81 files changed, 1737 insertions, 1393 deletions

diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 18f74ec4dce9..9d03d1ebca6f 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -1001,44 +1001,6 @@ done:
 }
 
 /**
- * v9fs_vfs_readlink - read a symlink's location
- * @dentry: dentry for symlink
- * @buffer: buffer to load symlink location into
- * @buflen: length of buffer
- *
- */
-
-static int v9fs_vfs_readlink(struct dentry *dentry, char __user * buffer,
-                             int buflen)
-{
-        int retval;
-        int ret;
-        char *link = __getname();
-
-        if (unlikely(!link))
-                return -ENOMEM;
-
-        if (buflen > PATH_MAX)
-                buflen = PATH_MAX;
-
-        P9_DPRINTK(P9_DEBUG_VFS, " dentry: %s (%p)\n", dentry->d_name.name,
-                                                                        dentry);
-
-        retval = v9fs_readlink(dentry, link, buflen);
-
-        if (retval > 0) {
-                if ((ret = copy_to_user(buffer, link, retval)) != 0) {
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                                        "problem copying to user: %d\n", ret);
-                        retval = ret;
-                }
-        }
-
-        __putname(link);
-        return retval;
-}
-
-/**
  * v9fs_vfs_follow_link - follow a symlink path
  * @dentry: dentry for symlink
  * @nd: nameidata
@@ -1230,7 +1192,6 @@ static const struct inode_operations v9fs_dir_inode_operations_ext = {
         .rmdir = v9fs_vfs_rmdir,
         .mknod = v9fs_vfs_mknod,
         .rename = v9fs_vfs_rename,
-        .readlink = v9fs_vfs_readlink,
         .getattr = v9fs_vfs_getattr,
         .setattr = v9fs_vfs_setattr,
 };
@@ -1253,7 +1214,7 @@ static const struct inode_operations v9fs_file_inode_operations = {
 };
 
 static const struct inode_operations v9fs_symlink_inode_operations = {
-        .readlink = v9fs_vfs_readlink,
+        .readlink = generic_readlink,
         .follow_link = v9fs_vfs_follow_link,
         .put_link = v9fs_vfs_put_link,
         .getattr = v9fs_vfs_getattr,
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index c25256a5c5b0..c57d9ce5ff7e 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -171,6 +171,9 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
 #ifdef ELF_FDPIC_PLAT_INIT
         unsigned long dynaddr;
 #endif
+#ifndef CONFIG_MMU
+        unsigned long stack_prot;
+#endif
         struct file *interpreter = NULL; /* to shut gcc up */
         char *interpreter_name = NULL;
         int executable_stack;
@@ -316,6 +319,8 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
          * defunct, deceased, etc. after this point we have to exit via
          * error_kill */
         set_personality(PER_LINUX_FDPIC);
+        if (elf_read_implies_exec(&exec_params.hdr, executable_stack))
+                current->personality |= READ_IMPLIES_EXEC;
         set_binfmt(&elf_fdpic_format);
 
         current->mm->start_code = 0;
@@ -377,9 +382,13 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
         if (stack_size < PAGE_SIZE * 2)
                 stack_size = PAGE_SIZE * 2;
 
+        stack_prot = PROT_READ | PROT_WRITE;
+        if (executable_stack == EXSTACK_ENABLE_X ||
+            (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC))
+                stack_prot |= PROT_EXEC;
+
         down_write(&current->mm->mmap_sem);
-        current->mm->start_brk = do_mmap(NULL, 0, stack_size,
-                                         PROT_READ | PROT_WRITE | PROT_EXEC,
+        current->mm->start_brk = do_mmap(NULL, 0, stack_size, stack_prot,
                                          MAP_PRIVATE | MAP_ANONYMOUS |
                                          MAP_UNINITIALIZED | MAP_GROWSDOWN,
                                          0);
@@ -1798,11 +1807,11 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         ELF_CORE_WRITE_EXTRA_DATA;
 #endif
 
-        if (file->f_pos != offset) {
+        if (cprm->file->f_pos != offset) {
                 /* Sanity check */
                 printk(KERN_WARNING
                        "elf_core_dump: file->f_pos (%lld) != offset (%lld)\n",
-                       file->f_pos, offset);
+                       cprm->file->f_pos, offset);
         }
 
 end_coredump:
diff --git a/fs/bio.c b/fs/bio.c
index 76e6713abf94..12429c9553eb 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_create_slab(unsigned int extra_size)
 
         i = 0;
         while (i < bio_slab_nr) {
-                struct bio_slab *bslab = &bio_slabs[i];
+                bslab = &bio_slabs[i];
 
                 if (!bslab->slab && entry == -1)
                         entry = i;
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 2e9e69987a82..54f4798ab46a 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -112,12 +112,14 @@ static int btrfs_set_acl(struct btrfs_trans_handle *trans,
         switch (type) {
         case ACL_TYPE_ACCESS:
                 mode = inode->i_mode;
-                ret = posix_acl_equiv_mode(acl, &mode);
-                if (ret < 0)
-                        return ret;
-                ret = 0;
-                inode->i_mode = mode;
                 name = POSIX_ACL_XATTR_ACCESS;
+                if (acl) {
+                        ret = posix_acl_equiv_mode(acl, &mode);
+                        if (ret < 0)
+                                return ret;
+                        inode->i_mode = mode;
+                }
+                ret = 0;
                 break;
         case ACL_TYPE_DEFAULT:
                 if (!S_ISDIR(inode->i_mode))
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 56e50137d0e6..432a2da4641e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -83,6 +83,17 @@ static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
         return (cache->flags & bits) == bits;
 }
 
+void btrfs_get_block_group(struct btrfs_block_group_cache *cache)
+{
+        atomic_inc(&cache->count);
+}
+
+void btrfs_put_block_group(struct btrfs_block_group_cache *cache)
+{
+        if (atomic_dec_and_test(&cache->count))
+                kfree(cache);
+}
+
 /*
  * this adds the block group to the fs_info rb tree for the block group
  * cache
@@ -156,7 +167,7 @@ block_group_cache_tree_search(struct btrfs_fs_info *info, u64 bytenr,
                 }
         }
         if (ret)
-                atomic_inc(&ret->count);
+                btrfs_get_block_group(ret);
         spin_unlock(&info->block_group_cache_lock);
 
         return ret;
@@ -407,6 +418,8 @@ err:
 
         put_caching_control(caching_ctl);
         atomic_dec(&block_group->space_info->caching_threads);
+        btrfs_put_block_group(block_group);
+
         return 0;
 }
 
@@ -447,6 +460,7 @@ static int cache_block_group(struct btrfs_block_group_cache *cache)
         up_write(&fs_info->extent_commit_sem);
 
         atomic_inc(&cache->space_info->caching_threads);
+        btrfs_get_block_group(cache);
 
         tsk = kthread_run(caching_kthread, cache, "btrfs-cache-%llu\n",
                           cache->key.objectid);
@@ -486,12 +500,6 @@ struct btrfs_block_group_cache *btrfs_lookup_block_group(
         return cache;
 }
 
-void btrfs_put_block_group(struct btrfs_block_group_cache *cache)
-{
-        if (atomic_dec_and_test(&cache->count))
-                kfree(cache);
-}
-
 static struct btrfs_space_info *__find_space_info(struct btrfs_fs_info *info,
                                                   u64 flags)
 {
@@ -2582,7 +2590,7 @@ next_block_group(struct btrfs_root *root,
         if (node) {
                 cache = rb_entry(node, struct btrfs_block_group_cache,
                                  cache_node);
-                atomic_inc(&cache->count);
+                btrfs_get_block_group(cache);
         } else
                 cache = NULL;
         spin_unlock(&root->fs_info->block_group_cache_lock);
@@ -4227,7 +4235,7 @@ search:
                 u64 offset;
                 int cached;
 
-                atomic_inc(&block_group->count);
+                btrfs_get_block_group(block_group);
                 search_start = block_group->key.objectid;
 
 have_block_group:
@@ -4315,7 +4323,7 @@ have_block_group:
 
                                 btrfs_put_block_group(block_group);
                                 block_group = last_ptr->block_group;
-                                atomic_inc(&block_group->count);
+                                btrfs_get_block_group(block_group);
                                 spin_unlock(&last_ptr->lock);
                                 spin_unlock(&last_ptr->refill_lock);
 
@@ -7395,9 +7403,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                         wait_block_group_cache_done(block_group);
 
                 btrfs_remove_free_space_cache(block_group);
-
-                WARN_ON(atomic_read(&block_group->count) != 1);
-                kfree(block_group);
+                btrfs_put_block_group(block_group);
 
                 spin_lock(&info->block_group_cache_lock);
         }
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index feaa13b105d9..c02033596f02 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -506,7 +506,8 @@ next_slot:
 }
 
 static int extent_mergeable(struct extent_buffer *leaf, int slot,
-                            u64 objectid, u64 bytenr, u64 *start, u64 *end)
+                            u64 objectid, u64 bytenr, u64 orig_offset,
+                            u64 *start, u64 *end)
 {
         struct btrfs_file_extent_item *fi;
         struct btrfs_key key;
@@ -522,6 +523,7 @@ static int extent_mergeable(struct extent_buffer *leaf, int slot,
         fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
         if (btrfs_file_extent_type(leaf, fi) != BTRFS_FILE_EXTENT_REG ||
             btrfs_file_extent_disk_bytenr(leaf, fi) != bytenr ||
+            btrfs_file_extent_offset(leaf, fi) != key.offset - orig_offset ||
             btrfs_file_extent_compression(leaf, fi) ||
             btrfs_file_extent_encryption(leaf, fi) ||
             btrfs_file_extent_other_encoding(leaf, fi))
@@ -561,6 +563,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
         u64 split;
         int del_nr = 0;
         int del_slot = 0;
+        int recow;
         int ret;
 
         btrfs_drop_extent_cache(inode, start, end - 1, 0);
@@ -568,6 +571,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         BUG_ON(!path);
 again:
+        recow = 0;
         split = start;
         key.objectid = inode->i_ino;
         key.type = BTRFS_EXTENT_DATA_KEY;
@@ -591,12 +595,60 @@ again:
         bytenr = btrfs_file_extent_disk_bytenr(leaf, fi);
         num_bytes = btrfs_file_extent_disk_num_bytes(leaf, fi);
         orig_offset = key.offset - btrfs_file_extent_offset(leaf, fi);
+        memcpy(&new_key, &key, sizeof(new_key));
+
+        if (start == key.offset && end < extent_end) {
+                other_start = 0;
+                other_end = start;
+                if (extent_mergeable(leaf, path->slots[0] - 1,
+                                     inode->i_ino, bytenr, orig_offset,
+                                     &other_start, &other_end)) {
+                        new_key.offset = end;
+                        btrfs_set_item_key_safe(trans, root, path, &new_key);
+                        fi = btrfs_item_ptr(leaf, path->slots[0],
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        extent_end - end);
+                        btrfs_set_file_extent_offset(leaf, fi,
+                                                     end - orig_offset);
+                        fi = btrfs_item_ptr(leaf, path->slots[0] - 1,
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        end - other_start);
+                        btrfs_mark_buffer_dirty(leaf);
+                        goto out;
+                }
+        }
+
+        if (start > key.offset && end == extent_end) {
+                other_start = end;
+                other_end = 0;
+                if (extent_mergeable(leaf, path->slots[0] + 1,
+                                     inode->i_ino, bytenr, orig_offset,
+                                     &other_start, &other_end)) {
+                        fi = btrfs_item_ptr(leaf, path->slots[0],
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        start - key.offset);
+                        path->slots[0]++;
+                        new_key.offset = start;
+                        btrfs_set_item_key_safe(trans, root, path, &new_key);
+
+                        fi = btrfs_item_ptr(leaf, path->slots[0],
+                                            struct btrfs_file_extent_item);
+                        btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                        other_end - start);
+                        btrfs_set_file_extent_offset(leaf, fi,
+                                                     start - orig_offset);
+                        btrfs_mark_buffer_dirty(leaf);
+                        goto out;
+                }
+        }
 
         while (start > key.offset || end < extent_end) {
                 if (key.offset == start)
                         split = end;
 
-                memcpy(&new_key, &key, sizeof(new_key));
                 new_key.offset = split;
                 ret = btrfs_duplicate_item(trans, root, path, &new_key);
                 if (ret == -EAGAIN) {
@@ -631,15 +683,18 @@ again:
                         path->slots[0]--;
                         extent_end = end;
                 }
+                recow = 1;
         }
 
-        fi = btrfs_item_ptr(leaf, path->slots[0],
-                            struct btrfs_file_extent_item);
-
         other_start = end;
         other_end = 0;
-        if (extent_mergeable(leaf, path->slots[0] + 1, inode->i_ino,
-                             bytenr, &other_start, &other_end)) {
+        if (extent_mergeable(leaf, path->slots[0] + 1,
+                             inode->i_ino, bytenr, orig_offset,
+                             &other_start, &other_end)) {
+                if (recow) {
+                        btrfs_release_path(root, path);
+                        goto again;
+                }
                 extent_end = other_end;
                 del_slot = path->slots[0] + 1;
                 del_nr++;
@@ -650,8 +705,13 @@ again:
         }
         other_start = 0;
         other_end = start;
-        if (extent_mergeable(leaf, path->slots[0] - 1, inode->i_ino,
-                             bytenr, &other_start, &other_end)) {
+        if (extent_mergeable(leaf, path->slots[0] - 1,
+                             inode->i_ino, bytenr, orig_offset,
+                             &other_start, &other_end)) {
+                if (recow) {
+                        btrfs_release_path(root, path);
+                        goto again;
+                }
                 key.offset = other_start;
                 del_slot = path->slots[0];
                 del_nr++;
@@ -660,22 +720,22 @@ again:
                                         inode->i_ino, orig_offset);
                 BUG_ON(ret);
         }
+        fi = btrfs_item_ptr(leaf, path->slots[0],
+                           struct btrfs_file_extent_item);
         if (del_nr == 0) {
                 btrfs_set_file_extent_type(leaf, fi,
                                            BTRFS_FILE_EXTENT_REG);
                 btrfs_mark_buffer_dirty(leaf);
-                goto out;
-        }
-
-        fi = btrfs_item_ptr(leaf, del_slot - 1,
-                            struct btrfs_file_extent_item);
-        btrfs_set_file_extent_type(leaf, fi, BTRFS_FILE_EXTENT_REG);
-        btrfs_set_file_extent_num_bytes(leaf, fi,
-                                        extent_end - key.offset);
-        btrfs_mark_buffer_dirty(leaf);
+        } else {
+                btrfs_set_file_extent_type(leaf, fi,
+                                           BTRFS_FILE_EXTENT_REG);
+                btrfs_set_file_extent_num_bytes(leaf, fi,
+                                                extent_end - key.offset);
+                btrfs_mark_buffer_dirty(leaf);
 
-        ret = btrfs_del_items(trans, root, path, del_slot, del_nr);
-        BUG_ON(ret);
+                ret = btrfs_del_items(trans, root, path, del_slot, del_nr);
+                BUG_ON(ret);
+        }
 out:
         btrfs_free_path(path);
         return 0;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 5440bab23635..b330e27c2d8b 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3796,6 +3796,12 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
 
         if (location.type == BTRFS_INODE_ITEM_KEY) {
                 inode = btrfs_iget(dir->i_sb, &location, root);
+                if (unlikely(root->clean_orphans) &&
+                    !(inode->i_sb->s_flags & MS_RDONLY)) {
+                        down_read(&root->fs_info->cleanup_work_sem);
+                        btrfs_orphan_cleanup(root);
+                        up_read(&root->fs_info->cleanup_work_sem);
+                }
                 return inode;
         }
 
@@ -3995,7 +4001,11 @@ skip:
 
         /* Reached end of directory/root. Bump pos past the last item. */
         if (key_type == BTRFS_DIR_INDEX_KEY)
-                filp->f_pos = INT_LIMIT(off_t);
+                /*
+                 * 32-bit glibc will use getdents64, but then strtol -
+                 * so the last number we can serve is this.
+                 */
+                filp->f_pos = 0x7fffffff;
         else
                 filp->f_pos++;
 nopos:
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index b10a49d4bc6a..5c2a9e78a949 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -626,6 +626,8 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
 
         if (ordered)
                 offset = entry_end(ordered);
+        else
+                offset = ALIGN(offset, BTRFS_I(inode)->root->sectorsize);
 
         mutex_lock(&tree->mutex);
         disk_i_size = BTRFS_I(inode)->disk_i_size;
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index a9728680eca8..ed3e4a2ec2c8 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3281,8 +3281,10 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
                 return -ENOMEM;
 
         path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
+                kfree(cluster);
                 return -ENOMEM;
+        }
 
         rc->extents_found = 0;
         rc->extents_skipped = 0;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 198cff28766d..220dad5db017 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2649,8 +2649,10 @@ again:
         em = lookup_extent_mapping(em_tree, logical, *length);
         read_unlock(&em_tree->lock);
 
-        if (!em && unplug_page)
+        if (!em && unplug_page) {
+                kfree(multi);
                 return 0;
+        }
 
         if (!em) {
                 printk(KERN_CRIT "unable to find logical %llu len %llu\n",
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 094ea65afc85..7b2600b380d7 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -5,7 +5,9 @@ have duplicated data). Fix oops in cifs_lookup. Workaround problem
 mounting to OS/400 Netserve. Fix oops in cifs_get_tcp_session.
 Disable use of server inode numbers when server only
 partially supports them (e.g. for one server querying inode numbers on
-FindFirst fails but QPathInfo queries works).
+FindFirst fails but QPathInfo queries works). Fix oops with dfs in 
+cifs_put_smb_ses. Fix mmap to work on directio mounts (needed
+for OpenOffice when on forcedirectio mount e.g.)
 
 Version 1.60
 -------------
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index fea9e898c4ba..b44ce0a0711c 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -269,7 +269,7 @@ static int add_mount_helper(struct vfsmount *newmnt, struct nameidata *nd,
         int err;
 
         mntget(newmnt);
-        err = do_add_mount(newmnt, &nd->path, nd->path.mnt->mnt_flags, mntlist);
+        err = do_add_mount(newmnt, &nd->path, nd->path.mnt->mnt_flags | MNT_SHRINKABLE, mntlist);
         switch (err) {
         case 0:
                 path_put(&nd->path);
@@ -371,7 +371,6 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
         if (IS_ERR(mnt))
                 goto out_err;
 
-        nd->path.mnt->mnt_flags |= MNT_SHRINKABLE;
         rc = add_mount_helper(mnt, nd, &cifs_dfs_automount_list);
 
 out:
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 29f1da761bbf..8c6a03627176 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -758,7 +758,7 @@ const struct file_operations cifs_file_ops = {
 };
 
 const struct file_operations cifs_file_direct_ops = {
-        /* no mmap, no aio, no readv -
+        /* no aio, no readv -
            BB reevaluate whether they can be done with directio, no cache */
         .read = cifs_user_read,
         .write = cifs_user_write,
@@ -767,6 +767,7 @@ const struct file_operations cifs_file_direct_ops = {
         .lock = cifs_lock,
         .fsync = cifs_fsync,
         .flush = cifs_flush,
+        .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
 #ifdef CONFIG_CIFS_POSIX
         .unlocked_ioctl  = cifs_ioctl,
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 63ea83ff687f..3bbcaa716b3c 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2287,12 +2287,12 @@ int
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 char *mount_data_global, const char *devname)
 {
-        int rc = 0;
+        int rc;
         int xid;
         struct smb_vol *volume_info;
-        struct cifsSesInfo *pSesInfo = NULL;
-        struct cifsTconInfo *tcon = NULL;
-        struct TCP_Server_Info *srvTcp = NULL;
+        struct cifsSesInfo *pSesInfo;
+        struct cifsTconInfo *tcon;
+        struct TCP_Server_Info *srvTcp;
         char   *full_path;
         char *mount_data = mount_data_global;
 #ifdef CONFIG_CIFS_DFS_UPCALL
@@ -2301,6 +2301,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         int referral_walks_count = 0;
 try_mount_again:
 #endif
+        rc = 0;
+        tcon = NULL;
+        pSesInfo = NULL;
+        srvTcp = NULL;
         full_path = NULL;
 
         xid = GetXid();
@@ -2597,6 +2601,7 @@ remote_path_check:
 
                         cleanup_volume_info(&volume_info);
                         referral_walks_count++;
+                        FreeXid(xid);
                         goto try_mount_again;
                 }
 #else /* No DFS support, return error on mount */
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 332dd00f0894..c5c45de1a2ee 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1005,6 +1005,9 @@ COMPATIBLE_IOCTL(SCSI_IOCTL_SEND_COMMAND)
 COMPATIBLE_IOCTL(SCSI_IOCTL_PROBE_HOST)
 COMPATIBLE_IOCTL(SCSI_IOCTL_GET_PCI)
 #endif
+/* Big V (don't complain on serial console) */
+IGNORE_IOCTL(VT_OPENQRY)
+IGNORE_IOCTL(VT_GETMODE)
 /* Little p (/dev/rtc, /dev/envctrl, etc.) */
 COMPATIBLE_IOCTL(RTC_AIE_ON)
 COMPATIBLE_IOCTL(RTC_AIE_OFF)
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index c8afa6b1d91d..32a5f46b1157 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -121,8 +121,10 @@ static int get_target(const char *symname, struct path *path,
                                 ret = -ENOENT;
                                 path_put(path);
                         }
-                } else
+                } else {
                         ret = -EPERM;
+                        path_put(path);
+                }
         }
 
         return ret;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index fbb6e5eed697..7cb0a59f4b9d 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1748,7 +1748,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
                             char *cipher_name, size_t *key_size)
 {
         char dummy_key[ECRYPTFS_MAX_KEY_BYTES];
-        char *full_alg_name;
+        char *full_alg_name = NULL;
         int rc;
 
         *key_tfm = NULL;
@@ -1763,7 +1763,6 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
         if (rc)
                 goto out;
         *key_tfm = crypto_alloc_blkcipher(full_alg_name, 0, CRYPTO_ALG_ASYNC);
-        kfree(full_alg_name);
         if (IS_ERR(*key_tfm)) {
                 rc = PTR_ERR(*key_tfm);
                 printk(KERN_ERR "Unable to allocate crypto cipher with name "
@@ -1786,6 +1785,7 @@ ecryptfs_process_key_cipher(struct crypto_blkcipher **key_tfm,
                 goto out;
         }
 out:
+        kfree(full_alg_name);
         return rc;
 }
 
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 9e944057001b..678172b61be2 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -158,7 +158,7 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
         struct dentry *ecryptfs_dentry = file->f_path.dentry;
         /* Private value of ecryptfs_dentry allocated in
          * ecryptfs_lookup() */
-        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
+        struct dentry *lower_dentry;
         struct ecryptfs_file_info *file_info;
 
         mount_crypt_stat = &ecryptfs_superblock_to_private(
@@ -191,13 +191,6 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                                       | ECRYPTFS_ENCRYPTED);
         }
         mutex_unlock(&crypt_stat->cs_mutex);
-        if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
-            && !(file->f_flags & O_RDONLY)) {
-                rc = -EPERM;
-                printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
-                       "file must hence be opened RO\n", __func__);
-                goto out;
-        }
         if (!ecryptfs_inode_to_private(inode)->lower_file) {
                 rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
                 if (rc) {
@@ -208,6 +201,13 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                         goto out;
                 }
         }
+        if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
+            && !(file->f_flags & O_RDONLY)) {
+                rc = -EPERM;
+                printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
+                       "file must hence be opened RO\n", __func__);
+                goto out;
+        }
         ecryptfs_set_file_lower(
                 file, ecryptfs_inode_to_private(inode)->lower_file);
         if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
@@ -299,7 +299,6 @@ static int ecryptfs_ioctl(struct inode *inode, struct file *file,
 const struct file_operations ecryptfs_dir_fops = {
         .readdir = ecryptfs_readdir,
         .ioctl = ecryptfs_ioctl,
-        .mmap = generic_file_mmap,
         .open = ecryptfs_open,
         .flush = ecryptfs_flush,
         .release = ecryptfs_release,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 429ca0b3ba08..4a430ab4115c 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -282,7 +282,8 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                 goto out;
         }
         rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
-                                ecryptfs_dir_inode->i_sb, 1);
+                                ecryptfs_dir_inode->i_sb,
+                                ECRYPTFS_INTERPOSE_FLAG_D_ADD);
         if (rc) {
                 printk(KERN_ERR "%s: Error interposing; rc = [%d]\n",
                        __func__, rc);
@@ -463,9 +464,6 @@ out_lock:
         unlock_dir(lower_dir_dentry);
         dput(lower_new_dentry);
         dput(lower_old_dentry);
-        d_drop(lower_old_dentry);
-        d_drop(new_dentry);
-        d_drop(old_dentry);
         return rc;
 }
 
@@ -614,6 +612,7 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct dentry *lower_new_dentry;
         struct dentry *lower_old_dir_dentry;
         struct dentry *lower_new_dir_dentry;
+        struct dentry *trap = NULL;
 
         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
@@ -621,7 +620,17 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         dget(lower_new_dentry);
         lower_old_dir_dentry = dget_parent(lower_old_dentry);
         lower_new_dir_dentry = dget_parent(lower_new_dentry);
-        lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+        trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+        /* source should not be ancestor of target */
+        if (trap == lower_old_dentry) {
+                rc = -EINVAL;
+                goto out_lock;
+        }
+        /* target should not be ancestor of source */
+        if (trap == lower_new_dentry) {
+                rc = -ENOTEMPTY;
+                goto out_lock;
+        }
         rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
                         lower_new_dir_dentry->d_inode, lower_new_dentry);
         if (rc)
@@ -715,31 +724,31 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         /* Released in ecryptfs_put_link(); only release here on error */
         buf = kmalloc(len, GFP_KERNEL);
         if (!buf) {
-                rc = -ENOMEM;
+                buf = ERR_PTR(-ENOMEM);
                 goto out;
         }
         old_fs = get_fs();
         set_fs(get_ds());
         rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
         set_fs(old_fs);
-        if (rc < 0)
-                goto out_free;
-        else
+        if (rc < 0) {
+                kfree(buf);
+                buf = ERR_PTR(rc);
+        } else
                 buf[rc] = '\0';
-        rc = 0;
-        nd_set_link(nd, buf);
-        goto out;
-out_free:
-        kfree(buf);
 out:
-        return ERR_PTR(rc);
+        nd_set_link(nd, buf);
+        return NULL;
 }
 
 static void
 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
 {
-        /* Free the char* */
-        kfree(nd_get_link(nd));
+        char *buf = nd_get_link(nd);
+        if (!IS_ERR(buf)) {
+                /* Free the char* */
+                kfree(buf);
+        }
 }
 
 /**
@@ -772,18 +781,23 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
 }
 
 /**
- * ecryptfs_truncate
+ * truncate_upper
  * @dentry: The ecryptfs layer dentry
- * @new_length: The length to expand the file to
+ * @ia: Address of the ecryptfs inode's attributes
+ * @lower_ia: Address of the lower inode's attributes
  *
  * Function to handle truncations modifying the size of the file. Note
  * that the file sizes are interpolated. When expanding, we are simply
- * writing strings of 0's out. When truncating, we need to modify the
- * underlying file size according to the page index interpolations.
+ * writing strings of 0's out. When truncating, we truncate the upper
+ * inode and update the lower_ia according to the page index
+ * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
+ * the caller must use lower_ia in a call to notify_change() to perform
+ * the truncation of the lower inode.
  *
  * Returns zero on success; non-zero otherwise
  */
-int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+static int truncate_upper(struct dentry *dentry, struct iattr *ia,
+                          struct iattr *lower_ia)
 {
         int rc = 0;
         struct inode *inode = dentry->d_inode;
@@ -794,8 +808,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         loff_t lower_size_before_truncate;
         loff_t lower_size_after_truncate;
 
-        if (unlikely((new_length == i_size)))
+        if (unlikely((ia->ia_size == i_size))) {
+                lower_ia->ia_valid &= ~ATTR_SIZE;
                 goto out;
+        }
         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
         /* Set up a fake ecryptfs file, this is used to interface with
          * the file in the underlying filesystem so that the
@@ -815,28 +831,30 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                 &fake_ecryptfs_file,
                 ecryptfs_inode_to_private(dentry->d_inode)->lower_file);
         /* Switch on growing or shrinking file */
-        if (new_length > i_size) {
+        if (ia->ia_size > i_size) {
                 char zero[] = { 0x00 };
 
+                lower_ia->ia_valid &= ~ATTR_SIZE;
                 /* Write a single 0 at the last position of the file;
                  * this triggers code that will fill in 0's throughout
                  * the intermediate portion of the previous end of the
                  * file and the new and of the file */
                 rc = ecryptfs_write(&fake_ecryptfs_file, zero,
-                                    (new_length - 1), 1);
-        } else { /* new_length < i_size_read(inode) */
-                /* We're chopping off all the pages down do the page
-                 * in which new_length is located. Fill in the end of
-                 * that page from (new_length & ~PAGE_CACHE_MASK) to
+                                    (ia->ia_size - 1), 1);
+        } else { /* ia->ia_size < i_size_read(inode) */
+                /* We're chopping off all the pages down to the page
+                 * in which ia->ia_size is located. Fill in the end of
+                 * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to
                  * PAGE_CACHE_SIZE with zeros. */
                 size_t num_zeros = (PAGE_CACHE_SIZE
-                                    - (new_length & ~PAGE_CACHE_MASK));
+                                    - (ia->ia_size & ~PAGE_CACHE_MASK));
 
                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
-                        rc = vmtruncate(inode, new_length);
+                        rc = vmtruncate(inode, ia->ia_size);
                         if (rc)
                                 goto out_free;
-                        rc = vmtruncate(lower_dentry->d_inode, new_length);
+                        lower_ia->ia_size = ia->ia_size;
+                        lower_ia->ia_valid |= ATTR_SIZE;
                         goto out_free;
                 }
                 if (num_zeros) {
@@ -848,7 +866,7 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                                 goto out_free;
                         }
                         rc = ecryptfs_write(&fake_ecryptfs_file, zeros_virt,
-                                            new_length, num_zeros);
+                                            ia->ia_size, num_zeros);
                         kfree(zeros_virt);
                         if (rc) {
                                 printk(KERN_ERR "Error attempting to zero out "
@@ -857,7 +875,7 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                                 goto out_free;
                         }
                 }
-                vmtruncate(inode, new_length);
+                vmtruncate(inode, ia->ia_size);
                 rc = ecryptfs_write_inode_size_to_metadata(inode);
                 if (rc) {
                         printk(KERN_ERR "Problem with "
@@ -870,10 +888,12 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                 lower_size_before_truncate =
                     upper_size_to_lower_size(crypt_stat, i_size);
                 lower_size_after_truncate =
-                    upper_size_to_lower_size(crypt_stat, new_length);
-                if (lower_size_after_truncate < lower_size_before_truncate)
-                        vmtruncate(lower_dentry->d_inode,
-                                   lower_size_after_truncate);
+                    upper_size_to_lower_size(crypt_stat, ia->ia_size);
+                if (lower_size_after_truncate < lower_size_before_truncate) {
+                        lower_ia->ia_size = lower_size_after_truncate;
+                        lower_ia->ia_valid |= ATTR_SIZE;
+                } else
+                        lower_ia->ia_valid &= ~ATTR_SIZE;
         }
 out_free:
         if (ecryptfs_file_to_private(&fake_ecryptfs_file))
@@ -883,6 +903,33 @@ out:
         return rc;
 }
 
+/**
+ * ecryptfs_truncate
+ * @dentry: The ecryptfs layer dentry
+ * @new_length: The length to expand the file to
+ *
+ * Simple function that handles the truncation of an eCryptfs inode and
+ * its corresponding lower inode.
+ *
+ * Returns zero on success; non-zero otherwise
+ */
+int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+{
+        struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
+        struct iattr lower_ia = { .ia_valid = 0 };
+        int rc;
+
+        rc = truncate_upper(dentry, &ia, &lower_ia);
+        if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
+                struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+
+                mutex_lock(&lower_dentry->d_inode->i_mutex);
+                rc = notify_change(lower_dentry, &lower_ia);
+                mutex_unlock(&lower_dentry->d_inode->i_mutex);
+        }
+        return rc;
+}
+
 static int
 ecryptfs_permission(struct inode *inode, int mask)
 {
@@ -905,6 +952,7 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
 {
         int rc = 0;
         struct dentry *lower_dentry;
+        struct iattr lower_ia;
         struct inode *inode;
         struct inode *lower_inode;
         struct ecryptfs_crypt_stat *crypt_stat;
@@ -943,15 +991,11 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                 }
         }
         mutex_unlock(&crypt_stat->cs_mutex);
+        memcpy(&lower_ia, ia, sizeof(lower_ia));
+        if (ia->ia_valid & ATTR_FILE)
+                lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
         if (ia->ia_valid & ATTR_SIZE) {
-                ecryptfs_printk(KERN_DEBUG,
-                                "ia->ia_valid = [0x%x] ATTR_SIZE" " = [0x%x]\n",
-                                ia->ia_valid, ATTR_SIZE);
-                rc = ecryptfs_truncate(dentry, ia->ia_size);
-                /* ecryptfs_truncate handles resizing of the lower file */
-                ia->ia_valid &= ~ATTR_SIZE;
-                ecryptfs_printk(KERN_DEBUG, "ia->ia_valid = [%x]\n",
-                                ia->ia_valid);
+                rc = truncate_upper(dentry, ia, &lower_ia);
                 if (rc < 0)
                         goto out;
         }
@@ -960,17 +1004,32 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
          * mode change is for clearing setuid/setgid bits. Allow lower fs
          * to interpret this in its own way.
          */
-        if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
-                ia->ia_valid &= ~ATTR_MODE;
+        if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
+                lower_ia.ia_valid &= ~ATTR_MODE;
 
         mutex_lock(&lower_dentry->d_inode->i_mutex);
-        rc = notify_change(lower_dentry, ia);
+        rc = notify_change(lower_dentry, &lower_ia);
         mutex_unlock(&lower_dentry->d_inode->i_mutex);
 out:
         fsstack_copy_attr_all(inode, lower_inode);
         return rc;
 }
 
+int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                     struct kstat *stat)
+{
+        struct kstat lower_stat;
+        int rc;
+
+        rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
+                         ecryptfs_dentry_to_lower(dentry), &lower_stat);
+        if (!rc) {
+                generic_fillattr(dentry->d_inode, stat);
+                stat->blocks = lower_stat.blocks;
+        }
+        return rc;
+}
+
 int
 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
                   size_t size, int flags)
@@ -1100,6 +1159,7 @@ const struct inode_operations ecryptfs_dir_iops = {
 const struct inode_operations ecryptfs_main_iops = {
         .permission = ecryptfs_permission,
         .setattr = ecryptfs_setattr,
+        .getattr = ecryptfs_getattr,
         .setxattr = ecryptfs_setxattr,
         .getxattr = ecryptfs_getxattr,
         .listxattr = ecryptfs_listxattr,
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 567bc4b9f70a..ea2f92101dfe 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -585,8 +585,8 @@ out:
  *                        with as much information as it can before needing
  *                        the lower filesystem.
  * ecryptfs_read_super(): this accesses the lower filesystem and uses
- *                        ecryptfs_interpolate to perform most of the linking
- * ecryptfs_interpolate(): links the lower filesystem into ecryptfs
+ *                        ecryptfs_interpose to perform most of the linking
+ * ecryptfs_interpose(): links the lower filesystem into ecryptfs (inode.c)
  */
 static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags,
                         const char *dev_name, void *raw_data,
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 698a8636d39c..2afbcebeda71 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -738,13 +738,28 @@ static int exofs_write_begin_export(struct file *file,
                                         fsdata);
 }
 
+static int exofs_write_end(struct file *file, struct address_space *mapping,
+                        loff_t pos, unsigned len, unsigned copied,
+                        struct page *page, void *fsdata)
+{
+        struct inode *inode = mapping->host;
+        /* According to comment in simple_write_end i_mutex is held */
+        loff_t i_size = inode->i_size;
+        int ret;
+
+        ret = simple_write_end(file, mapping,pos, len, copied, page, fsdata);
+        if (i_size != inode->i_size)
+                mark_inode_dirty(inode);
+        return ret;
+}
+
 const struct address_space_operations exofs_aops = {
         .readpage       = exofs_readpage,
         .readpages      = exofs_readpages,
         .writepage      = exofs_writepage,
         .writepages     = exofs_writepages,
         .write_begin    = exofs_write_begin_export,
-        .write_end      = simple_write_end,
+        .write_end      = exofs_write_end,
 };
 
 /******************************************************************************
diff --git a/fs/exofs/pnfs.h b/fs/exofs/pnfs.h
index 423033addd1f..c52e9888b8ab 100644
--- a/fs/exofs/pnfs.h
+++ b/fs/exofs/pnfs.h
@@ -15,13 +15,7 @@
 #ifndef __EXOFS_PNFS_H__
 #define __EXOFS_PNFS_H__
 
-#if defined(CONFIG_PNFS)
-
-
-/* FIXME: move this file to: linux/exportfs/pnfs_osd_xdr.h */
-#include "../nfs/objlayout/pnfs_osd_xdr.h"
-
-#else /* defined(CONFIG_PNFS) */
+#if ! defined(__PNFS_OSD_XDR_H__)
 
 enum pnfs_iomode {
         IOMODE_READ = 1,
@@ -46,6 +40,6 @@ struct pnfs_osd_data_map {
         u32     odm_raid_algorithm;
 };
 
-#endif /* else defined(CONFIG_PNFS) */
+#endif /* ! defined(__PNFS_OSD_XDR_H__) */
 
 #endif /* __EXOFS_PNFS_H__ */
diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
index 9acf7e808139..9ed1bb1f319f 100644
--- a/fs/ext4/Kconfig
+++ b/fs/ext4/Kconfig
@@ -28,6 +28,7 @@ config EXT4_FS
 
 config EXT4_USE_FOR_EXT23
         bool "Use ext4 for ext2/ext3 file systems"
+        depends on EXT4_FS
         depends on EXT3_FS=n || EXT2_FS=n
         default y
         help
diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
index 4df8621ec31c..a60ab9aad57d 100644
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/swap.h>
 #include <linux/pagemap.h>
-#include <linux/version.h>
 #include <linux/blkdev.h>
 #include <linux/mutex.h>
 #include "ext4.h"
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 56f9271ee8cc..af7b62699ea9 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -699,6 +699,8 @@ struct ext4_inode_info {
         unsigned int i_reserved_meta_blocks;
         unsigned int i_allocated_meta_blocks;
         unsigned short i_delalloc_reserved_flag;
+        sector_t i_da_metadata_calc_last_lblock;
+        int i_da_metadata_calc_len;
 
         /* on-disk additional length */
         __u16 i_extra_isize;
diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
index 2ca686454e87..bdb6ce7e2eb4 100644
--- a/fs/ext4/ext4_extents.h
+++ b/fs/ext4/ext4_extents.h
@@ -225,7 +225,8 @@ static inline void ext4_ext_mark_initialized(struct ext4_extent *ext)
         ext->ee_len = cpu_to_le16(ext4_ext_get_actual_len(ext));
 }
 
-extern int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks);
+extern int ext4_ext_calc_metadata_amount(struct inode *inode,
+                                         sector_t lblocks);
 extern ext4_fsblk_t ext_pblock(struct ext4_extent *ex);
 extern ext4_fsblk_t idx_pblock(struct ext4_extent_idx *);
 extern void ext4_ext_store_pblock(struct ext4_extent *, ext4_fsblk_t);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 3a7928f825e4..7d7b74e94687 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -296,29 +296,44 @@ static inline int ext4_ext_space_root_idx(struct inode *inode, int check)
  * to allocate @blocks
  * Worse case is one block per extent
  */
-int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks)
+int ext4_ext_calc_metadata_amount(struct inode *inode, sector_t lblock)
 {
-        int lcap, icap, rcap, leafs, idxs, num;
-        int newextents = blocks;
-
-        rcap = ext4_ext_space_root_idx(inode, 0);
-        lcap = ext4_ext_space_block(inode, 0);
-        icap = ext4_ext_space_block_idx(inode, 0);
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int idxs, num = 0;
 
-        /* number of new leaf blocks needed */
-        num = leafs = (newextents + lcap - 1) / lcap;
+        idxs = ((inode->i_sb->s_blocksize - sizeof(struct ext4_extent_header))
+                / sizeof(struct ext4_extent_idx));
 
         /*
-         * Worse case, we need separate index block(s)
-         * to link all new leaf blocks
+         * If the new delayed allocation block is contiguous with the
+         * previous da block, it can share index blocks with the
+         * previous block, so we only need to allocate a new index
+         * block every idxs leaf blocks.  At ldxs**2 blocks, we need
+         * an additional index block, and at ldxs**3 blocks, yet
+         * another index blocks.
          */
-        idxs = (leafs + icap - 1) / icap;
-        do {
-                num += idxs;
-                idxs = (idxs + icap - 1) / icap;
-        } while (idxs > rcap);
+        if (ei->i_da_metadata_calc_len &&
+            ei->i_da_metadata_calc_last_lblock+1 == lblock) {
+                if ((ei->i_da_metadata_calc_len % idxs) == 0)
+                        num++;
+                if ((ei->i_da_metadata_calc_len % (idxs*idxs)) == 0)
+                        num++;
+                if ((ei->i_da_metadata_calc_len % (idxs*idxs*idxs)) == 0) {
+                        num++;
+                        ei->i_da_metadata_calc_len = 0;
+                } else
+                        ei->i_da_metadata_calc_len++;
+                ei->i_da_metadata_calc_last_lblock++;
+                return num;
+        }
 
-        return num;
+        /*
+         * In the worst case we need a new set of index blocks at
+         * every level of the inode's extent tree.
+         */
+        ei->i_da_metadata_calc_len = 1;
+        ei->i_da_metadata_calc_last_lblock = lblock;
+        return ext_depth(inode) + 1;
 }
 
 static int
@@ -3023,6 +3038,14 @@ out:
         return err;
 }
 
+static void unmap_underlying_metadata_blocks(struct block_device *bdev,
+                        sector_t block, int count)
+{
+        int i;
+        for (i = 0; i < count; i++)
+                unmap_underlying_metadata(bdev, block + i);
+}
+
 static int
 ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
                         ext4_lblk_t iblock, unsigned int max_blocks,
@@ -3098,6 +3121,18 @@ out:
         } else
                 allocated = ret;
         set_buffer_new(bh_result);
+        /*
+         * if we allocated more blocks than requested
+         * we need to make sure we unmap the extra block
+         * allocated. The actual needed block will get
+         * unmapped later when we find the buffer_head marked
+         * new.
+         */
+        if (allocated > max_blocks) {
+                unmap_underlying_metadata_blocks(inode->i_sb->s_bdev,
+                                        newblock + max_blocks,
+                                        allocated - max_blocks);
+        }
 map_out:
         set_buffer_mapped(bh_result);
 out1:
@@ -3190,7 +3225,13 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
          * this situation is possible, though, _during_ tree modification;
          * this is why assert can't be put in ext4_ext_find_extent()
          */
-        BUG_ON(path[depth].p_ext == NULL && depth != 0);
+        if (path[depth].p_ext == NULL && depth != 0) {
+                ext4_error(inode->i_sb, __func__, "bad extent address "
+                           "inode: %lu, iblock: %d, depth: %d",
+                           inode->i_ino, iblock, depth);
+                err = -EIO;
+                goto out2;
+        }
         eh = path[depth].p_hdr;
 
         ex = path[depth].p_ext;
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
index 0b22497d92e1..98bd140aad01 100644
--- a/fs/ext4/fsync.c
+++ b/fs/ext4/fsync.c
@@ -88,9 +88,21 @@ int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
                 return ext4_force_commit(inode->i_sb);
 
         commit_tid = datasync ? ei->i_datasync_tid : ei->i_sync_tid;
-        if (jbd2_log_start_commit(journal, commit_tid))
+        if (jbd2_log_start_commit(journal, commit_tid)) {
+                /*
+                 * When the journal is on a different device than the
+                 * fs data disk, we need to issue the barrier in
+                 * writeback mode.  (In ordered mode, the jbd2 layer
+                 * will take care of issuing the barrier.  In
+                 * data=journal, all of the data blocks are written to
+                 * the journal device.)
+                 */
+                if (ext4_should_writeback_data(inode) &&
+                    (journal->j_fs_dev != journal->j_dev) &&
+                    (journal->j_flags & JBD2_BARRIER))
+                        blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
                 jbd2_log_wait_commit(journal, commit_tid);
-        else if (journal->j_flags & JBD2_BARRIER)
+        } else if (journal->j_flags & JBD2_BARRIER)
                 blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
         return ret;
 }
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ab807963a614..c818972c8302 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1009,77 +1009,88 @@ qsize_t *ext4_get_reserved_space(struct inode *inode)
         return &EXT4_I(inode)->i_reserved_quota;
 }
 #endif
+
 /*
  * Calculate the number of metadata blocks need to reserve
- * to allocate @blocks for non extent file based file
+ * to allocate a new block at @lblocks for non extent file based file
  */
-static int ext4_indirect_calc_metadata_amount(struct inode *inode, int blocks)
+static int ext4_indirect_calc_metadata_amount(struct inode *inode,
+                                              sector_t lblock)
 {
-        int icap = EXT4_ADDR_PER_BLOCK(inode->i_sb);
-        int ind_blks, dind_blks, tind_blks;
-
-        /* number of new indirect blocks needed */
-        ind_blks = (blocks + icap - 1) / icap;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int dind_mask = EXT4_ADDR_PER_BLOCK(inode->i_sb) - 1;
+        int blk_bits;
 
-        dind_blks = (ind_blks + icap - 1) / icap;
+        if (lblock < EXT4_NDIR_BLOCKS)
+                return 0;
 
-        tind_blks = 1;
+        lblock -= EXT4_NDIR_BLOCKS;
 
-        return ind_blks + dind_blks + tind_blks;
+        if (ei->i_da_metadata_calc_len &&
+            (lblock & dind_mask) == ei->i_da_metadata_calc_last_lblock) {
+                ei->i_da_metadata_calc_len++;
+                return 0;
+        }
+        ei->i_da_metadata_calc_last_lblock = lblock & dind_mask;
+        ei->i_da_metadata_calc_len = 1;
+        blk_bits = roundup_pow_of_two(lblock + 1);
+        return (blk_bits / EXT4_ADDR_PER_BLOCK_BITS(inode->i_sb)) + 1;
 }
 
 /*
  * Calculate the number of metadata blocks need to reserve
- * to allocate given number of blocks
+ * to allocate a block located at @lblock
  */
-static int ext4_calc_metadata_amount(struct inode *inode, int blocks)
+static int ext4_calc_metadata_amount(struct inode *inode, sector_t lblock)
 {
-        if (!blocks)
-                return 0;
-
         if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
-                return ext4_ext_calc_metadata_amount(inode, blocks);
+                return ext4_ext_calc_metadata_amount(inode, lblock);
 
-        return ext4_indirect_calc_metadata_amount(inode, blocks);
+        return ext4_indirect_calc_metadata_amount(inode, lblock);
 }
 
+/*
+ * Called with i_data_sem down, which is important since we can call
+ * ext4_discard_preallocations() from here.
+ */
 static void ext4_da_update_reserve_space(struct inode *inode, int used)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        int total, mdb, mdb_free, mdb_claim = 0;
-
-        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-        /* recalculate the number of metablocks still need to be reserved */
-        total = EXT4_I(inode)->i_reserved_data_blocks - used;
-        mdb = ext4_calc_metadata_amount(inode, total);
-
-        /* figure out how many metablocks to release */
-        BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
-        mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
-
-        if (mdb_free) {
-                /* Account for allocated meta_blocks */
-                mdb_claim = EXT4_I(inode)->i_allocated_meta_blocks;
-                BUG_ON(mdb_free < mdb_claim);
-                mdb_free -= mdb_claim;
-
-                /* update fs dirty blocks counter */
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int mdb_free = 0;
+
+        spin_lock(&ei->i_block_reservation_lock);
+        if (unlikely(used > ei->i_reserved_data_blocks)) {
+                ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, used %d "
+                         "with only %d reserved data blocks\n",
+                         __func__, inode->i_ino, used,
+                         ei->i_reserved_data_blocks);
+                WARN_ON(1);
+                used = ei->i_reserved_data_blocks;
+        }
+
+        /* Update per-inode reservations */
+        ei->i_reserved_data_blocks -= used;
+        used += ei->i_allocated_meta_blocks;
+        ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks;
+        ei->i_allocated_meta_blocks = 0;
+        percpu_counter_sub(&sbi->s_dirtyblocks_counter, used);
+
+        if (ei->i_reserved_data_blocks == 0) {
+                /*
+                 * We can release all of the reserved metadata blocks
+                 * only when we have written all of the delayed
+                 * allocation blocks.
+                 */
+                mdb_free = ei->i_reserved_meta_blocks;
+                ei->i_reserved_meta_blocks = 0;
+                ei->i_da_metadata_calc_len = 0;
                 percpu_counter_sub(&sbi->s_dirtyblocks_counter, mdb_free);
-                EXT4_I(inode)->i_allocated_meta_blocks = 0;
-                EXT4_I(inode)->i_reserved_meta_blocks = mdb;
         }
-
-        /* update per-inode reservations */
-        BUG_ON(used  > EXT4_I(inode)->i_reserved_data_blocks);
-        EXT4_I(inode)->i_reserved_data_blocks -= used;
-        percpu_counter_sub(&sbi->s_dirtyblocks_counter, used + mdb_claim);
         spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
 
-        vfs_dq_claim_block(inode, used + mdb_claim);
-
-        /*
-         * free those over-booking quota for metadata blocks
-         */
+        /* Update quota subsystem */
+        vfs_dq_claim_block(inode, used);
         if (mdb_free)
                 vfs_dq_release_reservation_block(inode, mdb_free);
 
@@ -1088,7 +1099,8 @@ static void ext4_da_update_reserve_space(struct inode *inode, int used)
          * there aren't any writers on the inode, we can discard the
          * inode's preallocations.
          */
-        if (!total && (atomic_read(&inode->i_writecount) == 0))
+        if ((ei->i_reserved_data_blocks == 0) &&
+            (atomic_read(&inode->i_writecount) == 0))
                 ext4_discard_preallocations(inode);
 }
 
@@ -1797,11 +1809,15 @@ static int ext4_journalled_write_end(struct file *file,
         return ret ? ret : copied;
 }
 
-static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
+/*
+ * Reserve a single block located at lblock
+ */
+static int ext4_da_reserve_space(struct inode *inode, sector_t lblock)
 {
         int retries = 0;
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        unsigned long md_needed, mdblocks, total = 0;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned long md_needed, md_reserved;
 
         /*
          * recalculate the amount of metadata blocks to reserve
@@ -1809,35 +1825,43 @@ static int ext4_da_reserve_space(struct inode *inode, int nrblocks)
          * worse case is one extent per block
          */
 repeat:
-        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-        total = EXT4_I(inode)->i_reserved_data_blocks + nrblocks;
-        mdblocks = ext4_calc_metadata_amount(inode, total);
-        BUG_ON(mdblocks < EXT4_I(inode)->i_reserved_meta_blocks);
-
-        md_needed = mdblocks - EXT4_I(inode)->i_reserved_meta_blocks;
-        total = md_needed + nrblocks;
-        spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+        spin_lock(&ei->i_block_reservation_lock);
+        md_reserved = ei->i_reserved_meta_blocks;
+        md_needed = ext4_calc_metadata_amount(inode, lblock);
+        spin_unlock(&ei->i_block_reservation_lock);
 
         /*
          * Make quota reservation here to prevent quota overflow
          * later. Real quota accounting is done at pages writeout
          * time.
          */
-        if (vfs_dq_reserve_block(inode, total))
+        if (vfs_dq_reserve_block(inode, md_needed + 1)) {
+                /* 
+                 * We tend to badly over-estimate the amount of
+                 * metadata blocks which are needed, so if we have
+                 * reserved any metadata blocks, try to force out the
+                 * inode and see if we have any better luck.
+                 */
+                if (md_reserved && retries++ <= 3)
+                        goto retry;
                 return -EDQUOT;
+        }
 
-        if (ext4_claim_free_blocks(sbi, total)) {
-                vfs_dq_release_reservation_block(inode, total);
+        if (ext4_claim_free_blocks(sbi, md_needed + 1)) {
+                vfs_dq_release_reservation_block(inode, md_needed + 1);
                 if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
+                retry:
+                        if (md_reserved)
+                                write_inode_now(inode, (retries == 3));
                         yield();
                         goto repeat;
                 }
                 return -ENOSPC;
         }
-        spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-        EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
-        EXT4_I(inode)->i_reserved_meta_blocks += md_needed;
-        spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+        spin_lock(&ei->i_block_reservation_lock);
+        ei->i_reserved_data_blocks++;
+        ei->i_reserved_meta_blocks += md_needed;
+        spin_unlock(&ei->i_block_reservation_lock);
 
         return 0;       /* success */
 }
@@ -1845,49 +1869,46 @@ repeat:
 static void ext4_da_release_space(struct inode *inode, int to_free)
 {
         struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
-        int total, mdb, mdb_free, release;
+        struct ext4_inode_info *ei = EXT4_I(inode);
 
         if (!to_free)
                 return;         /* Nothing to release, exit */
 
         spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
 
-        if (!EXT4_I(inode)->i_reserved_data_blocks) {
+        if (unlikely(to_free > ei->i_reserved_data_blocks)) {
                 /*
-                 * if there is no reserved blocks, but we try to free some
-                 * then the counter is messed up somewhere.
-                 * but since this function is called from invalidate
-                 * page, it's harmless to return without any action
+                 * if there aren't enough reserved blocks, then the
+                 * counter is messed up somewhere.  Since this
+                 * function is called from invalidate page, it's
+                 * harmless to return without any action.
                  */
-                printk(KERN_INFO "ext4 delalloc try to release %d reserved "
-                            "blocks for inode %lu, but there is no reserved "
-                            "data blocks\n", to_free, inode->i_ino);
-                spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
-                return;
+                ext4_msg(inode->i_sb, KERN_NOTICE, "ext4_da_release_space: "
+                         "ino %lu, to_free %d with only %d reserved "
+                         "data blocks\n", inode->i_ino, to_free,
+                         ei->i_reserved_data_blocks);
+                WARN_ON(1);
+                to_free = ei->i_reserved_data_blocks;
         }
+        ei->i_reserved_data_blocks -= to_free;
 
-        /* recalculate the number of metablocks still need to be reserved */
-        total = EXT4_I(inode)->i_reserved_data_blocks - to_free;
-        mdb = ext4_calc_metadata_amount(inode, total);
-
-        /* figure out how many metablocks to release */
-        BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
-        mdb_free = EXT4_I(inode)->i_reserved_meta_blocks - mdb;
-
-        release = to_free + mdb_free;
-
-        /* update fs dirty blocks counter for truncate case */
-        percpu_counter_sub(&sbi->s_dirtyblocks_counter, release);
+        if (ei->i_reserved_data_blocks == 0) {
+                /*
+                 * We can release all of the reserved metadata blocks
+                 * only when we have written all of the delayed
+                 * allocation blocks.
+                 */
+                to_free += ei->i_reserved_meta_blocks;
+                ei->i_reserved_meta_blocks = 0;
+                ei->i_da_metadata_calc_len = 0;
+        }
 
-        /* update per-inode reservations */
-        BUG_ON(to_free > EXT4_I(inode)->i_reserved_data_blocks);
-        EXT4_I(inode)->i_reserved_data_blocks -= to_free;
+        /* update fs dirty blocks counter */
+        percpu_counter_sub(&sbi->s_dirtyblocks_counter, to_free);
 
-        BUG_ON(mdb > EXT4_I(inode)->i_reserved_meta_blocks);
-        EXT4_I(inode)->i_reserved_meta_blocks = mdb;
         spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
 
-        vfs_dq_release_reservation_block(inode, release);
+        vfs_dq_release_reservation_block(inode, to_free);
 }
 
 static void ext4_da_page_release_reservation(struct page *page,
@@ -2493,7 +2514,7 @@ static int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                  * XXX: __block_prepare_write() unmaps passed block,
                  * is it OK?
                  */
-                ret = ext4_da_reserve_space(inode, 1);
+                ret = ext4_da_reserve_space(inode, iblock);
                 if (ret)
                         /* not enough space to reserve */
                         return ret;
@@ -2967,8 +2988,7 @@ retry:
 out_writepages:
         if (!no_nrwrite_index_update)
                 wbc->no_nrwrite_index_update = 0;
-        if (wbc->nr_to_write > nr_to_writebump)
-                wbc->nr_to_write -= nr_to_writebump;
+        wbc->nr_to_write -= nr_to_writebump;
         wbc->range_start = range_start;
         trace_ext4_da_writepages_result(inode, wbc, ret, pages_written);
         return ret;
@@ -2993,11 +3013,18 @@ static int ext4_nonda_switch(struct super_block *sb)
         if (2 * free_blocks < 3 * dirty_blocks ||
                 free_blocks < (dirty_blocks + EXT4_FREEBLOCKS_WATERMARK)) {
                 /*
-                 * free block count is less that 150% of dirty blocks
-                 * or free blocks is less that watermark
+                 * free block count is less than 150% of dirty blocks
+                 * or free blocks is less than watermark
                  */
                 return 1;
         }
+        /*
+         * Even if we don't switch but are nearing capacity,
+         * start pushing delalloc when 1/2 of free blocks are dirty.
+         */
+        if (free_blocks < 2 * dirty_blocks)
+                writeback_inodes_sb_if_idle(sb);
+
         return 0;
 }
 
diff --git a/fs/ext4/mballoc.h b/fs/ext4/mballoc.h
index 0ca811061bc7..436521cae456 100644
--- a/fs/ext4/mballoc.h
+++ b/fs/ext4/mballoc.h
@@ -17,7 +17,6 @@
 #include <linux/proc_fs.h>
 #include <linux/pagemap.h>
 #include <linux/seq_file.h>
-#include <linux/version.h>
 #include <linux/blkdev.h>
 #include <linux/mutex.h>
 #include "ext4_jbd2.h"
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 6ed9aa91f27d..735c20d5fd56 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -702,6 +702,7 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
         ei->i_reserved_data_blocks = 0;
         ei->i_reserved_meta_blocks = 0;
         ei->i_allocated_meta_blocks = 0;
+        ei->i_da_metadata_calc_len = 0;
         ei->i_delalloc_reserved_flag = 0;
         spin_lock_init(&(ei->i_block_reservation_lock));
 #ifdef CONFIG_QUOTA
@@ -2174,9 +2175,9 @@ static ssize_t lifetime_write_kbytes_show(struct ext4_attr *a,
         struct super_block *sb = sbi->s_buddy_cache->i_sb;
 
         return snprintf(buf, PAGE_SIZE, "%llu\n",
-                        sbi->s_kbytes_written + 
+                        (unsigned long long)(sbi->s_kbytes_written +
                         ((part_stat_read(sb->s_bdev->bd_part, sectors[1]) -
-                          EXT4_SB(sb)->s_sectors_written_start) >> 1));
+                          EXT4_SB(sb)->s_sectors_written_start) >> 1)));
 }
 
 static ssize_t inode_readahead_blks_store(struct ext4_attr *a,
@@ -4005,6 +4006,7 @@ static inline void unregister_as_ext2(void)
 {
         unregister_filesystem(&ext2_fs_type);
 }
+MODULE_ALIAS("ext2");
 #else
 static inline void register_as_ext2(void) { }
 static inline void unregister_as_ext2(void) { }
@@ -4031,6 +4033,7 @@ static inline void unregister_as_ext3(void)
 {
         unregister_filesystem(&ext3_fs_type);
 }
+MODULE_ALIAS("ext3");
 #else
 static inline void register_as_ext3(void) { }
 static inline void unregister_as_ext3(void) { }
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 83218bebbc7c..f3a2f7ed45aa 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1332,6 +1332,8 @@ retry:
                         goto cleanup;
                 kfree(b_entry_name);
                 kfree(buffer);
+                b_entry_name = NULL;
+                buffer = NULL;
                 brelse(is->iloc.bh);
                 kfree(is);
                 kfree(bs);
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 2cf93ec40a67..97e01dc0d95f 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -618,60 +618,90 @@ static DEFINE_RWLOCK(fasync_lock);
 static struct kmem_cache *fasync_cache __read_mostly;
 
 /*
- * fasync_helper() is used by almost all character device drivers
- * to set up the fasync queue. It returns negative on error, 0 if it did
- * no changes and positive if it added/deleted the entry.
+ * Remove a fasync entry. If successfully removed, return
+ * positive and clear the FASYNC flag. If no entry exists,
+ * do nothing and return 0.
+ *
+ * NOTE! It is very important that the FASYNC flag always
+ * match the state "is the filp on a fasync list".
+ *
+ * We always take the 'filp->f_lock', in since fasync_lock
+ * needs to be irq-safe.
  */
-int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
+static int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
 {
         struct fasync_struct *fa, **fp;
-        struct fasync_struct *new = NULL;
         int result = 0;
 
-        if (on) {
-                new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
-                if (!new)
-                        return -ENOMEM;
+        spin_lock(&filp->f_lock);
+        write_lock_irq(&fasync_lock);
+        for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
+                if (fa->fa_file != filp)
+                        continue;
+                *fp = fa->fa_next;
+                kmem_cache_free(fasync_cache, fa);
+                filp->f_flags &= ~FASYNC;
+                result = 1;
+                break;
         }
+        write_unlock_irq(&fasync_lock);
+        spin_unlock(&filp->f_lock);
+        return result;
+}
+
+/*
+ * Add a fasync entry. Return negative on error, positive if
+ * added, and zero if did nothing but change an existing one.
+ *
+ * NOTE! It is very important that the FASYNC flag always
+ * match the state "is the filp on a fasync list".
+ */
+static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
+{
+        struct fasync_struct *new, *fa, **fp;
+        int result = 0;
+
+        new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
+        if (!new)
+                return -ENOMEM;
 
-        /*
-         * We need to take f_lock first since it's not an IRQ-safe
-         * lock.
-         */
         spin_lock(&filp->f_lock);
         write_lock_irq(&fasync_lock);
         for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
-                if (fa->fa_file == filp) {
-                        if(on) {
-                                fa->fa_fd = fd;
-                                kmem_cache_free(fasync_cache, new);
-                        } else {
-                                *fp = fa->fa_next;
-                                kmem_cache_free(fasync_cache, fa);
-                                result = 1;
-                        }
-                        goto out;
-                }
+                if (fa->fa_file != filp)
+                        continue;
+                fa->fa_fd = fd;
+                kmem_cache_free(fasync_cache, new);
+                goto out;
         }
 
-        if (on) {
-                new->magic = FASYNC_MAGIC;
-                new->fa_file = filp;
-                new->fa_fd = fd;
-                new->fa_next = *fapp;
-                *fapp = new;
-                result = 1;
-        }
+        new->magic = FASYNC_MAGIC;
+        new->fa_file = filp;
+        new->fa_fd = fd;
+        new->fa_next = *fapp;
+        *fapp = new;
+        result = 1;
+        filp->f_flags |= FASYNC;
+
 out:
-        if (on)
-                filp->f_flags |= FASYNC;
-        else
-                filp->f_flags &= ~FASYNC;
         write_unlock_irq(&fasync_lock);
         spin_unlock(&filp->f_lock);
         return result;
 }
 
+/*
+ * fasync_helper() is used by almost all character device drivers
+ * to set up the fasync queue, and for regular files by the file
+ * lease code. It returns negative on error, 0 if it did no changes
+ * and positive if it added/deleted the entry.
+ */
+int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
+{
+        if (!on)
+                return fasync_remove_entry(filp, fapp);
+        return fasync_add_entry(fd, filp, fapp);
+}
+
 EXPORT_SYMBOL(fasync_helper);
 
 void __kill_fasync(struct fasync_struct *fa, int sig, int band)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 49bc1b8e8f19..1a7c42c64ff4 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -242,6 +242,7 @@ static void bdi_sync_writeback(struct backing_dev_info *bdi,
 /**
  * bdi_start_writeback - start writeback
  * @bdi: the backing device to write from
+ * @sb: write inodes from this super_block
  * @nr_pages: the number of pages to write
  *
  * Description:
@@ -1187,6 +1188,23 @@ void writeback_inodes_sb(struct super_block *sb)
 EXPORT_SYMBOL(writeback_inodes_sb);
 
 /**
+ * writeback_inodes_sb_if_idle  -       start writeback if none underway
+ * @sb: the superblock
+ *
+ * Invoke writeback_inodes_sb if no writeback is currently underway.
+ * Returns 1 if writeback was started, 0 if not.
+ */
+int writeback_inodes_sb_if_idle(struct super_block *sb)
+{
+        if (!writeback_in_progress(sb->s_bdi)) {
+                writeback_inodes_sb(sb);
+                return 1;
+        } else
+                return 0;
+}
+EXPORT_SYMBOL(writeback_inodes_sb_if_idle);
+
+/**
  * sync_inodes_sb       -       sync sb inode pages
  * @sb: the superblock
  *
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 4eb308aa3234..a6abbae8a278 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -569,6 +569,40 @@ static int gfs2_fsync(struct file *file, struct dentry *dentry, int datasync)
         return ret;
 }
 
+/**
+ * gfs2_file_aio_write - Perform a write to a file
+ * @iocb: The io context
+ * @iov: The data to write
+ * @nr_segs: Number of @iov segments
+ * @pos: The file position
+ *
+ * We have to do a lock/unlock here to refresh the inode size for
+ * O_APPEND writes, otherwise we can land up writing at the wrong
+ * offset. There is still a race, but provided the app is using its
+ * own file locking, this will make O_APPEND work as expected.
+ *
+ */
+
+static ssize_t gfs2_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+                                   unsigned long nr_segs, loff_t pos)
+{
+        struct file *file = iocb->ki_filp;
+
+        if (file->f_flags & O_APPEND) {
+                struct dentry *dentry = file->f_dentry;
+                struct gfs2_inode *ip = GFS2_I(dentry->d_inode);
+                struct gfs2_holder gh;
+                int ret;
+
+                ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
+                if (ret)
+                        return ret;
+                gfs2_glock_dq_uninit(&gh);
+        }
+
+        return generic_file_aio_write(iocb, iov, nr_segs, pos);
+}
+
 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
 
 /**
@@ -711,7 +745,7 @@ const struct file_operations gfs2_file_fops = {
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
         .write          = do_sync_write,
-        .aio_write      = generic_file_aio_write,
+        .aio_write      = gfs2_file_aio_write,
         .unlocked_ioctl = gfs2_ioctl,
         .mmap           = gfs2_mmap,
         .open           = gfs2_open,
@@ -741,7 +775,7 @@ const struct file_operations gfs2_file_fops_nolock = {
         .read           = do_sync_read,
         .aio_read       = generic_file_aio_read,
         .write          = do_sync_write,
-        .aio_write      = generic_file_aio_write,
+        .aio_write      = gfs2_file_aio_write,
         .unlocked_ioctl = gfs2_ioctl,
         .mmap           = gfs2_mmap,
         .open           = gfs2_open,
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index cb8d7a93d5ec..6f68a5f18eb8 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -121,7 +121,7 @@ struct inode *gfs2_aspace_get(struct gfs2_sbd *sdp)
         if (aspace) {
                 mapping_set_gfp_mask(aspace->i_mapping, GFP_NOFS);
                 aspace->i_mapping->a_ops = &aspace_aops;
-                aspace->i_size = ~0ULL;
+                aspace->i_size = MAX_LFS_FILESIZE;
                 ip = GFS2_I(aspace);
                 clear_bit(GIF_USER, &ip->i_flags);
                 insert_inode_hash(aspace);
diff --git a/fs/gfs2/ops_inode.c b/fs/gfs2/ops_inode.c
index 247436c10deb..78f73ca1ef3e 100644
--- a/fs/gfs2/ops_inode.c
+++ b/fs/gfs2/ops_inode.c
@@ -748,7 +748,7 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
         struct gfs2_rgrpd *nrgd;
         unsigned int num_gh;
         int dir_rename = 0;
-        int alloc_required;
+        int alloc_required = 0;
         unsigned int x;
         int error;
 
@@ -867,7 +867,9 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
                         goto out_gunlock;
         }
 
-        alloc_required = error = gfs2_diradd_alloc_required(ndir, &ndentry->d_name);
+        if (nip == NULL)
+                alloc_required = gfs2_diradd_alloc_required(ndir, &ndentry->d_name);
+        error = alloc_required;
         if (error < 0)
                 goto out_gunlock;
         error = 0;
diff --git a/fs/gfs2/xattr.c b/fs/gfs2/xattr.c
index 8a04108e0c22..c2ebdf2c01d4 100644
--- a/fs/gfs2/xattr.c
+++ b/fs/gfs2/xattr.c
@@ -1296,6 +1296,7 @@ fail:
 
 int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
 {
+        struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
         struct gfs2_ea_location el;
         struct buffer_head *dibh;
         int error;
@@ -1305,16 +1306,17 @@ int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
                 return error;
 
         if (GFS2_EA_IS_STUFFED(el.el_ea)) {
-                error = gfs2_trans_begin(GFS2_SB(&ip->i_inode), RES_DINODE + RES_EATTR, 0);
-                if (error)
-                        return error;
-
-                gfs2_trans_add_bh(ip->i_gl, el.el_bh, 1);
-                memcpy(GFS2_EA2DATA(el.el_ea), data,
-                       GFS2_EA_DATA_LEN(el.el_ea));
-        } else
+                error = gfs2_trans_begin(sdp, RES_DINODE + RES_EATTR, 0);
+                if (error == 0) {
+                        gfs2_trans_add_bh(ip->i_gl, el.el_bh, 1);
+                        memcpy(GFS2_EA2DATA(el.el_ea), data,
+                               GFS2_EA_DATA_LEN(el.el_ea));
+                }
+        } else {
                 error = ea_acl_chmod_unstuffed(ip, el.el_ea, data);
+        }
 
+        brelse(el.el_bh);
         if (error)
                 return error;
 
@@ -1327,8 +1329,7 @@ int gfs2_xattr_acl_chmod(struct gfs2_inode *ip, struct iattr *attr, char *data)
                 brelse(dibh);
         }
 
-        gfs2_trans_end(GFS2_SB(&ip->i_inode));
-
+        gfs2_trans_end(sdp);
         return error;
 }
 
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index a5089a6dd67a..7239efc690d8 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -646,22 +646,27 @@ static const struct super_operations hppfs_sbops = {
 static int hppfs_readlink(struct dentry *dentry, char __user *buffer,
                           int buflen)
 {
-        struct dentry *proc_dentry;
-
-        proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
         return proc_dentry->d_inode->i_op->readlink(proc_dentry, buffer,
                                                     buflen);
 }
 
 static void *hppfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
-        struct dentry *proc_dentry;
-
-        proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
 
         return proc_dentry->d_inode->i_op->follow_link(proc_dentry, nd);
 }
 
+static void hppfs_put_link(struct dentry *dentry, struct nameidata *nd,
+                           void *cookie)
+{
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+
+        if (proc_dentry->d_inode->i_op->put_link)
+                proc_dentry->d_inode->i_op->put_link(proc_dentry, nd, cookie);
+}
+
 static const struct inode_operations hppfs_dir_iops = {
         .lookup         = hppfs_lookup,
 };
@@ -669,6 +674,7 @@ static const struct inode_operations hppfs_dir_iops = {
 static const struct inode_operations hppfs_link_iops = {
         .readlink       = hppfs_readlink,
         .follow_link    = hppfs_follow_link,
+        .put_link       = hppfs_put_link,
 };
 
 static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
index ca0f5eb62b20..886849370950 100644
--- a/fs/jbd2/checkpoint.c
+++ b/fs/jbd2/checkpoint.c
@@ -22,6 +22,7 @@
 #include <linux/jbd2.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
+#include <linux/blkdev.h>
 #include <trace/events/jbd2.h>
 
 /*
@@ -515,6 +516,20 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
         journal->j_tail_sequence = first_tid;
         journal->j_tail = blocknr;
         spin_unlock(&journal->j_state_lock);
+
+        /*
+         * If there is an external journal, we need to make sure that
+         * any data blocks that were recently written out --- perhaps
+         * by jbd2_log_do_checkpoint() --- are flushed out before we
+         * drop the transactions from the external journal.  It's
+         * unlikely this will be necessary, especially with a
+         * appropriately sized journal, but we need this to guarantee
+         * correctness.  Fortunately jbd2_cleanup_journal_tail()
+         * doesn't get called all that often.
+         */
+        if ((journal->j_fs_dev != journal->j_dev) &&
+            (journal->j_flags & JBD2_BARRIER))
+                blkdev_issue_flush(journal->j_fs_dev, NULL);
         if (!(journal->j_flags & JBD2_ABORT))
                 jbd2_journal_update_superblock(journal, 1);
         return 0;
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 6a10238d2c63..1bc74b6f26d2 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -259,6 +259,7 @@ static int journal_submit_data_buffers(journal_t *journal,
                         ret = err;
                 spin_lock(&journal->j_list_lock);
                 J_ASSERT(jinode->i_transaction == commit_transaction);
+                commit_transaction->t_flushed_data_blocks = 1;
                 jinode->i_flags &= ~JI_COMMIT_RUNNING;
                 wake_up_bit(&jinode->i_flags, __JI_COMMIT_RUNNING);
         }
@@ -708,8 +709,17 @@ start_journal_io:
                 }
         }
 
-        /* Done it all: now write the commit record asynchronously. */
+        /* 
+         * If the journal is not located on the file system device,
+         * then we must flush the file system device before we issue
+         * the commit record
+         */
+        if (commit_transaction->t_flushed_data_blocks &&
+            (journal->j_fs_dev != journal->j_dev) &&
+            (journal->j_flags & JBD2_BARRIER))
+                blkdev_issue_flush(journal->j_fs_dev, NULL);
 
+        /* Done it all: now write the commit record asynchronously. */
         if (JBD2_HAS_INCOMPAT_FEATURE(journal,
                                       JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT)) {
                 err = journal_submit_commit_record(journal, commit_transaction,
@@ -720,13 +730,6 @@ start_journal_io:
                         blkdev_issue_flush(journal->j_dev, NULL);
         }
 
-        /*
-         * This is the right place to wait for data buffers both for ASYNC
-         * and !ASYNC commit. If commit is ASYNC, we need to wait only after
-         * the commit block went to disk (which happens above). If commit is
-         * SYNC, we need to wait for data buffers before we start writing
-         * commit block, which happens below in such setting.
-         */
         err = journal_finish_inode_data_buffers(journal, commit_transaction);
         if (err) {
                 printk(KERN_WARNING
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 17af879e6e9e..ac0d027595d0 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -814,7 +814,7 @@ static journal_t * journal_init_common (void)
         journal_t *journal;
         int err;
 
-        journal = kzalloc(sizeof(*journal), GFP_KERNEL|__GFP_NOFAIL);
+        journal = kzalloc(sizeof(*journal), GFP_KERNEL);
         if (!journal)
                 goto fail;
 
diff --git a/fs/namei.c b/fs/namei.c
index 68921d9b5302..94a5e60779f9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -232,6 +232,7 @@ int generic_permission(struct inode *inode, int mask,
         /*
          * Searching includes executable on directories, else just read.
          */
+        mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
         if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
                 if (capable(CAP_DAC_READ_SEARCH))
                         return 0;
@@ -560,6 +561,7 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
                 dget(dentry);
         }
         mntget(path->mnt);
+        nd->last_type = LAST_BIND;
         cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
         error = PTR_ERR(cookie);
         if (!IS_ERR(cookie)) {
@@ -1602,11 +1604,12 @@ struct file *do_filp_open(int dfd, const char *pathname,
         struct file *filp;
         struct nameidata nd;
         int error;
-        struct path path, save;
+        struct path path;
         struct dentry *dir;
         int count = 0;
         int will_truncate;
         int flag = open_to_namei_flags(open_flag);
+        int force_reval = 0;
 
         /*
          * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
@@ -1618,7 +1621,7 @@ struct file *do_filp_open(int dfd, const char *pathname,
                 open_flag |= O_DSYNC;
 
         if (!acc_mode)
-                acc_mode = MAY_OPEN | ACC_MODE(flag);
+                acc_mode = MAY_OPEN | ACC_MODE(open_flag);
 
         /* O_TRUNC implies we need access checks for write permissions */
         if (flag & O_TRUNC)
@@ -1658,9 +1661,12 @@ struct file *do_filp_open(int dfd, const char *pathname,
         /*
          * Create - we need to know the parent.
          */
+reval:
         error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
         if (error)
                 return ERR_PTR(error);
+        if (force_reval)
+                nd.flags |= LOOKUP_REVAL;
         error = path_walk(pathname, &nd);
         if (error) {
                 if (nd.root.mnt)
@@ -1852,17 +1858,7 @@ do_link:
         error = security_inode_follow_link(path.dentry, &nd);
         if (error)
                 goto exit_dput;
-        save = nd.path;
-        path_get(&save);
         error = __do_follow_link(&path, &nd);
-        if (error == -ESTALE) {
-                /* nd.path had been dropped */
-                nd.path = save;
-                path_get(&nd.path);
-                nd.flags |= LOOKUP_REVAL;
-                error = __do_follow_link(&path, &nd);
-        }
-        path_put(&save);
         path_put(&path);
         if (error) {
                 /* Does someone understand code flow here? Or it is only
@@ -1872,6 +1868,10 @@ do_link:
                 release_open_intent(&nd);
                 if (nd.root.mnt)
                         path_put(&nd.root);
+                if (error == -ESTALE && !force_reval) {
+                        force_reval = 1;
+                        goto reval;
+                }
                 return ERR_PTR(error);
         }
         nd.flags &= ~LOOKUP_PARENT;
diff --git a/fs/namespace.c b/fs/namespace.c
index 7d70d63ceb29..c768f733c8d6 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -965,10 +965,12 @@ EXPORT_SYMBOL(may_umount_tree);
 int may_umount(struct vfsmount *mnt)
 {
         int ret = 1;
+        down_read(&namespace_sem);
         spin_lock(&vfsmount_lock);
         if (propagate_mount_busy(mnt, 2))
                 ret = 0;
         spin_unlock(&vfsmount_lock);
+        up_read(&namespace_sem);
         return ret;
 }
 
@@ -1352,12 +1354,12 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt,
         if (err)
                 goto out_cleanup_ids;
 
+        spin_lock(&vfsmount_lock);
+
         if (IS_MNT_SHARED(dest_mnt)) {
                 for (p = source_mnt; p; p = next_mnt(p, source_mnt))
                         set_mnt_shared(p);
         }
-
-        spin_lock(&vfsmount_lock);
         if (parent_path) {
                 detach_mnt(source_mnt, parent_path);
                 attach_mnt(source_mnt, path);
@@ -1534,8 +1536,12 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
                 err = change_mount_flags(path->mnt, flags);
         else
                 err = do_remount_sb(sb, flags, data, 0);
-        if (!err)
+        if (!err) {
+                spin_lock(&vfsmount_lock);
+                mnt_flags |= path->mnt->mnt_flags & MNT_PNODE_MASK;
                 path->mnt->mnt_flags = mnt_flags;
+                spin_unlock(&vfsmount_lock);
+        }
         up_write(&sb->s_umount);
         if (!err) {
                 security_sb_post_remount(path->mnt, flags, data);
@@ -1665,6 +1671,8 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path,
 {
         int err;
 
+        mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD);
+
         down_write(&namespace_sem);
         /* Something was mounted here while we slept */
         while (d_mountpoint(path->dentry) &&
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2c5ace4f00a7..3c7f03b669fb 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1615,6 +1615,7 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 goto out;
 
                         new_dentry = dentry;
+                        rehash = NULL;
                         new_inode = NULL;
                 }
         }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7c2e337d05af..c194793b642b 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -780,12 +780,9 @@ static inline int nfsd_dosync(struct file *filp, struct dentry *dp,
         int (*fsync) (struct file *, struct dentry *, int);
         int err;
 
-        err = filemap_fdatawrite(inode->i_mapping);
+        err = filemap_write_and_wait(inode->i_mapping);
         if (err == 0 && fop && (fsync = fop->fsync))
                 err = fsync(filp, dp, 0);
-        if (err == 0)
-                err = filemap_fdatawait(inode->i_mapping);
-
         return err;
 }
 
diff --git a/fs/nilfs2/bmap.c b/fs/nilfs2/bmap.c
index f4a14ea2ed9c..effdbdbe6c11 100644
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -417,8 +417,8 @@ __u64 nilfs_bmap_data_get_key(const struct nilfs_bmap *bmap,
 
         key = page_index(bh->b_page) << (PAGE_CACHE_SHIFT -
                                          bmap->b_inode->i_blkbits);
-        for (pbh = page_buffers(bh->b_page); pbh != bh;
-             pbh = pbh->b_this_page, key++);
+        for (pbh = page_buffers(bh->b_page); pbh != bh; pbh = pbh->b_this_page)
+                key++;
 
         return key;
 }
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index d5ad54e204a5..18737818db63 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -328,19 +328,24 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                         tnicps += nicps;
                         nilfs_mdt_mark_buffer_dirty(cp_bh);
                         nilfs_mdt_mark_dirty(cpfile);
-                        if (!nilfs_cpfile_is_in_first(cpfile, cno) &&
-                            (count = nilfs_cpfile_block_sub_valid_checkpoints(
-                                    cpfile, cp_bh, kaddr, nicps)) == 0) {
-                                /* make hole */
-                                kunmap_atomic(kaddr, KM_USER0);
-                                brelse(cp_bh);
-                                ret = nilfs_cpfile_delete_checkpoint_block(
-                                        cpfile, cno);
-                                if (ret == 0)
-                                        continue;
-                                printk(KERN_ERR "%s: cannot delete block\n",
-                                       __func__);
-                                break;
+                        if (!nilfs_cpfile_is_in_first(cpfile, cno)) {
+                                count =
+                                  nilfs_cpfile_block_sub_valid_checkpoints(
+                                                cpfile, cp_bh, kaddr, nicps);
+                                if (count == 0) {
+                                        /* make hole */
+                                        kunmap_atomic(kaddr, KM_USER0);
+                                        brelse(cp_bh);
+                                        ret =
+                                          nilfs_cpfile_delete_checkpoint_block(
+                                                                   cpfile, cno);
+                                        if (ret == 0)
+                                                continue;
+                                        printk(KERN_ERR
+                                               "%s: cannot delete block\n",
+                                               __func__);
+                                        break;
+                                }
                         }
                 }
 
diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index d369ac718277..236753df5cdf 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -51,11 +51,11 @@ static int nilfs_direct_lookup(const struct nilfs_bmap *bmap,
         struct nilfs_direct *direct;
         __u64 ptr;
 
-        direct = (struct nilfs_direct *)bmap;
-        if ((key > NILFS_DIRECT_KEY_MAX) ||
-            (level != 1) ||     /* XXX: use macro for level 1 */
-            ((ptr = nilfs_direct_get_ptr(direct, key)) ==
-             NILFS_BMAP_INVALID_PTR))
+        direct = (struct nilfs_direct *)bmap;  /* XXX: use macro for level 1 */
+        if (key > NILFS_DIRECT_KEY_MAX || level != 1)
+                return -ENOENT;
+        ptr = nilfs_direct_get_ptr(direct, key);
+        if (ptr == NILFS_BMAP_INVALID_PTR)
                 return -ENOENT;
 
         if (ptrp != NULL)
@@ -73,9 +73,10 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *bmap,
         sector_t blocknr;
         int ret, cnt;
 
-        if (key > NILFS_DIRECT_KEY_MAX ||
-            (ptr = nilfs_direct_get_ptr(direct, key)) ==
-            NILFS_BMAP_INVALID_PTR)
+        if (key > NILFS_DIRECT_KEY_MAX)
+                return -ENOENT;
+        ptr = nilfs_direct_get_ptr(direct, key);
+        if (ptr == NILFS_BMAP_INVALID_PTR)
                 return -ENOENT;
 
         if (NILFS_BMAP_USE_VBN(bmap)) {
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index f6af76042d80..d6b2b83de363 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -480,7 +480,7 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
                                       unsigned int cmd, void __user *argp)
 {
         struct nilfs_argv argv[5];
-        const static size_t argsz[5] = {
+        static const size_t argsz[5] = {
                 sizeof(struct nilfs_vdesc),
                 sizeof(struct nilfs_period),
                 sizeof(__u64),
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index c9ee67b442e1..1afb0a10229f 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -121,7 +121,7 @@ static int idr_callback(int id, void *p, void *data)
         if (warned)
                 return 0;
 
-        warned = false;
+        warned = true;
         entry = p;
         ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry);
 
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 8271cf05c957..a94e8bd8eb1f 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -552,7 +552,7 @@ retry:
 
         spin_lock(&group->inotify_data.idr_lock);
         ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
-                                group->inotify_data.last_wd,
+                                group->inotify_data.last_wd+1,
                                 &tmp_ientry->wd);
         spin_unlock(&group->inotify_data.idr_lock);
         if (ret) {
@@ -632,7 +632,7 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
 
         spin_lock_init(&group->inotify_data.idr_lock);
         idr_init(&group->inotify_data.idr);
-        group->inotify_data.last_wd = 1;
+        group->inotify_data.last_wd = 0;
         group->inotify_data.user = user;
         group->inotify_data.fa = NULL;
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 3d30a1c974a8..06ccf6a86d35 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1772,7 +1772,8 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                                          loff_t *ppos,
                                          size_t count,
                                          int appending,
-                                         int *direct_io)
+                                         int *direct_io,
+                                         int *has_refcount)
 {
         int ret = 0, meta_level = 0;
         struct inode *inode = dentry->d_inode;
@@ -1833,6 +1834,8 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                                                                saved_pos,
                                                                count,
                                                                &meta_level);
+                        if (has_refcount)
+                                *has_refcount = 1;
                 }
 
                 if (ret < 0) {
@@ -1856,6 +1859,10 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
                         break;
                 }
 
+                if (has_refcount && *has_refcount == 1) {
+                        *direct_io = 0;
+                        break;
+                }
                 /*
                  * Allowing concurrent direct writes means
                  * i_size changes wouldn't be synchronized, so
@@ -1899,7 +1906,7 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                                     loff_t pos)
 {
         int ret, direct_io, appending, rw_level, have_alloc_sem  = 0;
-        int can_do_direct;
+        int can_do_direct, has_refcount = 0;
         ssize_t written = 0;
         size_t ocount;          /* original count */
         size_t count;           /* after file limit checks */
@@ -1942,7 +1949,7 @@ relock:
         can_do_direct = direct_io;
         ret = ocfs2_prepare_inode_for_write(file->f_path.dentry, ppos,
                                             iocb->ki_left, appending,
-                                            &can_do_direct);
+                                            &can_do_direct, &has_refcount);
         if (ret < 0) {
                 mlog_errno(ret);
                 goto out;
@@ -2006,14 +2013,16 @@ out_dio:
         /* buffered aio wouldn't have proper lock coverage today */
         BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
 
-        if ((file->f_flags & O_DSYNC && !direct_io) || IS_SYNC(inode)) {
+        if ((file->f_flags & O_DSYNC && !direct_io) || IS_SYNC(inode) ||
+            (file->f_flags & O_DIRECT && has_refcount)) {
                 ret = filemap_fdatawrite_range(file->f_mapping, pos,
                                                pos + count - 1);
                 if (ret < 0)
                         written = ret;
 
                 if (!ret && (old_size != i_size_read(inode) ||
-                    old_clusters != OCFS2_I(inode)->ip_clusters)) {
+                    old_clusters != OCFS2_I(inode)->ip_clusters ||
+                    has_refcount)) {
                         ret = jbd2_journal_force_commit(osb->journal->j_journal);
                         if (ret < 0)
                                 written = ret;
@@ -2062,7 +2071,7 @@ static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
         int ret;
 
         ret = ocfs2_prepare_inode_for_write(out->f_path.dentry, &sd->pos,
-                                            sd->total_len, 0, NULL);
+                                            sd->total_len, 0, NULL, NULL);
         if (ret < 0) {
                 mlog_errno(ret);
                 return ret;
diff --git a/fs/proc/array.c b/fs/proc/array.c
index f560325c444f..13b5d0708175 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -327,94 +327,6 @@ static inline void task_context_switch_counts(struct seq_file *m,
                         p->nivcsw);
 }
 
-#ifdef CONFIG_MMU
-
-struct stack_stats {
-        struct vm_area_struct *vma;
-        unsigned long   startpage;
-        unsigned long   usage;
-};
-
-static int stack_usage_pte_range(pmd_t *pmd, unsigned long addr,
-                                unsigned long end, struct mm_walk *walk)
-{
-        struct stack_stats *ss = walk->private;
-        struct vm_area_struct *vma = ss->vma;
-        pte_t *pte, ptent;
-        spinlock_t *ptl;
-        int ret = 0;
-
-        pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
-        for (; addr != end; pte++, addr += PAGE_SIZE) {
-                ptent = *pte;
-
-#ifdef CONFIG_STACK_GROWSUP
-                if (pte_present(ptent) || is_swap_pte(ptent))
-                        ss->usage = addr - ss->startpage + PAGE_SIZE;
-#else
-                if (pte_present(ptent) || is_swap_pte(ptent)) {
-                        ss->usage = ss->startpage - addr + PAGE_SIZE;
-                        pte++;
-                        ret = 1;
-                        break;
-                }
-#endif
-        }
-        pte_unmap_unlock(pte - 1, ptl);
-        cond_resched();
-        return ret;
-}
-
-static inline unsigned long get_stack_usage_in_bytes(struct vm_area_struct *vma,
-                                struct task_struct *task)
-{
-        struct stack_stats ss;
-        struct mm_walk stack_walk = {
-                .pmd_entry = stack_usage_pte_range,
-                .mm = vma->vm_mm,
-                .private = &ss,
-        };
-
-        if (!vma->vm_mm || is_vm_hugetlb_page(vma))
-                return 0;
-
-        ss.vma = vma;
-        ss.startpage = task->stack_start & PAGE_MASK;
-        ss.usage = 0;
-
-#ifdef CONFIG_STACK_GROWSUP
-        walk_page_range(KSTK_ESP(task) & PAGE_MASK, vma->vm_end,
-                &stack_walk);
-#else
-        walk_page_range(vma->vm_start, (KSTK_ESP(task) & PAGE_MASK) + PAGE_SIZE,
-                &stack_walk);
-#endif
-        return ss.usage;
-}
-
-static inline void task_show_stack_usage(struct seq_file *m,
-                                                struct task_struct *task)
-{
-        struct vm_area_struct   *vma;
-        struct mm_struct        *mm = get_task_mm(task);
-
-        if (mm) {
-                down_read(&mm->mmap_sem);
-                vma = find_vma(mm, task->stack_start);
-                if (vma)
-                        seq_printf(m, "Stack usage:\t%lu kB\n",
-                                get_stack_usage_in_bytes(vma, task) >> 10);
-
-                up_read(&mm->mmap_sem);
-                mmput(mm);
-        }
-}
-#else
-static void task_show_stack_usage(struct seq_file *m, struct task_struct *task)
-{
-}
-#endif          /* CONFIG_MMU */
-
 static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
 {
         seq_printf(m, "Cpus_allowed:\t");
@@ -445,7 +357,6 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
         task_show_regs(m, task);
 #endif
         task_context_switch_counts(m, task);
-        task_show_stack_usage(m, task);
         return 0;
 }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 18d5cc62d8ed..e42bbd843ed1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1419,7 +1419,6 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
                 goto out;
 
         error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-        nd->last_type = LAST_BIND;
 out:
         return ERR_PTR(error);
 }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 47c03f4336b8..f277c4a111cb 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -361,12 +361,11 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                 if (!pte_present(ptent))
                         continue;
 
-                mss->resident += PAGE_SIZE;
-
                 page = vm_normal_page(vma, addr, ptent);
                 if (!page)
                         continue;
 
+                mss->resident += PAGE_SIZE;
                 /* Accumulate the size in pages that have been accessed. */
                 if (pte_young(ptent) || PageReferenced(page))
                         mss->referenced += PAGE_SIZE;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index dea86abdf2e7..3fc62b097bed 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1377,6 +1377,9 @@ static void inode_sub_rsv_space(struct inode *inode, qsize_t number)
 static qsize_t inode_get_rsv_space(struct inode *inode)
 {
         qsize_t ret;
+
+        if (!inode->i_sb->dq_op->get_reserved_space)
+                return 0;
         spin_lock(&inode->i_lock);
         ret = *inode_reserved_space(inode);
         spin_unlock(&inode->i_lock);
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 2efc57173fd7..1739a4aba25f 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -123,30 +123,6 @@ add_error:
 
 /*****************************************************************************/
 /*
- * check that file shrinkage doesn't leave any VMAs dangling in midair
- */
-static int ramfs_nommu_check_mappings(struct inode *inode,
-                                      size_t newsize, size_t size)
-{
-        struct vm_area_struct *vma;
-        struct prio_tree_iter iter;
-
-        /* search for VMAs that fall within the dead zone */
-        vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
-                              newsize >> PAGE_SHIFT,
-                              (size + PAGE_SIZE - 1) >> PAGE_SHIFT
-                              ) {
-                /* found one - only interested if it's shared out of the page
-                 * cache */
-                if (vma->vm_flags & VM_SHARED)
-                        return -ETXTBSY; /* not quite true, but near enough */
-        }
-
-        return 0;
-}
-
-/*****************************************************************************/
-/*
  *
  */
 static int ramfs_nommu_resize(struct inode *inode, loff_t newsize, loff_t size)
@@ -164,7 +140,7 @@ static int ramfs_nommu_resize(struct inode *inode, loff_t newsize, loff_t size)
 
         /* check that a decrease in size doesn't cut off any shared mappings */
         if (newsize < size) {
-                ret = ramfs_nommu_check_mappings(inode, newsize, size);
+                ret = nommu_shrink_inode_mappings(inode, size, newsize);
                 if (ret < 0)
                         return ret;
         }
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index 685495707181..65c872761177 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -1277,7 +1277,10 @@ int reiserfs_init_bitmap_cache(struct super_block *sb)
         struct reiserfs_bitmap_info *bitmap;
         unsigned int bmap_nr = reiserfs_bmap_count(sb);
 
+        /* Avoid lock recursion in fault case */
+        reiserfs_write_unlock(sb);
         bitmap = vmalloc(sizeof(*bitmap) * bmap_nr);
+        reiserfs_write_lock(sb);
         if (bitmap == NULL)
                 return -ENOMEM;
 
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 290ae38fca8a..9087b10209e6 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -31,11 +31,12 @@ void reiserfs_delete_inode(struct inode *inode)
             JOURNAL_PER_BALANCE_CNT * 2 +
             2 * REISERFS_QUOTA_INIT_BLOCKS(inode->i_sb);
         struct reiserfs_transaction_handle th;
+        int depth;
         int err;
 
         truncate_inode_pages(&inode->i_data, 0);
 
-        reiserfs_write_lock(inode->i_sb);
+        depth = reiserfs_write_lock_once(inode->i_sb);
 
         /* The = 0 happens when we abort creating a new inode for some reason like lack of space.. */
         if (!(inode->i_state & I_NEW) && INODE_PKEY(inode)->k_objectid != 0) {  /* also handles bad_inode case */
@@ -74,7 +75,7 @@ void reiserfs_delete_inode(struct inode *inode)
       out:
         clear_inode(inode);     /* note this must go after the journal_end to prevent deadlock */
         inode->i_blocks = 0;
-        reiserfs_write_unlock(inode->i_sb);
+        reiserfs_write_unlock_once(inode->i_sb, depth);
 }
 
 static void _make_cpu_key(struct cpu_key *key, int version, __u32 dirid,
@@ -3061,13 +3062,14 @@ static ssize_t reiserfs_direct_IO(int rw, struct kiocb *iocb,
 int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = dentry->d_inode;
-        int error;
         unsigned int ia_valid;
+        int depth;
+        int error;
 
         /* must be turned off for recursive notify_change calls */
         ia_valid = attr->ia_valid &= ~(ATTR_KILL_SUID|ATTR_KILL_SGID);
 
-        reiserfs_write_lock(inode->i_sb);
+        depth = reiserfs_write_lock_once(inode->i_sb);
         if (attr->ia_valid & ATTR_SIZE) {
                 /* version 2 items will be caught by the s_maxbytes check
                  ** done for us in vmtruncate
@@ -3148,8 +3150,17 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
                                     journal_end(&th, inode->i_sb, jbegin_count);
                         }
                 }
-                if (!error)
+                if (!error) {
+                        /*
+                         * Relax the lock here, as it might truncate the
+                         * inode pages and wait for inode pages locks.
+                         * To release such page lock, the owner needs the
+                         * reiserfs lock
+                         */
+                        reiserfs_write_unlock_once(inode->i_sb, depth);
                         error = inode_setattr(inode, attr);
+                        depth = reiserfs_write_lock_once(inode->i_sb);
+                }
         }
 
         if (!error && reiserfs_posixacl(inode->i_sb)) {
@@ -3158,7 +3169,8 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
       out:
-        reiserfs_write_unlock(inode->i_sb);
+        reiserfs_write_unlock_once(inode->i_sb, depth);
+
         return error;
 }
 
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index ace77451ceb1..f53505de0712 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -104,9 +104,10 @@ setflags_out:
                 err = put_user(inode->i_generation, (int __user *)arg);
                 break;
         case REISERFS_IOC_SETVERSION:
-                if (!is_owner_or_cap(inode))
+                if (!is_owner_or_cap(inode)) {
                         err = -EPERM;
                         break;
+                }
                 err = mnt_want_write(filp->f_path.mnt);
                 if (err)
                         break;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 2f8a7e7b8dab..83ac4d3b3cb0 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2009,10 +2009,11 @@ static int do_journal_release(struct reiserfs_transaction_handle *th,
                 destroy_workqueue(commit_wq);
                 commit_wq = NULL;
         }
-        reiserfs_write_lock(sb);
 
         free_journal_ram(sb);
 
+        reiserfs_write_lock(sb);
+
         return 0;
 }
 
@@ -2758,11 +2759,18 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
         struct reiserfs_journal *journal;
         struct reiserfs_journal_list *jl;
         char b[BDEVNAME_SIZE];
+        int ret;
 
+        /*
+         * Unlock here to avoid various RECLAIM-FS-ON <-> IN-RECLAIM-FS
+         * dependency inversion warnings.
+         */
+        reiserfs_write_unlock(sb);
         journal = SB_JOURNAL(sb) = vmalloc(sizeof(struct reiserfs_journal));
         if (!journal) {
                 reiserfs_warning(sb, "journal-1256",
                                  "unable to get memory for journal structure");
+                reiserfs_write_lock(sb);
                 return 1;
         }
         memset(journal, 0, sizeof(struct reiserfs_journal));
@@ -2771,10 +2779,12 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
         INIT_LIST_HEAD(&journal->j_working_list);
         INIT_LIST_HEAD(&journal->j_journal_list);
         journal->j_persistent_trans = 0;
-        if (reiserfs_allocate_list_bitmaps(sb,
-                                           journal->j_list_bitmap,
-                                           reiserfs_bmap_count(sb)))
+        ret = reiserfs_allocate_list_bitmaps(sb, journal->j_list_bitmap,
+                                           reiserfs_bmap_count(sb));
+        reiserfs_write_lock(sb);
+        if (ret)
                 goto free_and_return;
+
         allocate_bitmap_nodes(sb);
 
         /* reserved for journal area support */
diff --git a/fs/reiserfs/lock.c b/fs/reiserfs/lock.c
index ee2cfc0fd8a7..b87aa2c1afc1 100644
--- a/fs/reiserfs/lock.c
+++ b/fs/reiserfs/lock.c
@@ -86,3 +86,12 @@ void reiserfs_check_lock_depth(struct super_block *sb, char *caller)
                 reiserfs_panic(sb, "%s called without kernel lock held %d",
                                caller);
 }
+
+#ifdef CONFIG_REISERFS_CHECK
+void reiserfs_lock_check_recursive(struct super_block *sb)
+{
+        struct reiserfs_sb_info *sb_i = REISERFS_SB(sb);
+
+        WARN_ONCE((sb_i->lock_depth > 0), "Unwanted recursive reiserfs lock!\n");
+}
+#endif
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index e296ff72a6cc..9d4dcf0b07cb 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -921,6 +921,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
         struct reiserfs_transaction_handle th;
         int jbegin_count;
         unsigned long savelink;
+        int depth;
 
         inode = dentry->d_inode;
 
@@ -932,7 +933,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
             JOURNAL_PER_BALANCE_CNT * 2 + 2 +
             4 * REISERFS_QUOTA_TRANS_BLOCKS(dir->i_sb);
 
-        reiserfs_write_lock(dir->i_sb);
+        depth = reiserfs_write_lock_once(dir->i_sb);
         retval = journal_begin(&th, dir->i_sb, jbegin_count);
         if (retval)
                 goto out_unlink;
@@ -993,7 +994,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
 
         retval = journal_end(&th, dir->i_sb, jbegin_count);
         reiserfs_check_path(&path);
-        reiserfs_write_unlock(dir->i_sb);
+        reiserfs_write_unlock_once(dir->i_sb, depth);
         return retval;
 
       end_unlink:
@@ -1003,7 +1004,7 @@ static int reiserfs_unlink(struct inode *dir, struct dentry *dentry)
         if (err)
                 retval = err;
       out_unlink:
-        reiserfs_write_unlock(dir->i_sb);
+        reiserfs_write_unlock_once(dir->i_sb, depth);
         return retval;
 }
 
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index 8c7033a8b67e..81f09fab8ae4 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -83,7 +83,8 @@ static int xattr_unlink(struct inode *dir, struct dentry *dentry)
         BUG_ON(!mutex_is_locked(&dir->i_mutex));
         vfs_dq_init(dir);
 
-        mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_CHILD);
+        reiserfs_mutex_lock_nested_safe(&dentry->d_inode->i_mutex,
+                                        I_MUTEX_CHILD, dir->i_sb);
         error = dir->i_op->unlink(dir, dentry);
         mutex_unlock(&dentry->d_inode->i_mutex);
 
@@ -98,7 +99,8 @@ static int xattr_rmdir(struct inode *dir, struct dentry *dentry)
         BUG_ON(!mutex_is_locked(&dir->i_mutex));
         vfs_dq_init(dir);
 
-        mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_CHILD);
+        reiserfs_mutex_lock_nested_safe(&dentry->d_inode->i_mutex,
+                                        I_MUTEX_CHILD, dir->i_sb);
         dentry_unhash(dentry);
         error = dir->i_op->rmdir(dir, dentry);
         if (!error)
@@ -235,16 +237,22 @@ static int reiserfs_for_each_xattr(struct inode *inode,
         if (IS_PRIVATE(inode) || get_inode_sd_version(inode) == STAT_DATA_V1)
                 return 0;
 
+        reiserfs_write_unlock(inode->i_sb);
         dir = open_xa_dir(inode, XATTR_REPLACE);
         if (IS_ERR(dir)) {
                 err = PTR_ERR(dir);
+                reiserfs_write_lock(inode->i_sb);
                 goto out;
         } else if (!dir->d_inode) {
                 err = 0;
+                reiserfs_write_lock(inode->i_sb);
                 goto out_dir;
         }
 
         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_XATTR);
+
+        reiserfs_write_lock(inode->i_sb);
+
         buf.xadir = dir;
         err = reiserfs_readdir_dentry(dir, &buf, fill_with_dentries, &pos);
         while ((err == 0 || err == -ENOSPC) && buf.count) {
@@ -283,8 +291,9 @@ static int reiserfs_for_each_xattr(struct inode *inode,
                 err = journal_begin(&th, inode->i_sb, blocks);
                 if (!err) {
                         int jerror;
-                        mutex_lock_nested(&dir->d_parent->d_inode->i_mutex,
-                                          I_MUTEX_XATTR);
+                        reiserfs_mutex_lock_nested_safe(
+                                          &dir->d_parent->d_inode->i_mutex,
+                                          I_MUTEX_XATTR, inode->i_sb);
                         err = action(dir, data);
                         jerror = journal_end(&th, inode->i_sb, blocks);
                         mutex_unlock(&dir->d_parent->d_inode->i_mutex);
@@ -443,7 +452,9 @@ static int lookup_and_delete_xattr(struct inode *inode, const char *name)
         }
 
         if (dentry->d_inode) {
+                reiserfs_write_lock(inode->i_sb);
                 err = xattr_unlink(xadir->d_inode, dentry);
+                reiserfs_write_unlock(inode->i_sb);
                 update_ctime(inode);
         }
 
@@ -477,15 +488,24 @@ reiserfs_xattr_set_handle(struct reiserfs_transaction_handle *th,
         if (get_inode_sd_version(inode) == STAT_DATA_V1)
                 return -EOPNOTSUPP;
 
-        if (!buffer)
-                return lookup_and_delete_xattr(inode, name);
+        reiserfs_write_unlock(inode->i_sb);
+
+        if (!buffer) {
+                err = lookup_and_delete_xattr(inode, name);
+                reiserfs_write_lock(inode->i_sb);
+                return err;
+        }
 
         dentry = xattr_lookup(inode, name, flags);
-        if (IS_ERR(dentry))
+        if (IS_ERR(dentry)) {
+                reiserfs_write_lock(inode->i_sb);
                 return PTR_ERR(dentry);
+        }
 
         down_write(&REISERFS_I(inode)->i_xattr_sem);
 
+        reiserfs_write_lock(inode->i_sb);
+
         xahash = xattr_hash(buffer, buffer_size);
         while (buffer_pos < buffer_size || buffer_pos == 0) {
                 size_t chunk;
@@ -540,8 +560,12 @@ reiserfs_xattr_set_handle(struct reiserfs_transaction_handle *th,
                         .ia_size = buffer_size,
                         .ia_valid = ATTR_SIZE | ATTR_CTIME,
                 };
+
+                reiserfs_write_unlock(inode->i_sb);
                 mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_XATTR);
                 down_write(&dentry->d_inode->i_alloc_sem);
+                reiserfs_write_lock(inode->i_sb);
+
                 err = reiserfs_setattr(dentry, &newattrs);
                 up_write(&dentry->d_inode->i_alloc_sem);
                 mutex_unlock(&dentry->d_inode->i_mutex);
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index cc32e6ada67b..dd20a7883f0f 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -455,7 +455,9 @@ int reiserfs_acl_chmod(struct inode *inode)
                 return 0;
         }
 
+        reiserfs_write_unlock(inode->i_sb);
         acl = reiserfs_get_acl(inode, ACL_TYPE_ACCESS);
+        reiserfs_write_lock(inode->i_sb);
         if (!acl)
                 return 0;
         if (IS_ERR(acl))
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index f05f2303a8b8..699f371b9f12 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -106,8 +106,10 @@ static struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
                         return NULL;
 
                 t = atomic_cmpxchg(&sd->s_active, v, v + 1);
-                if (likely(t == v))
+                if (likely(t == v)) {
+                        rwsem_acquire_read(&sd->dep_map, 0, 1, _RET_IP_);
                         return sd;
+                }
                 if (t < 0)
                         return NULL;
 
@@ -130,6 +132,7 @@ static void sysfs_put_active(struct sysfs_dirent *sd)
         if (unlikely(!sd))
                 return;
 
+        rwsem_release(&sd->dep_map, 1, _RET_IP_);
         v = atomic_dec_return(&sd->s_active);
         if (likely(v != SD_DEACTIVATED_BIAS))
                 return;
@@ -194,15 +197,21 @@ static void sysfs_deactivate(struct sysfs_dirent *sd)
         BUG_ON(sd->s_sibling || !(sd->s_flags & SYSFS_FLAG_REMOVED));
         sd->s_sibling = (void *)&wait;
 
+        rwsem_acquire(&sd->dep_map, 0, 0, _RET_IP_);
         /* atomic_add_return() is a mb(), put_active() will always see
          * the updated sd->s_sibling.
          */
         v = atomic_add_return(SD_DEACTIVATED_BIAS, &sd->s_active);
 
-        if (v != SD_DEACTIVATED_BIAS)
+        if (v != SD_DEACTIVATED_BIAS) {
+                lock_contended(&sd->dep_map, _RET_IP_);
                 wait_for_completion(&wait);
+        }
 
         sd->s_sibling = NULL;
+
+        lock_acquired(&sd->dep_map, _RET_IP_);
+        rwsem_release(&sd->dep_map, 1, _RET_IP_);
 }
 
 static int sysfs_alloc_ino(ino_t *pino)
@@ -345,6 +354,7 @@ struct sysfs_dirent *sysfs_new_dirent(const char *name, umode_t mode, int type)
 
         atomic_set(&sd->s_count, 1);
         atomic_set(&sd->s_active, 0);
+        sysfs_dirent_init_lockdep(sd);
 
         sd->s_name = name;
         sd->s_mode = mode;
diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index ca52e7b9d8f8..cdd9377a6e06 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -8,6 +8,7 @@
  * This file is released under the GPLv2.
  */
 
+#include <linux/lockdep.h>
 #include <linux/fs.h>
 
 struct sysfs_open_dirent;
@@ -50,6 +51,9 @@ struct sysfs_inode_attrs {
 struct sysfs_dirent {
         atomic_t                s_count;
         atomic_t                s_active;
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        struct lockdep_map      dep_map;
+#endif
         struct sysfs_dirent     *s_parent;
         struct sysfs_dirent     *s_sibling;
         const char              *s_name;
@@ -84,6 +88,17 @@ static inline unsigned int sysfs_type(struct sysfs_dirent *sd)
         return sd->s_flags & SYSFS_TYPE_MASK;
 }
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+#define sysfs_dirent_init_lockdep(sd)                           \
+do {                                                            \
+        static struct lock_class_key __key;                     \
+                                                                \
+        lockdep_init_map(&sd->dep_map, "s_active", &__key, 0);  \
+} while(0)
+#else
+#define sysfs_dirent_init_lockdep(sd) do {} while(0)
+#endif
+
 /*
  * Context structure to be used while adding/removing nodes.
  */
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 618c2701d3a7..e5a3d8e96bb7 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -54,6 +54,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/list_sort.h>
 #include "ubifs.h"
 
 /*
@@ -108,101 +109,6 @@ static int switch_gc_head(struct ubifs_info *c)
 }
 
 /**
- * list_sort - sort a list.
- * @priv: private data, passed to @cmp
- * @head: the list to sort
- * @cmp: the elements comparison function
- *
- * This function has been implemented by Mark J Roberts <mjr@znex.org>. It
- * implements "merge sort" which has O(nlog(n)) complexity. The list is sorted
- * in ascending order.
- *
- * The comparison function @cmp is supposed to return a negative value if @a is
- * than @b, and a positive value if @a is greater than @b. If @a and @b are
- * equivalent, then it does not matter what this function returns.
- */
-static void list_sort(void *priv, struct list_head *head,
-                      int (*cmp)(void *priv, struct list_head *a,
-                                 struct list_head *b))
-{
-        struct list_head *p, *q, *e, *list, *tail, *oldhead;
-        int insize, nmerges, psize, qsize, i;
-
-        if (list_empty(head))
-                return;
-
-        list = head->next;
-        list_del(head);
-        insize = 1;
-        for (;;) {
-                p = oldhead = list;
-                list = tail = NULL;
-                nmerges = 0;
-
-                while (p) {
-                        nmerges++;
-                        q = p;
-                        psize = 0;
-                        for (i = 0; i < insize; i++) {
-                                psize++;
-                                q = q->next == oldhead ? NULL : q->next;
-                                if (!q)
-                                        break;
-                        }
-
-                        qsize = insize;
-                        while (psize > 0 || (qsize > 0 && q)) {
-                                if (!psize) {
-                                        e = q;
-                                        q = q->next;
-                                        qsize--;
-                                        if (q == oldhead)
-                                                q = NULL;
-                                } else if (!qsize || !q) {
-                                        e = p;
-                                        p = p->next;
-                                        psize--;
-                                        if (p == oldhead)
-                                                p = NULL;
-                                } else if (cmp(priv, p, q) <= 0) {
-                                        e = p;
-                                        p = p->next;
-                                        psize--;
-                                        if (p == oldhead)
-                                                p = NULL;
-                                } else {
-                                        e = q;
-                                        q = q->next;
-                                        qsize--;
-                                        if (q == oldhead)
-                                                q = NULL;
-                                }
-                                if (tail)
-                                        tail->next = e;
-                                else
-                                        list = e;
-                                e->prev = tail;
-                                tail = e;
-                        }
-                        p = q;
-                }
-
-                tail->next = list;
-                list->prev = tail;
-
-                if (nmerges <= 1)
-                        break;
-
-                insize *= 2;
-        }
-
-        head->next = list;
-        head->prev = list->prev;
-        list->prev->next = head;
-        list->prev = head;
-}
-
-/**
  * data_nodes_cmp - compare 2 data nodes.
  * @priv: UBIFS file-system description object
  * @a: first data node
diff --git a/fs/xfs/linux-2.6/xfs_acl.c b/fs/xfs/linux-2.6/xfs_acl.c
index 2512125dfa7c..883ca5ab8af5 100644
--- a/fs/xfs/linux-2.6/xfs_acl.c
+++ b/fs/xfs/linux-2.6/xfs_acl.c
@@ -251,8 +251,9 @@ xfs_set_mode(struct inode *inode, mode_t mode)
         if (mode != inode->i_mode) {
                 struct iattr iattr;
 
-                iattr.ia_valid = ATTR_MODE;
+                iattr.ia_valid = ATTR_MODE | ATTR_CTIME;
                 iattr.ia_mode = mode;
+                iattr.ia_ctime = current_fs_time(inode->i_sb);
 
                 error = -xfs_setattr(XFS_I(inode), &iattr, XFS_ATTR_NOACL);
         }
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 09783cc444ac..77414db10dc2 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -954,16 +954,14 @@ xfs_fs_destroy_inode(
         ASSERT_ALWAYS(!xfs_iflags_test(ip, XFS_IRECLAIM));
 
         /*
-         * If we have nothing to flush with this inode then complete the
-         * teardown now, otherwise delay the flush operation.
+         * We always use background reclaim here because even if the
+         * inode is clean, it still may be under IO and hence we have
+         * to take the flush lock. The background reclaim path handles
+         * this more efficiently than we can here, so simply let background
+         * reclaim tear down all inodes.
          */
-        if (!xfs_inode_clean(ip)) {
-                xfs_inode_set_reclaim_tag(ip);
-                return;
-        }
-
 out_reclaim:
-        xfs_ireclaim(ip);
+        xfs_inode_set_reclaim_tag(ip);
 }
 
 /*
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 6fed97a8cd3e..1f5e4bb5e970 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -65,7 +65,6 @@ xfs_inode_ag_lookup(
          * as the tree is sparse and a gang lookup walks to find
          * the number of objects requested.
          */
-        read_lock(&pag->pag_ici_lock);
         if (tag == XFS_ICI_NO_TAG) {
                 nr_found = radix_tree_gang_lookup(&pag->pag_ici_root,
                                 (void **)&ip, *first_index, 1);
@@ -74,7 +73,7 @@ xfs_inode_ag_lookup(
                                 (void **)&ip, *first_index, 1, tag);
         }
         if (!nr_found)
-                goto unlock;
+                return NULL;
 
         /*
          * Update the index for the next lookup. Catch overflows
@@ -84,13 +83,8 @@ xfs_inode_ag_lookup(
          */
         *first_index = XFS_INO_TO_AGINO(mp, ip->i_ino + 1);
         if (*first_index < XFS_INO_TO_AGINO(mp, ip->i_ino))
-                goto unlock;
-
+                return NULL;
         return ip;
-
-unlock:
-        read_unlock(&pag->pag_ici_lock);
-        return NULL;
 }
 
 STATIC int
@@ -100,7 +94,8 @@ xfs_inode_ag_walk(
         int                     (*execute)(struct xfs_inode *ip,
                                            struct xfs_perag *pag, int flags),
         int                     flags,
-        int                     tag)
+        int                     tag,
+        int                     exclusive)
 {
         struct xfs_perag        *pag = &mp->m_perag[ag];
         uint32_t                first_index;
@@ -114,10 +109,20 @@ restart:
                 int             error = 0;
                 xfs_inode_t     *ip;
 
+                if (exclusive)
+                        write_lock(&pag->pag_ici_lock);
+                else
+                        read_lock(&pag->pag_ici_lock);
                 ip = xfs_inode_ag_lookup(mp, pag, &first_index, tag);
-                if (!ip)
+                if (!ip) {
+                        if (exclusive)
+                                write_unlock(&pag->pag_ici_lock);
+                        else
+                                read_unlock(&pag->pag_ici_lock);
                         break;
+                }
 
+                /* execute releases pag->pag_ici_lock */
                 error = execute(ip, pag, flags);
                 if (error == EAGAIN) {
                         skipped++;
@@ -125,9 +130,8 @@ restart:
                 }
                 if (error)
                         last_error = error;
-                /*
-                 * bail out if the filesystem is corrupted.
-                 */
+
+                /* bail out if the filesystem is corrupted.  */
                 if (error == EFSCORRUPTED)
                         break;
 
@@ -148,7 +152,8 @@ xfs_inode_ag_iterator(
         int                     (*execute)(struct xfs_inode *ip,
                                            struct xfs_perag *pag, int flags),
         int                     flags,
-        int                     tag)
+        int                     tag,
+        int                     exclusive)
 {
         int                     error = 0;
         int                     last_error = 0;
@@ -157,7 +162,8 @@ xfs_inode_ag_iterator(
         for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
                 if (!mp->m_perag[ag].pag_ici_init)
                         continue;
-                error = xfs_inode_ag_walk(mp, ag, execute, flags, tag);
+                error = xfs_inode_ag_walk(mp, ag, execute, flags, tag,
+                                                exclusive);
                 if (error) {
                         last_error = error;
                         if (error == EFSCORRUPTED)
@@ -174,30 +180,31 @@ xfs_sync_inode_valid(
         struct xfs_perag        *pag)
 {
         struct inode            *inode = VFS_I(ip);
+        int                     error = EFSCORRUPTED;
 
         /* nothing to sync during shutdown */
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
-                read_unlock(&pag->pag_ici_lock);
-                return EFSCORRUPTED;
-        }
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                goto out_unlock;
 
-        /*
-         * If we can't get a reference on the inode, it must be in reclaim.
-         * Leave it for the reclaim code to flush. Also avoid inodes that
-         * haven't been fully initialised.
-         */
-        if (!igrab(inode)) {
-                read_unlock(&pag->pag_ici_lock);
-                return ENOENT;
-        }
-        read_unlock(&pag->pag_ici_lock);
+        /* avoid new or reclaimable inodes. Leave for reclaim code to flush */
+        error = ENOENT;
+        if (xfs_iflags_test(ip, XFS_INEW | XFS_IRECLAIMABLE | XFS_IRECLAIM))
+                goto out_unlock;
 
-        if (is_bad_inode(inode) || xfs_iflags_test(ip, XFS_INEW)) {
+        /* If we can't grab the inode, it must on it's way to reclaim. */
+        if (!igrab(inode))
+                goto out_unlock;
+
+        if (is_bad_inode(inode)) {
                 IRELE(ip);
-                return ENOENT;
+                goto out_unlock;
         }
 
-        return 0;
+        /* inode is valid */
+        error = 0;
+out_unlock:
+        read_unlock(&pag->pag_ici_lock);
+        return error;
 }
 
 STATIC int
@@ -282,7 +289,7 @@ xfs_sync_data(
         ASSERT((flags & ~(SYNC_TRYLOCK|SYNC_WAIT)) == 0);
 
         error = xfs_inode_ag_iterator(mp, xfs_sync_inode_data, flags,
-                                      XFS_ICI_NO_TAG);
+                                      XFS_ICI_NO_TAG, 0);
         if (error)
                 return XFS_ERROR(error);
 
@@ -304,7 +311,7 @@ xfs_sync_attr(
         ASSERT((flags & ~SYNC_WAIT) == 0);
 
         return xfs_inode_ag_iterator(mp, xfs_sync_inode_attr, flags,
-                                     XFS_ICI_NO_TAG);
+                                     XFS_ICI_NO_TAG, 0);
 }
 
 STATIC int
@@ -664,60 +671,6 @@ xfs_syncd_stop(
         kthread_stop(mp->m_sync_task);
 }
 
-STATIC int
-xfs_reclaim_inode(
-        xfs_inode_t     *ip,
-        int             sync_mode)
-{
-        xfs_perag_t     *pag = xfs_get_perag(ip->i_mount, ip->i_ino);
-
-        /* The hash lock here protects a thread in xfs_iget_core from
-         * racing with us on linking the inode back with a vnode.
-         * Once we have the XFS_IRECLAIM flag set it will not touch
-         * us.
-         */
-        write_lock(&pag->pag_ici_lock);
-        spin_lock(&ip->i_flags_lock);
-        if (__xfs_iflags_test(ip, XFS_IRECLAIM) ||
-            !__xfs_iflags_test(ip, XFS_IRECLAIMABLE)) {
-                spin_unlock(&ip->i_flags_lock);
-                write_unlock(&pag->pag_ici_lock);
-                return -EAGAIN;
-        }
-        __xfs_iflags_set(ip, XFS_IRECLAIM);
-        spin_unlock(&ip->i_flags_lock);
-        write_unlock(&pag->pag_ici_lock);
-        xfs_put_perag(ip->i_mount, pag);
-
-        /*
-         * If the inode is still dirty, then flush it out.  If the inode
-         * is not in the AIL, then it will be OK to flush it delwri as
-         * long as xfs_iflush() does not keep any references to the inode.
-         * We leave that decision up to xfs_iflush() since it has the
-         * knowledge of whether it's OK to simply do a delwri flush of
-         * the inode or whether we need to wait until the inode is
-         * pulled from the AIL.
-         * We get the flush lock regardless, though, just to make sure
-         * we don't free it while it is being flushed.
-         */
-        xfs_ilock(ip, XFS_ILOCK_EXCL);
-        xfs_iflock(ip);
-
-        /*
-         * In the case of a forced shutdown we rely on xfs_iflush() to
-         * wait for the inode to be unpinned before returning an error.
-         */
-        if (!is_bad_inode(VFS_I(ip)) && xfs_iflush(ip, sync_mode) == 0) {
-                /* synchronize with xfs_iflush_done */
-                xfs_iflock(ip);
-                xfs_ifunlock(ip);
-        }
-
-        xfs_iunlock(ip, XFS_ILOCK_EXCL);
-        xfs_ireclaim(ip);
-        return 0;
-}
-
 void
 __xfs_inode_set_reclaim_tag(
         struct xfs_perag        *pag,
@@ -760,19 +713,55 @@ __xfs_inode_clear_reclaim_tag(
 }
 
 STATIC int
-xfs_reclaim_inode_now(
+xfs_reclaim_inode(
         struct xfs_inode        *ip,
         struct xfs_perag        *pag,
-        int                     flags)
+        int                     sync_mode)
 {
-        /* ignore if already under reclaim */
-        if (xfs_iflags_test(ip, XFS_IRECLAIM)) {
-                read_unlock(&pag->pag_ici_lock);
+        /*
+         * The radix tree lock here protects a thread in xfs_iget from racing
+         * with us starting reclaim on the inode.  Once we have the
+         * XFS_IRECLAIM flag set it will not touch us.
+         */
+        spin_lock(&ip->i_flags_lock);
+        ASSERT_ALWAYS(__xfs_iflags_test(ip, XFS_IRECLAIMABLE));
+        if (__xfs_iflags_test(ip, XFS_IRECLAIM)) {
+                /* ignore as it is already under reclaim */
+                spin_unlock(&ip->i_flags_lock);
+                write_unlock(&pag->pag_ici_lock);
                 return 0;
         }
-        read_unlock(&pag->pag_ici_lock);
+        __xfs_iflags_set(ip, XFS_IRECLAIM);
+        spin_unlock(&ip->i_flags_lock);
+        write_unlock(&pag->pag_ici_lock);
 
-        return xfs_reclaim_inode(ip, flags);
+        /*
+         * If the inode is still dirty, then flush it out.  If the inode
+         * is not in the AIL, then it will be OK to flush it delwri as
+         * long as xfs_iflush() does not keep any references to the inode.
+         * We leave that decision up to xfs_iflush() since it has the
+         * knowledge of whether it's OK to simply do a delwri flush of
+         * the inode or whether we need to wait until the inode is
+         * pulled from the AIL.
+         * We get the flush lock regardless, though, just to make sure
+         * we don't free it while it is being flushed.
+         */
+        xfs_ilock(ip, XFS_ILOCK_EXCL);
+        xfs_iflock(ip);
+
+        /*
+         * In the case of a forced shutdown we rely on xfs_iflush() to
+         * wait for the inode to be unpinned before returning an error.
+         */
+        if (!is_bad_inode(VFS_I(ip)) && xfs_iflush(ip, sync_mode) == 0) {
+                /* synchronize with xfs_iflush_done */
+                xfs_iflock(ip);
+                xfs_ifunlock(ip);
+        }
+
+        xfs_iunlock(ip, XFS_ILOCK_EXCL);
+        xfs_ireclaim(ip);
+        return 0;
 }
 
 int
@@ -780,6 +769,6 @@ xfs_reclaim_inodes(
         xfs_mount_t     *mp,
         int             mode)
 {
-        return xfs_inode_ag_iterator(mp, xfs_reclaim_inode_now, mode,
-                                        XFS_ICI_RECLAIM_TAG);
+        return xfs_inode_ag_iterator(mp, xfs_reclaim_inode, mode,
+                                        XFS_ICI_RECLAIM_TAG, 1);
 }
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index a500b4d91835..ea932b43335d 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -54,6 +54,6 @@ void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag,
 int xfs_sync_inode_valid(struct xfs_inode *ip, struct xfs_perag *pag);
 int xfs_inode_ag_iterator(struct xfs_mount *mp,
         int (*execute)(struct xfs_inode *ip, struct xfs_perag *pag, int flags),
-        int flags, int tag);
+        int flags, int tag, int write_lock);
 
 #endif
diff --git a/fs/xfs/linux-2.6/xfs_trace.h b/fs/xfs/linux-2.6/xfs_trace.h
index c40834bdee58..c22a608321a3 100644
--- a/fs/xfs/linux-2.6/xfs_trace.h
+++ b/fs/xfs/linux-2.6/xfs_trace.h
@@ -33,51 +33,55 @@ struct xfs_dquot;
 struct xlog_ticket;
 struct log;
 
+DECLARE_EVENT_CLASS(xfs_attr_list_class,
+        TP_PROTO(struct xfs_attr_list_context *ctx),
+        TP_ARGS(ctx),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(u32, hashval)
+                __field(u32, blkno)
+                __field(u32, offset)
+                __field(void *, alist)
+                __field(int, bufsize)
+                __field(int, count)
+                __field(int, firstu)
+                __field(int, dupcnt)
+                __field(int, flags)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ctx->dp)->i_sb->s_dev;
+                __entry->ino = ctx->dp->i_ino;
+                __entry->hashval = ctx->cursor->hashval;
+                __entry->blkno = ctx->cursor->blkno;
+                __entry->offset = ctx->cursor->offset;
+                __entry->alist = ctx->alist;
+                __entry->bufsize = ctx->bufsize;
+                __entry->count = ctx->count;
+                __entry->firstu = ctx->firstu;
+                __entry->flags = ctx->flags;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx cursor h/b/o 0x%x/0x%x/%u dupcnt %u "
+                  "alist 0x%p size %u count %u firstu %u flags %d %s",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                   __entry->ino,
+                   __entry->hashval,
+                   __entry->blkno,
+                   __entry->offset,
+                   __entry->dupcnt,
+                   __entry->alist,
+                   __entry->bufsize,
+                   __entry->count,
+                   __entry->firstu,
+                   __entry->flags,
+                   __print_flags(__entry->flags, "|", XFS_ATTR_FLAGS)
+        )
+)
+
 #define DEFINE_ATTR_LIST_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_attr_list_class, name, \
         TP_PROTO(struct xfs_attr_list_context *ctx), \
-        TP_ARGS(ctx), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(u32, hashval) \
-                __field(u32, blkno) \
-                __field(u32, offset) \
-                __field(void *, alist) \
-                __field(int, bufsize) \
-                __field(int, count) \
-                __field(int, firstu) \
-                __field(int, dupcnt) \
-                __field(int, flags) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ctx->dp)->i_sb->s_dev; \
-                __entry->ino = ctx->dp->i_ino; \
-                __entry->hashval = ctx->cursor->hashval; \
-                __entry->blkno = ctx->cursor->blkno; \
-                __entry->offset = ctx->cursor->offset; \
-                __entry->alist = ctx->alist; \
-                __entry->bufsize = ctx->bufsize; \
-                __entry->count = ctx->count; \
-                __entry->firstu = ctx->firstu; \
-                __entry->flags = ctx->flags; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx cursor h/b/o 0x%x/0x%x/%u dupcnt %u " \
-                  "alist 0x%p size %u count %u firstu %u flags %d %s", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                   __entry->ino, \
-                   __entry->hashval, \
-                   __entry->blkno, \
-                   __entry->offset, \
-                   __entry->dupcnt, \
-                   __entry->alist, \
-                   __entry->bufsize, \
-                   __entry->count, \
-                   __entry->firstu, \
-                   __entry->flags, \
-                   __print_flags(__entry->flags, "|", XFS_ATTR_FLAGS) \
-        ) \
-)
+        TP_ARGS(ctx))
 DEFINE_ATTR_LIST_EVENT(xfs_attr_list_sf);
 DEFINE_ATTR_LIST_EVENT(xfs_attr_list_sf_all);
 DEFINE_ATTR_LIST_EVENT(xfs_attr_list_leaf);
@@ -178,91 +182,99 @@ TRACE_EVENT(xfs_iext_insert,
                   (char *)__entry->caller_ip)
 );
 
+DECLARE_EVENT_CLASS(xfs_bmap_class,
+        TP_PROTO(struct xfs_inode *ip, xfs_extnum_t idx, int state,
+                 unsigned long caller_ip),
+        TP_ARGS(ip, idx, state, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(xfs_extnum_t, idx)
+                __field(xfs_fileoff_t, startoff)
+                __field(xfs_fsblock_t, startblock)
+                __field(xfs_filblks_t, blockcount)
+                __field(xfs_exntst_t, state)
+                __field(int, bmap_state)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                struct xfs_ifork        *ifp = (state & BMAP_ATTRFORK) ?
+                                                ip->i_afp : &ip->i_df;
+                struct xfs_bmbt_irec    r;
+
+                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &r);
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->idx = idx;
+                __entry->startoff = r.br_startoff;
+                __entry->startblock = r.br_startblock;
+                __entry->blockcount = r.br_blockcount;
+                __entry->state = r.br_state;
+                __entry->bmap_state = state;
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx state %s idx %ld "
+                  "offset %lld block %s count %lld flag %d caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_flags(__entry->bmap_state, "|", XFS_BMAP_EXT_FLAGS),
+                  (long)__entry->idx,
+                  __entry->startoff,
+                  xfs_fmtfsblock(__entry->startblock),
+                  __entry->blockcount,
+                  __entry->state,
+                  (char *)__entry->caller_ip)
+)
+
 #define DEFINE_BMAP_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_bmap_class, name, \
         TP_PROTO(struct xfs_inode *ip, xfs_extnum_t idx, int state, \
                  unsigned long caller_ip), \
-        TP_ARGS(ip, idx, state, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(xfs_extnum_t, idx) \
-                __field(xfs_fileoff_t, startoff) \
-                __field(xfs_fsblock_t, startblock) \
-                __field(xfs_filblks_t, blockcount) \
-                __field(xfs_exntst_t, state) \
-                __field(int, bmap_state) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                struct xfs_ifork        *ifp = (state & BMAP_ATTRFORK) ? \
-                                                ip->i_afp : &ip->i_df; \
-                struct xfs_bmbt_irec    r; \
-        \
-                xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &r); \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->idx = idx; \
-                __entry->startoff = r.br_startoff; \
-                __entry->startblock = r.br_startblock; \
-                __entry->blockcount = r.br_blockcount; \
-                __entry->state = r.br_state; \
-                __entry->bmap_state = state; \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx state %s idx %ld " \
-                  "offset %lld block %s count %lld flag %d caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __print_flags(__entry->bmap_state, "|", XFS_BMAP_EXT_FLAGS), \
-                  (long)__entry->idx, \
-                  __entry->startoff, \
-                  xfs_fmtfsblock(__entry->startblock), \
-                  __entry->blockcount, \
-                  __entry->state, \
-                  (char *)__entry->caller_ip) \
-)
-
+        TP_ARGS(ip, idx, state, caller_ip))
 DEFINE_BMAP_EVENT(xfs_iext_remove);
 DEFINE_BMAP_EVENT(xfs_bmap_pre_update);
 DEFINE_BMAP_EVENT(xfs_bmap_post_update);
 DEFINE_BMAP_EVENT(xfs_extlist);
 
-#define DEFINE_BUF_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_buf *bp, unsigned long caller_ip), \
-        TP_ARGS(bp, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_daddr_t, bno) \
-                __field(size_t, buffer_length) \
-                __field(int, hold) \
-                __field(int, pincount) \
-                __field(unsigned, lockval) \
-                __field(unsigned, flags) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = bp->b_target->bt_dev; \
-                __entry->bno = bp->b_bn; \
-                __entry->buffer_length = bp->b_buffer_length; \
-                __entry->hold = atomic_read(&bp->b_hold); \
-                __entry->pincount = atomic_read(&bp->b_pin_count); \
-                __entry->lockval = xfs_buf_lock_value(bp); \
-                __entry->flags = bp->b_flags; \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d " \
-                  "lock %d flags %s caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  (unsigned long long)__entry->bno, \
-                  __entry->buffer_length, \
-                  __entry->hold, \
-                  __entry->pincount, \
-                  __entry->lockval, \
-                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS), \
-                  (void *)__entry->caller_ip) \
+DECLARE_EVENT_CLASS(xfs_buf_class,
+        TP_PROTO(struct xfs_buf *bp, unsigned long caller_ip),
+        TP_ARGS(bp, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_daddr_t, bno)
+                __field(size_t, buffer_length)
+                __field(int, hold)
+                __field(int, pincount)
+                __field(unsigned, lockval)
+                __field(unsigned, flags)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = bp->b_target->bt_dev;
+                __entry->bno = bp->b_bn;
+                __entry->buffer_length = bp->b_buffer_length;
+                __entry->hold = atomic_read(&bp->b_hold);
+                __entry->pincount = atomic_read(&bp->b_pin_count);
+                __entry->lockval = xfs_buf_lock_value(bp);
+                __entry->flags = bp->b_flags;
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
+                  "lock %d flags %s caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  (unsigned long long)__entry->bno,
+                  __entry->buffer_length,
+                  __entry->hold,
+                  __entry->pincount,
+                  __entry->lockval,
+                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS),
+                  (void *)__entry->caller_ip)
 )
+
+#define DEFINE_BUF_EVENT(name) \
+DEFINE_EVENT(xfs_buf_class, name, \
+        TP_PROTO(struct xfs_buf *bp, unsigned long caller_ip), \
+        TP_ARGS(bp, caller_ip))
 DEFINE_BUF_EVENT(xfs_buf_init);
 DEFINE_BUF_EVENT(xfs_buf_free);
 DEFINE_BUF_EVENT(xfs_buf_hold);
@@ -299,41 +311,45 @@ DEFINE_BUF_EVENT(xfs_reset_dqcounts);
 DEFINE_BUF_EVENT(xfs_inode_item_push);
 
 /* pass flags explicitly */
-#define DEFINE_BUF_FLAGS_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_buf *bp, unsigned flags, unsigned long caller_ip), \
-        TP_ARGS(bp, flags, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_daddr_t, bno) \
-                __field(size_t, buffer_length) \
-                __field(int, hold) \
-                __field(int, pincount) \
-                __field(unsigned, lockval) \
-                __field(unsigned, flags) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = bp->b_target->bt_dev; \
-                __entry->bno = bp->b_bn; \
-                __entry->buffer_length = bp->b_buffer_length; \
-                __entry->flags = flags; \
-                __entry->hold = atomic_read(&bp->b_hold); \
-                __entry->pincount = atomic_read(&bp->b_pin_count); \
-                __entry->lockval = xfs_buf_lock_value(bp); \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d " \
-                  "lock %d flags %s caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  (unsigned long long)__entry->bno, \
-                  __entry->buffer_length, \
-                  __entry->hold, \
-                  __entry->pincount, \
-                  __entry->lockval, \
-                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS), \
-                  (void *)__entry->caller_ip) \
+DECLARE_EVENT_CLASS(xfs_buf_flags_class,
+        TP_PROTO(struct xfs_buf *bp, unsigned flags, unsigned long caller_ip),
+        TP_ARGS(bp, flags, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_daddr_t, bno)
+                __field(size_t, buffer_length)
+                __field(int, hold)
+                __field(int, pincount)
+                __field(unsigned, lockval)
+                __field(unsigned, flags)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = bp->b_target->bt_dev;
+                __entry->bno = bp->b_bn;
+                __entry->buffer_length = bp->b_buffer_length;
+                __entry->flags = flags;
+                __entry->hold = atomic_read(&bp->b_hold);
+                __entry->pincount = atomic_read(&bp->b_pin_count);
+                __entry->lockval = xfs_buf_lock_value(bp);
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
+                  "lock %d flags %s caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  (unsigned long long)__entry->bno,
+                  __entry->buffer_length,
+                  __entry->hold,
+                  __entry->pincount,
+                  __entry->lockval,
+                  __print_flags(__entry->flags, "|", XFS_BUF_FLAGS),
+                  (void *)__entry->caller_ip)
 )
+
+#define DEFINE_BUF_FLAGS_EVENT(name) \
+DEFINE_EVENT(xfs_buf_flags_class, name, \
+        TP_PROTO(struct xfs_buf *bp, unsigned flags, unsigned long caller_ip), \
+        TP_ARGS(bp, flags, caller_ip))
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_find);
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_get);
 DEFINE_BUF_FLAGS_EVENT(xfs_buf_read);
@@ -376,55 +392,58 @@ TRACE_EVENT(xfs_buf_ioerror,
                   (void *)__entry->caller_ip)
 );
 
-#define DEFINE_BUF_ITEM_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_buf_log_item *bip), \
-        TP_ARGS(bip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_daddr_t, buf_bno) \
-                __field(size_t, buf_len) \
-                __field(int, buf_hold) \
-                __field(int, buf_pincount) \
-                __field(int, buf_lockval) \
-                __field(unsigned, buf_flags) \
-                __field(unsigned, bli_recur) \
-                __field(int, bli_refcount) \
-                __field(unsigned, bli_flags) \
-                __field(void *, li_desc) \
-                __field(unsigned, li_flags) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = bip->bli_buf->b_target->bt_dev; \
-                __entry->bli_flags = bip->bli_flags; \
-                __entry->bli_recur = bip->bli_recur; \
-                __entry->bli_refcount = atomic_read(&bip->bli_refcount); \
-                __entry->buf_bno = bip->bli_buf->b_bn; \
-                __entry->buf_len = bip->bli_buf->b_buffer_length; \
-                __entry->buf_flags = bip->bli_buf->b_flags; \
-                __entry->buf_hold = atomic_read(&bip->bli_buf->b_hold); \
-                __entry->buf_pincount = \
-                        atomic_read(&bip->bli_buf->b_pin_count); \
-                __entry->buf_lockval = xfs_buf_lock_value(bip->bli_buf); \
-                __entry->li_desc = bip->bli_item.li_desc; \
-                __entry->li_flags = bip->bli_item.li_flags; \
-        ), \
-        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d " \
-                  "lock %d flags %s recur %d refcount %d bliflags %s " \
-                  "lidesc 0x%p liflags %s", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  (unsigned long long)__entry->buf_bno, \
-                  __entry->buf_len, \
-                  __entry->buf_hold, \
-                  __entry->buf_pincount, \
-                  __entry->buf_lockval, \
-                  __print_flags(__entry->buf_flags, "|", XFS_BUF_FLAGS), \
-                  __entry->bli_recur, \
-                  __entry->bli_refcount, \
-                  __print_flags(__entry->bli_flags, "|", XFS_BLI_FLAGS), \
-                  __entry->li_desc, \
-                  __print_flags(__entry->li_flags, "|", XFS_LI_FLAGS)) \
+DECLARE_EVENT_CLASS(xfs_buf_item_class,
+        TP_PROTO(struct xfs_buf_log_item *bip),
+        TP_ARGS(bip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_daddr_t, buf_bno)
+                __field(size_t, buf_len)
+                __field(int, buf_hold)
+                __field(int, buf_pincount)
+                __field(int, buf_lockval)
+                __field(unsigned, buf_flags)
+                __field(unsigned, bli_recur)
+                __field(int, bli_refcount)
+                __field(unsigned, bli_flags)
+                __field(void *, li_desc)
+                __field(unsigned, li_flags)
+        ),
+        TP_fast_assign(
+                __entry->dev = bip->bli_buf->b_target->bt_dev;
+                __entry->bli_flags = bip->bli_flags;
+                __entry->bli_recur = bip->bli_recur;
+                __entry->bli_refcount = atomic_read(&bip->bli_refcount);
+                __entry->buf_bno = bip->bli_buf->b_bn;
+                __entry->buf_len = bip->bli_buf->b_buffer_length;
+                __entry->buf_flags = bip->bli_buf->b_flags;
+                __entry->buf_hold = atomic_read(&bip->bli_buf->b_hold);
+                __entry->buf_pincount = atomic_read(&bip->bli_buf->b_pin_count);
+                __entry->buf_lockval = xfs_buf_lock_value(bip->bli_buf);
+                __entry->li_desc = bip->bli_item.li_desc;
+                __entry->li_flags = bip->bli_item.li_flags;
+        ),
+        TP_printk("dev %d:%d bno 0x%llx len 0x%zx hold %d pincount %d "
+                  "lock %d flags %s recur %d refcount %d bliflags %s "
+                  "lidesc 0x%p liflags %s",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  (unsigned long long)__entry->buf_bno,
+                  __entry->buf_len,
+                  __entry->buf_hold,
+                  __entry->buf_pincount,
+                  __entry->buf_lockval,
+                  __print_flags(__entry->buf_flags, "|", XFS_BUF_FLAGS),
+                  __entry->bli_recur,
+                  __entry->bli_refcount,
+                  __print_flags(__entry->bli_flags, "|", XFS_BLI_FLAGS),
+                  __entry->li_desc,
+                  __print_flags(__entry->li_flags, "|", XFS_LI_FLAGS))
 )
+
+#define DEFINE_BUF_ITEM_EVENT(name) \
+DEFINE_EVENT(xfs_buf_item_class, name, \
+        TP_PROTO(struct xfs_buf_log_item *bip), \
+        TP_ARGS(bip))
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_size);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_size_stale);
 DEFINE_BUF_ITEM_EVENT(xfs_buf_item_format);
@@ -450,78 +469,90 @@ DEFINE_BUF_ITEM_EVENT(xfs_trans_bhold);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_bhold_release);
 DEFINE_BUF_ITEM_EVENT(xfs_trans_binval);
 
+DECLARE_EVENT_CLASS(xfs_lock_class,
+        TP_PROTO(struct xfs_inode *ip, unsigned lock_flags,
+                 unsigned long caller_ip),
+        TP_ARGS(ip,  lock_flags, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(int, lock_flags)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->lock_flags = lock_flags;
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx flags %s caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_flags(__entry->lock_flags, "|", XFS_LOCK_FLAGS),
+                  (void *)__entry->caller_ip)
+)
+
 #define DEFINE_LOCK_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_lock_class, name, \
         TP_PROTO(struct xfs_inode *ip, unsigned lock_flags, \
                  unsigned long caller_ip), \
-        TP_ARGS(ip,  lock_flags, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(int, lock_flags) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->lock_flags = lock_flags; \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx flags %s caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __print_flags(__entry->lock_flags, "|", XFS_LOCK_FLAGS), \
-                  (void *)__entry->caller_ip) \
-)
-
+        TP_ARGS(ip,  lock_flags, caller_ip))
 DEFINE_LOCK_EVENT(xfs_ilock);
 DEFINE_LOCK_EVENT(xfs_ilock_nowait);
 DEFINE_LOCK_EVENT(xfs_ilock_demote);
 DEFINE_LOCK_EVENT(xfs_iunlock);
 
+DECLARE_EVENT_CLASS(xfs_iget_class,
+        TP_PROTO(struct xfs_inode *ip),
+        TP_ARGS(ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino)
+)
+
 #define DEFINE_IGET_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_iget_class, name, \
         TP_PROTO(struct xfs_inode *ip), \
-        TP_ARGS(ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino) \
-)
+        TP_ARGS(ip))
 DEFINE_IGET_EVENT(xfs_iget_skip);
 DEFINE_IGET_EVENT(xfs_iget_reclaim);
 DEFINE_IGET_EVENT(xfs_iget_found);
 DEFINE_IGET_EVENT(xfs_iget_alloc);
 
+DECLARE_EVENT_CLASS(xfs_inode_class,
+        TP_PROTO(struct xfs_inode *ip, unsigned long caller_ip),
+        TP_ARGS(ip, caller_ip),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(int, count)
+                __field(unsigned long, caller_ip)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->count = atomic_read(&VFS_I(ip)->i_count);
+                __entry->caller_ip = caller_ip;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx count %d caller %pf",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __entry->count,
+                  (char *)__entry->caller_ip)
+)
+
 #define DEFINE_INODE_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_inode_class, name, \
         TP_PROTO(struct xfs_inode *ip, unsigned long caller_ip), \
-        TP_ARGS(ip, caller_ip), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(int, count) \
-                __field(unsigned long, caller_ip) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->count = atomic_read(&VFS_I(ip)->i_count); \
-                __entry->caller_ip = caller_ip; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx count %d caller %pf", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __entry->count, \
-                  (char *)__entry->caller_ip) \
-)
+        TP_ARGS(ip, caller_ip))
 DEFINE_INODE_EVENT(xfs_ihold);
 DEFINE_INODE_EVENT(xfs_irele);
 /* the old xfs_itrace_entry tracer - to be replaced by s.th. in the VFS */
@@ -529,55 +560,59 @@ DEFINE_INODE_EVENT(xfs_inode);
 #define xfs_itrace_entry(ip)    \
         trace_xfs_inode(ip, _THIS_IP_)
 
-#define DEFINE_DQUOT_EVENT(tname) \
-TRACE_EVENT(tname, \
-        TP_PROTO(struct xfs_dquot *dqp), \
-        TP_ARGS(dqp), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(__be32, id) \
-                __field(unsigned, flags) \
-                __field(unsigned, nrefs) \
-                __field(unsigned long long, res_bcount) \
-                __field(unsigned long long, bcount) \
-                __field(unsigned long long, icount) \
-                __field(unsigned long long, blk_hardlimit) \
-                __field(unsigned long long, blk_softlimit) \
-                __field(unsigned long long, ino_hardlimit) \
-                __field(unsigned long long, ino_softlimit) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = dqp->q_mount->m_super->s_dev; \
-                __entry->id = dqp->q_core.d_id; \
-                __entry->flags = dqp->dq_flags; \
-                __entry->nrefs = dqp->q_nrefs; \
-                __entry->res_bcount = dqp->q_res_bcount; \
-                __entry->bcount = be64_to_cpu(dqp->q_core.d_bcount); \
-                __entry->icount = be64_to_cpu(dqp->q_core.d_icount); \
-                __entry->blk_hardlimit = \
-                        be64_to_cpu(dqp->q_core.d_blk_hardlimit); \
-                __entry->blk_softlimit = \
-                        be64_to_cpu(dqp->q_core.d_blk_softlimit); \
-                __entry->ino_hardlimit = \
-                        be64_to_cpu(dqp->q_core.d_ino_hardlimit); \
-                __entry->ino_softlimit = \
-                        be64_to_cpu(dqp->q_core.d_ino_softlimit); \
+DECLARE_EVENT_CLASS(xfs_dquot_class,
+        TP_PROTO(struct xfs_dquot *dqp),
+        TP_ARGS(dqp),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(__be32, id)
+                __field(unsigned, flags)
+                __field(unsigned, nrefs)
+                __field(unsigned long long, res_bcount)
+                __field(unsigned long long, bcount)
+                __field(unsigned long long, icount)
+                __field(unsigned long long, blk_hardlimit)
+                __field(unsigned long long, blk_softlimit)
+                __field(unsigned long long, ino_hardlimit)
+                __field(unsigned long long, ino_softlimit)
         ), \
-        TP_printk("dev %d:%d id 0x%x flags %s nrefs %u res_bc 0x%llx " \
-                  "bcnt 0x%llx [hard 0x%llx | soft 0x%llx] " \
-                  "icnt 0x%llx [hard 0x%llx | soft 0x%llx]", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  be32_to_cpu(__entry->id), \
-                  __print_flags(__entry->flags, "|", XFS_DQ_FLAGS), \
-                  __entry->nrefs, \
-                  __entry->res_bcount, \
-                  __entry->bcount, \
-                  __entry->blk_hardlimit, \
-                  __entry->blk_softlimit, \
-                  __entry->icount, \
-                  __entry->ino_hardlimit, \
-                  __entry->ino_softlimit) \
+        TP_fast_assign(
+                __entry->dev = dqp->q_mount->m_super->s_dev;
+                __entry->id = dqp->q_core.d_id;
+                __entry->flags = dqp->dq_flags;
+                __entry->nrefs = dqp->q_nrefs;
+                __entry->res_bcount = dqp->q_res_bcount;
+                __entry->bcount = be64_to_cpu(dqp->q_core.d_bcount);
+                __entry->icount = be64_to_cpu(dqp->q_core.d_icount);
+                __entry->blk_hardlimit =
+                        be64_to_cpu(dqp->q_core.d_blk_hardlimit);
+                __entry->blk_softlimit =
+                        be64_to_cpu(dqp->q_core.d_blk_softlimit);
+                __entry->ino_hardlimit =
+                        be64_to_cpu(dqp->q_core.d_ino_hardlimit);
+                __entry->ino_softlimit =
+                        be64_to_cpu(dqp->q_core.d_ino_softlimit);
+        ),
+        TP_printk("dev %d:%d id 0x%x flags %s nrefs %u res_bc 0x%llx "
+                  "bcnt 0x%llx [hard 0x%llx | soft 0x%llx] "
+                  "icnt 0x%llx [hard 0x%llx | soft 0x%llx]",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  be32_to_cpu(__entry->id),
+                  __print_flags(__entry->flags, "|", XFS_DQ_FLAGS),
+                  __entry->nrefs,
+                  __entry->res_bcount,
+                  __entry->bcount,
+                  __entry->blk_hardlimit,
+                  __entry->blk_softlimit,
+                  __entry->icount,
+                  __entry->ino_hardlimit,
+                  __entry->ino_softlimit)
 )
+
+#define DEFINE_DQUOT_EVENT(name) \
+DEFINE_EVENT(xfs_dquot_class, name, \
+        TP_PROTO(struct xfs_dquot *dqp), \
+        TP_ARGS(dqp))
 DEFINE_DQUOT_EVENT(xfs_dqadjust);
 DEFINE_DQUOT_EVENT(xfs_dqshake_dirty);
 DEFINE_DQUOT_EVENT(xfs_dqshake_unlink);
@@ -610,72 +645,75 @@ DEFINE_DQUOT_EVENT(xfs_dqflush_done);
 DEFINE_IGET_EVENT(xfs_dquot_dqalloc);
 DEFINE_IGET_EVENT(xfs_dquot_dqdetach);
 
+DECLARE_EVENT_CLASS(xfs_loggrant_class,
+        TP_PROTO(struct log *log, struct xlog_ticket *tic),
+        TP_ARGS(log, tic),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(unsigned, trans_type)
+                __field(char, ocnt)
+                __field(char, cnt)
+                __field(int, curr_res)
+                __field(int, unit_res)
+                __field(unsigned int, flags)
+                __field(void *, reserve_headq)
+                __field(void *, write_headq)
+                __field(int, grant_reserve_cycle)
+                __field(int, grant_reserve_bytes)
+                __field(int, grant_write_cycle)
+                __field(int, grant_write_bytes)
+                __field(int, curr_cycle)
+                __field(int, curr_block)
+                __field(xfs_lsn_t, tail_lsn)
+        ),
+        TP_fast_assign(
+                __entry->dev = log->l_mp->m_super->s_dev;
+                __entry->trans_type = tic->t_trans_type;
+                __entry->ocnt = tic->t_ocnt;
+                __entry->cnt = tic->t_cnt;
+                __entry->curr_res = tic->t_curr_res;
+                __entry->unit_res = tic->t_unit_res;
+                __entry->flags = tic->t_flags;
+                __entry->reserve_headq = log->l_reserve_headq;
+                __entry->write_headq = log->l_write_headq;
+                __entry->grant_reserve_cycle = log->l_grant_reserve_cycle;
+                __entry->grant_reserve_bytes = log->l_grant_reserve_bytes;
+                __entry->grant_write_cycle = log->l_grant_write_cycle;
+                __entry->grant_write_bytes = log->l_grant_write_bytes;
+                __entry->curr_cycle = log->l_curr_cycle;
+                __entry->curr_block = log->l_curr_block;
+                __entry->tail_lsn = log->l_tail_lsn;
+        ),
+        TP_printk("dev %d:%d type %s t_ocnt %u t_cnt %u t_curr_res %u "
+                  "t_unit_res %u t_flags %s reserve_headq 0x%p "
+                  "write_headq 0x%p grant_reserve_cycle %d "
+                  "grant_reserve_bytes %d grant_write_cycle %d "
+                  "grant_write_bytes %d curr_cycle %d curr_block %d "
+                  "tail_cycle %d tail_block %d",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __print_symbolic(__entry->trans_type, XFS_TRANS_TYPES),
+                  __entry->ocnt,
+                  __entry->cnt,
+                  __entry->curr_res,
+                  __entry->unit_res,
+                  __print_flags(__entry->flags, "|", XLOG_TIC_FLAGS),
+                  __entry->reserve_headq,
+                  __entry->write_headq,
+                  __entry->grant_reserve_cycle,
+                  __entry->grant_reserve_bytes,
+                  __entry->grant_write_cycle,
+                  __entry->grant_write_bytes,
+                  __entry->curr_cycle,
+                  __entry->curr_block,
+                  CYCLE_LSN(__entry->tail_lsn),
+                  BLOCK_LSN(__entry->tail_lsn)
+        )
+)
 
-#define DEFINE_LOGGRANT_EVENT(tname) \
-TRACE_EVENT(tname, \
+#define DEFINE_LOGGRANT_EVENT(name) \
+DEFINE_EVENT(xfs_loggrant_class, name, \
         TP_PROTO(struct log *log, struct xlog_ticket *tic), \
-        TP_ARGS(log, tic), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(unsigned, trans_type) \
-                __field(char, ocnt) \
-                __field(char, cnt) \
-                __field(int, curr_res) \
-                __field(int, unit_res) \
-                __field(unsigned int, flags) \
-                __field(void *, reserve_headq) \
-                __field(void *, write_headq) \
-                __field(int, grant_reserve_cycle) \
-                __field(int, grant_reserve_bytes) \
-                __field(int, grant_write_cycle) \
-                __field(int, grant_write_bytes) \
-                __field(int, curr_cycle) \
-                __field(int, curr_block) \
-                __field(xfs_lsn_t, tail_lsn) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = log->l_mp->m_super->s_dev; \
-                __entry->trans_type = tic->t_trans_type; \
-                __entry->ocnt = tic->t_ocnt; \
-                __entry->cnt = tic->t_cnt; \
-                __entry->curr_res = tic->t_curr_res; \
-                __entry->unit_res = tic->t_unit_res; \
-                __entry->flags = tic->t_flags; \
-                __entry->reserve_headq = log->l_reserve_headq; \
-                __entry->write_headq = log->l_write_headq; \
-                __entry->grant_reserve_cycle = log->l_grant_reserve_cycle; \
-                __entry->grant_reserve_bytes = log->l_grant_reserve_bytes; \
-                __entry->grant_write_cycle = log->l_grant_write_cycle; \
-                __entry->grant_write_bytes = log->l_grant_write_bytes; \
-                __entry->curr_cycle = log->l_curr_cycle; \
-                __entry->curr_block = log->l_curr_block; \
-                __entry->tail_lsn = log->l_tail_lsn; \
-        ), \
-        TP_printk("dev %d:%d type %s t_ocnt %u t_cnt %u t_curr_res %u " \
-                  "t_unit_res %u t_flags %s reserve_headq 0x%p " \
-                  "write_headq 0x%p grant_reserve_cycle %d " \
-                  "grant_reserve_bytes %d grant_write_cycle %d " \
-                  "grant_write_bytes %d curr_cycle %d curr_block %d " \
-                  "tail_cycle %d tail_block %d", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __print_symbolic(__entry->trans_type, XFS_TRANS_TYPES), \
-                  __entry->ocnt, \
-                  __entry->cnt, \
-                  __entry->curr_res, \
-                  __entry->unit_res, \
-                  __print_flags(__entry->flags, "|", XLOG_TIC_FLAGS), \
-                  __entry->reserve_headq, \
-                  __entry->write_headq, \
-                  __entry->grant_reserve_cycle, \
-                  __entry->grant_reserve_bytes, \
-                  __entry->grant_write_cycle, \
-                  __entry->grant_write_bytes, \
-                  __entry->curr_cycle, \
-                  __entry->curr_block, \
-                  CYCLE_LSN(__entry->tail_lsn), \
-                  BLOCK_LSN(__entry->tail_lsn) \
-        ) \
-)
+        TP_ARGS(log, tic))
 DEFINE_LOGGRANT_EVENT(xfs_log_done_nonperm);
 DEFINE_LOGGRANT_EVENT(xfs_log_done_perm);
 DEFINE_LOGGRANT_EVENT(xfs_log_reserve);
@@ -815,7 +853,7 @@ TRACE_EVENT(name, \
         ), \
         TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx " \
                   "offset 0x%llx count %zd flags %s " \
-                  "startoff 0x%llx startblock 0x%llx blockcount 0x%llx", \
+                  "startoff 0x%llx startblock %s blockcount 0x%llx", \
                   MAJOR(__entry->dev), MINOR(__entry->dev), \
                   __entry->ino, \
                   __entry->size, \
@@ -824,7 +862,7 @@ TRACE_EVENT(name, \
                   __entry->count, \
                   __print_flags(__entry->flags, "|", BMAPI_FLAGS), \
                   __entry->startoff, \
-                  __entry->startblock, \
+                  xfs_fmtfsblock(__entry->startblock), \
                   __entry->blockcount) \
 )
 DEFINE_IOMAP_EVENT(xfs_iomap_enter);
@@ -897,28 +935,32 @@ TRACE_EVENT(xfs_itruncate_start,
                   __entry->toss_finish)
 );
 
+DECLARE_EVENT_CLASS(xfs_itrunc_class,
+        TP_PROTO(struct xfs_inode *ip, xfs_fsize_t new_size),
+        TP_ARGS(ip, new_size),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(xfs_fsize_t, size)
+                __field(xfs_fsize_t, new_size)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(ip)->i_sb->s_dev;
+                __entry->ino = ip->i_ino;
+                __entry->size = ip->i_d.di_size;
+                __entry->new_size = new_size;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __entry->size,
+                  __entry->new_size)
+)
+
 #define DEFINE_ITRUNC_EVENT(name) \
-TRACE_EVENT(name, \
+DEFINE_EVENT(xfs_itrunc_class, name, \
         TP_PROTO(struct xfs_inode *ip, xfs_fsize_t new_size), \
-        TP_ARGS(ip, new_size), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(xfs_fsize_t, size) \
-                __field(xfs_fsize_t, new_size) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(ip)->i_sb->s_dev; \
-                __entry->ino = ip->i_ino; \
-                __entry->size = ip->i_d.di_size; \
-                __entry->new_size = new_size; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx size 0x%llx new_size 0x%llx", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __entry->size, \
-                  __entry->new_size) \
-)
+        TP_ARGS(ip, new_size))
 DEFINE_ITRUNC_EVENT(xfs_itruncate_finish_start);
 DEFINE_ITRUNC_EVENT(xfs_itruncate_finish_end);
 
@@ -1037,28 +1079,28 @@ TRACE_EVENT(xfs_alloc_unbusy,
 
 TRACE_EVENT(xfs_alloc_busysearch,
         TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, xfs_agblock_t agbno,
-                 xfs_extlen_t len, int found),
-        TP_ARGS(mp, agno, agbno, len, found),
+                 xfs_extlen_t len, xfs_lsn_t lsn),
+        TP_ARGS(mp, agno, agbno, len, lsn),
         TP_STRUCT__entry(
                 __field(dev_t, dev)
                 __field(xfs_agnumber_t, agno)
                 __field(xfs_agblock_t, agbno)
                 __field(xfs_extlen_t, len)
-                __field(int, found)
+                __field(xfs_lsn_t, lsn)
         ),
         TP_fast_assign(
                 __entry->dev = mp->m_super->s_dev;
                 __entry->agno = agno;
                 __entry->agbno = agbno;
                 __entry->len = len;
-                __entry->found = found;
+                __entry->lsn = lsn;
         ),
-        TP_printk("dev %d:%d agno %u agbno %u len %u %s",
+        TP_printk("dev %d:%d agno %u agbno %u len %u force lsn 0x%llx",
                   MAJOR(__entry->dev), MINOR(__entry->dev),
                   __entry->agno,
                   __entry->agbno,
                   __entry->len,
-                  __print_symbolic(__entry->found, XFS_BUSY_STATES))
+                  __entry->lsn)
 );
 
 TRACE_EVENT(xfs_agf,
@@ -1152,77 +1194,80 @@ TRACE_EVENT(xfs_free_extent,
 
 );
 
-#define DEFINE_ALLOC_EVENT(name) \
-TRACE_EVENT(name, \
-        TP_PROTO(struct xfs_alloc_arg *args), \
-        TP_ARGS(args), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_agnumber_t, agno) \
-                __field(xfs_agblock_t, agbno) \
-                __field(xfs_extlen_t, minlen) \
-                __field(xfs_extlen_t, maxlen) \
-                __field(xfs_extlen_t, mod) \
-                __field(xfs_extlen_t, prod) \
-                __field(xfs_extlen_t, minleft) \
-                __field(xfs_extlen_t, total) \
-                __field(xfs_extlen_t, alignment) \
-                __field(xfs_extlen_t, minalignslop) \
-                __field(xfs_extlen_t, len) \
-                __field(short, type) \
-                __field(short, otype) \
-                __field(char, wasdel) \
-                __field(char, wasfromfl) \
-                __field(char, isfl) \
-                __field(char, userdata) \
-                __field(xfs_fsblock_t, firstblock) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = args->mp->m_super->s_dev; \
-                __entry->agno = args->agno; \
-                __entry->agbno = args->agbno; \
-                __entry->minlen = args->minlen; \
-                __entry->maxlen = args->maxlen; \
-                __entry->mod = args->mod; \
-                __entry->prod = args->prod; \
-                __entry->minleft = args->minleft; \
-                __entry->total = args->total; \
-                __entry->alignment = args->alignment; \
-                __entry->minalignslop = args->minalignslop; \
-                __entry->len = args->len; \
-                __entry->type = args->type; \
-                __entry->otype = args->otype; \
-                __entry->wasdel = args->wasdel; \
-                __entry->wasfromfl = args->wasfromfl; \
-                __entry->isfl = args->isfl; \
-                __entry->userdata = args->userdata; \
-                __entry->firstblock = args->firstblock; \
-        ), \
-        TP_printk("dev %d:%d agno %u agbno %u minlen %u maxlen %u mod %u " \
-                  "prod %u minleft %u total %u alignment %u minalignslop %u " \
-                  "len %u type %s otype %s wasdel %d wasfromfl %d isfl %d " \
-                  "userdata %d firstblock 0x%llx", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->agno, \
-                  __entry->agbno, \
-                  __entry->minlen, \
-                  __entry->maxlen, \
-                  __entry->mod, \
-                  __entry->prod, \
-                  __entry->minleft, \
-                  __entry->total, \
-                  __entry->alignment, \
-                  __entry->minalignslop, \
-                  __entry->len, \
-                  __print_symbolic(__entry->type, XFS_ALLOC_TYPES), \
-                  __print_symbolic(__entry->otype, XFS_ALLOC_TYPES), \
-                  __entry->wasdel, \
-                  __entry->wasfromfl, \
-                  __entry->isfl, \
-                  __entry->userdata, \
-                  __entry->firstblock) \
+DECLARE_EVENT_CLASS(xfs_alloc_class,
+        TP_PROTO(struct xfs_alloc_arg *args),
+        TP_ARGS(args),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_agnumber_t, agno)
+                __field(xfs_agblock_t, agbno)
+                __field(xfs_extlen_t, minlen)
+                __field(xfs_extlen_t, maxlen)
+                __field(xfs_extlen_t, mod)
+                __field(xfs_extlen_t, prod)
+                __field(xfs_extlen_t, minleft)
+                __field(xfs_extlen_t, total)
+                __field(xfs_extlen_t, alignment)
+                __field(xfs_extlen_t, minalignslop)
+                __field(xfs_extlen_t, len)
+                __field(short, type)
+                __field(short, otype)
+                __field(char, wasdel)
+                __field(char, wasfromfl)
+                __field(char, isfl)
+                __field(char, userdata)
+                __field(xfs_fsblock_t, firstblock)
+        ),
+        TP_fast_assign(
+                __entry->dev = args->mp->m_super->s_dev;
+                __entry->agno = args->agno;
+                __entry->agbno = args->agbno;
+                __entry->minlen = args->minlen;
+                __entry->maxlen = args->maxlen;
+                __entry->mod = args->mod;
+                __entry->prod = args->prod;
+                __entry->minleft = args->minleft;
+                __entry->total = args->total;
+                __entry->alignment = args->alignment;
+                __entry->minalignslop = args->minalignslop;
+                __entry->len = args->len;
+                __entry->type = args->type;
+                __entry->otype = args->otype;
+                __entry->wasdel = args->wasdel;
+                __entry->wasfromfl = args->wasfromfl;
+                __entry->isfl = args->isfl;
+                __entry->userdata = args->userdata;
+                __entry->firstblock = args->firstblock;
+        ),
+        TP_printk("dev %d:%d agno %u agbno %u minlen %u maxlen %u mod %u "
+                  "prod %u minleft %u total %u alignment %u minalignslop %u "
+                  "len %u type %s otype %s wasdel %d wasfromfl %d isfl %d "
+                  "userdata %d firstblock 0x%llx",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->agno,
+                  __entry->agbno,
+                  __entry->minlen,
+                  __entry->maxlen,
+                  __entry->mod,
+                  __entry->prod,
+                  __entry->minleft,
+                  __entry->total,
+                  __entry->alignment,
+                  __entry->minalignslop,
+                  __entry->len,
+                  __print_symbolic(__entry->type, XFS_ALLOC_TYPES),
+                  __print_symbolic(__entry->otype, XFS_ALLOC_TYPES),
+                  __entry->wasdel,
+                  __entry->wasfromfl,
+                  __entry->isfl,
+                  __entry->userdata,
+                  __entry->firstblock)
 )
 
+#define DEFINE_ALLOC_EVENT(name) \
+DEFINE_EVENT(xfs_alloc_class, name, \
+        TP_PROTO(struct xfs_alloc_arg *args), \
+        TP_ARGS(args))
 DEFINE_ALLOC_EVENT(xfs_alloc_exact_done);
 DEFINE_ALLOC_EVENT(xfs_alloc_exact_error);
 DEFINE_ALLOC_EVENT(xfs_alloc_near_nominleft);
@@ -1245,92 +1290,100 @@ DEFINE_ALLOC_EVENT(xfs_alloc_vextent_noagbp);
 DEFINE_ALLOC_EVENT(xfs_alloc_vextent_loopfailed);
 DEFINE_ALLOC_EVENT(xfs_alloc_vextent_allfailed);
 
-#define DEFINE_DIR2_TRACE(tname) \
-TRACE_EVENT(tname, \
+DECLARE_EVENT_CLASS(xfs_dir2_class,
+        TP_PROTO(struct xfs_da_args *args),
+        TP_ARGS(args),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __dynamic_array(char, name, args->namelen)
+                __field(int, namelen)
+                __field(xfs_dahash_t, hashval)
+                __field(xfs_ino_t, inumber)
+                __field(int, op_flags)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(args->dp)->i_sb->s_dev;
+                __entry->ino = args->dp->i_ino;
+                if (args->namelen)
+                        memcpy(__get_str(name), args->name, args->namelen);
+                __entry->namelen = args->namelen;
+                __entry->hashval = args->hashval;
+                __entry->inumber = args->inumber;
+                __entry->op_flags = args->op_flags;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx name %.*s namelen %d hashval 0x%x "
+                  "inumber 0x%llx op_flags %s",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __entry->namelen,
+                  __entry->namelen ? __get_str(name) : NULL,
+                  __entry->namelen,
+                  __entry->hashval,
+                  __entry->inumber,
+                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS))
+)
+
+#define DEFINE_DIR2_EVENT(name) \
+DEFINE_EVENT(xfs_dir2_class, name, \
         TP_PROTO(struct xfs_da_args *args), \
-        TP_ARGS(args), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __dynamic_array(char, name, args->namelen) \
-                __field(int, namelen) \
-                __field(xfs_dahash_t, hashval) \
-                __field(xfs_ino_t, inumber) \
-                __field(int, op_flags) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(args->dp)->i_sb->s_dev; \
-                __entry->ino = args->dp->i_ino; \
-                if (args->namelen) \
-                        memcpy(__get_str(name), args->name, args->namelen); \
-                __entry->namelen = args->namelen; \
-                __entry->hashval = args->hashval; \
-                __entry->inumber = args->inumber; \
-                __entry->op_flags = args->op_flags; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx name %.*s namelen %d hashval 0x%x " \
-                  "inumber 0x%llx op_flags %s", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __entry->namelen, \
-                  __entry->namelen ? __get_str(name) : NULL, \
-                  __entry->namelen, \
-                  __entry->hashval, \
-                  __entry->inumber, \
-                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS)) \
+        TP_ARGS(args))
+DEFINE_DIR2_EVENT(xfs_dir2_sf_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_create);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_toino4);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_toino8);
+DEFINE_DIR2_EVENT(xfs_dir2_sf_to_block);
+DEFINE_DIR2_EVENT(xfs_dir2_block_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_block_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_block_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_block_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_block_to_sf);
+DEFINE_DIR2_EVENT(xfs_dir2_block_to_leaf);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_to_block);
+DEFINE_DIR2_EVENT(xfs_dir2_leaf_to_node);
+DEFINE_DIR2_EVENT(xfs_dir2_node_addname);
+DEFINE_DIR2_EVENT(xfs_dir2_node_lookup);
+DEFINE_DIR2_EVENT(xfs_dir2_node_replace);
+DEFINE_DIR2_EVENT(xfs_dir2_node_removename);
+DEFINE_DIR2_EVENT(xfs_dir2_node_to_leaf);
+
+DECLARE_EVENT_CLASS(xfs_dir2_space_class,
+        TP_PROTO(struct xfs_da_args *args, int idx),
+        TP_ARGS(args, idx),
+        TP_STRUCT__entry(
+                __field(dev_t, dev)
+                __field(xfs_ino_t, ino)
+                __field(int, op_flags)
+                __field(int, idx)
+        ),
+        TP_fast_assign(
+                __entry->dev = VFS_I(args->dp)->i_sb->s_dev;
+                __entry->ino = args->dp->i_ino;
+                __entry->op_flags = args->op_flags;
+                __entry->idx = idx;
+        ),
+        TP_printk("dev %d:%d ino 0x%llx op_flags %s index %d",
+                  MAJOR(__entry->dev), MINOR(__entry->dev),
+                  __entry->ino,
+                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS),
+                  __entry->idx)
 )
-DEFINE_DIR2_TRACE(xfs_dir2_sf_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_create);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_toino4);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_toino8);
-DEFINE_DIR2_TRACE(xfs_dir2_sf_to_block);
-DEFINE_DIR2_TRACE(xfs_dir2_block_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_block_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_block_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_block_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_block_to_sf);
-DEFINE_DIR2_TRACE(xfs_dir2_block_to_leaf);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_to_block);
-DEFINE_DIR2_TRACE(xfs_dir2_leaf_to_node);
-DEFINE_DIR2_TRACE(xfs_dir2_node_addname);
-DEFINE_DIR2_TRACE(xfs_dir2_node_lookup);
-DEFINE_DIR2_TRACE(xfs_dir2_node_replace);
-DEFINE_DIR2_TRACE(xfs_dir2_node_removename);
-DEFINE_DIR2_TRACE(xfs_dir2_node_to_leaf);
 
-#define DEFINE_DIR2_SPACE_TRACE(tname) \
-TRACE_EVENT(tname, \
+#define DEFINE_DIR2_SPACE_EVENT(name) \
+DEFINE_EVENT(xfs_dir2_space_class, name, \
         TP_PROTO(struct xfs_da_args *args, int idx), \
-        TP_ARGS(args, idx), \
-        TP_STRUCT__entry( \
-                __field(dev_t, dev) \
-                __field(xfs_ino_t, ino) \
-                __field(int, op_flags) \
-                __field(int, idx) \
-        ), \
-        TP_fast_assign( \
-                __entry->dev = VFS_I(args->dp)->i_sb->s_dev; \
-                __entry->ino = args->dp->i_ino; \
-                __entry->op_flags = args->op_flags; \
-                __entry->idx = idx; \
-        ), \
-        TP_printk("dev %d:%d ino 0x%llx op_flags %s index %d", \
-                  MAJOR(__entry->dev), MINOR(__entry->dev), \
-                  __entry->ino, \
-                  __print_flags(__entry->op_flags, "|", XFS_DA_OP_FLAGS), \
-                  __entry->idx) \
-)
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_leafn_add);
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_leafn_remove);
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_grow_inode);
-DEFINE_DIR2_SPACE_TRACE(xfs_dir2_shrink_inode);
+        TP_ARGS(args, idx))
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_leafn_add);
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_leafn_remove);
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_grow_inode);
+DEFINE_DIR2_SPACE_EVENT(xfs_dir2_shrink_inode);
 
 TRACE_EVENT(xfs_dir2_leafn_moveents,
         TP_PROTO(struct xfs_da_args *args, int src_idx, int dst_idx, int count),
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 71af76fe8a23..873e07e29074 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -891,7 +891,7 @@ xfs_qm_dqrele_all_inodes(
         uint             flags)
 {
         ASSERT(mp->m_quotainfo);
-        xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, XFS_ICI_NO_TAG);
+        xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, XFS_ICI_NO_TAG, 0);
 }
 
 /*------------------------------------------------------------------------*/
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index a1c65fc6d9c4..275b1f4f9430 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -2563,43 +2563,41 @@ xfs_alloc_search_busy(xfs_trans_t *tp,
         xfs_mount_t             *mp;
         xfs_perag_busy_t        *bsy;
         xfs_agblock_t           uend, bend;
-        xfs_lsn_t               lsn;
+        xfs_lsn_t               lsn = 0;
         int                     cnt;
 
         mp = tp->t_mountp;
 
         spin_lock(&mp->m_perag[agno].pagb_lock);
-        cnt = mp->m_perag[agno].pagb_count;
 
         uend = bno + len - 1;
 
-        /* search pagb_list for this slot, skipping open slots */
-        for (bsy = mp->m_perag[agno].pagb_list; cnt; bsy++) {
+        /*
+         * search pagb_list for this slot, skipping open slots. We have to
+         * search the entire array as there may be multiple overlaps and
+         * we have to get the most recent LSN for the log force to push out
+         * all the transactions that span the range.
+         */
+        for (cnt = 0; cnt < mp->m_perag[agno].pagb_count; cnt++) {
+                bsy = &mp->m_perag[agno].pagb_list[cnt];
+                if (!bsy->busy_tp)
+                        continue;
 
-                /*
-                 * (start1,length1) within (start2, length2)
-                 */
-                if (bsy->busy_tp != NULL) {
-                        bend = bsy->busy_start + bsy->busy_length - 1;
-                        if ((bno > bend) || (uend < bsy->busy_start)) {
-                                cnt--;
-                        } else {
-                                break;
-                        }
-                }
-        }
+                bend = bsy->busy_start + bsy->busy_length - 1;
+                if (bno > bend || uend < bsy->busy_start)
+                        continue;
 
-        trace_xfs_alloc_busysearch(mp, agno, bno, len, !!cnt);
+                /* (start1,length1) within (start2, length2) */
+                if (XFS_LSN_CMP(bsy->busy_tp->t_commit_lsn, lsn) > 0)
+                        lsn = bsy->busy_tp->t_commit_lsn;
+        }
+        spin_unlock(&mp->m_perag[agno].pagb_lock);
+        trace_xfs_alloc_busysearch(tp->t_mountp, agno, bno, len, lsn);
 
         /*
          * If a block was found, force the log through the LSN of the
          * transaction that freed the block
          */
-        if (cnt) {
-                lsn = bsy->busy_tp->t_commit_lsn;
-                spin_unlock(&mp->m_perag[agno].pagb_lock);
+        if (lsn)
                 xfs_log_force(mp, lsn, XFS_LOG_FORCE|XFS_LOG_SYNC);
-        } else {
-                spin_unlock(&mp->m_perag[agno].pagb_lock);
-        }
 }
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index d1483a4f71b8..84ca1cf16a1e 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -114,10 +114,82 @@ xfs_swapext(
         return error;
 }
 
+/*
+ * We need to check that the format of the data fork in the temporary inode is
+ * valid for the target inode before doing the swap. This is not a problem with
+ * attr1 because of the fixed fork offset, but attr2 has a dynamically sized
+ * data fork depending on the space the attribute fork is taking so we can get
+ * invalid formats on the target inode.
+ *
+ * E.g. target has space for 7 extents in extent format, temp inode only has
+ * space for 6.  If we defragment down to 7 extents, then the tmp format is a
+ * btree, but when swapped it needs to be in extent format. Hence we can't just
+ * blindly swap data forks on attr2 filesystems.
+ *
+ * Note that we check the swap in both directions so that we don't end up with
+ * a corrupt temporary inode, either.
+ *
+ * Note that fixing the way xfs_fsr sets up the attribute fork in the source
+ * inode will prevent this situation from occurring, so all we do here is
+ * reject and log the attempt. basically we are putting the responsibility on
+ * userspace to get this right.
+ */
+static int
+xfs_swap_extents_check_format(
+        xfs_inode_t     *ip,    /* target inode */
+        xfs_inode_t     *tip)   /* tmp inode */
+{
+
+        /* Should never get a local format */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL ||
+            tip->i_d.di_format == XFS_DINODE_FMT_LOCAL)
+                return EINVAL;
+
+        /*
+         * if the target inode has less extents that then temporary inode then
+         * why did userspace call us?
+         */
+        if (ip->i_d.di_nextents < tip->i_d.di_nextents)
+                return EINVAL;
+
+        /*
+         * if the target inode is in extent form and the temp inode is in btree
+         * form then we will end up with the target inode in the wrong format
+         * as we already know there are less extents in the temp inode.
+         */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
+            tip->i_d.di_format == XFS_DINODE_FMT_BTREE)
+                return EINVAL;
+
+        /* Check temp in extent form to max in target */
+        if (tip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
+            XFS_IFORK_NEXTENTS(tip, XFS_DATA_FORK) > ip->i_df.if_ext_max)
+                return EINVAL;
+
+        /* Check target in extent form to max in temp */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_EXTENTS &&
+            XFS_IFORK_NEXTENTS(ip, XFS_DATA_FORK) > tip->i_df.if_ext_max)
+                return EINVAL;
+
+        /* Check root block of temp in btree form to max in target */
+        if (tip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
+            XFS_IFORK_BOFF(ip) &&
+            tip->i_df.if_broot_bytes > XFS_IFORK_BOFF(ip))
+                return EINVAL;
+
+        /* Check root block of target in btree form to max in temp */
+        if (ip->i_d.di_format == XFS_DINODE_FMT_BTREE &&
+            XFS_IFORK_BOFF(tip) &&
+            ip->i_df.if_broot_bytes > XFS_IFORK_BOFF(tip))
+                return EINVAL;
+
+        return 0;
+}
+
 int
 xfs_swap_extents(
-        xfs_inode_t     *ip,
-        xfs_inode_t     *tip,
+        xfs_inode_t     *ip,    /* target inode */
+        xfs_inode_t     *tip,   /* tmp inode */
         xfs_swapext_t   *sxp)
 {
         xfs_mount_t     *mp;
@@ -161,13 +233,6 @@ xfs_swap_extents(
                 goto out_unlock;
         }
 
-        /* Should never get a local format */
-        if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL ||
-            tip->i_d.di_format == XFS_DINODE_FMT_LOCAL) {
-                error = XFS_ERROR(EINVAL);
-                goto out_unlock;
-        }
-
         if (VN_CACHED(VFS_I(tip)) != 0) {
                 error = xfs_flushinval_pages(tip, 0, -1,
                                 FI_REMAPF_LOCKED);
@@ -189,13 +254,12 @@ xfs_swap_extents(
                 goto out_unlock;
         }
 
-        /*
-         * If the target has extended attributes, the tmp file
-         * must also in order to ensure the correct data fork
-         * format.
-         */
-        if ( XFS_IFORK_Q(ip) != XFS_IFORK_Q(tip) ) {
-                error = XFS_ERROR(EINVAL);
+        /* check inode formats now that data is flushed */
+        error = xfs_swap_extents_check_format(ip, tip);
+        if (error) {
+                xfs_fs_cmn_err(CE_NOTE, mp,
+                    "%s: inode 0x%llx format is incompatible for exchanging.",
+                                __FILE__, ip->i_ino);
                 goto out_unlock;
         }
 
@@ -276,6 +340,16 @@ xfs_swap_extents(
         *tifp = *tempifp;       /* struct copy */
 
         /*
+         * Fix the in-memory data fork values that are dependent on the fork
+         * offset in the inode. We can't assume they remain the same as attr2
+         * has dynamic fork offsets.
+         */
+        ifp->if_ext_max = XFS_IFORK_SIZE(ip, XFS_DATA_FORK) /
+                                        (uint)sizeof(xfs_bmbt_rec_t);
+        tifp->if_ext_max = XFS_IFORK_SIZE(tip, XFS_DATA_FORK) /
+                                        (uint)sizeof(xfs_bmbt_rec_t);
+
+        /*
          * Fix the on-disk inode values
          */
         tmp = (__uint64_t)ip->i_d.di_nblocks;
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index fa402a6bbbcf..155e798f30a1 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -73,7 +73,6 @@ xfs_inode_alloc(
         ASSERT(atomic_read(&ip->i_pincount) == 0);
         ASSERT(!spin_is_locked(&ip->i_flags_lock));
         ASSERT(completion_done(&ip->i_flush));
-        ASSERT(!rwsem_is_locked(&ip->i_iolock.mr_lock));
 
         mrlock_init(&ip->i_iolock, MRLOCK_BARRIER, "xfsio", ip->i_ino);
 
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index ce278b3ae7fc..ef77fd88c8e3 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2841,8 +2841,8 @@ xfs_iflush(
         mp = ip->i_mount;
 
         /*
-         * If the inode isn't dirty, then just release the inode
-         * flush lock and do nothing.
+         * If the inode isn't dirty, then just release the inode flush lock and
+         * do nothing.
          */
         if (xfs_inode_clean(ip)) {
                 xfs_ifunlock(ip);
@@ -2868,6 +2868,19 @@ xfs_iflush(
         xfs_iunpin_wait(ip);
 
         /*
+         * For stale inodes we cannot rely on the backing buffer remaining
+         * stale in cache for the remaining life of the stale inode and so
+         * xfs_itobp() below may give us a buffer that no longer contains
+         * inodes below. We have to check this after ensuring the inode is
+         * unpinned so that it is safe to reclaim the stale inode after the
+         * flush call.
+         */
+        if (xfs_iflags_test(ip, XFS_ISTALE)) {
+                xfs_ifunlock(ip);
+                return 0;
+        }
+
+        /*
          * This may have been unpinned because the filesystem is shutting
          * down forcibly. If that's the case we must not write this inode
          * to disk, because the log record didn't make it to disk!
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 9e15a1185362..6be05f756d59 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -1517,6 +1517,8 @@ xfs_rtfree_range(
          */
         error = xfs_rtfind_forw(mp, tp, end, mp->m_sb.sb_rextents - 1,
                 &postblock);
+        if (error)
+                return error;
         /*
          * If there are blocks not being freed at the front of the
          * old extent, add summary data for them to be allocated.
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 6558ffd8d140..6f268756bf36 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -70,7 +70,6 @@ xfs_setattr(
         uint                    commit_flags=0;
         uid_t                   uid=0, iuid=0;
         gid_t                   gid=0, igid=0;
-        int                     timeflags = 0;
         struct xfs_dquot        *udqp, *gdqp, *olddquot1, *olddquot2;
         int                     need_iolock = 1;
 
@@ -135,16 +134,13 @@ xfs_setattr(
         if (flags & XFS_ATTR_NOLOCK)
                 need_iolock = 0;
         if (!(mask & ATTR_SIZE)) {
-                if ((mask != (ATTR_CTIME|ATTR_ATIME|ATTR_MTIME)) ||
-                    (mp->m_flags & XFS_MOUNT_WSYNC)) {
-                        tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
-                        commit_flags = 0;
-                        if ((code = xfs_trans_reserve(tp, 0,
-                                                     XFS_ICHANGE_LOG_RES(mp), 0,
-                                                     0, 0))) {
-                                lock_flags = 0;
-                                goto error_return;
-                        }
+                tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
+                commit_flags = 0;
+                code = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp),
+                                         0, 0, 0);
+                if (code) {
+                        lock_flags = 0;
+                        goto error_return;
                 }
         } else {
                 if (DM_EVENT_ENABLED(ip, DM_EVENT_TRUNCATE) &&
@@ -295,15 +291,23 @@ xfs_setattr(
                  * or we are explicitly asked to change it. This handles
                  * the semantic difference between truncate() and ftruncate()
                  * as implemented in the VFS.
+                 *
+                 * The regular truncate() case without ATTR_CTIME and ATTR_MTIME
+                 * is a special case where we need to update the times despite
+                 * not having these flags set.  For all other operations the
+                 * VFS set these flags explicitly if it wants a timestamp
+                 * update.
                  */
-                if (iattr->ia_size != ip->i_size || (mask & ATTR_CTIME))
-                        timeflags |= XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG;
+                if (iattr->ia_size != ip->i_size &&
+                    (!(mask & (ATTR_CTIME | ATTR_MTIME)))) {
+                        iattr->ia_ctime = iattr->ia_mtime =
+                                current_fs_time(inode->i_sb);
+                        mask |= ATTR_CTIME | ATTR_MTIME;
+                }
 
                 if (iattr->ia_size > ip->i_size) {
                         ip->i_d.di_size = iattr->ia_size;
                         ip->i_size = iattr->ia_size;
-                        if (!(flags & XFS_ATTR_DMI))
-                                xfs_ichgtime(ip, XFS_ICHGTIME_CHG);
                         xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
                 } else if (iattr->ia_size <= ip->i_size ||
                            (iattr->ia_size == 0 && ip->i_d.di_nextents)) {
@@ -374,9 +378,6 @@ xfs_setattr(
                         ip->i_d.di_gid = gid;
                         inode->i_gid = gid;
                 }
-
-                xfs_trans_log_inode (tp, ip, XFS_ILOG_CORE);
-                timeflags |= XFS_ICHGTIME_CHG;
         }
 
         /*
@@ -393,51 +394,37 @@ xfs_setattr(
 
                 inode->i_mode &= S_IFMT;
                 inode->i_mode |= mode & ~S_IFMT;
-
-                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
-                timeflags |= XFS_ICHGTIME_CHG;
         }
 
         /*
          * Change file access or modified times.
          */
-        if (mask & (ATTR_ATIME|ATTR_MTIME)) {
-                if (mask & ATTR_ATIME) {
-                        inode->i_atime = iattr->ia_atime;
-                        ip->i_d.di_atime.t_sec = iattr->ia_atime.tv_sec;
-                        ip->i_d.di_atime.t_nsec = iattr->ia_atime.tv_nsec;
-                        ip->i_update_core = 1;
-                }
-                if (mask & ATTR_MTIME) {
-                        inode->i_mtime = iattr->ia_mtime;
-                        ip->i_d.di_mtime.t_sec = iattr->ia_mtime.tv_sec;
-                        ip->i_d.di_mtime.t_nsec = iattr->ia_mtime.tv_nsec;
-                        timeflags &= ~XFS_ICHGTIME_MOD;
-                        timeflags |= XFS_ICHGTIME_CHG;
-                }
-                if (tp && (mask & (ATTR_MTIME_SET|ATTR_ATIME_SET)))
-                        xfs_trans_log_inode (tp, ip, XFS_ILOG_CORE);
+        if (mask & ATTR_ATIME) {
+                inode->i_atime = iattr->ia_atime;
+                ip->i_d.di_atime.t_sec = iattr->ia_atime.tv_sec;
+                ip->i_d.di_atime.t_nsec = iattr->ia_atime.tv_nsec;
+                ip->i_update_core = 1;
         }
-
-        /*
-         * Change file inode change time only if ATTR_CTIME set
-         * AND we have been called by a DMI function.
-         */
-
-        if ((flags & XFS_ATTR_DMI) && (mask & ATTR_CTIME)) {
+        if (mask & ATTR_CTIME) {
                 inode->i_ctime = iattr->ia_ctime;
                 ip->i_d.di_ctime.t_sec = iattr->ia_ctime.tv_sec;
                 ip->i_d.di_ctime.t_nsec = iattr->ia_ctime.tv_nsec;
                 ip->i_update_core = 1;
-                timeflags &= ~XFS_ICHGTIME_CHG;
+        }
+        if (mask & ATTR_MTIME) {
+                inode->i_mtime = iattr->ia_mtime;
+                ip->i_d.di_mtime.t_sec = iattr->ia_mtime.tv_sec;
+                ip->i_d.di_mtime.t_nsec = iattr->ia_mtime.tv_nsec;
+                ip->i_update_core = 1;
         }
 
         /*
-         * Send out timestamp changes that need to be set to the
-         * current time.  Not done when called by a DMI function.
+         * And finally, log the inode core if any attribute in it
+         * has been changed.
          */
-        if (timeflags && !(flags & XFS_ATTR_DMI))
-                xfs_ichgtime(ip, timeflags);
+        if (mask & (ATTR_UID|ATTR_GID|ATTR_MODE|
+                    ATTR_ATIME|ATTR_CTIME|ATTR_MTIME))
+                xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
 
         XFS_STATS_INC(xs_ig_attrchg);
 
@@ -452,12 +439,10 @@ xfs_setattr(
          * mix so this probably isn't worth the trouble to optimize.
          */
         code = 0;
-        if (tp) {
-                if (mp->m_flags & XFS_MOUNT_WSYNC)
-                        xfs_trans_set_sync(tp);
+        if (mp->m_flags & XFS_MOUNT_WSYNC)
+                xfs_trans_set_sync(tp);
 
-                code = xfs_trans_commit(tp, commit_flags);
-        }
+        code = xfs_trans_commit(tp, commit_flags);
 
         xfs_iunlock(ip, lock_flags);