47 files changed, 5422 insertions, 2102 deletions

diff --git a/fs/Kconfig b/fs/Kconfig
index f9b5842c8d2d..20f9b557732d 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -393,18 +393,30 @@ config INOTIFY
         bool "Inotify file change notification support"
         default y
         ---help---
-          Say Y here to enable inotify support and the associated system
-          calls.  Inotify is a file change notification system and a
-          replacement for dnotify.  Inotify fixes numerous shortcomings in
-          dnotify and introduces several new features.  It allows monitoring
-          of both files and directories via a single open fd.  Other features
-          include multiple file events, one-shot support, and unmount
+          Say Y here to enable inotify support.  Inotify is a file change
+          notification system and a replacement for dnotify.  Inotify fixes
+          numerous shortcomings in dnotify and introduces several new features
+          including multiple file events, one-shot support, and unmount
           notification.
 
           For more information, see Documentation/filesystems/inotify.txt
 
           If unsure, say Y.
 
+config INOTIFY_USER
+        bool "Inotify support for userspace"
+        depends on INOTIFY
+        default y
+        ---help---
+          Say Y here to enable inotify support for userspace, including the
+          associated system calls.  Inotify allows monitoring of both files and
+          directories via a single open fd.  Events are read from the file
+          descriptor, which is also select()- and poll()-able.
+
+          For more information, see Documentation/filesystems/inotify.txt
+
+          If unsure, say Y.
+
 config QUOTA
         bool "Quota support"
         help
@@ -1101,6 +1113,44 @@ config JFFS2_SUMMARY
 
           If unsure, say 'N'.
 
+config JFFS2_FS_XATTR
+        bool "JFFS2 XATTR support (EXPERIMENTAL)"
+        depends on JFFS2_FS && EXPERIMENTAL && !JFFS2_FS_WRITEBUFFER
+        default n
+        help
+          Extended attributes are name:value pairs associated with inodes by
+          the kernel or by users (see the attr(5) manual page, or visit
+          <http://acl.bestbits.at/> for details).
+          
+          If unsure, say N.
+
+config JFFS2_FS_POSIX_ACL
+        bool "JFFS2 POSIX Access Control Lists"
+        depends on JFFS2_FS_XATTR
+        default y
+        select FS_POSIX_ACL
+        help
+          Posix Access Control Lists (ACLs) support permissions for users and
+          groups beyond the owner/group/world scheme.
+          
+          To learn more about Access Control Lists, visit the Posix ACLs for
+          Linux website <http://acl.bestbits.at/>.
+          
+          If you don't know what Access Control Lists are, say N
+
+config JFFS2_FS_SECURITY
+        bool "JFFS2 Security Labels"
+        depends on JFFS2_FS_XATTR
+        default y
+        help
+          Security labels support alternative access control models
+          implemented by security modules like SELinux.  This option
+          enables an extended attribute handler for file security
+          labels in the jffs2 filesystem.
+          
+          If you are not using a security module that requires using
+          extended attributes for file security labels, say N.
+
 config JFFS2_COMPRESSION_OPTIONS
         bool "Advanced compression options for JFFS2"
         depends on JFFS2_FS
diff --git a/fs/Makefile b/fs/Makefile
index 078d3d1191a5..d0ea6bfccf29 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -13,6 +13,7 @@ obj-y :=	open.o read_write.o file_table.o buffer.o  bio.o super.o \
                 ioprio.o pnode.o drop_caches.o splice.o sync.o
 
 obj-$(CONFIG_INOTIFY)           += inotify.o
+obj-$(CONFIG_INOTIFY_USER)      += inotify_user.o
 obj-$(CONFIG_EPOLL)             += eventpoll.o
 obj-$(CONFIG_COMPAT)            += compat.o compat_ioctl.o
 
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 1b4491cdd115..2695337d4d64 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -337,20 +337,20 @@ static inline int ep_cmp_ffd(struct epoll_filefd *p1,
 /* Special initialization for the rb-tree node to detect linkage */
 static inline void ep_rb_initnode(struct rb_node *n)
 {
-        n->rb_parent = n;
+        rb_set_parent(n, n);
 }
 
 /* Removes a node from the rb-tree and marks it for a fast is-linked check */
 static inline void ep_rb_erase(struct rb_node *n, struct rb_root *r)
 {
         rb_erase(n, r);
-        n->rb_parent = n;
+        rb_set_parent(n, n);
 }
 
 /* Fast check to verify that the item is linked to the main rb-tree */
 static inline int ep_rb_linked(struct rb_node *n)
 {
-        return n->rb_parent != n;
+        return rb_parent(n) != n;
 }
 
 /*
diff --git a/fs/exec.c b/fs/exec.c
index 3a79d97ac234..d07858c0b7c4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -49,6 +49,7 @@
 #include <linux/rmap.h>
 #include <linux/acct.h>
 #include <linux/cn_proc.h>
+#include <linux/audit.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -1085,6 +1086,11 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
         /* kernel module loader fixup */
         /* so we don't try to load run modprobe in kernel space. */
         set_fs(USER_DS);
+
+        retval = audit_bprm(bprm);
+        if (retval)
+                return retval;
+
         retval = -ENOENT;
         for (try=0; try<2; try++) {
                 read_lock(&binfmt_lock);
diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
index f37528ed222e..fbb0d4ed07d4 100644
--- a/fs/ext3/dir.c
+++ b/fs/ext3/dir.c
@@ -284,7 +284,7 @@ static void free_rb_tree_fname(struct rb_root *root)
                  * beginning of the loop and try to free the parent
                  * node.
                  */
-                parent = n->rb_parent;
+                parent = rb_parent(n);
                 fname = rb_entry(n, struct fname, rb_hash);
                 while (fname) {
                         struct fname * old = fname;
diff --git a/fs/inotify.c b/fs/inotify.c
index 732ec4bd5774..723836a1f718 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -5,7 +5,10 @@
  *      John McCutchan  <ttb@tentacle.dhs.org>
  *      Robert Love     <rml@novell.com>
  *
+ * Kernel API added by: Amy Griffis <amy.griffis@hp.com>
+ *
  * Copyright (C) 2005 John McCutchan
+ * Copyright 2006 Hewlett-Packard Development Company, L.P.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -20,35 +23,17 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
 #include <linux/slab.h>
 #include <linux/fs.h>
-#include <linux/file.h>
-#include <linux/mount.h>
-#include <linux/namei.h>
-#include <linux/poll.h>
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/writeback.h>
 #include <linux/inotify.h>
-#include <linux/syscalls.h>
-
-#include <asm/ioctls.h>
 
 static atomic_t inotify_cookie;
 
-static kmem_cache_t *watch_cachep __read_mostly;
-static kmem_cache_t *event_cachep __read_mostly;
-
-static struct vfsmount *inotify_mnt __read_mostly;
-
-/* these are configurable via /proc/sys/fs/inotify/ */
-int inotify_max_user_instances __read_mostly;
-int inotify_max_user_watches __read_mostly;
-int inotify_max_queued_events __read_mostly;
-
 /*
  * Lock ordering:
  *
@@ -56,327 +41,108 @@ int inotify_max_queued_events __read_mostly;
  * iprune_mutex (synchronize shrink_icache_memory())
  *      inode_lock (protects the super_block->s_inodes list)
  *      inode->inotify_mutex (protects inode->inotify_watches and watches->i_list)
- *              inotify_dev->mutex (protects inotify_device and watches->d_list)
+ *              inotify_handle->mutex (protects inotify_handle and watches->h_list)
+ *
+ * The inode->inotify_mutex and inotify_handle->mutex and held during execution
+ * of a caller's event handler.  Thus, the caller must not hold any locks
+ * taken in their event handler while calling any of the published inotify
+ * interfaces.
  */
 
 /*
- * Lifetimes of the three main data structures--inotify_device, inode, and
+ * Lifetimes of the three main data structures--inotify_handle, inode, and
  * inotify_watch--are managed by reference count.
  *
- * inotify_device: Lifetime is from inotify_init() until release.  Additional
- * references can bump the count via get_inotify_dev() and drop the count via
- * put_inotify_dev().
+ * inotify_handle: Lifetime is from inotify_init() to inotify_destroy().
+ * Additional references can bump the count via get_inotify_handle() and drop
+ * the count via put_inotify_handle().
  *
- * inotify_watch: Lifetime is from create_watch() to destory_watch().
- * Additional references can bump the count via get_inotify_watch() and drop
- * the count via put_inotify_watch().
+ * inotify_watch: for inotify's purposes, lifetime is from inotify_add_watch()
+ * to remove_watch_no_event().  Additional references can bump the count via
+ * get_inotify_watch() and drop the count via put_inotify_watch().  The caller
+ * is reponsible for the final put after receiving IN_IGNORED, or when using
+ * IN_ONESHOT after receiving the first event.  Inotify does the final put if
+ * inotify_destroy() is called.
  *
  * inode: Pinned so long as the inode is associated with a watch, from
- * create_watch() to put_inotify_watch().
+ * inotify_add_watch() to the final put_inotify_watch().
  */
 
 /*
- * struct inotify_device - represents an inotify instance
+ * struct inotify_handle - represents an inotify instance
  *
  * This structure is protected by the mutex 'mutex'.
  */
-struct inotify_device {
-        wait_queue_head_t       wq;             /* wait queue for i/o */
+struct inotify_handle {
         struct idr              idr;            /* idr mapping wd -> watch */
         struct mutex            mutex;          /* protects this bad boy */
-        struct list_head        events;         /* list of queued events */
         struct list_head        watches;        /* list of watches */
         atomic_t                count;          /* reference count */
-        struct user_struct      *user;          /* user who opened this dev */
-        unsigned int            queue_size;     /* size of the queue (bytes) */
-        unsigned int            event_count;    /* number of pending events */
-        unsigned int            max_events;     /* maximum number of events */
         u32                     last_wd;        /* the last wd allocated */
+        const struct inotify_operations *in_ops; /* inotify caller operations */
 };
 
-/*
- * struct inotify_kernel_event - An inotify event, originating from a watch and
- * queued for user-space.  A list of these is attached to each instance of the
- * device.  In read(), this list is walked and all events that can fit in the
- * buffer are returned.
- *
- * Protected by dev->mutex of the device in which we are queued.
- */
-struct inotify_kernel_event {
-        struct inotify_event    event;  /* the user-space event */
-        struct list_head        list;   /* entry in inotify_device's list */
-        char                    *name;  /* filename, if any */
-};
-
-/*
- * struct inotify_watch - represents a watch request on a specific inode
- *
- * d_list is protected by dev->mutex of the associated watch->dev.
- * i_list and mask are protected by inode->inotify_mutex of the associated inode.
- * dev, inode, and wd are never written to once the watch is created.
- */
-struct inotify_watch {
-        struct list_head        d_list; /* entry in inotify_device's list */
-        struct list_head        i_list; /* entry in inode's list */
-        atomic_t                count;  /* reference count */
-        struct inotify_device   *dev;   /* associated device */
-        struct inode            *inode; /* associated inode */
-        s32                     wd;     /* watch descriptor */
-        u32                     mask;   /* event mask for this watch */
-};
-
-#ifdef CONFIG_SYSCTL
-
-#include <linux/sysctl.h>
-
-static int zero;
-
-ctl_table inotify_table[] = {
-        {
-                .ctl_name       = INOTIFY_MAX_USER_INSTANCES,
-                .procname       = "max_user_instances",
-                .data           = &inotify_max_user_instances,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
-                .extra1         = &zero,
-        },
-        {
-                .ctl_name       = INOTIFY_MAX_USER_WATCHES,
-                .procname       = "max_user_watches",
-                .data           = &inotify_max_user_watches,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec,
-                .extra1         = &zero, 
-        },
-        {
-                .ctl_name       = INOTIFY_MAX_QUEUED_EVENTS,
-                .procname       = "max_queued_events",
-                .data           = &inotify_max_queued_events,
-                .maxlen         = sizeof(int),
-                .mode           = 0644, 
-                .proc_handler   = &proc_dointvec_minmax,
-                .strategy       = &sysctl_intvec, 
-                .extra1         = &zero
-        },
-        { .ctl_name = 0 }
-};
-#endif /* CONFIG_SYSCTL */
-
-static inline void get_inotify_dev(struct inotify_device *dev)
+static inline void get_inotify_handle(struct inotify_handle *ih)
 {
-        atomic_inc(&dev->count);
+        atomic_inc(&ih->count);
 }
 
-static inline void put_inotify_dev(struct inotify_device *dev)
+static inline void put_inotify_handle(struct inotify_handle *ih)
 {
-        if (atomic_dec_and_test(&dev->count)) {
-                atomic_dec(&dev->user->inotify_devs);
-                free_uid(dev->user);
-                idr_destroy(&dev->idr);
-                kfree(dev);
+        if (atomic_dec_and_test(&ih->count)) {
+                idr_destroy(&ih->idr);
+                kfree(ih);
         }
 }
 
-static inline void get_inotify_watch(struct inotify_watch *watch)
+/**
+ * get_inotify_watch - grab a reference to an inotify_watch
+ * @watch: watch to grab
+ */
+void get_inotify_watch(struct inotify_watch *watch)
 {
         atomic_inc(&watch->count);
 }
+EXPORT_SYMBOL_GPL(get_inotify_watch);
 
-/*
+/**
  * put_inotify_watch - decrements the ref count on a given watch.  cleans up
- * the watch and its references if the count reaches zero.
+ * watch references if the count reaches zero.  inotify_watch is freed by
+ * inotify callers via the destroy_watch() op.
+ * @watch: watch to release
  */
-static inline void put_inotify_watch(struct inotify_watch *watch)
+void put_inotify_watch(struct inotify_watch *watch)
 {
         if (atomic_dec_and_test(&watch->count)) {
-                put_inotify_dev(watch->dev);
-                iput(watch->inode);
-                kmem_cache_free(watch_cachep, watch);
-        }
-}
-
-/*
- * kernel_event - create a new kernel event with the given parameters
- *
- * This function can sleep.
- */
-static struct inotify_kernel_event * kernel_event(s32 wd, u32 mask, u32 cookie,
-                                                  const char *name)
-{
-        struct inotify_kernel_event *kevent;
-
-        kevent = kmem_cache_alloc(event_cachep, GFP_KERNEL);
-        if (unlikely(!kevent))
-                return NULL;
-
-        /* we hand this out to user-space, so zero it just in case */
-        memset(&kevent->event, 0, sizeof(struct inotify_event));
-
-        kevent->event.wd = wd;
-        kevent->event.mask = mask;
-        kevent->event.cookie = cookie;
-
-        INIT_LIST_HEAD(&kevent->list);
-
-        if (name) {
-                size_t len, rem, event_size = sizeof(struct inotify_event);
-
-                /*
-                 * We need to pad the filename so as to properly align an
-                 * array of inotify_event structures.  Because the structure is
-                 * small and the common case is a small filename, we just round
-                 * up to the next multiple of the structure's sizeof.  This is
-                 * simple and safe for all architectures.
-                 */
-                len = strlen(name) + 1;
-                rem = event_size - len;
-                if (len > event_size) {
-                        rem = event_size - (len % event_size);
-                        if (len % event_size == 0)
-                                rem = 0;
-                }
-
-                kevent->name = kmalloc(len + rem, GFP_KERNEL);
-                if (unlikely(!kevent->name)) {
-                        kmem_cache_free(event_cachep, kevent);
-                        return NULL;
-                }
-                memcpy(kevent->name, name, len);
-                if (rem)
-                        memset(kevent->name + len, 0, rem);             
-                kevent->event.len = len + rem;
-        } else {
-                kevent->event.len = 0;
-                kevent->name = NULL;
-        }
-
-        return kevent;
-}
-
-/*
- * inotify_dev_get_event - return the next event in the given dev's queue
- *
- * Caller must hold dev->mutex.
- */
-static inline struct inotify_kernel_event *
-inotify_dev_get_event(struct inotify_device *dev)
-{
-        return list_entry(dev->events.next, struct inotify_kernel_event, list);
-}
-
-/*
- * inotify_dev_queue_event - add a new event to the given device
- *
- * Caller must hold dev->mutex.  Can sleep (calls kernel_event()).
- */
-static void inotify_dev_queue_event(struct inotify_device *dev,
-                                    struct inotify_watch *watch, u32 mask,
-                                    u32 cookie, const char *name)
-{
-        struct inotify_kernel_event *kevent, *last;
-
-        /* coalescing: drop this event if it is a dupe of the previous */
-        last = inotify_dev_get_event(dev);
-        if (last && last->event.mask == mask && last->event.wd == watch->wd &&
-                        last->event.cookie == cookie) {
-                const char *lastname = last->name;
-
-                if (!name && !lastname)
-                        return;
-                if (name && lastname && !strcmp(lastname, name))
-                        return;
-        }
-
-        /* the queue overflowed and we already sent the Q_OVERFLOW event */
-        if (unlikely(dev->event_count > dev->max_events))
-                return;
-
-        /* if the queue overflows, we need to notify user space */
-        if (unlikely(dev->event_count == dev->max_events))
-                kevent = kernel_event(-1, IN_Q_OVERFLOW, cookie, NULL);
-        else
-                kevent = kernel_event(watch->wd, mask, cookie, name);
-
-        if (unlikely(!kevent))
-                return;
-
-        /* queue the event and wake up anyone waiting */
-        dev->event_count++;
-        dev->queue_size += sizeof(struct inotify_event) + kevent->event.len;
-        list_add_tail(&kevent->list, &dev->events);
-        wake_up_interruptible(&dev->wq);
-}
-
-/*
- * remove_kevent - cleans up and ultimately frees the given kevent
- *
- * Caller must hold dev->mutex.
- */
-static void remove_kevent(struct inotify_device *dev,
-                          struct inotify_kernel_event *kevent)
-{
-        list_del(&kevent->list);
-
-        dev->event_count--;
-        dev->queue_size -= sizeof(struct inotify_event) + kevent->event.len;
-
-        kfree(kevent->name);
-        kmem_cache_free(event_cachep, kevent);
-}
+                struct inotify_handle *ih = watch->ih;
 
-/*
- * inotify_dev_event_dequeue - destroy an event on the given device
- *
- * Caller must hold dev->mutex.
- */
-static void inotify_dev_event_dequeue(struct inotify_device *dev)
-{
-        if (!list_empty(&dev->events)) {
-                struct inotify_kernel_event *kevent;
-                kevent = inotify_dev_get_event(dev);
-                remove_kevent(dev, kevent);
+                iput(watch->inode);
+                ih->in_ops->destroy_watch(watch);
+                put_inotify_handle(ih);
         }
 }
+EXPORT_SYMBOL_GPL(put_inotify_watch);
 
 /*
- * inotify_dev_get_wd - returns the next WD for use by the given dev
+ * inotify_handle_get_wd - returns the next WD for use by the given handle
  *
- * Callers must hold dev->mutex.  This function can sleep.
+ * Callers must hold ih->mutex.  This function can sleep.
  */
-static int inotify_dev_get_wd(struct inotify_device *dev,
-                              struct inotify_watch *watch)
+static int inotify_handle_get_wd(struct inotify_handle *ih,
+                                 struct inotify_watch *watch)
 {
         int ret;
 
         do {
-                if (unlikely(!idr_pre_get(&dev->idr, GFP_KERNEL)))
+                if (unlikely(!idr_pre_get(&ih->idr, GFP_KERNEL)))
                         return -ENOSPC;
-                ret = idr_get_new_above(&dev->idr, watch, dev->last_wd+1, &watch->wd);
+                ret = idr_get_new_above(&ih->idr, watch, ih->last_wd+1, &watch->wd);
         } while (ret == -EAGAIN);
 
-        return ret;
-}
+        if (likely(!ret))
+                ih->last_wd = watch->wd;
 
-/*
- * find_inode - resolve a user-given path to a specific inode and return a nd
- */
-static int find_inode(const char __user *dirname, struct nameidata *nd,
-                      unsigned flags)
-{
-        int error;
-
-        error = __user_walk(dirname, flags, nd);
-        if (error)
-                return error;
-        /* you can only watch an inode if you have read permissions on it */
-        error = vfs_permission(nd, MAY_READ);
-        if (error) 
-                path_release(nd);
-        return error;
+        return ret;
 }
 
 /*
@@ -422,67 +188,18 @@ static void set_dentry_child_flags(struct inode *inode, int watched)
 }
 
 /*
- * create_watch - creates a watch on the given device.
- *
- * Callers must hold dev->mutex.  Calls inotify_dev_get_wd() so may sleep.
- * Both 'dev' and 'inode' (by way of nameidata) need to be pinned.
- */
-static struct inotify_watch *create_watch(struct inotify_device *dev,
-                                          u32 mask, struct inode *inode)
-{
-        struct inotify_watch *watch;
-        int ret;
-
-        if (atomic_read(&dev->user->inotify_watches) >=
-                        inotify_max_user_watches)
-                return ERR_PTR(-ENOSPC);
-
-        watch = kmem_cache_alloc(watch_cachep, GFP_KERNEL);
-        if (unlikely(!watch))
-                return ERR_PTR(-ENOMEM);
-
-        ret = inotify_dev_get_wd(dev, watch);
-        if (unlikely(ret)) {
-                kmem_cache_free(watch_cachep, watch);
-                return ERR_PTR(ret);
-        }
-
-        dev->last_wd = watch->wd;
-        watch->mask = mask;
-        atomic_set(&watch->count, 0);
-        INIT_LIST_HEAD(&watch->d_list);
-        INIT_LIST_HEAD(&watch->i_list);
-
-        /* save a reference to device and bump the count to make it official */
-        get_inotify_dev(dev);
-        watch->dev = dev;
-
-        /*
-         * Save a reference to the inode and bump the ref count to make it
-         * official.  We hold a reference to nameidata, which makes this safe.
-         */
-        watch->inode = igrab(inode);
-
-        /* bump our own count, corresponding to our entry in dev->watches */
-        get_inotify_watch(watch);
-
-        atomic_inc(&dev->user->inotify_watches);
-
-        return watch;
-}
-
-/*
- * inotify_find_dev - find the watch associated with the given inode and dev
+ * inotify_find_handle - find the watch associated with the given inode and
+ * handle
  *
  * Callers must hold inode->inotify_mutex.
  */
-static struct inotify_watch *inode_find_dev(struct inode *inode,
-                                            struct inotify_device *dev)
+static struct inotify_watch *inode_find_handle(struct inode *inode,
+                                               struct inotify_handle *ih)
 {
         struct inotify_watch *watch;
 
         list_for_each_entry(watch, &inode->inotify_watches, i_list) {
-                if (watch->dev == dev)
+                if (watch->ih == ih)
                         return watch;
         }
 
@@ -490,40 +207,40 @@ static struct inotify_watch *inode_find_dev(struct inode *inode,
 }
 
 /*
- * remove_watch_no_event - remove_watch() without the IN_IGNORED event.
+ * remove_watch_no_event - remove watch without the IN_IGNORED event.
+ *
+ * Callers must hold both inode->inotify_mutex and ih->mutex.
  */
 static void remove_watch_no_event(struct inotify_watch *watch,
-                                  struct inotify_device *dev)
+                                  struct inotify_handle *ih)
 {
         list_del(&watch->i_list);
-        list_del(&watch->d_list);
+        list_del(&watch->h_list);
 
         if (!inotify_inode_watched(watch->inode))
                 set_dentry_child_flags(watch->inode, 0);
 
-        atomic_dec(&dev->user->inotify_watches);
-        idr_remove(&dev->idr, watch->wd);
-        put_inotify_watch(watch);
+        idr_remove(&ih->idr, watch->wd);
 }
 
-/*
- * remove_watch - Remove a watch from both the device and the inode.  Sends
- * the IN_IGNORED event to the given device signifying that the inode is no
- * longer watched.
- *
- * Callers must hold both inode->inotify_mutex and dev->mutex.  We drop a
- * reference to the inode before returning.
+/**
+ * inotify_remove_watch_locked - Remove a watch from both the handle and the
+ * inode.  Sends the IN_IGNORED event signifying that the inode is no longer
+ * watched.  May be invoked from a caller's event handler.
+ * @ih: inotify handle associated with watch
+ * @watch: watch to remove
  *
- * The inode is not iput() so as to remain atomic.  If the inode needs to be
- * iput(), the call returns one.  Otherwise, it returns zero.
+ * Callers must hold both inode->inotify_mutex and ih->mutex.
  */
-static void remove_watch(struct inotify_watch *watch,struct inotify_device *dev)
+void inotify_remove_watch_locked(struct inotify_handle *ih,
+                                 struct inotify_watch *watch)
 {
-        inotify_dev_queue_event(dev, watch, IN_IGNORED, 0, NULL);
-        remove_watch_no_event(watch, dev);
+        remove_watch_no_event(watch, ih);
+        ih->in_ops->handle_event(watch, watch->wd, IN_IGNORED, 0, NULL, NULL);
 }
+EXPORT_SYMBOL_GPL(inotify_remove_watch_locked);
 
-/* Kernel API */
+/* Kernel API for producing events */
 
 /*
  * inotify_d_instantiate - instantiate dcache entry for inode
@@ -563,9 +280,10 @@ void inotify_d_move(struct dentry *entry)
  * @mask: event mask describing this event
  * @cookie: cookie for synchronization, or zero
  * @name: filename, if any
+ * @n_inode: inode associated with name
  */
 void inotify_inode_queue_event(struct inode *inode, u32 mask, u32 cookie,
-                               const char *name)
+                               const char *name, struct inode *n_inode)
 {
         struct inotify_watch *watch, *next;
 
@@ -576,14 +294,13 @@ void inotify_inode_queue_event(struct inode *inode, u32 mask, u32 cookie,
         list_for_each_entry_safe(watch, next, &inode->inotify_watches, i_list) {
                 u32 watch_mask = watch->mask;
                 if (watch_mask & mask) {
-                        struct inotify_device *dev = watch->dev;
-                        get_inotify_watch(watch);
-                        mutex_lock(&dev->mutex);
-                        inotify_dev_queue_event(dev, watch, mask, cookie, name);
+                        struct inotify_handle *ih= watch->ih;
+                        mutex_lock(&ih->mutex);
                         if (watch_mask & IN_ONESHOT)
-                                remove_watch_no_event(watch, dev);
-                        mutex_unlock(&dev->mutex);
-                        put_inotify_watch(watch);
+                                remove_watch_no_event(watch, ih);
+                        ih->in_ops->handle_event(watch, watch->wd, mask, cookie,
+                                                 name, n_inode);
+                        mutex_unlock(&ih->mutex);
                 }
         }
         mutex_unlock(&inode->inotify_mutex);
@@ -613,7 +330,8 @@ void inotify_dentry_parent_queue_event(struct dentry *dentry, u32 mask,
         if (inotify_inode_watched(inode)) {
                 dget(parent);
                 spin_unlock(&dentry->d_lock);
-                inotify_inode_queue_event(inode, mask, cookie, name);
+                inotify_inode_queue_event(inode, mask, cookie, name,
+                                          dentry->d_inode);
                 dput(parent);
         } else
                 spin_unlock(&dentry->d_lock);
@@ -665,7 +383,7 @@ void inotify_unmount_inodes(struct list_head *list)
 
                 need_iput_tmp = need_iput;
                 need_iput = NULL;
-                /* In case the remove_watch() drops a reference. */
+                /* In case inotify_remove_watch_locked() drops a reference. */
                 if (inode != need_iput_tmp)
                         __iget(inode);
                 else
@@ -694,11 +412,12 @@ void inotify_unmount_inodes(struct list_head *list)
                 mutex_lock(&inode->inotify_mutex);
                 watches = &inode->inotify_watches;
                 list_for_each_entry_safe(watch, next_w, watches, i_list) {
-                        struct inotify_device *dev = watch->dev;
-                        mutex_lock(&dev->mutex);
-                        inotify_dev_queue_event(dev, watch, IN_UNMOUNT,0,NULL);
-                        remove_watch(watch, dev);
-                        mutex_unlock(&dev->mutex);
+                        struct inotify_handle *ih= watch->ih;
+                        mutex_lock(&ih->mutex);
+                        ih->in_ops->handle_event(watch, watch->wd, IN_UNMOUNT, 0,
+                                                 NULL, NULL);
+                        inotify_remove_watch_locked(ih, watch);
+                        mutex_unlock(&ih->mutex);
                 }
                 mutex_unlock(&inode->inotify_mutex);
                 iput(inode);            
@@ -718,432 +437,292 @@ void inotify_inode_is_dead(struct inode *inode)
 
         mutex_lock(&inode->inotify_mutex);
         list_for_each_entry_safe(watch, next, &inode->inotify_watches, i_list) {
-                struct inotify_device *dev = watch->dev;
-                mutex_lock(&dev->mutex);
-                remove_watch(watch, dev);
-                mutex_unlock(&dev->mutex);
+                struct inotify_handle *ih = watch->ih;
+                mutex_lock(&ih->mutex);
+                inotify_remove_watch_locked(ih, watch);
+                mutex_unlock(&ih->mutex);
         }
         mutex_unlock(&inode->inotify_mutex);
 }
 EXPORT_SYMBOL_GPL(inotify_inode_is_dead);
 
-/* Device Interface */
+/* Kernel Consumer API */
 
-static unsigned int inotify_poll(struct file *file, poll_table *wait)
+/**
+ * inotify_init - allocate and initialize an inotify instance
+ * @ops: caller's inotify operations
+ */
+struct inotify_handle *inotify_init(const struct inotify_operations *ops)
 {
-        struct inotify_device *dev = file->private_data;
-        int ret = 0;
+        struct inotify_handle *ih;
 
-        poll_wait(file, &dev->wq, wait);
-        mutex_lock(&dev->mutex);
-        if (!list_empty(&dev->events))
-                ret = POLLIN | POLLRDNORM;
-        mutex_unlock(&dev->mutex);
+        ih = kmalloc(sizeof(struct inotify_handle), GFP_KERNEL);
+        if (unlikely(!ih))
+                return ERR_PTR(-ENOMEM);
 
-        return ret;
+        idr_init(&ih->idr);
+        INIT_LIST_HEAD(&ih->watches);
+        mutex_init(&ih->mutex);
+        ih->last_wd = 0;
+        ih->in_ops = ops;
+        atomic_set(&ih->count, 0);
+        get_inotify_handle(ih);
+
+        return ih;
 }
+EXPORT_SYMBOL_GPL(inotify_init);
 
-static ssize_t inotify_read(struct file *file, char __user *buf,
-                            size_t count, loff_t *pos)
+/**
+ * inotify_init_watch - initialize an inotify watch
+ * @watch: watch to initialize
+ */
+void inotify_init_watch(struct inotify_watch *watch)
 {
-        size_t event_size = sizeof (struct inotify_event);
-        struct inotify_device *dev;
-        char __user *start;
-        int ret;
-        DEFINE_WAIT(wait);
-
-        start = buf;
-        dev = file->private_data;
-
-        while (1) {
-                int events;
-
-                prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE);
-
-                mutex_lock(&dev->mutex);
-                events = !list_empty(&dev->events);
-                mutex_unlock(&dev->mutex);
-                if (events) {
-                        ret = 0;
-                        break;
-                }
-
-                if (file->f_flags & O_NONBLOCK) {
-                        ret = -EAGAIN;
-                        break;
-                }
-
-                if (signal_pending(current)) {
-                        ret = -EINTR;
-                        break;
-                }
-
-                schedule();
-        }
-
-        finish_wait(&dev->wq, &wait);
-        if (ret)
-                return ret;
-
-        mutex_lock(&dev->mutex);
-        while (1) {
-                struct inotify_kernel_event *kevent;
-
-                ret = buf - start;
-                if (list_empty(&dev->events))
-                        break;
-
-                kevent = inotify_dev_get_event(dev);
-                if (event_size + kevent->event.len > count)
-                        break;
-
-                if (copy_to_user(buf, &kevent->event, event_size)) {
-                        ret = -EFAULT;
-                        break;
-                }
-                buf += event_size;
-                count -= event_size;
-
-                if (kevent->name) {
-                        if (copy_to_user(buf, kevent->name, kevent->event.len)){
-                                ret = -EFAULT;
-                                break;
-                        }
-                        buf += kevent->event.len;
-                        count -= kevent->event.len;
-                }
-
-                remove_kevent(dev, kevent);
-        }
-        mutex_unlock(&dev->mutex);
-
-        return ret;
+        INIT_LIST_HEAD(&watch->h_list);
+        INIT_LIST_HEAD(&watch->i_list);
+        atomic_set(&watch->count, 0);
+        get_inotify_watch(watch); /* initial get */
 }
+EXPORT_SYMBOL_GPL(inotify_init_watch);
 
-static int inotify_release(struct inode *ignored, struct file *file)
+/**
+ * inotify_destroy - clean up and destroy an inotify instance
+ * @ih: inotify handle
+ */
+void inotify_destroy(struct inotify_handle *ih)
 {
-        struct inotify_device *dev = file->private_data;
-
         /*
-         * Destroy all of the watches on this device.  Unfortunately, not very
+         * Destroy all of the watches for this handle. Unfortunately, not very
          * pretty.  We cannot do a simple iteration over the list, because we
          * do not know the inode until we iterate to the watch.  But we need to
-         * hold inode->inotify_mutex before dev->mutex.  The following works.
+         * hold inode->inotify_mutex before ih->mutex.  The following works.
          */
         while (1) {
                 struct inotify_watch *watch;
                 struct list_head *watches;
                 struct inode *inode;
 
-                mutex_lock(&dev->mutex);
-                watches = &dev->watches;
+                mutex_lock(&ih->mutex);
+                watches = &ih->watches;
                 if (list_empty(watches)) {
-                        mutex_unlock(&dev->mutex);
+                        mutex_unlock(&ih->mutex);
                         break;
                 }
-                watch = list_entry(watches->next, struct inotify_watch, d_list);
+                watch = list_entry(watches->next, struct inotify_watch, h_list);
                 get_inotify_watch(watch);
-                mutex_unlock(&dev->mutex);
+                mutex_unlock(&ih->mutex);
 
                 inode = watch->inode;
                 mutex_lock(&inode->inotify_mutex);
-                mutex_lock(&dev->mutex);
+                mutex_lock(&ih->mutex);
 
                 /* make sure we didn't race with another list removal */
-                if (likely(idr_find(&dev->idr, watch->wd)))
-                        remove_watch_no_event(watch, dev);
+                if (likely(idr_find(&ih->idr, watch->wd))) {
+                        remove_watch_no_event(watch, ih);
+                        put_inotify_watch(watch);
+                }
 
-                mutex_unlock(&dev->mutex);
+                mutex_unlock(&ih->mutex);
                 mutex_unlock(&inode->inotify_mutex);
                 put_inotify_watch(watch);
         }
 
-        /* destroy all of the events on this device */
-        mutex_lock(&dev->mutex);
-        while (!list_empty(&dev->events))
-                inotify_dev_event_dequeue(dev);
-        mutex_unlock(&dev->mutex);
-
-        /* free this device: the put matching the get in inotify_init() */
-        put_inotify_dev(dev);
-
-        return 0;
+        /* free this handle: the put matching the get in inotify_init() */
+        put_inotify_handle(ih);
 }
+EXPORT_SYMBOL_GPL(inotify_destroy);
 
-/*
- * inotify_ignore - remove a given wd from this inotify instance.
+/**
+ * inotify_find_watch - find an existing watch for an (ih,inode) pair
+ * @ih: inotify handle
+ * @inode: inode to watch
+ * @watchp: pointer to existing inotify_watch
  *
- * Can sleep.
+ * Caller must pin given inode (via nameidata).
  */
-static int inotify_ignore(struct inotify_device *dev, s32 wd)
+s32 inotify_find_watch(struct inotify_handle *ih, struct inode *inode,
+                       struct inotify_watch **watchp)
 {
-        struct inotify_watch *watch;
-        struct inode *inode;
-
-        mutex_lock(&dev->mutex);
-        watch = idr_find(&dev->idr, wd);
-        if (unlikely(!watch)) {
-                mutex_unlock(&dev->mutex);
-                return -EINVAL;
-        }
-        get_inotify_watch(watch);
-        inode = watch->inode;
-        mutex_unlock(&dev->mutex);
+        struct inotify_watch *old;
+        int ret = -ENOENT;
 
         mutex_lock(&inode->inotify_mutex);
-        mutex_lock(&dev->mutex);
+        mutex_lock(&ih->mutex);
 
-        /* make sure that we did not race */
-        if (likely(idr_find(&dev->idr, wd) == watch))
-                remove_watch(watch, dev);
+        old = inode_find_handle(inode, ih);
+        if (unlikely(old)) {
+                get_inotify_watch(old); /* caller must put watch */
+                *watchp = old;
+                ret = old->wd;
+        }
 
-        mutex_unlock(&dev->mutex);
+        mutex_unlock(&ih->mutex);
         mutex_unlock(&inode->inotify_mutex);
-        put_inotify_watch(watch);
 
-        return 0;
+        return ret;
 }
+EXPORT_SYMBOL_GPL(inotify_find_watch);
 
-static long inotify_ioctl(struct file *file, unsigned int cmd,
-                          unsigned long arg)
+/**
+ * inotify_find_update_watch - find and update the mask of an existing watch
+ * @ih: inotify handle
+ * @inode: inode's watch to update
+ * @mask: mask of events to watch
+ *
+ * Caller must pin given inode (via nameidata).
+ */
+s32 inotify_find_update_watch(struct inotify_handle *ih, struct inode *inode,
+                              u32 mask)
 {
-        struct inotify_device *dev;
-        void __user *p;
-        int ret = -ENOTTY;
-
-        dev = file->private_data;
-        p = (void __user *) arg;
-
-        switch (cmd) {
-        case FIONREAD:
-                ret = put_user(dev->queue_size, (int __user *) p);
-                break;
-        }
-
-        return ret;
-}
+        struct inotify_watch *old;
+        int mask_add = 0;
+        int ret;
 
-static const struct file_operations inotify_fops = {
-        .poll           = inotify_poll,
-        .read           = inotify_read,
-        .release        = inotify_release,
-        .unlocked_ioctl = inotify_ioctl,
-        .compat_ioctl   = inotify_ioctl,
-};
+        if (mask & IN_MASK_ADD)
+                mask_add = 1;
 
-asmlinkage long sys_inotify_init(void)
-{
-        struct inotify_device *dev;
-        struct user_struct *user;
-        struct file *filp;      
-        int fd, ret;
-
-        fd = get_unused_fd();
-        if (fd < 0)
-                return fd;
-
-        filp = get_empty_filp();
-        if (!filp) {
-                ret = -ENFILE;
-                goto out_put_fd;
-        }
+        /* don't allow invalid bits: we don't want flags set */
+        mask &= IN_ALL_EVENTS | IN_ONESHOT;
+        if (unlikely(!mask))
+                return -EINVAL;
 
-        user = get_uid(current->user);
-        if (unlikely(atomic_read(&user->inotify_devs) >=
-                        inotify_max_user_instances)) {
-                ret = -EMFILE;
-                goto out_free_uid;
-        }
+        mutex_lock(&inode->inotify_mutex);
+        mutex_lock(&ih->mutex);
 
-        dev = kmalloc(sizeof(struct inotify_device), GFP_KERNEL);
-        if (unlikely(!dev)) {
-                ret = -ENOMEM;
-                goto out_free_uid;
+        /*
+         * Handle the case of re-adding a watch on an (inode,ih) pair that we
+         * are already watching.  We just update the mask and return its wd.
+         */
+        old = inode_find_handle(inode, ih);
+        if (unlikely(!old)) {
+                ret = -ENOENT;
+                goto out;
         }
 
-        filp->f_op = &inotify_fops;
-        filp->f_vfsmnt = mntget(inotify_mnt);
-        filp->f_dentry = dget(inotify_mnt->mnt_root);
-        filp->f_mapping = filp->f_dentry->d_inode->i_mapping;
-        filp->f_mode = FMODE_READ;
-        filp->f_flags = O_RDONLY;
-        filp->private_data = dev;
-
-        idr_init(&dev->idr);
-        INIT_LIST_HEAD(&dev->events);
-        INIT_LIST_HEAD(&dev->watches);
-        init_waitqueue_head(&dev->wq);
-        mutex_init(&dev->mutex);
-        dev->event_count = 0;
-        dev->queue_size = 0;
-        dev->max_events = inotify_max_queued_events;
-        dev->user = user;
-        dev->last_wd = 0;
-        atomic_set(&dev->count, 0);
-
-        get_inotify_dev(dev);
-        atomic_inc(&user->inotify_devs);
-        fd_install(fd, filp);
-
-        return fd;
-out_free_uid:
-        free_uid(user);
-        put_filp(filp);
-out_put_fd:
-        put_unused_fd(fd);
+        if (mask_add)
+                old->mask |= mask;
+        else
+                old->mask = mask;
+        ret = old->wd;
+out:
+        mutex_unlock(&ih->mutex);
+        mutex_unlock(&inode->inotify_mutex);
         return ret;
 }
+EXPORT_SYMBOL_GPL(inotify_find_update_watch);
 
-asmlinkage long sys_inotify_add_watch(int fd, const char __user *path, u32 mask)
+/**
+ * inotify_add_watch - add a watch to an inotify instance
+ * @ih: inotify handle
+ * @watch: caller allocated watch structure
+ * @inode: inode to watch
+ * @mask: mask of events to watch
+ *
+ * Caller must pin given inode (via nameidata).
+ * Caller must ensure it only calls inotify_add_watch() once per watch.
+ * Calls inotify_handle_get_wd() so may sleep.
+ */
+s32 inotify_add_watch(struct inotify_handle *ih, struct inotify_watch *watch,
+                      struct inode *inode, u32 mask)
 {
-        struct inotify_watch *watch, *old;
-        struct inode *inode;
-        struct inotify_device *dev;
-        struct nameidata nd;
-        struct file *filp;
-        int ret, fput_needed;
-        int mask_add = 0;
-        unsigned flags = 0;
-
-        filp = fget_light(fd, &fput_needed);
-        if (unlikely(!filp))
-                return -EBADF;
-
-        /* verify that this is indeed an inotify instance */
-        if (unlikely(filp->f_op != &inotify_fops)) {
-                ret = -EINVAL;
-                goto fput_and_out;
-        }
-
-        if (!(mask & IN_DONT_FOLLOW))
-                flags |= LOOKUP_FOLLOW;
-        if (mask & IN_ONLYDIR)
-                flags |= LOOKUP_DIRECTORY;
-
-        ret = find_inode(path, &nd, flags);
-        if (unlikely(ret))
-                goto fput_and_out;
+        int ret = 0;
 
-        /* inode held in place by reference to nd; dev by fget on fd */
-        inode = nd.dentry->d_inode;
-        dev = filp->private_data;
+        /* don't allow invalid bits: we don't want flags set */
+        mask &= IN_ALL_EVENTS | IN_ONESHOT;
+        if (unlikely(!mask))
+                return -EINVAL;
+        watch->mask = mask;
 
         mutex_lock(&inode->inotify_mutex);
-        mutex_lock(&dev->mutex);
-
-        if (mask & IN_MASK_ADD)
-                mask_add = 1;
+        mutex_lock(&ih->mutex);
 
-        /* don't let user-space set invalid bits: we don't want flags set */
-        mask &= IN_ALL_EVENTS | IN_ONESHOT;
-        if (unlikely(!mask)) {
-                ret = -EINVAL;
+        /* Initialize a new watch */
+        ret = inotify_handle_get_wd(ih, watch);
+        if (unlikely(ret))
                 goto out;
-        }
+        ret = watch->wd;
+
+        /* save a reference to handle and bump the count to make it official */
+        get_inotify_handle(ih);
+        watch->ih = ih;
 
         /*
-         * Handle the case of re-adding a watch on an (inode,dev) pair that we
-         * are already watching.  We just update the mask and return its wd.
+         * Save a reference to the inode and bump the ref count to make it
+         * official.  We hold a reference to nameidata, which makes this safe.
          */
-        old = inode_find_dev(inode, dev);
-        if (unlikely(old)) {
-                if (mask_add)
-                        old->mask |= mask;
-                else
-                        old->mask = mask;
-                ret = old->wd;
-                goto out;
-        }
-
-        watch = create_watch(dev, mask, inode);
-        if (unlikely(IS_ERR(watch))) {
-                ret = PTR_ERR(watch);
-                goto out;
-        }
+        watch->inode = igrab(inode);
 
         if (!inotify_inode_watched(inode))
                 set_dentry_child_flags(inode, 1);
 
-        /* Add the watch to the device's and the inode's list */
-        list_add(&watch->d_list, &dev->watches);
+        /* Add the watch to the handle's and the inode's list */
+        list_add(&watch->h_list, &ih->watches);
         list_add(&watch->i_list, &inode->inotify_watches);
-        ret = watch->wd;
 out:
-        mutex_unlock(&dev->mutex);
+        mutex_unlock(&ih->mutex);
         mutex_unlock(&inode->inotify_mutex);
-        path_release(&nd);
-fput_and_out:
-        fput_light(filp, fput_needed);
         return ret;
 }
+EXPORT_SYMBOL_GPL(inotify_add_watch);
 
-asmlinkage long sys_inotify_rm_watch(int fd, u32 wd)
+/**
+ * inotify_rm_wd - remove a watch from an inotify instance
+ * @ih: inotify handle
+ * @wd: watch descriptor to remove
+ *
+ * Can sleep.
+ */
+int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
 {
-        struct file *filp;
-        struct inotify_device *dev;
-        int ret, fput_needed;
-
-        filp = fget_light(fd, &fput_needed);
-        if (unlikely(!filp))
-                return -EBADF;
+        struct inotify_watch *watch;
+        struct inode *inode;
 
-        /* verify that this is indeed an inotify instance */
-        if (unlikely(filp->f_op != &inotify_fops)) {
-                ret = -EINVAL;
-                goto out;
+        mutex_lock(&ih->mutex);
+        watch = idr_find(&ih->idr, wd);
+        if (unlikely(!watch)) {
+                mutex_unlock(&ih->mutex);
+                return -EINVAL;
         }
+        get_inotify_watch(watch);
+        inode = watch->inode;
+        mutex_unlock(&ih->mutex);
 
-        dev = filp->private_data;
-        ret = inotify_ignore(dev, wd);
+        mutex_lock(&inode->inotify_mutex);
+        mutex_lock(&ih->mutex);
 
-out:
-        fput_light(filp, fput_needed);
-        return ret;
+        /* make sure that we did not race */
+        if (likely(idr_find(&ih->idr, wd) == watch))
+                inotify_remove_watch_locked(ih, watch);
+
+        mutex_unlock(&ih->mutex);
+        mutex_unlock(&inode->inotify_mutex);
+        put_inotify_watch(watch);
+
+        return 0;
 }
+EXPORT_SYMBOL_GPL(inotify_rm_wd);
 
-static struct super_block *
-inotify_get_sb(struct file_system_type *fs_type, int flags,
-               const char *dev_name, void *data)
+/**
+ * inotify_rm_watch - remove a watch from an inotify instance
+ * @ih: inotify handle
+ * @watch: watch to remove
+ *
+ * Can sleep.
+ */
+int inotify_rm_watch(struct inotify_handle *ih,
+                     struct inotify_watch *watch)
 {
-    return get_sb_pseudo(fs_type, "inotify", NULL, 0xBAD1DEA);
+        return inotify_rm_wd(ih, watch->wd);
 }
-
-static struct file_system_type inotify_fs_type = {
-    .name           = "inotifyfs",
-    .get_sb         = inotify_get_sb,
-    .kill_sb        = kill_anon_super,
-};
+EXPORT_SYMBOL_GPL(inotify_rm_watch);
 
 /*
- * inotify_setup - Our initialization function.  Note that we cannnot return
- * error because we have compiled-in VFS hooks.  So an (unlikely) failure here
- * must result in panic().
+ * inotify_setup - core initialization function
  */
 static int __init inotify_setup(void)
 {
-        int ret;
-
-        ret = register_filesystem(&inotify_fs_type);
-        if (unlikely(ret))
-                panic("inotify: register_filesystem returned %d!\n", ret);
-
-        inotify_mnt = kern_mount(&inotify_fs_type);
-        if (IS_ERR(inotify_mnt))
-                panic("inotify: kern_mount ret %ld!\n", PTR_ERR(inotify_mnt));
-
-        inotify_max_queued_events = 16384;
-        inotify_max_user_instances = 128;
-        inotify_max_user_watches = 8192;
-
         atomic_set(&inotify_cookie, 0);
 
-        watch_cachep = kmem_cache_create("inotify_watch_cache",
-                                         sizeof(struct inotify_watch),
-                                         0, SLAB_PANIC, NULL, NULL);
-        event_cachep = kmem_cache_create("inotify_event_cache",
-                                         sizeof(struct inotify_kernel_event),
-                                         0, SLAB_PANIC, NULL, NULL);
-
         return 0;
 }
 
diff --git a/fs/inotify_user.c b/fs/inotify_user.c
new file mode 100644
index 000000000000..9e9931e2badd
--- /dev/null
+++ b/fs/inotify_user.c
@@ -0,0 +1,719 @@
+/*
+ * fs/inotify_user.c - inotify support for userspace
+ *
+ * Authors:
+ *      John McCutchan  <ttb@tentacle.dhs.org>
+ *      Robert Love     <rml@novell.com>
+ *
+ * Copyright (C) 2005 John McCutchan
+ * Copyright 2006 Hewlett-Packard Development Company, L.P.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2, or (at your option) any
+ * later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/poll.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/inotify.h>
+#include <linux/syscalls.h>
+
+#include <asm/ioctls.h>
+
+static kmem_cache_t *watch_cachep __read_mostly;
+static kmem_cache_t *event_cachep __read_mostly;
+
+static struct vfsmount *inotify_mnt __read_mostly;
+
+/* these are configurable via /proc/sys/fs/inotify/ */
+int inotify_max_user_instances __read_mostly;
+int inotify_max_user_watches __read_mostly;
+int inotify_max_queued_events __read_mostly;
+
+/*
+ * Lock ordering:
+ *
+ * inotify_dev->up_mutex (ensures we don't re-add the same watch)
+ *      inode->inotify_mutex (protects inode's watch list)
+ *              inotify_handle->mutex (protects inotify_handle's watch list)
+ *                      inotify_dev->ev_mutex (protects device's event queue)
+ */
+
+/*
+ * Lifetimes of the main data structures:
+ *
+ * inotify_device: Lifetime is managed by reference count, from
+ * sys_inotify_init() until release.  Additional references can bump the count
+ * via get_inotify_dev() and drop the count via put_inotify_dev().
+ *
+ * inotify_user_watch: Lifetime is from create_watch() to the receipt of an
+ * IN_IGNORED event from inotify, or when using IN_ONESHOT, to receipt of the
+ * first event, or to inotify_destroy().
+ */
+
+/*
+ * struct inotify_device - represents an inotify instance
+ *
+ * This structure is protected by the mutex 'mutex'.
+ */
+struct inotify_device {
+        wait_queue_head_t       wq;             /* wait queue for i/o */
+        struct mutex            ev_mutex;       /* protects event queue */
+        struct mutex            up_mutex;       /* synchronizes watch updates */
+        struct list_head        events;         /* list of queued events */
+        atomic_t                count;          /* reference count */
+        struct user_struct      *user;          /* user who opened this dev */
+        struct inotify_handle   *ih;            /* inotify handle */
+        unsigned int            queue_size;     /* size of the queue (bytes) */
+        unsigned int            event_count;    /* number of pending events */
+        unsigned int            max_events;     /* maximum number of events */
+};
+
+/*
+ * struct inotify_kernel_event - An inotify event, originating from a watch and
+ * queued for user-space.  A list of these is attached to each instance of the
+ * device.  In read(), this list is walked and all events that can fit in the
+ * buffer are returned.
+ *
+ * Protected by dev->ev_mutex of the device in which we are queued.
+ */
+struct inotify_kernel_event {
+        struct inotify_event    event;  /* the user-space event */
+        struct list_head        list;   /* entry in inotify_device's list */
+        char                    *name;  /* filename, if any */
+};
+
+/*
+ * struct inotify_user_watch - our version of an inotify_watch, we add
+ * a reference to the associated inotify_device.
+ */
+struct inotify_user_watch {
+        struct inotify_device   *dev;   /* associated device */
+        struct inotify_watch    wdata;  /* inotify watch data */
+};
+
+#ifdef CONFIG_SYSCTL
+
+#include <linux/sysctl.h>
+
+static int zero;
+
+ctl_table inotify_table[] = {
+        {
+                .ctl_name       = INOTIFY_MAX_USER_INSTANCES,
+                .procname       = "max_user_instances",
+                .data           = &inotify_max_user_instances,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+        },
+        {
+                .ctl_name       = INOTIFY_MAX_USER_WATCHES,
+                .procname       = "max_user_watches",
+                .data           = &inotify_max_user_watches,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero,
+        },
+        {
+                .ctl_name       = INOTIFY_MAX_QUEUED_EVENTS,
+                .procname       = "max_queued_events",
+                .data           = &inotify_max_queued_events,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_minmax,
+                .strategy       = &sysctl_intvec,
+                .extra1         = &zero
+        },
+        { .ctl_name = 0 }
+};
+#endif /* CONFIG_SYSCTL */
+
+static inline void get_inotify_dev(struct inotify_device *dev)
+{
+        atomic_inc(&dev->count);
+}
+
+static inline void put_inotify_dev(struct inotify_device *dev)
+{
+        if (atomic_dec_and_test(&dev->count)) {
+                atomic_dec(&dev->user->inotify_devs);
+                free_uid(dev->user);
+                kfree(dev);
+        }
+}
+
+/*
+ * free_inotify_user_watch - cleans up the watch and its references
+ */
+static void free_inotify_user_watch(struct inotify_watch *w)
+{
+        struct inotify_user_watch *watch;
+        struct inotify_device *dev;
+
+        watch = container_of(w, struct inotify_user_watch, wdata);
+        dev = watch->dev;
+
+        atomic_dec(&dev->user->inotify_watches);
+        put_inotify_dev(dev);
+        kmem_cache_free(watch_cachep, watch);
+}
+
+/*
+ * kernel_event - create a new kernel event with the given parameters
+ *
+ * This function can sleep.
+ */
+static struct inotify_kernel_event * kernel_event(s32 wd, u32 mask, u32 cookie,
+                                                  const char *name)
+{
+        struct inotify_kernel_event *kevent;
+
+        kevent = kmem_cache_alloc(event_cachep, GFP_KERNEL);
+        if (unlikely(!kevent))
+                return NULL;
+
+        /* we hand this out to user-space, so zero it just in case */
+        memset(&kevent->event, 0, sizeof(struct inotify_event));
+
+        kevent->event.wd = wd;
+        kevent->event.mask = mask;
+        kevent->event.cookie = cookie;
+
+        INIT_LIST_HEAD(&kevent->list);
+
+        if (name) {
+                size_t len, rem, event_size = sizeof(struct inotify_event);
+
+                /*
+                 * We need to pad the filename so as to properly align an
+                 * array of inotify_event structures.  Because the structure is
+                 * small and the common case is a small filename, we just round
+                 * up to the next multiple of the structure's sizeof.  This is
+                 * simple and safe for all architectures.
+                 */
+                len = strlen(name) + 1;
+                rem = event_size - len;
+                if (len > event_size) {
+                        rem = event_size - (len % event_size);
+                        if (len % event_size == 0)
+                                rem = 0;
+                }
+
+                kevent->name = kmalloc(len + rem, GFP_KERNEL);
+                if (unlikely(!kevent->name)) {
+                        kmem_cache_free(event_cachep, kevent);
+                        return NULL;
+                }
+                memcpy(kevent->name, name, len);
+                if (rem)
+                        memset(kevent->name + len, 0, rem);
+                kevent->event.len = len + rem;
+        } else {
+                kevent->event.len = 0;
+                kevent->name = NULL;
+        }
+
+        return kevent;
+}
+
+/*
+ * inotify_dev_get_event - return the next event in the given dev's queue
+ *
+ * Caller must hold dev->ev_mutex.
+ */
+static inline struct inotify_kernel_event *
+inotify_dev_get_event(struct inotify_device *dev)
+{
+        return list_entry(dev->events.next, struct inotify_kernel_event, list);
+}
+
+/*
+ * inotify_dev_queue_event - event handler registered with core inotify, adds
+ * a new event to the given device
+ *
+ * Can sleep (calls kernel_event()).
+ */
+static void inotify_dev_queue_event(struct inotify_watch *w, u32 wd, u32 mask,
+                                    u32 cookie, const char *name,
+                                    struct inode *ignored)
+{
+        struct inotify_user_watch *watch;
+        struct inotify_device *dev;
+        struct inotify_kernel_event *kevent, *last;
+
+        watch = container_of(w, struct inotify_user_watch, wdata);
+        dev = watch->dev;
+
+        mutex_lock(&dev->ev_mutex);
+
+        /* we can safely put the watch as we don't reference it while
+         * generating the event
+         */
+        if (mask & IN_IGNORED || mask & IN_ONESHOT)
+                put_inotify_watch(w); /* final put */
+
+        /* coalescing: drop this event if it is a dupe of the previous */
+        last = inotify_dev_get_event(dev);
+        if (last && last->event.mask == mask && last->event.wd == wd &&
+                        last->event.cookie == cookie) {
+                const char *lastname = last->name;
+
+                if (!name && !lastname)
+                        goto out;
+                if (name && lastname && !strcmp(lastname, name))
+                        goto out;
+        }
+
+        /* the queue overflowed and we already sent the Q_OVERFLOW event */
+        if (unlikely(dev->event_count > dev->max_events))
+                goto out;
+
+        /* if the queue overflows, we need to notify user space */
+        if (unlikely(dev->event_count == dev->max_events))
+                kevent = kernel_event(-1, IN_Q_OVERFLOW, cookie, NULL);
+        else
+                kevent = kernel_event(wd, mask, cookie, name);
+
+        if (unlikely(!kevent))
+                goto out;
+
+        /* queue the event and wake up anyone waiting */
+        dev->event_count++;
+        dev->queue_size += sizeof(struct inotify_event) + kevent->event.len;
+        list_add_tail(&kevent->list, &dev->events);
+        wake_up_interruptible(&dev->wq);
+
+out:
+        mutex_unlock(&dev->ev_mutex);
+}
+
+/*
+ * remove_kevent - cleans up and ultimately frees the given kevent
+ *
+ * Caller must hold dev->ev_mutex.
+ */
+static void remove_kevent(struct inotify_device *dev,
+                          struct inotify_kernel_event *kevent)
+{
+        list_del(&kevent->list);
+
+        dev->event_count--;
+        dev->queue_size -= sizeof(struct inotify_event) + kevent->event.len;
+
+        kfree(kevent->name);
+        kmem_cache_free(event_cachep, kevent);
+}
+
+/*
+ * inotify_dev_event_dequeue - destroy an event on the given device
+ *
+ * Caller must hold dev->ev_mutex.
+ */
+static void inotify_dev_event_dequeue(struct inotify_device *dev)
+{
+        if (!list_empty(&dev->events)) {
+                struct inotify_kernel_event *kevent;
+                kevent = inotify_dev_get_event(dev);
+                remove_kevent(dev, kevent);
+        }
+}
+
+/*
+ * find_inode - resolve a user-given path to a specific inode and return a nd
+ */
+static int find_inode(const char __user *dirname, struct nameidata *nd,
+                      unsigned flags)
+{
+        int error;
+
+        error = __user_walk(dirname, flags, nd);
+        if (error)
+                return error;
+        /* you can only watch an inode if you have read permissions on it */
+        error = vfs_permission(nd, MAY_READ);
+        if (error)
+                path_release(nd);
+        return error;
+}
+
+/*
+ * create_watch - creates a watch on the given device.
+ *
+ * Callers must hold dev->up_mutex.
+ */
+static int create_watch(struct inotify_device *dev, struct inode *inode,
+                        u32 mask)
+{
+        struct inotify_user_watch *watch;
+        int ret;
+
+        if (atomic_read(&dev->user->inotify_watches) >=
+                        inotify_max_user_watches)
+                return -ENOSPC;
+
+        watch = kmem_cache_alloc(watch_cachep, GFP_KERNEL);
+        if (unlikely(!watch))
+                return -ENOMEM;
+
+        /* save a reference to device and bump the count to make it official */
+        get_inotify_dev(dev);
+        watch->dev = dev;
+
+        atomic_inc(&dev->user->inotify_watches);
+
+        inotify_init_watch(&watch->wdata);
+        ret = inotify_add_watch(dev->ih, &watch->wdata, inode, mask);
+        if (ret < 0)
+                free_inotify_user_watch(&watch->wdata);
+
+        return ret;
+}
+
+/* Device Interface */
+
+static unsigned int inotify_poll(struct file *file, poll_table *wait)
+{
+        struct inotify_device *dev = file->private_data;
+        int ret = 0;
+
+        poll_wait(file, &dev->wq, wait);
+        mutex_lock(&dev->ev_mutex);
+        if (!list_empty(&dev->events))
+                ret = POLLIN | POLLRDNORM;
+        mutex_unlock(&dev->ev_mutex);
+
+        return ret;
+}
+
+static ssize_t inotify_read(struct file *file, char __user *buf,
+                            size_t count, loff_t *pos)
+{
+        size_t event_size = sizeof (struct inotify_event);
+        struct inotify_device *dev;
+        char __user *start;
+        int ret;
+        DEFINE_WAIT(wait);
+
+        start = buf;
+        dev = file->private_data;
+
+        while (1) {
+                int events;
+
+                prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE);
+
+                mutex_lock(&dev->ev_mutex);
+                events = !list_empty(&dev->events);
+                mutex_unlock(&dev->ev_mutex);
+                if (events) {
+                        ret = 0;
+                        break;
+                }
+
+                if (file->f_flags & O_NONBLOCK) {
+                        ret = -EAGAIN;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        ret = -EINTR;
+                        break;
+                }
+
+                schedule();
+        }
+
+        finish_wait(&dev->wq, &wait);
+        if (ret)
+                return ret;
+
+        mutex_lock(&dev->ev_mutex);
+        while (1) {
+                struct inotify_kernel_event *kevent;
+
+                ret = buf - start;
+                if (list_empty(&dev->events))
+                        break;
+
+                kevent = inotify_dev_get_event(dev);
+                if (event_size + kevent->event.len > count)
+                        break;
+
+                if (copy_to_user(buf, &kevent->event, event_size)) {
+                        ret = -EFAULT;
+                        break;
+                }
+                buf += event_size;
+                count -= event_size;
+
+                if (kevent->name) {
+                        if (copy_to_user(buf, kevent->name, kevent->event.len)){
+                                ret = -EFAULT;
+                                break;
+                        }
+                        buf += kevent->event.len;
+                        count -= kevent->event.len;
+                }
+
+                remove_kevent(dev, kevent);
+        }
+        mutex_unlock(&dev->ev_mutex);
+
+        return ret;
+}
+
+static int inotify_release(struct inode *ignored, struct file *file)
+{
+        struct inotify_device *dev = file->private_data;
+
+        inotify_destroy(dev->ih);
+
+        /* destroy all of the events on this device */
+        mutex_lock(&dev->ev_mutex);
+        while (!list_empty(&dev->events))
+                inotify_dev_event_dequeue(dev);
+        mutex_unlock(&dev->ev_mutex);
+
+        /* free this device: the put matching the get in inotify_init() */
+        put_inotify_dev(dev);
+
+        return 0;
+}
+
+static long inotify_ioctl(struct file *file, unsigned int cmd,
+                          unsigned long arg)
+{
+        struct inotify_device *dev;
+        void __user *p;
+        int ret = -ENOTTY;
+
+        dev = file->private_data;
+        p = (void __user *) arg;
+
+        switch (cmd) {
+        case FIONREAD:
+                ret = put_user(dev->queue_size, (int __user *) p);
+                break;
+        }
+
+        return ret;
+}
+
+static const struct file_operations inotify_fops = {
+        .poll           = inotify_poll,
+        .read           = inotify_read,
+        .release        = inotify_release,
+        .unlocked_ioctl = inotify_ioctl,
+        .compat_ioctl   = inotify_ioctl,
+};
+
+static const struct inotify_operations inotify_user_ops = {
+        .handle_event   = inotify_dev_queue_event,
+        .destroy_watch  = free_inotify_user_watch,
+};
+
+asmlinkage long sys_inotify_init(void)
+{
+        struct inotify_device *dev;
+        struct inotify_handle *ih;
+        struct user_struct *user;
+        struct file *filp;
+        int fd, ret;
+
+        fd = get_unused_fd();
+        if (fd < 0)
+                return fd;
+
+        filp = get_empty_filp();
+        if (!filp) {
+                ret = -ENFILE;
+                goto out_put_fd;
+        }
+
+        user = get_uid(current->user);
+        if (unlikely(atomic_read(&user->inotify_devs) >=
+                        inotify_max_user_instances)) {
+                ret = -EMFILE;
+                goto out_free_uid;
+        }
+
+        dev = kmalloc(sizeof(struct inotify_device), GFP_KERNEL);
+        if (unlikely(!dev)) {
+                ret = -ENOMEM;
+                goto out_free_uid;
+        }
+
+        ih = inotify_init(&inotify_user_ops);
+        if (unlikely(IS_ERR(ih))) {
+                ret = PTR_ERR(ih);
+                goto out_free_dev;
+        }
+        dev->ih = ih;
+
+        filp->f_op = &inotify_fops;
+        filp->f_vfsmnt = mntget(inotify_mnt);
+        filp->f_dentry = dget(inotify_mnt->mnt_root);
+        filp->f_mapping = filp->f_dentry->d_inode->i_mapping;
+        filp->f_mode = FMODE_READ;
+        filp->f_flags = O_RDONLY;
+        filp->private_data = dev;
+
+        INIT_LIST_HEAD(&dev->events);
+        init_waitqueue_head(&dev->wq);
+        mutex_init(&dev->ev_mutex);
+        mutex_init(&dev->up_mutex);
+        dev->event_count = 0;
+        dev->queue_size = 0;
+        dev->max_events = inotify_max_queued_events;
+        dev->user = user;
+        atomic_set(&dev->count, 0);
+
+        get_inotify_dev(dev);
+        atomic_inc(&user->inotify_devs);
+        fd_install(fd, filp);
+
+        return fd;
+out_free_dev:
+        kfree(dev);
+out_free_uid:
+        free_uid(user);
+        put_filp(filp);
+out_put_fd:
+        put_unused_fd(fd);
+        return ret;
+}
+
+asmlinkage long sys_inotify_add_watch(int fd, const char __user *path, u32 mask)
+{
+        struct inode *inode;
+        struct inotify_device *dev;
+        struct nameidata nd;
+        struct file *filp;
+        int ret, fput_needed;
+        unsigned flags = 0;
+
+        filp = fget_light(fd, &fput_needed);
+        if (unlikely(!filp))
+                return -EBADF;
+
+        /* verify that this is indeed an inotify instance */
+        if (unlikely(filp->f_op != &inotify_fops)) {
+                ret = -EINVAL;
+                goto fput_and_out;
+        }
+
+        if (!(mask & IN_DONT_FOLLOW))
+                flags |= LOOKUP_FOLLOW;
+        if (mask & IN_ONLYDIR)
+                flags |= LOOKUP_DIRECTORY;
+
+        ret = find_inode(path, &nd, flags);
+        if (unlikely(ret))
+                goto fput_and_out;
+
+        /* inode held in place by reference to nd; dev by fget on fd */
+        inode = nd.dentry->d_inode;
+        dev = filp->private_data;
+
+        mutex_lock(&dev->up_mutex);
+        ret = inotify_find_update_watch(dev->ih, inode, mask);
+        if (ret == -ENOENT)
+                ret = create_watch(dev, inode, mask);
+        mutex_unlock(&dev->up_mutex);
+
+        path_release(&nd);
+fput_and_out:
+        fput_light(filp, fput_needed);
+        return ret;
+}
+
+asmlinkage long sys_inotify_rm_watch(int fd, u32 wd)
+{
+        struct file *filp;
+        struct inotify_device *dev;
+        int ret, fput_needed;
+
+        filp = fget_light(fd, &fput_needed);
+        if (unlikely(!filp))
+                return -EBADF;
+
+        /* verify that this is indeed an inotify instance */
+        if (unlikely(filp->f_op != &inotify_fops)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        dev = filp->private_data;
+
+        /* we free our watch data when we get IN_IGNORED */
+        ret = inotify_rm_wd(dev->ih, wd);
+
+out:
+        fput_light(filp, fput_needed);
+        return ret;
+}
+
+static struct super_block *
+inotify_get_sb(struct file_system_type *fs_type, int flags,
+               const char *dev_name, void *data)
+{
+    return get_sb_pseudo(fs_type, "inotify", NULL, 0xBAD1DEA);
+}
+
+static struct file_system_type inotify_fs_type = {
+    .name           = "inotifyfs",
+    .get_sb         = inotify_get_sb,
+    .kill_sb        = kill_anon_super,
+};
+
+/*
+ * inotify_user_setup - Our initialization function.  Note that we cannnot return
+ * error because we have compiled-in VFS hooks.  So an (unlikely) failure here
+ * must result in panic().
+ */
+static int __init inotify_user_setup(void)
+{
+        int ret;
+
+        ret = register_filesystem(&inotify_fs_type);
+        if (unlikely(ret))
+                panic("inotify: register_filesystem returned %d!\n", ret);
+
+        inotify_mnt = kern_mount(&inotify_fs_type);
+        if (IS_ERR(inotify_mnt))
+                panic("inotify: kern_mount ret %ld!\n", PTR_ERR(inotify_mnt));
+
+        inotify_max_queued_events = 16384;
+        inotify_max_user_instances = 128;
+        inotify_max_user_watches = 8192;
+
+        watch_cachep = kmem_cache_create("inotify_watch_cache",
+                                         sizeof(struct inotify_user_watch),
+                                         0, SLAB_PANIC, NULL, NULL);
+        event_cachep = kmem_cache_create("inotify_event_cache",
+                                         sizeof(struct inotify_kernel_event),
+                                         0, SLAB_PANIC, NULL, NULL);
+
+        return 0;
+}
+
+module_init(inotify_user_setup);
diff --git a/fs/jffs/intrep.c b/fs/jffs/intrep.c
index 0ef207dfaf6f..5371a403130a 100644
--- a/fs/jffs/intrep.c
+++ b/fs/jffs/intrep.c
@@ -247,7 +247,7 @@ flash_safe_read(struct mtd_info *mtd, loff_t from,
         D3(printk(KERN_NOTICE "flash_safe_read(%p, %08x, %p, %08x)\n",
                   mtd, (unsigned int) from, buf, count));
 
-        res = MTD_READ(mtd, from, count, &retlen, buf);
+        res = mtd->read(mtd, from, count, &retlen, buf);
         if (retlen != count) {
                 panic("Didn't read all bytes in flash_safe_read(). Returned %d\n", res);
         }
@@ -262,7 +262,7 @@ flash_read_u32(struct mtd_info *mtd, loff_t from)
         __u32 ret;
         int res;
 
-        res = MTD_READ(mtd, from, 4, &retlen, (unsigned char *)&ret);
+        res = mtd->read(mtd, from, 4, &retlen, (unsigned char *)&ret);
         if (retlen != 4) {
                 printk("Didn't read all bytes in flash_read_u32(). Returned %d\n", res);
                 return 0;
@@ -282,7 +282,7 @@ flash_safe_write(struct mtd_info *mtd, loff_t to,
         D3(printk(KERN_NOTICE "flash_safe_write(%p, %08x, %p, %08x)\n",
                   mtd, (unsigned int) to, buf, count));
 
-        res = MTD_WRITE(mtd, to, count, &retlen, buf);
+        res = mtd->write(mtd, to, count, &retlen, buf);
         if (retlen != count) {
                 printk("Didn't write all bytes in flash_safe_write(). Returned %d\n", res);
         }
@@ -300,9 +300,9 @@ flash_safe_writev(struct mtd_info *mtd, const struct kvec *vecs,
 
         D3(printk(KERN_NOTICE "flash_safe_writev(%p, %08x, %p)\n",
                   mtd, (unsigned int) to, vecs));
-        
+
         if (mtd->writev) {
-                res = MTD_WRITEV(mtd, vecs, iovec_cnt, to, &retlen);
+                res = mtd->writev(mtd, vecs, iovec_cnt, to, &retlen);
                 return res ? res : retlen;
         }
         /* Not implemented writev. Repeatedly use write - on the not so
@@ -312,7 +312,8 @@ flash_safe_writev(struct mtd_info *mtd, const struct kvec *vecs,
         retlen=0;
 
         for (i=0; !res && i<iovec_cnt; i++) {
-                res = MTD_WRITE(mtd, to, vecs[i].iov_len, &retlen_a, vecs[i].iov_base);
+                res = mtd->write(mtd, to, vecs[i].iov_len, &retlen_a,
+                                 vecs[i].iov_base);
                 if (retlen_a != vecs[i].iov_len) {
                         printk("Didn't write all bytes in flash_safe_writev(). Returned %d\n", res);
                         if (i != iovec_cnt-1)
@@ -393,7 +394,7 @@ flash_erase_region(struct mtd_info *mtd, loff_t start,
         set_current_state(TASK_UNINTERRUPTIBLE);
         add_wait_queue(&wait_q, &wait);
 
-        if (MTD_ERASE(mtd, erase) < 0) {
+        if (mtd->erase(mtd, erase) < 0) {
                 set_current_state(TASK_RUNNING);
                 remove_wait_queue(&wait_q, &wait);
                 kfree(erase);
diff --git a/fs/jffs2/Makefile b/fs/jffs2/Makefile
index 77dc5561a04e..7f28ee0bd132 100644
--- a/fs/jffs2/Makefile
+++ b/fs/jffs2/Makefile
@@ -12,6 +12,9 @@ jffs2-y	+= symlink.o build.o erase.o background.o fs.o writev.o
 jffs2-y += super.o debug.o
 
 jffs2-$(CONFIG_JFFS2_FS_WRITEBUFFER)    += wbuf.o
+jffs2-$(CONFIG_JFFS2_FS_XATTR)          += xattr.o xattr_trusted.o xattr_user.o
+jffs2-$(CONFIG_JFFS2_FS_SECURITY)       += security.o
+jffs2-$(CONFIG_JFFS2_FS_POSIX_ACL)      += acl.o
 jffs2-$(CONFIG_JFFS2_RUBIN)     += compr_rubin.o
 jffs2-$(CONFIG_JFFS2_RTIME)     += compr_rtime.o
 jffs2-$(CONFIG_JFFS2_ZLIB)      += compr_zlib.o
diff --git a/fs/jffs2/README.Locking b/fs/jffs2/README.Locking
index b7943439b6ec..c8f0bd64e53e 100644
--- a/fs/jffs2/README.Locking
+++ b/fs/jffs2/README.Locking
@@ -150,3 +150,24 @@ the buffer.
 
 Ordering constraints:
         Lock wbuf_sem last, after the alloc_sem or and f->sem.
+
+
+        c->xattr_sem
+        ------------
+
+This read/write semaphore protects against concurrent access to the
+xattr related objects which include stuff in superblock and ic->xref.
+In read-only path, write-semaphore is too much exclusion. It's enough
+by read-semaphore. But you must hold write-semaphore when updating,
+creating or deleting any xattr related object.
+
+Once xattr_sem released, there would be no assurance for the existence
+of those objects. Thus, a series of processes is often required to retry,
+when updating such a object is necessary under holding read semaphore.
+For example, do_jffs2_getxattr() holds read-semaphore to scan xref and
+xdatum at first. But it retries this process with holding write-semaphore
+after release read-semaphore, if it's necessary to load name/value pair
+from medium.
+
+Ordering constraints:
+        Lock xattr_sem last, after the alloc_sem.
diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
new file mode 100644
index 000000000000..320dd48b834e
--- /dev/null
+++ b/fs/jffs2/acl.c
@@ -0,0 +1,485 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/crc32.h>
+#include <linux/jffs2.h>
+#include <linux/xattr.h>
+#include <linux/posix_acl_xattr.h>
+#include <linux/mtd/mtd.h>
+#include "nodelist.h"
+
+static size_t jffs2_acl_size(int count)
+{
+        if (count <= 4) {
+                return sizeof(struct jffs2_acl_header)
+                       + count * sizeof(struct jffs2_acl_entry_short);
+        } else {
+                return sizeof(struct jffs2_acl_header)
+                       + 4 * sizeof(struct jffs2_acl_entry_short)
+                       + (count - 4) * sizeof(struct jffs2_acl_entry);
+        }
+}
+
+static int jffs2_acl_count(size_t size)
+{
+        size_t s;
+
+        size -= sizeof(struct jffs2_acl_header);
+        s = size - 4 * sizeof(struct jffs2_acl_entry_short);
+        if (s < 0) {
+                if (size % sizeof(struct jffs2_acl_entry_short))
+                        return -1;
+                return size / sizeof(struct jffs2_acl_entry_short);
+        } else {
+                if (s % sizeof(struct jffs2_acl_entry))
+                        return -1;
+                return s / sizeof(struct jffs2_acl_entry) + 4;
+        }
+}
+
+static struct posix_acl *jffs2_acl_from_medium(void *value, size_t size)
+{
+        void *end = value + size;
+        struct jffs2_acl_header *header = value;
+        struct jffs2_acl_entry *entry;
+        struct posix_acl *acl;
+        uint32_t ver;
+        int i, count;
+
+        if (!value)
+                return NULL;
+        if (size < sizeof(struct jffs2_acl_header))
+                return ERR_PTR(-EINVAL);
+        ver = je32_to_cpu(header->a_version);
+        if (ver != JFFS2_ACL_VERSION) {
+                JFFS2_WARNING("Invalid ACL version. (=%u)\n", ver);
+                return ERR_PTR(-EINVAL);
+        }
+
+        value += sizeof(struct jffs2_acl_header);
+        count = jffs2_acl_count(size);
+        if (count < 0)
+                return ERR_PTR(-EINVAL);
+        if (count == 0)
+                return NULL;
+
+        acl = posix_acl_alloc(count, GFP_KERNEL);
+        if (!acl)
+                return ERR_PTR(-ENOMEM);
+
+        for (i=0; i < count; i++) {
+                entry = value;
+                if (value + sizeof(struct jffs2_acl_entry_short) > end)
+                        goto fail;
+                acl->a_entries[i].e_tag = je16_to_cpu(entry->e_tag);
+                acl->a_entries[i].e_perm = je16_to_cpu(entry->e_perm);
+                switch (acl->a_entries[i].e_tag) {
+                        case ACL_USER_OBJ:
+                        case ACL_GROUP_OBJ:
+                        case ACL_MASK:
+                        case ACL_OTHER:
+                                value += sizeof(struct jffs2_acl_entry_short);
+                                acl->a_entries[i].e_id = ACL_UNDEFINED_ID;
+                                break;
+
+                        case ACL_USER:
+                        case ACL_GROUP:
+                                value += sizeof(struct jffs2_acl_entry);
+                                if (value > end)
+                                        goto fail;
+                                acl->a_entries[i].e_id = je32_to_cpu(entry->e_id);
+                                break;
+
+                        default:
+                                goto fail;
+                }
+        }
+        if (value != end)
+                goto fail;
+        return acl;
+ fail:
+        posix_acl_release(acl);
+        return ERR_PTR(-EINVAL);
+}
+
+static void *jffs2_acl_to_medium(const struct posix_acl *acl, size_t *size)
+{
+        struct jffs2_acl_header *header;
+        struct jffs2_acl_entry *entry;
+        void *e;
+        size_t i;
+
+        *size = jffs2_acl_size(acl->a_count);
+        header = kmalloc(sizeof(*header) + acl->a_count * sizeof(*entry), GFP_KERNEL);
+        if (!header)
+                return ERR_PTR(-ENOMEM);
+        header->a_version = cpu_to_je32(JFFS2_ACL_VERSION);
+        e = header + 1;
+        for (i=0; i < acl->a_count; i++) {
+                entry = e;
+                entry->e_tag = cpu_to_je16(acl->a_entries[i].e_tag);
+                entry->e_perm = cpu_to_je16(acl->a_entries[i].e_perm);
+                switch(acl->a_entries[i].e_tag) {
+                        case ACL_USER:
+                        case ACL_GROUP:
+                                entry->e_id = cpu_to_je32(acl->a_entries[i].e_id);
+                                e += sizeof(struct jffs2_acl_entry);
+                                break;
+
+                        case ACL_USER_OBJ:
+                        case ACL_GROUP_OBJ:
+                        case ACL_MASK:
+                        case ACL_OTHER:
+                                e += sizeof(struct jffs2_acl_entry_short);
+                                break;
+
+                        default:
+                                goto fail;
+                }
+        }
+        return header;
+ fail:
+        kfree(header);
+        return ERR_PTR(-EINVAL);
+}
+
+static struct posix_acl *jffs2_iget_acl(struct inode *inode, struct posix_acl **i_acl)
+{
+        struct posix_acl *acl = JFFS2_ACL_NOT_CACHED;
+
+        spin_lock(&inode->i_lock);
+        if (*i_acl != JFFS2_ACL_NOT_CACHED)
+                acl = posix_acl_dup(*i_acl);
+        spin_unlock(&inode->i_lock);
+        return acl;
+}
+
+static void jffs2_iset_acl(struct inode *inode, struct posix_acl **i_acl, struct posix_acl *acl)
+{
+        spin_lock(&inode->i_lock);
+        if (*i_acl != JFFS2_ACL_NOT_CACHED)
+                posix_acl_release(*i_acl);
+        *i_acl = posix_acl_dup(acl);
+        spin_unlock(&inode->i_lock);
+}
+
+static struct posix_acl *jffs2_get_acl(struct inode *inode, int type)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        struct posix_acl *acl;
+        char *value = NULL;
+        int rc, xprefix;
+
+        switch (type) {
+        case ACL_TYPE_ACCESS:
+                acl = jffs2_iget_acl(inode, &f->i_acl_access);
+                if (acl != JFFS2_ACL_NOT_CACHED)
+                        return acl;
+                xprefix = JFFS2_XPREFIX_ACL_ACCESS;
+                break;
+        case ACL_TYPE_DEFAULT:
+                acl = jffs2_iget_acl(inode, &f->i_acl_default);
+                if (acl != JFFS2_ACL_NOT_CACHED)
+                        return acl;
+                xprefix = JFFS2_XPREFIX_ACL_DEFAULT;
+                break;
+        default:
+                return ERR_PTR(-EINVAL);
+        }
+        rc = do_jffs2_getxattr(inode, xprefix, "", NULL, 0);
+        if (rc > 0) {
+                value = kmalloc(rc, GFP_KERNEL);
+                if (!value)
+                        return ERR_PTR(-ENOMEM);
+                rc = do_jffs2_getxattr(inode, xprefix, "", value, rc);
+        }
+        if (rc > 0) {
+                acl = jffs2_acl_from_medium(value, rc);
+        } else if (rc == -ENODATA || rc == -ENOSYS) {
+                acl = NULL;
+        } else {
+                acl = ERR_PTR(rc);
+        }
+        if (value)
+                kfree(value);
+        if (!IS_ERR(acl)) {
+                switch (type) {
+                case ACL_TYPE_ACCESS:
+                        jffs2_iset_acl(inode, &f->i_acl_access, acl);
+                        break;
+                case ACL_TYPE_DEFAULT:
+                        jffs2_iset_acl(inode, &f->i_acl_default, acl);
+                        break;
+                }
+        }
+        return acl;
+}
+
+static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        size_t size = 0;
+        char *value = NULL;
+        int rc, xprefix;
+
+        if (S_ISLNK(inode->i_mode))
+                return -EOPNOTSUPP;
+
+        switch (type) {
+        case ACL_TYPE_ACCESS:
+                xprefix = JFFS2_XPREFIX_ACL_ACCESS;
+                if (acl) {
+                        mode_t mode = inode->i_mode;
+                        rc = posix_acl_equiv_mode(acl, &mode);
+                        if (rc < 0)
+                                return rc;
+                        if (inode->i_mode != mode) {
+                                inode->i_mode = mode;
+                                jffs2_dirty_inode(inode);
+                        }
+                        if (rc == 0)
+                                acl = NULL;
+                }
+                break;
+        case ACL_TYPE_DEFAULT:
+                xprefix = JFFS2_XPREFIX_ACL_DEFAULT;
+                if (!S_ISDIR(inode->i_mode))
+                        return acl ? -EACCES : 0;
+                break;
+        default:
+                return -EINVAL;
+        }
+        if (acl) {
+                value = jffs2_acl_to_medium(acl, &size);
+                if (IS_ERR(value))
+                        return PTR_ERR(value);
+        }
+
+        rc = do_jffs2_setxattr(inode, xprefix, "", value, size, 0);
+        if (value)
+                kfree(value);
+        if (!rc) {
+                switch(type) {
+                case ACL_TYPE_ACCESS:
+                        jffs2_iset_acl(inode, &f->i_acl_access, acl);
+                        break;
+                case ACL_TYPE_DEFAULT:
+                        jffs2_iset_acl(inode, &f->i_acl_default, acl);
+                        break;
+                }
+        }
+        return rc;
+}
+
+static int jffs2_check_acl(struct inode *inode, int mask)
+{
+        struct posix_acl *acl;
+        int rc;
+
+        acl = jffs2_get_acl(inode, ACL_TYPE_ACCESS);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+        if (acl) {
+                rc = posix_acl_permission(inode, acl, mask);
+                posix_acl_release(acl);
+                return rc;
+        }
+        return -EAGAIN;
+}
+
+int jffs2_permission(struct inode *inode, int mask, struct nameidata *nd)
+{
+        return generic_permission(inode, mask, jffs2_check_acl);
+}
+
+int jffs2_init_acl(struct inode *inode, struct inode *dir)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        struct posix_acl *acl = NULL, *clone;
+        mode_t mode;
+        int rc = 0;
+
+        f->i_acl_access = JFFS2_ACL_NOT_CACHED;
+        f->i_acl_default = JFFS2_ACL_NOT_CACHED;
+        if (!S_ISLNK(inode->i_mode)) {
+                acl = jffs2_get_acl(dir, ACL_TYPE_DEFAULT);
+                if (IS_ERR(acl))
+                        return PTR_ERR(acl);
+                if (!acl)
+                        inode->i_mode &= ~current->fs->umask;
+        }
+        if (acl) {
+                if (S_ISDIR(inode->i_mode)) {
+                        rc = jffs2_set_acl(inode, ACL_TYPE_DEFAULT, acl);
+                        if (rc)
+                                goto cleanup;
+                }
+                clone = posix_acl_clone(acl, GFP_KERNEL);
+                rc = -ENOMEM;
+                if (!clone)
+                        goto cleanup;
+                mode = inode->i_mode;
+                rc = posix_acl_create_masq(clone, &mode);
+                if (rc >= 0) {
+                        inode->i_mode = mode;
+                        if (rc > 0)
+                                rc = jffs2_set_acl(inode, ACL_TYPE_ACCESS, clone);
+                }
+                posix_acl_release(clone);
+        }
+ cleanup:
+        posix_acl_release(acl);
+        return rc;
+}
+
+void jffs2_clear_acl(struct inode *inode)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+
+        if (f->i_acl_access && f->i_acl_access != JFFS2_ACL_NOT_CACHED) {
+                posix_acl_release(f->i_acl_access);
+                f->i_acl_access = JFFS2_ACL_NOT_CACHED;
+        }
+        if (f->i_acl_default && f->i_acl_default != JFFS2_ACL_NOT_CACHED) {
+                posix_acl_release(f->i_acl_default);
+                f->i_acl_default = JFFS2_ACL_NOT_CACHED;
+        }
+}
+
+int jffs2_acl_chmod(struct inode *inode)
+{
+        struct posix_acl *acl, *clone;
+        int rc;
+
+        if (S_ISLNK(inode->i_mode))
+                return -EOPNOTSUPP;
+        acl = jffs2_get_acl(inode, ACL_TYPE_ACCESS);
+        if (IS_ERR(acl) || !acl)
+                return PTR_ERR(acl);
+        clone = posix_acl_clone(acl, GFP_KERNEL);
+        posix_acl_release(acl);
+        if (!clone)
+                return -ENOMEM;
+        rc = posix_acl_chmod_masq(clone, inode->i_mode);
+        if (!rc)
+                rc = jffs2_set_acl(inode, ACL_TYPE_ACCESS, clone);
+        posix_acl_release(clone);
+        return rc;
+}
+
+static size_t jffs2_acl_access_listxattr(struct inode *inode, char *list, size_t list_size,
+                                         const char *name, size_t name_len)
+{
+        const int retlen = sizeof(POSIX_ACL_XATTR_ACCESS);
+
+        if (list && retlen <= list_size)
+                strcpy(list, POSIX_ACL_XATTR_ACCESS);
+        return retlen;
+}
+
+static size_t jffs2_acl_default_listxattr(struct inode *inode, char *list, size_t list_size,
+                                          const char *name, size_t name_len)
+{
+        const int retlen = sizeof(POSIX_ACL_XATTR_DEFAULT);
+
+        if (list && retlen <= list_size)
+                strcpy(list, POSIX_ACL_XATTR_DEFAULT);
+        return retlen;
+}
+
+static int jffs2_acl_getxattr(struct inode *inode, int type, void *buffer, size_t size)
+{
+        struct posix_acl *acl;
+        int rc;
+
+        acl = jffs2_get_acl(inode, type);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+        if (!acl)
+                return -ENODATA;
+        rc = posix_acl_to_xattr(acl, buffer, size);
+        posix_acl_release(acl);
+
+        return rc;
+}
+
+static int jffs2_acl_access_getxattr(struct inode *inode, const char *name, void *buffer, size_t size)
+{
+        if (name[0] != '\0')
+                return -EINVAL;
+        return jffs2_acl_getxattr(inode, ACL_TYPE_ACCESS, buffer, size);
+}
+
+static int jffs2_acl_default_getxattr(struct inode *inode, const char *name, void *buffer, size_t size)
+{
+        if (name[0] != '\0')
+                return -EINVAL;
+        return jffs2_acl_getxattr(inode, ACL_TYPE_DEFAULT, buffer, size);
+}
+
+static int jffs2_acl_setxattr(struct inode *inode, int type, const void *value, size_t size)
+{
+        struct posix_acl *acl;
+        int rc;
+
+        if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
+                return -EPERM;
+
+        if (value) {
+                acl = posix_acl_from_xattr(value, size);
+                if (IS_ERR(acl))
+                        return PTR_ERR(acl);
+                if (acl) {
+                        rc = posix_acl_valid(acl);
+                        if (rc)
+                                goto out;
+                }
+        } else {
+                acl = NULL;
+        }
+        rc = jffs2_set_acl(inode, type, acl);
+ out:
+        posix_acl_release(acl);
+        return rc;
+}
+
+static int jffs2_acl_access_setxattr(struct inode *inode, const char *name,
+                                     const void *buffer, size_t size, int flags)
+{
+        if (name[0] != '\0')
+                return -EINVAL;
+        return jffs2_acl_setxattr(inode, ACL_TYPE_ACCESS, buffer, size);
+}
+
+static int jffs2_acl_default_setxattr(struct inode *inode, const char *name,
+                                      const void *buffer, size_t size, int flags)
+{
+        if (name[0] != '\0')
+                return -EINVAL;
+        return jffs2_acl_setxattr(inode, ACL_TYPE_DEFAULT, buffer, size);
+}
+
+struct xattr_handler jffs2_acl_access_xattr_handler = {
+        .prefix = POSIX_ACL_XATTR_ACCESS,
+        .list   = jffs2_acl_access_listxattr,
+        .get    = jffs2_acl_access_getxattr,
+        .set    = jffs2_acl_access_setxattr,
+};
+
+struct xattr_handler jffs2_acl_default_xattr_handler = {
+        .prefix = POSIX_ACL_XATTR_DEFAULT,
+        .list   = jffs2_acl_default_listxattr,
+        .get    = jffs2_acl_default_getxattr,
+        .set    = jffs2_acl_default_setxattr,
+};
diff --git a/fs/jffs2/acl.h b/fs/jffs2/acl.h
new file mode 100644
index 000000000000..8893bd1a6ba7
--- /dev/null
+++ b/fs/jffs2/acl.h
@@ -0,0 +1,45 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+struct jffs2_acl_entry {
+        jint16_t        e_tag;
+        jint16_t        e_perm;
+        jint32_t        e_id;
+};
+
+struct jffs2_acl_entry_short {
+        jint16_t        e_tag;
+        jint16_t        e_perm;
+};
+
+struct jffs2_acl_header {
+        jint32_t        a_version;
+};
+
+#ifdef CONFIG_JFFS2_FS_POSIX_ACL
+
+#define JFFS2_ACL_NOT_CACHED ((void *)-1)
+
+extern int jffs2_permission(struct inode *, int, struct nameidata *);
+extern int jffs2_acl_chmod(struct inode *);
+extern int jffs2_init_acl(struct inode *, struct inode *);
+extern void jffs2_clear_acl(struct inode *);
+
+extern struct xattr_handler jffs2_acl_access_xattr_handler;
+extern struct xattr_handler jffs2_acl_default_xattr_handler;
+
+#else
+
+#define jffs2_permission NULL
+#define jffs2_acl_chmod(inode)          (0)
+#define jffs2_init_acl(inode,dir)       (0)
+#define jffs2_clear_acl(inode)
+
+#endif  /* CONFIG_JFFS2_FS_POSIX_ACL */
diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c
index 70f7a896c04a..02826967ab58 100644
--- a/fs/jffs2/build.c
+++ b/fs/jffs2/build.c
@@ -160,6 +160,7 @@ static int jffs2_build_filesystem(struct jffs2_sb_info *c)
                 ic->scan_dents = NULL;
                 cond_resched();
         }
+        jffs2_build_xattr_subsystem(c);
         c->flags &= ~JFFS2_SB_FLAG_BUILDING;
 
         dbg_fsbuild("FS build complete\n");
@@ -178,6 +179,7 @@ exit:
                                 jffs2_free_full_dirent(fd);
                         }
                 }
+                jffs2_clear_xattr_subsystem(c);
         }
 
         return ret;
diff --git a/fs/jffs2/compr.c b/fs/jffs2/compr.c
index e7944e665b9f..7001ba26c067 100644
--- a/fs/jffs2/compr.c
+++ b/fs/jffs2/compr.c
@@ -412,7 +412,7 @@ void jffs2_free_comprbuf(unsigned char *comprbuf, unsigned char *orig)
                 kfree(comprbuf);
 }
 
-int jffs2_compressors_init(void)
+int __init jffs2_compressors_init(void)
 {
 /* Registering compressors */
 #ifdef CONFIG_JFFS2_ZLIB
diff --git a/fs/jffs2/compr.h b/fs/jffs2/compr.h
index a77e830d85c5..509b8b1c0811 100644
--- a/fs/jffs2/compr.h
+++ b/fs/jffs2/compr.h
@@ -23,8 +23,8 @@
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/jffs2.h>
-#include <linux/jffs2_fs_i.h>
-#include <linux/jffs2_fs_sb.h>
+#include "jffs2_fs_i.h"
+#include "jffs2_fs_sb.h"
 #include "nodelist.h"
 
 #define JFFS2_RUBINMIPS_PRIORITY 10
diff --git a/fs/jffs2/debug.c b/fs/jffs2/debug.c
index 1fe17de713e8..72b4fc13a106 100644
--- a/fs/jffs2/debug.c
+++ b/fs/jffs2/debug.c
@@ -192,13 +192,13 @@ __jffs2_dbg_acct_paranoia_check_nolock(struct jffs2_sb_info *c,
                 else
                         my_dirty_size += totlen;
 
-                if ((!ref2->next_phys) != (ref2 == jeb->last_node)) {
-                        JFFS2_ERROR("node_ref for node at %#08x (mem %p) has next_phys at %#08x (mem %p), last_node is at %#08x (mem %p).\n",
-                                ref_offset(ref2), ref2, ref_offset(ref2->next_phys), ref2->next_phys,
-                                ref_offset(jeb->last_node), jeb->last_node);
+                if ((!ref_next(ref2)) != (ref2 == jeb->last_node)) {
+                        JFFS2_ERROR("node_ref for node at %#08x (mem %p) has next at %#08x (mem %p), last_node is at %#08x (mem %p).\n",
+                                    ref_offset(ref2), ref2, ref_offset(ref_next(ref2)), ref_next(ref2),
+                                    ref_offset(jeb->last_node), jeb->last_node);
                         goto error;
                 }
-                ref2 = ref2->next_phys;
+                ref2 = ref_next(ref2);
         }
 
         if (my_used_size != jeb->used_size) {
@@ -268,9 +268,9 @@ __jffs2_dbg_dump_node_refs_nolock(struct jffs2_sb_info *c,
         }
 
         printk(JFFS2_DBG);
-        for (ref = jeb->first_node; ; ref = ref->next_phys) {
+        for (ref = jeb->first_node; ; ref = ref_next(ref)) {
                 printk("%#08x(%#x)", ref_offset(ref), ref->__totlen);
-                if (ref->next_phys)
+                if (ref_next(ref))
                         printk("->");
                 else
                         break;
diff --git a/fs/jffs2/debug.h b/fs/jffs2/debug.h
index 162af6dfe292..5fa494a792b2 100644
--- a/fs/jffs2/debug.h
+++ b/fs/jffs2/debug.h
@@ -171,6 +171,12 @@
 #define dbg_memalloc(fmt, ...)
 #endif
 
+/* Watch the XATTR subsystem */
+#ifdef JFFS2_DBG_XATTR_MESSAGES
+#define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+#else
+#define dbg_xattr(fmt, ...)
+#endif 
 
 /* "Sanity" checks */
 void
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index 8bc7a5018e40..edd8371fc6a5 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -17,8 +17,8 @@
 #include <linux/fs.h>
 #include <linux/crc32.h>
 #include <linux/jffs2.h>
-#include <linux/jffs2_fs_i.h>
-#include <linux/jffs2_fs_sb.h>
+#include "jffs2_fs_i.h"
+#include "jffs2_fs_sb.h"
 #include <linux/time.h>
 #include "nodelist.h"
 
@@ -57,7 +57,12 @@ struct inode_operations jffs2_dir_inode_operations =
         .rmdir =        jffs2_rmdir,
         .mknod =        jffs2_mknod,
         .rename =       jffs2_rename,
+        .permission =   jffs2_permission,
         .setattr =      jffs2_setattr,
+        .setxattr =     jffs2_setxattr,
+        .getxattr =     jffs2_getxattr,
+        .listxattr =    jffs2_listxattr,
+        .removexattr =  jffs2_removexattr
 };
 
 /***********************************************************************/
@@ -78,6 +83,9 @@ static struct dentry *jffs2_lookup(struct inode *dir_i, struct dentry *target,
 
         D1(printk(KERN_DEBUG "jffs2_lookup()\n"));
 
+        if (target->d_name.len > JFFS2_MAX_NAME_LEN)
+                return ERR_PTR(-ENAMETOOLONG);
+
         dir_f = JFFS2_INODE_INFO(dir_i);
         c = JFFS2_SB_INFO(dir_i->i_sb);
 
@@ -206,12 +214,15 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
         ret = jffs2_do_create(c, dir_f, f, ri,
                               dentry->d_name.name, dentry->d_name.len);
 
-        if (ret) {
-                make_bad_inode(inode);
-                iput(inode);
-                jffs2_free_raw_inode(ri);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
+        ret = jffs2_init_security(inode, dir_i);
+        if (ret)
+                goto fail;
+        ret = jffs2_init_acl(inode, dir_i);
+        if (ret)
+                goto fail;
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(ri->ctime));
 
@@ -221,6 +232,12 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
         D1(printk(KERN_DEBUG "jffs2_create: Created ino #%lu with mode %o, nlink %d(%d). nrpages %ld\n",
                   inode->i_ino, inode->i_mode, inode->i_nlink, f->inocache->nlink, inode->i_mapping->nrpages));
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        iput(inode);
+        jffs2_free_raw_inode(ri);
+        return ret;
 }
 
 /***********************************************************************/
@@ -291,7 +308,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         struct jffs2_full_dnode *fn;
         struct jffs2_full_dirent *fd;
         int namelen;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret, targetlen = strlen(target);
 
         /* FIXME: If you care. We'd need to use frags for the target
@@ -310,8 +327,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
          * Just the node will do for now, though
          */
         namelen = dentry->d_name.len;
-        ret = jffs2_reserve_space(c, sizeof(*ri) + targetlen, &phys_ofs, &alloclen,
-                                ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+        ret = jffs2_reserve_space(c, sizeof(*ri) + targetlen, &alloclen,
+                                  ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
 
         if (ret) {
                 jffs2_free_raw_inode(ri);
@@ -339,7 +356,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         ri->data_crc = cpu_to_je32(crc32(0, target, targetlen));
         ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
 
-        fn = jffs2_write_dnode(c, f, ri, target, targetlen, phys_ofs, ALLOC_NORMAL);
+        fn = jffs2_write_dnode(c, f, ri, target, targetlen, ALLOC_NORMAL);
 
         jffs2_free_raw_inode(ri);
 
@@ -371,8 +388,20 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         up(&f->sem);
 
         jffs2_complete_reservation(c);
-        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &phys_ofs, &alloclen,
-                                ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
+
+        ret = jffs2_init_security(inode, dir_i);
+        if (ret) {
+                jffs2_clear_inode(inode);
+                return ret;
+        }
+        ret = jffs2_init_acl(inode, dir_i);
+        if (ret) {
+                jffs2_clear_inode(inode);
+                return ret;
+        }
+
+        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
+                                  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
         if (ret) {
                 /* Eep. */
                 jffs2_clear_inode(inode);
@@ -404,7 +433,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
         rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
 
-        fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, phys_ofs, ALLOC_NORMAL);
+        fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
 
         if (IS_ERR(fd)) {
                 /* dirent failed to write. Delete the inode normally
@@ -442,7 +471,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         struct jffs2_full_dnode *fn;
         struct jffs2_full_dirent *fd;
         int namelen;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret;
 
         mode |= S_IFDIR;
@@ -457,8 +486,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
          * Just the node will do for now, though
          */
         namelen = dentry->d_name.len;
-        ret = jffs2_reserve_space(c, sizeof(*ri), &phys_ofs, &alloclen, ALLOC_NORMAL,
-                                JFFS2_SUMMARY_INODE_SIZE);
+        ret = jffs2_reserve_space(c, sizeof(*ri), &alloclen, ALLOC_NORMAL,
+                                  JFFS2_SUMMARY_INODE_SIZE);
 
         if (ret) {
                 jffs2_free_raw_inode(ri);
@@ -483,7 +512,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         ri->data_crc = cpu_to_je32(0);
         ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
 
-        fn = jffs2_write_dnode(c, f, ri, NULL, 0, phys_ofs, ALLOC_NORMAL);
+        fn = jffs2_write_dnode(c, f, ri, NULL, 0, ALLOC_NORMAL);
 
         jffs2_free_raw_inode(ri);
 
@@ -501,8 +530,20 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         up(&f->sem);
 
         jffs2_complete_reservation(c);
-        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &phys_ofs, &alloclen,
-                                ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
+
+        ret = jffs2_init_security(inode, dir_i);
+        if (ret) {
+                jffs2_clear_inode(inode);
+                return ret;
+        }
+        ret = jffs2_init_acl(inode, dir_i);
+        if (ret) {
+                jffs2_clear_inode(inode);
+                return ret;
+        }
+
+        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
+                                  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
         if (ret) {
                 /* Eep. */
                 jffs2_clear_inode(inode);
@@ -534,7 +575,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
         rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
 
-        fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, phys_ofs, ALLOC_NORMAL);
+        fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
 
         if (IS_ERR(fd)) {
                 /* dirent failed to write. Delete the inode normally
@@ -588,12 +629,12 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         struct jffs2_full_dnode *fn;
         struct jffs2_full_dirent *fd;
         int namelen;
-        jint16_t dev;
+        union jffs2_device_node dev;
         int devlen = 0;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret;
 
-        if (!old_valid_dev(rdev))
+        if (!new_valid_dev(rdev))
                 return -EINVAL;
 
         ri = jffs2_alloc_raw_inode();
@@ -602,17 +643,15 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
 
         c = JFFS2_SB_INFO(dir_i->i_sb);
 
-        if (S_ISBLK(mode) || S_ISCHR(mode)) {
-                dev = cpu_to_je16(old_encode_dev(rdev));
-                devlen = sizeof(dev);
-        }
+        if (S_ISBLK(mode) || S_ISCHR(mode))
+                devlen = jffs2_encode_dev(&dev, rdev);
 
         /* Try to reserve enough space for both node and dirent.
          * Just the node will do for now, though
          */
         namelen = dentry->d_name.len;
-        ret = jffs2_reserve_space(c, sizeof(*ri) + devlen, &phys_ofs, &alloclen,
-                                ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+        ret = jffs2_reserve_space(c, sizeof(*ri) + devlen, &alloclen,
+                                  ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
 
         if (ret) {
                 jffs2_free_raw_inode(ri);
@@ -639,7 +678,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         ri->data_crc = cpu_to_je32(crc32(0, &dev, devlen));
         ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
 
-        fn = jffs2_write_dnode(c, f, ri, (char *)&dev, devlen, phys_ofs, ALLOC_NORMAL);
+        fn = jffs2_write_dnode(c, f, ri, (char *)&dev, devlen, ALLOC_NORMAL);
 
         jffs2_free_raw_inode(ri);
 
@@ -657,8 +696,20 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         up(&f->sem);
 
         jffs2_complete_reservation(c);
-        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &phys_ofs, &alloclen,
-                                ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
+
+        ret = jffs2_init_security(inode, dir_i);
+        if (ret) {
+                jffs2_clear_inode(inode);
+                return ret;
+        }
+        ret = jffs2_init_acl(inode, dir_i);
+        if (ret) {
+                jffs2_clear_inode(inode);
+                return ret;
+        }
+
+        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
+                                  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
         if (ret) {
                 /* Eep. */
                 jffs2_clear_inode(inode);
@@ -693,7 +744,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
         rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
 
-        fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, phys_ofs, ALLOC_NORMAL);
+        fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
 
         if (IS_ERR(fd)) {
                 /* dirent failed to write. Delete the inode normally
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index dad68fdffe9e..1862e8bc101d 100644
--- a/fs/jffs2/erase.c
+++ b/fs/jffs2/erase.c
@@ -30,7 +30,6 @@ static void jffs2_erase_callback(struct erase_info *);
 #endif
 static void jffs2_erase_failed(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, uint32_t bad_offset);
 static void jffs2_erase_succeeded(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
-static void jffs2_free_all_node_refs(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
 static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
 
 static void jffs2_erase_block(struct jffs2_sb_info *c,
@@ -136,7 +135,7 @@ void jffs2_erase_pending_blocks(struct jffs2_sb_info *c, int count)
                         c->used_size -= jeb->used_size;
                         c->dirty_size -= jeb->dirty_size;
                         jeb->wasted_size = jeb->used_size = jeb->dirty_size = jeb->free_size = 0;
-                        jffs2_free_all_node_refs(c, jeb);
+                        jffs2_free_jeb_node_refs(c, jeb);
                         list_add(&jeb->list, &c->erasing_list);
                         spin_unlock(&c->erase_completion_lock);
 
@@ -231,6 +230,7 @@ static inline void jffs2_remove_node_refs_from_ino_list(struct jffs2_sb_info *c,
                            at the end of the linked list. Stash it and continue
                            from the beginning of the list */
                         ic = (struct jffs2_inode_cache *)(*prev);
+                        BUG_ON(ic->class != RAWNODE_CLASS_INODE_CACHE);
                         prev = &ic->nodes;
                         continue;
                 }
@@ -283,22 +283,27 @@ static inline void jffs2_remove_node_refs_from_ino_list(struct jffs2_sb_info *c,
                 jffs2_del_ino_cache(c, ic);
 }
 
-static void jffs2_free_all_node_refs(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
+void jffs2_free_jeb_node_refs(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
 {
-        struct jffs2_raw_node_ref *ref;
+        struct jffs2_raw_node_ref *block, *ref;
         D1(printk(KERN_DEBUG "Freeing all node refs for eraseblock offset 0x%08x\n", jeb->offset));
-        while(jeb->first_node) {
-                ref = jeb->first_node;
-                jeb->first_node = ref->next_phys;
 
-                /* Remove from the inode-list */
-                if (ref->next_in_ino)
+        block = ref = jeb->first_node;
+
+        while (ref) {
+                if (ref->flash_offset == REF_LINK_NODE) {
+                        ref = ref->next_in_ino;
+                        jffs2_free_refblock(block);
+                        block = ref;
+                        continue;
+                }
+                if (ref->flash_offset != REF_EMPTY_NODE && ref->next_in_ino)
                         jffs2_remove_node_refs_from_ino_list(c, ref, jeb);
                 /* else it was a non-inode node or already removed, so don't bother */
 
-                jffs2_free_raw_node_ref(ref);
+                ref++;
         }
-        jeb->last_node = NULL;
+        jeb->first_node = jeb->last_node = NULL;
 }
 
 static int jffs2_block_check_erase(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, uint32_t *bad_offset)
@@ -351,7 +356,6 @@ fail:
 
 static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
 {
-        struct jffs2_raw_node_ref *marker_ref = NULL;
         size_t retlen;
         int ret;
         uint32_t bad_offset;
@@ -373,12 +377,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
                                 goto filebad;
                 }
 
-                jeb->first_node = jeb->last_node = NULL;
+                /* Everything else got zeroed before the erase */
                 jeb->free_size = c->sector_size;
-                jeb->used_size = 0;
-                jeb->dirty_size = 0;
-                jeb->wasted_size = 0;
-
         } else {
 
                 struct kvec vecs[1];
@@ -388,11 +388,7 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
                         .totlen =       cpu_to_je32(c->cleanmarker_size)
                 };
 
-                marker_ref = jffs2_alloc_raw_node_ref();
-                if (!marker_ref) {
-                        printk(KERN_WARNING "Failed to allocate raw node ref for clean marker. Refiling\n");
-                        goto refile;
-                }
+                jffs2_prealloc_raw_node_refs(c, jeb, 1);
 
                 marker.hdr_crc = cpu_to_je32(crc32(0, &marker, sizeof(struct jffs2_unknown_node)-4));
 
@@ -408,21 +404,13 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
                                 printk(KERN_WARNING "Short write to newly-erased block at 0x%08x: Wanted %zd, got %zd\n",
                                        jeb->offset, sizeof(marker), retlen);
 
-                        jffs2_free_raw_node_ref(marker_ref);
                         goto filebad;
                 }
 
-                marker_ref->next_in_ino = NULL;
-                marker_ref->next_phys = NULL;
-                marker_ref->flash_offset = jeb->offset | REF_NORMAL;
-                marker_ref->__totlen = c->cleanmarker_size;
-
-                jeb->first_node = jeb->last_node = marker_ref;
-
-                jeb->free_size = c->sector_size - c->cleanmarker_size;
-                jeb->used_size = c->cleanmarker_size;
-                jeb->dirty_size = 0;
-                jeb->wasted_size = 0;
+                /* Everything else got zeroed before the erase */
+                jeb->free_size = c->sector_size;
+                /* FIXME Special case for cleanmarker in empty block */
+                jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL);
         }
 
         spin_lock(&c->erase_completion_lock);
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 9f4171213e58..bb8844f40e48 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -54,7 +54,12 @@ const struct file_operations jffs2_file_operations =
 
 struct inode_operations jffs2_file_inode_operations =
 {
-        .setattr =      jffs2_setattr
+        .permission =   jffs2_permission,
+        .setattr =      jffs2_setattr,
+        .setxattr =     jffs2_setxattr,
+        .getxattr =     jffs2_getxattr,
+        .listxattr =    jffs2_listxattr,
+        .removexattr =  jffs2_removexattr
 };
 
 struct address_space_operations jffs2_file_address_operations =
@@ -129,13 +134,13 @@ static int jffs2_prepare_write (struct file *filp, struct page *pg,
                 struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
                 struct jffs2_raw_inode ri;
                 struct jffs2_full_dnode *fn;
-                uint32_t phys_ofs, alloc_len;
+                uint32_t alloc_len;
 
                 D1(printk(KERN_DEBUG "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
                           (unsigned int)inode->i_size, pageofs));
 
-                ret = jffs2_reserve_space(c, sizeof(ri), &phys_ofs, &alloc_len,
-                                        ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+                ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
+                                          ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
                 if (ret)
                         return ret;
 
@@ -161,7 +166,7 @@ static int jffs2_prepare_write (struct file *filp, struct page *pg,
                 ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
                 ri.data_crc = cpu_to_je32(0);
 
-                fn = jffs2_write_dnode(c, f, &ri, NULL, 0, phys_ofs, ALLOC_NORMAL);
+                fn = jffs2_write_dnode(c, f, &ri, NULL, 0, ALLOC_NORMAL);
 
                 if (IS_ERR(fn)) {
                         ret = PTR_ERR(fn);
@@ -215,12 +220,20 @@ static int jffs2_commit_write (struct file *filp, struct page *pg,
         D1(printk(KERN_DEBUG "jffs2_commit_write(): ino #%lu, page at 0x%lx, range %d-%d, flags %lx\n",
                   inode->i_ino, pg->index << PAGE_CACHE_SHIFT, start, end, pg->flags));
 
-        if (!start && end == PAGE_CACHE_SIZE) {
-                /* We need to avoid deadlock with page_cache_read() in
-                   jffs2_garbage_collect_pass(). So we have to mark the
-                   page up to date, to prevent page_cache_read() from
-                   trying to re-lock it. */
-                SetPageUptodate(pg);
+        if (end == PAGE_CACHE_SIZE) {
+                if (!start) {
+                        /* We need to avoid deadlock with page_cache_read() in
+                           jffs2_garbage_collect_pass(). So we have to mark the
+                           page up to date, to prevent page_cache_read() from
+                           trying to re-lock it. */
+                        SetPageUptodate(pg);
+                } else {
+                        /* When writing out the end of a page, write out the 
+                           _whole_ page. This helps to reduce the number of
+                           nodes in files which have many short writes, like
+                           syslog files. */
+                        start = aligned_start = 0;
+                }
         }
 
         ri = jffs2_alloc_raw_inode();
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 09e5d10b8840..7b6c24b14f85 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -33,11 +33,11 @@ static int jffs2_do_setattr (struct inode *inode, struct iattr *iattr)
         struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
         struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
         struct jffs2_raw_inode *ri;
-        unsigned short dev;
+        union jffs2_device_node dev;
         unsigned char *mdata = NULL;
         int mdatalen = 0;
         unsigned int ivalid;
-        uint32_t phys_ofs, alloclen;
+        uint32_t alloclen;
         int ret;
         D1(printk(KERN_DEBUG "jffs2_setattr(): ino #%lu\n", inode->i_ino));
         ret = inode_change_ok(inode, iattr);
@@ -51,20 +51,24 @@ static int jffs2_do_setattr (struct inode *inode, struct iattr *iattr)
            it out again with the appropriate data attached */
         if (S_ISBLK(inode->i_mode) || S_ISCHR(inode->i_mode)) {
                 /* For these, we don't actually need to read the old node */
-                dev = old_encode_dev(inode->i_rdev);
+                mdatalen = jffs2_encode_dev(&dev, inode->i_rdev);
                 mdata = (char *)&dev;
-                mdatalen = sizeof(dev);
                 D1(printk(KERN_DEBUG "jffs2_setattr(): Writing %d bytes of kdev_t\n", mdatalen));
         } else if (S_ISLNK(inode->i_mode)) {
+                down(&f->sem);
                 mdatalen = f->metadata->size;
                 mdata = kmalloc(f->metadata->size, GFP_USER);
-                if (!mdata)
+                if (!mdata) {
+                        up(&f->sem);
                         return -ENOMEM;
+                }
                 ret = jffs2_read_dnode(c, f, f->metadata, mdata, 0, mdatalen);
                 if (ret) {
+                        up(&f->sem);
                         kfree(mdata);
                         return ret;
                 }
+                up(&f->sem);
                 D1(printk(KERN_DEBUG "jffs2_setattr(): Writing %d bytes of symlink target\n", mdatalen));
         }
 
@@ -75,8 +79,8 @@ static int jffs2_do_setattr (struct inode *inode, struct iattr *iattr)
                 return -ENOMEM;
         }
 
-        ret = jffs2_reserve_space(c, sizeof(*ri) + mdatalen, &phys_ofs, &alloclen,
-                                ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+        ret = jffs2_reserve_space(c, sizeof(*ri) + mdatalen, &alloclen,
+                                  ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
         if (ret) {
                 jffs2_free_raw_inode(ri);
                 if (S_ISLNK(inode->i_mode & S_IFMT))
@@ -127,7 +131,7 @@ static int jffs2_do_setattr (struct inode *inode, struct iattr *iattr)
         else
                 ri->data_crc = cpu_to_je32(0);
 
-        new_metadata = jffs2_write_dnode(c, f, ri, mdata, mdatalen, phys_ofs, ALLOC_NORMAL);
+        new_metadata = jffs2_write_dnode(c, f, ri, mdata, mdatalen, ALLOC_NORMAL);
         if (S_ISLNK(inode->i_mode))
                 kfree(mdata);
 
@@ -180,7 +184,12 @@ static int jffs2_do_setattr (struct inode *inode, struct iattr *iattr)
 
 int jffs2_setattr(struct dentry *dentry, struct iattr *iattr)
 {
-        return jffs2_do_setattr(dentry->d_inode, iattr);
+        int rc;
+
+        rc = jffs2_do_setattr(dentry->d_inode, iattr);
+        if (!rc && (iattr->ia_valid & ATTR_MODE))
+                rc = jffs2_acl_chmod(dentry->d_inode);
+        return rc;
 }
 
 int jffs2_statfs(struct super_block *sb, struct kstatfs *buf)
@@ -219,6 +228,7 @@ void jffs2_clear_inode (struct inode *inode)
 
         D1(printk(KERN_DEBUG "jffs2_clear_inode(): ino #%lu mode %o\n", inode->i_ino, inode->i_mode));
 
+        jffs2_xattr_delete_inode(c, f->inocache);
         jffs2_do_clear_inode(c, f);
 }
 
@@ -227,6 +237,8 @@ void jffs2_read_inode (struct inode *inode)
         struct jffs2_inode_info *f;
         struct jffs2_sb_info *c;
         struct jffs2_raw_inode latest_node;
+        union jffs2_device_node jdev;
+        dev_t rdev = 0;
         int ret;
 
         D1(printk(KERN_DEBUG "jffs2_read_inode(): inode->i_ino == %lu\n", inode->i_ino));
@@ -258,7 +270,6 @@ void jffs2_read_inode (struct inode *inode)
         inode->i_blocks = (inode->i_size + 511) >> 9;
 
         switch (inode->i_mode & S_IFMT) {
-                jint16_t rdev;
 
         case S_IFLNK:
                 inode->i_op = &jffs2_symlink_inode_operations;
@@ -292,8 +303,16 @@ void jffs2_read_inode (struct inode *inode)
         case S_IFBLK:
         case S_IFCHR:
                 /* Read the device numbers from the media */
+                if (f->metadata->size != sizeof(jdev.old) &&
+                    f->metadata->size != sizeof(jdev.new)) {
+                        printk(KERN_NOTICE "Device node has strange size %d\n", f->metadata->size);
+                        up(&f->sem);
+                        jffs2_do_clear_inode(c, f);
+                        make_bad_inode(inode);
+                        return;
+                }
                 D1(printk(KERN_DEBUG "Reading device numbers from flash\n"));
-                if (jffs2_read_dnode(c, f, f->metadata, (char *)&rdev, 0, sizeof(rdev)) < 0) {
+                if (jffs2_read_dnode(c, f, f->metadata, (char *)&jdev, 0, f->metadata->size) < 0) {
                         /* Eep */
                         printk(KERN_NOTICE "Read device numbers for inode %lu failed\n", (unsigned long)inode->i_ino);
                         up(&f->sem);
@@ -301,12 +320,15 @@ void jffs2_read_inode (struct inode *inode)
                         make_bad_inode(inode);
                         return;
                 }
+                if (f->metadata->size == sizeof(jdev.old))
+                        rdev = old_decode_dev(je16_to_cpu(jdev.old));
+                else
+                        rdev = new_decode_dev(je32_to_cpu(jdev.new));
 
         case S_IFSOCK:
         case S_IFIFO:
                 inode->i_op = &jffs2_file_inode_operations;
-                init_special_inode(inode, inode->i_mode,
-                                   old_decode_dev((je16_to_cpu(rdev))));
+                init_special_inode(inode, inode->i_mode, rdev);
                 break;
 
         default:
@@ -492,6 +514,8 @@ int jffs2_do_fill_super(struct super_block *sb, void *data, int silent)
         }
         memset(c->inocache_list, 0, INOCACHE_HASHSIZE * sizeof(struct jffs2_inode_cache *));
 
+        jffs2_init_xattr_subsystem(c);
+
         if ((ret = jffs2_do_mount_fs(c)))
                 goto out_inohash;
 
@@ -526,6 +550,7 @@ int jffs2_do_fill_super(struct super_block *sb, void *data, int silent)
         else
                 kfree(c->blocks);
  out_inohash:
+        jffs2_clear_xattr_subsystem(c);
         kfree(c->inocache_list);
  out_wbuf:
         jffs2_flash_cleanup(c);
@@ -639,13 +664,6 @@ static int jffs2_flash_setup(struct jffs2_sb_info *c) {
                         return ret;
         }
 
-        /* add setups for other bizarre flashes here... */
-        if (jffs2_nor_ecc(c)) {
-                ret = jffs2_nor_ecc_flash_setup(c);
-                if (ret)
-                        return ret;
-        }
-
         /* and Dataflash */
         if (jffs2_dataflash(c)) {
                 ret = jffs2_dataflash_setup(c);
@@ -669,11 +687,6 @@ void jffs2_flash_cleanup(struct jffs2_sb_info *c) {
                 jffs2_nand_flash_cleanup(c);
         }
 
-        /* add cleanups for other bizarre flashes here... */
-        if (jffs2_nor_ecc(c)) {
-                jffs2_nor_ecc_flash_cleanup(c);
-        }
-
         /* and DataFlash */
         if (jffs2_dataflash(c)) {
                 jffs2_dataflash_cleanup(c);
diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
index f9ffece453a3..477c526d638b 100644
--- a/fs/jffs2/gc.c
+++ b/fs/jffs2/gc.c
@@ -125,6 +125,7 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
         struct jffs2_eraseblock *jeb;
         struct jffs2_raw_node_ref *raw;
         int ret = 0, inum, nlink;
+        int xattr = 0;
 
         if (down_interruptible(&c->alloc_sem))
                 return -EINTR;
@@ -138,7 +139,7 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
                    the node CRCs etc. Do it now. */
 
                 /* checked_ino is protected by the alloc_sem */
-                if (c->checked_ino > c->highest_ino) {
+                if (c->checked_ino > c->highest_ino && xattr) {
                         printk(KERN_CRIT "Checked all inodes but still 0x%x bytes of unchecked space?\n",
                                c->unchecked_size);
                         jffs2_dbg_dump_block_lists_nolock(c);
@@ -148,6 +149,9 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
 
                 spin_unlock(&c->erase_completion_lock);
 
+                if (!xattr)
+                        xattr = jffs2_verify_xattr(c);
+
                 spin_lock(&c->inocache_lock);
 
                 ic = jffs2_get_ino_cache(c, c->checked_ino++);
@@ -181,6 +185,10 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
                            and trigger the BUG() above while we haven't yet
                            finished checking all its nodes */
                         D1(printk(KERN_DEBUG "Waiting for ino #%u to finish reading\n", ic->ino));
+                        /* We need to come back again for the _same_ inode. We've
+                         made no progress in this case, but that should be OK */
+                        c->checked_ino--;
+
                         up(&c->alloc_sem);
                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
                         return 0;
@@ -231,7 +239,7 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
 
         while(ref_obsolete(raw)) {
                 D1(printk(KERN_DEBUG "Node at 0x%08x is obsolete... skipping\n", ref_offset(raw)));
-                raw = raw->next_phys;
+                raw = ref_next(raw);
                 if (unlikely(!raw)) {
                         printk(KERN_WARNING "eep. End of raw list while still supposedly nodes to GC\n");
                         printk(KERN_WARNING "erase block at 0x%08x. free_size 0x%08x, dirty_size 0x%08x, used_size 0x%08x\n",
@@ -248,16 +256,37 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
 
         if (!raw->next_in_ino) {
                 /* Inode-less node. Clean marker, snapshot or something like that */
-                /* FIXME: If it's something that needs to be copied, including something
-                   we don't grok that has JFFS2_NODETYPE_RWCOMPAT_COPY, we should do so */
                 spin_unlock(&c->erase_completion_lock);
-                jffs2_mark_node_obsolete(c, raw);
+                if (ref_flags(raw) == REF_PRISTINE) {
+                        /* It's an unknown node with JFFS2_FEATURE_RWCOMPAT_COPY */
+                        jffs2_garbage_collect_pristine(c, NULL, raw);
+                } else {
+                        /* Just mark it obsolete */
+                        jffs2_mark_node_obsolete(c, raw);
+                }
                 up(&c->alloc_sem);
                 goto eraseit_lock;
         }
 
         ic = jffs2_raw_ref_to_ic(raw);
 
+#ifdef CONFIG_JFFS2_FS_XATTR
+        /* When 'ic' refers xattr_datum/xattr_ref, this node is GCed as xattr.
+         * We can decide whether this node is inode or xattr by ic->class.     */
+        if (ic->class == RAWNODE_CLASS_XATTR_DATUM
+            || ic->class == RAWNODE_CLASS_XATTR_REF) {
+                BUG_ON(raw->next_in_ino != (void *)ic);
+                spin_unlock(&c->erase_completion_lock);
+
+                if (ic->class == RAWNODE_CLASS_XATTR_DATUM) {
+                        ret = jffs2_garbage_collect_xattr_datum(c, (struct jffs2_xattr_datum *)ic);
+                } else {
+                        ret = jffs2_garbage_collect_xattr_ref(c, (struct jffs2_xattr_ref *)ic);
+                }
+                goto release_sem;
+        }
+#endif
+
         /* We need to hold the inocache. Either the erase_completion_lock or
            the inocache_lock are sufficient; we trade down since the inocache_lock
            causes less contention. */
@@ -499,7 +528,6 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
                                           struct jffs2_raw_node_ref *raw)
 {
         union jffs2_node_union *node;
-        struct jffs2_raw_node_ref *nraw;
         size_t retlen;
         int ret;
         uint32_t phys_ofs, alloclen;
@@ -508,15 +536,16 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
 
         D1(printk(KERN_DEBUG "Going to GC REF_PRISTINE node at 0x%08x\n", ref_offset(raw)));
 
-        rawlen = ref_totlen(c, c->gcblock, raw);
+        alloclen = rawlen = ref_totlen(c, c->gcblock, raw);
 
         /* Ask for a small amount of space (or the totlen if smaller) because we
            don't want to force wastage of the end of a block if splitting would
            work. */
-        ret = jffs2_reserve_space_gc(c, min_t(uint32_t, sizeof(struct jffs2_raw_inode) +
-                                JFFS2_MIN_DATA_LEN, rawlen), &phys_ofs, &alloclen, rawlen);
-                                /* this is not the exact summary size of it,
-                                        it is only an upper estimation */
+        if (ic && alloclen > sizeof(struct jffs2_raw_inode) + JFFS2_MIN_DATA_LEN)
+                alloclen = sizeof(struct jffs2_raw_inode) + JFFS2_MIN_DATA_LEN;
+
+        ret = jffs2_reserve_space_gc(c, alloclen, &alloclen, rawlen);
+        /* 'rawlen' is not the exact summary size; it is only an upper estimation */
 
         if (ret)
                 return ret;
@@ -580,22 +609,17 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
                 }
                 break;
         default:
-                printk(KERN_WARNING "Unknown node type for REF_PRISTINE node at 0x%08x: 0x%04x\n",
-                       ref_offset(raw), je16_to_cpu(node->u.nodetype));
-                goto bail;
-        }
-
-        nraw = jffs2_alloc_raw_node_ref();
-        if (!nraw) {
-                ret = -ENOMEM;
-                goto out_node;
+                /* If it's inode-less, we don't _know_ what it is. Just copy it intact */
+                if (ic) {
+                        printk(KERN_WARNING "Unknown node type for REF_PRISTINE node at 0x%08x: 0x%04x\n",
+                               ref_offset(raw), je16_to_cpu(node->u.nodetype));
+                        goto bail;
+                }
         }
 
         /* OK, all the CRCs are good; this node can just be copied as-is. */
  retry:
-        nraw->flash_offset = phys_ofs;
-        nraw->__totlen = rawlen;
-        nraw->next_phys = NULL;
+        phys_ofs = write_ofs(c);
 
         ret = jffs2_flash_write(c, phys_ofs, rawlen, &retlen, (char *)node);
 
@@ -603,17 +627,11 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
                 printk(KERN_NOTICE "Write of %d bytes at 0x%08x failed. returned %d, retlen %zd\n",
                        rawlen, phys_ofs, ret, retlen);
                 if (retlen) {
-                        /* Doesn't belong to any inode */
-                        nraw->next_in_ino = NULL;
-
-                        nraw->flash_offset |= REF_OBSOLETE;
-                        jffs2_add_physical_node_ref(c, nraw);
-                        jffs2_mark_node_obsolete(c, nraw);
+                        jffs2_add_physical_node_ref(c, phys_ofs | REF_OBSOLETE, rawlen, NULL);
                 } else {
-                        printk(KERN_NOTICE "Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n", nraw->flash_offset);
-                        jffs2_free_raw_node_ref(nraw);
+                        printk(KERN_NOTICE "Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n", phys_ofs);
                 }
-                if (!retried && (nraw = jffs2_alloc_raw_node_ref())) {
+                if (!retried) {
                         /* Try to reallocate space and retry */
                         uint32_t dummy;
                         struct jffs2_eraseblock *jeb = &c->blocks[phys_ofs / c->sector_size];
@@ -625,7 +643,7 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
                         jffs2_dbg_acct_sanity_check(c,jeb);
                         jffs2_dbg_acct_paranoia_check(c, jeb);
 
-                        ret = jffs2_reserve_space_gc(c, rawlen, &phys_ofs, &dummy, rawlen);
+                        ret = jffs2_reserve_space_gc(c, rawlen, &dummy, rawlen);
                                                 /* this is not the exact summary size of it,
                                                         it is only an upper estimation */
 
@@ -638,25 +656,13 @@ static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
                                 goto retry;
                         }
                         D1(printk(KERN_DEBUG "Failed to allocate space to retry failed write: %d!\n", ret));
-                        jffs2_free_raw_node_ref(nraw);
                 }
 
-                jffs2_free_raw_node_ref(nraw);
                 if (!ret)
                         ret = -EIO;
                 goto out_node;
         }
-        nraw->flash_offset |= REF_PRISTINE;
-        jffs2_add_physical_node_ref(c, nraw);
-
-        /* Link into per-inode list. This is safe because of the ic
-           state being INO_STATE_GC. Note that if we're doing this
-           for an inode which is in-core, the 'nraw' pointer is then
-           going to be fetched from ic->nodes by our caller. */
-        spin_lock(&c->erase_completion_lock);
-        nraw->next_in_ino = ic->nodes;
-        ic->nodes = nraw;
-        spin_unlock(&c->erase_completion_lock);
+        jffs2_add_physical_node_ref(c, phys_ofs | REF_PRISTINE, rawlen, ic);
 
         jffs2_mark_node_obsolete(c, raw);
         D1(printk(KERN_DEBUG "WHEEE! GC REF_PRISTINE node at 0x%08x succeeded\n", ref_offset(raw)));
@@ -675,19 +681,16 @@ static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_
         struct jffs2_full_dnode *new_fn;
         struct jffs2_raw_inode ri;
         struct jffs2_node_frag *last_frag;
-        jint16_t dev;
+        union jffs2_device_node dev;
         char *mdata = NULL, mdatalen = 0;
-        uint32_t alloclen, phys_ofs, ilen;
+        uint32_t alloclen, ilen;
         int ret;
 
         if (S_ISBLK(JFFS2_F_I_MODE(f)) ||
             S_ISCHR(JFFS2_F_I_MODE(f)) ) {
                 /* For these, we don't actually need to read the old node */
-                /* FIXME: for minor or major > 255. */
-                dev = cpu_to_je16(((JFFS2_F_I_RDEV_MAJ(f) << 8) |
-                        JFFS2_F_I_RDEV_MIN(f)));
+                mdatalen = jffs2_encode_dev(&dev, JFFS2_F_I_RDEV(f));
                 mdata = (char *)&dev;
-                mdatalen = sizeof(dev);
                 D1(printk(KERN_DEBUG "jffs2_garbage_collect_metadata(): Writing %d bytes of kdev_t\n", mdatalen));
         } else if (S_ISLNK(JFFS2_F_I_MODE(f))) {
                 mdatalen = fn->size;
@@ -706,7 +709,7 @@ static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_
 
         }
 
-        ret = jffs2_reserve_space_gc(c, sizeof(ri) + mdatalen, &phys_ofs, &alloclen,
+        ret = jffs2_reserve_space_gc(c, sizeof(ri) + mdatalen, &alloclen,
                                 JFFS2_SUMMARY_INODE_SIZE);
         if (ret) {
                 printk(KERN_WARNING "jffs2_reserve_space_gc of %zd bytes for garbage_collect_metadata failed: %d\n",
@@ -744,7 +747,7 @@ static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_
         ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
         ri.data_crc = cpu_to_je32(crc32(0, mdata, mdatalen));
 
-        new_fn = jffs2_write_dnode(c, f, &ri, mdata, mdatalen, phys_ofs, ALLOC_GC);
+        new_fn = jffs2_write_dnode(c, f, &ri, mdata, mdatalen, ALLOC_GC);
 
         if (IS_ERR(new_fn)) {
                 printk(KERN_WARNING "Error writing new dnode: %ld\n", PTR_ERR(new_fn));
@@ -765,7 +768,7 @@ static int jffs2_garbage_collect_dirent(struct jffs2_sb_info *c, struct jffs2_er
 {
         struct jffs2_full_dirent *new_fd;
         struct jffs2_raw_dirent rd;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret;
 
         rd.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
@@ -787,14 +790,14 @@ static int jffs2_garbage_collect_dirent(struct jffs2_sb_info *c, struct jffs2_er
         rd.node_crc = cpu_to_je32(crc32(0, &rd, sizeof(rd)-8));
         rd.name_crc = cpu_to_je32(crc32(0, fd->name, rd.nsize));
 
-        ret = jffs2_reserve_space_gc(c, sizeof(rd)+rd.nsize, &phys_ofs, &alloclen,
+        ret = jffs2_reserve_space_gc(c, sizeof(rd)+rd.nsize, &alloclen,
                                 JFFS2_SUMMARY_DIRENT_SIZE(rd.nsize));
         if (ret) {
                 printk(KERN_WARNING "jffs2_reserve_space_gc of %zd bytes for garbage_collect_dirent failed: %d\n",
                        sizeof(rd)+rd.nsize, ret);
                 return ret;
         }
-        new_fd = jffs2_write_dirent(c, f, &rd, fd->name, rd.nsize, phys_ofs, ALLOC_GC);
+        new_fd = jffs2_write_dirent(c, f, &rd, fd->name, rd.nsize, ALLOC_GC);
 
         if (IS_ERR(new_fd)) {
                 printk(KERN_WARNING "jffs2_write_dirent in garbage_collect_dirent failed: %ld\n", PTR_ERR(new_fd));
@@ -922,7 +925,7 @@ static int jffs2_garbage_collect_hole(struct jffs2_sb_info *c, struct jffs2_eras
         struct jffs2_raw_inode ri;
         struct jffs2_node_frag *frag;
         struct jffs2_full_dnode *new_fn;
-        uint32_t alloclen, phys_ofs, ilen;
+        uint32_t alloclen, ilen;
         int ret;
 
         D1(printk(KERN_DEBUG "Writing replacement hole node for ino #%u from offset 0x%x to 0x%x\n",
@@ -1001,14 +1004,14 @@ static int jffs2_garbage_collect_hole(struct jffs2_sb_info *c, struct jffs2_eras
         ri.data_crc = cpu_to_je32(0);
         ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
 
-        ret = jffs2_reserve_space_gc(c, sizeof(ri), &phys_ofs, &alloclen,
-                                JFFS2_SUMMARY_INODE_SIZE);
+        ret = jffs2_reserve_space_gc(c, sizeof(ri), &alloclen,
+                                     JFFS2_SUMMARY_INODE_SIZE);
         if (ret) {
                 printk(KERN_WARNING "jffs2_reserve_space_gc of %zd bytes for garbage_collect_hole failed: %d\n",
                        sizeof(ri), ret);
                 return ret;
         }
-        new_fn = jffs2_write_dnode(c, f, &ri, NULL, 0, phys_ofs, ALLOC_GC);
+        new_fn = jffs2_write_dnode(c, f, &ri, NULL, 0, ALLOC_GC);
 
         if (IS_ERR(new_fn)) {
                 printk(KERN_WARNING "Error writing new hole node: %ld\n", PTR_ERR(new_fn));
@@ -1070,7 +1073,7 @@ static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_era
 {
         struct jffs2_full_dnode *new_fn;
         struct jffs2_raw_inode ri;
-        uint32_t alloclen, phys_ofs, offset, orig_end, orig_start;
+        uint32_t alloclen, offset, orig_end, orig_start;
         int ret = 0;
         unsigned char *comprbuf = NULL, *writebuf;
         unsigned long pg;
@@ -1227,7 +1230,7 @@ static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_era
                 uint32_t cdatalen;
                 uint16_t comprtype = JFFS2_COMPR_NONE;
 
-                ret = jffs2_reserve_space_gc(c, sizeof(ri) + JFFS2_MIN_DATA_LEN, &phys_ofs,
+                ret = jffs2_reserve_space_gc(c, sizeof(ri) + JFFS2_MIN_DATA_LEN,
                                         &alloclen, JFFS2_SUMMARY_INODE_SIZE);
 
                 if (ret) {
@@ -1264,7 +1267,7 @@ static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_era
                 ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
                 ri.data_crc = cpu_to_je32(crc32(0, comprbuf, cdatalen));
 
-                new_fn = jffs2_write_dnode(c, f, &ri, comprbuf, cdatalen, phys_ofs, ALLOC_GC);
+                new_fn = jffs2_write_dnode(c, f, &ri, comprbuf, cdatalen, ALLOC_GC);
 
                 jffs2_free_comprbuf(comprbuf, writebuf);
 
diff --git a/fs/jffs2/histo.h b/fs/jffs2/histo.h
deleted file mode 100644
index 22a93a08210c..000000000000
--- a/fs/jffs2/histo.h
+++ /dev/null
@@ -1,3 +0,0 @@
-/* This file provides the bit-probabilities for the input file */
-#define BIT_DIVIDER 629
-static int bits[9] = { 179,167,183,165,159,198,178,119,}; /* ia32 .so files */
diff --git a/fs/jffs2/jffs2_fs_i.h b/fs/jffs2/jffs2_fs_i.h
new file mode 100644
index 000000000000..2e0cc8e00b85
--- /dev/null
+++ b/fs/jffs2/jffs2_fs_i.h
@@ -0,0 +1,55 @@
+/* $Id: jffs2_fs_i.h,v 1.19 2005/11/07 11:14:52 gleixner Exp $ */
+
+#ifndef _JFFS2_FS_I
+#define _JFFS2_FS_I
+
+#include <linux/version.h>
+#include <linux/rbtree.h>
+#include <linux/posix_acl.h>
+#include <asm/semaphore.h>
+
+struct jffs2_inode_info {
+        /* We need an internal mutex similar to inode->i_mutex.
+           Unfortunately, we can't used the existing one, because
+           either the GC would deadlock, or we'd have to release it
+           before letting GC proceed. Or we'd have to put ugliness
+           into the GC code so it didn't attempt to obtain the i_mutex
+           for the inode(s) which are already locked */
+        struct semaphore sem;
+
+        /* The highest (datanode) version number used for this ino */
+        uint32_t highest_version;
+
+        /* List of data fragments which make up the file */
+        struct rb_root fragtree;
+
+        /* There may be one datanode which isn't referenced by any of the
+           above fragments, if it contains a metadata update but no actual
+           data - or if this is a directory inode */
+        /* This also holds the _only_ dnode for symlinks/device nodes,
+           etc. */
+        struct jffs2_full_dnode *metadata;
+
+        /* Directory entries */
+        struct jffs2_full_dirent *dents;
+
+        /* The target path if this is the inode of a symlink */
+        unsigned char *target;
+
+        /* Some stuff we just have to keep in-core at all times, for each inode. */
+        struct jffs2_inode_cache *inocache;
+
+        uint16_t flags;
+        uint8_t usercompr;
+#if !defined (__ECOS)
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,5,2)
+        struct inode vfs_inode;
+#endif
+#endif
+#ifdef CONFIG_JFFS2_FS_POSIX_ACL
+        struct posix_acl *i_acl_access;
+        struct posix_acl *i_acl_default;
+#endif
+};
+
+#endif /* _JFFS2_FS_I */
diff --git a/fs/jffs2/jffs2_fs_sb.h b/fs/jffs2/jffs2_fs_sb.h
new file mode 100644
index 000000000000..935fec1b1201
--- /dev/null
+++ b/fs/jffs2/jffs2_fs_sb.h
@@ -0,0 +1,133 @@
+/* $Id: jffs2_fs_sb.h,v 1.54 2005/09/21 13:37:34 dedekind Exp $ */
+
+#ifndef _JFFS2_FS_SB
+#define _JFFS2_FS_SB
+
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/completion.h>
+#include <asm/semaphore.h>
+#include <linux/timer.h>
+#include <linux/wait.h>
+#include <linux/list.h>
+#include <linux/rwsem.h>
+
+#define JFFS2_SB_FLAG_RO 1
+#define JFFS2_SB_FLAG_SCANNING 2 /* Flash scanning is in progress */
+#define JFFS2_SB_FLAG_BUILDING 4 /* File system building is in progress */
+
+struct jffs2_inodirty;
+
+/* A struct for the overall file system control.  Pointers to
+   jffs2_sb_info structs are named `c' in the source code.
+   Nee jffs_control
+*/
+struct jffs2_sb_info {
+        struct mtd_info *mtd;
+
+        uint32_t highest_ino;
+        uint32_t checked_ino;
+
+        unsigned int flags;
+
+        struct task_struct *gc_task;    /* GC task struct */
+        struct completion gc_thread_start; /* GC thread start completion */
+        struct completion gc_thread_exit; /* GC thread exit completion port */
+
+        struct semaphore alloc_sem;     /* Used to protect all the following
+                                           fields, and also to protect against
+                                           out-of-order writing of nodes. And GC. */
+        uint32_t cleanmarker_size;      /* Size of an _inline_ CLEANMARKER
+                                         (i.e. zero for OOB CLEANMARKER */
+
+        uint32_t flash_size;
+        uint32_t used_size;
+        uint32_t dirty_size;
+        uint32_t wasted_size;
+        uint32_t free_size;
+        uint32_t erasing_size;
+        uint32_t bad_size;
+        uint32_t sector_size;
+        uint32_t unchecked_size;
+
+        uint32_t nr_free_blocks;
+        uint32_t nr_erasing_blocks;
+
+        /* Number of free blocks there must be before we... */
+        uint8_t resv_blocks_write;      /* ... allow a normal filesystem write */
+        uint8_t resv_blocks_deletion;   /* ... allow a normal filesystem deletion */
+        uint8_t resv_blocks_gctrigger;  /* ... wake up the GC thread */
+        uint8_t resv_blocks_gcbad;      /* ... pick a block from the bad_list to GC */
+        uint8_t resv_blocks_gcmerge;    /* ... merge pages when garbage collecting */
+
+        uint32_t nospc_dirty_size;
+
+        uint32_t nr_blocks;
+        struct jffs2_eraseblock *blocks;        /* The whole array of blocks. Used for getting blocks
+                                                 * from the offset (blocks[ofs / sector_size]) */
+        struct jffs2_eraseblock *nextblock;     /* The block we're currently filling */
+
+        struct jffs2_eraseblock *gcblock;       /* The block we're currently garbage-collecting */
+
+        struct list_head clean_list;            /* Blocks 100% full of clean data */
+        struct list_head very_dirty_list;       /* Blocks with lots of dirty space */
+        struct list_head dirty_list;            /* Blocks with some dirty space */
+        struct list_head erasable_list;         /* Blocks which are completely dirty, and need erasing */
+        struct list_head erasable_pending_wbuf_list;    /* Blocks which need erasing but only after the current wbuf is flushed */
+        struct list_head erasing_list;          /* Blocks which are currently erasing */
+        struct list_head erase_pending_list;    /* Blocks which need erasing now */
+        struct list_head erase_complete_list;   /* Blocks which are erased and need the clean marker written to them */
+        struct list_head free_list;             /* Blocks which are free and ready to be used */
+        struct list_head bad_list;              /* Bad blocks. */
+        struct list_head bad_used_list;         /* Bad blocks with valid data in. */
+
+        spinlock_t erase_completion_lock;       /* Protect free_list and erasing_list
+                                                   against erase completion handler */
+        wait_queue_head_t erase_wait;           /* For waiting for erases to complete */
+
+        wait_queue_head_t inocache_wq;
+        struct jffs2_inode_cache **inocache_list;
+        spinlock_t inocache_lock;
+
+        /* Sem to allow jffs2_garbage_collect_deletion_dirent to
+           drop the erase_completion_lock while it's holding a pointer
+           to an obsoleted node. I don't like this. Alternatives welcomed. */
+        struct semaphore erase_free_sem;
+
+        uint32_t wbuf_pagesize; /* 0 for NOR and other flashes with no wbuf */
+
+#ifdef CONFIG_JFFS2_FS_WRITEBUFFER
+        /* Write-behind buffer for NAND flash */
+        unsigned char *wbuf;
+        unsigned char *oobbuf;
+        uint32_t wbuf_ofs;
+        uint32_t wbuf_len;
+        struct jffs2_inodirty *wbuf_inodes;
+
+        struct rw_semaphore wbuf_sem;   /* Protects the write buffer */
+
+        /* Information about out-of-band area usage... */
+        struct nand_ecclayout *ecclayout;
+        uint32_t badblock_pos;
+        uint32_t fsdata_pos;
+        uint32_t fsdata_len;
+#endif
+
+        struct jffs2_summary *summary;          /* Summary information */
+
+#ifdef CONFIG_JFFS2_FS_XATTR
+#define XATTRINDEX_HASHSIZE     (57)
+        uint32_t highest_xid;
+        struct list_head xattrindex[XATTRINDEX_HASHSIZE];
+        struct list_head xattr_unchecked;
+        struct jffs2_xattr_ref *xref_temp;
+        struct rw_semaphore xattr_sem;
+        uint32_t xdatum_mem_usage;
+        uint32_t xdatum_mem_threshold;
+#endif
+        /* OS-private pointer for getting back to master superblock info */
+        void *os_priv;
+};
+
+#endif /* _JFFS2_FB_SB */
diff --git a/fs/jffs2/malloc.c b/fs/jffs2/malloc.c
index 036cbd11c004..4889d0700c0e 100644
--- a/fs/jffs2/malloc.c
+++ b/fs/jffs2/malloc.c
@@ -26,6 +26,10 @@ static kmem_cache_t *tmp_dnode_info_slab;
 static kmem_cache_t *raw_node_ref_slab;
 static kmem_cache_t *node_frag_slab;
 static kmem_cache_t *inode_cache_slab;
+#ifdef CONFIG_JFFS2_FS_XATTR
+static kmem_cache_t *xattr_datum_cache;
+static kmem_cache_t *xattr_ref_cache;
+#endif
 
 int __init jffs2_create_slab_caches(void)
 {
@@ -53,8 +57,8 @@ int __init jffs2_create_slab_caches(void)
         if (!tmp_dnode_info_slab)
                 goto err;
 
-        raw_node_ref_slab = kmem_cache_create("jffs2_raw_node_ref",
-                                              sizeof(struct jffs2_raw_node_ref),
+        raw_node_ref_slab = kmem_cache_create("jffs2_refblock",
+                                              sizeof(struct jffs2_raw_node_ref) * (REFS_PER_BLOCK + 1),
                                               0, 0, NULL, NULL);
         if (!raw_node_ref_slab)
                 goto err;
@@ -68,8 +72,24 @@ int __init jffs2_create_slab_caches(void)
         inode_cache_slab = kmem_cache_create("jffs2_inode_cache",
                                              sizeof(struct jffs2_inode_cache),
                                              0, 0, NULL, NULL);
-        if (inode_cache_slab)
-                return 0;
+        if (!inode_cache_slab)
+                goto err;
+
+#ifdef CONFIG_JFFS2_FS_XATTR
+        xattr_datum_cache = kmem_cache_create("jffs2_xattr_datum",
+                                             sizeof(struct jffs2_xattr_datum),
+                                             0, 0, NULL, NULL);
+        if (!xattr_datum_cache)
+                goto err;
+
+        xattr_ref_cache = kmem_cache_create("jffs2_xattr_ref",
+                                           sizeof(struct jffs2_xattr_ref),
+                                           0, 0, NULL, NULL);
+        if (!xattr_ref_cache)
+                goto err;
+#endif
+
+        return 0;
  err:
         jffs2_destroy_slab_caches();
         return -ENOMEM;
@@ -91,6 +111,12 @@ void jffs2_destroy_slab_caches(void)
                 kmem_cache_destroy(node_frag_slab);
         if(inode_cache_slab)
                 kmem_cache_destroy(inode_cache_slab);
+#ifdef CONFIG_JFFS2_FS_XATTR
+        if (xattr_datum_cache)
+                kmem_cache_destroy(xattr_datum_cache);
+        if (xattr_ref_cache)
+                kmem_cache_destroy(xattr_ref_cache);
+#endif
 }
 
 struct jffs2_full_dirent *jffs2_alloc_full_dirent(int namesize)
@@ -164,15 +190,65 @@ void jffs2_free_tmp_dnode_info(struct jffs2_tmp_dnode_info *x)
         kmem_cache_free(tmp_dnode_info_slab, x);
 }
 
-struct jffs2_raw_node_ref *jffs2_alloc_raw_node_ref(void)
+struct jffs2_raw_node_ref *jffs2_alloc_refblock(void)
 {
         struct jffs2_raw_node_ref *ret;
+
         ret = kmem_cache_alloc(raw_node_ref_slab, GFP_KERNEL);
-        dbg_memalloc("%p\n", ret);
+        if (ret) {
+                int i = 0;
+                for (i=0; i < REFS_PER_BLOCK; i++) {
+                        ret[i].flash_offset = REF_EMPTY_NODE;
+                        ret[i].next_in_ino = NULL;
+                }
+                ret[i].flash_offset = REF_LINK_NODE;
+                ret[i].next_in_ino = NULL;
+        }
         return ret;
 }
 
-void jffs2_free_raw_node_ref(struct jffs2_raw_node_ref *x)
+int jffs2_prealloc_raw_node_refs(struct jffs2_sb_info *c,
+                                 struct jffs2_eraseblock *jeb, int nr)
+{
+        struct jffs2_raw_node_ref **p, *ref;
+        int i = nr;
+
+        dbg_memalloc("%d\n", nr);
+
+        p = &jeb->last_node;
+        ref = *p;
+
+        dbg_memalloc("Reserving %d refs for block @0x%08x\n", nr, jeb->offset);
+
+        /* If jeb->last_node is really a valid node then skip over it */
+        if (ref && ref->flash_offset != REF_EMPTY_NODE)
+                ref++;
+
+        while (i) {
+                if (!ref) {
+                        dbg_memalloc("Allocating new refblock linked from %p\n", p);
+                        ref = *p = jffs2_alloc_refblock();
+                        if (!ref)
+                                return -ENOMEM;
+                }
+                if (ref->flash_offset == REF_LINK_NODE) {
+                        p = &ref->next_in_ino;
+                        ref = *p;
+                        continue;
+                }
+                i--;
+                ref++;
+        }
+        jeb->allocated_refs = nr;
+
+        dbg_memalloc("Reserved %d refs for block @0x%08x, last_node is %p (%08x,%p)\n",
+                  nr, jeb->offset, jeb->last_node, jeb->last_node->flash_offset,
+                  jeb->last_node->next_in_ino);
+
+        return 0;
+}
+
+void jffs2_free_refblock(struct jffs2_raw_node_ref *x)
 {
         dbg_memalloc("%p\n", x);
         kmem_cache_free(raw_node_ref_slab, x);
@@ -205,3 +281,40 @@ void jffs2_free_inode_cache(struct jffs2_inode_cache *x)
         dbg_memalloc("%p\n", x);
         kmem_cache_free(inode_cache_slab, x);
 }
+
+#ifdef CONFIG_JFFS2_FS_XATTR
+struct jffs2_xattr_datum *jffs2_alloc_xattr_datum(void)
+{
+        struct jffs2_xattr_datum *xd;
+        xd = kmem_cache_alloc(xattr_datum_cache, GFP_KERNEL);
+        dbg_memalloc("%p\n", xd);
+
+        memset(xd, 0, sizeof(struct jffs2_xattr_datum));
+        xd->class = RAWNODE_CLASS_XATTR_DATUM;
+        INIT_LIST_HEAD(&xd->xindex);
+        return xd;
+}
+
+void jffs2_free_xattr_datum(struct jffs2_xattr_datum *xd)
+{
+        dbg_memalloc("%p\n", xd);
+        kmem_cache_free(xattr_datum_cache, xd);
+}
+
+struct jffs2_xattr_ref *jffs2_alloc_xattr_ref(void)
+{
+        struct jffs2_xattr_ref *ref;
+        ref = kmem_cache_alloc(xattr_ref_cache, GFP_KERNEL);
+        dbg_memalloc("%p\n", ref);
+
+        memset(ref, 0, sizeof(struct jffs2_xattr_ref));
+        ref->class = RAWNODE_CLASS_XATTR_REF;
+        return ref;
+}
+
+void jffs2_free_xattr_ref(struct jffs2_xattr_ref *ref)
+{
+        dbg_memalloc("%p\n", ref);
+        kmem_cache_free(xattr_ref_cache, ref);
+}
+#endif
diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index 1d46677afd17..927dfe42ba76 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -438,8 +438,7 @@ static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info
         if (c->mtd->point) {
                 err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
                 if (!err && retlen < tn->csize) {
-                        JFFS2_WARNING("MTD point returned len too short: %zu "
-                                        "instead of %u.\n", retlen, tn->csize);
+                        JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
                         c->mtd->unpoint(c->mtd, buffer, ofs, len);
                 } else if (err)
                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
@@ -462,8 +461,7 @@ static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info
                 }
 
                 if (retlen != len) {
-                        JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n",
-                                        ofs, retlen, len);
+                        JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
                         err = -EIO;
                         goto free_out;
                 }
@@ -940,6 +938,7 @@ void jffs2_free_ino_caches(struct jffs2_sb_info *c)
                 this = c->inocache_list[i];
                 while (this) {
                         next = this->next;
+                        jffs2_xattr_free_inode(c, this);
                         jffs2_free_inode_cache(this);
                         this = next;
                 }
@@ -954,9 +953,13 @@ void jffs2_free_raw_node_refs(struct jffs2_sb_info *c)
 
         for (i=0; i<c->nr_blocks; i++) {
                 this = c->blocks[i].first_node;
-                while(this) {
-                        next = this->next_phys;
-                        jffs2_free_raw_node_ref(this);
+                while (this) {
+                        if (this[REFS_PER_BLOCK].flash_offset == REF_LINK_NODE)
+                                next = this[REFS_PER_BLOCK].next_in_ino;
+                        else
+                                next = NULL;
+
+                        jffs2_free_refblock(this);
                         this = next;
                 }
                 c->blocks[i].first_node = c->blocks[i].last_node = NULL;
@@ -1047,3 +1050,169 @@ void jffs2_kill_fragtree(struct rb_root *root, struct jffs2_sb_info *c)
                 cond_resched();
         }
 }
+
+struct jffs2_raw_node_ref *jffs2_link_node_ref(struct jffs2_sb_info *c,
+                                               struct jffs2_eraseblock *jeb,
+                                               uint32_t ofs, uint32_t len,
+                                               struct jffs2_inode_cache *ic)
+{
+        struct jffs2_raw_node_ref *ref;
+
+        BUG_ON(!jeb->allocated_refs);
+        jeb->allocated_refs--;
+
+        ref = jeb->last_node;
+
+        dbg_noderef("Last node at %p is (%08x,%p)\n", ref, ref->flash_offset,
+                    ref->next_in_ino);
+
+        while (ref->flash_offset != REF_EMPTY_NODE) {
+                if (ref->flash_offset == REF_LINK_NODE)
+                        ref = ref->next_in_ino;
+                else
+                        ref++;
+        }
+
+        dbg_noderef("New ref is %p (%08x becomes %08x,%p) len 0x%x\n", ref, 
+                    ref->flash_offset, ofs, ref->next_in_ino, len);
+
+        ref->flash_offset = ofs;
+
+        if (!jeb->first_node) {
+                jeb->first_node = ref;
+                BUG_ON(ref_offset(ref) != jeb->offset);
+        } else if (unlikely(ref_offset(ref) != jeb->offset + c->sector_size - jeb->free_size)) {
+                uint32_t last_len = ref_totlen(c, jeb, jeb->last_node);
+
+                JFFS2_ERROR("Adding new ref %p at (0x%08x-0x%08x) not immediately after previous (0x%08x-0x%08x)\n",
+                            ref, ref_offset(ref), ref_offset(ref)+len,
+                            ref_offset(jeb->last_node), 
+                            ref_offset(jeb->last_node)+last_len);
+                BUG();
+        }
+        jeb->last_node = ref;
+
+        if (ic) {
+                ref->next_in_ino = ic->nodes;
+                ic->nodes = ref;
+        } else {
+                ref->next_in_ino = NULL;
+        }
+
+        switch(ref_flags(ref)) {
+        case REF_UNCHECKED:
+                c->unchecked_size += len;
+                jeb->unchecked_size += len;
+                break;
+
+        case REF_NORMAL:
+        case REF_PRISTINE:
+                c->used_size += len;
+                jeb->used_size += len;
+                break;
+
+        case REF_OBSOLETE:
+                c->dirty_size += len;
+                jeb->dirty_size += len;
+                break;
+        }
+        c->free_size -= len;
+        jeb->free_size -= len;
+
+#ifdef TEST_TOTLEN
+        /* Set (and test) __totlen field... for now */
+        ref->__totlen = len;
+        ref_totlen(c, jeb, ref);
+#endif
+        return ref;
+}
+
+/* No locking, no reservation of 'ref'. Do not use on a live file system */
+int jffs2_scan_dirty_space(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
+                           uint32_t size)
+{
+        if (!size)
+                return 0;
+        if (unlikely(size > jeb->free_size)) {
+                printk(KERN_CRIT "Dirty space 0x%x larger then free_size 0x%x (wasted 0x%x)\n",
+                       size, jeb->free_size, jeb->wasted_size);
+                BUG();
+        }
+        /* REF_EMPTY_NODE is !obsolete, so that works OK */
+        if (jeb->last_node && ref_obsolete(jeb->last_node)) {
+#ifdef TEST_TOTLEN
+                jeb->last_node->__totlen += size;
+#endif
+                c->dirty_size += size;
+                c->free_size -= size;
+                jeb->dirty_size += size;
+                jeb->free_size -= size;
+        } else {
+                uint32_t ofs = jeb->offset + c->sector_size - jeb->free_size;
+                ofs |= REF_OBSOLETE;
+
+                jffs2_link_node_ref(c, jeb, ofs, size, NULL);
+        }
+
+        return 0;
+}
+
+/* Calculate totlen from surrounding nodes or eraseblock */
+static inline uint32_t __ref_totlen(struct jffs2_sb_info *c,
+                                    struct jffs2_eraseblock *jeb,
+                                    struct jffs2_raw_node_ref *ref)
+{
+        uint32_t ref_end;
+        struct jffs2_raw_node_ref *next_ref = ref_next(ref);
+
+        if (next_ref)
+                ref_end = ref_offset(next_ref);
+        else {
+                if (!jeb)
+                        jeb = &c->blocks[ref->flash_offset / c->sector_size];
+
+                /* Last node in block. Use free_space */
+                if (unlikely(ref != jeb->last_node)) {
+                        printk(KERN_CRIT "ref %p @0x%08x is not jeb->last_node (%p @0x%08x)\n",
+                               ref, ref_offset(ref), jeb->last_node, jeb->last_node?ref_offset(jeb->last_node):0);
+                        BUG();
+                }
+                ref_end = jeb->offset + c->sector_size - jeb->free_size;
+        }
+        return ref_end - ref_offset(ref);
+}
+
+uint32_t __jffs2_ref_totlen(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
+                            struct jffs2_raw_node_ref *ref)
+{
+        uint32_t ret;
+
+        ret = __ref_totlen(c, jeb, ref);
+
+#ifdef TEST_TOTLEN
+        if (unlikely(ret != ref->__totlen)) {
+                if (!jeb)
+                        jeb = &c->blocks[ref->flash_offset / c->sector_size];
+
+                printk(KERN_CRIT "Totlen for ref at %p (0x%08x-0x%08x) miscalculated as 0x%x instead of %x\n",
+                       ref, ref_offset(ref), ref_offset(ref)+ref->__totlen,
+                       ret, ref->__totlen);
+                if (ref_next(ref)) {
+                        printk(KERN_CRIT "next %p (0x%08x-0x%08x)\n", ref_next(ref), ref_offset(ref_next(ref)),
+                               ref_offset(ref_next(ref))+ref->__totlen);
+                } else 
+                        printk(KERN_CRIT "No next ref. jeb->last_node is %p\n", jeb->last_node);
+
+                printk(KERN_CRIT "jeb->wasted_size %x, dirty_size %x, used_size %x, free_size %x\n", jeb->wasted_size, jeb->dirty_size, jeb->used_size, jeb->free_size);
+
+#if defined(JFFS2_DBG_DUMPS) || defined(JFFS2_DBG_PARANOIA_CHECKS)
+                __jffs2_dbg_dump_node_refs_nolock(c, jeb);
+#endif
+
+                WARN_ON(1);
+
+                ret = ref->__totlen;
+        }
+#endif /* TEST_TOTLEN */
+        return ret;
+}
diff --git a/fs/jffs2/nodelist.h b/fs/jffs2/nodelist.h
index 23a67bb3052f..b16c60bbcf6e 100644
--- a/fs/jffs2/nodelist.h
+++ b/fs/jffs2/nodelist.h
@@ -18,8 +18,10 @@
 #include <linux/fs.h>
 #include <linux/types.h>
 #include <linux/jffs2.h>
-#include <linux/jffs2_fs_sb.h>
-#include <linux/jffs2_fs_i.h>
+#include "jffs2_fs_sb.h"
+#include "jffs2_fs_i.h"
+#include "xattr.h"
+#include "acl.h"
 #include "summary.h"
 
 #ifdef __ECOS
@@ -75,14 +77,50 @@
 struct jffs2_raw_node_ref
 {
         struct jffs2_raw_node_ref *next_in_ino; /* Points to the next raw_node_ref
-                for this inode. If this is the last, it points to the inode_cache
-                for this inode instead. The inode_cache will have NULL in the first
-                word so you know when you've got there :) */
-        struct jffs2_raw_node_ref *next_phys;
+                for this object. If this _is_ the last, it points to the inode_cache,
+                xattr_ref or xattr_datum instead. The common part of those structures
+                has NULL in the first word. See jffs2_raw_ref_to_ic() below */
         uint32_t flash_offset;
+#define TEST_TOTLEN
+#ifdef TEST_TOTLEN
         uint32_t __totlen; /* This may die; use ref_totlen(c, jeb, ) below */
+#endif
 };
 
+#define REF_LINK_NODE ((int32_t)-1)
+#define REF_EMPTY_NODE ((int32_t)-2)
+
+/* Use blocks of about 256 bytes */
+#define REFS_PER_BLOCK ((255/sizeof(struct jffs2_raw_node_ref))-1)
+
+static inline struct jffs2_raw_node_ref *ref_next(struct jffs2_raw_node_ref *ref)
+{
+        ref++;
+
+        /* Link to another block of refs */
+        if (ref->flash_offset == REF_LINK_NODE) {
+                ref = ref->next_in_ino;
+                if (!ref)
+                        return ref;
+        }
+
+        /* End of chain */
+        if (ref->flash_offset == REF_EMPTY_NODE)
+                return NULL;
+
+        return ref;
+}
+
+static inline struct jffs2_inode_cache *jffs2_raw_ref_to_ic(struct jffs2_raw_node_ref *raw)
+{
+        while(raw->next_in_ino)
+                raw = raw->next_in_ino;
+
+        /* NB. This can be a jffs2_xattr_datum or jffs2_xattr_ref and
+           not actually a jffs2_inode_cache. Check ->class */
+        return ((struct jffs2_inode_cache *)raw);
+}
+
         /* flash_offset & 3 always has to be zero, because nodes are
            always aligned at 4 bytes. So we have a couple of extra bits
            to play with, which indicate the node's status; see below: */
@@ -95,6 +133,11 @@ struct jffs2_raw_node_ref
 #define ref_obsolete(ref)       (((ref)->flash_offset & 3) == REF_OBSOLETE)
 #define mark_ref_normal(ref)    do { (ref)->flash_offset = ref_offset(ref) | REF_NORMAL; } while(0)
 
+/* NB: REF_PRISTINE for an inode-less node (ref->next_in_ino == NULL) indicates
+   it is an unknown node of type JFFS2_NODETYPE_RWCOMPAT_COPY, so it'll get
+   copied. If you need to do anything different to GC inode-less nodes, then
+   you need to modify gc.c accordingly. */
+
 /* For each inode in the filesystem, we need to keep a record of
    nlink, because it would be a PITA to scan the whole directory tree
    at read_inode() time to calculate it, and to keep sufficient information
@@ -103,15 +146,27 @@ struct jffs2_raw_node_ref
    a pointer to the first physical node which is part of this inode, too.
 */
 struct jffs2_inode_cache {
+        /* First part of structure is shared with other objects which
+           can terminate the raw node refs' next_in_ino list -- which
+           currently struct jffs2_xattr_datum and struct jffs2_xattr_ref. */
+
         struct jffs2_full_dirent *scan_dents; /* Used during scan to hold
                 temporary lists of dirents, and later must be set to
                 NULL to mark the end of the raw_node_ref->next_in_ino
                 chain. */
-        struct jffs2_inode_cache *next;
         struct jffs2_raw_node_ref *nodes;
+        uint8_t class;  /* It's used for identification */
+
+        /* end of shared structure */
+
+        uint8_t flags;
+        uint16_t state;
         uint32_t ino;
+        struct jffs2_inode_cache *next;
+#ifdef CONFIG_JFFS2_FS_XATTR
+        struct jffs2_xattr_ref *xref;
+#endif
         int nlink;
-        int state;
 };
 
 /* Inode states for 'state' above. We need the 'GC' state to prevent
@@ -125,8 +180,16 @@ struct jffs2_inode_cache {
 #define INO_STATE_READING       5       /* In read_inode() */
 #define INO_STATE_CLEARING      6       /* In clear_inode() */
 
+#define INO_FLAGS_XATTR_CHECKED 0x01    /* has no duplicate xattr_ref */
+
+#define RAWNODE_CLASS_INODE_CACHE       0
+#define RAWNODE_CLASS_XATTR_DATUM       1
+#define RAWNODE_CLASS_XATTR_REF         2
+
 #define INOCACHE_HASHSIZE 128
 
+#define write_ofs(c) ((c)->nextblock->offset + (c)->sector_size - (c)->nextblock->free_size)
+
 /*
   Larger representation of a raw node, kept in-core only when the
   struct inode for this particular ino is instantiated.
@@ -192,6 +255,7 @@ struct jffs2_eraseblock
         uint32_t wasted_size;
         uint32_t free_size;     /* Note that sector_size - free_size
                                    is the address of the first free space */
+        uint32_t allocated_refs;
         struct jffs2_raw_node_ref *first_node;
         struct jffs2_raw_node_ref *last_node;
 
@@ -203,57 +267,7 @@ static inline int jffs2_blocks_use_vmalloc(struct jffs2_sb_info *c)
         return ((c->flash_size / c->sector_size) * sizeof (struct jffs2_eraseblock)) > (128 * 1024);
 }
 
-/* Calculate totlen from surrounding nodes or eraseblock */
-static inline uint32_t __ref_totlen(struct jffs2_sb_info *c,
-                                    struct jffs2_eraseblock *jeb,
-                                    struct jffs2_raw_node_ref *ref)
-{
-        uint32_t ref_end;
-
-        if (ref->next_phys)
-                ref_end = ref_offset(ref->next_phys);
-        else {
-                if (!jeb)
-                        jeb = &c->blocks[ref->flash_offset / c->sector_size];
-
-                /* Last node in block. Use free_space */
-                BUG_ON(ref != jeb->last_node);
-                ref_end = jeb->offset + c->sector_size - jeb->free_size;
-        }
-        return ref_end - ref_offset(ref);
-}
-
-static inline uint32_t ref_totlen(struct jffs2_sb_info *c,
-                                  struct jffs2_eraseblock *jeb,
-                                  struct jffs2_raw_node_ref *ref)
-{
-        uint32_t ret;
-
-#if CONFIG_JFFS2_FS_DEBUG > 0
-        if (jeb && jeb != &c->blocks[ref->flash_offset / c->sector_size]) {
-                printk(KERN_CRIT "ref_totlen called with wrong block -- at 0x%08x instead of 0x%08x; ref 0x%08x\n",
-                       jeb->offset, c->blocks[ref->flash_offset / c->sector_size].offset, ref_offset(ref));
-                BUG();
-        }
-#endif
-
-#if 1
-        ret = ref->__totlen;
-#else
-        /* This doesn't actually work yet */
-        ret = __ref_totlen(c, jeb, ref);
-        if (ret != ref->__totlen) {
-                printk(KERN_CRIT "Totlen for ref at %p (0x%08x-0x%08x) miscalculated as 0x%x instead of %x\n",
-                       ref, ref_offset(ref), ref_offset(ref)+ref->__totlen,
-                       ret, ref->__totlen);
-                if (!jeb)
-                        jeb = &c->blocks[ref->flash_offset / c->sector_size];
-                jffs2_dbg_dump_node_refs_nolock(c, jeb);
-                BUG();
-        }
-#endif
-        return ret;
-}
+#define ref_totlen(a, b, c) __jffs2_ref_totlen((a), (b), (c))
 
 #define ALLOC_NORMAL    0       /* Normal allocation */
 #define ALLOC_DELETION  1       /* Deletion node. Best to allow it */
@@ -268,13 +282,15 @@ static inline uint32_t ref_totlen(struct jffs2_sb_info *c,
 
 #define PAD(x) (((x)+3)&~3)
 
-static inline struct jffs2_inode_cache *jffs2_raw_ref_to_ic(struct jffs2_raw_node_ref *raw)
+static inline int jffs2_encode_dev(union jffs2_device_node *jdev, dev_t rdev)
 {
-        while(raw->next_in_ino) {
-                raw = raw->next_in_ino;
+        if (old_valid_dev(rdev)) {
+                jdev->old = cpu_to_je16(old_encode_dev(rdev));
+                return sizeof(jdev->old);
+        } else {
+                jdev->new = cpu_to_je32(new_encode_dev(rdev));
+                return sizeof(jdev->new);
         }
-
-        return ((struct jffs2_inode_cache *)raw);
 }
 
 static inline struct jffs2_node_frag *frag_first(struct rb_root *root)
@@ -299,7 +315,6 @@ static inline struct jffs2_node_frag *frag_last(struct rb_root *root)
         return rb_entry(node, struct jffs2_node_frag, rb);
 }
 
-#define rb_parent(rb) ((rb)->rb_parent)
 #define frag_next(frag) rb_entry(rb_next(&(frag)->rb), struct jffs2_node_frag, rb)
 #define frag_prev(frag) rb_entry(rb_prev(&(frag)->rb), struct jffs2_node_frag, rb)
 #define frag_parent(frag) rb_entry(rb_parent(&(frag)->rb), struct jffs2_node_frag, rb)
@@ -324,28 +339,44 @@ void jffs2_obsolete_node_frag(struct jffs2_sb_info *c, struct jffs2_node_frag *t
 int jffs2_add_full_dnode_to_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_full_dnode *fn);
 void jffs2_truncate_fragtree (struct jffs2_sb_info *c, struct rb_root *list, uint32_t size);
 int jffs2_add_older_frag_to_fragtree(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_tmp_dnode_info *tn);
+struct jffs2_raw_node_ref *jffs2_link_node_ref(struct jffs2_sb_info *c,
+                                               struct jffs2_eraseblock *jeb,
+                                               uint32_t ofs, uint32_t len,
+                                               struct jffs2_inode_cache *ic);
+extern uint32_t __jffs2_ref_totlen(struct jffs2_sb_info *c,
+                                   struct jffs2_eraseblock *jeb,
+                                   struct jffs2_raw_node_ref *ref);
 
 /* nodemgmt.c */
 int jffs2_thread_should_wake(struct jffs2_sb_info *c);
-int jffs2_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *ofs,
+int jffs2_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
                         uint32_t *len, int prio, uint32_t sumsize);
-int jffs2_reserve_space_gc(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *ofs,
+int jffs2_reserve_space_gc(struct jffs2_sb_info *c, uint32_t minsize,
                         uint32_t *len, uint32_t sumsize);
-int jffs2_add_physical_node_ref(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *new);
+struct jffs2_raw_node_ref *jffs2_add_physical_node_ref(struct jffs2_sb_info *c, 
+                                                       uint32_t ofs, uint32_t len,
+                                                       struct jffs2_inode_cache *ic);
 void jffs2_complete_reservation(struct jffs2_sb_info *c);
 void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *raw);
 
 /* write.c */
 int jffs2_do_new_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, uint32_t mode, struct jffs2_raw_inode *ri);
 
-struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_raw_inode *ri, const unsigned char *data, uint32_t datalen, uint32_t flash_ofs, int alloc_mode);
-struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_raw_dirent *rd, const unsigned char *name, uint32_t namelen, uint32_t flash_ofs, int alloc_mode);
+struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
+                                           struct jffs2_raw_inode *ri, const unsigned char *data,
+                                           uint32_t datalen, int alloc_mode);
+struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
+                                             struct jffs2_raw_dirent *rd, const unsigned char *name,
+                                             uint32_t namelen, int alloc_mode);
 int jffs2_write_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
                             struct jffs2_raw_inode *ri, unsigned char *buf,
                             uint32_t offset, uint32_t writelen, uint32_t *retlen);
-int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, struct jffs2_inode_info *f, struct jffs2_raw_inode *ri, const char *name, int namelen);
-int jffs2_do_unlink(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, const char *name, int namelen, struct jffs2_inode_info *dead_f, uint32_t time);
-int jffs2_do_link (struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, uint32_t ino, uint8_t type, const char *name, int namelen, uint32_t time);
+int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, struct jffs2_inode_info *f,
+                    struct jffs2_raw_inode *ri, const char *name, int namelen);
+int jffs2_do_unlink(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, const char *name,
+                    int namelen, struct jffs2_inode_info *dead_f, uint32_t time);
+int jffs2_do_link(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, uint32_t ino,
+                   uint8_t type, const char *name, int namelen, uint32_t time);
 
 
 /* readinode.c */
@@ -368,12 +399,19 @@ struct jffs2_raw_inode *jffs2_alloc_raw_inode(void);
 void jffs2_free_raw_inode(struct jffs2_raw_inode *);
 struct jffs2_tmp_dnode_info *jffs2_alloc_tmp_dnode_info(void);
 void jffs2_free_tmp_dnode_info(struct jffs2_tmp_dnode_info *);
-struct jffs2_raw_node_ref *jffs2_alloc_raw_node_ref(void);
-void jffs2_free_raw_node_ref(struct jffs2_raw_node_ref *);
+int jffs2_prealloc_raw_node_refs(struct jffs2_sb_info *c,
+                                 struct jffs2_eraseblock *jeb, int nr);
+void jffs2_free_refblock(struct jffs2_raw_node_ref *);
 struct jffs2_node_frag *jffs2_alloc_node_frag(void);
 void jffs2_free_node_frag(struct jffs2_node_frag *);
 struct jffs2_inode_cache *jffs2_alloc_inode_cache(void);
 void jffs2_free_inode_cache(struct jffs2_inode_cache *);
+#ifdef CONFIG_JFFS2_FS_XATTR
+struct jffs2_xattr_datum *jffs2_alloc_xattr_datum(void);
+void jffs2_free_xattr_datum(struct jffs2_xattr_datum *);
+struct jffs2_xattr_ref *jffs2_alloc_xattr_ref(void);
+void jffs2_free_xattr_ref(struct jffs2_xattr_ref *);
+#endif
 
 /* gc.c */
 int jffs2_garbage_collect_pass(struct jffs2_sb_info *c);
@@ -393,12 +431,14 @@ int jffs2_fill_scan_buf(struct jffs2_sb_info *c, void *buf,
                                 uint32_t ofs, uint32_t len);
 struct jffs2_inode_cache *jffs2_scan_make_ino_cache(struct jffs2_sb_info *c, uint32_t ino);
 int jffs2_scan_classify_jeb(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
+int jffs2_scan_dirty_space(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, uint32_t size);
 
 /* build.c */
 int jffs2_do_mount_fs(struct jffs2_sb_info *c);
 
 /* erase.c */
 void jffs2_erase_pending_blocks(struct jffs2_sb_info *c, int count);
+void jffs2_free_jeb_node_refs(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb);
 
 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
 /* wbuf.c */
diff --git a/fs/jffs2/nodemgmt.c b/fs/jffs2/nodemgmt.c
index 49127a1f0458..8bedfd2ff689 100644
--- a/fs/jffs2/nodemgmt.c
+++ b/fs/jffs2/nodemgmt.c
@@ -23,13 +23,12 @@
  *      jffs2_reserve_space - request physical space to write nodes to flash
  *      @c: superblock info
  *      @minsize: Minimum acceptable size of allocation
- *      @ofs: Returned value of node offset
  *      @len: Returned value of allocation length
  *      @prio: Allocation type - ALLOC_{NORMAL,DELETION}
  *
  *      Requests a block of physical space on the flash. Returns zero for success
- *      and puts 'ofs' and 'len' into the appriopriate place, or returns -ENOSPC
- *      or other error if appropriate.
+ *      and puts 'len' into the appropriate place, or returns -ENOSPC or other 
+ *      error if appropriate. Doesn't return len since that's 
  *
  *      If it returns zero, jffs2_reserve_space() also downs the per-filesystem
  *      allocation semaphore, to prevent more than one allocation from being
@@ -40,9 +39,9 @@
  */
 
 static int jffs2_do_reserve_space(struct jffs2_sb_info *c,  uint32_t minsize,
-                                        uint32_t *ofs, uint32_t *len, uint32_t sumsize);
+                                  uint32_t *len, uint32_t sumsize);
 
-int jffs2_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *ofs,
+int jffs2_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
                         uint32_t *len, int prio, uint32_t sumsize)
 {
         int ret = -EAGAIN;
@@ -132,19 +131,21 @@ int jffs2_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *ofs
                         spin_lock(&c->erase_completion_lock);
                 }
 
-                ret = jffs2_do_reserve_space(c, minsize, ofs, len, sumsize);
+                ret = jffs2_do_reserve_space(c, minsize, len, sumsize);
                 if (ret) {
                         D1(printk(KERN_DEBUG "jffs2_reserve_space: ret is %d\n", ret));
                 }
         }
         spin_unlock(&c->erase_completion_lock);
+        if (!ret)
+                ret = jffs2_prealloc_raw_node_refs(c, c->nextblock, 1);
         if (ret)
                 up(&c->alloc_sem);
         return ret;
 }
 
-int jffs2_reserve_space_gc(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *ofs,
-                        uint32_t *len, uint32_t sumsize)
+int jffs2_reserve_space_gc(struct jffs2_sb_info *c, uint32_t minsize,
+                           uint32_t *len, uint32_t sumsize)
 {
         int ret = -EAGAIN;
         minsize = PAD(minsize);
@@ -153,12 +154,15 @@ int jffs2_reserve_space_gc(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *
 
         spin_lock(&c->erase_completion_lock);
         while(ret == -EAGAIN) {
-                ret = jffs2_do_reserve_space(c, minsize, ofs, len, sumsize);
+                ret = jffs2_do_reserve_space(c, minsize, len, sumsize);
                 if (ret) {
                         D1(printk(KERN_DEBUG "jffs2_reserve_space_gc: looping, ret is %d\n", ret));
                 }
         }
         spin_unlock(&c->erase_completion_lock);
+        if (!ret)
+                ret = jffs2_prealloc_raw_node_refs(c, c->nextblock, 1);
+
         return ret;
 }
 
@@ -259,10 +263,11 @@ static int jffs2_find_nextblock(struct jffs2_sb_info *c)
 }
 
 /* Called with alloc sem _and_ erase_completion_lock */
-static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uint32_t *ofs, uint32_t *len, uint32_t sumsize)
+static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize,
+                                  uint32_t *len, uint32_t sumsize)
 {
         struct jffs2_eraseblock *jeb = c->nextblock;
-        uint32_t reserved_size;                         /* for summary information at the end of the jeb */
+        uint32_t reserved_size;                         /* for summary information at the end of the jeb */
         int ret;
 
  restart:
@@ -312,6 +317,8 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uin
                 }
         } else {
                 if (jeb && minsize > jeb->free_size) {
+                        uint32_t waste;
+
                         /* Skip the end of this block and file it as having some dirty space */
                         /* If there's a pending write to it, flush now */
 
@@ -324,10 +331,26 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uin
                                 goto restart;
                         }
 
-                        c->wasted_size += jeb->free_size;
-                        c->free_size -= jeb->free_size;
-                        jeb->wasted_size += jeb->free_size;
-                        jeb->free_size = 0;
+                        spin_unlock(&c->erase_completion_lock);
+
+                        ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
+                        if (ret)
+                                return ret;
+                        /* Just lock it again and continue. Nothing much can change because
+                           we hold c->alloc_sem anyway. In fact, it's not entirely clear why
+                           we hold c->erase_completion_lock in the majority of this function...
+                           but that's a question for another (more caffeine-rich) day. */
+                        spin_lock(&c->erase_completion_lock);
+
+                        waste = jeb->free_size;
+                        jffs2_link_node_ref(c, jeb,
+                                            (jeb->offset + c->sector_size - waste) | REF_OBSOLETE,
+                                            waste, NULL);
+                        /* FIXME: that made it count as dirty. Convert to wasted */
+                        jeb->dirty_size -= waste;
+                        c->dirty_size -= waste;
+                        jeb->wasted_size += waste;
+                        c->wasted_size += waste;
 
                         jffs2_close_nextblock(c, jeb);
                         jeb = NULL;
@@ -349,7 +372,6 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uin
         }
         /* OK, jeb (==c->nextblock) is now pointing at a block which definitely has
            enough space */
-        *ofs = jeb->offset + (c->sector_size - jeb->free_size);
         *len = jeb->free_size - reserved_size;
 
         if (c->cleanmarker_size && jeb->used_size == c->cleanmarker_size &&
@@ -365,7 +387,8 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uin
                 spin_lock(&c->erase_completion_lock);
         }
 
-        D1(printk(KERN_DEBUG "jffs2_do_reserve_space(): Giving 0x%x bytes at 0x%x\n", *len, *ofs));
+        D1(printk(KERN_DEBUG "jffs2_do_reserve_space(): Giving 0x%x bytes at 0x%x\n",
+                  *len, jeb->offset + (c->sector_size - jeb->free_size)));
         return 0;
 }
 
@@ -374,7 +397,6 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uin
  *      @c: superblock info
  *      @new: new node reference to add
  *      @len: length of this physical node
- *      @dirty: dirty flag for new node
  *
  *      Should only be used to report nodes for which space has been allocated
  *      by jffs2_reserve_space.
@@ -382,42 +404,30 @@ static int jffs2_do_reserve_space(struct jffs2_sb_info *c, uint32_t minsize, uin
  *      Must be called with the alloc_sem held.
  */
 
-int jffs2_add_physical_node_ref(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *new)
+struct jffs2_raw_node_ref *jffs2_add_physical_node_ref(struct jffs2_sb_info *c,
+                                                       uint32_t ofs, uint32_t len,
+                                                       struct jffs2_inode_cache *ic)
 {
         struct jffs2_eraseblock *jeb;
-        uint32_t len;
+        struct jffs2_raw_node_ref *new;
 
-        jeb = &c->blocks[new->flash_offset / c->sector_size];
-        len = ref_totlen(c, jeb, new);
+        jeb = &c->blocks[ofs / c->sector_size];
 
-        D1(printk(KERN_DEBUG "jffs2_add_physical_node_ref(): Node at 0x%x(%d), size 0x%x\n", ref_offset(new), ref_flags(new), len));
+        D1(printk(KERN_DEBUG "jffs2_add_physical_node_ref(): Node at 0x%x(%d), size 0x%x\n",
+                  ofs & ~3, ofs & 3, len));
 #if 1
-        /* we could get some obsolete nodes after nextblock was refiled
-           in wbuf.c */
-        if ((c->nextblock || !ref_obsolete(new))
-            &&(jeb != c->nextblock || ref_offset(new) != jeb->offset + (c->sector_size - jeb->free_size))) {
+        /* Allow non-obsolete nodes only to be added at the end of c->nextblock, 
+           if c->nextblock is set. Note that wbuf.c will file obsolete nodes
+           even after refiling c->nextblock */
+        if ((c->nextblock || ((ofs & 3) != REF_OBSOLETE))
+            && (jeb != c->nextblock || (ofs & ~3) != jeb->offset + (c->sector_size - jeb->free_size))) {
                 printk(KERN_WARNING "argh. node added in wrong place\n");
-                jffs2_free_raw_node_ref(new);
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         }
 #endif
         spin_lock(&c->erase_completion_lock);
 
-        if (!jeb->first_node)
-                jeb->first_node = new;
-        if (jeb->last_node)
-                jeb->last_node->next_phys = new;
-        jeb->last_node = new;
-
-        jeb->free_size -= len;
-        c->free_size -= len;
-        if (ref_obsolete(new)) {
-                jeb->dirty_size += len;
-                c->dirty_size += len;
-        } else {
-                jeb->used_size += len;
-                c->used_size += len;
-        }
+        new = jffs2_link_node_ref(c, jeb, ofs, len, ic);
 
         if (!jeb->free_size && !jeb->dirty_size && !ISDIRTY(jeb->wasted_size)) {
                 /* If it lives on the dirty_list, jffs2_reserve_space will put it there */
@@ -438,7 +448,7 @@ int jffs2_add_physical_node_ref(struct jffs2_sb_info *c, struct jffs2_raw_node_r
 
         spin_unlock(&c->erase_completion_lock);
 
-        return 0;
+        return new;
 }
 
 
@@ -470,8 +480,9 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
         struct jffs2_unknown_node n;
         int ret, addedsize;
         size_t retlen;
+        uint32_t freed_len;
 
-        if(!ref) {
+        if(unlikely(!ref)) {
                 printk(KERN_NOTICE "EEEEEK. jffs2_mark_node_obsolete called with NULL node\n");
                 return;
         }
@@ -499,32 +510,34 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
 
         spin_lock(&c->erase_completion_lock);
 
+        freed_len = ref_totlen(c, jeb, ref);
+
         if (ref_flags(ref) == REF_UNCHECKED) {
-                D1(if (unlikely(jeb->unchecked_size < ref_totlen(c, jeb, ref))) {
+                D1(if (unlikely(jeb->unchecked_size < freed_len)) {
                         printk(KERN_NOTICE "raw unchecked node of size 0x%08x freed from erase block %d at 0x%08x, but unchecked_size was already 0x%08x\n",
-                               ref_totlen(c, jeb, ref), blocknr, ref->flash_offset, jeb->used_size);
+                               freed_len, blocknr, ref->flash_offset, jeb->used_size);
                         BUG();
                 })
-                D1(printk(KERN_DEBUG "Obsoleting previously unchecked node at 0x%08x of len %x: ", ref_offset(ref), ref_totlen(c, jeb, ref)));
-                jeb->unchecked_size -= ref_totlen(c, jeb, ref);
-                c->unchecked_size -= ref_totlen(c, jeb, ref);
+                D1(printk(KERN_DEBUG "Obsoleting previously unchecked node at 0x%08x of len %x: ", ref_offset(ref), freed_len));
+                jeb->unchecked_size -= freed_len;
+                c->unchecked_size -= freed_len;
         } else {
-                D1(if (unlikely(jeb->used_size < ref_totlen(c, jeb, ref))) {
+                D1(if (unlikely(jeb->used_size < freed_len)) {
                         printk(KERN_NOTICE "raw node of size 0x%08x freed from erase block %d at 0x%08x, but used_size was already 0x%08x\n",
-                               ref_totlen(c, jeb, ref), blocknr, ref->flash_offset, jeb->used_size);
+                               freed_len, blocknr, ref->flash_offset, jeb->used_size);
                         BUG();
                 })
-                D1(printk(KERN_DEBUG "Obsoleting node at 0x%08x of len %#x: ", ref_offset(ref), ref_totlen(c, jeb, ref)));
-                jeb->used_size -= ref_totlen(c, jeb, ref);
-                c->used_size -= ref_totlen(c, jeb, ref);
+                D1(printk(KERN_DEBUG "Obsoleting node at 0x%08x of len %#x: ", ref_offset(ref), freed_len));
+                jeb->used_size -= freed_len;
+                c->used_size -= freed_len;
         }
 
         // Take care, that wasted size is taken into concern
-        if ((jeb->dirty_size || ISDIRTY(jeb->wasted_size + ref_totlen(c, jeb, ref))) && jeb != c->nextblock) {
-                D1(printk(KERN_DEBUG "Dirtying\n"));
-                addedsize = ref_totlen(c, jeb, ref);
-                jeb->dirty_size += ref_totlen(c, jeb, ref);
-                c->dirty_size += ref_totlen(c, jeb, ref);
+        if ((jeb->dirty_size || ISDIRTY(jeb->wasted_size + freed_len)) && jeb != c->nextblock) {
+                D1(printk("Dirtying\n"));
+                addedsize = freed_len;
+                jeb->dirty_size += freed_len;
+                c->dirty_size += freed_len;
 
                 /* Convert wasted space to dirty, if not a bad block */
                 if (jeb->wasted_size) {
@@ -543,10 +556,10 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
                         }
                 }
         } else {
-                D1(printk(KERN_DEBUG "Wasting\n"));
+                D1(printk("Wasting\n"));
                 addedsize = 0;
-                jeb->wasted_size += ref_totlen(c, jeb, ref);
-                c->wasted_size += ref_totlen(c, jeb, ref);
+                jeb->wasted_size += freed_len;
+                c->wasted_size += freed_len;
         }
         ref->flash_offset = ref_offset(ref) | REF_OBSOLETE;
 
@@ -622,7 +635,7 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
         /* The erase_free_sem is locked, and has been since before we marked the node obsolete
            and potentially put its eraseblock onto the erase_pending_list. Thus, we know that
            the block hasn't _already_ been erased, and that 'ref' itself hasn't been freed yet
-           by jffs2_free_all_node_refs() in erase.c. Which is nice. */
+           by jffs2_free_jeb_node_refs() in erase.c. Which is nice. */
 
         D1(printk(KERN_DEBUG "obliterating obsoleted node at 0x%08x\n", ref_offset(ref)));
         ret = jffs2_flash_read(c, ref_offset(ref), sizeof(n), &retlen, (char *)&n);
@@ -634,8 +647,8 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
                 printk(KERN_WARNING "Short read from obsoleted node at 0x%08x: %zd\n", ref_offset(ref), retlen);
                 goto out_erase_sem;
         }
-        if (PAD(je32_to_cpu(n.totlen)) != PAD(ref_totlen(c, jeb, ref))) {
-                printk(KERN_WARNING "Node totlen on flash (0x%08x) != totlen from node ref (0x%08x)\n", je32_to_cpu(n.totlen), ref_totlen(c, jeb, ref));
+        if (PAD(je32_to_cpu(n.totlen)) != PAD(freed_len)) {
+                printk(KERN_WARNING "Node totlen on flash (0x%08x) != totlen from node ref (0x%08x)\n", je32_to_cpu(n.totlen), freed_len);
                 goto out_erase_sem;
         }
         if (!(je16_to_cpu(n.nodetype) & JFFS2_NODE_ACCURATE)) {
@@ -671,6 +684,10 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
                 spin_lock(&c->erase_completion_lock);
 
                 ic = jffs2_raw_ref_to_ic(ref);
+                /* It seems we should never call jffs2_mark_node_obsolete() for
+                   XATTR nodes.... yet. Make sure we notice if/when we change
+                   that :) */
+                BUG_ON(ic->class != RAWNODE_CLASS_INODE_CACHE);
                 for (p = &ic->nodes; (*p) != ref; p = &((*p)->next_in_ino))
                         ;
 
@@ -683,51 +700,6 @@ void jffs2_mark_node_obsolete(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
                 spin_unlock(&c->erase_completion_lock);
         }
 
-
-        /* Merge with the next node in the physical list, if there is one
-           and if it's also obsolete and if it doesn't belong to any inode */
-        if (ref->next_phys && ref_obsolete(ref->next_phys) &&
-            !ref->next_phys->next_in_ino) {
-                struct jffs2_raw_node_ref *n = ref->next_phys;
-
-                spin_lock(&c->erase_completion_lock);
-
-                ref->__totlen += n->__totlen;
-                ref->next_phys = n->next_phys;
-                if (jeb->last_node == n) jeb->last_node = ref;
-                if (jeb->gc_node == n) {
-                        /* gc will be happy continuing gc on this node */
-                        jeb->gc_node=ref;
-                }
-                spin_unlock(&c->erase_completion_lock);
-
-                jffs2_free_raw_node_ref(n);
-        }
-
-        /* Also merge with the previous node in the list, if there is one
-           and that one is obsolete */
-        if (ref != jeb->first_node ) {
-                struct jffs2_raw_node_ref *p = jeb->first_node;
-
-                spin_lock(&c->erase_completion_lock);
-
-                while (p->next_phys != ref)
-                        p = p->next_phys;
-
-                if (ref_obsolete(p) && !ref->next_in_ino) {
-                        p->__totlen += ref->__totlen;
-                        if (jeb->last_node == ref) {
-                                jeb->last_node = p;
-                        }
-                        if (jeb->gc_node == ref) {
-                                /* gc will be happy continuing gc on this node */
-                                jeb->gc_node=p;
-                        }
-                        p->next_phys = ref->next_phys;
-                        jffs2_free_raw_node_ref(ref);
-                }
-                spin_unlock(&c->erase_completion_lock);
-        }
  out_erase_sem:
         up(&c->erase_free_sem);
 }
diff --git a/fs/jffs2/os-linux.h b/fs/jffs2/os-linux.h
index d307cf548625..cd4021bcb944 100644
--- a/fs/jffs2/os-linux.h
+++ b/fs/jffs2/os-linux.h
@@ -31,9 +31,7 @@ struct kvec;
 #define JFFS2_F_I_MODE(f) (OFNI_EDONI_2SFFJ(f)->i_mode)
 #define JFFS2_F_I_UID(f) (OFNI_EDONI_2SFFJ(f)->i_uid)
 #define JFFS2_F_I_GID(f) (OFNI_EDONI_2SFFJ(f)->i_gid)
-
-#define JFFS2_F_I_RDEV_MIN(f) (iminor(OFNI_EDONI_2SFFJ(f)))
-#define JFFS2_F_I_RDEV_MAJ(f) (imajor(OFNI_EDONI_2SFFJ(f)))
+#define JFFS2_F_I_RDEV(f) (OFNI_EDONI_2SFFJ(f)->i_rdev)
 
 #define ITIME(sec) ((struct timespec){sec, 0})
 #define I_SEC(tv) ((tv).tv_sec)
@@ -60,6 +58,10 @@ static inline void jffs2_init_inode_info(struct jffs2_inode_info *f)
         f->target = NULL;
         f->flags = 0;
         f->usercompr = 0;
+#ifdef CONFIG_JFFS2_FS_POSIX_ACL
+        f->i_acl_access = JFFS2_ACL_NOT_CACHED;
+        f->i_acl_default = JFFS2_ACL_NOT_CACHED;
+#endif
 }
 
 
@@ -90,13 +92,10 @@ static inline void jffs2_init_inode_info(struct jffs2_inode_info *f)
 #define jffs2_flash_writev(a,b,c,d,e,f) jffs2_flash_direct_writev(a,b,c,d,e)
 #define jffs2_wbuf_timeout NULL
 #define jffs2_wbuf_process NULL
-#define jffs2_nor_ecc(c) (0)
 #define jffs2_dataflash(c) (0)
-#define jffs2_nor_wbuf_flash(c) (0)
-#define jffs2_nor_ecc_flash_setup(c) (0)
-#define jffs2_nor_ecc_flash_cleanup(c) do {} while (0)
 #define jffs2_dataflash_setup(c) (0)
 #define jffs2_dataflash_cleanup(c) do {} while (0)
+#define jffs2_nor_wbuf_flash(c) (0)
 #define jffs2_nor_wbuf_flash_setup(c) (0)
 #define jffs2_nor_wbuf_flash_cleanup(c) do {} while (0)
 
@@ -107,9 +106,7 @@ static inline void jffs2_init_inode_info(struct jffs2_inode_info *f)
 #ifdef CONFIG_JFFS2_SUMMARY
 #define jffs2_can_mark_obsolete(c) (0)
 #else
-#define jffs2_can_mark_obsolete(c) \
-  ((c->mtd->type == MTD_NORFLASH && !(c->mtd->flags & (MTD_ECC|MTD_PROGRAM_REGIONS))) || \
-   c->mtd->type == MTD_RAM)
+#define jffs2_can_mark_obsolete(c) (c->mtd->flags & (MTD_BIT_WRITEABLE))
 #endif
 
 #define jffs2_cleanmarker_oob(c) (c->mtd->type == MTD_NANDFLASH)
@@ -133,15 +130,11 @@ int jffs2_flush_wbuf_pad(struct jffs2_sb_info *c);
 int jffs2_nand_flash_setup(struct jffs2_sb_info *c);
 void jffs2_nand_flash_cleanup(struct jffs2_sb_info *c);
 
-#define jffs2_nor_ecc(c) (c->mtd->type == MTD_NORFLASH && (c->mtd->flags & MTD_ECC))
-int jffs2_nor_ecc_flash_setup(struct jffs2_sb_info *c);
-void jffs2_nor_ecc_flash_cleanup(struct jffs2_sb_info *c);
-
 #define jffs2_dataflash(c) (c->mtd->type == MTD_DATAFLASH)
 int jffs2_dataflash_setup(struct jffs2_sb_info *c);
 void jffs2_dataflash_cleanup(struct jffs2_sb_info *c);
 
-#define jffs2_nor_wbuf_flash(c) (c->mtd->type == MTD_NORFLASH && (c->mtd->flags & MTD_PROGRAM_REGIONS))
+#define jffs2_nor_wbuf_flash(c) (c->mtd->type == MTD_NORFLASH && ! (c->mtd->flags & MTD_BIT_WRITEABLE))
 int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c);
 void jffs2_nor_wbuf_flash_cleanup(struct jffs2_sb_info *c);
 
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index f1695642d0f7..5fec012b02ed 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -66,7 +66,7 @@ static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
                         jffs2_free_full_dnode(tn->fn);
                         jffs2_free_tmp_dnode_info(tn);
 
-                        this = this->rb_parent;
+                        this = rb_parent(this);
                         if (!this)
                                 break;
 
@@ -116,19 +116,42 @@ static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_r
                                 uint32_t *latest_mctime, uint32_t *mctime_ver)
 {
         struct jffs2_full_dirent *fd;
+        uint32_t crc;
 
-        /* The direntry nodes are checked during the flash scanning */
-        BUG_ON(ref_flags(ref) == REF_UNCHECKED);
         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
         BUG_ON(ref_obsolete(ref));
 
-        /* Sanity check */
-        if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
-                JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
-                       ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
+        crc = crc32(0, rd, sizeof(*rd) - 8);
+        if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
+                JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
+                             ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
                 return 1;
         }
 
+        /* If we've never checked the CRCs on this node, check them now */
+        if (ref_flags(ref) == REF_UNCHECKED) {
+                struct jffs2_eraseblock *jeb;
+                int len;
+
+                /* Sanity check */
+                if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
+                        JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
+                                    ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
+                        return 1;
+                }
+
+                jeb = &c->blocks[ref->flash_offset / c->sector_size];
+                len = ref_totlen(c, jeb, ref);
+
+                spin_lock(&c->erase_completion_lock);
+                jeb->used_size += len;
+                jeb->unchecked_size -= len;
+                c->used_size += len;
+                c->unchecked_size -= len;
+                ref->flash_offset = ref_offset(ref) | REF_PRISTINE;
+                spin_unlock(&c->erase_completion_lock);
+        }
+
         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
         if (unlikely(!fd))
                 return -ENOMEM;
@@ -198,13 +221,21 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
         struct jffs2_tmp_dnode_info *tn;
         uint32_t len, csize;
         int ret = 1;
+        uint32_t crc;
 
         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
         BUG_ON(ref_obsolete(ref));
 
+        crc = crc32(0, rd, sizeof(*rd) - 8);
+        if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
+                JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
+                             ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
+                return 1;
+        }
+
         tn = jffs2_alloc_tmp_dnode_info();
         if (!tn) {
-                JFFS2_ERROR("failed to allocate tn (%d bytes).\n", sizeof(*tn));
+                JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
                 return -ENOMEM;
         }
 
@@ -213,14 +244,6 @@ static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref
 
         /* If we've never checked the CRCs on this node, check them now */
         if (ref_flags(ref) == REF_UNCHECKED) {
-                uint32_t crc;
-
-                crc = crc32(0, rd, sizeof(*rd) - 8);
-                if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
-                        JFFS2_NOTICE("header CRC failed on node at %#08x: read %#08x, calculated %#08x\n",
-                                        ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
-                        goto free_out;
-                }
 
                 /* Sanity checks */
                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
@@ -343,7 +366,7 @@ free_out:
  * Helper function for jffs2_get_inode_nodes().
  * It is called every time an unknown node is found.
  *
- * Returns: 0 on succes;
+ * Returns: 0 on success;
  *          1 if the node should be marked obsolete;
  *          negative error code on failure.
  */
@@ -354,37 +377,30 @@ static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_re
 
         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 
-        if (crc32(0, un, sizeof(struct jffs2_unknown_node) - 4) != je32_to_cpu(un->hdr_crc)) {
-                /* Hmmm. This should have been caught at scan time. */
-                JFFS2_NOTICE("node header CRC failed at %#08x. But it must have been OK earlier.\n", ref_offset(ref));
-                jffs2_dbg_dump_node(c, ref_offset(ref));
-                return 1;
-        } else {
-                switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
+        switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 
-                case JFFS2_FEATURE_INCOMPAT:
-                        JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
-                                je16_to_cpu(un->nodetype), ref_offset(ref));
-                        /* EEP */
-                        BUG();
-                        break;
+        case JFFS2_FEATURE_INCOMPAT:
+                JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
+                            je16_to_cpu(un->nodetype), ref_offset(ref));
+                /* EEP */
+                BUG();
+                break;
 
-                case JFFS2_FEATURE_ROCOMPAT:
-                        JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
-                                        je16_to_cpu(un->nodetype), ref_offset(ref));
-                        BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
-                        break;
+        case JFFS2_FEATURE_ROCOMPAT:
+                JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
+                            je16_to_cpu(un->nodetype), ref_offset(ref));
+                BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
+                break;
 
-                case JFFS2_FEATURE_RWCOMPAT_COPY:
-                        JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
-                                        je16_to_cpu(un->nodetype), ref_offset(ref));
-                        break;
+        case JFFS2_FEATURE_RWCOMPAT_COPY:
+                JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
+                             je16_to_cpu(un->nodetype), ref_offset(ref));
+                break;
 
-                case JFFS2_FEATURE_RWCOMPAT_DELETE:
-                        JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
-                                        je16_to_cpu(un->nodetype), ref_offset(ref));
-                        return 1;
-                }
+        case JFFS2_FEATURE_RWCOMPAT_DELETE:
+                JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
+                             je16_to_cpu(un->nodetype), ref_offset(ref));
+                return 1;
         }
 
         return 0;
@@ -434,7 +450,7 @@ static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
         }
 
         if (retlen < len) {
-                JFFS2_ERROR("short read at %#08x: %d instead of %d.\n",
+                JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
                                 offs, retlen, len);
                 return -EIO;
         }
@@ -542,13 +558,25 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                 }
 
                 if (retlen < len) {
-                        JFFS2_ERROR("short read at %#08x: %d instead of %d.\n", ref_offset(ref), retlen, len);
+                        JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
                         err = -EIO;
                         goto free_out;
                 }
 
                 node = (union jffs2_node_union *)bufstart;
 
+                /* No need to mask in the valid bit; it shouldn't be invalid */
+                if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
+                        JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
+                                     ref_offset(ref), je16_to_cpu(node->u.magic),
+                                     je16_to_cpu(node->u.nodetype),
+                                     je32_to_cpu(node->u.totlen),
+                                     je32_to_cpu(node->u.hdr_crc));
+                        jffs2_dbg_dump_node(c, ref_offset(ref));
+                        jffs2_mark_node_obsolete(c, ref);
+                        goto cont;
+                }
+
                 switch (je16_to_cpu(node->u.nodetype)) {
 
                 case JFFS2_NODETYPE_DIRENT:
@@ -606,6 +634,7 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                                 goto free_out;
 
                 }
+        cont:
                 spin_lock(&c->erase_completion_lock);
         }
 
@@ -679,12 +708,12 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
                         jffs2_mark_node_obsolete(c, fn->raw);
 
                 BUG_ON(rb->rb_left);
-                if (rb->rb_parent && rb->rb_parent->rb_left == rb) {
+                if (rb_parent(rb) && rb_parent(rb)->rb_left == rb) {
                         /* We were then left-hand child of our parent. We need
                          * to move our own right-hand child into our place. */
                         repl_rb = rb->rb_right;
                         if (repl_rb)
-                                repl_rb->rb_parent = rb->rb_parent;
+                                rb_set_parent(repl_rb, rb_parent(rb));
                 } else
                         repl_rb = NULL;
 
@@ -692,14 +721,14 @@ static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
 
                 /* Remove the spent tn from the tree; don't bother rebalancing
                  * but put our right-hand child in our own place. */
-                if (tn->rb.rb_parent) {
-                        if (tn->rb.rb_parent->rb_left == &tn->rb)
-                                tn->rb.rb_parent->rb_left = repl_rb;
-                        else if (tn->rb.rb_parent->rb_right == &tn->rb)
-                                tn->rb.rb_parent->rb_right = repl_rb;
+                if (rb_parent(&tn->rb)) {
+                        if (rb_parent(&tn->rb)->rb_left == &tn->rb)
+                                rb_parent(&tn->rb)->rb_left = repl_rb;
+                        else if (rb_parent(&tn->rb)->rb_right == &tn->rb)
+                                rb_parent(&tn->rb)->rb_right = repl_rb;
                         else BUG();
                 } else if (tn->rb.rb_right)
-                        tn->rb.rb_right->rb_parent = NULL;
+                        rb_set_parent(tn->rb.rb_right, NULL);
 
                 jffs2_free_tmp_dnode_info(tn);
                 if (ret) {
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
index cf55b221fc2b..61618080b86f 100644
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -65,6 +65,28 @@ static inline uint32_t EMPTY_SCAN_SIZE(uint32_t sector_size) {
                 return DEFAULT_EMPTY_SCAN_SIZE;
 }
 
+static int file_dirty(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
+{
+        int ret;
+
+        if ((ret = jffs2_prealloc_raw_node_refs(c, jeb, 1)))
+                return ret;
+        if ((ret = jffs2_scan_dirty_space(c, jeb, jeb->free_size)))
+                return ret;
+        /* Turned wasted size into dirty, since we apparently 
+           think it's recoverable now. */
+        jeb->dirty_size += jeb->wasted_size;
+        c->dirty_size += jeb->wasted_size;
+        c->wasted_size -= jeb->wasted_size;
+        jeb->wasted_size = 0;
+        if (VERYDIRTY(c, jeb->dirty_size)) {
+                list_add(&jeb->list, &c->very_dirty_list);
+        } else {
+                list_add(&jeb->list, &c->dirty_list);
+        }
+        return 0;
+}
+
 int jffs2_scan_medium(struct jffs2_sb_info *c)
 {
         int i, ret;
@@ -170,34 +192,20 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
                                         (!c->nextblock || c->nextblock->free_size < jeb->free_size)) {
                                 /* Better candidate for the next writes to go to */
                                 if (c->nextblock) {
-                                        c->nextblock->dirty_size += c->nextblock->free_size + c->nextblock->wasted_size;
-                                        c->dirty_size += c->nextblock->free_size + c->nextblock->wasted_size;
-                                        c->free_size -= c->nextblock->free_size;
-                                        c->wasted_size -= c->nextblock->wasted_size;
-                                        c->nextblock->free_size = c->nextblock->wasted_size = 0;
-                                        if (VERYDIRTY(c, c->nextblock->dirty_size)) {
-                                                list_add(&c->nextblock->list, &c->very_dirty_list);
-                                        } else {
-                                                list_add(&c->nextblock->list, &c->dirty_list);
-                                        }
+                                        ret = file_dirty(c, c->nextblock);
+                                        if (ret)
+                                                return ret;
                                         /* deleting summary information of the old nextblock */
                                         jffs2_sum_reset_collected(c->summary);
                                 }
-                                /* update collected summary infromation for the current nextblock */
+                                /* update collected summary information for the current nextblock */
                                 jffs2_sum_move_collected(c, s);
                                 D1(printk(KERN_DEBUG "jffs2_scan_medium(): new nextblock = 0x%08x\n", jeb->offset));
                                 c->nextblock = jeb;
                         } else {
-                                jeb->dirty_size += jeb->free_size + jeb->wasted_size;
-                                c->dirty_size += jeb->free_size + jeb->wasted_size;
-                                c->free_size -= jeb->free_size;
-                                c->wasted_size -= jeb->wasted_size;
-                                jeb->free_size = jeb->wasted_size = 0;
-                                if (VERYDIRTY(c, jeb->dirty_size)) {
-                                        list_add(&jeb->list, &c->very_dirty_list);
-                                } else {
-                                        list_add(&jeb->list, &c->dirty_list);
-                                }
+                                ret = file_dirty(c, jeb);
+                                if (ret)
+                                        return ret;
                         }
                         break;
 
@@ -222,9 +230,6 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
                 }
         }
 
-        if (jffs2_sum_active() && s)
-                kfree(s);
-
         /* Nextblock dirty is always seen as wasted, because we cannot recycle it now */
         if (c->nextblock && (c->nextblock->dirty_size)) {
                 c->nextblock->wasted_size += c->nextblock->dirty_size;
@@ -242,11 +247,8 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
 
                 D1(printk(KERN_DEBUG "jffs2_scan_medium(): Skipping %d bytes in nextblock to ensure page alignment\n",
                           skip));
-                c->nextblock->wasted_size += skip;
-                c->wasted_size += skip;
-
-                c->nextblock->free_size -= skip;
-                c->free_size -= skip;
+                jffs2_prealloc_raw_node_refs(c, c->nextblock, 1);
+                jffs2_scan_dirty_space(c, c->nextblock, skip);
         }
 #endif
         if (c->nr_erasing_blocks) {
@@ -266,6 +268,9 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
         else
                 c->mtd->unpoint(c->mtd, flashbuf, 0, c->mtd->size);
 #endif
+        if (s)
+                kfree(s);
+
         return ret;
 }
 
@@ -290,7 +295,7 @@ int jffs2_fill_scan_buf (struct jffs2_sb_info *c, void *buf,
 int jffs2_scan_classify_jeb(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
 {
         if ((jeb->used_size + jeb->unchecked_size) == PAD(c->cleanmarker_size) && !jeb->dirty_size
-                && (!jeb->first_node || !jeb->first_node->next_phys) )
+            && (!jeb->first_node || !ref_next(jeb->first_node)) )
                 return BLK_STATE_CLEANMARKER;
 
         /* move blocks with max 4 byte dirty space to cleanlist */
@@ -306,11 +311,119 @@ int jffs2_scan_classify_jeb(struct jffs2_sb_info *c, struct jffs2_eraseblock *je
                 return BLK_STATE_ALLDIRTY;
 }
 
+#ifdef CONFIG_JFFS2_FS_XATTR
+static int jffs2_scan_xattr_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
+                                 struct jffs2_raw_xattr *rx, uint32_t ofs,
+                                 struct jffs2_summary *s)
+{
+        struct jffs2_xattr_datum *xd;
+        uint32_t totlen, crc;
+        int err;
+
+        crc = crc32(0, rx, sizeof(struct jffs2_raw_xattr) - 4);
+        if (crc != je32_to_cpu(rx->node_crc)) {
+                if (je32_to_cpu(rx->node_crc) != 0xffffffff)
+                        JFFS2_WARNING("node CRC failed at %#08x, read=%#08x, calc=%#08x\n",
+                                      ofs, je32_to_cpu(rx->node_crc), crc);
+                if ((err = jffs2_scan_dirty_space(c, jeb, je32_to_cpu(rx->totlen))))
+                        return err;
+                return 0;
+        }
+
+        totlen = PAD(sizeof(*rx) + rx->name_len + 1 + je16_to_cpu(rx->value_len));
+        if (totlen != je32_to_cpu(rx->totlen)) {
+                JFFS2_WARNING("node length mismatch at %#08x, read=%u, calc=%u\n",
+                              ofs, je32_to_cpu(rx->totlen), totlen);
+                if ((err = jffs2_scan_dirty_space(c, jeb, je32_to_cpu(rx->totlen))))
+                        return err;
+                return 0;
+        }
+
+        xd = jffs2_setup_xattr_datum(c, je32_to_cpu(rx->xid), je32_to_cpu(rx->version));
+        if (IS_ERR(xd)) {
+                if (PTR_ERR(xd) == -EEXIST) {
+                        if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(rx->totlen)))))
+                                return err;
+                        return 0;
+                }
+                return PTR_ERR(xd);
+        }
+        xd->xprefix = rx->xprefix;
+        xd->name_len = rx->name_len;
+        xd->value_len = je16_to_cpu(rx->value_len);
+        xd->data_crc = je32_to_cpu(rx->data_crc);
+
+        xd->node = jffs2_link_node_ref(c, jeb, ofs | REF_PRISTINE, totlen, NULL);
+        /* FIXME */ xd->node->next_in_ino = (void *)xd;
+
+        if (jffs2_sum_active())
+                jffs2_sum_add_xattr_mem(s, rx, ofs - jeb->offset);
+        dbg_xattr("scaning xdatum at %#08x (xid=%u, version=%u)\n",
+                  ofs, xd->xid, xd->version);
+        return 0;
+}
+
+static int jffs2_scan_xref_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
+                                struct jffs2_raw_xref *rr, uint32_t ofs,
+                                struct jffs2_summary *s)
+{
+        struct jffs2_xattr_ref *ref;
+        uint32_t crc;
+        int err;
+
+        crc = crc32(0, rr, sizeof(*rr) - 4);
+        if (crc != je32_to_cpu(rr->node_crc)) {
+                if (je32_to_cpu(rr->node_crc) != 0xffffffff)
+                        JFFS2_WARNING("node CRC failed at %#08x, read=%#08x, calc=%#08x\n",
+                                      ofs, je32_to_cpu(rr->node_crc), crc);
+                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(rr->totlen)))))
+                        return err;
+                return 0;
+        }
+
+        if (PAD(sizeof(struct jffs2_raw_xref)) != je32_to_cpu(rr->totlen)) {
+                JFFS2_WARNING("node length mismatch at %#08x, read=%u, calc=%zd\n",
+                              ofs, je32_to_cpu(rr->totlen),
+                              PAD(sizeof(struct jffs2_raw_xref)));
+                if ((err = jffs2_scan_dirty_space(c, jeb, je32_to_cpu(rr->totlen))))
+                        return err;
+                return 0;
+        }
+
+        ref = jffs2_alloc_xattr_ref();
+        if (!ref)
+                return -ENOMEM;
+
+        /* BEFORE jffs2_build_xattr_subsystem() called, 
+         * ref->xid is used to store 32bit xid, xd is not used
+         * ref->ino is used to store 32bit inode-number, ic is not used
+         * Thoes variables are declared as union, thus using those
+         * are exclusive. In a similar way, ref->next is temporarily
+         * used to chain all xattr_ref object. It's re-chained to
+         * jffs2_inode_cache in jffs2_build_xattr_subsystem() correctly.
+         */
+        ref->ino = je32_to_cpu(rr->ino);
+        ref->xid = je32_to_cpu(rr->xid);
+        ref->next = c->xref_temp;
+        c->xref_temp = ref;
+
+        ref->node = jffs2_link_node_ref(c, jeb, ofs | REF_PRISTINE, PAD(je32_to_cpu(rr->totlen)), NULL);
+        /* FIXME */ ref->node->next_in_ino = (void *)ref;
+
+        if (jffs2_sum_active())
+                jffs2_sum_add_xref_mem(s, rr, ofs - jeb->offset);
+        dbg_xattr("scan xref at %#08x (xid=%u, ino=%u)\n",
+                  ofs, ref->xid, ref->ino);
+        return 0;
+}
+#endif
+
+/* Called with 'buf_size == 0' if buf is in fact a pointer _directly_ into
+   the flash, XIP-style */
 static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
-                                unsigned char *buf, uint32_t buf_size, struct jffs2_summary *s) {
+                                  unsigned char *buf, uint32_t buf_size, struct jffs2_summary *s) {
         struct jffs2_unknown_node *node;
         struct jffs2_unknown_node crcnode;
-        struct jffs2_sum_marker *sm;
         uint32_t ofs, prevofs;
         uint32_t hdr_crc, buf_ofs, buf_len;
         int err;
@@ -344,44 +457,75 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
 #endif
 
         if (jffs2_sum_active()) {
-                sm = kmalloc(sizeof(struct jffs2_sum_marker), GFP_KERNEL);
-                if (!sm) {
-                        return -ENOMEM;
-                }
-
-                err = jffs2_fill_scan_buf(c, (unsigned char *) sm, jeb->offset + c->sector_size -
-                                        sizeof(struct jffs2_sum_marker), sizeof(struct jffs2_sum_marker));
-                if (err) {
-                        kfree(sm);
-                        return err;
-                }
-
-                if (je32_to_cpu(sm->magic) == JFFS2_SUM_MAGIC ) {
-                        err = jffs2_sum_scan_sumnode(c, jeb, je32_to_cpu(sm->offset), &pseudo_random);
-                        if (err) {
-                                kfree(sm);
+                struct jffs2_sum_marker *sm;
+                void *sumptr = NULL;
+                uint32_t sumlen;
+              
+                if (!buf_size) {
+                        /* XIP case. Just look, point at the summary if it's there */
+                        sm = (void *)buf + c->sector_size - sizeof(*sm);
+                        if (je32_to_cpu(sm->magic) == JFFS2_SUM_MAGIC) {
+                                sumptr = buf + je32_to_cpu(sm->offset);
+                                sumlen = c->sector_size - je32_to_cpu(sm->offset);
+                        }
+                } else {
+                        /* If NAND flash, read a whole page of it. Else just the end */
+                        if (c->wbuf_pagesize)
+                                buf_len = c->wbuf_pagesize;
+                        else
+                                buf_len = sizeof(*sm);
+
+                        /* Read as much as we want into the _end_ of the preallocated buffer */
+                        err = jffs2_fill_scan_buf(c, buf + buf_size - buf_len, 
+                                                  jeb->offset + c->sector_size - buf_len,
+                                                  buf_len);                             
+                        if (err)
                                 return err;
+
+                        sm = (void *)buf + buf_size - sizeof(*sm);
+                        if (je32_to_cpu(sm->magic) == JFFS2_SUM_MAGIC) {
+                                sumlen = c->sector_size - je32_to_cpu(sm->offset);
+                                sumptr = buf + buf_size - sumlen;
+
+                                /* Now, make sure the summary itself is available */
+                                if (sumlen > buf_size) {
+                                        /* Need to kmalloc for this. */
+                                        sumptr = kmalloc(sumlen, GFP_KERNEL);
+                                        if (!sumptr)
+                                                return -ENOMEM;
+                                        memcpy(sumptr + sumlen - buf_len, buf + buf_size - buf_len, buf_len);
+                                }
+                                if (buf_len < sumlen) {
+                                        /* Need to read more so that the entire summary node is present */
+                                        err = jffs2_fill_scan_buf(c, sumptr, 
+                                                                  jeb->offset + c->sector_size - sumlen,
+                                                                  sumlen - buf_len);                            
+                                        if (err)
+                                                return err;
+                                }
                         }
+
                 }
 
-                kfree(sm);
+                if (sumptr) {
+                        err = jffs2_sum_scan_sumnode(c, jeb, sumptr, sumlen, &pseudo_random);
 
-                ofs = jeb->offset;
-                prevofs = jeb->offset - 1;
+                        if (buf_size && sumlen > buf_size)
+                                kfree(sumptr);
+                        /* If it returns with a real error, bail. 
+                           If it returns positive, that's a block classification
+                           (i.e. BLK_STATE_xxx) so return that too.
+                           If it returns zero, fall through to full scan. */
+                        if (err)
+                                return err;
+                }
         }
 
         buf_ofs = jeb->offset;
 
         if (!buf_size) {
+                /* This is the XIP case -- we're reading _directly_ from the flash chip */
                 buf_len = c->sector_size;
-
-                if (jffs2_sum_active()) {
-                        /* must reread because of summary test */
-                        err = jffs2_fill_scan_buf(c, buf, buf_ofs, buf_len);
-                        if (err)
-                                return err;
-                }
-
         } else {
                 buf_len = EMPTY_SCAN_SIZE(c->sector_size);
                 err = jffs2_fill_scan_buf(c, buf, buf_ofs, buf_len);
@@ -418,7 +562,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
         if (ofs) {
                 D1(printk(KERN_DEBUG "Free space at %08x ends at %08x\n", jeb->offset,
                           jeb->offset + ofs));
-                DIRTY_SPACE(ofs);
+                if ((err = jffs2_prealloc_raw_node_refs(c, jeb, 1)))
+                        return err;
+                if ((err = jffs2_scan_dirty_space(c, jeb, ofs)))
+                        return err;
         }
 
         /* Now ofs is a complete physical flash offset as it always was... */
@@ -433,6 +580,11 @@ scan_more:
 
                 jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 
+                /* Make sure there are node refs available for use */
+                err = jffs2_prealloc_raw_node_refs(c, jeb, 2);
+                if (err)
+                        return err;
+
                 cond_resched();
 
                 if (ofs & 3) {
@@ -442,7 +594,8 @@ scan_more:
                 }
                 if (ofs == prevofs) {
                         printk(KERN_WARNING "ofs 0x%08x has already been seen. Skipping\n", ofs);
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
@@ -451,7 +604,8 @@ scan_more:
                 if (jeb->offset + c->sector_size < ofs + sizeof(*node)) {
                         D1(printk(KERN_DEBUG "Fewer than %zd bytes left to end of block. (%x+%x<%x+%zx) Not reading\n", sizeof(struct jffs2_unknown_node),
                                   jeb->offset, c->sector_size, ofs, sizeof(*node)));
-                        DIRTY_SPACE((jeb->offset + c->sector_size)-ofs);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, (jeb->offset + c->sector_size)-ofs)))
+                                return err;
                         break;
                 }
 
@@ -481,7 +635,8 @@ scan_more:
                                 if (*(uint32_t *)(&buf[inbuf_ofs]) != 0xffffffff) {
                                         printk(KERN_WARNING "Empty flash at 0x%08x ends at 0x%08x\n",
                                                empty_start, ofs);
-                                        DIRTY_SPACE(ofs-empty_start);
+                                        if ((err = jffs2_scan_dirty_space(c, jeb, ofs-empty_start)))
+                                                return err;
                                         goto scan_more;
                                 }
 
@@ -494,7 +649,7 @@ scan_more:
                         /* If we're only checking the beginning of a block with a cleanmarker,
                            bail now */
                         if (buf_ofs == jeb->offset && jeb->used_size == PAD(c->cleanmarker_size) &&
-                            c->cleanmarker_size && !jeb->dirty_size && !jeb->first_node->next_phys) {
+                            c->cleanmarker_size && !jeb->dirty_size && !ref_next(jeb->first_node)) {
                                 D1(printk(KERN_DEBUG "%d bytes at start of block seems clean... assuming all clean\n", EMPTY_SCAN_SIZE(c->sector_size)));
                                 return BLK_STATE_CLEANMARKER;
                         }
@@ -518,20 +673,23 @@ scan_more:
 
                 if (ofs == jeb->offset && je16_to_cpu(node->magic) == KSAMTIB_CIGAM_2SFFJ) {
                         printk(KERN_WARNING "Magic bitmask is backwards at offset 0x%08x. Wrong endian filesystem?\n", ofs);
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
                 if (je16_to_cpu(node->magic) == JFFS2_DIRTY_BITMASK) {
                         D1(printk(KERN_DEBUG "Dirty bitmask at 0x%08x\n", ofs));
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
                 if (je16_to_cpu(node->magic) == JFFS2_OLD_MAGIC_BITMASK) {
                         printk(KERN_WARNING "Old JFFS2 bitmask found at 0x%08x\n", ofs);
                         printk(KERN_WARNING "You cannot use older JFFS2 filesystems with newer kernels\n");
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
@@ -540,7 +698,8 @@ scan_more:
                         noisy_printk(&noise, "jffs2_scan_eraseblock(): Magic bitmask 0x%04x not found at 0x%08x: 0x%04x instead\n",
                                      JFFS2_MAGIC_BITMASK, ofs,
                                      je16_to_cpu(node->magic));
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
@@ -557,7 +716,8 @@ scan_more:
                                      je32_to_cpu(node->totlen),
                                      je32_to_cpu(node->hdr_crc),
                                      hdr_crc);
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
@@ -568,7 +728,8 @@ scan_more:
                         printk(KERN_WARNING "Node at 0x%08x with length 0x%08x would run over the end of the erase block\n",
                                ofs, je32_to_cpu(node->totlen));
                         printk(KERN_WARNING "Perhaps the file system was created with the wrong erase size?\n");
-                        DIRTY_SPACE(4);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
                         ofs += 4;
                         continue;
                 }
@@ -576,7 +737,8 @@ scan_more:
                 if (!(je16_to_cpu(node->nodetype) & JFFS2_NODE_ACCURATE)) {
                         /* Wheee. This is an obsoleted node */
                         D2(printk(KERN_DEBUG "Node at 0x%08x is obsolete. Skipping\n", ofs));
-                        DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
+                        if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(node->totlen)))))
+                                return err;
                         ofs += PAD(je32_to_cpu(node->totlen));
                         continue;
                 }
@@ -614,30 +776,59 @@ scan_more:
                         ofs += PAD(je32_to_cpu(node->totlen));
                         break;
 
+#ifdef CONFIG_JFFS2_FS_XATTR
+                case JFFS2_NODETYPE_XATTR:
+                        if (buf_ofs + buf_len < ofs + je32_to_cpu(node->totlen)) {
+                                buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
+                                D1(printk(KERN_DEBUG "Fewer than %d bytes (xattr node)"
+                                          " left to end of buf. Reading 0x%x at 0x%08x\n",
+                                          je32_to_cpu(node->totlen), buf_len, ofs));
+                                err = jffs2_fill_scan_buf(c, buf, ofs, buf_len);
+                                if (err)
+                                        return err;
+                                buf_ofs = ofs;
+                                node = (void *)buf;
+                        }
+                        err = jffs2_scan_xattr_node(c, jeb, (void *)node, ofs, s);
+                        if (err)
+                                return err;
+                        ofs += PAD(je32_to_cpu(node->totlen));
+                        break;
+                case JFFS2_NODETYPE_XREF:
+                        if (buf_ofs + buf_len < ofs + je32_to_cpu(node->totlen)) {
+                                buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
+                                D1(printk(KERN_DEBUG "Fewer than %d bytes (xref node)"
+                                          " left to end of buf. Reading 0x%x at 0x%08x\n",
+                                          je32_to_cpu(node->totlen), buf_len, ofs));
+                                err = jffs2_fill_scan_buf(c, buf, ofs, buf_len);
+                                if (err)
+                                        return err;
+                                buf_ofs = ofs;
+                                node = (void *)buf;
+                        }
+                        err = jffs2_scan_xref_node(c, jeb, (void *)node, ofs, s);
+                        if (err)
+                                return err;
+                        ofs += PAD(je32_to_cpu(node->totlen));
+                        break;
+#endif  /* CONFIG_JFFS2_FS_XATTR */
+
                 case JFFS2_NODETYPE_CLEANMARKER:
                         D1(printk(KERN_DEBUG "CLEANMARKER node found at 0x%08x\n", ofs));
                         if (je32_to_cpu(node->totlen) != c->cleanmarker_size) {
                                 printk(KERN_NOTICE "CLEANMARKER node found at 0x%08x has totlen 0x%x != normal 0x%x\n",
                                        ofs, je32_to_cpu(node->totlen), c->cleanmarker_size);
-                                DIRTY_SPACE(PAD(sizeof(struct jffs2_unknown_node)));
+                                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(sizeof(struct jffs2_unknown_node)))))
+                                        return err;
                                 ofs += PAD(sizeof(struct jffs2_unknown_node));
                         } else if (jeb->first_node) {
                                 printk(KERN_NOTICE "CLEANMARKER node found at 0x%08x, not first node in block (0x%08x)\n", ofs, jeb->offset);
-                                DIRTY_SPACE(PAD(sizeof(struct jffs2_unknown_node)));
+                                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(sizeof(struct jffs2_unknown_node)))))
+                                        return err;
                                 ofs += PAD(sizeof(struct jffs2_unknown_node));
                         } else {
-                                struct jffs2_raw_node_ref *marker_ref = jffs2_alloc_raw_node_ref();
-                                if (!marker_ref) {
-                                        printk(KERN_NOTICE "Failed to allocate node ref for clean marker\n");
-                                        return -ENOMEM;
-                                }
-                                marker_ref->next_in_ino = NULL;
-                                marker_ref->next_phys = NULL;
-                                marker_ref->flash_offset = ofs | REF_NORMAL;
-                                marker_ref->__totlen = c->cleanmarker_size;
-                                jeb->first_node = jeb->last_node = marker_ref;
+                                jffs2_link_node_ref(c, jeb, ofs | REF_NORMAL, c->cleanmarker_size, NULL);
 
-                                USED_SPACE(PAD(c->cleanmarker_size));
                                 ofs += PAD(c->cleanmarker_size);
                         }
                         break;
@@ -645,7 +836,8 @@ scan_more:
                 case JFFS2_NODETYPE_PADDING:
                         if (jffs2_sum_active())
                                 jffs2_sum_add_padding_mem(s, je32_to_cpu(node->totlen));
-                        DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
+                        if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(node->totlen)))))
+                                return err;
                         ofs += PAD(je32_to_cpu(node->totlen));
                         break;
 
@@ -656,7 +848,8 @@ scan_more:
                                 c->flags |= JFFS2_SB_FLAG_RO;
                                 if (!(jffs2_is_readonly(c)))
                                         return -EROFS;
-                                DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
+                                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(node->totlen)))))
+                                        return err;
                                 ofs += PAD(je32_to_cpu(node->totlen));
                                 break;
 
@@ -666,15 +859,21 @@ scan_more:
 
                         case JFFS2_FEATURE_RWCOMPAT_DELETE:
                                 D1(printk(KERN_NOTICE "Unknown but compatible feature node (0x%04x) found at offset 0x%08x\n", je16_to_cpu(node->nodetype), ofs));
-                                DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
+                                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(node->totlen)))))
+                                        return err;
                                 ofs += PAD(je32_to_cpu(node->totlen));
                                 break;
 
-                        case JFFS2_FEATURE_RWCOMPAT_COPY:
+                        case JFFS2_FEATURE_RWCOMPAT_COPY: {
                                 D1(printk(KERN_NOTICE "Unknown but compatible feature node (0x%04x) found at offset 0x%08x\n", je16_to_cpu(node->nodetype), ofs));
-                                USED_SPACE(PAD(je32_to_cpu(node->totlen)));
+
+                                jffs2_link_node_ref(c, jeb, ofs | REF_PRISTINE, PAD(je32_to_cpu(node->totlen)), NULL);
+
+                                /* We can't summarise nodes we don't grok */
+                                jffs2_sum_disable_collecting(s);
                                 ofs += PAD(je32_to_cpu(node->totlen));
                                 break;
+                                }
                         }
                 }
         }
@@ -687,9 +886,9 @@ scan_more:
                 }
         }
 
-        D1(printk(KERN_DEBUG "Block at 0x%08x: free 0x%08x, dirty 0x%08x, unchecked 0x%08x, used 0x%08x\n", jeb->offset,
-                  jeb->free_size, jeb->dirty_size, jeb->unchecked_size, jeb->used_size));
-
+        D1(printk(KERN_DEBUG "Block at 0x%08x: free 0x%08x, dirty 0x%08x, unchecked 0x%08x, used 0x%08x, wasted 0x%08x\n",
+                  jeb->offset,jeb->free_size, jeb->dirty_size, jeb->unchecked_size, jeb->used_size, jeb->wasted_size));
+        
         /* mark_node_obsolete can add to wasted !! */
         if (jeb->wasted_size) {
                 jeb->dirty_size += jeb->wasted_size;
@@ -730,9 +929,9 @@ struct jffs2_inode_cache *jffs2_scan_make_ino_cache(struct jffs2_sb_info *c, uin
 static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
                                  struct jffs2_raw_inode *ri, uint32_t ofs, struct jffs2_summary *s)
 {
-        struct jffs2_raw_node_ref *raw;
         struct jffs2_inode_cache *ic;
         uint32_t ino = je32_to_cpu(ri->ino);
+        int err;
 
         D1(printk(KERN_DEBUG "jffs2_scan_inode_node(): Node at 0x%08x\n", ofs));
 
@@ -745,12 +944,6 @@ static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_erasebloc
            Which means that the _full_ amount of time to get to proper write mode with GC
            operational may actually be _longer_ than before. Sucks to be me. */
 
-        raw = jffs2_alloc_raw_node_ref();
-        if (!raw) {
-                printk(KERN_NOTICE "jffs2_scan_inode_node(): allocation of node reference failed\n");
-                return -ENOMEM;
-        }
-
         ic = jffs2_get_ino_cache(c, ino);
         if (!ic) {
                 /* Inocache get failed. Either we read a bogus ino# or it's just genuinely the
@@ -762,30 +955,17 @@ static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_erasebloc
                         printk(KERN_NOTICE "jffs2_scan_inode_node(): CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
                                ofs, je32_to_cpu(ri->node_crc), crc);
                         /* We believe totlen because the CRC on the node _header_ was OK, just the node itself failed. */
-                        DIRTY_SPACE(PAD(je32_to_cpu(ri->totlen)));
-                        jffs2_free_raw_node_ref(raw);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(ri->totlen)))))
+                                return err;
                         return 0;
                 }
                 ic = jffs2_scan_make_ino_cache(c, ino);
-                if (!ic) {
-                        jffs2_free_raw_node_ref(raw);
+                if (!ic)
                         return -ENOMEM;
-                }
         }
 
         /* Wheee. It worked */
-
-        raw->flash_offset = ofs | REF_UNCHECKED;
-        raw->__totlen = PAD(je32_to_cpu(ri->totlen));
-        raw->next_phys = NULL;
-        raw->next_in_ino = ic->nodes;
-
-        ic->nodes = raw;
-        if (!jeb->first_node)
-                jeb->first_node = raw;
-        if (jeb->last_node)
-                jeb->last_node->next_phys = raw;
-        jeb->last_node = raw;
+        jffs2_link_node_ref(c, jeb, ofs | REF_UNCHECKED, PAD(je32_to_cpu(ri->totlen)), ic);
 
         D1(printk(KERN_DEBUG "Node is ino #%u, version %d. Range 0x%x-0x%x\n",
                   je32_to_cpu(ri->ino), je32_to_cpu(ri->version),
@@ -794,8 +974,6 @@ static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_erasebloc
 
         pseudo_random += je32_to_cpu(ri->version);
 
-        UNCHECKED_SPACE(PAD(je32_to_cpu(ri->totlen)));
-
         if (jffs2_sum_active()) {
                 jffs2_sum_add_inode_mem(s, ri, ofs - jeb->offset);
         }
@@ -806,10 +984,10 @@ static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_erasebloc
 static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
                                   struct jffs2_raw_dirent *rd, uint32_t ofs, struct jffs2_summary *s)
 {
-        struct jffs2_raw_node_ref *raw;
         struct jffs2_full_dirent *fd;
         struct jffs2_inode_cache *ic;
         uint32_t crc;
+        int err;
 
         D1(printk(KERN_DEBUG "jffs2_scan_dirent_node(): Node at 0x%08x\n", ofs));
 
@@ -821,7 +999,8 @@ static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblo
                 printk(KERN_NOTICE "jffs2_scan_dirent_node(): Node CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
                        ofs, je32_to_cpu(rd->node_crc), crc);
                 /* We believe totlen because the CRC on the node _header_ was OK, just the node itself failed. */
-                DIRTY_SPACE(PAD(je32_to_cpu(rd->totlen)));
+                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(rd->totlen)))))
+                        return err;
                 return 0;
         }
 
@@ -842,40 +1021,23 @@ static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblo
                 jffs2_free_full_dirent(fd);
                 /* FIXME: Why do we believe totlen? */
                 /* We believe totlen because the CRC on the node _header_ was OK, just the name failed. */
-                DIRTY_SPACE(PAD(je32_to_cpu(rd->totlen)));
+                if ((err = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(rd->totlen)))))
+                        return err;
                 return 0;
         }
-        raw = jffs2_alloc_raw_node_ref();
-        if (!raw) {
-                jffs2_free_full_dirent(fd);
-                printk(KERN_NOTICE "jffs2_scan_dirent_node(): allocation of node reference failed\n");
-                return -ENOMEM;
-        }
         ic = jffs2_scan_make_ino_cache(c, je32_to_cpu(rd->pino));
         if (!ic) {
                 jffs2_free_full_dirent(fd);
-                jffs2_free_raw_node_ref(raw);
                 return -ENOMEM;
         }
 
-        raw->__totlen = PAD(je32_to_cpu(rd->totlen));
-        raw->flash_offset = ofs | REF_PRISTINE;
-        raw->next_phys = NULL;
-        raw->next_in_ino = ic->nodes;
-        ic->nodes = raw;
-        if (!jeb->first_node)
-                jeb->first_node = raw;
-        if (jeb->last_node)
-                jeb->last_node->next_phys = raw;
-        jeb->last_node = raw;
+        fd->raw = jffs2_link_node_ref(c, jeb, ofs | REF_PRISTINE, PAD(je32_to_cpu(rd->totlen)), ic);
 
-        fd->raw = raw;
         fd->next = NULL;
         fd->version = je32_to_cpu(rd->version);
         fd->ino = je32_to_cpu(rd->ino);
         fd->nhash = full_name_hash(fd->name, rd->nsize);
         fd->type = rd->type;
-        USED_SPACE(PAD(je32_to_cpu(rd->totlen)));
         jffs2_add_fd_to_list(c, fd, &ic->scan_dents);
 
         if (jffs2_sum_active()) {
diff --git a/fs/jffs2/security.c b/fs/jffs2/security.c
new file mode 100644
index 000000000000..52a9894a6364
--- /dev/null
+++ b/fs/jffs2/security.c
@@ -0,0 +1,82 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+#include <linux/crc32.h>
+#include <linux/jffs2.h>
+#include <linux/xattr.h>
+#include <linux/mtd/mtd.h>
+#include <linux/security.h>
+#include "nodelist.h"
+
+/* ---- Initial Security Label Attachment -------------- */
+int jffs2_init_security(struct inode *inode, struct inode *dir)
+{
+        int rc;
+        size_t len;
+        void *value;
+        char *name;
+
+        rc = security_inode_init_security(inode, dir, &name, &value, &len);
+        if (rc) {
+                if (rc == -EOPNOTSUPP)
+                        return 0;
+                return rc;
+        }
+        rc = do_jffs2_setxattr(inode, JFFS2_XPREFIX_SECURITY, name, value, len, 0);
+
+        kfree(name);
+        kfree(value);
+        return rc;
+}
+
+/* ---- XATTR Handler for "security.*" ----------------- */
+static int jffs2_security_getxattr(struct inode *inode, const char *name,
+                                   void *buffer, size_t size)
+{
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        return do_jffs2_getxattr(inode, JFFS2_XPREFIX_SECURITY, name, buffer, size);
+}
+
+static int jffs2_security_setxattr(struct inode *inode, const char *name, const void *buffer,
+                                   size_t size, int flags)
+{
+        if (!strcmp(name, ""))
+                return -EINVAL;
+
+        return do_jffs2_setxattr(inode, JFFS2_XPREFIX_SECURITY, name, buffer, size, flags);
+}
+
+static size_t jffs2_security_listxattr(struct inode *inode, char *list, size_t list_size,
+                                       const char *name, size_t name_len)
+{
+        size_t retlen = XATTR_SECURITY_PREFIX_LEN + name_len + 1;
+
+        if (list && retlen <= list_size) {
+                strcpy(list, XATTR_SECURITY_PREFIX);
+                strcpy(list + XATTR_SECURITY_PREFIX_LEN, name);
+        }
+
+        return retlen;
+}
+
+struct xattr_handler jffs2_security_xattr_handler = {
+        .prefix = XATTR_SECURITY_PREFIX,
+        .list = jffs2_security_listxattr,
+        .set = jffs2_security_setxattr,
+        .get = jffs2_security_getxattr
+};
diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
index fb9cec61fcf2..0b02fc79e4d1 100644
--- a/fs/jffs2/summary.c
+++ b/fs/jffs2/summary.c
@@ -5,6 +5,7 @@
  *                     Zoltan Sogor <weth@inf.u-szeged.hu>,
  *                     Patrik Kluba <pajko@halom.u-szeged.hu>,
  *                     University of Szeged, Hungary
+ *               2005  KaiGai Kohei <kaigai@ak.jp.nec.com>
  *
  * For licensing information, see the file 'LICENCE' in this directory.
  *
@@ -81,6 +82,19 @@ static int jffs2_sum_add_mem(struct jffs2_summary *s, union jffs2_sum_mem *item)
                         dbg_summary("dirent (%u) added to summary\n",
                                                 je32_to_cpu(item->d.ino));
                         break;
+#ifdef CONFIG_JFFS2_FS_XATTR
+                case JFFS2_NODETYPE_XATTR:
+                        s->sum_size += JFFS2_SUMMARY_XATTR_SIZE;
+                        s->sum_num++;
+                        dbg_summary("xattr (xid=%u, version=%u) added to summary\n",
+                                    je32_to_cpu(item->x.xid), je32_to_cpu(item->x.version));
+                        break;
+                case JFFS2_NODETYPE_XREF:
+                        s->sum_size += JFFS2_SUMMARY_XREF_SIZE;
+                        s->sum_num++;
+                        dbg_summary("xref added to summary\n");
+                        break;
+#endif
                 default:
                         JFFS2_WARNING("UNKNOWN node type %u\n",
                                             je16_to_cpu(item->u.nodetype));
@@ -141,6 +155,40 @@ int jffs2_sum_add_dirent_mem(struct jffs2_summary *s, struct jffs2_raw_dirent *r
         return jffs2_sum_add_mem(s, (union jffs2_sum_mem *)temp);
 }
 
+#ifdef CONFIG_JFFS2_FS_XATTR
+int jffs2_sum_add_xattr_mem(struct jffs2_summary *s, struct jffs2_raw_xattr *rx, uint32_t ofs)
+{
+        struct jffs2_sum_xattr_mem *temp;
+
+        temp = kmalloc(sizeof(struct jffs2_sum_xattr_mem), GFP_KERNEL);
+        if (!temp)
+                return -ENOMEM;
+
+        temp->nodetype = rx->nodetype;
+        temp->xid = rx->xid;
+        temp->version = rx->version;
+        temp->offset = cpu_to_je32(ofs);
+        temp->totlen = rx->totlen;
+        temp->next = NULL;
+
+        return jffs2_sum_add_mem(s, (union jffs2_sum_mem *)temp);
+}
+
+int jffs2_sum_add_xref_mem(struct jffs2_summary *s, struct jffs2_raw_xref *rr, uint32_t ofs)
+{
+        struct jffs2_sum_xref_mem *temp;
+
+        temp = kmalloc(sizeof(struct jffs2_sum_xref_mem), GFP_KERNEL);
+        if (!temp)
+                return -ENOMEM;
+
+        temp->nodetype = rr->nodetype;
+        temp->offset = cpu_to_je32(ofs);
+        temp->next = NULL;
+
+        return jffs2_sum_add_mem(s, (union jffs2_sum_mem *)temp);
+}
+#endif
 /* Cleanup every collected summary information */
 
 static void jffs2_sum_clean_collected(struct jffs2_summary *s)
@@ -259,7 +307,40 @@ int jffs2_sum_add_kvec(struct jffs2_sb_info *c, const struct kvec *invecs,
 
                         return jffs2_sum_add_mem(c->summary, (union jffs2_sum_mem *)temp);
                 }
+#ifdef CONFIG_JFFS2_FS_XATTR
+                case JFFS2_NODETYPE_XATTR: {
+                        struct jffs2_sum_xattr_mem *temp;
+                        if (je32_to_cpu(node->x.version) == 0xffffffff)
+                                return 0;
+                        temp = kmalloc(sizeof(struct jffs2_sum_xattr_mem), GFP_KERNEL);
+                        if (!temp)
+                                goto no_mem;
+
+                        temp->nodetype = node->x.nodetype;
+                        temp->xid = node->x.xid;
+                        temp->version = node->x.version;
+                        temp->totlen = node->x.totlen;
+                        temp->offset = cpu_to_je32(ofs);
+                        temp->next = NULL;
+
+                        return jffs2_sum_add_mem(c->summary, (union jffs2_sum_mem *)temp);
+                }
+                case JFFS2_NODETYPE_XREF: {
+                        struct jffs2_sum_xref_mem *temp;
+
+                        if (je32_to_cpu(node->r.ino) == 0xffffffff
+                            && je32_to_cpu(node->r.xid) == 0xffffffff)
+                                return 0;
+                        temp = kmalloc(sizeof(struct jffs2_sum_xref_mem), GFP_KERNEL);
+                        if (!temp)
+                                goto no_mem;
+                        temp->nodetype = node->r.nodetype;
+                        temp->offset = cpu_to_je32(ofs);
+                        temp->next = NULL;
 
+                        return jffs2_sum_add_mem(c->summary, (union jffs2_sum_mem *)temp);
+                }
+#endif
                 case JFFS2_NODETYPE_PADDING:
                         dbg_summary("node PADDING\n");
                         c->summary->sum_padded += je32_to_cpu(node->u.totlen);
@@ -288,23 +369,41 @@ no_mem:
         return -ENOMEM;
 }
 
+static struct jffs2_raw_node_ref *sum_link_node_ref(struct jffs2_sb_info *c,
+                                                    struct jffs2_eraseblock *jeb,
+                                                    uint32_t ofs, uint32_t len,
+                                                    struct jffs2_inode_cache *ic)
+{
+        /* If there was a gap, mark it dirty */
+        if ((ofs & ~3) > c->sector_size - jeb->free_size) {
+                /* Ew. Summary doesn't actually tell us explicitly about dirty space */
+                jffs2_scan_dirty_space(c, jeb, (ofs & ~3) - (c->sector_size - jeb->free_size));
+        }
+
+        return jffs2_link_node_ref(c, jeb, jeb->offset + ofs, len, ic);
+}
 
 /* Process the stored summary information - helper function for jffs2_sum_scan_sumnode() */
 
 static int jffs2_sum_process_sum_data(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
                                 struct jffs2_raw_summary *summary, uint32_t *pseudo_random)
 {
-        struct jffs2_raw_node_ref *raw;
         struct jffs2_inode_cache *ic;
         struct jffs2_full_dirent *fd;
         void *sp;
         int i, ino;
+        int err;
 
         sp = summary->sum;
 
         for (i=0; i<je32_to_cpu(summary->sum_num); i++) {
                 dbg_summary("processing summary index %d\n", i);
 
+                /* Make sure there's a spare ref for dirty space */
+                err = jffs2_prealloc_raw_node_refs(c, jeb, 2);
+                if (err)
+                        return err;
+
                 switch (je16_to_cpu(((struct jffs2_sum_unknown_flash *)sp)->nodetype)) {
                         case JFFS2_NODETYPE_INODE: {
                                 struct jffs2_sum_inode_flash *spi;
@@ -312,38 +411,20 @@ static int jffs2_sum_process_sum_data(struct jffs2_sb_info *c, struct jffs2_eras
 
                                 ino = je32_to_cpu(spi->inode);
 
-                                dbg_summary("Inode at 0x%08x\n",
-                                                        jeb->offset + je32_to_cpu(spi->offset));
-
-                                raw = jffs2_alloc_raw_node_ref();
-                                if (!raw) {
-                                        JFFS2_NOTICE("allocation of node reference failed\n");
-                                        kfree(summary);
-                                        return -ENOMEM;
-                                }
+                                dbg_summary("Inode at 0x%08x-0x%08x\n",
+                                            jeb->offset + je32_to_cpu(spi->offset),
+                                            jeb->offset + je32_to_cpu(spi->offset) + je32_to_cpu(spi->totlen));
 
                                 ic = jffs2_scan_make_ino_cache(c, ino);
                                 if (!ic) {
                                         JFFS2_NOTICE("scan_make_ino_cache failed\n");
-                                        jffs2_free_raw_node_ref(raw);
-                                        kfree(summary);
                                         return -ENOMEM;
                                 }
 
-                                raw->flash_offset = (jeb->offset + je32_to_cpu(spi->offset)) | REF_UNCHECKED;
-                                raw->__totlen = PAD(je32_to_cpu(spi->totlen));
-                                raw->next_phys = NULL;
-                                raw->next_in_ino = ic->nodes;
-
-                                ic->nodes = raw;
-                                if (!jeb->first_node)
-                                        jeb->first_node = raw;
-                                if (jeb->last_node)
-                                        jeb->last_node->next_phys = raw;
-                                jeb->last_node = raw;
-                                *pseudo_random += je32_to_cpu(spi->version);
+                                sum_link_node_ref(c, jeb, je32_to_cpu(spi->offset) | REF_UNCHECKED,
+                                                  PAD(je32_to_cpu(spi->totlen)), ic);
 
-                                UNCHECKED_SPACE(PAD(je32_to_cpu(spi->totlen)));
+                                *pseudo_random += je32_to_cpu(spi->version);
 
                                 sp += JFFS2_SUMMARY_INODE_SIZE;
 
@@ -354,52 +435,33 @@ static int jffs2_sum_process_sum_data(struct jffs2_sb_info *c, struct jffs2_eras
                                 struct jffs2_sum_dirent_flash *spd;
                                 spd = sp;
 
-                                dbg_summary("Dirent at 0x%08x\n",
-                                                        jeb->offset + je32_to_cpu(spd->offset));
+                                dbg_summary("Dirent at 0x%08x-0x%08x\n",
+                                            jeb->offset + je32_to_cpu(spd->offset),
+                                            jeb->offset + je32_to_cpu(spd->offset) + je32_to_cpu(spd->totlen));
+
 
                                 fd = jffs2_alloc_full_dirent(spd->nsize+1);
-                                if (!fd) {
-                                        kfree(summary);
+                                if (!fd)
                                         return -ENOMEM;
-                                }
 
                                 memcpy(&fd->name, spd->name, spd->nsize);
                                 fd->name[spd->nsize] = 0;
 
-                                raw = jffs2_alloc_raw_node_ref();
-                                if (!raw) {
-                                        jffs2_free_full_dirent(fd);
-                                        JFFS2_NOTICE("allocation of node reference failed\n");
-                                        kfree(summary);
-                                        return -ENOMEM;
-                                }
-
                                 ic = jffs2_scan_make_ino_cache(c, je32_to_cpu(spd->pino));
                                 if (!ic) {
                                         jffs2_free_full_dirent(fd);
-                                        jffs2_free_raw_node_ref(raw);
-                                        kfree(summary);
                                         return -ENOMEM;
                                 }
 
-                                raw->__totlen = PAD(je32_to_cpu(spd->totlen));
-                                raw->flash_offset = (jeb->offset + je32_to_cpu(spd->offset)) | REF_PRISTINE;
-                                raw->next_phys = NULL;
-                                raw->next_in_ino = ic->nodes;
-                                ic->nodes = raw;
-                                if (!jeb->first_node)
-                                        jeb->first_node = raw;
-                                if (jeb->last_node)
-                                        jeb->last_node->next_phys = raw;
-                                jeb->last_node = raw;
-
-                                fd->raw = raw;
+                                fd->raw = sum_link_node_ref(c, jeb,  je32_to_cpu(spd->offset) | REF_UNCHECKED,
+                                                            PAD(je32_to_cpu(spd->totlen)), ic);
+
                                 fd->next = NULL;
                                 fd->version = je32_to_cpu(spd->version);
                                 fd->ino = je32_to_cpu(spd->ino);
                                 fd->nhash = full_name_hash(fd->name, spd->nsize);
                                 fd->type = spd->type;
-                                USED_SPACE(PAD(je32_to_cpu(spd->totlen)));
+
                                 jffs2_add_fd_to_list(c, fd, &ic->scan_dents);
 
                                 *pseudo_random += je32_to_cpu(spd->version);
@@ -408,48 +470,105 @@ static int jffs2_sum_process_sum_data(struct jffs2_sb_info *c, struct jffs2_eras
 
                                 break;
                         }
+#ifdef CONFIG_JFFS2_FS_XATTR
+                        case JFFS2_NODETYPE_XATTR: {
+                                struct jffs2_xattr_datum *xd;
+                                struct jffs2_sum_xattr_flash *spx;
+
+                                spx = (struct jffs2_sum_xattr_flash *)sp;
+                                dbg_summary("xattr at %#08x-%#08x (xid=%u, version=%u)\n", 
+                                            jeb->offset + je32_to_cpu(spx->offset),
+                                            jeb->offset + je32_to_cpu(spx->offset) + je32_to_cpu(spx->totlen),
+                                            je32_to_cpu(spx->xid), je32_to_cpu(spx->version));
+
+                                xd = jffs2_setup_xattr_datum(c, je32_to_cpu(spx->xid),
+                                                                je32_to_cpu(spx->version));
+                                if (IS_ERR(xd)) {
+                                        if (PTR_ERR(xd) == -EEXIST) {
+                                                /* a newer version of xd exists */
+                                                if ((err = jffs2_scan_dirty_space(c, jeb, je32_to_cpu(spx->totlen))))
+                                                        return err;
+                                                sp += JFFS2_SUMMARY_XATTR_SIZE;
+                                                break;
+                                        }
+                                        JFFS2_NOTICE("allocation of xattr_datum failed\n");
+                                        return PTR_ERR(xd);
+                                }
+
+                                xd->node = sum_link_node_ref(c, jeb, je32_to_cpu(spx->offset) | REF_UNCHECKED,
+                                                             PAD(je32_to_cpu(spx->totlen)), NULL);
+                                /* FIXME */ xd->node->next_in_ino = (void *)xd;
+
+                                *pseudo_random += je32_to_cpu(spx->xid);
+                                sp += JFFS2_SUMMARY_XATTR_SIZE;
+
+                                break;
+                        }
+                        case JFFS2_NODETYPE_XREF: {
+                                struct jffs2_xattr_ref *ref;
+                                struct jffs2_sum_xref_flash *spr;
+
+                                spr = (struct jffs2_sum_xref_flash *)sp;
+                                dbg_summary("xref at %#08x-%#08x\n",
+                                            jeb->offset + je32_to_cpu(spr->offset),
+                                            jeb->offset + je32_to_cpu(spr->offset) + 
+                                            (uint32_t)PAD(sizeof(struct jffs2_raw_xref)));
+
+                                ref = jffs2_alloc_xattr_ref();
+                                if (!ref) {
+                                        JFFS2_NOTICE("allocation of xattr_datum failed\n");
+                                        return -ENOMEM;
+                                }
+                                ref->ino = 0xfffffffe;
+                                ref->xid = 0xfffffffd;
+                                ref->next = c->xref_temp;
+                                c->xref_temp = ref;
 
+                                ref->node = sum_link_node_ref(c, jeb, je32_to_cpu(spr->offset) | REF_UNCHECKED,
+                                                              PAD(sizeof(struct jffs2_raw_xref)), NULL);
+                                /* FIXME */ ref->node->next_in_ino = (void *)ref;
+
+                                *pseudo_random += ref->node->flash_offset;
+                                sp += JFFS2_SUMMARY_XREF_SIZE;
+
+                                break;
+                        }
+#endif
                         default : {
-                                JFFS2_WARNING("Unsupported node type found in summary! Exiting...");
-                                kfree(summary);
-                                return -EIO;
+                                uint16_t nodetype = je16_to_cpu(((struct jffs2_sum_unknown_flash *)sp)->nodetype);
+                                JFFS2_WARNING("Unsupported node type %x found in summary! Exiting...\n", nodetype);
+                                if ((nodetype & JFFS2_COMPAT_MASK) == JFFS2_FEATURE_INCOMPAT)
+                                        return -EIO;
+
+                                /* For compatible node types, just fall back to the full scan */
+                                c->wasted_size -= jeb->wasted_size;
+                                c->free_size += c->sector_size - jeb->free_size;
+                                c->used_size -= jeb->used_size;
+                                c->dirty_size -= jeb->dirty_size;
+                                jeb->wasted_size = jeb->used_size = jeb->dirty_size = 0;
+                                jeb->free_size = c->sector_size;
+
+                                jffs2_free_jeb_node_refs(c, jeb);
+                                return -ENOTRECOVERABLE;
                         }
                 }
         }
-
-        kfree(summary);
         return 0;
 }
 
 /* Process the summary node - called from jffs2_scan_eraseblock() */
-
 int jffs2_sum_scan_sumnode(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
-                                uint32_t ofs, uint32_t *pseudo_random)
+                           struct jffs2_raw_summary *summary, uint32_t sumsize,
+                           uint32_t *pseudo_random)
 {
         struct jffs2_unknown_node crcnode;
-        struct jffs2_raw_node_ref *cache_ref;
-        struct jffs2_raw_summary *summary;
-        int ret, sumsize;
+        int ret, ofs;
         uint32_t crc;
 
-        sumsize = c->sector_size - ofs;
-        ofs += jeb->offset;
+        ofs = c->sector_size - sumsize;
 
         dbg_summary("summary found for 0x%08x at 0x%08x (0x%x bytes)\n",
-                                jeb->offset, ofs, sumsize);
-
-        summary = kmalloc(sumsize, GFP_KERNEL);
-
-        if (!summary) {
-                return -ENOMEM;
-        }
-
-        ret = jffs2_fill_scan_buf(c, (unsigned char *)summary, ofs, sumsize);
-
-        if (ret) {
-                kfree(summary);
-                return ret;
-        }
+                    jeb->offset, jeb->offset + ofs, sumsize);
 
         /* OK, now check for node validity and CRC */
         crcnode.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
@@ -486,66 +605,49 @@ int jffs2_sum_scan_sumnode(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb
 
                 dbg_summary("Summary : CLEANMARKER node \n");
 
+                ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
+                if (ret)
+                        return ret;
+
                 if (je32_to_cpu(summary->cln_mkr) != c->cleanmarker_size) {
                         dbg_summary("CLEANMARKER node has totlen 0x%x != normal 0x%x\n",
                                 je32_to_cpu(summary->cln_mkr), c->cleanmarker_size);
-                        UNCHECKED_SPACE(PAD(je32_to_cpu(summary->cln_mkr)));
+                        if ((ret = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(summary->cln_mkr)))))
+                                return ret;
                 } else if (jeb->first_node) {
                         dbg_summary("CLEANMARKER node not first node in block "
                                         "(0x%08x)\n", jeb->offset);
-                        UNCHECKED_SPACE(PAD(je32_to_cpu(summary->cln_mkr)));
+                        if ((ret = jffs2_scan_dirty_space(c, jeb, PAD(je32_to_cpu(summary->cln_mkr)))))
+                                return ret;
                 } else {
-                        struct jffs2_raw_node_ref *marker_ref = jffs2_alloc_raw_node_ref();
-
-                        if (!marker_ref) {
-                                JFFS2_NOTICE("Failed to allocate node ref for clean marker\n");
-                                kfree(summary);
-                                return -ENOMEM;
-                        }
-
-                        marker_ref->next_in_ino = NULL;
-                        marker_ref->next_phys = NULL;
-                        marker_ref->flash_offset = jeb->offset | REF_NORMAL;
-                        marker_ref->__totlen = je32_to_cpu(summary->cln_mkr);
-                        jeb->first_node = jeb->last_node = marker_ref;
-
-                        USED_SPACE( PAD(je32_to_cpu(summary->cln_mkr)) );
+                        jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL,
+                                            je32_to_cpu(summary->cln_mkr), NULL);
                 }
         }
 
-        if (je32_to_cpu(summary->padded)) {
-                DIRTY_SPACE(je32_to_cpu(summary->padded));
-        }
-
         ret = jffs2_sum_process_sum_data(c, jeb, summary, pseudo_random);
+        /* -ENOTRECOVERABLE isn't a fatal error -- it means we should do a full
+           scan of this eraseblock. So return zero */
+        if (ret == -ENOTRECOVERABLE)
+                return 0;
         if (ret)
-                return ret;
+                return ret;             /* real error */
 
         /* for PARANOIA_CHECK */
-        cache_ref = jffs2_alloc_raw_node_ref();
-
-        if (!cache_ref) {
-                JFFS2_NOTICE("Failed to allocate node ref for cache\n");
-                return -ENOMEM;
-        }
-
-        cache_ref->next_in_ino = NULL;
-        cache_ref->next_phys = NULL;
-        cache_ref->flash_offset = ofs | REF_NORMAL;
-        cache_ref->__totlen = sumsize;
-
-        if (!jeb->first_node)
-                jeb->first_node = cache_ref;
-        if (jeb->last_node)
-                jeb->last_node->next_phys = cache_ref;
-        jeb->last_node = cache_ref;
+        ret = jffs2_prealloc_raw_node_refs(c, jeb, 2);
+        if (ret)
+                return ret;
 
-        USED_SPACE(sumsize);
+        sum_link_node_ref(c, jeb, ofs | REF_NORMAL, sumsize, NULL);
 
-        jeb->wasted_size += jeb->free_size;
-        c->wasted_size += jeb->free_size;
-        c->free_size -= jeb->free_size;
-        jeb->free_size = 0;
+        if (unlikely(jeb->free_size)) {
+                JFFS2_WARNING("Free size 0x%x bytes in eraseblock @0x%08x with summary?\n",
+                              jeb->free_size, jeb->offset);
+                jeb->wasted_size += jeb->free_size;
+                c->wasted_size += jeb->free_size;
+                c->free_size -= jeb->free_size;
+                jeb->free_size = 0;
+        }
 
         return jffs2_scan_classify_jeb(c, jeb);
 
@@ -564,6 +666,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
         union jffs2_sum_mem *temp;
         struct jffs2_sum_marker *sm;
         struct kvec vecs[2];
+        uint32_t sum_ofs;
         void *wpage;
         int ret;
         size_t retlen;
@@ -581,16 +684,17 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
         wpage = c->summary->sum_buf;
 
         while (c->summary->sum_num) {
+                temp = c->summary->sum_list_head;
 
-                switch (je16_to_cpu(c->summary->sum_list_head->u.nodetype)) {
+                switch (je16_to_cpu(temp->u.nodetype)) {
                         case JFFS2_NODETYPE_INODE: {
                                 struct jffs2_sum_inode_flash *sino_ptr = wpage;
 
-                                sino_ptr->nodetype = c->summary->sum_list_head->i.nodetype;
-                                sino_ptr->inode = c->summary->sum_list_head->i.inode;
-                                sino_ptr->version = c->summary->sum_list_head->i.version;
-                                sino_ptr->offset = c->summary->sum_list_head->i.offset;
-                                sino_ptr->totlen = c->summary->sum_list_head->i.totlen;
+                                sino_ptr->nodetype = temp->i.nodetype;
+                                sino_ptr->inode = temp->i.inode;
+                                sino_ptr->version = temp->i.version;
+                                sino_ptr->offset = temp->i.offset;
+                                sino_ptr->totlen = temp->i.totlen;
 
                                 wpage += JFFS2_SUMMARY_INODE_SIZE;
 
@@ -600,30 +704,60 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
                         case JFFS2_NODETYPE_DIRENT: {
                                 struct jffs2_sum_dirent_flash *sdrnt_ptr = wpage;
 
-                                sdrnt_ptr->nodetype = c->summary->sum_list_head->d.nodetype;
-                                sdrnt_ptr->totlen = c->summary->sum_list_head->d.totlen;
-                                sdrnt_ptr->offset = c->summary->sum_list_head->d.offset;
-                                sdrnt_ptr->pino = c->summary->sum_list_head->d.pino;
-                                sdrnt_ptr->version = c->summary->sum_list_head->d.version;
-                                sdrnt_ptr->ino = c->summary->sum_list_head->d.ino;
-                                sdrnt_ptr->nsize = c->summary->sum_list_head->d.nsize;
-                                sdrnt_ptr->type = c->summary->sum_list_head->d.type;
+                                sdrnt_ptr->nodetype = temp->d.nodetype;
+                                sdrnt_ptr->totlen = temp->d.totlen;
+                                sdrnt_ptr->offset = temp->d.offset;
+                                sdrnt_ptr->pino = temp->d.pino;
+                                sdrnt_ptr->version = temp->d.version;
+                                sdrnt_ptr->ino = temp->d.ino;
+                                sdrnt_ptr->nsize = temp->d.nsize;
+                                sdrnt_ptr->type = temp->d.type;
 
-                                memcpy(sdrnt_ptr->name, c->summary->sum_list_head->d.name,
-                                                        c->summary->sum_list_head->d.nsize);
+                                memcpy(sdrnt_ptr->name, temp->d.name,
+                                                        temp->d.nsize);
 
-                                wpage += JFFS2_SUMMARY_DIRENT_SIZE(c->summary->sum_list_head->d.nsize);
+                                wpage += JFFS2_SUMMARY_DIRENT_SIZE(temp->d.nsize);
 
                                 break;
                         }
+#ifdef CONFIG_JFFS2_FS_XATTR
+                        case JFFS2_NODETYPE_XATTR: {
+                                struct jffs2_sum_xattr_flash *sxattr_ptr = wpage;
+
+                                temp = c->summary->sum_list_head;
+                                sxattr_ptr->nodetype = temp->x.nodetype;
+                                sxattr_ptr->xid = temp->x.xid;
+                                sxattr_ptr->version = temp->x.version;
+                                sxattr_ptr->offset = temp->x.offset;
+                                sxattr_ptr->totlen = temp->x.totlen;
+
+                                wpage += JFFS2_SUMMARY_XATTR_SIZE;
+                                break;
+                        }
+                        case JFFS2_NODETYPE_XREF: {
+                                struct jffs2_sum_xref_flash *sxref_ptr = wpage;
 
+                                temp = c->summary->sum_list_head;
+                                sxref_ptr->nodetype = temp->r.nodetype;
+                                sxref_ptr->offset = temp->r.offset;
+
+                                wpage += JFFS2_SUMMARY_XREF_SIZE;
+                                break;
+                        }
+#endif
                         default : {
-                                BUG();  /* unknown node in summary information */
+                                if ((je16_to_cpu(temp->u.nodetype) & JFFS2_COMPAT_MASK)
+                                    == JFFS2_FEATURE_RWCOMPAT_COPY) {
+                                        dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n",
+                                                    je16_to_cpu(temp->u.nodetype));
+                                        jffs2_sum_disable_collecting(c->summary);
+                                } else {
+                                        BUG();  /* unknown node in summary information */
+                                }
                         }
                 }
 
-                temp = c->summary->sum_list_head;
-                c->summary->sum_list_head = c->summary->sum_list_head->u.next;
+                c->summary->sum_list_head = temp->u.next;
                 kfree(temp);
 
                 c->summary->sum_num--;
@@ -645,25 +779,34 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
         vecs[1].iov_base = c->summary->sum_buf;
         vecs[1].iov_len = datasize;
 
-        dbg_summary("JFFS2: writing out data to flash to pos : 0x%08x\n",
-                        jeb->offset + c->sector_size - jeb->free_size);
+        sum_ofs = jeb->offset + c->sector_size - jeb->free_size;
 
-        spin_unlock(&c->erase_completion_lock);
-        ret = jffs2_flash_writev(c, vecs, 2, jeb->offset + c->sector_size -
-                                jeb->free_size, &retlen, 0);
-        spin_lock(&c->erase_completion_lock);
+        dbg_summary("JFFS2: writing out data to flash to pos : 0x%08x\n",
+                    sum_ofs);
 
+        ret = jffs2_flash_writev(c, vecs, 2, sum_ofs, &retlen, 0);
 
         if (ret || (retlen != infosize)) {
-                JFFS2_WARNING("Write of %zd bytes at 0x%08x failed. returned %d, retlen %zd\n",
-                        infosize, jeb->offset + c->sector_size - jeb->free_size, ret, retlen);
+
+                JFFS2_WARNING("Write of %u bytes at 0x%08x failed. returned %d, retlen %zd\n",
+                              infosize, sum_ofs, ret, retlen);
+
+                if (retlen) {
+                        /* Waste remaining space */
+                        spin_lock(&c->erase_completion_lock);
+                        jffs2_link_node_ref(c, jeb, sum_ofs | REF_OBSOLETE, infosize, NULL);
+                        spin_unlock(&c->erase_completion_lock);
+                }
 
                 c->summary->sum_size = JFFS2_SUMMARY_NOSUM_SIZE;
-                WASTED_SPACE(infosize);
 
-                return 1;
+                return 0;
         }
 
+        spin_lock(&c->erase_completion_lock);
+        jffs2_link_node_ref(c, jeb, sum_ofs | REF_NORMAL, infosize, NULL);
+        spin_unlock(&c->erase_completion_lock);
+
         return 0;
 }
 
@@ -671,13 +814,16 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
 
 int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
 {
-        struct jffs2_raw_node_ref *summary_ref;
-        int datasize, infosize, padsize, ret;
+        int datasize, infosize, padsize;
         struct jffs2_eraseblock *jeb;
+        int ret;
 
         dbg_summary("called\n");
 
+        spin_unlock(&c->erase_completion_lock);
+
         jeb = c->nextblock;
+        jffs2_prealloc_raw_node_refs(c, jeb, 1);
 
         if (!c->summary->sum_num || !c->summary->sum_list_head) {
                 JFFS2_WARNING("Empty summary info!!!\n");
@@ -696,35 +842,11 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
                 jffs2_sum_disable_collecting(c->summary);
 
                 JFFS2_WARNING("Not enough space for summary, padsize = %d\n", padsize);
+                spin_lock(&c->erase_completion_lock);
                 return 0;
         }
 
         ret = jffs2_sum_write_data(c, jeb, infosize, datasize, padsize);
-        if (ret)
-                return 0; /* can't write out summary, block is marked as NOSUM_SIZE */
-
-        /* for ACCT_PARANOIA_CHECK */
-        spin_unlock(&c->erase_completion_lock);
-        summary_ref = jffs2_alloc_raw_node_ref();
         spin_lock(&c->erase_completion_lock);
-
-        if (!summary_ref) {
-                JFFS2_NOTICE("Failed to allocate node ref for summary\n");
-                return -ENOMEM;
-        }
-
-        summary_ref->next_in_ino = NULL;
-        summary_ref->next_phys = NULL;
-        summary_ref->flash_offset = (jeb->offset + c->sector_size - jeb->free_size) | REF_NORMAL;
-        summary_ref->__totlen = infosize;
-
-        if (!jeb->first_node)
-                jeb->first_node = summary_ref;
-        if (jeb->last_node)
-                jeb->last_node->next_phys = summary_ref;
-        jeb->last_node = summary_ref;
-
-        USED_SPACE(infosize);
-
-        return 0;
+        return ret;
 }
diff --git a/fs/jffs2/summary.h b/fs/jffs2/summary.h
index b7a678be1709..6bf1f6aa4552 100644
--- a/fs/jffs2/summary.h
+++ b/fs/jffs2/summary.h
@@ -18,23 +18,6 @@
 #include <linux/uio.h>
 #include <linux/jffs2.h>
 
-#define DIRTY_SPACE(x) do { typeof(x) _x = (x); \
-                c->free_size -= _x; c->dirty_size += _x; \
-                jeb->free_size -= _x ; jeb->dirty_size += _x; \
-                }while(0)
-#define USED_SPACE(x) do { typeof(x) _x = (x); \
-                c->free_size -= _x; c->used_size += _x; \
-                jeb->free_size -= _x ; jeb->used_size += _x; \
-                }while(0)
-#define WASTED_SPACE(x) do { typeof(x) _x = (x); \
-                c->free_size -= _x; c->wasted_size += _x; \
-                jeb->free_size -= _x ; jeb->wasted_size += _x; \
-                }while(0)
-#define UNCHECKED_SPACE(x) do { typeof(x) _x = (x); \
-                c->free_size -= _x; c->unchecked_size += _x; \
-                jeb->free_size -= _x ; jeb->unchecked_size += _x; \
-                }while(0)
-
 #define BLK_STATE_ALLFF         0
 #define BLK_STATE_CLEAN         1
 #define BLK_STATE_PARTDIRTY     2
@@ -45,6 +28,8 @@
 #define JFFS2_SUMMARY_NOSUM_SIZE 0xffffffff
 #define JFFS2_SUMMARY_INODE_SIZE (sizeof(struct jffs2_sum_inode_flash))
 #define JFFS2_SUMMARY_DIRENT_SIZE(x) (sizeof(struct jffs2_sum_dirent_flash) + (x))
+#define JFFS2_SUMMARY_XATTR_SIZE (sizeof(struct jffs2_sum_xattr_flash))
+#define JFFS2_SUMMARY_XREF_SIZE (sizeof(struct jffs2_sum_xref_flash))
 
 /* Summary structures used on flash */
 
@@ -75,11 +60,28 @@ struct jffs2_sum_dirent_flash
         uint8_t name[0];        /* dirent name */
 } __attribute__((packed));
 
+struct jffs2_sum_xattr_flash
+{
+        jint16_t nodetype;      /* == JFFS2_NODETYPE_XATR */
+        jint32_t xid;           /* xattr identifier */
+        jint32_t version;       /* version number */
+        jint32_t offset;        /* offset on jeb */
+        jint32_t totlen;        /* node length */
+} __attribute__((packed));
+
+struct jffs2_sum_xref_flash
+{
+        jint16_t nodetype;      /* == JFFS2_NODETYPE_XREF */
+        jint32_t offset;        /* offset on jeb */
+} __attribute__((packed));
+
 union jffs2_sum_flash
 {
         struct jffs2_sum_unknown_flash u;
         struct jffs2_sum_inode_flash i;
         struct jffs2_sum_dirent_flash d;
+        struct jffs2_sum_xattr_flash x;
+        struct jffs2_sum_xref_flash r;
 };
 
 /* Summary structures used in the memory */
@@ -114,11 +116,30 @@ struct jffs2_sum_dirent_mem
         uint8_t name[0];        /* dirent name */
 } __attribute__((packed));
 
+struct jffs2_sum_xattr_mem
+{
+        union jffs2_sum_mem *next;
+        jint16_t nodetype;
+        jint32_t xid;
+        jint32_t version;
+        jint32_t offset;
+        jint32_t totlen;
+} __attribute__((packed));
+
+struct jffs2_sum_xref_mem
+{
+        union jffs2_sum_mem *next;
+        jint16_t nodetype;
+        jint32_t offset;
+} __attribute__((packed));
+
 union jffs2_sum_mem
 {
         struct jffs2_sum_unknown_mem u;
         struct jffs2_sum_inode_mem i;
         struct jffs2_sum_dirent_mem d;
+        struct jffs2_sum_xattr_mem x;
+        struct jffs2_sum_xref_mem r;
 };
 
 /* Summary related information stored in superblock */
@@ -159,8 +180,11 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c);
 int jffs2_sum_add_padding_mem(struct jffs2_summary *s, uint32_t size);
 int jffs2_sum_add_inode_mem(struct jffs2_summary *s, struct jffs2_raw_inode *ri, uint32_t ofs);
 int jffs2_sum_add_dirent_mem(struct jffs2_summary *s, struct jffs2_raw_dirent *rd, uint32_t ofs);
+int jffs2_sum_add_xattr_mem(struct jffs2_summary *s, struct jffs2_raw_xattr *rx, uint32_t ofs);
+int jffs2_sum_add_xref_mem(struct jffs2_summary *s, struct jffs2_raw_xref *rr, uint32_t ofs);
 int jffs2_sum_scan_sumnode(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
-                        uint32_t ofs, uint32_t *pseudo_random);
+                           struct jffs2_raw_summary *summary, uint32_t sumlen,
+                           uint32_t *pseudo_random);
 
 #else                           /* SUMMARY DISABLED */
 
@@ -176,7 +200,9 @@ int jffs2_sum_scan_sumnode(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb
 #define jffs2_sum_add_padding_mem(a,b)
 #define jffs2_sum_add_inode_mem(a,b,c)
 #define jffs2_sum_add_dirent_mem(a,b,c)
-#define jffs2_sum_scan_sumnode(a,b,c,d) (0)
+#define jffs2_sum_add_xattr_mem(a,b,c)
+#define jffs2_sum_add_xref_mem(a,b,c)
+#define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
 
 #endif /* CONFIG_JFFS2_SUMMARY */
 
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index ffd8e84b22cc..9d0521451f59 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -151,7 +151,10 @@ static struct super_block *jffs2_get_sb_mtd(struct file_system_type *fs_type,
 
         sb->s_op = &jffs2_super_operations;
         sb->s_flags = flags | MS_NOATIME;
-
+        sb->s_xattr = jffs2_xattr_handlers;
+#ifdef CONFIG_JFFS2_FS_POSIX_ACL
+        sb->s_flags |= MS_POSIXACL;
+#endif
         ret = jffs2_do_fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
 
         if (ret) {
@@ -293,6 +296,7 @@ static void jffs2_put_super (struct super_block *sb)
                 kfree(c->blocks);
         jffs2_flash_cleanup(c);
         kfree(c->inocache_list);
+        jffs2_clear_xattr_subsystem(c);
         if (c->mtd->sync)
                 c->mtd->sync(c->mtd);
 
@@ -320,6 +324,18 @@ static int __init init_jffs2_fs(void)
 {
         int ret;
 
+        /* Paranoia checks for on-medium structures. If we ask GCC
+           to pack them with __attribute__((packed)) then it _also_
+           assumes that they're not aligned -- so it emits crappy
+           code on some architectures. Ideally we want an attribute
+           which means just 'no padding', without the alignment
+           thing. But GCC doesn't have that -- we have to just
+           hope the structs are the right sizes, instead. */
+        BUG_ON(sizeof(struct jffs2_unknown_node) != 12);
+        BUG_ON(sizeof(struct jffs2_raw_dirent) != 40);
+        BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
+        BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
+
         printk(KERN_INFO "JFFS2 version 2.2."
 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
                " (NAND)"
@@ -327,7 +343,7 @@ static int __init init_jffs2_fs(void)
 #ifdef CONFIG_JFFS2_SUMMARY
                " (SUMMARY) "
 #endif
-               " (C) 2001-2003 Red Hat, Inc.\n");
+               " (C) 2001-2006 Red Hat, Inc.\n");
 
         jffs2_inode_cachep = kmem_cache_create("jffs2_i",
                                              sizeof(struct jffs2_inode_info),
diff --git a/fs/jffs2/symlink.c b/fs/jffs2/symlink.c
index d55754fe8925..fc211b6e9b03 100644
--- a/fs/jffs2/symlink.c
+++ b/fs/jffs2/symlink.c
@@ -24,7 +24,12 @@ struct inode_operations jffs2_symlink_inode_operations =
 {
         .readlink =     generic_readlink,
         .follow_link =  jffs2_follow_link,
-        .setattr =      jffs2_setattr
+        .permission =   jffs2_permission,
+        .setattr =      jffs2_setattr,
+        .setxattr =     jffs2_setxattr,
+        .getxattr =     jffs2_getxattr,
+        .listxattr =    jffs2_listxattr,
+        .removexattr =  jffs2_removexattr
 };
 
 static void *jffs2_follow_link(struct dentry *dentry, struct nameidata *nd)
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index 4cebf0e57c46..a7f153f79ecb 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -156,69 +156,130 @@ static void jffs2_block_refile(struct jffs2_sb_info *c, struct jffs2_eraseblock
                 jffs2_erase_pending_trigger(c);
         }
 
-        /* Adjust its size counts accordingly */
-        c->wasted_size += jeb->free_size;
-        c->free_size -= jeb->free_size;
-        jeb->wasted_size += jeb->free_size;
-        jeb->free_size = 0;
+        if (!jffs2_prealloc_raw_node_refs(c, jeb, 1)) {
+                uint32_t oldfree = jeb->free_size;
+
+                jffs2_link_node_ref(c, jeb, 
+                                    (jeb->offset+c->sector_size-oldfree) | REF_OBSOLETE,
+                                    oldfree, NULL);
+                /* convert to wasted */
+                c->wasted_size += oldfree;
+                jeb->wasted_size += oldfree;
+                c->dirty_size -= oldfree;
+                jeb->dirty_size -= oldfree;
+        }
 
         jffs2_dbg_dump_block_lists_nolock(c);
         jffs2_dbg_acct_sanity_check_nolock(c,jeb);
         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 }
 
+static struct jffs2_raw_node_ref **jffs2_incore_replace_raw(struct jffs2_sb_info *c,
+                                                            struct jffs2_inode_info *f,
+                                                            struct jffs2_raw_node_ref *raw,
+                                                            union jffs2_node_union *node)
+{
+        struct jffs2_node_frag *frag;
+        struct jffs2_full_dirent *fd;
+
+        dbg_noderef("incore_replace_raw: node at %p is {%04x,%04x}\n",
+                    node, je16_to_cpu(node->u.magic), je16_to_cpu(node->u.nodetype));
+
+        BUG_ON(je16_to_cpu(node->u.magic) != 0x1985 &&
+               je16_to_cpu(node->u.magic) != 0);
+
+        switch (je16_to_cpu(node->u.nodetype)) {
+        case JFFS2_NODETYPE_INODE:
+                if (f->metadata && f->metadata->raw == raw) {
+                        dbg_noderef("Will replace ->raw in f->metadata at %p\n", f->metadata);
+                        return &f->metadata->raw;
+                }
+                frag = jffs2_lookup_node_frag(&f->fragtree, je32_to_cpu(node->i.offset));
+                BUG_ON(!frag);
+                /* Find a frag which refers to the full_dnode we want to modify */
+                while (!frag->node || frag->node->raw != raw) {
+                        frag = frag_next(frag);
+                        BUG_ON(!frag);
+                }
+                dbg_noderef("Will replace ->raw in full_dnode at %p\n", frag->node);
+                return &frag->node->raw;
+
+        case JFFS2_NODETYPE_DIRENT:
+                for (fd = f->dents; fd; fd = fd->next) {
+                        if (fd->raw == raw) {
+                                dbg_noderef("Will replace ->raw in full_dirent at %p\n", fd);
+                                return &fd->raw;
+                        }
+                }
+                BUG();
+
+        default:
+                dbg_noderef("Don't care about replacing raw for nodetype %x\n",
+                            je16_to_cpu(node->u.nodetype));
+                break;
+        }
+        return NULL;
+}
+
 /* Recover from failure to write wbuf. Recover the nodes up to the
  * wbuf, not the one which we were starting to try to write. */
 
 static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
 {
         struct jffs2_eraseblock *jeb, *new_jeb;
-        struct jffs2_raw_node_ref **first_raw, **raw;
+        struct jffs2_raw_node_ref *raw, *next, *first_raw = NULL;
         size_t retlen;
         int ret;
+        int nr_refile = 0;
         unsigned char *buf;
         uint32_t start, end, ofs, len;
 
-        spin_lock(&c->erase_completion_lock);
-
         jeb = &c->blocks[c->wbuf_ofs / c->sector_size];
 
+        spin_lock(&c->erase_completion_lock);
         jffs2_block_refile(c, jeb, REFILE_NOTEMPTY);
+        spin_unlock(&c->erase_completion_lock);
+
+        BUG_ON(!ref_obsolete(jeb->last_node));
 
         /* Find the first node to be recovered, by skipping over every
            node which ends before the wbuf starts, or which is obsolete. */
-        first_raw = &jeb->first_node;
-        while (*first_raw &&
-               (ref_obsolete(*first_raw) ||
-                (ref_offset(*first_raw)+ref_totlen(c, jeb, *first_raw)) < c->wbuf_ofs)) {
-                D1(printk(KERN_DEBUG "Skipping node at 0x%08x(%d)-0x%08x which is either before 0x%08x or obsolete\n",
-                          ref_offset(*first_raw), ref_flags(*first_raw),
-                          (ref_offset(*first_raw) + ref_totlen(c, jeb, *first_raw)),
-                          c->wbuf_ofs));
-                first_raw = &(*first_raw)->next_phys;
+        for (next = raw = jeb->first_node; next; raw = next) {
+                next = ref_next(raw);
+
+                if (ref_obsolete(raw) || 
+                    (next && ref_offset(next) <= c->wbuf_ofs)) {
+                        dbg_noderef("Skipping node at 0x%08x(%d)-0x%08x which is either before 0x%08x or obsolete\n",
+                                    ref_offset(raw), ref_flags(raw),
+                                    (ref_offset(raw) + ref_totlen(c, jeb, raw)),
+                                    c->wbuf_ofs);
+                        continue;
+                }
+                dbg_noderef("First node to be recovered is at 0x%08x(%d)-0x%08x\n",
+                            ref_offset(raw), ref_flags(raw),
+                            (ref_offset(raw) + ref_totlen(c, jeb, raw)));
+
+                first_raw = raw;
+                break;
         }
 
-        if (!*first_raw) {
+        if (!first_raw) {
                 /* All nodes were obsolete. Nothing to recover. */
                 D1(printk(KERN_DEBUG "No non-obsolete nodes to be recovered. Just filing block bad\n"));
-                spin_unlock(&c->erase_completion_lock);
+                c->wbuf_len = 0;
                 return;
         }
 
-        start = ref_offset(*first_raw);
-        end = ref_offset(*first_raw) + ref_totlen(c, jeb, *first_raw);
-
-        /* Find the last node to be recovered */
-        raw = first_raw;
-        while ((*raw)) {
-                if (!ref_obsolete(*raw))
-                        end = ref_offset(*raw) + ref_totlen(c, jeb, *raw);
+        start = ref_offset(first_raw);
+        end = ref_offset(jeb->last_node);
+        nr_refile = 1;
 
-                raw = &(*raw)->next_phys;
-        }
-        spin_unlock(&c->erase_completion_lock);
+        /* Count the number of refs which need to be copied */
+        while ((raw = ref_next(raw)) != jeb->last_node)
+                nr_refile++;
 
-        D1(printk(KERN_DEBUG "wbuf recover %08x-%08x\n", start, end));
+        dbg_noderef("wbuf recover %08x-%08x (%d bytes in %d nodes)\n",
+                    start, end, end - start, nr_refile);
 
         buf = NULL;
         if (start < c->wbuf_ofs) {
@@ -233,28 +294,37 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
                 }
 
                 /* Do the read... */
-                if (jffs2_cleanmarker_oob(c))
-                        ret = c->mtd->read_ecc(c->mtd, start, c->wbuf_ofs - start, &retlen, buf, NULL, c->oobinfo);
-                else
-                        ret = c->mtd->read(c->mtd, start, c->wbuf_ofs - start, &retlen, buf);
+                ret = c->mtd->read(c->mtd, start, c->wbuf_ofs - start, &retlen, buf);
 
-                if (ret == -EBADMSG && retlen == c->wbuf_ofs - start) {
-                        /* ECC recovered */
+                /* ECC recovered ? */
+                if ((ret == -EUCLEAN || ret == -EBADMSG) &&
+                    (retlen == c->wbuf_ofs - start))
                         ret = 0;
-                }
+
                 if (ret || retlen != c->wbuf_ofs - start) {
                         printk(KERN_CRIT "Old data are already lost in wbuf recovery. Data loss ensues.\n");
 
                         kfree(buf);
                         buf = NULL;
                 read_failed:
-                        first_raw = &(*first_raw)->next_phys;
+                        first_raw = ref_next(first_raw);
+                        nr_refile--;
+                        while (first_raw && ref_obsolete(first_raw)) {
+                                first_raw = ref_next(first_raw);
+                                nr_refile--;
+                        }
+
                         /* If this was the only node to be recovered, give up */
-                        if (!(*first_raw))
+                        if (!first_raw) {
+                                c->wbuf_len = 0;
                                 return;
+                        }
 
                         /* It wasn't. Go on and try to recover nodes complete in the wbuf */
-                        start = ref_offset(*first_raw);
+                        start = ref_offset(first_raw);
+                        dbg_noderef("wbuf now recover %08x-%08x (%d bytes in %d nodes)\n",
+                                    start, end, end - start, nr_refile);
+
                 } else {
                         /* Read succeeded. Copy the remaining data from the wbuf */
                         memcpy(buf + (c->wbuf_ofs - start), c->wbuf, end - c->wbuf_ofs);
@@ -263,14 +333,23 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
         /* OK... we're to rewrite (end-start) bytes of data from first_raw onwards.
            Either 'buf' contains the data, or we find it in the wbuf */
 
-
         /* ... and get an allocation of space from a shiny new block instead */
-        ret = jffs2_reserve_space_gc(c, end-start, &ofs, &len, JFFS2_SUMMARY_NOSUM_SIZE);
+        ret = jffs2_reserve_space_gc(c, end-start, &len, JFFS2_SUMMARY_NOSUM_SIZE);
         if (ret) {
                 printk(KERN_WARNING "Failed to allocate space for wbuf recovery. Data loss ensues.\n");
                 kfree(buf);
                 return;
         }
+
+        ret = jffs2_prealloc_raw_node_refs(c, c->nextblock, nr_refile);
+        if (ret) {
+                printk(KERN_WARNING "Failed to allocate node refs for wbuf recovery. Data loss ensues.\n");
+                kfree(buf);
+                return;
+        }
+
+        ofs = write_ofs(c);
+
         if (end-start >= c->wbuf_pagesize) {
                 /* Need to do another write immediately, but it's possible
                    that this is just because the wbuf itself is completely
@@ -288,36 +367,22 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
                 if (breakme++ == 20) {
                         printk(KERN_NOTICE "Faking write error at 0x%08x\n", ofs);
                         breakme = 0;
-                        c->mtd->write_ecc(c->mtd, ofs, towrite, &retlen,
-                                          brokenbuf, NULL, c->oobinfo);
+                        c->mtd->write(c->mtd, ofs, towrite, &retlen,
+                                      brokenbuf);
                         ret = -EIO;
                 } else
 #endif
-                if (jffs2_cleanmarker_oob(c))
-                        ret = c->mtd->write_ecc(c->mtd, ofs, towrite, &retlen,
-                                                rewrite_buf, NULL, c->oobinfo);
-                else
-                        ret = c->mtd->write(c->mtd, ofs, towrite, &retlen, rewrite_buf);
+                        ret = c->mtd->write(c->mtd, ofs, towrite, &retlen,
+                                            rewrite_buf);
 
                 if (ret || retlen != towrite) {
                         /* Argh. We tried. Really we did. */
                         printk(KERN_CRIT "Recovery of wbuf failed due to a second write error\n");
                         kfree(buf);
 
-                        if (retlen) {
-                                struct jffs2_raw_node_ref *raw2;
-
-                                raw2 = jffs2_alloc_raw_node_ref();
-                                if (!raw2)
-                                        return;
+                        if (retlen)
+                                jffs2_add_physical_node_ref(c, ofs | REF_OBSOLETE, ref_totlen(c, jeb, first_raw), NULL);
 
-                                raw2->flash_offset = ofs | REF_OBSOLETE;
-                                raw2->__totlen = ref_totlen(c, jeb, *first_raw);
-                                raw2->next_phys = NULL;
-                                raw2->next_in_ino = NULL;
-
-                                jffs2_add_physical_node_ref(c, raw2);
-                        }
                         return;
                 }
                 printk(KERN_NOTICE "Recovery of wbuf succeeded to %08x\n", ofs);
@@ -326,12 +391,10 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
                 c->wbuf_ofs = ofs + towrite;
                 memmove(c->wbuf, rewrite_buf + towrite, c->wbuf_len);
                 /* Don't muck about with c->wbuf_inodes. False positives are harmless. */
-                kfree(buf);
         } else {
                 /* OK, now we're left with the dregs in whichever buffer we're using */
                 if (buf) {
                         memcpy(c->wbuf, buf, end-start);
-                        kfree(buf);
                 } else {
                         memmove(c->wbuf, c->wbuf + (start - c->wbuf_ofs), end - start);
                 }
@@ -343,62 +406,111 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
         new_jeb = &c->blocks[ofs / c->sector_size];
 
         spin_lock(&c->erase_completion_lock);
-        if (new_jeb->first_node) {
-                /* Odd, but possible with ST flash later maybe */
-                new_jeb->last_node->next_phys = *first_raw;
-        } else {
-                new_jeb->first_node = *first_raw;
-        }
-
-        raw = first_raw;
-        while (*raw) {
-                uint32_t rawlen = ref_totlen(c, jeb, *raw);
+        for (raw = first_raw; raw != jeb->last_node; raw = ref_next(raw)) {
+                uint32_t rawlen = ref_totlen(c, jeb, raw);
+                struct jffs2_inode_cache *ic;
+                struct jffs2_raw_node_ref *new_ref;
+                struct jffs2_raw_node_ref **adjust_ref = NULL;
+                struct jffs2_inode_info *f = NULL;
 
                 D1(printk(KERN_DEBUG "Refiling block of %08x at %08x(%d) to %08x\n",
-                          rawlen, ref_offset(*raw), ref_flags(*raw), ofs));
+                          rawlen, ref_offset(raw), ref_flags(raw), ofs));
+
+                ic = jffs2_raw_ref_to_ic(raw);
+
+                /* Ick. This XATTR mess should be fixed shortly... */
+                if (ic && ic->class == RAWNODE_CLASS_XATTR_DATUM) {
+                        struct jffs2_xattr_datum *xd = (void *)ic;
+                        BUG_ON(xd->node != raw);
+                        adjust_ref = &xd->node;
+                        raw->next_in_ino = NULL;
+                        ic = NULL;
+                } else if (ic && ic->class == RAWNODE_CLASS_XATTR_REF) {
+                        struct jffs2_xattr_datum *xr = (void *)ic;
+                        BUG_ON(xr->node != raw);
+                        adjust_ref = &xr->node;
+                        raw->next_in_ino = NULL;
+                        ic = NULL;
+                } else if (ic && ic->class == RAWNODE_CLASS_INODE_CACHE) {
+                        struct jffs2_raw_node_ref **p = &ic->nodes;
+
+                        /* Remove the old node from the per-inode list */
+                        while (*p && *p != (void *)ic) {
+                                if (*p == raw) {
+                                        (*p) = (raw->next_in_ino);
+                                        raw->next_in_ino = NULL;
+                                        break;
+                                }
+                                p = &((*p)->next_in_ino);
+                        }
 
-                if (ref_obsolete(*raw)) {
-                        /* Shouldn't really happen much */
-                        new_jeb->dirty_size += rawlen;
-                        new_jeb->free_size -= rawlen;
-                        c->dirty_size += rawlen;
-                } else {
-                        new_jeb->used_size += rawlen;
-                        new_jeb->free_size -= rawlen;
+                        if (ic->state == INO_STATE_PRESENT && !ref_obsolete(raw)) {
+                                /* If it's an in-core inode, then we have to adjust any
+                                   full_dirent or full_dnode structure to point to the
+                                   new version instead of the old */
+                                f = jffs2_gc_fetch_inode(c, ic->ino, ic->nlink);
+                                if (IS_ERR(f)) {
+                                        /* Should never happen; it _must_ be present */
+                                        JFFS2_ERROR("Failed to iget() ino #%u, err %ld\n",
+                                                    ic->ino, PTR_ERR(f));
+                                        BUG();
+                                }
+                                /* We don't lock f->sem. There's a number of ways we could
+                                   end up in here with it already being locked, and nobody's
+                                   going to modify it on us anyway because we hold the
+                                   alloc_sem. We're only changing one ->raw pointer too,
+                                   which we can get away with without upsetting readers. */
+                                adjust_ref = jffs2_incore_replace_raw(c, f, raw,
+                                                                      (void *)(buf?:c->wbuf) + (ref_offset(raw) - start));
+                        } else if (unlikely(ic->state != INO_STATE_PRESENT &&
+                                            ic->state != INO_STATE_CHECKEDABSENT &&
+                                            ic->state != INO_STATE_GC)) {
+                                JFFS2_ERROR("Inode #%u is in strange state %d!\n", ic->ino, ic->state);
+                                BUG();
+                        }
+                }
+
+                new_ref = jffs2_link_node_ref(c, new_jeb, ofs | ref_flags(raw), rawlen, ic);
+
+                if (adjust_ref) {
+                        BUG_ON(*adjust_ref != raw);
+                        *adjust_ref = new_ref;
+                }
+                if (f)
+                        jffs2_gc_release_inode(c, f);
+
+                if (!ref_obsolete(raw)) {
                         jeb->dirty_size += rawlen;
                         jeb->used_size  -= rawlen;
                         c->dirty_size += rawlen;
+                        c->used_size -= rawlen;
+                        raw->flash_offset = ref_offset(raw) | REF_OBSOLETE;
+                        BUG_ON(raw->next_in_ino);
                 }
-                c->free_size -= rawlen;
-                (*raw)->flash_offset = ofs | ref_flags(*raw);
                 ofs += rawlen;
-                new_jeb->last_node = *raw;
-
-                raw = &(*raw)->next_phys;
         }
 
+        kfree(buf);
+
         /* Fix up the original jeb now it's on the bad_list */
-        *first_raw = NULL;
-        if (first_raw == &jeb->first_node) {
-                jeb->last_node = NULL;
+        if (first_raw == jeb->first_node) {
                 D1(printk(KERN_DEBUG "Failing block at %08x is now empty. Moving to erase_pending_list\n", jeb->offset));
                 list_del(&jeb->list);
                 list_add(&jeb->list, &c->erase_pending_list);
                 c->nr_erasing_blocks++;
                 jffs2_erase_pending_trigger(c);
         }
-        else
-                jeb->last_node = container_of(first_raw, struct jffs2_raw_node_ref, next_phys);
 
         jffs2_dbg_acct_sanity_check_nolock(c, jeb);
-        jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
+        jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 
         jffs2_dbg_acct_sanity_check_nolock(c, new_jeb);
-        jffs2_dbg_acct_paranoia_check_nolock(c, new_jeb);
+        jffs2_dbg_acct_paranoia_check_nolock(c, new_jeb);
 
         spin_unlock(&c->erase_completion_lock);
 
-        D1(printk(KERN_DEBUG "wbuf recovery completed OK\n"));
+        D1(printk(KERN_DEBUG "wbuf recovery completed OK. wbuf_ofs 0x%08x, len 0x%x\n", c->wbuf_ofs, c->wbuf_len));
+
 }
 
 /* Meaning of pad argument:
@@ -412,6 +524,7 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
 
 static int __jffs2_flush_wbuf(struct jffs2_sb_info *c, int pad)
 {
+        struct jffs2_eraseblock *wbuf_jeb;
         int ret;
         size_t retlen;
 
@@ -429,6 +542,10 @@ static int __jffs2_flush_wbuf(struct jffs2_sb_info *c, int pad)
         if (!c->wbuf_len)       /* already checked c->wbuf above */
                 return 0;
 
+        wbuf_jeb = &c->blocks[c->wbuf_ofs / c->sector_size];
+        if (jffs2_prealloc_raw_node_refs(c, wbuf_jeb, c->nextblock->allocated_refs + 1))
+                return -ENOMEM;
+
         /* claim remaining space on the page
            this happens, if we have a change to a new block,
            or if fsync forces us to flush the writebuffer.
@@ -458,15 +575,12 @@ static int __jffs2_flush_wbuf(struct jffs2_sb_info *c, int pad)
         if (breakme++ == 20) {
                 printk(KERN_NOTICE "Faking write error at 0x%08x\n", c->wbuf_ofs);
                 breakme = 0;
-                c->mtd->write_ecc(c->mtd, c->wbuf_ofs, c->wbuf_pagesize,
-                                        &retlen, brokenbuf, NULL, c->oobinfo);
+                c->mtd->write(c->mtd, c->wbuf_ofs, c->wbuf_pagesize, &retlen,
+                              brokenbuf);
                 ret = -EIO;
         } else
 #endif
 
-        if (jffs2_cleanmarker_oob(c))
-                ret = c->mtd->write_ecc(c->mtd, c->wbuf_ofs, c->wbuf_pagesize, &retlen, c->wbuf, NULL, c->oobinfo);
-        else
                 ret = c->mtd->write(c->mtd, c->wbuf_ofs, c->wbuf_pagesize, &retlen, c->wbuf);
 
         if (ret || retlen != c->wbuf_pagesize) {
@@ -483,32 +597,34 @@ static int __jffs2_flush_wbuf(struct jffs2_sb_info *c, int pad)
                 return ret;
         }
 
-        spin_lock(&c->erase_completion_lock);
-
         /* Adjust free size of the block if we padded. */
         if (pad) {
-                struct jffs2_eraseblock *jeb;
-
-                jeb = &c->blocks[c->wbuf_ofs / c->sector_size];
+                uint32_t waste = c->wbuf_pagesize - c->wbuf_len;
 
                 D1(printk(KERN_DEBUG "jffs2_flush_wbuf() adjusting free_size of %sblock at %08x\n",
-                          (jeb==c->nextblock)?"next":"", jeb->offset));
+                          (wbuf_jeb==c->nextblock)?"next":"", wbuf_jeb->offset));
 
                 /* wbuf_pagesize - wbuf_len is the amount of space that's to be
                    padded. If there is less free space in the block than that,
                    something screwed up */
-                if (jeb->free_size < (c->wbuf_pagesize - c->wbuf_len)) {
+                if (wbuf_jeb->free_size < waste) {
                         printk(KERN_CRIT "jffs2_flush_wbuf(): Accounting error. wbuf at 0x%08x has 0x%03x bytes, 0x%03x left.\n",
-                               c->wbuf_ofs, c->wbuf_len, c->wbuf_pagesize-c->wbuf_len);
+                               c->wbuf_ofs, c->wbuf_len, waste);
                         printk(KERN_CRIT "jffs2_flush_wbuf(): But free_size for block at 0x%08x is only 0x%08x\n",
-                               jeb->offset, jeb->free_size);
+                               wbuf_jeb->offset, wbuf_jeb->free_size);
                         BUG();
                 }
-                jeb->free_size -= (c->wbuf_pagesize - c->wbuf_len);
-                c->free_size -= (c->wbuf_pagesize - c->wbuf_len);
-                jeb->wasted_size += (c->wbuf_pagesize - c->wbuf_len);
-                c->wasted_size += (c->wbuf_pagesize - c->wbuf_len);
-        }
+
+                spin_lock(&c->erase_completion_lock);
+
+                jffs2_link_node_ref(c, wbuf_jeb, (c->wbuf_ofs + c->wbuf_len) | REF_OBSOLETE, waste, NULL);
+                /* FIXME: that made it count as dirty. Convert to wasted */
+                wbuf_jeb->dirty_size -= waste;
+                c->dirty_size -= waste;
+                wbuf_jeb->wasted_size += waste;
+                c->wasted_size += waste;
+        } else
+                spin_lock(&c->erase_completion_lock);
 
         /* Stick any now-obsoleted blocks on the erase_pending_list */
         jffs2_refile_wbuf_blocks(c);
@@ -603,20 +719,30 @@ int jffs2_flush_wbuf_pad(struct jffs2_sb_info *c)
 
         return ret;
 }
-int jffs2_flash_writev(struct jffs2_sb_info *c, const struct kvec *invecs, unsigned long count, loff_t to, size_t *retlen, uint32_t ino)
+
+static size_t jffs2_fill_wbuf(struct jffs2_sb_info *c, const uint8_t *buf,
+                              size_t len)
 {
-        struct kvec outvecs[3];
-        uint32_t totlen = 0;
-        uint32_t split_ofs = 0;
-        uint32_t old_totlen;
-        int ret, splitvec = -1;
-        int invec, outvec;
-        size_t wbuf_retlen;
-        unsigned char *wbuf_ptr;
-        size_t donelen = 0;
+        if (len && !c->wbuf_len && (len >= c->wbuf_pagesize))
+                return 0;
+
+        if (len > (c->wbuf_pagesize - c->wbuf_len))
+                len = c->wbuf_pagesize - c->wbuf_len;
+        memcpy(c->wbuf + c->wbuf_len, buf, len);
+        c->wbuf_len += (uint32_t) len;
+        return len;
+}
+
+int jffs2_flash_writev(struct jffs2_sb_info *c, const struct kvec *invecs,
+                       unsigned long count, loff_t to, size_t *retlen,
+                       uint32_t ino)
+{
+        struct jffs2_eraseblock *jeb;
+        size_t wbuf_retlen, donelen = 0;
         uint32_t outvec_to = to;
+        int ret, invec;
 
-        /* If not NAND flash, don't bother */
+        /* If not writebuffered flash, don't bother */
         if (!jffs2_is_writebuffered(c))
                 return jffs2_flash_direct_writev(c, invecs, count, to, retlen);
 
@@ -629,34 +755,22 @@ int jffs2_flash_writev(struct jffs2_sb_info *c, const struct kvec *invecs, unsig
                 memset(c->wbuf,0xff,c->wbuf_pagesize);
         }
 
-        /* Fixup the wbuf if we are moving to a new eraseblock.  The checks below
-           fail for ECC'd NOR because cleanmarker == 16, so a block starts at
-           xxx0010.  */
-        if (jffs2_nor_ecc(c)) {
-                if (((c->wbuf_ofs % c->sector_size) == 0) && !c->wbuf_len) {
-                        c->wbuf_ofs = PAGE_DIV(to);
-                        c->wbuf_len = PAGE_MOD(to);
-                        memset(c->wbuf,0xff,c->wbuf_pagesize);
-                }
-        }
-
-        /* Sanity checks on target address.
-           It's permitted to write at PAD(c->wbuf_len+c->wbuf_ofs),
-           and it's permitted to write at the beginning of a new
-           erase block. Anything else, and you die.
-           New block starts at xxx000c (0-b = block header)
-        */
+        /*
+         * Sanity checks on target address.  It's permitted to write
+         * at PAD(c->wbuf_len+c->wbuf_ofs), and it's permitted to
+         * write at the beginning of a new erase block. Anything else,
+         * and you die.  New block starts at xxx000c (0-b = block
+         * header)
+         */
         if (SECTOR_ADDR(to) != SECTOR_ADDR(c->wbuf_ofs)) {
                 /* It's a write to a new block */
                 if (c->wbuf_len) {
-                        D1(printk(KERN_DEBUG "jffs2_flash_writev() to 0x%lx causes flush of wbuf at 0x%08x\n", (unsigned long)to, c->wbuf_ofs));
+                        D1(printk(KERN_DEBUG "jffs2_flash_writev() to 0x%lx "
+                                  "causes flush of wbuf at 0x%08x\n",
+                                  (unsigned long)to, c->wbuf_ofs));
                         ret = __jffs2_flush_wbuf(c, PAD_NOACCOUNT);
-                        if (ret) {
-                                /* the underlying layer has to check wbuf_len to do the cleanup */
-                                D1(printk(KERN_WARNING "jffs2_flush_wbuf() called from jffs2_flash_writev() failed %d\n", ret));
-                                *retlen = 0;
-                                goto exit;
-                        }
+                        if (ret)
+                                goto outerr;
                 }
                 /* set pointer to new block */
                 c->wbuf_ofs = PAGE_DIV(to);
@@ -665,165 +779,70 @@ int jffs2_flash_writev(struct jffs2_sb_info *c, const struct kvec *invecs, unsig
 
         if (to != PAD(c->wbuf_ofs + c->wbuf_len)) {
                 /* We're not writing immediately after the writebuffer. Bad. */
-                printk(KERN_CRIT "jffs2_flash_writev(): Non-contiguous write to %08lx\n", (unsigned long)to);
+                printk(KERN_CRIT "jffs2_flash_writev(): Non-contiguous write "
+                       "to %08lx\n", (unsigned long)to);
                 if (c->wbuf_len)
                         printk(KERN_CRIT "wbuf was previously %08x-%08x\n",
-                                          c->wbuf_ofs, c->wbuf_ofs+c->wbuf_len);
+                               c->wbuf_ofs, c->wbuf_ofs+c->wbuf_len);
                 BUG();
         }
 
-        /* Note outvecs[3] above. We know count is never greater than 2 */
-        if (count > 2) {
-                printk(KERN_CRIT "jffs2_flash_writev(): count is %ld\n", count);
-                BUG();
-        }
-
-        invec = 0;
-        outvec = 0;
-
-        /* Fill writebuffer first, if already in use */
-        if (c->wbuf_len) {
-                uint32_t invec_ofs = 0;
-
-                /* adjust alignment offset */
-                if (c->wbuf_len != PAGE_MOD(to)) {
-                        c->wbuf_len = PAGE_MOD(to);
-                        /* take care of alignment to next page */
-                        if (!c->wbuf_len)
-                                c->wbuf_len = c->wbuf_pagesize;
-                }
-
-                while(c->wbuf_len < c->wbuf_pagesize) {
-                        uint32_t thislen;
-
-                        if (invec == count)
-                                goto alldone;
-
-                        thislen = c->wbuf_pagesize - c->wbuf_len;
-
-                        if (thislen >= invecs[invec].iov_len)
-                                thislen = invecs[invec].iov_len;
-
-                        invec_ofs = thislen;
-
-                        memcpy(c->wbuf + c->wbuf_len, invecs[invec].iov_base, thislen);
-                        c->wbuf_len += thislen;
-                        donelen += thislen;
-                        /* Get next invec, if actual did not fill the buffer */
-                        if (c->wbuf_len < c->wbuf_pagesize)
-                                invec++;
-                }
-
-                /* write buffer is full, flush buffer */
-                ret = __jffs2_flush_wbuf(c, NOPAD);
-                if (ret) {
-                        /* the underlying layer has to check wbuf_len to do the cleanup */
-                        D1(printk(KERN_WARNING "jffs2_flush_wbuf() called from jffs2_flash_writev() failed %d\n", ret));
-                        /* Retlen zero to make sure our caller doesn't mark the space dirty.
-                           We've already done everything that's necessary */
-                        *retlen = 0;
-                        goto exit;
-                }
-                outvec_to += donelen;
-                c->wbuf_ofs = outvec_to;
-
-                /* All invecs done ? */
-                if (invec == count)
-                        goto alldone;
-
-                /* Set up the first outvec, containing the remainder of the
-                   invec we partially used */
-                if (invecs[invec].iov_len > invec_ofs) {
-                        outvecs[0].iov_base = invecs[invec].iov_base+invec_ofs;
-                        totlen = outvecs[0].iov_len = invecs[invec].iov_len-invec_ofs;
-                        if (totlen > c->wbuf_pagesize) {
-                                splitvec = outvec;
-                                split_ofs = outvecs[0].iov_len - PAGE_MOD(totlen);
-                        }
-                        outvec++;
-                }
-                invec++;
-        }
-
-        /* OK, now we've flushed the wbuf and the start of the bits
-           we have been asked to write, now to write the rest.... */
-
-        /* totlen holds the amount of data still to be written */
-        old_totlen = totlen;
-        for ( ; invec < count; invec++,outvec++ ) {
-                outvecs[outvec].iov_base = invecs[invec].iov_base;
-                totlen += outvecs[outvec].iov_len = invecs[invec].iov_len;
-                if (PAGE_DIV(totlen) != PAGE_DIV(old_totlen)) {
-                        splitvec = outvec;
-                        split_ofs = outvecs[outvec].iov_len - PAGE_MOD(totlen);
-                        old_totlen = totlen;
+        /* adjust alignment offset */
+        if (c->wbuf_len != PAGE_MOD(to)) {
+                c->wbuf_len = PAGE_MOD(to);
+                /* take care of alignment to next page */
+                if (!c->wbuf_len) {
+                        c->wbuf_len = c->wbuf_pagesize;
+                        ret = __jffs2_flush_wbuf(c, NOPAD);
+                        if (ret)
+                                goto outerr;
                 }
         }
 
-        /* Now the outvecs array holds all the remaining data to write */
-        /* Up to splitvec,split_ofs is to be written immediately. The rest
-           goes into the (now-empty) wbuf */
-
-        if (splitvec != -1) {
-                uint32_t remainder;
-
-                remainder = outvecs[splitvec].iov_len - split_ofs;
-                outvecs[splitvec].iov_len = split_ofs;
-
-                /* We did cross a page boundary, so we write some now */
-                if (jffs2_cleanmarker_oob(c))
-                        ret = c->mtd->writev_ecc(c->mtd, outvecs, splitvec+1, outvec_to, &wbuf_retlen, NULL, c->oobinfo);
-                else
-                        ret = jffs2_flash_direct_writev(c, outvecs, splitvec+1, outvec_to, &wbuf_retlen);
-
-                if (ret < 0 || wbuf_retlen != PAGE_DIV(totlen)) {
-                        /* At this point we have no problem,
-                           c->wbuf is empty. However refile nextblock to avoid
-                           writing again to same address.
-                        */
-                        struct jffs2_eraseblock *jeb;
+        for (invec = 0; invec < count; invec++) {
+                int vlen = invecs[invec].iov_len;
+                uint8_t *v = invecs[invec].iov_base;
 
-                        spin_lock(&c->erase_completion_lock);
+                wbuf_retlen = jffs2_fill_wbuf(c, v, vlen);
 
-                        jeb = &c->blocks[outvec_to / c->sector_size];
-                        jffs2_block_refile(c, jeb, REFILE_ANYWAY);
-
-                        *retlen = 0;
-                        spin_unlock(&c->erase_completion_lock);
-                        goto exit;
+                if (c->wbuf_len == c->wbuf_pagesize) {
+                        ret = __jffs2_flush_wbuf(c, NOPAD);
+                        if (ret)
+                                goto outerr;
                 }
-
+                vlen -= wbuf_retlen;
+                outvec_to += wbuf_retlen;
                 donelen += wbuf_retlen;
-                c->wbuf_ofs = PAGE_DIV(outvec_to) + PAGE_DIV(totlen);
-
-                if (remainder) {
-                        outvecs[splitvec].iov_base += split_ofs;
-                        outvecs[splitvec].iov_len = remainder;
-                } else {
-                        splitvec++;
+                v += wbuf_retlen;
+
+                if (vlen >= c->wbuf_pagesize) {
+                        ret = c->mtd->write(c->mtd, outvec_to, PAGE_DIV(vlen),
+                                            &wbuf_retlen, v);
+                        if (ret < 0 || wbuf_retlen != PAGE_DIV(vlen))
+                                goto outfile;
+
+                        vlen -= wbuf_retlen;
+                        outvec_to += wbuf_retlen;
+                        c->wbuf_ofs = outvec_to;
+                        donelen += wbuf_retlen;
+                        v += wbuf_retlen;
                 }
 
-        } else {
-                splitvec = 0;
-        }
-
-        /* Now splitvec points to the start of the bits we have to copy
-           into the wbuf */
-        wbuf_ptr = c->wbuf;
+                wbuf_retlen = jffs2_fill_wbuf(c, v, vlen);
+                if (c->wbuf_len == c->wbuf_pagesize) {
+                        ret = __jffs2_flush_wbuf(c, NOPAD);
+                        if (ret)
+                                goto outerr;
+                }
 
-        for ( ; splitvec < outvec; splitvec++) {
-                /* Don't copy the wbuf into itself */
-                if (outvecs[splitvec].iov_base == c->wbuf)
-                        continue;
-                memcpy(wbuf_ptr, outvecs[splitvec].iov_base, outvecs[splitvec].iov_len);
-                wbuf_ptr += outvecs[splitvec].iov_len;
-                donelen += outvecs[splitvec].iov_len;
+                outvec_to += wbuf_retlen;
+                donelen += wbuf_retlen;
         }
-        c->wbuf_len = wbuf_ptr - c->wbuf;
 
-        /* If there's a remainder in the wbuf and it's a non-GC write,
-           remember that the wbuf affects this ino */
-alldone:
+        /*
+         * If there's a remainder in the wbuf and it's a non-GC write,
+         * remember that the wbuf affects this ino
+         */
         *retlen = donelen;
 
         if (jffs2_sum_active()) {
@@ -836,8 +855,24 @@ alldone:
                 jffs2_wbuf_dirties_inode(c, ino);
 
         ret = 0;
+        up_write(&c->wbuf_sem);
+        return ret;
 
-exit:
+outfile:
+        /*
+         * At this point we have no problem, c->wbuf is empty. However
+         * refile nextblock to avoid writing again to same address.
+         */
+
+        spin_lock(&c->erase_completion_lock);
+
+        jeb = &c->blocks[outvec_to / c->sector_size];
+        jffs2_block_refile(c, jeb, REFILE_ANYWAY);
+
+        spin_unlock(&c->erase_completion_lock);
+
+outerr:
+        *retlen = 0;
         up_write(&c->wbuf_sem);
         return ret;
 }
@@ -846,7 +881,8 @@ exit:
  *      This is the entry for flash write.
  *      Check, if we work on NAND FLASH, if so build an kvec and write it via vritev
 */
-int jffs2_flash_write(struct jffs2_sb_info *c, loff_t ofs, size_t len, size_t *retlen, const u_char *buf)
+int jffs2_flash_write(struct jffs2_sb_info *c, loff_t ofs, size_t len,
+                      size_t *retlen, const u_char *buf)
 {
         struct kvec vecs[1];
 
@@ -871,25 +907,23 @@ int jffs2_flash_read(struct jffs2_sb_info *c, loff_t ofs, size_t len, size_t *re
 
         /* Read flash */
         down_read(&c->wbuf_sem);
-        if (jffs2_cleanmarker_oob(c))
-                ret = c->mtd->read_ecc(c->mtd, ofs, len, retlen, buf, NULL, c->oobinfo);
-        else
-                ret = c->mtd->read(c->mtd, ofs, len, retlen, buf);
-
-        if ( (ret == -EBADMSG) && (*retlen == len) ) {
-                printk(KERN_WARNING "mtd->read(0x%zx bytes from 0x%llx) returned ECC error\n",
-                       len, ofs);
+        ret = c->mtd->read(c->mtd, ofs, len, retlen, buf);
+
+        if ( (ret == -EBADMSG || ret == -EUCLEAN) && (*retlen == len) ) {
+                if (ret == -EBADMSG)
+                        printk(KERN_WARNING "mtd->read(0x%zx bytes from 0x%llx)"
+                               " returned ECC error\n", len, ofs);
                 /*
-                 * We have the raw data without ECC correction in the buffer, maybe
-                 * we are lucky and all data or parts are correct. We check the node.
-                 * If data are corrupted node check will sort it out.
-                 * We keep this block, it will fail on write or erase and the we
-                 * mark it bad. Or should we do that now? But we should give him a chance.
-                 * Maybe we had a system crash or power loss before the ecc write or
-                 * a erase was completed.
+                 * We have the raw data without ECC correction in the buffer,
+                 * maybe we are lucky and all data or parts are correct. We
+                 * check the node.  If data are corrupted node check will sort
+                 * it out.  We keep this block, it will fail on write or erase
+                 * and the we mark it bad. Or should we do that now? But we
+                 * should give him a chance.  Maybe we had a system crash or
+                 * power loss before the ecc write or a erase was completed.
                  * So we return success. :)
                  */
-                ret = 0;
+                ret = 0;
         }
 
         /* if no writebuffer available or write buffer empty, return */
@@ -911,7 +945,7 @@ int jffs2_flash_read(struct jffs2_sb_info *c, loff_t ofs, size_t len, size_t *re
                 orbf = (c->wbuf_ofs - ofs);     /* offset in read buffer */
                 if (orbf > len)                 /* is write beyond write buffer ? */
                         goto exit;
-                lwbf = len - orbf;              /* number of bytes to copy */
+                lwbf = len - orbf;              /* number of bytes to copy */
                 if (lwbf > c->wbuf_len)
                         lwbf = c->wbuf_len;
         }
@@ -923,158 +957,159 @@ exit:
         return ret;
 }
 
+#define NR_OOB_SCAN_PAGES       4
+
 /*
- *      Check, if the out of band area is empty
+ * Check, if the out of band area is empty
  */
-int jffs2_check_oob_empty( struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, int mode)
+int jffs2_check_oob_empty(struct jffs2_sb_info *c,
+                          struct jffs2_eraseblock *jeb, int mode)
 {
-        unsigned char *buf;
-        int     ret = 0;
-        int     i,len,page;
-        size_t  retlen;
-        int     oob_size;
-
-        /* allocate a buffer for all oob data in this sector */
-        oob_size = c->mtd->oobsize;
-        len = 4 * oob_size;
-        buf = kmalloc(len, GFP_KERNEL);
-        if (!buf) {
-                printk(KERN_NOTICE "jffs2_check_oob_empty(): allocation of temporary data buffer for oob check failed\n");
-                return -ENOMEM;
-        }
-        /*
-         * if mode = 0, we scan for a total empty oob area, else we have
-         * to take care of the cleanmarker in the first page of the block
-        */
-        ret = jffs2_flash_read_oob(c, jeb->offset, len , &retlen, buf);
+        int i, page, ret;
+        int oobsize = c->mtd->oobsize;
+        struct mtd_oob_ops ops;
+
+        ops.len = NR_OOB_SCAN_PAGES * oobsize;
+        ops.ooblen = oobsize;
+        ops.oobbuf = c->oobbuf;
+        ops.ooboffs = 0;
+        ops.datbuf = NULL;
+        ops.mode = MTD_OOB_PLACE;
+
+        ret = c->mtd->read_oob(c->mtd, jeb->offset, &ops);
         if (ret) {
-                D1(printk(KERN_WARNING "jffs2_check_oob_empty(): Read OOB failed %d for block at %08x\n", ret, jeb->offset));
-                goto out;
+                D1(printk(KERN_WARNING "jffs2_check_oob_empty(): Read OOB "
+                          "failed %d for block at %08x\n", ret, jeb->offset));
+                return ret;
         }
 
-        if (retlen < len) {
-                D1(printk(KERN_WARNING "jffs2_check_oob_empty(): Read OOB return short read "
-                          "(%zd bytes not %d) for block at %08x\n", retlen, len, jeb->offset));
-                ret = -EIO;
-                goto out;
+        if (ops.retlen < ops.len) {
+                D1(printk(KERN_WARNING "jffs2_check_oob_empty(): Read OOB "
+                          "returned short read (%zd bytes not %d) for block "
+                          "at %08x\n", ops.retlen, ops.len, jeb->offset));
+                return -EIO;
         }
 
         /* Special check for first page */
-        for(i = 0; i < oob_size ; i++) {
+        for(i = 0; i < oobsize ; i++) {
                 /* Yeah, we know about the cleanmarker. */
                 if (mode && i >= c->fsdata_pos &&
                     i < c->fsdata_pos + c->fsdata_len)
                         continue;
 
-                if (buf[i] != 0xFF) {
-                        D2(printk(KERN_DEBUG "Found %02x at %x in OOB for %08x\n",
-                                  buf[i], i, jeb->offset));
-                        ret = 1;
-                        goto out;
+                if (ops.oobbuf[i] != 0xFF) {
+                        D2(printk(KERN_DEBUG "Found %02x at %x in OOB for "
+                                  "%08x\n", ops.oobbuf[i], i, jeb->offset));
+                        return 1;
                 }
         }
 
         /* we know, we are aligned :) */
-        for (page = oob_size; page < len; page += sizeof(long)) {
-                unsigned long dat = *(unsigned long *)(&buf[page]);
-                if(dat != -1) {
-                        ret = 1;
-                        goto out;
-                }
+        for (page = oobsize; page < ops.len; page += sizeof(long)) {
+                long dat = *(long *)(&ops.oobbuf[page]);
+                if(dat != -1)
+                        return 1;
         }
-
-out:
-        kfree(buf);
-
-        return ret;
+        return 0;
 }
 
 /*
-*       Scan for a valid cleanmarker and for bad blocks
-*       For virtual blocks (concatenated physical blocks) check the cleanmarker
-*       only in the first page of the first physical block, but scan for bad blocks in all
-*       physical blocks
-*/
-int jffs2_check_nand_cleanmarker (struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
+ * Scan for a valid cleanmarker and for bad blocks
+ */
+int jffs2_check_nand_cleanmarker (struct jffs2_sb_info *c,
+                                  struct jffs2_eraseblock *jeb)
 {
         struct jffs2_unknown_node n;
-        unsigned char buf[2 * NAND_MAX_OOBSIZE];
-        unsigned char *p;
-        int ret, i, cnt, retval = 0;
-        size_t retlen, offset;
-        int oob_size;
-
-        offset = jeb->offset;
-        oob_size = c->mtd->oobsize;
-
-        /* Loop through the physical blocks */
-        for (cnt = 0; cnt < (c->sector_size / c->mtd->erasesize); cnt++) {
-                /* Check first if the block is bad. */
-                if (c->mtd->block_isbad (c->mtd, offset)) {
-                        D1 (printk (KERN_WARNING "jffs2_check_nand_cleanmarker(): Bad block at %08x\n", jeb->offset));
-                        return 2;
-                }
-                /*
-                   *    We read oob data from page 0 and 1 of the block.
-                   *    page 0 contains cleanmarker and badblock info
-                   *    page 1 contains failure count of this block
-                 */
-                ret = c->mtd->read_oob (c->mtd, offset, oob_size << 1, &retlen, buf);
+        struct mtd_oob_ops ops;
+        int oobsize = c->mtd->oobsize;
+        unsigned char *p,*b;
+        int i, ret;
+        size_t offset = jeb->offset;
+
+        /* Check first if the block is bad. */
+        if (c->mtd->block_isbad(c->mtd, offset)) {
+                D1 (printk(KERN_WARNING "jffs2_check_nand_cleanmarker()"
+                           ": Bad block at %08x\n", jeb->offset));
+                return 2;
+        }
 
-                if (ret) {
-                        D1 (printk (KERN_WARNING "jffs2_check_nand_cleanmarker(): Read OOB failed %d for block at %08x\n", ret, jeb->offset));
-                        return ret;
-                }
-                if (retlen < (oob_size << 1)) {
-                        D1 (printk (KERN_WARNING "jffs2_check_nand_cleanmarker(): Read OOB return short read (%zd bytes not %d) for block at %08x\n", retlen, oob_size << 1, jeb->offset));
-                        return -EIO;
-                }
+        ops.len = oobsize;
+        ops.ooblen = oobsize;
+        ops.oobbuf = c->oobbuf;
+        ops.ooboffs = 0;
+        ops.datbuf = NULL;
+        ops.mode = MTD_OOB_PLACE;
 
-                /* Check cleanmarker only on the first physical block */
-                if (!cnt) {
-                        n.magic = cpu_to_je16 (JFFS2_MAGIC_BITMASK);
-                        n.nodetype = cpu_to_je16 (JFFS2_NODETYPE_CLEANMARKER);
-                        n.totlen = cpu_to_je32 (8);
-                        p = (unsigned char *) &n;
+        ret = c->mtd->read_oob(c->mtd, offset, &ops);
+        if (ret) {
+                D1 (printk(KERN_WARNING "jffs2_check_nand_cleanmarker(): "
+                           "Read OOB failed %d for block at %08x\n",
+                           ret, jeb->offset));
+                return ret;
+        }
 
-                        for (i = 0; i < c->fsdata_len; i++) {
-                                if (buf[c->fsdata_pos + i] != p[i]) {
-                                        retval = 1;
-                                }
-                        }
-                        D1(if (retval == 1) {
-                                printk(KERN_WARNING "jffs2_check_nand_cleanmarker(): Cleanmarker node not detected in block at %08x\n", jeb->offset);
-                                printk(KERN_WARNING "OOB at %08x was ", offset);
-                                for (i=0; i < oob_size; i++) {
-                                        printk("%02x ", buf[i]);
-                                }
-                                printk("\n");
-                        })
-                }
-                offset += c->mtd->erasesize;
+        if (ops.retlen < ops.len) {
+                D1 (printk (KERN_WARNING "jffs2_check_nand_cleanmarker(): "
+                            "Read OOB return short read (%zd bytes not %d) "
+                            "for block at %08x\n", ops.retlen, ops.len,
+                            jeb->offset));
+                return -EIO;
         }
-        return retval;
+
+        n.magic = cpu_to_je16 (JFFS2_MAGIC_BITMASK);
+        n.nodetype = cpu_to_je16 (JFFS2_NODETYPE_CLEANMARKER);
+        n.totlen = cpu_to_je32 (8);
+        p = (unsigned char *) &n;
+        b = c->oobbuf + c->fsdata_pos;
+
+        for (i = c->fsdata_len; i; i--) {
+                if (*b++ != *p++)
+                        ret = 1;
+        }
+
+        D1(if (ret == 1) {
+                printk(KERN_WARNING "jffs2_check_nand_cleanmarker(): "
+                       "Cleanmarker node not detected in block at %08x\n",
+                       offset);
+                printk(KERN_WARNING "OOB at %08zx was ", offset);
+                for (i=0; i < oobsize; i++)
+                        printk("%02x ", c->oobbuf[i]);
+                printk("\n");
+        });
+        return ret;
 }
 
-int jffs2_write_nand_cleanmarker(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
+int jffs2_write_nand_cleanmarker(struct jffs2_sb_info *c,
+                                 struct jffs2_eraseblock *jeb)
 {
-        struct  jffs2_unknown_node n;
-        int     ret;
-        size_t  retlen;
+        struct jffs2_unknown_node n;
+        int     ret;
+        struct mtd_oob_ops ops;
 
         n.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
         n.nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER);
         n.totlen = cpu_to_je32(8);
 
-        ret = jffs2_flash_write_oob(c, jeb->offset + c->fsdata_pos, c->fsdata_len, &retlen, (unsigned char *)&n);
+        ops.len = c->fsdata_len;
+        ops.ooblen = c->fsdata_len;;
+        ops.oobbuf = (uint8_t *)&n;
+        ops.ooboffs = c->fsdata_pos;
+        ops.datbuf = NULL;
+        ops.mode = MTD_OOB_PLACE;
+
+        ret = c->mtd->write_oob(c->mtd, jeb->offset, &ops);
 
         if (ret) {
-                D1(printk(KERN_WARNING "jffs2_write_nand_cleanmarker(): Write failed for block at %08x: error %d\n", jeb->offset, ret));
+                D1(printk(KERN_WARNING "jffs2_write_nand_cleanmarker(): "
+                          "Write failed for block at %08x: error %d\n",
+                          jeb->offset, ret));
                 return ret;
         }
-        if (retlen != c->fsdata_len) {
-                D1(printk(KERN_WARNING "jffs2_write_nand_cleanmarker(): Short write for block at %08x: %zd not %d\n", jeb->offset, retlen, c->fsdata_len));
-                return ret;
+        if (ops.retlen != ops.len) {
+                D1(printk(KERN_WARNING "jffs2_write_nand_cleanmarker(): "
+                          "Short write for block at %08x: %zd not %d\n",
+                          jeb->offset, ops.retlen, ops.len));
+                return -EIO;
         }
         return 0;
 }
@@ -1108,18 +1143,9 @@ int jffs2_write_nand_badblock(struct jffs2_sb_info *c, struct jffs2_eraseblock *
         return 1;
 }
 
-#define NAND_JFFS2_OOB16_FSDALEN        8
-
-static struct nand_oobinfo jffs2_oobinfo_docecc = {
-        .useecc = MTD_NANDECC_PLACE,
-        .eccbytes = 6,
-        .eccpos = {0,1,2,3,4,5}
-};
-
-
 static int jffs2_nand_set_oobinfo(struct jffs2_sb_info *c)
 {
-        struct nand_oobinfo *oinfo = &c->mtd->oobinfo;
+        struct nand_ecclayout *oinfo = c->mtd->ecclayout;
 
         /* Do this only, if we have an oob buffer */
         if (!c->mtd->oobsize)
@@ -1129,33 +1155,23 @@ static int jffs2_nand_set_oobinfo(struct jffs2_sb_info *c)
         c->cleanmarker_size = 0;
 
         /* Should we use autoplacement ? */
-        if (oinfo && oinfo->useecc == MTD_NANDECC_AUTOPLACE) {
-                D1(printk(KERN_DEBUG "JFFS2 using autoplace on NAND\n"));
-                /* Get the position of the free bytes */
-                if (!oinfo->oobfree[0][1]) {
-                        printk (KERN_WARNING "jffs2_nand_set_oobinfo(): Eeep. Autoplacement selected and no empty space in oob\n");
-                        return -ENOSPC;
-                }
-                c->fsdata_pos = oinfo->oobfree[0][0];
-                c->fsdata_len = oinfo->oobfree[0][1];
-                if (c->fsdata_len > 8)
-                        c->fsdata_len = 8;
-        } else {
-                /* This is just a legacy fallback and should go away soon */
-                switch(c->mtd->ecctype) {
-                case MTD_ECC_RS_DiskOnChip:
-                        printk(KERN_WARNING "JFFS2 using DiskOnChip hardware ECC without autoplacement. Fix it!\n");
-                        c->oobinfo = &jffs2_oobinfo_docecc;
-                        c->fsdata_pos = 6;
-                        c->fsdata_len = NAND_JFFS2_OOB16_FSDALEN;
-                        c->badblock_pos = 15;
-                        break;
+        if (!oinfo) {
+                D1(printk(KERN_DEBUG "JFFS2 on NAND. No autoplacment info found\n"));
+                return -EINVAL;
+        }
 
-                default:
-                        D1(printk(KERN_DEBUG "JFFS2 on NAND. No autoplacment info found\n"));
-                        return -EINVAL;
-                }
+        D1(printk(KERN_DEBUG "JFFS2 using autoplace on NAND\n"));
+        /* Get the position of the free bytes */
+        if (!oinfo->oobfree[0].length) {
+                printk (KERN_WARNING "jffs2_nand_set_oobinfo(): Eeep."
+                        " Autoplacement selected and no empty space in oob\n");
+                return -ENOSPC;
         }
+        c->fsdata_pos = oinfo->oobfree[0].offset;
+        c->fsdata_len = oinfo->oobfree[0].length;
+        if (c->fsdata_len > 8)
+                c->fsdata_len = 8;
+
         return 0;
 }
 
@@ -1165,13 +1181,17 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
 
         /* Initialise write buffer */
         init_rwsem(&c->wbuf_sem);
-        c->wbuf_pagesize = c->mtd->oobblock;
+        c->wbuf_pagesize = c->mtd->writesize;
         c->wbuf_ofs = 0xFFFFFFFF;
 
         c->wbuf = kmalloc(c->wbuf_pagesize, GFP_KERNEL);
         if (!c->wbuf)
                 return -ENOMEM;
 
+        c->oobbuf = kmalloc(NR_OOB_SCAN_PAGES * c->mtd->oobsize, GFP_KERNEL);
+        if (!c->oobbuf)
+                return -ENOMEM;
+
         res = jffs2_nand_set_oobinfo(c);
 
 #ifdef BREAKME
@@ -1189,6 +1209,7 @@ int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
 void jffs2_nand_flash_cleanup(struct jffs2_sb_info *c)
 {
         kfree(c->wbuf);
+        kfree(c->oobbuf);
 }
 
 int jffs2_dataflash_setup(struct jffs2_sb_info *c) {
@@ -1236,33 +1257,14 @@ void jffs2_dataflash_cleanup(struct jffs2_sb_info *c) {
         kfree(c->wbuf);
 }
 
-int jffs2_nor_ecc_flash_setup(struct jffs2_sb_info *c) {
-        /* Cleanmarker is actually larger on the flashes */
-        c->cleanmarker_size = 16;
-
-        /* Initialize write buffer */
-        init_rwsem(&c->wbuf_sem);
-        c->wbuf_pagesize = c->mtd->eccsize;
-        c->wbuf_ofs = 0xFFFFFFFF;
-
-        c->wbuf = kmalloc(c->wbuf_pagesize, GFP_KERNEL);
-        if (!c->wbuf)
-                return -ENOMEM;
-
-        return 0;
-}
-
-void jffs2_nor_ecc_flash_cleanup(struct jffs2_sb_info *c) {
-        kfree(c->wbuf);
-}
-
 int jffs2_nor_wbuf_flash_setup(struct jffs2_sb_info *c) {
-        /* Cleanmarker currently occupies a whole programming region */
-        c->cleanmarker_size = MTD_PROGREGION_SIZE(c->mtd);
+        /* Cleanmarker currently occupies whole programming regions,
+         * either one or 2 for 8Byte STMicro flashes. */
+        c->cleanmarker_size = max(16u, c->mtd->writesize);
 
         /* Initialize write buffer */
         init_rwsem(&c->wbuf_sem);
-        c->wbuf_pagesize = MTD_PROGREGION_SIZE(c->mtd);
+        c->wbuf_pagesize = c->mtd->writesize;
         c->wbuf_ofs = 0xFFFFFFFF;
 
         c->wbuf = kmalloc(c->wbuf_pagesize, GFP_KERNEL);
diff --git a/fs/jffs2/write.c b/fs/jffs2/write.c
index 1342f0158e9b..67176792e138 100644
--- a/fs/jffs2/write.c
+++ b/fs/jffs2/write.c
@@ -37,7 +37,6 @@ int jffs2_do_new_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, uint
         f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
         f->inocache->state = INO_STATE_PRESENT;
 
-
         jffs2_add_ino_cache(c, f->inocache);
         D1(printk(KERN_DEBUG "jffs2_do_new_inode(): Assigned ino# %d\n", f->inocache->ino));
         ri->ino = cpu_to_je32(f->inocache->ino);
@@ -57,12 +56,14 @@ int jffs2_do_new_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, uint
 /* jffs2_write_dnode - given a raw_inode, allocate a full_dnode for it,
    write it to the flash, link it into the existing inode/fragment list */
 
-struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_raw_inode *ri, const unsigned char *data, uint32_t datalen, uint32_t flash_ofs, int alloc_mode)
+struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
+                                           struct jffs2_raw_inode *ri, const unsigned char *data,
+                                           uint32_t datalen, int alloc_mode)
 
 {
-        struct jffs2_raw_node_ref *raw;
         struct jffs2_full_dnode *fn;
         size_t retlen;
+        uint32_t flash_ofs;
         struct kvec vecs[2];
         int ret;
         int retried = 0;
@@ -78,34 +79,21 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
         vecs[1].iov_base = (unsigned char *)data;
         vecs[1].iov_len = datalen;
 
-        jffs2_dbg_prewrite_paranoia_check(c, flash_ofs, vecs[0].iov_len + vecs[1].iov_len);
-
         if (je32_to_cpu(ri->totlen) != sizeof(*ri) + datalen) {
                 printk(KERN_WARNING "jffs2_write_dnode: ri->totlen (0x%08x) != sizeof(*ri) (0x%08zx) + datalen (0x%08x)\n", je32_to_cpu(ri->totlen), sizeof(*ri), datalen);
         }
-        raw = jffs2_alloc_raw_node_ref();
-        if (!raw)
-                return ERR_PTR(-ENOMEM);
 
         fn = jffs2_alloc_full_dnode();
-        if (!fn) {
-                jffs2_free_raw_node_ref(raw);
+        if (!fn)
                 return ERR_PTR(-ENOMEM);
-        }
-
-        fn->ofs = je32_to_cpu(ri->offset);
-        fn->size = je32_to_cpu(ri->dsize);
-        fn->frags = 0;
 
         /* check number of valid vecs */
         if (!datalen || !data)
                 cnt = 1;
  retry:
-        fn->raw = raw;
+        flash_ofs = write_ofs(c);
 
-        raw->flash_offset = flash_ofs;
-        raw->__totlen = PAD(sizeof(*ri)+datalen);
-        raw->next_phys = NULL;
+        jffs2_dbg_prewrite_paranoia_check(c, flash_ofs, vecs[0].iov_len + vecs[1].iov_len);
 
         if ((alloc_mode!=ALLOC_GC) && (je32_to_cpu(ri->version) < f->highest_version)) {
                 BUG_ON(!retried);
@@ -125,22 +113,16 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
 
                 /* Mark the space as dirtied */
                 if (retlen) {
-                        /* Doesn't belong to any inode */
-                        raw->next_in_ino = NULL;
-
                         /* Don't change raw->size to match retlen. We may have
                            written the node header already, and only the data will
                            seem corrupted, in which case the scan would skip over
                            any node we write before the original intended end of
                            this node */
-                        raw->flash_offset |= REF_OBSOLETE;
-                        jffs2_add_physical_node_ref(c, raw);
-                        jffs2_mark_node_obsolete(c, raw);
+                        jffs2_add_physical_node_ref(c, flash_ofs | REF_OBSOLETE, PAD(sizeof(*ri)+datalen), NULL);
                 } else {
-                        printk(KERN_NOTICE "Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n", raw->flash_offset);
-                        jffs2_free_raw_node_ref(raw);
+                        printk(KERN_NOTICE "Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n", flash_ofs);
                 }
-                if (!retried && alloc_mode != ALLOC_NORETRY && (raw = jffs2_alloc_raw_node_ref())) {
+                if (!retried && alloc_mode != ALLOC_NORETRY) {
                         /* Try to reallocate space and retry */
                         uint32_t dummy;
                         struct jffs2_eraseblock *jeb = &c->blocks[flash_ofs / c->sector_size];
@@ -153,19 +135,20 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
                         jffs2_dbg_acct_paranoia_check(c, jeb);
 
                         if (alloc_mode == ALLOC_GC) {
-                                ret = jffs2_reserve_space_gc(c, sizeof(*ri) + datalen, &flash_ofs,
-                                                        &dummy, JFFS2_SUMMARY_INODE_SIZE);
+                                ret = jffs2_reserve_space_gc(c, sizeof(*ri) + datalen, &dummy,
+                                                             JFFS2_SUMMARY_INODE_SIZE);
                         } else {
                                 /* Locking pain */
                                 up(&f->sem);
                                 jffs2_complete_reservation(c);
 
-                                ret = jffs2_reserve_space(c, sizeof(*ri) + datalen, &flash_ofs,
-                                                        &dummy, alloc_mode, JFFS2_SUMMARY_INODE_SIZE);
+                                ret = jffs2_reserve_space(c, sizeof(*ri) + datalen, &dummy,
+                                                          alloc_mode, JFFS2_SUMMARY_INODE_SIZE);
                                 down(&f->sem);
                         }
 
                         if (!ret) {
+                                flash_ofs = write_ofs(c);
                                 D1(printk(KERN_DEBUG "Allocated space at 0x%08x to retry failed write.\n", flash_ofs));
 
                                 jffs2_dbg_acct_sanity_check(c,jeb);
@@ -174,7 +157,6 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
                                 goto retry;
                         }
                         D1(printk(KERN_DEBUG "Failed to allocate space to retry failed write: %d!\n", ret));
-                        jffs2_free_raw_node_ref(raw);
                 }
                 /* Release the full_dnode which is now useless, and return */
                 jffs2_free_full_dnode(fn);
@@ -188,20 +170,17 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
         if ((je32_to_cpu(ri->dsize) >= PAGE_CACHE_SIZE) ||
             ( ((je32_to_cpu(ri->offset)&(PAGE_CACHE_SIZE-1))==0) &&
               (je32_to_cpu(ri->dsize)+je32_to_cpu(ri->offset) ==  je32_to_cpu(ri->isize)))) {
-                raw->flash_offset |= REF_PRISTINE;
+                flash_ofs |= REF_PRISTINE;
         } else {
-                raw->flash_offset |= REF_NORMAL;
+                flash_ofs |= REF_NORMAL;
         }
-        jffs2_add_physical_node_ref(c, raw);
-
-        /* Link into per-inode list */
-        spin_lock(&c->erase_completion_lock);
-        raw->next_in_ino = f->inocache->nodes;
-        f->inocache->nodes = raw;
-        spin_unlock(&c->erase_completion_lock);
+        fn->raw = jffs2_add_physical_node_ref(c, flash_ofs, PAD(sizeof(*ri)+datalen), f->inocache);
+        fn->ofs = je32_to_cpu(ri->offset);
+        fn->size = je32_to_cpu(ri->dsize);
+        fn->frags = 0;
 
         D1(printk(KERN_DEBUG "jffs2_write_dnode wrote node at 0x%08x(%d) with dsize 0x%x, csize 0x%x, node_crc 0x%08x, data_crc 0x%08x, totlen 0x%08x\n",
-                  flash_ofs, ref_flags(raw), je32_to_cpu(ri->dsize),
+                  flash_ofs & ~3, flash_ofs & 3, je32_to_cpu(ri->dsize),
                   je32_to_cpu(ri->csize), je32_to_cpu(ri->node_crc),
                   je32_to_cpu(ri->data_crc), je32_to_cpu(ri->totlen)));
 
@@ -212,12 +191,14 @@ struct jffs2_full_dnode *jffs2_write_dnode(struct jffs2_sb_info *c, struct jffs2
         return fn;
 }
 
-struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_raw_dirent *rd, const unsigned char *name, uint32_t namelen, uint32_t flash_ofs, int alloc_mode)
+struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
+                                             struct jffs2_raw_dirent *rd, const unsigned char *name,
+                                             uint32_t namelen, int alloc_mode)
 {
-        struct jffs2_raw_node_ref *raw;
         struct jffs2_full_dirent *fd;
         size_t retlen;
         struct kvec vecs[2];
+        uint32_t flash_ofs;
         int retried = 0;
         int ret;
 
@@ -228,26 +209,16 @@ struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jff
         D1(if(je32_to_cpu(rd->hdr_crc) != crc32(0, rd, sizeof(struct jffs2_unknown_node)-4)) {
                 printk(KERN_CRIT "Eep. CRC not correct in jffs2_write_dirent()\n");
                 BUG();
-        }
-           );
+           });
 
         vecs[0].iov_base = rd;
         vecs[0].iov_len = sizeof(*rd);
         vecs[1].iov_base = (unsigned char *)name;
         vecs[1].iov_len = namelen;
 
-        jffs2_dbg_prewrite_paranoia_check(c, flash_ofs, vecs[0].iov_len + vecs[1].iov_len);
-
-        raw = jffs2_alloc_raw_node_ref();
-
-        if (!raw)
-                return ERR_PTR(-ENOMEM);
-
         fd = jffs2_alloc_full_dirent(namelen+1);
-        if (!fd) {
-                jffs2_free_raw_node_ref(raw);
+        if (!fd)
                 return ERR_PTR(-ENOMEM);
-        }
 
         fd->version = je32_to_cpu(rd->version);
         fd->ino = je32_to_cpu(rd->ino);
@@ -257,11 +228,9 @@ struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jff
         fd->name[namelen]=0;
 
  retry:
-        fd->raw = raw;
+        flash_ofs = write_ofs(c);
 
-        raw->flash_offset = flash_ofs;
-        raw->__totlen = PAD(sizeof(*rd)+namelen);
-        raw->next_phys = NULL;
+        jffs2_dbg_prewrite_paranoia_check(c, flash_ofs, vecs[0].iov_len + vecs[1].iov_len);
 
         if ((alloc_mode!=ALLOC_GC) && (je32_to_cpu(rd->version) < f->highest_version)) {
                 BUG_ON(!retried);
@@ -280,15 +249,11 @@ struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jff
                                sizeof(*rd)+namelen, flash_ofs, ret, retlen);
                 /* Mark the space as dirtied */
                 if (retlen) {
-                        raw->next_in_ino = NULL;
-                        raw->flash_offset |= REF_OBSOLETE;
-                        jffs2_add_physical_node_ref(c, raw);
-                        jffs2_mark_node_obsolete(c, raw);
+                        jffs2_add_physical_node_ref(c, flash_ofs | REF_OBSOLETE, PAD(sizeof(*rd)+namelen), NULL);
                 } else {
-                        printk(KERN_NOTICE "Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n", raw->flash_offset);
-                        jffs2_free_raw_node_ref(raw);
+                        printk(KERN_NOTICE "Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n", flash_ofs);
                 }
-                if (!retried && (raw = jffs2_alloc_raw_node_ref())) {
+                if (!retried) {
                         /* Try to reallocate space and retry */
                         uint32_t dummy;
                         struct jffs2_eraseblock *jeb = &c->blocks[flash_ofs / c->sector_size];
@@ -301,39 +266,33 @@ struct jffs2_full_dirent *jffs2_write_dirent(struct jffs2_sb_info *c, struct jff
                         jffs2_dbg_acct_paranoia_check(c, jeb);
 
                         if (alloc_mode == ALLOC_GC) {
-                                ret = jffs2_reserve_space_gc(c, sizeof(*rd) + namelen, &flash_ofs,
-                                                        &dummy, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
+                                ret = jffs2_reserve_space_gc(c, sizeof(*rd) + namelen, &dummy,
+                                                             JFFS2_SUMMARY_DIRENT_SIZE(namelen));
                         } else {
                                 /* Locking pain */
                                 up(&f->sem);
                                 jffs2_complete_reservation(c);
 
-                                ret = jffs2_reserve_space(c, sizeof(*rd) + namelen, &flash_ofs,
-                                                        &dummy, alloc_mode, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
+                                ret = jffs2_reserve_space(c, sizeof(*rd) + namelen, &dummy,
+                                                          alloc_mode, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
                                 down(&f->sem);
                         }
 
                         if (!ret) {
+                                flash_ofs = write_ofs(c);
                                 D1(printk(KERN_DEBUG "Allocated space at 0x%08x to retry failed write.\n", flash_ofs));
                                 jffs2_dbg_acct_sanity_check(c,jeb);
                                 jffs2_dbg_acct_paranoia_check(c, jeb);
                                 goto retry;
                         }
                         D1(printk(KERN_DEBUG "Failed to allocate space to retry failed write: %d!\n", ret));
-                        jffs2_free_raw_node_ref(raw);
                 }
                 /* Release the full_dnode which is now useless, and return */
                 jffs2_free_full_dirent(fd);
                 return ERR_PTR(ret?ret:-EIO);
         }
         /* Mark the space used */
-        raw->flash_offset |= REF_PRISTINE;
-        jffs2_add_physical_node_ref(c, raw);
-
-        spin_lock(&c->erase_completion_lock);
-        raw->next_in_ino = f->inocache->nodes;
-        f->inocache->nodes = raw;
-        spin_unlock(&c->erase_completion_lock);
+        fd->raw = jffs2_add_physical_node_ref(c, flash_ofs | REF_PRISTINE, PAD(sizeof(*rd)+namelen), f->inocache);
 
         if (retried) {
                 jffs2_dbg_acct_sanity_check(c,NULL);
@@ -359,14 +318,14 @@ int jffs2_write_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
                 struct jffs2_full_dnode *fn;
                 unsigned char *comprbuf = NULL;
                 uint16_t comprtype = JFFS2_COMPR_NONE;
-                uint32_t phys_ofs, alloclen;
+                uint32_t alloclen;
                 uint32_t datalen, cdatalen;
                 int retried = 0;
 
         retry:
                 D2(printk(KERN_DEBUG "jffs2_commit_write() loop: 0x%x to write to 0x%x\n", writelen, offset));
 
-                ret = jffs2_reserve_space(c, sizeof(*ri) + JFFS2_MIN_DATA_LEN, &phys_ofs,
+                ret = jffs2_reserve_space(c, sizeof(*ri) + JFFS2_MIN_DATA_LEN,
                                         &alloclen, ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
                 if (ret) {
                         D1(printk(KERN_DEBUG "jffs2_reserve_space returned %d\n", ret));
@@ -394,7 +353,7 @@ int jffs2_write_inode_range(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
                 ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
                 ri->data_crc = cpu_to_je32(crc32(0, comprbuf, cdatalen));
 
-                fn = jffs2_write_dnode(c, f, ri, comprbuf, cdatalen, phys_ofs, ALLOC_NORETRY);
+                fn = jffs2_write_dnode(c, f, ri, comprbuf, cdatalen, ALLOC_NORETRY);
 
                 jffs2_free_comprbuf(comprbuf, buf);
 
@@ -448,13 +407,13 @@ int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, str
         struct jffs2_raw_dirent *rd;
         struct jffs2_full_dnode *fn;
         struct jffs2_full_dirent *fd;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret;
 
         /* Try to reserve enough space for both node and dirent.
          * Just the node will do for now, though
          */
-        ret = jffs2_reserve_space(c, sizeof(*ri), &phys_ofs, &alloclen, ALLOC_NORMAL,
+        ret = jffs2_reserve_space(c, sizeof(*ri), &alloclen, ALLOC_NORMAL,
                                 JFFS2_SUMMARY_INODE_SIZE);
         D1(printk(KERN_DEBUG "jffs2_do_create(): reserved 0x%x bytes\n", alloclen));
         if (ret) {
@@ -465,7 +424,7 @@ int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, str
         ri->data_crc = cpu_to_je32(0);
         ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
 
-        fn = jffs2_write_dnode(c, f, ri, NULL, 0, phys_ofs, ALLOC_NORMAL);
+        fn = jffs2_write_dnode(c, f, ri, NULL, 0, ALLOC_NORMAL);
 
         D1(printk(KERN_DEBUG "jffs2_do_create created file with mode 0x%x\n",
                   jemode_to_cpu(ri->mode)));
@@ -484,7 +443,7 @@ int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, str
 
         up(&f->sem);
         jffs2_complete_reservation(c);
-        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &phys_ofs, &alloclen,
+        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                 ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
 
         if (ret) {
@@ -516,7 +475,7 @@ int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, str
         rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
         rd->name_crc = cpu_to_je32(crc32(0, name, namelen));
 
-        fd = jffs2_write_dirent(c, dir_f, rd, name, namelen, phys_ofs, ALLOC_NORMAL);
+        fd = jffs2_write_dirent(c, dir_f, rd, name, namelen, ALLOC_NORMAL);
 
         jffs2_free_raw_dirent(rd);
 
@@ -545,7 +504,7 @@ int jffs2_do_unlink(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f,
 {
         struct jffs2_raw_dirent *rd;
         struct jffs2_full_dirent *fd;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret;
 
         if (1 /* alternative branch needs testing */ ||
@@ -556,7 +515,7 @@ int jffs2_do_unlink(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f,
                 if (!rd)
                         return -ENOMEM;
 
-                ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &phys_ofs, &alloclen,
+                ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                         ALLOC_DELETION, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
                 if (ret) {
                         jffs2_free_raw_dirent(rd);
@@ -580,7 +539,7 @@ int jffs2_do_unlink(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f,
                 rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
                 rd->name_crc = cpu_to_je32(crc32(0, name, namelen));
 
-                fd = jffs2_write_dirent(c, dir_f, rd, name, namelen, phys_ofs, ALLOC_DELETION);
+                fd = jffs2_write_dirent(c, dir_f, rd, name, namelen, ALLOC_DELETION);
 
                 jffs2_free_raw_dirent(rd);
 
@@ -659,14 +618,14 @@ int jffs2_do_link (struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, uint
 {
         struct jffs2_raw_dirent *rd;
         struct jffs2_full_dirent *fd;
-        uint32_t alloclen, phys_ofs;
+        uint32_t alloclen;
         int ret;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd)
                 return -ENOMEM;
 
-        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &phys_ofs, &alloclen,
+        ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                 ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
         if (ret) {
                 jffs2_free_raw_dirent(rd);
@@ -692,7 +651,7 @@ int jffs2_do_link (struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, uint
         rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
         rd->name_crc = cpu_to_je32(crc32(0, name, namelen));
 
-        fd = jffs2_write_dirent(c, dir_f, rd, name, namelen, phys_ofs, ALLOC_NORMAL);
+        fd = jffs2_write_dirent(c, dir_f, rd, name, namelen, ALLOC_NORMAL);
 
         jffs2_free_raw_dirent(rd);
 
diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
new file mode 100644
index 000000000000..2d82e250be34
--- /dev/null
+++ b/fs/jffs2/xattr.c
@@ -0,0 +1,1238 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+#include <linux/crc32.h>
+#include <linux/jffs2.h>
+#include <linux/xattr.h>
+#include <linux/mtd/mtd.h>
+#include "nodelist.h"
+/* -------- xdatum related functions ----------------
+ * xattr_datum_hashkey(xprefix, xname, xvalue, xsize)
+ *   is used to calcurate xdatum hashkey. The reminder of hashkey into XATTRINDEX_HASHSIZE is
+ *   the index of the xattr name/value pair cache (c->xattrindex).
+ * unload_xattr_datum(c, xd)
+ *   is used to release xattr name/value pair and detach from c->xattrindex.
+ * reclaim_xattr_datum(c)
+ *   is used to reclaim xattr name/value pairs on the xattr name/value pair cache when
+ *   memory usage by cache is over c->xdatum_mem_threshold. Currentry, this threshold 
+ *   is hard coded as 32KiB.
+ * delete_xattr_datum_node(c, xd)
+ *   is used to delete a jffs2 node is dominated by xdatum. When EBS(Erase Block Summary) is
+ *   enabled, it overwrites the obsolete node by myself.
+ * delete_xattr_datum(c, xd)
+ *   is used to delete jffs2_xattr_datum object. It must be called with 0-value of reference
+ *   counter. (It means how many jffs2_xattr_ref object refers this xdatum.)
+ * do_verify_xattr_datum(c, xd)
+ *   is used to load the xdatum informations without name/value pair from the medium.
+ *   It's necessary once, because those informations are not collected during mounting
+ *   process when EBS is enabled.
+ *   0 will be returned, if success. An negative return value means recoverable error, and
+ *   positive return value means unrecoverable error. Thus, caller must remove this xdatum
+ *   and xref when it returned positive value.
+ * do_load_xattr_datum(c, xd)
+ *   is used to load name/value pair from the medium.
+ *   The meanings of return value is same as do_verify_xattr_datum().
+ * load_xattr_datum(c, xd)
+ *   is used to be as a wrapper of do_verify_xattr_datum() and do_load_xattr_datum().
+ *   If xd need to call do_verify_xattr_datum() at first, it's called before calling
+ *   do_load_xattr_datum(). The meanings of return value is same as do_verify_xattr_datum().
+ * save_xattr_datum(c, xd)
+ *   is used to write xdatum to medium. xd->version will be incremented.
+ * create_xattr_datum(c, xprefix, xname, xvalue, xsize)
+ *   is used to create new xdatum and write to medium.
+ * -------------------------------------------------- */
+
+static uint32_t xattr_datum_hashkey(int xprefix, const char *xname, const char *xvalue, int xsize)
+{
+        int name_len = strlen(xname);
+
+        return crc32(xprefix, xname, name_len) ^ crc32(xprefix, xvalue, xsize);
+}
+
+static void unload_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        D1(dbg_xattr("%s: xid=%u, version=%u\n", __FUNCTION__, xd->xid, xd->version));
+        if (xd->xname) {
+                c->xdatum_mem_usage -= (xd->name_len + 1 + xd->value_len);
+                kfree(xd->xname);
+        }
+
+        list_del_init(&xd->xindex);
+        xd->hashkey = 0;
+        xd->xname = NULL;
+        xd->xvalue = NULL;
+}
+
+static void reclaim_xattr_datum(struct jffs2_sb_info *c)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_xattr_datum *xd, *_xd;
+        uint32_t target, before;
+        static int index = 0;
+        int count;
+
+        if (c->xdatum_mem_threshold > c->xdatum_mem_usage)
+                return;
+
+        before = c->xdatum_mem_usage;
+        target = c->xdatum_mem_usage * 4 / 5; /* 20% reduction */
+        for (count = 0; count < XATTRINDEX_HASHSIZE; count++) {
+                list_for_each_entry_safe(xd, _xd, &c->xattrindex[index], xindex) {
+                        if (xd->flags & JFFS2_XFLAGS_HOT) {
+                                xd->flags &= ~JFFS2_XFLAGS_HOT;
+                        } else if (!(xd->flags & JFFS2_XFLAGS_BIND)) {
+                                unload_xattr_datum(c, xd);
+                        }
+                        if (c->xdatum_mem_usage <= target)
+                                goto out;
+                }
+                index = (index+1) % XATTRINDEX_HASHSIZE;
+        }
+ out:
+        JFFS2_NOTICE("xdatum_mem_usage from %u byte to %u byte (%u byte reclaimed)\n",
+                     before, c->xdatum_mem_usage, before - c->xdatum_mem_usage);
+}
+
+static void delete_xattr_datum_node(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_raw_xattr rx;
+        size_t length;
+        int rc;
+
+        if (!xd->node) {
+                JFFS2_WARNING("xdatum (xid=%u) is removed twice.\n", xd->xid);
+                return;
+        }
+        if (jffs2_sum_active()) {
+                memset(&rx, 0xff, sizeof(struct jffs2_raw_xattr));
+                rc = jffs2_flash_read(c, ref_offset(xd->node),
+                                      sizeof(struct jffs2_unknown_node),
+                                      &length, (char *)&rx);
+                if (rc || length != sizeof(struct jffs2_unknown_node)) {
+                        JFFS2_ERROR("jffs2_flash_read()=%d, req=%zu, read=%zu at %#08x\n",
+                                    rc, sizeof(struct jffs2_unknown_node),
+                                    length, ref_offset(xd->node));
+                }
+                rc = jffs2_flash_write(c, ref_offset(xd->node), sizeof(rx),
+                                       &length, (char *)&rx);
+                if (rc || length != sizeof(struct jffs2_raw_xattr)) {
+                        JFFS2_ERROR("jffs2_flash_write()=%d, req=%zu, wrote=%zu ar %#08x\n",
+                                    rc, sizeof(rx), length, ref_offset(xd->node));
+                }
+        }
+        spin_lock(&c->erase_completion_lock);
+        xd->node->next_in_ino = NULL;
+        spin_unlock(&c->erase_completion_lock);
+        jffs2_mark_node_obsolete(c, xd->node);
+        xd->node = NULL;
+}
+
+static void delete_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        BUG_ON(xd->refcnt);
+
+        unload_xattr_datum(c, xd);
+        if (xd->node) {
+                delete_xattr_datum_node(c, xd);
+                xd->node = NULL;
+        }
+        jffs2_free_xattr_datum(xd);
+}
+
+static int do_verify_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_eraseblock *jeb;
+        struct jffs2_raw_xattr rx;
+        size_t readlen;
+        uint32_t crc, totlen;
+        int rc;
+
+        BUG_ON(!xd->node);
+        BUG_ON(ref_flags(xd->node) != REF_UNCHECKED);
+
+        rc = jffs2_flash_read(c, ref_offset(xd->node), sizeof(rx), &readlen, (char *)&rx);
+        if (rc || readlen != sizeof(rx)) {
+                JFFS2_WARNING("jffs2_flash_read()=%d, req=%zu, read=%zu at %#08x\n",
+                              rc, sizeof(rx), readlen, ref_offset(xd->node));
+                return rc ? rc : -EIO;
+        }
+        crc = crc32(0, &rx, sizeof(rx) - 4);
+        if (crc != je32_to_cpu(rx.node_crc)) {
+                if (je32_to_cpu(rx.node_crc) != 0xffffffff)
+                        JFFS2_ERROR("node CRC failed at %#08x, read=%#08x, calc=%#08x\n",
+                                    ref_offset(xd->node), je32_to_cpu(rx.hdr_crc), crc);
+                return EIO;
+        }
+        totlen = PAD(sizeof(rx) + rx.name_len + 1 + je16_to_cpu(rx.value_len));
+        if (je16_to_cpu(rx.magic) != JFFS2_MAGIC_BITMASK
+            || je16_to_cpu(rx.nodetype) != JFFS2_NODETYPE_XATTR
+            || je32_to_cpu(rx.totlen) != totlen
+            || je32_to_cpu(rx.xid) != xd->xid
+            || je32_to_cpu(rx.version) != xd->version) {
+                JFFS2_ERROR("inconsistent xdatum at %#08x, magic=%#04x/%#04x, "
+                            "nodetype=%#04x/%#04x, totlen=%u/%u, xid=%u/%u, version=%u/%u\n",
+                            ref_offset(xd->node), je16_to_cpu(rx.magic), JFFS2_MAGIC_BITMASK,
+                            je16_to_cpu(rx.nodetype), JFFS2_NODETYPE_XATTR,
+                            je32_to_cpu(rx.totlen), totlen,
+                            je32_to_cpu(rx.xid), xd->xid,
+                            je32_to_cpu(rx.version), xd->version);
+                return EIO;
+        }
+        xd->xprefix = rx.xprefix;
+        xd->name_len = rx.name_len;
+        xd->value_len = je16_to_cpu(rx.value_len);
+        xd->data_crc = je32_to_cpu(rx.data_crc);
+
+        /* This JFFS2_NODETYPE_XATTR node is checked */
+        jeb = &c->blocks[ref_offset(xd->node) / c->sector_size];
+        totlen = PAD(je32_to_cpu(rx.totlen));
+
+        spin_lock(&c->erase_completion_lock);
+        c->unchecked_size -= totlen; c->used_size += totlen;
+        jeb->unchecked_size -= totlen; jeb->used_size += totlen;
+        xd->node->flash_offset = ref_offset(xd->node) | REF_PRISTINE;
+        spin_unlock(&c->erase_completion_lock);
+
+        /* unchecked xdatum is chained with c->xattr_unchecked */
+        list_del_init(&xd->xindex);
+
+        dbg_xattr("success on verfying xdatum (xid=%u, version=%u)\n",
+                  xd->xid, xd->version);
+
+        return 0;
+}
+
+static int do_load_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        char *data;
+        size_t readlen;
+        uint32_t crc, length;
+        int i, ret, retry = 0;
+
+        BUG_ON(!xd->node);
+        BUG_ON(ref_flags(xd->node) != REF_PRISTINE);
+        BUG_ON(!list_empty(&xd->xindex));
+ retry:
+        length = xd->name_len + 1 + xd->value_len;
+        data = kmalloc(length, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        ret = jffs2_flash_read(c, ref_offset(xd->node)+sizeof(struct jffs2_raw_xattr),
+                               length, &readlen, data);
+
+        if (ret || length!=readlen) {
+                JFFS2_WARNING("jffs2_flash_read() returned %d, request=%d, readlen=%zu, at %#08x\n",
+                              ret, length, readlen, ref_offset(xd->node));
+                kfree(data);
+                return ret ? ret : -EIO;
+        }
+
+        data[xd->name_len] = '\0';
+        crc = crc32(0, data, length);
+        if (crc != xd->data_crc) {
+                JFFS2_WARNING("node CRC failed (JFFS2_NODETYPE_XREF)"
+                              " at %#08x, read: 0x%08x calculated: 0x%08x\n",
+                              ref_offset(xd->node), xd->data_crc, crc);
+                kfree(data);
+                return EIO;
+        }
+
+        xd->flags |= JFFS2_XFLAGS_HOT;
+        xd->xname = data;
+        xd->xvalue = data + xd->name_len+1;
+
+        c->xdatum_mem_usage += length;
+
+        xd->hashkey = xattr_datum_hashkey(xd->xprefix, xd->xname, xd->xvalue, xd->value_len);
+        i = xd->hashkey % XATTRINDEX_HASHSIZE;
+        list_add(&xd->xindex, &c->xattrindex[i]);
+        if (!retry) {
+                retry = 1;
+                reclaim_xattr_datum(c);
+                if (!xd->xname)
+                        goto retry;
+        }
+
+        dbg_xattr("success on loading xdatum (xid=%u, xprefix=%u, xname='%s')\n",
+                  xd->xid, xd->xprefix, xd->xname);
+
+        return 0;
+}
+
+static int load_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem);
+         * rc < 0 : recoverable error, try again
+         * rc = 0 : success
+         * rc > 0 : Unrecoverable error, this node should be deleted.
+         */
+        int rc = 0;
+        BUG_ON(xd->xname);
+        if (!xd->node)
+                return EIO;
+        if (unlikely(ref_flags(xd->node) != REF_PRISTINE)) {
+                rc = do_verify_xattr_datum(c, xd);
+                if (rc > 0) {
+                        list_del_init(&xd->xindex);
+                        delete_xattr_datum_node(c, xd);
+                }
+        }
+        if (!rc)
+                rc = do_load_xattr_datum(c, xd);
+        return rc;
+}
+
+static int save_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_raw_node_ref *raw;
+        struct jffs2_raw_xattr rx;
+        struct kvec vecs[2];
+        size_t length;
+        int rc, totlen;
+        uint32_t phys_ofs = write_ofs(c);
+
+        BUG_ON(!xd->xname);
+
+        vecs[0].iov_base = &rx;
+        vecs[0].iov_len = PAD(sizeof(rx));
+        vecs[1].iov_base = xd->xname;
+        vecs[1].iov_len = xd->name_len + 1 + xd->value_len;
+        totlen = vecs[0].iov_len + vecs[1].iov_len;
+
+        /* Setup raw-xattr */
+        rx.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
+        rx.nodetype = cpu_to_je16(JFFS2_NODETYPE_XATTR);
+        rx.totlen = cpu_to_je32(PAD(totlen));
+        rx.hdr_crc = cpu_to_je32(crc32(0, &rx, sizeof(struct jffs2_unknown_node) - 4));
+
+        rx.xid = cpu_to_je32(xd->xid);
+        rx.version = cpu_to_je32(++xd->version);
+        rx.xprefix = xd->xprefix;
+        rx.name_len = xd->name_len;
+        rx.value_len = cpu_to_je16(xd->value_len);
+        rx.data_crc = cpu_to_je32(crc32(0, vecs[1].iov_base, vecs[1].iov_len));
+        rx.node_crc = cpu_to_je32(crc32(0, &rx, sizeof(struct jffs2_raw_xattr) - 4));
+
+        rc = jffs2_flash_writev(c, vecs, 2, phys_ofs, &length, 0);
+        if (rc || totlen != length) {
+                JFFS2_WARNING("jffs2_flash_writev()=%d, req=%u, wrote=%zu, at %#08x\n",
+                              rc, totlen, length, phys_ofs);
+                rc = rc ? rc : -EIO;
+                if (length)
+                        jffs2_add_physical_node_ref(c, phys_ofs | REF_OBSOLETE, PAD(totlen), NULL);
+
+                return rc;
+        }
+
+        /* success */
+        raw = jffs2_add_physical_node_ref(c, phys_ofs | REF_PRISTINE, PAD(totlen), NULL);
+        /* FIXME */ raw->next_in_ino = (void *)xd;
+
+        if (xd->node)
+                delete_xattr_datum_node(c, xd);
+        xd->node = raw;
+
+        dbg_xattr("success on saving xdatum (xid=%u, version=%u, xprefix=%u, xname='%s')\n",
+                  xd->xid, xd->version, xd->xprefix, xd->xname);
+
+        return 0;
+}
+
+static struct jffs2_xattr_datum *create_xattr_datum(struct jffs2_sb_info *c,
+                                                    int xprefix, const char *xname,
+                                                    const char *xvalue, int xsize)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_xattr_datum *xd;
+        uint32_t hashkey, name_len;
+        char *data;
+        int i, rc;
+
+        /* Search xattr_datum has same xname/xvalue by index */
+        hashkey = xattr_datum_hashkey(xprefix, xname, xvalue, xsize);
+        i = hashkey % XATTRINDEX_HASHSIZE;
+        list_for_each_entry(xd, &c->xattrindex[i], xindex) {
+                if (xd->hashkey==hashkey
+                    && xd->xprefix==xprefix
+                    && xd->value_len==xsize
+                    && !strcmp(xd->xname, xname)
+                    && !memcmp(xd->xvalue, xvalue, xsize)) {
+                        xd->refcnt++;
+                        return xd;
+                }
+        }
+
+        /* Not found, Create NEW XATTR-Cache */
+        name_len = strlen(xname);
+
+        xd = jffs2_alloc_xattr_datum();
+        if (!xd)
+                return ERR_PTR(-ENOMEM);
+
+        data = kmalloc(name_len + 1 + xsize, GFP_KERNEL);
+        if (!data) {
+                jffs2_free_xattr_datum(xd);
+                return ERR_PTR(-ENOMEM);
+        }
+        strcpy(data, xname);
+        memcpy(data + name_len + 1, xvalue, xsize);
+
+        xd->refcnt = 1;
+        xd->xid = ++c->highest_xid;
+        xd->flags |= JFFS2_XFLAGS_HOT;
+        xd->xprefix = xprefix;
+
+        xd->hashkey = hashkey;
+        xd->xname = data;
+        xd->xvalue = data + name_len + 1;
+        xd->name_len = name_len;
+        xd->value_len = xsize;
+        xd->data_crc = crc32(0, data, xd->name_len + 1 + xd->value_len);
+
+        rc = save_xattr_datum(c, xd);
+        if (rc) {
+                kfree(xd->xname);
+                jffs2_free_xattr_datum(xd);
+                return ERR_PTR(rc);
+        }
+
+        /* Insert Hash Index */
+        i = hashkey % XATTRINDEX_HASHSIZE;
+        list_add(&xd->xindex, &c->xattrindex[i]);
+
+        c->xdatum_mem_usage += (xd->name_len + 1 + xd->value_len);
+        reclaim_xattr_datum(c);
+
+        return xd;
+}
+
+/* -------- xref related functions ------------------
+ * verify_xattr_ref(c, ref)
+ *   is used to load xref information from medium. Because summary data does not
+ *   contain xid/ino, it's necessary to verify once while mounting process.
+ * delete_xattr_ref_node(c, ref)
+ *   is used to delete a jffs2 node is dominated by xref. When EBS is enabled,
+ *   it overwrites the obsolete node by myself. 
+ * delete_xattr_ref(c, ref)
+ *   is used to delete jffs2_xattr_ref object. If the reference counter of xdatum
+ *   is refered by this xref become 0, delete_xattr_datum() is called later.
+ * save_xattr_ref(c, ref)
+ *   is used to write xref to medium.
+ * create_xattr_ref(c, ic, xd)
+ *   is used to create a new xref and write to medium.
+ * jffs2_xattr_delete_inode(c, ic)
+ *   is called to remove xrefs related to obsolete inode when inode is unlinked.
+ * jffs2_xattr_free_inode(c, ic)
+ *   is called to release xattr related objects when unmounting. 
+ * check_xattr_ref_inode(c, ic)
+ *   is used to confirm inode does not have duplicate xattr name/value pair.
+ * -------------------------------------------------- */
+static int verify_xattr_ref(struct jffs2_sb_info *c, struct jffs2_xattr_ref *ref)
+{
+        struct jffs2_eraseblock *jeb;
+        struct jffs2_raw_xref rr;
+        size_t readlen;
+        uint32_t crc, totlen;
+        int rc;
+
+        BUG_ON(ref_flags(ref->node) != REF_UNCHECKED);
+
+        rc = jffs2_flash_read(c, ref_offset(ref->node), sizeof(rr), &readlen, (char *)&rr);
+        if (rc || sizeof(rr) != readlen) {
+                JFFS2_WARNING("jffs2_flash_read()=%d, req=%zu, read=%zu, at %#08x\n",
+                              rc, sizeof(rr), readlen, ref_offset(ref->node));
+                return rc ? rc : -EIO;
+        }
+        /* obsolete node */
+        crc = crc32(0, &rr, sizeof(rr) - 4);
+        if (crc != je32_to_cpu(rr.node_crc)) {
+                if (je32_to_cpu(rr.node_crc) != 0xffffffff)
+                        JFFS2_ERROR("node CRC failed at %#08x, read=%#08x, calc=%#08x\n",
+                                    ref_offset(ref->node), je32_to_cpu(rr.node_crc), crc);
+                return EIO;
+        }
+        if (je16_to_cpu(rr.magic) != JFFS2_MAGIC_BITMASK
+            || je16_to_cpu(rr.nodetype) != JFFS2_NODETYPE_XREF
+            || je32_to_cpu(rr.totlen) != PAD(sizeof(rr))) {
+                JFFS2_ERROR("inconsistent xref at %#08x, magic=%#04x/%#04x, "
+                            "nodetype=%#04x/%#04x, totlen=%u/%zu\n",
+                            ref_offset(ref->node), je16_to_cpu(rr.magic), JFFS2_MAGIC_BITMASK,
+                            je16_to_cpu(rr.nodetype), JFFS2_NODETYPE_XREF,
+                            je32_to_cpu(rr.totlen), PAD(sizeof(rr)));
+                return EIO;
+        }
+        ref->ino = je32_to_cpu(rr.ino);
+        ref->xid = je32_to_cpu(rr.xid);
+
+        /* fixup superblock/eraseblock info */
+        jeb = &c->blocks[ref_offset(ref->node) / c->sector_size];
+        totlen = PAD(sizeof(rr));
+
+        spin_lock(&c->erase_completion_lock);
+        c->unchecked_size -= totlen; c->used_size += totlen;
+        jeb->unchecked_size -= totlen; jeb->used_size += totlen;
+        ref->node->flash_offset = ref_offset(ref->node) | REF_PRISTINE;
+        spin_unlock(&c->erase_completion_lock);
+
+        dbg_xattr("success on verifying xref (ino=%u, xid=%u) at %#08x\n",
+                  ref->ino, ref->xid, ref_offset(ref->node));
+        return 0;
+}
+
+static void delete_xattr_ref_node(struct jffs2_sb_info *c, struct jffs2_xattr_ref *ref)
+{
+        struct jffs2_raw_xref rr;
+        size_t length;
+        int rc;
+
+        if (jffs2_sum_active()) {
+                memset(&rr, 0xff, sizeof(rr));
+                rc = jffs2_flash_read(c, ref_offset(ref->node),
+                                      sizeof(struct jffs2_unknown_node),
+                                      &length, (char *)&rr);
+                if (rc || length != sizeof(struct jffs2_unknown_node)) {
+                        JFFS2_ERROR("jffs2_flash_read()=%d, req=%zu, read=%zu at %#08x\n",
+                                    rc, sizeof(struct jffs2_unknown_node),
+                                    length, ref_offset(ref->node));
+                }
+                rc = jffs2_flash_write(c, ref_offset(ref->node), sizeof(rr),
+                                       &length, (char *)&rr);
+                if (rc || length != sizeof(struct jffs2_raw_xref)) {
+                        JFFS2_ERROR("jffs2_flash_write()=%d, req=%zu, wrote=%zu at %#08x\n",
+                                    rc, sizeof(rr), length, ref_offset(ref->node));
+                }
+        }
+        spin_lock(&c->erase_completion_lock);
+        ref->node->next_in_ino = NULL;
+        spin_unlock(&c->erase_completion_lock);
+        jffs2_mark_node_obsolete(c, ref->node);
+        ref->node = NULL;
+}
+
+static void delete_xattr_ref(struct jffs2_sb_info *c, struct jffs2_xattr_ref *ref)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_xattr_datum *xd;
+
+        BUG_ON(!ref->node);
+        delete_xattr_ref_node(c, ref);
+
+        xd = ref->xd;
+        xd->refcnt--;
+        if (!xd->refcnt)
+                delete_xattr_datum(c, xd);
+        jffs2_free_xattr_ref(ref);
+}
+
+static int save_xattr_ref(struct jffs2_sb_info *c, struct jffs2_xattr_ref *ref)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_raw_node_ref *raw;
+        struct jffs2_raw_xref rr;
+        size_t length;
+        uint32_t phys_ofs = write_ofs(c);
+        int ret;
+
+        rr.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
+        rr.nodetype = cpu_to_je16(JFFS2_NODETYPE_XREF);
+        rr.totlen = cpu_to_je32(PAD(sizeof(rr)));
+        rr.hdr_crc = cpu_to_je32(crc32(0, &rr, sizeof(struct jffs2_unknown_node) - 4));
+
+        rr.ino = cpu_to_je32(ref->ic->ino);
+        rr.xid = cpu_to_je32(ref->xd->xid);
+        rr.node_crc = cpu_to_je32(crc32(0, &rr, sizeof(rr) - 4));
+
+        ret = jffs2_flash_write(c, phys_ofs, sizeof(rr), &length, (char *)&rr);
+        if (ret || sizeof(rr) != length) {
+                JFFS2_WARNING("jffs2_flash_write() returned %d, request=%zu, retlen=%zu, at %#08x\n",
+                              ret, sizeof(rr), length, phys_ofs);
+                ret = ret ? ret : -EIO;
+                if (length)
+                        jffs2_add_physical_node_ref(c, phys_ofs | REF_OBSOLETE, PAD(sizeof(rr)), NULL);
+
+                return ret;
+        }
+
+        raw = jffs2_add_physical_node_ref(c, phys_ofs | REF_PRISTINE, PAD(sizeof(rr)), NULL);
+        /* FIXME */ raw->next_in_ino = (void *)ref;
+        if (ref->node)
+                delete_xattr_ref_node(c, ref);
+        ref->node = raw;
+
+        dbg_xattr("success on saving xref (ino=%u, xid=%u)\n", ref->ic->ino, ref->xd->xid);
+
+        return 0;
+}
+
+static struct jffs2_xattr_ref *create_xattr_ref(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic,
+                                                struct jffs2_xattr_datum *xd)
+{
+        /* must be called under down_write(xattr_sem) */
+        struct jffs2_xattr_ref *ref;
+        int ret;
+
+        ref = jffs2_alloc_xattr_ref();
+        if (!ref)
+                return ERR_PTR(-ENOMEM);
+        ref->ic = ic;
+        ref->xd = xd;
+
+        ret = save_xattr_ref(c, ref);
+        if (ret) {
+                jffs2_free_xattr_ref(ref);
+                return ERR_PTR(ret);
+        }
+
+        /* Chain to inode */
+        ref->next = ic->xref;
+        ic->xref = ref;
+
+        return ref; /* success */
+}
+
+void jffs2_xattr_delete_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
+{
+        /* It's called from jffs2_clear_inode() on inode removing.
+           When an inode with XATTR is removed, those XATTRs must be removed. */
+        struct jffs2_xattr_ref *ref, *_ref;
+
+        if (!ic || ic->nlink > 0)
+                return;
+
+        down_write(&c->xattr_sem);
+        for (ref = ic->xref; ref; ref = _ref) {
+                _ref = ref->next;
+                delete_xattr_ref(c, ref);
+        }
+        ic->xref = NULL;
+        up_write(&c->xattr_sem);
+}
+
+void jffs2_xattr_free_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
+{
+        /* It's called from jffs2_free_ino_caches() until unmounting FS. */
+        struct jffs2_xattr_datum *xd;
+        struct jffs2_xattr_ref *ref, *_ref;
+
+        down_write(&c->xattr_sem);
+        for (ref = ic->xref; ref; ref = _ref) {
+                _ref = ref->next;
+                xd = ref->xd;
+                xd->refcnt--;
+                if (!xd->refcnt) {
+                        unload_xattr_datum(c, xd);
+                        jffs2_free_xattr_datum(xd);
+                }
+                jffs2_free_xattr_ref(ref);
+        }
+        ic->xref = NULL;
+        up_write(&c->xattr_sem);
+}
+
+static int check_xattr_ref_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
+{
+        /* success of check_xattr_ref_inode() means taht inode (ic) dose not have
+         * duplicate name/value pairs. If duplicate name/value pair would be found,
+         * one will be removed.
+         */
+        struct jffs2_xattr_ref *ref, *cmp, **pref;
+        int rc = 0;
+
+        if (likely(ic->flags & INO_FLAGS_XATTR_CHECKED))
+                return 0;
+        down_write(&c->xattr_sem);
+ retry:
+        rc = 0;
+        for (ref=ic->xref, pref=&ic->xref; ref; pref=&ref->next, ref=ref->next) {
+                if (!ref->xd->xname) {
+                        rc = load_xattr_datum(c, ref->xd);
+                        if (unlikely(rc > 0)) {
+                                *pref = ref->next;
+                                delete_xattr_ref(c, ref);
+                                goto retry;
+                        } else if (unlikely(rc < 0))
+                                goto out;
+                }
+                for (cmp=ref->next, pref=&ref->next; cmp; pref=&cmp->next, cmp=cmp->next) {
+                        if (!cmp->xd->xname) {
+                                ref->xd->flags |= JFFS2_XFLAGS_BIND;
+                                rc = load_xattr_datum(c, cmp->xd);
+                                ref->xd->flags &= ~JFFS2_XFLAGS_BIND;
+                                if (unlikely(rc > 0)) {
+                                        *pref = cmp->next;
+                                        delete_xattr_ref(c, cmp);
+                                        goto retry;
+                                } else if (unlikely(rc < 0))
+                                        goto out;
+                        }
+                        if (ref->xd->xprefix == cmp->xd->xprefix
+                            && !strcmp(ref->xd->xname, cmp->xd->xname)) {
+                                *pref = cmp->next;
+                                delete_xattr_ref(c, cmp);
+                                goto retry;
+                        }
+                }
+        }
+        ic->flags |= INO_FLAGS_XATTR_CHECKED;
+ out:
+        up_write(&c->xattr_sem);
+
+        return rc;
+}
+
+/* -------- xattr subsystem functions ---------------
+ * jffs2_init_xattr_subsystem(c)
+ *   is used to initialize semaphore and list_head, and some variables.
+ * jffs2_find_xattr_datum(c, xid)
+ *   is used to lookup xdatum while scanning process.
+ * jffs2_clear_xattr_subsystem(c)
+ *   is used to release any xattr related objects.
+ * jffs2_build_xattr_subsystem(c)
+ *   is used to associate xdatum and xref while super block building process.
+ * jffs2_setup_xattr_datum(c, xid, version)
+ *   is used to insert xdatum while scanning process.
+ * -------------------------------------------------- */
+void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c)
+{
+        int i;
+
+        for (i=0; i < XATTRINDEX_HASHSIZE; i++)
+                INIT_LIST_HEAD(&c->xattrindex[i]);
+        INIT_LIST_HEAD(&c->xattr_unchecked);
+        c->xref_temp = NULL;
+
+        init_rwsem(&c->xattr_sem);
+        c->xdatum_mem_usage = 0;
+        c->xdatum_mem_threshold = 32 * 1024;    /* Default 32KB */
+}
+
+static struct jffs2_xattr_datum *jffs2_find_xattr_datum(struct jffs2_sb_info *c, uint32_t xid)
+{
+        struct jffs2_xattr_datum *xd;
+        int i = xid % XATTRINDEX_HASHSIZE;
+
+        /* It's only used in scanning/building process. */
+        BUG_ON(!(c->flags & (JFFS2_SB_FLAG_SCANNING|JFFS2_SB_FLAG_BUILDING)));
+
+        list_for_each_entry(xd, &c->xattrindex[i], xindex) {
+                if (xd->xid==xid)
+                        return xd;
+        }
+        return NULL;
+}
+
+void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c)
+{
+        struct jffs2_xattr_datum *xd, *_xd;
+        struct jffs2_xattr_ref *ref, *_ref;
+        int i;
+
+        for (ref=c->xref_temp; ref; ref = _ref) {
+                _ref = ref->next;
+                jffs2_free_xattr_ref(ref);
+        }
+        c->xref_temp = NULL;
+
+        for (i=0; i < XATTRINDEX_HASHSIZE; i++) {
+                list_for_each_entry_safe(xd, _xd, &c->xattrindex[i], xindex) {
+                        list_del(&xd->xindex);
+                        if (xd->xname)
+                                kfree(xd->xname);
+                        jffs2_free_xattr_datum(xd);
+                }
+        }
+}
+
+void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+{
+        struct jffs2_xattr_ref *ref, *_ref;
+        struct jffs2_xattr_datum *xd, *_xd;
+        struct jffs2_inode_cache *ic;
+        int i, xdatum_count =0, xdatum_unchecked_count = 0, xref_count = 0;
+
+        BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+
+        /* Phase.1 */
+        for (ref=c->xref_temp; ref; ref=_ref) {
+                _ref = ref->next;
+                /* checking REF_UNCHECKED nodes */
+                if (ref_flags(ref->node) != REF_PRISTINE) {
+                        if (verify_xattr_ref(c, ref)) {
+                                delete_xattr_ref_node(c, ref);
+                                jffs2_free_xattr_ref(ref);
+                                continue;
+                        }
+                }
+                /* At this point, ref->xid and ref->ino contain XID and inode number.
+                   ref->xd and ref->ic are not valid yet. */
+                xd = jffs2_find_xattr_datum(c, ref->xid);
+                ic = jffs2_get_ino_cache(c, ref->ino);
+                if (!xd || !ic) {
+                        if (ref_flags(ref->node) != REF_UNCHECKED)
+                                JFFS2_WARNING("xref(ino=%u, xid=%u) is orphan. \n",
+                                              ref->ino, ref->xid);
+                        delete_xattr_ref_node(c, ref);
+                        jffs2_free_xattr_ref(ref);
+                        continue;
+                }
+                ref->xd = xd;
+                ref->ic = ic;
+                xd->refcnt++;
+                ref->next = ic->xref;
+                ic->xref = ref;
+                xref_count++;
+        }
+        c->xref_temp = NULL;
+        /* After this, ref->xid/ino are NEVER used. */
+
+        /* Phase.2 */
+        for (i=0; i < XATTRINDEX_HASHSIZE; i++) {
+                list_for_each_entry_safe(xd, _xd, &c->xattrindex[i], xindex) {
+                        list_del_init(&xd->xindex);
+                        if (!xd->refcnt) {
+                                if (ref_flags(xd->node) != REF_UNCHECKED)
+                                        JFFS2_WARNING("orphan xdatum(xid=%u, version=%u) at %#08x\n",
+                                                      xd->xid, xd->version, ref_offset(xd->node));
+                                delete_xattr_datum(c, xd);
+                                continue;
+                        }
+                        if (ref_flags(xd->node) != REF_PRISTINE) {
+                                dbg_xattr("unchecked xdatum(xid=%u) at %#08x\n",
+                                          xd->xid, ref_offset(xd->node));
+                                list_add(&xd->xindex, &c->xattr_unchecked);
+                                xdatum_unchecked_count++;
+                        }
+                        xdatum_count++;
+                }
+        }
+        /* build complete */
+        JFFS2_NOTICE("complete building xattr subsystem, %u of xdatum (%u unchecked) and "
+                     "%u of xref found.\n", xdatum_count, xdatum_unchecked_count, xref_count);
+}
+
+struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+                                                  uint32_t xid, uint32_t version)
+{
+        struct jffs2_xattr_datum *xd, *_xd;
+
+        _xd = jffs2_find_xattr_datum(c, xid);
+        if (_xd) {
+                dbg_xattr("duplicate xdatum (xid=%u, version=%u/%u) at %#08x\n",
+                          xid, version, _xd->version, ref_offset(_xd->node));
+                if (version < _xd->version)
+                        return ERR_PTR(-EEXIST);
+        }
+        xd = jffs2_alloc_xattr_datum();
+        if (!xd)
+                return ERR_PTR(-ENOMEM);
+        xd->xid = xid;
+        xd->version = version;
+        if (xd->xid > c->highest_xid)
+                c->highest_xid = xd->xid;
+        list_add_tail(&xd->xindex, &c->xattrindex[xid % XATTRINDEX_HASHSIZE]);
+
+        if (_xd) {
+                list_del_init(&_xd->xindex);
+                delete_xattr_datum_node(c, _xd);
+                jffs2_free_xattr_datum(_xd);
+        }
+        return xd;
+}
+
+/* -------- xattr subsystem functions ---------------
+ * xprefix_to_handler(xprefix)
+ *   is used to translate xprefix into xattr_handler.
+ * jffs2_listxattr(dentry, buffer, size)
+ *   is an implementation of listxattr handler on jffs2.
+ * do_jffs2_getxattr(inode, xprefix, xname, buffer, size)
+ *   is an implementation of getxattr handler on jffs2.
+ * do_jffs2_setxattr(inode, xprefix, xname, buffer, size, flags)
+ *   is an implementation of setxattr handler on jffs2.
+ * -------------------------------------------------- */
+struct xattr_handler *jffs2_xattr_handlers[] = {
+        &jffs2_user_xattr_handler,
+#ifdef CONFIG_JFFS2_FS_SECURITY
+        &jffs2_security_xattr_handler,
+#endif
+#ifdef CONFIG_JFFS2_FS_POSIX_ACL
+        &jffs2_acl_access_xattr_handler,
+        &jffs2_acl_default_xattr_handler,
+#endif
+        &jffs2_trusted_xattr_handler,
+        NULL
+};
+
+static struct xattr_handler *xprefix_to_handler(int xprefix) {
+        struct xattr_handler *ret;
+
+        switch (xprefix) {
+        case JFFS2_XPREFIX_USER:
+                ret = &jffs2_user_xattr_handler;
+                break;
+#ifdef CONFIG_JFFS2_FS_SECURITY
+        case JFFS2_XPREFIX_SECURITY:
+                ret = &jffs2_security_xattr_handler;
+                break;
+#endif
+#ifdef CONFIG_JFFS2_FS_POSIX_ACL
+        case JFFS2_XPREFIX_ACL_ACCESS:
+                ret = &jffs2_acl_access_xattr_handler;
+                break;
+        case JFFS2_XPREFIX_ACL_DEFAULT:
+                ret = &jffs2_acl_default_xattr_handler;
+                break;
+#endif
+        case JFFS2_XPREFIX_TRUSTED:
+                ret = &jffs2_trusted_xattr_handler;
+                break;
+        default:
+                ret = NULL;
+                break;
+        }
+        return ret;
+}
+
+ssize_t jffs2_listxattr(struct dentry *dentry, char *buffer, size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+        struct jffs2_inode_cache *ic = f->inocache;
+        struct jffs2_xattr_ref *ref, **pref;
+        struct jffs2_xattr_datum *xd;
+        struct xattr_handler *xhandle;
+        ssize_t len, rc;
+        int retry = 0;
+
+        rc = check_xattr_ref_inode(c, ic);
+        if (unlikely(rc))
+                return rc;
+
+        down_read(&c->xattr_sem);
+ retry:
+        len = 0;
+        for (ref=ic->xref, pref=&ic->xref; ref; pref=&ref->next, ref=ref->next) {
+                BUG_ON(ref->ic != ic);
+                xd = ref->xd;
+                if (!xd->xname) {
+                        /* xdatum is unchached */
+                        if (!retry) {
+                                retry = 1;
+                                up_read(&c->xattr_sem);
+                                down_write(&c->xattr_sem);
+                                goto retry;
+                        } else {
+                                rc = load_xattr_datum(c, xd);
+                                if (unlikely(rc > 0)) {
+                                        *pref = ref->next;
+                                        delete_xattr_ref(c, ref);
+                                        goto retry;
+                                } else if (unlikely(rc < 0))
+                                        goto out;
+                        }
+                }
+                xhandle = xprefix_to_handler(xd->xprefix);
+                if (!xhandle)
+                        continue;
+                if (buffer) {
+                        rc = xhandle->list(inode, buffer+len, size-len, xd->xname, xd->name_len);
+                } else {
+                        rc = xhandle->list(inode, NULL, 0, xd->xname, xd->name_len);
+                }
+                if (rc < 0)
+                        goto out;
+                len += rc;
+        }
+        rc = len;
+ out:
+        if (!retry) {
+                up_read(&c->xattr_sem);
+        } else {
+                up_write(&c->xattr_sem);
+        }
+        return rc;
+}
+
+int do_jffs2_getxattr(struct inode *inode, int xprefix, const char *xname,
+                      char *buffer, size_t size)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+        struct jffs2_inode_cache *ic = f->inocache;
+        struct jffs2_xattr_datum *xd;
+        struct jffs2_xattr_ref *ref, **pref;
+        int rc, retry = 0;
+
+        rc = check_xattr_ref_inode(c, ic);
+        if (unlikely(rc))
+                return rc;
+
+        down_read(&c->xattr_sem);
+ retry:
+        for (ref=ic->xref, pref=&ic->xref; ref; pref=&ref->next, ref=ref->next) {
+                BUG_ON(ref->ic!=ic);
+
+                xd = ref->xd;
+                if (xd->xprefix != xprefix)
+                        continue;
+                if (!xd->xname) {
+                        /* xdatum is unchached */
+                        if (!retry) {
+                                retry = 1;
+                                up_read(&c->xattr_sem);
+                                down_write(&c->xattr_sem);
+                                goto retry;
+                        } else {
+                                rc = load_xattr_datum(c, xd);
+                                if (unlikely(rc > 0)) {
+                                        *pref = ref->next;
+                                        delete_xattr_ref(c, ref);
+                                        goto retry;
+                                } else if (unlikely(rc < 0)) {
+                                        goto out;
+                                }
+                        }
+                }
+                if (!strcmp(xname, xd->xname)) {
+                        rc = xd->value_len;
+                        if (buffer) {
+                                if (size < rc) {
+                                        rc = -ERANGE;
+                                } else {
+                                        memcpy(buffer, xd->xvalue, rc);
+                                }
+                        }
+                        goto out;
+                }
+        }
+        rc = -ENODATA;
+ out:
+        if (!retry) {
+                up_read(&c->xattr_sem);
+        } else {
+                up_write(&c->xattr_sem);
+        }
+        return rc;
+}
+
+int do_jffs2_setxattr(struct inode *inode, int xprefix, const char *xname,
+                      const char *buffer, size_t size, int flags)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+        struct jffs2_inode_cache *ic = f->inocache;
+        struct jffs2_xattr_datum *xd;
+        struct jffs2_xattr_ref *ref, *newref, **pref;
+        uint32_t length, request;
+        int rc;
+
+        rc = check_xattr_ref_inode(c, ic);
+        if (unlikely(rc))
+                return rc;
+
+        request = PAD(sizeof(struct jffs2_raw_xattr) + strlen(xname) + 1 + size);
+        rc = jffs2_reserve_space(c, request, &length,
+                                 ALLOC_NORMAL, JFFS2_SUMMARY_XATTR_SIZE);
+        if (rc) {
+                JFFS2_WARNING("jffs2_reserve_space()=%d, request=%u\n", rc, request);
+                return rc;
+        }
+
+        /* Find existing xattr */
+        down_write(&c->xattr_sem);
+ retry:
+        for (ref=ic->xref, pref=&ic->xref; ref; pref=&ref->next, ref=ref->next) {
+                xd = ref->xd;
+                if (xd->xprefix != xprefix)
+                        continue;
+                if (!xd->xname) {
+                        rc = load_xattr_datum(c, xd);
+                        if (unlikely(rc > 0)) {
+                                *pref = ref->next;
+                                delete_xattr_ref(c, ref);
+                                goto retry;
+                        } else if (unlikely(rc < 0))
+                                goto out;
+                }
+                if (!strcmp(xd->xname, xname)) {
+                        if (flags & XATTR_CREATE) {
+                                rc = -EEXIST;
+                                goto out;
+                        }
+                        if (!buffer) {
+                                *pref = ref->next;
+                                delete_xattr_ref(c, ref);
+                                rc = 0;
+                                goto out;
+                        }
+                        goto found;
+                }
+        }
+        /* not found */
+        if (flags & XATTR_REPLACE) {
+                rc = -ENODATA;
+                goto out;
+        }
+        if (!buffer) {
+                rc = -EINVAL;
+                goto out;
+        }
+ found:
+        xd = create_xattr_datum(c, xprefix, xname, buffer, size);
+        if (IS_ERR(xd)) {
+                rc = PTR_ERR(xd);
+                goto out;
+        }
+        up_write(&c->xattr_sem);
+        jffs2_complete_reservation(c);
+
+        /* create xattr_ref */
+        request = PAD(sizeof(struct jffs2_raw_xref));
+        rc = jffs2_reserve_space(c, request, &length,
+                                 ALLOC_NORMAL, JFFS2_SUMMARY_XREF_SIZE);
+        if (rc) {
+                JFFS2_WARNING("jffs2_reserve_space()=%d, request=%u\n", rc, request);
+                down_write(&c->xattr_sem);
+                xd->refcnt--;
+                if (!xd->refcnt)
+                        delete_xattr_datum(c, xd);
+                up_write(&c->xattr_sem);
+                return rc;
+        }
+        down_write(&c->xattr_sem);
+        if (ref)
+                *pref = ref->next;
+        newref = create_xattr_ref(c, ic, xd);
+        if (IS_ERR(newref)) {
+                if (ref) {
+                        ref->next = ic->xref;
+                        ic->xref = ref;
+                }
+                rc = PTR_ERR(newref);
+                xd->refcnt--;
+                if (!xd->refcnt)
+                        delete_xattr_datum(c, xd);
+        } else if (ref) {
+                delete_xattr_ref(c, ref);
+        }
+ out:
+        up_write(&c->xattr_sem);
+        jffs2_complete_reservation(c);
+        return rc;
+}
+
+/* -------- garbage collector functions -------------
+ * jffs2_garbage_collect_xattr_datum(c, xd)
+ *   is used to move xdatum into new node.
+ * jffs2_garbage_collect_xattr_ref(c, ref)
+ *   is used to move xref into new node.
+ * jffs2_verify_xattr(c)
+ *   is used to call do_verify_xattr_datum() before garbage collecting.
+ * -------------------------------------------------- */
+int jffs2_garbage_collect_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd)
+{
+        uint32_t totlen, length, old_ofs;
+        int rc = -EINVAL;
+
+        down_write(&c->xattr_sem);
+        BUG_ON(!xd->node);
+
+        old_ofs = ref_offset(xd->node);
+        totlen = ref_totlen(c, c->gcblock, xd->node);
+        if (totlen < sizeof(struct jffs2_raw_xattr))
+                goto out;
+
+        if (!xd->xname) {
+                rc = load_xattr_datum(c, xd);
+                if (unlikely(rc > 0)) {
+                        delete_xattr_datum_node(c, xd);
+                        rc = 0;
+                        goto out;
+                } else if (unlikely(rc < 0))
+                        goto out;
+        }
+        rc = jffs2_reserve_space_gc(c, totlen, &length, JFFS2_SUMMARY_XATTR_SIZE);
+        if (rc || length < totlen) {
+                JFFS2_WARNING("jffs2_reserve_space()=%d, request=%u\n", rc, totlen);
+                rc = rc ? rc : -EBADFD;
+                goto out;
+        }
+        rc = save_xattr_datum(c, xd);
+        if (!rc)
+                dbg_xattr("xdatum (xid=%u, version=%u) GC'ed from %#08x to %08x\n",
+                          xd->xid, xd->version, old_ofs, ref_offset(xd->node));
+ out:
+        up_write(&c->xattr_sem);
+        return rc;
+}
+
+
+int jffs2_garbage_collect_xattr_ref(struct jffs2_sb_info *c, struct jffs2_xattr_ref *ref)
+{
+        uint32_t totlen, length, old_ofs;
+        int rc = -EINVAL;
+
+        down_write(&c->xattr_sem);
+        BUG_ON(!ref->node);
+
+        old_ofs = ref_offset(ref->node);
+        totlen = ref_totlen(c, c->gcblock, ref->node);
+        if (totlen != sizeof(struct jffs2_raw_xref))
+                goto out;
+
+        rc = jffs2_reserve_space_gc(c, totlen, &length, JFFS2_SUMMARY_XREF_SIZE);
+        if (rc || length < totlen) {
+                JFFS2_WARNING("%s: jffs2_reserve_space() = %d, request = %u\n",
+                              __FUNCTION__, rc, totlen);
+                rc = rc ? rc : -EBADFD;
+                goto out;
+        }
+        rc = save_xattr_ref(c, ref);
+        if (!rc)
+                dbg_xattr("xref (ino=%u, xid=%u) GC'ed from %#08x to %08x\n",
+                          ref->ic->ino, ref->xd->xid, old_ofs, ref_offset(ref->node));
+ out:
+        up_write(&c->xattr_sem);
+        return rc;
+}
+
+int jffs2_verify_xattr(struct jffs2_sb_info *c)
+{
+        struct jffs2_xattr_datum *xd, *_xd;
+        int rc;
+
+        down_write(&c->xattr_sem);
+        list_for_each_entry_safe(xd, _xd, &c->xattr_unchecked, xindex) {
+                rc = do_verify_xattr_datum(c, xd);
+                if (rc == 0) {
+                        list_del_init(&xd->xindex);
+                        break;
+                } else if (rc > 0) {
+                        list_del_init(&xd->xindex);
+                        delete_xattr_datum_node(c, xd);
+                }
+        }
+        up_write(&c->xattr_sem);
+
+        return list_empty(&c->xattr_unchecked) ? 1 : 0;
+}
diff --git a/fs/jffs2/xattr.h b/fs/jffs2/xattr.h
new file mode 100644
index 000000000000..2c199856c582
--- /dev/null
+++ b/fs/jffs2/xattr.h
@@ -0,0 +1,116 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+#ifndef _JFFS2_FS_XATTR_H_
+#define _JFFS2_FS_XATTR_H_
+
+#include <linux/xattr.h>
+#include <linux/list.h>
+
+#define JFFS2_XFLAGS_HOT        (0x01)  /* This datum is HOT */
+#define JFFS2_XFLAGS_BIND       (0x02)  /* This datum is not reclaimed */
+
+struct jffs2_xattr_datum
+{
+        void *always_null;
+        struct jffs2_raw_node_ref *node;
+        uint8_t class;
+        uint8_t flags;
+        uint16_t xprefix;                       /* see JFFS2_XATTR_PREFIX_* */
+
+        struct list_head xindex;        /* chained from c->xattrindex[n] */
+        uint32_t refcnt;                /* # of xattr_ref refers this */
+        uint32_t xid;
+        uint32_t version;
+
+        uint32_t data_crc;
+        uint32_t hashkey;
+        char *xname;            /* XATTR name without prefix */
+        uint32_t name_len;      /* length of xname */
+        char *xvalue;           /* XATTR value */
+        uint32_t value_len;     /* length of xvalue */
+};
+
+struct jffs2_inode_cache;
+struct jffs2_xattr_ref
+{
+        void *always_null;
+        struct jffs2_raw_node_ref *node;
+        uint8_t class;
+        uint8_t flags;          /* Currently unused */
+        u16 unused;
+
+        union {
+                struct jffs2_inode_cache *ic;   /* reference to jffs2_inode_cache */
+                uint32_t ino;                   /* only used in scanning/building  */
+        };
+        union {
+                struct jffs2_xattr_datum *xd;   /* reference to jffs2_xattr_datum */
+                uint32_t xid;                   /* only used in sccanning/building */
+        };
+        struct jffs2_xattr_ref *next;           /* chained from ic->xref_list */
+};
+
+#ifdef CONFIG_JFFS2_FS_XATTR
+
+extern void jffs2_init_xattr_subsystem(struct jffs2_sb_info *c);
+extern void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c);
+extern void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c);
+
+extern struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,
+                                                  uint32_t xid, uint32_t version);
+
+extern void jffs2_xattr_delete_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic);
+extern void jffs2_xattr_free_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic);
+
+extern int jffs2_garbage_collect_xattr_datum(struct jffs2_sb_info *c, struct jffs2_xattr_datum *xd);
+extern int jffs2_garbage_collect_xattr_ref(struct jffs2_sb_info *c, struct jffs2_xattr_ref *ref);
+extern int jffs2_verify_xattr(struct jffs2_sb_info *c);
+
+extern int do_jffs2_getxattr(struct inode *inode, int xprefix, const char *xname,
+                             char *buffer, size_t size);
+extern int do_jffs2_setxattr(struct inode *inode, int xprefix, const char *xname,
+                             const char *buffer, size_t size, int flags);
+
+extern struct xattr_handler *jffs2_xattr_handlers[];
+extern struct xattr_handler jffs2_user_xattr_handler;
+extern struct xattr_handler jffs2_trusted_xattr_handler;
+
+extern ssize_t jffs2_listxattr(struct dentry *, char *, size_t);
+#define jffs2_getxattr          generic_getxattr
+#define jffs2_setxattr          generic_setxattr
+#define jffs2_removexattr       generic_removexattr
+
+#else
+
+#define jffs2_init_xattr_subsystem(c)
+#define jffs2_build_xattr_subsystem(c)
+#define jffs2_clear_xattr_subsystem(c)
+
+#define jffs2_xattr_delete_inode(c, ic)
+#define jffs2_xattr_free_inode(c, ic)
+#define jffs2_verify_xattr(c)                   (1)
+
+#define jffs2_xattr_handlers    NULL
+#define jffs2_listxattr         NULL
+#define jffs2_getxattr          NULL
+#define jffs2_setxattr          NULL
+#define jffs2_removexattr       NULL
+
+#endif /* CONFIG_JFFS2_FS_XATTR */
+
+#ifdef CONFIG_JFFS2_FS_SECURITY
+extern int jffs2_init_security(struct inode *inode, struct inode *dir);
+extern struct xattr_handler jffs2_security_xattr_handler;
+#else
+#define jffs2_init_security(inode,dir)  (0)
+#endif /* CONFIG_JFFS2_FS_SECURITY */
+
+#endif /* _JFFS2_FS_XATTR_H_ */
diff --git a/fs/jffs2/xattr_trusted.c b/fs/jffs2/xattr_trusted.c
new file mode 100644
index 000000000000..ed046e19dbfa
--- /dev/null
+++ b/fs/jffs2/xattr_trusted.c
@@ -0,0 +1,52 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/jffs2.h>
+#include <linux/xattr.h>
+#include <linux/mtd/mtd.h>
+#include "nodelist.h"
+
+static int jffs2_trusted_getxattr(struct inode *inode, const char *name,
+                                  void *buffer, size_t size)
+{
+        if (!strcmp(name, ""))
+                return -EINVAL;
+        return do_jffs2_getxattr(inode, JFFS2_XPREFIX_TRUSTED, name, buffer, size);
+}
+
+static int jffs2_trusted_setxattr(struct inode *inode, const char *name, const void *buffer,
+                                  size_t size, int flags)
+{
+        if (!strcmp(name, ""))
+                return -EINVAL;
+        return do_jffs2_setxattr(inode, JFFS2_XPREFIX_TRUSTED, name, buffer, size, flags);
+}
+
+static size_t jffs2_trusted_listxattr(struct inode *inode, char *list, size_t list_size,
+                                      const char *name, size_t name_len)
+{
+        size_t retlen = XATTR_TRUSTED_PREFIX_LEN + name_len + 1;
+
+        if (list && retlen<=list_size) {
+                strcpy(list, XATTR_TRUSTED_PREFIX);
+                strcpy(list + XATTR_TRUSTED_PREFIX_LEN, name);
+        }
+
+        return retlen;
+}
+
+struct xattr_handler jffs2_trusted_xattr_handler = {
+        .prefix = XATTR_TRUSTED_PREFIX,
+        .list = jffs2_trusted_listxattr,
+        .set = jffs2_trusted_setxattr,
+        .get = jffs2_trusted_getxattr
+};
diff --git a/fs/jffs2/xattr_user.c b/fs/jffs2/xattr_user.c
new file mode 100644
index 000000000000..2f8e9aa01ea0
--- /dev/null
+++ b/fs/jffs2/xattr_user.c
@@ -0,0 +1,52 @@
+/*
+ * JFFS2 -- Journalling Flash File System, Version 2.
+ *
+ * Copyright (C) 2006  NEC Corporation
+ *
+ * Created by KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * For licensing information, see the file 'LICENCE' in this directory.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/jffs2.h>
+#include <linux/xattr.h>
+#include <linux/mtd/mtd.h>
+#include "nodelist.h"
+
+static int jffs2_user_getxattr(struct inode *inode, const char *name,
+                               void *buffer, size_t size)
+{
+        if (!strcmp(name, ""))
+                return -EINVAL;
+        return do_jffs2_getxattr(inode, JFFS2_XPREFIX_USER, name, buffer, size);
+}
+
+static int jffs2_user_setxattr(struct inode *inode, const char *name, const void *buffer,
+                               size_t size, int flags)
+{
+        if (!strcmp(name, ""))
+                return -EINVAL;
+        return do_jffs2_setxattr(inode, JFFS2_XPREFIX_USER, name, buffer, size, flags);
+}
+
+static size_t jffs2_user_listxattr(struct inode *inode, char *list, size_t list_size,
+                                   const char *name, size_t name_len)
+{
+        size_t retlen = XATTR_USER_PREFIX_LEN + name_len + 1;
+
+        if (list && retlen <= list_size) {
+                strcpy(list, XATTR_USER_PREFIX);
+                strcpy(list + XATTR_USER_PREFIX_LEN, name);
+        }
+
+        return retlen;
+}
+
+struct xattr_handler jffs2_user_xattr_handler = {
+        .prefix = XATTR_USER_PREFIX,
+        .list = jffs2_user_listxattr,
+        .set = jffs2_user_setxattr,
+        .get = jffs2_user_getxattr
+};
diff --git a/fs/namei.c b/fs/namei.c
index d6e2ee251736..184fe4acf824 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1127,7 +1127,7 @@ out:
         if (likely(retval == 0)) {
                 if (unlikely(current->audit_context && nd && nd->dentry &&
                                 nd->dentry->d_inode))
-                audit_inode(name, nd->dentry->d_inode, flags);
+                audit_inode(name, nd->dentry->d_inode);
         }
 out_fail:
         return retval;
diff --git a/fs/open.c b/fs/open.c
index 317b7c7f38a7..4f178acd4c09 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -633,7 +633,7 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
         dentry = file->f_dentry;
         inode = dentry->d_inode;
 
-        audit_inode(NULL, inode, 0);
+        audit_inode(NULL, inode);
 
         err = -EROFS;
         if (IS_RDONLY(inode))
@@ -786,7 +786,7 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
         if (file) {
                 struct dentry * dentry;
                 dentry = file->f_dentry;
-                audit_inode(NULL, dentry->d_inode, 0);
+                audit_inode(NULL, dentry->d_inode);
                 error = chown_common(dentry, user, group);
                 fput(file);
         }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 6cc77dc3f3ff..6afff725a8c9 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1019,8 +1019,8 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
         if (current != task)
                 return -EPERM;
 
-        if (count > PAGE_SIZE)
-                count = PAGE_SIZE;
+        if (count >= PAGE_SIZE)
+                count = PAGE_SIZE - 1;
 
         if (*ppos != 0) {
                 /* No partial writes. */
@@ -1033,6 +1033,7 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
         if (copy_from_user(page, buf, count))
                 goto out_free_page;
 
+        page[count] = '\0';
         loginuid = simple_strtoul(page, &tmp, 10);
         if (tmp == page) {
                 length = -EINVAL;
diff --git a/fs/xattr.c b/fs/xattr.c
index e416190f5e9c..c32f15b5f60f 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -242,7 +242,7 @@ sys_fsetxattr(int fd, char __user *name, void __user *value,
         if (!f)
                 return error;
         dentry = f->f_dentry;
-        audit_inode(NULL, dentry->d_inode, 0);
+        audit_inode(NULL, dentry->d_inode);
         error = setxattr(dentry, name, value, size, flags);
         fput(f);
         return error;
@@ -469,7 +469,7 @@ sys_fremovexattr(int fd, char __user *name)
         if (!f)
                 return error;
         dentry = f->f_dentry;
-        audit_inode(NULL, dentry->d_inode, 0);
+        audit_inode(NULL, dentry->d_inode);
         error = removexattr(dentry, name);
         fput(f);
         return error;