72 files changed, 842 insertions, 398 deletions
diff --git a/fs/9p/conv.c b/fs/9p/conv.c
index 32a9f99154..bf1f100679 100644
--- a/fs/9p/conv.c
+++ b/fs/9p/conv.c
@@ -116,13 +116,19 @@ static void buf_put_int64(struct cbuf *buf, u64 val)
        }
 }
-static void buf_put_stringn(struct cbuf *buf, const char *s, u16 slen)
+static char *buf_put_stringn(struct cbuf *buf, const char *s, u16 slen)
 {
+        char *ret;
+        ret = NULL;
        if (buf_check_size(buf, slen + 2)) {
                buf_put_int16(buf, slen);
+                ret = buf->p;
                memcpy(buf->p, s, slen);
                buf->p += slen;
        }
+        return ret;
 }
 static inline void buf_put_string(struct cbuf *buf, const char *s)
@@ -430,15 +436,19 @@ static inline void v9fs_put_int64(struct cbuf *bufp, u64 val, u64 * p)
 static void
 v9fs_put_str(struct cbuf *bufp, char *data, struct v9fs_str *str)
 {
-        if (data) {
+        int len;
-                str->len = strlen(data);
+        char *s;
-                str->str = bufp->p;
-        } else {
+        if (data)
-                str->len = 0;
+                len = strlen(data);
-                str->str = NULL;
+        else
-        }
+                len = 0;
-        buf_put_stringn(bufp, data, str->len);
+        s = buf_put_stringn(bufp, data, len);
+        if (str) {
+                str->len = len;
+                str->str = s;
+        }
 }
 static int
diff --git a/fs/9p/mux.c b/fs/9p/mux.c
index 945cb368d4..ea1134eb47 100644
--- a/fs/9p/mux.c
+++ b/fs/9p/mux.c
@@ -471,10 +471,13 @@ static void v9fs_write_work(void *a)
                }
                spin_lock(&m->lock);
-                req =
+again:
-                    list_entry(m->unsent_req_list.next, struct v9fs_req,
+                req = list_entry(m->unsent_req_list.next, struct v9fs_req,
                               req_list);
                list_move_tail(&req->req_list, &m->req_list);
+                if (req->err == ERREQFLUSH)
+                        goto again;
                m->wbuf = req->tcall->sdata;
                m->wsize = req->tcall->size;
                m->wpos = 0;
@@ -525,7 +528,7 @@ static void process_request(struct v9fs_mux_data *m, struct v9fs_req *req)
        struct v9fs_str *ename;
        tag = req->tag;
-        if (req->rcall->id == RERROR && !req->err) {
+        if (!req->err && req->rcall->id == RERROR) {
                ecode = req->rcall->params.rerror.errno;
                ename = &req->rcall->params.rerror.error;
@@ -551,7 +554,10 @@ static void process_request(struct v9fs_mux_data *m, struct v9fs_req *req)
                        req->err = -EIO;
        }
-        if (req->cb && req->err != ERREQFLUSH) {
+        if (req->err == ERREQFLUSH)
+                return;
+        if (req->cb) {
                dprintk(DEBUG_MUX, "calling callback tcall %p rcall %p\n",
                        req->tcall, req->rcall);
@@ -812,6 +818,7 @@ v9fs_mux_rpc_cb(void *a, struct v9fs_fcall *tc, struct v9fs_fcall *rc, int err)
        struct v9fs_mux_rpc *r;
        if (err == ERREQFLUSH) {
+                kfree(rc);
                dprintk(DEBUG_MUX, "err req flush\n");
                return;
        }
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 91f552454c..63e5b0398e 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -886,8 +886,8 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
        }
        /* copy extension buffer into buffer */
-        if (fcall->params.rstat.stat.extension.len < buflen)
+        if (fcall->params.rstat.stat.extension.len+1 < buflen)
-                buflen = fcall->params.rstat.stat.extension.len;
+                buflen = fcall->params.rstat.stat.extension.len + 1;
        memcpy(buffer, fcall->params.rstat.stat.extension.str, buflen - 1);
        buffer[buflen-1] = 0;
@@ -951,7 +951,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
        if (!link)
                link = ERR_PTR(-ENOMEM);
        else {
-                len = v9fs_readlink(dentry, link, strlen(link));
+                len = v9fs_readlink(dentry, link, PATH_MAX);
                if (len < 0) {
                        __putname(link);
diff --git a/fs/Kconfig b/fs/Kconfig
index 93b5dc4082..e9749b0eec 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -883,8 +883,6 @@ config CONFIGFS_FS
          Both sysfs and configfs can and should exist together on the
          same system. One is not a replacement for the other.
-          If unsure, say N.
 endmenu
 menu "Miscellaneous filesystems"
diff --git a/fs/buffer.c b/fs/buffer.c
index 5e4a90ee10..62cfd17dc5 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2867,22 +2867,22 @@ void ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
                else if (test_set_buffer_locked(bh))
                        continue;
-                get_bh(bh);
                if (rw == WRITE || rw == SWRITE) {
                        if (test_clear_buffer_dirty(bh)) {
                                bh->b_end_io = end_buffer_write_sync;
+                                get_bh(bh);
                                submit_bh(WRITE, bh);
                                continue;
                        }
                } else {
                        if (!buffer_uptodate(bh)) {
                                bh->b_end_io = end_buffer_read_sync;
+                                get_bh(bh);
                                submit_bh(rw, bh);
                                continue;
                        }
                }
                unlock_buffer(bh);
-                put_bh(bh);
        }
 }
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 88f60aa520..e488603fb1 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1785,7 +1785,16 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                } else if(volume_info.wsize)
                        cifs_sb->wsize = volume_info.wsize;
                else
-                        cifs_sb->wsize = CIFSMaxBufSize; /* default */
+                        cifs_sb->wsize = 
+                                min_t(const int, PAGEVEC_SIZE * PAGE_CACHE_SIZE,
+                                        127*1024);
+                        /* old default of CIFSMaxBufSize was too small now
+                           that SMB Write2 can send multiple pages in kvec.   
+                           RFC1001 does not describe what happens when frame
+                           bigger than 128K is sent so use that as max in
+                           conjunction with 52K kvec constraint on arch with 4K
+                           page size  */
                if(cifs_sb->rsize < PAGE_CACHE_SIZE) {
                        cifs_sb->rsize = PAGE_CACHE_SIZE; 
                        /* Windows ME does this */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 77c990f0cb..d17c97d07c 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1190,7 +1190,6 @@ retry:
                                        /* BB what if continued retry is
                                           requested via mount flags? */
                                        set_bit(AS_EIO, &mapping->flags);
-                                        SetPageError(page);
                                } else {
                                        cifs_stats_bytes_written(cifs_sb->tcon,
                                                                 bytes_written);
@@ -1198,6 +1197,13 @@ retry:
                        }
                        for (i = 0; i < n_iov; i++) {
                                page = pvec.pages[first + i];
+                                /* Should we also set page error on
+                                success rc but too little data written? */
+                                /* BB investigate retry logic on temporary
+                                server crash cases and how recovery works
+                                when page marked as error */ 
+                                if(rc)
+                                        SetPageError(page);
                                kunmap(page);
                                unlock_page(page);
                                page_cache_release(page);
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 7b98792150..b12cb8a7da 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -498,7 +498,6 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                        else
                                *pRespBufType = CIFS_SMALL_BUFFER;
                        iov[0].iov_len = receive_len + 4;
-                        iov[1].iov_len = 0;
                        dump_smb(midQ->resp_buf, 80);
                        /* convert the length into a more usable form */
diff --git a/fs/compat.c b/fs/compat.c
index cc58a20df5..a2ba78bdf7 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -73,17 +73,17 @@ asmlinkage long compat_sys_utime(char __user *filename, struct compat_utimbuf __
        return do_utimes(AT_FDCWD, filename, t ? tv : NULL);
 }
-asmlinkage long compat_sys_futimesat(int dfd, char __user *filename, struct compat_timeval __user *t)
+asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename, struct compat_timeval __user *t)
 {
        struct timeval tv[2];
-        if (t) { 
+        if (t) {
                if (get_user(tv[0].tv_sec, &t[0].tv_sec) ||
                    get_user(tv[0].tv_usec, &t[0].tv_usec) ||
                    get_user(tv[1].tv_sec, &t[1].tv_sec) ||
                    get_user(tv[1].tv_usec, &t[1].tv_usec))
-                        return -EFAULT; 
+                        return -EFAULT;
-        } 
+        }
        return do_utimes(dfd, filename, t ? tv : NULL);
 }
@@ -114,7 +114,7 @@ asmlinkage long compat_sys_newlstat(char __user * filename,
        return error;
 }
-asmlinkage long compat_sys_newfstatat(int dfd, char __user *filename,
+asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user *filename,
                struct compat_stat __user *statbuf, int flag)
 {
        struct kstat stat;
@@ -1326,7 +1326,7 @@ compat_sys_open(const char __user *filename, int flags, int mode)
 * O_LARGEFILE flag.
 */
 asmlinkage long
-compat_sys_openat(int dfd, const char __user *filename, int flags, int mode)
+compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode)
 {
        return do_sys_open(dfd, filename, flags, mode);
 }
@@ -1751,11 +1751,15 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
        ret = compat_core_sys_select(n, inp, outp, exp, &timeout);
        if (tvp) {
+                struct compat_timeval rtv;
                if (current->personality & STICKY_TIMEOUTS)
                        goto sticky;
-                tv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
+                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
-                tv.tv_sec = timeout;
+                rtv.tv_sec = timeout;
-                if (copy_to_user(tvp, &tv, sizeof(tv))) {
+                if (compat_timeval_compare(&rtv, &tv) < 0)
+                        rtv = tv;
+                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
                        /*
                         * If an application puts its timeval in read-only
@@ -1822,13 +1826,17 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
        } while (!ret && !timeout && tsp && (ts.tv_sec || ts.tv_nsec));
        if (tsp && !(current->personality & STICKY_TIMEOUTS)) {
-                ts.tv_sec += timeout / HZ;
+                struct compat_timespec rts;
-                ts.tv_nsec += (timeout % HZ) * (1000000000/HZ);
-                if (ts.tv_nsec >= 1000000000) {
+                rts.tv_sec = timeout / HZ;
-                        ts.tv_sec++;
+                rts.tv_nsec = (timeout % HZ) * (NSEC_PER_SEC/HZ);
-                        ts.tv_nsec -= 1000000000;
+                if (rts.tv_nsec >= NSEC_PER_SEC) {
+                        rts.tv_sec++;
+                        rts.tv_nsec -= NSEC_PER_SEC;
                }
-                (void)copy_to_user(tsp, &ts, sizeof(ts));
+                if (compat_timespec_compare(&rts, &ts) < 0)
+                        rts = ts;
+                copy_to_user(tsp, &rts, sizeof(rts));
        }
        if (ret == -ERESTARTNOHAND) {
@@ -1918,12 +1926,17 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
        if (tsp && timeout >= 0) {
+                struct compat_timespec rts;
                if (current->personality & STICKY_TIMEOUTS)
                        goto sticky;
                /* Yes, we know it's actually an s64, but it's also positive. */
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
-                ts.tv_sec = timeout;
+                                        1000;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_sec = timeout;
+                if (compat_timespec_compare(&rts, &ts) < 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
                        /*
                         * If an application puts its timeval in read-only
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 5dd0207ffd..057e60217f 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -931,8 +931,8 @@ struct compat_sg_req_info { /* used by SG_GET_REQUEST_TABLE ioctl() */
 static int sg_grt_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
        int err, i;
-        sg_req_info_t *r;
+        sg_req_info_t __user *r;
-        struct compat_sg_req_info *o = (struct compat_sg_req_info *)arg;
+        struct compat_sg_req_info __user *o = (void __user *)arg;
        r = compat_alloc_user_space(sizeof(sg_req_info_t)*SG_MAX_QUEUE);
        err = sys_ioctl(fd,cmd,(unsigned long)r);
        if (err < 0)
@@ -2739,8 +2739,8 @@ static int do_ncp_setprivatedata(unsigned int fd, unsigned int cmd, unsigned lon
 static int
 lp_timeout_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
-        struct compat_timeval *tc = (struct compat_timeval *)arg;
+        struct compat_timeval __user *tc = (struct compat_timeval __user *)arg;
-        struct timeval *tn = compat_alloc_user_space(sizeof(struct timeval));
+        struct timeval __user *tn = compat_alloc_user_space(sizeof(struct timeval));
        struct timeval ts;
        if (get_user(ts.tv_sec, &tc->tv_sec) ||
            get_user(ts.tv_usec, &tc->tv_usec) ||
diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index 8899d9c5f6..f70e46951b 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -36,6 +36,7 @@ struct configfs_dirent {
        int                     s_type;
        umode_t                 s_mode;
        struct dentry           * s_dentry;
+        struct iattr            * s_iattr;
 };
 #define CONFIGFS_ROOT           0x0001
@@ -48,10 +49,11 @@ struct configfs_dirent {
 #define CONFIGFS_NOT_PINNED     (CONFIGFS_ITEM_ATTR)
 extern struct vfsmount * configfs_mount;
+extern kmem_cache_t *configfs_dir_cachep;
 extern int configfs_is_root(struct config_item *item);
-extern struct inode * configfs_new_inode(mode_t mode);
+extern struct inode * configfs_new_inode(mode_t mode, struct configfs_dirent *);
 extern int configfs_create(struct dentry *, int mode, int (*init)(struct inode *));
 extern int configfs_create_file(struct config_item *, const struct configfs_attribute *);
@@ -63,6 +65,7 @@ extern void configfs_hash_and_remove(struct dentry * dir, const char * name);
 extern const unsigned char * configfs_get_name(struct configfs_dirent *sd);
 extern void configfs_drop_dentry(struct configfs_dirent *sd, struct dentry *parent);
+extern int configfs_setattr(struct dentry *dentry, struct iattr *iattr);
 extern int configfs_pin_fs(void);
 extern void configfs_release_fs(void);
@@ -120,8 +123,10 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
 static inline void release_configfs_dirent(struct configfs_dirent * sd)
 {
-        if (!(sd->s_type & CONFIGFS_ROOT))
+        if (!(sd->s_type & CONFIGFS_ROOT)) {
-                kfree(sd);
+                kfree(sd->s_iattr);
+                kmem_cache_free(configfs_dir_cachep, sd);
+        }
 }
 static inline struct configfs_dirent * configfs_get(struct configfs_dirent * sd)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index b668ec6152..ca60e3abef 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -72,7 +72,7 @@ static struct configfs_dirent *configfs_new_dirent(struct configfs_dirent * pare
 {
        struct configfs_dirent * sd;
-        sd = kmalloc(sizeof(*sd), GFP_KERNEL);
+        sd = kmem_cache_alloc(configfs_dir_cachep, GFP_KERNEL);
        if (!sd)
                return NULL;
@@ -136,13 +136,19 @@ static int create_dir(struct config_item * k, struct dentry * p,
        int error;
        umode_t mode = S_IFDIR| S_IRWXU | S_IRUGO | S_IXUGO;
-        error = configfs_create(d, mode, init_dir);
+        error = configfs_make_dirent(p->d_fsdata, d, k, mode,
+                                     CONFIGFS_DIR);
        if (!error) {
-                error = configfs_make_dirent(p->d_fsdata, d, k, mode,
+                error = configfs_create(d, mode, init_dir);
-                                           CONFIGFS_DIR);
                if (!error) {
                        p->d_inode->i_nlink++;
                        (d)->d_op = &configfs_dentry_ops;
+                } else {
+                        struct configfs_dirent *sd = d->d_fsdata;
+                        if (sd) {
+                                list_del_init(&sd->s_sibling);
+                                configfs_put(sd);
+                        }
                }
        }
        return error;
@@ -182,12 +188,19 @@ int configfs_create_link(struct configfs_symlink *sl,
        int err = 0;
        umode_t mode = S_IFLNK | S_IRWXUGO;
-        err = configfs_create(dentry, mode, init_symlink);
+        err = configfs_make_dirent(parent->d_fsdata, dentry, sl, mode,
+                                   CONFIGFS_ITEM_LINK);
        if (!err) {
-                err = configfs_make_dirent(parent->d_fsdata, dentry, sl,
+                err = configfs_create(dentry, mode, init_symlink);
-                                         mode, CONFIGFS_ITEM_LINK);
                if (!err)
                        dentry->d_op = &configfs_dentry_ops;
+                else {
+                        struct configfs_dirent *sd = dentry->d_fsdata;
+                        if (sd) {
+                                list_del_init(&sd->s_sibling);
+                                configfs_put(sd);
+                        }
+                }
        }
        return err;
 }
@@ -241,13 +254,15 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den
        struct configfs_attribute * attr = sd->s_element;
        int error;
+        dentry->d_fsdata = configfs_get(sd);
+        sd->s_dentry = dentry;
        error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG, init_file);
-        if (error)
+        if (error) {
+                configfs_put(sd);
                return error;
+        }
        dentry->d_op = &configfs_dentry_ops;
-        dentry->d_fsdata = configfs_get(sd);
-        sd->s_dentry = dentry;
        d_rehash(dentry);
        return 0;
@@ -839,6 +854,7 @@ struct inode_operations configfs_dir_inode_operations = {
        .symlink        = configfs_symlink,
        .unlink         = configfs_unlink,
        .lookup         = configfs_lookup,
+        .setattr        = configfs_setattr,
 };
 #if 0
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index c26cd61f13..3921920d87 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -26,7 +26,6 @@
 #include <linux/fs.h>
 #include <linux/module.h>
-#include <linux/dnotify.h>
 #include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
@@ -150,7 +149,7 @@ out:
 /**
 *      fill_write_buffer - copy buffer from userspace.
 *      @buffer:        data buffer for file.
- *      @userbuf:       data from user.
+ *      @buf:           data from user.
 *      @count:         number of bytes in @userbuf.
 *
 *      Allocate @buffer->page if it hasn't been already, then
@@ -177,8 +176,9 @@ fill_write_buffer(struct configfs_buffer * buffer, const char __user * buf, size
 /**
 *      flush_write_buffer - push buffer to config_item.
- *      @file:          file pointer.
+ *      @dentry:        dentry to the attribute
 *      @buffer:        data buffer for file.
+ *      @count:         number of bytes
 *
 *      Get the correct pointers for the config_item and the attribute we're
 *      dealing with, then call the store() method for the attribute,
@@ -217,15 +217,16 @@ static ssize_t
 configfs_write_file(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
        struct configfs_buffer * buffer = file->private_data;
+        ssize_t len;
        down(&buffer->sem);
-        count = fill_write_buffer(buffer,buf,count);
+        len = fill_write_buffer(buffer, buf, count);
-        if (count > 0)
+        if (len > 0)
-                count = flush_write_buffer(file->f_dentry,buffer,count);
+                len = flush_write_buffer(file->f_dentry, buffer, count);
-        if (count > 0)
+        if (len > 0)
-                *ppos += count;
+                *ppos += len;
        up(&buffer->sem);
-        return count;
+        return len;
 }
 static int check_perm(struct inode * inode, struct file * file)
diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c
index 6577c588de..c153bd9534 100644
--- a/fs/configfs/inode.c
+++ b/fs/configfs/inode.c
@@ -31,6 +31,7 @@
 #include <linux/pagemap.h>
 #include <linux/namei.h>
 #include <linux/backing-dev.h>
+#include <linux/capability.h>
 #include <linux/configfs.h>
 #include "configfs_internal.h"
@@ -48,18 +49,107 @@ static struct backing_dev_info configfs_backing_dev_info = {
        .capabilities   = BDI_CAP_NO_ACCT_DIRTY | BDI_CAP_NO_WRITEBACK,
 };
-struct inode * configfs_new_inode(mode_t mode)
+static struct inode_operations configfs_inode_operations ={
+        .setattr        = configfs_setattr,
+};
+int configfs_setattr(struct dentry * dentry, struct iattr * iattr)
+{
+        struct inode * inode = dentry->d_inode;
+        struct configfs_dirent * sd = dentry->d_fsdata;
+        struct iattr * sd_iattr;
+        unsigned int ia_valid = iattr->ia_valid;
+        int error;
+        if (!sd)
+                return -EINVAL;
+        sd_iattr = sd->s_iattr;
+        error = inode_change_ok(inode, iattr);
+        if (error)
+                return error;
+        error = inode_setattr(inode, iattr);
+        if (error)
+                return error;
+        if (!sd_iattr) {
+                /* setting attributes for the first time, allocate now */
+                sd_iattr = kmalloc(sizeof(struct iattr), GFP_KERNEL);
+                if (!sd_iattr)
+                        return -ENOMEM;
+                /* assign default attributes */
+                memset(sd_iattr, 0, sizeof(struct iattr));
+                sd_iattr->ia_mode = sd->s_mode;
+                sd_iattr->ia_uid = 0;
+                sd_iattr->ia_gid = 0;
+                sd_iattr->ia_atime = sd_iattr->ia_mtime = sd_iattr->ia_ctime = CURRENT_TIME;
+                sd->s_iattr = sd_iattr;
+        }
+        /* attributes were changed atleast once in past */
+        if (ia_valid & ATTR_UID)
+                sd_iattr->ia_uid = iattr->ia_uid;
+        if (ia_valid & ATTR_GID)
+                sd_iattr->ia_gid = iattr->ia_gid;
+        if (ia_valid & ATTR_ATIME)
+                sd_iattr->ia_atime = timespec_trunc(iattr->ia_atime,
+                                                inode->i_sb->s_time_gran);
+        if (ia_valid & ATTR_MTIME)
+                sd_iattr->ia_mtime = timespec_trunc(iattr->ia_mtime,
+                                                inode->i_sb->s_time_gran);
+        if (ia_valid & ATTR_CTIME)
+                sd_iattr->ia_ctime = timespec_trunc(iattr->ia_ctime,
+                                                inode->i_sb->s_time_gran);
+        if (ia_valid & ATTR_MODE) {
+                umode_t mode = iattr->ia_mode;
+                if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
+                        mode &= ~S_ISGID;
+                sd_iattr->ia_mode = sd->s_mode = mode;
+        }
+        return error;
+}
+static inline void set_default_inode_attr(struct inode * inode, mode_t mode)
+{
+        inode->i_mode = mode;
+        inode->i_uid = 0;
+        inode->i_gid = 0;
+        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+}
+static inline void set_inode_attr(struct inode * inode, struct iattr * iattr)
+{
+        inode->i_mode = iattr->ia_mode;
+        inode->i_uid = iattr->ia_uid;
+        inode->i_gid = iattr->ia_gid;
+        inode->i_atime = iattr->ia_atime;
+        inode->i_mtime = iattr->ia_mtime;
+        inode->i_ctime = iattr->ia_ctime;
+}
+struct inode * configfs_new_inode(mode_t mode, struct configfs_dirent * sd)
 {
        struct inode * inode = new_inode(configfs_sb);
        if (inode) {
-                inode->i_mode = mode;
-                inode->i_uid = 0;
-                inode->i_gid = 0;
                inode->i_blksize = PAGE_CACHE_SIZE;
                inode->i_blocks = 0;
-                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
                inode->i_mapping->a_ops = &configfs_aops;
                inode->i_mapping->backing_dev_info = &configfs_backing_dev_info;
+                inode->i_op = &configfs_inode_operations;
+                if (sd->s_iattr) {
+                        /* sysfs_dirent has non-default attributes
+                         * get them for the new inode from persistent copy
+                         * in sysfs_dirent
+                         */
+                        set_inode_attr(inode, sd->s_iattr);
+                } else
+                        set_default_inode_attr(inode, mode);
        }
        return inode;
 }
@@ -70,7 +160,8 @@ int configfs_create(struct dentry * dentry, int mode, int (*init)(struct inode *
        struct inode * inode = NULL;
        if (dentry) {
                if (!dentry->d_inode) {
-                        if ((inode = configfs_new_inode(mode))) {
+                        struct configfs_dirent *sd = dentry->d_fsdata;
+                        if ((inode = configfs_new_inode(mode, sd))) {
                                if (dentry->d_parent && dentry->d_parent->d_inode) {
                                        struct inode *p_inode = dentry->d_parent->d_inode;
                                        p_inode->i_mtime = p_inode->i_ctime = CURRENT_TIME;
@@ -103,10 +194,9 @@ int configfs_create(struct dentry * dentry, int mode, int (*init)(struct inode *
 */
 const unsigned char * configfs_get_name(struct configfs_dirent *sd)
 {
-        struct attribute * attr;
+        struct configfs_attribute *attr;
-        if (!sd || !sd->s_element)
+        BUG_ON(!sd || !sd->s_element);
-                BUG();
        /* These always have a dentry, so use that */
        if (sd->s_type & (CONFIGFS_DIR | CONFIGFS_ITEM_LINK))
@@ -114,7 +204,7 @@ const unsigned char * configfs_get_name(struct configfs_dirent *sd)
        if (sd->s_type & CONFIGFS_ITEM_ATTR) {
                attr = sd->s_element;
-                return attr->name;
+                return attr->ca_name;
        }
        return NULL;
 }
@@ -130,13 +220,17 @@ void configfs_drop_dentry(struct configfs_dirent * sd, struct dentry * parent)
        if (dentry) {
                spin_lock(&dcache_lock);
+                spin_lock(&dentry->d_lock);
                if (!(d_unhashed(dentry) && dentry->d_inode)) {
                        dget_locked(dentry);
                        __d_drop(dentry);
+                        spin_unlock(&dentry->d_lock);
                        spin_unlock(&dcache_lock);
                        simple_unlink(parent->d_inode, dentry);
-                } else
+                } else {
+                        spin_unlock(&dentry->d_lock);
                        spin_unlock(&dcache_lock);
+                }
        }
 }
@@ -145,6 +239,10 @@ void configfs_hash_and_remove(struct dentry * dir, const char * name)
        struct configfs_dirent * sd;
        struct configfs_dirent * parent_sd = dir->d_fsdata;
+        if (dir->d_inode == NULL)
+                /* no inode means this hasn't been made visible yet */
+                return;
        mutex_lock(&dir->d_inode->i_mutex);
        list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
                if (!sd->s_element)
diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index 1a2f6f6a4d..f920d30478 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -38,6 +38,7 @@
 struct vfsmount * configfs_mount = NULL;
 struct super_block * configfs_sb = NULL;
+kmem_cache_t *configfs_dir_cachep;
 static int configfs_mnt_count = 0;
 static struct super_operations configfs_ops = {
@@ -62,6 +63,7 @@ static struct configfs_dirent configfs_root = {
        .s_children     = LIST_HEAD_INIT(configfs_root.s_children),
        .s_element      = &configfs_root_group.cg_item,
        .s_type         = CONFIGFS_ROOT,
+        .s_iattr        = NULL,
 };
 static int configfs_fill_super(struct super_block *sb, void *data, int silent)
@@ -73,9 +75,11 @@ static int configfs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
        sb->s_magic = CONFIGFS_MAGIC;
        sb->s_op = &configfs_ops;
+        sb->s_time_gran = 1;
        configfs_sb = sb;
-        inode = configfs_new_inode(S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO);
+        inode = configfs_new_inode(S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
+                                   &configfs_root);
        if (inode) {
                inode->i_op = &configfs_dir_inode_operations;
                inode->i_fop = &configfs_dir_operations;
@@ -128,19 +132,31 @@ static decl_subsys(config, NULL, NULL);
 static int __init configfs_init(void)
 {
-        int err;
+        int err = -ENOMEM;
+        configfs_dir_cachep = kmem_cache_create("configfs_dir_cache",
+                                                sizeof(struct configfs_dirent),
+                                                0, 0, NULL, NULL);
+        if (!configfs_dir_cachep)
+                goto out;
        kset_set_kset_s(&config_subsys, kernel_subsys);
        err = subsystem_register(&config_subsys);
-        if (err)
+        if (err) {
-                return err;
+                kmem_cache_destroy(configfs_dir_cachep);
+                configfs_dir_cachep = NULL;
+                goto out;
+        }
        err = register_filesystem(&configfs_fs_type);
        if (err) {
                printk(KERN_ERR "configfs: Unable to register filesystem!\n");
                subsystem_unregister(&config_subsys);
+                kmem_cache_destroy(configfs_dir_cachep);
+                configfs_dir_cachep = NULL;
        }
+out:
        return err;
 }
@@ -148,11 +164,13 @@ static void __exit configfs_exit(void)
 {
        unregister_filesystem(&configfs_fs_type);
        subsystem_unregister(&config_subsys);
+        kmem_cache_destroy(configfs_dir_cachep);
+        configfs_dir_cachep = NULL;
 }
 MODULE_AUTHOR("Oracle");
 MODULE_LICENSE("GPL");
-MODULE_VERSION("0.0.1");
+MODULE_VERSION("0.0.2");
 MODULE_DESCRIPTION("Simple RAM filesystem for user driven kernel subsystem configuration.");
 module_init(configfs_init);
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index 50f5840521..e5512e295c 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -162,8 +162,7 @@ int configfs_unlink(struct inode *dir, struct dentry *dentry)
        if (!(sd->s_type & CONFIGFS_ITEM_LINK))
                goto out;
-        if (dentry->d_parent == configfs_sb->s_root)
+        BUG_ON(dentry->d_parent == configfs_sb->s_root);
-                BUG();
        sl = sd->s_element;
@@ -277,5 +276,6 @@ struct inode_operations configfs_symlink_inode_operations = {
        .follow_link = configfs_follow_link,
        .readlink = generic_readlink,
        .put_link = configfs_put_link,
+        .setattr = configfs_setattr,
 };
diff --git a/fs/dcache.c b/fs/dcache.c
index 86bdb93789..a173bba326 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -743,7 +743,9 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
        dentry->d_op = NULL;
        dentry->d_fsdata = NULL;
        dentry->d_mounted = 0;
+#ifdef CONFIG_PROFILING
        dentry->d_cookie = NULL;
+#endif
        INIT_HLIST_NODE(&dentry->d_hash);
        INIT_LIST_HEAD(&dentry->d_lru);
        INIT_LIST_HEAD(&dentry->d_subdirs);
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index efc97d9b78..d575452cd9 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -56,7 +56,7 @@ static u64 debugfs_u8_get(void *data)
 DEFINE_SIMPLE_ATTRIBUTE(fops_u8, debugfs_u8_get, debugfs_u8_set, "%llu\n");
 /**
- * debugfs_create_u8 - create a file in the debugfs filesystem that is used to read and write a unsigned 8 bit value.
+ * debugfs_create_u8 - create a file in the debugfs filesystem that is used to read and write an unsigned 8 bit value.
 *
 * @name: a pointer to a string containing the name of the file to create.
 * @mode: the permission that the file should have
@@ -98,7 +98,7 @@ static u64 debugfs_u16_get(void *data)
 DEFINE_SIMPLE_ATTRIBUTE(fops_u16, debugfs_u16_get, debugfs_u16_set, "%llu\n");
 /**
- * debugfs_create_u16 - create a file in the debugfs filesystem that is used to read and write a unsigned 8 bit value.
+ * debugfs_create_u16 - create a file in the debugfs filesystem that is used to read and write an unsigned 16 bit value.
 *
 * @name: a pointer to a string containing the name of the file to create.
 * @mode: the permission that the file should have
@@ -140,7 +140,7 @@ static u64 debugfs_u32_get(void *data)
 DEFINE_SIMPLE_ATTRIBUTE(fops_u32, debugfs_u32_get, debugfs_u32_set, "%llu\n");
 /**
- * debugfs_create_u32 - create a file in the debugfs filesystem that is used to read and write a unsigned 8 bit value.
+ * debugfs_create_u32 - create a file in the debugfs filesystem that is used to read and write an unsigned 32 bit value.
 *
 * @name: a pointer to a string containing the name of the file to create.
 * @mode: the permission that the file should have
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 30dbbd1df5..848044af7e 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -857,6 +857,7 @@ do_holes:
                        /* Handle holes */
                        if (!buffer_mapped(map_bh)) {
                                char *kaddr;
+                                loff_t i_size_aligned;
                                /* AKPM: eargh, -ENOTBLK is a hack */
                                if (dio->rw == WRITE) {
@@ -864,8 +865,14 @@ do_holes:
                                        return -ENOTBLK;
                                }
+                                /*
+                                 * Be sure to account for a partial block as the
+                                 * last block in the file
+                                 */
+                                i_size_aligned = ALIGN(i_size_read(dio->inode),
+                                                        1 << blkbits);
                                if (dio->block_in_file >=
-                                        i_size_read(dio->inode)>>blkbits) {
+                                                i_size_aligned >> blkbits) {
                                        /* We hit eof */
                                        page_cache_release(page);
                                        goto out;
diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c
index 35acc43b89..da52b4a5db 100644
--- a/fs/ext2/acl.c
+++ b/fs/ext2/acl.c
@@ -220,7 +220,7 @@ ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
        struct ext2_inode_info *ei = EXT2_I(inode);
        int name_index;
        void *value = NULL;
-        size_t size;
+        size_t size = 0;
        int error;
        if (S_ISLNK(inode->i_mode))
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index 74714af4ae..e52765219e 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -605,7 +605,7 @@ got:
        insert_inode_hash(inode);
        if (DQUOT_ALLOC_INODE(inode)) {
-                err = -ENOSPC;
+                err = -EDQUOT;
                goto fail_drop;
        }
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 8d6819846f..cb6f9bd658 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -221,6 +221,11 @@ static int ext2_show_options(struct seq_file *seq, struct vfsmount *vfs)
                seq_puts(seq, ",grpquota");
 #endif
+#if defined(CONFIG_EXT2_FS_XIP)
+        if (sbi->s_mount_opt & EXT2_MOUNT_XIP)
+                seq_puts(seq, ",xip");
+#endif
        return 0;
 }
diff --git a/fs/ext3/acl.c b/fs/ext3/acl.c
index 47a9da2dfb..0d21d558b8 100644
--- a/fs/ext3/acl.c
+++ b/fs/ext3/acl.c
@@ -226,7 +226,7 @@ ext3_set_acl(handle_t *handle, struct inode *inode, int type,
        struct ext3_inode_info *ei = EXT3_I(inode);
        int name_index;
        void *value = NULL;
-        size_t size;
+        size_t size = 0;
        int error;
        if (S_ISLNK(inode->i_mode))
diff --git a/fs/fat/file.c b/fs/fat/file.c
index e99c5a73b3..88aa1ae13f 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -210,10 +210,30 @@ static int fat_free(struct inode *inode, int skip)
        if (MSDOS_I(inode)->i_start == 0)
                return 0;
-        /*
+        fat_cache_inval_inode(inode);
-         * Write a new EOF, and get the remaining cluster chain for freeing.
-         */
        wait = IS_DIRSYNC(inode);
+        i_start = free_start = MSDOS_I(inode)->i_start;
+        i_logstart = MSDOS_I(inode)->i_logstart;
+        /* First, we write the new file size. */
+        if (!skip) {
+                MSDOS_I(inode)->i_start = 0;
+                MSDOS_I(inode)->i_logstart = 0;
+        }
+        MSDOS_I(inode)->i_attrs |= ATTR_ARCH;
+        inode->i_ctime = inode->i_mtime = CURRENT_TIME_SEC;
+        if (wait) {
+                err = fat_sync_inode(inode);
+                if (err) {
+                        MSDOS_I(inode)->i_start = i_start;
+                        MSDOS_I(inode)->i_logstart = i_logstart;
+                        return err;
+                }
+        } else
+                mark_inode_dirty(inode);
+        /* Write a new EOF, and get the remaining cluster chain for freeing. */
        if (skip) {
                struct fat_entry fatent;
                int ret, fclus, dclus;
@@ -244,35 +264,11 @@ static int fat_free(struct inode *inode, int skip)
                        return ret;
                free_start = ret;
-                i_start = i_logstart = 0;
-                fat_cache_inval_inode(inode);
-        } else {
-                fat_cache_inval_inode(inode);
-                i_start = free_start = MSDOS_I(inode)->i_start;
-                i_logstart = MSDOS_I(inode)->i_logstart;
-                MSDOS_I(inode)->i_start = 0;
-                MSDOS_I(inode)->i_logstart = 0;
        }
-        MSDOS_I(inode)->i_attrs |= ATTR_ARCH;
-        inode->i_ctime = inode->i_mtime = CURRENT_TIME_SEC;
-        if (wait) {
-                err = fat_sync_inode(inode);
-                if (err)
-                        goto error;
-        } else
-                mark_inode_dirty(inode);
        inode->i_blocks = skip << (MSDOS_SB(sb)->cluster_bits - 9);
        /* Freeing the remained cluster chain */
        return fat_free_clusters(inode, free_start);
-error:
-        if (i_start) {
-                MSDOS_I(inode)->i_start = i_start;
-                MSDOS_I(inode)->i_logstart = i_logstart;
-        }
-        return err;
 }
 void fat_truncate(struct inode *inode)
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index 32fb0a3f1d..944652e9dd 100644
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -196,19 +196,9 @@ EXPORT_SYMBOL_GPL(fat_date_unix2dos);
 int fat_sync_bhs(struct buffer_head **bhs, int nr_bhs)
 {
-        int i, e, err = 0;
+        int i, err = 0;
-        for (i = 0; i < nr_bhs; i++) {
+        ll_rw_block(SWRITE, nr_bhs, bhs);
-                lock_buffer(bhs[i]);
-                if (test_clear_buffer_dirty(bhs[i])) {
-                        get_bh(bhs[i]);
-                        bhs[i]->b_end_io = end_buffer_write_sync;
-                        e = submit_bh(WRITE, bhs[i]);
-                        if (!err && e)
-                                err = e;
-                } else
-                        unlock_buffer(bhs[i]);
-        }
        for (i = 0; i < nr_bhs; i++) {
                wait_on_buffer(bhs[i]);
                if (buffer_eopnotsupp(bhs[i])) {
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 5f96786d1c..dc4a7007f4 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -208,8 +208,11 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
        struct inode * inode = filp->f_dentry->d_inode;
        int error = 0;
-        /* O_APPEND cannot be cleared if the file is marked as append-only */
+        /*
-        if (!(arg & O_APPEND) && IS_APPEND(inode))
+         * O_APPEND cannot be cleared if the file is marked as append-only
+         * and the file is open for write.
+         */
+        if (((arg ^ filp->f_flags) & O_APPEND) && IS_APPEND(inode))
                return -EPERM;
        /* O_NOATIME can only be set by the owner or superuser */
diff --git a/fs/file.c b/fs/file.c
index fd066b261c..cea7cbea11 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -379,7 +379,6 @@ static void __devinit fdtable_defer_list_init(int cpu)
 void __init files_defer_init(void)
 {
        int i;
-        /* Really early - can't use for_each_cpu */
+        for_each_cpu(i)
-        for (i = 0; i < NR_CPUS; i++)
                fdtable_defer_list_init(i);
 }
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 4526da8907..f556a0d5c0 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -120,9 +120,9 @@ struct fuse_req *fuse_get_request(struct fuse_conn *fc)
        return do_get_request(fc);
 }
+/* Must be called with fuse_lock held */
 static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
 {
-        spin_lock(&fuse_lock);
        if (req->preallocated) {
                atomic_dec(&fc->num_waiting);
                list_add(&req->list, &fc->unused_list);
@@ -134,11 +134,19 @@ static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
                fc->outstanding_debt--;
        else
                up(&fc->outstanding_sem);
-        spin_unlock(&fuse_lock);
 }
 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 {
+        if (atomic_dec_and_test(&req->count)) {
+                spin_lock(&fuse_lock);
+                fuse_putback_request(fc, req);
+                spin_unlock(&fuse_lock);
+        }
+}
+static void fuse_put_request_locked(struct fuse_conn *fc, struct fuse_req *req)
+{
        if (atomic_dec_and_test(&req->count))
                fuse_putback_request(fc, req);
 }
@@ -163,26 +171,36 @@ void fuse_release_background(struct fuse_req *req)
 * still waiting), the 'end' callback is called if given, else the
 * reference to the request is released
 *
+ * Releasing extra reference for foreground requests must be done
+ * within the same locked region as setting state to finished.  This
+ * is because fuse_reset_request() may be called after request is
+ * finished and it must be the sole possessor.  If request is
+ * interrupted and put in the background, it will return with an error
+ * and hence never be reset and reused.
+ *
 * Called with fuse_lock, unlocks it
 */
 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
-        req->end = NULL;
        list_del(&req->list);
        req->state = FUSE_REQ_FINISHED;
-        spin_unlock(&fuse_lock);
+        if (!req->background) {
-        if (req->background) {
+                wake_up(&req->waitq);
+                fuse_put_request_locked(fc, req);
+                spin_unlock(&fuse_lock);
+        } else {
+                void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
+                req->end = NULL;
+                spin_unlock(&fuse_lock);
                down_read(&fc->sbput_sem);
                if (fc->mounted)
                        fuse_release_background(req);
                up_read(&fc->sbput_sem);
+                if (end)
+                        end(fc, req);
+                else
+                        fuse_put_request(fc, req);
        }
-        wake_up(&req->waitq);
-        if (end)
-                end(fc, req);
-        else
-                fuse_put_request(fc, req);
 }
 /*
diff --git a/fs/inotify.c b/fs/inotify.c
index 878ccca612..3041503bde 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -967,7 +967,7 @@ asmlinkage long sys_inotify_add_watch(int fd, const char __user *path, u32 mask)
                mask_add = 1;
        /* don't let user-space set invalid bits: we don't want flags set */
-        mask &= IN_ALL_EVENTS;
+        mask &= IN_ALL_EVENTS | IN_ONESHOT;
        if (unlikely(!mask)) {
                ret = -EINVAL;
                goto out;
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 429f4b263c..ca917973c2 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1308,6 +1308,7 @@ int journal_stop(handle_t *handle)
        transaction_t *transaction = handle->h_transaction;
        journal_t *journal = transaction->t_journal;
        int old_handle_count, err;
+        pid_t pid;
        J_ASSERT(transaction->t_updates > 0);
        J_ASSERT(journal_current_handle() == handle);
@@ -1333,8 +1334,15 @@ int journal_stop(handle_t *handle)
         * It doesn't cost much - we're about to run a commit and sleep
         * on IO anyway.  Speeds up many-threaded, many-dir operations
         * by 30x or more...
+         *
+         * But don't do this if this process was the most recent one to
+         * perform a synchronous write.  We do this to detect the case where a
+         * single process is doing a stream of sync writes.  No point in waiting
+         * for joiners in that case.
         */
-        if (handle->h_sync) {
+        pid = current->pid;
+        if (handle->h_sync && journal->j_last_sync_writer != pid) {
+                journal->j_last_sync_writer = pid;
                do {
                        old_handle_count = transaction->t_handle_count;
                        schedule_timeout_uninterruptible(1);
diff --git a/fs/jffs/intrep.c b/fs/jffs/intrep.c
index b2e95421d9..ce7b54b0b2 100644
--- a/fs/jffs/intrep.c
+++ b/fs/jffs/intrep.c
@@ -1965,7 +1965,7 @@ retry:
                iovec_cnt++;
                if (JFFS_GET_PAD_BYTES(raw_inode->nsize)) {
-                        static char allff[3]={255,255,255};
+                        static unsigned char allff[3]={255,255,255};
                        /* Add some extra padding if necessary */
                        node_iovec[iovec_cnt].iov_base = allff;
                        node_iovec[iovec_cnt].iov_len =
diff --git a/fs/libfs.c b/fs/libfs.c
index 63c020e658..71fd08fa41 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -388,6 +388,7 @@ int simple_fill_super(struct super_block *s, int magic, struct tree_descr *files
        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
        inode->i_op = &simple_dir_inode_operations;
        inode->i_fop = &simple_dir_operations;
+        inode->i_nlink = 2;
        root = d_alloc_root(inode);
        if (!root) {
                iput(inode);
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index 1455240395..220058d861 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -22,12 +22,14 @@
 #define NLMDBG_FACILITY         NLMDBG_CLIENT
 #define NLMCLNT_GRACE_WAIT      (5*HZ)
 #define NLMCLNT_POLL_TIMEOUT    (30*HZ)
+#define NLMCLNT_MAX_RETRIES     3
 static int      nlmclnt_test(struct nlm_rqst *, struct file_lock *);
 static int      nlmclnt_lock(struct nlm_rqst *, struct file_lock *);
 static int      nlmclnt_unlock(struct nlm_rqst *, struct file_lock *);
 static int      nlm_stat_to_errno(u32 stat);
 static void     nlmclnt_locks_init_private(struct file_lock *fl, struct nlm_host *host);
+static int      nlmclnt_cancel(struct nlm_host *, int , struct file_lock *);
 static const struct rpc_call_ops nlmclnt_unlock_ops;
 static const struct rpc_call_ops nlmclnt_cancel_ops;
@@ -598,7 +600,7 @@ out_unblock:
        nlmclnt_finish_block(req);
        /* Cancel the blocked request if it is still pending */
        if (resp->status == NLM_LCK_BLOCKED)
-                nlmclnt_cancel(host, fl);
+                nlmclnt_cancel(host, req->a_args.block, fl);
 out:
        nlmclnt_release_lockargs(req);
        return status;
@@ -728,8 +730,7 @@ static const struct rpc_call_ops nlmclnt_unlock_ops = {
 * We always use an async RPC call for this in order not to hang a
 * process that has been Ctrl-C'ed.
 */
-int
+static int nlmclnt_cancel(struct nlm_host *host, int block, struct file_lock *fl)
-nlmclnt_cancel(struct nlm_host *host, struct file_lock *fl)
 {
        struct nlm_rqst *req;
        unsigned long   flags;
@@ -750,6 +751,7 @@ nlmclnt_cancel(struct nlm_host *host, struct file_lock *fl)
        req->a_flags = RPC_TASK_ASYNC;
        nlmclnt_setlockargs(req, fl);
+        req->a_args.block = block;
        status = nlmclnt_async_call(req, NLMPROC_CANCEL, &nlmclnt_cancel_ops);
        if (status < 0) {
@@ -801,6 +803,9 @@ die:
        return;
 retry_cancel:
+        /* Don't ever retry more than 3 times */
+        if (req->a_retries++ >= NLMCLNT_MAX_RETRIES)
+                goto die;
        nlm_rebind_host(req->a_host);
        rpc_restart_call(task);
        rpc_delay(task, 30 * HZ);
diff --git a/fs/namei.c b/fs/namei.c
index 7ac9fb4acb..e28de846c5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -790,7 +790,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
        inode = nd->dentry->d_inode;
        if (nd->depth)
-                lookup_flags = LOOKUP_FOLLOW;
+                lookup_flags = LOOKUP_FOLLOW | (nd->flags & LOOKUP_CONTINUE);
        /* At this point we know we have a real path component. */
        for(;;) {
@@ -885,7 +885,8 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
 last_with_slashes:
                lookup_flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
 last_component:
-                nd->flags &= ~LOOKUP_CONTINUE;
+                /* Clear LOOKUP_CONTINUE iff it was previously unset */
+                nd->flags &= lookup_flags | ~LOOKUP_CONTINUE;
                if (lookup_flags & LOOKUP_PARENT)
                        goto lookup_parent;
                if (this.name[0] == '.') switch (this.len) {
@@ -1069,6 +1070,8 @@ static int fastcall do_path_lookup(int dfd, const char *name,
                                unsigned int flags, struct nameidata *nd)
 {
        int retval = 0;
+        int fput_needed;
+        struct file *file;
        nd->last_type = LAST_ROOT; /* if there are only slashes... */
        nd->flags = flags;
@@ -1090,29 +1093,22 @@ static int fastcall do_path_lookup(int dfd, const char *name,
                nd->mnt = mntget(current->fs->pwdmnt);
                nd->dentry = dget(current->fs->pwd);
        } else {
-                struct file *file;
-                int fput_needed;
                struct dentry *dentry;
                file = fget_light(dfd, &fput_needed);
-                if (!file) {
+                retval = -EBADF;
-                        retval = -EBADF;
+                if (!file)
-                        goto out_fail;
+                        goto unlock_fail;
-                }
                dentry = file->f_dentry;
-                if (!S_ISDIR(dentry->d_inode->i_mode)) {
+                retval = -ENOTDIR;
-                        retval = -ENOTDIR;
+                if (!S_ISDIR(dentry->d_inode->i_mode))
-                        fput_light(file, fput_needed);
+                        goto fput_unlock_fail;
-                        goto out_fail;
-                }
                retval = file_permission(file, MAY_EXEC);
-                if (retval) {
+                if (retval)
-                        fput_light(file, fput_needed);
+                        goto fput_unlock_fail;
-                        goto out_fail;
-                }
                nd->mnt = mntget(file->f_vfsmnt);
                nd->dentry = dget(dentry);
@@ -1123,10 +1119,17 @@ static int fastcall do_path_lookup(int dfd, const char *name,
        current->total_link_count = 0;
        retval = link_path_walk(name, nd);
 out:
-        if (unlikely(current->audit_context
+        if (likely(retval == 0)) {
-                     && nd && nd->dentry && nd->dentry->d_inode))
+                if (unlikely(current->audit_context && nd && nd->dentry &&
+                                nd->dentry->d_inode))
                audit_inode(name, nd->dentry->d_inode, flags);
-out_fail:
+        }
+        return retval;
+fput_unlock_fail:
+        fput_light(file, fput_needed);
+unlock_fail:
+        read_unlock(&current->fs->lock);
        return retval;
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index ce97becff4..058a44865b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -494,7 +494,7 @@ void umount_tree(struct vfsmount *mnt, int propagate, struct list_head *kill)
                p->mnt_namespace = NULL;
                list_del_init(&p->mnt_child);
                if (p->mnt_parent != p)
-                        mnt->mnt_mountpoint->d_mounted--;
+                        p->mnt_mountpoint->d_mounted--;
                change_mnt_propagation(p, MS_PRIVATE);
        }
 }
@@ -1325,27 +1325,17 @@ dput_out:
        return retval;
 }
-int copy_namespace(int flags, struct task_struct *tsk)
+/*
+ * Allocate a new namespace structure and populate it with contents
+ * copied from the namespace of the passed in task structure.
+ */
+struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
 {
        struct namespace *namespace = tsk->namespace;
        struct namespace *new_ns;
        struct vfsmount *rootmnt = NULL, *pwdmnt = NULL, *altrootmnt = NULL;
-        struct fs_struct *fs = tsk->fs;
        struct vfsmount *p, *q;
-        if (!namespace)
-                return 0;
-        get_namespace(namespace);
-        if (!(flags & CLONE_NEWNS))
-                return 0;
-        if (!capable(CAP_SYS_ADMIN)) {
-                put_namespace(namespace);
-                return -EPERM;
-        }
        new_ns = kmalloc(sizeof(struct namespace), GFP_KERNEL);
        if (!new_ns)
                goto out;
@@ -1396,8 +1386,6 @@ int copy_namespace(int flags, struct task_struct *tsk)
        }
        up_write(&namespace_sem);
-        tsk->namespace = new_ns;
        if (rootmnt)
                mntput(rootmnt);
        if (pwdmnt)
@@ -1405,12 +1393,40 @@ int copy_namespace(int flags, struct task_struct *tsk)
        if (altrootmnt)
                mntput(altrootmnt);
-        put_namespace(namespace);
+out:
-        return 0;
+        return new_ns;
+}
+int copy_namespace(int flags, struct task_struct *tsk)
+{
+        struct namespace *namespace = tsk->namespace;
+        struct namespace *new_ns;
+        int err = 0;
+        if (!namespace)
+                return 0;
+        get_namespace(namespace);
+        if (!(flags & CLONE_NEWNS))
+                return 0;
+        if (!capable(CAP_SYS_ADMIN)) {
+                err = -EPERM;
+                goto out;
+        }
+        new_ns = dup_namespace(tsk, tsk->fs);
+        if (!new_ns) {
+                err = -ENOMEM;
+                goto out;
+        }
+        tsk->namespace = new_ns;
 out:
        put_namespace(namespace);
-        return -ENOMEM;
+        return err;
 }
 asmlinkage long sys_mount(char __user * dev_name, char __user * dir_name,
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 10ae377e68..04ab2fc360 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -481,7 +481,7 @@ retry:
                if (wdata->verf.committed != NFS_FILE_SYNC) {
                        need_commit = 1;
                        if (memcmp(&first_verf.verifier, &wdata->verf.verifier,
-                                        sizeof(first_verf.verifier)));
+                                        sizeof(first_verf.verifier)))
                                goto sync_retry;
                }
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index e897e00c2c..c0a754ecde 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -465,10 +465,11 @@ static int __init root_nfs_ports(void)
                                        "number from server, using default\n");
                        port = nfsd_port;
                }
-                nfs_port = htons(port);
+                nfs_port = port;
                dprintk("Root-NFS: Portmapper on server returned %d "
                        "as nfsd port\n", port);
        }
+        nfs_port = htons(nfs_port);
        if ((port = root_nfs_getport(NFS_MNT_PROGRAM, mountd_ver, proto)) < 0) {
                printk(KERN_ERR "Root-NFS: Unable to get mountd port "
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index a00fe86862..6d63f1d9e5 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -195,10 +195,12 @@ nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open
        /* Openowner is now set, so sequence id will get bumped.  Now we need
         * these checks before we do any creates: */
+        status = nfserr_grace;
        if (nfs4_in_grace() && open->op_claim_type != NFS4_OPEN_CLAIM_PREVIOUS)
-                return nfserr_grace;
+                goto out;
+        status = nfserr_no_grace;
        if (!nfs4_in_grace() && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
-                return nfserr_no_grace;
+                goto out;
        switch (open->op_claim_type) {
                case NFS4_OPEN_CLAIM_DELEGATE_CUR:
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index d424041b38..bae3d7548b 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -58,7 +58,7 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh,
                goto out;
        }
-        down(&OCFS2_I(inode)->ip_io_sem);
+        mutex_lock(&OCFS2_I(inode)->ip_io_mutex);
        lock_buffer(bh);
        set_buffer_uptodate(bh);
@@ -82,7 +82,7 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh,
                brelse(bh);
        }
-        up(&OCFS2_I(inode)->ip_io_sem);
+        mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
 out:
        mlog_exit(ret);
        return ret;
@@ -125,13 +125,13 @@ int ocfs2_read_blocks(struct ocfs2_super *osb, u64 block, int nr,
                flags &= ~OCFS2_BH_CACHED;
        if (inode)
-                down(&OCFS2_I(inode)->ip_io_sem);
+                mutex_lock(&OCFS2_I(inode)->ip_io_mutex);
        for (i = 0 ; i < nr ; i++) {
                if (bhs[i] == NULL) {
                        bhs[i] = sb_getblk(sb, block++);
                        if (bhs[i] == NULL) {
                                if (inode)
-                                        up(&OCFS2_I(inode)->ip_io_sem);
+                                        mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
                                status = -EIO;
                                mlog_errno(status);
                                goto bail;
@@ -220,7 +220,7 @@ int ocfs2_read_blocks(struct ocfs2_super *osb, u64 block, int nr,
                        ocfs2_set_buffer_uptodate(inode, bh);
        }
        if (inode)
-                up(&OCFS2_I(inode)->ip_io_sem);
+                mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
        mlog(ML_BH_IO, "block=(%"MLFu64"), nr=(%d), cached=%s\n", block, nr,
             (!(flags & OCFS2_BH_CACHED) || ignore_cache) ? "no" : "yes");
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 7307ba5289..d08971d29b 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -917,8 +917,9 @@ static int o2hb_thread(void *data)
                elapsed_msec = o2hb_elapsed_msecs(&before_hb, &after_hb);
                mlog(0, "start = %lu.%lu, end = %lu.%lu, msec = %u\n",
-                     before_hb.tv_sec, before_hb.tv_usec,
+                     before_hb.tv_sec, (unsigned long) before_hb.tv_usec,
-                     after_hb.tv_sec, after_hb.tv_usec, elapsed_msec);
+                     after_hb.tv_sec, (unsigned long) after_hb.tv_usec,
+                     elapsed_msec);
                if (elapsed_msec < reg->hr_timeout_ms) {
                        /* the kthread api has blocked signals for us so no
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 35d92c01a9..d22d4cf08d 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1285,14 +1285,16 @@ static void o2net_idle_timer(unsigned long data)
        mlog(ML_NOTICE, "here are some times that might help debug the "
             "situation: (tmr %ld.%ld now %ld.%ld dr %ld.%ld adv "
             "%ld.%ld:%ld.%ld func (%08x:%u) %ld.%ld:%ld.%ld)\n",
-             sc->sc_tv_timer.tv_sec, sc->sc_tv_timer.tv_usec, 
+             sc->sc_tv_timer.tv_sec, (long) sc->sc_tv_timer.tv_usec, 
-             now.tv_sec, now.tv_usec,
+             now.tv_sec, (long) now.tv_usec,
-             sc->sc_tv_data_ready.tv_sec, sc->sc_tv_data_ready.tv_usec, 
+             sc->sc_tv_data_ready.tv_sec, (long) sc->sc_tv_data_ready.tv_usec,
-             sc->sc_tv_advance_start.tv_sec, sc->sc_tv_advance_start.tv_usec, 
+             sc->sc_tv_advance_start.tv_sec,
-             sc->sc_tv_advance_stop.tv_sec, sc->sc_tv_advance_stop.tv_usec, 
+             (long) sc->sc_tv_advance_start.tv_usec,
+             sc->sc_tv_advance_stop.tv_sec,
+             (long) sc->sc_tv_advance_stop.tv_usec,
             sc->sc_msg_key, sc->sc_msg_type,
-             sc->sc_tv_func_start.tv_sec, sc->sc_tv_func_start.tv_usec,
+             sc->sc_tv_func_start.tv_sec, (long) sc->sc_tv_func_start.tv_usec,
-             sc->sc_tv_func_stop.tv_sec, sc->sc_tv_func_stop.tv_usec);
+             sc->sc_tv_func_stop.tv_sec, (long) sc->sc_tv_func_stop.tv_usec);
        o2net_sc_queue_work(sc, &sc->sc_shutdown_work);
 }
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index 3fecba0a60..42eb53b529 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -657,6 +657,7 @@ void dlm_complete_thread(struct dlm_ctxt *dlm);
 int dlm_launch_recovery_thread(struct dlm_ctxt *dlm);
 void dlm_complete_recovery_thread(struct dlm_ctxt *dlm);
 void dlm_wait_for_recovery(struct dlm_ctxt *dlm);
+int dlm_is_node_dead(struct dlm_ctxt *dlm, u8 node);
 void dlm_put(struct dlm_ctxt *dlm);
 struct dlm_ctxt *dlm_grab(struct dlm_ctxt *dlm);
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index da3c22045f..6ee3083738 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -573,8 +573,11 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data)
        spin_lock(&dlm_domain_lock);
        dlm = __dlm_lookup_domain_full(query->domain, query->name_len);
        /* Once the dlm ctxt is marked as leaving then we don't want
-         * to be put in someone's domain map. */
+         * to be put in someone's domain map. 
+         * Also, explicitly disallow joining at certain troublesome
+         * times (ie. during recovery). */
        if (dlm && dlm->dlm_state != DLM_CTXT_LEAVING) {
+                int bit = query->node_idx;
                spin_lock(&dlm->spinlock);
                if (dlm->dlm_state == DLM_CTXT_NEW &&
@@ -586,6 +589,19 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data)
                } else if (dlm->joining_node != DLM_LOCK_RES_OWNER_UNKNOWN) {
                        /* Disallow parallel joins. */
                        response = JOIN_DISALLOW;
+                } else if (dlm->reco.state & DLM_RECO_STATE_ACTIVE) {
+                        mlog(ML_NOTICE, "node %u trying to join, but recovery "
+                             "is ongoing.\n", bit);
+                        response = JOIN_DISALLOW;
+                } else if (test_bit(bit, dlm->recovery_map)) {
+                        mlog(ML_NOTICE, "node %u trying to join, but it "
+                             "still needs recovery.\n", bit);
+                        response = JOIN_DISALLOW;
+                } else if (test_bit(bit, dlm->domain_map)) {
+                        mlog(ML_NOTICE, "node %u trying to join, but it "
+                             "is still in the domain! needs recovery?\n",
+                             bit);
+                        response = JOIN_DISALLOW;
                } else {
                        /* Alright we're fully a part of this domain
                         * so we keep some state as to who's joining
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 27e984f7e4..a3194fe173 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1050,17 +1050,10 @@ static int dlm_restart_lock_mastery(struct dlm_ctxt *dlm,
        node = dlm_bitmap_diff_iter_next(&bdi, &sc);
        while (node >= 0) {
                if (sc == NODE_UP) {
-                        /* a node came up.  easy.  might not even need
+                        /* a node came up.  clear any old vote from
-                         * to talk to it if its node number is higher
+                         * the response map and set it in the vote map
-                         * or if we are already blocked. */
+                         * then restart the mastery. */
-                        mlog(0, "node up! %d\n", node);
+                        mlog(ML_NOTICE, "node %d up while restarting\n", node);
-                        if (blocked)
-                                goto next;
-                        if (node > dlm->node_num) {
-                                mlog(0, "node > this node. skipping.\n");
-                                goto next;
-                        }
                        /* redo the master request, but only for the new node */
                        mlog(0, "sending request to new node\n");
@@ -2005,6 +1998,15 @@ fail:
                                break;
                        mlog(0, "timed out during migration\n");
+                        /* avoid hang during shutdown when migrating lockres 
+                         * to a node which also goes down */
+                        if (dlm_is_node_dead(dlm, target)) {
+                                mlog(0, "%s:%.*s: expected migration target %u "
+                                     "is no longer up.  restarting.\n",
+                                     dlm->name, res->lockname.len,
+                                     res->lockname.name, target);
+                                ret = -ERESTARTSYS;
+                        }
                }
                if (ret == -ERESTARTSYS) {
                        /* migration failed, detach and clean up mle */
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 0c8eb1093f..186e9a76aa 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -39,6 +39,7 @@
 #include <linux/inet.h>
 #include <linux/timer.h>
 #include <linux/kthread.h>
+#include <linux/delay.h>
 #include "cluster/heartbeat.h"
@@ -256,6 +257,27 @@ static int dlm_recovery_thread(void *data)
        return 0;
 }
+/* returns true when the recovery master has contacted us */
+static int dlm_reco_master_ready(struct dlm_ctxt *dlm)
+{
+        int ready;
+        spin_lock(&dlm->spinlock);
+        ready = (dlm->reco.new_master != O2NM_INVALID_NODE_NUM);
+        spin_unlock(&dlm->spinlock);
+        return ready;
+}
+/* returns true if node is no longer in the domain
+ * could be dead or just not joined */
+int dlm_is_node_dead(struct dlm_ctxt *dlm, u8 node)
+{
+        int dead;
+        spin_lock(&dlm->spinlock);
+        dead = test_bit(node, dlm->domain_map);
+        spin_unlock(&dlm->spinlock);
+        return dead;
+}
 /* callers of the top-level api calls (dlmlock/dlmunlock) should
 * block on the dlm->reco.event when recovery is in progress.
 * the dlm recovery thread will set this state when it begins
@@ -297,6 +319,7 @@ static void dlm_end_recovery(struct dlm_ctxt *dlm)
 static int dlm_do_recovery(struct dlm_ctxt *dlm)
 {
        int status = 0;
+        int ret;
        spin_lock(&dlm->spinlock);
@@ -343,10 +366,13 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
                goto master_here;
        if (dlm->reco.new_master == O2NM_INVALID_NODE_NUM) {
-                /* choose a new master */
+                /* choose a new master, returns 0 if this node
-                if (!dlm_pick_recovery_master(dlm)) {
+                 * is the master, -EEXIST if it's another node.
+                 * this does not return until a new master is chosen
+                 * or recovery completes entirely. */
+                ret = dlm_pick_recovery_master(dlm);
+                if (!ret) {
                        /* already notified everyone.  go. */
-                        dlm->reco.new_master = dlm->node_num;
                        goto master_here;
                }
                mlog(0, "another node will master this recovery session.\n");
@@ -371,8 +397,13 @@ master_here:
        if (status < 0) {
                mlog(ML_ERROR, "error %d remastering locks for node %u, "
                     "retrying.\n", status, dlm->reco.dead_node);
+                /* yield a bit to allow any final network messages
+                 * to get handled on remaining nodes */
+                msleep(100);
        } else {
                /* success!  see if any other nodes need recovery */
+                mlog(0, "DONE mastering recovery of %s:%u here(this=%u)!\n",
+                     dlm->name, dlm->reco.dead_node, dlm->node_num);
                dlm_reset_recovery(dlm);
        }
        dlm_end_recovery(dlm);
@@ -477,7 +508,7 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
                                        BUG();
                                        break;
                                case DLM_RECO_NODE_DATA_DEAD:
-                                        mlog(0, "node %u died after "
+                                        mlog(ML_NOTICE, "node %u died after "
                                             "requesting recovery info for "
                                             "node %u\n", ndata->node_num,
                                             dead_node);
@@ -485,6 +516,19 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
                                        // start all over
                                        destroy = 1;
                                        status = -EAGAIN;
+                                        /* instead of spinning like crazy here,
+                                         * wait for the domain map to catch up
+                                         * with the network state.  otherwise this
+                                         * can be hit hundreds of times before
+                                         * the node is really seen as dead. */
+                                        wait_event_timeout(dlm->dlm_reco_thread_wq,
+                                                           dlm_is_node_dead(dlm,
+                                                                ndata->node_num),
+                                                           msecs_to_jiffies(1000));
+                                        mlog(0, "waited 1 sec for %u, "
+                                             "dead? %s\n", ndata->node_num,
+                                             dlm_is_node_dead(dlm, ndata->node_num) ?
+                                             "yes" : "no");
                                        goto leave;
                                case DLM_RECO_NODE_DATA_RECEIVING:
                                case DLM_RECO_NODE_DATA_REQUESTED:
@@ -678,11 +722,27 @@ static void dlm_request_all_locks_worker(struct dlm_work_item *item, void *data)
        dlm = item->dlm;
        dead_node = item->u.ral.dead_node;
        reco_master = item->u.ral.reco_master;
+        mres = (struct dlm_migratable_lockres *)data;
+        if (dead_node != dlm->reco.dead_node ||
+            reco_master != dlm->reco.new_master) {
+                /* show extra debug info if the recovery state is messed */
+                mlog(ML_ERROR, "%s: bad reco state: reco(dead=%u, master=%u), "
+                     "request(dead=%u, master=%u)\n",
+                     dlm->name, dlm->reco.dead_node, dlm->reco.new_master,
+                     dead_node, reco_master);
+                mlog(ML_ERROR, "%s: name=%.*s master=%u locks=%u/%u flags=%u "
+                     "entry[0]={c=%"MLFu64",l=%u,f=%u,t=%d,ct=%d,hb=%d,n=%u}\n",
+                     dlm->name, mres->lockname_len, mres->lockname, mres->master,
+                     mres->num_locks, mres->total_locks, mres->flags,
+                     mres->ml[0].cookie, mres->ml[0].list, mres->ml[0].flags,
+                     mres->ml[0].type, mres->ml[0].convert_type,
+                     mres->ml[0].highest_blocked, mres->ml[0].node);
+                BUG();
+        }
        BUG_ON(dead_node != dlm->reco.dead_node);
        BUG_ON(reco_master != dlm->reco.new_master);
-        mres = (struct dlm_migratable_lockres *)data;
        /* lock resources should have already been moved to the
         * dlm->reco.resources list.  now move items from that list
         * to a temp list if the dead owner matches.  note that the
@@ -757,15 +817,18 @@ int dlm_reco_data_done_handler(struct o2net_msg *msg, u32 len, void *data)
                        continue;
                switch (ndata->state) {
+                        /* should have moved beyond INIT but not to FINALIZE yet */
                        case DLM_RECO_NODE_DATA_INIT:
                        case DLM_RECO_NODE_DATA_DEAD:
-                        case DLM_RECO_NODE_DATA_DONE:
                        case DLM_RECO_NODE_DATA_FINALIZE_SENT:
                                mlog(ML_ERROR, "bad ndata state for node %u:"
                                     " state=%d\n", ndata->node_num,
                                     ndata->state);
                                BUG();
                                break;
+                        /* these states are possible at this point, anywhere along
+                         * the line of recovery */
+                        case DLM_RECO_NODE_DATA_DONE:
                        case DLM_RECO_NODE_DATA_RECEIVING:
                        case DLM_RECO_NODE_DATA_REQUESTED:
                        case DLM_RECO_NODE_DATA_REQUESTING:
@@ -799,13 +862,31 @@ static void dlm_move_reco_locks_to_list(struct dlm_ctxt *dlm,
 {
        struct dlm_lock_resource *res;
        struct list_head *iter, *iter2;
+        struct dlm_lock *lock;
        spin_lock(&dlm->spinlock);
        list_for_each_safe(iter, iter2, &dlm->reco.resources) {
                res = list_entry (iter, struct dlm_lock_resource, recovering);
+                /* always prune any $RECOVERY entries for dead nodes,
+                 * otherwise hangs can occur during later recovery */
                if (dlm_is_recovery_lock(res->lockname.name,
-                                         res->lockname.len))
+                                         res->lockname.len)) {
+                        spin_lock(&res->spinlock);
+                        list_for_each_entry(lock, &res->granted, list) {
+                                if (lock->ml.node == dead_node) {
+                                        mlog(0, "AHA! there was "
+                                             "a $RECOVERY lock for dead "
+                                             "node %u (%s)!\n", 
+                                             dead_node, dlm->name);
+                                        list_del_init(&lock->list);
+                                        dlm_lock_put(lock);
+                                        break;
+                                }
+                        }
+                        spin_unlock(&res->spinlock);
                        continue;
+                }
                if (res->owner == dead_node) {
                        mlog(0, "found lockres owned by dead node while "
                                  "doing recovery for node %u. sending it.\n",
@@ -1179,7 +1260,7 @@ static void dlm_mig_lockres_worker(struct dlm_work_item *item, void *data)
 again:
                ret = dlm_lockres_master_requery(dlm, res, &real_master);
                if (ret < 0) {
-                        mlog(0, "dlm_lockres_master_requery failure: %d\n",
+                        mlog(0, "dlm_lockres_master_requery ret=%d\n",
                                  ret);
                        goto again;
                }
@@ -1757,6 +1838,7 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
        struct dlm_lock_resource *res;
        int i;
        struct list_head *bucket;
+        struct dlm_lock *lock;
        /* purge any stale mles */
@@ -1780,10 +1862,25 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
                bucket = &(dlm->resources[i]);
                list_for_each(iter, bucket) {
                        res = list_entry (iter, struct dlm_lock_resource, list);
+                        /* always prune any $RECOVERY entries for dead nodes,
+                         * otherwise hangs can occur during later recovery */
                        if (dlm_is_recovery_lock(res->lockname.name,
-                                                 res->lockname.len))
+                                                 res->lockname.len)) {
+                                spin_lock(&res->spinlock);
+                                list_for_each_entry(lock, &res->granted, list) {
+                                        if (lock->ml.node == dead_node) {
+                                                mlog(0, "AHA! there was "
+                                                     "a $RECOVERY lock for dead "
+                                                     "node %u (%s)!\n",
+                                                     dead_node, dlm->name);
+                                                list_del_init(&lock->list);
+                                                dlm_lock_put(lock);
+                                                break;
+                                        }
+                                }
+                                spin_unlock(&res->spinlock);
                                continue;
-                        
+                        }                       
                        spin_lock(&res->spinlock);
                        /* zero the lvb if necessary */
                        dlm_revalidate_lvb(dlm, res, dead_node);
@@ -1869,12 +1966,9 @@ void dlm_hb_node_up_cb(struct o2nm_node *node, int idx, void *data)
                return;
        spin_lock(&dlm->spinlock);
        set_bit(idx, dlm->live_nodes_map);
+        /* do NOT notify mle attached to the heartbeat events.
-        /* notify any mles attached to the heartbeat events */
+         * new nodes are not interesting in mastery until joined. */
-        dlm_hb_event_notify_attached(dlm, idx, 1);
        spin_unlock(&dlm->spinlock);
        dlm_put(dlm);
@@ -1897,7 +1991,18 @@ static void dlm_reco_unlock_ast(void *astdata, enum dlm_status st)
        mlog(0, "unlockast for recovery lock fired!\n");
 }
+/*
+ * dlm_pick_recovery_master will continually attempt to use
+ * dlmlock() on the special "$RECOVERY" lockres with the
+ * LKM_NOQUEUE flag to get an EX.  every thread that enters
+ * this function on each node racing to become the recovery
+ * master will not stop attempting this until either:
+ * a) this node gets the EX (and becomes the recovery master),
+ * or b) dlm->reco.new_master gets set to some nodenum 
+ * != O2NM_INVALID_NODE_NUM (another node will do the reco).
+ * so each time a recovery master is needed, the entire cluster
+ * will sync at this point.  if the new master dies, that will
+ * be detected in dlm_do_recovery */
 static int dlm_pick_recovery_master(struct dlm_ctxt *dlm)
 {
        enum dlm_status ret;
@@ -1906,23 +2011,45 @@ static int dlm_pick_recovery_master(struct dlm_ctxt *dlm)
        mlog(0, "starting recovery of %s at %lu, dead=%u, this=%u\n",
             dlm->name, jiffies, dlm->reco.dead_node, dlm->node_num);
-retry:
+again:  
        memset(&lksb, 0, sizeof(lksb));
        ret = dlmlock(dlm, LKM_EXMODE, &lksb, LKM_NOQUEUE|LKM_RECOVERY,
                      DLM_RECOVERY_LOCK_NAME, dlm_reco_ast, dlm, dlm_reco_bast);
+        mlog(0, "%s: dlmlock($RECOVERY) returned %d, lksb=%d\n",
+             dlm->name, ret, lksb.status);
        if (ret == DLM_NORMAL) {
                mlog(0, "dlm=%s dlmlock says I got it (this=%u)\n",
                     dlm->name, dlm->node_num);
-                /* I am master, send message to all nodes saying
+                
-                 * that I am beginning a recovery session */
+                /* got the EX lock.  check to see if another node 
-                status = dlm_send_begin_reco_message(dlm,
+                 * just became the reco master */
-                                              dlm->reco.dead_node);
+                if (dlm_reco_master_ready(dlm)) {
+                        mlog(0, "%s: got reco EX lock, but %u will "
+                             "do the recovery\n", dlm->name,
+                             dlm->reco.new_master);
+                        status = -EEXIST;
+                } else {
+                        status = dlm_send_begin_reco_message(dlm,
+                                      dlm->reco.dead_node);
+                        /* this always succeeds */
+                        BUG_ON(status);
+                        /* set the new_master to this node */
+                        spin_lock(&dlm->spinlock);
+                        dlm->reco.new_master = dlm->node_num;
+                        spin_unlock(&dlm->spinlock);
+                }
                /* recovery lock is a special case.  ast will not get fired,
                 * so just go ahead and unlock it. */
                ret = dlmunlock(dlm, &lksb, 0, dlm_reco_unlock_ast, dlm);
+                if (ret == DLM_DENIED) {
+                        mlog(0, "got DLM_DENIED, trying LKM_CANCEL\n");
+                        ret = dlmunlock(dlm, &lksb, LKM_CANCEL, dlm_reco_unlock_ast, dlm);
+                }
                if (ret != DLM_NORMAL) {
                        /* this would really suck. this could only happen
                         * if there was a network error during the unlock
@@ -1930,20 +2057,42 @@ retry:
                         * is actually "done" and the lock structure is
                         * even freed.  we can continue, but only
                         * because this specific lock name is special. */
-                        mlog(0, "dlmunlock returned %d\n", ret);
+                        mlog(ML_ERROR, "dlmunlock returned %d\n", ret);
-                }
-                if (status < 0) {
-                        mlog(0, "failed to send recovery message. "
-                                   "must retry with new node map.\n");
-                        goto retry;
                }
        } else if (ret == DLM_NOTQUEUED) {
                mlog(0, "dlm=%s dlmlock says another node got it (this=%u)\n",
                     dlm->name, dlm->node_num);
                /* another node is master. wait on
-                 * reco.new_master != O2NM_INVALID_NODE_NUM */
+                 * reco.new_master != O2NM_INVALID_NODE_NUM 
+                 * for at most one second */
+                wait_event_timeout(dlm->dlm_reco_thread_wq,
+                                         dlm_reco_master_ready(dlm),
+                                         msecs_to_jiffies(1000));
+                if (!dlm_reco_master_ready(dlm)) {
+                        mlog(0, "%s: reco master taking awhile\n",
+                             dlm->name);
+                        goto again;
+                }
+                /* another node has informed this one that it is reco master */
+                mlog(0, "%s: reco master %u is ready to recover %u\n",
+                     dlm->name, dlm->reco.new_master, dlm->reco.dead_node);
                status = -EEXIST;
+        } else {
+                struct dlm_lock_resource *res;
+                /* dlmlock returned something other than NOTQUEUED or NORMAL */
+                mlog(ML_ERROR, "%s: got %s from dlmlock($RECOVERY), "
+                     "lksb.status=%s\n", dlm->name, dlm_errname(ret),
+                     dlm_errname(lksb.status));
+                res = dlm_lookup_lockres(dlm, DLM_RECOVERY_LOCK_NAME,
+                                         DLM_RECOVERY_LOCK_NAME_LEN);
+                if (res) {
+                        dlm_print_one_lock_resource(res);
+                        dlm_lockres_put(res);
+                } else {
+                        mlog(ML_ERROR, "recovery lock not found\n");
+                }
+                BUG();
        }
        return status;
@@ -1982,7 +2131,7 @@ static int dlm_send_begin_reco_message(struct dlm_ctxt *dlm, u8 dead_node)
                        mlog(0, "not sending begin reco to self\n");
                        continue;
                }
+retry:
                ret = -EINVAL;
                mlog(0, "attempting to send begin reco msg to %d\n",
                          nodenum);
@@ -1991,8 +2140,17 @@ static int dlm_send_begin_reco_message(struct dlm_ctxt *dlm, u8 dead_node)
                /* negative status is handled ok by caller here */
                if (ret >= 0)
                        ret = status;
+                if (dlm_is_host_down(ret)) {
+                        /* node is down.  not involved in recovery
+                         * so just keep going */
+                        mlog(0, "%s: node %u was down when sending "
+                             "begin reco msg (%d)\n", dlm->name, nodenum, ret);
+                        ret = 0;
+                }
                if (ret < 0) {
                        struct dlm_lock_resource *res;
+                        /* this is now a serious problem, possibly ENOMEM 
+                         * in the network stack.  must retry */
                        mlog_errno(ret);
                        mlog(ML_ERROR, "begin reco of dlm %s to node %u "
                            " returned %d\n", dlm->name, nodenum, ret);
@@ -2004,7 +2162,10 @@ static int dlm_send_begin_reco_message(struct dlm_ctxt *dlm, u8 dead_node)
                        } else {
                                mlog(ML_ERROR, "recovery lock not found\n");
                        }
-                        break;
+                        /* sleep for a bit in hopes that we can avoid 
+                         * another ENOMEM */
+                        msleep(100);
+                        goto retry;
                }
        }
@@ -2027,19 +2188,34 @@ int dlm_begin_reco_handler(struct o2net_msg *msg, u32 len, void *data)
        spin_lock(&dlm->spinlock);
        if (dlm->reco.new_master != O2NM_INVALID_NODE_NUM) {
-                mlog(0, "new_master already set to %u!\n",
+                if (test_bit(dlm->reco.new_master, dlm->recovery_map)) {
-                          dlm->reco.new_master);
+                        mlog(0, "%s: new_master %u died, changing "
+                             "to %u\n", dlm->name, dlm->reco.new_master,
+                             br->node_idx);
+                } else {
+                        mlog(0, "%s: new_master %u NOT DEAD, changing "
+                             "to %u\n", dlm->name, dlm->reco.new_master,
+                             br->node_idx);
+                        /* may not have seen the new master as dead yet */
+                }
        }
        if (dlm->reco.dead_node != O2NM_INVALID_NODE_NUM) {
-                mlog(0, "dead_node already set to %u!\n",
+                mlog(ML_NOTICE, "%s: dead_node previously set to %u, "
-                          dlm->reco.dead_node);
+                     "node %u changing it to %u\n", dlm->name, 
+                     dlm->reco.dead_node, br->node_idx, br->dead_node);
        }
        dlm->reco.new_master = br->node_idx;
        dlm->reco.dead_node = br->dead_node;
        if (!test_bit(br->dead_node, dlm->recovery_map)) {
-                mlog(ML_ERROR, "recovery master %u sees %u as dead, but this "
+                mlog(0, "recovery master %u sees %u as dead, but this "
                     "node has not yet.  marking %u as dead\n",
                     br->node_idx, br->dead_node, br->dead_node);
+                if (!test_bit(br->dead_node, dlm->domain_map) ||
+                    !test_bit(br->dead_node, dlm->live_nodes_map))
+                        mlog(0, "%u not in domain/live_nodes map "
+                             "so setting it in reco map manually\n",
+                             br->dead_node);
+                set_bit(br->dead_node, dlm->recovery_map);
                __dlm_hb_node_down(dlm, br->dead_node);
        }
        spin_unlock(&dlm->spinlock);
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index cec2ce1cd3..c95f08d2e9 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -188,6 +188,19 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                        actions &= ~(DLM_UNLOCK_REMOVE_LOCK|
                                     DLM_UNLOCK_REGRANT_LOCK|
                                     DLM_UNLOCK_CLEAR_CONVERT_TYPE);
+                } else if (status == DLM_RECOVERING || 
+                           status == DLM_MIGRATING || 
+                           status == DLM_FORWARD) {
+                        /* must clear the actions because this unlock
+                         * is about to be retried.  cannot free or do
+                         * any list manipulation. */
+                        mlog(0, "%s:%.*s: clearing actions, %s\n",
+                             dlm->name, res->lockname.len,
+                             res->lockname.name,
+                             status==DLM_RECOVERING?"recovering":
+                             (status==DLM_MIGRATING?"migrating":
+                              "forward"));
+                        actions = 0;
                }
                if (flags & LKM_CANCEL)
                        lock->cancel_pending = 0;
diff --git a/fs/ocfs2/dlm/userdlm.c b/fs/ocfs2/dlm/userdlm.c
index e1fdd28879..c3764f4744 100644
--- a/fs/ocfs2/dlm/userdlm.c
+++ b/fs/ocfs2/dlm/userdlm.c
@@ -27,7 +27,7 @@
 * Boston, MA 021110-1307, USA.
 */
-#include <asm/signal.h>
+#include <linux/signal.h>
 #include <linux/module.h>
 #include <linux/fs.h>
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index f2fb40cd29..b6ba292e95 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -262,8 +262,7 @@ static int ocfs2_extent_map_find_leaf(struct inode *inode,
                el = &eb->h_list;
        }
-        if (el->l_tree_depth)
+        BUG_ON(el->l_tree_depth);
-                BUG();
        for (i = 0; i < le16_to_cpu(el->l_next_free_rec); i++) {
                rec = &el->l_recs[i];
@@ -364,8 +363,8 @@ static int ocfs2_extent_map_lookup_read(struct inode *inode,
                return ret;
        }
-        if (ent->e_tree_depth)
+        /* FIXME: Make sure this isn't a corruption */
-                BUG();  /* FIXME: Make sure this isn't a corruption */
+        BUG_ON(ent->e_tree_depth);
        *ret_ent = ent;
@@ -423,8 +422,7 @@ static int ocfs2_extent_map_try_insert(struct inode *inode,
                                          le32_to_cpu(rec->e_clusters), NULL,
                                          NULL);
-        if (!old_ent)
+        BUG_ON(!old_ent);
-                BUG();
        ret = -EEXIST;
        if (old_ent->e_tree_depth < tree_depth)
@@ -988,7 +986,7 @@ int __init init_ocfs2_extent_maps(void)
        return 0;
 }
-void __exit exit_ocfs2_extent_maps(void)
+void exit_ocfs2_extent_maps(void)
 {
        kmem_cache_destroy(ocfs2_em_ent_cachep);
 }
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index eaf33caa0a..1715bc90e7 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1022,8 +1022,9 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                }
                newsize = count + saved_pos;
-                mlog(0, "pos=%lld newsize=%"MLFu64" cursize=%lld\n",
+                mlog(0, "pos=%lld newsize=%lld cursize=%lld\n",
-                     saved_pos, newsize, i_size_read(inode));
+                     (long long) saved_pos, (long long) newsize,
+                     (long long) i_size_read(inode));
                /* No need for a higher level metadata lock if we're
                 * never going past i_size. */
@@ -1042,8 +1043,9 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                spin_unlock(&OCFS2_I(inode)->ip_lock);
                mlog(0, "Writing at EOF, may need more allocation: "
-                     "i_size = %lld, newsize = %"MLFu64", need %u clusters\n",
+                     "i_size = %lld, newsize = %lld, need %u clusters\n",
-                     i_size_read(inode), newsize, clusters);
+                     (long long) i_size_read(inode), (long long) newsize,
+                     clusters);
                /* We only want to continue the rest of this loop if
                 * our extend will actually require more
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index d4ecc06277..8122489c57 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -903,10 +903,10 @@ void ocfs2_clear_inode(struct inode *inode)
                        "Clear inode of %"MLFu64", inode is locked\n",
                        oi->ip_blkno);
-        mlog_bug_on_msg(down_trylock(&oi->ip_io_sem),
+        mlog_bug_on_msg(!mutex_trylock(&oi->ip_io_mutex),
-                        "Clear inode of %"MLFu64", io_sem is locked\n",
+                        "Clear inode of %"MLFu64", io_mutex is locked\n",
                        oi->ip_blkno);
-        up(&oi->ip_io_sem);
+        mutex_unlock(&oi->ip_io_mutex);
        /*
         * down_trylock() returns 0, down_write_trylock() returns 1
diff --git a/fs/ocfs2/inode.h b/fs/ocfs2/inode.h
index 9b01774336..84c5079612 100644
--- a/fs/ocfs2/inode.h
+++ b/fs/ocfs2/inode.h
@@ -46,10 +46,10 @@ struct ocfs2_inode_info
        struct list_head                ip_io_markers;
        int                             ip_orphaned_slot;
-        struct semaphore                ip_io_sem;
+        struct mutex                    ip_io_mutex;
        /* Used by the journalling code to attach an inode to a
-         * handle.  These are protected by ip_io_sem in order to lock
+         * handle.  These are protected by ip_io_mutex in order to lock
         * out other I/O to the inode until we either commit or
         * abort. */
        struct list_head                ip_handle_list;
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 303c8d9645..fa0bcac5ce 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -147,8 +147,7 @@ struct ocfs2_journal_handle *ocfs2_start_trans(struct ocfs2_super *osb,
        mlog_entry("(max_buffs = %d)\n", max_buffs);
-        if (!osb || !osb->journal->j_journal)
+        BUG_ON(!osb || !osb->journal->j_journal);
-                BUG();
        if (ocfs2_is_hard_readonly(osb)) {
                ret = -EROFS;
@@ -401,7 +400,7 @@ int ocfs2_journal_access(struct ocfs2_journal_handle *handle,
         * j_trans_barrier for us. */
        ocfs2_set_inode_lock_trans(OCFS2_SB(inode->i_sb)->journal, inode);
-        down(&OCFS2_I(inode)->ip_io_sem);
+        mutex_lock(&OCFS2_I(inode)->ip_io_mutex);
        switch (type) {
        case OCFS2_JOURNAL_ACCESS_CREATE:
        case OCFS2_JOURNAL_ACCESS_WRITE:
@@ -416,7 +415,7 @@ int ocfs2_journal_access(struct ocfs2_journal_handle *handle,
                status = -EINVAL;
                mlog(ML_ERROR, "Uknown access type!\n");
        }
-        up(&OCFS2_I(inode)->ip_io_sem);
+        mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
        if (status < 0)
                mlog(ML_ERROR, "Error %d getting %d access to buffer!\n",
@@ -561,7 +560,11 @@ int ocfs2_journal_init(struct ocfs2_journal *journal, int *dirty)
        SET_INODE_JOURNAL(inode);
        OCFS2_I(inode)->ip_open_count++;
-        status = ocfs2_meta_lock(inode, NULL, &bh, 1);
+        /* Skip recovery waits here - journal inode metadata never
+         * changes in a live cluster so it can be considered an
+         * exception to the rule. */
+        status = ocfs2_meta_lock_full(inode, NULL, &bh, 1,
+                                      OCFS2_META_LOCK_RECOVERY);
        if (status < 0) {
                if (status != -ERESTARTSYS)
                        mlog(ML_ERROR, "Could not get lock on journal!\n");
@@ -672,8 +675,7 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
        mlog_entry_void();
-        if (!osb)
+        BUG_ON(!osb);
-                BUG();
        journal = osb->journal;
        if (!journal)
@@ -805,8 +807,7 @@ int ocfs2_journal_wipe(struct ocfs2_journal *journal, int full)
        mlog_entry_void();
-        if (!journal)
+        BUG_ON(!journal);
-                BUG();
        status = journal_wipe(journal->j_journal, full);
        if (status < 0) {
@@ -1072,10 +1073,10 @@ restart:
                                        NULL);
 bail:
-        down(&osb->recovery_lock);
+        mutex_lock(&osb->recovery_lock);
        if (!status &&
            !ocfs2_node_map_is_empty(osb, &osb->recovery_map)) {
-                up(&osb->recovery_lock);
+                mutex_unlock(&osb->recovery_lock);
                goto restart;
        }
@@ -1083,7 +1084,7 @@ bail:
        mb(); /* sync with ocfs2_recovery_thread_running */
        wake_up(&osb->recovery_event);
-        up(&osb->recovery_lock);
+        mutex_unlock(&osb->recovery_lock);
        mlog_exit(status);
        /* no one is callint kthread_stop() for us so the kthread() api
@@ -1098,7 +1099,7 @@ void ocfs2_recovery_thread(struct ocfs2_super *osb, int node_num)
        mlog_entry("(node_num=%d, osb->node_num = %d)\n",
                   node_num, osb->node_num);
-        down(&osb->recovery_lock);
+        mutex_lock(&osb->recovery_lock);
        if (osb->disable_recovery)
                goto out;
@@ -1120,7 +1121,7 @@ void ocfs2_recovery_thread(struct ocfs2_super *osb, int node_num)
        }
 out:
-        up(&osb->recovery_lock);
+        mutex_unlock(&osb->recovery_lock);
        wake_up(&osb->recovery_event);
        mlog_exit_void();
@@ -1271,8 +1272,7 @@ static int ocfs2_recover_node(struct ocfs2_super *osb,
        /* Should not ever be called to recover ourselves -- in that
         * case we should've called ocfs2_journal_load instead. */
-        if (osb->node_num == node_num)
+        BUG_ON(osb->node_num == node_num);
-                BUG();
        slot_num = ocfs2_node_num_to_slot(si, node_num);
        if (slot_num == OCFS2_INVALID_SLOT) {
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index f468c600cf..8d8e4779df 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -33,6 +33,7 @@
 #include <linux/rbtree.h>
 #include <linux/workqueue.h>
 #include <linux/kref.h>
+#include <linux/mutex.h>
 #include "cluster/nodemanager.h"
 #include "cluster/heartbeat.h"
@@ -233,7 +234,7 @@ struct ocfs2_super
        struct proc_dir_entry *proc_sub_dir; /* points to /proc/fs/ocfs2/<maj_min> */
        atomic_t vol_state;
-        struct semaphore recovery_lock;
+        struct mutex recovery_lock;
        struct task_struct *recovery_thread_task;
        int disable_recovery;
        wait_queue_head_t checkpoint_event;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 364d64bd5f..046824b6b6 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -932,7 +932,7 @@ static void ocfs2_inode_init_once(void *data,
                oi->ip_dir_start_lookup = 0;
                init_rwsem(&oi->ip_alloc_sem);
-                init_MUTEX(&(oi->ip_io_sem));
+                mutex_init(&oi->ip_io_mutex);
                oi->ip_blkno = 0ULL;
                oi->ip_clusters = 0;
@@ -1137,9 +1137,9 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
        /* disable any new recovery threads and wait for any currently
         * running ones to exit. Do this before setting the vol_state. */
-        down(&osb->recovery_lock);
+        mutex_lock(&osb->recovery_lock);
        osb->disable_recovery = 1;
-        up(&osb->recovery_lock);
+        mutex_unlock(&osb->recovery_lock);
        wait_event(osb->recovery_event, !ocfs2_recovery_thread_running(osb));
        /* At this point, we know that no more recovery threads can be
@@ -1254,8 +1254,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
        osb->sb = sb;
        /* Save off for ocfs2_rw_direct */
        osb->s_sectsize_bits = blksize_bits(sector_size);
-        if (!osb->s_sectsize_bits)
+        BUG_ON(!osb->s_sectsize_bits);
-                BUG();
        osb->net_response_ids = 0;
        spin_lock_init(&osb->net_response_lock);
@@ -1283,7 +1282,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
        snprintf(osb->dev_str, sizeof(osb->dev_str), "%u,%u",
                 MAJOR(osb->sb->s_dev), MINOR(osb->sb->s_dev));
-        init_MUTEX(&osb->recovery_lock);
+        mutex_init(&osb->recovery_lock);
        osb->disable_recovery = 0;
        osb->recovery_thread_task = NULL;
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index 600a8bc5b5..fc29cb7a43 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -77,8 +77,7 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
        if (arr && ((inode = *arr) != NULL)) {
                /* get a ref in addition to the array ref */
                inode = igrab(inode);
-                if (!inode)
+                BUG_ON(!inode);
-                        BUG();
                return inode;
        }
@@ -89,8 +88,7 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
        /* add one more if putting into array for first time */
        if (arr && inode) {
                *arr = igrab(inode);
-                if (!*arr)
+                BUG_ON(!*arr);
-                        BUG();
        }
        return inode;
 }
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index 3a0458fd3e..300b5bedfb 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -388,7 +388,7 @@ out_free:
        }
 }
-/* Item insertion is guarded by ip_io_sem, so the insertion path takes
+/* Item insertion is guarded by ip_io_mutex, so the insertion path takes
 * advantage of this by not rechecking for a duplicate insert during
 * the slow case. Additionally, if the cache needs to be bumped up to
 * a tree, the code will not recheck after acquiring the lock --
@@ -418,7 +418,7 @@ void ocfs2_set_buffer_uptodate(struct inode *inode,
             (unsigned long long) bh->b_blocknr);
        /* No need to recheck under spinlock - insertion is guarded by
-         * ip_io_sem */
+         * ip_io_mutex */
        spin_lock(&oi->ip_lock);
        if (ocfs2_insert_can_use_array(oi, ci)) {
                /* Fast case - it's an array and there's a free
@@ -440,7 +440,7 @@ void ocfs2_set_buffer_uptodate(struct inode *inode,
 /* Called against a newly allocated buffer. Most likely nobody should
 * be able to read this sort of metadata while it's still being
- * allocated, but this is careful to take ip_io_sem anyway. */
+ * allocated, but this is careful to take ip_io_mutex anyway. */
 void ocfs2_set_new_buffer_uptodate(struct inode *inode,
                                   struct buffer_head *bh)
 {
@@ -451,9 +451,9 @@ void ocfs2_set_new_buffer_uptodate(struct inode *inode,
        set_buffer_uptodate(bh);
-        down(&oi->ip_io_sem);
+        mutex_lock(&oi->ip_io_mutex);
        ocfs2_set_buffer_uptodate(inode, bh);
-        up(&oi->ip_io_sem);
+        mutex_unlock(&oi->ip_io_mutex);
 }
 /* Requires ip_lock. */
@@ -537,7 +537,7 @@ int __init init_ocfs2_uptodate_cache(void)
        return 0;
 }
-void __exit exit_ocfs2_uptodate_cache(void)
+void exit_ocfs2_uptodate_cache(void)
 {
        if (ocfs2_uptodate_cachep)
                kmem_cache_destroy(ocfs2_uptodate_cachep);
diff --git a/fs/ocfs2/uptodate.h b/fs/ocfs2/uptodate.h
index e5aacdf4ea..01cd32d26b 100644
--- a/fs/ocfs2/uptodate.h
+++ b/fs/ocfs2/uptodate.h
@@ -27,7 +27,7 @@
 #define OCFS2_UPTODATE_H
 int __init init_ocfs2_uptodate_cache(void);
-void __exit exit_ocfs2_uptodate_cache(void);
+void exit_ocfs2_uptodate_cache(void);
 void ocfs2_metadata_cache_init(struct inode *inode);
 void ocfs2_metadata_cache_purge(struct inode *inode);
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 8f8014285a..1d24fead51 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -548,7 +548,7 @@ static int show_stat(struct seq_file *p, void *v)
        }
        seq_printf(p, "intr %llu", (unsigned long long)sum);
-#if !defined(CONFIG_PPC64) && !defined(CONFIG_ALPHA)
+#if !defined(CONFIG_PPC64) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
        for (i = 0; i < NR_IRQS; i++)
                seq_printf(p, " %u", kstat_irqs(i));
 #endif
diff --git a/fs/quota_v2.c b/fs/quota_v2.c
index a4ef91bb4f..b4199ec3ec 100644
--- a/fs/quota_v2.c
+++ b/fs/quota_v2.c
@@ -35,7 +35,7 @@ static int v2_check_quota_file(struct super_block *sb, int type)
 
        size = sb->s_op->quota_read(sb, type, (char *)&dqhead, sizeof(struct v2_disk_dqheader), 0);
        if (size != sizeof(struct v2_disk_dqheader)) {
-                printk("quota_v2: failed read expected=%d got=%d\n",
+                printk("quota_v2: failed read expected=%zd got=%zd\n",
                        sizeof(struct v2_disk_dqheader), size);
                return 0;
        }
diff --git a/fs/reiserfs/hashes.c b/fs/reiserfs/hashes.c
index a3ec238fd9..e664ac16fa 100644
--- a/fs/reiserfs/hashes.c
+++ b/fs/reiserfs/hashes.c
@@ -21,7 +21,6 @@
 #include <linux/kernel.h>
 #include <linux/reiserfs_fs.h>
 #include <asm/types.h>
-#include <asm/bug.h>
 #define DELTA 0x9E3779B9
 #define FULLROUNDS 10           /* 32 is overkill, 16 is strong crypto */
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 77891de0e0..d63da756eb 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1124,8 +1124,6 @@ static void handle_attrs(struct super_block *s)
                                         "reiserfs: cannot support attributes until flag is set in super-block");
                        REISERFS_SB(s)->s_mount_opt &= ~(1 << REISERFS_ATTRS);
                }
-        } else if (le32_to_cpu(rs->s_flags) & reiserfs_attrs_cleared) {
-                REISERFS_SB(s)->s_mount_opt |= REISERFS_ATTRS;
        }
 }
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index 43de3ba833..ab8894c3b9 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -228,7 +228,8 @@ struct posix_acl *reiserfs_get_acl(struct inode *inode, int type)
                acl = ERR_PTR(retval);
        } else {
                acl = posix_acl_from_disk(value, retval);
-                *p_acl = posix_acl_dup(acl);
+                if (!IS_ERR(acl))
+                        *p_acl = posix_acl_dup(acl);
        }
        kfree(value);
diff --git a/fs/select.c b/fs/select.c
index c0f02d36c6..6ce68a9c89 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -398,11 +398,15 @@ asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
        ret = core_sys_select(n, inp, outp, exp, &timeout);
        if (tvp) {
+                struct timeval rtv;
                if (current->personality & STICKY_TIMEOUTS)
                        goto sticky;
-                tv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
+                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
-                tv.tv_sec = timeout;
+                rtv.tv_sec = timeout;
-                if (copy_to_user(tvp, &tv, sizeof(tv))) {
+                if (timeval_compare(&rtv, &tv) < 0)
+                        rtv = tv;
+                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
                        /*
                         * If an application puts its timeval in read-only
@@ -460,11 +464,16 @@ asmlinkage long sys_pselect7(int n, fd_set __user *inp, fd_set __user *outp,
        ret = core_sys_select(n, inp, outp, exp, &timeout);
        if (tsp) {
+                struct timespec rts;
                if (current->personality & STICKY_TIMEOUTS)
                        goto sticky;
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
-                ts.tv_sec = timeout;
+                                                1000;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_sec = timeout;
+                if (timespec_compare(&rts, &ts) < 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
                        /*
                         * If an application puts its timeval in read-only
@@ -510,9 +519,9 @@ asmlinkage long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp,
        if (sig) {
                if (!access_ok(VERIFY_READ, sig, sizeof(void *)+sizeof(size_t))
-                    || __get_user(up, (sigset_t * __user *)sig)
+                    || __get_user(up, (sigset_t __user * __user *)sig)
                    || __get_user(sigsetsize,
-                                (size_t * __user)(sig+sizeof(void *))))
+                                (size_t __user *)(sig+sizeof(void *))))
                        return -EFAULT;
        }
@@ -758,12 +767,17 @@ asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
                sigprocmask(SIG_SETMASK, &sigsaved, NULL);
        if (tsp && timeout >= 0) {
+                struct timespec rts;
                if (current->personality & STICKY_TIMEOUTS)
                        goto sticky;
                /* Yes, we know it's actually an s64, but it's also positive. */
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
-                ts.tv_sec = timeout;
+                                                1000;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_sec = timeout;
+                if (timespec_compare(&rts, &ts) < 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
                sticky:
                        /*
                         * If an application puts its timeval in read-only
diff --git a/fs/stat.c b/fs/stat.c
index 24211b030f..9948cc1685 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -261,6 +261,7 @@ asmlinkage long sys_newlstat(char __user *filename, struct stat __user *statbuf)
        return error;
 }
+#ifndef __ARCH_WANT_STAT64
 asmlinkage long sys_newfstatat(int dfd, char __user *filename,
                                struct stat __user *statbuf, int flag)
 {
@@ -281,6 +282,7 @@ asmlinkage long sys_newfstatat(int dfd, char __user *filename,
 out:
        return error;
 }
+#endif
 asmlinkage long sys_newfstat(unsigned int fd, struct stat __user *statbuf)
 {
@@ -395,6 +397,26 @@ asmlinkage long sys_fstat64(unsigned long fd, struct stat64 __user * statbuf)
        return error;
 }
+asmlinkage long sys_fstatat64(int dfd, char __user *filename,
+                               struct stat64 __user *statbuf, int flag)
+{
+        struct kstat stat;
+        int error = -EINVAL;
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
+        if (flag & AT_SYMLINK_NOFOLLOW)
+                error = vfs_lstat_fd(dfd, filename, &stat);
+        else
+                error = vfs_stat_fd(dfd, filename, &stat);
+        if (!error)
+                error = cp_new_stat64(&stat, statbuf);
+out:
+        return error;
+}
 #endif /* __ARCH_WANT_STAT64 */
 void inode_add_bytes(struct inode *inode, loff_t bytes)
diff --git a/fs/super.c b/fs/super.c
index c177b92419..30294218fa 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -247,8 +247,9 @@ void generic_shutdown_super(struct super_block *sb)
                /* Forget any remaining inodes */
                if (invalidate_inodes(sb)) {
-                        printk("VFS: Busy inodes after unmount. "
+                        printk("VFS: Busy inodes after unmount of %s. "
-                           "Self-destruct in 5 seconds.  Have a nice day...\n");
+                           "Self-destruct in 5 seconds.  Have a nice day...\n",
+                           sb->s_id);
                }
                unlock_kernel();
diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index 4fae57d9d1..201049ac8a 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -579,10 +579,9 @@ static void udf_table_free_blocks(struct super_block * sb,
                        {
                                loffset = nextoffset;
                                aed->lengthAllocDescs = cpu_to_le32(adsize);
-                                if (obh)
+                                sptr = UDF_I_DATA(inode) + nextoffset -
-                                        sptr = UDF_I_DATA(inode) + nextoffset -  udf_file_entry_alloc_offset(inode) + UDF_I_LENEATTR(inode) - adsize;
+                                        udf_file_entry_alloc_offset(inode) +
-                                else
+                                        UDF_I_LENEATTR(inode) - adsize;
-                                        sptr = obh->b_data + nextoffset - adsize;
                                dptr = nbh->b_data + sizeof(struct allocExtDesc);
                                memcpy(dptr, sptr, adsize);
                                nextoffset = sizeof(struct allocExtDesc) + adsize;
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index ca732e79c4..ab9a7629d2 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -296,7 +296,7 @@ static struct dentry *
 udf_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
        struct inode *inode = NULL;
-        struct fileIdentDesc cfi, *fi;
+        struct fileIdentDesc cfi;
        struct udf_fileident_bh fibh;
        if (dentry->d_name.len > UDF_NAME_LEN-2)
@@ -318,7 +318,7 @@ udf_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
        else
 #endif /* UDF_RECOVERY */
-        if ((fi = udf_find_entry(dir, dentry, &fibh, &cfi)))
+        if (udf_find_entry(dir, dentry, &fibh, &cfi))
        {
                if (fibh.sbh != fibh.ebh)
                        udf_release_data(fibh.ebh);
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index e0c04e36a0..3c3f62ce2a 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -376,7 +376,7 @@ out:
 * This function gets the block which contains the fragment.
 */
-static int ufs_getfrag_block (struct inode *inode, sector_t fragment, struct buffer_head *bh_result, int create)
+int ufs_getfrag_block (struct inode *inode, sector_t fragment, struct buffer_head *bh_result, int create)
 {
        struct super_block * sb = inode->i_sb;
        struct ufs_sb_private_info * uspi = UFS_SB(sb)->s_uspi;
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index d4aacee593..e9055ef7f5 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -388,7 +388,8 @@ static int ufs_parse_options (char * options, unsigned * mount_options)
 /*
 * Read on-disk structures associated with cylinder groups
 */
-static int ufs_read_cylinder_structures (struct super_block *sb) {
+static int ufs_read_cylinder_structures (struct super_block *sb)
+{
        struct ufs_sb_info * sbi = UFS_SB(sb);
        struct ufs_sb_private_info * uspi;
        struct ufs_super_block *usb;
@@ -415,6 +416,7 @@ static int ufs_read_cylinder_structures (struct super_block *sb) {
        base = space = kmalloc(size, GFP_KERNEL);
        if (!base)
                goto failed; 
+        sbi->s_csp = (struct ufs_csum *)space;
        for (i = 0; i < blks; i += uspi->s_fpb) {
                size = uspi->s_bsize;
                if (i + uspi->s_fpb > blks)
@@ -430,7 +432,6 @@ static int ufs_read_cylinder_structures (struct super_block *sb) {
                        goto failed;
                ubh_ubhcpymem (space, ubh, size);
-                sbi->s_csp[ufs_fragstoblks(i)]=(struct ufs_csum *)space;
                space += size;
                ubh_brelse (ubh);
@@ -486,7 +487,8 @@ failed:
 * Put on-disk structures associated with cylinder groups and 
 * write them back to disk
 */
-static void ufs_put_cylinder_structures (struct super_block *sb) {
+static void ufs_put_cylinder_structures (struct super_block *sb)
+{
        struct ufs_sb_info * sbi = UFS_SB(sb);
        struct ufs_sb_private_info * uspi;
        struct ufs_buffer_head * ubh;
@@ -499,7 +501,7 @@ static void ufs_put_cylinder_structures (struct super_block *sb) {
        size = uspi->s_cssize;
        blks = (size + uspi->s_fsize - 1) >> uspi->s_fshift;
-        base = space = (char*) sbi->s_csp[0];
+        base = space = (char*) sbi->s_csp;
        for (i = 0; i < blks; i += uspi->s_fpb) {
                size = uspi->s_bsize;
                if (i + uspi->s_fpb > blks)
diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index 61d2e35012..02e86291ef 100644
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -29,6 +29,11 @@
 * Idea from Pierre del Perugia <delperug@gla.ecoledoc.ibp.fr>
 */
+/*
+ * Modified to avoid infinite loop on 2006 by
+ * Evgeniy Dushistov <dushistov@mail.ru>
+ */
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/ufs_fs.h>
@@ -65,19 +70,16 @@
 #define DIRECT_BLOCK ((inode->i_size + uspi->s_bsize - 1) >> uspi->s_bshift)
 #define DIRECT_FRAGMENT ((inode->i_size + uspi->s_fsize - 1) >> uspi->s_fshift)
-#define DATA_BUFFER_USED(bh) \
-        (atomic_read(&bh->b_count)>1 || buffer_locked(bh))
 static int ufs_trunc_direct (struct inode * inode)
 {
        struct ufs_inode_info *ufsi = UFS_I(inode);
        struct super_block * sb;
        struct ufs_sb_private_info * uspi;
-        struct buffer_head * bh;
        __fs32 * p;
        unsigned frag1, frag2, frag3, frag4, block1, block2;
        unsigned frag_to_free, free_count;
-        unsigned i, j, tmp;
+        unsigned i, tmp;
        int retry;
        
        UFSD(("ENTER\n"))
@@ -117,15 +119,7 @@ static int ufs_trunc_direct (struct inode * inode)
                ufs_panic (sb, "ufs_trunc_direct", "internal error");
        frag1 = ufs_fragnum (frag1);
        frag2 = ufs_fragnum (frag2);
-        for (j = frag1; j < frag2; j++) {
-                bh = sb_find_get_block (sb, tmp + j);
-                if ((bh && DATA_BUFFER_USED(bh)) || tmp != fs32_to_cpu(sb, *p)) {
-                        retry = 1;
-                        brelse (bh);
-                        goto next1;
-                }
-                bforget (bh);
-        }
        inode->i_blocks -= (frag2-frag1) << uspi->s_nspfshift;
        mark_inode_dirty(inode);
        ufs_free_fragments (inode, tmp + frag1, frag2 - frag1);
@@ -140,15 +134,7 @@ next1:
                tmp = fs32_to_cpu(sb, *p);
                if (!tmp)
                        continue;
-                for (j = 0; j < uspi->s_fpb; j++) {
-                        bh = sb_find_get_block(sb, tmp + j);
-                        if ((bh && DATA_BUFFER_USED(bh)) || tmp != fs32_to_cpu(sb, *p)) {
-                                retry = 1;
-                                brelse (bh);
-                                goto next2;
-                        }
-                        bforget (bh);
-                }
                *p = 0;
                inode->i_blocks -= uspi->s_nspb;
                mark_inode_dirty(inode);
@@ -162,7 +148,6 @@ next1:
                        frag_to_free = tmp;
                        free_count = uspi->s_fpb;
                }
-next2:;
        }
        
        if (free_count > 0)
@@ -179,15 +164,7 @@ next2:;
        if (!tmp )
                ufs_panic(sb, "ufs_truncate_direct", "internal error");
        frag4 = ufs_fragnum (frag4);
-        for (j = 0; j < frag4; j++) {
-                bh = sb_find_get_block (sb, tmp + j);
-                if ((bh && DATA_BUFFER_USED(bh)) || tmp != fs32_to_cpu(sb, *p)) {
-                        retry = 1;
-                        brelse (bh);
-                        goto next1;
-                }
-                bforget (bh);
-        }
        *p = 0;
        inode->i_blocks -= frag4 << uspi->s_nspfshift;
        mark_inode_dirty(inode);
@@ -204,9 +181,8 @@ static int ufs_trunc_indirect (struct inode * inode, unsigned offset, __fs32 *p)
        struct super_block * sb;
        struct ufs_sb_private_info * uspi;
        struct ufs_buffer_head * ind_ubh;
-        struct buffer_head * bh;
        __fs32 * ind;
-        unsigned indirect_block, i, j, tmp;
+        unsigned indirect_block, i, tmp;
        unsigned frag_to_free, free_count;
        int retry;
@@ -238,15 +214,7 @@ static int ufs_trunc_indirect (struct inode * inode, unsigned offset, __fs32 *p)
                tmp = fs32_to_cpu(sb, *ind);
                if (!tmp)
                        continue;
-                for (j = 0; j < uspi->s_fpb; j++) {
-                        bh = sb_find_get_block(sb, tmp + j);
-                        if ((bh && DATA_BUFFER_USED(bh)) || tmp != fs32_to_cpu(sb, *ind)) {
-                                retry = 1;
-                                brelse (bh);
-                                goto next;
-                        }
-                        bforget (bh);
-                }       
                *ind = 0;
                ubh_mark_buffer_dirty(ind_ubh);
                if (free_count == 0) {
@@ -261,7 +229,6 @@ static int ufs_trunc_indirect (struct inode * inode, unsigned offset, __fs32 *p)
                }
                inode->i_blocks -= uspi->s_nspb;
                mark_inode_dirty(inode);
-next:;
        }
        if (free_count > 0) {
@@ -430,9 +397,7 @@ void ufs_truncate (struct inode * inode)
        struct ufs_inode_info *ufsi = UFS_I(inode);
        struct super_block * sb;
        struct ufs_sb_private_info * uspi;
-        struct buffer_head * bh;
+        int retry;
-        unsigned offset;
-        int err, retry;
        
        UFSD(("ENTER\n"))
        sb = inode->i_sb;
@@ -442,6 +407,9 @@ void ufs_truncate (struct inode * inode)
                return;
        if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
                return;
+        block_truncate_page(inode->i_mapping,   inode->i_size, ufs_getfrag_block);
        lock_kernel();
        while (1) {
                retry = ufs_trunc_direct(inode);
@@ -457,15 +425,7 @@ void ufs_truncate (struct inode * inode)
                blk_run_address_space(inode->i_mapping);
                yield();
        }
-        offset = inode->i_size & uspi->s_fshift;
-        if (offset) {
-                bh = ufs_bread (inode, inode->i_size >> uspi->s_fshift, 0, &err);
-                if (bh) {
-                        memset (bh->b_data + offset, 0, uspi->s_fsize - offset);
-                        mark_buffer_dirty (bh);
-                        brelse (bh);
-                }
-        }
        inode->i_mtime = inode->i_ctime = CURRENT_TIME_SEC;
        ufsi->i_lastfrag = DIRECT_FRAGMENT;
        unlock_kernel();
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 9892268e30..8f2beec526 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -747,10 +747,11 @@ xfs_convert_page(
                        struct backing_dev_info *bdi;
                        bdi = inode->i_mapping->backing_dev_info;
+                        wbc->nr_to_write--;
                        if (bdi_write_congested(bdi)) {
                                wbc->encountered_congestion = 1;
                                done = 1;
-                        } else if (--wbc->nr_to_write <= 0) {
+                        } else if (wbc->nr_to_write <= 0) {
                                done = 1;
                        }
                }
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index eda7919b70..d7f6f2d8ac 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -673,6 +673,8 @@ linvfs_setattr(
        if (ia_valid & ATTR_ATIME) {
                vattr.va_mask |= XFS_AT_ATIME;
                vattr.va_atime = attr->ia_atime;
+                if (ia_valid & ATTR_ATIME_SET)
+                        inode->i_atime = attr->ia_atime;
        }
        if (ia_valid & ATTR_MTIME) {
                vattr.va_mask |= XFS_AT_MTIME;