);
-                if (new) {
-                        if (active)
-                                dput(active);
-                        return new;
-                } else {
-                        if (!status)
-                                status = -ENOENT;
+                if (!oz_mode) {
+                        spin_lock(&sbi->fs_lock);
+                        ino->flags &= ~AUTOFS_INF_PENDING;
+                        spin_unlock(&sbi->fs_lock);
                 }
         }
 
         /*
-         * If we had a mount failure, return status to user space.
-         * If the mount succeeded and we used a dentry from the active queue
-         * return it.
+         * If this dentry is unhashed, then we shouldn't honour this
+         * lookup.  Returning ENOENT here doesn't do the right thing
+         * for all system calls, but it should be OK for the operations
+         * we permit from an autofs.
          */
-        if (status) {
-                dentry = ERR_PTR(status);
-                if (active)
-                        dput(active);
-                return dentry;
-        } else {
+        if (!oz_mode && d_unhashed(dentry)) {
                 /*
-                 * Valid successful mount, return active dentry or NULL
-                 * for a new dentry.
+                 * A user space application can (and has done in the past)
+                 * remove and re-create this directory during the callback.
+                 * This can leave us with an unhashed dentry, but a
+                 * successful mount!  So we need to perform another
+                 * cached lookup in case the dentry now exists.
                  */
+                struct dentry *parent = dentry->d_parent;
+                struct dentry *new = d_lookup(parent, &dentry->d_name);
+                if (new != NULL)
+                        dentry = new;
+                else
+                        dentry = ERR_PTR(-ENOENT);
+
                 if (active)
-                        return active;
+                        dput(active);
+
+                return dentry;
         }
 
+        if (active)
+                return active;
+
         return NULL;
 }
 
@@ -834,6 +668,8 @@ static int autofs4_dir_symlink(struct inode *dir,
         if (!ino)
                 return -ENOMEM;
 
+        autofs4_del_active(dentry);
+
         ino->size = strlen(symname);
         cp = kmalloc(ino->size + 1, GFP_KERNEL);
         if (!cp) {
@@ -910,6 +746,7 @@ static int autofs4_dir_unlink(struct inode *dir, struct dentry *dentry)
         dir->i_mtime = CURRENT_TIME;
 
         spin_lock(&dcache_lock);
+        autofs4_add_expiring(dentry);
         spin_lock(&dentry->d_lock);
         __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
@@ -935,6 +772,7 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
                 spin_unlock(&dcache_lock);
                 return -ENOTEMPTY;
         }
+        autofs4_add_expiring(dentry);
         spin_lock(&dentry->d_lock);
         __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
@@ -972,6 +810,8 @@ static int autofs4_dir_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         if (!ino)
                 return -ENOMEM;
 
+        autofs4_del_active(dentry);
+
         inode = autofs4_get_inode(dir->i_sb, ino);
         if (!inode) {
                 if (!dentry->d_fsdata)
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index 8f3d9fd89604..f22a7d3dc362 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -15,6 +15,7 @@
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <linux/vfs.h>
+#include <linux/writeback.h>
 #include <asm/uaccess.h>
 #include "bfs.h"
 
@@ -98,7 +99,7 @@ error:
         return ERR_PTR(-EIO);
 }
 
-static int bfs_write_inode(struct inode *inode, int wait)
+static int bfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct bfs_sb_info *info = BFS_SB(inode->i_sb);
         unsigned int ino = (u16)inode->i_ino;
@@ -147,7 +148,7 @@ static int bfs_write_inode(struct inode *inode, int wait)
         di->i_eoffset = cpu_to_le32(i_sblock * BFS_BSIZE + inode->i_size - 1);
 
         mark_buffer_dirty(bh);
-        if (wait) {
+        if (wbc->sync_mode == WB_SYNC_ALL) {
                 sync_dirty_buffer(bh);
                 if (buffer_req(bh) && !buffer_uptodate(bh))
                         err = -EIO;
diff --git a/fs/bio.c b/fs/bio.c
index 88094afc29ea..dc17afd672e3 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -507,10 +507,8 @@ int bio_get_nr_vecs(struct block_device *bdev)
         int nr_pages;
 
         nr_pages = ((queue_max_sectors(q) << 9) + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        if (nr_pages > queue_max_phys_segments(q))
-                nr_pages = queue_max_phys_segments(q);
-        if (nr_pages > queue_max_hw_segments(q))
-                nr_pages = queue_max_hw_segments(q);
+        if (nr_pages > queue_max_segments(q))
+                nr_pages = queue_max_segments(q);
 
         return nr_pages;
 }
@@ -575,8 +573,7 @@ static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
          * make this too complex.
          */
 
-        while (bio->bi_phys_segments >= queue_max_phys_segments(q)
-               || bio->bi_phys_segments >= queue_max_hw_segments(q)) {
+        while (bio->bi_phys_segments >= queue_max_segments(q)) {
 
                 if (retried_segments)
                         return 0;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 2aa8ec6a0981..8b5cfdd4bfc1 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2326,7 +2326,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
 int btrfs_readpage(struct file *file, struct page *page);
 void btrfs_delete_inode(struct inode *inode);
 void btrfs_put_inode(struct inode *inode);
-int btrfs_write_inode(struct inode *inode, int wait);
+int btrfs_write_inode(struct inode *inode, struct writeback_control *wbc);
 void btrfs_dirty_inode(struct inode *inode);
 struct inode *btrfs_alloc_inode(struct super_block *sb);
 void btrfs_destroy_inode(struct inode *inode);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 4deb280f8969..c41db6d45ab6 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3968,7 +3968,7 @@ err:
         return ret;
 }
 
-int btrfs_write_inode(struct inode *inode, int wait)
+int btrfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_trans_handle *trans;
@@ -3977,7 +3977,7 @@ int btrfs_write_inode(struct inode *inode, int wait)
         if (root->fs_info->btree_inode == inode)
                 return 0;
 
-        if (wait) {
+        if (wbc->sync_mode == WB_SYNC_ALL) {
                 trans = btrfs_join_transaction(root, 1);
                 btrfs_set_trans_block_group(trans, inode);
                 ret = btrfs_commit_transaction(trans, root);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 49503d2edc7e..bc0025cdd1c9 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,6 +1,7 @@
 Version 1.62
 ------------
-Add sockopt=TCP_NODELAY mount option.
+Add sockopt=TCP_NODELAY mount option. EA (xattr) routines hardened
+to more strictly handle corrupt frames.
 
 Version 1.61
 ------------
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index ed751bb657db..a1c817eb291a 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -205,7 +205,7 @@ struct cifsUidInfo {
 struct cifsSesInfo {
         struct list_head smb_ses_list;
         struct list_head tcon_list;
-        struct semaphore sesSem;
+        struct mutex session_mutex;
 #if 0
         struct cifsUidInfo *uidInfo;    /* pointer to user info */
 #endif
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 3877737f96a6..14d036d8db11 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -415,10 +415,10 @@ struct smb_hdr {
         __u8 WordCount;
 } __attribute__((packed));
 /* given a pointer to an smb_hdr retrieve the value of byte count */
-#define BCC(smb_var) (*(__u16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount)))
-#define BCC_LE(smb_var) (*(__le16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount)))
+#define BCC(smb_var) (*(__u16 *)((char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount)))
+#define BCC_LE(smb_var) (*(__le16 *)((char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount)))
 /* given a pointer to an smb_hdr retrieve the pointer to the byte area */
-#define pByteArea(smb_var) ((unsigned char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount) + 2)
+#define pByteArea(smb_var) ((unsigned char *)(smb_var) + sizeof(struct smb_hdr) + (2 * (smb_var)->WordCount) + 2)
 
 /*
  * Computer Name Length (since Netbios name was length 16 with last byte 0x20)
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 5646727e33f5..88e2bc44ac58 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -363,13 +363,10 @@ extern int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon,
                         __u32 filter, struct file *file, int multishot,
                         const struct nls_table *nls_codepage);
 extern ssize_t CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
-                        const unsigned char *searchName, char *EAData,
+                        const unsigned char *searchName,
+                        const unsigned char *ea_name, char *EAData,
                         size_t bufsize, const struct nls_table *nls_codepage,
                         int remap_special_chars);
-extern ssize_t CIFSSMBQueryEA(const int xid, struct cifsTconInfo *tcon,
-                const unsigned char *searchName, const unsigned char *ea_name,
-                unsigned char *ea_value, size_t buf_size,
-                const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon,
                 const char *fileName, const char *ea_name,
                 const void *ea_value, const __u16 ea_value_len,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 941441d3e386..9d17df3e0768 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -170,19 +170,19 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
          * need to prevent multiple threads trying to simultaneously
          * reconnect the same SMB session
          */
-        down(&ses->sesSem);
+        mutex_lock(&ses->session_mutex);
         if (ses->need_reconnect)
                 rc = cifs_setup_session(0, ses, nls_codepage);
 
         /* do we need to reconnect tcon? */
         if (rc || !tcon->need_reconnect) {
-                up(&ses->sesSem);
+                mutex_unlock(&ses->session_mutex);
                 goto out;
         }
 
         mark_open_files_invalid(tcon);
         rc = CIFSTCon(0, ses, tcon->treeName, tcon, nls_codepage);
-        up(&ses->sesSem);
+        mutex_unlock(&ses->session_mutex);
         cFYI(1, ("reconnect tcon rc = %d", rc));
 
         if (rc)
@@ -700,13 +700,13 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         if (!ses || !ses->server)
                 return -EIO;
 
-        down(&ses->sesSem);
+        mutex_lock(&ses->session_mutex);
         if (ses->need_reconnect)
                 goto session_already_dead; /* no need to send SMBlogoff if uid
                                               already closed due to reconnect */
         rc = small_smb_init(SMB_COM_LOGOFF_ANDX, 2, NULL, (void **)&pSMB);
         if (rc) {
-                up(&ses->sesSem);
+                mutex_unlock(&ses->session_mutex);
                 return rc;
         }
 
@@ -721,7 +721,7 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         pSMB->AndXCommand = 0xFF;
         rc = SendReceiveNoRsp(xid, ses, (struct smb_hdr *) pSMB, 0);
 session_already_dead:
-        up(&ses->sesSem);
+        mutex_unlock(&ses->session_mutex);
 
         /* if session dead then we do not need to do ulogoff,
                 since server closed smb session, no sense reporting
@@ -5269,22 +5269,34 @@ int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon,
         cifs_buf_release(pSMB);
         return rc;
 }
+
 #ifdef CONFIG_CIFS_XATTR
+/*
+ * Do a path-based QUERY_ALL_EAS call and parse the result. This is a common
+ * function used by listxattr and getxattr type calls. When ea_name is set,
+ * it looks for that attribute name and stuffs that value into the EAData
+ * buffer. When ea_name is NULL, it stuffs a list of attribute names into the
+ * buffer. In both cases, the return value is either the length of the
+ * resulting data or a negative error code. If EAData is a NULL pointer then
+ * the data isn't copied to it, but the length is returned.
+ */
 ssize_t
 CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
-                 const unsigned char *searchName,
-                 char *EAData, size_t buf_size,
-                 const struct nls_table *nls_codepage, int remap)
+                const unsigned char *searchName, const unsigned char *ea_name,
+                char *EAData, size_t buf_size,
+                const struct nls_table *nls_codepage, int remap)
 {
                 /* BB assumes one setup word */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
         TRANSACTION2_QPI_RSP *pSMBr = NULL;
         int rc = 0;
         int bytes_returned;
-        int name_len;
+        int list_len;
+        struct fealist *ea_response_data;
         struct fea *temp_fea;
         char *temp_ptr;
-        __u16 params, byte_count;
+        char *end_of_smb;
+        __u16 params, byte_count, data_offset;
 
         cFYI(1, ("In Query All EAs path %s", searchName));
 QAllEAsRetry:
@@ -5294,22 +5306,22 @@ QAllEAsRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len =
+                list_len =
                     cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
                                      PATH_MAX, nls_codepage, remap);
-                name_len++;     /* trailing null */
-                name_len *= 2;
+                list_len++;     /* trailing null */
+                list_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
-                name_len = strnlen(searchName, PATH_MAX);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
+                list_len = strnlen(searchName, PATH_MAX);
+                list_len++;     /* trailing null */
+                strncpy(pSMB->FileName, searchName, list_len);
         }
 
-        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
+        params = 2 /* level */ + 4 /* reserved */ + list_len /* includes NUL */;
         pSMB->TotalDataCount = 0;
         pSMB->MaxParameterCount = cpu_to_le16(2);
         /* BB find exact max SMB PDU from sess structure BB */
-        pSMB->MaxDataCount = cpu_to_le16(4000);
+        pSMB->MaxDataCount = cpu_to_le16(CIFSMaxBufSize);
         pSMB->MaxSetupCount = 0;
         pSMB->Reserved = 0;
         pSMB->Flags = 0;
@@ -5334,237 +5346,117 @@ QAllEAsRetry:
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc) {
                 cFYI(1, ("Send error in QueryAllEAs = %d", rc));
-        } else {                /* decode response */
-                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                goto QAllEAsOut;
+        }
 
-                /* BB also check enough total bytes returned */
-                /* BB we need to improve the validity checking
-                of these trans2 responses */
-                if (rc || (pSMBr->ByteCount < 4))
-                        rc = -EIO;      /* bad smb */
-           /* else if (pFindData){
-                        memcpy((char *) pFindData,
-                               (char *) &pSMBr->hdr.Protocol +
-                               data_offset, kl);
-                }*/ else {
-                        /* check that length of list is not more than bcc */
-                        /* check that each entry does not go beyond length
-                           of list */
-                        /* check that each element of each entry does not
-                           go beyond end of list */
-                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
-                        struct fealist *ea_response_data;
-                        rc = 0;
-                        /* validate_trans2_offsets() */
-                        /* BB check if start of smb + data_offset > &bcc+ bcc */
-                        ea_response_data = (struct fealist *)
-                                (((char *) &pSMBr->hdr.Protocol) +
-                                data_offset);
-                        name_len = le32_to_cpu(ea_response_data->list_len);
-                        cFYI(1, ("ea length %d", name_len));
-                        if (name_len <= 8) {
-                        /* returned EA size zeroed at top of function */
-                                cFYI(1, ("empty EA list returned from server"));
-                        } else {
-                                /* account for ea list len */
-                                name_len -= 4;
-                                temp_fea = ea_response_data->list;
-                                temp_ptr = (char *)temp_fea;
-                                while (name_len > 0) {
-                                        __u16 value_len;
-                                        name_len -= 4;
-                                        temp_ptr += 4;
-                                        rc += temp_fea->name_len;
-                                /* account for prefix user. and trailing null */
-                                        rc = rc + 5 + 1;
-                                        if (rc < (int)buf_size) {
-                                                memcpy(EAData, "user.", 5);
-                                                EAData += 5;
-                                                memcpy(EAData, temp_ptr,
-                                                       temp_fea->name_len);
-                                                EAData += temp_fea->name_len;
-                                                /* null terminate name */
-                                                *EAData = 0;
-                                                EAData = EAData + 1;
-                                        } else if (buf_size == 0) {
-                                                /* skip copy - calc size only */
-                                        } else {
-                                                /* stop before overrun buffer */
-                                                rc = -ERANGE;
-                                                break;
-                                        }
-                                        name_len -= temp_fea->name_len;
-                                        temp_ptr += temp_fea->name_len;
-                                        /* account for trailing null */
-                                        name_len--;
-                                        temp_ptr++;
-                                        value_len =
-                                              le16_to_cpu(temp_fea->value_len);
-                                        name_len -= value_len;
-                                        temp_ptr += value_len;
-                                        /* BB check that temp_ptr is still
-                                              within the SMB BB*/
-
-                                        /* no trailing null to account for
-                                           in value len */
-                                        /* go on to next EA */
-                                        temp_fea = (struct fea *)temp_ptr;
-                                }
-                        }
-                }
+
+        /* BB also check enough total bytes returned */
+        /* BB we need to improve the validity checking
+        of these trans2 responses */
+
+        rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+        if (rc || (pSMBr->ByteCount < 4)) {
+                rc = -EIO;      /* bad smb */
+                goto QAllEAsOut;
         }
-        cifs_buf_release(pSMB);
-        if (rc == -EAGAIN)
-                goto QAllEAsRetry;
 
-        return (ssize_t)rc;
-}
+        /* check that length of list is not more than bcc */
+        /* check that each entry does not go beyond length
+           of list */
+        /* check that each element of each entry does not
+           go beyond end of list */
+        /* validate_trans2_offsets() */
+        /* BB check if start of smb + data_offset > &bcc+ bcc */
 
-ssize_t CIFSSMBQueryEA(const int xid, struct cifsTconInfo *tcon,
-                const unsigned char *searchName, const unsigned char *ea_name,
-                unsigned char *ea_value, size_t buf_size,
-                const struct nls_table *nls_codepage, int remap)
-{
-        TRANSACTION2_QPI_REQ *pSMB = NULL;
-        TRANSACTION2_QPI_RSP *pSMBr = NULL;
-        int rc = 0;
-        int bytes_returned;
-        int name_len;
-        struct fea *temp_fea;
-        char *temp_ptr;
-        __u16 params, byte_count;
+        data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+        ea_response_data = (struct fealist *)
+                                (((char *) &pSMBr->hdr.Protocol) + data_offset);
 
-        cFYI(1, ("In Query EA path %s", searchName));
-QEARetry:
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
-        if (rc)
-                return rc;
+        list_len = le32_to_cpu(ea_response_data->list_len);
+        cFYI(1, ("ea length %d", list_len));
+        if (list_len <= 8) {
+                cFYI(1, ("empty EA list returned from server"));
+                goto QAllEAsOut;
+        }
 
-        if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len =
-                    cifsConvertToUCS((__le16 *) pSMB->FileName, searchName,
-                                     PATH_MAX, nls_codepage, remap);
-                name_len++;     /* trailing null */
-                name_len *= 2;
-        } else {        /* BB improve the check for buffer overruns BB */
-                name_len = strnlen(searchName, PATH_MAX);
-                name_len++;     /* trailing null */
-                strncpy(pSMB->FileName, searchName, name_len);
+        /* make sure list_len doesn't go past end of SMB */
+        end_of_smb = (char *)pByteArea(&pSMBr->hdr) + BCC(&pSMBr->hdr);
+        if ((char *)ea_response_data + list_len > end_of_smb) {
+                cFYI(1, ("EA list appears to go beyond SMB"));
+                rc = -EIO;
+                goto QAllEAsOut;
         }
 
-        params = 2 /* level */ + 4 /* reserved */ + name_len /* includes NUL */;
-        pSMB->TotalDataCount = 0;
-        pSMB->MaxParameterCount = cpu_to_le16(2);
-        /* BB find exact max SMB PDU from sess structure BB */
-        pSMB->MaxDataCount = cpu_to_le16(4000);
-        pSMB->MaxSetupCount = 0;
-        pSMB->Reserved = 0;
-        pSMB->Flags = 0;
-        pSMB->Timeout = 0;
-        pSMB->Reserved2 = 0;
-        pSMB->ParameterOffset = cpu_to_le16(offsetof(
-                struct smb_com_transaction2_qpi_req, InformationLevel) - 4);
-        pSMB->DataCount = 0;
-        pSMB->DataOffset = 0;
-        pSMB->SetupCount = 1;
-        pSMB->Reserved3 = 0;
-        pSMB->SubCommand = cpu_to_le16(TRANS2_QUERY_PATH_INFORMATION);
-        byte_count = params + 1 /* pad */ ;
-        pSMB->TotalParameterCount = cpu_to_le16(params);
-        pSMB->ParameterCount = pSMB->TotalParameterCount;
-        pSMB->InformationLevel = cpu_to_le16(SMB_INFO_QUERY_ALL_EAS);
-        pSMB->Reserved4 = 0;
-        pSMB->hdr.smb_buf_length += byte_count;
-        pSMB->ByteCount = cpu_to_le16(byte_count);
+        /* account for ea list len */
+        list_len -= 4;
+        temp_fea = ea_response_data->list;
+        temp_ptr = (char *)temp_fea;
+        while (list_len > 0) {
+                unsigned int name_len;
+                __u16 value_len;
+
+                list_len -= 4;
+                temp_ptr += 4;
+                /* make sure we can read name_len and value_len */
+                if (list_len < 0) {
+                        cFYI(1, ("EA entry goes beyond length of list"));
+                        rc = -EIO;
+                        goto QAllEAsOut;
+                }
 
-        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
-        if (rc) {
-                cFYI(1, ("Send error in Query EA = %d", rc));
-        } else {                /* decode response */
-                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                name_len = temp_fea->name_len;
+                value_len = le16_to_cpu(temp_fea->value_len);
+                list_len -= name_len + 1 + value_len;
+                if (list_len < 0) {
+                        cFYI(1, ("EA entry goes beyond length of list"));
+                        rc = -EIO;
+                        goto QAllEAsOut;
+                }
 
-                /* BB also check enough total bytes returned */
-                /* BB we need to improve the validity checking
-                of these trans2 responses */
-                if (rc || (pSMBr->ByteCount < 4))
-                        rc = -EIO;      /* bad smb */
-           /* else if (pFindData){
-                        memcpy((char *) pFindData,
-                               (char *) &pSMBr->hdr.Protocol +
-                               data_offset, kl);
-                }*/ else {
-                        /* check that length of list is not more than bcc */
-                        /* check that each entry does not go beyond length
-                           of list */
-                        /* check that each element of each entry does not
-                           go beyond end of list */
-                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
-                        struct fealist *ea_response_data;
-                        rc = -ENODATA;
-                        /* validate_trans2_offsets() */
-                        /* BB check if start of smb + data_offset > &bcc+ bcc*/
-                        ea_response_data = (struct fealist *)
-                                (((char *) &pSMBr->hdr.Protocol) +
-                                data_offset);
-                        name_len = le32_to_cpu(ea_response_data->list_len);
-                        cFYI(1, ("ea length %d", name_len));
-                        if (name_len <= 8) {
-                        /* returned EA size zeroed at top of function */
-                                cFYI(1, ("empty EA list returned from server"));
-                        } else {
-                                /* account for ea list len */
-                                name_len -= 4;
-                                temp_fea = ea_response_data->list;
-                                temp_ptr = (char *)temp_fea;
-                                /* loop through checking if we have a matching
-                                name and then return the associated value */
-                                while (name_len > 0) {
-                                        __u16 value_len;
-                                        name_len -= 4;
-                                        temp_ptr += 4;
-                                        value_len =
-                                              le16_to_cpu(temp_fea->value_len);
-                                /* BB validate that value_len falls within SMB,
-                                even though maximum for name_len is 255 */
-                                        if (memcmp(temp_fea->name, ea_name,
-                                                  temp_fea->name_len) == 0) {
-                                                /* found a match */
-                                                rc = value_len;
-                                /* account for prefix user. and trailing null */
-                                                if (rc <= (int)buf_size) {
-                                                        memcpy(ea_value,
-                                                                temp_fea->name+temp_fea->name_len+1,
-                                                                rc);
-                                                        /* ea values, unlike ea
-                                                           names, are not null
-                                                           terminated */
-                                                } else if (buf_size == 0) {
-                                                /* skip copy - calc size only */
-                                                } else {
-                                                /* stop before overrun buffer */
-                                                        rc = -ERANGE;
-                                                }
-                                                break;
-                                        }
-                                        name_len -= temp_fea->name_len;
-                                        temp_ptr += temp_fea->name_len;
-                                        /* account for trailing null */
-                                        name_len--;
-                                        temp_ptr++;
-                                        name_len -= value_len;
-                                        temp_ptr += value_len;
-                                        /* No trailing null to account for in
-                                           value_len.  Go on to next EA */
-                                        temp_fea = (struct fea *)temp_ptr;
+                if (ea_name) {
+                        if (strncmp(ea_name, temp_ptr, name_len) == 0) {
+                                temp_ptr += name_len + 1;
+                                rc = value_len;
+                                if (buf_size == 0)
+                                        goto QAllEAsOut;
+                                if ((size_t)value_len > buf_size) {
+                                        rc = -ERANGE;
+                                        goto QAllEAsOut;
                                 }
+                                memcpy(EAData, temp_ptr, value_len);
+                                goto QAllEAsOut;
+                        }
+                } else {
+                        /* account for prefix user. and trailing null */
+                        rc += (5 + 1 + name_len);
+                        if (rc < (int) buf_size) {
+                                memcpy(EAData, "user.", 5);
+                                EAData += 5;
+                                memcpy(EAData, temp_ptr, name_len);
+                                EAData += name_len;
+                                /* null terminate name */
+                                *EAData = 0;
+                                ++EAData;
+                        } else if (buf_size == 0) {
+                                /* skip copy - calc size only */
+                        } else {
+                                /* stop before overrun buffer */
+                                rc = -ERANGE;
+                                break;
                         }
                 }
+                temp_ptr += name_len + 1 + value_len;
+                temp_fea = (struct fea *)temp_ptr;
         }
+
+        /* didn't find the named attribute */
+        if (ea_name)
+                rc = -ENODATA;
+
+QAllEAsOut:
         cifs_buf_release(pSMB);
         if (rc == -EAGAIN)
-                goto QEARetry;
+                goto QAllEAsRetry;
 
         return (ssize_t)rc;
 }
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 2e9e09ca0e30..45eb6cba793f 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2388,13 +2388,13 @@ try_mount_again:
                  */
                 cifs_put_tcp_session(srvTcp);
 
-                down(&pSesInfo->sesSem);
+                mutex_lock(&pSesInfo->session_mutex);
                 if (pSesInfo->need_reconnect) {
                         cFYI(1, ("Session needs reconnect"));
                         rc = cifs_setup_session(xid, pSesInfo,
                                                 cifs_sb->local_nls);
                 }
-                up(&pSesInfo->sesSem);
+                mutex_unlock(&pSesInfo->session_mutex);
         } else if (!rc) {
                 cFYI(1, ("Existing smb sess not found"));
                 pSesInfo = sesInfoAlloc();
@@ -2437,12 +2437,12 @@ try_mount_again:
                 }
                 pSesInfo->linux_uid = volume_info->linux_uid;
                 pSesInfo->overrideSecFlg = volume_info->secFlg;
-                down(&pSesInfo->sesSem);
+                mutex_lock(&pSesInfo->session_mutex);
 
                 /* BB FIXME need to pass vol->secFlgs BB */
                 rc = cifs_setup_session(xid, pSesInfo,
                                         cifs_sb->local_nls);
-                up(&pSesInfo->sesSem);
+                mutex_unlock(&pSesInfo->session_mutex);
         }
 
         /* search for existing tcon to this server share */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 057e1dae12ab..3d8f8a96f5a3 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2289,9 +2289,9 @@ cifs_oplock_break(struct slow_work *work)
         if (inode && S_ISREG(inode->i_mode)) {
 #ifdef CONFIG_CIFS_EXPERIMENTAL
                 if (cinode->clientCanCacheAll == 0)
-                        break_lease(inode, FMODE_READ);
+                        break_lease(inode, O_RDONLY);
                 else if (cinode->clientCanCacheRead == 0)
-                        break_lease(inode, FMODE_WRITE);
+                        break_lease(inode, O_WRONLY);
 #endif
                 rc = filemap_fdatawrite(inode->i_mapping);
                 if (cinode->clientCanCacheRead == 0) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index e3fda978f481..8bdbc818164c 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -111,6 +111,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
 
         cifs_i->delete_pending = fattr->cf_flags & CIFS_FATTR_DELETE_PENDING;
 
+        cifs_i->server_eof = fattr->cf_eof;
         /*
          * Can't safely change the file size here if the client is writing to
          * it due to potential races.
@@ -366,7 +367,7 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
         char ea_value[4];
         __u32 mode;
 
-        rc = CIFSSMBQueryEA(xid, cifs_sb->tcon, path, "SETFILEBITS",
+        rc = CIFSSMBQAllEAs(xid, cifs_sb->tcon, path, "SETFILEBITS",
                             ea_value, 4 /* size of buf */, cifs_sb->local_nls,
                             cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index d27d4ec6579b..d1474996a812 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -79,7 +79,7 @@ sesInfoAlloc(void)
                 ++ret_buf->ses_count;
                 INIT_LIST_HEAD(&ret_buf->smb_ses_list);
                 INIT_LIST_HEAD(&ret_buf->tcon_list);
-                init_MUTEX(&ret_buf->sesSem);
+                mutex_init(&ret_buf->session_mutex);
         }
         return ret_buf;
 }
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index a75afa3dd9e1..3e2ef0de1209 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -244,7 +244,7 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                         /* revalidate/getattr then populate from inode */
                 } /* BB add else when above is implemented */
                 ea_name += 5; /* skip past user. prefix */
-                rc = CIFSSMBQueryEA(xid, pTcon, full_path, ea_name, ea_value,
+                rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
                         buf_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if (strncmp(ea_name, CIFS_XATTR_OS2_PREFIX, 4) == 0) {
@@ -252,7 +252,7 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                         goto get_ea_exit;
 
                 ea_name += 4; /* skip past os2. prefix */
-                rc = CIFSSMBQueryEA(xid, pTcon, full_path, ea_name, ea_value,
+                rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
                         buf_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if (strncmp(ea_name, POSIX_ACL_XATTR_ACCESS,
@@ -364,8 +364,8 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size)
         /* if proc/fs/cifs/streamstoxattr is set then
                 search server for EAs or streams to
                 returns as xattrs */
-        rc = CIFSSMBQAllEAs(xid, pTcon, full_path, data, buf_size,
-                                cifs_sb->local_nls,
+        rc = CIFSSMBQAllEAs(xid, pTcon, full_path, NULL, data,
+                                buf_size, cifs_sb->local_nls,
                                 cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
 
diff --git a/fs/dcache.c b/fs/dcache.c
index 953173a293a9..f1358e5c3a59 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -257,6 +257,7 @@ kill_it:
         if (dentry)
                 goto repeat;
 }
+EXPORT_SYMBOL(dput);
 
 /**
  * d_invalidate - invalidate a dentry
@@ -314,6 +315,7 @@ int d_invalidate(struct dentry * dentry)
         spin_unlock(&dcache_lock);
         return 0;
 }
+EXPORT_SYMBOL(d_invalidate);
 
 /* This should be called _only_ with dcache_lock held */
 
@@ -328,6 +330,7 @@ struct dentry * dget_locked(struct dentry *dentry)
 {
         return __dget_locked(dentry);
 }
+EXPORT_SYMBOL(dget_locked);
 
 /**
  * d_find_alias - grab a hashed alias of inode
@@ -384,6 +387,7 @@ struct dentry * d_find_alias(struct inode *inode)
         }
         return de;
 }
+EXPORT_SYMBOL(d_find_alias);
 
 /*
  *      Try to kill dentries associated with this inode.
@@ -408,6 +412,7 @@ restart:
         }
         spin_unlock(&dcache_lock);
 }
+EXPORT_SYMBOL(d_prune_aliases);
 
 /*
  * Throw away a dentry - free the inode, dput the parent.  This requires that
@@ -610,6 +615,7 @@ void shrink_dcache_sb(struct super_block * sb)
 {
         __shrink_dcache_sb(sb, NULL, 0);
 }
+EXPORT_SYMBOL(shrink_dcache_sb);
 
 /*
  * destroy a single subtree of dentries for unmount
@@ -792,6 +798,7 @@ positive:
         spin_unlock(&dcache_lock);
         return 1;
 }
+EXPORT_SYMBOL(have_submounts);
 
 /*
  * Search the dentry child list for the specified parent,
@@ -876,6 +883,7 @@ void shrink_dcache_parent(struct dentry * parent)
         while ((found = select_parent(parent)) != 0)
                 __shrink_dcache_sb(sb, &found, 0);
 }
+EXPORT_SYMBOL(shrink_dcache_parent);
 
 /*
  * Scan `nr' dentries and return the number which remain.
@@ -968,6 +976,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
 
         return dentry;
 }
+EXPORT_SYMBOL(d_alloc);
 
 struct dentry *d_alloc_name(struct dentry *parent, const char *name)
 {
@@ -1012,6 +1021,7 @@ void d_instantiate(struct dentry *entry, struct inode * inode)
         spin_unlock(&dcache_lock);
         security_d_instantiate(entry, inode);
 }
+EXPORT_SYMBOL(d_instantiate);
 
 /**
  * d_instantiate_unique - instantiate a non-aliased dentry
@@ -1108,6 +1118,7 @@ struct dentry * d_alloc_root(struct inode * root_inode)
         }
         return res;
 }
+EXPORT_SYMBOL(d_alloc_root);
 
 static inline struct hlist_head *d_hash(struct dentry *parent,
                                         unsigned long hash)
@@ -1211,7 +1222,6 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                         BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
                         spin_unlock(&dcache_lock);
                         security_d_instantiate(new, inode);
-                        d_rehash(dentry);
                         d_move(new, dentry);
                         iput(inode);
                 } else {
@@ -1225,6 +1235,7 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                 d_add(dentry, inode);
         return new;
 }
+EXPORT_SYMBOL(d_splice_alias);
 
 /**
  * d_add_ci - lookup or allocate new dentry with case-exact name
@@ -1314,6 +1325,7 @@ err_out:
         iput(inode);
         return ERR_PTR(error);
 }
+EXPORT_SYMBOL(d_add_ci);
 
 /**
  * d_lookup - search for a dentry
@@ -1357,6 +1369,7 @@ struct dentry * d_lookup(struct dentry * parent, struct qstr * name)
         } while (read_seqretry(&rename_lock, seq));
         return dentry;
 }
+EXPORT_SYMBOL(d_lookup);
 
 struct dentry * __d_lookup(struct dentry * parent, struct qstr * name)
 {
@@ -1483,6 +1496,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent)
 out:
         return 0;
 }
+EXPORT_SYMBOL(d_validate);
 
 /*
  * When a file is deleted, we have two options:
@@ -1528,6 +1542,7 @@ void d_delete(struct dentry * dentry)
 
         fsnotify_nameremove(dentry, isdir);
 }
+EXPORT_SYMBOL(d_delete);
 
 static void __d_rehash(struct dentry * entry, struct hlist_head *list)
 {
@@ -1556,6 +1571,7 @@ void d_rehash(struct dentry * entry)
         spin_unlock(&entry->d_lock);
         spin_unlock(&dcache_lock);
 }
+EXPORT_SYMBOL(d_rehash);
 
 /*
  * When switching names, the actual string doesn't strictly have to
@@ -1702,6 +1718,7 @@ void d_move(struct dentry * dentry, struct dentry * target)
         d_move_locked(dentry, target);
         spin_unlock(&dcache_lock);
 }
+EXPORT_SYMBOL(d_move);
 
 /**
  * d_ancestor - search for an ancestor
@@ -1868,6 +1885,7 @@ shouldnt_be_hashed:
         spin_unlock(&dcache_lock);
         BUG();
 }
+EXPORT_SYMBOL_GPL(d_materialise_unique);
 
 static int prepend(char **buffer, int *buflen, const char *str, int namelen)
 {
@@ -2005,6 +2023,7 @@ char *d_path(const struct path *path, char *buf, int buflen)
         path_put(&root);
         return res;
 }
+EXPORT_SYMBOL(d_path);
 
 /*
  * Helper function for dentry_operations.d_dname() members
@@ -2171,6 +2190,30 @@ int is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
         return result;
 }
 
+int path_is_under(struct path *path1, struct path *path2)
+{
+        struct vfsmount *mnt = path1->mnt;
+        struct dentry *dentry = path1->dentry;
+        int res;
+        spin_lock(&vfsmount_lock);
+        if (mnt != path2->mnt) {
+                for (;;) {
+                        if (mnt->mnt_parent == mnt) {
+                                spin_unlock(&vfsmount_lock);
+                                return 0;
+                        }
+                        if (mnt->mnt_parent == path2->mnt)
+                                break;
+                        mnt = mnt->mnt_parent;
+                }
+                dentry = mnt->mnt_mountpoint;
+        }
+        res = is_subdir(dentry, path2->dentry);
+        spin_unlock(&vfsmount_lock);
+        return res;
+}
+EXPORT_SYMBOL(path_is_under);
+
 void d_genocide(struct dentry *root)
 {
         struct dentry *this_parent = root;
@@ -2228,6 +2271,7 @@ ino_t find_inode_number(struct dentry *dir, struct qstr *name)
         }
         return ino;
 }
+EXPORT_SYMBOL(find_inode_number);
 
 static __initdata unsigned long dhash_entries;
 static int __init set_dhash_entries(char *str)
@@ -2297,6 +2341,7 @@ static void __init dcache_init(void)
 
 /* SLAB cache for __getname() consumers */
 struct kmem_cache *names_cachep __read_mostly;
+EXPORT_SYMBOL(names_cachep);
 
 EXPORT_SYMBOL(d_genocide);
 
@@ -2326,26 +2371,3 @@ void __init vfs_caches_init(unsigned long mempages)
         bdev_cache_init();
         chrdev_init();
 }
-
-EXPORT_SYMBOL(d_alloc);
-EXPORT_SYMBOL(d_alloc_root);
-EXPORT_SYMBOL(d_delete);
-EXPORT_SYMBOL(d_find_alias);
-EXPORT_SYMBOL(d_instantiate);
-EXPORT_SYMBOL(d_invalidate);
-EXPORT_SYMBOL(d_lookup);
-EXPORT_SYMBOL(d_move);
-EXPORT_SYMBOL_GPL(d_materialise_unique);
-EXPORT_SYMBOL(d_path);
-EXPORT_SYMBOL(d_prune_aliases);
-EXPORT_SYMBOL(d_rehash);
-EXPORT_SYMBOL(d_splice_alias);
-EXPORT_SYMBOL(d_add_ci);
-EXPORT_SYMBOL(d_validate);
-EXPORT_SYMBOL(dget_locked);
-EXPORT_SYMBOL(dput);
-EXPORT_SYMBOL(find_inode_number);
-EXPORT_SYMBOL(have_submounts);
-EXPORT_SYMBOL(names_cachep);
-EXPORT_SYMBOL(shrink_dcache_parent);
-EXPORT_SYMBOL(shrink_dcache_sb);
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 274ac865bae8..049d6c36da09 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -496,7 +496,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
         }
         d_move(old_dentry, dentry);
         fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name,
-                old_dentry->d_name.name, S_ISDIR(old_dentry->d_inode->i_mode),
+                S_ISDIR(old_dentry->d_inode->i_mode),
                 NULL, old_dentry);
         fsnotify_oldname_free(old_name);
         unlock_rename(new_dir, old_dir);
diff --git a/fs/exofs/common.h b/fs/exofs/common.h
index b1b178e61718..f0d520312d8b 100644
--- a/fs/exofs/common.h
+++ b/fs/exofs/common.h
@@ -55,6 +55,8 @@
 /* exofs Application specific page/attribute */
 # define EXOFS_APAGE_FS_DATA    (OSD_APAGE_APP_DEFINED_FIRST + 3)
 # define EXOFS_ATTR_INODE_DATA  1
+# define EXOFS_ATTR_INODE_FILE_LAYOUT   2
+# define EXOFS_ATTR_INODE_DIR_LAYOUT    3
 
 /*
  * The maximum number of files we can have is limited by the size of the
@@ -206,4 +208,41 @@ enum {
         (((name_len) + offsetof(struct exofs_dir_entry, name)  + \
           EXOFS_DIR_ROUND) & ~EXOFS_DIR_ROUND)
 
+/*
+ * The on-disk (optional) layout structure.
+ * sits in an EXOFS_ATTR_INODE_FILE_LAYOUT or EXOFS_ATTR_INODE_DIR_LAYOUT
+ * attribute, attached to any inode, usually to a directory.
+ */
+
+enum exofs_inode_layout_gen_functions {
+        LAYOUT_MOVING_WINDOW = 0,
+        LAYOUT_IMPLICT = 1,
+};
+
+struct exofs_on_disk_inode_layout {
+        __le16 gen_func; /* One of enum exofs_inode_layout_gen_functions */
+        __le16 pad;
+        union {
+                /* gen_func == LAYOUT_MOVING_WINDOW (default) */
+                struct exofs_layout_sliding_window {
+                        __le32 num_devices; /* first n devices in global-table*/
+                } sliding_window __packed;
+
+                /* gen_func == LAYOUT_IMPLICT */
+                struct exofs_layout_implict_list {
+                        struct exofs_dt_data_map data_map;
+                        /* Variable array of size data_map.cb_num_comps. These
+                         * are device indexes of the devices in the global table
+                         */
+                        __le32 dev_indexes[];
+                } implict __packed;
+        };
+} __packed;
+
+static inline size_t exofs_on_disk_inode_layout_size(unsigned max_devs)
+{
+        return sizeof(struct exofs_on_disk_inode_layout) +
+                max_devs * sizeof(__le32);
+}
+
 #endif /*ifndef __EXOFS_COM_H__*/
diff --git a/fs/exofs/exofs.h b/fs/exofs/exofs.h
index c35fd4623986..8442e353309f 100644
--- a/fs/exofs/exofs.h
+++ b/fs/exofs/exofs.h
@@ -55,12 +55,28 @@
 /* u64 has problems with printk this will cast it to unsigned long long */
 #define _LLU(x) (unsigned long long)(x)
 
+struct exofs_layout {
+        osd_id          s_pid;                  /* partition ID of file system*/
+
+        /* Our way of looking at the data_map */
+        unsigned stripe_unit;
+        unsigned mirrors_p1;
+
+        unsigned group_width;
+        u64      group_depth;
+        unsigned group_count;
+
+        enum exofs_inode_layout_gen_functions lay_func;
+
+        unsigned        s_numdevs;              /* Num of devices in array    */
+        struct osd_dev  *s_ods[0];              /* Variable length            */
+};
+
 /*
  * our extension to the in-memory superblock
  */
 struct exofs_sb_info {
         struct exofs_fscb s_fscb;               /* Written often, pre-allocate*/
-        osd_id          s_pid;                  /* partition ID of file system*/
         int             s_timeout;              /* timeout for OSD operations */
         uint64_t        s_nextid;               /* highest object ID used     */
         uint32_t        s_numfiles;             /* number of files on fs      */
@@ -69,22 +85,27 @@ struct exofs_sb_info {
         atomic_t        s_curr_pending;         /* number of pending commands */
         uint8_t         s_cred[OSD_CAP_LEN];    /* credential for the fscb    */
 
-        struct pnfs_osd_data_map data_map;      /* Default raid to use        */
-        unsigned        s_numdevs;              /* Num of devices in array    */
-        struct osd_dev  *s_ods[1];              /* Variable length, minimum 1 */
+        struct pnfs_osd_data_map data_map;      /* Default raid to use
+                                                 * FIXME: Needed ?
+                                                 */
+/*      struct exofs_layout     dir_layout;*/   /* Default dir layout */
+        struct exofs_layout     layout;         /* Default files layout,
+                                                 * contains the variable osd_dev
+                                                 * array. Keep last */
+        struct osd_dev  *_min_one_dev[1];       /* Place holder for one dev   */
 };
 
 /*
  * our extension to the in-memory inode
  */
 struct exofs_i_info {
+        struct inode   vfs_inode;          /* normal in-memory inode          */
+        wait_queue_head_t i_wq;            /* wait queue for inode            */
         unsigned long  i_flags;            /* various atomic flags            */
         uint32_t       i_data[EXOFS_IDATA];/*short symlink names and device #s*/
         uint32_t       i_dir_start_lookup; /* which page to start lookup      */
-        wait_queue_head_t i_wq;            /* wait queue for inode            */
         uint64_t       i_commit_size;      /* the object's written length     */
         uint8_t        i_cred[OSD_CAP_LEN];/* all-powerful credential         */
-        struct inode   vfs_inode;          /* normal in-memory inode          */
 };
 
 static inline osd_id exofs_oi_objno(struct exofs_i_info *oi)
@@ -101,7 +122,7 @@ struct exofs_io_state {
         void                    *private;
         exofs_io_done_fn        done;
 
-        struct exofs_sb_info    *sbi;
+        struct exofs_layout     *layout;
         struct osd_obj_id       obj;
         u8                      *cred;
 
@@ -109,7 +130,11 @@ struct exofs_io_state {
         loff_t                  offset;
         unsigned long           length;
         void                    *kern_buff;
-        struct bio              *bio;
+
+        struct page             **pages;
+        unsigned                nr_pages;
+        unsigned                pgbase;
+        unsigned                pages_consumed;
 
         /* Attributes */
         unsigned                in_attr_len;
@@ -122,6 +147,9 @@ struct exofs_io_state {
         struct exofs_per_dev_state {
                 struct osd_request *or;
                 struct bio *bio;
+                loff_t offset;
+                unsigned length;
+                unsigned dev;
         } per_dev[];
 };
 
@@ -175,6 +203,12 @@ static inline struct exofs_i_info *exofs_i(struct inode *inode)
 }
 
 /*
+ * Given a layout, object_number and stripe_index return the associated global
+ * dev_index
+ */
+unsigned exofs_layout_od_id(struct exofs_layout *layout,
+                            osd_id obj_no, unsigned layout_index);
+/*
  * Maximum count of links to a file
  */
 #define EXOFS_LINK_MAX           32000
@@ -189,7 +223,8 @@ void exofs_make_credential(u8 cred_a[OSD_CAP_LEN],
 int exofs_read_kern(struct osd_dev *od, u8 *cred, struct osd_obj_id *obj,
                     u64 offset, void *p, unsigned length);
 
-int  exofs_get_io_state(struct exofs_sb_info *sbi, struct exofs_io_state** ios);
+int  exofs_get_io_state(struct exofs_layout *layout,
+                        struct exofs_io_state **ios);
 void exofs_put_io_state(struct exofs_io_state *ios);
 
 int exofs_check_io(struct exofs_io_state *ios, u64 *resid);
@@ -226,7 +261,7 @@ int exofs_write_begin(struct file *file, struct address_space *mapping,
                 struct page **pagep, void **fsdata);
 extern struct inode *exofs_iget(struct super_block *, unsigned long);
 struct inode *exofs_new_inode(struct inode *, int);
-extern int exofs_write_inode(struct inode *, int);
+extern int exofs_write_inode(struct inode *, struct writeback_control *wbc);
 extern void exofs_delete_inode(struct inode *);
 
 /* dir.c:                */
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 2afbcebeda71..a17e4b733e35 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -41,16 +41,18 @@
 
 enum { BIO_MAX_PAGES_KMALLOC =
                 (PAGE_SIZE - sizeof(struct bio)) / sizeof(struct bio_vec),
+        MAX_PAGES_KMALLOC =
+                PAGE_SIZE / sizeof(struct page *),
 };
 
 struct page_collect {
         struct exofs_sb_info *sbi;
-        struct request_queue *req_q;
         struct inode *inode;
         unsigned expected_pages;
         struct exofs_io_state *ios;
 
-        struct bio *bio;
+        struct page **pages;
+        unsigned alloc_pages;
         unsigned nr_pages;
         unsigned long length;
         loff_t pg_first; /* keep 64bit also in 32-arches */
@@ -62,15 +64,12 @@ static void _pcol_init(struct page_collect *pcol, unsigned expected_pages,
         struct exofs_sb_info *sbi = inode->i_sb->s_fs_info;
 
         pcol->sbi = sbi;
-        /* Create master bios on first Q, later on cloning, each clone will be
-         * allocated on it's destination Q
-         */
-        pcol->req_q = osd_request_queue(sbi->s_ods[0]);
         pcol->inode = inode;
         pcol->expected_pages = expected_pages;
 
         pcol->ios = NULL;
-        pcol->bio = NULL;
+        pcol->pages = NULL;
+        pcol->alloc_pages = 0;
         pcol->nr_pages = 0;
         pcol->length = 0;
         pcol->pg_first = -1;
@@ -80,7 +79,8 @@ static void _pcol_reset(struct page_collect *pcol)
 {
         pcol->expected_pages -= min(pcol->nr_pages, pcol->expected_pages);
 
-        pcol->bio = NULL;
+        pcol->pages = NULL;
+        pcol->alloc_pages = 0;
         pcol->nr_pages = 0;
         pcol->length = 0;
         pcol->pg_first = -1;
@@ -90,38 +90,43 @@ static void _pcol_reset(struct page_collect *pcol)
          * it might not end here. don't be left with nothing
          */
         if (!pcol->expected_pages)
-                pcol->expected_pages = BIO_MAX_PAGES_KMALLOC;
+                pcol->expected_pages = MAX_PAGES_KMALLOC;
 }
 
 static int pcol_try_alloc(struct page_collect *pcol)
 {
-        int pages = min_t(unsigned, pcol->expected_pages,
-                          BIO_MAX_PAGES_KMALLOC);
+        unsigned pages = min_t(unsigned, pcol->expected_pages,
+                          MAX_PAGES_KMALLOC);
 
         if (!pcol->ios) { /* First time allocate io_state */
-                int ret = exofs_get_io_state(pcol->sbi, &pcol->ios);
+                int ret = exofs_get_io_state(&pcol->sbi->layout, &pcol->ios);
 
                 if (ret)
                         return ret;
         }
 
+        /* TODO: easily support bio chaining */
+        pages =  min_t(unsigned, pages,
+                       pcol->sbi->layout.group_width * BIO_MAX_PAGES_KMALLOC);
+
         for (; pages; pages >>= 1) {
-                pcol->bio = bio_kmalloc(GFP_KERNEL, pages);
-                if (likely(pcol->bio))
+                pcol->pages = kmalloc(pages * sizeof(struct page *),
+                                      GFP_KERNEL);
+                if (likely(pcol->pages)) {
+                        pcol->alloc_pages = pages;
                         return 0;
+                }
         }
 
-        EXOFS_ERR("Failed to bio_kmalloc expected_pages=%u\n",
+        EXOFS_ERR("Failed to kmalloc expected_pages=%u\n",
                   pcol->expected_pages);
         return -ENOMEM;
 }
 
 static void pcol_free(struct page_collect *pcol)
 {
-        if (pcol->bio) {
-                bio_put(pcol->bio);
-                pcol->bio = NULL;
-        }
+        kfree(pcol->pages);
+        pcol->pages = NULL;
 
         if (pcol->ios) {
                 exofs_put_io_state(pcol->ios);
@@ -132,11 +137,10 @@ static void pcol_free(struct page_collect *pcol)
 static int pcol_add_page(struct page_collect *pcol, struct page *page,
                          unsigned len)
 {
-        int added_len = bio_add_pc_page(pcol->req_q, pcol->bio, page, len, 0);
-        if (unlikely(len != added_len))
+        if (unlikely(pcol->nr_pages >= pcol->alloc_pages))
                 return -ENOMEM;
 
-        ++pcol->nr_pages;
+        pcol->pages[pcol->nr_pages++] = page;
         pcol->length += len;
         return 0;
 }
@@ -181,7 +185,6 @@ static void update_write_page(struct page *page, int ret)
  */
 static int __readpages_done(struct page_collect *pcol, bool do_unlock)
 {
-        struct bio_vec *bvec;
         int i;
         u64 resid;
         u64 good_bytes;
@@ -193,13 +196,13 @@ static int __readpages_done(struct page_collect *pcol, bool do_unlock)
         else
                 good_bytes = pcol->length - resid;
 
-        EXOFS_DBGMSG("readpages_done(0x%lx) good_bytes=0x%llx"
+        EXOFS_DBGMSG2("readpages_done(0x%lx) good_bytes=0x%llx"
                      " length=0x%lx nr_pages=%u\n",
                      pcol->inode->i_ino, _LLU(good_bytes), pcol->length,
                      pcol->nr_pages);
 
-        __bio_for_each_segment(bvec, pcol->bio, i, 0) {
-                struct page *page = bvec->bv_page;
+        for (i = 0; i < pcol->nr_pages; i++) {
+                struct page *page = pcol->pages[i];
                 struct inode *inode = page->mapping->host;
                 int page_stat;
 
@@ -218,11 +221,11 @@ static int __readpages_done(struct page_collect *pcol, bool do_unlock)
                 ret = update_read_page(page, page_stat);
                 if (do_unlock)
                         unlock_page(page);
-                length += bvec->bv_len;
+                length += PAGE_SIZE;
         }
 
         pcol_free(pcol);
-        EXOFS_DBGMSG("readpages_done END\n");
+        EXOFS_DBGMSG2("readpages_done END\n");
         return ret;
 }
 
@@ -238,11 +241,10 @@ static void readpages_done(struct exofs_io_state *ios, void *p)
 
 static void _unlock_pcol_pages(struct page_collect *pcol, int ret, int rw)
 {
-        struct bio_vec *bvec;
         int i;
 
-        __bio_for_each_segment(bvec, pcol->bio, i, 0) {
-                struct page *page = bvec->bv_page;
+        for (i = 0; i < pcol->nr_pages; i++) {
+                struct page *page = pcol->pages[i];
 
                 if (rw == READ)
                         update_read_page(page, ret);
@@ -260,13 +262,14 @@ static int read_exec(struct page_collect *pcol, bool is_sync)
         struct page_collect *pcol_copy = NULL;
         int ret;
 
-        if (!pcol->bio)
+        if (!pcol->pages)
                 return 0;
 
         /* see comment in _readpage() about sync reads */
         WARN_ON(is_sync && (pcol->nr_pages != 1));
 
-        ios->bio = pcol->bio;
+        ios->pages = pcol->pages;
+        ios->nr_pages = pcol->nr_pages;
         ios->length = pcol->length;
         ios->offset = pcol->pg_first << PAGE_CACHE_SHIFT;
 
@@ -290,7 +293,7 @@ static int read_exec(struct page_collect *pcol, bool is_sync)
 
         atomic_inc(&pcol->sbi->s_curr_pending);
 
-        EXOFS_DBGMSG("read_exec obj=0x%llx start=0x%llx length=0x%lx\n",
+        EXOFS_DBGMSG2("read_exec obj=0x%llx start=0x%llx length=0x%lx\n",
                   ios->obj.id, _LLU(ios->offset), pcol->length);
 
         /* pages ownership was passed to pcol_copy */
@@ -366,7 +369,7 @@ try_again:
                 goto try_again;
         }
 
-        if (!pcol->bio) {
+        if (!pcol->pages) {
                 ret = pcol_try_alloc(pcol);
                 if (unlikely(ret))
                         goto fail;
@@ -448,7 +451,6 @@ static int exofs_readpage(struct file *file, struct page *page)
 static void writepages_done(struct exofs_io_state *ios, void *p)
 {
         struct page_collect *pcol = p;
-        struct bio_vec *bvec;
         int i;
         u64 resid;
         u64  good_bytes;
@@ -462,13 +464,13 @@ static void writepages_done(struct exofs_io_state *ios, void *p)
         else
                 good_bytes = pcol->length - resid;
 
-        EXOFS_DBGMSG("writepages_done(0x%lx) good_bytes=0x%llx"
+        EXOFS_DBGMSG2("writepages_done(0x%lx) good_bytes=0x%llx"
                      " length=0x%lx nr_pages=%u\n",
                      pcol->inode->i_ino, _LLU(good_bytes), pcol->length,
                      pcol->nr_pages);
 
-        __bio_for_each_segment(bvec, pcol->bio, i, 0) {
-                struct page *page = bvec->bv_page;
+        for (i = 0; i < pcol->nr_pages; i++) {
+                struct page *page = pcol->pages[i];
                 struct inode *inode = page->mapping->host;
                 int page_stat;
 
@@ -485,12 +487,12 @@ static void writepages_done(struct exofs_io_state *ios, void *p)
                 EXOFS_DBGMSG2("    writepages_done(0x%lx, 0x%lx) status=%d\n",
                              inode->i_ino, page->index, page_stat);
 
-                length += bvec->bv_len;
+                length += PAGE_SIZE;
         }
 
         pcol_free(pcol);
         kfree(pcol);
-        EXOFS_DBGMSG("writepages_done END\n");
+        EXOFS_DBGMSG2("writepages_done END\n");
 }
 
 static int write_exec(struct page_collect *pcol)
@@ -500,7 +502,7 @@ static int write_exec(struct page_collect *pcol)
         struct page_collect *pcol_copy = NULL;
         int ret;
 
-        if (!pcol->bio)
+        if (!pcol->pages)
                 return 0;
 
         pcol_copy = kmalloc(sizeof(*pcol_copy), GFP_KERNEL);
@@ -512,9 +514,8 @@ static int write_exec(struct page_collect *pcol)
 
         *pcol_copy = *pcol;
 
-        pcol_copy->bio->bi_rw |= (1 << BIO_RW); /* FIXME: bio_set_dir() */
-
-        ios->bio = pcol_copy->bio;
+        ios->pages = pcol_copy->pages;
+        ios->nr_pages = pcol_copy->nr_pages;
         ios->offset = pcol_copy->pg_first << PAGE_CACHE_SHIFT;
         ios->length = pcol_copy->length;
         ios->done = writepages_done;
@@ -527,7 +528,7 @@ static int write_exec(struct page_collect *pcol)
         }
 
         atomic_inc(&pcol->sbi->s_curr_pending);
-        EXOFS_DBGMSG("write_exec(0x%lx, 0x%llx) start=0x%llx length=0x%lx\n",
+        EXOFS_DBGMSG2("write_exec(0x%lx, 0x%llx) start=0x%llx length=0x%lx\n",
                   pcol->inode->i_ino, pcol->pg_first, _LLU(ios->offset),
                   pcol->length);
         /* pages ownership was passed to pcol_copy */
@@ -605,7 +606,7 @@ try_again:
                 goto try_again;
         }
 
-        if (!pcol->bio) {
+        if (!pcol->pages) {
                 ret = pcol_try_alloc(pcol);
                 if (unlikely(ret))
                         goto fail;
@@ -616,7 +617,7 @@ try_again:
 
         ret = pcol_add_page(pcol, page, len);
         if (unlikely(ret)) {
-                EXOFS_DBGMSG("Failed pcol_add_page "
+                EXOFS_DBGMSG2("Failed pcol_add_page "
                              "nr_pages=%u total_length=0x%lx\n",
                              pcol->nr_pages, pcol->length);
 
@@ -663,7 +664,7 @@ static int exofs_writepages(struct address_space *mapping,
         if (expected_pages < 32L)
                 expected_pages = 32L;
 
-        EXOFS_DBGMSG("inode(0x%lx) wbc->start=0x%llx wbc->end=0x%llx "
+        EXOFS_DBGMSG2("inode(0x%lx) wbc->start=0x%llx wbc->end=0x%llx "
                      "nrpages=%lu start=0x%lx end=0x%lx expected_pages=%ld\n",
                      mapping->host->i_ino, wbc->range_start, wbc->range_end,
                      mapping->nrpages, start, end, expected_pages);
@@ -859,20 +860,33 @@ int exofs_setattr(struct dentry *dentry, struct iattr *iattr)
         return error;
 }
 
+static const struct osd_attr g_attr_inode_file_layout = ATTR_DEF(
+        EXOFS_APAGE_FS_DATA,
+        EXOFS_ATTR_INODE_FILE_LAYOUT,
+        0);
+static const struct osd_attr g_attr_inode_dir_layout = ATTR_DEF(
+        EXOFS_APAGE_FS_DATA,
+        EXOFS_ATTR_INODE_DIR_LAYOUT,
+        0);
+
 /*
- * Read an inode from the OSD, and return it as is.  We also return the size
- * attribute in the 'obj_size' argument.
+ * Read the Linux inode info from the OSD, and return it as is. In exofs the
+ * inode info is in an application specific page/attribute of the osd-object.
  */
 static int exofs_get_inode(struct super_block *sb, struct exofs_i_info *oi,
-                    struct exofs_fcb *inode, uint64_t *obj_size)
+                    struct exofs_fcb *inode)
 {
         struct exofs_sb_info *sbi = sb->s_fs_info;
-        struct osd_attr attrs[2];
+        struct osd_attr attrs[] = {
+                [0] = g_attr_inode_data,
+                [1] = g_attr_inode_file_layout,
+                [2] = g_attr_inode_dir_layout,
+        };
         struct exofs_io_state *ios;
+        struct exofs_on_disk_inode_layout *layout;
         int ret;
 
-        *obj_size = ~0;
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("%s: exofs_get_io_state failed.\n", __func__);
                 return ret;
@@ -882,14 +896,25 @@ static int exofs_get_inode(struct super_block *sb, struct exofs_i_info *oi,
         exofs_make_credential(oi->i_cred, &ios->obj);
         ios->cred = oi->i_cred;
 
-        attrs[0] = g_attr_inode_data;
-        attrs[1] = g_attr_logical_length;
+        attrs[1].len = exofs_on_disk_inode_layout_size(sbi->layout.s_numdevs);
+        attrs[2].len = exofs_on_disk_inode_layout_size(sbi->layout.s_numdevs);
+
         ios->in_attr = attrs;
         ios->in_attr_len = ARRAY_SIZE(attrs);
 
         ret = exofs_sbi_read(ios);
-        if (ret)
+        if (unlikely(ret)) {
+                EXOFS_ERR("object(0x%llx) corrupted, return empty file=>%d\n",
+                          _LLU(ios->obj.id), ret);
+                memset(inode, 0, sizeof(*inode));
+                inode->i_mode = 0040000 | (0777 & ~022);
+                /* If object is lost on target we might as well enable it's
+                 * delete.
+                 */
+                if ((ret == -ENOENT) || (ret == -EINVAL))
+                        ret = 0;
                 goto out;
+        }
 
         ret = extract_attr_from_ios(ios, &attrs[0]);
         if (ret) {
@@ -901,11 +926,33 @@ static int exofs_get_inode(struct super_block *sb, struct exofs_i_info *oi,
 
         ret = extract_attr_from_ios(ios, &attrs[1]);
         if (ret) {
-                EXOFS_ERR("%s: extract_attr of logical_length failed\n",
-                          __func__);
+                EXOFS_ERR("%s: extract_attr of inode_data failed\n", __func__);
+                goto out;
+        }
+        if (attrs[1].len) {
+                layout = attrs[1].val_ptr;
+                if (layout->gen_func != cpu_to_le16(LAYOUT_MOVING_WINDOW)) {
+                        EXOFS_ERR("%s: unsupported files layout %d\n",
+                                __func__, layout->gen_func);
+                        ret = -ENOTSUPP;
+                        goto out;
+                }
+        }
+
+        ret = extract_attr_from_ios(ios, &attrs[2]);
+        if (ret) {
+                EXOFS_ERR("%s: extract_attr of inode_data failed\n", __func__);
                 goto out;
         }
-        *obj_size = get_unaligned_be64(attrs[1].val_ptr);
+        if (attrs[2].len) {
+                layout = attrs[2].val_ptr;
+                if (layout->gen_func != cpu_to_le16(LAYOUT_MOVING_WINDOW)) {
+                        EXOFS_ERR("%s: unsupported meta-data layout %d\n",
+                                __func__, layout->gen_func);
+                        ret = -ENOTSUPP;
+                        goto out;
+                }
+        }
 
 out:
         exofs_put_io_state(ios);
@@ -925,7 +972,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
         struct exofs_i_info *oi;
         struct exofs_fcb fcb;
         struct inode *inode;
-        uint64_t obj_size;
         int ret;
 
         inode = iget_locked(sb, ino);
@@ -937,7 +983,7 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
         __oi_init(oi);
 
         /* read the inode from the osd */
-        ret = exofs_get_inode(sb, oi, &fcb, &obj_size);
+        ret = exofs_get_inode(sb, oi, &fcb);
         if (ret)
                 goto bad_inode;
 
@@ -958,13 +1004,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
         inode->i_blkbits = EXOFS_BLKSHIFT;
         inode->i_generation = le32_to_cpu(fcb.i_generation);
 
-        if ((inode->i_size != obj_size) &&
-                (!exofs_inode_is_fast_symlink(inode))) {
-                EXOFS_ERR("WARNING: Size of inode=%llu != object=%llu\n",
-                          inode->i_size, _LLU(obj_size));
-                /* FIXME: call exofs_inode_recovery() */
-        }
-
         oi->i_dir_start_lookup = 0;
 
         if ((inode->i_nlink == 0) && (inode->i_mode == 0)) {
@@ -1043,7 +1082,7 @@ static void create_done(struct exofs_io_state *ios, void *p)
 
         if (unlikely(ret)) {
                 EXOFS_ERR("object=0x%llx creation faild in pid=0x%llx",
-                          _LLU(exofs_oi_objno(oi)), _LLU(sbi->s_pid));
+                          _LLU(exofs_oi_objno(oi)), _LLU(sbi->layout.s_pid));
                 /*TODO: When FS is corrupted creation can fail, object already
                  * exist. Get rid of this asynchronous creation, if exist
                  * increment the obj counter and try the next object. Until we
@@ -1104,7 +1143,7 @@ struct inode *exofs_new_inode(struct inode *dir, int mode)
 
         mark_inode_dirty(inode);
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("exofs_new_inode: exofs_get_io_state failed\n");
                 return ERR_PTR(ret);
@@ -1170,8 +1209,10 @@ static int exofs_update_inode(struct inode *inode, int do_sync)
         int ret;
 
         args = kzalloc(sizeof(*args), GFP_KERNEL);
-        if (!args)
+        if (!args) {
+                EXOFS_DBGMSG("Faild kzalloc of args\n");
                 return -ENOMEM;
+        }
 
         fcb = &args->fcb;
 
@@ -1200,7 +1241,7 @@ static int exofs_update_inode(struct inode *inode, int do_sync)
         } else
                 memcpy(fcb->i_data, oi->i_data, sizeof(fcb->i_data));
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("%s: exofs_get_io_state failed.\n", __func__);
                 goto free_args;
@@ -1234,13 +1275,14 @@ static int exofs_update_inode(struct inode *inode, int do_sync)
 free_args:
         kfree(args);
 out:
-        EXOFS_DBGMSG("ret=>%d\n", ret);
+        EXOFS_DBGMSG("(0x%lx) do_sync=%d ret=>%d\n",
+                     inode->i_ino, do_sync, ret);
         return ret;
 }
 
-int exofs_write_inode(struct inode *inode, int wait)
+int exofs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
-        return exofs_update_inode(inode, wait);
+        return exofs_update_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
 }
 
 /*
@@ -1283,7 +1325,7 @@ void exofs_delete_inode(struct inode *inode)
 
         clear_inode(inode);
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (unlikely(ret)) {
                 EXOFS_ERR("%s: exofs_get_io_state failed\n", __func__);
                 return;
diff --git a/fs/exofs/ios.c b/fs/exofs/ios.c
index 5bad01fa1f9f..5293bc411d17 100644
--- a/fs/exofs/ios.c
+++ b/fs/exofs/ios.c
@@ -23,9 +23,13 @@
  */
 
 #include <scsi/scsi_device.h>
+#include <asm/div64.h>
 
 #include "exofs.h"
 
+#define EXOFS_DBGMSG2(M...) do {} while (0)
+/* #define EXOFS_DBGMSG2 EXOFS_DBGMSG */
+
 void exofs_make_credential(u8 cred_a[OSD_CAP_LEN], const struct osd_obj_id *obj)
 {
         osd_sec_init_nosec_doall_caps(cred_a, obj, false, true);
@@ -64,21 +68,24 @@ out:
         return ret;
 }
 
-int exofs_get_io_state(struct exofs_sb_info *sbi, struct exofs_io_state** pios)
+int exofs_get_io_state(struct exofs_layout *layout,
+                       struct exofs_io_state **pios)
 {
         struct exofs_io_state *ios;
 
         /*TODO: Maybe use kmem_cach per sbi of size
-         * exofs_io_state_size(sbi->s_numdevs)
+         * exofs_io_state_size(layout->s_numdevs)
          */
-        ios = kzalloc(exofs_io_state_size(sbi->s_numdevs), GFP_KERNEL);
+        ios = kzalloc(exofs_io_state_size(layout->s_numdevs), GFP_KERNEL);
         if (unlikely(!ios)) {
+                EXOFS_DBGMSG("Faild kzalloc bytes=%d\n",
+                             exofs_io_state_size(layout->s_numdevs));
                 *pios = NULL;
                 return -ENOMEM;
         }
 
-        ios->sbi = sbi;
-        ios->obj.partition = sbi->s_pid;
+        ios->layout = layout;
+        ios->obj.partition = layout->s_pid;
         *pios = ios;
         return 0;
 }
@@ -101,6 +108,29 @@ void exofs_put_io_state(struct exofs_io_state *ios)
         }
 }
 
+unsigned exofs_layout_od_id(struct exofs_layout *layout,
+                            osd_id obj_no, unsigned layout_index)
+{
+/*      switch (layout->lay_func) {
+        case LAYOUT_MOVING_WINDOW:
+        {*/
+                unsigned dev_mod = obj_no;
+
+                return (layout_index + dev_mod * layout->mirrors_p1) %
+                                                              layout->s_numdevs;
+/*      }
+        case LAYOUT_FUNC_IMPLICT:
+                return layout->devs[layout_index];
+        }*/
+}
+
+static inline struct osd_dev *exofs_ios_od(struct exofs_io_state *ios,
+                                           unsigned layout_index)
+{
+        return ios->layout->s_ods[
+                exofs_layout_od_id(ios->layout, ios->obj.id, layout_index)];
+}
+
 static void _sync_done(struct exofs_io_state *ios, void *p)
 {
         struct completion *waiting = p;
@@ -168,6 +198,21 @@ static int exofs_io_execute(struct exofs_io_state *ios)
         return ret;
 }
 
+static void _clear_bio(struct bio *bio)
+{
+        struct bio_vec *bv;
+        unsigned i;
+
+        __bio_for_each_segment(bv, bio, i, 0) {
+                unsigned this_count = bv->bv_len;
+
+                if (likely(PAGE_SIZE == this_count))
+                        clear_highpage(bv->bv_page);
+                else
+                        zero_user(bv->bv_page, bv->bv_offset, this_count);
+        }
+}
+
 int exofs_check_io(struct exofs_io_state *ios, u64 *resid)
 {
         enum osd_err_priority acumulated_osd_err = 0;
@@ -176,16 +221,25 @@ int exofs_check_io(struct exofs_io_state *ios, u64 *resid)
 
         for (i = 0; i < ios->numdevs; i++) {
                 struct osd_sense_info osi;
-                int ret = osd_req_decode_sense(ios->per_dev[i].or, &osi);
+                struct osd_request *or = ios->per_dev[i].or;
+                int ret;
+
+                if (unlikely(!or))
+                        continue;
 
+                ret = osd_req_decode_sense(or, &osi);
                 if (likely(!ret))
                         continue;
 
-                if (unlikely(ret == -EFAULT)) {
-                        EXOFS_DBGMSG("%s: EFAULT Need page clear\n", __func__);
-                        /*FIXME: All the pages in this device range should:
-                         *      clear_highpage(page);
-                         */
+                if (OSD_ERR_PRI_CLEAR_PAGES == osi.osd_err_pri) {
+                        /* start read offset passed endof file */
+                        _clear_bio(ios->per_dev[i].bio);
+                        EXOFS_DBGMSG("start read offset passed end of file "
+                                "offset=0x%llx, length=0x%llx\n",
+                                _LLU(ios->per_dev[i].offset),
+                                _LLU(ios->per_dev[i].length));
+
+                        continue; /* we recovered */
                 }
 
                 if (osi.osd_err_pri >= acumulated_osd_err) {
@@ -205,14 +259,259 @@ int exofs_check_io(struct exofs_io_state *ios, u64 *resid)
         return acumulated_lin_err;
 }
 
+/*
+ * L - logical offset into the file
+ *
+ * U - The number of bytes in a stripe within a group
+ *
+ *      U = stripe_unit * group_width
+ *
+ * T - The number of bytes striped within a group of component objects
+ *     (before advancing to the next group)
+ *
+ *      T = stripe_unit * group_width * group_depth
+ *
+ * S - The number of bytes striped across all component objects
+ *     before the pattern repeats
+ *
+ *      S = stripe_unit * group_width * group_depth * group_count
+ *
+ * M - The "major" (i.e., across all components) stripe number
+ *
+ *      M = L / S
+ *
+ * G - Counts the groups from the beginning of the major stripe
+ *
+ *      G = (L - (M * S)) / T   [or (L % S) / T]
+ *
+ * H - The byte offset within the group
+ *
+ *      H = (L - (M * S)) % T   [or (L % S) % T]
+ *
+ * N - The "minor" (i.e., across the group) stripe number
+ *
+ *      N = H / U
+ *
+ * C - The component index coresponding to L
+ *
+ *      C = (H - (N * U)) / stripe_unit + G * group_width
+ *      [or (L % U) / stripe_unit + G * group_width]
+ *
+ * O - The component offset coresponding to L
+ *
+ *      O = L % stripe_unit + N * stripe_unit + M * group_depth * stripe_unit
+ */
+struct _striping_info {
+        u64 obj_offset;
+        u64 group_length;
+        u64 total_group_length;
+        u64 Major;
+        unsigned dev;
+        unsigned unit_off;
+};
+
+static void _calc_stripe_info(struct exofs_io_state *ios, u64 file_offset,
+                              struct _striping_info *si)
+{
+        u32     stripe_unit = ios->layout->stripe_unit;
+        u32     group_width = ios->layout->group_width;
+        u64     group_depth = ios->layout->group_depth;
+
+        u32     U = stripe_unit * group_width;
+        u64     T = U * group_depth;
+        u64     S = T * ios->layout->group_count;
+        u64     M = div64_u64(file_offset, S);
+
+        /*
+        G = (L - (M * S)) / T
+        H = (L - (M * S)) % T
+        */
+        u64     LmodS = file_offset - M * S;
+        u32     G = div64_u64(LmodS, T);
+        u64     H = LmodS - G * T;
+
+        u32     N = div_u64(H, U);
+
+        /* "H - (N * U)" is just "H % U" so it's bound to u32 */
+        si->dev = (u32)(H - (N * U)) / stripe_unit + G * group_width;
+        si->dev *= ios->layout->mirrors_p1;
+
+        div_u64_rem(file_offset, stripe_unit, &si->unit_off);
+
+        si->obj_offset = si->unit_off + (N * stripe_unit) +
+                                  (M * group_depth * stripe_unit);
+
+        si->group_length = T - H;
+        si->total_group_length = T;
+        si->Major = M;
+}
+
+static int _add_stripe_unit(struct exofs_io_state *ios,  unsigned *cur_pg,
+                unsigned pgbase, struct exofs_per_dev_state *per_dev,
+                int cur_len)
+{
+        unsigned pg = *cur_pg;
+        struct request_queue *q =
+                        osd_request_queue(exofs_ios_od(ios, per_dev->dev));
+
+        per_dev->length += cur_len;
+
+        if (per_dev->bio == NULL) {
+                unsigned pages_in_stripe = ios->layout->group_width *
+                                        (ios->layout->stripe_unit / PAGE_SIZE);
+                unsigned bio_size = (ios->nr_pages + pages_in_stripe) /
+                                                ios->layout->group_width;
+
+                per_dev->bio = bio_kmalloc(GFP_KERNEL, bio_size);
+                if (unlikely(!per_dev->bio)) {
+                        EXOFS_DBGMSG("Faild to allocate BIO size=%u\n",
+                                     bio_size);
+                        return -ENOMEM;
+                }
+        }
+
+        while (cur_len > 0) {
+                unsigned pglen = min_t(unsigned, PAGE_SIZE - pgbase, cur_len);
+                unsigned added_len;
+
+                BUG_ON(ios->nr_pages <= pg);
+                cur_len -= pglen;
+
+                added_len = bio_add_pc_page(q, per_dev->bio, ios->pages[pg],
+                                            pglen, pgbase);
+                if (unlikely(pglen != added_len))
+                        return -ENOMEM;
+                pgbase = 0;
+                ++pg;
+        }
+        BUG_ON(cur_len);
+
+        *cur_pg = pg;
+        return 0;
+}
+
+static int _prepare_one_group(struct exofs_io_state *ios, u64 length,
+                              struct _striping_info *si, unsigned first_comp)
+{
+        unsigned stripe_unit = ios->layout->stripe_unit;
+        unsigned mirrors_p1 = ios->layout->mirrors_p1;
+        unsigned devs_in_group = ios->layout->group_width * mirrors_p1;
+        unsigned dev = si->dev;
+        unsigned first_dev = dev - (dev % devs_in_group);
+        unsigned comp = first_comp + (dev - first_dev);
+        unsigned max_comp = ios->numdevs ? ios->numdevs - mirrors_p1 : 0;
+        unsigned cur_pg = ios->pages_consumed;
+        int ret = 0;
+
+        while (length) {
+                struct exofs_per_dev_state *per_dev = &ios->per_dev[comp];
+                unsigned cur_len, page_off = 0;
+
+                if (!per_dev->length) {
+                        per_dev->dev = dev;
+                        if (dev < si->dev) {
+                                per_dev->offset = si->obj_offset + stripe_unit -
+                                                                   si->unit_off;
+                                cur_len = stripe_unit;
+                        } else if (dev == si->dev) {
+                                per_dev->offset = si->obj_offset;
+                                cur_len = stripe_unit - si->unit_off;
+                                page_off = si->unit_off & ~PAGE_MASK;
+                                BUG_ON(page_off && (page_off != ios->pgbase));
+                        } else { /* dev > si->dev */
+                                per_dev->offset = si->obj_offset - si->unit_off;
+                                cur_len = stripe_unit;
+                        }
+
+                        if (max_comp < comp)
+                                max_comp = comp;
+
+                        dev += mirrors_p1;
+                        dev = (dev % devs_in_group) + first_dev;
+                } else {
+                        cur_len = stripe_unit;
+                }
+                if (cur_len >= length)
+                        cur_len = length;
+
+                ret = _add_stripe_unit(ios, &cur_pg, page_off , per_dev,
+                                       cur_len);
+                if (unlikely(ret))
+                        goto out;
+
+                comp += mirrors_p1;
+                comp = (comp % devs_in_group) + first_comp;
+
+                length -= cur_len;
+        }
+out:
+        ios->numdevs = max_comp + mirrors_p1;
+        ios->pages_consumed = cur_pg;
+        return ret;
+}
+
+static int _prepare_for_striping(struct exofs_io_state *ios)
+{
+        u64 length = ios->length;
+        struct _striping_info si;
+        unsigned devs_in_group = ios->layout->group_width *
+                                 ios->layout->mirrors_p1;
+        unsigned first_comp = 0;
+        int ret = 0;
+
+        _calc_stripe_info(ios, ios->offset, &si);
+
+        if (!ios->pages) {
+                if (ios->kern_buff) {
+                        struct exofs_per_dev_state *per_dev = &ios->per_dev[0];
+
+                        per_dev->offset = si.obj_offset;
+                        per_dev->dev = si.dev;
+
+                        /* no cross device without page array */
+                        BUG_ON((ios->layout->group_width > 1) &&
+                               (si.unit_off + ios->length >
+                                ios->layout->stripe_unit));
+                }
+                ios->numdevs = ios->layout->mirrors_p1;
+                return 0;
+        }
+
+        while (length) {
+                if (length < si.group_length)
+                        si.group_length = length;
+
+                ret = _prepare_one_group(ios, si.group_length, &si, first_comp);
+                if (unlikely(ret))
+                        goto out;
+
+                length -= si.group_length;
+
+                si.group_length = si.total_group_length;
+                si.unit_off = 0;
+                ++si.Major;
+                si.obj_offset = si.Major * ios->layout->stripe_unit *
+                                                ios->layout->group_depth;
+
+                si.dev = (si.dev - (si.dev % devs_in_group)) + devs_in_group;
+                si.dev %= ios->layout->s_numdevs;
+
+                first_comp += devs_in_group;
+                first_comp %= ios->layout->s_numdevs;
+        }
+
+out:
+        return ret;
+}
+
 int exofs_sbi_create(struct exofs_io_state *ios)
 {
         int i, ret;
 
-        for (i = 0; i < ios->sbi->s_numdevs; i++) {
+        for (i = 0; i < ios->layout->s_numdevs; i++) {
                 struct osd_request *or;
 
-                or = osd_start_request(ios->sbi->s_ods[i], GFP_KERNEL);
+                or = osd_start_request(exofs_ios_od(ios, i), GFP_KERNEL);
                 if (unlikely(!or)) {
                         EXOFS_ERR("%s: osd_start_request failed\n", __func__);
                         ret = -ENOMEM;
@@ -233,10 +532,10 @@ int exofs_sbi_remove(struct exofs_io_state *ios)
 {
         int i, ret;
 
-        for (i = 0; i < ios->sbi->s_numdevs; i++) {
+        for (i = 0; i < ios->layout->s_numdevs; i++) {
                 struct osd_request *or;
 
-                or = osd_start_request(ios->sbi->s_ods[i], GFP_KERNEL);
+                or = osd_start_request(exofs_ios_od(ios, i), GFP_KERNEL);
                 if (unlikely(!or)) {
                         EXOFS_ERR("%s: osd_start_request failed\n", __func__);
                         ret = -ENOMEM;
@@ -253,51 +552,74 @@ out:
         return ret;
 }
 
-int exofs_sbi_write(struct exofs_io_state *ios)
+static int _sbi_write_mirror(struct exofs_io_state *ios, int cur_comp)
 {
-        int i, ret;
+        struct exofs_per_dev_state *master_dev = &ios->per_dev[cur_comp];
+        unsigned dev = ios->per_dev[cur_comp].dev;
+        unsigned last_comp = cur_comp + ios->layout->mirrors_p1;
+        int ret = 0;
 
-        for (i = 0; i < ios->sbi->s_numdevs; i++) {
+        if (ios->pages && !master_dev->length)
+                return 0; /* Just an empty slot */
+
+        for (; cur_comp < last_comp; ++cur_comp, ++dev) {
+                struct exofs_per_dev_state *per_dev = &ios->per_dev[cur_comp];
                 struct osd_request *or;
 
-                or = osd_start_request(ios->sbi->s_ods[i], GFP_KERNEL);
+                or = osd_start_request(exofs_ios_od(ios, dev), GFP_KERNEL);
                 if (unlikely(!or)) {
                         EXOFS_ERR("%s: osd_start_request failed\n", __func__);
                         ret = -ENOMEM;
                         goto out;
                 }
-                ios->per_dev[i].or = or;
-                ios->numdevs++;
+                per_dev->or = or;
+                per_dev->offset = master_dev->offset;
 
-                if (ios->bio) {
+                if (ios->pages) {
                         struct bio *bio;
 
-                        if (i != 0) {
+                        if (per_dev != master_dev) {
                                 bio = bio_kmalloc(GFP_KERNEL,
-                                                  ios->bio->bi_max_vecs);
+                                                  master_dev->bio->bi_max_vecs);
                                 if (unlikely(!bio)) {
+                                        EXOFS_DBGMSG(
+                                              "Faild to allocate BIO size=%u\n",
+                                              master_dev->bio->bi_max_vecs);
                                         ret = -ENOMEM;
                                         goto out;
                                 }
 
-                                __bio_clone(bio, ios->bio);
+                                __bio_clone(bio, master_dev->bio);
                                 bio->bi_bdev = NULL;
                                 bio->bi_next = NULL;
-                                ios->per_dev[i].bio =  bio;
+                                per_dev->length = master_dev->length;
+                                per_dev->bio =  bio;
+                                per_dev->dev = dev;
                         } else {
-                                bio = ios->bio;
+                                bio = master_dev->bio;
+                                /* FIXME: bio_set_dir() */
+                                bio->bi_rw |= (1 << BIO_RW);
                         }
 
-                        osd_req_write(or, &ios->obj, ios->offset, bio,
-                                      ios->length);
-/*                      EXOFS_DBGMSG("write sync=%d\n", sync);*/
+                        osd_req_write(or, &ios->obj, per_dev->offset, bio,
+                                      per_dev->length);
+                        EXOFS_DBGMSG("write(0x%llx) offset=0x%llx "
+                                      "length=0x%llx dev=%d\n",
+                                     _LLU(ios->obj.id), _LLU(per_dev->offset),
+                                     _LLU(per_dev->length), dev);
                 } else if (ios->kern_buff) {
-                        osd_req_write_kern(or, &ios->obj, ios->offset,
+                        ret = osd_req_write_kern(or, &ios->obj, per_dev->offset,
                                            ios->kern_buff, ios->length);
-/*                      EXOFS_DBGMSG("write_kern sync=%d\n", sync);*/
+                        if (unlikely(ret))
+                                goto out;
+                        EXOFS_DBGMSG2("write_kern(0x%llx) offset=0x%llx "
+                                      "length=0x%llx dev=%d\n",
+                                     _LLU(ios->obj.id), _LLU(per_dev->offset),
+                                     _LLU(ios->length), dev);
                 } else {
                         osd_req_set_attributes(or, &ios->obj);
-/*                      EXOFS_DBGMSG("set_attributes sync=%d\n", sync);*/
+                        EXOFS_DBGMSG2("obj(0x%llx) set_attributes=%d dev=%d\n",
+                                     _LLU(ios->obj.id), ios->out_attr_len, dev);
                 }
 
                 if (ios->out_attr)
@@ -308,54 +630,93 @@ int exofs_sbi_write(struct exofs_io_state *ios)
                         osd_req_add_get_attr_list(or, ios->in_attr,
                                                   ios->in_attr_len);
         }
-        ret = exofs_io_execute(ios);
 
 out:
         return ret;
 }
 
-int exofs_sbi_read(struct exofs_io_state *ios)
+int exofs_sbi_write(struct exofs_io_state *ios)
 {
-        int i, ret;
+        int i;
+        int ret;
 
-        for (i = 0; i < 1; i++) {
-                struct osd_request *or;
-                unsigned first_dev = (unsigned)ios->obj.id;
+        ret = _prepare_for_striping(ios);
+        if (unlikely(ret))
+                return ret;
 
-                first_dev %= ios->sbi->s_numdevs;
-                or = osd_start_request(ios->sbi->s_ods[first_dev], GFP_KERNEL);
-                if (unlikely(!or)) {
-                        EXOFS_ERR("%s: osd_start_request failed\n", __func__);
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                ios->per_dev[i].or = or;
-                ios->numdevs++;
+        for (i = 0; i < ios->numdevs; i += ios->layout->mirrors_p1) {
+                ret = _sbi_write_mirror(ios, i);
+                if (unlikely(ret))
+                        return ret;
+        }
 
-                if (ios->bio) {
-                        osd_req_read(or, &ios->obj, ios->offset, ios->bio,
-                                     ios->length);
-/*                      EXOFS_DBGMSG("read sync=%d\n", sync);*/
-                } else if (ios->kern_buff) {
-                        osd_req_read_kern(or, &ios->obj, ios->offset,
-                                           ios->kern_buff, ios->length);
-/*                      EXOFS_DBGMSG("read_kern sync=%d\n", sync);*/
-                } else {
-                        osd_req_get_attributes(or, &ios->obj);
-/*                      EXOFS_DBGMSG("get_attributes sync=%d\n", sync);*/
-                }
+        ret = exofs_io_execute(ios);
+        return ret;
+}
 
-                if (ios->out_attr)
-                        osd_req_add_set_attr_list(or, ios->out_attr,
-                                                  ios->out_attr_len);
+static int _sbi_read_mirror(struct exofs_io_state *ios, unsigned cur_comp)
+{
+        struct osd_request *or;
+        struct exofs_per_dev_state *per_dev = &ios->per_dev[cur_comp];
+        unsigned first_dev = (unsigned)ios->obj.id;
 
-                if (ios->in_attr)
-                        osd_req_add_get_attr_list(or, ios->in_attr,
-                                                  ios->in_attr_len);
+        if (ios->pages && !per_dev->length)
+                return 0; /* Just an empty slot */
+
+        first_dev = per_dev->dev + first_dev % ios->layout->mirrors_p1;
+        or = osd_start_request(exofs_ios_od(ios, first_dev), GFP_KERNEL);
+        if (unlikely(!or)) {
+                EXOFS_ERR("%s: osd_start_request failed\n", __func__);
+                return -ENOMEM;
         }
-        ret = exofs_io_execute(ios);
+        per_dev->or = or;
+
+        if (ios->pages) {
+                osd_req_read(or, &ios->obj, per_dev->offset,
+                                per_dev->bio, per_dev->length);
+                EXOFS_DBGMSG("read(0x%llx) offset=0x%llx length=0x%llx"
+                             " dev=%d\n", _LLU(ios->obj.id),
+                             _LLU(per_dev->offset), _LLU(per_dev->length),
+                             first_dev);
+        } else if (ios->kern_buff) {
+                int ret = osd_req_read_kern(or, &ios->obj, per_dev->offset,
+                                            ios->kern_buff, ios->length);
+                EXOFS_DBGMSG2("read_kern(0x%llx) offset=0x%llx "
+                              "length=0x%llx dev=%d ret=>%d\n",
+                              _LLU(ios->obj.id), _LLU(per_dev->offset),
+                              _LLU(ios->length), first_dev, ret);
+                if (unlikely(ret))
+                        return ret;
+        } else {
+                osd_req_get_attributes(or, &ios->obj);
+                EXOFS_DBGMSG2("obj(0x%llx) get_attributes=%d dev=%d\n",
+                              _LLU(ios->obj.id), ios->in_attr_len, first_dev);
+        }
+        if (ios->out_attr)
+                osd_req_add_set_attr_list(or, ios->out_attr, ios->out_attr_len);
 
-out:
+        if (ios->in_attr)
+                osd_req_add_get_attr_list(or, ios->in_attr, ios->in_attr_len);
+
+        return 0;
+}
+
+int exofs_sbi_read(struct exofs_io_state *ios)
+{
+        int i;
+        int ret;
+
+        ret = _prepare_for_striping(ios);
+        if (unlikely(ret))
+                return ret;
+
+        for (i = 0; i < ios->numdevs; i += ios->layout->mirrors_p1) {
+                ret = _sbi_read_mirror(ios, i);
+                if (unlikely(ret))
+                        return ret;
+        }
+
+        ret = exofs_io_execute(ios);
         return ret;
 }
 
@@ -380,42 +741,82 @@ int extract_attr_from_ios(struct exofs_io_state *ios, struct osd_attr *attr)
         return -EIO;
 }
 
+static int _truncate_mirrors(struct exofs_io_state *ios, unsigned cur_comp,
+                             struct osd_attr *attr)
+{
+        int last_comp = cur_comp + ios->layout->mirrors_p1;
+
+        for (; cur_comp < last_comp; ++cur_comp) {
+                struct exofs_per_dev_state *per_dev = &ios->per_dev[cur_comp];
+                struct osd_request *or;
+
+                or = osd_start_request(exofs_ios_od(ios, cur_comp), GFP_KERNEL);
+                if (unlikely(!or)) {
+                        EXOFS_ERR("%s: osd_start_request failed\n", __func__);
+                        return -ENOMEM;
+                }
+                per_dev->or = or;
+
+                osd_req_set_attributes(or, &ios->obj);
+                osd_req_add_set_attr_list(or, attr, 1);
+        }
+
+        return 0;
+}
+
 int exofs_oi_truncate(struct exofs_i_info *oi, u64 size)
 {
         struct exofs_sb_info *sbi = oi->vfs_inode.i_sb->s_fs_info;
         struct exofs_io_state *ios;
-        struct osd_attr attr;
-        __be64 newsize;
+        struct exofs_trunc_attr {
+                struct osd_attr attr;
+                __be64 newsize;
+        } *size_attrs;
+        struct _striping_info si;
         int i, ret;
 
-        if (exofs_get_io_state(sbi, &ios))
-                return -ENOMEM;
+        ret = exofs_get_io_state(&sbi->layout, &ios);
+        if (unlikely(ret))
+                return ret;
+
+        size_attrs = kcalloc(ios->layout->group_width, sizeof(*size_attrs),
+                             GFP_KERNEL);
+        if (unlikely(!size_attrs)) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         ios->obj.id = exofs_oi_objno(oi);
         ios->cred = oi->i_cred;
 
-        newsize = cpu_to_be64(size);
-        attr = g_attr_logical_length;
-        attr.val_ptr = &newsize;
+        ios->numdevs = ios->layout->s_numdevs;
+        _calc_stripe_info(ios, size, &si);
 
-        for (i = 0; i < sbi->s_numdevs; i++) {
-                struct osd_request *or;
+        for (i = 0; i < ios->layout->group_width; ++i) {
+                struct exofs_trunc_attr *size_attr = &size_attrs[i];
+                u64 obj_size;
 
-                or = osd_start_request(sbi->s_ods[i], GFP_KERNEL);
-                if (unlikely(!or)) {
-                        EXOFS_ERR("%s: osd_start_request failed\n", __func__);
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                ios->per_dev[i].or = or;
-                ios->numdevs++;
+                if (i < si.dev)
+                        obj_size = si.obj_offset +
+                                        ios->layout->stripe_unit - si.unit_off;
+                else if (i == si.dev)
+                        obj_size = si.obj_offset;
+                else /* i > si.dev */
+                        obj_size = si.obj_offset - si.unit_off;
 
-                osd_req_set_attributes(or, &ios->obj);
-                osd_req_add_set_attr_list(or, &attr, 1);
+                size_attr->newsize = cpu_to_be64(obj_size);
+                size_attr->attr = g_attr_logical_length;
+                size_attr->attr.val_ptr = &size_attr->newsize;
+
+                ret = _truncate_mirrors(ios, i * ios->layout->mirrors_p1,
+                                        &size_attr->attr);
+                if (unlikely(ret))
+                        goto out;
         }
         ret = exofs_io_execute(ios);
 
 out:
+        kfree(size_attrs);
         exofs_put_io_state(ios);
         return ret;
 }
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index a1d1e77b12eb..6cf5e4e84d61 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -210,7 +210,7 @@ int exofs_sync_fs(struct super_block *sb, int wait)
         sbi = sb->s_fs_info;
         fscb = &sbi->s_fscb;
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (ret)
                 goto out;
 
@@ -264,12 +264,12 @@ static void _exofs_print_device(const char *msg, const char *dev_path,
 
 void exofs_free_sbi(struct exofs_sb_info *sbi)
 {
-        while (sbi->s_numdevs) {
-                int i = --sbi->s_numdevs;
-                struct osd_dev *od = sbi->s_ods[i];
+        while (sbi->layout.s_numdevs) {
+                int i = --sbi->layout.s_numdevs;
+                struct osd_dev *od = sbi->layout.s_ods[i];
 
                 if (od) {
-                        sbi->s_ods[i] = NULL;
+                        sbi->layout.s_ods[i] = NULL;
                         osduld_put_device(od);
                 }
         }
@@ -298,7 +298,8 @@ static void exofs_put_super(struct super_block *sb)
                                   msecs_to_jiffies(100));
         }
 
-        _exofs_print_device("Unmounting", NULL, sbi->s_ods[0], sbi->s_pid);
+        _exofs_print_device("Unmounting", NULL, sbi->layout.s_ods[0],
+                            sbi->layout.s_pid);
 
         exofs_free_sbi(sbi);
         sb->s_fs_info = NULL;
@@ -307,6 +308,8 @@ static void exofs_put_super(struct super_block *sb)
 static int _read_and_match_data_map(struct exofs_sb_info *sbi, unsigned numdevs,
                                     struct exofs_device_table *dt)
 {
+        u64 stripe_length;
+
         sbi->data_map.odm_num_comps   =
                                 le32_to_cpu(dt->dt_data_map.cb_num_comps);
         sbi->data_map.odm_stripe_unit =
@@ -320,14 +323,63 @@ static int _read_and_match_data_map(struct exofs_sb_info *sbi, unsigned numdevs,
         sbi->data_map.odm_raid_algorithm  =
                                 le32_to_cpu(dt->dt_data_map.cb_raid_algorithm);
 
-/* FIXME: Hard coded mirror only for now. if not so do not mount */
-        if ((sbi->data_map.odm_num_comps != numdevs) ||
-            (sbi->data_map.odm_stripe_unit != EXOFS_BLKSIZE) ||
-            (sbi->data_map.odm_raid_algorithm != PNFS_OSD_RAID_0) ||
-            (sbi->data_map.odm_mirror_cnt != (numdevs - 1)))
+/* FIXME: Only raid0 for now. if not so, do not mount */
+        if (sbi->data_map.odm_num_comps != numdevs) {
+                EXOFS_ERR("odm_num_comps(%u) != numdevs(%u)\n",
+                          sbi->data_map.odm_num_comps, numdevs);
                 return -EINVAL;
-        else
-                return 0;
+        }
+        if (sbi->data_map.odm_raid_algorithm != PNFS_OSD_RAID_0) {
+                EXOFS_ERR("Only RAID_0 for now\n");
+                return -EINVAL;
+        }
+        if (0 != (numdevs % (sbi->data_map.odm_mirror_cnt + 1))) {
+                EXOFS_ERR("Data Map wrong, numdevs=%d mirrors=%d\n",
+                          numdevs, sbi->data_map.odm_mirror_cnt);
+                return -EINVAL;
+        }
+
+        if (0 != (sbi->data_map.odm_stripe_unit & ~PAGE_MASK)) {
+                EXOFS_ERR("Stripe Unit(0x%llx)"
+                          " must be Multples of PAGE_SIZE(0x%lx)\n",
+                          _LLU(sbi->data_map.odm_stripe_unit), PAGE_SIZE);
+                return -EINVAL;
+        }
+
+        sbi->layout.stripe_unit = sbi->data_map.odm_stripe_unit;
+        sbi->layout.mirrors_p1 = sbi->data_map.odm_mirror_cnt + 1;
+
+        if (sbi->data_map.odm_group_width) {
+                sbi->layout.group_width = sbi->data_map.odm_group_width;
+                sbi->layout.group_depth = sbi->data_map.odm_group_depth;
+                if (!sbi->layout.group_depth) {
+                        EXOFS_ERR("group_depth == 0 && group_width != 0\n");
+                        return -EINVAL;
+                }
+                sbi->layout.group_count = sbi->data_map.odm_num_comps /
+                                                sbi->layout.mirrors_p1 /
+                                                sbi->data_map.odm_group_width;
+        } else {
+                if (sbi->data_map.odm_group_depth) {
+                        printk(KERN_NOTICE "Warning: group_depth ignored "
+                                "group_width == 0 && group_depth == %d\n",
+                                sbi->data_map.odm_group_depth);
+                        sbi->data_map.odm_group_depth = 0;
+                }
+                sbi->layout.group_width = sbi->data_map.odm_num_comps /
+                                                        sbi->layout.mirrors_p1;
+                sbi->layout.group_depth = -1;
+                sbi->layout.group_count = 1;
+        }
+
+        stripe_length = (u64)sbi->layout.group_width * sbi->layout.stripe_unit;
+        if (stripe_length >= (1ULL << 32)) {
+                EXOFS_ERR("Total Stripe length(0x%llx)"
+                          " >= 32bit is not supported\n", _LLU(stripe_length));
+                return -EINVAL;
+        }
+
+        return 0;
 }
 
 /* @odi is valid only as long as @fscb_dev is valid */
@@ -361,7 +413,7 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
 {
         struct exofs_sb_info *sbi = *psbi;
         struct osd_dev *fscb_od;
-        struct osd_obj_id obj = {.partition = sbi->s_pid,
+        struct osd_obj_id obj = {.partition = sbi->layout.s_pid,
                                  .id = EXOFS_DEVTABLE_ID};
         struct exofs_device_table *dt;
         unsigned table_bytes = table_count * sizeof(dt->dt_dev_table[0]) +
@@ -376,9 +428,9 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                 return -ENOMEM;
         }
 
-        fscb_od = sbi->s_ods[0];
-        sbi->s_ods[0] = NULL;
-        sbi->s_numdevs = 0;
+        fscb_od = sbi->layout.s_ods[0];
+        sbi->layout.s_ods[0] = NULL;
+        sbi->layout.s_numdevs = 0;
         ret = exofs_read_kern(fscb_od, sbi->s_cred, &obj, 0, dt, table_bytes);
         if (unlikely(ret)) {
                 EXOFS_ERR("ERROR: reading device table\n");
@@ -397,14 +449,15 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                 goto out;
 
         if (likely(numdevs > 1)) {
-                unsigned size = numdevs * sizeof(sbi->s_ods[0]);
+                unsigned size = numdevs * sizeof(sbi->layout.s_ods[0]);
 
                 sbi = krealloc(sbi, sizeof(*sbi) + size, GFP_KERNEL);
                 if (unlikely(!sbi)) {
                         ret = -ENOMEM;
                         goto out;
                 }
-                memset(&sbi->s_ods[1], 0, size - sizeof(sbi->s_ods[0]));
+                memset(&sbi->layout.s_ods[1], 0,
+                       size - sizeof(sbi->layout.s_ods[0]));
                 *psbi = sbi;
         }
 
@@ -427,8 +480,8 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                  * line. We always keep them in device-table order.
                  */
                 if (fscb_od && osduld_device_same(fscb_od, &odi)) {
-                        sbi->s_ods[i] = fscb_od;
-                        ++sbi->s_numdevs;
+                        sbi->layout.s_ods[i] = fscb_od;
+                        ++sbi->layout.s_numdevs;
                         fscb_od = NULL;
                         continue;
                 }
@@ -441,8 +494,8 @@ static int exofs_read_lookup_dev_table(struct exofs_sb_info **psbi,
                         goto out;
                 }
 
-                sbi->s_ods[i] = od;
-                ++sbi->s_numdevs;
+                sbi->layout.s_ods[i] = od;
+                ++sbi->layout.s_numdevs;
 
                 /* Read the fscb of the other devices to make sure the FS
                  * partition is there.
@@ -499,9 +552,15 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
                 goto free_sbi;
         }
 
-        sbi->s_ods[0] = od;
-        sbi->s_numdevs = 1;
-        sbi->s_pid = opts->pid;
+        /* Default layout in case we do not have a device-table */
+        sbi->layout.stripe_unit = PAGE_SIZE;
+        sbi->layout.mirrors_p1 = 1;
+        sbi->layout.group_width = 1;
+        sbi->layout.group_depth = -1;
+        sbi->layout.group_count = 1;
+        sbi->layout.s_ods[0] = od;
+        sbi->layout.s_numdevs = 1;
+        sbi->layout.s_pid = opts->pid;
         sbi->s_timeout = opts->timeout;
 
         /* fill in some other data by hand */
@@ -514,7 +573,7 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_bdev = NULL;
         sb->s_dev = 0;
 
-        obj.partition = sbi->s_pid;
+        obj.partition = sbi->layout.s_pid;
         obj.id = EXOFS_SUPER_ID;
         exofs_make_credential(sbi->s_cred, &obj);
 
@@ -578,13 +637,13 @@ static int exofs_fill_super(struct super_block *sb, void *data, int silent)
                 goto free_sbi;
         }
 
-        _exofs_print_device("Mounting", opts->dev_name, sbi->s_ods[0],
-                            sbi->s_pid);
+        _exofs_print_device("Mounting", opts->dev_name, sbi->layout.s_ods[0],
+                            sbi->layout.s_pid);
         return 0;
 
 free_sbi:
         EXOFS_ERR("Unable to mount exofs on %s pid=0x%llx err=%d\n",
-                  opts->dev_name, sbi->s_pid, ret);
+                  opts->dev_name, sbi->layout.s_pid, ret);
         exofs_free_sbi(sbi);
         return ret;
 }
@@ -627,7 +686,7 @@ static int exofs_statfs(struct dentry *dentry, struct kstatfs *buf)
         uint8_t cred_a[OSD_CAP_LEN];
         int ret;
 
-        ret = exofs_get_io_state(sbi, &ios);
+        ret = exofs_get_io_state(&sbi->layout, &ios);
         if (ret) {
                 EXOFS_DBGMSG("exofs_get_io_state failed.\n");
                 return ret;
diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
index 061914add3cf..0b038e47ad2f 100644
--- a/fs/ext2/ext2.h
+++ b/fs/ext2/ext2.h
@@ -118,7 +118,7 @@ extern unsigned long ext2_count_free (struct buffer_head *, unsigned);
 
 /* inode.c */
 extern struct inode *ext2_iget (struct super_block *, unsigned long);
-extern int ext2_write_inode (struct inode *, int);
+extern int ext2_write_inode (struct inode *, struct writeback_control *);
 extern void ext2_delete_inode (struct inode *);
 extern int ext2_sync_inode (struct inode *);
 extern int ext2_get_block(struct inode *, sector_t, struct buffer_head *, int);
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index 71b032c65a02..36ae1cac767c 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -41,6 +41,8 @@ MODULE_AUTHOR("Remy Card and others");
 MODULE_DESCRIPTION("Second Extended Filesystem");
 MODULE_LICENSE("GPL");
 
+static int __ext2_write_inode(struct inode *inode, int do_sync);
+
 /*
  * Test whether an inode is a fast symlink.
  */
@@ -64,7 +66,7 @@ void ext2_delete_inode (struct inode * inode)
                 goto no_delete;
         EXT2_I(inode)->i_dtime  = get_seconds();
         mark_inode_dirty(inode);
-        ext2_write_inode(inode, inode_needs_sync(inode));
+        __ext2_write_inode(inode, inode_needs_sync(inode));
 
         inode->i_size = 0;
         if (inode->i_blocks)
@@ -1335,7 +1337,7 @@ bad_inode:
         return ERR_PTR(ret);
 }
 
-int ext2_write_inode(struct inode *inode, int do_sync)
+static int __ext2_write_inode(struct inode *inode, int do_sync)
 {
         struct ext2_inode_info *ei = EXT2_I(inode);
         struct super_block *sb = inode->i_sb;
@@ -1440,6 +1442,11 @@ int ext2_write_inode(struct inode *inode, int do_sync)
         return err;
 }
 
+int ext2_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __ext2_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int ext2_sync_inode(struct inode *inode)
 {
         struct writeback_control wbc = {
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 455e6e6e5cb9..7aca55fcc976 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -3096,7 +3096,7 @@ out_brelse:
  * `stuff()' is running, and the new i_size will be lost.  Plus the inode
  * will no longer be on the superblock's dirty inode list.
  */
-int ext3_write_inode(struct inode *inode, int wait)
+int ext3_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         if (current->flags & PF_MEMALLOC)
                 return 0;
@@ -3107,7 +3107,7 @@ int ext3_write_inode(struct inode *inode, int wait)
                 return -EIO;
         }
 
-        if (!wait)
+        if (wbc->sync_mode != WB_SYNC_ALL)
                 return 0;
 
         return ext3_force_commit(inode->i_sb);
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 22bc7435d913..d2f37a5516c7 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -97,8 +97,8 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                 /* If checksum is bad mark all blocks used to prevent allocation
                  * essentially implementing a per-group read-only flag. */
                 if (!ext4_group_desc_csum_verify(sbi, block_group, gdp)) {
-                        ext4_error(sb, __func__,
-                                  "Checksum bad for group %u", block_group);
+                        ext4_error(sb, "Checksum bad for group %u",
+                                        block_group);
                         ext4_free_blks_set(sb, gdp, 0);
                         ext4_free_inodes_set(sb, gdp, 0);
                         ext4_itable_unused_set(sb, gdp, 0);
@@ -130,8 +130,7 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
                  * to make sure we calculate the right free blocks
                  */
                 group_blocks = ext4_blocks_count(sbi->s_es) -
-                        le32_to_cpu(sbi->s_es->s_first_data_block) -
-                        (EXT4_BLOCKS_PER_GROUP(sb) * (ngroups - 1));
+                        ext4_group_first_block_no(sb, ngroups - 1);
         } else {
                 group_blocks = EXT4_BLOCKS_PER_GROUP(sb);
         }
@@ -189,9 +188,6 @@ unsigned ext4_init_block_bitmap(struct super_block *sb, struct buffer_head *bh,
  * when a file system is mounted (see ext4_fill_super).
  */
 
-
-#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
-
 /**
  * ext4_get_group_desc() -- load group descriptor from disk
  * @sb:                 super block
@@ -210,10 +206,8 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
         struct ext4_sb_info *sbi = EXT4_SB(sb);
 
         if (block_group >= ngroups) {
-                ext4_error(sb, "ext4_get_group_desc",
-                           "block_group >= groups_count - "
-                           "block_group = %u, groups_count = %u",
-                           block_group, ngroups);
+                ext4_error(sb, "block_group >= groups_count - block_group = %u,"
+                           " groups_count = %u", block_group, ngroups);
 
                 return NULL;
         }
@@ -221,8 +215,7 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
         group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
         offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
         if (!sbi->s_group_desc[group_desc]) {
-                ext4_error(sb, "ext4_get_group_desc",
-                           "Group descriptor not loaded - "
+                ext4_error(sb, "Group descriptor not loaded - "
                            "block_group = %u, group_desc = %u, desc = %u",
                            block_group, group_desc, offset);
                 return NULL;
@@ -282,9 +275,7 @@ static int ext4_valid_block_bitmap(struct super_block *sb,
                 return 1;
 
 err_out:
-        ext4_error(sb, __func__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %llu",
+        ext4_error(sb, "Invalid block bitmap - block_group = %d, block = %llu",
                         block_group, bitmap_blk);
         return 0;
 }
@@ -311,8 +302,7 @@ ext4_read_block_bitmap(struct super_block *sb, ext4_group_t block_group)
         bitmap_blk = ext4_block_bitmap(sb, desc);
         bh = sb_getblk(sb, bitmap_blk);
         if (unlikely(!bh)) {
-                ext4_error(sb, __func__,
-                            "Cannot read block bitmap - "
+                ext4_error(sb, "Cannot read block bitmap - "
                             "block_group = %u, block_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -354,8 +344,7 @@ ext4_read_block_bitmap(struct super_block *sb, ext4_group_t block_group)
         set_bitmap_uptodate(bh);
         if (bh_submit_read(bh) < 0) {
                 put_bh(bh);
-                ext4_error(sb, __func__,
-                            "Cannot read block bitmap - "
+                ext4_error(sb, "Cannot read block bitmap - "
                             "block_group = %u, block_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -419,8 +408,7 @@ void ext4_add_groupblocks(handle_t *handle, struct super_block *sb,
             in_range(block, ext4_inode_table(sb, desc), sbi->s_itb_per_group) ||
             in_range(block + count - 1, ext4_inode_table(sb, desc),
                      sbi->s_itb_per_group)) {
-                ext4_error(sb, __func__,
-                           "Adding blocks in system zones - "
+                ext4_error(sb, "Adding blocks in system zones - "
                            "Block = %llu, count = %lu",
                            block, count);
                 goto error_return;
@@ -453,8 +441,7 @@ void ext4_add_groupblocks(handle_t *handle, struct super_block *sb,
                 BUFFER_TRACE(bitmap_bh, "clear bit");
                 if (!ext4_clear_bit_atomic(ext4_group_lock_ptr(sb, block_group),
                                                 bit + i, bitmap_bh->b_data)) {
-                        ext4_error(sb, __func__,
-                                   "bit already cleared for block %llu",
+                        ext4_error(sb, "bit already cleared for block %llu",
                                    (ext4_fsblk_t)(block + i));
                         BUFFER_TRACE(bitmap_bh, "bit already cleared");
                 } else {
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index a60ab9aad57d..983f0e127493 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -205,14 +205,14 @@ void ext4_release_system_zone(struct super_block *sb)
                 entry = rb_entry(n, struct ext4_system_zone, node);
                 kmem_cache_free(ext4_system_zone_cachep, entry);
                 if (!parent)
-                        EXT4_SB(sb)->system_blks.rb_node = NULL;
+                        EXT4_SB(sb)->system_blks = RB_ROOT;
                 else if (parent->rb_left == n)
                         parent->rb_left = NULL;
                 else if (parent->rb_right == n)
                         parent->rb_right = NULL;
                 n = parent;
         }
-        EXT4_SB(sb)->system_blks.rb_node = NULL;
+        EXT4_SB(sb)->system_blks = RB_ROOT;
 }
 
 /*
diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
index 9dc93168e262..86cb6d86a048 100644
--- a/fs/ext4/dir.c
+++ b/fs/ext4/dir.c
@@ -83,10 +83,12 @@ int ext4_check_dir_entry(const char *function, struct inode *dir,
                 error_msg = "inode out of bounds";
 
         if (error_msg != NULL)
-                ext4_error(dir->i_sb, function,
-                        "bad entry in directory #%lu: %s - "
-                        "offset=%u, inode=%u, rec_len=%d, name_len=%d",
-                        dir->i_ino, error_msg, offset,
+                __ext4_error(dir->i_sb, function,
+                        "bad entry in directory #%lu: %s - block=%llu"
+                        "offset=%u(%u), inode=%u, rec_len=%d, name_len=%d",
+                        dir->i_ino, error_msg, 
+                        (unsigned long long) bh->b_blocknr,     
+                        (unsigned) (offset%bh->b_size), offset,
                         le32_to_cpu(de->inode),
                         rlen, de->name_len);
         return error_msg == NULL ? 1 : 0;
@@ -150,7 +152,7 @@ static int ext4_readdir(struct file *filp,
                  */
                 if (!bh) {
                         if (!dir_has_error) {
-                                ext4_error(sb, __func__, "directory #%lu "
+                                ext4_error(sb, "directory #%lu "
                                            "contains a hole at offset %Lu",
                                            inode->i_ino,
                                            (unsigned long long) filp->f_pos);
@@ -303,7 +305,7 @@ static void free_rb_tree_fname(struct rb_root *root)
                         kfree(old);
                 }
                 if (!parent)
-                        root->rb_node = NULL;
+                        *root = RB_ROOT;
                 else if (parent->rb_left == n)
                         parent->rb_left = NULL;
                 else if (parent->rb_right == n)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 874d169a193e..bf938cf7c5f0 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -53,6 +53,12 @@
 #define ext4_debug(f, a...)     do {} while (0)
 #endif
 
+#define EXT4_ERROR_INODE(inode, fmt, a...) \
+        ext4_error_inode(__func__, (inode), (fmt), ## a);
+
+#define EXT4_ERROR_FILE(file, fmt, a...)        \
+        ext4_error_file(__func__, (file), (fmt), ## a);
+
 /* data type for block offset of block group */
 typedef int ext4_grpblk_t;
 
@@ -133,14 +139,14 @@ struct mpage_da_data {
         int pages_written;
         int retval;
 };
-#define DIO_AIO_UNWRITTEN       0x1
+#define EXT4_IO_UNWRITTEN       0x1
 typedef struct ext4_io_end {
         struct list_head        list;           /* per-file finished AIO list */
         struct inode            *inode;         /* file being written to */
         unsigned int            flag;           /* unwritten or not */
-        int                     error;          /* I/O error code */
-        ext4_lblk_t             offset;         /* offset in the file */
-        size_t                  size;           /* size of the extent */
+        struct page             *page;          /* page struct for buffer write */
+        loff_t                  offset;         /* offset in the file */
+        ssize_t                 size;           /* size of the extent */
         struct work_struct      work;           /* data work queue */
 } ext4_io_end_t;
 
@@ -284,10 +290,12 @@ struct flex_groups {
 #define EXT4_TOPDIR_FL                  0x00020000 /* Top of directory hierarchies*/
 #define EXT4_HUGE_FILE_FL               0x00040000 /* Set to each huge file */
 #define EXT4_EXTENTS_FL                 0x00080000 /* Inode uses extents */
+#define EXT4_EA_INODE_FL                0x00200000 /* Inode used for large EA */
+#define EXT4_EOFBLOCKS_FL               0x00400000 /* Blocks allocated beyond EOF */
 #define EXT4_RESERVED_FL                0x80000000 /* reserved for ext4 lib */
 
-#define EXT4_FL_USER_VISIBLE            0x000BDFFF /* User visible flags */
-#define EXT4_FL_USER_MODIFIABLE         0x000B80FF /* User modifiable flags */
+#define EXT4_FL_USER_VISIBLE            0x004BDFFF /* User visible flags */
+#define EXT4_FL_USER_MODIFIABLE         0x004B80FF /* User modifiable flags */
 
 /* Flags that should be inherited by new inodes from their parent. */
 #define EXT4_FL_INHERITED (EXT4_SECRM_FL | EXT4_UNRM_FL | EXT4_COMPR_FL |\
@@ -313,17 +321,6 @@ static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags)
                 return flags & EXT4_OTHER_FLMASK;
 }
 
-/*
- * Inode dynamic state flags
- */
-#define EXT4_STATE_JDATA                0x00000001 /* journaled data exists */
-#define EXT4_STATE_NEW                  0x00000002 /* inode is newly created */
-#define EXT4_STATE_XATTR                0x00000004 /* has in-inode xattrs */
-#define EXT4_STATE_NO_EXPAND            0x00000008 /* No space for expansion */
-#define EXT4_STATE_DA_ALLOC_CLOSE       0x00000010 /* Alloc DA blks on close */
-#define EXT4_STATE_EXT_MIGRATE          0x00000020 /* Inode is migrating */
-#define EXT4_STATE_DIO_UNWRITTEN        0x00000040 /* need convert on dio done*/
-
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
         __u32 group;            /* Group number for this data */
@@ -364,19 +361,20 @@ struct ext4_new_group_data {
         /* caller is from the direct IO path, request to creation of an
         unitialized extents if not allocated, split the uninitialized
         extent if blocks has been preallocated already*/
-#define EXT4_GET_BLOCKS_DIO                     0x0008
+#define EXT4_GET_BLOCKS_PRE_IO                  0x0008
 #define EXT4_GET_BLOCKS_CONVERT                 0x0010
-#define EXT4_GET_BLOCKS_DIO_CREATE_EXT          (EXT4_GET_BLOCKS_DIO|\
+#define EXT4_GET_BLOCKS_IO_CREATE_EXT           (EXT4_GET_BLOCKS_PRE_IO|\
+                                         EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
+        /* Convert extent to initialized after IO complete */
+#define EXT4_GET_BLOCKS_IO_CONVERT_EXT          (EXT4_GET_BLOCKS_CONVERT|\
                                          EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
-        /* Convert extent to initialized after direct IO complete */
-#define EXT4_GET_BLOCKS_DIO_CONVERT_EXT         (EXT4_GET_BLOCKS_CONVERT|\
-                                         EXT4_GET_BLOCKS_DIO_CREATE_EXT)
 
 /*
  * Flags used by ext4_free_blocks
  */
 #define EXT4_FREE_BLOCKS_METADATA       0x0001
 #define EXT4_FREE_BLOCKS_FORGET         0x0002
+#define EXT4_FREE_BLOCKS_VALIDATED      0x0004
 
 /*
  * ioctl commands
@@ -630,7 +628,7 @@ struct ext4_inode_info {
          * near to their parent directory's inode.
          */
         ext4_group_t    i_block_group;
-        __u32   i_state;                /* Dynamic state flags for ext4 */
+        unsigned long   i_state_flags;          /* Dynamic state flags */
 
         ext4_lblk_t             i_dir_start_lookup;
 #ifdef CONFIG_EXT4_FS_XATTR
@@ -708,8 +706,9 @@ struct ext4_inode_info {
         qsize_t i_reserved_quota;
 #endif
 
-        /* completed async DIOs that might need unwritten extents handling */
-        struct list_head i_aio_dio_complete_list;
+        /* completed IOs that might need unwritten extents handling */
+        struct list_head i_completed_io_list;
+        spinlock_t i_completed_io_lock;
         /* current io_end structure for async DIO write*/
         ext4_io_end_t *cur_aio_dio;
 
@@ -760,6 +759,7 @@ struct ext4_inode_info {
 #define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_DIOREAD_NOLOCK       0x400000 /* Enable support for dio read nolocking */
 #define EXT4_MOUNT_JOURNAL_CHECKSUM     0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT 0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
@@ -1014,7 +1014,7 @@ struct ext4_sb_info {
         atomic_t s_lock_busy;
 
         /* locality groups */
-        struct ext4_locality_group *s_locality_groups;
+        struct ext4_locality_group __percpu *s_locality_groups;
 
         /* for write statistics */
         unsigned long s_sectors_written_start;
@@ -1050,6 +1050,34 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
                 (ino >= EXT4_FIRST_INO(sb) &&
                  ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
 }
+
+/*
+ * Inode dynamic state flags
+ */
+enum {
+        EXT4_STATE_JDATA,               /* journaled data exists */
+        EXT4_STATE_NEW,                 /* inode is newly created */
+        EXT4_STATE_XATTR,               /* has in-inode xattrs */
+        EXT4_STATE_NO_EXPAND,           /* No space for expansion */
+        EXT4_STATE_DA_ALLOC_CLOSE,      /* Alloc DA blks on close */
+        EXT4_STATE_EXT_MIGRATE,         /* Inode is migrating */
+        EXT4_STATE_DIO_UNWRITTEN,       /* need convert on dio done*/
+};
+
+static inline int ext4_test_inode_state(struct inode *inode, int bit)
+{
+        return test_bit(bit, &EXT4_I(inode)->i_state_flags);
+}
+
+static inline void ext4_set_inode_state(struct inode *inode, int bit)
+{
+        set_bit(bit, &EXT4_I(inode)->i_state_flags);
+}
+
+static inline void ext4_clear_inode_state(struct inode *inode, int bit)
+{
+        clear_bit(bit, &EXT4_I(inode)->i_state_flags);
+}
 #else
 /* Assume that user mode programs are passing in an ext4fs superblock, not
  * a kernel struct super_block.  This will allow us to call the feature-test
@@ -1126,6 +1154,8 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
 #define EXT4_FEATURE_INCOMPAT_64BIT             0x0080
 #define EXT4_FEATURE_INCOMPAT_MMP               0x0100
 #define EXT4_FEATURE_INCOMPAT_FLEX_BG           0x0200
+#define EXT4_FEATURE_INCOMPAT_EA_INODE          0x0400 /* EA in inode */
+#define EXT4_FEATURE_INCOMPAT_DIRDATA           0x1000 /* data in dirent */
 
 #define EXT4_FEATURE_COMPAT_SUPP        EXT2_FEATURE_COMPAT_EXT_ATTR
 #define EXT4_FEATURE_INCOMPAT_SUPP      (EXT4_FEATURE_INCOMPAT_FILETYPE| \
@@ -1416,7 +1446,7 @@ int ext4_get_block(struct inode *inode, sector_t iblock,
                                 struct buffer_head *bh_result, int create);
 
 extern struct inode *ext4_iget(struct super_block *, unsigned long);
-extern int  ext4_write_inode(struct inode *, int);
+extern int  ext4_write_inode(struct inode *, struct writeback_control *);
 extern int  ext4_setattr(struct dentry *, struct iattr *);
 extern int  ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
                                 struct kstat *stat);
@@ -1439,7 +1469,7 @@ extern int ext4_block_truncate_page(handle_t *handle,
                 struct address_space *mapping, loff_t from);
 extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
 extern qsize_t *ext4_get_reserved_space(struct inode *inode);
-extern int flush_aio_dio_completed_IO(struct inode *inode);
+extern int flush_completed_IO(struct inode *inode);
 extern void ext4_da_update_reserve_space(struct inode *inode,
                                         int used, int quota_claim);
 /* ioctl.c */
@@ -1465,13 +1495,20 @@ extern int ext4_group_extend(struct super_block *sb,
                                 ext4_fsblk_t n_blocks_count);
 
 /* super.c */
-extern void ext4_error(struct super_block *, const char *, const char *, ...)
+extern void __ext4_error(struct super_block *, const char *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+#define ext4_error(sb, message...)      __ext4_error(sb, __func__, ## message)
+extern void ext4_error_inode(const char *, struct inode *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+extern void ext4_error_file(const char *, struct file *, const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
 extern void __ext4_std_error(struct super_block *, const char *, int);
 extern void ext4_abort(struct super_block *, const char *, const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
-extern void ext4_warning(struct super_block *, const char *, const char *, ...)
+extern void __ext4_warning(struct super_block *, const char *,
+                          const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
+#define ext4_warning(sb, message...)    __ext4_warning(sb, __func__, ## message)
 extern void ext4_msg(struct super_block *, const char *, const char *, ...)
         __attribute__ ((format (printf, 3, 4)));
 extern void ext4_grp_locked_error(struct super_block *, ext4_group_t,
@@ -1744,7 +1781,7 @@ extern void ext4_ext_release(struct super_block *);
 extern long ext4_fallocate(struct inode *inode, int mode, loff_t offset,
                           loff_t len);
 extern int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
-                          loff_t len);
+                          ssize_t len);
 extern int ext4_get_blocks(handle_t *handle, struct inode *inode,
                            sector_t block, unsigned int max_blocks,
                            struct buffer_head *bh, int flags);
@@ -1756,6 +1793,15 @@ extern int ext4_move_extents(struct file *o_filp, struct file *d_filp,
                              __u64 len, __u64 *moved_len);
 
 
+/* BH_Uninit flag: blocks are allocated but uninitialized on disk */
+enum ext4_state_bits {
+        BH_Uninit       /* blocks are allocated but uninitialized on disk */
+          = BH_JBDPrivateStart,
+};
+
+BUFFER_FNS(Uninit, uninit)
+TAS_BUFFER_FNS(Uninit, uninit)
+
 /*
  * Add new method to test wether block and inode bitmaps are properly
  * initialized. With uninit_bg reading the block from disk is not enough
@@ -1773,6 +1819,8 @@ static inline void set_bitmap_uptodate(struct buffer_head *bh)
         set_bit(BH_BITMAP_UPTODATE, &(bh)->b_state);
 }
 
+#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
+
 #endif  /* __KERNEL__ */
 
 #endif  /* _EXT4_H */
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index b57e5c711b6d..53d2764d71ca 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -125,14 +125,14 @@ int __ext4_handle_dirty_metadata(const char *where, handle_t *handle,
                         ext4_journal_abort_handle(where, __func__, bh,
                                                   handle, err);
         } else {
-                if (inode && bh)
+                if (inode)
                         mark_buffer_dirty_inode(bh, inode);
                 else
                         mark_buffer_dirty(bh);
                 if (inode && inode_needs_sync(inode)) {
                         sync_dirty_buffer(bh);
                         if (buffer_req(bh) && !buffer_uptodate(bh)) {
-                                ext4_error(inode->i_sb, __func__,
+                                ext4_error(inode->i_sb,
                                            "IO error syncing inode, "
                                            "inode=%lu, block=%llu",
                                            inode->i_ino,
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 05eca817d704..b79ad5126468 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -304,4 +304,28 @@ static inline int ext4_should_writeback_data(struct inode *inode)
         return 0;
 }
 
+/*
+ * This function controls whether or not we should try to go down the
+ * dioread_nolock code paths, which makes it safe to avoid taking
+ * i_mutex for direct I/O reads.  This only works for extent-based
+ * files, and it doesn't work for nobh or if data journaling is
+ * enabled, since the dioread_nolock code uses b_private to pass
+ * information back to the I/O completion handler, and this conflicts
+ * with the jbd's use of b_private.
+ */
+static inline int ext4_should_dioread_nolock(struct inode *inode)
+{
+        if (!test_opt(inode->i_sb, DIOREAD_NOLOCK))
+                return 0;
+        if (test_opt(inode->i_sb, NOBH))
+                return 0;
+        if (!S_ISREG(inode->i_mode))
+                return 0;
+        if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
+                return 0;
+        if (ext4_should_journal_data(inode))
+                return 0;
+        return 1;
+}
+
 #endif  /* _EXT4_JBD2_H */
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 765a4826b118..94c8ee81f5e1 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -195,8 +195,7 @@ static ext4_fsblk_t ext4_ext_find_goal(struct inode *inode,
                 if (S_ISREG(inode->i_mode))
                         block_group++;
         }
-        bg_start = (block_group * EXT4_BLOCKS_PER_GROUP(inode->i_sb)) +
-                le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_first_data_block);
+        bg_start = ext4_group_first_block_no(inode->i_sb, block_group);
         last_block = ext4_blocks_count(EXT4_SB(inode->i_sb)->s_es) - 1;
 
         /*
@@ -440,7 +439,7 @@ static int __ext4_ext_check(const char *function, struct inode *inode,
         return 0;
 
 corrupted:
-        ext4_error(inode->i_sb, function,
+        __ext4_error(inode->i_sb, function,
                         "bad header/extent in inode #%lu: %s - magic %x, "
                         "entries %u, max %u(%u), depth %u(%u)",
                         inode->i_ino, error_msg, le16_to_cpu(eh->eh_magic),
@@ -703,7 +702,12 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block,
                 }
                 eh = ext_block_hdr(bh);
                 ppos++;
-                BUG_ON(ppos > depth);
+                if (unlikely(ppos > depth)) {
+                        put_bh(bh);
+                        EXT4_ERROR_INODE(inode,
+                                         "ppos %d > depth %d", ppos, depth);
+                        goto err;
+                }
                 path[ppos].p_bh = bh;
                 path[ppos].p_hdr = eh;
                 i--;
@@ -749,7 +753,12 @@ int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
         if (err)
                 return err;
 
-        BUG_ON(logical == le32_to_cpu(curp->p_idx->ei_block));
+        if (unlikely(logical == le32_to_cpu(curp->p_idx->ei_block))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d == ei_block %d!",
+                                 logical, le32_to_cpu(curp->p_idx->ei_block));
+                return -EIO;
+        }
         len = EXT_MAX_INDEX(curp->p_hdr) - curp->p_idx;
         if (logical > le32_to_cpu(curp->p_idx->ei_block)) {
                 /* insert after */
@@ -779,9 +788,17 @@ int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
         ext4_idx_store_pblock(ix, ptr);
         le16_add_cpu(&curp->p_hdr->eh_entries, 1);
 
-        BUG_ON(le16_to_cpu(curp->p_hdr->eh_entries)
-                             > le16_to_cpu(curp->p_hdr->eh_max));
-        BUG_ON(ix > EXT_LAST_INDEX(curp->p_hdr));
+        if (unlikely(le16_to_cpu(curp->p_hdr->eh_entries)
+                             > le16_to_cpu(curp->p_hdr->eh_max))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d == ei_block %d!",
+                                 logical, le32_to_cpu(curp->p_idx->ei_block));
+                return -EIO;
+        }
+        if (unlikely(ix > EXT_LAST_INDEX(curp->p_hdr))) {
+                EXT4_ERROR_INODE(inode, "ix > EXT_LAST_INDEX!");
+                return -EIO;
+        }
 
         err = ext4_ext_dirty(handle, inode, curp);
         ext4_std_error(inode->i_sb, err);
@@ -819,7 +836,10 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
         /* if current leaf will be split, then we should use
          * border from split point */
-        BUG_ON(path[depth].p_ext > EXT_MAX_EXTENT(path[depth].p_hdr));
+        if (unlikely(path[depth].p_ext > EXT_MAX_EXTENT(path[depth].p_hdr))) {
+                EXT4_ERROR_INODE(inode, "p_ext > EXT_MAX_EXTENT!");
+                return -EIO;
+        }
         if (path[depth].p_ext != EXT_MAX_EXTENT(path[depth].p_hdr)) {
                 border = path[depth].p_ext[1].ee_block;
                 ext_debug("leaf will be split."
@@ -860,7 +880,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
         /* initialize new leaf */
         newblock = ablocks[--a];
-        BUG_ON(newblock == 0);
+        if (unlikely(newblock == 0)) {
+                EXT4_ERROR_INODE(inode, "newblock == 0!");
+                err = -EIO;
+                goto cleanup;
+        }
         bh = sb_getblk(inode->i_sb, newblock);
         if (!bh) {
                 err = -EIO;
@@ -880,7 +904,14 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
         ex = EXT_FIRST_EXTENT(neh);
 
         /* move remainder of path[depth] to the new leaf */
-        BUG_ON(path[depth].p_hdr->eh_entries != path[depth].p_hdr->eh_max);
+        if (unlikely(path[depth].p_hdr->eh_entries !=
+                     path[depth].p_hdr->eh_max)) {
+                EXT4_ERROR_INODE(inode, "eh_entries %d != eh_max %d!",
+                                 path[depth].p_hdr->eh_entries,
+                                 path[depth].p_hdr->eh_max);
+                err = -EIO;
+                goto cleanup;
+        }
         /* start copy from next extent */
         /* TODO: we could do it by single memmove */
         m = 0;
@@ -927,7 +958,11 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
         /* create intermediate indexes */
         k = depth - at - 1;
-        BUG_ON(k < 0);
+        if (unlikely(k < 0)) {
+                EXT4_ERROR_INODE(inode, "k %d < 0!", k);
+                err = -EIO;
+                goto cleanup;
+        }
         if (k)
                 ext_debug("create %d intermediate indices\n", k);
         /* insert new index into current index block */
@@ -964,8 +999,14 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
 
                 ext_debug("cur 0x%p, last 0x%p\n", path[i].p_idx,
                                 EXT_MAX_INDEX(path[i].p_hdr));
-                BUG_ON(EXT_MAX_INDEX(path[i].p_hdr) !=
-                                EXT_LAST_INDEX(path[i].p_hdr));
+                if (unlikely(EXT_MAX_INDEX(path[i].p_hdr) !=
+                                        EXT_LAST_INDEX(path[i].p_hdr))) {
+                        EXT4_ERROR_INODE(inode,
+                                         "EXT_MAX_INDEX != EXT_LAST_INDEX ee_block %d!",
+                                         le32_to_cpu(path[i].p_ext->ee_block));
+                        err = -EIO;
+                        goto cleanup;
+                }
                 while (path[i].p_idx <= EXT_MAX_INDEX(path[i].p_hdr)) {
                         ext_debug("%d: move %d:%llu in new index %llu\n", i,
                                         le32_to_cpu(path[i].p_idx->ei_block),
@@ -1203,7 +1244,10 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
         struct ext4_extent *ex;
         int depth, ee_len;
 
-        BUG_ON(path == NULL);
+        if (unlikely(path == NULL)) {
+                EXT4_ERROR_INODE(inode, "path == NULL *logical %d!", *logical);
+                return -EIO;
+        }
         depth = path->p_depth;
         *phys = 0;
 
@@ -1217,15 +1261,33 @@ ext4_ext_search_left(struct inode *inode, struct ext4_ext_path *path,
         ex = path[depth].p_ext;
         ee_len = ext4_ext_get_actual_len(ex);
         if (*logical < le32_to_cpu(ex->ee_block)) {
-                BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
+                if (unlikely(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "EXT_FIRST_EXTENT != ex *logical %d ee_block %d!",
+                                         *logical, le32_to_cpu(ex->ee_block));
+                        return -EIO;
+                }
                 while (--depth >= 0) {
                         ix = path[depth].p_idx;
-                        BUG_ON(ix != EXT_FIRST_INDEX(path[depth].p_hdr));
+                        if (unlikely(ix != EXT_FIRST_INDEX(path[depth].p_hdr))) {
+                                EXT4_ERROR_INODE(inode,
+                                  "ix (%d) != EXT_FIRST_INDEX (%d) (depth %d)!",
+                                  ix != NULL ? ix->ei_block : 0,
+                                  EXT_FIRST_INDEX(path[depth].p_hdr) != NULL ?
+                                    EXT_FIRST_INDEX(path[depth].p_hdr)->ei_block : 0,
+                                  depth);
+                                return -EIO;
+                        }
                 }
                 return 0;
         }
 
-        BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));
+        if (unlikely(*logical < (le32_to_cpu(ex->ee_block) + ee_len))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d < ee_block %d + ee_len %d!",
+                                 *logical, le32_to_cpu(ex->ee_block), ee_len);
+                return -EIO;
+        }
 
         *logical = le32_to_cpu(ex->ee_block) + ee_len - 1;
         *phys = ext_pblock(ex) + ee_len - 1;
@@ -1251,7 +1313,10 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
         int depth;      /* Note, NOT eh_depth; depth from top of tree */
         int ee_len;
 
-        BUG_ON(path == NULL);
+        if (unlikely(path == NULL)) {
+                EXT4_ERROR_INODE(inode, "path == NULL *logical %d!", *logical);
+                return -EIO;
+        }
         depth = path->p_depth;
         *phys = 0;
 
@@ -1265,17 +1330,32 @@ ext4_ext_search_right(struct inode *inode, struct ext4_ext_path *path,
         ex = path[depth].p_ext;
         ee_len = ext4_ext_get_actual_len(ex);
         if (*logical < le32_to_cpu(ex->ee_block)) {
-                BUG_ON(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex);
+                if (unlikely(EXT_FIRST_EXTENT(path[depth].p_hdr) != ex)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "first_extent(path[%d].p_hdr) != ex",
+                                         depth);
+                        return -EIO;
+                }
                 while (--depth >= 0) {
                         ix = path[depth].p_idx;
-                        BUG_ON(ix != EXT_FIRST_INDEX(path[depth].p_hdr));
+                        if (unlikely(ix != EXT_FIRST_INDEX(path[depth].p_hdr))) {
+                                EXT4_ERROR_INODE(inode,
+                                                 "ix != EXT_FIRST_INDEX *logical %d!",
+                                                 *logical);
+                                return -EIO;
+                        }
                 }
                 *logical = le32_to_cpu(ex->ee_block);
                 *phys = ext_pblock(ex);
                 return 0;
         }
 
-        BUG_ON(*logical < (le32_to_cpu(ex->ee_block) + ee_len));
+        if (unlikely(*logical < (le32_to_cpu(ex->ee_block) + ee_len))) {
+                EXT4_ERROR_INODE(inode,
+                                 "logical %d < ee_block %d + ee_len %d!",
+                                 *logical, le32_to_cpu(ex->ee_block), ee_len);
+                return -EIO;
+        }
 
         if (ex != EXT_LAST_EXTENT(path[depth].p_hdr)) {
                 /* next allocated block in this leaf */
@@ -1414,8 +1494,12 @@ static int ext4_ext_correct_indexes(handle_t *handle, struct inode *inode,
 
         eh = path[depth].p_hdr;
         ex = path[depth].p_ext;
-        BUG_ON(ex == NULL);
-        BUG_ON(eh == NULL);
+
+        if (unlikely(ex == NULL || eh == NULL)) {
+                EXT4_ERROR_INODE(inode,
+                                 "ex %p == NULL or eh %p == NULL", ex, eh);
+                return -EIO;
+        }
 
         if (depth == 0) {
                 /* there is no tree at all */
@@ -1538,8 +1622,9 @@ int ext4_ext_try_to_merge(struct inode *inode,
                 merge_done = 1;
                 WARN_ON(eh->eh_entries == 0);
                 if (!eh->eh_entries)
-                        ext4_error(inode->i_sb, "ext4_ext_try_to_merge",
-                           "inode#%lu, eh->eh_entries = 0!", inode->i_ino);
+                        ext4_error(inode->i_sb,
+                                   "inode#%lu, eh->eh_entries = 0!",
+                                   inode->i_ino);
         }
 
         return merge_done;
@@ -1612,13 +1697,19 @@ int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,
         ext4_lblk_t next;
         unsigned uninitialized = 0;
 
-        BUG_ON(ext4_ext_get_actual_len(newext) == 0);
+        if (unlikely(ext4_ext_get_actual_len(newext) == 0)) {
+                EXT4_ERROR_INODE(inode, "ext4_ext_get_actual_len(newext) == 0");
+                return -EIO;
+        }
         depth = ext_depth(inode);
         ex = path[depth].p_ext;
-        BUG_ON(path[depth].p_hdr == NULL);
+        if (unlikely(path[depth].p_hdr == NULL)) {
+                EXT4_ERROR_INODE(inode, "path[%d].p_hdr == NULL", depth);
+                return -EIO;
+        }
 
         /* try to insert block into found extent and return */
-        if (ex && (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+        if (ex && !(flag & EXT4_GET_BLOCKS_PRE_IO)
                 && ext4_can_extents_be_merged(inode, ex, newext)) {
                 ext_debug("append [%d]%d block to %d:[%d]%d (from %llu)\n",
                                 ext4_ext_is_uninitialized(newext),
@@ -1739,7 +1830,7 @@ has_space:
 
 merge:
         /* try to merge extents to the right */
-        if (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+        if (!(flag & EXT4_GET_BLOCKS_PRE_IO))
                 ext4_ext_try_to_merge(inode, path, nearex);
 
         /* try to merge extents to the left */
@@ -1787,7 +1878,11 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
                 }
 
                 depth = ext_depth(inode);
-                BUG_ON(path[depth].p_hdr == NULL);
+                if (unlikely(path[depth].p_hdr == NULL)) {
+                        EXT4_ERROR_INODE(inode, "path[%d].p_hdr == NULL", depth);
+                        err = -EIO;
+                        break;
+                }
                 ex = path[depth].p_ext;
                 next = ext4_ext_next_allocated_block(path);
 
@@ -1838,7 +1933,11 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
                         cbex.ec_type = EXT4_EXT_CACHE_EXTENT;
                 }
 
-                BUG_ON(cbex.ec_len == 0);
+                if (unlikely(cbex.ec_len == 0)) {
+                        EXT4_ERROR_INODE(inode, "cbex.ec_len == 0");
+                        err = -EIO;
+                        break;
+                }
                 err = func(inode, path, &cbex, ex, cbdata);
                 ext4_ext_drop_refs(path);
 
@@ -1952,7 +2051,7 @@ ext4_ext_in_cache(struct inode *inode, ext4_lblk_t block,
 
         BUG_ON(cex->ec_type != EXT4_EXT_CACHE_GAP &&
                         cex->ec_type != EXT4_EXT_CACHE_EXTENT);
-        if (block >= cex->ec_block && block < cex->ec_block + cex->ec_len) {
+        if (in_range(block, cex->ec_block, cex->ec_len)) {
                 ex->ee_block = cpu_to_le32(cex->ec_block);
                 ext4_ext_store_pblock(ex, cex->ec_start);
                 ex->ee_len = cpu_to_le16(cex->ec_len);
@@ -1981,7 +2080,10 @@ static int ext4_ext_rm_idx(handle_t *handle, struct inode *inode,
         /* free index block */
         path--;
         leaf = idx_pblock(path->p_idx);
-        BUG_ON(path->p_hdr->eh_entries == 0);
+        if (unlikely(path->p_hdr->eh_entries == 0)) {
+                EXT4_ERROR_INODE(inode, "path->p_hdr->eh_entries == 0");
+                return -EIO;
+        }
         err = ext4_ext_get_access(handle, inode, path);
         if (err)
                 return err;
@@ -2119,8 +2221,10 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
         if (!path[depth].p_hdr)
                 path[depth].p_hdr = ext_block_hdr(path[depth].p_bh);
         eh = path[depth].p_hdr;
-        BUG_ON(eh == NULL);
-
+        if (unlikely(path[depth].p_hdr == NULL)) {
+                EXT4_ERROR_INODE(inode, "path[%d].p_hdr == NULL", depth);
+                return -EIO;
+        }
         /* find where to start removing */
         ex = EXT_LAST_EXTENT(eh);
 
@@ -2983,7 +3087,7 @@ fix_extent_len:
         ext4_ext_dirty(handle, inode, path + depth);
         return err;
 }
-static int ext4_convert_unwritten_extents_dio(handle_t *handle,
+static int ext4_convert_unwritten_extents_endio(handle_t *handle,
                                               struct inode *inode,
                                               struct ext4_ext_path *path)
 {
@@ -3063,8 +3167,8 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                   flags, allocated);
         ext4_ext_show_leaf(inode, path);
 
-        /* DIO get_block() before submit the IO, split the extent */
-        if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+        /* get_block() before submit the IO, split the extent */
+        if ((flags & EXT4_GET_BLOCKS_PRE_IO)) {
                 ret = ext4_split_unwritten_extents(handle,
                                                 inode, path, iblock,
                                                 max_blocks, flags);
@@ -3074,14 +3178,16 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                  * completed
                  */
                 if (io)
-                        io->flag = DIO_AIO_UNWRITTEN;
+                        io->flag = EXT4_IO_UNWRITTEN;
                 else
-                        EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
+                        ext4_set_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
+                if (ext4_should_dioread_nolock(inode))
+                        set_buffer_uninit(bh_result);
                 goto out;
         }
-        /* async DIO end_io complete, convert the filled extent to written */
-        if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
-                ret = ext4_convert_unwritten_extents_dio(handle, inode,
+        /* IO end_io complete, convert the filled extent to written */
+        if ((flags & EXT4_GET_BLOCKS_CONVERT)) {
+                ret = ext4_convert_unwritten_extents_endio(handle, inode,
                                                         path);
                 if (ret >= 0)
                         ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -3185,7 +3291,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
 {
         struct ext4_ext_path *path = NULL;
         struct ext4_extent_header *eh;
-        struct ext4_extent newex, *ex;
+        struct ext4_extent newex, *ex, *last_ex;
         ext4_fsblk_t newblock;
         int err = 0, depth, ret, cache_type;
         unsigned int allocated = 0;
@@ -3237,10 +3343,10 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
          * this situation is possible, though, _during_ tree modification;
          * this is why assert can't be put in ext4_ext_find_extent()
          */
-        if (path[depth].p_ext == NULL && depth != 0) {
-                ext4_error(inode->i_sb, __func__, "bad extent address "
-                           "inode: %lu, iblock: %d, depth: %d",
-                           inode->i_ino, iblock, depth);
+        if (unlikely(path[depth].p_ext == NULL && depth != 0)) {
+                EXT4_ERROR_INODE(inode, "bad extent address "
+                                 "iblock: %d, depth: %d pblock %lld",
+                                 iblock, depth, path[depth].p_block);
                 err = -EIO;
                 goto out2;
         }
@@ -3258,7 +3364,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                  */
                 ee_len = ext4_ext_get_actual_len(ex);
                 /* if found extent covers block, simply return it */
-                if (iblock >= ee_block && iblock < ee_block + ee_len) {
+                if (in_range(iblock, ee_block, ee_len)) {
                         newblock = iblock - ee_block + ee_start;
                         /* number of remaining blocks in the extent */
                         allocated = ee_len - (iblock - ee_block);
@@ -3350,21 +3456,35 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
         if (flags & EXT4_GET_BLOCKS_UNINIT_EXT){
                 ext4_ext_mark_uninitialized(&newex);
                 /*
-                 * io_end structure was created for every async
-                 * direct IO write to the middle of the file.
-                 * To avoid unecessary convertion for every aio dio rewrite
-                 * to the mid of file, here we flag the IO that is really
-                 * need the convertion.
+                 * io_end structure was created for every IO write to an
+                 * uninitialized extent. To avoid unecessary conversion,
+                 * here we flag the IO that really needs the conversion.
                  * For non asycn direct IO case, flag the inode state
                  * that we need to perform convertion when IO is done.
                  */
-                if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+                if ((flags & EXT4_GET_BLOCKS_PRE_IO)) {
                         if (io)
-                                io->flag = DIO_AIO_UNWRITTEN;
+                                io->flag = EXT4_IO_UNWRITTEN;
                         else
-                                EXT4_I(inode)->i_state |=
-                                        EXT4_STATE_DIO_UNWRITTEN;;
+                                ext4_set_inode_state(inode,
+                                                     EXT4_STATE_DIO_UNWRITTEN);
+                }
+                if (ext4_should_dioread_nolock(inode))
+                        set_buffer_uninit(bh_result);
+        }
+
+        if (unlikely(EXT4_I(inode)->i_flags & EXT4_EOFBLOCKS_FL)) {
+                if (unlikely(!eh->eh_entries)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "eh->eh_entries == 0 ee_block %d",
+                                         ex->ee_block);
+                        err = -EIO;
+                        goto out2;
                 }
+                last_ex = EXT_LAST_EXTENT(eh);
+                if (iblock + ar.len > le32_to_cpu(last_ex->ee_block)
+                    + ext4_ext_get_actual_len(last_ex))
+                        EXT4_I(inode)->i_flags &= ~EXT4_EOFBLOCKS_FL;
         }
         err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
         if (err) {
@@ -3499,6 +3619,13 @@ static void ext4_falloc_update_inode(struct inode *inode,
                         i_size_write(inode, new_size);
                 if (new_size > EXT4_I(inode)->i_disksize)
                         ext4_update_i_disksize(inode, new_size);
+        } else {
+                /*
+                 * Mark that we allocate beyond EOF so the subsequent truncate
+                 * can proceed even if the new size is the same as i_size.
+                 */
+                if (new_size > i_size_read(inode))
+                        EXT4_I(inode)->i_flags |= EXT4_EOFBLOCKS_FL;
         }
 
 }
@@ -3603,7 +3730,7 @@ retry:
  * Returns 0 on success.
  */
 int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
-                                    loff_t len)
+                                    ssize_t len)
 {
         handle_t *handle;
         ext4_lblk_t block;
@@ -3635,7 +3762,7 @@ int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
                 map_bh.b_state = 0;
                 ret = ext4_get_blocks(handle, inode, block,
                                       max_blocks, &map_bh,
-                                      EXT4_GET_BLOCKS_DIO_CONVERT_EXT);
+                                      EXT4_GET_BLOCKS_IO_CONVERT_EXT);
                 if (ret <= 0) {
                         WARN_ON(ret <= 0);
                         printk(KERN_ERR "%s: ext4_ext_get_blocks "
@@ -3739,7 +3866,7 @@ static int ext4_xattr_fiemap(struct inode *inode,
         int error = 0;
 
         /* in-inode? */
-        if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
                 struct ext4_iloc iloc;
                 int offset;     /* offset of xattr in inode */
 
@@ -3767,7 +3894,6 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 __u64 start, __u64 len)
 {
         ext4_lblk_t start_blk;
-        ext4_lblk_t len_blks;
         int error = 0;
 
         /* fallback to generic here if not in extents fmt */
@@ -3781,8 +3907,14 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
                 error = ext4_xattr_fiemap(inode, fieinfo);
         } else {
+                ext4_lblk_t len_blks;
+                __u64 last_blk;
+
                 start_blk = start >> inode->i_sb->s_blocksize_bits;
-                len_blks = len >> inode->i_sb->s_blocksize_bits;
+                last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
+                if (last_blk >= EXT_MAX_BLOCK)
+                        last_blk = EXT_MAX_BLOCK-1;
+                len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
 
                 /*
                  * Walk the extent tree gathering extent information.
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 9630583cef28..503a48927402 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -35,9 +35,9 @@
  */
 static int ext4_release_file(struct inode *inode, struct file *filp)
 {
-        if (EXT4_I(inode)->i_state & EXT4_STATE_DA_ALLOC_CLOSE) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE)) {
                 ext4_alloc_da_blocks(inode);
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_DA_ALLOC_CLOSE;
+                ext4_clear_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
         }
         /* if we are the last writer on the inode, drop the block reservation */
         if ((filp->f_mode & FMODE_WRITE) &&
@@ -116,11 +116,9 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
                  * devices or filesystem images.
                  */
                 memset(buf, 0, sizeof(buf));
-                path.mnt = mnt->mnt_parent;
-                path.dentry = mnt->mnt_mountpoint;
-                path_get(&path);
+                path.mnt = mnt;
+                path.dentry = mnt->mnt_root;
                 cp = d_path(&path, buf, sizeof(buf));
-                path_put(&path);
                 if (!IS_ERR(cp)) {
                         memcpy(sbi->s_es->s_last_mounted, cp,
                                sizeof(sbi->s_es->s_last_mounted));
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 98bd140aad01..0d0c3239c1cd 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -63,7 +63,7 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
         if (inode->i_sb->s_flags & MS_RDONLY)
                 return 0;
 
-        ret = flush_aio_dio_completed_IO(inode);
+        ret = flush_completed_IO(inode);
         if (ret < 0)
                 return ret;
         
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index f3624ead4f6c..004c9da9e5c6 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -76,8 +76,7 @@ unsigned ext4_init_inode_bitmap(struct super_block *sb, struct buffer_head *bh,
         /* If checksum is bad mark all blocks and inodes use to prevent
          * allocation, essentially implementing a per-group read-only flag. */
         if (!ext4_group_desc_csum_verify(sbi, block_group, gdp)) {
-                ext4_error(sb, __func__, "Checksum bad for group %u",
-                           block_group);
+                ext4_error(sb, "Checksum bad for group %u", block_group);
                 ext4_free_blks_set(sb, gdp, 0);
                 ext4_free_inodes_set(sb, gdp, 0);
                 ext4_itable_unused_set(sb, gdp, 0);
@@ -111,8 +110,7 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
         bitmap_blk = ext4_inode_bitmap(sb, desc);
         bh = sb_getblk(sb, bitmap_blk);
         if (unlikely(!bh)) {
-                ext4_error(sb, __func__,
-                            "Cannot read inode bitmap - "
+                ext4_error(sb, "Cannot read inode bitmap - "
                             "block_group = %u, inode_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -153,8 +151,7 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
         set_bitmap_uptodate(bh);
         if (bh_submit_read(bh) < 0) {
                 put_bh(bh);
-                ext4_error(sb, __func__,
-                            "Cannot read inode bitmap - "
+                ext4_error(sb, "Cannot read inode bitmap - "
                             "block_group = %u, inode_bitmap = %llu",
                             block_group, bitmap_blk);
                 return NULL;
@@ -229,8 +226,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
 
         es = EXT4_SB(sb)->s_es;
         if (ino < EXT4_FIRST_INO(sb) || ino > le32_to_cpu(es->s_inodes_count)) {
-                ext4_error(sb, "ext4_free_inode",
-                           "reserved or nonexistent inode %lu", ino);
+                ext4_error(sb, "reserved or nonexistent inode %lu", ino);
                 goto error_return;
         }
         block_group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
@@ -248,8 +244,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
         cleared = ext4_clear_bit_atomic(ext4_group_lock_ptr(sb, block_group),
                                         bit, bitmap_bh->b_data);
         if (!cleared)
-                ext4_error(sb, "ext4_free_inode",
-                           "bit already cleared for inode %lu", ino);
+                ext4_error(sb, "bit already cleared for inode %lu", ino);
         else {
                 gdp = ext4_get_group_desc(sb, block_group, &bh2);
 
@@ -736,8 +731,7 @@ static int ext4_claim_inode(struct super_block *sb,
         if ((group == 0 && ino < EXT4_FIRST_INO(sb)) ||
                         ino > EXT4_INODES_PER_GROUP(sb)) {
                 ext4_unlock_group(sb, group);
-                ext4_error(sb, __func__,
-                           "reserved inode or inode > inodes count - "
+                ext4_error(sb, "reserved inode or inode > inodes count - "
                            "block_group = %u, inode=%lu", group,
                            ino + group * EXT4_INODES_PER_GROUP(sb));
                 return 1;
@@ -904,7 +898,7 @@ repeat_in_this_group:
                                 BUFFER_TRACE(inode_bitmap_bh,
                                         "call ext4_handle_dirty_metadata");
                                 err = ext4_handle_dirty_metadata(handle,
-                                                                 inode,
+                                                                 NULL,
                                                         inode_bitmap_bh);
                                 if (err)
                                         goto fail;
@@ -1029,7 +1023,8 @@ got:
         inode->i_generation = sbi->s_next_generation++;
         spin_unlock(&sbi->s_next_gen_lock);
 
-        ei->i_state = EXT4_STATE_NEW;
+        ei->i_state_flags = 0;
+        ext4_set_inode_state(inode, EXT4_STATE_NEW);
 
         ei->i_extra_isize = EXT4_SB(sb)->s_want_extra_isize;
 
@@ -1098,8 +1093,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
 
         /* Error cases - e2fsck has already cleaned up for us */
         if (ino > max_ino) {
-                ext4_warning(sb, __func__,
-                             "bad orphan ino %lu!  e2fsck was run?", ino);
+                ext4_warning(sb, "bad orphan ino %lu!  e2fsck was run?", ino);
                 goto error;
         }
 
@@ -1107,8 +1101,7 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
         bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
         bitmap_bh = ext4_read_inode_bitmap(sb, block_group);
         if (!bitmap_bh) {
-                ext4_warning(sb, __func__,
-                             "inode bitmap error for orphan %lu", ino);
+                ext4_warning(sb, "inode bitmap error for orphan %lu", ino);
                 goto error;
         }
 
@@ -1140,8 +1133,7 @@ iget_failed:
         err = PTR_ERR(inode);
         inode = NULL;
 bad_orphan:
-        ext4_warning(sb, __func__,
-                     "bad orphan inode %lu!  e2fsck was run?", ino);
+        ext4_warning(sb, "bad orphan inode %lu!  e2fsck was run?", ino);
         printk(KERN_NOTICE "ext4_test_bit(bit=%d, block=%llu) = %d\n",
                bit, (unsigned long long)bitmap_bh->b_blocknr,
                ext4_test_bit(bit, bitmap_bh->b_data));
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e11952404e02..f977aade0d1b 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -38,6 +38,7 @@
 #include <linux/uio.h>
 #include <linux/bio.h>
 #include <linux/workqueue.h>
+#include <linux/kernel.h>
 
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -194,7 +195,7 @@ void ext4_delete_inode(struct inode *inode)
         inode->i_size = 0;
         err = ext4_mark_inode_dirty(handle, inode);
         if (err) {
-                ext4_warning(inode->i_sb, __func__,
+                ext4_warning(inode->i_sb,
                              "couldn't mark inode dirty (err %d)", err);
                 goto stop_handle;
         }
@@ -212,7 +213,7 @@ void ext4_delete_inode(struct inode *inode)
                 if (err > 0)
                         err = ext4_journal_restart(handle, 3);
                 if (err != 0) {
-                        ext4_warning(inode->i_sb, __func__,
+                        ext4_warning(inode->i_sb,
                                      "couldn't extend journal (err %d)", err);
                 stop_handle:
                         ext4_journal_stop(handle);
@@ -323,8 +324,7 @@ static int ext4_block_to_path(struct inode *inode,
                 offsets[n++] = i_block & (ptrs - 1);
                 final = ptrs;
         } else {
-                ext4_warning(inode->i_sb, "ext4_block_to_path",
-                             "block %lu > max in inode %lu",
+                ext4_warning(inode->i_sb, "block %lu > max in inode %lu",
                              i_block + direct_blocks +
                              indirect_blocks + double_blocks, inode->i_ino);
         }
@@ -344,7 +344,7 @@ static int __ext4_check_blockref(const char *function, struct inode *inode,
                 if (blk &&
                     unlikely(!ext4_data_block_valid(EXT4_SB(inode->i_sb),
                                                     blk, 1))) {
-                        ext4_error(inode->i_sb, function,
+                        __ext4_error(inode->i_sb, function,
                                    "invalid block reference %u "
                                    "in inode #%lu", blk, inode->i_ino);
                         return -EIO;
@@ -607,7 +607,14 @@ static int ext4_alloc_blocks(handle_t *handle, struct inode *inode,
                 if (*err)
                         goto failed_out;
 
-                BUG_ON(current_block + count > EXT4_MAX_BLOCK_FILE_PHYS);
+                if (unlikely(current_block + count > EXT4_MAX_BLOCK_FILE_PHYS)) {
+                        EXT4_ERROR_INODE(inode,
+                                         "current_block %llu + count %lu > %d!",
+                                         current_block, count,
+                                         EXT4_MAX_BLOCK_FILE_PHYS);
+                        *err = -EIO;
+                        goto failed_out;
+                }
 
                 target -= count;
                 /* allocate blocks for indirect blocks */
@@ -643,7 +650,14 @@ static int ext4_alloc_blocks(handle_t *handle, struct inode *inode,
                 ar.flags = EXT4_MB_HINT_DATA;
 
         current_block = ext4_mb_new_blocks(handle, &ar, err);
-        BUG_ON(current_block + ar.len > EXT4_MAX_BLOCK_FILE_PHYS);
+        if (unlikely(current_block + ar.len > EXT4_MAX_BLOCK_FILE_PHYS)) {
+                EXT4_ERROR_INODE(inode,
+                                 "current_block %llu + ar.len %d > %d!",
+                                 current_block, ar.len,
+                                 EXT4_MAX_BLOCK_FILE_PHYS);
+                *err = -EIO;
+                goto failed_out;
+        }
 
         if (*err && (target == blks)) {
                 /*
@@ -1061,6 +1075,7 @@ void ext4_da_update_reserve_space(struct inode *inode,
         int mdb_free = 0, allocated_meta_blocks = 0;
 
         spin_lock(&ei->i_block_reservation_lock);
+        trace_ext4_da_update_reserve_space(inode, used);
         if (unlikely(used > ei->i_reserved_data_blocks)) {
                 ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, used %d "
                          "with only %d reserved data blocks\n",
@@ -1124,7 +1139,7 @@ static int check_block_validity(struct inode *inode, const char *msg,
                                 sector_t logical, sector_t phys, int len)
 {
         if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), phys, len)) {
-                ext4_error(inode->i_sb, msg,
+                __ext4_error(inode->i_sb, msg,
                            "inode #%lu logical block %llu mapped to %llu "
                            "(size %d)", inode->i_ino,
                            (unsigned long long) logical,
@@ -1306,7 +1321,7 @@ int ext4_get_blocks(handle_t *handle, struct inode *inode, sector_t block,
                          * i_data's format changing.  Force the migrate
                          * to fail by clearing migrate flags
                          */
-                        EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
+                        ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
                 }
 
                 /*
@@ -1534,6 +1549,8 @@ static void ext4_truncate_failed_write(struct inode *inode)
         ext4_truncate(inode);
 }
 
+static int ext4_get_block_write(struct inode *inode, sector_t iblock,
+                   struct buffer_head *bh_result, int create);
 static int ext4_write_begin(struct file *file, struct address_space *mapping,
                             loff_t pos, unsigned len, unsigned flags,
                             struct page **pagep, void **fsdata)
@@ -1575,8 +1592,12 @@ retry:
         }
         *pagep = page;
 
-        ret = block_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
-                                ext4_get_block);
+        if (ext4_should_dioread_nolock(inode))
+                ret = block_write_begin(file, mapping, pos, len, flags, pagep,
+                                fsdata, ext4_get_block_write);
+        else
+                ret = block_write_begin(file, mapping, pos, len, flags, pagep,
+                                fsdata, ext4_get_block);
 
         if (!ret && ext4_should_journal_data(inode)) {
                 ret = walk_page_buffers(handle, page_buffers(page),
@@ -1793,7 +1814,7 @@ static int ext4_journalled_write_end(struct file *file,
         new_i_size = pos + copied;
         if (new_i_size > inode->i_size)
                 i_size_write(inode, pos+copied);
-        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+        ext4_set_inode_state(inode, EXT4_STATE_JDATA);
         if (new_i_size > EXT4_I(inode)->i_disksize) {
                 ext4_update_i_disksize(inode, new_i_size);
                 ret2 = ext4_mark_inode_dirty(handle, inode);
@@ -1846,6 +1867,7 @@ repeat:
         spin_lock(&ei->i_block_reservation_lock);
         md_reserved = ei->i_reserved_meta_blocks;
         md_needed = ext4_calc_metadata_amount(inode, lblock);
+        trace_ext4_da_reserve_space(inode, md_needed);
         spin_unlock(&ei->i_block_reservation_lock);
 
         /*
@@ -2091,6 +2113,8 @@ static void mpage_put_bnr_to_bhs(struct mpage_da_data *mpd, sector_t logical,
                                 } else if (buffer_mapped(bh))
                                         BUG_ON(bh->b_blocknr != pblock);
 
+                                if (buffer_uninit(exbh))
+                                        set_buffer_uninit(bh);
                                 cur_logical++;
                                 pblock++;
                         } while ((bh = bh->b_this_page) != head);
@@ -2133,17 +2157,16 @@ static void ext4_da_block_invalidatepages(struct mpage_da_data *mpd,
                         break;
                 for (i = 0; i < nr_pages; i++) {
                         struct page *page = pvec.pages[i];
-                        index = page->index;
-                        if (index > end)
+                        if (page->index > end)
                                 break;
-                        index++;
-
                         BUG_ON(!PageLocked(page));
                         BUG_ON(PageWriteback(page));
                         block_invalidatepage(page, 0);
                         ClearPageUptodate(page);
                         unlock_page(page);
                 }
+                index = pvec.pages[nr_pages - 1]->index + 1;
+                pagevec_release(&pvec);
         }
         return;
 }
@@ -2220,6 +2243,8 @@ static int mpage_da_map_blocks(struct mpage_da_data *mpd)
          */
         new.b_state = 0;
         get_blocks_flags = EXT4_GET_BLOCKS_CREATE;
+        if (ext4_should_dioread_nolock(mpd->inode))
+                get_blocks_flags |= EXT4_GET_BLOCKS_IO_CREATE_EXT;
         if (mpd->b_state & (1 << BH_Delay))
                 get_blocks_flags |= EXT4_GET_BLOCKS_DELALLOC_RESERVE;
 
@@ -2630,11 +2655,14 @@ static int __ext4_journalled_writepage(struct page *page,
                 ret = err;
 
         walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
-        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+        ext4_set_inode_state(inode, EXT4_STATE_JDATA);
 out:
         return ret;
 }
 
+static int ext4_set_bh_endio(struct buffer_head *bh, struct inode *inode);
+static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate);
+
 /*
  * Note that we don't need to start a transaction unless we're journaling data
  * because we should have holes filled from ext4_page_mkwrite(). We even don't
@@ -2682,7 +2710,7 @@ static int ext4_writepage(struct page *page,
         int ret = 0;
         loff_t size;
         unsigned int len;
-        struct buffer_head *page_bufs;
+        struct buffer_head *page_bufs = NULL;
         struct inode *inode = page->mapping->host;
 
         trace_ext4_writepage(inode, page);
@@ -2758,7 +2786,11 @@ static int ext4_writepage(struct page *page,
 
         if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
                 ret = nobh_writepage(page, noalloc_get_block_write, wbc);
-        else
+        else if (page_bufs && buffer_uninit(page_bufs)) {
+                ext4_set_bh_endio(page_bufs, inode);
+                ret = block_write_full_page_endio(page, noalloc_get_block_write,
+                                            wbc, ext4_end_io_buffer_write);
+        } else
                 ret = block_write_full_page(page, noalloc_get_block_write,
                                             wbc);
 
@@ -3301,7 +3333,8 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                 filemap_write_and_wait(mapping);
         }
 
-        if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
+        if (EXT4_JOURNAL(inode) &&
+            ext4_test_inode_state(inode, EXT4_STATE_JDATA)) {
                 /*
                  * This is a REALLY heavyweight approach, but the use of
                  * bmap on dirty files is expected to be extremely rare:
@@ -3320,7 +3353,7 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                  * everything they get.
                  */
 
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_JDATA;
+                ext4_clear_inode_state(inode, EXT4_STATE_JDATA);
                 journal = EXT4_JOURNAL(inode);
                 jbd2_journal_lock_updates(journal);
                 err = jbd2_journal_flush(journal);
@@ -3345,11 +3378,45 @@ ext4_readpages(struct file *file, struct address_space *mapping,
         return mpage_readpages(mapping, pages, nr_pages, ext4_get_block);
 }
 
+static void ext4_free_io_end(ext4_io_end_t *io)
+{
+        BUG_ON(!io);
+        if (io->page)
+                put_page(io->page);
+        iput(io->inode);
+        kfree(io);
+}
+
+static void ext4_invalidatepage_free_endio(struct page *page, unsigned long offset)
+{
+        struct buffer_head *head, *bh;
+        unsigned int curr_off = 0;
+
+        if (!page_has_buffers(page))
+                return;
+        head = bh = page_buffers(page);
+        do {
+                if (offset <= curr_off && test_clear_buffer_uninit(bh)
+                                        && bh->b_private) {
+                        ext4_free_io_end(bh->b_private);
+                        bh->b_private = NULL;
+                        bh->b_end_io = NULL;
+                }
+                curr_off = curr_off + bh->b_size;
+                bh = bh->b_this_page;
+        } while (bh != head);
+}
+
 static void ext4_invalidatepage(struct page *page, unsigned long offset)
 {
         journal_t *journal = EXT4_JOURNAL(page->mapping->host);
 
         /*
+         * free any io_end structure allocated for buffers to be discarded
+         */
+        if (ext4_should_dioread_nolock(page->mapping->host))
+                ext4_invalidatepage_free_endio(page, offset);
+        /*
          * If it's a full truncate we just forget about the pending dirtying
          */
         if (offset == 0)
@@ -3420,7 +3487,14 @@ static ssize_t ext4_ind_direct_IO(int rw, struct kiocb *iocb,
         }
 
 retry:
-        ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
+        if (rw == READ && ext4_should_dioread_nolock(inode))
+                ret = blockdev_direct_IO_no_locking(rw, iocb, inode,
+                                 inode->i_sb->s_bdev, iov,
+                                 offset, nr_segs,
+                                 ext4_get_block, NULL);
+        else
+                ret = blockdev_direct_IO(rw, iocb, inode,
+                                 inode->i_sb->s_bdev, iov,
                                  offset, nr_segs,
                                  ext4_get_block, NULL);
         if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
@@ -3436,6 +3510,9 @@ retry:
                          * but cannot extend i_size. Bail out and pretend
                          * the write failed... */
                         ret = PTR_ERR(handle);
+                        if (inode->i_nlink)
+                                ext4_orphan_del(NULL, inode);
+
                         goto out;
                 }
                 if (inode->i_nlink)
@@ -3463,75 +3540,63 @@ out:
         return ret;
 }
 
-static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
+static int ext4_get_block_write(struct inode *inode, sector_t iblock,
                    struct buffer_head *bh_result, int create)
 {
-        handle_t *handle = NULL;
+        handle_t *handle = ext4_journal_current_handle();
         int ret = 0;
         unsigned max_blocks = bh_result->b_size >> inode->i_blkbits;
         int dio_credits;
+        int started = 0;
 
-        ext4_debug("ext4_get_block_dio_write: inode %lu, create flag %d\n",
+        ext4_debug("ext4_get_block_write: inode %lu, create flag %d\n",
                    inode->i_ino, create);
         /*
-         * DIO VFS code passes create = 0 flag for write to
-         * the middle of file. It does this to avoid block
-         * allocation for holes, to prevent expose stale data
-         * out when there is parallel buffered read (which does
-         * not hold the i_mutex lock) while direct IO write has
-         * not completed. DIO request on holes finally falls back
-         * to buffered IO for this reason.
-         *
-         * For ext4 extent based file, since we support fallocate,
-         * new allocated extent as uninitialized, for holes, we
-         * could fallocate blocks for holes, thus parallel
-         * buffered IO read will zero out the page when read on
-         * a hole while parallel DIO write to the hole has not completed.
-         *
-         * when we come here, we know it's a direct IO write to
-         * to the middle of file (<i_size)
-         * so it's safe to override the create flag from VFS.
+         * ext4_get_block in prepare for a DIO write or buffer write.
+         * We allocate an uinitialized extent if blocks haven't been allocated.
+         * The extent will be converted to initialized after IO complete.
          */
-        create = EXT4_GET_BLOCKS_DIO_CREATE_EXT;
+        create = EXT4_GET_BLOCKS_IO_CREATE_EXT;
 
-        if (max_blocks > DIO_MAX_BLOCKS)
-                max_blocks = DIO_MAX_BLOCKS;
-        dio_credits = ext4_chunk_trans_blocks(inode, max_blocks);
-        handle = ext4_journal_start(inode, dio_credits);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                goto out;
+        if (!handle) {
+                if (max_blocks > DIO_MAX_BLOCKS)
+                        max_blocks = DIO_MAX_BLOCKS;
+                dio_credits = ext4_chunk_trans_blocks(inode, max_blocks);
+                handle = ext4_journal_start(inode, dio_credits);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        goto out;
+                }
+                started = 1;
         }
+
         ret = ext4_get_blocks(handle, inode, iblock, max_blocks, bh_result,
                               create);
         if (ret > 0) {
                 bh_result->b_size = (ret << inode->i_blkbits);
                 ret = 0;
         }
-        ext4_journal_stop(handle);
+        if (started)
+                ext4_journal_stop(handle);
 out:
         return ret;
 }
 
-static void ext4_free_io_end(ext4_io_end_t *io)
-{
-        BUG_ON(!io);
-        iput(io->inode);
-        kfree(io);
-}
-static void dump_aio_dio_list(struct inode * inode)
+static void dump_completed_IO(struct inode * inode)
 {
 #ifdef  EXT4_DEBUG
         struct list_head *cur, *before, *after;
         ext4_io_end_t *io, *io0, *io1;
+        unsigned long flags;
 
-        if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
-                ext4_debug("inode %lu aio dio list is empty\n", inode->i_ino);
+        if (list_empty(&EXT4_I(inode)->i_completed_io_list)){
+                ext4_debug("inode %lu completed_io list is empty\n", inode->i_ino);
                 return;
         }
 
-        ext4_debug("Dump inode %lu aio_dio_completed_IO list \n", inode->i_ino);
-        list_for_each_entry(io, &EXT4_I(inode)->i_aio_dio_complete_list, list){
+        ext4_debug("Dump inode %lu completed_io list \n", inode->i_ino);
+        spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
+        list_for_each_entry(io, &EXT4_I(inode)->i_completed_io_list, list){
                 cur = &io->list;
                 before = cur->prev;
                 io0 = container_of(before, ext4_io_end_t, list);
@@ -3541,32 +3606,31 @@ static void dump_aio_dio_list(struct inode * inode)
                 ext4_debug("io 0x%p from inode %lu,prev 0x%p,next 0x%p\n",
                             io, inode->i_ino, io0, io1);
         }
+        spin_unlock_irqrestore(&EXT4_I(inode)->i_completed_io_lock, flags);
 #endif
 }
 
 /*
  * check a range of space and convert unwritten extents to written.
  */
-static int ext4_end_aio_dio_nolock(ext4_io_end_t *io)
+static int ext4_end_io_nolock(ext4_io_end_t *io)
 {
         struct inode *inode = io->inode;
         loff_t offset = io->offset;
-        size_t size = io->size;
+        ssize_t size = io->size;
         int ret = 0;
 
-        ext4_debug("end_aio_dio_onlock: io 0x%p from inode %lu,list->next 0x%p,"
+        ext4_debug("ext4_end_io_nolock: io 0x%p from inode %lu,list->next 0x%p,"
                    "list->prev 0x%p\n",
                    io, inode->i_ino, io->list.next, io->list.prev);
 
         if (list_empty(&io->list))
                 return ret;
 
-        if (io->flag != DIO_AIO_UNWRITTEN)
+        if (io->flag != EXT4_IO_UNWRITTEN)
                 return ret;
 
-        if (offset + size <= i_size_read(inode))
-                ret = ext4_convert_unwritten_extents(inode, offset, size);
-
+        ret = ext4_convert_unwritten_extents(inode, offset, size);
         if (ret < 0) {
                 printk(KERN_EMERG "%s: failed to convert unwritten"
                         "extents to written extents, error is %d"
@@ -3579,50 +3643,64 @@ static int ext4_end_aio_dio_nolock(ext4_io_end_t *io)
         io->flag = 0;
         return ret;
 }
+
 /*
  * work on completed aio dio IO, to convert unwritten extents to extents
  */
-static void ext4_end_aio_dio_work(struct work_struct *work)
+static void ext4_end_io_work(struct work_struct *work)
 {
-        ext4_io_end_t *io  = container_of(work, ext4_io_end_t, work);
-        struct inode *inode = io->inode;
-        int ret = 0;
+        ext4_io_end_t           *io = container_of(work, ext4_io_end_t, work);
+        struct inode            *inode = io->inode;
+        struct ext4_inode_info  *ei = EXT4_I(inode);
+        unsigned long           flags;
+        int                     ret;
 
         mutex_lock(&inode->i_mutex);
-        ret = ext4_end_aio_dio_nolock(io);
-        if (ret >= 0) {
-                if (!list_empty(&io->list))
-                        list_del_init(&io->list);
-                ext4_free_io_end(io);
+        ret = ext4_end_io_nolock(io);
+        if (ret < 0) {
+                mutex_unlock(&inode->i_mutex);
+                return;
         }
+
+        spin_lock_irqsave(&ei->i_completed_io_lock, flags);
+        if (!list_empty(&io->list))
+                list_del_init(&io->list);
+        spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
         mutex_unlock(&inode->i_mutex);
+        ext4_free_io_end(io);
 }
+
 /*
  * This function is called from ext4_sync_file().
  *
- * When AIO DIO IO is completed, the work to convert unwritten
- * extents to written is queued on workqueue but may not get immediately
+ * When IO is completed, the work to convert unwritten extents to
+ * written is queued on workqueue but may not get immediately
  * scheduled. When fsync is called, we need to ensure the
  * conversion is complete before fsync returns.
- * The inode keeps track of a list of completed AIO from DIO path
- * that might needs to do the conversion. This function walks through
- * the list and convert the related unwritten extents to written.
+ * The inode keeps track of a list of pending/completed IO that
+ * might needs to do the conversion. This function walks through
+ * the list and convert the related unwritten extents for completed IO
+ * to written.
+ * The function return the number of pending IOs on success.
  */
-int flush_aio_dio_completed_IO(struct inode *inode)
+int flush_completed_IO(struct inode *inode)
 {
         ext4_io_end_t *io;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned long flags;
         int ret = 0;
         int ret2 = 0;
 
-        if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list))
+        if (list_empty(&ei->i_completed_io_list))
                 return ret;
 
-        dump_aio_dio_list(inode);
-        while (!list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
-                io = list_entry(EXT4_I(inode)->i_aio_dio_complete_list.next,
+        dump_completed_IO(inode);
+        spin_lock_irqsave(&ei->i_completed_io_lock, flags);
+        while (!list_empty(&ei->i_completed_io_list)){
+                io = list_entry(ei->i_completed_io_list.next,
                                 ext4_io_end_t, list);
                 /*
-                 * Calling ext4_end_aio_dio_nolock() to convert completed
+                 * Calling ext4_end_io_nolock() to convert completed
                  * IO to written.
                  *
                  * When ext4_sync_file() is called, run_queue() may already
@@ -3635,20 +3713,23 @@ int flush_aio_dio_completed_IO(struct inode *inode)
                  * avoid double converting from both fsync and background work
                  * queue work.
                  */
-                ret = ext4_end_aio_dio_nolock(io);
+                spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
+                ret = ext4_end_io_nolock(io);
+                spin_lock_irqsave(&ei->i_completed_io_lock, flags);
                 if (ret < 0)
                         ret2 = ret;
                 else
                         list_del_init(&io->list);
         }
+        spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
         return (ret2 < 0) ? ret2 : 0;
 }
 
-static ext4_io_end_t *ext4_init_io_end (struct inode *inode)
+static ext4_io_end_t *ext4_init_io_end (struct inode *inode, gfp_t flags)
 {
         ext4_io_end_t *io = NULL;
 
-        io = kmalloc(sizeof(*io), GFP_NOFS);
+        io = kmalloc(sizeof(*io), flags);
 
         if (io) {
                 igrab(inode);
@@ -3656,8 +3737,8 @@ static ext4_io_end_t *ext4_init_io_end (struct inode *inode)
                 io->flag = 0;
                 io->offset = 0;
                 io->size = 0;
-                io->error = 0;
-                INIT_WORK(&io->work, ext4_end_aio_dio_work);
+                io->page = NULL;
+                INIT_WORK(&io->work, ext4_end_io_work);
                 INIT_LIST_HEAD(&io->list);
         }
 
@@ -3669,6 +3750,8 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
 {
         ext4_io_end_t *io_end = iocb->private;
         struct workqueue_struct *wq;
+        unsigned long flags;
+        struct ext4_inode_info *ei;
 
         /* if not async direct IO or dio with 0 bytes write, just return */
         if (!io_end || !size)
@@ -3680,7 +3763,7 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
                   size);
 
         /* if not aio dio with unwritten extents, just free io and return */
-        if (io_end->flag != DIO_AIO_UNWRITTEN){
+        if (io_end->flag != EXT4_IO_UNWRITTEN){
                 ext4_free_io_end(io_end);
                 iocb->private = NULL;
                 return;
@@ -3688,16 +3771,85 @@ static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
 
         io_end->offset = offset;
         io_end->size = size;
+        io_end->flag = EXT4_IO_UNWRITTEN;
         wq = EXT4_SB(io_end->inode->i_sb)->dio_unwritten_wq;
 
         /* queue the work to convert unwritten extents to written */
         queue_work(wq, &io_end->work);
 
         /* Add the io_end to per-inode completed aio dio list*/
-        list_add_tail(&io_end->list,
-                 &EXT4_I(io_end->inode)->i_aio_dio_complete_list);
+        ei = EXT4_I(io_end->inode);
+        spin_lock_irqsave(&ei->i_completed_io_lock, flags);
+        list_add_tail(&io_end->list, &ei->i_completed_io_list);
+        spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
         iocb->private = NULL;
 }
+
+static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate)
+{
+        ext4_io_end_t *io_end = bh->b_private;
+        struct workqueue_struct *wq;
+        struct inode *inode;
+        unsigned long flags;
+
+        if (!test_clear_buffer_uninit(bh) || !io_end)
+                goto out;
+
+        if (!(io_end->inode->i_sb->s_flags & MS_ACTIVE)) {
+                printk("sb umounted, discard end_io request for inode %lu\n",
+                        io_end->inode->i_ino);
+                ext4_free_io_end(io_end);
+                goto out;
+        }
+
+        io_end->flag = EXT4_IO_UNWRITTEN;
+        inode = io_end->inode;
+
+        /* Add the io_end to per-inode completed io list*/
+        spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
+        list_add_tail(&io_end->list, &EXT4_I(inode)->i_completed_io_list);
+        spin_unlock_irqrestore(&EXT4_I(inode)->i_completed_io_lock, flags);
+
+        wq = EXT4_SB(inode->i_sb)->dio_unwritten_wq;
+        /* queue the work to convert unwritten extents to written */
+        queue_work(wq, &io_end->work);
+out:
+        bh->b_private = NULL;
+        bh->b_end_io = NULL;
+        clear_buffer_uninit(bh);
+        end_buffer_async_write(bh, uptodate);
+}
+
+static int ext4_set_bh_endio(struct buffer_head *bh, struct inode *inode)
+{
+        ext4_io_end_t *io_end;
+        struct page *page = bh->b_page;
+        loff_t offset = (sector_t)page->index << PAGE_CACHE_SHIFT;
+        size_t size = bh->b_size;
+
+retry:
+        io_end = ext4_init_io_end(inode, GFP_ATOMIC);
+        if (!io_end) {
+                if (printk_ratelimit())
+                        printk(KERN_WARNING "%s: allocation fail\n", __func__);
+                schedule();
+                goto retry;
+        }
+        io_end->offset = offset;
+        io_end->size = size;
+        /*
+         * We need to hold a reference to the page to make sure it
+         * doesn't get evicted before ext4_end_io_work() has a chance
+         * to convert the extent from written to unwritten.
+         */
+        io_end->page = page;
+        get_page(io_end->page);
+
+        bh->b_private = io_end;
+        bh->b_end_io = ext4_end_io_buffer_write;
+        return 0;
+}
+
 /*
  * For ext4 extent files, ext4 will do direct-io write to holes,
  * preallocated extents, and those write extend the file, no need to
@@ -3751,7 +3903,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 iocb->private = NULL;
                 EXT4_I(inode)->cur_aio_dio = NULL;
                 if (!is_sync_kiocb(iocb)) {
-                        iocb->private = ext4_init_io_end(inode);
+                        iocb->private = ext4_init_io_end(inode, GFP_NOFS);
                         if (!iocb->private)
                                 return -ENOMEM;
                         /*
@@ -3767,7 +3919,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 ret = blockdev_direct_IO(rw, iocb, inode,
                                          inode->i_sb->s_bdev, iov,
                                          offset, nr_segs,
-                                         ext4_get_block_dio_write,
+                                         ext4_get_block_write,
                                          ext4_end_io_dio);
                 if (iocb->private)
                         EXT4_I(inode)->cur_aio_dio = NULL;
@@ -3788,8 +3940,8 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                 if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
                         ext4_free_io_end(iocb->private);
                         iocb->private = NULL;
-                } else if (ret > 0 && (EXT4_I(inode)->i_state &
-                                       EXT4_STATE_DIO_UNWRITTEN)) {
+                } else if (ret > 0 && ext4_test_inode_state(inode,
+                                                EXT4_STATE_DIO_UNWRITTEN)) {
                         int err;
                         /*
                          * for non AIO case, since the IO is already
@@ -3799,7 +3951,7 @@ static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
                                                              offset, ret);
                         if (err < 0)
                                 ret = err;
-                        EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+                        ext4_clear_inode_state(inode, EXT4_STATE_DIO_UNWRITTEN);
                 }
                 return ret;
         }
@@ -4130,18 +4282,27 @@ no_top:
  * We release `count' blocks on disk, but (last - first) may be greater
  * than `count' because there can be holes in there.
  */
-static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
-                              struct buffer_head *bh,
-                              ext4_fsblk_t block_to_free,
-                              unsigned long count, __le32 *first,
-                              __le32 *last)
+static int ext4_clear_blocks(handle_t *handle, struct inode *inode,
+                             struct buffer_head *bh,
+                             ext4_fsblk_t block_to_free,
+                             unsigned long count, __le32 *first,
+                             __le32 *last)
 {
         __le32 *p;
-        int     flags = EXT4_FREE_BLOCKS_FORGET;
+        int     flags = EXT4_FREE_BLOCKS_FORGET | EXT4_FREE_BLOCKS_VALIDATED;
 
         if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))
                 flags |= EXT4_FREE_BLOCKS_METADATA;
 
+        if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), block_to_free,
+                                   count)) {
+                ext4_error(inode->i_sb, "inode #%lu: "
+                           "attempt to clear blocks %llu len %lu, invalid",
+                           inode->i_ino, (unsigned long long) block_to_free,
+                           count);
+                return 1;
+        }
+
         if (try_to_extend_transaction(handle, inode)) {
                 if (bh) {
                         BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
@@ -4160,6 +4321,7 @@ static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
                 *p = 0;
 
         ext4_free_blocks(handle, inode, 0, block_to_free, count, flags);
+        return 0;
 }
 
 /**
@@ -4215,9 +4377,10 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                         } else if (nr == block_to_free + count) {
                                 count++;
                         } else {
-                                ext4_clear_blocks(handle, inode, this_bh,
-                                                  block_to_free,
-                                                  count, block_to_free_p, p);
+                                if (ext4_clear_blocks(handle, inode, this_bh,
+                                                      block_to_free, count,
+                                                      block_to_free_p, p))
+                                        break;
                                 block_to_free = nr;
                                 block_to_free_p = p;
                                 count = 1;
@@ -4241,7 +4404,7 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                 if ((EXT4_JOURNAL(inode) == NULL) || bh2jh(this_bh))
                         ext4_handle_dirty_metadata(handle, inode, this_bh);
                 else
-                        ext4_error(inode->i_sb, __func__,
+                        ext4_error(inode->i_sb,
                                    "circular indirect block detected, "
                                    "inode=%lu, block=%llu",
                                    inode->i_ino,
@@ -4281,6 +4444,16 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
                         if (!nr)
                                 continue;               /* A hole */
 
+                        if (!ext4_data_block_valid(EXT4_SB(inode->i_sb),
+                                                   nr, 1)) {
+                                ext4_error(inode->i_sb,
+                                           "indirect mapped block in inode "
+                                           "#%lu invalid (level %d, blk #%lu)",
+                                           inode->i_ino, depth,
+                                           (unsigned long) nr);
+                                break;
+                        }
+
                         /* Go read the buffer for the next level down */
                         bh = sb_bread(inode->i_sb, nr);
 
@@ -4289,7 +4462,7 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
                          * (should be rare).
                          */
                         if (!bh) {
-                                ext4_error(inode->i_sb, "ext4_free_branches",
+                                ext4_error(inode->i_sb,
                                            "Read failure, inode=%lu, block=%llu",
                                            inode->i_ino, nr);
                                 continue;
@@ -4433,8 +4606,10 @@ void ext4_truncate(struct inode *inode)
         if (!ext4_can_truncate(inode))
                 return;
 
+        EXT4_I(inode)->i_flags &= ~EXT4_EOFBLOCKS_FL;
+
         if (inode->i_size == 0 && !test_opt(inode->i_sb, NO_AUTO_DA_ALLOC))
-                ei->i_state |= EXT4_STATE_DA_ALLOC_CLOSE;
+                ext4_set_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE);
 
         if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
                 ext4_ext_truncate(inode);
@@ -4604,9 +4779,8 @@ static int __ext4_get_inode_loc(struct inode *inode,
 
         bh = sb_getblk(sb, block);
         if (!bh) {
-                ext4_error(sb, "ext4_get_inode_loc", "unable to read "
-                           "inode block - inode=%lu, block=%llu",
-                           inode->i_ino, block);
+                ext4_error(sb, "unable to read inode block - "
+                           "inode=%lu, block=%llu", inode->i_ino, block);
                 return -EIO;
         }
         if (!buffer_uptodate(bh)) {
@@ -4704,9 +4878,8 @@ make_io:
                 submit_bh(READ_META, bh);
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh)) {
-                        ext4_error(sb, __func__,
-                                   "unable to read inode block - inode=%lu, "
-                                   "block=%llu", inode->i_ino, block);
+                        ext4_error(sb, "unable to read inode block - inode=%lu,"
+                                   " block=%llu", inode->i_ino, block);
                         brelse(bh);
                         return -EIO;
                 }
@@ -4720,7 +4893,7 @@ int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
 {
         /* We have all inode data except xattrs in memory here. */
         return __ext4_get_inode_loc(inode, iloc,
-                !(EXT4_I(inode)->i_state & EXT4_STATE_XATTR));
+                !ext4_test_inode_state(inode, EXT4_STATE_XATTR));
 }
 
 void ext4_set_inode_flags(struct inode *inode)
@@ -4814,7 +4987,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
         }
         inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
 
-        ei->i_state = 0;
+        ei->i_state_flags = 0;
         ei->i_dir_start_lookup = 0;
         ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
         /* We now have enough fields to check if the inode was active or not.
@@ -4897,7 +5070,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
                                         EXT4_GOOD_OLD_INODE_SIZE +
                                         ei->i_extra_isize;
                         if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC))
-                                ei->i_state |= EXT4_STATE_XATTR;
+                                ext4_set_inode_state(inode, EXT4_STATE_XATTR);
                 }
         } else
                 ei->i_extra_isize = 0;
@@ -4917,8 +5090,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
         ret = 0;
         if (ei->i_file_acl &&
             !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
-                ext4_error(sb, __func__,
-                           "bad extended attribute block %llu in inode #%lu",
+                ext4_error(sb, "bad extended attribute block %llu inode #%lu",
                            ei->i_file_acl, inode->i_ino);
                 ret = -EIO;
                 goto bad_inode;
@@ -4964,8 +5136,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
                            new_decode_dev(le32_to_cpu(raw_inode->i_block[1])));
         } else {
                 ret = -EIO;
-                ext4_error(inode->i_sb, __func__,
-                           "bogus i_mode (%o) for inode=%lu",
+                ext4_error(inode->i_sb, "bogus i_mode (%o) for inode=%lu",
                            inode->i_mode, inode->i_ino);
                 goto bad_inode;
         }
@@ -5037,7 +5208,7 @@ static int ext4_do_update_inode(handle_t *handle,
 
         /* For fields not not tracking in the in-memory inode,
          * initialise them to zero for new inodes. */
-        if (ei->i_state & EXT4_STATE_NEW)
+        if (ext4_test_inode_state(inode, EXT4_STATE_NEW))
                 memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
 
         ext4_get_inode_flags(ei);
@@ -5101,7 +5272,7 @@ static int ext4_do_update_inode(handle_t *handle,
                                         EXT4_FEATURE_RO_COMPAT_LARGE_FILE);
                         sb->s_dirt = 1;
                         ext4_handle_sync(handle);
-                        err = ext4_handle_dirty_metadata(handle, inode,
+                        err = ext4_handle_dirty_metadata(handle, NULL,
                                         EXT4_SB(sb)->s_sbh);
                 }
         }
@@ -5130,10 +5301,10 @@ static int ext4_do_update_inode(handle_t *handle,
         }
 
         BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
-        rc = ext4_handle_dirty_metadata(handle, inode, bh);
+        rc = ext4_handle_dirty_metadata(handle, NULL, bh);
         if (!err)
                 err = rc;
-        ei->i_state &= ~EXT4_STATE_NEW;
+        ext4_clear_inode_state(inode, EXT4_STATE_NEW);
 
         ext4_update_inode_fsync_trans(handle, inode, 0);
 out_brelse:
@@ -5177,7 +5348,7 @@ out_brelse:
  * `stuff()' is running, and the new i_size will be lost.  Plus the inode
  * will no longer be on the superblock's dirty inode list.
  */
-int ext4_write_inode(struct inode *inode, int wait)
+int ext4_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int err;
 
@@ -5191,7 +5362,7 @@ int ext4_write_inode(struct inode *inode, int wait)
                         return -EIO;
                 }
 
-                if (!wait)
+                if (wbc->sync_mode != WB_SYNC_ALL)
                         return 0;
 
                 err = ext4_force_commit(inode->i_sb);
@@ -5201,13 +5372,11 @@ int ext4_write_inode(struct inode *inode, int wait)
                 err = ext4_get_inode_loc(inode, &iloc);
                 if (err)
                         return err;
-                if (wait)
+                if (wbc->sync_mode == WB_SYNC_ALL)
                         sync_dirty_buffer(iloc.bh);
                 if (buffer_req(iloc.bh) && !buffer_uptodate(iloc.bh)) {
-                        ext4_error(inode->i_sb, __func__,
-                                   "IO error syncing inode, "
-                                   "inode=%lu, block=%llu",
-                                   inode->i_ino,
+                        ext4_error(inode->i_sb, "IO error syncing inode, "
+                                   "inode=%lu, block=%llu", inode->i_ino,
                                    (unsigned long long)iloc.bh->b_blocknr);
                         err = -EIO;
                 }
@@ -5288,7 +5457,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         if (S_ISREG(inode->i_mode) &&
-            attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
+            attr->ia_valid & ATTR_SIZE &&
+            (attr->ia_size < inode->i_size ||
+             (EXT4_I(inode)->i_flags & EXT4_EOFBLOCKS_FL))) {
                 handle_t *handle;
 
                 handle = ext4_journal_start(inode, 3);
@@ -5319,6 +5490,9 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
                                 goto err_out;
                         }
                 }
+                /* ext4_truncate will clear the flag */
+                if ((EXT4_I(inode)->i_flags & EXT4_EOFBLOCKS_FL))
+                        ext4_truncate(inode);
         }
 
         rc = inode_setattr(inode, attr);
@@ -5557,8 +5731,8 @@ static int ext4_expand_extra_isize(struct inode *inode,
         entry = IFIRST(header);
 
         /* No extended attributes present */
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR) ||
-                header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
+        if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
+            header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
                 memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
                         new_extra_isize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
@@ -5602,7 +5776,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
         err = ext4_reserve_inode_write(handle, inode, &iloc);
         if (ext4_handle_valid(handle) &&
             EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
-            !(EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND)) {
+            !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
                 /*
                  * We need extra buffer credits since we may write into EA block
                  * with this same handle. If journal_extend fails, then it will
@@ -5616,10 +5790,11 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
                                                       sbi->s_want_extra_isize,
                                                       iloc, handle);
                         if (ret) {
-                                EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
+                                ext4_set_inode_state(inode,
+                                                     EXT4_STATE_NO_EXPAND);
                                 if (mnt_count !=
                                         le16_to_cpu(sbi->s_es->s_mnt_count)) {
-                                        ext4_warning(inode->i_sb, __func__,
+                                        ext4_warning(inode->i_sb,
                                         "Unable to expand inode %lu. Delete"
                                         " some EAs or run e2fsck.",
                                         inode->i_ino);
@@ -5683,7 +5858,7 @@ static int ext4_pin_inode(handle_t *handle, struct inode *inode)
                         err = jbd2_journal_get_write_access(handle, iloc.bh);
                         if (!err)
                                 err = ext4_handle_dirty_metadata(handle,
-                                                                 inode,
+                                                                 NULL,
                                                                  iloc.bh);
                         brelse(iloc.bh);
                 }
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index b63d193126db..016d0249294f 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -92,6 +92,15 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                         flags &= ~EXT4_EXTENTS_FL;
                 }
 
+                if (flags & EXT4_EOFBLOCKS_FL) {
+                        /* we don't support adding EOFBLOCKS flag */
+                        if (!(oldflags & EXT4_EOFBLOCKS_FL)) {
+                                err = -EOPNOTSUPP;
+                                goto flags_out;
+                        }
+                } else if (oldflags & EXT4_EOFBLOCKS_FL)
+                        ext4_truncate(inode);
+
                 handle = ext4_journal_start(inode, 1);
                 if (IS_ERR(handle)) {
                         err = PTR_ERR(handle);
@@ -249,7 +258,8 @@ setversion_out:
                 if (me.moved_len > 0)
                         file_remove_suid(donor_filp);
 
-                if (copy_to_user((struct move_extent *)arg, &me, sizeof(me)))
+                if (copy_to_user((struct move_extent __user *)arg, 
+                                 &me, sizeof(me)))
                         err = -EFAULT;
 mext_out:
                 fput(donor_filp);
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index d34afad3e137..abb11e328b65 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -441,10 +441,9 @@ static void mb_free_blocks_double(struct inode *inode, struct ext4_buddy *e4b,
         for (i = 0; i < count; i++) {
                 if (!mb_test_bit(first + i, e4b->bd_info->bb_bitmap)) {
                         ext4_fsblk_t blocknr;
-                        blocknr = e4b->bd_group * EXT4_BLOCKS_PER_GROUP(sb);
+
+                        blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
                         blocknr += first + i;
-                        blocknr +=
-                            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
                         ext4_grp_locked_error(sb, e4b->bd_group,
                                    __func__, "double-free of inode"
                                    " %lu's block %llu(bit %u in group %u)",
@@ -1255,10 +1254,9 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
 
                 if (!mb_test_bit(block, EXT4_MB_BITMAP(e4b))) {
                         ext4_fsblk_t blocknr;
-                        blocknr = e4b->bd_group * EXT4_BLOCKS_PER_GROUP(sb);
+
+                        blocknr = ext4_group_first_block_no(sb, e4b->bd_group);
                         blocknr += block;
-                        blocknr +=
-                            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
                         ext4_grp_locked_error(sb, e4b->bd_group,
                                    __func__, "double-free of inode"
                                    " %lu's block %llu(bit %u in group %u)",
@@ -1631,7 +1629,6 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
         int max;
         int err;
         struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
-        struct ext4_super_block *es = sbi->s_es;
         struct ext4_free_extent ex;
 
         if (!(ac->ac_flags & EXT4_MB_HINT_TRY_GOAL))
@@ -1648,8 +1645,8 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
         if (max >= ac->ac_g_ex.fe_len && ac->ac_g_ex.fe_len == sbi->s_stripe) {
                 ext4_fsblk_t start;
 
-                start = (e4b->bd_group * EXT4_BLOCKS_PER_GROUP(ac->ac_sb)) +
-                        ex.fe_start + le32_to_cpu(es->s_first_data_block);
+                start = ext4_group_first_block_no(ac->ac_sb, e4b->bd_group) +
+                        ex.fe_start;
                 /* use do_div to get remainder (would be 64-bit modulo) */
                 if (do_div(start, sbi->s_stripe) == 0) {
                         ac->ac_found++;
@@ -1803,8 +1800,8 @@ void ext4_mb_scan_aligned(struct ext4_allocation_context *ac,
         BUG_ON(sbi->s_stripe == 0);
 
         /* find first stripe-aligned block in group */
-        first_group_block = e4b->bd_group * EXT4_BLOCKS_PER_GROUP(sb)
-                + le32_to_cpu(sbi->s_es->s_first_data_block);
+        first_group_block = ext4_group_first_block_no(sb, e4b->bd_group);
+
         a = first_group_block + sbi->s_stripe - 1;
         do_div(a, sbi->s_stripe);
         i = (a * sbi->s_stripe) - first_group_block;
@@ -2256,7 +2253,7 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
 
         INIT_LIST_HEAD(&meta_group_info[i]->bb_prealloc_list);
         init_rwsem(&meta_group_info[i]->alloc_sem);
-        meta_group_info[i]->bb_free_root.rb_node = NULL;
+        meta_group_info[i]->bb_free_root = RB_ROOT;
 
 #ifdef DOUBLE_CHECK
         {
@@ -2560,12 +2557,9 @@ static void release_blocks_on_commit(journal_t *journal, transaction_t *txn)
                 ext4_unlock_group(sb, entry->group);
                 if (test_opt(sb, DISCARD)) {
                         ext4_fsblk_t discard_block;
-                        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
 
-                        discard_block = (ext4_fsblk_t)entry->group *
-                                                EXT4_BLOCKS_PER_GROUP(sb)
-                                        + entry->start_blk
-                                        + le32_to_cpu(es->s_first_data_block);
+                        discard_block = entry->start_blk +
+                                ext4_group_first_block_no(sb, entry->group);
                         trace_ext4_discard_blocks(sb,
                                         (unsigned long long)discard_block,
                                         entry->count);
@@ -2703,14 +2697,11 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
         if (err)
                 goto out_err;
 
-        block = ac->ac_b_ex.fe_group * EXT4_BLOCKS_PER_GROUP(sb)
-                + ac->ac_b_ex.fe_start
-                + le32_to_cpu(es->s_first_data_block);
+        block = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);
 
         len = ac->ac_b_ex.fe_len;
         if (!ext4_data_block_valid(sbi, block, len)) {
-                ext4_error(sb, __func__,
-                           "Allocating blocks %llu-%llu which overlap "
+                ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
                            "fs metadata\n", block, block+len);
                 /* File system mounted not to panic on error
                  * Fix the bitmap and repeat the block allocation
@@ -3161,9 +3152,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)
                 /* The max size of hash table is PREALLOC_TB_SIZE */
                 order = PREALLOC_TB_SIZE - 1;
 
-        goal_block = ac->ac_g_ex.fe_group * EXT4_BLOCKS_PER_GROUP(ac->ac_sb) +
-                     ac->ac_g_ex.fe_start +
-                     le32_to_cpu(EXT4_SB(ac->ac_sb)->s_es->s_first_data_block);
+        goal_block = ext4_grp_offs_to_block(ac->ac_sb, &ac->ac_g_ex);
         /*
          * search for the prealloc space that is having
          * minimal distance from the goal block.
@@ -3526,8 +3515,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
                 if (bit >= end)
                         break;
                 next = mb_find_next_bit(bitmap_bh->b_data, end, bit);
-                start = group * EXT4_BLOCKS_PER_GROUP(sb) + bit +
-                                le32_to_cpu(sbi->s_es->s_first_data_block);
+                start = ext4_group_first_block_no(sb, group) + bit;
                 mb_debug(1, "    free preallocated %u/%u in group %u\n",
                                 (unsigned) start, (unsigned) next - bit,
                                 (unsigned) group);
@@ -3623,15 +3611,13 @@ ext4_mb_discard_group_preallocations(struct super_block *sb,
 
         bitmap_bh = ext4_read_block_bitmap(sb, group);
         if (bitmap_bh == NULL) {
-                ext4_error(sb, __func__, "Error in reading block "
-                                "bitmap for %u", group);
+                ext4_error(sb, "Error reading block bitmap for %u", group);
                 return 0;
         }
 
         err = ext4_mb_load_buddy(sb, group, &e4b);
         if (err) {
-                ext4_error(sb, __func__, "Error in loading buddy "
-                                "information for %u", group);
+                ext4_error(sb, "Error loading buddy information for %u", group);
                 put_bh(bitmap_bh);
                 return 0;
         }
@@ -3804,15 +3790,15 @@ repeat:
 
                 err = ext4_mb_load_buddy(sb, group, &e4b);
                 if (err) {
-                        ext4_error(sb, __func__, "Error in loading buddy "
-                                        "information for %u", group);
+                        ext4_error(sb, "Error loading buddy information for %u",
+                                        group);
                         continue;
                 }
 
                 bitmap_bh = ext4_read_block_bitmap(sb, group);
                 if (bitmap_bh == NULL) {
-                        ext4_error(sb, __func__, "Error in reading block "
-                                        "bitmap for %u", group);
+                        ext4_error(sb, "Error reading block bitmap for %u",
+                                        group);
                         ext4_mb_release_desc(&e4b);
                         continue;
                 }
@@ -3938,7 +3924,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac)
 
         /* don't use group allocation for large files */
         size = max(size, isize);
-        if (size >= sbi->s_mb_stream_request) {
+        if (size > sbi->s_mb_stream_request) {
                 ac->ac_flags |= EXT4_MB_STREAM_ALLOC;
                 return;
         }
@@ -4077,8 +4063,8 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
 
                 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, NULL);
                 if (ext4_mb_load_buddy(sb, group, &e4b)) {
-                        ext4_error(sb, __func__, "Error in loading buddy "
-                                        "information for %u", group);
+                        ext4_error(sb, "Error loading buddy information for %u",
+                                        group);
                         continue;
                 }
                 ext4_lock_group(sb, group);
@@ -4476,10 +4462,10 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
 
         sbi = EXT4_SB(sb);
         es = EXT4_SB(sb)->s_es;
-        if (!ext4_data_block_valid(sbi, block, count)) {
-                ext4_error(sb, __func__,
-                            "Freeing blocks not in datazone - "
-                            "block = %llu, count = %lu", block, count);
+        if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
+            !ext4_data_block_valid(sbi, block, count)) {
+                ext4_error(sb, "Freeing blocks not in datazone - "
+                           "block = %llu, count = %lu", block, count);
                 goto error_return;
         }
 
@@ -4547,8 +4533,7 @@ do_more:
             in_range(block + count - 1, ext4_inode_table(sb, gdp),
                       EXT4_SB(sb)->s_itb_per_group)) {
 
-                ext4_error(sb, __func__,
-                           "Freeing blocks in system zone - "
+                ext4_error(sb, "Freeing blocks in system zone - "
                            "Block = %llu, count = %lu", block, count);
                 /* err = 0. ext4_std_error should be a no op */
                 goto error_return;
diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h
index 436521cae456..b619322c76f0 100644
--- a/fs/ext4/mballoc.h
+++ b/fs/ext4/mballoc.h
@@ -220,16 +220,9 @@ struct ext4_buddy {
 #define EXT4_MB_BITMAP(e4b)     ((e4b)->bd_bitmap)
 #define EXT4_MB_BUDDY(e4b)      ((e4b)->bd_buddy)
 
-#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
-
 static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb,
                                         struct ext4_free_extent *fex)
 {
-        ext4_fsblk_t block;
-
-        block = (ext4_fsblk_t) fex->fe_group * EXT4_BLOCKS_PER_GROUP(sb)
-                        + fex->fe_start
-                        + le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
-        return block;
+        return ext4_group_first_block_no(sb, fex->fe_group) + fex->fe_start;
 }
 #endif
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
index 81415814b00b..8b87bd0eac95 100644
--- a/fs/ext4/migrate.c
+++ b/fs/ext4/migrate.c
@@ -365,12 +365,12 @@ static int ext4_ext_swap_inode_data(handle_t *handle, struct inode *inode,
          * happened after we started the migrate. We need to
          * fail the migrate
          */
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_EXT_MIGRATE)) {
+        if (!ext4_test_inode_state(inode, EXT4_STATE_EXT_MIGRATE)) {
                 retval = -EAGAIN;
                 up_write(&EXT4_I(inode)->i_data_sem);
                 goto err_out;
         } else
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
+                ext4_clear_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
         /*
          * We have the extent map build with the tmp inode.
          * Now copy the i_data across
@@ -503,14 +503,10 @@ int ext4_ext_migrate(struct inode *inode)
         }
         i_size_write(tmp_inode, i_size_read(inode));
         /*
-         * We don't want the inode to be reclaimed
-         * if we got interrupted in between. We have
-         * this tmp inode carrying reference to the
-         * data blocks of the original file. We set
-         * the i_nlink to zero at the last stage after
-         * switching the original file to extent format
+         * Set the i_nlink to zero so it will be deleted later
+         * when we drop inode reference.
          */
-        tmp_inode->i_nlink = 1;
+        tmp_inode->i_nlink = 0;
 
         ext4_ext_tree_init(handle, tmp_inode);
         ext4_orphan_add(handle, tmp_inode);
@@ -533,10 +529,20 @@ int ext4_ext_migrate(struct inode *inode)
          * allocation.
          */
         down_read((&EXT4_I(inode)->i_data_sem));
-        EXT4_I(inode)->i_state |= EXT4_STATE_EXT_MIGRATE;
+        ext4_set_inode_state(inode, EXT4_STATE_EXT_MIGRATE);
         up_read((&EXT4_I(inode)->i_data_sem));
 
         handle = ext4_journal_start(inode, 1);
+        if (IS_ERR(handle)) {
+                /*
+                 * It is impossible to update on-disk structures without
+                 * a handle, so just rollback in-core changes and live other
+                 * work to orphan_list_cleanup()
+                 */
+                ext4_orphan_del(NULL, tmp_inode);
+                retval = PTR_ERR(handle);
+                goto out;
+        }
 
         ei = EXT4_I(inode);
         i_data = ei->i_data;
@@ -618,15 +624,8 @@ err_out:
 
         /* Reset the extent details */
         ext4_ext_tree_init(handle, tmp_inode);
-
-        /*
-         * Set the i_nlink to zero so that
-         * generic_drop_inode really deletes the
-         * inode
-         */
-        tmp_inode->i_nlink = 0;
-
         ext4_journal_stop(handle);
+out:
         unlock_new_inode(tmp_inode);
         iput(tmp_inode);
 
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 82c415be87a4..aa5fe28d180f 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -152,12 +152,12 @@ mext_check_null_inode(struct inode *inode1, struct inode *inode2,
         int ret = 0;
 
         if (inode1 == NULL) {
-                ext4_error(inode2->i_sb, function,
+                __ext4_error(inode2->i_sb, function,
                         "Both inodes should not be NULL: "
                         "inode1 NULL inode2 %lu", inode2->i_ino);
                 ret = -EIO;
         } else if (inode2 == NULL) {
-                ext4_error(inode1->i_sb, function,
+                __ext4_error(inode1->i_sb, function,
                         "Both inodes should not be NULL: "
                         "inode1 %lu inode2 NULL", inode1->i_ino);
                 ret = -EIO;
@@ -252,6 +252,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
                 }
 
                 o_start->ee_len = start_ext->ee_len;
+                eblock = le32_to_cpu(start_ext->ee_block);
                 new_flag = 1;
 
         } else if (start_ext->ee_len && new_ext->ee_len &&
@@ -262,6 +263,7 @@ mext_insert_across_blocks(handle_t *handle, struct inode *orig_inode,
                  * orig  |------------------------------|
                  */
                 o_start->ee_len = start_ext->ee_len;
+                eblock = le32_to_cpu(start_ext->ee_block);
                 new_flag = 1;
 
         } else if (!start_ext->ee_len && new_ext->ee_len &&
@@ -475,7 +477,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
         struct ext4_extent *oext, *o_start, *o_end, *prev_ext;
         struct ext4_extent new_ext, start_ext, end_ext;
         ext4_lblk_t new_ext_end;
-        ext4_fsblk_t new_phys_end;
         int oext_alen, new_ext_alen, end_ext_alen;
         int depth = ext_depth(orig_inode);
         int ret;
@@ -489,7 +490,6 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
         new_ext.ee_len = dext->ee_len;
         new_ext_alen = ext4_ext_get_actual_len(&new_ext);
         new_ext_end = le32_to_cpu(new_ext.ee_block) + new_ext_alen - 1;
-        new_phys_end = ext_pblock(&new_ext) + new_ext_alen - 1;
 
         /*
          * Case: original extent is first
@@ -502,6 +502,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
                 le32_to_cpu(oext->ee_block) + oext_alen) {
                 start_ext.ee_len = cpu_to_le16(le32_to_cpu(new_ext.ee_block) -
                                                le32_to_cpu(oext->ee_block));
+                start_ext.ee_block = oext->ee_block;
                 copy_extent_status(oext, &start_ext);
         } else if (oext > EXT_FIRST_EXTENT(orig_path[depth].p_hdr)) {
                 prev_ext = oext - 1;
@@ -515,6 +516,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
                         start_ext.ee_len = cpu_to_le16(
                                 ext4_ext_get_actual_len(prev_ext) +
                                 new_ext_alen);
+                        start_ext.ee_block = oext->ee_block;
                         copy_extent_status(prev_ext, &start_ext);
                         new_ext.ee_len = 0;
                 }
@@ -526,7 +528,7 @@ mext_leaf_block(handle_t *handle, struct inode *orig_inode,
          * new_ext       |-------|
          */
         if (le32_to_cpu(oext->ee_block) + oext_alen - 1 < new_ext_end) {
-                ext4_error(orig_inode->i_sb, __func__,
+                ext4_error(orig_inode->i_sb,
                         "new_ext_end(%u) should be less than or equal to "
                         "oext->ee_block(%u) + oext_alen(%d) - 1",
                         new_ext_end, le32_to_cpu(oext->ee_block),
@@ -689,12 +691,12 @@ mext_replace_branches(handle_t *handle, struct inode *orig_inode,
         while (1) {
                 /* The extent for donor must be found. */
                 if (!dext) {
-                        ext4_error(donor_inode->i_sb, __func__,
+                        ext4_error(donor_inode->i_sb,
                                    "The extent for donor must be found");
                         *err = -EIO;
                         goto out;
                 } else if (donor_off != le32_to_cpu(tmp_dext.ee_block)) {
-                        ext4_error(donor_inode->i_sb, __func__,
+                        ext4_error(donor_inode->i_sb,
                                 "Donor offset(%u) and the first block of donor "
                                 "extent(%u) should be equal",
                                 donor_off,
@@ -928,7 +930,7 @@ out2:
 }
 
 /**
- * mext_check_argumants - Check whether move extent can be done
+ * mext_check_arguments - Check whether move extent can be done
  *
  * @orig_inode:         original inode
  * @donor_inode:        donor inode
@@ -949,14 +951,6 @@ mext_check_arguments(struct inode *orig_inode,
         unsigned int blkbits = orig_inode->i_blkbits;
         unsigned int blocksize = 1 << blkbits;
 
-        /* Regular file check */
-        if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
-                ext4_debug("ext4 move extent: The argument files should be "
-                        "regular file [ino:orig %lu, donor %lu]\n",
-                        orig_inode->i_ino, donor_inode->i_ino);
-                return -EINVAL;
-        }
-
         if (donor_inode->i_mode & (S_ISUID|S_ISGID)) {
                 ext4_debug("ext4 move extent: suid or sgid is set"
                            " to donor file [ino:orig %lu, donor %lu]\n",
@@ -1204,6 +1198,14 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
                 return -EINVAL;
         }
 
+        /* Regular file check */
+        if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
+                ext4_debug("ext4 move extent: The argument files should be "
+                        "regular file [ino:orig %lu, donor %lu]\n",
+                        orig_inode->i_ino, donor_inode->i_ino);
+                return -EINVAL;
+        }
+
         /* Protect orig and donor inodes against a truncate */
         ret1 = mext_inode_double_lock(orig_inode, donor_inode);
         if (ret1 < 0)
@@ -1351,7 +1353,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
                         if (ret1 < 0)
                                 break;
                         if (*moved_len > len) {
-                                ext4_error(orig_inode->i_sb, __func__,
+                                ext4_error(orig_inode->i_sb,
                                         "We replaced blocks too much! "
                                         "sum of replaced: %llu requested: %llu",
                                         *moved_len, len);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 17a17e10dd60..608d21f873ec 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -383,8 +383,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         if (root->info.hash_version != DX_HASH_TEA &&
             root->info.hash_version != DX_HASH_HALF_MD4 &&
             root->info.hash_version != DX_HASH_LEGACY) {
-                ext4_warning(dir->i_sb, __func__,
-                             "Unrecognised inode hash code %d",
+                ext4_warning(dir->i_sb, "Unrecognised inode hash code %d",
                              root->info.hash_version);
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
@@ -399,8 +398,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         hash = hinfo->hash;
 
         if (root->info.unused_flags & 1) {
-                ext4_warning(dir->i_sb, __func__,
-                             "Unimplemented inode hash flags: %#06x",
+                ext4_warning(dir->i_sb, "Unimplemented inode hash flags: %#06x",
                              root->info.unused_flags);
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
@@ -408,8 +406,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         }
 
         if ((indirect = root->info.indirect_levels) > 1) {
-                ext4_warning(dir->i_sb, __func__,
-                             "Unimplemented inode hash depth: %#06x",
+                ext4_warning(dir->i_sb, "Unimplemented inode hash depth: %#06x",
                              root->info.indirect_levels);
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
@@ -421,8 +418,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
 
         if (dx_get_limit(entries) != dx_root_limit(dir,
                                                    root->info.info_length)) {
-                ext4_warning(dir->i_sb, __func__,
-                             "dx entry: limit != root limit");
+                ext4_warning(dir->i_sb, "dx entry: limit != root limit");
                 brelse(bh);
                 *err = ERR_BAD_DX_DIR;
                 goto fail;
@@ -433,7 +429,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
         {
                 count = dx_get_count(entries);
                 if (!count || count > dx_get_limit(entries)) {
-                        ext4_warning(dir->i_sb, __func__,
+                        ext4_warning(dir->i_sb,
                                      "dx entry: no count or count > limit");
                         brelse(bh);
                         *err = ERR_BAD_DX_DIR;
@@ -478,7 +474,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
                         goto fail2;
                 at = entries = ((struct dx_node *) bh->b_data)->entries;
                 if (dx_get_limit(entries) != dx_node_limit (dir)) {
-                        ext4_warning(dir->i_sb, __func__,
+                        ext4_warning(dir->i_sb,
                                      "dx entry: limit != node limit");
                         brelse(bh);
                         *err = ERR_BAD_DX_DIR;
@@ -494,7 +490,7 @@ fail2:
         }
 fail:
         if (*err == ERR_BAD_DX_DIR)
-                ext4_warning(dir->i_sb, __func__,
+                ext4_warning(dir->i_sb,
                              "Corrupt dir inode %ld, running e2fsck is "
                              "recommended.", dir->i_ino);
         return NULL;
@@ -947,9 +943,8 @@ restart:
                 wait_on_buffer(bh);
                 if (!buffer_uptodate(bh)) {
                         /* read error, skip block & hope for the best */
-                        ext4_error(sb, __func__, "reading directory #%lu "
-                                   "offset %lu", dir->i_ino,
-                                   (unsigned long)block);
+                        ext4_error(sb, "reading directory #%lu offset %lu",
+                                   dir->i_ino, (unsigned long)block);
                         brelse(bh);
                         goto next;
                 }
@@ -1041,7 +1036,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir, const struct q
                 retval = ext4_htree_next_block(dir, hash, frame,
                                                frames, NULL);
                 if (retval < 0) {
-                        ext4_warning(sb, __func__,
+                        ext4_warning(sb,
                              "error reading index page in directory #%lu",
                              dir->i_ino);
                         *err = retval;
@@ -1071,14 +1066,13 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, stru
                 __u32 ino = le32_to_cpu(de->inode);
                 brelse(bh);
                 if (!ext4_valid_inum(dir->i_sb, ino)) {
-                        ext4_error(dir->i_sb, "ext4_lookup",
-                                   "bad inode number: %u", ino);
+                        ext4_error(dir->i_sb, "bad inode number: %u", ino);
                         return ERR_PTR(-EIO);
                 }
                 inode = ext4_iget(dir->i_sb, ino);
                 if (unlikely(IS_ERR(inode))) {
                         if (PTR_ERR(inode) == -ESTALE) {
-                                ext4_error(dir->i_sb, __func__,
+                                ext4_error(dir->i_sb,
                                                 "deleted inode referenced: %u",
                                                 ino);
                                 return ERR_PTR(-EIO);
@@ -1110,7 +1104,7 @@ struct dentry *ext4_get_parent(struct dentry *child)
         brelse(bh);
 
         if (!ext4_valid_inum(child->d_inode->i_sb, ino)) {
-                ext4_error(child->d_inode->i_sb, "ext4_get_parent",
+                ext4_error(child->d_inode->i_sb,
                            "bad inode number: %u", ino);
                 return ERR_PTR(-EIO);
         }
@@ -1410,7 +1404,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         de = (struct ext4_dir_entry_2 *)((char *)fde +
                 ext4_rec_len_from_disk(fde->rec_len, blocksize));
         if ((char *) de >= (((char *) root) + blocksize)) {
-                ext4_error(dir->i_sb, __func__,
+                ext4_error(dir->i_sb,
                            "invalid rec_len for '..' in inode %lu",
                            dir->i_ino);
                 brelse(bh);
@@ -1575,8 +1569,7 @@ static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
 
                 if (levels && (dx_get_count(frames->entries) ==
                                dx_get_limit(frames->entries))) {
-                        ext4_warning(sb, __func__,
-                                     "Directory index full!");
+                        ext4_warning(sb, "Directory index full!");
                         err = -ENOSPC;
                         goto cleanup;
                 }
@@ -1916,11 +1909,11 @@ static int empty_dir(struct inode *inode)
         if (inode->i_size < EXT4_DIR_REC_LEN(1) + EXT4_DIR_REC_LEN(2) ||
             !(bh = ext4_bread(NULL, inode, 0, 0, &err))) {
                 if (err)
-                        ext4_error(inode->i_sb, __func__,
+                        ext4_error(inode->i_sb,
                                    "error %d reading directory #%lu offset 0",
                                    err, inode->i_ino);
                 else
-                        ext4_warning(inode->i_sb, __func__,
+                        ext4_warning(inode->i_sb,
                                      "bad directory (dir #%lu) - no data block",
                                      inode->i_ino);
                 return 1;
@@ -1931,7 +1924,7 @@ static int empty_dir(struct inode *inode)
                         !le32_to_cpu(de1->inode) ||
                         strcmp(".", de->name) ||
                         strcmp("..", de1->name)) {
-                ext4_warning(inode->i_sb, "empty_dir",
+                ext4_warning(inode->i_sb,
                              "bad directory (dir #%lu) - no `.' or `..'",
                              inode->i_ino);
                 brelse(bh);
@@ -1949,7 +1942,7 @@ static int empty_dir(struct inode *inode)
                                 offset >> EXT4_BLOCK_SIZE_BITS(sb), 0, &err);
                         if (!bh) {
                                 if (err)
-                                        ext4_error(sb, __func__,
+                                        ext4_error(sb,
                                                    "error %d reading directory"
                                                    " #%lu offset %u",
                                                    err, inode->i_ino, offset);
@@ -2020,11 +2013,18 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
         err = ext4_reserve_inode_write(handle, inode, &iloc);
         if (err)
                 goto out_unlock;
+        /*
+         * Due to previous errors inode may be already a part of on-disk
+         * orphan list. If so skip on-disk list modification.
+         */
+        if (NEXT_ORPHAN(inode) && NEXT_ORPHAN(inode) <=
+                (le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)))
+                        goto mem_insert;
 
         /* Insert this inode at the head of the on-disk orphan list... */
         NEXT_ORPHAN(inode) = le32_to_cpu(EXT4_SB(sb)->s_es->s_last_orphan);
         EXT4_SB(sb)->s_es->s_last_orphan = cpu_to_le32(inode->i_ino);
-        err = ext4_handle_dirty_metadata(handle, inode, EXT4_SB(sb)->s_sbh);
+        err = ext4_handle_dirty_metadata(handle, NULL, EXT4_SB(sb)->s_sbh);
         rc = ext4_mark_iloc_dirty(handle, inode, &iloc);
         if (!err)
                 err = rc;
@@ -2037,6 +2037,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
          *
          * This is safe: on error we're going to ignore the orphan list
          * anyway on the next recovery. */
+mem_insert:
         if (!err)
                 list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);
 
@@ -2096,7 +2097,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
                 if (err)
                         goto out_brelse;
                 sbi->s_es->s_last_orphan = cpu_to_le32(ino_next);
-                err = ext4_handle_dirty_metadata(handle, inode, sbi->s_sbh);
+                err = ext4_handle_dirty_metadata(handle, NULL, sbi->s_sbh);
         } else {
                 struct ext4_iloc iloc2;
                 struct inode *i_prev =
@@ -2163,7 +2164,7 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
         if (retval)
                 goto end_rmdir;
         if (!EXT4_DIR_LINK_EMPTY(inode))
-                ext4_warning(inode->i_sb, "ext4_rmdir",
+                ext4_warning(inode->i_sb,
                              "empty directory has too many links (%d)",
                              inode->i_nlink);
         inode->i_version++;
@@ -2215,7 +2216,7 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
                 goto end_unlink;
 
         if (!inode->i_nlink) {
-                ext4_warning(inode->i_sb, "ext4_unlink",
+                ext4_warning(inode->i_sb,
                              "Deleting nonexistent file (%lu), %d",
                              inode->i_ino, inode->i_nlink);
                 inode->i_nlink = 1;
@@ -2462,7 +2463,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 }
         }
         if (retval) {
-                ext4_warning(old_dir->i_sb, "ext4_rename",
+                ext4_warning(old_dir->i_sb,
                                 "Deleting old file (%lu), %d, error=%d",
                                 old_dir->i_ino, old_dir->i_nlink, retval);
         }
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 3b2c5541d8a6..5692c48754a0 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -48,65 +48,54 @@ static int verify_group_input(struct super_block *sb,
 
         ext4_get_group_no_and_offset(sb, start, NULL, &offset);
         if (group != sbi->s_groups_count)
-                ext4_warning(sb, __func__,
-                             "Cannot add at group %u (only %u groups)",
+                ext4_warning(sb, "Cannot add at group %u (only %u groups)",
                              input->group, sbi->s_groups_count);
         else if (offset != 0)
-                        ext4_warning(sb, __func__, "Last group not full");
+                        ext4_warning(sb, "Last group not full");
         else if (input->reserved_blocks > input->blocks_count / 5)
-                ext4_warning(sb, __func__, "Reserved blocks too high (%u)",
+                ext4_warning(sb, "Reserved blocks too high (%u)",
                              input->reserved_blocks);
         else if (free_blocks_count < 0)
-                ext4_warning(sb, __func__, "Bad blocks count %u",
+                ext4_warning(sb, "Bad blocks count %u",
                              input->blocks_count);
         else if (!(bh = sb_bread(sb, end - 1)))
-                ext4_warning(sb, __func__,
-                             "Cannot read last block (%llu)",
+                ext4_warning(sb, "Cannot read last block (%llu)",
                              end - 1);
         else if (outside(input->block_bitmap, start, end))
-                ext4_warning(sb, __func__,
-                             "Block bitmap not in group (block %llu)",
+                ext4_warning(sb, "Block bitmap not in group (block %llu)",
                              (unsigned long long)input->block_bitmap);
         else if (outside(input->inode_bitmap, start, end))
-                ext4_warning(sb, __func__,
-                             "Inode bitmap not in group (block %llu)",
+                ext4_warning(sb, "Inode bitmap not in group (block %llu)",
                              (unsigned long long)input->inode_bitmap);
         else if (outside(input->inode_table, start, end) ||
                  outside(itend - 1, start, end))
-                ext4_warning(sb, __func__,
-                             "Inode table not in group (blocks %llu-%llu)",
+                ext4_warning(sb, "Inode table not in group (blocks %llu-%llu)",
                              (unsigned long long)input->inode_table, itend - 1);
         else if (input->inode_bitmap == input->block_bitmap)
-                ext4_warning(sb, __func__,
-                             "Block bitmap same as inode bitmap (%llu)",
+                ext4_warning(sb, "Block bitmap same as inode bitmap (%llu)",
                              (unsigned long long)input->block_bitmap);
         else if (inside(input->block_bitmap, input->inode_table, itend))
-                ext4_warning(sb, __func__,
-                             "Block bitmap (%llu) in inode table (%llu-%llu)",
+                ext4_warning(sb, "Block bitmap (%llu) in inode table "
+                             "(%llu-%llu)",
                              (unsigned long long)input->block_bitmap,
                              (unsigned long long)input->inode_table, itend - 1);
         else if (inside(input->inode_bitmap, input->inode_table, itend))
-                ext4_warning(sb, __func__,
-                             "Inode bitmap (%llu) in inode table (%llu-%llu)",
+                ext4_warning(sb, "Inode bitmap (%llu) in inode table "
+                             "(%llu-%llu)",
                              (unsigned long long)input->inode_bitmap,
                              (unsigned long long)input->inode_table, itend - 1);
         else if (inside(input->block_bitmap, start, metaend))
-                ext4_warning(sb, __func__,
-                             "Block bitmap (%llu) in GDT table"
-                             " (%llu-%llu)",
+                ext4_warning(sb, "Block bitmap (%llu) in GDT table (%llu-%llu)",
                              (unsigned long long)input->block_bitmap,
                              start, metaend - 1);
         else if (inside(input->inode_bitmap, start, metaend))
-                ext4_warning(sb, __func__,
-                             "Inode bitmap (%llu) in GDT table"
-                             " (%llu-%llu)",
+                ext4_warning(sb, "Inode bitmap (%llu) in GDT table (%llu-%llu)",
                              (unsigned long long)input->inode_bitmap,
                              start, metaend - 1);
         else if (inside(input->inode_table, start, metaend) ||
                  inside(itend - 1, start, metaend))
-                ext4_warning(sb, __func__,
-                             "Inode table (%llu-%llu) overlaps"
-                             "GDT table (%llu-%llu)",
+                ext4_warning(sb, "Inode table (%llu-%llu) overlaps GDT table "
+                             "(%llu-%llu)",
                              (unsigned long long)input->inode_table,
                              itend - 1, start, metaend - 1);
         else
@@ -364,8 +353,7 @@ static int verify_reserved_gdb(struct super_block *sb,
         while ((grp = ext4_list_backups(sb, &three, &five, &seven)) < end) {
                 if (le32_to_cpu(*p++) !=
                     grp * EXT4_BLOCKS_PER_GROUP(sb) + blk){
-                        ext4_warning(sb, __func__,
-                                     "reserved GDT %llu"
+                        ext4_warning(sb, "reserved GDT %llu"
                                      " missing grp %d (%llu)",
                                      blk, grp,
                                      grp *
@@ -420,8 +408,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
          */
         if (EXT4_SB(sb)->s_sbh->b_blocknr !=
             le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
-                ext4_warning(sb, __func__,
-                        "won't resize using backup superblock at %llu",
+                ext4_warning(sb, "won't resize using backup superblock at %llu",
                         (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
                 return -EPERM;
         }
@@ -444,8 +431,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
 
         data = (__le32 *)dind->b_data;
         if (le32_to_cpu(data[gdb_num % EXT4_ADDR_PER_BLOCK(sb)]) != gdblock) {
-                ext4_warning(sb, __func__,
-                             "new group %u GDT block %llu not reserved",
+                ext4_warning(sb, "new group %u GDT block %llu not reserved",
                              input->group, gdblock);
                 err = -EINVAL;
                 goto exit_dind;
@@ -468,7 +454,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
                         GFP_NOFS);
         if (!n_group_desc) {
                 err = -ENOMEM;
-                ext4_warning(sb, __func__,
+                ext4_warning(sb,
                               "not enough memory for %lu groups", gdb_num + 1);
                 goto exit_inode;
         }
@@ -567,8 +553,7 @@ static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
         /* Get each reserved primary GDT block and verify it holds backups */
         for (res = 0; res < reserved_gdb; res++, blk++) {
                 if (le32_to_cpu(*data) != blk) {
-                        ext4_warning(sb, __func__,
-                                     "reserved block %llu"
+                        ext4_warning(sb, "reserved block %llu"
                                      " not at offset %ld",
                                      blk,
                                      (long)(data - (__le32 *)dind->b_data));
@@ -713,8 +698,7 @@ static void update_backups(struct super_block *sb,
          */
 exit_err:
         if (err) {
-                ext4_warning(sb, __func__,
-                             "can't update backup for group %u (err %d), "
+                ext4_warning(sb, "can't update backup for group %u (err %d), "
                              "forcing fsck on next reboot", group, err);
                 sbi->s_mount_state &= ~EXT4_VALID_FS;
                 sbi->s_es->s_state &= cpu_to_le16(~EXT4_VALID_FS);
@@ -753,20 +737,19 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
 
         if (gdb_off == 0 && !EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                         EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER)) {
-                ext4_warning(sb, __func__,
-                             "Can't resize non-sparse filesystem further");
+                ext4_warning(sb, "Can't resize non-sparse filesystem further");
                 return -EPERM;
         }
 
         if (ext4_blocks_count(es) + input->blocks_count <
             ext4_blocks_count(es)) {
-                ext4_warning(sb, __func__, "blocks_count overflow");
+                ext4_warning(sb, "blocks_count overflow");
                 return -EINVAL;
         }
 
         if (le32_to_cpu(es->s_inodes_count) + EXT4_INODES_PER_GROUP(sb) <
             le32_to_cpu(es->s_inodes_count)) {
-                ext4_warning(sb, __func__, "inodes_count overflow");
+                ext4_warning(sb, "inodes_count overflow");
                 return -EINVAL;
         }
 
@@ -774,14 +757,13 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
                 if (!EXT4_HAS_COMPAT_FEATURE(sb,
                                              EXT4_FEATURE_COMPAT_RESIZE_INODE)
                     || !le16_to_cpu(es->s_reserved_gdt_blocks)) {
-                        ext4_warning(sb, __func__,
+                        ext4_warning(sb,
                                      "No reserved GDT blocks, can't resize");
                         return -EPERM;
                 }
                 inode = ext4_iget(sb, EXT4_RESIZE_INO);
                 if (IS_ERR(inode)) {
-                        ext4_warning(sb, __func__,
-                                     "Error opening resize inode");
+                        ext4_warning(sb, "Error opening resize inode");
                         return PTR_ERR(inode);
                 }
         }
@@ -810,8 +792,7 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
 
         mutex_lock(&sbi->s_resize_lock);
         if (input->group != sbi->s_groups_count) {
-                ext4_warning(sb, __func__,
-                             "multiple resizers run on filesystem!");
+                ext4_warning(sb, "multiple resizers run on filesystem!");
                 err = -EBUSY;
                 goto exit_journal;
         }
@@ -997,13 +978,12 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
                         " too large to resize to %llu blocks safely\n",
                         sb->s_id, n_blocks_count);
                 if (sizeof(sector_t) < 8)
-                        ext4_warning(sb, __func__, "CONFIG_LBDAF not enabled");
+                        ext4_warning(sb, "CONFIG_LBDAF not enabled");
                 return -EINVAL;
         }
 
         if (n_blocks_count < o_blocks_count) {
-                ext4_warning(sb, __func__,
-                             "can't shrink FS - resize aborted");
+                ext4_warning(sb, "can't shrink FS - resize aborted");
                 return -EBUSY;
         }
 
@@ -1011,15 +991,14 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
         ext4_get_group_no_and_offset(sb, o_blocks_count, &group, &last);
 
         if (last == 0) {
-                ext4_warning(sb, __func__,
-                             "need to use ext2online to resize further");
+                ext4_warning(sb, "need to use ext2online to resize further");
                 return -EPERM;
         }
 
         add = EXT4_BLOCKS_PER_GROUP(sb) - last;
 
         if (o_blocks_count + add < o_blocks_count) {
-                ext4_warning(sb, __func__, "blocks_count overflow");
+                ext4_warning(sb, "blocks_count overflow");
                 return -EINVAL;
         }
 
@@ -1027,16 +1006,13 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
                 add = n_blocks_count - o_blocks_count;
 
         if (o_blocks_count + add < n_blocks_count)
-                ext4_warning(sb, __func__,
-                             "will only finish group (%llu"
-                             " blocks, %u new)",
+                ext4_warning(sb, "will only finish group (%llu blocks, %u new)",
                              o_blocks_count + add, add);
 
         /* See if the device is actually as big as what was requested */
         bh = sb_bread(sb, o_blocks_count + add - 1);
         if (!bh) {
-                ext4_warning(sb, __func__,
-                             "can't read last block, resize aborted");
+                ext4_warning(sb, "can't read last block, resize aborted");
                 return -ENOSPC;
         }
         brelse(bh);
@@ -1047,14 +1023,13 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
         handle = ext4_journal_start_sb(sb, 3);
         if (IS_ERR(handle)) {
                 err = PTR_ERR(handle);
-                ext4_warning(sb, __func__, "error %d on journal start", err);
+                ext4_warning(sb, "error %d on journal start", err);
                 goto exit_put;
         }
 
         mutex_lock(&EXT4_SB(sb)->s_resize_lock);
         if (o_blocks_count != ext4_blocks_count(es)) {
-                ext4_warning(sb, __func__,
-                             "multiple resizers run on filesystem!");
+                ext4_warning(sb, "multiple resizers run on filesystem!");
                 mutex_unlock(&EXT4_SB(sb)->s_resize_lock);
                 ext4_journal_stop(handle);
                 err = -EBUSY;
@@ -1063,8 +1038,7 @@ int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
 
         if ((err = ext4_journal_get_write_access(handle,
                                                  EXT4_SB(sb)->s_sbh))) {
-                ext4_warning(sb, __func__,
-                             "error %d on journal write access", err);
+                ext4_warning(sb, "error %d on journal write access", err);
                 mutex_unlock(&EXT4_SB(sb)->s_resize_lock);
                 ext4_journal_stop(handle);
                 goto exit_put;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 735c20d5fd56..ad1ee5f21bab 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -333,7 +333,7 @@ static void ext4_handle_error(struct super_block *sb)
                         sb->s_id);
 }
 
-void ext4_error(struct super_block *sb, const char *function,
+void __ext4_error(struct super_block *sb, const char *function,
                 const char *fmt, ...)
 {
         va_list args;
@@ -347,6 +347,42 @@ void ext4_error(struct super_block *sb, const char *function,
         ext4_handle_error(sb);
 }
 
+void ext4_error_inode(const char *function, struct inode *inode,
+                      const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        printk(KERN_CRIT "EXT4-fs error (device %s): %s: inode #%lu: (comm %s) ",
+               inode->i_sb->s_id, function, inode->i_ino, current->comm);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+
+        ext4_handle_error(inode->i_sb);
+}
+
+void ext4_error_file(const char *function, struct file *file,
+                     const char *fmt, ...)
+{
+        va_list args;
+        struct inode *inode = file->f_dentry->d_inode;
+        char pathname[80], *path;
+
+        va_start(args, fmt);
+        path = d_path(&(file->f_path), pathname, sizeof(pathname));
+        if (!path)
+                path = "(unknown)";
+        printk(KERN_CRIT
+               "EXT4-fs error (device %s): %s: inode #%lu (comm %s path %s): ",
+               inode->i_sb->s_id, function, inode->i_ino, current->comm, path);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+
+        ext4_handle_error(inode->i_sb);
+}
+
 static const char *ext4_decode_error(struct super_block *sb, int errno,
                                      char nbuf[16])
 {
@@ -450,7 +486,7 @@ void ext4_msg (struct super_block * sb, const char *prefix,
         va_end(args);
 }
 
-void ext4_warning(struct super_block *sb, const char *function,
+void __ext4_warning(struct super_block *sb, const char *function,
                   const char *fmt, ...)
 {
         va_list args;
@@ -507,7 +543,7 @@ void ext4_update_dynamic_rev(struct super_block *sb)
         if (le32_to_cpu(es->s_rev_level) > EXT4_GOOD_OLD_REV)
                 return;
 
-        ext4_warning(sb, __func__,
+        ext4_warning(sb,
                      "updating to rev %d because of new feature flag, "
                      "running e2fsck is recommended",
                      EXT4_DYNAMIC_REV);
@@ -708,7 +744,8 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
 #ifdef CONFIG_QUOTA
         ei->i_reserved_quota = 0;
 #endif
-        INIT_LIST_HEAD(&ei->i_aio_dio_complete_list);
+        INIT_LIST_HEAD(&ei->i_completed_io_list);
+        spin_lock_init(&ei->i_completed_io_lock);
         ei->cur_aio_dio = NULL;
         ei->i_sync_tid = 0;
         ei->i_datasync_tid = 0;
@@ -796,10 +833,10 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
         if (sbi->s_qf_names[GRPQUOTA])
                 seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
 
-        if (sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA)
+        if (test_opt(sb, USRQUOTA))
                 seq_puts(seq, ",usrquota");
 
-        if (sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA)
+        if (test_opt(sb, GRPQUOTA))
                 seq_puts(seq, ",grpquota");
 #endif
 }
@@ -926,6 +963,9 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
         if (test_opt(sb, NOLOAD))
                 seq_puts(seq, ",norecovery");
 
+        if (test_opt(sb, DIOREAD_NOLOCK))
+                seq_puts(seq, ",dioread_nolock");
+
         ext4_show_quota_options(seq, sb);
 
         return 0;
@@ -1109,6 +1149,7 @@ enum {
         Opt_stripe, Opt_delalloc, Opt_nodelalloc,
         Opt_block_validity, Opt_noblock_validity,
         Opt_inode_readahead_blks, Opt_journal_ioprio,
+        Opt_dioread_nolock, Opt_dioread_lock,
         Opt_discard, Opt_nodiscard,
 };
 
@@ -1176,6 +1217,8 @@ static const match_table_t tokens = {
         {Opt_auto_da_alloc, "auto_da_alloc=%u"},
         {Opt_auto_da_alloc, "auto_da_alloc"},
         {Opt_noauto_da_alloc, "noauto_da_alloc"},
+        {Opt_dioread_nolock, "dioread_nolock"},
+        {Opt_dioread_lock, "dioread_lock"},
         {Opt_discard, "discard"},
         {Opt_nodiscard, "nodiscard"},
         {Opt_err, NULL},
@@ -1205,6 +1248,66 @@ static ext4_fsblk_t get_sb_block(void **data)
 }
 
 #define DEFAULT_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3))
+static char deprecated_msg[] = "Mount option \"%s\" will be removed by %s\n"
+        "Contact linux-ext4@vger.kernel.org if you think we should keep it.\n";
+
+#ifdef CONFIG_QUOTA
+static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        char *qname;
+
+        if (sb_any_quota_loaded(sb) &&
+                !sbi->s_qf_names[qtype]) {
+                ext4_msg(sb, KERN_ERR,
+                        "Cannot change journaled "
+                        "quota options when quota turned on");
+                return 0;
+        }
+        qname = match_strdup(args);
+        if (!qname) {
+                ext4_msg(sb, KERN_ERR,
+                        "Not enough memory for storing quotafile name");
+                return 0;
+        }
+        if (sbi->s_qf_names[qtype] &&
+                strcmp(sbi->s_qf_names[qtype], qname)) {
+                ext4_msg(sb, KERN_ERR,
+                        "%s quota file already specified", QTYPE2NAME(qtype));
+                kfree(qname);
+                return 0;
+        }
+        sbi->s_qf_names[qtype] = qname;
+        if (strchr(sbi->s_qf_names[qtype], '/')) {
+                ext4_msg(sb, KERN_ERR,
+                        "quotafile must be on filesystem root");
+                kfree(sbi->s_qf_names[qtype]);
+                sbi->s_qf_names[qtype] = NULL;
+                return 0;
+        }
+        set_opt(sbi->s_mount_opt, QUOTA);
+        return 1;
+}
+
+static int clear_qf_name(struct super_block *sb, int qtype)
+{
+
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+
+        if (sb_any_quota_loaded(sb) &&
+                sbi->s_qf_names[qtype]) {
+                ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
+                        " when quota turned on");
+                return 0;
+        }
+        /*
+         * The space will be released later when all options are confirmed
+         * to be correct
+         */
+        sbi->s_qf_names[qtype] = NULL;
+        return 1;
+}
+#endif
 
 static int parse_options(char *options, struct super_block *sb,
                          unsigned long *journal_devnum,
@@ -1217,8 +1320,7 @@ static int parse_options(char *options, struct super_block *sb,
         int data_opt = 0;
         int option;
 #ifdef CONFIG_QUOTA
-        int qtype, qfmt;
-        char *qname;
+        int qfmt;
 #endif
 
         if (!options)
@@ -1229,19 +1331,31 @@ static int parse_options(char *options, struct super_block *sb,
                 if (!*p)
                         continue;
 
+                /*
+                 * Initialize args struct so we know whether arg was
+                 * found; some options take optional arguments.
+                 */
+                args[0].to = args[0].from = 0;
                 token = match_token(p, tokens, args);
                 switch (token) {
                 case Opt_bsd_df:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         clear_opt(sbi->s_mount_opt, MINIX_DF);
                         break;
                 case Opt_minix_df:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         set_opt(sbi->s_mount_opt, MINIX_DF);
+
                         break;
                 case Opt_grpid:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         set_opt(sbi->s_mount_opt, GRPID);
+
                         break;
                 case Opt_nogrpid:
+                        ext4_msg(sb, KERN_WARNING, deprecated_msg, p, "2.6.38");
                         clear_opt(sbi->s_mount_opt, GRPID);
+
                         break;
                 case Opt_resuid:
                         if (match_int(&args[0], &option))
@@ -1378,14 +1492,13 @@ static int parse_options(char *options, struct super_block *sb,
                         data_opt = EXT4_MOUNT_WRITEBACK_DATA;
                 datacheck:
                         if (is_remount) {
-                                if ((sbi->s_mount_opt & EXT4_MOUNT_DATA_FLAGS)
-                                                != data_opt) {
+                                if (test_opt(sb, DATA_FLAGS) != data_opt) {
                                         ext4_msg(sb, KERN_ERR,
                                                 "Cannot change data mode on remount");
                                         return 0;
                                 }
                         } else {
-                                sbi->s_mount_opt &= ~EXT4_MOUNT_DATA_FLAGS;
+                                clear_opt(sbi->s_mount_opt, DATA_FLAGS);
                                 sbi->s_mount_opt |= data_opt;
                         }
                         break;
@@ -1397,63 +1510,22 @@ static int parse_options(char *options, struct super_block *sb,
                         break;
 #ifdef CONFIG_QUOTA
                 case Opt_usrjquota:
-                        qtype = USRQUOTA;
-                        goto set_qf_name;
-                case Opt_grpjquota:
-                        qtype = GRPQUOTA;
-set_qf_name:
-                        if (sb_any_quota_loaded(sb) &&
-                            !sbi->s_qf_names[qtype]) {
-                                ext4_msg(sb, KERN_ERR,
-                                       "Cannot change journaled "
-                                       "quota options when quota turned on");
+                        if (!set_qf_name(sb, USRQUOTA, &args[0]))
                                 return 0;
-                        }
-                        qname = match_strdup(&args[0]);
-                        if (!qname) {
-                                ext4_msg(sb, KERN_ERR,
-                                        "Not enough memory for "
-                                        "storing quotafile name");
-                                return 0;
-                        }
-                        if (sbi->s_qf_names[qtype] &&
-                            strcmp(sbi->s_qf_names[qtype], qname)) {
-                                ext4_msg(sb, KERN_ERR,
-                                        "%s quota file already "
-                                        "specified", QTYPE2NAME(qtype));
-                                kfree(qname);
-                                return 0;
-                        }
-                        sbi->s_qf_names[qtype] = qname;
-                        if (strchr(sbi->s_qf_names[qtype], '/')) {
-                                ext4_msg(sb, KERN_ERR,
-                                        "quotafile must be on "
-                                        "filesystem root");
-                                kfree(sbi->s_qf_names[qtype]);
-                                sbi->s_qf_names[qtype] = NULL;
+                        break;
+                case Opt_grpjquota:
+                        if (!set_qf_name(sb, GRPQUOTA, &args[0]))
                                 return 0;
-                        }
-                        set_opt(sbi->s_mount_opt, QUOTA);
                         break;
                 case Opt_offusrjquota:
-                        qtype = USRQUOTA;
-                        goto clear_qf_name;
+                        if (!clear_qf_name(sb, USRQUOTA))
+                                return 0;
+                        break;
                 case Opt_offgrpjquota:
-                        qtype = GRPQUOTA;
-clear_qf_name:
-                        if (sb_any_quota_loaded(sb) &&
-                            sbi->s_qf_names[qtype]) {
-                                ext4_msg(sb, KERN_ERR, "Cannot change "
-                                        "journaled quota options when "
-                                        "quota turned on");
+                        if (!clear_qf_name(sb, GRPQUOTA))
                                 return 0;
-                        }
-                        /*
-                         * The space will be released later when all options
-                         * are confirmed to be correct
-                         */
-                        sbi->s_qf_names[qtype] = NULL;
                         break;
+
                 case Opt_jqfmt_vfsold:
                         qfmt = QFMT_VFS_OLD;
                         goto set_qf_format;
@@ -1518,10 +1590,11 @@ set_qf_format:
                         clear_opt(sbi->s_mount_opt, BARRIER);
                         break;
                 case Opt_barrier:
-                        if (match_int(&args[0], &option)) {
-                                set_opt(sbi->s_mount_opt, BARRIER);
-                                break;
-                        }
+                        if (args[0].from) {
+                                if (match_int(&args[0], &option))
+                                        return 0;
+                        } else
+                                option = 1;     /* No argument, default to 1 */
                         if (option)
                                 set_opt(sbi->s_mount_opt, BARRIER);
                         else
@@ -1594,10 +1667,11 @@ set_qf_format:
                         set_opt(sbi->s_mount_opt,NO_AUTO_DA_ALLOC);
                         break;
                 case Opt_auto_da_alloc:
-                        if (match_int(&args[0], &option)) {
-                                clear_opt(sbi->s_mount_opt, NO_AUTO_DA_ALLOC);
-                                break;
-                        }
+                        if (args[0].from) {
+                                if (match_int(&args[0], &option))
+                                        return 0;
+                        } else
+                                option = 1;     /* No argument, default to 1 */
                         if (option)
                                 clear_opt(sbi->s_mount_opt, NO_AUTO_DA_ALLOC);
                         else
@@ -1609,6 +1683,12 @@ set_qf_format:
                 case Opt_nodiscard:
                         clear_opt(sbi->s_mount_opt, DISCARD);
                         break;
+                case Opt_dioread_nolock:
+                        set_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                        break;
+                case Opt_dioread_lock:
+                        clear_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                        break;
                 default:
                         ext4_msg(sb, KERN_ERR,
                                "Unrecognized mount option \"%s\" "
@@ -1618,18 +1698,13 @@ set_qf_format:
         }
 #ifdef CONFIG_QUOTA
         if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
-                if ((sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA) &&
-                     sbi->s_qf_names[USRQUOTA])
+                if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
                         clear_opt(sbi->s_mount_opt, USRQUOTA);
 
-                if ((sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA) &&
-                     sbi->s_qf_names[GRPQUOTA])
+                if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
                         clear_opt(sbi->s_mount_opt, GRPQUOTA);
 
-                if ((sbi->s_qf_names[USRQUOTA] &&
-                                (sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA)) ||
-                    (sbi->s_qf_names[GRPQUOTA] &&
-                                (sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA))) {
+                if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
                         ext4_msg(sb, KERN_ERR, "old and new quota "
                                         "format mixing");
                         return 0;
@@ -2432,8 +2507,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
         if (def_mount_opts & EXT4_DEFM_DEBUG)
                 set_opt(sbi->s_mount_opt, DEBUG);
-        if (def_mount_opts & EXT4_DEFM_BSDGROUPS)
+        if (def_mount_opts & EXT4_DEFM_BSDGROUPS) {
+                ext4_msg(sb, KERN_WARNING, deprecated_msg, "bsdgroups",
+                        "2.6.38");
                 set_opt(sbi->s_mount_opt, GRPID);
+        }
         if (def_mount_opts & EXT4_DEFM_UID16)
                 set_opt(sbi->s_mount_opt, NO_UID32);
 #ifdef CONFIG_EXT4_FS_XATTR
@@ -2445,11 +2523,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 set_opt(sbi->s_mount_opt, POSIX_ACL);
 #endif
         if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
-                sbi->s_mount_opt |= EXT4_MOUNT_JOURNAL_DATA;
+                set_opt(sbi->s_mount_opt, JOURNAL_DATA);
         else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)
-                sbi->s_mount_opt |= EXT4_MOUNT_ORDERED_DATA;
+                set_opt(sbi->s_mount_opt, ORDERED_DATA);
         else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_WBACK)
-                sbi->s_mount_opt |= EXT4_MOUNT_WRITEBACK_DATA;
+                set_opt(sbi->s_mount_opt, WRITEBACK_DATA);
 
         if (le16_to_cpu(sbi->s_es->s_errors) == EXT4_ERRORS_PANIC)
                 set_opt(sbi->s_mount_opt, ERRORS_PANIC);
@@ -2477,7 +2555,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount;
 
         sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
-                ((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+                (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
 
         if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV &&
             (EXT4_HAS_COMPAT_FEATURE(sb, ~0U) ||
@@ -2766,7 +2844,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
               EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER)) {
                 ext4_msg(sb, KERN_ERR, "required journal recovery "
                        "suppressed and not mounted read-only");
-                goto failed_mount4;
+                goto failed_mount_wq;
         } else {
                 clear_opt(sbi->s_mount_opt, DATA_FLAGS);
                 set_opt(sbi->s_mount_opt, WRITEBACK_DATA);
@@ -2779,7 +2857,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
             !jbd2_journal_set_features(EXT4_SB(sb)->s_journal, 0, 0,
                                        JBD2_FEATURE_INCOMPAT_64BIT)) {
                 ext4_msg(sb, KERN_ERR, "Failed to set 64-bit journal feature");
-                goto failed_mount4;
+                goto failed_mount_wq;
         }
 
         if (test_opt(sb, JOURNAL_ASYNC_COMMIT)) {
@@ -2818,7 +2896,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                     (sbi->s_journal, 0, 0, JBD2_FEATURE_INCOMPAT_REVOKE)) {
                         ext4_msg(sb, KERN_ERR, "Journal does not support "
                                "requested data journaling mode");
-                        goto failed_mount4;
+                        goto failed_mount_wq;
                 }
         default:
                 break;
@@ -2826,13 +2904,17 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
         set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
 
 no_journal:
-
         if (test_opt(sb, NOBH)) {
                 if (!(test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)) {
                         ext4_msg(sb, KERN_WARNING, "Ignoring nobh option - "
                                 "its supported only with writeback mode");
                         clear_opt(sbi->s_mount_opt, NOBH);
                 }
+                if (test_opt(sb, DIOREAD_NOLOCK)) {
+                        ext4_msg(sb, KERN_WARNING, "dioread_nolock option is "
+                                "not supported with nobh mode");
+                        goto failed_mount_wq;
+                }
         }
         EXT4_SB(sb)->dio_unwritten_wq = create_workqueue("ext4-dio-unwritten");
         if (!EXT4_SB(sb)->dio_unwritten_wq) {
@@ -2897,6 +2979,18 @@ no_journal:
                          "requested data journaling mode");
                 clear_opt(sbi->s_mount_opt, DELALLOC);
         }
+        if (test_opt(sb, DIOREAD_NOLOCK)) {
+                if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
+                        ext4_msg(sb, KERN_WARNING, "Ignoring dioread_nolock "
+                                "option - requested data journaling mode");
+                        clear_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                }
+                if (sb->s_blocksize < PAGE_SIZE) {
+                        ext4_msg(sb, KERN_WARNING, "Ignoring dioread_nolock "
+                                "option - block size is too small");
+                        clear_opt(sbi->s_mount_opt, DIOREAD_NOLOCK);
+                }
+        }
 
         err = ext4_setup_system_zone(sb);
         if (err) {
@@ -3360,10 +3454,9 @@ static void ext4_clear_journal_err(struct super_block *sb,
                 char nbuf[16];
 
                 errstr = ext4_decode_error(sb, j_errno, nbuf);
-                ext4_warning(sb, __func__, "Filesystem error recorded "
+                ext4_warning(sb, "Filesystem error recorded "
                              "from previous mount: %s", errstr);
-                ext4_warning(sb, __func__, "Marking fs in need of "
-                             "filesystem check.");
+                ext4_warning(sb, "Marking fs in need of filesystem check.");
 
                 EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
                 es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
@@ -3514,7 +3607,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
                 ext4_abort(sb, __func__, "Abort forced by user");
 
         sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
-                ((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+                (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
 
         es = sbi->s_es;
 
@@ -3917,9 +4010,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
         ext4_lblk_t blk = off >> EXT4_BLOCK_SIZE_BITS(sb);
         int err = 0;
         int offset = off & (sb->s_blocksize - 1);
-        int tocopy;
         int journal_quota = EXT4_SB(sb)->s_qf_names[type] != NULL;
-        size_t towrite = len;
         struct buffer_head *bh;
         handle_t *handle = journal_current_handle();
 
@@ -3929,52 +4020,53 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
                         (unsigned long long)off, (unsigned long long)len);
                 return -EIO;
         }
+        /*
+         * Since we account only one data block in transaction credits,
+         * then it is impossible to cross a block boundary.
+         */
+        if (sb->s_blocksize - offset < len) {
+                ext4_msg(sb, KERN_WARNING, "Quota write (off=%llu, len=%llu)"
+                        " cancelled because not block aligned",
+                        (unsigned long long)off, (unsigned long long)len);
+                return -EIO;
+        }
+
         mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
-        while (towrite > 0) {
-                tocopy = sb->s_blocksize - offset < towrite ?
-                                sb->s_blocksize - offset : towrite;
-                bh = ext4_bread(handle, inode, blk, 1, &err);
-                if (!bh)
+        bh = ext4_bread(handle, inode, blk, 1, &err);
+        if (!bh)
+                goto out;
+        if (journal_quota) {
+                err = ext4_journal_get_write_access(handle, bh);
+                if (err) {
+                        brelse(bh);
                         goto out;
-                if (journal_quota) {
-                        err = ext4_journal_get_write_access(handle, bh);
-                        if (err) {
-                                brelse(bh);
-                                goto out;
-                        }
                 }
-                lock_buffer(bh);
-                memcpy(bh->b_data+offset, data, tocopy);
-                flush_dcache_page(bh->b_page);
-                unlock_buffer(bh);
-                if (journal_quota)
-                        err = ext4_handle_dirty_metadata(handle, NULL, bh);
-                else {
-                        /* Always do at least ordered writes for quotas */
-                        err = ext4_jbd2_file_inode(handle, inode);
-                        mark_buffer_dirty(bh);
-                }
-                brelse(bh);
-                if (err)
-                        goto out;
-                offset = 0;
-                towrite -= tocopy;
-                data += tocopy;
-                blk++;
         }
+        lock_buffer(bh);
+        memcpy(bh->b_data+offset, data, len);
+        flush_dcache_page(bh->b_page);
+        unlock_buffer(bh);
+        if (journal_quota)
+                err = ext4_handle_dirty_metadata(handle, NULL, bh);
+        else {
+                /* Always do at least ordered writes for quotas */
+                err = ext4_jbd2_file_inode(handle, inode);
+                mark_buffer_dirty(bh);
+        }
+        brelse(bh);
 out:
-        if (len == towrite) {
+        if (err) {
                 mutex_unlock(&inode->i_mutex);
                 return err;
         }
-        if (inode->i_size < off+len-towrite) {
-                i_size_write(inode, off+len-towrite);
+        if (inode->i_size < off + len) {
+                i_size_write(inode, off + len);
                 EXT4_I(inode)->i_disksize = inode->i_size;
         }
         inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         ext4_mark_inode_dirty(handle, inode);
         mutex_unlock(&inode->i_mutex);
-        return len - towrite;
+        return len;
 }
 
 #endif
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index f3a2f7ed45aa..efc16a4b7ceb 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -227,7 +227,8 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name,
         ea_bdebug(bh, "b_count=%d, refcount=%d",
                 atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
         if (ext4_xattr_check_block(bh)) {
-bad_block:      ext4_error(inode->i_sb, __func__,
+bad_block:
+                ext4_error(inode->i_sb,
                            "inode %lu: bad block %llu", inode->i_ino,
                            EXT4_I(inode)->i_file_acl);
                 error = -EIO;
@@ -267,7 +268,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
         void *end;
         int error;
 
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
+        if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
                 return -ENODATA;
         error = ext4_get_inode_loc(inode, &iloc);
         if (error)
@@ -371,7 +372,7 @@ ext4_xattr_block_list(struct dentry *dentry, char *buffer, size_t buffer_size)
         ea_bdebug(bh, "b_count=%d, refcount=%d",
                 atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
         if (ext4_xattr_check_block(bh)) {
-                ext4_error(inode->i_sb, __func__,
+                ext4_error(inode->i_sb,
                            "inode %lu: bad block %llu", inode->i_ino,
                            EXT4_I(inode)->i_file_acl);
                 error = -EIO;
@@ -396,7 +397,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)
         void *end;
         int error;
 
-        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
+        if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR))
                 return 0;
         error = ext4_get_inode_loc(inode, &iloc);
         if (error)
@@ -665,9 +666,8 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i,
                         atomic_read(&(bs->bh->b_count)),
                         le32_to_cpu(BHDR(bs->bh)->h_refcount));
                 if (ext4_xattr_check_block(bs->bh)) {
-                        ext4_error(sb, __func__,
-                                "inode %lu: bad block %llu", inode->i_ino,
-                                EXT4_I(inode)->i_file_acl);
+                        ext4_error(sb, "inode %lu: bad block %llu",
+                                   inode->i_ino, EXT4_I(inode)->i_file_acl);
                         error = -EIO;
                         goto cleanup;
                 }
@@ -880,9 +880,8 @@ cleanup_dquot:
         goto cleanup;
 
 bad_block:
-        ext4_error(inode->i_sb, __func__,
-                   "inode %lu: bad block %llu", inode->i_ino,
-                   EXT4_I(inode)->i_file_acl);
+        ext4_error(inode->i_sb, "inode %lu: bad block %llu",
+                   inode->i_ino, EXT4_I(inode)->i_file_acl);
         goto cleanup;
 
 #undef header
@@ -908,7 +907,7 @@ ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
         is->s.base = is->s.first = IFIRST(header);
         is->s.here = is->s.first;
         is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
-        if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
                 error = ext4_xattr_check_names(IFIRST(header), is->s.end);
                 if (error)
                         return error;
@@ -940,10 +939,10 @@ ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
         header = IHDR(inode, ext4_raw_inode(&is->iloc));
         if (!IS_LAST_ENTRY(s->first)) {
                 header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
-                EXT4_I(inode)->i_state |= EXT4_STATE_XATTR;
+                ext4_set_inode_state(inode, EXT4_STATE_XATTR);
         } else {
                 header->h_magic = cpu_to_le32(0);
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_XATTR;
+                ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
         }
         return 0;
 }
@@ -986,8 +985,8 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
         if (strlen(name) > 255)
                 return -ERANGE;
         down_write(&EXT4_I(inode)->xattr_sem);
-        no_expand = EXT4_I(inode)->i_state & EXT4_STATE_NO_EXPAND;
-        EXT4_I(inode)->i_state |= EXT4_STATE_NO_EXPAND;
+        no_expand = ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND);
+        ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 
         error = ext4_get_inode_loc(inode, &is.iloc);
         if (error)
@@ -997,10 +996,10 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
         if (error)
                 goto cleanup;
 
-        if (EXT4_I(inode)->i_state & EXT4_STATE_NEW) {
+        if (ext4_test_inode_state(inode, EXT4_STATE_NEW)) {
                 struct ext4_inode *raw_inode = ext4_raw_inode(&is.iloc);
                 memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_NEW;
+                ext4_clear_inode_state(inode, EXT4_STATE_NEW);
         }
 
         error = ext4_xattr_ibody_find(inode, &i, &is);
@@ -1052,7 +1051,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
                 ext4_xattr_update_super_block(handle, inode->i_sb);
                 inode->i_ctime = ext4_current_time(inode);
                 if (!value)
-                        EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
+                        ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
                 error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
                 /*
                  * The bh is consumed by ext4_mark_iloc_dirty, even with
@@ -1067,7 +1066,7 @@ cleanup:
         brelse(is.iloc.bh);
         brelse(bs.bh);
         if (no_expand == 0)
-                EXT4_I(inode)->i_state &= ~EXT4_STATE_NO_EXPAND;
+                ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
         up_write(&EXT4_I(inode)->xattr_sem);
         return error;
 }
@@ -1195,9 +1194,8 @@ retry:
                 if (!bh)
                         goto cleanup;
                 if (ext4_xattr_check_block(bh)) {
-                        ext4_error(inode->i_sb, __func__,
-                                "inode %lu: bad block %llu", inode->i_ino,
-                                EXT4_I(inode)->i_file_acl);
+                        ext4_error(inode->i_sb, "inode %lu: bad block %llu",
+                                   inode->i_ino, EXT4_I(inode)->i_file_acl);
                         error = -EIO;
                         goto cleanup;
                 }
@@ -1302,6 +1300,8 @@ retry:
 
                 /* Remove the chosen entry from the inode */
                 error = ext4_xattr_ibody_set(handle, inode, &i, is);
+                if (error)
+                        goto cleanup;
 
                 entry = IFIRST(header);
                 if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
@@ -1372,16 +1372,14 @@ ext4_xattr_delete_inode(handle_t *handle, struct inode *inode)
                 goto cleanup;
         bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
         if (!bh) {
-                ext4_error(inode->i_sb, __func__,
-                        "inode %lu: block %llu read error", inode->i_ino,
-                        EXT4_I(inode)->i_file_acl);
+                ext4_error(inode->i_sb, "inode %lu: block %llu read error",
+                           inode->i_ino, EXT4_I(inode)->i_file_acl);
                 goto cleanup;
         }
         if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
             BHDR(bh)->h_blocks != cpu_to_le32(1)) {
-                ext4_error(inode->i_sb, __func__,
-                        "inode %lu: bad block %llu", inode->i_ino,
-                        EXT4_I(inode)->i_file_acl);
+                ext4_error(inode->i_sb, "inode %lu: bad block %llu",
+                           inode->i_ino, EXT4_I(inode)->i_file_acl);
                 goto cleanup;
         }
         ext4_xattr_release_block(handle, inode, bh);
@@ -1506,7 +1504,7 @@ again:
                 }
                 bh = sb_bread(inode->i_sb, ce->e_block);
                 if (!bh) {
-                        ext4_error(inode->i_sb, __func__,
+                        ext4_error(inode->i_sb,
                                 "inode %lu: block %lu read error",
                                 inode->i_ino, (unsigned long) ce->e_block);
                 } else if (le32_to_cpu(BHDR(bh)->h_refcount) >=
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 14da530b05ca..fbeecdc194dc 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -577,7 +577,7 @@ static inline loff_t fat_i_pos_read(struct msdos_sb_info *sbi,
         return i_pos;
 }
 
-static int fat_write_inode(struct inode *inode, int wait)
+static int __fat_write_inode(struct inode *inode, int wait)
 {
         struct super_block *sb = inode->i_sb;
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
@@ -634,9 +634,14 @@ retry:
         return err;
 }
 
+static int fat_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __fat_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int fat_sync_inode(struct inode *inode)
 {
-        return fat_write_inode(inode, 1);
+        return __fat_write_inode(inode, 1);
 }
 
 EXPORT_SYMBOL_GPL(fat_sync_inode);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1a7c42c64ff4..76fc4d594acb 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -381,10 +381,10 @@ static void queue_io(struct bdi_writeback *wb, unsigned long *older_than_this)
         move_expired_inodes(&wb->b_dirty, &wb->b_io, older_than_this);
 }
 
-static int write_inode(struct inode *inode, int sync)
+static int write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         if (inode->i_sb->s_op->write_inode && !is_bad_inode(inode))
-                return inode->i_sb->s_op->write_inode(inode, sync);
+                return inode->i_sb->s_op->write_inode(inode, wbc);
         return 0;
 }
 
@@ -421,7 +421,6 @@ static int
 writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct address_space *mapping = inode->i_mapping;
-        int wait = wbc->sync_mode == WB_SYNC_ALL;
         unsigned dirty;
         int ret;
 
@@ -439,7 +438,7 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
                  * We'll have another go at writing back this inode when we
                  * completed a full scan of b_io.
                  */
-                if (!wait) {
+                if (wbc->sync_mode != WB_SYNC_ALL) {
                         requeue_io(inode);
                         return 0;
                 }
@@ -461,15 +460,20 @@ writeback_single_inode(struct inode *inode, struct writeback_control *wbc)
 
         ret = do_writepages(mapping, wbc);
 
-        /* Don't write the inode if only I_DIRTY_PAGES was set */
-        if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
-                int err = write_inode(inode, wait);
+        /*
+         * Make sure to wait on the data before writing out the metadata.
+         * This is important for filesystems that modify metadata on data
+         * I/O completion.
+         */
+        if (wbc->sync_mode == WB_SYNC_ALL) {
+                int err = filemap_fdatawait(mapping);
                 if (ret == 0)
                         ret = err;
         }
 
-        if (wait) {
-                int err = filemap_fdatawait(mapping);
+        /* Don't write the inode if only I_DIRTY_PAGES was set */
+        if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
+                int err = write_inode(inode, wbc);
                 if (ret == 0)
                         ret = err;
         }
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 51d9e33d634f..eb7e9423691f 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -865,13 +865,10 @@ static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
 
         down_read(&fc->killsb);
         err = -ENOENT;
-        if (!fc->sb)
-                goto err_unlock;
-
-        err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
-                                       outarg.off, outarg.len);
-
-err_unlock:
+        if (fc->sb) {
+                err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
+                                               outarg.off, outarg.len);
+        }
         up_read(&fc->killsb);
         return err;
 
@@ -884,10 +881,15 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
                                    struct fuse_copy_state *cs)
 {
         struct fuse_notify_inval_entry_out outarg;
-        int err = -EINVAL;
-        char buf[FUSE_NAME_MAX+1];
+        int err = -ENOMEM;
+        char *buf;
         struct qstr name;
 
+        buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
+        if (!buf)
+                goto err;
+
+        err = -EINVAL;
         if (size < sizeof(outarg))
                 goto err;
 
@@ -910,16 +912,14 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
 
         down_read(&fc->killsb);
         err = -ENOENT;
-        if (!fc->sb)
-                goto err_unlock;
-
-        err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
-
-err_unlock:
+        if (fc->sb)
+                err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
         up_read(&fc->killsb);
+        kfree(buf);
         return err;
 
 err:
+        kfree(buf);
         fuse_copy_finish(cs);
         return err;
 }
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 7b8da9415267..0c1d0b82dcf1 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -1061,8 +1061,8 @@ out:
 
 int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
 {
-        struct inode *aspace = page->mapping->host;
-        struct gfs2_sbd *sdp = aspace->i_sb->s_fs_info;
+        struct address_space *mapping = page->mapping;
+        struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct buffer_head *bh, *head;
         struct gfs2_bufdata *bd;
 
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index f42663325931..454d4b4eb36b 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -19,7 +19,6 @@
 #include <linux/list.h>
 #include <linux/wait.h>
 #include <linux/module.h>
-#include <linux/rwsem.h>
 #include <asm/uaccess.h>
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
@@ -60,7 +59,6 @@ static int __dump_glock(struct seq_file *seq, const struct gfs2_glock *gl);
 #define GLOCK_BUG_ON(gl,x) do { if (unlikely(x)) { __dump_glock(NULL, gl); BUG(); } } while(0)
 static void do_xmote(struct gfs2_glock *gl, struct gfs2_holder *gh, unsigned int target);
 
-static DECLARE_RWSEM(gfs2_umount_flush_sem);
 static struct dentry *gfs2_root;
 static struct workqueue_struct *glock_workqueue;
 struct workqueue_struct *gfs2_delete_workqueue;
@@ -154,12 +152,14 @@ static unsigned int gl_hash(const struct gfs2_sbd *sdp,
 static void glock_free(struct gfs2_glock *gl)
 {
         struct gfs2_sbd *sdp = gl->gl_sbd;
-        struct inode *aspace = gl->gl_aspace;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
+        struct kmem_cache *cachep = gfs2_glock_cachep;
 
-        if (aspace)
-                gfs2_aspace_put(aspace);
+        GLOCK_BUG_ON(gl, mapping && mapping->nrpages);
         trace_gfs2_glock_put(gl);
-        sdp->sd_lockstruct.ls_ops->lm_put_lock(gfs2_glock_cachep, gl);
+        if (mapping)
+                cachep = gfs2_glock_aspace_cachep;
+        sdp->sd_lockstruct.ls_ops->lm_put_lock(cachep, gl);
 }
 
 /**
@@ -712,7 +712,6 @@ static void glock_work_func(struct work_struct *work)
                 finish_xmote(gl, gl->gl_reply);
                 drop_ref = 1;
         }
-        down_read(&gfs2_umount_flush_sem);
         spin_lock(&gl->gl_spin);
         if (test_and_clear_bit(GLF_PENDING_DEMOTE, &gl->gl_flags) &&
             gl->gl_state != LM_ST_UNLOCKED &&
@@ -725,7 +724,6 @@ static void glock_work_func(struct work_struct *work)
         }
         run_queue(gl, 0);
         spin_unlock(&gl->gl_spin);
-        up_read(&gfs2_umount_flush_sem);
         if (!delay ||
             queue_delayed_work(glock_workqueue, &gl->gl_work, delay) == 0)
                 gfs2_glock_put(gl);
@@ -750,10 +748,11 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
                    const struct gfs2_glock_operations *glops, int create,
                    struct gfs2_glock **glp)
 {
+        struct super_block *s = sdp->sd_vfs;
         struct lm_lockname name = { .ln_number = number, .ln_type = glops->go_type };
         struct gfs2_glock *gl, *tmp;
         unsigned int hash = gl_hash(sdp, &name);
-        int error;
+        struct address_space *mapping;
 
         read_lock(gl_lock_addr(hash));
         gl = search_bucket(hash, sdp, &name);
@@ -765,7 +764,10 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         if (!create)
                 return -ENOENT;
 
-        gl = kmem_cache_alloc(gfs2_glock_cachep, GFP_KERNEL);
+        if (glops->go_flags & GLOF_ASPACE)
+                gl = kmem_cache_alloc(gfs2_glock_aspace_cachep, GFP_KERNEL);
+        else
+                gl = kmem_cache_alloc(gfs2_glock_cachep, GFP_KERNEL);
         if (!gl)
                 return -ENOMEM;
 
@@ -784,18 +786,18 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         gl->gl_tchange = jiffies;
         gl->gl_object = NULL;
         gl->gl_sbd = sdp;
-        gl->gl_aspace = NULL;
         INIT_DELAYED_WORK(&gl->gl_work, glock_work_func);
         INIT_WORK(&gl->gl_delete, delete_work_func);
 
-        /* If this glock protects actual on-disk data or metadata blocks,
-           create a VFS inode to manage the pages/buffers holding them. */
-        if (glops == &gfs2_inode_glops || glops == &gfs2_rgrp_glops) {
-                gl->gl_aspace = gfs2_aspace_get(sdp);
-                if (!gl->gl_aspace) {
-                        error = -ENOMEM;
-                        goto fail;
-                }
+        mapping = gfs2_glock2aspace(gl);
+        if (mapping) {
+                mapping->a_ops = &gfs2_meta_aops;
+                mapping->host = s->s_bdev->bd_inode;
+                mapping->flags = 0;
+                mapping_set_gfp_mask(mapping, GFP_NOFS);
+                mapping->assoc_mapping = NULL;
+                mapping->backing_dev_info = s->s_bdi;
+                mapping->writeback_index = 0;
         }
 
         write_lock(gl_lock_addr(hash));
@@ -812,10 +814,6 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         *glp = gl;
 
         return 0;
-
-fail:
-        kmem_cache_free(gfs2_glock_cachep, gl);
-        return error;
 }
 
 /**
@@ -1510,35 +1508,10 @@ void gfs2_glock_thaw(struct gfs2_sbd *sdp)
 
 void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
 {
-        unsigned long t;
         unsigned int x;
-        int cont;
 
-        t = jiffies;
-
-        for (;;) {
-                cont = 0;
-                for (x = 0; x < GFS2_GL_HASH_SIZE; x++) {
-                        if (examine_bucket(clear_glock, sdp, x))
-                                cont = 1;
-                }
-
-                if (!cont)
-                        break;
-
-                if (time_after_eq(jiffies,
-                                  t + gfs2_tune_get(sdp, gt_stall_secs) * HZ)) {
-                        fs_warn(sdp, "Unmount seems to be stalled. "
-                                     "Dumping lock state...\n");
-                        gfs2_dump_lockstate(sdp);
-                        t = jiffies;
-                }
-
-                down_write(&gfs2_umount_flush_sem);
-                invalidate_inodes(sdp->sd_vfs);
-                up_write(&gfs2_umount_flush_sem);
-                msleep(10);
-        }
+        for (x = 0; x < GFS2_GL_HASH_SIZE; x++)
+                examine_bucket(clear_glock, sdp, x);
         flush_workqueue(glock_workqueue);
         wait_event(sdp->sd_glock_wait, atomic_read(&sdp->sd_glock_disposal) == 0);
         gfs2_dump_lockstate(sdp);
@@ -1685,7 +1658,7 @@ static int __dump_glock(struct seq_file *seq, const struct gfs2_glock *gl)
         dtime *= 1000000/HZ; /* demote time in uSec */
         if (!test_bit(GLF_DEMOTE, &gl->gl_flags))
                 dtime = 0;
-        gfs2_print_dbg(seq, "G:  s:%s n:%u/%llu f:%s t:%s d:%s/%llu a:%d r:%d\n",
+        gfs2_print_dbg(seq, "G:  s:%s n:%u/%llx f:%s t:%s d:%s/%llu a:%d r:%d\n",
                   state2str(gl->gl_state),
                   gl->gl_name.ln_type,
                   (unsigned long long)gl->gl_name.ln_number,
diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index c0262faf4725..2bda1911b156 100644
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -180,6 +180,13 @@ static inline int gfs2_glock_is_held_shrd(struct gfs2_glock *gl)
         return gl->gl_state == LM_ST_SHARED;
 }
 
+static inline struct address_space *gfs2_glock2aspace(struct gfs2_glock *gl)
+{
+        if (gl->gl_ops->go_flags & GLOF_ASPACE)
+                return (struct address_space *)(gl + 1);
+        return NULL;
+}
+
 int gfs2_glock_get(struct gfs2_sbd *sdp,
                    u64 number, const struct gfs2_glock_operations *glops,
                    int create, struct gfs2_glock **glp);
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 78554acc0605..38e3749d476c 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -87,7 +87,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
 
 static void rgrp_go_sync(struct gfs2_glock *gl)
 {
-        struct address_space *metamapping = gl->gl_aspace->i_mapping;
+        struct address_space *metamapping = gfs2_glock2aspace(gl);
         int error;
 
         if (!test_and_clear_bit(GLF_DIRTY, &gl->gl_flags))
@@ -113,7 +113,7 @@ static void rgrp_go_sync(struct gfs2_glock *gl)
 
 static void rgrp_go_inval(struct gfs2_glock *gl, int flags)
 {
-        struct address_space *mapping = gl->gl_aspace->i_mapping;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
 
         BUG_ON(!(flags & DIO_METADATA));
         gfs2_assert_withdraw(gl->gl_sbd, !atomic_read(&gl->gl_ail_count));
@@ -134,7 +134,7 @@ static void rgrp_go_inval(struct gfs2_glock *gl, int flags)
 static void inode_go_sync(struct gfs2_glock *gl)
 {
         struct gfs2_inode *ip = gl->gl_object;
-        struct address_space *metamapping = gl->gl_aspace->i_mapping;
+        struct address_space *metamapping = gfs2_glock2aspace(gl);
         int error;
 
         if (ip && !S_ISREG(ip->i_inode.i_mode))
@@ -183,7 +183,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
         gfs2_assert_withdraw(gl->gl_sbd, !atomic_read(&gl->gl_ail_count));
 
         if (flags & DIO_METADATA) {
-                struct address_space *mapping = gl->gl_aspace->i_mapping;
+                struct address_space *mapping = gfs2_glock2aspace(gl);
                 truncate_inode_pages(mapping, 0);
                 if (ip) {
                         set_bit(GIF_INVALID, &ip->i_flags);
@@ -282,7 +282,8 @@ static int inode_go_dump(struct seq_file *seq, const struct gfs2_glock *gl)
 
 static int rgrp_go_demote_ok(const struct gfs2_glock *gl)
 {
-        return !gl->gl_aspace->i_mapping->nrpages;
+        const struct address_space *mapping = (const struct address_space *)(gl + 1);
+        return !mapping->nrpages;
 }
 
 /**
@@ -387,8 +388,7 @@ static void iopen_go_callback(struct gfs2_glock *gl)
         struct gfs2_inode *ip = (struct gfs2_inode *)gl->gl_object;
 
         if (gl->gl_demote_state == LM_ST_UNLOCKED &&
-            gl->gl_state == LM_ST_SHARED &&
-            ip && test_bit(GIF_USER, &ip->i_flags)) {
+            gl->gl_state == LM_ST_SHARED && ip) {
                 gfs2_glock_hold(gl);
                 if (queue_work(gfs2_delete_workqueue, &gl->gl_delete) == 0)
                         gfs2_glock_put_nolock(gl);
@@ -407,6 +407,7 @@ const struct gfs2_glock_operations gfs2_inode_glops = {
         .go_dump = inode_go_dump,
         .go_type = LM_TYPE_INODE,
         .go_min_hold_time = HZ / 5,
+        .go_flags = GLOF_ASPACE,
 };
 
 const struct gfs2_glock_operations gfs2_rgrp_glops = {
@@ -418,6 +419,7 @@ const struct gfs2_glock_operations gfs2_rgrp_glops = {
         .go_dump = gfs2_rgrp_dump,
         .go_type = LM_TYPE_RGRP,
         .go_min_hold_time = HZ / 5,
+        .go_flags = GLOF_ASPACE,
 };
 
 const struct gfs2_glock_operations gfs2_trans_glops = {
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index bc0ad158e6b4..b8025e51cabf 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -162,6 +162,8 @@ struct gfs2_glock_operations {
         void (*go_callback) (struct gfs2_glock *gl);
         const int go_type;
         const unsigned long go_min_hold_time;
+        const unsigned long go_flags;
+#define GLOF_ASPACE 1
 };
 
 enum {
@@ -225,7 +227,6 @@ struct gfs2_glock {
 
         struct gfs2_sbd *gl_sbd;
 
-        struct inode *gl_aspace;
         struct list_head gl_ail_list;
         atomic_t gl_ail_count;
         struct delayed_work gl_work;
@@ -258,7 +259,6 @@ enum {
         GIF_INVALID             = 0,
         GIF_QD_LOCKED           = 1,
         GIF_SW_PAGED            = 3,
-        GIF_USER                = 4, /* user inode, not metadata addr space */
 };
 
 
@@ -451,7 +451,6 @@ struct gfs2_tune {
         unsigned int gt_quota_quantum; /* Secs between syncs to quota file */
         unsigned int gt_new_files_jdata;
         unsigned int gt_max_readahead; /* Max bytes to read-ahead from disk */
-        unsigned int gt_stall_secs; /* Detects trouble! */
         unsigned int gt_complain_secs;
         unsigned int gt_statfs_quantum;
         unsigned int gt_statfs_slow;
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 6e220f4eee7d..b1bf2694fb2b 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -45,7 +45,7 @@ static int iget_test(struct inode *inode, void *opaque)
         struct gfs2_inode *ip = GFS2_I(inode);
         u64 *no_addr = opaque;
 
-        if (ip->i_no_addr == *no_addr && test_bit(GIF_USER, &ip->i_flags))
+        if (ip->i_no_addr == *no_addr)
                 return 1;
 
         return 0;
@@ -58,7 +58,6 @@ static int iget_set(struct inode *inode, void *opaque)
 
         inode->i_ino = (unsigned long)*no_addr;
         ip->i_no_addr = *no_addr;
-        set_bit(GIF_USER, &ip->i_flags);
         return 0;
 }
 
@@ -84,7 +83,7 @@ static int iget_skip_test(struct inode *inode, void *opaque)
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_skip_data *data = opaque;
 
-        if (ip->i_no_addr == data->no_addr && test_bit(GIF_USER, &ip->i_flags)){
+        if (ip->i_no_addr == data->no_addr) {
                 if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE)){
                         data->skipped = 1;
                         return 0;
@@ -103,7 +102,6 @@ static int iget_skip_set(struct inode *inode, void *opaque)
                 return 1;
         inode->i_ino = (unsigned long)(data->no_addr);
         ip->i_no_addr = data->no_addr;
-        set_bit(GIF_USER, &ip->i_flags);
         return 0;
 }
 
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 0e5e0e7022e5..569b46240f61 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -30,7 +30,10 @@ static void gdlm_ast(void *arg)
 
         switch (gl->gl_lksb.sb_status) {
         case -DLM_EUNLOCK: /* Unlocked, so glock can be freed */
-                kmem_cache_free(gfs2_glock_cachep, gl);
+                if (gl->gl_ops->go_flags & GLOF_ASPACE)
+                        kmem_cache_free(gfs2_glock_aspace_cachep, gl);
+                else
+                        kmem_cache_free(gfs2_glock_cachep, gl);
                 if (atomic_dec_and_test(&sdp->sd_glock_disposal))
                         wake_up(&sdp->sd_glock_wait);
                 return;
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index de97632ba32f..adc260fbea90 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -528,9 +528,9 @@ static void databuf_lo_add(struct gfs2_sbd *sdp, struct gfs2_log_element *le)
                 gfs2_pin(sdp, bd->bd_bh);
                 tr->tr_num_databuf_new++;
                 sdp->sd_log_num_databuf++;
-                list_add(&le->le_list, &sdp->sd_log_le_databuf);
+                list_add_tail(&le->le_list, &sdp->sd_log_le_databuf);
         } else {
-                list_add(&le->le_list, &sdp->sd_log_le_ordered);
+                list_add_tail(&le->le_list, &sdp->sd_log_le_ordered);
         }
 out:
         gfs2_log_unlock(sdp);
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index 5b31f7741a8f..a88fadc704bb 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -52,6 +52,22 @@ static void gfs2_init_glock_once(void *foo)
         atomic_set(&gl->gl_ail_count, 0);
 }
 
+static void gfs2_init_gl_aspace_once(void *foo)
+{
+        struct gfs2_glock *gl = foo;
+        struct address_space *mapping = (struct address_space *)(gl + 1);
+
+        gfs2_init_glock_once(gl);
+        memset(mapping, 0, sizeof(*mapping));
+        INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
+        spin_lock_init(&mapping->tree_lock);
+        spin_lock_init(&mapping->i_mmap_lock);
+        INIT_LIST_HEAD(&mapping->private_list);
+        spin_lock_init(&mapping->private_lock);
+        INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);
+        INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);
+}
+
 /**
  * init_gfs2_fs - Register GFS2 as a filesystem
  *
@@ -78,6 +94,14 @@ static int __init init_gfs2_fs(void)
         if (!gfs2_glock_cachep)
                 goto fail;
 
+        gfs2_glock_aspace_cachep = kmem_cache_create("gfs2_glock (aspace)",
+                                        sizeof(struct gfs2_glock) +
+                                        sizeof(struct address_space),
+                                        0, 0, gfs2_init_gl_aspace_once);
+
+        if (!gfs2_glock_aspace_cachep)
+                goto fail;
+
         gfs2_inode_cachep = kmem_cache_create("gfs2_inode",
                                               sizeof(struct gfs2_inode),
                                               0,  SLAB_RECLAIM_ACCOUNT|
@@ -144,6 +168,9 @@ fail:
         if (gfs2_inode_cachep)
                 kmem_cache_destroy(gfs2_inode_cachep);
 
+        if (gfs2_glock_aspace_cachep)
+                kmem_cache_destroy(gfs2_glock_aspace_cachep);
+
         if (gfs2_glock_cachep)
                 kmem_cache_destroy(gfs2_glock_cachep);
 
@@ -169,6 +196,7 @@ static void __exit exit_gfs2_fs(void)
         kmem_cache_destroy(gfs2_rgrpd_cachep);
         kmem_cache_destroy(gfs2_bufdata_cachep);
         kmem_cache_destroy(gfs2_inode_cachep);
+        kmem_cache_destroy(gfs2_glock_aspace_cachep);
         kmem_cache_destroy(gfs2_glock_cachep);
 
         gfs2_sys_uninit();
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 6f68a5f18eb8..0bb12c80937a 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -93,49 +93,13 @@ static int gfs2_aspace_writepage(struct page *page, struct writeback_control *wb
         return err;
 }
 
-static const struct address_space_operations aspace_aops = {
+const struct address_space_operations gfs2_meta_aops = {
         .writepage = gfs2_aspace_writepage,
         .releasepage = gfs2_releasepage,
         .sync_page = block_sync_page,
 };
 
 /**
- * gfs2_aspace_get - Create and initialize a struct inode structure
- * @sdp: the filesystem the aspace is in
- *
- * Right now a struct inode is just a struct inode.  Maybe Linux
- * will supply a more lightweight address space construct (that works)
- * in the future.
- *
- * Make sure pages/buffers in this aspace aren't in high memory.
- *
- * Returns: the aspace
- */
-
-struct inode *gfs2_aspace_get(struct gfs2_sbd *sdp)
-{
-        struct inode *aspace;
-        struct gfs2_inode *ip;
-
-        aspace = new_inode(sdp->sd_vfs);
-        if (aspace) {
-                mapping_set_gfp_mask(aspace->i_mapping, GFP_NOFS);
-                aspace->i_mapping->a_ops = &aspace_aops;
-                aspace->i_size = MAX_LFS_FILESIZE;
-                ip = GFS2_I(aspace);
-                clear_bit(GIF_USER, &ip->i_flags);
-                insert_inode_hash(aspace);
-        }
-        return aspace;
-}
-
-void gfs2_aspace_put(struct inode *aspace)
-{
-        remove_inode_hash(aspace);
-        iput(aspace);
-}
-
-/**
  * gfs2_meta_sync - Sync all buffers associated with a glock
  * @gl: The glock
  *
@@ -143,7 +107,7 @@ void gfs2_aspace_put(struct inode *aspace)
 
 void gfs2_meta_sync(struct gfs2_glock *gl)
 {
-        struct address_space *mapping = gl->gl_aspace->i_mapping;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
         int error;
 
         filemap_fdatawrite(mapping);
@@ -164,7 +128,7 @@ void gfs2_meta_sync(struct gfs2_glock *gl)
 
 struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create)
 {
-        struct address_space *mapping = gl->gl_aspace->i_mapping;
+        struct address_space *mapping = gfs2_glock2aspace(gl);
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct page *page;
         struct buffer_head *bh;
@@ -344,8 +308,10 @@ void gfs2_attach_bufdata(struct gfs2_glock *gl, struct buffer_head *bh,
 
 void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int meta)
 {
-        struct gfs2_sbd *sdp = GFS2_SB(bh->b_page->mapping->host);
+        struct address_space *mapping = bh->b_page->mapping;
+        struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
         struct gfs2_bufdata *bd = bh->b_private;
+
         if (test_clear_buffer_pinned(bh)) {
                 list_del_init(&bd->bd_le.le_list);
                 if (meta) {
diff --git a/fs/gfs2/meta_io.h b/fs/gfs2/meta_io.h
index de270c2f9b63..6a1d9ba16411 100644
--- a/fs/gfs2/meta_io.h
+++ b/fs/gfs2/meta_io.h
@@ -37,8 +37,16 @@ static inline void gfs2_buffer_copy_tail(struct buffer_head *to_bh,
                0, from_head - to_head);
 }
 
-struct inode *gfs2_aspace_get(struct gfs2_sbd *sdp);
-void gfs2_aspace_put(struct inode *aspace);
+extern const struct address_space_operations gfs2_meta_aops;
+
+static inline struct gfs2_sbd *gfs2_mapping2sbd(struct address_space *mapping)
+{
+        struct inode *inode = mapping->host;
+        if (mapping->a_ops == &gfs2_meta_aops)
+                return (((struct gfs2_glock *)mapping) - 1)->gl_sbd;
+        else
+                return inode->i_sb->s_fs_info;
+}
 
 void gfs2_meta_sync(struct gfs2_glock *gl);
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index a86ed6381566..a054b526dc08 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -65,7 +65,6 @@ static void gfs2_tune_init(struct gfs2_tune *gt)
         gt->gt_quota_scale_den = 1;
         gt->gt_new_files_jdata = 0;
         gt->gt_max_readahead = 1 << 18;
-        gt->gt_stall_secs = 600;
         gt->gt_complain_secs = 10;
 }
 
@@ -1241,10 +1240,9 @@ fail_sb:
 fail_locking:
         init_locking(sdp, &mount_gh, UNDO);
 fail_lm:
+        invalidate_inodes(sb);
         gfs2_gl_hash_clear(sdp);
         gfs2_lm_unmount(sdp);
-        while (invalidate_inodes(sb))
-                yield();
 fail_sys:
         gfs2_sys_fs_del(sdp);
 fail:
diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
index 84350e1be66d..4e64352d49de 100644
--- a/fs/gfs2/ops_inode.c
+++ b/fs/gfs2/ops_inode.c
@@ -976,122 +976,62 @@ out:
 }
 
 /**
- * gfs2_readlinki - return the contents of a symlink
- * @ip: the symlink's inode
- * @buf: a pointer to the buffer to be filled
- * @len: a pointer to the length of @buf
+ * gfs2_follow_link - Follow a symbolic link
+ * @dentry: The dentry of the link
+ * @nd: Data that we pass to vfs_follow_link()
  *
- * If @buf is too small, a piece of memory is kmalloc()ed and needs
- * to be freed by the caller.
+ * This can handle symlinks of any size.
  *
- * Returns: errno
+ * Returns: 0 on success or error code
  */
 
-static int gfs2_readlinki(struct gfs2_inode *ip, char **buf, unsigned int *len)
+static void *gfs2_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
+        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
         struct gfs2_holder i_gh;
         struct buffer_head *dibh;
         unsigned int x;
+        char *buf;
         int error;
 
         gfs2_holder_init(ip->i_gl, LM_ST_SHARED, 0, &i_gh);
         error = gfs2_glock_nq(&i_gh);
         if (error) {
                 gfs2_holder_uninit(&i_gh);
-                return error;
+                nd_set_link(nd, ERR_PTR(error));
+                return NULL;
         }
 
         if (!ip->i_disksize) {
                 gfs2_consist_inode(ip);
-                error = -EIO;
+                buf = ERR_PTR(-EIO);
                 goto out;
         }
 
         error = gfs2_meta_inode_buffer(ip, &dibh);
-        if (error)
+        if (error) {
+                buf = ERR_PTR(error);
                 goto out;
-
-        x = ip->i_disksize + 1;
-        if (x > *len) {
-                *buf = kmalloc(x, GFP_NOFS);
-                if (!*buf) {
-                        error = -ENOMEM;
-                        goto out_brelse;
-                }
         }
 
-        memcpy(*buf, dibh->b_data + sizeof(struct gfs2_dinode), x);
-        *len = x;
-
-out_brelse:
+        x = ip->i_disksize + 1;
+        buf = kmalloc(x, GFP_NOFS);
+        if (!buf)
+                buf = ERR_PTR(-ENOMEM);
+        else
+                memcpy(buf, dibh->b_data + sizeof(struct gfs2_dinode), x);
         brelse(dibh);
 out:
         gfs2_glock_dq_uninit(&i_gh);
-        return error;
-}
-
-/**
- * gfs2_readlink - Read the value of a symlink
- * @dentry: the symlink
- * @buf: the buffer to read the symlink data into
- * @size: the size of the buffer
- *
- * Returns: errno
- */
-
-static int gfs2_readlink(struct dentry *dentry, char __user *user_buf,
-                         int user_size)
-{
-        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
-        char array[GFS2_FAST_NAME_SIZE], *buf = array;
-        unsigned int len = GFS2_FAST_NAME_SIZE;
-        int error;
-
-        error = gfs2_readlinki(ip, &buf, &len);
-        if (error)
-                return error;
-
-        if (user_size > len - 1)
-                user_size = len - 1;
-
-        if (copy_to_user(user_buf, buf, user_size))
-                error = -EFAULT;
-        else
-                error = user_size;
-
-        if (buf != array)
-                kfree(buf);
-
-        return error;
+        nd_set_link(nd, buf);
+        return NULL;
 }
 
-/**
- * gfs2_follow_link - Follow a symbolic link
- * @dentry: The dentry of the link
- * @nd: Data that we pass to vfs_follow_link()
- *
- * This can handle symlinks of any size. It is optimised for symlinks
- * under GFS2_FAST_NAME_SIZE.
- *
- * Returns: 0 on success or error code
- */
-
-static void *gfs2_follow_link(struct dentry *dentry, struct nameidata *nd)
+static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
-        struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
-        char array[GFS2_FAST_NAME_SIZE], *buf = array;
-        unsigned int len = GFS2_FAST_NAME_SIZE;
-        int error;
-
-        error = gfs2_readlinki(ip, &buf, &len);
-        if (!error) {
-                error = vfs_follow_link(nd, buf);
-                if (buf != array)
-                        kfree(buf);
-        } else
-                path_put(&nd->path);
-
-        return ERR_PTR(error);
+        char *s = nd_get_link(nd);
+        if (!IS_ERR(s))
+                kfree(s);
 }
 
 /**
@@ -1426,8 +1366,9 @@ const struct inode_operations gfs2_dir_iops = {
 };
 
 const struct inode_operations gfs2_symlink_iops = {
-        .readlink = gfs2_readlink,
+        .readlink = generic_readlink,
         .follow_link = gfs2_follow_link,
+        .put_link = gfs2_put_link,
         .permission = gfs2_permission,
         .setattr = gfs2_setattr,
         .getattr = gfs2_getattr,
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index b9dd3da22c0a..ca87598ead7f 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -22,6 +22,7 @@
 #include <linux/crc32.h>
 #include <linux/time.h>
 #include <linux/wait.h>
+#include <linux/writeback.h>
 
 #include "gfs2.h"
 #include "incore.h"
@@ -711,7 +712,7 @@ void gfs2_unfreeze_fs(struct gfs2_sbd *sdp)
  * Returns: errno
  */
 
-static int gfs2_write_inode(struct inode *inode, int sync)
+static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
@@ -722,8 +723,7 @@ static int gfs2_write_inode(struct inode *inode, int sync)
         int ret = 0;
 
         /* Check this is a "normal" inode, etc */
-        if (!test_bit(GIF_USER, &ip->i_flags) ||
-            (current->flags & PF_MEMALLOC))
+        if (current->flags & PF_MEMALLOC)
                 return 0;
         ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         if (ret)
@@ -746,7 +746,7 @@ static int gfs2_write_inode(struct inode *inode, int sync)
 do_unlock:
         gfs2_glock_dq_uninit(&gh);
 do_flush:
-        if (sync != 0)
+        if (wbc->sync_mode == WB_SYNC_ALL)
                 gfs2_log_flush(GFS2_SB(inode), ip->i_gl);
         return ret;
 }
@@ -860,6 +860,7 @@ restart:
         gfs2_clear_rgrpd(sdp);
         gfs2_jindex_free(sdp);
         /*  Take apart glock structures and buffer lists  */
+        invalidate_inodes(sdp->sd_vfs);
         gfs2_gl_hash_clear(sdp);
         /*  Unmount the locking protocol  */
         gfs2_lm_unmount(sdp);
@@ -1194,7 +1195,7 @@ static void gfs2_drop_inode(struct inode *inode)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
 
-        if (test_bit(GIF_USER, &ip->i_flags) && inode->i_nlink) {
+        if (inode->i_nlink) {
                 struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
                 if (gl && test_bit(GLF_DEMOTE, &gl->gl_flags))
                         clear_nlink(inode);
@@ -1212,18 +1213,12 @@ static void gfs2_clear_inode(struct inode *inode)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
 
-        /* This tells us its a "real" inode and not one which only
-         * serves to contain an address space (see rgrp.c, meta_io.c)
-         * which therefore doesn't have its own glocks.
-         */
-        if (test_bit(GIF_USER, &ip->i_flags)) {
-                ip->i_gl->gl_object = NULL;
-                gfs2_glock_put(ip->i_gl);
-                ip->i_gl = NULL;
-                if (ip->i_iopen_gh.gh_gl) {
-                        ip->i_iopen_gh.gh_gl->gl_object = NULL;
-                        gfs2_glock_dq_uninit(&ip->i_iopen_gh);
-                }
+        ip->i_gl->gl_object = NULL;
+        gfs2_glock_put(ip->i_gl);
+        ip->i_gl = NULL;
+        if (ip->i_iopen_gh.gh_gl) {
+                ip->i_iopen_gh.gh_gl->gl_object = NULL;
+                gfs2_glock_dq_uninit(&ip->i_iopen_gh);
         }
 }
 
@@ -1358,9 +1353,6 @@ static void gfs2_delete_inode(struct inode *inode)
         struct gfs2_holder gh;
         int error;
 
-        if (!test_bit(GIF_USER, &ip->i_flags))
-                goto out;
-
         error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
         if (unlikely(error)) {
                 gfs2_glock_dq_uninit(&ip->i_iopen_gh);
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 0dc34621f6a6..a0db1c94317d 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -478,7 +478,6 @@ TUNE_ATTR(complain_secs, 0);
 TUNE_ATTR(statfs_slow, 0);
 TUNE_ATTR(new_files_jdata, 0);
 TUNE_ATTR(quota_simul_sync, 1);
-TUNE_ATTR(stall_secs, 1);
 TUNE_ATTR(statfs_quantum, 1);
 TUNE_ATTR_3(quota_scale, quota_scale_show, quota_scale_store);
 
@@ -491,7 +490,6 @@ static struct attribute *tune_attrs[] = {
         &tune_attr_complain_secs.attr,
         &tune_attr_statfs_slow.attr,
         &tune_attr_quota_simul_sync.attr,
-        &tune_attr_stall_secs.attr,
         &tune_attr_statfs_quantum.attr,
         &tune_attr_quota_scale.attr,
         &tune_attr_new_files_jdata.attr,
diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c
index f6a7efa34eb9..226f2bfbf16a 100644
--- a/fs/gfs2/util.c
+++ b/fs/gfs2/util.c
@@ -21,6 +21,7 @@
 #include "util.h"
 
 struct kmem_cache *gfs2_glock_cachep __read_mostly;
+struct kmem_cache *gfs2_glock_aspace_cachep __read_mostly;
 struct kmem_cache *gfs2_inode_cachep __read_mostly;
 struct kmem_cache *gfs2_bufdata_cachep __read_mostly;
 struct kmem_cache *gfs2_rgrpd_cachep __read_mostly;
diff --git a/fs/gfs2/util.h b/fs/gfs2/util.h
index 33e96b0ce9ab..b432e04600de 100644
--- a/fs/gfs2/util.h
+++ b/fs/gfs2/util.h
@@ -145,6 +145,7 @@ gfs2_io_error_bh_i((sdp), (bh), __func__, __FILE__, __LINE__);
 
 
 extern struct kmem_cache *gfs2_glock_cachep;
+extern struct kmem_cache *gfs2_glock_aspace_cachep;
 extern struct kmem_cache *gfs2_inode_cachep;
 extern struct kmem_cache *gfs2_bufdata_cachep;
 extern struct kmem_cache *gfs2_rgrpd_cachep;
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index 052387e11671..fe35e3b626c4 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -188,7 +188,7 @@ extern const struct address_space_operations hfs_btree_aops;
 
 extern struct inode *hfs_new_inode(struct inode *, struct qstr *, int);
 extern void hfs_inode_write_fork(struct inode *, struct hfs_extent *, __be32 *, __be32 *);
-extern int hfs_write_inode(struct inode *, int);
+extern int hfs_write_inode(struct inode *, struct writeback_control *);
 extern int hfs_inode_setattr(struct dentry *, struct iattr *);
 extern void hfs_inode_read_fork(struct inode *inode, struct hfs_extent *ext,
                         __be32 log_size, __be32 phys_size, u32 clump_size);
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index a1cbff2b4d99..14f5cb1b9fdc 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -381,7 +381,7 @@ void hfs_inode_write_fork(struct inode *inode, struct hfs_extent *ext,
                                          HFS_SB(inode->i_sb)->alloc_blksz);
 }
 
-int hfs_write_inode(struct inode *inode, int unused)
+int hfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct inode *main_inode = inode;
         struct hfs_find_data fd;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 43022f3d5148..74b473a8ef92 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -87,7 +87,8 @@ bad_inode:
         return ERR_PTR(err);
 }
 
-static int hfsplus_write_inode(struct inode *inode, int unused)
+static int hfsplus_write_inode(struct inode *inode,
+                struct writeback_control *wbc)
 {
         struct hfsplus_vh *vhdr;
         int ret = 0;
diff --git a/fs/hpfs/anode.c b/fs/hpfs/anode.c
index 1aa88c4e0964..6a2f04bf3df0 100644
--- a/fs/hpfs/anode.c
+++ b/fs/hpfs/anode.c
@@ -353,7 +353,7 @@ int hpfs_ea_read(struct super_block *s, secno a, int ano, unsigned pos,
 }
 
 int hpfs_ea_write(struct super_block *s, secno a, int ano, unsigned pos,
-             unsigned len, char *buf)
+             unsigned len, const char *buf)
 {
         struct buffer_head *bh;
         char *data;
diff --git a/fs/hpfs/dentry.c b/fs/hpfs/dentry.c
index 940d6d150bee..67d9d36b3d5f 100644
--- a/fs/hpfs/dentry.c
+++ b/fs/hpfs/dentry.c
@@ -20,8 +20,8 @@ static int hpfs_hash_dentry(struct dentry *dentry, struct qstr *qstr)
 
         if (l == 1) if (qstr->name[0]=='.') goto x;
         if (l == 2) if (qstr->name[0]=='.' || qstr->name[1]=='.') goto x;
-        hpfs_adjust_length((char *)qstr->name, &l);
-        /*if (hpfs_chk_name((char *)qstr->name,&l))*/
+        hpfs_adjust_length(qstr->name, &l);
+        /*if (hpfs_chk_name(qstr->name,&l))*/
                 /*return -ENAMETOOLONG;*/
                 /*return -ENOENT;*/
         x:
@@ -38,14 +38,16 @@ static int hpfs_compare_dentry(struct dentry *dentry, struct qstr *a, struct qst
 {
         unsigned al=a->len;
         unsigned bl=b->len;
-        hpfs_adjust_length((char *)a->name, &al);
-        /*hpfs_adjust_length((char *)b->name, &bl);*/
+        hpfs_adjust_length(a->name, &al);
+        /*hpfs_adjust_length(b->name, &bl);*/
         /* 'a' is the qstr of an already existing dentry, so the name
          * must be valid. 'b' must be validated first.
          */
 
-        if (hpfs_chk_name((char *)b->name, &bl)) return 1;
-        if (hpfs_compare_names(dentry->d_sb, (char *)a->name, al, (char *)b->name, bl, 0)) return 1;
+        if (hpfs_chk_name(b->name, &bl))
+                return 1;
+        if (hpfs_compare_names(dentry->d_sb, a->name, al, b->name, bl, 0))
+                return 1;
         return 0;
 }
 
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 8865c94f55f6..26e3964a4b8c 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -59,7 +59,7 @@ static int hpfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         struct hpfs_dirent *de;
         int lc;
         long old_pos;
-        char *tempname;
+        unsigned char *tempname;
         int c1, c2 = 0;
         int ret = 0;
 
@@ -158,11 +158,11 @@ static int hpfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 tempname = hpfs_translate_name(inode->i_sb, de->name, de->namelen, lc, de->not_8x3);
                 if (filldir(dirent, tempname, de->namelen, old_pos, de->fnode, DT_UNKNOWN) < 0) {
                         filp->f_pos = old_pos;
-                        if (tempname != (char *)de->name) kfree(tempname);
+                        if (tempname != de->name) kfree(tempname);
                         hpfs_brelse4(&qbh);
                         goto out;
                 }
-                if (tempname != (char *)de->name) kfree(tempname);
+                if (tempname != de->name) kfree(tempname);
                 hpfs_brelse4(&qbh);
         }
 out:
@@ -187,7 +187,7 @@ out:
 
 struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh;
         struct hpfs_dirent *de;
@@ -197,7 +197,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
         struct hpfs_inode_info *hpfs_result;
 
         lock_kernel();
-        if ((err = hpfs_chk_name((char *)name, &len))) {
+        if ((err = hpfs_chk_name(name, &len))) {
                 if (err == -ENAMETOOLONG) {
                         unlock_kernel();
                         return ERR_PTR(-ENAMETOOLONG);
@@ -209,7 +209,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
          * '.' and '..' will never be passed here.
          */
 
-        de = map_dirent(dir, hpfs_i(dir)->i_dno, (char *) name, len, NULL, &qbh);
+        de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, NULL, &qbh);
 
         /*
          * This is not really a bailout, just means file not found.
@@ -250,7 +250,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
         hpfs_result = hpfs_i(result);
         if (!de->directory) hpfs_result->i_parent_dir = dir->i_ino;
 
-        hpfs_decide_conv(result, (char *)name, len);
+        hpfs_decide_conv(result, name, len);
 
         if (de->has_acl || de->has_xtd_perm) if (!(dir->i_sb->s_flags & MS_RDONLY)) {
                 hpfs_error(result->i_sb, "ACLs or XPERM found. This is probably HPFS386. This driver doesn't support it now. Send me some info on these structures");
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index fe83c2b7d2d8..9b2ffadfc8c4 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -158,7 +158,8 @@ static void set_last_pointer(struct super_block *s, struct dnode *d, dnode_secno
 
 /* Add an entry to dnode and don't care if it grows over 2048 bytes */
 
-struct hpfs_dirent *hpfs_add_de(struct super_block *s, struct dnode *d, unsigned char *name,
+struct hpfs_dirent *hpfs_add_de(struct super_block *s, struct dnode *d,
+                                const unsigned char *name,
                                 unsigned namelen, secno down_ptr)
 {
         struct hpfs_dirent *de;
@@ -223,7 +224,7 @@ static void fix_up_ptrs(struct super_block *s, struct dnode *d)
 /* Add an entry to dnode and do dnode splitting if required */
 
 static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
-                             unsigned char *name, unsigned namelen,
+                             const unsigned char *name, unsigned namelen,
                              struct hpfs_dirent *new_de, dnode_secno down_ptr)
 {
         struct quad_buffer_head qbh, qbh1, qbh2;
@@ -231,7 +232,7 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
         dnode_secno adno, rdno;
         struct hpfs_dirent *de;
         struct hpfs_dirent nde;
-        char *nname;
+        unsigned char *nname;
         int h;
         int pos;
         struct buffer_head *bh;
@@ -305,7 +306,9 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
                 pos++;
         }
         copy_de(new_de = &nde, de);
-        memcpy(name = nname, de->name, namelen = de->namelen);
+        memcpy(nname, de->name, de->namelen);
+        name = nname;
+        namelen = de->namelen;
         for_all_poss(i, hpfs_pos_subst, ((loff_t)dno << 4) | pos, 4);
         down_ptr = adno;
         set_last_pointer(i->i_sb, ad, de->down ? de_down_pointer(de) : 0);
@@ -368,7 +371,8 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
  * I hope, now it's finally bug-free.
  */
 
-int hpfs_add_dirent(struct inode *i, unsigned char *name, unsigned namelen,
+int hpfs_add_dirent(struct inode *i,
+                    const unsigned char *name, unsigned namelen,
                     struct hpfs_dirent *new_de, int cdepth)
 {
         struct hpfs_inode_info *hpfs_inode = hpfs_i(i);
@@ -897,7 +901,8 @@ struct hpfs_dirent *map_pos_dirent(struct inode *inode, loff_t *posp,
 
 /* Find a dirent in tree */
 
-struct hpfs_dirent *map_dirent(struct inode *inode, dnode_secno dno, char *name, unsigned len,
+struct hpfs_dirent *map_dirent(struct inode *inode, dnode_secno dno,
+                               const unsigned char *name, unsigned len,
                                dnode_secno *dd, struct quad_buffer_head *qbh)
 {
         struct dnode *dnode;
@@ -988,8 +993,8 @@ void hpfs_remove_dtree(struct super_block *s, dnode_secno dno)
 struct hpfs_dirent *map_fnode_dirent(struct super_block *s, fnode_secno fno,
                                      struct fnode *f, struct quad_buffer_head *qbh)
 {
-        char *name1;
-        char *name2;
+        unsigned char *name1;
+        unsigned char *name2;
         int name1len, name2len;
         struct dnode *d;
         dnode_secno dno, downd;
diff --git a/fs/hpfs/ea.c b/fs/hpfs/ea.c
index 547a8384571f..45e53d972b42 100644
--- a/fs/hpfs/ea.c
+++ b/fs/hpfs/ea.c
@@ -62,8 +62,8 @@ static char *get_indirect_ea(struct super_block *s, int ano, secno a, int size)
         return ret;
 }
 
-static void set_indirect_ea(struct super_block *s, int ano, secno a, char *data,
-                            int size)
+static void set_indirect_ea(struct super_block *s, int ano, secno a,
+                            const char *data, int size)
 {
         hpfs_ea_write(s, a, ano, 0, size, data);
 }
@@ -186,7 +186,8 @@ char *hpfs_get_ea(struct super_block *s, struct fnode *fnode, char *key, int *si
  * This driver can't change sizes of eas ('cause I just don't need it).
  */
 
-void hpfs_set_ea(struct inode *inode, struct fnode *fnode, char *key, char *data, int size)
+void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
+                 const char *data, int size)
 {
         fnode_secno fno = inode->i_ino;
         struct super_block *s = inode->i_sb;
diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
index 701ca54c0867..97bf738cd5d6 100644
--- a/fs/hpfs/hpfs_fn.h
+++ b/fs/hpfs/hpfs_fn.h
@@ -215,7 +215,7 @@ secno hpfs_bplus_lookup(struct super_block *, struct inode *, struct bplus_heade
 secno hpfs_add_sector_to_btree(struct super_block *, secno, int, unsigned);
 void hpfs_remove_btree(struct super_block *, struct bplus_header *);
 int hpfs_ea_read(struct super_block *, secno, int, unsigned, unsigned, char *);
-int hpfs_ea_write(struct super_block *, secno, int, unsigned, unsigned, char *);
+int hpfs_ea_write(struct super_block *, secno, int, unsigned, unsigned, const char *);
 void hpfs_ea_remove(struct super_block *, secno, int, unsigned);
 void hpfs_truncate_btree(struct super_block *, secno, int, unsigned);
 void hpfs_remove_fnode(struct super_block *, fnode_secno fno);
@@ -244,13 +244,17 @@ extern const struct file_operations hpfs_dir_ops;
 
 void hpfs_add_pos(struct inode *, loff_t *);
 void hpfs_del_pos(struct inode *, loff_t *);
-struct hpfs_dirent *hpfs_add_de(struct super_block *, struct dnode *, unsigned char *, unsigned, secno);
-int hpfs_add_dirent(struct inode *, unsigned char *, unsigned, struct hpfs_dirent *, int);
+struct hpfs_dirent *hpfs_add_de(struct super_block *, struct dnode *,
+                                const unsigned char *, unsigned, secno);
+int hpfs_add_dirent(struct inode *, const unsigned char *, unsigned,
+                    struct hpfs_dirent *, int);
 int hpfs_remove_dirent(struct inode *, dnode_secno, struct hpfs_dirent *, struct quad_buffer_head *, int);
 void hpfs_count_dnodes(struct super_block *, dnode_secno, int *, int *, int *);
 dnode_secno hpfs_de_as_down_as_possible(struct super_block *, dnode_secno dno);
 struct hpfs_dirent *map_pos_dirent(struct inode *, loff_t *, struct quad_buffer_head *);
-struct hpfs_dirent *map_dirent(struct inode *, dnode_secno, char *, unsigned, dnode_secno *, struct quad_buffer_head *);
+struct hpfs_dirent *map_dirent(struct inode *, dnode_secno,
+                               const unsigned char *, unsigned, dnode_secno *,
+                               struct quad_buffer_head *);
 void hpfs_remove_dtree(struct super_block *, dnode_secno);
 struct hpfs_dirent *map_fnode_dirent(struct super_block *, fnode_secno, struct fnode *, struct quad_buffer_head *);
 
@@ -259,7 +263,8 @@ struct hpfs_dirent *map_fnode_dirent(struct super_block *, fnode_secno, struct f
 void hpfs_ea_ext_remove(struct super_block *, secno, int, unsigned);
 int hpfs_read_ea(struct super_block *, struct fnode *, char *, char *, int);
 char *hpfs_get_ea(struct super_block *, struct fnode *, char *, int *);
-void hpfs_set_ea(struct inode *, struct fnode *, char *, char *, int);
+void hpfs_set_ea(struct inode *, struct fnode *, const char *,
+                 const char *, int);
 
 /* file.c */
 
@@ -282,7 +287,7 @@ void hpfs_delete_inode(struct inode *);
 
 unsigned *hpfs_map_dnode_bitmap(struct super_block *, struct quad_buffer_head *);
 unsigned *hpfs_map_bitmap(struct super_block *, unsigned, struct quad_buffer_head *, char *);
-char *hpfs_load_code_page(struct super_block *, secno);
+unsigned char *hpfs_load_code_page(struct super_block *, secno);
 secno *hpfs_load_bitmap_directory(struct super_block *, secno bmp);
 struct fnode *hpfs_map_fnode(struct super_block *s, ino_t, struct buffer_head **);
 struct anode *hpfs_map_anode(struct super_block *s, anode_secno, struct buffer_head **);
@@ -292,12 +297,13 @@ dnode_secno hpfs_fnode_dno(struct super_block *s, ino_t ino);
 /* name.c */
 
 unsigned char hpfs_upcase(unsigned char *, unsigned char);
-int hpfs_chk_name(unsigned char *, unsigned *);
-char *hpfs_translate_name(struct super_block *, unsigned char *, unsigned, int, int);
-int hpfs_compare_names(struct super_block *, unsigned char *, unsigned, unsigned char *, unsigned, int);
-int hpfs_is_name_long(unsigned char *, unsigned);
-void hpfs_adjust_length(unsigned char *, unsigned *);
-void hpfs_decide_conv(struct inode *, unsigned char *, unsigned);
+int hpfs_chk_name(const unsigned char *, unsigned *);
+unsigned char *hpfs_translate_name(struct super_block *, unsigned char *, unsigned, int, int);
+int hpfs_compare_names(struct super_block *, const unsigned char *, unsigned,
+                       const unsigned char *, unsigned, int);
+int hpfs_is_name_long(const unsigned char *, unsigned);
+void hpfs_adjust_length(const unsigned char *, unsigned *);
+void hpfs_decide_conv(struct inode *, const unsigned char *, unsigned);
 
 /* namei.c */
 
diff --git a/fs/hpfs/inode.c b/fs/hpfs/inode.c
index fe703ae46bc7..ff90affb94e1 100644
--- a/fs/hpfs/inode.c
+++ b/fs/hpfs/inode.c
@@ -46,7 +46,7 @@ void hpfs_read_inode(struct inode *i)
         struct fnode *fnode;
         struct super_block *sb = i->i_sb;
         struct hpfs_inode_info *hpfs_inode = hpfs_i(i);
-        unsigned char *ea;
+        void *ea;
         int ea_size;
 
         if (!(fnode = hpfs_map_fnode(sb, i->i_ino, &bh))) {
@@ -112,7 +112,7 @@ void hpfs_read_inode(struct inode *i)
                 }
         }
         if (fnode->dirflag) {
-                unsigned n_dnodes, n_subdirs;
+                int n_dnodes, n_subdirs;
                 i->i_mode |= S_IFDIR;
                 i->i_op = &hpfs_dir_iops;
                 i->i_fop = &hpfs_dir_ops;
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index c4724589b2eb..840d033ecee8 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -35,7 +35,7 @@ unsigned int *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
  * lowercasing table
  */
 
-char *hpfs_load_code_page(struct super_block *s, secno cps)
+unsigned char *hpfs_load_code_page(struct super_block *s, secno cps)
 {
         struct buffer_head *bh;
         secno cpds;
@@ -71,7 +71,7 @@ char *hpfs_load_code_page(struct super_block *s, secno cps)
                 brelse(bh);
                 return NULL;
         }
-        ptr = (char *)cpd + cpd->offs[cpi] + 6;
+        ptr = (unsigned char *)cpd + cpd->offs[cpi] + 6;
         if (!(cp_table = kmalloc(256, GFP_KERNEL))) {
                 printk("HPFS: out of memory for code page table\n");
                 brelse(bh);
@@ -217,7 +217,7 @@ struct dnode *hpfs_map_dnode(struct super_block *s, unsigned secno,
         if ((dnode = hpfs_map_4sectors(s, secno, qbh, DNODE_RD_AHEAD)))
                 if (hpfs_sb(s)->sb_chk) {
                         unsigned p, pp = 0;
-                        unsigned char *d = (char *)dnode;
+                        unsigned char *d = (unsigned char *)dnode;
                         int b = 0;
                         if (dnode->magic != DNODE_MAGIC) {
                                 hpfs_error(s, "bad magic on dnode %08x", secno);
diff --git a/fs/hpfs/name.c b/fs/hpfs/name.c
index 1f4a964384eb..f24736d7a439 100644
--- a/fs/hpfs/name.c
+++ b/fs/hpfs/name.c
@@ -8,16 +8,16 @@
 
 #include "hpfs_fn.h"
 
-static char *text_postfix[]={
+static const char *text_postfix[]={
 ".ASM", ".BAS", ".BAT", ".C", ".CC", ".CFG", ".CMD", ".CON", ".CPP", ".DEF",
 ".DOC", ".DPR", ".ERX", ".H", ".HPP", ".HTM", ".HTML", ".JAVA", ".LOG", ".PAS",
 ".RC", ".TEX", ".TXT", ".Y", ""};
 
-static char *text_prefix[]={
+static const char *text_prefix[]={
 "AUTOEXEC.", "CHANGES", "COPYING", "CONFIG.", "CREDITS", "FAQ", "FILE_ID.DIZ",
 "MAKEFILE", "READ.ME", "README", "TERMCAP", ""};
 
-void hpfs_decide_conv(struct inode *inode, unsigned char *name, unsigned len)
+void hpfs_decide_conv(struct inode *inode, const unsigned char *name, unsigned len)
 {
         struct hpfs_inode_info *hpfs_inode = hpfs_i(inode);
         int i;
@@ -71,7 +71,7 @@ static inline unsigned char locase(unsigned char *dir, unsigned char a)
         return dir[a];
 }
 
-int hpfs_chk_name(unsigned char *name, unsigned *len)
+int hpfs_chk_name(const unsigned char *name, unsigned *len)
 {
         int i;
         if (*len > 254) return -ENAMETOOLONG;
@@ -83,10 +83,10 @@ int hpfs_chk_name(unsigned char *name, unsigned *len)
         return 0;
 }
 
-char *hpfs_translate_name(struct super_block *s, unsigned char *from,
+unsigned char *hpfs_translate_name(struct super_block *s, unsigned char *from,
                           unsigned len, int lc, int lng)
 {
-        char *to;
+        unsigned char *to;
         int i;
         if (hpfs_sb(s)->sb_chk >= 2) if (hpfs_is_name_long(from, len) != lng) {
                 printk("HPFS: Long name flag mismatch - name ");
@@ -103,8 +103,9 @@ char *hpfs_translate_name(struct super_block *s, unsigned char *from,
         return to;
 }
 
-int hpfs_compare_names(struct super_block *s, unsigned char *n1, unsigned l1,
-                       unsigned char *n2, unsigned l2, int last)
+int hpfs_compare_names(struct super_block *s,
+                       const unsigned char *n1, unsigned l1,
+                       const unsigned char *n2, unsigned l2, int last)
 {
         unsigned l = l1 < l2 ? l1 : l2;
         unsigned i;
@@ -120,7 +121,7 @@ int hpfs_compare_names(struct super_block *s, unsigned char *n1, unsigned l1,
         return 0;
 }
 
-int hpfs_is_name_long(unsigned char *name, unsigned len)
+int hpfs_is_name_long(const unsigned char *name, unsigned len)
 {
         int i,j;
         for (i = 0; i < len && name[i] != '.'; i++)
@@ -134,7 +135,7 @@ int hpfs_is_name_long(unsigned char *name, unsigned len)
 
 /* OS/2 clears dots and spaces at the end of file name, so we have to */
 
-void hpfs_adjust_length(unsigned char *name, unsigned *len)
+void hpfs_adjust_length(const unsigned char *name, unsigned *len)
 {
         if (!*len) return;
         if (*len == 1 && name[0] == '.') return;
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 82b9c4ba9ed0..11c2b4080f65 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -11,7 +11,7 @@
 
 static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh0;
         struct buffer_head *bh;
@@ -24,7 +24,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         int r;
         struct hpfs_dirent dee;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len))) return err==-ENOENT ? -EINVAL : err;
+        if ((err = hpfs_chk_name(name, &len))) return err==-ENOENT ? -EINVAL : err;
         lock_kernel();
         err = -ENOSPC;
         fnode = hpfs_alloc_fnode(dir->i_sb, hpfs_i(dir)->i_dno, &fno, &bh);
@@ -62,7 +62,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
                 result->i_mode &= ~0222;
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail3;
         if (r == -1) {
@@ -121,7 +121,7 @@ bail:
 
 static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struct nameidata *nd)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct inode *result = NULL;
         struct buffer_head *bh;
@@ -130,7 +130,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         int r;
         struct hpfs_dirent dee;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len)))
+        if ((err = hpfs_chk_name(name, &len)))
                 return err==-ENOENT ? -EINVAL : err;
         lock_kernel();
         err = -ENOSPC;
@@ -155,7 +155,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         result->i_op = &hpfs_file_iops;
         result->i_fop = &hpfs_file_ops;
         result->i_nlink = 1;
-        hpfs_decide_conv(result, (char *)name, len);
+        hpfs_decide_conv(result, name, len);
         hpfs_i(result)->i_parent_dir = dir->i_ino;
         result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, dee.creation_date);
         result->i_ctime.tv_nsec = 0;
@@ -170,7 +170,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         hpfs_i(result)->mmu_private = 0;
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -211,7 +211,7 @@ bail:
 
 static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t rdev)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct buffer_head *bh;
         struct fnode *fnode;
@@ -220,7 +220,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         struct hpfs_dirent dee;
         struct inode *result = NULL;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len))) return err==-ENOENT ? -EINVAL : err;
+        if ((err = hpfs_chk_name(name, &len))) return err==-ENOENT ? -EINVAL : err;
         if (hpfs_sb(dir->i_sb)->sb_eas < 2) return -EPERM;
         if (!new_valid_dev(rdev))
                 return -EINVAL;
@@ -256,7 +256,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         init_special_inode(result, mode, rdev);
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -289,7 +289,7 @@ bail:
 
 static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *symlink)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct buffer_head *bh;
         struct fnode *fnode;
@@ -298,7 +298,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         struct hpfs_dirent dee;
         struct inode *result;
         int err;
-        if ((err = hpfs_chk_name((char *)name, &len))) return err==-ENOENT ? -EINVAL : err;
+        if ((err = hpfs_chk_name(name, &len))) return err==-ENOENT ? -EINVAL : err;
         lock_kernel();
         if (hpfs_sb(dir->i_sb)->sb_eas < 2) {
                 unlock_kernel();
@@ -335,7 +335,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         result->i_data.a_ops = &hpfs_symlink_aops;
 
         mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, (char *)name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee, 0);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -345,7 +345,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         fnode->len = len;
         memcpy(fnode->name, name, len > 15 ? 15 : len);
         fnode->up = dir->i_ino;
-        hpfs_set_ea(result, fnode, "SYMLINK", (char *)symlink, strlen(symlink));
+        hpfs_set_ea(result, fnode, "SYMLINK", symlink, strlen(symlink));
         mark_buffer_dirty(bh);
         brelse(bh);
 
@@ -369,7 +369,7 @@ bail:
 
 static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh;
         struct hpfs_dirent *de;
@@ -381,12 +381,12 @@ static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
         int err;
 
         lock_kernel();
-        hpfs_adjust_length((char *)name, &len);
+        hpfs_adjust_length(name, &len);
 again:
         mutex_lock(&hpfs_i(inode)->i_parent_mutex);
         mutex_lock(&hpfs_i(dir)->i_mutex);
         err = -ENOENT;
-        de = map_dirent(dir, hpfs_i(dir)->i_dno, (char *)name, len, &dno, &qbh);
+        de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
         if (!de)
                 goto out;
 
@@ -413,22 +413,25 @@ again:
 
                 mutex_unlock(&hpfs_i(dir)->i_mutex);
                 mutex_unlock(&hpfs_i(inode)->i_parent_mutex);
-                d_drop(dentry);
-                spin_lock(&dentry->d_lock);
-                if (atomic_read(&dentry->d_count) > 1 ||
-                    generic_permission(inode, MAY_WRITE, NULL) ||
+                dentry_unhash(dentry);
+                if (!d_unhashed(dentry)) {
+                        dput(dentry);
+                        unlock_kernel();
+                        return -ENOSPC;
+                }
+                if (generic_permission(inode, MAY_WRITE, NULL) ||
                     !S_ISREG(inode->i_mode) ||
                     get_write_access(inode)) {
-                        spin_unlock(&dentry->d_lock);
                         d_rehash(dentry);
+                        dput(dentry);
                 } else {
                         struct iattr newattrs;
-                        spin_unlock(&dentry->d_lock);
                         /*printk("HPFS: truncating file before delete.\n");*/
                         newattrs.ia_size = 0;
                         newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
                         err = notify_change(dentry, &newattrs);
                         put_write_access(inode);
+                        dput(dentry);
                         if (!err)
                                 goto again;
                 }
@@ -451,7 +454,7 @@ out:
 
 static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
 {
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         unsigned len = dentry->d_name.len;
         struct quad_buffer_head qbh;
         struct hpfs_dirent *de;
@@ -462,12 +465,12 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
         int err;
         int r;
 
-        hpfs_adjust_length((char *)name, &len);
+        hpfs_adjust_length(name, &len);
         lock_kernel();
         mutex_lock(&hpfs_i(inode)->i_parent_mutex);
         mutex_lock(&hpfs_i(dir)->i_mutex);
         err = -ENOENT;
-        de = map_dirent(dir, hpfs_i(dir)->i_dno, (char *)name, len, &dno, &qbh);
+        de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
         if (!de)
                 goto out;
 
@@ -546,10 +549,10 @@ const struct address_space_operations hpfs_symlink_aops = {
 static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 struct inode *new_dir, struct dentry *new_dentry)
 {
-        char *old_name = (char *)old_dentry->d_name.name;
-        int old_len = old_dentry->d_name.len;
-        char *new_name = (char *)new_dentry->d_name.name;
-        int new_len = new_dentry->d_name.len;
+        const unsigned char *old_name = old_dentry->d_name.name;
+        unsigned old_len = old_dentry->d_name.len;
+        const unsigned char *new_name = new_dentry->d_name.name;
+        unsigned new_len = new_dentry->d_name.len;
         struct inode *i = old_dentry->d_inode;
         struct inode *new_inode = new_dentry->d_inode;
         struct quad_buffer_head qbh, qbh1;
@@ -560,9 +563,9 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct buffer_head *bh;
         struct fnode *fnode;
         int err;
-        if ((err = hpfs_chk_name((char *)new_name, &new_len))) return err;
+        if ((err = hpfs_chk_name(new_name, &new_len))) return err;
         err = 0;
-        hpfs_adjust_length((char *)old_name, &old_len);
+        hpfs_adjust_length(old_name, &old_len);
 
         lock_kernel();
         /* order doesn't matter, due to VFS exclusion */
@@ -579,7 +582,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 goto end1;
         }
 
-        if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, (char *)old_name, old_len, &dno, &qbh))) {
+        if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, old_name, old_len, &dno, &qbh))) {
                 hpfs_error(i->i_sb, "lookup succeeded but map dirent failed");
                 err = -ENOENT;
                 goto end1;
@@ -590,7 +593,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (new_inode) {
                 int r;
                 if ((r = hpfs_remove_dirent(old_dir, dno, dep, &qbh, 1)) != 2) {
-                        if ((nde = map_dirent(new_dir, hpfs_i(new_dir)->i_dno, (char *)new_name, new_len, NULL, &qbh1))) {
+                        if ((nde = map_dirent(new_dir, hpfs_i(new_dir)->i_dno, new_name, new_len, NULL, &qbh1))) {
                                 clear_nlink(new_inode);
                                 copy_de(nde, &de);
                                 memcpy(nde->name, new_name, new_len);
@@ -618,7 +621,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         }
         
         if (new_dir == old_dir)
-                if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, (char *)old_name, old_len, &dno, &qbh))) {
+                if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, old_name, old_len, &dno, &qbh))) {
                         hpfs_unlock_creation(i->i_sb);
                         hpfs_error(i->i_sb, "lookup succeeded but map dirent failed at #2");
                         err = -ENOENT;
@@ -648,7 +651,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 brelse(bh);
         }
         hpfs_i(i)->i_conv = hpfs_sb(i->i_sb)->sb_conv;
-        hpfs_decide_conv(i, (char *)new_name, new_len);
+        hpfs_decide_conv(i, new_name, new_len);
 end1:
         if (old_dir != new_dir)
                 mutex_unlock(&hpfs_i(new_dir)->i_mutex);
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index 7239efc690d8..2e4dfa8593da 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -718,7 +718,7 @@ static int hppfs_fill_super(struct super_block *sb, void *d, int silent)
         struct vfsmount *proc_mnt;
         int err = -ENOENT;
 
-        proc_mnt = do_kern_mount("proc", 0, "proc", NULL);
+        proc_mnt = mntget(current->nsproxy->pid_ns->proc_mnt);
         if (IS_ERR(proc_mnt))
                 goto out;
 
diff --git a/fs/internal.h b/fs/internal.h
index e96a1667d749..8a03a5447bdf 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -70,6 +70,8 @@ extern struct vfsmount *copy_tree(struct vfsmount *, struct dentry *, int);
 
 extern void __init mnt_init(void);
 
+extern spinlock_t vfsmount_lock;
+
 /*
  * fs_struct.c
  */
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index 886849370950..30beb11ef928 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -507,6 +507,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
         if (blocknr < journal->j_tail)
                 freed = freed + journal->j_last - journal->j_first;
 
+        trace_jbd2_cleanup_journal_tail(journal, first_tid, blocknr, freed);
         jbd_debug(1,
                   "Cleaning journal tail from %d to %d (offset %lu), "
                   "freeing %lu\n",
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 1bc74b6f26d2..671da7fb7ffd 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -883,8 +883,7 @@ restart_loop:
                 spin_unlock(&journal->j_list_lock);
                 bh = jh2bh(jh);
                 jbd_lock_bh_state(bh);
-                J_ASSERT_JH(jh, jh->b_transaction == commit_transaction ||
-                        jh->b_transaction == journal->j_running_transaction);
+                J_ASSERT_JH(jh, jh->b_transaction == commit_transaction);
 
                 /*
                  * If there is undo-protected committed data against
@@ -930,12 +929,12 @@ restart_loop:
                 /* A buffer which has been freed while still being
                  * journaled by a previous transaction may end up still
                  * being dirty here, but we want to avoid writing back
-                 * that buffer in the future now that the last use has
-                 * been committed.  That's not only a performance gain,
-                 * it also stops aliasing problems if the buffer is left
-                 * behind for writeback and gets reallocated for another
+                 * that buffer in the future after the "add to orphan"
+                 * operation been committed,  That's not only a performance
+                 * gain, it also stops aliasing problems if the buffer is
+                 * left behind for writeback and gets reallocated for another
                  * use in a different page. */
-                if (buffer_freed(bh)) {
+                if (buffer_freed(bh) && !jh->b_next_transaction) {
                         clear_buffer_freed(bh);
                         clear_buffer_jbddirty(bh);
                 }
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index ac0d027595d0..c03d4dce4d76 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -39,6 +39,8 @@
 #include <linux/seq_file.h>
 #include <linux/math64.h>
 #include <linux/hash.h>
+#include <linux/log2.h>
+#include <linux/vmalloc.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/jbd2.h>
@@ -93,6 +95,7 @@ EXPORT_SYMBOL(jbd2_journal_begin_ordered_truncate);
 
 static int journal_convert_superblock_v1(journal_t *, journal_superblock_t *);
 static void __journal_abort_soft (journal_t *journal, int errno);
+static int jbd2_journal_create_slab(size_t slab_size);
 
 /*
  * Helper function used to manage commit timeouts
@@ -1248,6 +1251,13 @@ int jbd2_journal_load(journal_t *journal)
                 }
         }
 
+        /*
+         * Create a slab for this blocksize
+         */
+        err = jbd2_journal_create_slab(be32_to_cpu(sb->s_blocksize));
+        if (err)
+                return err;
+
         /* Let the recovery code check whether it needs to recover any
          * data from the journal. */
         if (jbd2_journal_recover(journal))
@@ -1807,6 +1817,127 @@ size_t journal_tag_bytes(journal_t *journal)
 }
 
 /*
+ * JBD memory management
+ *
+ * These functions are used to allocate block-sized chunks of memory
+ * used for making copies of buffer_head data.  Very often it will be
+ * page-sized chunks of data, but sometimes it will be in
+ * sub-page-size chunks.  (For example, 16k pages on Power systems
+ * with a 4k block file system.)  For blocks smaller than a page, we
+ * use a SLAB allocator.  There are slab caches for each block size,
+ * which are allocated at mount time, if necessary, and we only free
+ * (all of) the slab caches when/if the jbd2 module is unloaded.  For
+ * this reason we don't need to a mutex to protect access to
+ * jbd2_slab[] allocating or releasing memory; only in
+ * jbd2_journal_create_slab().
+ */
+#define JBD2_MAX_SLABS 8
+static struct kmem_cache *jbd2_slab[JBD2_MAX_SLABS];
+static DECLARE_MUTEX(jbd2_slab_create_sem);
+
+static const char *jbd2_slab_names[JBD2_MAX_SLABS] = {
+        "jbd2_1k", "jbd2_2k", "jbd2_4k", "jbd2_8k",
+        "jbd2_16k", "jbd2_32k", "jbd2_64k", "jbd2_128k"
+};
+
+
+static void jbd2_journal_destroy_slabs(void)
+{
+        int i;
+
+        for (i = 0; i < JBD2_MAX_SLABS; i++) {
+                if (jbd2_slab[i])
+                        kmem_cache_destroy(jbd2_slab[i]);
+                jbd2_slab[i] = NULL;
+        }
+}
+
+static int jbd2_journal_create_slab(size_t size)
+{
+        int i = order_base_2(size) - 10;
+        size_t slab_size;
+
+        if (size == PAGE_SIZE)
+                return 0;
+
+        if (i >= JBD2_MAX_SLABS)
+                return -EINVAL;
+
+        if (unlikely(i < 0))
+                i = 0;
+        down(&jbd2_slab_create_sem);
+        if (jbd2_slab[i]) {
+                up(&jbd2_slab_create_sem);
+                return 0;       /* Already created */
+        }
+
+        slab_size = 1 << (i+10);
+        jbd2_slab[i] = kmem_cache_create(jbd2_slab_names[i], slab_size,
+                                         slab_size, 0, NULL);
+        up(&jbd2_slab_create_sem);
+        if (!jbd2_slab[i]) {
+                printk(KERN_EMERG "JBD2: no memory for jbd2_slab cache\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static struct kmem_cache *get_slab(size_t size)
+{
+        int i = order_base_2(size) - 10;
+
+        BUG_ON(i >= JBD2_MAX_SLABS);
+        if (unlikely(i < 0))
+                i = 0;
+        BUG_ON(jbd2_slab[i] == 0);
+        return jbd2_slab[i];
+}
+
+void *jbd2_alloc(size_t size, gfp_t flags)
+{
+        void *ptr;
+
+        BUG_ON(size & (size-1)); /* Must be a power of 2 */
+
+        flags |= __GFP_REPEAT;
+        if (size == PAGE_SIZE)
+                ptr = (void *)__get_free_pages(flags, 0);
+        else if (size > PAGE_SIZE) {
+                int order = get_order(size);
+
+                if (order < 3)
+                        ptr = (void *)__get_free_pages(flags, order);
+                else
+                        ptr = vmalloc(size);
+        } else
+                ptr = kmem_cache_alloc(get_slab(size), flags);
+
+        /* Check alignment; SLUB has gotten this wrong in the past,
+         * and this can lead to user data corruption! */
+        BUG_ON(((unsigned long) ptr) & (size-1));
+
+        return ptr;
+}
+
+void jbd2_free(void *ptr, size_t size)
+{
+        if (size == PAGE_SIZE) {
+                free_pages((unsigned long)ptr, 0);
+                return;
+        }
+        if (size > PAGE_SIZE) {
+                int order = get_order(size);
+
+                if (order < 3)
+                        free_pages((unsigned long)ptr, order);
+                else
+                        vfree(ptr);
+                return;
+        }
+        kmem_cache_free(get_slab(size), ptr);
+};
+
+/*
  * Journal_head storage management
  */
 static struct kmem_cache *jbd2_journal_head_cache;
@@ -2204,6 +2335,7 @@ static void jbd2_journal_destroy_caches(void)
         jbd2_journal_destroy_revoke_caches();
         jbd2_journal_destroy_jbd2_journal_head_cache();
         jbd2_journal_destroy_handle_cache();
+        jbd2_journal_destroy_slabs();
 }
 
 static int __init journal_init(void)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index a0512700542f..bfc70f57900f 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1727,6 +1727,21 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
         if (!jh)
                 goto zap_buffer_no_jh;
 
+        /*
+         * We cannot remove the buffer from checkpoint lists until the
+         * transaction adding inode to orphan list (let's call it T)
+         * is committed.  Otherwise if the transaction changing the
+         * buffer would be cleaned from the journal before T is
+         * committed, a crash will cause that the correct contents of
+         * the buffer will be lost.  On the other hand we have to
+         * clear the buffer dirty bit at latest at the moment when the
+         * transaction marking the buffer as freed in the filesystem
+         * structures is committed because from that moment on the
+         * buffer can be reallocated and used by a different page.
+         * Since the block hasn't been freed yet but the inode has
+         * already been added to orphan list, it is safe for us to add
+         * the buffer to BJ_Forget list of the newest transaction.
+         */
         transaction = jh->b_transaction;
         if (transaction == NULL) {
                 /* First case: not on any transaction.  If it
@@ -1783,16 +1798,15 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
         } else if (transaction == journal->j_committing_transaction) {
                 JBUFFER_TRACE(jh, "on committing transaction");
                 /*
-                 * If it is committing, we simply cannot touch it.  We
-                 * can remove it's next_transaction pointer from the
-                 * running transaction if that is set, but nothing
-                 * else. */
+                 * The buffer is committing, we simply cannot touch
+                 * it. So we just set j_next_transaction to the
+                 * running transaction (if there is one) and mark
+                 * buffer as freed so that commit code knows it should
+                 * clear dirty bits when it is done with the buffer.
+                 */
                 set_buffer_freed(bh);
-                if (jh->b_next_transaction) {
-                        J_ASSERT(jh->b_next_transaction ==
-                                        journal->j_running_transaction);
-                        jh->b_next_transaction = NULL;
-                }
+                if (journal->j_running_transaction && buffer_jbddirty(bh))
+                        jh->b_next_transaction = journal->j_running_transaction;
                 jbd2_journal_put_journal_head(jh);
                 spin_unlock(&journal->j_list_lock);
                 jbd_unlock_bh_state(bh);
@@ -1969,7 +1983,7 @@ void jbd2_journal_file_buffer(struct journal_head *jh,
  */
 void __jbd2_journal_refile_buffer(struct journal_head *jh)
 {
-        int was_dirty;
+        int was_dirty, jlist;
         struct buffer_head *bh = jh2bh(jh);
 
         J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
@@ -1991,8 +2005,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
         __jbd2_journal_temp_unlink_buffer(jh);
         jh->b_transaction = jh->b_next_transaction;
         jh->b_next_transaction = NULL;
-        __jbd2_journal_file_buffer(jh, jh->b_transaction,
-                                jh->b_modified ? BJ_Metadata : BJ_Reserved);
+        if (buffer_freed(bh))
+                jlist = BJ_Forget;
+        else if (jh->b_modified)
+                jlist = BJ_Metadata;
+        else
+                jlist = BJ_Reserved;
+        __jbd2_journal_file_buffer(jh, jh->b_transaction, jlist);
         J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
 
         if (was_dirty)
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index b2ae190a77ba..182b78cc3e62 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -22,6 +22,7 @@
 #include <linux/buffer_head.h>
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
+#include <linux/writeback.h>
 #include "jfs_incore.h"
 #include "jfs_inode.h"
 #include "jfs_filsys.h"
@@ -120,8 +121,10 @@ int jfs_commit_inode(struct inode *inode, int wait)
         return rc;
 }
 
-int jfs_write_inode(struct inode *inode, int wait)
+int jfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
+        int wait = wbc->sync_mode == WB_SYNC_ALL;
+
         if (test_cflag(COMMIT_Nolink, inode))
                 return 0;
         /*
diff --git a/fs/jfs/jfs_inode.h b/fs/jfs/jfs_inode.h
index 1eff7db34d63..15902b03c2a7 100644
--- a/fs/jfs/jfs_inode.h
+++ b/fs/jfs/jfs_inode.h
@@ -26,7 +26,7 @@ extern long jfs_ioctl(struct file *, unsigned int, unsigned long);
 extern long jfs_compat_ioctl(struct file *, unsigned int, unsigned long);
 extern struct inode *jfs_iget(struct super_block *, unsigned long);
 extern int jfs_commit_inode(struct inode *, int);
-extern int jfs_write_inode(struct inode*, int);
+extern int jfs_write_inode(struct inode *, struct writeback_control *);
 extern void jfs_delete_inode(struct inode *);
 extern void jfs_dirty_inode(struct inode *);
 extern void jfs_truncate(struct inode *);
diff --git a/fs/libfs.c b/fs/libfs.c
index 6e8d17e1dc4c..9e50bcf55857 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -338,28 +338,14 @@ int simple_readpage(struct file *file, struct page *page)
         return 0;
 }
 
-int simple_prepare_write(struct file *file, struct page *page,
-                        unsigned from, unsigned to)
-{
-        if (!PageUptodate(page)) {
-                if (to - from != PAGE_CACHE_SIZE)
-                        zero_user_segments(page,
-                                0, from,
-                                to, PAGE_CACHE_SIZE);
-        }
-        return 0;
-}
-
 int simple_write_begin(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned flags,
                         struct page **pagep, void **fsdata)
 {
         struct page *page;
         pgoff_t index;
-        unsigned from;
 
         index = pos >> PAGE_CACHE_SHIFT;
-        from = pos & (PAGE_CACHE_SIZE - 1);
 
         page = grab_cache_page_write_begin(mapping, index, flags);
         if (!page)
@@ -367,43 +353,59 @@ int simple_write_begin(struct file *file, struct address_space *mapping,
 
         *pagep = page;
 
-        return simple_prepare_write(file, page, from, from+len);
-}
-
-static int simple_commit_write(struct file *file, struct page *page,
-                               unsigned from, unsigned to)
-{
-        struct inode *inode = page->mapping->host;
-        loff_t pos = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to;
+        if (!PageUptodate(page) && (len != PAGE_CACHE_SIZE)) {
+                unsigned from = pos & (PAGE_CACHE_SIZE - 1);
 
-        if (!PageUptodate(page))
-                SetPageUptodate(page);
-        /*
-         * No need to use i_size_read() here, the i_size
-         * cannot change under us because we hold the i_mutex.
-         */
-        if (pos > inode->i_size)
-                i_size_write(inode, pos);
-        set_page_dirty(page);
+                zero_user_segments(page, 0, from, from + len, PAGE_CACHE_SIZE);
+        }
         return 0;
 }
 
+/**
+ * simple_write_end - .write_end helper for non-block-device FSes
+ * @available: See .write_end of address_space_operations
+ * @file:               "
+ * @mapping:            "
+ * @pos:                "
+ * @len:                "
+ * @copied:             "
+ * @page:               "
+ * @fsdata:             "
+ *
+ * simple_write_end does the minimum needed for updating a page after writing is
+ * done. It has the same API signature as the .write_end of
+ * address_space_operations vector. So it can just be set onto .write_end for
+ * FSes that don't need any other processing. i_mutex is assumed to be held.
+ * Block based filesystems should use generic_write_end().
+ * NOTE: Even though i_size might get updated by this function, mark_inode_dirty
+ * is not called, so a filesystem that actually does store data in .write_inode
+ * should extend on what's done here with a call to mark_inode_dirty() in the
+ * case that i_size has changed.
+ */
 int simple_write_end(struct file *file, struct address_space *mapping,
                         loff_t pos, unsigned len, unsigned copied,
                         struct page *page, void *fsdata)
 {
-        unsigned from = pos & (PAGE_CACHE_SIZE - 1);
+        struct inode *inode = page->mapping->host;
+        loff_t last_pos = pos + copied;
 
         /* zero the stale part of the page if we did a short copy */
         if (copied < len) {
-                void *kaddr = kmap_atomic(page, KM_USER0);
-                memset(kaddr + from + copied, 0, len - copied);
-                flush_dcache_page(page);
-                kunmap_atomic(kaddr, KM_USER0);
+                unsigned from = pos & (PAGE_CACHE_SIZE - 1);
+
+                zero_user(page, from + copied, len - copied);
         }
 
-        simple_commit_write(file, page, from, from+copied);
+        if (!PageUptodate(page))
+                SetPageUptodate(page);
+        /*
+         * No need to use i_size_read() here, the i_size
+         * cannot change under us because we hold the i_mutex.
+         */
+        if (last_pos > inode->i_size)
+                i_size_write(inode, last_pos);
 
+        set_page_dirty(page);
         unlock_page(page);
         page_cache_release(page);
 
@@ -853,7 +855,6 @@ EXPORT_SYMBOL(simple_getattr);
 EXPORT_SYMBOL(simple_link);
 EXPORT_SYMBOL(simple_lookup);
 EXPORT_SYMBOL(simple_pin_fs);
-EXPORT_UNUSED_SYMBOL(simple_prepare_write);
 EXPORT_SYMBOL(simple_readpage);
 EXPORT_SYMBOL(simple_release_fs);
 EXPORT_SYMBOL(simple_rename);
diff --git a/fs/locks.c b/fs/locks.c
index a8794f233bc9..ae9ded026b7c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1182,8 +1182,9 @@ int __break_lease(struct inode *inode, unsigned int mode)
         struct file_lock *fl;
         unsigned long break_time;
         int i_have_this_lease = 0;
+        int want_write = (mode & O_ACCMODE) != O_RDONLY;
 
-        new_fl = lease_alloc(NULL, mode & FMODE_WRITE ? F_WRLCK : F_RDLCK);
+        new_fl = lease_alloc(NULL, want_write ? F_WRLCK : F_RDLCK);
 
         lock_kernel();
 
@@ -1197,7 +1198,7 @@ int __break_lease(struct inode *inode, unsigned int mode)
                 if (fl->fl_owner == current->files)
                         i_have_this_lease = 1;
 
-        if (mode & FMODE_WRITE) {
+        if (want_write) {
                 /* If we want write access, we have to revoke any lease. */
                 future = F_UNLCK | F_INPROGRESS;
         } else if (flock->fl_type & F_INPROGRESS) {
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 74ea82d72164..756f8c93780c 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -17,8 +17,10 @@
 #include <linux/init.h>
 #include <linux/highuid.h>
 #include <linux/vfs.h>
+#include <linux/writeback.h>
 
-static int minix_write_inode(struct inode * inode, int wait);
+static int minix_write_inode(struct inode *inode,
+                struct writeback_control *wbc);
 static int minix_statfs(struct dentry *dentry, struct kstatfs *buf);
 static int minix_remount (struct super_block * sb, int * flags, char * data);
 
@@ -552,7 +554,7 @@ static struct buffer_head * V2_minix_update_inode(struct inode * inode)
         return bh;
 }
 
-static int minix_write_inode(struct inode *inode, int wait)
+static int minix_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int err = 0;
         struct buffer_head *bh;
@@ -563,7 +565,7 @@ static int minix_write_inode(struct inode *inode, int wait)
                 bh = V2_minix_update_inode(inode);
         if (!bh)
                 return -EIO;
-        if (wait && buffer_dirty(bh)) {
+        if (wbc->sync_mode == WB_SYNC_ALL && buffer_dirty(bh)) {
                 sync_dirty_buffer(bh);
                 if (buffer_req(bh) && !buffer_uptodate(bh)) {
                         printk("IO error syncing minix inode [%s:%08lx]\n",
diff --git a/fs/namei.c b/fs/namei.c
index a4855af776a8..9a6456099f1e 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -498,8 +498,6 @@ static int link_path_walk(const char *, struct nameidata *);
 
 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
 {
-        int res = 0;
-        char *name;
         if (IS_ERR(link))
                 goto fail;
 
@@ -510,22 +508,7 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l
                 path_get(&nd->root);
         }
 
-        res = link_path_walk(link, nd);
-        if (nd->depth || res || nd->last_type!=LAST_NORM)
-                return res;
-        /*
-         * If it is an iterative symlinks resolution in open_namei() we
-         * have to copy the last component. And all that crap because of
-         * bloody create() on broken symlinks. Furrfu...
-         */
-        name = __getname();
-        if (unlikely(!name)) {
-                path_put(&nd->path);
-                return -ENOMEM;
-        }
-        strcpy(name, nd->last.name);
-        nd->last.name = name;
-        return 0;
+        return link_path_walk(link, nd);
 fail:
         path_put(&nd->path);
         return PTR_ERR(link);
@@ -547,10 +530,10 @@ static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
         nd->path.dentry = path->dentry;
 }
 
-static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
+static __always_inline int
+__do_follow_link(struct path *path, struct nameidata *nd, void **p)
 {
         int error;
-        void *cookie;
         struct dentry *dentry = path->dentry;
 
         touch_atime(path->mnt, dentry);
@@ -562,9 +545,9 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
         }
         mntget(path->mnt);
         nd->last_type = LAST_BIND;
-        cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
-        error = PTR_ERR(cookie);
-        if (!IS_ERR(cookie)) {
+        *p = dentry->d_inode->i_op->follow_link(dentry, nd);
+        error = PTR_ERR(*p);
+        if (!IS_ERR(*p)) {
                 char *s = nd_get_link(nd);
                 error = 0;
                 if (s)
@@ -574,8 +557,6 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
                         if (error)
                                 path_put(&nd->path);
                 }
-                if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, nd, cookie);
         }
         return error;
 }
@@ -589,6 +570,7 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
  */
 static inline int do_follow_link(struct path *path, struct nameidata *nd)
 {
+        void *cookie;
         int err = -ELOOP;
         if (current->link_count >= MAX_NESTED_LINKS)
                 goto loop;
@@ -602,7 +584,9 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
         current->link_count++;
         current->total_link_count++;
         nd->depth++;
-        err = __do_follow_link(path, nd);
+        err = __do_follow_link(path, nd, &cookie);
+        if (!IS_ERR(cookie) && path->dentry->d_inode->i_op->put_link)
+                path->dentry->d_inode->i_op->put_link(path->dentry, nd, cookie);
         path_put(path);
         current->link_count--;
         nd->depth--;
@@ -689,33 +673,20 @@ static __always_inline void follow_dotdot(struct nameidata *nd)
         set_root(nd);
 
         while(1) {
-                struct vfsmount *parent;
                 struct dentry *old = nd->path.dentry;
 
                 if (nd->path.dentry == nd->root.dentry &&
                     nd->path.mnt == nd->root.mnt) {
                         break;
                 }
-                spin_lock(&dcache_lock);
                 if (nd->path.dentry != nd->path.mnt->mnt_root) {
-                        nd->path.dentry = dget(nd->path.dentry->d_parent);
-                        spin_unlock(&dcache_lock);
+                        /* rare case of legitimate dget_parent()... */
+                        nd->path.dentry = dget_parent(nd->path.dentry);
                         dput(old);
                         break;
                 }
-                spin_unlock(&dcache_lock);
-                spin_lock(&vfsmount_lock);
-                parent = nd->path.mnt->mnt_parent;
-                if (parent == nd->path.mnt) {
-                        spin_unlock(&vfsmount_lock);
+                if (!follow_up(&nd->path))
                         break;
-                }
-                mntget(parent);
-                nd->path.dentry = dget(nd->path.mnt->mnt_mountpoint);
-                spin_unlock(&vfsmount_lock);
-                dput(old);
-                mntput(nd->path.mnt);
-                nd->path.mnt = parent;
         }
         follow_mount(&nd->path);
 }
@@ -1347,7 +1318,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
                 return -ENOENT;
 
         BUG_ON(victim->d_parent->d_inode != dir);
-        audit_inode_child(victim->d_name.name, victim, dir);
+        audit_inode_child(victim, dir);
 
         error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
         if (error)
@@ -1388,22 +1359,6 @@ static inline int may_create(struct inode *dir, struct dentry *child)
         return inode_permission(dir, MAY_WRITE | MAY_EXEC);
 }
 
-/* 
- * O_DIRECTORY translates into forcing a directory lookup.
- */
-static inline int lookup_flags(unsigned int f)
-{
-        unsigned long retval = LOOKUP_FOLLOW;
-
-        if (f & O_NOFOLLOW)
-                retval &= ~LOOKUP_FOLLOW;
-        
-        if (f & O_DIRECTORY)
-                retval |= LOOKUP_DIRECTORY;
-
-        return retval;
-}
-
 /*
  * p1 and p2 should be directories on the same fs.
  */
@@ -1503,7 +1458,7 @@ int may_open(struct path *path, int acc_mode, int flag)
          * An append-only file must be opened in append mode for writing.
          */
         if (IS_APPEND(inode)) {
-                if  ((flag & FMODE_WRITE) && !(flag & O_APPEND))
+                if  ((flag & O_ACCMODE) != O_RDONLY && !(flag & O_APPEND))
                         return -EPERM;
                 if (flag & O_TRUNC)
                         return -EPERM;
@@ -1547,7 +1502,7 @@ static int handle_truncate(struct path *path)
  * what get passed to sys_open().
  */
 static int __open_namei_create(struct nameidata *nd, struct path *path,
-                                int flag, int mode)
+                                int open_flag, int mode)
 {
         int error;
         struct dentry *dir = nd->path.dentry;
@@ -1565,7 +1520,7 @@ out_unlock:
         if (error)
                 return error;
         /* Don't check for write permission, don't truncate */
-        return may_open(&nd->path, 0, flag & ~O_TRUNC);
+        return may_open(&nd->path, 0, open_flag & ~O_TRUNC);
 }
 
 /*
@@ -1603,129 +1558,135 @@ static int open_will_truncate(int flag, struct inode *inode)
         return (flag & O_TRUNC);
 }
 
-/*
- * Note that the low bits of the passed in "open_flag"
- * are not the same as in the local variable "flag". See
- * open_to_namei_flags() for more details.
- */
-struct file *do_filp_open(int dfd, const char *pathname,
-                int open_flag, int mode, int acc_mode)
+static struct file *finish_open(struct nameidata *nd,
+                                int open_flag, int acc_mode)
 {
         struct file *filp;
-        struct nameidata nd;
-        int error;
-        struct path path;
-        struct dentry *dir;
-        int count = 0;
         int will_truncate;
-        int flag = open_to_namei_flags(open_flag);
-        int force_reval = 0;
+        int error;
+
+        will_truncate = open_will_truncate(open_flag, nd->path.dentry->d_inode);
+        if (will_truncate) {
+                error = mnt_want_write(nd->path.mnt);
+                if (error)
+                        goto exit;
+        }
+        error = may_open(&nd->path, acc_mode, open_flag);
+        if (error) {
+                if (will_truncate)
+                        mnt_drop_write(nd->path.mnt);
+                goto exit;
+        }
+        filp = nameidata_to_filp(nd);
+        if (!IS_ERR(filp)) {
+                error = ima_file_check(filp, acc_mode);
+                if (error) {
+                        fput(filp);
+                        filp = ERR_PTR(error);
+                }
+        }
+        if (!IS_ERR(filp)) {
+                if (acc_mode & MAY_WRITE)
+                        vfs_dq_init(nd->path.dentry->d_inode);
 
+                if (will_truncate) {
+                        error = handle_truncate(&nd->path);
+                        if (error) {
+                                fput(filp);
+                                filp = ERR_PTR(error);
+                        }
+                }
+        }
         /*
-         * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
-         * check for O_DSYNC if the need any syncing at all we enforce it's
-         * always set instead of having to deal with possibly weird behaviour
-         * for malicious applications setting only __O_SYNC.
+         * It is now safe to drop the mnt write
+         * because the filp has had a write taken
+         * on its behalf.
          */
-        if (open_flag & __O_SYNC)
-                open_flag |= O_DSYNC;
-
-        if (!acc_mode)
-                acc_mode = MAY_OPEN | ACC_MODE(open_flag);
+        if (will_truncate)
+                mnt_drop_write(nd->path.mnt);
+        return filp;
 
-        /* O_TRUNC implies we need access checks for write permissions */
-        if (flag & O_TRUNC)
-                acc_mode |= MAY_WRITE;
+exit:
+        if (!IS_ERR(nd->intent.open.file))
+                release_open_intent(nd);
+        path_put(&nd->path);
+        return ERR_PTR(error);
+}
 
-        /* Allow the LSM permission hook to distinguish append 
-           access from general write access. */
-        if (flag & O_APPEND)
-                acc_mode |= MAY_APPEND;
+static struct file *do_last(struct nameidata *nd, struct path *path,
+                            int open_flag, int acc_mode,
+                            int mode, const char *pathname,
+                            int *want_dir)
+{
+        struct dentry *dir = nd->path.dentry;
+        struct file *filp;
+        int error = -EISDIR;
 
-        /*
-         * The simplest case - just a plain lookup.
-         */
-        if (!(flag & O_CREAT)) {
-                filp = get_empty_filp();
-
-                if (filp == NULL)
-                        return ERR_PTR(-ENFILE);
-                nd.intent.open.file = filp;
-                filp->f_flags = open_flag;
-                nd.intent.open.flags = flag;
-                nd.intent.open.create_mode = 0;
-                error = do_path_lookup(dfd, pathname,
-                                        lookup_flags(flag)|LOOKUP_OPEN, &nd);
-                if (IS_ERR(nd.intent.open.file)) {
-                        if (error == 0) {
-                                error = PTR_ERR(nd.intent.open.file);
-                                path_put(&nd.path);
+        switch (nd->last_type) {
+        case LAST_DOTDOT:
+                follow_dotdot(nd);
+                dir = nd->path.dentry;
+                if (nd->path.mnt->mnt_sb->s_type->fs_flags & FS_REVAL_DOT) {
+                        if (!dir->d_op->d_revalidate(dir, nd)) {
+                                error = -ESTALE;
+                                goto exit;
                         }
-                } else if (error)
-                        release_open_intent(&nd);
-                if (error)
-                        return ERR_PTR(error);
+                }
+                /* fallthrough */
+        case LAST_DOT:
+        case LAST_ROOT:
+                if (open_flag & O_CREAT)
+                        goto exit;
+                /* fallthrough */
+        case LAST_BIND:
+                audit_inode(pathname, dir);
                 goto ok;
         }
 
-        /*
-         * Create - we need to know the parent.
-         */
-reval:
-        error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
-        if (error)
-                return ERR_PTR(error);
-        if (force_reval)
-                nd.flags |= LOOKUP_REVAL;
-        error = path_walk(pathname, &nd);
-        if (error) {
-                if (nd.root.mnt)
-                        path_put(&nd.root);
-                return ERR_PTR(error);
+        /* trailing slashes? */
+        if (nd->last.name[nd->last.len]) {
+                if (open_flag & O_CREAT)
+                        goto exit;
+                *want_dir = 1;
         }
-        if (unlikely(!audit_dummy_context()))
-                audit_inode(pathname, nd.path.dentry);
 
-        /*
-         * We have the parent and last component. First of all, check
-         * that we are not asked to creat(2) an obvious directory - that
-         * will not do.
-         */
-        error = -EISDIR;
-        if (nd.last_type != LAST_NORM || nd.last.name[nd.last.len])
-                goto exit_parent;
+        /* just plain open? */
+        if (!(open_flag & O_CREAT)) {
+                error = do_lookup(nd, &nd->last, path);
+                if (error)
+                        goto exit;
+                error = -ENOENT;
+                if (!path->dentry->d_inode)
+                        goto exit_dput;
+                if (path->dentry->d_inode->i_op->follow_link)
+                        return NULL;
+                error = -ENOTDIR;
+                if (*want_dir & !path->dentry->d_inode->i_op->lookup)
+                        goto exit_dput;
+                path_to_nameidata(path, nd);
+                audit_inode(pathname, nd->path.dentry);
+                goto ok;
+        }
 
-        error = -ENFILE;
-        filp = get_empty_filp();
-        if (filp == NULL)
-                goto exit_parent;
-        nd.intent.open.file = filp;
-        filp->f_flags = open_flag;
-        nd.intent.open.flags = flag;
-        nd.intent.open.create_mode = mode;
-        dir = nd.path.dentry;
-        nd.flags &= ~LOOKUP_PARENT;
-        nd.flags |= LOOKUP_CREATE | LOOKUP_OPEN;
-        if (flag & O_EXCL)
-                nd.flags |= LOOKUP_EXCL;
+        /* OK, it's O_CREAT */
         mutex_lock(&dir->d_inode->i_mutex);
-        path.dentry = lookup_hash(&nd);
-        path.mnt = nd.path.mnt;
 
-do_last:
-        error = PTR_ERR(path.dentry);
-        if (IS_ERR(path.dentry)) {
+        path->dentry = lookup_hash(nd);
+        path->mnt = nd->path.mnt;
+
+        error = PTR_ERR(path->dentry);
+        if (IS_ERR(path->dentry)) {
                 mutex_unlock(&dir->d_inode->i_mutex);
                 goto exit;
         }
 
-        if (IS_ERR(nd.intent.open.file)) {
-                error = PTR_ERR(nd.intent.open.file);
+        if (IS_ERR(nd->intent.open.file)) {
+                error = PTR_ERR(nd->intent.open.file);
                 goto exit_mutex_unlock;
         }
 
         /* Negative dentry, just create the file */
-        if (!path.dentry->d_inode) {
+        if (!path->dentry->d_inode) {
                 /*
                  * This write is needed to ensure that a
                  * ro->rw transition does not occur between
@@ -1733,18 +1694,16 @@ do_last:
                  * a permanent write count is taken through
                  * the 'struct file' in nameidata_to_filp().
                  */
-                error = mnt_want_write(nd.path.mnt);
+                error = mnt_want_write(nd->path.mnt);
                 if (error)
                         goto exit_mutex_unlock;
-                error = __open_namei_create(&nd, &path, flag, mode);
+                error = __open_namei_create(nd, path, open_flag, mode);
                 if (error) {
-                        mnt_drop_write(nd.path.mnt);
+                        mnt_drop_write(nd->path.mnt);
                         goto exit;
                 }
-                filp = nameidata_to_filp(&nd);
-                mnt_drop_write(nd.path.mnt);
-                if (nd.root.mnt)
-                        path_put(&nd.root);
+                filp = nameidata_to_filp(nd);
+                mnt_drop_write(nd->path.mnt);
                 if (!IS_ERR(filp)) {
                         error = ima_file_check(filp, acc_mode);
                         if (error) {
@@ -1759,150 +1718,181 @@ do_last:
          * It already exists.
          */
         mutex_unlock(&dir->d_inode->i_mutex);
-        audit_inode(pathname, path.dentry);
+        audit_inode(pathname, path->dentry);
 
         error = -EEXIST;
-        if (flag & O_EXCL)
+        if (open_flag & O_EXCL)
                 goto exit_dput;
 
-        if (__follow_mount(&path)) {
+        if (__follow_mount(path)) {
                 error = -ELOOP;
-                if (flag & O_NOFOLLOW)
+                if (open_flag & O_NOFOLLOW)
                         goto exit_dput;
         }
 
         error = -ENOENT;
-        if (!path.dentry->d_inode)
+        if (!path->dentry->d_inode)
                 goto exit_dput;
-        if (path.dentry->d_inode->i_op->follow_link)
-                goto do_link;
 
-        path_to_nameidata(&path, &nd);
+        if (path->dentry->d_inode->i_op->follow_link)
+                return NULL;
+
+        path_to_nameidata(path, nd);
         error = -EISDIR;
-        if (S_ISDIR(path.dentry->d_inode->i_mode))
+        if (S_ISDIR(path->dentry->d_inode->i_mode))
                 goto exit;
 ok:
+        filp = finish_open(nd, open_flag, acc_mode);
+        return filp;
+
+exit_mutex_unlock:
+        mutex_unlock(&dir->d_inode->i_mutex);
+exit_dput:
+        path_put_conditional(path, nd);
+exit:
+        if (!IS_ERR(nd->intent.open.file))
+                release_open_intent(nd);
+        path_put(&nd->path);
+        return ERR_PTR(error);
+}
+
+/*
+ * Note that the low bits of the passed in "open_flag"
+ * are not the same as in the local variable "flag". See
+ * open_to_namei_flags() for more details.
+ */
+struct file *do_filp_open(int dfd, const char *pathname,
+                int open_flag, int mode, int acc_mode)
+{
+        struct file *filp;
+        struct nameidata nd;
+        int error;
+        struct path path;
+        int count = 0;
+        int flag = open_to_namei_flags(open_flag);
+        int force_reval = 0;
+        int want_dir = open_flag & O_DIRECTORY;
+
+        if (!(open_flag & O_CREAT))
+                mode = 0;
+
         /*
-         * Consider:
-         * 1. may_open() truncates a file
-         * 2. a rw->ro mount transition occurs
-         * 3. nameidata_to_filp() fails due to
-         *    the ro mount.
-         * That would be inconsistent, and should
-         * be avoided. Taking this mnt write here
-         * ensures that (2) can not occur.
+         * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
+         * check for O_DSYNC if the need any syncing at all we enforce it's
+         * always set instead of having to deal with possibly weird behaviour
+         * for malicious applications setting only __O_SYNC.
          */
-        will_truncate = open_will_truncate(flag, nd.path.dentry->d_inode);
-        if (will_truncate) {
-                error = mnt_want_write(nd.path.mnt);
-                if (error)
-                        goto exit;
-        }
-        error = may_open(&nd.path, acc_mode, flag);
+        if (open_flag & __O_SYNC)
+                open_flag |= O_DSYNC;
+
+        if (!acc_mode)
+                acc_mode = MAY_OPEN | ACC_MODE(open_flag);
+
+        /* O_TRUNC implies we need access checks for write permissions */
+        if (open_flag & O_TRUNC)
+                acc_mode |= MAY_WRITE;
+
+        /* Allow the LSM permission hook to distinguish append 
+           access from general write access. */
+        if (open_flag & O_APPEND)
+                acc_mode |= MAY_APPEND;
+
+        /* find the parent */
+reval:
+        error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
+        if (error)
+                return ERR_PTR(error);
+        if (force_reval)
+                nd.flags |= LOOKUP_REVAL;
+
+        current->total_link_count = 0;
+        error = link_path_walk(pathname, &nd);
         if (error) {
-                if (will_truncate)
-                        mnt_drop_write(nd.path.mnt);
-                goto exit;
-        }
-        filp = nameidata_to_filp(&nd);
-        if (!IS_ERR(filp)) {
-                error = ima_file_check(filp, acc_mode);
-                if (error) {
-                        fput(filp);
-                        filp = ERR_PTR(error);
-                }
+                filp = ERR_PTR(error);
+                goto out;
         }
-        if (!IS_ERR(filp)) {
-                if (acc_mode & MAY_WRITE)
-                        vfs_dq_init(nd.path.dentry->d_inode);
+        if (unlikely(!audit_dummy_context()) && (open_flag & O_CREAT))
+                audit_inode(pathname, nd.path.dentry);
 
-                if (will_truncate) {
-                        error = handle_truncate(&nd.path);
-                        if (error) {
-                                fput(filp);
-                                filp = ERR_PTR(error);
-                        }
-                }
-        }
         /*
-         * It is now safe to drop the mnt write
-         * because the filp has had a write taken
-         * on its behalf.
+         * We have the parent and last component.
          */
-        if (will_truncate)
-                mnt_drop_write(nd.path.mnt);
+
+        error = -ENFILE;
+        filp = get_empty_filp();
+        if (filp == NULL)
+                goto exit_parent;
+        nd.intent.open.file = filp;
+        filp->f_flags = open_flag;
+        nd.intent.open.flags = flag;
+        nd.intent.open.create_mode = mode;
+        nd.flags &= ~LOOKUP_PARENT;
+        nd.flags |= LOOKUP_OPEN;
+        if (open_flag & O_CREAT) {
+                nd.flags |= LOOKUP_CREATE;
+                if (open_flag & O_EXCL)
+                        nd.flags |= LOOKUP_EXCL;
+        }
+        filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname, &want_dir);
+        while (unlikely(!filp)) { /* trailing symlink */
+                struct path holder;
+                struct inode *inode = path.dentry->d_inode;
+                void *cookie;
+                error = -ELOOP;
+                /* S_ISDIR part is a temporary automount kludge */
+                if ((open_flag & O_NOFOLLOW) && !S_ISDIR(inode->i_mode))
+                        goto exit_dput;
+                if (count++ == 32)
+                        goto exit_dput;
+                /*
+                 * This is subtle. Instead of calling do_follow_link() we do
+                 * the thing by hands. The reason is that this way we have zero
+                 * link_count and path_walk() (called from ->follow_link)
+                 * honoring LOOKUP_PARENT.  After that we have the parent and
+                 * last component, i.e. we are in the same situation as after
+                 * the first path_walk().  Well, almost - if the last component
+                 * is normal we get its copy stored in nd->last.name and we will
+                 * have to putname() it when we are done. Procfs-like symlinks
+                 * just set LAST_BIND.
+                 */
+                nd.flags |= LOOKUP_PARENT;
+                error = security_inode_follow_link(path.dentry, &nd);
+                if (error)
+                        goto exit_dput;
+                error = __do_follow_link(&path, &nd, &cookie);
+                if (unlikely(error)) {
+                        /* nd.path had been dropped */
+                        if (!IS_ERR(cookie) && inode->i_op->put_link)
+                                inode->i_op->put_link(path.dentry, &nd, cookie);
+                        path_put(&path);
+                        release_open_intent(&nd);
+                        filp = ERR_PTR(error);
+                        goto out;
+                }
+                holder = path;
+                nd.flags &= ~LOOKUP_PARENT;
+                filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname, &want_dir);
+                if (inode->i_op->put_link)
+                        inode->i_op->put_link(holder.dentry, &nd, cookie);
+                path_put(&holder);
+        }
+out:
         if (nd.root.mnt)
                 path_put(&nd.root);
+        if (filp == ERR_PTR(-ESTALE) && !force_reval) {
+                force_reval = 1;
+                goto reval;
+        }
         return filp;
 
-exit_mutex_unlock:
-        mutex_unlock(&dir->d_inode->i_mutex);
 exit_dput:
         path_put_conditional(&path, &nd);
-exit:
         if (!IS_ERR(nd.intent.open.file))
                 release_open_intent(&nd);
 exit_parent:
-        if (nd.root.mnt)
-                path_put(&nd.root);
         path_put(&nd.path);
-        return ERR_PTR(error);
-
-do_link:
-        error = -ELOOP;
-        if (flag & O_NOFOLLOW)
-                goto exit_dput;
-        /*
-         * This is subtle. Instead of calling do_follow_link() we do the
-         * thing by hands. The reason is that this way we have zero link_count
-         * and path_walk() (called from ->follow_link) honoring LOOKUP_PARENT.
-         * After that we have the parent and last component, i.e.
-         * we are in the same situation as after the first path_walk().
-         * Well, almost - if the last component is normal we get its copy
-         * stored in nd->last.name and we will have to putname() it when we
-         * are done. Procfs-like symlinks just set LAST_BIND.
-         */
-        nd.flags |= LOOKUP_PARENT;
-        error = security_inode_follow_link(path.dentry, &nd);
-        if (error)
-                goto exit_dput;
-        error = __do_follow_link(&path, &nd);
-        path_put(&path);
-        if (error) {
-                /* Does someone understand code flow here? Or it is only
-                 * me so stupid? Anathema to whoever designed this non-sense
-                 * with "intent.open".
-                 */
-                release_open_intent(&nd);
-                if (nd.root.mnt)
-                        path_put(&nd.root);
-                if (error == -ESTALE && !force_reval) {
-                        force_reval = 1;
-                        goto reval;
-                }
-                return ERR_PTR(error);
-        }
-        nd.flags &= ~LOOKUP_PARENT;
-        if (nd.last_type == LAST_BIND)
-                goto ok;
-        error = -EISDIR;
-        if (nd.last_type != LAST_NORM)
-                goto exit;
-        if (nd.last.name[nd.last.len]) {
-                __putname(nd.last.name);
-                goto exit;
-        }
-        error = -ELOOP;
-        if (count++==32) {
-                __putname(nd.last.name);
-                goto exit;
-        }
-        dir = nd.path.dentry;
-        mutex_lock(&dir->d_inode->i_mutex);
-        path.dentry = lookup_hash(&nd);
-        path.mnt = nd.path.mnt;
-        __putname(nd.last.name);
-        goto do_last;
+        filp = ERR_PTR(error);
+        goto out;
 }
 
 /**
@@ -2275,8 +2265,11 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
                 error = -EBUSY;
         else {
                 error = security_inode_unlink(dir, dentry);
-                if (!error)
+                if (!error) {
                         error = dir->i_op->unlink(dir, dentry);
+                        if (!error)
+                                dentry->d_inode->i_flags |= S_DEAD;
+                }
         }
         mutex_unlock(&dentry->d_inode->i_mutex);
 
@@ -2629,6 +2622,8 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
         else
                 error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
         if (!error) {
+                if (target)
+                        target->i_flags |= S_DEAD;
                 if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
                         d_move(old_dentry, new_dentry);
         }
@@ -2671,11 +2666,9 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
         else
                 error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
-        if (!error) {
-                const char *new_name = old_dentry->d_name.name;
-                fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
+        if (!error)
+                fsnotify_move(old_dir, new_dir, old_name, is_dir,
                               new_dentry->d_inode, old_dentry);
-        }
         fsnotify_oldname_free(old_name);
 
         return error;
diff --git a/fs/namespace.c b/fs/namespace.c
index c768f733c8d6..8174c8ab5c70 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -573,7 +573,7 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
                         mnt->mnt_master = old;
                         CLEAR_MNT_SHARED(mnt);
                 } else if (!(flag & CL_PRIVATE)) {
-                        if ((flag & CL_PROPAGATION) || IS_MNT_SHARED(old))
+                        if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old))
                                 list_add(&mnt->mnt_share, &old->mnt_share);
                         if (IS_MNT_SLAVE(old))
                                 list_add(&mnt->mnt_slave, &old->mnt_slave);
@@ -737,6 +737,21 @@ static void m_stop(struct seq_file *m, void *v)
         up_read(&namespace_sem);
 }
 
+int mnt_had_events(struct proc_mounts *p)
+{
+        struct mnt_namespace *ns = p->ns;
+        int res = 0;
+
+        spin_lock(&vfsmount_lock);
+        if (p->event != ns->event) {
+                p->event = ns->event;
+                res = 1;
+        }
+        spin_unlock(&vfsmount_lock);
+
+        return res;
+}
+
 struct proc_fs_info {
         int flag;
         const char *str;
@@ -1121,8 +1136,15 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
 {
         struct path path;
         int retval;
+        int lookup_flags = 0;
 
-        retval = user_path(name, &path);
+        if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
+                return -EINVAL;
+
+        if (!(flags & UMOUNT_NOFOLLOW))
+                lookup_flags |= LOOKUP_FOLLOW;
+
+        retval = user_path_at(AT_FDCWD, name, lookup_flags, &path);
         if (retval)
                 goto out;
         retval = -EINVAL;
@@ -1246,6 +1268,21 @@ void drop_collected_mounts(struct vfsmount *mnt)
         release_mounts(&umount_list);
 }
 
+int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
+                   struct vfsmount *root)
+{
+        struct vfsmount *mnt;
+        int res = f(root, arg);
+        if (res)
+                return res;
+        list_for_each_entry(mnt, &root->mnt_list, mnt_list) {
+                res = f(mnt, arg);
+                if (res)
+                        return res;
+        }
+        return 0;
+}
+
 static void cleanup_group_ids(struct vfsmount *mnt, struct vfsmount *end)
 {
         struct vfsmount *p;
@@ -1538,7 +1575,7 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
                 err = do_remount_sb(sb, flags, data, 0);
         if (!err) {
                 spin_lock(&vfsmount_lock);
-                mnt_flags |= path->mnt->mnt_flags & MNT_PNODE_MASK;
+                mnt_flags |= path->mnt->mnt_flags & MNT_PROPAGATION_MASK;
                 path->mnt->mnt_flags = mnt_flags;
                 spin_unlock(&vfsmount_lock);
         }
@@ -1671,7 +1708,7 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path,
 {
         int err;
 
-        mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD);
+        mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL);
 
         down_write(&namespace_sem);
         /* Something was mounted here while we slept */
@@ -2314,17 +2351,13 @@ void __init mnt_init(void)
 
 void put_mnt_ns(struct mnt_namespace *ns)
 {
-        struct vfsmount *root;
         LIST_HEAD(umount_list);
 
-        if (!atomic_dec_and_lock(&ns->count, &vfsmount_lock))
+        if (!atomic_dec_and_test(&ns->count))
                 return;
-        root = ns->root;
-        ns->root = NULL;
-        spin_unlock(&vfsmount_lock);
         down_write(&namespace_sem);
         spin_lock(&vfsmount_lock);
-        umount_tree(root, 0, &umount_list);
+        umount_tree(ns->root, 0, &umount_list);
         spin_unlock(&vfsmount_lock);
         up_write(&namespace_sem);
         release_mounts(&umount_list);
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index f141bde7756a..7f9ecc46f3fb 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -97,16 +97,12 @@ u64 nfs_compat_user_ino64(u64 fileid)
         return ino;
 }
 
-int nfs_write_inode(struct inode *inode, int sync)
+int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int ret;
 
-        if (sync) {
-                ret = filemap_fdatawait(inode->i_mapping);
-                if (ret == 0)
-                        ret = nfs_commit_inode(inode, FLUSH_SYNC);
-        } else
-                ret = nfs_commit_inode(inode, 0);
+        ret = nfs_commit_inode(inode,
+                        wbc->sync_mode == WB_SYNC_ALL ? FLUSH_SYNC : 0);
         if (ret >= 0)
                 return 0;
         __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
@@ -574,14 +570,14 @@ void nfs_close_context(struct nfs_open_context *ctx, int is_sync)
         nfs_revalidate_inode(server, inode);
 }
 
-static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, struct dentry *dentry, struct rpc_cred *cred)
+static struct nfs_open_context *alloc_nfs_open_context(struct path *path, struct rpc_cred *cred)
 {
         struct nfs_open_context *ctx;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (ctx != NULL) {
-                ctx->path.dentry = dget(dentry);
-                ctx->path.mnt = mntget(mnt);
+                ctx->path = *path;
+                path_get(&ctx->path);
                 ctx->cred = get_rpccred(cred);
                 ctx->state = NULL;
                 ctx->lockowner = current->files;
@@ -686,7 +682,7 @@ int nfs_open(struct inode *inode, struct file *filp)
         cred = rpc_lookup_cred();
         if (IS_ERR(cred))
                 return PTR_ERR(cred);
-        ctx = alloc_nfs_open_context(filp->f_path.mnt, filp->f_path.dentry, cred);
+        ctx = alloc_nfs_open_context(&filp->f_path, cred);
         put_rpccred(cred);
         if (ctx == NULL)
                 return -ENOMEM;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 29e464d23b32..11f82f03c5de 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -211,7 +211,7 @@ extern int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask);
 extern struct workqueue_struct *nfsiod_workqueue;
 extern struct inode *nfs_alloc_inode(struct super_block *sb);
 extern void nfs_destroy_inode(struct inode *);
-extern int nfs_write_inode(struct inode *,int);
+extern int nfs_write_inode(struct inode *, struct writeback_control *);
 extern void nfs_clear_inode(struct inode *);
 #ifdef CONFIG_NFS_V4
 extern void nfs4_clear_inode(struct inode *);
diff --git a/fs/nfs/iostat.h b/fs/nfs/iostat.h
index 46d779abafd3..1d8d5c813b01 100644
--- a/fs/nfs/iostat.h
+++ b/fs/nfs/iostat.h
@@ -57,12 +57,12 @@ static inline void nfs_add_fscache_stats(struct inode *inode,
 }
 #endif
 
-static inline struct nfs_iostats *nfs_alloc_iostats(void)
+static inline struct nfs_iostats __percpu *nfs_alloc_iostats(void)
 {
         return alloc_percpu(struct nfs_iostats);
 }
 
-static inline void nfs_free_iostats(struct nfs_iostats *stats)
+static inline void nfs_free_iostats(struct nfs_iostats __percpu *stats)
 {
         if (stats != NULL)
                 free_percpu(stats);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 375f0fae2c6a..84d83be25a98 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -724,8 +724,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct path *path,
         p->o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
         if (p->o_arg.seqid == NULL)
                 goto err_free;
-        p->path.mnt = mntget(path->mnt);
-        p->path.dentry = dget(path->dentry);
+        path_get(path);
+        p->path = *path;
         p->dir = parent;
         p->owner = sp;
         atomic_inc(&sp->so_count);
@@ -1944,8 +1944,8 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
         calldata->res.seqid = calldata->arg.seqid;
         calldata->res.server = server;
         calldata->res.seq_res.sr_slotid = NFS4_MAX_SLOT_TABLE;
-        calldata->path.mnt = mntget(path->mnt);
-        calldata->path.dentry = dget(path->dentry);
+        path_get(path);
+        calldata->path = *path;
 
         msg.rpc_argp = &calldata->arg,
         msg.rpc_resp = &calldata->res,
diff --git a/fs/nfsctl.c b/fs/nfsctl.c
index d3854d94b7cf..bf9cbd242ddd 100644
--- a/fs/nfsctl.c
+++ b/fs/nfsctl.c
@@ -36,10 +36,9 @@ static struct file *do_open(char *name, int flags)
                 return ERR_PTR(error);
 
         if (flags == O_RDWR)
-                error = may_open(&nd.path, MAY_READ|MAY_WRITE,
-                                           FMODE_READ|FMODE_WRITE);
+                error = may_open(&nd.path, MAY_READ|MAY_WRITE, flags);
         else
-                error = may_open(&nd.path, MAY_WRITE, FMODE_WRITE);
+                error = may_open(&nd.path, MAY_WRITE, flags);
 
         if (!error)
                 return dentry_open(nd.path.dentry, nd.path.mnt, flags,
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index a8587e90fd5a..bbf72d8f9fc0 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2121,9 +2121,15 @@ out_acl:
                  * and this is the root of a cross-mounted filesystem.
                  */
                 if (ignore_crossmnt == 0 &&
-                    exp->ex_path.mnt->mnt_root->d_inode == dentry->d_inode) {
-                        err = vfs_getattr(exp->ex_path.mnt->mnt_parent,
-                                exp->ex_path.mnt->mnt_mountpoint, &stat);
+                    dentry == exp->ex_path.mnt->mnt_root) {
+                        struct path path = exp->ex_path;
+                        path_get(&path);
+                        while (follow_up(&path)) {
+                                if (path.dentry != path.mnt->mnt_root)
+                                        break;
+                        }
+                        err = vfs_getattr(path.mnt, path.dentry, &stat);
+                        path_put(&path);
                         if (err)
                                 goto out_nfserr;
                 }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 8715d194561a..15dc2deaac5f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -361,7 +361,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                  * If we are changing the size of the file, then
                  * we need to break all leases.
                  */
-                host_err = break_lease(inode, FMODE_WRITE | O_NONBLOCK);
+                host_err = break_lease(inode, O_WRONLY | O_NONBLOCK);
                 if (host_err == -EWOULDBLOCK)
                         host_err = -ETIMEDOUT;
                 if (host_err) /* ENOMEM or EWOULDBLOCK */
@@ -734,7 +734,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
          * Check to see if there are any leases on this file.
          * This may block while leases are broken.
          */
-        host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? FMODE_WRITE : 0));
+        host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
         if (host_err == -EWOULDBLOCK)
                 host_err = -ETIMEDOUT;
         if (host_err) /* NOMEM or WOULDBLOCK */
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index 187dd07ba86c..9d1e5de91afb 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -388,8 +388,7 @@ int nilfs_dat_translate(struct inode *dat, __u64 vblocknr, sector_t *blocknrp)
                 ret = -ENOENT;
                 goto out;
         }
-        if (blocknrp != NULL)
-                *blocknrp = blocknr;
+        *blocknrp = blocknr;
 
  out:
         kunmap_atomic(kaddr, KM_USER0);
diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 76d803e060a9..0092840492ee 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -224,7 +224,7 @@ fail:
  * len <= NILFS_NAME_LEN and de != NULL are guaranteed by caller.
  */
 static int
-nilfs_match(int len, const char * const name, struct nilfs_dir_entry *de)
+nilfs_match(int len, const unsigned char *name, struct nilfs_dir_entry *de)
 {
         if (len != de->name_len)
                 return 0;
@@ -349,11 +349,11 @@ done:
  * Entry is guaranteed to be valid.
  */
 struct nilfs_dir_entry *
-nilfs_find_entry(struct inode *dir, struct dentry *dentry,
+nilfs_find_entry(struct inode *dir, const struct qstr *qstr,
                  struct page **res_page)
 {
-        const char *name = dentry->d_name.name;
-        int namelen = dentry->d_name.len;
+        const unsigned char *name = qstr->name;
+        int namelen = qstr->len;
         unsigned reclen = NILFS_DIR_REC_LEN(namelen);
         unsigned long start, n;
         unsigned long npages = dir_pages(dir);
@@ -424,13 +424,13 @@ struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p)
         return de;
 }
 
-ino_t nilfs_inode_by_name(struct inode *dir, struct dentry *dentry)
+ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr)
 {
         ino_t res = 0;
         struct nilfs_dir_entry *de;
         struct page *page;
 
-        de = nilfs_find_entry(dir, dentry, &page);
+        de = nilfs_find_entry(dir, qstr, &page);
         if (de) {
                 res = le64_to_cpu(de->inode);
                 kunmap(page);
@@ -465,7 +465,7 @@ void nilfs_set_link(struct inode *dir, struct nilfs_dir_entry *de,
 int nilfs_add_link(struct dentry *dentry, struct inode *inode)
 {
         struct inode *dir = dentry->d_parent->d_inode;
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         int namelen = dentry->d_name.len;
         unsigned chunk_size = nilfs_chunk_size(dir);
         unsigned reclen = NILFS_DIR_REC_LEN(namelen);
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index d6b2b83de363..313d0a21da48 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -26,6 +26,7 @@
 #include <linux/capability.h>   /* capable() */
 #include <linux/uaccess.h>      /* copy_from_user(), copy_to_user() */
 #include <linux/vmalloc.h>
+#include <linux/mount.h>        /* mnt_want_write(), mnt_drop_write() */
 #include <linux/nilfs2_fs.h>
 #include "nilfs.h"
 #include "segment.h"
@@ -107,20 +108,28 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
+
+        ret = mnt_want_write(filp->f_path.mnt);
+        if (ret)
+                return ret;
+
+        ret = -EFAULT;
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
-                return -EFAULT;
+                goto out;
 
         mutex_lock(&nilfs->ns_mount_mutex);
+
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
                 cpfile, cpmode.cm_cno, cpmode.cm_mode);
-        if (unlikely(ret < 0)) {
+        if (unlikely(ret < 0))
                 nilfs_transaction_abort(inode->i_sb);
-                mutex_unlock(&nilfs->ns_mount_mutex);
-                return ret;
-        }
-        nilfs_transaction_commit(inode->i_sb); /* never fails */
+        else
+                nilfs_transaction_commit(inode->i_sb); /* never fails */
+
         mutex_unlock(&nilfs->ns_mount_mutex);
+out:
+        mnt_drop_write(filp->f_path.mnt);
         return ret;
 }
 
@@ -135,16 +144,23 @@ nilfs_ioctl_delete_checkpoint(struct inode *inode, struct file *filp,
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
+
+        ret = mnt_want_write(filp->f_path.mnt);
+        if (ret)
+                return ret;
+
+        ret = -EFAULT;
         if (copy_from_user(&cno, argp, sizeof(cno)))
-                return -EFAULT;
+                goto out;
 
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_delete_checkpoint(cpfile, cno);
-        if (unlikely(ret < 0)) {
+        if (unlikely(ret < 0))
                 nilfs_transaction_abort(inode->i_sb);
-                return ret;
-        }
-        nilfs_transaction_commit(inode->i_sb); /* never fails */
+        else
+                nilfs_transaction_commit(inode->i_sb); /* never fails */
+out:
+        mnt_drop_write(filp->f_path.mnt);
         return ret;
 }
 
@@ -496,12 +512,19 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        ret = mnt_want_write(filp->f_path.mnt);
+        if (ret)
+                return ret;
+
+        ret = -EFAULT;
         if (copy_from_user(argv, argp, sizeof(argv)))
-                return -EFAULT;
+                goto out;
 
+        ret = -EINVAL;
         nsegs = argv[4].v_nmembs;
         if (argv[4].v_size != argsz[4])
-                return -EINVAL;
+                goto out;
+
         /*
          * argv[4] points to segment numbers this ioctl cleans.  We
          * use kmalloc() for its buffer because memory used for the
@@ -509,9 +532,10 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
          */
         kbufs[4] = memdup_user((void __user *)(unsigned long)argv[4].v_base,
                                nsegs * sizeof(__u64));
-        if (IS_ERR(kbufs[4]))
-                return PTR_ERR(kbufs[4]);
-
+        if (IS_ERR(kbufs[4])) {
+                ret = PTR_ERR(kbufs[4]);
+                goto out;
+        }
         nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
 
         for (n = 0; n < 4; n++) {
@@ -563,10 +587,12 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                 nilfs_remove_all_gcinode(nilfs);
         clear_nilfs_gc_running(nilfs);
 
- out_free:
+out_free:
         while (--n >= 0)
                 vfree(kbufs[n]);
         kfree(kbufs[4]);
+out:
+        mnt_drop_write(filp->f_path.mnt);
         return ret;
 }
 
@@ -575,13 +601,17 @@ static int nilfs_ioctl_sync(struct inode *inode, struct file *filp,
 {
         __u64 cno;
         int ret;
+        struct the_nilfs *nilfs;
 
         ret = nilfs_construct_segment(inode->i_sb);
         if (ret < 0)
                 return ret;
 
         if (argp != NULL) {
-                cno = NILFS_SB(inode->i_sb)->s_nilfs->ns_cno - 1;
+                nilfs = NILFS_SB(inode->i_sb)->s_nilfs;
+                down_read(&nilfs->ns_segctor_sem);
+                cno = nilfs->ns_cno - 1;
+                up_read(&nilfs->ns_segctor_sem);
                 if (copy_to_user(argp, &cno, sizeof(cno)))
                         return -EFAULT;
         }
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index 07ba838ef089..ad6ed2cf19b4 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -67,7 +67,7 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         if (dentry->d_name.len > NILFS_NAME_LEN)
                 return ERR_PTR(-ENAMETOOLONG);
 
-        ino = nilfs_inode_by_name(dir, dentry);
+        ino = nilfs_inode_by_name(dir, &dentry->d_name);
         inode = NULL;
         if (ino) {
                 inode = nilfs_iget(dir->i_sb, ino);
@@ -81,10 +81,7 @@ struct dentry *nilfs_get_parent(struct dentry *child)
 {
         unsigned long ino;
         struct inode *inode;
-        struct dentry dotdot;
-
-        dotdot.d_name.name = "..";
-        dotdot.d_name.len = 2;
+        struct qstr dotdot = {.name = "..", .len = 2};
 
         ino = nilfs_inode_by_name(child->d_inode, &dotdot);
         if (!ino)
@@ -296,7 +293,7 @@ static int nilfs_do_unlink(struct inode *dir, struct dentry *dentry)
         int err;
 
         err = -ENOENT;
-        de = nilfs_find_entry(dir, dentry, &page);
+        de = nilfs_find_entry(dir, &dentry->d_name, &page);
         if (!de)
                 goto out;
 
@@ -389,7 +386,7 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 return err;
 
         err = -ENOENT;
-        old_de = nilfs_find_entry(old_dir, old_dentry, &old_page);
+        old_de = nilfs_find_entry(old_dir, &old_dentry->d_name, &old_page);
         if (!old_de)
                 goto out;
 
@@ -409,7 +406,7 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         goto out_dir;
 
                 err = -ENOENT;
-                new_de = nilfs_find_entry(new_dir, new_dentry, &new_page);
+                new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, &new_page);
                 if (!new_de)
                         goto out_dir;
                 inc_nlink(old_inode);
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 4da6f67e9a91..8723e5bfd071 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -217,10 +217,10 @@ static inline int nilfs_init_acl(struct inode *inode, struct inode *dir)
 
 /* dir.c */
 extern int nilfs_add_link(struct dentry *, struct inode *);
-extern ino_t nilfs_inode_by_name(struct inode *, struct dentry *);
+extern ino_t nilfs_inode_by_name(struct inode *, const struct qstr *);
 extern int nilfs_make_empty(struct inode *, struct inode *);
 extern struct nilfs_dir_entry *
-nilfs_find_entry(struct inode *, struct dentry *, struct page **);
+nilfs_find_entry(struct inode *, const struct qstr *, struct page **);
 extern int nilfs_delete_entry(struct nilfs_dir_entry *, struct page *);
 extern int nilfs_empty_dir(struct inode *);
 extern struct nilfs_dir_entry *nilfs_dotdot(struct inode *, struct page **);
diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
index c9c96c7825dc..017bedc761a0 100644
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -39,7 +39,6 @@ enum {
         NILFS_SEG_FAIL_IO,
         NILFS_SEG_FAIL_MAGIC,
         NILFS_SEG_FAIL_SEQ,
-        NILFS_SEG_FAIL_CHECKSUM_SEGSUM,
         NILFS_SEG_FAIL_CHECKSUM_SUPER_ROOT,
         NILFS_SEG_FAIL_CHECKSUM_FULL,
         NILFS_SEG_FAIL_CONSISTENCY,
@@ -71,10 +70,6 @@ static int nilfs_warn_segment_error(int err)
                 printk(KERN_WARNING
                        "NILFS warning: Sequence number mismatch\n");
                 break;
-        case NILFS_SEG_FAIL_CHECKSUM_SEGSUM:
-                printk(KERN_WARNING
-                       "NILFS warning: Checksum error in segment summary\n");
-                break;
         case NILFS_SEG_FAIL_CHECKSUM_SUPER_ROOT:
                 printk(KERN_WARNING
                        "NILFS warning: Checksum error in super root\n");
@@ -206,19 +201,15 @@ int nilfs_read_super_root_block(struct super_block *sb, sector_t sr_block,
  * @pseg_start: start disk block number of partial segment
  * @seg_seq: sequence number requested
  * @ssi: pointer to nilfs_segsum_info struct to store information
- * @full_check: full check flag
- *              (0: only checks segment summary CRC, 1: data CRC)
  */
 static int
 load_segment_summary(struct nilfs_sb_info *sbi, sector_t pseg_start,
-                     u64 seg_seq, struct nilfs_segsum_info *ssi,
-                     int full_check)
+                     u64 seg_seq, struct nilfs_segsum_info *ssi)
 {
         struct buffer_head *bh_sum;
         struct nilfs_segment_summary *sum;
-        unsigned long offset, nblock;
-        u64 check_bytes;
-        u32 crc, crc_sum;
+        unsigned long nblock;
+        u32 crc;
         int ret = NILFS_SEG_FAIL_IO;
 
         bh_sum = sb_bread(sbi->s_super, pseg_start);
@@ -237,34 +228,24 @@ load_segment_summary(struct nilfs_sb_info *sbi, sector_t pseg_start,
                 ret = NILFS_SEG_FAIL_SEQ;
                 goto failed;
         }
-        if (full_check) {
-                offset = sizeof(sum->ss_datasum);
-                check_bytes =
-                        ((u64)ssi->nblocks << sbi->s_super->s_blocksize_bits);
-                nblock = ssi->nblocks;
-                crc_sum = le32_to_cpu(sum->ss_datasum);
-                ret = NILFS_SEG_FAIL_CHECKSUM_FULL;
-        } else { /* only checks segment summary */
-                offset = sizeof(sum->ss_datasum) + sizeof(sum->ss_sumsum);
-                check_bytes = ssi->sumbytes;
-                nblock = ssi->nsumblk;
-                crc_sum = le32_to_cpu(sum->ss_sumsum);
-                ret = NILFS_SEG_FAIL_CHECKSUM_SEGSUM;
-        }
 
+        nblock = ssi->nblocks;
         if (unlikely(nblock == 0 ||
                      nblock > sbi->s_nilfs->ns_blocks_per_segment)) {
                 /* This limits the number of blocks read in the CRC check */
                 ret = NILFS_SEG_FAIL_CONSISTENCY;
                 goto failed;
         }
-        if (calc_crc_cont(sbi, bh_sum, &crc, offset, check_bytes,
+        if (calc_crc_cont(sbi, bh_sum, &crc, sizeof(sum->ss_datasum),
+                          ((u64)nblock << sbi->s_super->s_blocksize_bits),
                           pseg_start, nblock)) {
                 ret = NILFS_SEG_FAIL_IO;
                 goto failed;
         }
-        if (crc == crc_sum)
+        if (crc == le32_to_cpu(sum->ss_datasum))
                 ret = 0;
+        else
+                ret = NILFS_SEG_FAIL_CHECKSUM_FULL;
  failed:
         brelse(bh_sum);
  out:
@@ -598,7 +579,7 @@ static int nilfs_do_roll_forward(struct the_nilfs *nilfs,
 
         while (segnum != ri->ri_segnum || pseg_start <= ri->ri_pseg_start) {
 
-                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi, 1);
+                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi);
                 if (ret) {
                         if (ret == NILFS_SEG_FAIL_IO) {
                                 err = -EIO;
@@ -821,7 +802,7 @@ int nilfs_search_super_root(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi,
 
         for (;;) {
                 /* Load segment summary */
-                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi, 1);
+                ret = load_segment_summary(sbi, pseg_start, seg_seq, &ssi);
                 if (ret) {
                         if (ret == NILFS_SEG_FAIL_IO)
                                 goto failed;
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 645c78656aa0..ab56fe44e377 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -40,6 +40,11 @@ struct nilfs_write_info {
 };
 
 
+static int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
+                              struct the_nilfs *nilfs);
+static int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf);
+
+
 static struct kmem_cache *nilfs_segbuf_cachep;
 
 static void nilfs_segbuf_init_once(void *obj)
@@ -302,6 +307,19 @@ void nilfs_truncate_logs(struct list_head *logs,
         }
 }
 
+int nilfs_write_logs(struct list_head *logs, struct the_nilfs *nilfs)
+{
+        struct nilfs_segment_buffer *segbuf;
+        int ret = 0;
+
+        list_for_each_entry(segbuf, logs, sb_list) {
+                ret = nilfs_segbuf_write(segbuf, nilfs);
+                if (ret)
+                        break;
+        }
+        return ret;
+}
+
 int nilfs_wait_on_logs(struct list_head *logs)
 {
         struct nilfs_segment_buffer *segbuf;
diff --git a/fs/nilfs2/segbuf.h b/fs/nilfs2/segbuf.h
index 6af1630fb401..94dfd3517bc0 100644
--- a/fs/nilfs2/segbuf.h
+++ b/fs/nilfs2/segbuf.h
@@ -166,13 +166,10 @@ nilfs_segbuf_add_file_buffer(struct nilfs_segment_buffer *segbuf,
         segbuf->sb_sum.nfileblk++;
 }
 
-int nilfs_segbuf_write(struct nilfs_segment_buffer *segbuf,
-                       struct the_nilfs *nilfs);
-int nilfs_segbuf_wait(struct nilfs_segment_buffer *segbuf);
-
 void nilfs_clear_logs(struct list_head *logs);
 void nilfs_truncate_logs(struct list_head *logs,
                          struct nilfs_segment_buffer *last);
+int nilfs_write_logs(struct list_head *logs, struct the_nilfs *nilfs);
 int nilfs_wait_on_logs(struct list_head *logs);
 
 static inline void nilfs_destroy_logs(struct list_head *logs)
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 105b508b47a8..ada2f1b947a3 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1764,14 +1764,9 @@ static int nilfs_segctor_prepare_write(struct nilfs_sc_info *sci,
 static int nilfs_segctor_write(struct nilfs_sc_info *sci,
                                struct the_nilfs *nilfs)
 {
-        struct nilfs_segment_buffer *segbuf;
-        int ret = 0;
+        int ret;
 
-        list_for_each_entry(segbuf, &sci->sc_segbufs, sb_list) {
-                ret = nilfs_segbuf_write(segbuf, nilfs);
-                if (ret)
-                        break;
-        }
+        ret = nilfs_write_logs(&sci->sc_segbufs, nilfs);
         list_splice_tail_init(&sci->sc_segbufs, &sci->sc_write_logs);
         return ret;
 }
@@ -1937,8 +1932,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
 {
         struct nilfs_segment_buffer *segbuf;
         struct page *bd_page = NULL, *fs_page = NULL;
-        struct nilfs_sb_info *sbi = sci->sc_sbi;
-        struct the_nilfs *nilfs = sbi->s_nilfs;
+        struct the_nilfs *nilfs = sci->sc_sbi->s_nilfs;
         int update_sr = (sci->sc_super_root != NULL);
 
         list_for_each_entry(segbuf, &sci->sc_write_logs, sb_list) {
@@ -2020,7 +2014,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
         if (update_sr) {
                 nilfs_set_last_segment(nilfs, segbuf->sb_pseg_start,
                                        segbuf->sb_sum.seg_seq, nilfs->ns_cno++);
-                sbi->s_super->s_dirt = 1;
+                set_nilfs_sb_dirty(nilfs);
 
                 clear_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags);
                 clear_bit(NILFS_SC_DIRTY, &sci->sc_flags);
@@ -2425,43 +2419,43 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode,
         return err;
 }
 
-struct nilfs_segctor_req {
-        int mode;
-        __u32 seq_accepted;
-        int sc_err;  /* construction failure */
-        int sb_err;  /* super block writeback failure */
-};
-
 #define FLUSH_FILE_BIT  (0x1) /* data file only */
 #define FLUSH_DAT_BIT   (1 << NILFS_DAT_INO) /* DAT only */
 
-static void nilfs_segctor_accept(struct nilfs_sc_info *sci,
-                                 struct nilfs_segctor_req *req)
+/**
+ * nilfs_segctor_accept - record accepted sequence count of log-write requests
+ * @sci: segment constructor object
+ */
+static void nilfs_segctor_accept(struct nilfs_sc_info *sci)
 {
-        req->sc_err = req->sb_err = 0;
         spin_lock(&sci->sc_state_lock);
-        req->seq_accepted = sci->sc_seq_request;
+        sci->sc_seq_accepted = sci->sc_seq_request;
         spin_unlock(&sci->sc_state_lock);
 
         if (sci->sc_timer)
                 del_timer_sync(sci->sc_timer);
 }
 
-static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
-                                 struct nilfs_segctor_req *req)
+/**
+ * nilfs_segctor_notify - notify the result of request to caller threads
+ * @sci: segment constructor object
+ * @mode: mode of log forming
+ * @err: error code to be notified
+ */
+static void nilfs_segctor_notify(struct nilfs_sc_info *sci, int mode, int err)
 {
         /* Clear requests (even when the construction failed) */
         spin_lock(&sci->sc_state_lock);
 
-        if (req->mode == SC_LSEG_SR) {
+        if (mode == SC_LSEG_SR) {
                 sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
-                sci->sc_seq_done = req->seq_accepted;
-                nilfs_segctor_wakeup(sci, req->sc_err ? : req->sb_err);
+                sci->sc_seq_done = sci->sc_seq_accepted;
+                nilfs_segctor_wakeup(sci, err);
                 sci->sc_flush_request = 0;
         } else {
-                if (req->mode == SC_FLUSH_FILE)
+                if (mode == SC_FLUSH_FILE)
                         sci->sc_flush_request &= ~FLUSH_FILE_BIT;
-                else if (req->mode == SC_FLUSH_DAT)
+                else if (mode == SC_FLUSH_DAT)
                         sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
                 /* re-enable timer if checkpoint creation was not done */
@@ -2472,30 +2466,37 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci,
         spin_unlock(&sci->sc_state_lock);
 }
 
-static int nilfs_segctor_construct(struct nilfs_sc_info *sci,
-                                   struct nilfs_segctor_req *req)
+/**
+ * nilfs_segctor_construct - form logs and write them to disk
+ * @sci: segment constructor object
+ * @mode: mode of log forming
+ */
+static int nilfs_segctor_construct(struct nilfs_sc_info *sci, int mode)
 {
         struct nilfs_sb_info *sbi = sci->sc_sbi;
         struct the_nilfs *nilfs = sbi->s_nilfs;
         int err = 0;
 
+        nilfs_segctor_accept(sci);
+
         if (nilfs_discontinued(nilfs))
-                req->mode = SC_LSEG_SR;
-        if (!nilfs_segctor_confirm(sci)) {
-                err = nilfs_segctor_do_construct(sci, req->mode);
-                req->sc_err = err;
-        }
+                mode = SC_LSEG_SR;
+        if (!nilfs_segctor_confirm(sci))
+                err = nilfs_segctor_do_construct(sci, mode);
+
         if (likely(!err)) {
-                if (req->mode != SC_FLUSH_DAT)
+                if (mode != SC_FLUSH_DAT)
                         atomic_set(&nilfs->ns_ndirtyblks, 0);
                 if (test_bit(NILFS_SC_SUPER_ROOT, &sci->sc_flags) &&
                     nilfs_discontinued(nilfs)) {
                         down_write(&nilfs->ns_sem);
-                        req->sb_err = nilfs_commit_super(sbi,
-                                        nilfs_altsb_need_update(nilfs));
+                        err = nilfs_commit_super(
+                                sbi, nilfs_altsb_need_update(nilfs));
                         up_write(&nilfs->ns_sem);
                 }
         }
+
+        nilfs_segctor_notify(sci, mode, err);
         return err;
 }
 
@@ -2526,7 +2527,6 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
         struct nilfs_sc_info *sci = NILFS_SC(sbi);
         struct the_nilfs *nilfs = sbi->s_nilfs;
         struct nilfs_transaction_info ti;
-        struct nilfs_segctor_req req = { .mode = SC_LSEG_SR };
         int err;
 
         if (unlikely(!sci))
@@ -2547,10 +2547,8 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
         list_splice_tail_init(&nilfs->ns_gc_inodes, &sci->sc_gc_inodes);
 
         for (;;) {
-                nilfs_segctor_accept(sci, &req);
-                err = nilfs_segctor_construct(sci, &req);
+                err = nilfs_segctor_construct(sci, SC_LSEG_SR);
                 nilfs_remove_written_gcinodes(nilfs, &sci->sc_gc_inodes);
-                nilfs_segctor_notify(sci, &req);
 
                 if (likely(!err))
                         break;
@@ -2560,6 +2558,16 @@ int nilfs_clean_segments(struct super_block *sb, struct nilfs_argv *argv,
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule_timeout(sci->sc_interval);
         }
+        if (nilfs_test_opt(sbi, DISCARD)) {
+                int ret = nilfs_discard_segments(nilfs, sci->sc_freesegs,
+                                                 sci->sc_nfreesegs);
+                if (ret) {
+                        printk(KERN_WARNING
+                               "NILFS warning: error %d on discard request, "
+                               "turning discards off for the device\n", ret);
+                        nilfs_clear_opt(sbi, DISCARD);
+                }
+        }
 
  out_unlock:
         sci->sc_freesegs = NULL;
@@ -2573,13 +2581,9 @@ static void nilfs_segctor_thread_construct(struct nilfs_sc_info *sci, int mode)
 {
         struct nilfs_sb_info *sbi = sci->sc_sbi;
         struct nilfs_transaction_info ti;
-        struct nilfs_segctor_req req = { .mode = mode };
 
         nilfs_transaction_lock(sbi, &ti, 0);
-
-        nilfs_segctor_accept(sci, &req);
-        nilfs_segctor_construct(sci, &req);
-        nilfs_segctor_notify(sci, &req);
+        nilfs_segctor_construct(sci, mode);
 
         /*
          * Unclosed segment should be retried.  We do this using sc_timer.
@@ -2635,6 +2639,7 @@ static int nilfs_segctor_flush_mode(struct nilfs_sc_info *sci)
 static int nilfs_segctor_thread(void *arg)
 {
         struct nilfs_sc_info *sci = (struct nilfs_sc_info *)arg;
+        struct the_nilfs *nilfs = sci->sc_sbi->s_nilfs;
         struct timer_list timer;
         int timeout = 0;
 
@@ -2680,7 +2685,6 @@ static int nilfs_segctor_thread(void *arg)
         } else {
                 DEFINE_WAIT(wait);
                 int should_sleep = 1;
-                struct the_nilfs *nilfs;
 
                 prepare_to_wait(&sci->sc_wait_daemon, &wait,
                                 TASK_INTERRUPTIBLE);
@@ -2701,8 +2705,8 @@ static int nilfs_segctor_thread(void *arg)
                 finish_wait(&sci->sc_wait_daemon, &wait);
                 timeout = ((sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
                            time_after_eq(jiffies, sci->sc_timer->expires));
-                nilfs = sci->sc_sbi->s_nilfs;
-                if (sci->sc_super->s_dirt && nilfs_sb_need_update(nilfs))
+
+                if (nilfs_sb_dirty(nilfs) && nilfs_sb_need_update(nilfs))
                         set_nilfs_discontinued(nilfs);
         }
         goto loop;
@@ -2797,12 +2801,9 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci)
         do {
                 struct nilfs_sb_info *sbi = sci->sc_sbi;
                 struct nilfs_transaction_info ti;
-                struct nilfs_segctor_req req = { .mode = SC_LSEG_SR };
 
                 nilfs_transaction_lock(sbi, &ti, 0);
-                nilfs_segctor_accept(sci, &req);
-                ret = nilfs_segctor_construct(sci, &req);
-                nilfs_segctor_notify(sci, &req);
+                ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
                 nilfs_transaction_unlock(sbi);
 
         } while (ret && retrycount-- > 0);
@@ -2865,8 +2866,15 @@ int nilfs_attach_segment_constructor(struct nilfs_sb_info *sbi)
         struct the_nilfs *nilfs = sbi->s_nilfs;
         int err;
 
-        /* Each field of nilfs_segctor is cleared through the initialization
-           of super-block info */
+        if (NILFS_SC(sbi)) {
+                /*
+                 * This happens if the filesystem was remounted
+                 * read/write after nilfs_error degenerated it into a
+                 * read-only mount.
+                 */
+                nilfs_detach_segment_constructor(sbi);
+        }
+
         sbi->s_sc_info = nilfs_segctor_new(sbi);
         if (!sbi->s_sc_info)
                 return -ENOMEM;
diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index 3d3ab2f9864c..3155e0c7f415 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h
@@ -116,6 +116,7 @@ struct nilfs_segsum_pointer {
  * @sc_wait_daemon: Daemon wait queue
  * @sc_wait_task: Start/end wait queue to control segctord task
  * @sc_seq_request: Request counter
+ * @sc_seq_accept: Accepted request count
  * @sc_seq_done: Completion counter
  * @sc_sync: Request of explicit sync operation
  * @sc_interval: Timeout value of background construction
@@ -169,6 +170,7 @@ struct nilfs_sc_info {
         wait_queue_head_t       sc_wait_task;
 
         __u32                   sc_seq_request;
+        __u32                   sc_seq_accepted;
         __u32                   sc_seq_done;
 
         int                     sc_sync;
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 8173faee31e6..92579cc4c935 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -96,9 +96,6 @@ void nilfs_error(struct super_block *sb, const char *function,
         if (!(sb->s_flags & MS_RDONLY)) {
                 struct the_nilfs *nilfs = sbi->s_nilfs;
 
-                if (!nilfs_test_opt(sbi, ERRORS_CONT))
-                        nilfs_detach_segment_constructor(sbi);
-
                 down_write(&nilfs->ns_sem);
                 if (!(nilfs->ns_mount_state & NILFS_ERROR_FS)) {
                         nilfs->ns_mount_state |= NILFS_ERROR_FS;
@@ -301,7 +298,7 @@ int nilfs_commit_super(struct nilfs_sb_info *sbi, int dupsb)
                 memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
                 nilfs->ns_sbwtime[1] = t;
         }
-        sbi->s_super->s_dirt = 0;
+        clear_nilfs_sb_dirty(nilfs);
         return nilfs_sync_super(sbi, dupsb);
 }
 
@@ -345,7 +342,7 @@ static int nilfs_sync_fs(struct super_block *sb, int wait)
                 err = nilfs_construct_segment(sb);
 
         down_write(&nilfs->ns_sem);
-        if (sb->s_dirt)
+        if (nilfs_sb_dirty(nilfs))
                 nilfs_commit_super(sbi, 1);
         up_write(&nilfs->ns_sem);
 
@@ -481,6 +478,8 @@ static int nilfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
                 seq_printf(seq, ",order=strict");
         if (nilfs_test_opt(sbi, NORECOVERY))
                 seq_printf(seq, ",norecovery");
+        if (nilfs_test_opt(sbi, DISCARD))
+                seq_printf(seq, ",discard");
 
         return 0;
 }
@@ -550,7 +549,7 @@ static const struct export_operations nilfs_export_ops = {
 enum {
         Opt_err_cont, Opt_err_panic, Opt_err_ro,
         Opt_nobarrier, Opt_snapshot, Opt_order, Opt_norecovery,
-        Opt_err,
+        Opt_discard, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -561,6 +560,7 @@ static match_table_t tokens = {
         {Opt_snapshot, "cp=%u"},
         {Opt_order, "order=%s"},
         {Opt_norecovery, "norecovery"},
+        {Opt_discard, "discard"},
         {Opt_err, NULL}
 };
 
@@ -614,6 +614,9 @@ static int parse_options(char *options, struct super_block *sb)
                 case Opt_norecovery:
                         nilfs_set_opt(sbi, NORECOVERY);
                         break;
+                case Opt_discard:
+                        nilfs_set_opt(sbi, DISCARD);
+                        break;
                 default:
                         printk(KERN_ERR
                                "NILFS: Unrecognized mount option \"%s\"\n", p);
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 6241e1722efc..92733d5651d2 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -646,6 +646,44 @@ int init_nilfs(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi, char *data)
         goto out;
 }
 
+int nilfs_discard_segments(struct the_nilfs *nilfs, __u64 *segnump,
+                            size_t nsegs)
+{
+        sector_t seg_start, seg_end;
+        sector_t start = 0, nblocks = 0;
+        unsigned int sects_per_block;
+        __u64 *sn;
+        int ret = 0;
+
+        sects_per_block = (1 << nilfs->ns_blocksize_bits) /
+                bdev_logical_block_size(nilfs->ns_bdev);
+        for (sn = segnump; sn < segnump + nsegs; sn++) {
+                nilfs_get_segment_range(nilfs, *sn, &seg_start, &seg_end);
+
+                if (!nblocks) {
+                        start = seg_start;
+                        nblocks = seg_end - seg_start + 1;
+                } else if (start + nblocks == seg_start) {
+                        nblocks += seg_end - seg_start + 1;
+                } else {
+                        ret = blkdev_issue_discard(nilfs->ns_bdev,
+                                                   start * sects_per_block,
+                                                   nblocks * sects_per_block,
+                                                   GFP_NOFS,
+                                                   DISCARD_FL_BARRIER);
+                        if (ret < 0)
+                                return ret;
+                        nblocks = 0;
+                }
+        }
+        if (nblocks)
+                ret = blkdev_issue_discard(nilfs->ns_bdev,
+                                           start * sects_per_block,
+                                           nblocks * sects_per_block,
+                                           GFP_NOFS, DISCARD_FL_BARRIER);
+        return ret;
+}
+
 int nilfs_count_free_blocks(struct the_nilfs *nilfs, sector_t *nblocks)
 {
         struct inode *dat = nilfs_dat_inode(nilfs);
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 589786e33464..e9795f1724d7 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -38,6 +38,7 @@ enum {
                                    the latest checkpoint was loaded */
         THE_NILFS_DISCONTINUED, /* 'next' pointer chain has broken */
         THE_NILFS_GC_RUNNING,   /* gc process is running */
+        THE_NILFS_SB_DIRTY,     /* super block is dirty */
 };
 
 /**
@@ -197,6 +198,7 @@ THE_NILFS_FNS(INIT, init)
 THE_NILFS_FNS(LOADED, loaded)
 THE_NILFS_FNS(DISCONTINUED, discontinued)
 THE_NILFS_FNS(GC_RUNNING, gc_running)
+THE_NILFS_FNS(SB_DIRTY, sb_dirty)
 
 /* Minimum interval of periodical update of superblocks (in seconds) */
 #define NILFS_SB_FREQ           10
@@ -221,6 +223,7 @@ struct the_nilfs *find_or_create_nilfs(struct block_device *);
 void put_nilfs(struct the_nilfs *);
 int init_nilfs(struct the_nilfs *, struct nilfs_sb_info *, char *);
 int load_nilfs(struct the_nilfs *, struct nilfs_sb_info *);
+int nilfs_discard_segments(struct the_nilfs *, __u64 *, size_t);
 int nilfs_count_free_blocks(struct the_nilfs *, sector_t *);
 struct nilfs_sb_info *nilfs_find_sbinfo(struct the_nilfs *, int, __u64);
 int nilfs_checkpoint_is_mounted(struct the_nilfs *, __u64, int);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index a94e8bd8eb1f..472cdf29ef82 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -29,14 +29,12 @@
 #include <linux/init.h> /* module_init */
 #include <linux/inotify.h>
 #include <linux/kernel.h> /* roundup() */
-#include <linux/magic.h> /* superblock magic number */
-#include <linux/mount.h> /* mntget */
 #include <linux/namei.h> /* LOOKUP_FOLLOW */
-#include <linux/path.h> /* struct path */
 #include <linux/sched.h> /* struct user */
 #include <linux/slab.h> /* struct kmem_cache */
 #include <linux/syscalls.h>
 #include <linux/types.h>
+#include <linux/anon_inodes.h>
 #include <linux/uaccess.h>
 #include <linux/poll.h>
 #include <linux/wait.h>
@@ -45,8 +43,6 @@
 
 #include <asm/ioctls.h>
 
-static struct vfsmount *inotify_mnt __read_mostly;
-
 /* these are configurable via /proc/sys/fs/inotify/ */
 static int inotify_max_user_instances __read_mostly;
 static int inotify_max_queued_events __read_mostly;
@@ -645,9 +641,7 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
 {
         struct fsnotify_group *group;
         struct user_struct *user;
-        struct file *filp;
-        struct path path;
-        int fd, ret;
+        int ret;
 
         /* Check the IN_* constants for consistency.  */
         BUILD_BUG_ON(IN_CLOEXEC != O_CLOEXEC);
@@ -656,10 +650,6 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
         if (flags & ~(IN_CLOEXEC | IN_NONBLOCK))
                 return -EINVAL;
 
-        fd = get_unused_fd_flags(flags & O_CLOEXEC);
-        if (fd < 0)
-                return fd;
-
         user = get_current_user();
         if (unlikely(atomic_read(&user->inotify_devs) >=
                         inotify_max_user_instances)) {
@@ -676,27 +666,14 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
 
         atomic_inc(&user->inotify_devs);
 
-        path.mnt = inotify_mnt;
-        path.dentry = inotify_mnt->mnt_root;
-        path_get(&path);
-        filp = alloc_file(&path, FMODE_READ, &inotify_fops);
-        if (!filp)
-                goto Enfile;
+        ret = anon_inode_getfd("inotify", &inotify_fops, group,
+                                  O_RDONLY | flags);
+        if (ret >= 0)
+                return ret;
 
-        filp->f_flags = O_RDONLY | (flags & O_NONBLOCK);
-        filp->private_data = group;
-
-        fd_install(fd, filp);
-
-        return fd;
-
-Enfile:
-        ret = -ENFILE;
-        path_put(&path);
         atomic_dec(&user->inotify_devs);
 out_free_uid:
         free_uid(user);
-        put_unused_fd(fd);
         return ret;
 }
 
@@ -783,20 +760,6 @@ out:
         return ret;
 }
 
-static int
-inotify_get_sb(struct file_system_type *fs_type, int flags,
-               const char *dev_name, void *data, struct vfsmount *mnt)
-{
-        return get_sb_pseudo(fs_type, "inotify", NULL,
-                        INOTIFYFS_SUPER_MAGIC, mnt);
-}
-
-static struct file_system_type inotify_fs_type = {
-    .name       = "inotifyfs",
-    .get_sb     = inotify_get_sb,
-    .kill_sb    = kill_anon_super,
-};
-
 /*
  * inotify_user_setup - Our initialization function.  Note that we cannnot return
  * error because we have compiled-in VFS hooks.  So an (unlikely) failure here
@@ -804,16 +767,6 @@ static struct file_system_type inotify_fs_type = {
  */
 static int __init inotify_user_setup(void)
 {
-        int ret;
-
-        ret = register_filesystem(&inotify_fs_type);
-        if (unlikely(ret))
-                panic("inotify: register_filesystem returned %d!\n", ret);
-
-        inotify_mnt = kern_mount(&inotify_fs_type);
-        if (IS_ERR(inotify_mnt))
-                panic("inotify: kern_mount ret %ld!\n", PTR_ERR(inotify_mnt));
-
         inotify_inode_mark_cachep = KMEM_CACHE(inotify_inode_mark_entry, SLAB_PANIC);
         event_priv_cachep = KMEM_CACHE(inotify_event_private_data, SLAB_PANIC);
 
diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
index 5a9e34475e37..9173e82a45d1 100644
--- a/fs/ntfs/dir.c
+++ b/fs/ntfs/dir.c
@@ -1545,7 +1545,7 @@ static int ntfs_dir_fsync(struct file *filp, struct dentry *dentry,
                 write_inode_now(bmp_vi, !datasync);
                 iput(bmp_vi);
         }
-        ret = ntfs_write_inode(vi, 1);
+        ret = __ntfs_write_inode(vi, 1);
         write_inode_now(vi, !datasync);
         err = sync_blockdev(vi->i_sb->s_bdev);
         if (unlikely(err && !ret))
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index 43179ddd336f..b681c71d7069 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -2182,7 +2182,7 @@ static int ntfs_file_fsync(struct file *filp, struct dentry *dentry,
         ntfs_debug("Entering for inode 0x%lx.", vi->i_ino);
         BUG_ON(S_ISDIR(vi->i_mode));
         if (!datasync || !NInoNonResident(NTFS_I(vi)))
-                ret = ntfs_write_inode(vi, 1);
+                ret = __ntfs_write_inode(vi, 1);
         write_inode_now(vi, !datasync);
         /*
          * NOTE: If we were to use mapping->private_list (see ext2 and
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index dc2505abb6d7..4b57fb1eac2a 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -2957,7 +2957,7 @@ out:
  *
  * Return 0 on success and -errno on error.
  */
-int ntfs_write_inode(struct inode *vi, int sync)
+int __ntfs_write_inode(struct inode *vi, int sync)
 {
         sle64 nt;
         ntfs_inode *ni = NTFS_I(vi);
diff --git a/fs/ntfs/inode.h b/fs/ntfs/inode.h
index 117eaf8032a3..9a113544605d 100644
--- a/fs/ntfs/inode.h
+++ b/fs/ntfs/inode.h
@@ -307,12 +307,12 @@ extern void ntfs_truncate_vfs(struct inode *vi);
 
 extern int ntfs_setattr(struct dentry *dentry, struct iattr *attr);
 
-extern int ntfs_write_inode(struct inode *vi, int sync);
+extern int __ntfs_write_inode(struct inode *vi, int sync);
 
 static inline void ntfs_commit_inode(struct inode *vi)
 {
         if (!is_bad_inode(vi))
-                ntfs_write_inode(vi, 1);
+                __ntfs_write_inode(vi, 1);
         return;
 }
 
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 80b04770e8e9..1cf39dfaee7a 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -39,6 +39,7 @@
 #include "dir.h"
 #include "debug.h"
 #include "index.h"
+#include "inode.h"
 #include "aops.h"
 #include "layout.h"
 #include "malloc.h"
@@ -2662,6 +2663,13 @@ static int ntfs_statfs(struct dentry *dentry, struct kstatfs *sfs)
         return 0;
 }
 
+#ifdef NTFS_RW
+static int ntfs_write_inode(struct inode *vi, struct writeback_control *wbc)
+{
+        return __ntfs_write_inode(vi, wbc->sync_mode == WB_SYNC_ALL);
+}
+#endif
+
 /**
  * The complete super operations.
  */
diff --git a/fs/ocfs2/Makefile b/fs/ocfs2/Makefile
index 600d2d2ade11..791c0886c060 100644
--- a/fs/ocfs2/Makefile
+++ b/fs/ocfs2/Makefile
@@ -46,6 +46,7 @@ ocfs2_stackglue-objs := stackglue.o
 ocfs2_stack_o2cb-objs := stack_o2cb.o
 ocfs2_stack_user-objs := stack_user.o
 
+obj-$(CONFIG_OCFS2_FS) += dlmfs/
 # cluster/ is always needed when OCFS2_FS for masklog support
 obj-$(CONFIG_OCFS2_FS) += cluster/
 obj-$(CONFIG_OCFS2_FS_O2CB) += dlm/
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index d17bdc718f74..2bbe1ecc08c0 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1050,7 +1050,8 @@ static int ocfs2_create_new_meta_bhs(handle_t *handle,
                         strcpy(eb->h_signature, OCFS2_EXTENT_BLOCK_SIGNATURE);
                         eb->h_blkno = cpu_to_le64(first_blkno);
                         eb->h_fs_generation = cpu_to_le32(osb->fs_generation);
-                        eb->h_suballoc_slot = cpu_to_le16(osb->slot_num);
+                        eb->h_suballoc_slot =
+                                cpu_to_le16(meta_ac->ac_alloc_slot);
                         eb->h_suballoc_bit = cpu_to_le16(suballoc_bit_start);
                         eb->h_list.l_count =
                                 cpu_to_le16(ocfs2_extent_recs_per_eb(osb->sb));
@@ -6037,7 +6038,7 @@ static void ocfs2_truncate_log_worker(struct work_struct *work)
         if (status < 0)
                 mlog_errno(status);
         else
-                ocfs2_init_inode_steal_slot(osb);
+                ocfs2_init_steal_slots(osb);
 
         mlog_exit(status);
 }
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 7e9df11260f4..4c2a6d282c4d 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -577,8 +577,9 @@ static int ocfs2_direct_IO_get_blocks(struct inode *inode, sector_t iblock,
                 goto bail;
         }
 
-        /* We should already CoW the refcounted extent. */
-        BUG_ON(ext_flags & OCFS2_EXT_REFCOUNTED);
+        /* We should already CoW the refcounted extent in case of create. */
+        BUG_ON(create && (ext_flags & OCFS2_EXT_REFCOUNTED));
+
         /*
          * get_more_blocks() expects us to describe a hole by clearing
          * the mapped bit on bh_result().
diff --git a/fs/ocfs2/cluster/masklog.c b/fs/ocfs2/cluster/masklog.c
index 1cd2934de615..b39da877b12f 100644
--- a/fs/ocfs2/cluster/masklog.c
+++ b/fs/ocfs2/cluster/masklog.c
@@ -112,6 +112,7 @@ static struct mlog_attribute mlog_attrs[MLOG_MAX_BITS] = {
         define_mask(XATTR),
         define_mask(QUOTA),
         define_mask(REFCOUNT),
+        define_mask(BASTS),
         define_mask(ERROR),
         define_mask(NOTICE),
         define_mask(KTHREAD),
diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
index 9b4d11726cf2..3dfddbec32f2 100644
--- a/fs/ocfs2/cluster/masklog.h
+++ b/fs/ocfs2/cluster/masklog.h
@@ -114,6 +114,7 @@
 #define ML_XATTR        0x0000000020000000ULL /* ocfs2 extended attributes */
 #define ML_QUOTA        0x0000000040000000ULL /* ocfs2 quota operations */
 #define ML_REFCOUNT     0x0000000080000000ULL /* refcount tree operations */
+#define ML_BASTS        0x0000001000000000ULL /* dlmglue asts and basts */
 /* bits that are infrequently given and frequently matched in the high word */
 #define ML_ERROR        0x0000000100000000ULL /* sent to KERN_ERR */
 #define ML_NOTICE       0x0000000200000000ULL /* setn to KERN_NOTICE */
@@ -194,9 +195,9 @@ extern struct mlog_bits mlog_and_bits, mlog_not_bits;
  * previous token if args expands to nothing.
  */
 #define __mlog_printk(level, fmt, args...)                              \
-        printk(level "(%u,%lu):%s:%d " fmt, task_pid_nr(current),       \
-               __mlog_cpu_guess, __PRETTY_FUNCTION__, __LINE__ ,        \
-               ##args)
+        printk(level "(%s,%u,%lu):%s:%d " fmt, current->comm,           \
+               task_pid_nr(current), __mlog_cpu_guess,                  \
+               __PRETTY_FUNCTION__, __LINE__ , ##args)
 
 #define mlog(mask, fmt, args...) do {                                   \
         u64 __m = MLOG_MASK_PREFIX | (mask);                            \
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 28c3ec238796..765d66c70989 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -2439,7 +2439,7 @@ static int ocfs2_dx_dir_attach_index(struct ocfs2_super *osb,
         dx_root = (struct ocfs2_dx_root_block *)dx_root_bh->b_data;
         memset(dx_root, 0, osb->sb->s_blocksize);
         strcpy(dx_root->dr_signature, OCFS2_DX_ROOT_SIGNATURE);
-        dx_root->dr_suballoc_slot = cpu_to_le16(osb->slot_num);
+        dx_root->dr_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         dx_root->dr_suballoc_bit = cpu_to_le16(dr_suballoc_bit);
         dx_root->dr_fs_generation = cpu_to_le32(osb->fs_generation);
         dx_root->dr_blkno = cpu_to_le64(dr_blkno);
diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile
index 190361375700..dcebf0d920fa 100644
--- a/fs/ocfs2/dlm/Makefile
+++ b/fs/ocfs2/dlm/Makefile
@@ -1,8 +1,7 @@
 EXTRA_CFLAGS += -Ifs/ocfs2
 
-obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o ocfs2_dlmfs.o
+obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o
 
 ocfs2_dlm-objs := dlmdomain.o dlmdebug.o dlmthread.o dlmrecovery.o \
         dlmmaster.o dlmast.o dlmconvert.o dlmlock.o dlmunlock.o dlmver.o
 
-ocfs2_dlmfs-objs := userdlm.o dlmfs.o dlmfsver.o
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 344bcf90cbf4..b4f99de2caf3 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -310,7 +310,7 @@ static int dlm_recovery_thread(void *data)
         mlog(0, "dlm thread running for %s...\n", dlm->name);
 
         while (!kthread_should_stop()) {
-                if (dlm_joined(dlm)) {
+                if (dlm_domain_fully_joined(dlm)) {
                         status = dlm_do_recovery(dlm);
                         if (status == -EAGAIN) {
                                 /* do not sleep, recheck immediately. */
diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile
new file mode 100644
index 000000000000..df69b4856d0d
--- /dev/null
+++ b/fs/ocfs2/dlmfs/Makefile
@@ -0,0 +1,5 @@
+EXTRA_CFLAGS += -Ifs/ocfs2
+
+obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o
+
+ocfs2_dlmfs-objs := userdlm.o dlmfs.o dlmfsver.o
diff --git a/fs/ocfs2/dlm/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
index 02bf17808bdc..1b0de157a08c 100644
--- a/fs/ocfs2/dlm/dlmfs.c
+++ b/fs/ocfs2/dlmfs/dlmfs.c
@@ -43,24 +43,17 @@
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/backing-dev.h>
+#include <linux/poll.h>
 
 #include <asm/uaccess.h>
 
-
-#include "cluster/nodemanager.h"
-#include "cluster/heartbeat.h"
-#include "cluster/tcp.h"
-
-#include "dlmapi.h"
-
+#include "stackglue.h"
 #include "userdlm.h"
-
 #include "dlmfsver.h"
 
 #define MLOG_MASK_PREFIX ML_DLMFS
 #include "cluster/masklog.h"
 
-#include "ocfs2_lockingver.h"
 
 static const struct super_operations dlmfs_ops;
 static const struct file_operations dlmfs_file_operations;
@@ -71,15 +64,46 @@ static struct kmem_cache *dlmfs_inode_cache;
 
 struct workqueue_struct *user_dlm_worker;
 
+
+
 /*
- * This is the userdlmfs locking protocol version.
+ * These are the ABI capabilities of dlmfs.
+ *
+ * Over time, dlmfs has added some features that were not part of the
+ * initial ABI.  Unfortunately, some of these features are not detectable
+ * via standard usage.  For example, Linux's default poll always returns
+ * POLLIN, so there is no way for a caller of poll(2) to know when dlmfs
+ * added poll support.  Instead, we provide this list of new capabilities.
+ *
+ * Capabilities is a read-only attribute.  We do it as a module parameter
+ * so we can discover it whether dlmfs is built in, loaded, or even not
+ * loaded.
  *
- * See fs/ocfs2/dlmglue.c for more details on locking versions.
+ * The ABI features are local to this machine's dlmfs mount.  This is
+ * distinct from the locking protocol, which is concerned with inter-node
+ * interaction.
+ *
+ * Capabilities:
+ * - bast       : POLLIN against the file descriptor of a held lock
+ *                signifies a bast fired on the lock.
  */
-static const struct dlm_protocol_version user_locking_protocol = {
-        .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
-        .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
-};
+#define DLMFS_CAPABILITIES "bast stackglue"
+extern int param_set_dlmfs_capabilities(const char *val,
+                                        struct kernel_param *kp)
+{
+        printk(KERN_ERR "%s: readonly parameter\n", kp->name);
+        return -EINVAL;
+}
+static int param_get_dlmfs_capabilities(char *buffer,
+                                        struct kernel_param *kp)
+{
+        return strlcpy(buffer, DLMFS_CAPABILITIES,
+                       strlen(DLMFS_CAPABILITIES) + 1);
+}
+module_param_call(capabilities, param_set_dlmfs_capabilities,
+                  param_get_dlmfs_capabilities, NULL, 0444);
+MODULE_PARM_DESC(capabilities, DLMFS_CAPABILITIES);
+
 
 /*
  * decodes a set of open flags into a valid lock level and a set of flags.
@@ -179,13 +203,46 @@ static int dlmfs_file_release(struct inode *inode,
         return 0;
 }
 
+/*
+ * We do ->setattr() just to override size changes.  Our size is the size
+ * of the LVB and nothing else.
+ */
+static int dlmfs_file_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        int error;
+        struct inode *inode = dentry->d_inode;
+
+        attr->ia_valid &= ~ATTR_SIZE;
+        error = inode_change_ok(inode, attr);
+        if (!error)
+                error = inode_setattr(inode, attr);
+
+        return error;
+}
+
+static unsigned int dlmfs_file_poll(struct file *file, poll_table *wait)
+{
+        int event = 0;
+        struct inode *inode = file->f_path.dentry->d_inode;
+        struct dlmfs_inode_private *ip = DLMFS_I(inode);
+
+        poll_wait(file, &ip->ip_lockres.l_event, wait);
+
+        spin_lock(&ip->ip_lockres.l_lock);
+        if (ip->ip_lockres.l_flags & USER_LOCK_BLOCKED)
+                event = POLLIN | POLLRDNORM;
+        spin_unlock(&ip->ip_lockres.l_lock);
+
+        return event;
+}
+
 static ssize_t dlmfs_file_read(struct file *filp,
                                char __user *buf,
                                size_t count,
                                loff_t *ppos)
 {
         int bytes_left;
-        ssize_t readlen;
+        ssize_t readlen, got;
         char *lvb_buf;
         struct inode *inode = filp->f_path.dentry->d_inode;
 
@@ -211,9 +268,13 @@ static ssize_t dlmfs_file_read(struct file *filp,
         if (!lvb_buf)
                 return -ENOMEM;
 
-        user_dlm_read_lvb(inode, lvb_buf, readlen);
-        bytes_left = __copy_to_user(buf, lvb_buf, readlen);
-        readlen -= bytes_left;
+        got = user_dlm_read_lvb(inode, lvb_buf, readlen);
+        if (got) {
+                BUG_ON(got != readlen);
+                bytes_left = __copy_to_user(buf, lvb_buf, readlen);
+                readlen -= bytes_left;
+        } else
+                readlen = 0;
 
         kfree(lvb_buf);
 
@@ -272,7 +333,7 @@ static void dlmfs_init_once(void *foo)
         struct dlmfs_inode_private *ip =
                 (struct dlmfs_inode_private *) foo;
 
-        ip->ip_dlm = NULL;
+        ip->ip_conn = NULL;
         ip->ip_parent = NULL;
 
         inode_init_once(&ip->ip_vfs_inode);
@@ -314,14 +375,14 @@ static void dlmfs_clear_inode(struct inode *inode)
                 goto clear_fields;
         }
 
-        mlog(0, "we're a directory, ip->ip_dlm = 0x%p\n", ip->ip_dlm);
+        mlog(0, "we're a directory, ip->ip_conn = 0x%p\n", ip->ip_conn);
         /* we must be a directory. If required, lets unregister the
          * dlm context now. */
-        if (ip->ip_dlm)
-                user_dlm_unregister_context(ip->ip_dlm);
+        if (ip->ip_conn)
+                user_dlm_unregister(ip->ip_conn);
 clear_fields:
         ip->ip_parent = NULL;
-        ip->ip_dlm = NULL;
+        ip->ip_conn = NULL;
 }
 
 static struct backing_dev_info dlmfs_backing_dev_info = {
@@ -371,7 +432,7 @@ static struct inode *dlmfs_get_inode(struct inode *parent,
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
 
         ip = DLMFS_I(inode);
-        ip->ip_dlm = DLMFS_I(parent)->ip_dlm;
+        ip->ip_conn = DLMFS_I(parent)->ip_conn;
 
         switch (mode & S_IFMT) {
         default:
@@ -425,13 +486,12 @@ static int dlmfs_mkdir(struct inode * dir,
         struct inode *inode = NULL;
         struct qstr *domain = &dentry->d_name;
         struct dlmfs_inode_private *ip;
-        struct dlm_ctxt *dlm;
-        struct dlm_protocol_version proto = user_locking_protocol;
+        struct ocfs2_cluster_connection *conn;
 
         mlog(0, "mkdir %.*s\n", domain->len, domain->name);
 
         /* verify that we have a proper domain */
-        if (domain->len >= O2NM_MAX_NAME_LEN) {
+        if (domain->len >= GROUP_NAME_MAX) {
                 status = -EINVAL;
                 mlog(ML_ERROR, "invalid domain name for directory.\n");
                 goto bail;
@@ -446,14 +506,14 @@ static int dlmfs_mkdir(struct inode * dir,
 
         ip = DLMFS_I(inode);
 
-        dlm = user_dlm_register_context(domain, &proto);
-        if (IS_ERR(dlm)) {
-                status = PTR_ERR(dlm);
+        conn = user_dlm_register(domain);
+        if (IS_ERR(conn)) {
+                status = PTR_ERR(conn);
                 mlog(ML_ERROR, "Error %d could not register domain \"%.*s\"\n",
                      status, domain->len, domain->name);
                 goto bail;
         }
-        ip->ip_dlm = dlm;
+        ip->ip_conn = conn;
 
         inc_nlink(dir);
         d_instantiate(dentry, inode);
@@ -549,6 +609,7 @@ static int dlmfs_fill_super(struct super_block * sb,
 static const struct file_operations dlmfs_file_operations = {
         .open           = dlmfs_file_open,
         .release        = dlmfs_file_release,
+        .poll           = dlmfs_file_poll,
         .read           = dlmfs_file_read,
         .write          = dlmfs_file_write,
 };
@@ -576,6 +637,7 @@ static const struct super_operations dlmfs_ops = {
 
 static const struct inode_operations dlmfs_file_inode_operations = {
         .getattr        = simple_getattr,
+        .setattr        = dlmfs_file_setattr,
 };
 
 static int dlmfs_get_sb(struct file_system_type *fs_type,
@@ -620,6 +682,7 @@ static int __init init_dlmfs_fs(void)
         }
         cleanup_worker = 1;
 
+        user_dlm_set_locking_protocol();
         status = register_filesystem(&dlmfs_fs_type);
 bail:
         if (status) {
diff --git a/fs/ocfs2/dlm/dlmfsver.c b/fs/ocfs2/dlmfs/dlmfsver.c
index a733b3321f83..a733b3321f83 100644
--- a/fs/ocfs2/dlm/dlmfsver.c
+++ b/fs/ocfs2/dlmfs/dlmfsver.c
diff --git a/fs/ocfs2/dlm/dlmfsver.h b/fs/ocfs2/dlmfs/dlmfsver.h
index f35eadbed25c..f35eadbed25c 100644
--- a/fs/ocfs2/dlm/dlmfsver.h
+++ b/fs/ocfs2/dlmfs/dlmfsver.h
diff --git a/fs/ocfs2/dlm/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c
index 4cb1d3dae250..0499e3fb7bdb 100644
--- a/fs/ocfs2/dlm/userdlm.c
+++ b/fs/ocfs2/dlmfs/userdlm.c
@@ -34,18 +34,19 @@
 #include <linux/types.h>
 #include <linux/crc32.h>
 
-
-#include "cluster/nodemanager.h"
-#include "cluster/heartbeat.h"
-#include "cluster/tcp.h"
-
-#include "dlmapi.h"
-
+#include "ocfs2_lockingver.h"
+#include "stackglue.h"
 #include "userdlm.h"
 
 #define MLOG_MASK_PREFIX ML_DLMFS
 #include "cluster/masklog.h"
 
+
+static inline struct user_lock_res *user_lksb_to_lock_res(struct ocfs2_dlm_lksb *lksb)
+{
+        return container_of(lksb, struct user_lock_res, l_lksb);
+}
+
 static inline int user_check_wait_flag(struct user_lock_res *lockres,
                                        int flag)
 {
@@ -73,15 +74,15 @@ static inline void user_wait_on_blocked_lock(struct user_lock_res *lockres)
 }
 
 /* I heart container_of... */
-static inline struct dlm_ctxt *
-dlm_ctxt_from_user_lockres(struct user_lock_res *lockres)
+static inline struct ocfs2_cluster_connection *
+cluster_connection_from_user_lockres(struct user_lock_res *lockres)
 {
         struct dlmfs_inode_private *ip;
 
         ip = container_of(lockres,
                           struct dlmfs_inode_private,
                           ip_lockres);
-        return ip->ip_dlm;
+        return ip->ip_conn;
 }
 
 static struct inode *
@@ -103,9 +104,9 @@ static inline void user_recover_from_dlm_error(struct user_lock_res *lockres)
 }
 
 #define user_log_dlm_error(_func, _stat, _lockres) do {                 \
-        mlog(ML_ERROR, "Dlm error \"%s\" while calling %s on "          \
-                "resource %.*s: %s\n", dlm_errname(_stat), _func,       \
-                _lockres->l_namelen, _lockres->l_name, dlm_errmsg(_stat)); \
+        mlog(ML_ERROR, "Dlm error %d while calling %s on "              \
+                "resource %.*s\n", _stat, _func,                        \
+                _lockres->l_namelen, _lockres->l_name);                 \
 } while (0)
 
 /* WARNING: This function lives in a world where the only three lock
@@ -113,34 +114,35 @@ static inline void user_recover_from_dlm_error(struct user_lock_res *lockres)
  * lock types are added. */
 static inline int user_highest_compat_lock_level(int level)
 {
-        int new_level = LKM_EXMODE;
+        int new_level = DLM_LOCK_EX;
 
-        if (level == LKM_EXMODE)
-                new_level = LKM_NLMODE;
-        else if (level == LKM_PRMODE)
-                new_level = LKM_PRMODE;
+        if (level == DLM_LOCK_EX)
+                new_level = DLM_LOCK_NL;
+        else if (level == DLM_LOCK_PR)
+                new_level = DLM_LOCK_PR;
         return new_level;
 }
 
-static void user_ast(void *opaque)
+static void user_ast(struct ocfs2_dlm_lksb *lksb)
 {
-        struct user_lock_res *lockres = opaque;
-        struct dlm_lockstatus *lksb;
+        struct user_lock_res *lockres = user_lksb_to_lock_res(lksb);
+        int status;
 
-        mlog(0, "AST fired for lockres %.*s\n", lockres->l_namelen,
-             lockres->l_name);
+        mlog(ML_BASTS, "AST fired for lockres %.*s, level %d => %d\n",
+             lockres->l_namelen, lockres->l_name, lockres->l_level,
+             lockres->l_requested);
 
         spin_lock(&lockres->l_lock);
 
-        lksb = &(lockres->l_lksb);
-        if (lksb->status != DLM_NORMAL) {
+        status = ocfs2_dlm_lock_status(&lockres->l_lksb);
+        if (status) {
                 mlog(ML_ERROR, "lksb status value of %u on lockres %.*s\n",
-                     lksb->status, lockres->l_namelen, lockres->l_name);
+                     status, lockres->l_namelen, lockres->l_name);
                 spin_unlock(&lockres->l_lock);
                 return;
         }
 
-        mlog_bug_on_msg(lockres->l_requested == LKM_IVMODE,
+        mlog_bug_on_msg(lockres->l_requested == DLM_LOCK_IV,
                         "Lockres %.*s, requested ivmode. flags 0x%x\n",
                         lockres->l_namelen, lockres->l_name, lockres->l_flags);
 
@@ -148,13 +150,13 @@ static void user_ast(void *opaque)
         if (lockres->l_requested < lockres->l_level) {
                 if (lockres->l_requested <=
                     user_highest_compat_lock_level(lockres->l_blocking)) {
-                        lockres->l_blocking = LKM_NLMODE;
+                        lockres->l_blocking = DLM_LOCK_NL;
                         lockres->l_flags &= ~USER_LOCK_BLOCKED;
                 }
         }
 
         lockres->l_level = lockres->l_requested;
-        lockres->l_requested = LKM_IVMODE;
+        lockres->l_requested = DLM_LOCK_IV;
         lockres->l_flags |= USER_LOCK_ATTACHED;
         lockres->l_flags &= ~USER_LOCK_BUSY;
 
@@ -193,11 +195,11 @@ static void __user_dlm_cond_queue_lockres(struct user_lock_res *lockres)
                 return;
 
         switch (lockres->l_blocking) {
-        case LKM_EXMODE:
+        case DLM_LOCK_EX:
                 if (!lockres->l_ex_holders && !lockres->l_ro_holders)
                         queue = 1;
                 break;
-        case LKM_PRMODE:
+        case DLM_LOCK_PR:
                 if (!lockres->l_ex_holders)
                         queue = 1;
                 break;
@@ -209,12 +211,12 @@ static void __user_dlm_cond_queue_lockres(struct user_lock_res *lockres)
                 __user_dlm_queue_lockres(lockres);
 }
 
-static void user_bast(void *opaque, int level)
+static void user_bast(struct ocfs2_dlm_lksb *lksb, int level)
 {
-        struct user_lock_res *lockres = opaque;
+        struct user_lock_res *lockres = user_lksb_to_lock_res(lksb);
 
-        mlog(0, "Blocking AST fired for lockres %.*s. Blocking level %d\n",
-             lockres->l_namelen, lockres->l_name, level);
+        mlog(ML_BASTS, "BAST fired for lockres %.*s, blocking %d, level %d\n",
+             lockres->l_namelen, lockres->l_name, level, lockres->l_level);
 
         spin_lock(&lockres->l_lock);
         lockres->l_flags |= USER_LOCK_BLOCKED;
@@ -227,15 +229,15 @@ static void user_bast(void *opaque, int level)
         wake_up(&lockres->l_event);
 }
 
-static void user_unlock_ast(void *opaque, enum dlm_status status)
+static void user_unlock_ast(struct ocfs2_dlm_lksb *lksb, int status)
 {
-        struct user_lock_res *lockres = opaque;
+        struct user_lock_res *lockres = user_lksb_to_lock_res(lksb);
 
-        mlog(0, "UNLOCK AST called on lock %.*s\n", lockres->l_namelen,
-             lockres->l_name);
+        mlog(ML_BASTS, "UNLOCK AST fired for lockres %.*s, flags 0x%x\n",
+             lockres->l_namelen, lockres->l_name, lockres->l_flags);
 
-        if (status != DLM_NORMAL && status != DLM_CANCELGRANT)
-                mlog(ML_ERROR, "Dlm returns status %d\n", status);
+        if (status)
+                mlog(ML_ERROR, "dlm returns status %d\n", status);
 
         spin_lock(&lockres->l_lock);
         /* The teardown flag gets set early during the unlock process,
@@ -243,7 +245,7 @@ static void user_unlock_ast(void *opaque, enum dlm_status status)
          * for a concurrent cancel. */
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN
             && !(lockres->l_flags & USER_LOCK_IN_CANCEL)) {
-                lockres->l_level = LKM_IVMODE;
+                lockres->l_level = DLM_LOCK_IV;
         } else if (status == DLM_CANCELGRANT) {
                 /* We tried to cancel a convert request, but it was
                  * already granted. Don't clear the busy flag - the
@@ -254,7 +256,7 @@ static void user_unlock_ast(void *opaque, enum dlm_status status)
         } else {
                 BUG_ON(!(lockres->l_flags & USER_LOCK_IN_CANCEL));
                 /* Cancel succeeded, we want to re-queue */
-                lockres->l_requested = LKM_IVMODE; /* cancel an
+                lockres->l_requested = DLM_LOCK_IV; /* cancel an
                                                     * upconvert
                                                     * request. */
                 lockres->l_flags &= ~USER_LOCK_IN_CANCEL;
@@ -271,6 +273,21 @@ out_noclear:
         wake_up(&lockres->l_event);
 }
 
+/*
+ * This is the userdlmfs locking protocol version.
+ *
+ * See fs/ocfs2/dlmglue.c for more details on locking versions.
+ */
+static struct ocfs2_locking_protocol user_dlm_lproto = {
+        .lp_max_version = {
+                .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
+                .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
+        },
+        .lp_lock_ast            = user_ast,
+        .lp_blocking_ast        = user_bast,
+        .lp_unlock_ast          = user_unlock_ast,
+};
+
 static inline void user_dlm_drop_inode_ref(struct user_lock_res *lockres)
 {
         struct inode *inode;
@@ -283,10 +300,10 @@ static void user_dlm_unblock_lock(struct work_struct *work)
         int new_level, status;
         struct user_lock_res *lockres =
                 container_of(work, struct user_lock_res, l_work);
-        struct dlm_ctxt *dlm = dlm_ctxt_from_user_lockres(lockres);
+        struct ocfs2_cluster_connection *conn =
+                cluster_connection_from_user_lockres(lockres);
 
-        mlog(0, "processing lockres %.*s\n", lockres->l_namelen,
-             lockres->l_name);
+        mlog(0, "lockres %.*s\n", lockres->l_namelen, lockres->l_name);
 
         spin_lock(&lockres->l_lock);
 
@@ -304,17 +321,23 @@ static void user_dlm_unblock_lock(struct work_struct *work)
          * flag, and finally we might get another bast which re-queues
          * us before our ast for the downconvert is called. */
         if (!(lockres->l_flags & USER_LOCK_BLOCKED)) {
+                mlog(ML_BASTS, "lockres %.*s USER_LOCK_BLOCKED\n",
+                     lockres->l_namelen, lockres->l_name);
                 spin_unlock(&lockres->l_lock);
                 goto drop_ref;
         }
 
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
+                mlog(ML_BASTS, "lockres %.*s USER_LOCK_IN_TEARDOWN\n",
+                     lockres->l_namelen, lockres->l_name);
                 spin_unlock(&lockres->l_lock);
                 goto drop_ref;
         }
 
         if (lockres->l_flags & USER_LOCK_BUSY) {
                 if (lockres->l_flags & USER_LOCK_IN_CANCEL) {
+                        mlog(ML_BASTS, "lockres %.*s USER_LOCK_IN_CANCEL\n",
+                             lockres->l_namelen, lockres->l_name);
                         spin_unlock(&lockres->l_lock);
                         goto drop_ref;
                 }
@@ -322,32 +345,31 @@ static void user_dlm_unblock_lock(struct work_struct *work)
                 lockres->l_flags |= USER_LOCK_IN_CANCEL;
                 spin_unlock(&lockres->l_lock);
 
-                status = dlmunlock(dlm,
-                                   &lockres->l_lksb,
-                                   LKM_CANCEL,
-                                   user_unlock_ast,
-                                   lockres);
-                if (status != DLM_NORMAL)
-                        user_log_dlm_error("dlmunlock", status, lockres);
+                status = ocfs2_dlm_unlock(conn, &lockres->l_lksb,
+                                          DLM_LKF_CANCEL);
+                if (status)
+                        user_log_dlm_error("ocfs2_dlm_unlock", status, lockres);
                 goto drop_ref;
         }
 
         /* If there are still incompat holders, we can exit safely
          * without worrying about re-queueing this lock as that will
          * happen on the last call to user_cluster_unlock. */
-        if ((lockres->l_blocking == LKM_EXMODE)
+        if ((lockres->l_blocking == DLM_LOCK_EX)
             && (lockres->l_ex_holders || lockres->l_ro_holders)) {
                 spin_unlock(&lockres->l_lock);
-                mlog(0, "can't downconvert for ex: ro = %u, ex = %u\n",
-                        lockres->l_ro_holders, lockres->l_ex_holders);
+                mlog(ML_BASTS, "lockres %.*s, EX/PR Holders %u,%u\n",
+                     lockres->l_namelen, lockres->l_name,
+                     lockres->l_ex_holders, lockres->l_ro_holders);
                 goto drop_ref;
         }
 
-        if ((lockres->l_blocking == LKM_PRMODE)
+        if ((lockres->l_blocking == DLM_LOCK_PR)
             && lockres->l_ex_holders) {
                 spin_unlock(&lockres->l_lock);
-                mlog(0, "can't downconvert for pr: ex = %u\n",
-                        lockres->l_ex_holders);
+                mlog(ML_BASTS, "lockres %.*s, EX Holders %u\n",
+                     lockres->l_namelen, lockres->l_name,
+                     lockres->l_ex_holders);
                 goto drop_ref;
         }
 
@@ -355,22 +377,17 @@ static void user_dlm_unblock_lock(struct work_struct *work)
         new_level = user_highest_compat_lock_level(lockres->l_blocking);
         lockres->l_requested = new_level;
         lockres->l_flags |= USER_LOCK_BUSY;
-        mlog(0, "Downconvert lock from %d to %d\n",
-                lockres->l_level, new_level);
+        mlog(ML_BASTS, "lockres %.*s, downconvert %d => %d\n",
+             lockres->l_namelen, lockres->l_name, lockres->l_level, new_level);
         spin_unlock(&lockres->l_lock);
 
         /* need lock downconvert request now... */
-        status = dlmlock(dlm,
-                         new_level,
-                         &lockres->l_lksb,
-                         LKM_CONVERT|LKM_VALBLK,
-                         lockres->l_name,
-                         lockres->l_namelen,
-                         user_ast,
-                         lockres,
-                         user_bast);
-        if (status != DLM_NORMAL) {
-                user_log_dlm_error("dlmlock", status, lockres);
+        status = ocfs2_dlm_lock(conn, new_level, &lockres->l_lksb,
+                                DLM_LKF_CONVERT|DLM_LKF_VALBLK,
+                                lockres->l_name,
+                                lockres->l_namelen);
+        if (status) {
+                user_log_dlm_error("ocfs2_dlm_lock", status, lockres);
                 user_recover_from_dlm_error(lockres);
         }
 
@@ -382,10 +399,10 @@ static inline void user_dlm_inc_holders(struct user_lock_res *lockres,
                                         int level)
 {
         switch(level) {
-        case LKM_EXMODE:
+        case DLM_LOCK_EX:
                 lockres->l_ex_holders++;
                 break;
-        case LKM_PRMODE:
+        case DLM_LOCK_PR:
                 lockres->l_ro_holders++;
                 break;
         default:
@@ -410,20 +427,19 @@ int user_dlm_cluster_lock(struct user_lock_res *lockres,
                           int lkm_flags)
 {
         int status, local_flags;
-        struct dlm_ctxt *dlm = dlm_ctxt_from_user_lockres(lockres);
+        struct ocfs2_cluster_connection *conn =
+                cluster_connection_from_user_lockres(lockres);
 
-        if (level != LKM_EXMODE &&
-            level != LKM_PRMODE) {
+        if (level != DLM_LOCK_EX &&
+            level != DLM_LOCK_PR) {
                 mlog(ML_ERROR, "lockres %.*s: invalid request!\n",
                      lockres->l_namelen, lockres->l_name);
                 status = -EINVAL;
                 goto bail;
         }
 
-        mlog(0, "lockres %.*s: asking for %s lock, passed flags = 0x%x\n",
-             lockres->l_namelen, lockres->l_name,
-             (level == LKM_EXMODE) ? "LKM_EXMODE" : "LKM_PRMODE",
-             lkm_flags);
+        mlog(ML_BASTS, "lockres %.*s, level %d, flags = 0x%x\n",
+             lockres->l_namelen, lockres->l_name, level, lkm_flags);
 
 again:
         if (signal_pending(current)) {
@@ -457,35 +473,26 @@ again:
         }
 
         if (level > lockres->l_level) {
-                local_flags = lkm_flags | LKM_VALBLK;
-                if (lockres->l_level != LKM_IVMODE)
-                        local_flags |= LKM_CONVERT;
+                local_flags = lkm_flags | DLM_LKF_VALBLK;
+                if (lockres->l_level != DLM_LOCK_IV)
+                        local_flags |= DLM_LKF_CONVERT;
 
                 lockres->l_requested = level;
                 lockres->l_flags |= USER_LOCK_BUSY;
                 spin_unlock(&lockres->l_lock);
 
-                BUG_ON(level == LKM_IVMODE);
-                BUG_ON(level == LKM_NLMODE);
+                BUG_ON(level == DLM_LOCK_IV);
+                BUG_ON(level == DLM_LOCK_NL);
 
                 /* call dlm_lock to upgrade lock now */
-                status = dlmlock(dlm,
-                                 level,
-                                 &lockres->l_lksb,
-                                 local_flags,
-                                 lockres->l_name,
-                                 lockres->l_namelen,
-                                 user_ast,
-                                 lockres,
-                                 user_bast);
-                if (status != DLM_NORMAL) {
-                        if ((lkm_flags & LKM_NOQUEUE) &&
-                            (status == DLM_NOTQUEUED))
-                                status = -EAGAIN;
-                        else {
-                                user_log_dlm_error("dlmlock", status, lockres);
-                                status = -EINVAL;
-                        }
+                status = ocfs2_dlm_lock(conn, level, &lockres->l_lksb,
+                                        local_flags, lockres->l_name,
+                                        lockres->l_namelen);
+                if (status) {
+                        if ((lkm_flags & DLM_LKF_NOQUEUE) &&
+                            (status != -EAGAIN))
+                                user_log_dlm_error("ocfs2_dlm_lock",
+                                                   status, lockres);
                         user_recover_from_dlm_error(lockres);
                         goto bail;
                 }
@@ -506,11 +513,11 @@ static inline void user_dlm_dec_holders(struct user_lock_res *lockres,
                                         int level)
 {
         switch(level) {
-        case LKM_EXMODE:
+        case DLM_LOCK_EX:
                 BUG_ON(!lockres->l_ex_holders);
                 lockres->l_ex_holders--;
                 break;
-        case LKM_PRMODE:
+        case DLM_LOCK_PR:
                 BUG_ON(!lockres->l_ro_holders);
                 lockres->l_ro_holders--;
                 break;
@@ -522,8 +529,8 @@ static inline void user_dlm_dec_holders(struct user_lock_res *lockres,
 void user_dlm_cluster_unlock(struct user_lock_res *lockres,
                              int level)
 {
-        if (level != LKM_EXMODE &&
-            level != LKM_PRMODE) {
+        if (level != DLM_LOCK_EX &&
+            level != DLM_LOCK_PR) {
                 mlog(ML_ERROR, "lockres %.*s: invalid request!\n",
                      lockres->l_namelen, lockres->l_name);
                 return;
@@ -540,33 +547,40 @@ void user_dlm_write_lvb(struct inode *inode,
                         unsigned int len)
 {
         struct user_lock_res *lockres = &DLMFS_I(inode)->ip_lockres;
-        char *lvb = lockres->l_lksb.lvb;
+        char *lvb;
 
         BUG_ON(len > DLM_LVB_LEN);
 
         spin_lock(&lockres->l_lock);
 
-        BUG_ON(lockres->l_level < LKM_EXMODE);
+        BUG_ON(lockres->l_level < DLM_LOCK_EX);
+        lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
         memcpy(lvb, val, len);
 
         spin_unlock(&lockres->l_lock);
 }
 
-void user_dlm_read_lvb(struct inode *inode,
-                       char *val,
-                       unsigned int len)
+ssize_t user_dlm_read_lvb(struct inode *inode,
+                          char *val,
+                          unsigned int len)
 {
         struct user_lock_res *lockres = &DLMFS_I(inode)->ip_lockres;
-        char *lvb = lockres->l_lksb.lvb;
+        char *lvb;
+        ssize_t ret = len;
 
         BUG_ON(len > DLM_LVB_LEN);
 
         spin_lock(&lockres->l_lock);
 
-        BUG_ON(lockres->l_level < LKM_PRMODE);
-        memcpy(val, lvb, len);
+        BUG_ON(lockres->l_level < DLM_LOCK_PR);
+        if (ocfs2_dlm_lvb_valid(&lockres->l_lksb)) {
+                lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
+                memcpy(val, lvb, len);
+        } else
+                ret = 0;
 
         spin_unlock(&lockres->l_lock);
+        return ret;
 }
 
 void user_dlm_lock_res_init(struct user_lock_res *lockres,
@@ -576,9 +590,9 @@ void user_dlm_lock_res_init(struct user_lock_res *lockres,
 
         spin_lock_init(&lockres->l_lock);
         init_waitqueue_head(&lockres->l_event);
-        lockres->l_level = LKM_IVMODE;
-        lockres->l_requested = LKM_IVMODE;
-        lockres->l_blocking = LKM_IVMODE;
+        lockres->l_level = DLM_LOCK_IV;
+        lockres->l_requested = DLM_LOCK_IV;
+        lockres->l_blocking = DLM_LOCK_IV;
 
         /* should have been checked before getting here. */
         BUG_ON(dentry->d_name.len >= USER_DLM_LOCK_ID_MAX_LEN);
@@ -592,9 +606,10 @@ void user_dlm_lock_res_init(struct user_lock_res *lockres,
 int user_dlm_destroy_lock(struct user_lock_res *lockres)
 {
         int status = -EBUSY;
-        struct dlm_ctxt *dlm = dlm_ctxt_from_user_lockres(lockres);
+        struct ocfs2_cluster_connection *conn =
+                cluster_connection_from_user_lockres(lockres);
 
-        mlog(0, "asked to destroy %.*s\n", lockres->l_namelen, lockres->l_name);
+        mlog(ML_BASTS, "lockres %.*s\n", lockres->l_namelen, lockres->l_name);
 
         spin_lock(&lockres->l_lock);
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
@@ -627,14 +642,9 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
         lockres->l_flags |= USER_LOCK_BUSY;
         spin_unlock(&lockres->l_lock);
 
-        status = dlmunlock(dlm,
-                           &lockres->l_lksb,
-                           LKM_VALBLK,
-                           user_unlock_ast,
-                           lockres);
-        if (status != DLM_NORMAL) {
-                user_log_dlm_error("dlmunlock", status, lockres);
-                status = -EINVAL;
+        status = ocfs2_dlm_unlock(conn, &lockres->l_lksb, DLM_LKF_VALBLK);
+        if (status) {
+                user_log_dlm_error("ocfs2_dlm_unlock", status, lockres);
                 goto bail;
         }
 
@@ -645,32 +655,34 @@ bail:
         return status;
 }
 
-struct dlm_ctxt *user_dlm_register_context(struct qstr *name,
-                                           struct dlm_protocol_version *proto)
+static void user_dlm_recovery_handler_noop(int node_num,
+                                           void *recovery_data)
 {
-        struct dlm_ctxt *dlm;
-        u32 dlm_key;
-        char *domain;
-
-        domain = kmalloc(name->len + 1, GFP_NOFS);
-        if (!domain) {
-                mlog_errno(-ENOMEM);
-                return ERR_PTR(-ENOMEM);
-        }
+        /* We ignore recovery events */
+        return;
+}
 
-        dlm_key = crc32_le(0, name->name, name->len);
+void user_dlm_set_locking_protocol(void)
+{
+        ocfs2_stack_glue_set_max_proto_version(&user_dlm_lproto.lp_max_version);
+}
 
-        snprintf(domain, name->len + 1, "%.*s", name->len, name->name);
+struct ocfs2_cluster_connection *user_dlm_register(struct qstr *name)
+{
+        int rc;
+        struct ocfs2_cluster_connection *conn;
 
-        dlm = dlm_register_domain(domain, dlm_key, proto);
-        if (IS_ERR(dlm))
-                mlog_errno(PTR_ERR(dlm));
+        rc = ocfs2_cluster_connect_agnostic(name->name, name->len,
+                                            &user_dlm_lproto,
+                                            user_dlm_recovery_handler_noop,
+                                            NULL, &conn);
+        if (rc)
+                mlog_errno(rc);
 
-        kfree(domain);
-        return dlm;
+        return rc ? ERR_PTR(rc) : conn;
 }
 
-void user_dlm_unregister_context(struct dlm_ctxt *dlm)
+void user_dlm_unregister(struct ocfs2_cluster_connection *conn)
 {
-        dlm_unregister_domain(dlm);
+        ocfs2_cluster_disconnect(conn, 0);
 }
diff --git a/fs/ocfs2/dlm/userdlm.h b/fs/ocfs2/dlmfs/userdlm.h
index 0c3cc03c61fa..3b42d79531d7 100644
--- a/fs/ocfs2/dlm/userdlm.h
+++ b/fs/ocfs2/dlmfs/userdlm.h
@@ -57,7 +57,7 @@ struct user_lock_res {
         int                      l_level;
         unsigned int             l_ro_holders;
         unsigned int             l_ex_holders;
-        struct dlm_lockstatus    l_lksb;
+        struct ocfs2_dlm_lksb    l_lksb;
 
         int                      l_requested;
         int                      l_blocking;
@@ -80,15 +80,15 @@ void user_dlm_cluster_unlock(struct user_lock_res *lockres,
 void user_dlm_write_lvb(struct inode *inode,
                         const char *val,
                         unsigned int len);
-void user_dlm_read_lvb(struct inode *inode,
-                       char *val,
-                       unsigned int len);
-struct dlm_ctxt *user_dlm_register_context(struct qstr *name,
-                                           struct dlm_protocol_version *proto);
-void user_dlm_unregister_context(struct dlm_ctxt *dlm);
+ssize_t user_dlm_read_lvb(struct inode *inode,
+                          char *val,
+                          unsigned int len);
+struct ocfs2_cluster_connection *user_dlm_register(struct qstr *name);
+void user_dlm_unregister(struct ocfs2_cluster_connection *conn);
+void user_dlm_set_locking_protocol(void);
 
 struct dlmfs_inode_private {
-        struct dlm_ctxt             *ip_dlm;
+        struct ocfs2_cluster_connection *ip_conn;
 
         struct user_lock_res ip_lockres; /* unused for directories. */
         struct inode         *ip_parent;
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index e044019cb3b1..8298608d4165 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -297,6 +297,11 @@ static inline int ocfs2_is_inode_lock(struct ocfs2_lock_res *lockres)
                 lockres->l_type == OCFS2_LOCK_TYPE_OPEN;
 }
 
+static inline struct ocfs2_lock_res *ocfs2_lksb_to_lock_res(struct ocfs2_dlm_lksb *lksb)
+{
+        return container_of(lksb, struct ocfs2_lock_res, l_lksb);
+}
+
 static inline struct inode *ocfs2_lock_res_inode(struct ocfs2_lock_res *lockres)
 {
         BUG_ON(!ocfs2_is_inode_lock(lockres));
@@ -927,6 +932,10 @@ static int ocfs2_generic_handle_bast(struct ocfs2_lock_res *lockres,
                 lockres->l_blocking = level;
         }
 
+        mlog(ML_BASTS, "lockres %s, block %d, level %d, l_block %d, dwn %d\n",
+             lockres->l_name, level, lockres->l_level, lockres->l_blocking,
+             needs_downconvert);
+
         if (needs_downconvert)
                 lockres_or_flags(lockres, OCFS2_LOCK_BLOCKED);
 
@@ -1040,18 +1049,17 @@ static unsigned int lockres_set_pending(struct ocfs2_lock_res *lockres)
         return lockres->l_pending_gen;
 }
 
-
-static void ocfs2_blocking_ast(void *opaque, int level)
+static void ocfs2_blocking_ast(struct ocfs2_dlm_lksb *lksb, int level)
 {
-        struct ocfs2_lock_res *lockres = opaque;
+        struct ocfs2_lock_res *lockres = ocfs2_lksb_to_lock_res(lksb);
         struct ocfs2_super *osb = ocfs2_get_lockres_osb(lockres);
         int needs_downconvert;
         unsigned long flags;
 
         BUG_ON(level <= DLM_LOCK_NL);
 
-        mlog(0, "BAST fired for lockres %s, blocking %d, level %d type %s\n",
-             lockres->l_name, level, lockres->l_level,
+        mlog(ML_BASTS, "BAST fired for lockres %s, blocking %d, level %d, "
+             "type %s\n", lockres->l_name, level, lockres->l_level,
              ocfs2_lock_type_string(lockres->l_type));
 
         /*
@@ -1072,9 +1080,9 @@ static void ocfs2_blocking_ast(void *opaque, int level)
         ocfs2_wake_downconvert_thread(osb);
 }
 
-static void ocfs2_locking_ast(void *opaque)
+static void ocfs2_locking_ast(struct ocfs2_dlm_lksb *lksb)
 {
-        struct ocfs2_lock_res *lockres = opaque;
+        struct ocfs2_lock_res *lockres = ocfs2_lksb_to_lock_res(lksb);
         struct ocfs2_super *osb = ocfs2_get_lockres_osb(lockres);
         unsigned long flags;
         int status;
@@ -1095,6 +1103,10 @@ static void ocfs2_locking_ast(void *opaque)
                 return;
         }
 
+        mlog(ML_BASTS, "AST fired for lockres %s, action %d, unlock %d, "
+             "level %d => %d\n", lockres->l_name, lockres->l_action,
+             lockres->l_unlock_action, lockres->l_level, lockres->l_requested);
+
         switch(lockres->l_action) {
         case OCFS2_AST_ATTACH:
                 ocfs2_generic_handle_attach_action(lockres);
@@ -1107,8 +1119,8 @@ static void ocfs2_locking_ast(void *opaque)
                 ocfs2_generic_handle_downconvert_action(lockres);
                 break;
         default:
-                mlog(ML_ERROR, "lockres %s: ast fired with invalid action: %u "
-                     "lockres flags = 0x%lx, unlock action: %u\n",
+                mlog(ML_ERROR, "lockres %s: AST fired with invalid action: %u, "
+                     "flags 0x%lx, unlock: %u\n",
                      lockres->l_name, lockres->l_action, lockres->l_flags,
                      lockres->l_unlock_action);
                 BUG();
@@ -1134,6 +1146,88 @@ out:
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 }
 
+static void ocfs2_unlock_ast(struct ocfs2_dlm_lksb *lksb, int error)
+{
+        struct ocfs2_lock_res *lockres = ocfs2_lksb_to_lock_res(lksb);
+        unsigned long flags;
+
+        mlog_entry_void();
+
+        mlog(ML_BASTS, "UNLOCK AST fired for lockres %s, action = %d\n",
+             lockres->l_name, lockres->l_unlock_action);
+
+        spin_lock_irqsave(&lockres->l_lock, flags);
+        if (error) {
+                mlog(ML_ERROR, "Dlm passes error %d for lock %s, "
+                     "unlock_action %d\n", error, lockres->l_name,
+                     lockres->l_unlock_action);
+                spin_unlock_irqrestore(&lockres->l_lock, flags);
+                mlog_exit_void();
+                return;
+        }
+
+        switch(lockres->l_unlock_action) {
+        case OCFS2_UNLOCK_CANCEL_CONVERT:
+                mlog(0, "Cancel convert success for %s\n", lockres->l_name);
+                lockres->l_action = OCFS2_AST_INVALID;
+                /* Downconvert thread may have requeued this lock, we
+                 * need to wake it. */
+                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
+                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
+                break;
+        case OCFS2_UNLOCK_DROP_LOCK:
+                lockres->l_level = DLM_LOCK_IV;
+                break;
+        default:
+                BUG();
+        }
+
+        lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
+        lockres->l_unlock_action = OCFS2_UNLOCK_INVALID;
+        wake_up(&lockres->l_event);
+        spin_unlock_irqrestore(&lockres->l_lock, flags);
+
+        mlog_exit_void();
+}
+
+/*
+ * This is the filesystem locking protocol.  It provides the lock handling
+ * hooks for the underlying DLM.  It has a maximum version number.
+ * The version number allows interoperability with systems running at
+ * the same major number and an equal or smaller minor number.
+ *
+ * Whenever the filesystem does new things with locks (adds or removes a
+ * lock, orders them differently, does different things underneath a lock),
+ * the version must be changed.  The protocol is negotiated when joining
+ * the dlm domain.  A node may join the domain if its major version is
+ * identical to all other nodes and its minor version is greater than
+ * or equal to all other nodes.  When its minor version is greater than
+ * the other nodes, it will run at the minor version specified by the
+ * other nodes.
+ *
+ * If a locking change is made that will not be compatible with older
+ * versions, the major number must be increased and the minor version set
+ * to zero.  If a change merely adds a behavior that can be disabled when
+ * speaking to older versions, the minor version must be increased.  If a
+ * change adds a fully backwards compatible change (eg, LVB changes that
+ * are just ignored by older versions), the version does not need to be
+ * updated.
+ */
+static struct ocfs2_locking_protocol lproto = {
+        .lp_max_version = {
+                .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
+                .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
+        },
+        .lp_lock_ast            = ocfs2_locking_ast,
+        .lp_blocking_ast        = ocfs2_blocking_ast,
+        .lp_unlock_ast          = ocfs2_unlock_ast,
+};
+
+void ocfs2_set_locking_protocol(void)
+{
+        ocfs2_stack_glue_set_max_proto_version(&lproto.lp_max_version);
+}
+
 static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
                                                 int convert)
 {
@@ -1189,8 +1283,7 @@ static int ocfs2_lock_create(struct ocfs2_super *osb,
                              &lockres->l_lksb,
                              dlm_flags,
                              lockres->l_name,
-                             OCFS2_LOCK_ID_MAX_LEN - 1,
-                             lockres);
+                             OCFS2_LOCK_ID_MAX_LEN - 1);
         lockres_clear_pending(lockres, gen, osb);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_lock", ret, lockres);
@@ -1412,7 +1505,7 @@ again:
                 BUG_ON(level == DLM_LOCK_IV);
                 BUG_ON(level == DLM_LOCK_NL);
 
-                mlog(0, "lock %s, convert from %d to level = %d\n",
+                mlog(ML_BASTS, "lockres %s, convert from %d to %d\n",
                      lockres->l_name, lockres->l_level, level);
 
                 /* call dlm_lock to upgrade lock now */
@@ -1421,8 +1514,7 @@ again:
                                      &lockres->l_lksb,
                                      lkm_flags,
                                      lockres->l_name,
-                                     OCFS2_LOCK_ID_MAX_LEN - 1,
-                                     lockres);
+                                     OCFS2_LOCK_ID_MAX_LEN - 1);
                 lockres_clear_pending(lockres, gen, osb);
                 if (ret) {
                         if (!(lkm_flags & DLM_LKF_NOQUEUE) ||
@@ -1859,8 +1951,7 @@ int ocfs2_file_lock(struct file *file, int ex, int trylock)
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 
         ret = ocfs2_dlm_lock(osb->cconn, level, &lockres->l_lksb, lkm_flags,
-                             lockres->l_name, OCFS2_LOCK_ID_MAX_LEN - 1,
-                             lockres);
+                             lockres->l_name, OCFS2_LOCK_ID_MAX_LEN - 1);
         if (ret) {
                 if (!trylock || (ret != -EAGAIN)) {
                         ocfs2_log_dlm_error("ocfs2_dlm_lock", ret, lockres);
@@ -2989,7 +3080,7 @@ int ocfs2_dlm_init(struct ocfs2_super *osb)
         status = ocfs2_cluster_connect(osb->osb_cluster_stack,
                                        osb->uuid_str,
                                        strlen(osb->uuid_str),
-                                       ocfs2_do_node_down, osb,
+                                       &lproto, ocfs2_do_node_down, osb,
                                        &conn);
         if (status) {
                 mlog_errno(status);
@@ -3056,50 +3147,6 @@ void ocfs2_dlm_shutdown(struct ocfs2_super *osb,
         mlog_exit_void();
 }
 
-static void ocfs2_unlock_ast(void *opaque, int error)
-{
-        struct ocfs2_lock_res *lockres = opaque;
-        unsigned long flags;
-
-        mlog_entry_void();
-
-        mlog(0, "UNLOCK AST called on lock %s, action = %d\n", lockres->l_name,
-             lockres->l_unlock_action);
-
-        spin_lock_irqsave(&lockres->l_lock, flags);
-        if (error) {
-                mlog(ML_ERROR, "Dlm passes error %d for lock %s, "
-                     "unlock_action %d\n", error, lockres->l_name,
-                     lockres->l_unlock_action);
-                spin_unlock_irqrestore(&lockres->l_lock, flags);
-                mlog_exit_void();
-                return;
-        }
-
-        switch(lockres->l_unlock_action) {
-        case OCFS2_UNLOCK_CANCEL_CONVERT:
-                mlog(0, "Cancel convert success for %s\n", lockres->l_name);
-                lockres->l_action = OCFS2_AST_INVALID;
-                /* Downconvert thread may have requeued this lock, we
-                 * need to wake it. */
-                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
-                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
-                break;
-        case OCFS2_UNLOCK_DROP_LOCK:
-                lockres->l_level = DLM_LOCK_IV;
-                break;
-        default:
-                BUG();
-        }
-
-        lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
-        lockres->l_unlock_action = OCFS2_UNLOCK_INVALID;
-        wake_up(&lockres->l_event);
-        spin_unlock_irqrestore(&lockres->l_lock, flags);
-
-        mlog_exit_void();
-}
-
 static int ocfs2_drop_lock(struct ocfs2_super *osb,
                            struct ocfs2_lock_res *lockres)
 {
@@ -3167,8 +3214,7 @@ static int ocfs2_drop_lock(struct ocfs2_super *osb,
 
         mlog(0, "lock %s\n", lockres->l_name);
 
-        ret = ocfs2_dlm_unlock(osb->cconn, &lockres->l_lksb, lkm_flags,
-                               lockres);
+        ret = ocfs2_dlm_unlock(osb->cconn, &lockres->l_lksb, lkm_flags);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_unlock", ret, lockres);
                 mlog(ML_ERROR, "lockres flags: %lu\n", lockres->l_flags);
@@ -3276,13 +3322,20 @@ static unsigned int ocfs2_prepare_downconvert(struct ocfs2_lock_res *lockres,
         BUG_ON(lockres->l_blocking <= DLM_LOCK_NL);
 
         if (lockres->l_level <= new_level) {
-                mlog(ML_ERROR, "lockres->l_level (%d) <= new_level (%d)\n",
-                     lockres->l_level, new_level);
+                mlog(ML_ERROR, "lockres %s, lvl %d <= %d, blcklst %d, mask %d, "
+                     "type %d, flags 0x%lx, hold %d %d, act %d %d, req %d, "
+                     "block %d, pgen %d\n", lockres->l_name, lockres->l_level,
+                     new_level, list_empty(&lockres->l_blocked_list),
+                     list_empty(&lockres->l_mask_waiters), lockres->l_type,
+                     lockres->l_flags, lockres->l_ro_holders,
+                     lockres->l_ex_holders, lockres->l_action,
+                     lockres->l_unlock_action, lockres->l_requested,
+                     lockres->l_blocking, lockres->l_pending_gen);
                 BUG();
         }
 
-        mlog(0, "lock %s, new_level = %d, l_blocking = %d\n",
-             lockres->l_name, new_level, lockres->l_blocking);
+        mlog(ML_BASTS, "lockres %s, level %d => %d, blocking %d\n",
+             lockres->l_name, lockres->l_level, new_level, lockres->l_blocking);
 
         lockres->l_action = OCFS2_AST_DOWNCONVERT;
         lockres->l_requested = new_level;
@@ -3301,6 +3354,9 @@ static int ocfs2_downconvert_lock(struct ocfs2_super *osb,
 
         mlog_entry_void();
 
+        mlog(ML_BASTS, "lockres %s, level %d => %d\n", lockres->l_name,
+             lockres->l_level, new_level);
+
         if (lvb)
                 dlm_flags |= DLM_LKF_VALBLK;
 
@@ -3309,8 +3365,7 @@ static int ocfs2_downconvert_lock(struct ocfs2_super *osb,
                              &lockres->l_lksb,
                              dlm_flags,
                              lockres->l_name,
-                             OCFS2_LOCK_ID_MAX_LEN - 1,
-                             lockres);
+                             OCFS2_LOCK_ID_MAX_LEN - 1);
         lockres_clear_pending(lockres, generation, osb);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_lock", ret, lockres);
@@ -3331,14 +3386,12 @@ static int ocfs2_prepare_cancel_convert(struct ocfs2_super *osb,
         assert_spin_locked(&lockres->l_lock);
 
         mlog_entry_void();
-        mlog(0, "lock %s\n", lockres->l_name);
 
         if (lockres->l_unlock_action == OCFS2_UNLOCK_CANCEL_CONVERT) {
                 /* If we're already trying to cancel a lock conversion
                  * then just drop the spinlock and allow the caller to
                  * requeue this lock. */
-
-                mlog(0, "Lockres %s, skip convert\n", lockres->l_name);
+                mlog(ML_BASTS, "lockres %s, skip convert\n", lockres->l_name);
                 return 0;
         }
 
@@ -3353,6 +3406,8 @@ static int ocfs2_prepare_cancel_convert(struct ocfs2_super *osb,
                         "lock %s, invalid flags: 0x%lx\n",
                         lockres->l_name, lockres->l_flags);
 
+        mlog(ML_BASTS, "lockres %s\n", lockres->l_name);
+
         return 1;
 }
 
@@ -3362,16 +3417,15 @@ static int ocfs2_cancel_convert(struct ocfs2_super *osb,
         int ret;
 
         mlog_entry_void();
-        mlog(0, "lock %s\n", lockres->l_name);
 
         ret = ocfs2_dlm_unlock(osb->cconn, &lockres->l_lksb,
-                               DLM_LKF_CANCEL, lockres);
+                               DLM_LKF_CANCEL);
         if (ret) {
                 ocfs2_log_dlm_error("ocfs2_dlm_unlock", ret, lockres);
                 ocfs2_recover_from_dlm_error(lockres, 0);
         }
 
-        mlog(0, "lock %s return from ocfs2_dlm_unlock\n", lockres->l_name);
+        mlog(ML_BASTS, "lockres %s\n", lockres->l_name);
 
         mlog_exit(ret);
         return ret;
@@ -3428,8 +3482,11 @@ recheck:
                  * at the same time they set OCFS2_DLM_BUSY.  They must
                  * clear OCFS2_DLM_PENDING after dlm_lock() returns.
                  */
-                if (lockres->l_flags & OCFS2_LOCK_PENDING)
+                if (lockres->l_flags & OCFS2_LOCK_PENDING) {
+                        mlog(ML_BASTS, "lockres %s, ReQ: Pending\n",
+                             lockres->l_name);
                         goto leave_requeue;
+                }
 
                 ctl->requeue = 1;
                 ret = ocfs2_prepare_cancel_convert(osb, lockres);
@@ -3461,6 +3518,7 @@ recheck:
          */
         if (lockres->l_level == DLM_LOCK_NL) {
                 BUG_ON(lockres->l_ex_holders || lockres->l_ro_holders);
+                mlog(ML_BASTS, "lockres %s, Aborting dc\n", lockres->l_name);
                 lockres->l_blocking = DLM_LOCK_NL;
                 lockres_clear_flags(lockres, OCFS2_LOCK_BLOCKED);
                 spin_unlock_irqrestore(&lockres->l_lock, flags);
@@ -3470,28 +3528,41 @@ recheck:
         /* if we're blocking an exclusive and we have *any* holders,
          * then requeue. */
         if ((lockres->l_blocking == DLM_LOCK_EX)
-            && (lockres->l_ex_holders || lockres->l_ro_holders))
+            && (lockres->l_ex_holders || lockres->l_ro_holders)) {
+                mlog(ML_BASTS, "lockres %s, ReQ: EX/PR Holders %u,%u\n",
+                     lockres->l_name, lockres->l_ex_holders,
+                     lockres->l_ro_holders);
                 goto leave_requeue;
+        }
 
         /* If it's a PR we're blocking, then only
          * requeue if we've got any EX holders */
         if (lockres->l_blocking == DLM_LOCK_PR &&
-            lockres->l_ex_holders)
+            lockres->l_ex_holders) {
+                mlog(ML_BASTS, "lockres %s, ReQ: EX Holders %u\n",
+                     lockres->l_name, lockres->l_ex_holders);
                 goto leave_requeue;
+        }
 
         /*
          * Can we get a lock in this state if the holder counts are
          * zero? The meta data unblock code used to check this.
          */
         if ((lockres->l_ops->flags & LOCK_TYPE_REQUIRES_REFRESH)
-            && (lockres->l_flags & OCFS2_LOCK_REFRESHING))
+            && (lockres->l_flags & OCFS2_LOCK_REFRESHING)) {
+                mlog(ML_BASTS, "lockres %s, ReQ: Lock Refreshing\n",
+                     lockres->l_name);
                 goto leave_requeue;
+        }
 
         new_level = ocfs2_highest_compat_lock_level(lockres->l_blocking);
 
         if (lockres->l_ops->check_downconvert
-            && !lockres->l_ops->check_downconvert(lockres, new_level))
+            && !lockres->l_ops->check_downconvert(lockres, new_level)) {
+                mlog(ML_BASTS, "lockres %s, ReQ: Checkpointing\n",
+                     lockres->l_name);
                 goto leave_requeue;
+        }
 
         /* If we get here, then we know that there are no more
          * incompatible holders (and anyone asking for an incompatible
@@ -3509,13 +3580,19 @@ recheck:
 
         ctl->unblock_action = lockres->l_ops->downconvert_worker(lockres, blocking);
 
-        if (ctl->unblock_action == UNBLOCK_STOP_POST)
+        if (ctl->unblock_action == UNBLOCK_STOP_POST) {
+                mlog(ML_BASTS, "lockres %s, UNBLOCK_STOP_POST\n",
+                     lockres->l_name);
                 goto leave;
+        }
 
         spin_lock_irqsave(&lockres->l_lock, flags);
         if ((blocking != lockres->l_blocking) || (level != lockres->l_level)) {
                 /* If this changed underneath us, then we can't drop
                  * it just yet. */
+                mlog(ML_BASTS, "lockres %s, block=%d:%d, level=%d:%d, "
+                     "Recheck\n", lockres->l_name, blocking,
+                     lockres->l_blocking, level, lockres->l_level);
                 goto recheck;
         }
 
@@ -3910,45 +3987,6 @@ void ocfs2_refcount_unlock(struct ocfs2_refcount_tree *ref_tree, int ex)
                 ocfs2_cluster_unlock(osb, lockres, level);
 }
 
-/*
- * This is the filesystem locking protocol.  It provides the lock handling
- * hooks for the underlying DLM.  It has a maximum version number.
- * The version number allows interoperability with systems running at
- * the same major number and an equal or smaller minor number.
- *
- * Whenever the filesystem does new things with locks (adds or removes a
- * lock, orders them differently, does different things underneath a lock),
- * the version must be changed.  The protocol is negotiated when joining
- * the dlm domain.  A node may join the domain if its major version is
- * identical to all other nodes and its minor version is greater than
- * or equal to all other nodes.  When its minor version is greater than
- * the other nodes, it will run at the minor version specified by the
- * other nodes.
- *
- * If a locking change is made that will not be compatible with older
- * versions, the major number must be increased and the minor version set
- * to zero.  If a change merely adds a behavior that can be disabled when
- * speaking to older versions, the minor version must be increased.  If a
- * change adds a fully backwards compatible change (eg, LVB changes that
- * are just ignored by older versions), the version does not need to be
- * updated.
- */
-static struct ocfs2_locking_protocol lproto = {
-        .lp_max_version = {
-                .pv_major = OCFS2_LOCKING_PROTOCOL_MAJOR,
-                .pv_minor = OCFS2_LOCKING_PROTOCOL_MINOR,
-        },
-        .lp_lock_ast            = ocfs2_locking_ast,
-        .lp_blocking_ast        = ocfs2_blocking_ast,
-        .lp_unlock_ast          = ocfs2_unlock_ast,
-};
-
-void ocfs2_set_locking_protocol(void)
-{
-        ocfs2_stack_glue_set_locking_protocol(&lproto);
-}
-
-
 static void ocfs2_process_blocked_lock(struct ocfs2_super *osb,
                                        struct ocfs2_lock_res *lockres)
 {
@@ -3965,7 +4003,7 @@ static void ocfs2_process_blocked_lock(struct ocfs2_super *osb,
         BUG_ON(!lockres);
         BUG_ON(!lockres->l_ops);
 
-        mlog(0, "lockres %s blocked.\n", lockres->l_name);
+        mlog(ML_BASTS, "lockres %s blocked\n", lockres->l_name);
 
         /* Detect whether a lock has been marked as going away while
          * the downconvert thread was processing other things. A lock can
@@ -3988,7 +4026,7 @@ unqueue:
         } else
                 ocfs2_schedule_blocked_lock(osb, lockres);
 
-        mlog(0, "lockres %s, requeue = %s.\n", lockres->l_name,
+        mlog(ML_BASTS, "lockres %s, requeue = %s.\n", lockres->l_name,
              ctl.requeue ? "yes" : "no");
         spin_unlock_irqrestore(&lockres->l_lock, flags);
 
@@ -4010,7 +4048,7 @@ static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
                 /* Do not schedule a lock for downconvert when it's on
                  * the way to destruction - any nodes wanting access
                  * to the resource will get it soon. */
-                mlog(0, "Lockres %s won't be scheduled: flags 0x%lx\n",
+                mlog(ML_BASTS, "lockres %s won't be scheduled: flags 0x%lx\n",
                      lockres->l_name, lockres->l_flags);
                 return;
         }
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 558ce0312421..5b52547d6299 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -993,10 +993,9 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         if (size_change && attr->ia_size != i_size_read(inode)) {
-                if (attr->ia_size > sb->s_maxbytes) {
-                        status = -EFBIG;
+                status = inode_newsize_ok(inode, attr->ia_size);
+                if (status)
                         goto bail_unlock;
-                }
 
                 if (i_size_read(inode) > attr->ia_size) {
                         if (ocfs2_should_order_data(inode)) {
@@ -1836,6 +1835,8 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                                                                &meta_level);
                         if (has_refcount)
                                 *has_refcount = 1;
+                        if (direct_io)
+                                *direct_io = 0;
                 }
 
                 if (ret < 0) {
@@ -1859,10 +1860,6 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                         break;
                 }
 
-                if (has_refcount && *has_refcount == 1) {
-                        *direct_io = 0;
-                        break;
-                }
                 /*
                  * Allowing concurrent direct writes means
                  * i_size changes wouldn't be synchronized, so
@@ -2043,7 +2040,7 @@ out_dio:
          * async dio is going to do it in the future or an end_io after an
          * error has already done it.
          */
-        if (ret == -EIOCBQUEUED || !ocfs2_iocb_is_rw_locked(iocb)) {
+        if ((ret == -EIOCBQUEUED) || (!ocfs2_iocb_is_rw_locked(iocb))) {
                 rw_level = -1;
                 have_alloc_sem = 0;
         }
diff --git a/fs/ocfs2/ioctl.h b/fs/ocfs2/ioctl.h
index cf9a5ee30fef..0cd5323bd3f0 100644
--- a/fs/ocfs2/ioctl.h
+++ b/fs/ocfs2/ioctl.h
@@ -7,10 +7,10 @@
  *
  */
 
-#ifndef OCFS2_IOCTL_H
-#define OCFS2_IOCTL_H
+#ifndef OCFS2_IOCTL_PROTO_H
+#define OCFS2_IOCTL_PROTO_H
 
 long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
 long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg);
 
-#endif /* OCFS2_IOCTL_H */
+#endif /* OCFS2_IOCTL_PROTO_H */
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index ac10f83edb95..ca992d91f511 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -476,7 +476,7 @@ out_mutex:
 
 out:
         if (!status)
-                ocfs2_init_inode_steal_slot(osb);
+                ocfs2_init_steal_slots(osb);
         mlog_exit(status);
         return status;
 }
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 740f448041e2..1238b491db90 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -42,6 +42,7 @@
 
 #include "ocfs2_fs.h"
 #include "ocfs2_lockid.h"
+#include "ocfs2_ioctl.h"
 
 /* For struct ocfs2_blockcheck_stats */
 #include "blockcheck.h"
@@ -159,7 +160,7 @@ struct ocfs2_lock_res {
         int                      l_level;
         unsigned int             l_ro_holders;
         unsigned int             l_ex_holders;
-        union ocfs2_dlm_lksb     l_lksb;
+        struct ocfs2_dlm_lksb    l_lksb;
 
         /* used from AST/BAST funcs. */
         enum ocfs2_ast_action    l_action;
@@ -305,7 +306,9 @@ struct ocfs2_super
         u32 s_next_generation;
         unsigned long osb_flags;
         s16 s_inode_steal_slot;
+        s16 s_meta_steal_slot;
         atomic_t s_num_inodes_stolen;
+        atomic_t s_num_meta_stolen;
 
         unsigned long s_mount_opt;
         unsigned int s_atime_quantum;
@@ -760,33 +763,6 @@ static inline unsigned int ocfs2_megabytes_to_clusters(struct super_block *sb,
         return megs << (20 - OCFS2_SB(sb)->s_clustersize_bits);
 }
 
-static inline void ocfs2_init_inode_steal_slot(struct ocfs2_super *osb)
-{
-        spin_lock(&osb->osb_lock);
-        osb->s_inode_steal_slot = OCFS2_INVALID_SLOT;
-        spin_unlock(&osb->osb_lock);
-        atomic_set(&osb->s_num_inodes_stolen, 0);
-}
-
-static inline void ocfs2_set_inode_steal_slot(struct ocfs2_super *osb,
-                                              s16 slot)
-{
-        spin_lock(&osb->osb_lock);
-        osb->s_inode_steal_slot = slot;
-        spin_unlock(&osb->osb_lock);
-}
-
-static inline s16 ocfs2_get_inode_steal_slot(struct ocfs2_super *osb)
-{
-        s16 slot;
-
-        spin_lock(&osb->osb_lock);
-        slot = osb->s_inode_steal_slot;
-        spin_unlock(&osb->osb_lock);
-
-        return slot;
-}
-
 #define ocfs2_set_bit ext2_set_bit
 #define ocfs2_clear_bit ext2_clear_bit
 #define ocfs2_test_bit ext2_test_bit
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 7638a38c32bc..bb37218a7978 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -254,63 +254,6 @@
                                                  * refcount tree */
 
 /*
- * ioctl commands
- */
-#define OCFS2_IOC_GETFLAGS      _IOR('f', 1, long)
-#define OCFS2_IOC_SETFLAGS      _IOW('f', 2, long)
-#define OCFS2_IOC32_GETFLAGS    _IOR('f', 1, int)
-#define OCFS2_IOC32_SETFLAGS    _IOW('f', 2, int)
-
-/*
- * Space reservation / allocation / free ioctls and argument structure
- * are designed to be compatible with XFS.
- *
- * ALLOCSP* and FREESP* are not and will never be supported, but are
- * included here for completeness.
- */
-struct ocfs2_space_resv {
-        __s16           l_type;
-        __s16           l_whence;
-        __s64           l_start;
-        __s64           l_len;          /* len == 0 means until end of file */
-        __s32           l_sysid;
-        __u32           l_pid;
-        __s32           l_pad[4];       /* reserve area                     */
-};
-
-#define OCFS2_IOC_ALLOCSP               _IOW ('X', 10, struct ocfs2_space_resv)
-#define OCFS2_IOC_FREESP                _IOW ('X', 11, struct ocfs2_space_resv)
-#define OCFS2_IOC_RESVSP                _IOW ('X', 40, struct ocfs2_space_resv)
-#define OCFS2_IOC_UNRESVSP      _IOW ('X', 41, struct ocfs2_space_resv)
-#define OCFS2_IOC_ALLOCSP64     _IOW ('X', 36, struct ocfs2_space_resv)
-#define OCFS2_IOC_FREESP64      _IOW ('X', 37, struct ocfs2_space_resv)
-#define OCFS2_IOC_RESVSP64      _IOW ('X', 42, struct ocfs2_space_resv)
-#define OCFS2_IOC_UNRESVSP64    _IOW ('X', 43, struct ocfs2_space_resv)
-
-/* Used to pass group descriptor data when online resize is done */
-struct ocfs2_new_group_input {
-        __u64 group;            /* Group descriptor's blkno. */
-        __u32 clusters;         /* Total number of clusters in this group */
-        __u32 frees;            /* Total free clusters in this group */
-        __u16 chain;            /* Chain for this group */
-        __u16 reserved1;
-        __u32 reserved2;
-};
-
-#define OCFS2_IOC_GROUP_EXTEND  _IOW('o', 1, int)
-#define OCFS2_IOC_GROUP_ADD     _IOW('o', 2,struct ocfs2_new_group_input)
-#define OCFS2_IOC_GROUP_ADD64   _IOW('o', 3,struct ocfs2_new_group_input)
-
-/* Used to pass 2 file names to reflink. */
-struct reflink_arguments {
-        __u64 old_path;
-        __u64 new_path;
-        __u64 preserve;
-};
-#define OCFS2_IOC_REFLINK       _IOW('o', 4, struct reflink_arguments)
-
-
-/*
  * Journal Flags (ocfs2_dinode.id1.journal1.i_flags)
  */
 #define OCFS2_JOURNAL_DIRTY_FL  (0x00000001)    /* Journal needs recovery */
diff --git a/fs/ocfs2/ocfs2_ioctl.h b/fs/ocfs2/ocfs2_ioctl.h
new file mode 100644
index 000000000000..2d3420af1a83
--- /dev/null
+++ b/fs/ocfs2/ocfs2_ioctl.h
@@ -0,0 +1,79 @@
+/* -*- mode: c; c-basic-offset: 8; -*-
+ * vim: noexpandtab sw=8 ts=8 sts=0:
+ *
+ * ocfs2_ioctl.h
+ *
+ * Defines OCFS2 ioctls.
+ *
+ * Copyright (C) 2010 Oracle.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License, version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef OCFS2_IOCTL_H
+#define OCFS2_IOCTL_H
+
+/*
+ * ioctl commands
+ */
+#define OCFS2_IOC_GETFLAGS      _IOR('f', 1, long)
+#define OCFS2_IOC_SETFLAGS      _IOW('f', 2, long)
+#define OCFS2_IOC32_GETFLAGS    _IOR('f', 1, int)
+#define OCFS2_IOC32_SETFLAGS    _IOW('f', 2, int)
+
+/*
+ * Space reservation / allocation / free ioctls and argument structure
+ * are designed to be compatible with XFS.
+ *
+ * ALLOCSP* and FREESP* are not and will never be supported, but are
+ * included here for completeness.
+ */
+struct ocfs2_space_resv {
+        __s16           l_type;
+        __s16           l_whence;
+        __s64           l_start;
+        __s64           l_len;          /* len == 0 means until end of file */
+        __s32           l_sysid;
+        __u32           l_pid;
+        __s32           l_pad[4];       /* reserve area                     */
+};
+
+#define OCFS2_IOC_ALLOCSP               _IOW ('X', 10, struct ocfs2_space_resv)
+#define OCFS2_IOC_FREESP                _IOW ('X', 11, struct ocfs2_space_resv)
+#define OCFS2_IOC_RESVSP                _IOW ('X', 40, struct ocfs2_space_resv)
+#define OCFS2_IOC_UNRESVSP      _IOW ('X', 41, struct ocfs2_space_resv)
+#define OCFS2_IOC_ALLOCSP64     _IOW ('X', 36, struct ocfs2_space_resv)
+#define OCFS2_IOC_FREESP64      _IOW ('X', 37, struct ocfs2_space_resv)
+#define OCFS2_IOC_RESVSP64      _IOW ('X', 42, struct ocfs2_space_resv)
+#define OCFS2_IOC_UNRESVSP64    _IOW ('X', 43, struct ocfs2_space_resv)
+
+/* Used to pass group descriptor data when online resize is done */
+struct ocfs2_new_group_input {
+        __u64 group;            /* Group descriptor's blkno. */
+        __u32 clusters;         /* Total number of clusters in this group */
+        __u32 frees;            /* Total free clusters in this group */
+        __u16 chain;            /* Chain for this group */
+        __u16 reserved1;
+        __u32 reserved2;
+};
+
+#define OCFS2_IOC_GROUP_EXTEND  _IOW('o', 1, int)
+#define OCFS2_IOC_GROUP_ADD     _IOW('o', 2,struct ocfs2_new_group_input)
+#define OCFS2_IOC_GROUP_ADD64   _IOW('o', 3,struct ocfs2_new_group_input)
+
+/* Used to pass 2 file names to reflink. */
+struct reflink_arguments {
+        __u64 old_path;
+        __u64 new_path;
+        __u64 preserve;
+};
+#define OCFS2_IOC_REFLINK       _IOW('o', 4, struct reflink_arguments)
+
+#endif /* OCFS2_IOCTL_H */
diff --git a/fs/ocfs2/ocfs2_lockingver.h b/fs/ocfs2/ocfs2_lockingver.h
index 82d5eeac0fff..2e45c8d2ea7e 100644
--- a/fs/ocfs2/ocfs2_lockingver.h
+++ b/fs/ocfs2/ocfs2_lockingver.h
@@ -23,6 +23,8 @@
 /*
  * The protocol version for ocfs2 cluster locking.  See dlmglue.c for
  * more details.
+ *
+ * 1.0 - Initial locking version from ocfs2 1.4.
  */
 #define OCFS2_LOCKING_PROTOCOL_MAJOR 1
 #define OCFS2_LOCKING_PROTOCOL_MINOR 0
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 8ae65c9c020c..fb6aa7acf54b 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -626,7 +626,7 @@ static int ocfs2_create_refcount_tree(struct inode *inode,
         rb = (struct ocfs2_refcount_block *)new_bh->b_data;
         memset(rb, 0, inode->i_sb->s_blocksize);
         strcpy((void *)rb, OCFS2_REFCOUNT_BLOCK_SIGNATURE);
-        rb->rf_suballoc_slot = cpu_to_le16(osb->slot_num);
+        rb->rf_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         rb->rf_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         rb->rf_fs_generation = cpu_to_le32(osb->fs_generation);
         rb->rf_blkno = cpu_to_le64(first_blkno);
@@ -1330,7 +1330,7 @@ static int ocfs2_expand_inline_ref_root(handle_t *handle,
         memcpy(new_bh->b_data, ref_root_bh->b_data, sb->s_blocksize);
 
         new_rb = (struct ocfs2_refcount_block *)new_bh->b_data;
-        new_rb->rf_suballoc_slot = cpu_to_le16(OCFS2_SB(sb)->slot_num);
+        new_rb->rf_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         new_rb->rf_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         new_rb->rf_blkno = cpu_to_le64(blkno);
         new_rb->rf_cpos = cpu_to_le32(0);
@@ -1576,7 +1576,7 @@ static int ocfs2_new_leaf_refcount_block(handle_t *handle,
         new_rb = (struct ocfs2_refcount_block *)new_bh->b_data;
         memset(new_rb, 0, sb->s_blocksize);
         strcpy((void *)new_rb, OCFS2_REFCOUNT_BLOCK_SIGNATURE);
-        new_rb->rf_suballoc_slot = cpu_to_le16(OCFS2_SB(sb)->slot_num);
+        new_rb->rf_suballoc_slot = cpu_to_le16(meta_ac->ac_alloc_slot);
         new_rb->rf_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         new_rb->rf_fs_generation = cpu_to_le32(OCFS2_SB(sb)->fs_generation);
         new_rb->rf_blkno = cpu_to_le64(blkno);
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index 3038c92af493..7020e1253ffa 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -161,24 +161,23 @@ static int dlm_status_to_errno(enum dlm_status status)
 
 static void o2dlm_lock_ast_wrapper(void *astarg)
 {
-        BUG_ON(o2cb_stack.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
 
-        o2cb_stack.sp_proto->lp_lock_ast(astarg);
+        lksb->lksb_conn->cc_proto->lp_lock_ast(lksb);
 }
 
 static void o2dlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(o2cb_stack.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
 
-        o2cb_stack.sp_proto->lp_blocking_ast(astarg, level);
+        lksb->lksb_conn->cc_proto->lp_blocking_ast(lksb, level);
 }
 
 static void o2dlm_unlock_ast_wrapper(void *astarg, enum dlm_status status)
 {
+        struct ocfs2_dlm_lksb *lksb = astarg;
         int error = dlm_status_to_errno(status);
 
-        BUG_ON(o2cb_stack.sp_proto == NULL);
-
         /*
          * In o2dlm, you can get both the lock_ast() for the lock being
          * granted and the unlock_ast() for the CANCEL failing.  A
@@ -193,16 +192,15 @@ static void o2dlm_unlock_ast_wrapper(void *astarg, enum dlm_status status)
         if (status == DLM_CANCELGRANT)
                 return;
 
-        o2cb_stack.sp_proto->lp_unlock_ast(astarg, error);
+        lksb->lksb_conn->cc_proto->lp_unlock_ast(lksb, error);
 }
 
 static int o2cb_dlm_lock(struct ocfs2_cluster_connection *conn,
                          int mode,
-                         union ocfs2_dlm_lksb *lksb,
+                         struct ocfs2_dlm_lksb *lksb,
                          u32 flags,
                          void *name,
-                         unsigned int namelen,
-                         void *astarg)
+                         unsigned int namelen)
 {
         enum dlm_status status;
         int o2dlm_mode = mode_to_o2dlm(mode);
@@ -211,28 +209,27 @@ static int o2cb_dlm_lock(struct ocfs2_cluster_connection *conn,
 
         status = dlmlock(conn->cc_lockspace, o2dlm_mode, &lksb->lksb_o2dlm,
                          o2dlm_flags, name, namelen,
-                         o2dlm_lock_ast_wrapper, astarg,
+                         o2dlm_lock_ast_wrapper, lksb,
                          o2dlm_blocking_ast_wrapper);
         ret = dlm_status_to_errno(status);
         return ret;
 }
 
 static int o2cb_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                           union ocfs2_dlm_lksb *lksb,
-                           u32 flags,
-                           void *astarg)
+                           struct ocfs2_dlm_lksb *lksb,
+                           u32 flags)
 {
         enum dlm_status status;
         int o2dlm_flags = flags_to_o2dlm(flags);
         int ret;
 
         status = dlmunlock(conn->cc_lockspace, &lksb->lksb_o2dlm,
-                           o2dlm_flags, o2dlm_unlock_ast_wrapper, astarg);
+                           o2dlm_flags, o2dlm_unlock_ast_wrapper, lksb);
         ret = dlm_status_to_errno(status);
         return ret;
 }
 
-static int o2cb_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
+static int o2cb_dlm_lock_status(struct ocfs2_dlm_lksb *lksb)
 {
         return dlm_status_to_errno(lksb->lksb_o2dlm.status);
 }
@@ -242,17 +239,17 @@ static int o2cb_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
  * contents, it will zero out the LVB.  Thus the caller can always trust
  * the contents.
  */
-static int o2cb_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb)
+static int o2cb_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb)
 {
         return 1;
 }
 
-static void *o2cb_dlm_lvb(union ocfs2_dlm_lksb *lksb)
+static void *o2cb_dlm_lvb(struct ocfs2_dlm_lksb *lksb)
 {
         return (void *)(lksb->lksb_o2dlm.lvb);
 }
 
-static void o2cb_dump_lksb(union ocfs2_dlm_lksb *lksb)
+static void o2cb_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 {
         dlm_print_one_lock(lksb->lksb_o2dlm.lockid);
 }
@@ -280,7 +277,7 @@ static int o2cb_cluster_connect(struct ocfs2_cluster_connection *conn)
         struct dlm_protocol_version fs_version;
 
         BUG_ON(conn == NULL);
-        BUG_ON(o2cb_stack.sp_proto == NULL);
+        BUG_ON(conn->cc_proto == NULL);
 
         /* for now we only have one cluster/node, make sure we see it
          * in the heartbeat universe */
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index da78a2a334fd..5ae8812b2864 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -25,7 +25,6 @@
 #include <linux/reboot.h>
 #include <asm/uaccess.h>
 
-#include "ocfs2.h"  /* For struct ocfs2_lock_res */
 #include "stackglue.h"
 
 #include <linux/dlm_plock.h>
@@ -63,8 +62,8 @@
  * negotiated by the client.  The client negotiates based on the maximum
  * version advertised in /sys/fs/ocfs2/max_locking_protocol.  The major
  * number from the "SETV" message must match
- * ocfs2_user_plugin.sp_proto->lp_max_version.pv_major, and the minor number
- * must be less than or equal to ...->lp_max_version.pv_minor.
+ * ocfs2_user_plugin.sp_max_proto.pv_major, and the minor number
+ * must be less than or equal to ...sp_max_version.pv_minor.
  *
  * Once this information has been set, mounts will be allowed.  From this
  * point on, the "DOWN" message can be sent for node down notification.
@@ -401,7 +400,7 @@ static int ocfs2_control_do_setversion_msg(struct file *file,
         char *ptr = NULL;
         struct ocfs2_control_private *p = file->private_data;
         struct ocfs2_protocol_version *max =
-                &ocfs2_user_plugin.sp_proto->lp_max_version;
+                &ocfs2_user_plugin.sp_max_proto;
 
         if (ocfs2_control_get_handshake_state(file) !=
             OCFS2_CONTROL_HANDSHAKE_PROTOCOL)
@@ -664,18 +663,10 @@ static void ocfs2_control_exit(void)
                        -rc);
 }
 
-static struct dlm_lksb *fsdlm_astarg_to_lksb(void *astarg)
-{
-        struct ocfs2_lock_res *res = astarg;
-        return &res->l_lksb.lksb_fsdlm;
-}
-
 static void fsdlm_lock_ast_wrapper(void *astarg)
 {
-        struct dlm_lksb *lksb = fsdlm_astarg_to_lksb(astarg);
-        int status = lksb->sb_status;
-
-        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
+        int status = lksb->lksb_fsdlm.sb_status;
 
         /*
          * For now we're punting on the issue of other non-standard errors
@@ -688,25 +679,24 @@ static void fsdlm_lock_ast_wrapper(void *astarg)
          */
 
         if (status == -DLM_EUNLOCK || status == -DLM_ECANCEL)
-                ocfs2_user_plugin.sp_proto->lp_unlock_ast(astarg, 0);
+                lksb->lksb_conn->cc_proto->lp_unlock_ast(lksb, 0);
         else
-                ocfs2_user_plugin.sp_proto->lp_lock_ast(astarg);
+                lksb->lksb_conn->cc_proto->lp_lock_ast(lksb);
 }
 
 static void fsdlm_blocking_ast_wrapper(void *astarg, int level)
 {
-        BUG_ON(ocfs2_user_plugin.sp_proto == NULL);
+        struct ocfs2_dlm_lksb *lksb = astarg;
 
-        ocfs2_user_plugin.sp_proto->lp_blocking_ast(astarg, level);
+        lksb->lksb_conn->cc_proto->lp_blocking_ast(lksb, level);
 }
 
 static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
                          int mode,
-                         union ocfs2_dlm_lksb *lksb,
+                         struct ocfs2_dlm_lksb *lksb,
                          u32 flags,
                          void *name,
-                         unsigned int namelen,
-                         void *astarg)
+                         unsigned int namelen)
 {
         int ret;
 
@@ -716,36 +706,35 @@ static int user_dlm_lock(struct ocfs2_cluster_connection *conn,
 
         ret = dlm_lock(conn->cc_lockspace, mode, &lksb->lksb_fsdlm,
                        flags|DLM_LKF_NODLCKWT, name, namelen, 0,
-                       fsdlm_lock_ast_wrapper, astarg,
+                       fsdlm_lock_ast_wrapper, lksb,
                        fsdlm_blocking_ast_wrapper);
         return ret;
 }
 
 static int user_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                           union ocfs2_dlm_lksb *lksb,
-                           u32 flags,
-                           void *astarg)
+                           struct ocfs2_dlm_lksb *lksb,
+                           u32 flags)
 {
         int ret;
 
         ret = dlm_unlock(conn->cc_lockspace, lksb->lksb_fsdlm.sb_lkid,
-                         flags, &lksb->lksb_fsdlm, astarg);
+                         flags, &lksb->lksb_fsdlm, lksb);
         return ret;
 }
 
-static int user_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
+static int user_dlm_lock_status(struct ocfs2_dlm_lksb *lksb)
 {
         return lksb->lksb_fsdlm.sb_status;
 }
 
-static int user_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb)
+static int user_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb)
 {
         int invalid = lksb->lksb_fsdlm.sb_flags & DLM_SBF_VALNOTVALID;
 
         return !invalid;
 }
 
-static void *user_dlm_lvb(union ocfs2_dlm_lksb *lksb)
+static void *user_dlm_lvb(struct ocfs2_dlm_lksb *lksb)
 {
         if (!lksb->lksb_fsdlm.sb_lvbptr)
                 lksb->lksb_fsdlm.sb_lvbptr = (char *)lksb +
@@ -753,7 +742,7 @@ static void *user_dlm_lvb(union ocfs2_dlm_lksb *lksb)
         return (void *)(lksb->lksb_fsdlm.sb_lvbptr);
 }
 
-static void user_dlm_dump_lksb(union ocfs2_dlm_lksb *lksb)
+static void user_dlm_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 {
 }
 
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index f3df0baa9a48..39abf89697ed 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -36,7 +36,7 @@
 #define OCFS2_STACK_PLUGIN_USER         "user"
 #define OCFS2_MAX_HB_CTL_PATH           256
 
-static struct ocfs2_locking_protocol *lproto;
+static struct ocfs2_protocol_version locking_max_version;
 static DEFINE_SPINLOCK(ocfs2_stack_lock);
 static LIST_HEAD(ocfs2_stack_list);
 static char cluster_stack_name[OCFS2_STACK_LABEL_LEN + 1];
@@ -176,7 +176,7 @@ int ocfs2_stack_glue_register(struct ocfs2_stack_plugin *plugin)
         spin_lock(&ocfs2_stack_lock);
         if (!ocfs2_stack_lookup(plugin->sp_name)) {
                 plugin->sp_count = 0;
-                plugin->sp_proto = lproto;
+                plugin->sp_max_proto = locking_max_version;
                 list_add(&plugin->sp_list, &ocfs2_stack_list);
                 printk(KERN_INFO "ocfs2: Registered cluster interface %s\n",
                        plugin->sp_name);
@@ -213,77 +213,76 @@ void ocfs2_stack_glue_unregister(struct ocfs2_stack_plugin *plugin)
 }
 EXPORT_SYMBOL_GPL(ocfs2_stack_glue_unregister);
 
-void ocfs2_stack_glue_set_locking_protocol(struct ocfs2_locking_protocol *proto)
+void ocfs2_stack_glue_set_max_proto_version(struct ocfs2_protocol_version *max_proto)
 {
         struct ocfs2_stack_plugin *p;
 
-        BUG_ON(proto == NULL);
-
         spin_lock(&ocfs2_stack_lock);
-        BUG_ON(active_stack != NULL);
+        if (memcmp(max_proto, &locking_max_version,
+                   sizeof(struct ocfs2_protocol_version))) {
+                BUG_ON(locking_max_version.pv_major != 0);
 
-        lproto = proto;
-        list_for_each_entry(p, &ocfs2_stack_list, sp_list) {
-                p->sp_proto = lproto;
+                locking_max_version = *max_proto;
+                list_for_each_entry(p, &ocfs2_stack_list, sp_list) {
+                        p->sp_max_proto = locking_max_version;
+                }
         }
-
         spin_unlock(&ocfs2_stack_lock);
 }
-EXPORT_SYMBOL_GPL(ocfs2_stack_glue_set_locking_protocol);
+EXPORT_SYMBOL_GPL(ocfs2_stack_glue_set_max_proto_version);
 
 
 /*
- * The ocfs2_dlm_lock() and ocfs2_dlm_unlock() functions take
- * "struct ocfs2_lock_res *astarg" instead of "void *astarg" because the
- * underlying stack plugins need to pilfer the lksb off of the lock_res.
- * If some other structure needs to be passed as an astarg, the plugins
- * will need to be given a different avenue to the lksb.
+ * The ocfs2_dlm_lock() and ocfs2_dlm_unlock() functions take no argument
+ * for the ast and bast functions.  They will pass the lksb to the ast
+ * and bast.  The caller can wrap the lksb with their own structure to
+ * get more information.
  */
 int ocfs2_dlm_lock(struct ocfs2_cluster_connection *conn,
                    int mode,
-                   union ocfs2_dlm_lksb *lksb,
+                   struct ocfs2_dlm_lksb *lksb,
                    u32 flags,
                    void *name,
-                   unsigned int namelen,
-                   struct ocfs2_lock_res *astarg)
+                   unsigned int namelen)
 {
-        BUG_ON(lproto == NULL);
-
+        if (!lksb->lksb_conn)
+                lksb->lksb_conn = conn;
+        else
+                BUG_ON(lksb->lksb_conn != conn);
         return active_stack->sp_ops->dlm_lock(conn, mode, lksb, flags,
-                                              name, namelen, astarg);
+                                              name, namelen);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lock);
 
 int ocfs2_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                     union ocfs2_dlm_lksb *lksb,
-                     u32 flags,
-                     struct ocfs2_lock_res *astarg)
+                     struct ocfs2_dlm_lksb *lksb,
+                     u32 flags)
 {
-        BUG_ON(lproto == NULL);
+        BUG_ON(lksb->lksb_conn == NULL);
 
-        return active_stack->sp_ops->dlm_unlock(conn, lksb, flags, astarg);
+        return active_stack->sp_ops->dlm_unlock(conn, lksb, flags);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_unlock);
 
-int ocfs2_dlm_lock_status(union ocfs2_dlm_lksb *lksb)
+int ocfs2_dlm_lock_status(struct ocfs2_dlm_lksb *lksb)
 {
         return active_stack->sp_ops->lock_status(lksb);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lock_status);
 
-int ocfs2_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb)
+int ocfs2_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb)
 {
         return active_stack->sp_ops->lvb_valid(lksb);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lvb_valid);
 
-void *ocfs2_dlm_lvb(union ocfs2_dlm_lksb *lksb)
+void *ocfs2_dlm_lvb(struct ocfs2_dlm_lksb *lksb)
 {
         return active_stack->sp_ops->lock_lvb(lksb);
 }
 EXPORT_SYMBOL_GPL(ocfs2_dlm_lvb);
 
-void ocfs2_dlm_dump_lksb(union ocfs2_dlm_lksb *lksb)
+void ocfs2_dlm_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 {
         active_stack->sp_ops->dump_lksb(lksb);
 }
@@ -312,6 +311,7 @@ EXPORT_SYMBOL_GPL(ocfs2_plock);
 int ocfs2_cluster_connect(const char *stack_name,
                           const char *group,
                           int grouplen,
+                          struct ocfs2_locking_protocol *lproto,
                           void (*recovery_handler)(int node_num,
                                                    void *recovery_data),
                           void *recovery_data,
@@ -329,6 +329,12 @@ int ocfs2_cluster_connect(const char *stack_name,
                 goto out;
         }
 
+        if (memcmp(&lproto->lp_max_version, &locking_max_version,
+                   sizeof(struct ocfs2_protocol_version))) {
+                rc = -EINVAL;
+                goto out;
+        }
+
         new_conn = kzalloc(sizeof(struct ocfs2_cluster_connection),
                            GFP_KERNEL);
         if (!new_conn) {
@@ -341,6 +347,7 @@ int ocfs2_cluster_connect(const char *stack_name,
         new_conn->cc_recovery_handler = recovery_handler;
         new_conn->cc_recovery_data = recovery_data;
 
+        new_conn->cc_proto = lproto;
         /* Start the new connection at our maximum compatibility level */
         new_conn->cc_version = lproto->lp_max_version;
 
@@ -366,6 +373,24 @@ out:
 }
 EXPORT_SYMBOL_GPL(ocfs2_cluster_connect);
 
+/* The caller will ensure all nodes have the same cluster stack */
+int ocfs2_cluster_connect_agnostic(const char *group,
+                                   int grouplen,
+                                   struct ocfs2_locking_protocol *lproto,
+                                   void (*recovery_handler)(int node_num,
+                                                            void *recovery_data),
+                                   void *recovery_data,
+                                   struct ocfs2_cluster_connection **conn)
+{
+        char *stack_name = NULL;
+
+        if (cluster_stack_name[0])
+                stack_name = cluster_stack_name;
+        return ocfs2_cluster_connect(stack_name, group, grouplen, lproto,
+                                     recovery_handler, recovery_data, conn);
+}
+EXPORT_SYMBOL_GPL(ocfs2_cluster_connect_agnostic);
+
 /* If hangup_pending is 0, the stack driver will be dropped */
 int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
                              int hangup_pending)
@@ -453,10 +478,10 @@ static ssize_t ocfs2_max_locking_protocol_show(struct kobject *kobj,
         ssize_t ret = 0;
 
         spin_lock(&ocfs2_stack_lock);
-        if (lproto)
+        if (locking_max_version.pv_major)
                 ret = snprintf(buf, PAGE_SIZE, "%u.%u\n",
-                               lproto->lp_max_version.pv_major,
-                               lproto->lp_max_version.pv_minor);
+                               locking_max_version.pv_major,
+                               locking_max_version.pv_minor);
         spin_unlock(&ocfs2_stack_lock);
 
         return ret;
@@ -685,7 +710,10 @@ static int __init ocfs2_stack_glue_init(void)
 
 static void __exit ocfs2_stack_glue_exit(void)
 {
-        lproto = NULL;
+        memset(&locking_max_version, 0,
+               sizeof(struct ocfs2_protocol_version));
+        locking_max_version.pv_major = 0;
+        locking_max_version.pv_minor = 0;
         ocfs2_sysfs_exit();
         if (ocfs2_table_header)
                 unregister_sysctl_table(ocfs2_table_header);
diff --git a/fs/ocfs2/stackglue.h b/fs/ocfs2/stackglue.h
index 03a44d60eac9..8ce7398ae1d2 100644
--- a/fs/ocfs2/stackglue.h
+++ b/fs/ocfs2/stackglue.h
@@ -56,17 +56,6 @@ struct ocfs2_protocol_version {
 };
 
 /*
- * The ocfs2_locking_protocol defines the handlers called on ocfs2's behalf.
- */
-struct ocfs2_locking_protocol {
-        struct ocfs2_protocol_version lp_max_version;
-        void (*lp_lock_ast)(void *astarg);
-        void (*lp_blocking_ast)(void *astarg, int level);
-        void (*lp_unlock_ast)(void *astarg, int error);
-};
-
-
-/*
  * The dlm_lockstatus struct includes lvb space, but the dlm_lksb struct only
  * has a pointer to separately allocated lvb space.  This struct exists only to
  * include in the lksb union to make space for a combined dlm_lksb and lvb.
@@ -81,12 +70,27 @@ struct fsdlm_lksb_plus_lvb {
  * size of the union is known.  Lock status structures are embedded in
  * ocfs2 inodes.
  */
-union ocfs2_dlm_lksb {
-        struct dlm_lockstatus lksb_o2dlm;
-        struct dlm_lksb lksb_fsdlm;
-        struct fsdlm_lksb_plus_lvb padding;
+struct ocfs2_cluster_connection;
+struct ocfs2_dlm_lksb {
+         union {
+                 struct dlm_lockstatus lksb_o2dlm;
+                 struct dlm_lksb lksb_fsdlm;
+                 struct fsdlm_lksb_plus_lvb padding;
+         };
+         struct ocfs2_cluster_connection *lksb_conn;
+};
+
+/*
+ * The ocfs2_locking_protocol defines the handlers called on ocfs2's behalf.
+ */
+struct ocfs2_locking_protocol {
+        struct ocfs2_protocol_version lp_max_version;
+        void (*lp_lock_ast)(struct ocfs2_dlm_lksb *lksb);
+        void (*lp_blocking_ast)(struct ocfs2_dlm_lksb *lksb, int level);
+        void (*lp_unlock_ast)(struct ocfs2_dlm_lksb *lksb, int error);
 };
 
+
 /*
  * A cluster connection.  Mostly opaque to ocfs2, the connection holds
  * state for the underlying stack.  ocfs2 does use cc_version to determine
@@ -96,6 +100,7 @@ struct ocfs2_cluster_connection {
         char cc_name[GROUP_NAME_MAX];
         int cc_namelen;
         struct ocfs2_protocol_version cc_version;
+        struct ocfs2_locking_protocol *cc_proto;
         void (*cc_recovery_handler)(int node_num, void *recovery_data);
         void *cc_recovery_data;
         void *cc_lockspace;
@@ -155,27 +160,29 @@ struct ocfs2_stack_operations {
          *
          * ast and bast functions are not part of the call because the
          * stack will likely want to wrap ast and bast calls before passing
-         * them to stack->sp_proto.
+         * them to stack->sp_proto.  There is no astarg.  The lksb will
+         * be passed back to the ast and bast functions.  The caller can
+         * use this to find their object.
          */
         int (*dlm_lock)(struct ocfs2_cluster_connection *conn,
                         int mode,
-                        union ocfs2_dlm_lksb *lksb,
+                        struct ocfs2_dlm_lksb *lksb,
                         u32 flags,
                         void *name,
-                        unsigned int namelen,
-                        void *astarg);
+                        unsigned int namelen);
 
         /*
          * Call the underlying dlm unlock function.  The ->dlm_unlock()
          * function should convert the flags as appropriate.
          *
          * The unlock ast is not passed, as the stack will want to wrap
-         * it before calling stack->sp_proto->lp_unlock_ast().
+         * it before calling stack->sp_proto->lp_unlock_ast().  There is
+         * no astarg.  The lksb will be passed back to the unlock ast
+         * function.  The caller can use this to find their object.
          */
         int (*dlm_unlock)(struct ocfs2_cluster_connection *conn,
-                          union ocfs2_dlm_lksb *lksb,
-                          u32 flags,
-                          void *astarg);
+                          struct ocfs2_dlm_lksb *lksb,
+                          u32 flags);
 
         /*
          * Return the status of the current lock status block.  The fs
@@ -183,17 +190,17 @@ struct ocfs2_stack_operations {
          * callback pulls out the stack-specific lksb, converts the status
          * to a proper errno, and returns it.
          */
-        int (*lock_status)(union ocfs2_dlm_lksb *lksb);
+        int (*lock_status)(struct ocfs2_dlm_lksb *lksb);
 
         /*
          * Return non-zero if the LVB is valid.
          */
-        int (*lvb_valid)(union ocfs2_dlm_lksb *lksb);
+        int (*lvb_valid)(struct ocfs2_dlm_lksb *lksb);
 
         /*
          * Pull the lvb pointer off of the stack-specific lksb.
          */
-        void *(*lock_lvb)(union ocfs2_dlm_lksb *lksb);
+        void *(*lock_lvb)(struct ocfs2_dlm_lksb *lksb);
 
         /*
          * Cluster-aware posix locks
@@ -210,7 +217,7 @@ struct ocfs2_stack_operations {
          * This is an optoinal debugging hook.  If provided, the
          * stack can dump debugging information about this lock.
          */
-        void (*dump_lksb)(union ocfs2_dlm_lksb *lksb);
+        void (*dump_lksb)(struct ocfs2_dlm_lksb *lksb);
 };
 
 /*
@@ -226,7 +233,7 @@ struct ocfs2_stack_plugin {
         /* These are managed by the stackglue code. */
         struct list_head sp_list;
         unsigned int sp_count;
-        struct ocfs2_locking_protocol *sp_proto;
+        struct ocfs2_protocol_version sp_max_proto;
 };
 
 
@@ -234,10 +241,22 @@ struct ocfs2_stack_plugin {
 int ocfs2_cluster_connect(const char *stack_name,
                           const char *group,
                           int grouplen,
+                          struct ocfs2_locking_protocol *lproto,
                           void (*recovery_handler)(int node_num,
                                                    void *recovery_data),
                           void *recovery_data,
                           struct ocfs2_cluster_connection **conn);
+/*
+ * Used by callers that don't store their stack name.  They must ensure
+ * all nodes have the same stack.
+ */
+int ocfs2_cluster_connect_agnostic(const char *group,
+                                   int grouplen,
+                                   struct ocfs2_locking_protocol *lproto,
+                                   void (*recovery_handler)(int node_num,
+                                                            void *recovery_data),
+                                   void *recovery_data,
+                                   struct ocfs2_cluster_connection **conn);
 int ocfs2_cluster_disconnect(struct ocfs2_cluster_connection *conn,
                              int hangup_pending);
 void ocfs2_cluster_hangup(const char *group, int grouplen);
@@ -246,26 +265,24 @@ int ocfs2_cluster_this_node(unsigned int *node);
 struct ocfs2_lock_res;
 int ocfs2_dlm_lock(struct ocfs2_cluster_connection *conn,
                    int mode,
-                   union ocfs2_dlm_lksb *lksb,
+                   struct ocfs2_dlm_lksb *lksb,
                    u32 flags,
                    void *name,
-                   unsigned int namelen,
-                   struct ocfs2_lock_res *astarg);
+                   unsigned int namelen);
 int ocfs2_dlm_unlock(struct ocfs2_cluster_connection *conn,
-                     union ocfs2_dlm_lksb *lksb,
-                     u32 flags,
-                     struct ocfs2_lock_res *astarg);
+                     struct ocfs2_dlm_lksb *lksb,
+                     u32 flags);
 
-int ocfs2_dlm_lock_status(union ocfs2_dlm_lksb *lksb);
-int ocfs2_dlm_lvb_valid(union ocfs2_dlm_lksb *lksb);
-void *ocfs2_dlm_lvb(union ocfs2_dlm_lksb *lksb);
-void ocfs2_dlm_dump_lksb(union ocfs2_dlm_lksb *lksb);
+int ocfs2_dlm_lock_status(struct ocfs2_dlm_lksb *lksb);
+int ocfs2_dlm_lvb_valid(struct ocfs2_dlm_lksb *lksb);
+void *ocfs2_dlm_lvb(struct ocfs2_dlm_lksb *lksb);
+void ocfs2_dlm_dump_lksb(struct ocfs2_dlm_lksb *lksb);
 
 int ocfs2_stack_supports_plocks(void);
 int ocfs2_plock(struct ocfs2_cluster_connection *conn, u64 ino,
                 struct file *file, int cmd, struct file_lock *fl);
 
-void ocfs2_stack_glue_set_locking_protocol(struct ocfs2_locking_protocol *proto);
+void ocfs2_stack_glue_set_max_proto_version(struct ocfs2_protocol_version *max_proto);
 
 
 /* Used by stack plugins */
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index c30b644d9572..c3c60bc3e072 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -51,7 +51,7 @@
 #define ALLOC_NEW_GROUP                 0x1
 #define ALLOC_GROUPS_FROM_GLOBAL        0x2
 
-#define OCFS2_MAX_INODES_TO_STEAL       1024
+#define OCFS2_MAX_TO_STEAL              1024
 
 static inline void ocfs2_debug_bg(struct ocfs2_group_desc *bg);
 static inline void ocfs2_debug_suballoc_inode(struct ocfs2_dinode *fe);
@@ -637,12 +637,113 @@ bail:
         return status;
 }
 
+static void ocfs2_init_inode_steal_slot(struct ocfs2_super *osb)
+{
+        spin_lock(&osb->osb_lock);
+        osb->s_inode_steal_slot = OCFS2_INVALID_SLOT;
+        spin_unlock(&osb->osb_lock);
+        atomic_set(&osb->s_num_inodes_stolen, 0);
+}
+
+static void ocfs2_init_meta_steal_slot(struct ocfs2_super *osb)
+{
+        spin_lock(&osb->osb_lock);
+        osb->s_meta_steal_slot = OCFS2_INVALID_SLOT;
+        spin_unlock(&osb->osb_lock);
+        atomic_set(&osb->s_num_meta_stolen, 0);
+}
+
+void ocfs2_init_steal_slots(struct ocfs2_super *osb)
+{
+        ocfs2_init_inode_steal_slot(osb);
+        ocfs2_init_meta_steal_slot(osb);
+}
+
+static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type)
+{
+        spin_lock(&osb->osb_lock);
+        if (type == INODE_ALLOC_SYSTEM_INODE)
+                osb->s_inode_steal_slot = slot;
+        else if (type == EXTENT_ALLOC_SYSTEM_INODE)
+                osb->s_meta_steal_slot = slot;
+        spin_unlock(&osb->osb_lock);
+}
+
+static int __ocfs2_get_steal_slot(struct ocfs2_super *osb, int type)
+{
+        int slot = OCFS2_INVALID_SLOT;
+
+        spin_lock(&osb->osb_lock);
+        if (type == INODE_ALLOC_SYSTEM_INODE)
+                slot = osb->s_inode_steal_slot;
+        else if (type == EXTENT_ALLOC_SYSTEM_INODE)
+                slot = osb->s_meta_steal_slot;
+        spin_unlock(&osb->osb_lock);
+
+        return slot;
+}
+
+static int ocfs2_get_inode_steal_slot(struct ocfs2_super *osb)
+{
+        return __ocfs2_get_steal_slot(osb, INODE_ALLOC_SYSTEM_INODE);
+}
+
+static int ocfs2_get_meta_steal_slot(struct ocfs2_super *osb)
+{
+        return __ocfs2_get_steal_slot(osb, EXTENT_ALLOC_SYSTEM_INODE);
+}
+
+static int ocfs2_steal_resource(struct ocfs2_super *osb,
+                                struct ocfs2_alloc_context *ac,
+                                int type)
+{
+        int i, status = -ENOSPC;
+        int slot = __ocfs2_get_steal_slot(osb, type);
+
+        /* Start to steal resource from the first slot after ours. */
+        if (slot == OCFS2_INVALID_SLOT)
+                slot = osb->slot_num + 1;
+
+        for (i = 0; i < osb->max_slots; i++, slot++) {
+                if (slot == osb->max_slots)
+                        slot = 0;
+
+                if (slot == osb->slot_num)
+                        continue;
+
+                status = ocfs2_reserve_suballoc_bits(osb, ac,
+                                                     type,
+                                                     (u32)slot, NULL,
+                                                     NOT_ALLOC_NEW_GROUP);
+                if (status >= 0) {
+                        __ocfs2_set_steal_slot(osb, slot, type);
+                        break;
+                }
+
+                ocfs2_free_ac_resource(ac);
+        }
+
+        return status;
+}
+
+static int ocfs2_steal_inode(struct ocfs2_super *osb,
+                             struct ocfs2_alloc_context *ac)
+{
+        return ocfs2_steal_resource(osb, ac, INODE_ALLOC_SYSTEM_INODE);
+}
+
+static int ocfs2_steal_meta(struct ocfs2_super *osb,
+                            struct ocfs2_alloc_context *ac)
+{
+        return ocfs2_steal_resource(osb, ac, EXTENT_ALLOC_SYSTEM_INODE);
+}
+
 int ocfs2_reserve_new_metadata_blocks(struct ocfs2_super *osb,
                                       int blocks,
                                       struct ocfs2_alloc_context **ac)
 {
         int status;
-        u32 slot;
+        int slot = ocfs2_get_meta_steal_slot(osb);
 
         *ac = kzalloc(sizeof(struct ocfs2_alloc_context), GFP_KERNEL);
         if (!(*ac)) {
@@ -653,12 +754,34 @@ int ocfs2_reserve_new_metadata_blocks(struct ocfs2_super *osb,
 
         (*ac)->ac_bits_wanted = blocks;
         (*ac)->ac_which = OCFS2_AC_USE_META;
-        slot = osb->slot_num;
         (*ac)->ac_group_search = ocfs2_block_group_search;
 
+        if (slot != OCFS2_INVALID_SLOT &&
+                atomic_read(&osb->s_num_meta_stolen) < OCFS2_MAX_TO_STEAL)
+                goto extent_steal;
+
+        atomic_set(&osb->s_num_meta_stolen, 0);
         status = ocfs2_reserve_suballoc_bits(osb, (*ac),
                                              EXTENT_ALLOC_SYSTEM_INODE,
-                                             slot, NULL, ALLOC_NEW_GROUP);
+                                             (u32)osb->slot_num, NULL,
+                                             ALLOC_NEW_GROUP);
+
+
+        if (status >= 0) {
+                status = 0;
+                if (slot != OCFS2_INVALID_SLOT)
+                        ocfs2_init_meta_steal_slot(osb);
+                goto bail;
+        } else if (status < 0 && status != -ENOSPC) {
+                mlog_errno(status);
+                goto bail;
+        }
+
+        ocfs2_free_ac_resource(*ac);
+
+extent_steal:
+        status = ocfs2_steal_meta(osb, *ac);
+        atomic_inc(&osb->s_num_meta_stolen);
         if (status < 0) {
                 if (status != -ENOSPC)
                         mlog_errno(status);
@@ -685,43 +808,11 @@ int ocfs2_reserve_new_metadata(struct ocfs2_super *osb,
                                         ac);
 }
 
-static int ocfs2_steal_inode_from_other_nodes(struct ocfs2_super *osb,
-                                              struct ocfs2_alloc_context *ac)
-{
-        int i, status = -ENOSPC;
-        s16 slot = ocfs2_get_inode_steal_slot(osb);
-
-        /* Start to steal inodes from the first slot after ours. */
-        if (slot == OCFS2_INVALID_SLOT)
-                slot = osb->slot_num + 1;
-
-        for (i = 0; i < osb->max_slots; i++, slot++) {
-                if (slot == osb->max_slots)
-                        slot = 0;
-
-                if (slot == osb->slot_num)
-                        continue;
-
-                status = ocfs2_reserve_suballoc_bits(osb, ac,
-                                                     INODE_ALLOC_SYSTEM_INODE,
-                                                     slot, NULL,
-                                                     NOT_ALLOC_NEW_GROUP);
-                if (status >= 0) {
-                        ocfs2_set_inode_steal_slot(osb, slot);
-                        break;
-                }
-
-                ocfs2_free_ac_resource(ac);
-        }
-
-        return status;
-}
-
 int ocfs2_reserve_new_inode(struct ocfs2_super *osb,
                             struct ocfs2_alloc_context **ac)
 {
         int status;
-        s16 slot = ocfs2_get_inode_steal_slot(osb);
+        int slot = ocfs2_get_inode_steal_slot(osb);
         u64 alloc_group;
 
         *ac = kzalloc(sizeof(struct ocfs2_alloc_context), GFP_KERNEL);
@@ -754,14 +845,14 @@ int ocfs2_reserve_new_inode(struct ocfs2_super *osb,
          * need to check our slots to see whether there is some space for us.
          */
         if (slot != OCFS2_INVALID_SLOT &&
-            atomic_read(&osb->s_num_inodes_stolen) < OCFS2_MAX_INODES_TO_STEAL)
+            atomic_read(&osb->s_num_inodes_stolen) < OCFS2_MAX_TO_STEAL)
                 goto inode_steal;
 
         atomic_set(&osb->s_num_inodes_stolen, 0);
         alloc_group = osb->osb_inode_alloc_group;
         status = ocfs2_reserve_suballoc_bits(osb, *ac,
                                              INODE_ALLOC_SYSTEM_INODE,
-                                             osb->slot_num,
+                                             (u32)osb->slot_num,
                                              &alloc_group,
                                              ALLOC_NEW_GROUP |
                                              ALLOC_GROUPS_FROM_GLOBAL);
@@ -789,7 +880,7 @@ int ocfs2_reserve_new_inode(struct ocfs2_super *osb,
         ocfs2_free_ac_resource(*ac);
 
 inode_steal:
-        status = ocfs2_steal_inode_from_other_nodes(osb, *ac);
+        status = ocfs2_steal_inode(osb, *ac);
         atomic_inc(&osb->s_num_inodes_stolen);
         if (status < 0) {
                 if (status != -ENOSPC)
diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h
index 8c9a78a43164..fa60723c43e8 100644
--- a/fs/ocfs2/suballoc.h
+++ b/fs/ocfs2/suballoc.h
@@ -56,6 +56,7 @@ struct ocfs2_alloc_context {
                                  is the same as ~0 - unlimited */
 };
 
+void ocfs2_init_steal_slots(struct ocfs2_super *osb);
 void ocfs2_free_alloc_context(struct ocfs2_alloc_context *ac);
 static inline int ocfs2_alloc_context_bits_left(struct ocfs2_alloc_context *ac)
 {
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 755cd49a5ef3..dee03197a494 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -69,6 +69,7 @@
 #include "xattr.h"
 #include "quota.h"
 #include "refcounttree.h"
+#include "suballoc.h"
 
 #include "buffer_head_io.h"
 
@@ -301,9 +302,12 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
 
         spin_lock(&osb->osb_lock);
         out += snprintf(buf + out, len - out,
-                        "%10s => Slot: %d  NumStolen: %d\n", "Steal",
+                        "%10s => InodeSlot: %d  StolenInodes: %d, "
+                        "MetaSlot: %d  StolenMeta: %d\n", "Steal",
                         osb->s_inode_steal_slot,
-                        atomic_read(&osb->s_num_inodes_stolen));
+                        atomic_read(&osb->s_num_inodes_stolen),
+                        osb->s_meta_steal_slot,
+                        atomic_read(&osb->s_num_meta_stolen));
         spin_unlock(&osb->osb_lock);
 
         out += snprintf(buf + out, len - out, "OrphanScan => ");
@@ -1997,7 +2001,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
         osb->blocked_lock_count = 0;
         spin_lock_init(&osb->osb_lock);
         spin_lock_init(&osb->osb_xattr_lock);
-        ocfs2_init_inode_steal_slot(osb);
+        ocfs2_init_steal_slots(osb);
 
         atomic_set(&osb->alloc_stats.moves, 0);
         atomic_set(&osb->alloc_stats.local_data, 0);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 8fc6fb071c6d..d1b0d386f6d1 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -116,10 +116,11 @@ static struct xattr_handler *ocfs2_xattr_handler_map[OCFS2_XATTR_MAX] = {
 };
 
 struct ocfs2_xattr_info {
-        int name_index;
-        const char *name;
-        const void *value;
-        size_t value_len;
+        int             xi_name_index;
+        const char      *xi_name;
+        int             xi_name_len;
+        const void      *xi_value;
+        size_t          xi_value_len;
 };
 
 struct ocfs2_xattr_search {
@@ -137,6 +138,115 @@ struct ocfs2_xattr_search {
         int not_found;
 };
 
+/* Operations on struct ocfs2_xa_entry */
+struct ocfs2_xa_loc;
+struct ocfs2_xa_loc_operations {
+        /*
+         * Journal functions
+         */
+        int (*xlo_journal_access)(handle_t *handle, struct ocfs2_xa_loc *loc,
+                                  int type);
+        void (*xlo_journal_dirty)(handle_t *handle, struct ocfs2_xa_loc *loc);
+
+        /*
+         * Return a pointer to the appropriate buffer in loc->xl_storage
+         * at the given offset from loc->xl_header.
+         */
+        void *(*xlo_offset_pointer)(struct ocfs2_xa_loc *loc, int offset);
+
+        /* Can we reuse the existing entry for the new value? */
+        int (*xlo_can_reuse)(struct ocfs2_xa_loc *loc,
+                             struct ocfs2_xattr_info *xi);
+
+        /* How much space is needed for the new value? */
+        int (*xlo_check_space)(struct ocfs2_xa_loc *loc,
+                               struct ocfs2_xattr_info *xi);
+
+        /*
+         * Return the offset of the first name+value pair.  This is
+         * the start of our downward-filling free space.
+         */
+        int (*xlo_get_free_start)(struct ocfs2_xa_loc *loc);
+
+        /*
+         * Remove the name+value at this location.  Do whatever is
+         * appropriate with the remaining name+value pairs.
+         */
+        void (*xlo_wipe_namevalue)(struct ocfs2_xa_loc *loc);
+
+        /* Fill xl_entry with a new entry */
+        void (*xlo_add_entry)(struct ocfs2_xa_loc *loc, u32 name_hash);
+
+        /* Add name+value storage to an entry */
+        void (*xlo_add_namevalue)(struct ocfs2_xa_loc *loc, int size);
+
+        /*
+         * Initialize the value buf's access and bh fields for this entry.
+         * ocfs2_xa_fill_value_buf() will handle the xv pointer.
+         */
+        void (*xlo_fill_value_buf)(struct ocfs2_xa_loc *loc,
+                                   struct ocfs2_xattr_value_buf *vb);
+};
+
+/*
+ * Describes an xattr entry location.  This is a memory structure
+ * tracking the on-disk structure.
+ */
+struct ocfs2_xa_loc {
+        /* This xattr belongs to this inode */
+        struct inode *xl_inode;
+
+        /* The ocfs2_xattr_header inside the on-disk storage. Not NULL. */
+        struct ocfs2_xattr_header *xl_header;
+
+        /* Bytes from xl_header to the end of the storage */
+        int xl_size;
+
+        /*
+         * The ocfs2_xattr_entry this location describes.  If this is
+         * NULL, this location describes the on-disk structure where it
+         * would have been.
+         */
+        struct ocfs2_xattr_entry *xl_entry;
+
+        /*
+         * Internal housekeeping
+         */
+
+        /* Buffer(s) containing this entry */
+        void *xl_storage;
+
+        /* Operations on the storage backing this location */
+        const struct ocfs2_xa_loc_operations *xl_ops;
+};
+
+/*
+ * Convenience functions to calculate how much space is needed for a
+ * given name+value pair
+ */
+static int namevalue_size(int name_len, uint64_t value_len)
+{
+        if (value_len > OCFS2_XATTR_INLINE_SIZE)
+                return OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
+        else
+                return OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_SIZE(value_len);
+}
+
+static int namevalue_size_xi(struct ocfs2_xattr_info *xi)
+{
+        return namevalue_size(xi->xi_name_len, xi->xi_value_len);
+}
+
+static int namevalue_size_xe(struct ocfs2_xattr_entry *xe)
+{
+        u64 value_len = le64_to_cpu(xe->xe_value_size);
+
+        BUG_ON((value_len > OCFS2_XATTR_INLINE_SIZE) &&
+               ocfs2_xattr_is_local(xe));
+        return namevalue_size(xe->xe_name_len, value_len);
+}
+
+
 static int ocfs2_xattr_bucket_get_name_value(struct super_block *sb,
                                              struct ocfs2_xattr_header *xh,
                                              int index,
@@ -212,14 +322,6 @@ static inline u16 ocfs2_blocks_per_xattr_bucket(struct super_block *sb)
         return OCFS2_XATTR_BUCKET_SIZE / (1 << sb->s_blocksize_bits);
 }
 
-static inline u16 ocfs2_xattr_max_xe_in_bucket(struct super_block *sb)
-{
-        u16 len = sb->s_blocksize -
-                 offsetof(struct ocfs2_xattr_header, xh_entries);
-
-        return len / sizeof(struct ocfs2_xattr_entry);
-}
-
 #define bucket_blkno(_b) ((_b)->bu_bhs[0]->b_blocknr)
 #define bucket_block(_b, _n) ((_b)->bu_bhs[(_n)]->b_data)
 #define bucket_xh(_b) ((struct ocfs2_xattr_header *)bucket_block((_b), 0))
@@ -463,35 +565,22 @@ static u32 ocfs2_xattr_name_hash(struct inode *inode,
         return hash;
 }
 
-/*
- * ocfs2_xattr_hash_entry()
- *
- * Compute the hash of an extended attribute.
- */
-static void ocfs2_xattr_hash_entry(struct inode *inode,
-                                   struct ocfs2_xattr_header *header,
-                                   struct ocfs2_xattr_entry *entry)
+static int ocfs2_xattr_entry_real_size(int name_len, size_t value_len)
 {
-        u32 hash = 0;
-        char *name = (char *)header + le16_to_cpu(entry->xe_name_offset);
-
-        hash = ocfs2_xattr_name_hash(inode, name, entry->xe_name_len);
-        entry->xe_name_hash = cpu_to_le32(hash);
-
-        return;
+        return namevalue_size(name_len, value_len) +
+                sizeof(struct ocfs2_xattr_entry);
 }
 
-static int ocfs2_xattr_entry_real_size(int name_len, size_t value_len)
+static int ocfs2_xi_entry_usage(struct ocfs2_xattr_info *xi)
 {
-        int size = 0;
-
-        if (value_len <= OCFS2_XATTR_INLINE_SIZE)
-                size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_SIZE(value_len);
-        else
-                size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
-        size += sizeof(struct ocfs2_xattr_entry);
+        return namevalue_size_xi(xi) +
+                sizeof(struct ocfs2_xattr_entry);
+}
 
-        return size;
+static int ocfs2_xe_entry_usage(struct ocfs2_xattr_entry *xe)
+{
+        return namevalue_size_xe(xe) +
+                sizeof(struct ocfs2_xattr_entry);
 }
 
 int ocfs2_calc_security_init(struct inode *dir,
@@ -1308,452 +1397,897 @@ out:
         return ret;
 }
 
-static int ocfs2_xattr_cleanup(struct inode *inode,
-                               handle_t *handle,
-                               struct ocfs2_xattr_info *xi,
-                               struct ocfs2_xattr_search *xs,
-                               struct ocfs2_xattr_value_buf *vb,
-                               size_t offs)
+static int ocfs2_xa_check_space_helper(int needed_space, int free_start,
+                                       int num_entries)
 {
-        int ret = 0;
-        size_t name_len = strlen(xi->name);
-        void *val = xs->base + offs;
-        size_t size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
+        int free_space;
 
-        ret = vb->vb_access(handle, INODE_CACHE(inode), vb->vb_bh,
-                            OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-        /* Decrease xattr count */
-        le16_add_cpu(&xs->header->xh_count, -1);
-        /* Remove the xattr entry and tree root which has already be set*/
-        memset((void *)xs->here, 0, sizeof(struct ocfs2_xattr_entry));
-        memset(val, 0, size);
+        if (!needed_space)
+                return 0;
 
-        ret = ocfs2_journal_dirty(handle, vb->vb_bh);
-        if (ret < 0)
-                mlog_errno(ret);
-out:
-        return ret;
+        free_space = free_start -
+                sizeof(struct ocfs2_xattr_header) -
+                (num_entries * sizeof(struct ocfs2_xattr_entry)) -
+                OCFS2_XATTR_HEADER_GAP;
+        if (free_space < 0)
+                return -EIO;
+        if (free_space < needed_space)
+                return -ENOSPC;
+
+        return 0;
 }
 
-static int ocfs2_xattr_update_entry(struct inode *inode,
-                                    handle_t *handle,
-                                    struct ocfs2_xattr_info *xi,
-                                    struct ocfs2_xattr_search *xs,
-                                    struct ocfs2_xattr_value_buf *vb,
-                                    size_t offs)
+static int ocfs2_xa_journal_access(handle_t *handle, struct ocfs2_xa_loc *loc,
+                                   int type)
 {
-        int ret;
+        return loc->xl_ops->xlo_journal_access(handle, loc, type);
+}
 
-        ret = vb->vb_access(handle, INODE_CACHE(inode), vb->vb_bh,
-                            OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
+static void ocfs2_xa_journal_dirty(handle_t *handle, struct ocfs2_xa_loc *loc)
+{
+        loc->xl_ops->xlo_journal_dirty(handle, loc);
+}
 
-        xs->here->xe_name_offset = cpu_to_le16(offs);
-        xs->here->xe_value_size = cpu_to_le64(xi->value_len);
-        if (xi->value_len <= OCFS2_XATTR_INLINE_SIZE)
-                ocfs2_xattr_set_local(xs->here, 1);
-        else
-                ocfs2_xattr_set_local(xs->here, 0);
-        ocfs2_xattr_hash_entry(inode, xs->header, xs->here);
+/* Give a pointer into the storage for the given offset */
+static void *ocfs2_xa_offset_pointer(struct ocfs2_xa_loc *loc, int offset)
+{
+        BUG_ON(offset >= loc->xl_size);
+        return loc->xl_ops->xlo_offset_pointer(loc, offset);
+}
 
-        ret = ocfs2_journal_dirty(handle, vb->vb_bh);
-        if (ret < 0)
-                mlog_errno(ret);
-out:
-        return ret;
+/*
+ * Wipe the name+value pair and allow the storage to reclaim it.  This
+ * must be followed by either removal of the entry or a call to
+ * ocfs2_xa_add_namevalue().
+ */
+static void ocfs2_xa_wipe_namevalue(struct ocfs2_xa_loc *loc)
+{
+        loc->xl_ops->xlo_wipe_namevalue(loc);
 }
 
 /*
- * ocfs2_xattr_set_value_outside()
- *
- * Set large size value in B tree.
+ * Find lowest offset to a name+value pair.  This is the start of our
+ * downward-growing free space.
  */
-static int ocfs2_xattr_set_value_outside(struct inode *inode,
-                                         struct ocfs2_xattr_info *xi,
-                                         struct ocfs2_xattr_search *xs,
-                                         struct ocfs2_xattr_set_ctxt *ctxt,
-                                         struct ocfs2_xattr_value_buf *vb,
-                                         size_t offs)
+static int ocfs2_xa_get_free_start(struct ocfs2_xa_loc *loc)
 {
-        size_t name_len = strlen(xi->name);
-        void *val = xs->base + offs;
-        struct ocfs2_xattr_value_root *xv = NULL;
-        size_t size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
-        int ret = 0;
+        return loc->xl_ops->xlo_get_free_start(loc);
+}
 
-        memset(val, 0, size);
-        memcpy(val, xi->name, name_len);
-        xv = (struct ocfs2_xattr_value_root *)
-                (val + OCFS2_XATTR_SIZE(name_len));
-        xv->xr_clusters = 0;
-        xv->xr_last_eb_blk = 0;
-        xv->xr_list.l_tree_depth = 0;
-        xv->xr_list.l_count = cpu_to_le16(1);
-        xv->xr_list.l_next_free_rec = 0;
-        vb->vb_xv = xv;
-
-        ret = ocfs2_xattr_value_truncate(inode, vb, xi->value_len, ctxt);
-        if (ret < 0) {
-                mlog_errno(ret);
-                return ret;
+/* Can we reuse loc->xl_entry for xi? */
+static int ocfs2_xa_can_reuse_entry(struct ocfs2_xa_loc *loc,
+                                    struct ocfs2_xattr_info *xi)
+{
+        return loc->xl_ops->xlo_can_reuse(loc, xi);
+}
+
+/* How much free space is needed to set the new value */
+static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc,
+                                struct ocfs2_xattr_info *xi)
+{
+        return loc->xl_ops->xlo_check_space(loc, xi);
+}
+
+static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+{
+        loc->xl_ops->xlo_add_entry(loc, name_hash);
+        loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash);
+        /*
+         * We can't leave the new entry's xe_name_offset at zero or
+         * add_namevalue() will go nuts.  We set it to the size of our
+         * storage so that it can never be less than any other entry.
+         */
+        loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size);
+}
+
+static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc,
+                                   struct ocfs2_xattr_info *xi)
+{
+        int size = namevalue_size_xi(xi);
+        int nameval_offset;
+        char *nameval_buf;
+
+        loc->xl_ops->xlo_add_namevalue(loc, size);
+        loc->xl_entry->xe_value_size = cpu_to_le64(xi->xi_value_len);
+        loc->xl_entry->xe_name_len = xi->xi_name_len;
+        ocfs2_xattr_set_type(loc->xl_entry, xi->xi_name_index);
+        ocfs2_xattr_set_local(loc->xl_entry,
+                              xi->xi_value_len <= OCFS2_XATTR_INLINE_SIZE);
+
+        nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        nameval_buf = ocfs2_xa_offset_pointer(loc, nameval_offset);
+        memset(nameval_buf, 0, size);
+        memcpy(nameval_buf, xi->xi_name, xi->xi_name_len);
+}
+
+static void ocfs2_xa_fill_value_buf(struct ocfs2_xa_loc *loc,
+                                    struct ocfs2_xattr_value_buf *vb)
+{
+        int nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        int name_size = OCFS2_XATTR_SIZE(loc->xl_entry->xe_name_len);
+
+        /* Value bufs are for value trees */
+        BUG_ON(ocfs2_xattr_is_local(loc->xl_entry));
+        BUG_ON(namevalue_size_xe(loc->xl_entry) !=
+               (name_size + OCFS2_XATTR_ROOT_SIZE));
+
+        loc->xl_ops->xlo_fill_value_buf(loc, vb);
+        vb->vb_xv =
+                (struct ocfs2_xattr_value_root *)ocfs2_xa_offset_pointer(loc,
+                                                        nameval_offset +
+                                                        name_size);
+}
+
+static int ocfs2_xa_block_journal_access(handle_t *handle,
+                                         struct ocfs2_xa_loc *loc, int type)
+{
+        struct buffer_head *bh = loc->xl_storage;
+        ocfs2_journal_access_func access;
+
+        if (loc->xl_size == (bh->b_size -
+                             offsetof(struct ocfs2_xattr_block,
+                                      xb_attrs.xb_header)))
+                access = ocfs2_journal_access_xb;
+        else
+                access = ocfs2_journal_access_di;
+        return access(handle, INODE_CACHE(loc->xl_inode), bh, type);
+}
+
+static void ocfs2_xa_block_journal_dirty(handle_t *handle,
+                                         struct ocfs2_xa_loc *loc)
+{
+        struct buffer_head *bh = loc->xl_storage;
+
+        ocfs2_journal_dirty(handle, bh);
+}
+
+static void *ocfs2_xa_block_offset_pointer(struct ocfs2_xa_loc *loc,
+                                           int offset)
+{
+        return (char *)loc->xl_header + offset;
+}
+
+static int ocfs2_xa_block_can_reuse(struct ocfs2_xa_loc *loc,
+                                    struct ocfs2_xattr_info *xi)
+{
+        /*
+         * Block storage is strict.  If the sizes aren't exact, we will
+         * remove the old one and reinsert the new.
+         */
+        return namevalue_size_xe(loc->xl_entry) ==
+                namevalue_size_xi(xi);
+}
+
+static int ocfs2_xa_block_get_free_start(struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        int i, count = le16_to_cpu(xh->xh_count);
+        int offset, free_start = loc->xl_size;
+
+        for (i = 0; i < count; i++) {
+                offset = le16_to_cpu(xh->xh_entries[i].xe_name_offset);
+                if (offset < free_start)
+                        free_start = offset;
         }
-        ret = ocfs2_xattr_update_entry(inode, ctxt->handle, xi, xs, vb, offs);
-        if (ret < 0) {
-                mlog_errno(ret);
-                return ret;
+
+        return free_start;
+}
+
+static int ocfs2_xa_block_check_space(struct ocfs2_xa_loc *loc,
+                                      struct ocfs2_xattr_info *xi)
+{
+        int count = le16_to_cpu(loc->xl_header->xh_count);
+        int free_start = ocfs2_xa_get_free_start(loc);
+        int needed_space = ocfs2_xi_entry_usage(xi);
+
+        /*
+         * Block storage will reclaim the original entry before inserting
+         * the new value, so we only need the difference.  If the new
+         * entry is smaller than the old one, we don't need anything.
+         */
+        if (loc->xl_entry) {
+                /* Don't need space if we're reusing! */
+                if (ocfs2_xa_can_reuse_entry(loc, xi))
+                        needed_space = 0;
+                else
+                        needed_space -= ocfs2_xe_entry_usage(loc->xl_entry);
         }
-        ret = __ocfs2_xattr_set_value_outside(inode, ctxt->handle, vb,
-                                              xi->value, xi->value_len);
-        if (ret < 0)
-                mlog_errno(ret);
+        if (needed_space < 0)
+                needed_space = 0;
+        return ocfs2_xa_check_space_helper(needed_space, free_start, count);
+}
 
-        return ret;
+/*
+ * Block storage for xattrs keeps the name+value pairs compacted.  When
+ * we remove one, we have to shift any that preceded it towards the end.
+ */
+static void ocfs2_xa_block_wipe_namevalue(struct ocfs2_xa_loc *loc)
+{
+        int i, offset;
+        int namevalue_offset, first_namevalue_offset, namevalue_size;
+        struct ocfs2_xattr_entry *entry = loc->xl_entry;
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        int count = le16_to_cpu(xh->xh_count);
+
+        namevalue_offset = le16_to_cpu(entry->xe_name_offset);
+        namevalue_size = namevalue_size_xe(entry);
+        first_namevalue_offset = ocfs2_xa_get_free_start(loc);
+
+        /* Shift the name+value pairs */
+        memmove((char *)xh + first_namevalue_offset + namevalue_size,
+                (char *)xh + first_namevalue_offset,
+                namevalue_offset - first_namevalue_offset);
+        memset((char *)xh + first_namevalue_offset, 0, namevalue_size);
+
+        /* Now tell xh->xh_entries about it */
+        for (i = 0; i < count; i++) {
+                offset = le16_to_cpu(xh->xh_entries[i].xe_name_offset);
+                if (offset < namevalue_offset)
+                        le16_add_cpu(&xh->xh_entries[i].xe_name_offset,
+                                     namevalue_size);
+        }
+
+        /*
+         * Note that we don't update xh_free_start or xh_name_value_len
+         * because they're not used in block-stored xattrs.
+         */
+}
+
+static void ocfs2_xa_block_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+{
+        int count = le16_to_cpu(loc->xl_header->xh_count);
+        loc->xl_entry = &(loc->xl_header->xh_entries[count]);
+        le16_add_cpu(&loc->xl_header->xh_count, 1);
+        memset(loc->xl_entry, 0, sizeof(struct ocfs2_xattr_entry));
+}
+
+static void ocfs2_xa_block_add_namevalue(struct ocfs2_xa_loc *loc, int size)
+{
+        int free_start = ocfs2_xa_get_free_start(loc);
+
+        loc->xl_entry->xe_name_offset = cpu_to_le16(free_start - size);
+}
+
+static void ocfs2_xa_block_fill_value_buf(struct ocfs2_xa_loc *loc,
+                                          struct ocfs2_xattr_value_buf *vb)
+{
+        struct buffer_head *bh = loc->xl_storage;
+
+        if (loc->xl_size == (bh->b_size -
+                             offsetof(struct ocfs2_xattr_block,
+                                      xb_attrs.xb_header)))
+                vb->vb_access = ocfs2_journal_access_xb;
+        else
+                vb->vb_access = ocfs2_journal_access_di;
+        vb->vb_bh = bh;
 }
 
 /*
- * ocfs2_xattr_set_entry_local()
- *
- * Set, replace or remove extended attribute in local.
+ * Operations for xattrs stored in blocks.  This includes inline inode
+ * storage and unindexed ocfs2_xattr_blocks.
  */
-static void ocfs2_xattr_set_entry_local(struct inode *inode,
-                                        struct ocfs2_xattr_info *xi,
-                                        struct ocfs2_xattr_search *xs,
-                                        struct ocfs2_xattr_entry *last,
-                                        size_t min_offs)
+static const struct ocfs2_xa_loc_operations ocfs2_xa_block_loc_ops = {
+        .xlo_journal_access     = ocfs2_xa_block_journal_access,
+        .xlo_journal_dirty      = ocfs2_xa_block_journal_dirty,
+        .xlo_offset_pointer     = ocfs2_xa_block_offset_pointer,
+        .xlo_check_space        = ocfs2_xa_block_check_space,
+        .xlo_can_reuse          = ocfs2_xa_block_can_reuse,
+        .xlo_get_free_start     = ocfs2_xa_block_get_free_start,
+        .xlo_wipe_namevalue     = ocfs2_xa_block_wipe_namevalue,
+        .xlo_add_entry          = ocfs2_xa_block_add_entry,
+        .xlo_add_namevalue      = ocfs2_xa_block_add_namevalue,
+        .xlo_fill_value_buf     = ocfs2_xa_block_fill_value_buf,
+};
+
+static int ocfs2_xa_bucket_journal_access(handle_t *handle,
+                                          struct ocfs2_xa_loc *loc, int type)
 {
-        size_t name_len = strlen(xi->name);
-        int i;
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
 
-        if (xi->value && xs->not_found) {
-                /* Insert the new xattr entry. */
-                le16_add_cpu(&xs->header->xh_count, 1);
-                ocfs2_xattr_set_type(last, xi->name_index);
-                ocfs2_xattr_set_local(last, 1);
-                last->xe_name_len = name_len;
-        } else {
-                void *first_val;
-                void *val;
-                size_t offs, size;
-
-                first_val = xs->base + min_offs;
-                offs = le16_to_cpu(xs->here->xe_name_offset);
-                val = xs->base + offs;
-
-                if (le64_to_cpu(xs->here->xe_value_size) >
-                    OCFS2_XATTR_INLINE_SIZE)
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_ROOT_SIZE;
+        return ocfs2_xattr_bucket_journal_access(handle, bucket, type);
+}
+
+static void ocfs2_xa_bucket_journal_dirty(handle_t *handle,
+                                          struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+
+        ocfs2_xattr_bucket_journal_dirty(handle, bucket);
+}
+
+static void *ocfs2_xa_bucket_offset_pointer(struct ocfs2_xa_loc *loc,
+                                            int offset)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+        int block, block_offset;
+
+        /* The header is at the front of the bucket */
+        block = offset >> loc->xl_inode->i_sb->s_blocksize_bits;
+        block_offset = offset % loc->xl_inode->i_sb->s_blocksize;
+
+        return bucket_block(bucket, block) + block_offset;
+}
+
+static int ocfs2_xa_bucket_can_reuse(struct ocfs2_xa_loc *loc,
+                                     struct ocfs2_xattr_info *xi)
+{
+        return namevalue_size_xe(loc->xl_entry) >=
+                namevalue_size_xi(xi);
+}
+
+static int ocfs2_xa_bucket_get_free_start(struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+        return le16_to_cpu(bucket_xh(bucket)->xh_free_start);
+}
+
+static int ocfs2_bucket_align_free_start(struct super_block *sb,
+                                         int free_start, int size)
+{
+        /*
+         * We need to make sure that the name+value pair fits within
+         * one block.
+         */
+        if (((free_start - size) >> sb->s_blocksize_bits) !=
+            ((free_start - 1) >> sb->s_blocksize_bits))
+                free_start -= free_start % sb->s_blocksize;
+
+        return free_start;
+}
+
+static int ocfs2_xa_bucket_check_space(struct ocfs2_xa_loc *loc,
+                                       struct ocfs2_xattr_info *xi)
+{
+        int rc;
+        int count = le16_to_cpu(loc->xl_header->xh_count);
+        int free_start = ocfs2_xa_get_free_start(loc);
+        int needed_space = ocfs2_xi_entry_usage(xi);
+        int size = namevalue_size_xi(xi);
+        struct super_block *sb = loc->xl_inode->i_sb;
+
+        /*
+         * Bucket storage does not reclaim name+value pairs it cannot
+         * reuse.  They live as holes until the bucket fills, and then
+         * the bucket is defragmented.  However, the bucket can reclaim
+         * the ocfs2_xattr_entry.
+         */
+        if (loc->xl_entry) {
+                /* Don't need space if we're reusing! */
+                if (ocfs2_xa_can_reuse_entry(loc, xi))
+                        needed_space = 0;
                 else
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xs->here->xe_value_size));
-
-                if (xi->value && size == OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_SIZE(xi->value_len)) {
-                        /* The old and the new value have the
-                           same size. Just replace the value. */
-                        ocfs2_xattr_set_local(xs->here, 1);
-                        xs->here->xe_value_size = cpu_to_le64(xi->value_len);
-                        /* Clear value bytes. */
-                        memset(val + OCFS2_XATTR_SIZE(name_len),
-                               0,
-                               OCFS2_XATTR_SIZE(xi->value_len));
-                        memcpy(val + OCFS2_XATTR_SIZE(name_len),
-                               xi->value,
-                               xi->value_len);
-                        return;
-                }
-                /* Remove the old name+value. */
-                memmove(first_val + size, first_val, val - first_val);
-                memset(first_val, 0, size);
-                xs->here->xe_name_hash = 0;
-                xs->here->xe_name_offset = 0;
-                ocfs2_xattr_set_local(xs->here, 1);
-                xs->here->xe_value_size = 0;
-
-                min_offs += size;
-
-                /* Adjust all value offsets. */
-                last = xs->header->xh_entries;
-                for (i = 0 ; i < le16_to_cpu(xs->header->xh_count); i++) {
-                        size_t o = le16_to_cpu(last->xe_name_offset);
-
-                        if (o < offs)
-                                last->xe_name_offset = cpu_to_le16(o + size);
-                        last += 1;
-                }
+                        needed_space -= sizeof(struct ocfs2_xattr_entry);
+        }
+        BUG_ON(needed_space < 0);
 
-                if (!xi->value) {
-                        /* Remove the old entry. */
-                        last -= 1;
-                        memmove(xs->here, xs->here + 1,
-                                (void *)last - (void *)xs->here);
-                        memset(last, 0, sizeof(struct ocfs2_xattr_entry));
-                        le16_add_cpu(&xs->header->xh_count, -1);
-                }
+        if (free_start < size) {
+                if (needed_space)
+                        return -ENOSPC;
+        } else {
+                /*
+                 * First we check if it would fit in the first place.
+                 * Below, we align the free start to a block.  This may
+                 * slide us below the minimum gap.  By checking unaligned
+                 * first, we avoid that error.
+                 */
+                rc = ocfs2_xa_check_space_helper(needed_space, free_start,
+                                                 count);
+                if (rc)
+                        return rc;
+                free_start = ocfs2_bucket_align_free_start(sb, free_start,
+                                                           size);
         }
-        if (xi->value) {
-                /* Insert the new name+value. */
-                size_t size = OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_SIZE(xi->value_len);
-                void *val = xs->base + min_offs - size;
+        return ocfs2_xa_check_space_helper(needed_space, free_start, count);
+}
+
+static void ocfs2_xa_bucket_wipe_namevalue(struct ocfs2_xa_loc *loc)
+{
+        le16_add_cpu(&loc->xl_header->xh_name_value_len,
+                     -namevalue_size_xe(loc->xl_entry));
+}
 
-                xs->here->xe_name_offset = cpu_to_le16(min_offs - size);
-                memset(val, 0, size);
-                memcpy(val, xi->name, name_len);
-                memcpy(val + OCFS2_XATTR_SIZE(name_len),
-                       xi->value,
-                       xi->value_len);
-                xs->here->xe_value_size = cpu_to_le64(xi->value_len);
-                ocfs2_xattr_set_local(xs->here, 1);
-                ocfs2_xattr_hash_entry(inode, xs->header, xs->here);
+static void ocfs2_xa_bucket_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
+{
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        int count = le16_to_cpu(xh->xh_count);
+        int low = 0, high = count - 1, tmp;
+        struct ocfs2_xattr_entry *tmp_xe;
+
+        /*
+         * We keep buckets sorted by name_hash, so we need to find
+         * our insert place.
+         */
+        while (low <= high && count) {
+                tmp = (low + high) / 2;
+                tmp_xe = &xh->xh_entries[tmp];
+
+                if (name_hash > le32_to_cpu(tmp_xe->xe_name_hash))
+                        low = tmp + 1;
+                else if (name_hash < le32_to_cpu(tmp_xe->xe_name_hash))
+                        high = tmp - 1;
+                else {
+                        low = tmp;
+                        break;
+                }
         }
 
-        return;
+        if (low != count)
+                memmove(&xh->xh_entries[low + 1],
+                        &xh->xh_entries[low],
+                        ((count - low) * sizeof(struct ocfs2_xattr_entry)));
+
+        le16_add_cpu(&xh->xh_count, 1);
+        loc->xl_entry = &xh->xh_entries[low];
+        memset(loc->xl_entry, 0, sizeof(struct ocfs2_xattr_entry));
+}
+
+static void ocfs2_xa_bucket_add_namevalue(struct ocfs2_xa_loc *loc, int size)
+{
+        int free_start = ocfs2_xa_get_free_start(loc);
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        struct super_block *sb = loc->xl_inode->i_sb;
+        int nameval_offset;
+
+        free_start = ocfs2_bucket_align_free_start(sb, free_start, size);
+        nameval_offset = free_start - size;
+        loc->xl_entry->xe_name_offset = cpu_to_le16(nameval_offset);
+        xh->xh_free_start = cpu_to_le16(nameval_offset);
+        le16_add_cpu(&xh->xh_name_value_len, size);
+
+}
+
+static void ocfs2_xa_bucket_fill_value_buf(struct ocfs2_xa_loc *loc,
+                                           struct ocfs2_xattr_value_buf *vb)
+{
+        struct ocfs2_xattr_bucket *bucket = loc->xl_storage;
+        struct super_block *sb = loc->xl_inode->i_sb;
+        int nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        int size = namevalue_size_xe(loc->xl_entry);
+        int block_offset = nameval_offset >> sb->s_blocksize_bits;
+
+        /* Values are not allowed to straddle block boundaries */
+        BUG_ON(block_offset !=
+               ((nameval_offset + size - 1) >> sb->s_blocksize_bits));
+        /* We expect the bucket to be filled in */
+        BUG_ON(!bucket->bu_bhs[block_offset]);
+
+        vb->vb_access = ocfs2_journal_access;
+        vb->vb_bh = bucket->bu_bhs[block_offset];
+}
+
+/* Operations for xattrs stored in buckets. */
+static const struct ocfs2_xa_loc_operations ocfs2_xa_bucket_loc_ops = {
+        .xlo_journal_access     = ocfs2_xa_bucket_journal_access,
+        .xlo_journal_dirty      = ocfs2_xa_bucket_journal_dirty,
+        .xlo_offset_pointer     = ocfs2_xa_bucket_offset_pointer,
+        .xlo_check_space        = ocfs2_xa_bucket_check_space,
+        .xlo_can_reuse          = ocfs2_xa_bucket_can_reuse,
+        .xlo_get_free_start     = ocfs2_xa_bucket_get_free_start,
+        .xlo_wipe_namevalue     = ocfs2_xa_bucket_wipe_namevalue,
+        .xlo_add_entry          = ocfs2_xa_bucket_add_entry,
+        .xlo_add_namevalue      = ocfs2_xa_bucket_add_namevalue,
+        .xlo_fill_value_buf     = ocfs2_xa_bucket_fill_value_buf,
+};
+
+static unsigned int ocfs2_xa_value_clusters(struct ocfs2_xa_loc *loc)
+{
+        struct ocfs2_xattr_value_buf vb;
+
+        if (ocfs2_xattr_is_local(loc->xl_entry))
+                return 0;
+
+        ocfs2_xa_fill_value_buf(loc, &vb);
+        return le32_to_cpu(vb.vb_xv->xr_clusters);
+}
+
+static int ocfs2_xa_value_truncate(struct ocfs2_xa_loc *loc, u64 bytes,
+                                   struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int trunc_rc, access_rc;
+        struct ocfs2_xattr_value_buf vb;
+
+        ocfs2_xa_fill_value_buf(loc, &vb);
+        trunc_rc = ocfs2_xattr_value_truncate(loc->xl_inode, &vb, bytes,
+                                              ctxt);
+
+        /*
+         * The caller of ocfs2_xa_value_truncate() has already called
+         * ocfs2_xa_journal_access on the loc.  However, The truncate code
+         * calls ocfs2_extend_trans().  This may commit the previous
+         * transaction and open a new one.  If this is a bucket, truncate
+         * could leave only vb->vb_bh set up for journaling.  Meanwhile,
+         * the caller is expecting to dirty the entire bucket.  So we must
+         * reset the journal work.  We do this even if truncate has failed,
+         * as it could have failed after committing the extend.
+         */
+        access_rc = ocfs2_xa_journal_access(ctxt->handle, loc,
+                                            OCFS2_JOURNAL_ACCESS_WRITE);
+
+        /* Errors in truncate take precedence */
+        return trunc_rc ? trunc_rc : access_rc;
+}
+
+static void ocfs2_xa_remove_entry(struct ocfs2_xa_loc *loc)
+{
+        int index, count;
+        struct ocfs2_xattr_header *xh = loc->xl_header;
+        struct ocfs2_xattr_entry *entry = loc->xl_entry;
+
+        ocfs2_xa_wipe_namevalue(loc);
+        loc->xl_entry = NULL;
+
+        le16_add_cpu(&xh->xh_count, -1);
+        count = le16_to_cpu(xh->xh_count);
+
+        /*
+         * Only zero out the entry if there are more remaining.  This is
+         * important for an empty bucket, as it keeps track of the
+         * bucket's hash value.  It doesn't hurt empty block storage.
+         */
+        if (count) {
+                index = ((char *)entry - (char *)&xh->xh_entries) /
+                        sizeof(struct ocfs2_xattr_entry);
+                memmove(&xh->xh_entries[index], &xh->xh_entries[index + 1],
+                        (count - index) * sizeof(struct ocfs2_xattr_entry));
+                memset(&xh->xh_entries[count], 0,
+                       sizeof(struct ocfs2_xattr_entry));
+        }
 }
 
 /*
- * ocfs2_xattr_set_entry()
+ * If we have a problem adjusting the size of an external value during
+ * ocfs2_xa_prepare_entry() or ocfs2_xa_remove(), we may have an xattr
+ * in an intermediate state.  For example, the value may be partially
+ * truncated.
+ *
+ * If the value tree hasn't changed, the extend/truncate went nowhere.
+ * We have nothing to do.  The caller can treat it as a straight error.
  *
- * Set extended attribute entry into inode or block.
+ * If the value tree got partially truncated, we now have a corrupted
+ * extended attribute.  We're going to wipe its entry and leak the
+ * clusters.  Better to leak some storage than leave a corrupt entry.
  *
- * If extended attribute value size > OCFS2_XATTR_INLINE_SIZE,
- * We first insert tree root(ocfs2_xattr_value_root) with set_entry_local(),
- * then set value in B tree with set_value_outside().
+ * If the value tree grew, it obviously didn't grow enough for the
+ * new entry.  We're not going to try and reclaim those clusters either.
+ * If there was already an external value there (orig_clusters != 0),
+ * the new clusters are attached safely and we can just leave the old
+ * value in place.  If there was no external value there, we remove
+ * the entry.
+ *
+ * This way, the xattr block we store in the journal will be consistent.
+ * If the size change broke because of the journal, no changes will hit
+ * disk anyway.
  */
-static int ocfs2_xattr_set_entry(struct inode *inode,
-                                 struct ocfs2_xattr_info *xi,
-                                 struct ocfs2_xattr_search *xs,
-                                 struct ocfs2_xattr_set_ctxt *ctxt,
-                                 int flag)
-{
-        struct ocfs2_xattr_entry *last;
-        struct ocfs2_inode_info *oi = OCFS2_I(inode);
-        struct ocfs2_dinode *di = (struct ocfs2_dinode *)xs->inode_bh->b_data;
-        size_t min_offs = xs->end - xs->base, name_len = strlen(xi->name);
-        size_t size_l = 0;
-        handle_t *handle = ctxt->handle;
-        int free, i, ret;
-        struct ocfs2_xattr_info xi_l = {
-                .name_index = xi->name_index,
-                .name = xi->name,
-                .value = xi->value,
-                .value_len = xi->value_len,
-        };
-        struct ocfs2_xattr_value_buf vb = {
-                .vb_bh = xs->xattr_bh,
-                .vb_access = ocfs2_journal_access_di,
-        };
+static void ocfs2_xa_cleanup_value_truncate(struct ocfs2_xa_loc *loc,
+                                            const char *what,
+                                            unsigned int orig_clusters)
+{
+        unsigned int new_clusters = ocfs2_xa_value_clusters(loc);
+        char *nameval_buf = ocfs2_xa_offset_pointer(loc,
+                                le16_to_cpu(loc->xl_entry->xe_name_offset));
+
+        if (new_clusters < orig_clusters) {
+                mlog(ML_ERROR,
+                     "Partial truncate while %s xattr %.*s.  Leaking "
+                     "%u clusters and removing the entry\n",
+                     what, loc->xl_entry->xe_name_len, nameval_buf,
+                     orig_clusters - new_clusters);
+                ocfs2_xa_remove_entry(loc);
+        } else if (!orig_clusters) {
+                mlog(ML_ERROR,
+                     "Unable to allocate an external value for xattr "
+                     "%.*s safely.  Leaking %u clusters and removing the "
+                     "entry\n",
+                     loc->xl_entry->xe_name_len, nameval_buf,
+                     new_clusters - orig_clusters);
+                ocfs2_xa_remove_entry(loc);
+        } else if (new_clusters > orig_clusters)
+                mlog(ML_ERROR,
+                     "Unable to grow xattr %.*s safely.  %u new clusters "
+                     "have been added, but the value will not be "
+                     "modified\n",
+                     loc->xl_entry->xe_name_len, nameval_buf,
+                     new_clusters - orig_clusters);
+}
+
+static int ocfs2_xa_remove(struct ocfs2_xa_loc *loc,
+                           struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        unsigned int orig_clusters;
+
+        if (!ocfs2_xattr_is_local(loc->xl_entry)) {
+                orig_clusters = ocfs2_xa_value_clusters(loc);
+                rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+                if (rc) {
+                        mlog_errno(rc);
+                        /*
+                         * Since this is remove, we can return 0 if
+                         * ocfs2_xa_cleanup_value_truncate() is going to
+                         * wipe the entry anyway.  So we check the
+                         * cluster count as well.
+                         */
+                        if (orig_clusters != ocfs2_xa_value_clusters(loc))
+                                rc = 0;
+                        ocfs2_xa_cleanup_value_truncate(loc, "removing",
+                                                        orig_clusters);
+                        if (rc)
+                                goto out;
+                }
+        }
 
-        if (!(flag & OCFS2_INLINE_XATTR_FL)) {
-                BUG_ON(xs->xattr_bh == xs->inode_bh);
-                vb.vb_access = ocfs2_journal_access_xb;
-        } else
-                BUG_ON(xs->xattr_bh != xs->inode_bh);
+        ocfs2_xa_remove_entry(loc);
 
-        /* Compute min_offs, last and free space. */
-        last = xs->header->xh_entries;
+out:
+        return rc;
+}
 
-        for (i = 0 ; i < le16_to_cpu(xs->header->xh_count); i++) {
-                size_t offs = le16_to_cpu(last->xe_name_offset);
-                if (offs < min_offs)
-                        min_offs = offs;
-                last += 1;
-        }
+static void ocfs2_xa_install_value_root(struct ocfs2_xa_loc *loc)
+{
+        int name_size = OCFS2_XATTR_SIZE(loc->xl_entry->xe_name_len);
+        char *nameval_buf;
 
-        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
-        if (free < 0)
-                return -EIO;
+        nameval_buf = ocfs2_xa_offset_pointer(loc,
+                                le16_to_cpu(loc->xl_entry->xe_name_offset));
+        memcpy(nameval_buf + name_size, &def_xv, OCFS2_XATTR_ROOT_SIZE);
+}
 
-        if (!xs->not_found) {
-                size_t size = 0;
-                if (ocfs2_xattr_is_local(xs->here))
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xs->here->xe_value_size));
-                else
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                                OCFS2_XATTR_ROOT_SIZE;
-                free += (size + sizeof(struct ocfs2_xattr_entry));
-        }
-        /* Check free space in inode or block */
-        if (xi->value && xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
-                if (free < sizeof(struct ocfs2_xattr_entry) +
-                           OCFS2_XATTR_SIZE(name_len) +
-                           OCFS2_XATTR_ROOT_SIZE) {
-                        ret = -ENOSPC;
-                        goto out;
+/*
+ * Take an existing entry and make it ready for the new value.  This
+ * won't allocate space, but it may free space.  It should be ready for
+ * ocfs2_xa_prepare_entry() to finish the work.
+ */
+static int ocfs2_xa_reuse_entry(struct ocfs2_xa_loc *loc,
+                                struct ocfs2_xattr_info *xi,
+                                struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        int name_size = OCFS2_XATTR_SIZE(xi->xi_name_len);
+        unsigned int orig_clusters;
+        char *nameval_buf;
+        int xe_local = ocfs2_xattr_is_local(loc->xl_entry);
+        int xi_local = xi->xi_value_len <= OCFS2_XATTR_INLINE_SIZE;
+
+        BUG_ON(OCFS2_XATTR_SIZE(loc->xl_entry->xe_name_len) !=
+               name_size);
+
+        nameval_buf = ocfs2_xa_offset_pointer(loc,
+                                le16_to_cpu(loc->xl_entry->xe_name_offset));
+        if (xe_local) {
+                memset(nameval_buf + name_size, 0,
+                       namevalue_size_xe(loc->xl_entry) - name_size);
+                if (!xi_local)
+                        ocfs2_xa_install_value_root(loc);
+        } else {
+                orig_clusters = ocfs2_xa_value_clusters(loc);
+                if (xi_local) {
+                        rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+                        if (rc < 0)
+                                mlog_errno(rc);
+                        else
+                                memset(nameval_buf + name_size, 0,
+                                       namevalue_size_xe(loc->xl_entry) -
+                                       name_size);
+                } else if (le64_to_cpu(loc->xl_entry->xe_value_size) >
+                           xi->xi_value_len) {
+                        rc = ocfs2_xa_value_truncate(loc, xi->xi_value_len,
+                                                     ctxt);
+                        if (rc < 0)
+                                mlog_errno(rc);
                 }
-                size_l = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_ROOT_SIZE;
-                xi_l.value = (void *)&def_xv;
-                xi_l.value_len = OCFS2_XATTR_ROOT_SIZE;
-        } else if (xi->value) {
-                if (free < sizeof(struct ocfs2_xattr_entry) +
-                           OCFS2_XATTR_SIZE(name_len) +
-                           OCFS2_XATTR_SIZE(xi->value_len)) {
-                        ret = -ENOSPC;
+
+                if (rc) {
+                        ocfs2_xa_cleanup_value_truncate(loc, "reusing",
+                                                        orig_clusters);
                         goto out;
                 }
         }
 
-        if (!xs->not_found) {
-                /* For existing extended attribute */
-                size_t size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xs->here->xe_value_size));
-                size_t offs = le16_to_cpu(xs->here->xe_name_offset);
-                void *val = xs->base + offs;
+        loc->xl_entry->xe_value_size = cpu_to_le64(xi->xi_value_len);
+        ocfs2_xattr_set_local(loc->xl_entry, xi_local);
 
-                if (ocfs2_xattr_is_local(xs->here) && size == size_l) {
-                        /* Replace existing local xattr with tree root */
-                        ret = ocfs2_xattr_set_value_outside(inode, xi, xs,
-                                                            ctxt, &vb, offs);
-                        if (ret < 0)
-                                mlog_errno(ret);
-                        goto out;
-                } else if (!ocfs2_xattr_is_local(xs->here)) {
-                        /* For existing xattr which has value outside */
-                        vb.vb_xv = (struct ocfs2_xattr_value_root *)
-                                (val + OCFS2_XATTR_SIZE(name_len));
+out:
+        return rc;
+}
 
-                        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
-                                /*
-                                 * If new value need set outside also,
-                                 * first truncate old value to new value,
-                                 * then set new value with set_value_outside().
-                                 */
-                                ret = ocfs2_xattr_value_truncate(inode,
-                                                                 &vb,
-                                                                 xi->value_len,
-                                                                 ctxt);
-                                if (ret < 0) {
-                                        mlog_errno(ret);
-                                        goto out;
-                                }
+/*
+ * Prepares loc->xl_entry to receive the new xattr.  This includes
+ * properly setting up the name+value pair region.  If loc->xl_entry
+ * already exists, it will take care of modifying it appropriately.
+ *
+ * Note that this modifies the data.  You did journal_access already,
+ * right?
+ */
+static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc,
+                                  struct ocfs2_xattr_info *xi,
+                                  u32 name_hash,
+                                  struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        unsigned int orig_clusters;
+        __le64 orig_value_size = 0;
 
-                                ret = ocfs2_xattr_update_entry(inode,
-                                                               handle,
-                                                               xi,
-                                                               xs,
-                                                               &vb,
-                                                               offs);
-                                if (ret < 0) {
-                                        mlog_errno(ret);
-                                        goto out;
-                                }
+        rc = ocfs2_xa_check_space(loc, xi);
+        if (rc)
+                goto out;
 
-                                ret = __ocfs2_xattr_set_value_outside(inode,
-                                                                handle,
-                                                                &vb,
-                                                                xi->value,
-                                                                xi->value_len);
-                                if (ret < 0)
-                                        mlog_errno(ret);
+        if (loc->xl_entry) {
+                if (ocfs2_xa_can_reuse_entry(loc, xi)) {
+                        orig_value_size = loc->xl_entry->xe_value_size;
+                        rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
+                        if (rc)
+                                goto out;
+                        goto alloc_value;
+                }
+
+                if (!ocfs2_xattr_is_local(loc->xl_entry)) {
+                        orig_clusters = ocfs2_xa_value_clusters(loc);
+                        rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
+                        if (rc) {
+                                mlog_errno(rc);
+                                ocfs2_xa_cleanup_value_truncate(loc,
+                                                                "overwriting",
+                                                                orig_clusters);
                                 goto out;
-                        } else {
-                                /*
-                                 * If new value need set in local,
-                                 * just trucate old value to zero.
-                                 */
-                                 ret = ocfs2_xattr_value_truncate(inode,
-                                                                  &vb,
-                                                                  0,
-                                                                  ctxt);
-                                if (ret < 0)
-                                        mlog_errno(ret);
                         }
                 }
+                ocfs2_xa_wipe_namevalue(loc);
+        } else
+                ocfs2_xa_add_entry(loc, name_hash);
+
+        /*
+         * If we get here, we have a blank entry.  Fill it.  We grow our
+         * name+value pair back from the end.
+         */
+        ocfs2_xa_add_namevalue(loc, xi);
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
+                ocfs2_xa_install_value_root(loc);
+
+alloc_value:
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
+                orig_clusters = ocfs2_xa_value_clusters(loc);
+                rc = ocfs2_xa_value_truncate(loc, xi->xi_value_len, ctxt);
+                if (rc < 0) {
+                        /*
+                         * If we tried to grow an existing external value,
+                         * ocfs2_xa_cleanuP-value_truncate() is going to
+                         * let it stand.  We have to restore its original
+                         * value size.
+                         */
+                        loc->xl_entry->xe_value_size = orig_value_size;
+                        ocfs2_xa_cleanup_value_truncate(loc, "growing",
+                                                        orig_clusters);
+                        mlog_errno(rc);
+                }
         }
 
-        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), xs->inode_bh,
+out:
+        return rc;
+}
+
+/*
+ * Store the value portion of the name+value pair.  This will skip
+ * values that are stored externally.  Their tree roots were set up
+ * by ocfs2_xa_prepare_entry().
+ */
+static int ocfs2_xa_store_value(struct ocfs2_xa_loc *loc,
+                                struct ocfs2_xattr_info *xi,
+                                struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int rc = 0;
+        int nameval_offset = le16_to_cpu(loc->xl_entry->xe_name_offset);
+        int name_size = OCFS2_XATTR_SIZE(xi->xi_name_len);
+        char *nameval_buf;
+        struct ocfs2_xattr_value_buf vb;
+
+        nameval_buf = ocfs2_xa_offset_pointer(loc, nameval_offset);
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
+                ocfs2_xa_fill_value_buf(loc, &vb);
+                rc = __ocfs2_xattr_set_value_outside(loc->xl_inode,
+                                                     ctxt->handle, &vb,
+                                                     xi->xi_value,
+                                                     xi->xi_value_len);
+        } else
+                memcpy(nameval_buf + name_size, xi->xi_value, xi->xi_value_len);
+
+        return rc;
+}
+
+static int ocfs2_xa_set(struct ocfs2_xa_loc *loc,
+                        struct ocfs2_xattr_info *xi,
+                        struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int ret;
+        u32 name_hash = ocfs2_xattr_name_hash(loc->xl_inode, xi->xi_name,
+                                              xi->xi_name_len);
+
+        ret = ocfs2_xa_journal_access(ctxt->handle, loc,
                                       OCFS2_JOURNAL_ACCESS_WRITE);
         if (ret) {
                 mlog_errno(ret);
                 goto out;
         }
 
-        if (!(flag & OCFS2_INLINE_XATTR_FL)) {
-                ret = vb.vb_access(handle, INODE_CACHE(inode), vb.vb_bh,
-                                   OCFS2_JOURNAL_ACCESS_WRITE);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-        }
-
         /*
-         * Set value in local, include set tree root in local.
-         * This is the first step for value size >INLINE_SIZE.
+         * From here on out, everything is going to modify the buffer a
+         * little.  Errors are going to leave the xattr header in a
+         * sane state.  Thus, even with errors we dirty the sucker.
          */
-        ocfs2_xattr_set_entry_local(inode, &xi_l, xs, last, min_offs);
 
-        if (!(flag & OCFS2_INLINE_XATTR_FL)) {
-                ret = ocfs2_journal_dirty(handle, xs->xattr_bh);
-                if (ret < 0) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+        /* Don't worry, we are never called with !xi_value and !xl_entry */
+        if (!xi->xi_value) {
+                ret = ocfs2_xa_remove(loc, ctxt);
+                goto out_dirty;
         }
 
-        if (!(oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL) &&
-            (flag & OCFS2_INLINE_XATTR_FL)) {
-                struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-                unsigned int xattrsize = osb->s_xattr_inline_size;
-
-                /*
-                 * Adjust extent record count or inline data size
-                 * to reserve space for extended attribute.
-                 */
-                if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
-                        struct ocfs2_inline_data *idata = &di->id2.i_data;
-                        le16_add_cpu(&idata->id_count, -xattrsize);
-                } else if (!(ocfs2_inode_is_fast_symlink(inode))) {
-                        struct ocfs2_extent_list *el = &di->id2.i_list;
-                        le16_add_cpu(&el->l_count, -(xattrsize /
-                                        sizeof(struct ocfs2_extent_rec)));
-                }
-                di->i_xattr_inline_size = cpu_to_le16(xattrsize);
+        ret = ocfs2_xa_prepare_entry(loc, xi, name_hash, ctxt);
+        if (ret) {
+                if (ret != -ENOSPC)
+                        mlog_errno(ret);
+                goto out_dirty;
         }
-        /* Update xattr flag */
-        spin_lock(&oi->ip_lock);
-        oi->ip_dyn_features |= flag;
-        di->i_dyn_features = cpu_to_le16(oi->ip_dyn_features);
-        spin_unlock(&oi->ip_lock);
 
-        ret = ocfs2_journal_dirty(handle, xs->inode_bh);
-        if (ret < 0)
+        ret = ocfs2_xa_store_value(loc, xi, ctxt);
+        if (ret)
                 mlog_errno(ret);
 
-        if (!ret && xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
-                /*
-                 * Set value outside in B tree.
-                 * This is the second step for value size > INLINE_SIZE.
-                 */
-                size_t offs = le16_to_cpu(xs->here->xe_name_offset);
-                ret = ocfs2_xattr_set_value_outside(inode, xi, xs, ctxt,
-                                                    &vb, offs);
-                if (ret < 0) {
-                        int ret2;
+out_dirty:
+        ocfs2_xa_journal_dirty(ctxt->handle, loc);
 
-                        mlog_errno(ret);
-                        /*
-                         * If set value outside failed, we have to clean
-                         * the junk tree root we have already set in local.
-                         */
-                        ret2 = ocfs2_xattr_cleanup(inode, ctxt->handle,
-                                                   xi, xs, &vb, offs);
-                        if (ret2 < 0)
-                                mlog_errno(ret2);
-                }
-        }
 out:
         return ret;
 }
 
+static void ocfs2_init_dinode_xa_loc(struct ocfs2_xa_loc *loc,
+                                     struct inode *inode,
+                                     struct buffer_head *bh,
+                                     struct ocfs2_xattr_entry *entry)
+{
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
+
+        BUG_ON(!(OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_XATTR_FL));
+
+        loc->xl_inode = inode;
+        loc->xl_ops = &ocfs2_xa_block_loc_ops;
+        loc->xl_storage = bh;
+        loc->xl_entry = entry;
+        loc->xl_size = le16_to_cpu(di->i_xattr_inline_size);
+        loc->xl_header =
+                (struct ocfs2_xattr_header *)(bh->b_data + bh->b_size -
+                                              loc->xl_size);
+}
+
+static void ocfs2_init_xattr_block_xa_loc(struct ocfs2_xa_loc *loc,
+                                          struct inode *inode,
+                                          struct buffer_head *bh,
+                                          struct ocfs2_xattr_entry *entry)
+{
+        struct ocfs2_xattr_block *xb =
+                (struct ocfs2_xattr_block *)bh->b_data;
+
+        BUG_ON(le16_to_cpu(xb->xb_flags) & OCFS2_XATTR_INDEXED);
+
+        loc->xl_inode = inode;
+        loc->xl_ops = &ocfs2_xa_block_loc_ops;
+        loc->xl_storage = bh;
+        loc->xl_header = &(xb->xb_attrs.xb_header);
+        loc->xl_entry = entry;
+        loc->xl_size = bh->b_size - offsetof(struct ocfs2_xattr_block,
+                                             xb_attrs.xb_header);
+}
+
+static void ocfs2_init_xattr_bucket_xa_loc(struct ocfs2_xa_loc *loc,
+                                           struct ocfs2_xattr_bucket *bucket,
+                                           struct ocfs2_xattr_entry *entry)
+{
+        loc->xl_inode = bucket->bu_inode;
+        loc->xl_ops = &ocfs2_xa_bucket_loc_ops;
+        loc->xl_storage = bucket;
+        loc->xl_header = bucket_xh(bucket);
+        loc->xl_entry = entry;
+        loc->xl_size = OCFS2_XATTR_BUCKET_SIZE;
+}
+
 /*
  * In xattr remove, if it is stored outside and refcounted, we may have
  * the chance to split the refcount tree. So need the allocators.
@@ -2149,6 +2683,55 @@ static int ocfs2_xattr_ibody_find(struct inode *inode,
         return 0;
 }
 
+static int ocfs2_xattr_ibody_init(struct inode *inode,
+                                  struct buffer_head *di_bh,
+                                  struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int ret;
+        struct ocfs2_inode_info *oi = OCFS2_I(inode);
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
+        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+        unsigned int xattrsize = osb->s_xattr_inline_size;
+
+        if (!ocfs2_xattr_has_space_inline(inode, di)) {
+                ret = -ENOSPC;
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_di(ctxt->handle, INODE_CACHE(inode), di_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        /*
+         * Adjust extent record count or inline data size
+         * to reserve space for extended attribute.
+         */
+        if (oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                struct ocfs2_inline_data *idata = &di->id2.i_data;
+                le16_add_cpu(&idata->id_count, -xattrsize);
+        } else if (!(ocfs2_inode_is_fast_symlink(inode))) {
+                struct ocfs2_extent_list *el = &di->id2.i_list;
+                le16_add_cpu(&el->l_count, -(xattrsize /
+                                             sizeof(struct ocfs2_extent_rec)));
+        }
+        di->i_xattr_inline_size = cpu_to_le16(xattrsize);
+
+        spin_lock(&oi->ip_lock);
+        oi->ip_dyn_features |= OCFS2_INLINE_XATTR_FL|OCFS2_HAS_XATTR_FL;
+        di->i_dyn_features = cpu_to_le16(oi->ip_dyn_features);
+        spin_unlock(&oi->ip_lock);
+
+        ret = ocfs2_journal_dirty(ctxt->handle, di_bh);
+        if (ret < 0)
+                mlog_errno(ret);
+
+out:
+        return ret;
+}
+
 /*
  * ocfs2_xattr_ibody_set()
  *
@@ -2160,9 +2743,10 @@ static int ocfs2_xattr_ibody_set(struct inode *inode,
                                  struct ocfs2_xattr_search *xs,
                                  struct ocfs2_xattr_set_ctxt *ctxt)
 {
+        int ret;
         struct ocfs2_inode_info *oi = OCFS2_I(inode);
         struct ocfs2_dinode *di = (struct ocfs2_dinode *)xs->inode_bh->b_data;
-        int ret;
+        struct ocfs2_xa_loc loc;
 
         if (inode->i_sb->s_blocksize == OCFS2_MIN_BLOCKSIZE)
                 return -ENOSPC;
@@ -2175,8 +2759,25 @@ static int ocfs2_xattr_ibody_set(struct inode *inode,
                 }
         }
 
-        ret = ocfs2_xattr_set_entry(inode, xi, xs, ctxt,
-                                (OCFS2_INLINE_XATTR_FL | OCFS2_HAS_XATTR_FL));
+        if (!(oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL)) {
+                ret = ocfs2_xattr_ibody_init(inode, xs->inode_bh, ctxt);
+                if (ret) {
+                        if (ret != -ENOSPC)
+                                mlog_errno(ret);
+                        goto out;
+                }
+        }
+
+        ocfs2_init_dinode_xa_loc(&loc, inode, xs->inode_bh,
+                                 xs->not_found ? NULL : xs->here);
+        ret = ocfs2_xa_set(&loc, xi, ctxt);
+        if (ret) {
+                if (ret != -ENOSPC)
+                        mlog_errno(ret);
+                goto out;
+        }
+        xs->here = loc.xl_entry;
+
 out:
         up_write(&oi->ip_alloc_sem);
 
@@ -2236,12 +2837,11 @@ cleanup:
         return ret;
 }
 
-static int ocfs2_create_xattr_block(handle_t *handle,
-                                    struct inode *inode,
+static int ocfs2_create_xattr_block(struct inode *inode,
                                     struct buffer_head *inode_bh,
-                                    struct ocfs2_alloc_context *meta_ac,
-                                    struct buffer_head **ret_bh,
-                                    int indexed)
+                                    struct ocfs2_xattr_set_ctxt *ctxt,
+                                    int indexed,
+                                    struct buffer_head **ret_bh)
 {
         int ret;
         u16 suballoc_bit_start;
@@ -2252,14 +2852,14 @@ static int ocfs2_create_xattr_block(handle_t *handle,
         struct buffer_head *new_bh = NULL;
         struct ocfs2_xattr_block *xblk;
 
-        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), inode_bh,
-                                      OCFS2_JOURNAL_ACCESS_CREATE);
+        ret = ocfs2_journal_access_di(ctxt->handle, INODE_CACHE(inode),
+                                      inode_bh, OCFS2_JOURNAL_ACCESS_CREATE);
         if (ret < 0) {
                 mlog_errno(ret);
                 goto end;
         }
 
-        ret = ocfs2_claim_metadata(osb, handle, meta_ac, 1,
+        ret = ocfs2_claim_metadata(osb, ctxt->handle, ctxt->meta_ac, 1,
                                    &suballoc_bit_start, &num_got,
                                    &first_blkno);
         if (ret < 0) {
@@ -2270,7 +2870,7 @@ static int ocfs2_create_xattr_block(handle_t *handle,
         new_bh = sb_getblk(inode->i_sb, first_blkno);
         ocfs2_set_new_buffer_uptodate(INODE_CACHE(inode), new_bh);
 
-        ret = ocfs2_journal_access_xb(handle, INODE_CACHE(inode),
+        ret = ocfs2_journal_access_xb(ctxt->handle, INODE_CACHE(inode),
                                       new_bh,
                                       OCFS2_JOURNAL_ACCESS_CREATE);
         if (ret < 0) {
@@ -2282,11 +2882,10 @@ static int ocfs2_create_xattr_block(handle_t *handle,
         xblk = (struct ocfs2_xattr_block *)new_bh->b_data;
         memset(xblk, 0, inode->i_sb->s_blocksize);
         strcpy((void *)xblk, OCFS2_XATTR_BLOCK_SIGNATURE);
-        xblk->xb_suballoc_slot = cpu_to_le16(osb->slot_num);
+        xblk->xb_suballoc_slot = cpu_to_le16(ctxt->meta_ac->ac_alloc_slot);
         xblk->xb_suballoc_bit = cpu_to_le16(suballoc_bit_start);
         xblk->xb_fs_generation = cpu_to_le32(osb->fs_generation);
         xblk->xb_blkno = cpu_to_le64(first_blkno);
-
         if (indexed) {
                 struct ocfs2_xattr_tree_root *xr = &xblk->xb_attrs.xb_root;
                 xr->xt_clusters = cpu_to_le32(1);
@@ -2297,14 +2896,17 @@ static int ocfs2_create_xattr_block(handle_t *handle,
                 xr->xt_list.l_next_free_rec = cpu_to_le16(1);
                 xblk->xb_flags = cpu_to_le16(OCFS2_XATTR_INDEXED);
         }
+        ocfs2_journal_dirty(ctxt->handle, new_bh);
 
-        ret = ocfs2_journal_dirty(handle, new_bh);
-        if (ret < 0) {
-                mlog_errno(ret);
-                goto end;
-        }
+        /* Add it to the inode */
         di->i_xattr_loc = cpu_to_le64(first_blkno);
-        ocfs2_journal_dirty(handle, inode_bh);
+
+        spin_lock(&OCFS2_I(inode)->ip_lock);
+        OCFS2_I(inode)->ip_dyn_features |= OCFS2_HAS_XATTR_FL;
+        di->i_dyn_features = cpu_to_le16(OCFS2_I(inode)->ip_dyn_features);
+        spin_unlock(&OCFS2_I(inode)->ip_lock);
+
+        ocfs2_journal_dirty(ctxt->handle, inode_bh);
 
         *ret_bh = new_bh;
         new_bh = NULL;
@@ -2326,13 +2928,13 @@ static int ocfs2_xattr_block_set(struct inode *inode,
                                  struct ocfs2_xattr_set_ctxt *ctxt)
 {
         struct buffer_head *new_bh = NULL;
-        handle_t *handle = ctxt->handle;
         struct ocfs2_xattr_block *xblk = NULL;
         int ret;
+        struct ocfs2_xa_loc loc;
 
         if (!xs->xattr_bh) {
-                ret = ocfs2_create_xattr_block(handle, inode, xs->inode_bh,
-                                               ctxt->meta_ac, &new_bh, 0);
+                ret = ocfs2_create_xattr_block(inode, xs->inode_bh, ctxt,
+                                               0, &new_bh);
                 if (ret) {
                         mlog_errno(ret);
                         goto end;
@@ -2348,21 +2950,25 @@ static int ocfs2_xattr_block_set(struct inode *inode,
                 xblk = (struct ocfs2_xattr_block *)xs->xattr_bh->b_data;
 
         if (!(le16_to_cpu(xblk->xb_flags) & OCFS2_XATTR_INDEXED)) {
-                /* Set extended attribute into external block */
-                ret = ocfs2_xattr_set_entry(inode, xi, xs, ctxt,
-                                            OCFS2_HAS_XATTR_FL);
-                if (!ret || ret != -ENOSPC)
-                        goto end;
+                ocfs2_init_xattr_block_xa_loc(&loc, inode, xs->xattr_bh,
+                                              xs->not_found ? NULL : xs->here);
 
-                ret = ocfs2_xattr_create_index_block(inode, xs, ctxt);
-                if (ret)
+                ret = ocfs2_xa_set(&loc, xi, ctxt);
+                if (!ret)
+                        xs->here = loc.xl_entry;
+                else if (ret != -ENOSPC)
                         goto end;
+                else {
+                        ret = ocfs2_xattr_create_index_block(inode, xs, ctxt);
+                        if (ret)
+                                goto end;
+                }
         }
 
-        ret = ocfs2_xattr_set_entry_index_block(inode, xi, xs, ctxt);
+        if (le16_to_cpu(xblk->xb_flags) & OCFS2_XATTR_INDEXED)
+                ret = ocfs2_xattr_set_entry_index_block(inode, xi, xs, ctxt);
 
 end:
-
         return ret;
 }
 
@@ -2371,7 +2977,6 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
                                        struct ocfs2_xattr_info *xi,
                                        struct ocfs2_xattr_search *xs)
 {
-        u64 value_size;
         struct ocfs2_xattr_entry *last;
         int free, i;
         size_t min_offs = xs->end - xs->base;
@@ -2394,13 +2999,7 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
 
         BUG_ON(!xs->not_found);
 
-        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE)
-                value_size = OCFS2_XATTR_ROOT_SIZE;
-        else
-                value_size = OCFS2_XATTR_SIZE(xi->value_len);
-
-        if (free >= sizeof(struct ocfs2_xattr_entry) +
-                   OCFS2_XATTR_SIZE(strlen(xi->name)) + value_size)
+        if (free >= (sizeof(struct ocfs2_xattr_entry) + namevalue_size_xi(xi)))
                 return 1;
 
         return 0;
@@ -2424,7 +3023,7 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
         char *base = NULL;
         int name_offset, name_len = 0;
         u32 new_clusters = ocfs2_clusters_for_bytes(inode->i_sb,
-                                                    xi->value_len);
+                                                    xi->xi_value_len);
         u64 value_size;
 
         /*
@@ -2432,14 +3031,14 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
          * No matter whether we replace an old one or add a new one,
          * we need this for writing.
          */
-        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE)
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE)
                 credits += new_clusters *
                            ocfs2_clusters_to_blocks(inode->i_sb, 1);
 
         if (xis->not_found && xbs->not_found) {
                 credits += ocfs2_blocks_per_xattr_bucket(inode->i_sb);
 
-                if (xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
+                if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
                         clusters_add += new_clusters;
                         credits += ocfs2_calc_extend_credits(inode->i_sb,
                                                         &def_xv.xv.xr_list,
@@ -2484,7 +3083,7 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
          * The credits for removing the value tree will be extended
          * by ocfs2_remove_extent itself.
          */
-        if (!xi->value) {
+        if (!xi->xi_value) {
                 if (!ocfs2_xattr_is_local(xe))
                         credits += ocfs2_remove_extent_credits(inode->i_sb);
 
@@ -2514,7 +3113,7 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
                 }
         }
 
-        if (xi->value_len > OCFS2_XATTR_INLINE_SIZE) {
+        if (xi->xi_value_len > OCFS2_XATTR_INLINE_SIZE) {
                 /* the new values will be stored outside. */
                 u32 old_clusters = 0;
 
@@ -2547,9 +3146,10 @@ static int ocfs2_calc_xattr_set_need(struct inode *inode,
                  * value, we don't need any allocation, otherwise we have
                  * to guess metadata allocation.
                  */
-                if ((ocfs2_xattr_is_local(xe) && value_size >= xi->value_len) ||
+                if ((ocfs2_xattr_is_local(xe) &&
+                     (value_size >= xi->xi_value_len)) ||
                     (!ocfs2_xattr_is_local(xe) &&
-                     OCFS2_XATTR_ROOT_SIZE >= xi->value_len))
+                     OCFS2_XATTR_ROOT_SIZE >= xi->xi_value_len))
                         goto out;
         }
 
@@ -2639,7 +3239,7 @@ static int ocfs2_init_xattr_set_ctxt(struct inode *inode,
 
         meta_add += extra_meta;
         mlog(0, "Set xattr %s, reserve meta blocks = %d, clusters = %d, "
-             "credits = %d\n", xi->name, meta_add, clusters_add, *credits);
+             "credits = %d\n", xi->xi_name, meta_add, clusters_add, *credits);
 
         if (meta_add) {
                 ret = ocfs2_reserve_new_metadata_blocks(osb, meta_add,
@@ -2679,7 +3279,7 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
 {
         int ret = 0, credits, old_found;
 
-        if (!xi->value) {
+        if (!xi->xi_value) {
                 /* Remove existing extended attribute */
                 if (!xis->not_found)
                         ret = ocfs2_xattr_ibody_set(inode, xi, xis, ctxt);
@@ -2693,8 +3293,8 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
                          * If succeed and that extended attribute existing in
                          * external block, then we will remove it.
                          */
-                        xi->value = NULL;
-                        xi->value_len = 0;
+                        xi->xi_value = NULL;
+                        xi->xi_value_len = 0;
 
                         old_found = xis->not_found;
                         xis->not_found = -ENODATA;
@@ -2722,8 +3322,8 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
                 } else if (ret == -ENOSPC) {
                         if (di->i_xattr_loc && !xbs->xattr_bh) {
                                 ret = ocfs2_xattr_block_find(inode,
-                                                             xi->name_index,
-                                                             xi->name, xbs);
+                                                             xi->xi_name_index,
+                                                             xi->xi_name, xbs);
                                 if (ret)
                                         goto out;
 
@@ -2762,8 +3362,8 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
                                  * If succeed and that extended attribute
                                  * existing in inode, we will remove it.
                                  */
-                                xi->value = NULL;
-                                xi->value_len = 0;
+                                xi->xi_value = NULL;
+                                xi->xi_value_len = 0;
                                 xbs->not_found = -ENODATA;
                                 ret = ocfs2_calc_xattr_set_need(inode,
                                                                 di,
@@ -2829,10 +3429,11 @@ int ocfs2_xattr_set_handle(handle_t *handle,
         int ret;
 
         struct ocfs2_xattr_info xi = {
-                .name_index = name_index,
-                .name = name,
-                .value = value,
-                .value_len = value_len,
+                .xi_name_index = name_index,
+                .xi_name = name,
+                .xi_name_len = strlen(name),
+                .xi_value = value,
+                .xi_value_len = value_len,
         };
 
         struct ocfs2_xattr_search xis = {
@@ -2912,10 +3513,11 @@ int ocfs2_xattr_set(struct inode *inode,
         struct ocfs2_refcount_tree *ref_tree = NULL;
 
         struct ocfs2_xattr_info xi = {
-                .name_index = name_index,
-                .name = name,
-                .value = value,
-                .value_len = value_len,
+                .xi_name_index = name_index,
+                .xi_name = name,
+                .xi_name_len = strlen(name),
+                .xi_value = value,
+                .xi_value_len = value_len,
         };
 
         struct ocfs2_xattr_search xis = {
@@ -3759,7 +4361,7 @@ static int ocfs2_defrag_xattr_bucket(struct inode *inode,
                                      struct ocfs2_xattr_bucket *bucket)
 {
         int ret, i;
-        size_t end, offset, len, value_len;
+        size_t end, offset, len;
         struct ocfs2_xattr_header *xh;
         char *entries, *buf, *bucket_buf = NULL;
         u64 blkno = bucket_blkno(bucket);
@@ -3813,12 +4415,7 @@ static int ocfs2_defrag_xattr_bucket(struct inode *inode,
         end = OCFS2_XATTR_BUCKET_SIZE;
         for (i = 0; i < le16_to_cpu(xh->xh_count); i++, xe++) {
                 offset = le16_to_cpu(xe->xe_name_offset);
-                if (ocfs2_xattr_is_local(xe))
-                        value_len = OCFS2_XATTR_SIZE(
-                                        le64_to_cpu(xe->xe_value_size));
-                else
-                        value_len = OCFS2_XATTR_ROOT_SIZE;
-                len = OCFS2_XATTR_SIZE(xe->xe_name_len) + value_len;
+                len = namevalue_size_xe(xe);
 
                 /*
                  * We must make sure that the name/value pair
@@ -4007,7 +4604,7 @@ static int ocfs2_divide_xattr_bucket(struct inode *inode,
                                     int new_bucket_head)
 {
         int ret, i;
-        int count, start, len, name_value_len = 0, xe_len, name_offset = 0;
+        int count, start, len, name_value_len = 0, name_offset = 0;
         struct ocfs2_xattr_bucket *s_bucket = NULL, *t_bucket = NULL;
         struct ocfs2_xattr_header *xh;
         struct ocfs2_xattr_entry *xe;
@@ -4098,13 +4695,7 @@ static int ocfs2_divide_xattr_bucket(struct inode *inode,
         name_value_len = 0;
         for (i = 0; i < start; i++) {
                 xe = &xh->xh_entries[i];
-                xe_len = OCFS2_XATTR_SIZE(xe->xe_name_len);
-                if (ocfs2_xattr_is_local(xe))
-                        xe_len +=
-                           OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        xe_len += OCFS2_XATTR_ROOT_SIZE;
-                name_value_len += xe_len;
+                name_value_len += namevalue_size_xe(xe);
                 if (le16_to_cpu(xe->xe_name_offset) < name_offset)
                         name_offset = le16_to_cpu(xe->xe_name_offset);
         }
@@ -4134,12 +4725,6 @@ static int ocfs2_divide_xattr_bucket(struct inode *inode,
         xh->xh_free_start = cpu_to_le16(OCFS2_XATTR_BUCKET_SIZE);
         for (i = 0; i < le16_to_cpu(xh->xh_count); i++) {
                 xe = &xh->xh_entries[i];
-                xe_len = OCFS2_XATTR_SIZE(xe->xe_name_len);
-                if (ocfs2_xattr_is_local(xe))
-                        xe_len +=
-                           OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        xe_len += OCFS2_XATTR_ROOT_SIZE;
                 if (le16_to_cpu(xe->xe_name_offset) <
                     le16_to_cpu(xh->xh_free_start))
                         xh->xh_free_start = xe->xe_name_offset;
@@ -4751,195 +5336,6 @@ static inline char *ocfs2_xattr_bucket_get_val(struct inode *inode,
 }
 
 /*
- * Handle the normal xattr set, including replace, delete and new.
- *
- * Note: "local" indicates the real data's locality. So we can't
- * just its bucket locality by its length.
- */
-static void ocfs2_xattr_set_entry_normal(struct inode *inode,
-                                         struct ocfs2_xattr_info *xi,
-                                         struct ocfs2_xattr_search *xs,
-                                         u32 name_hash,
-                                         int local)
-{
-        struct ocfs2_xattr_entry *last, *xe;
-        int name_len = strlen(xi->name);
-        struct ocfs2_xattr_header *xh = xs->header;
-        u16 count = le16_to_cpu(xh->xh_count), start;
-        size_t blocksize = inode->i_sb->s_blocksize;
-        char *val;
-        size_t offs, size, new_size;
-
-        last = &xh->xh_entries[count];
-        if (!xs->not_found) {
-                xe = xs->here;
-                offs = le16_to_cpu(xe->xe_name_offset);
-                if (ocfs2_xattr_is_local(xe))
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        size = OCFS2_XATTR_SIZE(name_len) +
-                        OCFS2_XATTR_SIZE(OCFS2_XATTR_ROOT_SIZE);
-
-                /*
-                 * If the new value will be stored outside, xi->value has been
-                 * initalized as an empty ocfs2_xattr_value_root, and the same
-                 * goes with xi->value_len, so we can set new_size safely here.
-                 * See ocfs2_xattr_set_in_bucket.
-                 */
-                new_size = OCFS2_XATTR_SIZE(name_len) +
-                           OCFS2_XATTR_SIZE(xi->value_len);
-
-                le16_add_cpu(&xh->xh_name_value_len, -size);
-                if (xi->value) {
-                        if (new_size > size)
-                                goto set_new_name_value;
-
-                        /* Now replace the old value with new one. */
-                        if (local)
-                                xe->xe_value_size = cpu_to_le64(xi->value_len);
-                        else
-                                xe->xe_value_size = 0;
-
-                        val = ocfs2_xattr_bucket_get_val(inode,
-                                                         xs->bucket, offs);
-                        memset(val + OCFS2_XATTR_SIZE(name_len), 0,
-                               size - OCFS2_XATTR_SIZE(name_len));
-                        if (OCFS2_XATTR_SIZE(xi->value_len) > 0)
-                                memcpy(val + OCFS2_XATTR_SIZE(name_len),
-                                       xi->value, xi->value_len);
-
-                        le16_add_cpu(&xh->xh_name_value_len, new_size);
-                        ocfs2_xattr_set_local(xe, local);
-                        return;
-                } else {
-                        /*
-                         * Remove the old entry if there is more than one.
-                         * We don't remove the last entry so that we can
-                         * use it to indicate the hash value of the empty
-                         * bucket.
-                         */
-                        last -= 1;
-                        le16_add_cpu(&xh->xh_count, -1);
-                        if (xh->xh_count) {
-                                memmove(xe, xe + 1,
-                                        (void *)last - (void *)xe);
-                                memset(last, 0,
-                                       sizeof(struct ocfs2_xattr_entry));
-                        } else
-                                xh->xh_free_start =
-                                        cpu_to_le16(OCFS2_XATTR_BUCKET_SIZE);
-
-                        return;
-                }
-        } else {
-                /* find a new entry for insert. */
-                int low = 0, high = count - 1, tmp;
-                struct ocfs2_xattr_entry *tmp_xe;
-
-                while (low <= high && count) {
-                        tmp = (low + high) / 2;
-                        tmp_xe = &xh->xh_entries[tmp];
-
-                        if (name_hash > le32_to_cpu(tmp_xe->xe_name_hash))
-                                low = tmp + 1;
-                        else if (name_hash <
-                                 le32_to_cpu(tmp_xe->xe_name_hash))
-                                high = tmp - 1;
-                        else {
-                                low = tmp;
-                                break;
-                        }
-                }
-
-                xe = &xh->xh_entries[low];
-                if (low != count)
-                        memmove(xe + 1, xe, (void *)last - (void *)xe);
-
-                le16_add_cpu(&xh->xh_count, 1);
-                memset(xe, 0, sizeof(struct ocfs2_xattr_entry));
-                xe->xe_name_hash = cpu_to_le32(name_hash);
-                xe->xe_name_len = name_len;
-                ocfs2_xattr_set_type(xe, xi->name_index);
-        }
-
-set_new_name_value:
-        /* Insert the new name+value. */
-        size = OCFS2_XATTR_SIZE(name_len) + OCFS2_XATTR_SIZE(xi->value_len);
-
-        /*
-         * We must make sure that the name/value pair
-         * exists in the same block.
-         */
-        offs = le16_to_cpu(xh->xh_free_start);
-        start = offs - size;
-
-        if (start >> inode->i_sb->s_blocksize_bits !=
-            (offs - 1) >> inode->i_sb->s_blocksize_bits) {
-                offs = offs - offs % blocksize;
-                xh->xh_free_start = cpu_to_le16(offs);
-        }
-
-        val = ocfs2_xattr_bucket_get_val(inode, xs->bucket, offs - size);
-        xe->xe_name_offset = cpu_to_le16(offs - size);
-
-        memset(val, 0, size);
-        memcpy(val, xi->name, name_len);
-        memcpy(val + OCFS2_XATTR_SIZE(name_len), xi->value, xi->value_len);
-
-        xe->xe_value_size = cpu_to_le64(xi->value_len);
-        ocfs2_xattr_set_local(xe, local);
-        xs->here = xe;
-        le16_add_cpu(&xh->xh_free_start, -size);
-        le16_add_cpu(&xh->xh_name_value_len, size);
-
-        return;
-}
-
-/*
- * Set the xattr entry in the specified bucket.
- * The bucket is indicated by xs->bucket and it should have the enough
- * space for the xattr insertion.
- */
-static int ocfs2_xattr_set_entry_in_bucket(struct inode *inode,
-                                           handle_t *handle,
-                                           struct ocfs2_xattr_info *xi,
-                                           struct ocfs2_xattr_search *xs,
-                                           u32 name_hash,
-                                           int local)
-{
-        int ret;
-        u64 blkno;
-
-        mlog(0, "Set xattr entry len = %lu index = %d in bucket %llu\n",
-             (unsigned long)xi->value_len, xi->name_index,
-             (unsigned long long)bucket_blkno(xs->bucket));
-
-        if (!xs->bucket->bu_bhs[1]) {
-                blkno = bucket_blkno(xs->bucket);
-                ocfs2_xattr_bucket_relse(xs->bucket);
-                ret = ocfs2_read_xattr_bucket(xs->bucket, blkno);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-        }
-
-        ret = ocfs2_xattr_bucket_journal_access(handle, xs->bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret < 0) {
-                mlog_errno(ret);
-                goto out;
-        }
-
-        ocfs2_xattr_set_entry_normal(inode, xi, xs, name_hash, local);
-        ocfs2_xattr_bucket_journal_dirty(handle, xs->bucket);
-
-out:
-        return ret;
-}
-
-/*
  * Truncate the specified xe_off entry in xattr bucket.
  * bucket is indicated by header_bh and len is the new length.
  * Both the ocfs2_xattr_value_root and the entry will be updated here.
@@ -5009,66 +5405,6 @@ out:
         return ret;
 }
 
-static int ocfs2_xattr_bucket_value_truncate_xs(struct inode *inode,
-                                        struct ocfs2_xattr_search *xs,
-                                        int len,
-                                        struct ocfs2_xattr_set_ctxt *ctxt)
-{
-        int ret, offset;
-        struct ocfs2_xattr_entry *xe = xs->here;
-        struct ocfs2_xattr_header *xh = (struct ocfs2_xattr_header *)xs->base;
-
-        BUG_ON(!xs->bucket->bu_bhs[0] || !xe || ocfs2_xattr_is_local(xe));
-
-        offset = xe - xh->xh_entries;
-        ret = ocfs2_xattr_bucket_value_truncate(inode, xs->bucket,
-                                                offset, len, ctxt);
-        if (ret)
-                mlog_errno(ret);
-
-        return ret;
-}
-
-static int ocfs2_xattr_bucket_set_value_outside(struct inode *inode,
-                                                handle_t *handle,
-                                                struct ocfs2_xattr_search *xs,
-                                                char *val,
-                                                int value_len)
-{
-        int ret, offset, block_off;
-        struct ocfs2_xattr_value_root *xv;
-        struct ocfs2_xattr_entry *xe = xs->here;
-        struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
-        void *base;
-        struct ocfs2_xattr_value_buf vb = {
-                .vb_access = ocfs2_journal_access,
-        };
-
-        BUG_ON(!xs->base || !xe || ocfs2_xattr_is_local(xe));
-
-        ret = ocfs2_xattr_bucket_get_name_value(inode->i_sb, xh,
-                                                xe - xh->xh_entries,
-                                                &block_off,
-                                                &offset);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-
-        base = bucket_block(xs->bucket, block_off);
-        xv = (struct ocfs2_xattr_value_root *)(base + offset +
-                 OCFS2_XATTR_SIZE(xe->xe_name_len));
-
-        vb.vb_xv = xv;
-        vb.vb_bh = xs->bucket->bu_bhs[block_off];
-        ret = __ocfs2_xattr_set_value_outside(inode, handle,
-                                              &vb, val, value_len);
-        if (ret)
-                mlog_errno(ret);
-out:
-        return ret;
-}
-
 static int ocfs2_rm_xattr_cluster(struct inode *inode,
                                   struct buffer_head *root_bh,
                                   u64 blkno,
@@ -5167,128 +5503,6 @@ out:
         return ret;
 }
 
-static void ocfs2_xattr_bucket_remove_xs(struct inode *inode,
-                                         handle_t *handle,
-                                         struct ocfs2_xattr_search *xs)
-{
-        struct ocfs2_xattr_header *xh = bucket_xh(xs->bucket);
-        struct ocfs2_xattr_entry *last = &xh->xh_entries[
-                                                le16_to_cpu(xh->xh_count) - 1];
-        int ret = 0;
-
-        ret = ocfs2_xattr_bucket_journal_access(handle, xs->bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                return;
-        }
-
-        /* Remove the old entry. */
-        memmove(xs->here, xs->here + 1,
-                (void *)last - (void *)xs->here);
-        memset(last, 0, sizeof(struct ocfs2_xattr_entry));
-        le16_add_cpu(&xh->xh_count, -1);
-
-        ocfs2_xattr_bucket_journal_dirty(handle, xs->bucket);
-}
-
-/*
- * Set the xattr name/value in the bucket specified in xs.
- *
- * As the new value in xi may be stored in the bucket or in an outside cluster,
- * we divide the whole process into 3 steps:
- * 1. insert name/value in the bucket(ocfs2_xattr_set_entry_in_bucket)
- * 2. truncate of the outside cluster(ocfs2_xattr_bucket_value_truncate_xs)
- * 3. Set the value to the outside cluster(ocfs2_xattr_bucket_set_value_outside)
- * 4. If the clusters for the new outside value can't be allocated, we need
- *    to free the xattr we allocated in set.
- */
-static int ocfs2_xattr_set_in_bucket(struct inode *inode,
-                                     struct ocfs2_xattr_info *xi,
-                                     struct ocfs2_xattr_search *xs,
-                                     struct ocfs2_xattr_set_ctxt *ctxt)
-{
-        int ret, local = 1;
-        size_t value_len;
-        char *val = (char *)xi->value;
-        struct ocfs2_xattr_entry *xe = xs->here;
-        u32 name_hash = ocfs2_xattr_name_hash(inode, xi->name,
-                                              strlen(xi->name));
-
-        if (!xs->not_found && !ocfs2_xattr_is_local(xe)) {
-                /*
-                 * We need to truncate the xattr storage first.
-                 *
-                 * If both the old and new value are stored to
-                 * outside block, we only need to truncate
-                 * the storage and then set the value outside.
-                 *
-                 * If the new value should be stored within block,
-                 * we should free all the outside block first and
-                 * the modification to the xattr block will be done
-                 * by following steps.
-                 */
-                if (xi->value_len > OCFS2_XATTR_INLINE_SIZE)
-                        value_len = xi->value_len;
-                else
-                        value_len = 0;
-
-                ret = ocfs2_xattr_bucket_value_truncate_xs(inode, xs,
-                                                           value_len,
-                                                           ctxt);
-                if (ret)
-                        goto out;
-
-                if (value_len)
-                        goto set_value_outside;
-        }
-
-        value_len = xi->value_len;
-        /* So we have to handle the inside block change now. */
-        if (value_len > OCFS2_XATTR_INLINE_SIZE) {
-                /*
-                 * If the new value will be stored outside of block,
-                 * initalize a new empty value root and insert it first.
-                 */
-                local = 0;
-                xi->value = &def_xv;
-                xi->value_len = OCFS2_XATTR_ROOT_SIZE;
-        }
-
-        ret = ocfs2_xattr_set_entry_in_bucket(inode, ctxt->handle, xi, xs,
-                                              name_hash, local);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-
-        if (value_len <= OCFS2_XATTR_INLINE_SIZE)
-                goto out;
-
-        /* allocate the space now for the outside block storage. */
-        ret = ocfs2_xattr_bucket_value_truncate_xs(inode, xs,
-                                                   value_len, ctxt);
-        if (ret) {
-                mlog_errno(ret);
-
-                if (xs->not_found) {
-                        /*
-                         * We can't allocate enough clusters for outside
-                         * storage and we have allocated xattr already,
-                         * so need to remove it.
-                         */
-                        ocfs2_xattr_bucket_remove_xs(inode, ctxt->handle, xs);
-                }
-                goto out;
-        }
-
-set_value_outside:
-        ret = ocfs2_xattr_bucket_set_value_outside(inode, ctxt->handle,
-                                                   xs, val, value_len);
-out:
-        return ret;
-}
-
 /*
  * check whether the xattr bucket is filled up with the same hash value.
  * If we want to insert the xattr with the same hash, return -ENOSPC.
@@ -5317,156 +5531,116 @@ static int ocfs2_check_xattr_bucket_collision(struct inode *inode,
         return 0;
 }
 
-static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
-                                             struct ocfs2_xattr_info *xi,
-                                             struct ocfs2_xattr_search *xs,
-                                             struct ocfs2_xattr_set_ctxt *ctxt)
+/*
+ * Try to set the entry in the current bucket.  If we fail, the caller
+ * will handle getting us another bucket.
+ */
+static int ocfs2_xattr_set_entry_bucket(struct inode *inode,
+                                        struct ocfs2_xattr_info *xi,
+                                        struct ocfs2_xattr_search *xs,
+                                        struct ocfs2_xattr_set_ctxt *ctxt)
 {
-        struct ocfs2_xattr_header *xh;
-        struct ocfs2_xattr_entry *xe;
-        u16 count, header_size, xh_free_start;
-        int free, max_free, need, old;
-        size_t value_size = 0, name_len = strlen(xi->name);
-        size_t blocksize = inode->i_sb->s_blocksize;
-        int ret, allocation = 0;
-
-        mlog_entry("Set xattr %s in xattr index block\n", xi->name);
-
-try_again:
-        xh = xs->header;
-        count = le16_to_cpu(xh->xh_count);
-        xh_free_start = le16_to_cpu(xh->xh_free_start);
-        header_size = sizeof(struct ocfs2_xattr_header) +
-                        count * sizeof(struct ocfs2_xattr_entry);
-        max_free = OCFS2_XATTR_BUCKET_SIZE - header_size -
-                le16_to_cpu(xh->xh_name_value_len) - OCFS2_XATTR_HEADER_GAP;
-
-        mlog_bug_on_msg(header_size > blocksize, "bucket %llu has header size "
-                        "of %u which exceed block size\n",
-                        (unsigned long long)bucket_blkno(xs->bucket),
-                        header_size);
+        int ret;
+        struct ocfs2_xa_loc loc;
 
-        if (xi->value && xi->value_len > OCFS2_XATTR_INLINE_SIZE)
-                value_size = OCFS2_XATTR_ROOT_SIZE;
-        else if (xi->value)
-                value_size = OCFS2_XATTR_SIZE(xi->value_len);
+        mlog_entry("Set xattr %s in xattr bucket\n", xi->xi_name);
 
-        if (xs->not_found)
-                need = sizeof(struct ocfs2_xattr_entry) +
-                        OCFS2_XATTR_SIZE(name_len) + value_size;
-        else {
-                need = value_size + OCFS2_XATTR_SIZE(name_len);
+        ocfs2_init_xattr_bucket_xa_loc(&loc, xs->bucket,
+                                       xs->not_found ? NULL : xs->here);
+        ret = ocfs2_xa_set(&loc, xi, ctxt);
+        if (!ret) {
+                xs->here = loc.xl_entry;
+                goto out;
+        }
+        if (ret != -ENOSPC) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                /*
-                 * We only replace the old value if the new length is smaller
-                 * than the old one. Otherwise we will allocate new space in the
-                 * bucket to store it.
-                 */
-                xe = xs->here;
-                if (ocfs2_xattr_is_local(xe))
-                        old = OCFS2_XATTR_SIZE(le64_to_cpu(xe->xe_value_size));
-                else
-                        old = OCFS2_XATTR_SIZE(OCFS2_XATTR_ROOT_SIZE);
+        /* Ok, we need space.  Let's try defragmenting the bucket. */
+        ret = ocfs2_defrag_xattr_bucket(inode, ctxt->handle,
+                                        xs->bucket);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                if (old >= value_size)
-                        need = 0;
+        ret = ocfs2_xa_set(&loc, xi, ctxt);
+        if (!ret) {
+                xs->here = loc.xl_entry;
+                goto out;
         }
+        if (ret != -ENOSPC)
+                mlog_errno(ret);
 
-        free = xh_free_start - header_size - OCFS2_XATTR_HEADER_GAP;
-        /*
-         * We need to make sure the new name/value pair
-         * can exist in the same block.
-         */
-        if (xh_free_start % blocksize < need)
-                free -= xh_free_start % blocksize;
-
-        mlog(0, "xs->not_found = %d, in xattr bucket %llu: free = %d, "
-             "need = %d, max_free = %d, xh_free_start = %u, xh_name_value_len ="
-             " %u\n", xs->not_found,
-             (unsigned long long)bucket_blkno(xs->bucket),
-             free, need, max_free, le16_to_cpu(xh->xh_free_start),
-             le16_to_cpu(xh->xh_name_value_len));
-
-        if (free < need ||
-            (xs->not_found &&
-             count == ocfs2_xattr_max_xe_in_bucket(inode->i_sb))) {
-                if (need <= max_free &&
-                    count < ocfs2_xattr_max_xe_in_bucket(inode->i_sb)) {
-                        /*
-                         * We can create the space by defragment. Since only the
-                         * name/value will be moved, the xe shouldn't be changed
-                         * in xs.
-                         */
-                        ret = ocfs2_defrag_xattr_bucket(inode, ctxt->handle,
-                                                        xs->bucket);
-                        if (ret) {
-                                mlog_errno(ret);
-                                goto out;
-                        }
 
-                        xh_free_start = le16_to_cpu(xh->xh_free_start);
-                        free = xh_free_start - header_size
-                                - OCFS2_XATTR_HEADER_GAP;
-                        if (xh_free_start % blocksize < need)
-                                free -= xh_free_start % blocksize;
+out:
+        mlog_exit(ret);
+        return ret;
+}
 
-                        if (free >= need)
-                                goto xattr_set;
+static int ocfs2_xattr_set_entry_index_block(struct inode *inode,
+                                             struct ocfs2_xattr_info *xi,
+                                             struct ocfs2_xattr_search *xs,
+                                             struct ocfs2_xattr_set_ctxt *ctxt)
+{
+        int ret;
 
-                        mlog(0, "Can't get enough space for xattr insert by "
-                             "defragment. Need %u bytes, but we have %d, so "
-                             "allocate new bucket for it.\n", need, free);
-                }
+        mlog_entry("Set xattr %s in xattr index block\n", xi->xi_name);
 
-                /*
-                 * We have to add new buckets or clusters and one
-                 * allocation should leave us enough space for insert.
-                 */
-                BUG_ON(allocation);
+        ret = ocfs2_xattr_set_entry_bucket(inode, xi, xs, ctxt);
+        if (!ret)
+                goto out;
+        if (ret != -ENOSPC) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                /*
-                 * We do not allow for overlapping ranges between buckets. And
-                 * the maximum number of collisions we will allow for then is
-                 * one bucket's worth, so check it here whether we need to
-                 * add a new bucket for the insert.
-                 */
-                ret = ocfs2_check_xattr_bucket_collision(inode,
-                                                         xs->bucket,
-                                                         xi->name);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+        /* Ack, need more space.  Let's try to get another bucket! */
 
-                ret = ocfs2_add_new_xattr_bucket(inode,
-                                                 xs->xattr_bh,
+        /*
+         * We do not allow for overlapping ranges between buckets. And
+         * the maximum number of collisions we will allow for then is
+         * one bucket's worth, so check it here whether we need to
+         * add a new bucket for the insert.
+         */
+        ret = ocfs2_check_xattr_bucket_collision(inode,
                                                  xs->bucket,
-                                                 ctxt);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+                                                 xi->xi_name);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
 
-                /*
-                 * ocfs2_add_new_xattr_bucket() will have updated
-                 * xs->bucket if it moved, but it will not have updated
-                 * any of the other search fields.  Thus, we drop it and
-                 * re-search.  Everything should be cached, so it'll be
-                 * quick.
-                 */
-                ocfs2_xattr_bucket_relse(xs->bucket);
-                ret = ocfs2_xattr_index_block_find(inode, xs->xattr_bh,
-                                                   xi->name_index,
-                                                   xi->name, xs);
-                if (ret && ret != -ENODATA)
-                        goto out;
-                xs->not_found = ret;
-                allocation = 1;
-                goto try_again;
+        ret = ocfs2_add_new_xattr_bucket(inode,
+                                         xs->xattr_bh,
+                                         xs->bucket,
+                                         ctxt);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
         }
 
-xattr_set:
-        ret = ocfs2_xattr_set_in_bucket(inode, xi, xs, ctxt);
+        /*
+         * ocfs2_add_new_xattr_bucket() will have updated
+         * xs->bucket if it moved, but it will not have updated
+         * any of the other search fields.  Thus, we drop it and
+         * re-search.  Everything should be cached, so it'll be
+         * quick.
+         */
+        ocfs2_xattr_bucket_relse(xs->bucket);
+        ret = ocfs2_xattr_index_block_find(inode, xs->xattr_bh,
+                                           xi->xi_name_index,
+                                           xi->xi_name, xs);
+        if (ret && ret != -ENODATA)
+                goto out;
+        xs->not_found = ret;
+
+        /* Ok, we have a new bucket, let's try again */
+        ret = ocfs2_xattr_set_entry_bucket(inode, xi, xs, ctxt);
+        if (ret && (ret != -ENOSPC))
+                mlog_errno(ret);
+
 out:
         mlog_exit(ret);
         return ret;
@@ -5678,7 +5852,7 @@ static int ocfs2_prepare_refcount_xattr(struct inode *inode,
          * refcount tree, and make the original extent become 3. So we will need
          * 2 * cluster more extent recs at most.
          */
-        if (!xi->value || xi->value_len <= OCFS2_XATTR_INLINE_SIZE) {
+        if (!xi->xi_value || xi->xi_value_len <= OCFS2_XATTR_INLINE_SIZE) {
 
                 ret = ocfs2_refcounted_xattr_delete_need(inode,
                                                          &(*ref_tree)->rf_ci,
@@ -6354,9 +6528,11 @@ static int ocfs2_create_empty_xattr_block(struct inode *inode,
                                           int indexed)
 {
         int ret;
-        handle_t *handle;
         struct ocfs2_alloc_context *meta_ac;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+        struct ocfs2_xattr_set_ctxt ctxt = {
+                .meta_ac = meta_ac,
+        };
 
         ret = ocfs2_reserve_new_metadata_blocks(osb, 1, &meta_ac);
         if (ret < 0) {
@@ -6364,21 +6540,21 @@ static int ocfs2_create_empty_xattr_block(struct inode *inode,
                 return ret;
         }
 
-        handle = ocfs2_start_trans(osb, OCFS2_XATTR_BLOCK_CREATE_CREDITS);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
+        ctxt.handle = ocfs2_start_trans(osb, OCFS2_XATTR_BLOCK_CREATE_CREDITS);
+        if (IS_ERR(ctxt.handle)) {
+                ret = PTR_ERR(ctxt.handle);
                 mlog_errno(ret);
                 goto out;
         }
 
         mlog(0, "create new xattr block for inode %llu, index = %d\n",
              (unsigned long long)fe_bh->b_blocknr, indexed);
-        ret = ocfs2_create_xattr_block(handle, inode, fe_bh,
-                                       meta_ac, ret_bh, indexed);
+        ret = ocfs2_create_xattr_block(inode, fe_bh, &ctxt, indexed,
+                                       ret_bh);
         if (ret)
                 mlog_errno(ret);
 
-        ocfs2_commit_trans(osb, handle);
+        ocfs2_commit_trans(osb, ctxt.handle);
 out:
         ocfs2_free_alloc_context(meta_ac);
         return ret;
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
index f3b7c1541f3a..75d9b5ba1d45 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
@@ -11,6 +11,7 @@
 #include <linux/parser.h>
 #include <linux/buffer_head.h>
 #include <linux/vmalloc.h>
+#include <linux/writeback.h>
 #include <linux/crc-itu-t.h>
 #include "omfs.h"
 
@@ -89,7 +90,7 @@ static void omfs_update_checksums(struct omfs_inode *oi)
         oi->i_head.h_check_xor = xor;
 }
 
-static int omfs_write_inode(struct inode *inode, int wait)
+static int __omfs_write_inode(struct inode *inode, int wait)
 {
         struct omfs_inode *oi;
         struct omfs_sb_info *sbi = OMFS_SB(inode->i_sb);
@@ -162,9 +163,14 @@ out:
         return ret;
 }
 
+static int omfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __omfs_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int omfs_sync_inode(struct inode *inode)
 {
-        return omfs_write_inode(inode, 1);
+        return __omfs_write_inode(inode, 1);
 }
 
 /*
diff --git a/fs/open.c b/fs/open.c
index 040cef72bc00..e0b2d88b0380 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -271,7 +271,7 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
          * Make sure that there are no leases.  get_write_access() protects
          * against the truncate racing with a lease-granting setlease().
          */
-        error = break_lease(inode, FMODE_WRITE);
+        error = break_lease(inode, O_WRONLY);
         if (error)
                 goto put_write_and_out;
 
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 64bc8998ac9a..e8865c11777f 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -412,9 +412,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
         pdev = part_to_dev(p);
 
         p->start_sect = start;
-        p->alignment_offset = queue_sector_alignment_offset(disk->queue, start);
-        p->discard_alignment = queue_sector_discard_alignment(disk->queue,
-                                                              start);
+        p->alignment_offset =
+                queue_limit_alignment_offset(&disk->queue->limits, start);
+        p->discard_alignment =
+                queue_limit_discard_alignment(&disk->queue->limits, start);
         p->nr_sects = len;
         p->partno = partno;
         p->policy = get_disk_ro(disk);
diff --git a/fs/pnode.c b/fs/pnode.c
index 8d5f392ec3d3..5cc564a83149 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -86,7 +86,7 @@ static int do_make_slave(struct vfsmount *mnt)
 
         /*
          * slave 'mnt' to a peer mount that has the
-         * same root dentry. If none is available than
+         * same root dentry. If none is available then
          * slave it to anything that is available.
          */
         while ((peer_mnt = next_peer(peer_mnt)) != mnt &&
@@ -147,6 +147,11 @@ void change_mnt_propagation(struct vfsmount *mnt, int type)
  * get the next mount in the propagation tree.
  * @m: the mount seen last
  * @origin: the original mount from where the tree walk initiated
+ *
+ * Note that peer groups form contiguous segments of slave lists.
+ * We rely on that in get_source() to be able to find out if
+ * vfsmount found while iterating with propagation_next() is
+ * a peer of one we'd found earlier.
  */
 static struct vfsmount *propagation_next(struct vfsmount *m,
                                          struct vfsmount *origin)
@@ -186,10 +191,6 @@ static struct vfsmount *get_source(struct vfsmount *dest,
 {
         struct vfsmount *p_last_src = NULL;
         struct vfsmount *p_last_dest = NULL;
-        *type = CL_PROPAGATION;
-
-        if (IS_MNT_SHARED(dest))
-                *type |= CL_MAKE_SHARED;
 
         while (last_dest != dest->mnt_master) {
                 p_last_dest = last_dest;
@@ -202,13 +203,18 @@ static struct vfsmount *get_source(struct vfsmount *dest,
                 do {
                         p_last_dest = next_peer(p_last_dest);
                 } while (IS_MNT_NEW(p_last_dest));
+                /* is that a peer of the earlier? */
+                if (dest == p_last_dest) {
+                        *type = CL_MAKE_SHARED;
+                        return p_last_src;
+                }
         }
-
-        if (dest != p_last_dest) {
-                *type |= CL_SLAVE;
-                return last_src;
-        } else
-                return p_last_src;
+        /* slave of the earlier, then */
+        *type = CL_SLAVE;
+        /* beginning of peer group among the slaves? */
+        if (IS_MNT_SHARED(dest))
+                *type |= CL_MAKE_SHARED;
+        return last_src;
 }
 
 /*
diff --git a/fs/pnode.h b/fs/pnode.h
index 958665d662af..1ea4ae1efcd3 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -21,12 +21,11 @@
 #define CL_SLAVE                0x02
 #define CL_COPY_ALL             0x04
 #define CL_MAKE_SHARED          0x08
-#define CL_PROPAGATION          0x10
-#define CL_PRIVATE              0x20
+#define CL_PRIVATE              0x10
 
 static inline void set_mnt_shared(struct vfsmount *mnt)
 {
-        mnt->mnt_flags &= ~MNT_PNODE_MASK;
+        mnt->mnt_flags &= ~MNT_SHARED_MASK;
         mnt->mnt_flags |= MNT_SHARED;
 }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 623e2ffb5d2b..a7310841c831 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -647,17 +647,11 @@ static int mounts_release(struct inode *inode, struct file *file)
 static unsigned mounts_poll(struct file *file, poll_table *wait)
 {
         struct proc_mounts *p = file->private_data;
-        struct mnt_namespace *ns = p->ns;
         unsigned res = POLLIN | POLLRDNORM;
 
-        poll_wait(file, &ns->poll, wait);
-
-        spin_lock(&vfsmount_lock);
-        if (p->event != ns->event) {
-                p->event = ns->event;
+        poll_wait(file, &p->ns->poll, wait);
+        if (mnt_had_events(p))
                 res |= POLLERR | POLLPRI;
-        }
-        spin_unlock(&vfsmount_lock);
 
         return res;
 }
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 480cb1065eec..9580abeadeb3 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -662,6 +662,7 @@ struct proc_dir_entry *proc_symlink(const char *name,
         }
         return ent;
 }
+EXPORT_SYMBOL(proc_symlink);
 
 struct proc_dir_entry *proc_mkdir_mode(const char *name, mode_t mode,
                 struct proc_dir_entry *parent)
@@ -700,6 +701,7 @@ struct proc_dir_entry *proc_mkdir(const char *name,
 {
         return proc_mkdir_mode(name, S_IRUGO | S_IXUGO, parent);
 }
+EXPORT_SYMBOL(proc_mkdir);
 
 struct proc_dir_entry *create_proc_entry(const char *name, mode_t mode,
                                          struct proc_dir_entry *parent)
@@ -728,6 +730,7 @@ struct proc_dir_entry *create_proc_entry(const char *name, mode_t mode,
         }
         return ent;
 }
+EXPORT_SYMBOL(create_proc_entry);
 
 struct proc_dir_entry *proc_create_data(const char *name, mode_t mode,
                                         struct proc_dir_entry *parent,
@@ -762,6 +765,7 @@ out_free:
 out:
         return NULL;
 }
+EXPORT_SYMBOL(proc_create_data);
 
 static void free_proc_entry(struct proc_dir_entry *de)
 {
@@ -853,3 +857,4 @@ continue_removing:
                         de->parent->name, de->name, de->subdir->name);
         pde_put(de);
 }
+EXPORT_SYMBOL(remove_proc_entry);
diff --git a/fs/proc/kmsg.c b/fs/proc/kmsg.c
index 7ca78346d3f0..cfe90a48a6e8 100644
--- a/fs/proc/kmsg.c
+++ b/fs/proc/kmsg.c
@@ -12,37 +12,37 @@
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
 #include <linux/fs.h>
+#include <linux/syslog.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
 extern wait_queue_head_t log_wait;
 
-extern int do_syslog(int type, char __user *bug, int count);
-
 static int kmsg_open(struct inode * inode, struct file * file)
 {
-        return do_syslog(1,NULL,0);
+        return do_syslog(SYSLOG_ACTION_OPEN, NULL, 0, SYSLOG_FROM_FILE);
 }
 
 static int kmsg_release(struct inode * inode, struct file * file)
 {
-        (void) do_syslog(0,NULL,0);
+        (void) do_syslog(SYSLOG_ACTION_CLOSE, NULL, 0, SYSLOG_FROM_FILE);
         return 0;
 }
 
 static ssize_t kmsg_read(struct file *file, char __user *buf,
                          size_t count, loff_t *ppos)
 {
-        if ((file->f_flags & O_NONBLOCK) && !do_syslog(9, NULL, 0))
+        if ((file->f_flags & O_NONBLOCK) &&
+            !do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
                 return -EAGAIN;
-        return do_syslog(2, buf, count);
+        return do_syslog(SYSLOG_ACTION_READ, buf, count, SYSLOG_FROM_FILE);
 }
 
 static unsigned int kmsg_poll(struct file *file, poll_table *wait)
 {
         poll_wait(file, &log_wait, wait);
-        if (do_syslog(9, NULL, 0))
+        if (do_syslog(SYSLOG_ACTION_SIZE_UNREAD, NULL, 0, SYSLOG_FROM_FILE))
                 return POLLIN | POLLRDNORM;
         return 0;
 }
diff --git a/fs/proc/root.c b/fs/proc/root.c
index b080b791d9e3..757c069f2a65 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -220,9 +220,3 @@ void pid_ns_release_proc(struct pid_namespace *ns)
 {
         mntput(ns->proc_mnt);
 }
-
-EXPORT_SYMBOL(proc_symlink);
-EXPORT_SYMBOL(proc_mkdir);
-EXPORT_SYMBOL(create_proc_entry);
-EXPORT_SYMBOL(proc_create_data);
-EXPORT_SYMBOL(remove_proc_entry);
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 2df0f5c7c60b..0d651f980a8d 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1615,7 +1615,7 @@ int reiserfs_encode_fh(struct dentry *dentry, __u32 * data, int *lenp,
 ** to properly mark inodes for datasync and such, but only actually
 ** does something when called for a synchronous update.
 */
-int reiserfs_write_inode(struct inode *inode, int do_sync)
+int reiserfs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         struct reiserfs_transaction_handle th;
         int jbegin_count = 1;
@@ -1627,7 +1627,7 @@ int reiserfs_write_inode(struct inode *inode, int do_sync)
          ** inode needs to reach disk for safety, and they can safely be
          ** ignored because the altered inode has already been logged.
          */
-        if (do_sync && !(current->flags & PF_MEMALLOC)) {
+        if (wbc->sync_mode == WB_SYNC_ALL && !(current->flags & PF_MEMALLOC)) {
                 reiserfs_write_lock(inode->i_sb);
                 if (!journal_begin(&th, inode->i_sb, jbegin_count)) {
                         reiserfs_update_sd(&th, inode);
diff --git a/fs/seq_file.c b/fs/seq_file.c
index eae7d9dbf3ff..5afd554efad3 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -674,7 +674,6 @@ struct list_head *seq_list_start(struct list_head *head, loff_t pos)
 
         return NULL;
 }
-
 EXPORT_SYMBOL(seq_list_start);
 
 struct list_head *seq_list_start_head(struct list_head *head, loff_t pos)
@@ -684,7 +683,6 @@ struct list_head *seq_list_start_head(struct list_head *head, loff_t pos)
 
         return seq_list_start(head, pos - 1);
 }
-
 EXPORT_SYMBOL(seq_list_start_head);
 
 struct list_head *seq_list_next(void *v, struct list_head *head, loff_t *ppos)
@@ -695,5 +693,131 @@ struct list_head *seq_list_next(void *v, struct list_head *head, loff_t *ppos)
         ++*ppos;
         return lh == head ? NULL : lh;
 }
-
 EXPORT_SYMBOL(seq_list_next);
+
+/**
+ * seq_hlist_start - start an iteration of a hlist
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start().
+ */
+struct hlist_node *seq_hlist_start(struct hlist_head *head, loff_t pos)
+{
+        struct hlist_node *node;
+
+        hlist_for_each(node, head)
+                if (pos-- == 0)
+                        return node;
+        return NULL;
+}
+EXPORT_SYMBOL(seq_hlist_start);
+
+/**
+ * seq_hlist_start_head - start an iteration of a hlist
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start(). Call this function if you want to
+ * print a header at the top of the output.
+ */
+struct hlist_node *seq_hlist_start_head(struct hlist_head *head, loff_t pos)
+{
+        if (!pos)
+                return SEQ_START_TOKEN;
+
+        return seq_hlist_start(head, pos - 1);
+}
+EXPORT_SYMBOL(seq_hlist_start_head);
+
+/**
+ * seq_hlist_next - move to the next position of the hlist
+ * @v:    the current iterator
+ * @head: the head of the hlist
+ * @pos:  the current posision
+ *
+ * Called at seq_file->op->next().
+ */
+struct hlist_node *seq_hlist_next(void *v, struct hlist_head *head,
+                                  loff_t *ppos)
+{
+        struct hlist_node *node = v;
+
+        ++*ppos;
+        if (v == SEQ_START_TOKEN)
+                return head->first;
+        else
+                return node->next;
+}
+EXPORT_SYMBOL(seq_hlist_next);
+
+/**
+ * seq_hlist_start_rcu - start an iteration of a hlist protected by RCU
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start().
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+struct hlist_node *seq_hlist_start_rcu(struct hlist_head *head,
+                                       loff_t pos)
+{
+        struct hlist_node *node;
+
+        __hlist_for_each_rcu(node, head)
+                if (pos-- == 0)
+                        return node;
+        return NULL;
+}
+EXPORT_SYMBOL(seq_hlist_start_rcu);
+
+/**
+ * seq_hlist_start_head_rcu - start an iteration of a hlist protected by RCU
+ * @head: the head of the hlist
+ * @pos:  the start position of the sequence
+ *
+ * Called at seq_file->op->start(). Call this function if you want to
+ * print a header at the top of the output.
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+struct hlist_node *seq_hlist_start_head_rcu(struct hlist_head *head,
+                                            loff_t pos)
+{
+        if (!pos)
+                return SEQ_START_TOKEN;
+
+        return seq_hlist_start_rcu(head, pos - 1);
+}
+EXPORT_SYMBOL(seq_hlist_start_head_rcu);
+
+/**
+ * seq_hlist_next_rcu - move to the next position of the hlist protected by RCU
+ * @v:    the current iterator
+ * @head: the head of the hlist
+ * @pos:  the current posision
+ *
+ * Called at seq_file->op->next().
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+struct hlist_node *seq_hlist_next_rcu(void *v,
+                                      struct hlist_head *head,
+                                      loff_t *ppos)
+{
+        struct hlist_node *node = v;
+
+        ++*ppos;
+        if (v == SEQ_START_TOKEN)
+                return rcu_dereference(head->first);
+        else
+                return rcu_dereference(node->next);
+}
+EXPORT_SYMBOL(seq_hlist_next_rcu);
diff --git a/fs/squashfs/Makefile b/fs/squashfs/Makefile
index 70e3244fa30f..df8a19ef870d 100644
--- a/fs/squashfs/Makefile
+++ b/fs/squashfs/Makefile
@@ -4,4 +4,4 @@
 
 obj-$(CONFIG_SQUASHFS) += squashfs.o
 squashfs-y += block.o cache.o dir.o export.o file.o fragment.o id.o inode.o
-squashfs-y += namei.o super.o symlink.o
+squashfs-y += namei.o super.o symlink.o zlib_wrapper.o decompressor.o
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2a7960310349..1cb0d81b164b 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -29,15 +29,14 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/mutex.h>
 #include <linux/string.h>
 #include <linux/buffer_head.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
 #include "squashfs_fs_i.h"
 #include "squashfs.h"
+#include "decompressor.h"
 
 /*
  * Read the metadata block length, this is stored in the first two
@@ -153,72 +152,10 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
         }
 
         if (compressed) {
-                int zlib_err = 0, zlib_init = 0;
-
-                /*
-                 * Uncompress block.
-                 */
-
-                mutex_lock(&msblk->read_data_mutex);
-
-                msblk->stream.avail_out = 0;
-                msblk->stream.avail_in = 0;
-
-                bytes = length;
-                do {
-                        if (msblk->stream.avail_in == 0 && k < b) {
-                                avail = min(bytes, msblk->devblksize - offset);
-                                bytes -= avail;
-                                wait_on_buffer(bh[k]);
-                                if (!buffer_uptodate(bh[k]))
-                                        goto release_mutex;
-
-                                if (avail == 0) {
-                                        offset = 0;
-                                        put_bh(bh[k++]);
-                                        continue;
-                                }
-
-                                msblk->stream.next_in = bh[k]->b_data + offset;
-                                msblk->stream.avail_in = avail;
-                                offset = 0;
-                        }
-
-                        if (msblk->stream.avail_out == 0 && page < pages) {
-                                msblk->stream.next_out = buffer[page++];
-                                msblk->stream.avail_out = PAGE_CACHE_SIZE;
-                        }
-
-                        if (!zlib_init) {
-                                zlib_err = zlib_inflateInit(&msblk->stream);
-                                if (zlib_err != Z_OK) {
-                                        ERROR("zlib_inflateInit returned"
-                                                " unexpected result 0x%x,"
-                                                " srclength %d\n", zlib_err,
-                                                srclength);
-                                        goto release_mutex;
-                                }
-                                zlib_init = 1;
-                        }
-
-                        zlib_err = zlib_inflate(&msblk->stream, Z_SYNC_FLUSH);
-
-                        if (msblk->stream.avail_in == 0 && k < b)
-                                put_bh(bh[k++]);
-                } while (zlib_err == Z_OK);
-
-                if (zlib_err != Z_STREAM_END) {
-                        ERROR("zlib_inflate error, data probably corrupt\n");
-                        goto release_mutex;
-                }
-
-                zlib_err = zlib_inflateEnd(&msblk->stream);
-                if (zlib_err != Z_OK) {
-                        ERROR("zlib_inflate error, data probably corrupt\n");
-                        goto release_mutex;
-                }
-                length = msblk->stream.total_out;
-                mutex_unlock(&msblk->read_data_mutex);
+                length = squashfs_decompress(msblk, buffer, bh, b, offset,
+                         length, srclength, pages);
+                if (length < 0)
+                        goto read_failure;
         } else {
                 /*
                  * Block is uncompressed.
@@ -255,9 +192,6 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
         kfree(bh);
         return length;
 
-release_mutex:
-        mutex_unlock(&msblk->read_data_mutex);
-
 block_release:
         for (; k < b; k++)
                 put_bh(bh[k]);
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index 40c98fa6b5d6..57314bee9059 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -51,7 +51,6 @@
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/wait.h>
-#include <linux/zlib.h>
 #include <linux/pagemap.h>
 
 #include "squashfs_fs.h"
diff --git a/fs/squashfs/decompressor.c b/fs/squashfs/decompressor.c
new file mode 100644
index 000000000000..157478da6ac9
--- /dev/null
+++ b/fs/squashfs/decompressor.c
@@ -0,0 +1,68 @@
+/*
+ * Squashfs - a compressed read only filesystem for Linux
+ *
+ * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
+ * Phillip Lougher <phillip@lougher.demon.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ * decompressor.c
+ */
+
+#include <linux/types.h>
+#include <linux/mutex.h>
+#include <linux/buffer_head.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "squashfs_fs_i.h"
+#include "decompressor.h"
+#include "squashfs.h"
+
+/*
+ * This file (and decompressor.h) implements a decompressor framework for
+ * Squashfs, allowing multiple decompressors to be easily supported
+ */
+
+static const struct squashfs_decompressor squashfs_lzma_unsupported_comp_ops = {
+        NULL, NULL, NULL, LZMA_COMPRESSION, "lzma", 0
+};
+
+static const struct squashfs_decompressor squashfs_lzo_unsupported_comp_ops = {
+        NULL, NULL, NULL, LZO_COMPRESSION, "lzo", 0
+};
+
+static const struct squashfs_decompressor squashfs_unknown_comp_ops = {
+        NULL, NULL, NULL, 0, "unknown", 0
+};
+
+static const struct squashfs_decompressor *decompressor[] = {
+        &squashfs_zlib_comp_ops,
+        &squashfs_lzma_unsupported_comp_ops,
+        &squashfs_lzo_unsupported_comp_ops,
+        &squashfs_unknown_comp_ops
+};
+
+
+const struct squashfs_decompressor *squashfs_lookup_decompressor(int id)
+{
+        int i;
+
+        for (i = 0; decompressor[i]->id; i++)
+                if (id == decompressor[i]->id)
+                        break;
+
+        return decompressor[i];
+}
diff --git a/fs/squashfs/decompressor.h b/fs/squashfs/decompressor.h
new file mode 100644
index 000000000000..7425f80783f6
--- /dev/null
+++ b/fs/squashfs/decompressor.h
@@ -0,0 +1,55 @@
+#ifndef DECOMPRESSOR_H
+#define DECOMPRESSOR_H
+/*
+ * Squashfs - a compressed read only filesystem for Linux
+ *
+ * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
+ * Phillip Lougher <phillip@lougher.demon.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ * decompressor.h
+ */
+
+struct squashfs_decompressor {
+        void    *(*init)(struct squashfs_sb_info *);
+        void    (*free)(void *);
+        int     (*decompress)(struct squashfs_sb_info *, void **,
+                struct buffer_head **, int, int, int, int, int);
+        int     id;
+        char    *name;
+        int     supported;
+};
+
+static inline void *squashfs_decompressor_init(struct squashfs_sb_info *msblk)
+{
+        return msblk->decompressor->init(msblk);
+}
+
+static inline void squashfs_decompressor_free(struct squashfs_sb_info *msblk,
+        void *s)
+{
+        if (msblk->decompressor)
+                msblk->decompressor->free(s);
+}
+
+static inline int squashfs_decompress(struct squashfs_sb_info *msblk,
+        void **buffer, struct buffer_head **bh, int b, int offset, int length,
+        int srclength, int pages)
+{
+        return msblk->decompressor->decompress(msblk, buffer, bh, b, offset,
+                length, srclength, pages);
+}
+#endif
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index 566b0eaed868..12b933ac6585 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -30,7 +30,6 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
index 2b1b8fe5e037..7f93d5a9ee05 100644
--- a/fs/squashfs/export.c
+++ b/fs/squashfs/export.c
@@ -39,7 +39,6 @@
 #include <linux/vfs.h>
 #include <linux/dcache.h>
 #include <linux/exportfs.h>
-#include <linux/zlib.h>
 #include <linux/slab.h>
 
 #include "squashfs_fs.h"
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 717767d831df..a25c5060bdcb 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -47,7 +47,6 @@
 #include <linux/string.h>
 #include <linux/pagemap.h>
 #include <linux/mutex.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index b5a2c15bbbc7..7c90bbd6879d 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -36,7 +36,6 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
index 3795b837ba28..b7f64bcd2b70 100644
--- a/fs/squashfs/id.c
+++ b/fs/squashfs/id.c
@@ -34,7 +34,6 @@
 #include <linux/fs.h>
 #include <linux/vfs.h>
 #include <linux/slab.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 9101dbde39ec..49daaf669e41 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -40,7 +40,6 @@
 
 #include <linux/fs.h>
 #include <linux/vfs.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
index 9e398653b22b..5266bd8ad932 100644
--- a/fs/squashfs/namei.c
+++ b/fs/squashfs/namei.c
@@ -57,7 +57,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/dcache.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 0e9feb6adf7e..fe2587af5512 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -51,6 +51,9 @@ extern struct squashfs_cache_entry *squashfs_get_datablock(struct super_block *,
                                 u64, int);
 extern int squashfs_read_table(struct super_block *, void *, u64, int);
 
+/* decompressor.c */
+extern const struct squashfs_decompressor *squashfs_lookup_decompressor(int);
+
 /* export.c */
 extern __le64 *squashfs_read_inode_lookup_table(struct super_block *, u64,
                                 unsigned int);
@@ -71,7 +74,7 @@ extern struct inode *squashfs_iget(struct super_block *, long long,
 extern int squashfs_read_inode(struct inode *, long long);
 
 /*
- * Inodes and files operations
+ * Inodes, files and decompressor operations
  */
 
 /* dir.c */
@@ -88,3 +91,6 @@ extern const struct inode_operations squashfs_dir_inode_ops;
 
 /* symlink.c */
 extern const struct address_space_operations squashfs_symlink_aops;
+
+/* zlib_wrapper.c */
+extern const struct squashfs_decompressor squashfs_zlib_comp_ops;
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index 283daafc568e..79024245ea00 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -183,8 +183,6 @@
 #define SQUASHFS_MAX_FILE_SIZE          (1LL << \
                                         (SQUASHFS_MAX_FILE_SIZE_LOG - 2))
 
-#define SQUASHFS_MARKER_BYTE            0xff
-
 /* meta index cache */
 #define SQUASHFS_META_INDEXES   (SQUASHFS_METADATA_SIZE / sizeof(unsigned int))
 #define SQUASHFS_META_ENTRIES   127
@@ -211,7 +209,9 @@ struct meta_index {
 /*
  * definitions for structures on disk
  */
-#define ZLIB_COMPRESSION         1
+#define ZLIB_COMPRESSION        1
+#define LZMA_COMPRESSION        2
+#define LZO_COMPRESSION         3
 
 struct squashfs_super_block {
         __le32                  s_magic;
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index c8c65614dd1c..2e77dc547e25 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -52,25 +52,25 @@ struct squashfs_cache_entry {
 };
 
 struct squashfs_sb_info {
-        int                     devblksize;
-        int                     devblksize_log2;
-        struct squashfs_cache   *block_cache;
-        struct squashfs_cache   *fragment_cache;
-        struct squashfs_cache   *read_page;
-        int                     next_meta_index;
-        __le64                  *id_table;
-        __le64                  *fragment_index;
-        unsigned int            *fragment_index_2;
-        struct mutex            read_data_mutex;
-        struct mutex            meta_index_mutex;
-        struct meta_index       *meta_index;
-        z_stream                stream;
-        __le64                  *inode_lookup_table;
-        u64                     inode_table;
-        u64                     directory_table;
-        unsigned int            block_size;
-        unsigned short          block_log;
-        long long               bytes_used;
-        unsigned int            inodes;
+        const struct squashfs_decompressor      *decompressor;
+        int                                     devblksize;
+        int                                     devblksize_log2;
+        struct squashfs_cache                   *block_cache;
+        struct squashfs_cache                   *fragment_cache;
+        struct squashfs_cache                   *read_page;
+        int                                     next_meta_index;
+        __le64                                  *id_table;
+        __le64                                  *fragment_index;
+        struct mutex                            read_data_mutex;
+        struct mutex                            meta_index_mutex;
+        struct meta_index                       *meta_index;
+        void                                    *stream;
+        __le64                                  *inode_lookup_table;
+        u64                                     inode_table;
+        u64                                     directory_table;
+        unsigned int                            block_size;
+        unsigned short                          block_log;
+        long long                               bytes_used;
+        unsigned int                            inodes;
 };
 #endif
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 6c197ef53add..3550aec2f655 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -35,34 +35,41 @@
 #include <linux/pagemap.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/zlib.h>
 #include <linux/magic.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
 #include "squashfs_fs_i.h"
 #include "squashfs.h"
+#include "decompressor.h"
 
 static struct file_system_type squashfs_fs_type;
 static const struct super_operations squashfs_super_ops;
 
-static int supported_squashfs_filesystem(short major, short minor, short comp)
+static const struct squashfs_decompressor *supported_squashfs_filesystem(short
+        major, short minor, short id)
 {
+        const struct squashfs_decompressor *decompressor;
+
         if (major < SQUASHFS_MAJOR) {
                 ERROR("Major/Minor mismatch, older Squashfs %d.%d "
                         "filesystems are unsupported\n", major, minor);
-                return -EINVAL;
+                return NULL;
         } else if (major > SQUASHFS_MAJOR || minor > SQUASHFS_MINOR) {
                 ERROR("Major/Minor mismatch, trying to mount newer "
                         "%d.%d filesystem\n", major, minor);
                 ERROR("Please update your kernel\n");
-                return -EINVAL;
+                return NULL;
         }
 
-        if (comp != ZLIB_COMPRESSION)
-                return -EINVAL;
+        decompressor = squashfs_lookup_decompressor(id);
+        if (!decompressor->supported) {
+                ERROR("Filesystem uses \"%s\" compression. This is not "
+                        "supported\n", decompressor->name);
+                return NULL;
+        }
 
-        return 0;
+        return decompressor;
 }
 
 
@@ -87,13 +94,6 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         }
         msblk = sb->s_fs_info;
 
-        msblk->stream.workspace = kmalloc(zlib_inflate_workspacesize(),
-                GFP_KERNEL);
-        if (msblk->stream.workspace == NULL) {
-                ERROR("Failed to allocate zlib workspace\n");
-                goto failure;
-        }
-
         sblk = kzalloc(sizeof(*sblk), GFP_KERNEL);
         if (sblk == NULL) {
                 ERROR("Failed to allocate squashfs_super_block\n");
@@ -120,25 +120,25 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount;
         }
 
+        err = -EINVAL;
+
         /* Check it is a SQUASHFS superblock */
         sb->s_magic = le32_to_cpu(sblk->s_magic);
         if (sb->s_magic != SQUASHFS_MAGIC) {
                 if (!silent)
                         ERROR("Can't find a SQUASHFS superblock on %s\n",
                                                 bdevname(sb->s_bdev, b));
-                err = -EINVAL;
                 goto failed_mount;
         }
 
-        /* Check the MAJOR & MINOR versions and compression type */
-        err = supported_squashfs_filesystem(le16_to_cpu(sblk->s_major),
+        /* Check the MAJOR & MINOR versions and lookup compression type */
+        msblk->decompressor = supported_squashfs_filesystem(
+                        le16_to_cpu(sblk->s_major),
                         le16_to_cpu(sblk->s_minor),
                         le16_to_cpu(sblk->compression));
-        if (err < 0)
+        if (msblk->decompressor == NULL)
                 goto failed_mount;
 
-        err = -EINVAL;
-
         /*
          * Check if there's xattrs in the filesystem.  These are not
          * supported in this version, so warn that they will be ignored.
@@ -205,6 +205,10 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 
         err = -ENOMEM;
 
+        msblk->stream = squashfs_decompressor_init(msblk);
+        if (msblk->stream == NULL)
+                goto failed_mount;
+
         msblk->block_cache = squashfs_cache_init("metadata",
                         SQUASHFS_CACHED_BLKS, SQUASHFS_METADATA_SIZE);
         if (msblk->block_cache == NULL)
@@ -292,17 +296,16 @@ failed_mount:
         squashfs_cache_delete(msblk->block_cache);
         squashfs_cache_delete(msblk->fragment_cache);
         squashfs_cache_delete(msblk->read_page);
+        squashfs_decompressor_free(msblk, msblk->stream);
         kfree(msblk->inode_lookup_table);
         kfree(msblk->fragment_index);
         kfree(msblk->id_table);
-        kfree(msblk->stream.workspace);
         kfree(sb->s_fs_info);
         sb->s_fs_info = NULL;
         kfree(sblk);
         return err;
 
 failure:
-        kfree(msblk->stream.workspace);
         kfree(sb->s_fs_info);
         sb->s_fs_info = NULL;
         return -ENOMEM;
@@ -346,10 +349,10 @@ static void squashfs_put_super(struct super_block *sb)
                 squashfs_cache_delete(sbi->block_cache);
                 squashfs_cache_delete(sbi->fragment_cache);
                 squashfs_cache_delete(sbi->read_page);
+                squashfs_decompressor_free(sbi, sbi->stream);
                 kfree(sbi->id_table);
                 kfree(sbi->fragment_index);
                 kfree(sbi->meta_index);
-                kfree(sbi->stream.workspace);
                 kfree(sb->s_fs_info);
                 sb->s_fs_info = NULL;
         }
diff --git a/fs/squashfs/symlink.c b/fs/squashfs/symlink.c
index 83d87880aac8..e80be2022a7f 100644
--- a/fs/squashfs/symlink.c
+++ b/fs/squashfs/symlink.c
@@ -36,7 +36,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/pagemap.h>
-#include <linux/zlib.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
new file mode 100644
index 000000000000..4dd70e04333b
--- /dev/null
+++ b/fs/squashfs/zlib_wrapper.c
@@ -0,0 +1,150 @@
+/*
+ * Squashfs - a compressed read only filesystem for Linux
+ *
+ * Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
+ * Phillip Lougher <phillip@lougher.demon.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2,
+ * or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ * zlib_wrapper.c
+ */
+
+
+#include <linux/mutex.h>
+#include <linux/buffer_head.h>
+#include <linux/zlib.h>
+
+#include "squashfs_fs.h"
+#include "squashfs_fs_sb.h"
+#include "squashfs_fs_i.h"
+#include "squashfs.h"
+#include "decompressor.h"
+
+static void *zlib_init(struct squashfs_sb_info *dummy)
+{
+        z_stream *stream = kmalloc(sizeof(z_stream), GFP_KERNEL);
+        if (stream == NULL)
+                goto failed;
+        stream->workspace = kmalloc(zlib_inflate_workspacesize(),
+                GFP_KERNEL);
+        if (stream->workspace == NULL)
+                goto failed;
+
+        return stream;
+
+failed:
+        ERROR("Failed to allocate zlib workspace\n");
+        kfree(stream);
+        return NULL;
+}
+
+
+static void zlib_free(void *strm)
+{
+        z_stream *stream = strm;
+
+        if (stream)
+                kfree(stream->workspace);
+        kfree(stream);
+}
+
+
+static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
+        struct buffer_head **bh, int b, int offset, int length, int srclength,
+        int pages)
+{
+        int zlib_err = 0, zlib_init = 0;
+        int avail, bytes, k = 0, page = 0;
+        z_stream *stream = msblk->stream;
+
+        mutex_lock(&msblk->read_data_mutex);
+
+        stream->avail_out = 0;
+        stream->avail_in = 0;
+
+        bytes = length;
+        do {
+                if (stream->avail_in == 0 && k < b) {
+                        avail = min(bytes, msblk->devblksize - offset);
+                        bytes -= avail;
+                        wait_on_buffer(bh[k]);
+                        if (!buffer_uptodate(bh[k]))
+                                goto release_mutex;
+
+                        if (avail == 0) {
+                                offset = 0;
+                                put_bh(bh[k++]);
+                                continue;
+                        }
+
+                        stream->next_in = bh[k]->b_data + offset;
+                        stream->avail_in = avail;
+                        offset = 0;
+                }
+
+                if (stream->avail_out == 0 && page < pages) {
+                        stream->next_out = buffer[page++];
+                        stream->avail_out = PAGE_CACHE_SIZE;
+                }
+
+                if (!zlib_init) {
+                        zlib_err = zlib_inflateInit(stream);
+                        if (zlib_err != Z_OK) {
+                                ERROR("zlib_inflateInit returned unexpected "
+                                        "result 0x%x, srclength %d\n",
+                                        zlib_err, srclength);
+                                goto release_mutex;
+                        }
+                        zlib_init = 1;
+                }
+
+                zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
+
+                if (stream->avail_in == 0 && k < b)
+                        put_bh(bh[k++]);
+        } while (zlib_err == Z_OK);
+
+        if (zlib_err != Z_STREAM_END) {
+                ERROR("zlib_inflate error, data probably corrupt\n");
+                goto release_mutex;
+        }
+
+        zlib_err = zlib_inflateEnd(stream);
+        if (zlib_err != Z_OK) {
+                ERROR("zlib_inflate error, data probably corrupt\n");
+                goto release_mutex;
+        }
+
+        mutex_unlock(&msblk->read_data_mutex);
+        return stream->total_out;
+
+release_mutex:
+        mutex_unlock(&msblk->read_data_mutex);
+
+        for (; k < b; k++)
+                put_bh(bh[k]);
+
+        return -EIO;
+}
+
+const struct squashfs_decompressor squashfs_zlib_comp_ops = {
+        .init = zlib_init,
+        .free = zlib_free,
+        .decompress = zlib_uncompress,
+        .id = ZLIB_COMPRESSION,
+        .name = "zlib",
+        .supported = 1
+};
+
diff --git a/fs/super.c b/fs/super.c
index aff046b0fe78..f35ac6022109 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -568,7 +568,7 @@ out:
 int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
 {
         int retval;
-        int remount_rw;
+        int remount_rw, remount_ro;
 
         if (sb->s_frozen != SB_UNFROZEN)
                 return -EBUSY;
@@ -583,9 +583,12 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
         shrink_dcache_sb(sb);
         sync_filesystem(sb);
 
+        remount_ro = (flags & MS_RDONLY) && !(sb->s_flags & MS_RDONLY);
+        remount_rw = !(flags & MS_RDONLY) && (sb->s_flags & MS_RDONLY);
+
         /* If we are remounting RDONLY and current sb is read/write,
            make sure there are no rw files opened */
-        if ((flags & MS_RDONLY) && !(sb->s_flags & MS_RDONLY)) {
+        if (remount_ro) {
                 if (force)
                         mark_files_ro(sb);
                 else if (!fs_may_remount_ro(sb))
@@ -594,7 +597,6 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
                 if (retval < 0 && retval != -ENOSYS)
                         return -EBUSY;
         }
-        remount_rw = !(flags & MS_RDONLY) && (sb->s_flags & MS_RDONLY);
 
         if (sb->s_op->remount_fs) {
                 retval = sb->s_op->remount_fs(sb, &flags, data);
@@ -604,6 +606,16 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
         sb->s_flags = (sb->s_flags & ~MS_RMT_MASK) | (flags & MS_RMT_MASK);
         if (remount_rw)
                 vfs_dq_quota_on_remount(sb);
+        /*
+         * Some filesystems modify their metadata via some other path than the
+         * bdev buffer cache (eg. use a private mapping, or directories in
+         * pagecache, etc). Also file data modifications go via their own
+         * mappings. So If we try to mount readonly then copy the filesystem
+         * from bdev, we could get stale data, so invalidate it to give a best
+         * effort at coherency.
+         */
+        if (remount_ro && sb->s_bdev)
+                invalidate_bdev(sb->s_bdev);
         return 0;
 }
 
@@ -925,6 +937,9 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void
         if (!mnt)
                 goto out;
 
+        if (flags & MS_KERNMOUNT)
+                mnt->mnt_flags = MNT_INTERNAL;
+
         if (data && !(type->fs_flags & FS_BINARY_MOUNTDATA)) {
                 secdata = alloc_secdata();
                 if (!secdata)
diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
index 9824743832a7..4573734d723d 100644
--- a/fs/sysv/inode.c
+++ b/fs/sysv/inode.c
@@ -26,6 +26,7 @@
 #include <linux/init.h>
 #include <linux/buffer_head.h>
 #include <linux/vfs.h>
+#include <linux/writeback.h>
 #include <linux/namei.h>
 #include <asm/byteorder.h>
 #include "sysv.h"
@@ -246,7 +247,7 @@ bad_inode:
         return ERR_PTR(-EIO);
 }
 
-int sysv_write_inode(struct inode *inode, int wait)
+static int __sysv_write_inode(struct inode *inode, int wait)
 {
         struct super_block * sb = inode->i_sb;
         struct sysv_sb_info * sbi = SYSV_SB(sb);
@@ -296,9 +297,14 @@ int sysv_write_inode(struct inode *inode, int wait)
         return 0;
 }
 
+int sysv_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return __sysv_write_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
+}
+
 int sysv_sync_inode(struct inode *inode)
 {
-        return sysv_write_inode(inode, 1);
+        return __sysv_write_inode(inode, 1);
 }
 
 static void sysv_delete_inode(struct inode *inode)
diff --git a/fs/sysv/sysv.h b/fs/sysv/sysv.h
index 53786eb5cf60..94cb9b4d76c2 100644
--- a/fs/sysv/sysv.h
+++ b/fs/sysv/sysv.h
@@ -142,7 +142,7 @@ extern int __sysv_write_begin(struct file *file, struct address_space *mapping,
 
 /* inode.c */
 extern struct inode *sysv_iget(struct super_block *, unsigned int);
-extern int sysv_write_inode(struct inode *, int);
+extern int sysv_write_inode(struct inode *, struct writeback_control *wbc);
 extern int sysv_sync_inode(struct inode *);
 extern void sysv_set_inode(struct inode *, dev_t);
 extern int sysv_getattr(struct vfsmount *, struct dentry *, struct kstat *);
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 552fb0111fff..401e503d44a1 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -1120,7 +1120,7 @@ static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (release)
                 ubifs_release_budget(c, &ino_req);
         if (IS_SYNC(old_inode))
-                err = old_inode->i_sb->s_op->write_inode(old_inode, 1);
+                err = old_inode->i_sb->s_op->write_inode(old_inode, NULL);
         return err;
 
 out_cancel:
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 16a6444330ec..e26c02ab6cd5 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -1011,7 +1011,7 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)
         /* Is the page fully inside @i_size? */
         if (page->index < end_index) {
                 if (page->index >= synced_i_size >> PAGE_CACHE_SHIFT) {
-                        err = inode->i_sb->s_op->write_inode(inode, 1);
+                        err = inode->i_sb->s_op->write_inode(inode, NULL);
                         if (err)
                                 goto out_unlock;
                         /*
@@ -1039,7 +1039,7 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)
         kunmap_atomic(kaddr, KM_USER0);
 
         if (i_size > synced_i_size) {
-                err = inode->i_sb->s_op->write_inode(inode, 1);
+                err = inode->i_sb->s_op->write_inode(inode, NULL);
                 if (err)
                         goto out_unlock;
         }
@@ -1242,7 +1242,7 @@ static int do_setattr(struct ubifs_info *c, struct inode *inode,
         if (release)
                 ubifs_release_budget(c, &req);
         if (IS_SYNC(inode))
-                err = inode->i_sb->s_op->write_inode(inode, 1);
+                err = inode->i_sb->s_op->write_inode(inode, NULL);
         return err;
 
 out:
@@ -1316,7 +1316,7 @@ int ubifs_fsync(struct file *file, struct dentry *dentry, int datasync)
          * the inode unless this is a 'datasync()' call.
          */
         if (!datasync || (inode->i_state & I_DIRTY_DATASYNC)) {
-                err = inode->i_sb->s_op->write_inode(inode, 1);
+                err = inode->i_sb->s_op->write_inode(inode, NULL);
                 if (err)
                         return err;
         }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 43f9d19a6f33..4d2f2157dd3f 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -283,7 +283,7 @@ static void ubifs_destroy_inode(struct inode *inode)
 /*
  * Note, Linux write-back code calls this without 'i_mutex'.
  */
-static int ubifs_write_inode(struct inode *inode, int wait)
+static int ubifs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int err = 0;
         struct ubifs_info *c = inode->i_sb->s_fs_info;
diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index 82372e332f08..b2d96f45c12b 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -547,7 +547,7 @@ static void udf_table_free_blocks(struct super_block *sb,
                 }
 
                 if (epos.offset + (2 * adsize) > sb->s_blocksize) {
-                        char *sptr, *dptr;
+                        unsigned char *sptr, *dptr;
                         int loffset;
 
                         brelse(oepos.bh);
diff --git a/fs/udf/dir.c b/fs/udf/dir.c
index 61d9a76a3a69..f0f2a436251e 100644
--- a/fs/udf/dir.c
+++ b/fs/udf/dir.c
@@ -45,8 +45,8 @@ static int do_udf_readdir(struct inode *dir, struct file *filp,
         int block, iblock;
         loff_t nf_pos = (filp->f_pos - 1) << 2;
         int flen;
-        char *fname = NULL;
-        char *nameptr;
+        unsigned char *fname = NULL;
+        unsigned char *nameptr;
         uint16_t liu;
         uint8_t lfi;
         loff_t size = udf_ext0_offset(dir) + dir->i_size;
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index f90231eb2916..b02089247296 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1373,12 +1373,12 @@ static mode_t udf_convert_permissions(struct fileEntry *fe)
         return mode;
 }
 
-int udf_write_inode(struct inode *inode, int sync)
+int udf_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int ret;
 
         lock_kernel();
-        ret = udf_update_inode(inode, sync);
+        ret = udf_update_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
         unlock_kernel();
 
         return ret;
@@ -1672,7 +1672,7 @@ int8_t udf_add_aext(struct inode *inode, struct extent_position *epos,
                 return -1;
 
         if (epos->offset + (2 * adsize) > inode->i_sb->s_blocksize) {
-                char *sptr, *dptr;
+                unsigned char *sptr, *dptr;
                 struct buffer_head *nbh;
                 int err, loffset;
                 struct kernel_lb_addr obloc = epos->block;
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index cd2115060fdc..7c56ff00cd53 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -34,8 +34,8 @@
 #include <linux/crc-itu-t.h>
 #include <linux/exportfs.h>
 
-static inline int udf_match(int len1, const char *name1, int len2,
-                            const char *name2)
+static inline int udf_match(int len1, const unsigned char *name1, int len2,
+                            const unsigned char *name2)
 {
         if (len1 != len2)
                 return 0;
@@ -142,15 +142,15 @@ int udf_write_fi(struct inode *inode, struct fileIdentDesc *cfi,
 }
 
 static struct fileIdentDesc *udf_find_entry(struct inode *dir,
-                                            struct qstr *child,
+                                            const struct qstr *child,
                                             struct udf_fileident_bh *fibh,
                                             struct fileIdentDesc *cfi)
 {
         struct fileIdentDesc *fi = NULL;
         loff_t f_pos;
         int block, flen;
-        char *fname = NULL;
-        char *nameptr;
+        unsigned char *fname = NULL;
+        unsigned char *nameptr;
         uint8_t lfi;
         uint16_t liu;
         loff_t size;
@@ -308,7 +308,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
 {
         struct super_block *sb = dir->i_sb;
         struct fileIdentDesc *fi = NULL;
-        char *name = NULL;
+        unsigned char *name = NULL;
         int namelen;
         loff_t f_pos;
         loff_t size = udf_ext0_offset(dir) + dir->i_size;
@@ -885,16 +885,16 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
 {
         struct inode *inode;
         struct pathComponent *pc;
-        char *compstart;
+        const char *compstart;
         struct udf_fileident_bh fibh;
         struct extent_position epos = {};
         int eoffset, elen = 0;
         struct fileIdentDesc *fi;
         struct fileIdentDesc cfi;
-        char *ea;
+        uint8_t *ea;
         int err;
         int block;
-        char *name = NULL;
+        unsigned char *name = NULL;
         int namelen;
         struct buffer_head *bh;
         struct udf_inode_info *iinfo;
@@ -970,7 +970,7 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
 
                 pc = (struct pathComponent *)(ea + elen);
 
-                compstart = (char *)symname;
+                compstart = symname;
 
                 do {
                         symname++;
diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
index c3265e1385d4..852e91845688 100644
--- a/fs/udf/symlink.c
+++ b/fs/udf/symlink.c
@@ -32,12 +32,12 @@
 #include <linux/buffer_head.h>
 #include "udf_i.h"
 
-static void udf_pc_to_char(struct super_block *sb, char *from, int fromlen,
-                           char *to)
+static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+                           int fromlen, unsigned char *to)
 {
         struct pathComponent *pc;
         int elen = 0;
-        char *p = to;
+        unsigned char *p = to;
 
         while (elen < fromlen) {
                 pc = (struct pathComponent *)(from + elen);
@@ -75,9 +75,9 @@ static int udf_symlink_filler(struct file *file, struct page *page)
 {
         struct inode *inode = page->mapping->host;
         struct buffer_head *bh = NULL;
-        char *symlink;
+        unsigned char *symlink;
         int err = -EIO;
-        char *p = kmap(page);
+        unsigned char *p = kmap(page);
         struct udf_inode_info *iinfo;
 
         lock_kernel();
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 8d46f4294ee7..4223ac855da9 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -142,7 +142,7 @@ extern void udf_truncate(struct inode *);
 extern void udf_read_inode(struct inode *);
 extern void udf_delete_inode(struct inode *);
 extern void udf_clear_inode(struct inode *);
-extern int udf_write_inode(struct inode *, int);
+extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
 extern long udf_block_map(struct inode *, sector_t);
 extern int udf_extend_file(struct inode *, struct extent_position *,
                            struct kernel_long_ad *, sector_t);
diff --git a/fs/ufs/dir.c b/fs/ufs/dir.c
index 22af68f8b682..317a0d444f6b 100644
--- a/fs/ufs/dir.c
+++ b/fs/ufs/dir.c
@@ -31,7 +31,7 @@
  * len <= UFS_MAXNAMLEN and de != NULL are guaranteed by caller.
  */
 static inline int ufs_match(struct super_block *sb, int len,
-                const char * const name, struct ufs_dir_entry * de)
+                const unsigned char *name, struct ufs_dir_entry *de)
 {
         if (len != ufs_get_de_namlen(sb, de))
                 return 0;
@@ -70,7 +70,7 @@ static inline unsigned long ufs_dir_pages(struct inode *inode)
         return (inode->i_size+PAGE_CACHE_SIZE-1)>>PAGE_CACHE_SHIFT;
 }
 
-ino_t ufs_inode_by_name(struct inode *dir, struct qstr *qstr)
+ino_t ufs_inode_by_name(struct inode *dir, const struct qstr *qstr)
 {
         ino_t res = 0;
         struct ufs_dir_entry *de;
@@ -249,11 +249,11 @@ struct ufs_dir_entry *ufs_dotdot(struct inode *dir, struct page **p)
  * (as a parameter - res_dir). Page is returned mapped and unlocked.
  * Entry is guaranteed to be valid.
  */
-struct ufs_dir_entry *ufs_find_entry(struct inode *dir, struct qstr *qstr,
+struct ufs_dir_entry *ufs_find_entry(struct inode *dir, const struct qstr *qstr,
                                      struct page **res_page)
 {
         struct super_block *sb = dir->i_sb;
-        const char *name = qstr->name;
+        const unsigned char *name = qstr->name;
         int namelen = qstr->len;
         unsigned reclen = UFS_DIR_REC_LEN(namelen);
         unsigned long start, n;
@@ -313,7 +313,7 @@ found:
 int ufs_add_link(struct dentry *dentry, struct inode *inode)
 {
         struct inode *dir = dentry->d_parent->d_inode;
-        const char *name = dentry->d_name.name;
+        const unsigned char *name = dentry->d_name.name;
         int namelen = dentry->d_name.len;
         struct super_block *sb = dir->i_sb;
         unsigned reclen = UFS_DIR_REC_LEN(namelen);
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7cf33379fd46..0a627e08610b 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -36,6 +36,7 @@
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
 
 #include "ufs_fs.h"
 #include "ufs.h"
@@ -890,11 +891,11 @@ static int ufs_update_inode(struct inode * inode, int do_sync)
         return 0;
 }
 
-int ufs_write_inode (struct inode * inode, int wait)
+int ufs_write_inode(struct inode *inode, struct writeback_control *wbc)
 {
         int ret;
         lock_kernel();
-        ret = ufs_update_inode (inode, wait);
+        ret = ufs_update_inode(inode, wbc->sync_mode == WB_SYNC_ALL);
         unlock_kernel();
         return ret;
 }
diff --git a/fs/ufs/ufs.h b/fs/ufs/ufs.h
index 0b4c39bc0d9e..43f9f5d5670e 100644
--- a/fs/ufs/ufs.h
+++ b/fs/ufs/ufs.h
@@ -86,9 +86,9 @@ extern void ufs_put_cylinder (struct super_block *, unsigned);
 /* dir.c */
 extern const struct inode_operations ufs_dir_inode_operations;
 extern int ufs_add_link (struct dentry *, struct inode *);
-extern ino_t ufs_inode_by_name(struct inode *, struct qstr *);
+extern ino_t ufs_inode_by_name(struct inode *, const struct qstr *);
 extern int ufs_make_empty(struct inode *, struct inode *);
-extern struct ufs_dir_entry *ufs_find_entry(struct inode *, struct qstr *, struct page **);
+extern struct ufs_dir_entry *ufs_find_entry(struct inode *, const struct qstr *, struct page **);
 extern int ufs_delete_entry(struct inode *, struct ufs_dir_entry *, struct page *);
 extern int ufs_empty_dir (struct inode *);
 extern struct ufs_dir_entry *ufs_dotdot(struct inode *, struct page **);
@@ -106,7 +106,7 @@ extern struct inode * ufs_new_inode (struct inode *, int);
 
 /* inode.c */
 extern struct inode *ufs_iget(struct super_block *, unsigned long);
-extern int ufs_write_inode (struct inode *, int);
+extern int ufs_write_inode (struct inode *, struct writeback_control *);
 extern int ufs_sync_inode (struct inode *);
 extern void ufs_delete_inode (struct inode *);
 extern struct buffer_head * ufs_bread (struct inode *, unsigned, int, int *);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 25ea2408118f..71345a370d9f 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -1063,7 +1063,7 @@ xfs_log_inode(
 STATIC int
 xfs_fs_write_inode(
         struct inode            *inode,
-        int                     sync)
+        struct writeback_control *wbc)
 {
         struct xfs_inode        *ip = XFS_I(inode);
         struct xfs_mount        *mp = ip->i_mount;
@@ -1074,11 +1074,7 @@ xfs_fs_write_inode(
         if (XFS_FORCED_SHUTDOWN(mp))
                 return XFS_ERROR(EIO);
 
-        if (sync) {
-                error = xfs_wait_on_pages(ip, 0, -1);
-                if (error)
-                        goto out;
-
+        if (wbc->sync_mode == WB_SYNC_ALL) {
                 /*
                  * Make sure the inode has hit stable storage.  By using the
                  * log and the fsync transactions we reduce the IOs we have
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 70504fcf14cd..14dafd608230 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -245,7 +245,7 @@ typedef struct xfs_mount {
         struct xfs_qmops        *m_qm_ops;      /* vector of XQM ops */
         atomic_t                m_active_trans; /* number trans frozen */
 #ifdef HAVE_PERCPU_SB
-        xfs_icsb_cnts_t         *m_sb_cnts;     /* per-cpu superblock counters */
+        xfs_icsb_cnts_t __percpu *m_sb_cnts;    /* per-cpu superblock counters */
         unsigned long           m_icsb_counters; /* disabled per-cpu counters */
         struct notifier_block   m_icsb_notifier; /* hotplug cpu notifier */
         struct mutex            m_icsb_mutex;   /* balancer sync lock */