Merge with 2.4.0-test3-pre4.

59 files changed, 6040 insertions, 485 deletions

diff --git a/fs/Config.in b/fs/Config.in
index 730afdb94..f18e30675 100644
--- a/fs/Config.in
+++ b/fs/Config.in
@@ -24,7 +24,7 @@ dep_tristate '  MSDOS fs support' CONFIG_MSDOS_FS $CONFIG_FAT_FS
 dep_tristate '    UMSDOS: Unix-like file system on top of standard MSDOS fs' CONFIG_UMSDOS_FS $CONFIG_MSDOS_FS
 dep_tristate '  VFAT (Windows-95) fs support' CONFIG_VFAT_FS $CONFIG_FAT_FS
 dep_tristate 'EFS file system support (read only) (EXPERIMENTAL)' CONFIG_EFS_FS $CONFIG_EXPERIMENTAL
-
+dep_tristate 'Journalling Flash File System (JFFS) support (EXPERIMENTAL)' CONFIG_JFFS_FS $CONFIG_EXPERIMENTAL
 tristate 'Compressed ROM file system support' CONFIG_CRAMFS
 tristate 'Simple RAM-based file system support' CONFIG_RAMFS
 
diff --git a/fs/Makefile b/fs/Makefile
index 0693daf69..7573a7f95 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -19,7 +19,7 @@ MOD_LIST_NAME := FS_MODULES
 ALL_SUB_DIRS = coda minix ext2 fat msdos vfat proc isofs nfs umsdos ntfs \
 		hpfs sysv smbfs ncpfs ufs efs affs romfs autofs hfs lockd \
 		nfsd nls devpts devfs adfs partitions qnx4 udf bfs cramfs \
-		openpromfs autofs4 ramfs
+		openpromfs autofs4 ramfs jffs
 
 SUB_DIRS :=
 
@@ -230,6 +230,14 @@ else
   endif
 endif
 
+ifeq ($(CONFIG_JFFS_FS),y)
+SUB_DIRS += jffs
+else
+  ifeq ($(CONFIG_JFFS_FS),m)
+  MOD_SUB_DIRS += jffs
+  endif
+endif
+
 ifeq ($(CONFIG_AFFS_FS),y)
 SUB_DIRS += affs
 else
diff --git a/fs/affs/symlink.c b/fs/affs/symlink.c
index aee023ef5..f7e78a75d 100644
--- a/fs/affs/symlink.c
+++ b/fs/affs/symlink.c
@@ -14,6 +14,7 @@
 #include <linux/affs_fs.h>
 #include <linux/amigaffs.h>
 #include <linux/pagemap.h>
+#include <linux/smp_lock.h>
 
 static int affs_symlink_readpage(struct file *file, struct page *page)
 {
@@ -30,7 +31,9 @@ static int affs_symlink_readpage(struct file *file, struct page *page)
 	pr_debug("AFFS: follow_link(ino=%lu)\n",inode->i_ino);
 
 	err = -EIO;
+	lock_kernel();
 	bh = affs_bread(inode->i_dev,inode->i_ino,AFFS_I2BSIZE(inode));
+	unlock_kernel();
 	if (!bh)
 		goto fail;
 	i  = 0;
@@ -59,7 +62,9 @@ static int affs_symlink_readpage(struct file *file, struct page *page)
 		j++;
 	}
 	link[i] = '\0';
+	lock_kernel();
 	affs_brelse(bh);
+	unlock_kernel();
 	SetPageUptodate(page);
 	kunmap(page);
 	UnlockPage(page);
diff --git a/fs/autofs/root.c b/fs/autofs/root.c
index 63ac3db2a..4ba567499 100644
--- a/fs/autofs/root.c
+++ b/fs/autofs/root.c
@@ -13,6 +13,8 @@
 #include <linux/errno.h>
 #include <linux/stat.h>
 #include <linux/param.h>
+#include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include "autofs_i.h"
 
 static int autofs_root_readdir(struct file *,void *,filldir_t);
@@ -140,28 +142,39 @@ static int try_to_fill_dentry(struct dentry *dentry, struct super_block *sb, str
  */
 static int autofs_revalidate(struct dentry * dentry, int flags)
 {
-	struct inode * dir = dentry->d_parent->d_inode;
-	struct autofs_sb_info *sbi = autofs_sbi(dir->i_sb);
+	struct inode * dir;
+	struct autofs_sb_info *sbi;
 	struct autofs_dir_ent *ent;
+	int res;
+
+	lock_kernel();
+	dir = dentry->d_parent->d_inode;
+	sbi = autofs_sbi(dir->i_sb);
 
 	/* Pending dentry */
 	if ( dentry->d_flags & DCACHE_AUTOFS_PENDING ) {
 		if (autofs_oz_mode(sbi))
-			return 1;
+			res = 1;
 		else
-			return try_to_fill_dentry(dentry, dir->i_sb, sbi);
+			res = try_to_fill_dentry(dentry, dir->i_sb, sbi);
+		unlock_kernel();
+		return res;
 	}
 
 	/* Negative dentry.. invalidate if "old" */
-	if (!dentry->d_inode)
+	if (!dentry->d_inode) {
+		unlock_kernel();
 		return (dentry->d_time - jiffies <= AUTOFS_NEGATIVE_TIMEOUT);
+	}
 		
 	/* Check for a non-mountpoint directory */
 	if ( S_ISDIR(dentry->d_inode->i_mode) && !d_mountpoint(dentry) ) {
 		if (autofs_oz_mode(sbi))
-			return 1;
+			res = 1;
 		else
-			return try_to_fill_dentry(dentry, dir->i_sb, sbi);
+			res = try_to_fill_dentry(dentry, dir->i_sb, sbi);
+		unlock_kernel();
+		return res;
 	}
 
 	/* Update the usage list */
@@ -170,6 +183,7 @@ static int autofs_revalidate(struct dentry * dentry, int flags)
 		if ( ent )
 			autofs_update_usage(&sbi->dirhash,ent);
 	}
+	unlock_kernel();
 	return 1;
 }
 
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 98a7a0e6c..aca401b73 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -22,6 +22,7 @@ static int is_tree_busy(struct vfsmount *mnt)
 	struct list_head *next;
 	int count;
 
+	spin_lock(&dcache_lock);
 	count = atomic_read(&mnt->mnt_count);
 repeat:
 	next = this_parent->mnt_mounts.next;
@@ -38,8 +39,10 @@ resume:
 			goto repeat;
 		}
 		/* root is busy if any leaf is busy */
-		if (atomic_read(&p->mnt_count) > 1)
+		if (atomic_read(&p->mnt_count) > 1) {
+			spin_unlock(&dcache_lock);
 			return 1;
+		}
 	}
 	/*
 	 * All done at this level ... ascend and resume the search.
@@ -49,6 +52,7 @@ resume:
 		this_parent = this_parent->mnt_parent;
 		goto resume;
 	}
+	spin_unlock(&dcache_lock);
 
 	DPRINTK(("is_tree_busy: count=%d\n", count));
 	return count != 0; /* remaining users? */
@@ -77,6 +81,7 @@ static struct dentry *autofs4_expire(struct super_block *sb,
 
 	timeout = sbi->exp_timeout;
 
+	spin_lock(&dcache_lock);
 	for(tmp = root->d_subdirs.next;
 	    tmp != &root->d_subdirs; 
 	    tmp = tmp->next) {
@@ -110,6 +115,7 @@ static struct dentry *autofs4_expire(struct super_block *sb,
 		}
 		p = mntget(mnt);
 		d = dget(dentry);
+		spin_unlock(&dcache_lock);
 		while(d_mountpoint(d) && follow_down(&p, &d))
 			;
 
@@ -119,13 +125,17 @@ static struct dentry *autofs4_expire(struct super_block *sb,
 			DPRINTK(("autofs_expire: returning %p %.*s\n",
 				 dentry, dentry->d_name.len, dentry->d_name.name));
 			/* Start from here next time */
+			spin_lock(&dcache_lock);
 			list_del(&root->d_subdirs);
 			list_add(&root->d_subdirs, &dentry->d_child);
+			spin_unlock(&dcache_lock);
 			return dentry;
 		}
 		dput(d);
 		mntput(p);
+		spin_lock(&dcache_lock);
 	}
+	spin_unlock(&dcache_lock);
 
 	return NULL;
 }
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 00951bf8e..f3c3e9e12 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -14,6 +14,8 @@
 #include <linux/errno.h>
 #include <linux/stat.h>
 #include <linux/param.h>
+#include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include "autofs_i.h"
 
 static struct dentry *autofs4_dir_lookup(struct inode *,struct dentry *);
@@ -118,12 +120,15 @@ static int try_to_fill_dentry(struct dentry *dentry,
 
 	/* If this is an unused directory that isn't a mount point,
 	   bitch at the daemon and fix it in user space */
+	spin_lock(&dcache_lock);
 	if (S_ISDIR(dentry->d_inode->i_mode) &&
 	    !d_mountpoint(dentry) && 
 	    list_empty(&dentry->d_subdirs)) {
 		DPRINTK(("try_to_fill_entry: mounting existing dir\n"));
+		spin_unlock(&dcache_lock);
 		return autofs4_wait(sbi, &dentry->d_name, NFY_MOUNT) == 0;
 	}
+	spin_unlock(&dcache_lock);
 
 	/* We don't update the usages for the autofs daemon itself, this
 	   is necessary for recursive autofs mounts */
@@ -163,16 +168,19 @@ static int autofs4_root_revalidate(struct dentry * dentry, int flags)
 	ino = autofs4_dentry_ino(dentry);
 
 	/* Check for a non-mountpoint directory with no contents */
+	spin_lock(&dcache_lock);
 	if (S_ISDIR(dentry->d_inode->i_mode) &&
 	    !d_mountpoint(dentry) && 
 	    list_empty(&dentry->d_subdirs)) {
 		DPRINTK(("autofs_root_revalidate: dentry=%p %.*s, emptydir\n",
 			 dentry, dentry->d_name.len, dentry->d_name.name));
+		spin_unlock(&dcache_lock);
 		if (oz_mode)
 			return 1;
 		else
 			return try_to_fill_dentry(dentry, dir->i_sb, sbi);
 	}
+	spin_unlock(&dcache_lock);
 
 	/* Update the usage list */
 	if (!oz_mode)
@@ -197,6 +205,7 @@ static void autofs4_dentry_release(struct dentry *de)
 
 	DPRINTK(("autofs4_dentry_release: releasing %p\n", de));
 
+	lock_kernel();
 	de->d_fsdata = NULL;
 	if (inf) {
 		inf->dentry = NULL;
@@ -204,6 +213,7 @@ static void autofs4_dentry_release(struct dentry *de)
 
 		autofs4_free_ino(inf);
 	}
+	unlock_kernel();
 }
 
 /* For dentries of directories in the root dir */
@@ -372,9 +382,6 @@ static int autofs4_dir_unlink(struct inode *dir, struct dentry *dentry)
 
 	dir->i_mtime = CURRENT_TIME;
 
-	DPRINTK(("autofs_dir_unlink: unlinking %p %.*s, count=%d\n",
-		dentry, dentry->d_name.len, dentry->d_name.name, dentry->d_count));
-
 	d_drop(dentry);
 	
 	return 0;
@@ -388,8 +395,13 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
 	if (!autofs4_oz_mode(sbi))
 		return -EACCES;
 
-	if (!list_empty(&dentry->d_subdirs))
+	spin_lock(&dcache_lock);
+	if (!list_empty(&dentry->d_subdirs)) {
+		spin_unlock(&dcache_lock);
 		return -ENOTEMPTY;
+	}
+	list_del(&dentry->d_hash);
+	spin_unlock(&dcache_lock);
 
 	dput(ino->dentry);
 
@@ -399,11 +411,6 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
 	if (dir->i_nlink)
 		dir->i_nlink--;
 
-	DPRINTK(("autofs_dir_rmdir: rmdir %p %.*s, count=%d\n",
-		dentry, dentry->d_name.len, dentry->d_name.name, dentry->d_count));
-
-	d_drop(dentry);
-
 	return 0;
 }
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 29972c8ca..02ae171c4 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -528,7 +528,7 @@ int check_disk_change(kdev_t dev)
 	if (bdops == NULL) {
 		devfs_handle_t de;
 
-		de = devfs_find_handle (NULL, NULL, 0, i, MINOR (dev),
+		de = devfs_find_handle (NULL, NULL, i, MINOR (dev),
 					DEVFS_SPECIAL_BLK, 0);
 		if (de) bdops = devfs_get_ops (de);
 	}
diff --git a/fs/coda/cache.c b/fs/coda/cache.c
index eff2da6cd..e837db96a 100644
--- a/fs/coda/cache.c
+++ b/fs/coda/cache.c
@@ -228,6 +228,7 @@ static void coda_flag_children(struct dentry *parent, int flag)
 	struct list_head *child;
 	struct dentry *de;
 
+	spin_lock(&dcache_lock);
 	list_for_each(child, &parent->d_subdirs)
 	{
 		de = list_entry(child, struct dentry, d_child);
@@ -239,6 +240,7 @@ static void coda_flag_children(struct dentry *parent, int flag)
 		       de->d_parent->d_name.len, de->d_parent->d_name.name);
 		coda_flag_inode(de->d_inode, flag);
 	}
+	spin_unlock(&dcache_lock);
 	return; 
 }
 
diff --git a/fs/coda/dir.c b/fs/coda/dir.c
index 0e6fa5625..66279990e 100644
--- a/fs/coda/dir.c
+++ b/fs/coda/dir.c
@@ -15,9 +15,10 @@
 #include <linux/stat.h>
 #include <linux/errno.h>
 #include <linux/locks.h>
-#include <asm/segment.h>
-#include <asm/uaccess.h>
 #include <linux/string.h>
+#include <linux/smp_lock.h>
+
+#include <asm/uaccess.h>
 
 #include <linux/coda.h>
 #include <linux/coda_linux.h>
@@ -479,7 +480,7 @@ static int coda_rename(struct inode *old_dir, struct dentry *old_dentry,
         CDEBUG(D_INODE, "old: %s, (%d length), new: %s"
 	       "(%d length). old:d_count: %d, new:d_count: %d\n", 
 	       old_name, old_length, new_name, new_length,
-	       old_dentry->d_count, new_dentry->d_count);
+	       atomic_read(&old_dentry->d_count), atomic_read(&new_dentry->d_count));
 
         error = venus_rename(old_dir->i_sb, coda_i2f(old_dir), 
 			     coda_i2f(new_dir), old_length, new_length, 
@@ -582,7 +583,7 @@ int coda_open(struct inode *i, struct file *f)
 	coda_vfs_stat.open++;
 
         CDEBUG(D_SPECIAL, "OPEN inode number: %ld, count %d, flags %o.\n", 
-	       f->f_dentry->d_inode->i_ino, f->f_dentry->d_count, flags);
+	       f->f_dentry->d_inode->i_ino, atomic_read(&f->f_dentry->d_count), flags);
 
 	error = venus_open(i->i_sb, coda_i2f(i), coda_flags, &ino, &dev); 
 	if (error) {
@@ -779,21 +780,21 @@ exit:
 /* called when a cache lookup succeeds */
 static int coda_dentry_revalidate(struct dentry *de, int flags)
 {
-	int valid = 1;
 	struct inode *inode = de->d_inode;
 	struct coda_inode_info *cii;
 	ENTRY;
 
 	if (!inode)
 		return 1;
+	lock_kernel();
 	if (coda_isroot(inode))
-		return 1;
+		goto out;
 	if (is_bad_inode(inode))
-		return 0;
+		goto bad;
 
 	cii = ITOC(de->d_inode);
 	if (! (cii->c_flags & (C_PURGE | C_FLUSH)) )
-		return valid;
+		goto out;
 
 	shrink_dcache_parent(de);
 
@@ -801,17 +802,22 @@ static int coda_dentry_revalidate(struct dentry *de, int flags)
 	if (cii->c_flags & C_FLUSH) 
 		coda_flag_inode_children(inode, C_FLUSH);
 
-	if (de->d_count > 1) {
+	if (atomic_read(&de->d_count) > 1) {
 		/* pretend it's valid, but don't change the flags */
 		CDEBUG(D_DOWNCALL, "BOOM for: ino %ld, %s\n",
 		       de->d_inode->i_ino, coda_f2s(&cii->c_fid));
-		return 1;
+		goto out;
 	}
 
 	/* clear the flags. */
 	cii->c_flags &= ~(C_VATTR | C_PURGE | C_FLUSH);
 
+bad:
+	unlock_kernel();
 	return 0;
+out:
+	unlock_kernel();
+	return 1;
 }
 
 /*
@@ -857,8 +863,9 @@ int coda_revalidate_inode(struct dentry *dentry)
 	       dentry->d_name.len, dentry->d_name.name,
 	       dentry->d_parent->d_name.len, dentry->d_parent->d_name.name);
 
+	lock_kernel();
 	if ( cii->c_flags == 0 )
-		return 0;
+		goto ok;
 
 	if (cii->c_flags & (C_VATTR | C_PURGE | C_FLUSH)) {
 		error = venus_getattr(inode->i_sb, &(cii->c_fid), &attr);
@@ -890,6 +897,8 @@ int coda_revalidate_inode(struct dentry *dentry)
 		cii->c_flags &= ~(C_VATTR | C_PURGE | C_FLUSH);
 	}
 
+ok:
+	unlock_kernel();
 	return 0;
 
 return_bad_inode:
@@ -899,6 +908,7 @@ return_bad_inode:
 		iput(container);
 	}
 	make_bad_inode(inode);
+	unlock_kernel();
 	return -EIO;
 }
 
diff --git a/fs/coda/pioctl.c b/fs/coda/pioctl.c
index d97204125..dd2636895 100644
--- a/fs/coda/pioctl.c
+++ b/fs/coda/pioctl.c
@@ -120,7 +120,7 @@ static int coda_pioctl(struct inode * inode, struct file * filp,
 
         CDEBUG(D_PIOCTL, "ioctl on inode %ld\n", target_inode->i_ino);
 	CDEBUG(D_DOWNCALL, "dput on ino: %ld, icount %d, dcount %d\n", target_inode->i_ino, 
-	       atomic_read(&target_inode->i_count), nd.dentry->d_count);
+	       atomic_read(&target_inode->i_count), atomic_read(&nd.dentry->d_count));
 	path_release(&nd);
         return error;
 }
diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index 14fe68ad4..695e4158c 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -391,7 +391,7 @@ int init_coda_psdev(void)
 		     CODA_PSDEV_MAJOR);
               return -EIO;
 	}
-	devfs_handle = devfs_mk_dir (NULL, "coda", 4, NULL);
+	devfs_handle = devfs_mk_dir (NULL, "coda", NULL);
 	devfs_register_series (devfs_handle, "%u", MAX_CODADEVS, DEVFS_FL_NONE,
 			       CODA_PSDEV_MAJOR, 0,
 			       S_IFCHR | S_IRUSR | S_IWUSR,
diff --git a/fs/coda/symlink.c b/fs/coda/symlink.c
index 81ac4dfda..252f11664 100644
--- a/fs/coda/symlink.c
+++ b/fs/coda/symlink.c
@@ -14,6 +14,7 @@
 #include <linux/stat.h>
 #include <linux/errno.h>
 #include <linux/locks.h>
+#include <linux/smp_lock.h>
 
 #include <linux/coda.h>
 #include <linux/coda_linux.h>
@@ -30,10 +31,12 @@ static int coda_symlink_filler(struct file *file, struct page *page)
 	unsigned int len = PAGE_SIZE;
 	char *p = (char*)kmap(page);
 
+	lock_kernel();
         cnp = ITOC(inode);
 	coda_vfs_stat.follow_link++;
 
 	error = venus_readlink(inode->i_sb, &(cnp->c_fid), p, &len);
+	unlock_kernel();
 	if (error)
 		goto fail;
 	SetPageUptodate(page);
diff --git a/fs/dcache.c b/fs/dcache.c
index ad897ff38..c0c94ff1e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -28,6 +28,8 @@
 #define DCACHE_PARANOIA 1
 /* #define DCACHE_DEBUG 1 */
 
+spinlock_t dcache_lock = SPIN_LOCK_UNLOCKED;
+
 /* Right now the dcache depends on the kernel lock */
 #define check_lock()	if (!kernel_locked()) BUG()
 
@@ -57,6 +59,7 @@ struct {
 	int dummy[2];
 } dentry_stat = {0, 0, 45, 0,};
 
+/* no dcache_lock, please */
 static inline void d_free(struct dentry *dentry)
 {
 	if (dentry->d_op && dentry->d_op->d_release)
@@ -69,6 +72,7 @@ static inline void d_free(struct dentry *dentry)
 /*
  * Release the dentry's inode, using the fileystem
  * d_iput() operation if defined.
+ * Called with dcache_lock held, drops it.
  */
 static inline void dentry_iput(struct dentry * dentry)
 {
@@ -77,11 +81,13 @@ static inline void dentry_iput(struct dentry * dentry)
 		dentry->d_inode = NULL;
 		list_del(&dentry->d_alias);
 		INIT_LIST_HEAD(&dentry->d_alias);
+		spin_unlock(&dcache_lock);
 		if (dentry->d_op && dentry->d_op->d_iput)
 			dentry->d_op->d_iput(dentry, inode);
 		else
 			iput(inode);
-	}
+	} else
+		spin_unlock(&dcache_lock);
 }
 
 /* 
@@ -109,52 +115,35 @@ static inline void dentry_iput(struct dentry * dentry)
  * call the dentry unlink method as well as removing it from the queues and
  * releasing its resources. If the parent dentries were scheduled for release
  * they too may now get deleted.
+ *
+ * no dcache lock, please.
+ *
+ * Note: dput() itself is inlined and uses __dput() for slow path (after
+ * decrementing the ->d_count on the argument and finding it zero).
  */
 
-void dput(struct dentry *dentry)
+void __dput(struct dentry *dentry)
 {
-	int count;
-
-	check_lock();
-
-	if (!dentry)
-		return;
-
+	struct dentry * parent;
 repeat:
-	count = dentry->d_count - 1;
-	if (count != 0)
+	spin_lock(&dcache_lock);
+	if (atomic_read(&dentry->d_count))
 		goto out;
-
 	/*
-	 * Note that if d_op->d_delete blocks,
-	 * the dentry could go back in use.
-	 * Each fs will have to watch for this.
+	 * AV: ->d_delete() is _NOT_ allowed to block now.
 	 */
 	if (dentry->d_op && dentry->d_op->d_delete) {
-		if (dentry->d_op->d_delete(dentry))
-			d_drop(dentry);
-
-		count = dentry->d_count - 1;
-		if (count != 0)
-			goto out;
+		if (dentry->d_op->d_delete(dentry)) {
+			list_del(&dentry->d_hash);
+			goto kill_it;
+		}
 	}
-
+	if (list_empty(&dentry->d_hash))
+		goto kill_it;
 	if (!list_empty(&dentry->d_lru)) {
 		dentry_stat.nr_unused--;
 		list_del(&dentry->d_lru);
 	}
-	if (list_empty(&dentry->d_hash)) {
-		struct dentry * parent;
-
-		list_del(&dentry->d_child);
-		dentry_iput(dentry);
-		parent = dentry->d_parent;
-		d_free(dentry);
-		if (dentry == parent)
-			return;
-		dentry = parent;
-		goto repeat;
-	}
 	list_add(&dentry->d_lru, &dentry_unused);
 	dentry_stat.nr_unused++;
 	/*
@@ -163,16 +152,23 @@ repeat:
 	dentry->d_reftime = jiffies;
 
 out:
-	if (count >= 0) {
-		dentry->d_count = count;
-		return;
+	spin_unlock(&dcache_lock);
+	return;
+kill_it:
+	if (!list_empty(&dentry->d_lru)) {
+		dentry_stat.nr_unused--;
+		list_del(&dentry->d_lru);
 	}
-
-	printk(KERN_CRIT "Negative d_count (%d) for %s/%s\n",
-		count,
-		dentry->d_parent->d_name.name,
-		dentry->d_name.name);
-	BUG();
+	list_del(&dentry->d_child);
+	/* drops the lock, at that point nobody can reach this dentry */
+	dentry_iput(dentry);
+	parent = dentry->d_parent;
+	d_free(dentry);
+	if (dentry == parent)
+		return;
+	dentry = parent;
+	if (atomic_dec_and_test(&dentry->d_count))
+		goto repeat;
 }
 
 /**
@@ -183,23 +179,28 @@ out:
  * possible. If there are other dentries that can be
  * reached through this one we can't delete it and we
  * return -EBUSY. On success we return 0.
+ *
+ * no dcache lock.
  */
  
 int d_invalidate(struct dentry * dentry)
 {
-	check_lock();
-
 	/*
 	 * If it's already been dropped, return OK.
 	 */
-	if (list_empty(&dentry->d_hash))
+	spin_lock(&dcache_lock);
+	if (list_empty(&dentry->d_hash)) {
+		spin_unlock(&dcache_lock);
 		return 0;
+	}
 	/*
 	 * Check whether to do a partial shrink_dcache
 	 * to get rid of unused child entries.
 	 */
 	if (!list_empty(&dentry->d_subdirs)) {
+		spin_unlock(&dcache_lock);
 		shrink_dcache_parent(dentry);
+		spin_lock(&dcache_lock);
 	}
 
 	/*
@@ -212,12 +213,16 @@ int d_invalidate(struct dentry * dentry)
 	 * we might still populate it if it was a
 	 * working directory or similar).
 	 */
-	if (dentry->d_count > 1) {
-		if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))
+	if (atomic_read(&dentry->d_count) > 1) {
+		if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode)) {
+			spin_unlock(&dcache_lock);
 			return -EBUSY;
+		}
 	}
 
-	d_drop(dentry);
+	list_del(&dentry->d_hash);
+	INIT_LIST_HEAD(&dentry->d_hash);
+	spin_unlock(&dcache_lock);
 	return 0;
 }
 
@@ -236,15 +241,20 @@ struct dentry * d_find_alias(struct inode *inode)
 	struct list_head *head, *next, *tmp;
 	struct dentry *alias;
 
+	spin_lock(&dcache_lock);
 	head = &inode->i_dentry;
 	next = inode->i_dentry.next;
 	while (next != head) {
 		tmp = next;
 		next = tmp->next;
 		alias = list_entry(tmp, struct dentry, d_alias);
-		if (!d_unhashed(alias))
-			return dget(alias);
+		if (!list_empty(&alias->d_hash)) {
+			dget(alias);
+			spin_unlock(&dcache_lock);
+			return alias;
+		}
 	}
+	spin_unlock(&dcache_lock);
 	return NULL;
 }
 
@@ -256,22 +266,26 @@ void d_prune_aliases(struct inode *inode)
 {
 	struct list_head *tmp, *head = &inode->i_dentry;
 restart:
+	spin_lock(&dcache_lock);
 	tmp = head;
 	while ((tmp = tmp->next) != head) {
 		struct dentry *dentry = list_entry(tmp, struct dentry, d_alias);
-		if (!dentry->d_count) {
+		if (!atomic_read(&dentry->d_count)) {
 			dget(dentry);
+			spin_unlock(&dcache_lock);
 			d_drop(dentry);
 			dput(dentry);
 			goto restart;
 		}
 	}
+	spin_unlock(&dcache_lock);
 }
 
 /*
  * Throw away a dentry - free the inode, dput the parent.
  * This requires that the LRU list has already been
  * removed.
+ * Called with dcache_lock, drops it and then regains.
  */
 static inline void prune_one_dentry(struct dentry * dentry)
 {
@@ -284,6 +298,7 @@ static inline void prune_one_dentry(struct dentry * dentry)
 	d_free(dentry);
 	if (parent != dentry)
 		dput(parent);
+	spin_lock(&dcache_lock);
 }
 
 /**
@@ -301,10 +316,12 @@ static inline void prune_one_dentry(struct dentry * dentry)
  
 void prune_dcache(int count)
 {
-	check_lock();
+	spin_lock(&dcache_lock);
 	for (;;) {
 		struct dentry *dentry;
-		struct list_head *tmp = dentry_unused.prev;
+		struct list_head *tmp;
+
+		tmp = dentry_unused.prev;
 
 		if (tmp == &dentry_unused)
 			break;
@@ -312,12 +329,13 @@ void prune_dcache(int count)
 		list_del(tmp);
 		INIT_LIST_HEAD(tmp);
 		dentry = list_entry(tmp, struct dentry, d_lru);
-		if (!dentry->d_count) {
+		if (!atomic_read(&dentry->d_count)) {
 			prune_one_dentry(dentry);
 			if (!--count)
 				break;
 		}
 	}
+	spin_unlock(&dcache_lock);
 }
 
 /*
@@ -347,12 +365,11 @@ void shrink_dcache_sb(struct super_block * sb)
 	struct list_head *tmp, *next;
 	struct dentry *dentry;
 
-	check_lock();
-
 	/*
 	 * Pass one ... move the dentries for the specified
 	 * superblock to the most recent end of the unused list.
 	 */
+	spin_lock(&dcache_lock);
 	next = dentry_unused.next;
 	while (next != &dentry_unused) {
 		tmp = next;
@@ -375,7 +392,7 @@ repeat:
 		dentry = list_entry(tmp, struct dentry, d_lru);
 		if (dentry->d_sb != sb)
 			continue;
-		if (dentry->d_count)
+		if (atomic_read(&dentry->d_count))
 			continue;
 		dentry_stat.nr_unused--;
 		list_del(tmp);
@@ -383,6 +400,7 @@ repeat:
 		prune_one_dentry(dentry);
 		goto repeat;
 	}
+	spin_unlock(&dcache_lock);
 }
 
 /*
@@ -404,8 +422,9 @@ int have_submounts(struct dentry *parent)
 	struct dentry *this_parent = parent;
 	struct list_head *next;
 
+	spin_lock(&dcache_lock);
 	if (d_mountpoint(parent))
-		return 1;
+		goto positive;
 repeat:
 	next = this_parent->d_subdirs.next;
 resume:
@@ -415,7 +434,7 @@ resume:
 		next = tmp->next;
 		/* Have we found a mount point ? */
 		if (d_mountpoint(dentry))
-			return 1;
+			goto positive;
 		if (!list_empty(&dentry->d_subdirs)) {
 			this_parent = dentry;
 			goto repeat;
@@ -429,7 +448,11 @@ resume:
 		this_parent = this_parent->d_parent;
 		goto resume;
 	}
+	spin_unlock(&dcache_lock);
 	return 0; /* No mount points found in tree */
+positive:
+	spin_unlock(&dcache_lock);
+	return 1;
 }
 
 /*
@@ -445,8 +468,7 @@ static int select_parent(struct dentry * parent)
 	struct list_head *next;
 	int found = 0;
 
-	check_lock();
-
+	spin_lock(&dcache_lock);
 repeat:
 	next = this_parent->d_subdirs.next;
 resume:
@@ -454,7 +476,7 @@ resume:
 		struct list_head *tmp = next;
 		struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
 		next = tmp->next;
-		if (!dentry->d_count) {
+		if (!atomic_read(&dentry->d_count)) {
 			list_del(&dentry->d_lru);
 			list_add(&dentry->d_lru, dentry_unused.prev);
 			found++;
@@ -483,6 +505,7 @@ this_parent->d_parent->d_name.name, this_parent->d_name.name, found);
 #endif
 		goto resume;
 	}
+	spin_unlock(&dcache_lock);
 	return found;
 }
 
@@ -515,11 +538,9 @@ void shrink_dcache_parent(struct dentry * parent)
 int shrink_dcache_memory(int priority, unsigned int gfp_mask)
 {
 	int count = 0;
-	lock_kernel();
 	if (priority)
 		count = dentry_stat.nr_unused / priority;
 	prune_dcache(count);
-	unlock_kernel();
 	/* FIXME: kmem_cache_shrink here should tell us
 	   the number of pages freed, and it should
 	   work in a __GFP_DMA/__GFP_HIGHMEM behaviour
@@ -563,29 +584,30 @@ struct dentry * d_alloc(struct dentry * parent, const struct qstr *name)
 	memcpy(str, name->name, name->len);
 	str[name->len] = 0;
 
-	dentry->d_count = 1;
+	atomic_set(&dentry->d_count, 1);
 	dentry->d_flags = 0;
 	dentry->d_inode = NULL;
 	dentry->d_parent = NULL;
 	dentry->d_sb = NULL;
+	dentry->d_name.name = str;
+	dentry->d_name.len = name->len;
+	dentry->d_name.hash = name->hash;
+	dentry->d_op = NULL;
+	dentry->d_fsdata = NULL;
+	INIT_LIST_HEAD(&dentry->d_vfsmnt);
+	INIT_LIST_HEAD(&dentry->d_hash);
+	INIT_LIST_HEAD(&dentry->d_lru);
+	INIT_LIST_HEAD(&dentry->d_subdirs);
+	INIT_LIST_HEAD(&dentry->d_alias);
 	if (parent) {
 		dentry->d_parent = dget(parent);
 		dentry->d_sb = parent->d_sb;
+		spin_lock(&dcache_lock);
 		list_add(&dentry->d_child, &parent->d_subdirs);
+		spin_unlock(&dcache_lock);
 	} else
 		INIT_LIST_HEAD(&dentry->d_child);
-		
-	INIT_LIST_HEAD(&dentry->d_vfsmnt);
-	INIT_LIST_HEAD(&dentry->d_hash);
-	INIT_LIST_HEAD(&dentry->d_lru);
-	INIT_LIST_HEAD(&dentry->d_subdirs);
-	INIT_LIST_HEAD(&dentry->d_alias);
 
-	dentry->d_name.name = str;
-	dentry->d_name.len = name->len;
-	dentry->d_name.hash = name->hash;
-	dentry->d_op = NULL;
-	dentry->d_fsdata = NULL;
 	return dentry;
 }
 
@@ -606,9 +628,11 @@ struct dentry * d_alloc(struct dentry * parent, const struct qstr *name)
  
 void d_instantiate(struct dentry *entry, struct inode * inode)
 {
+	spin_lock(&dcache_lock);
 	if (inode)
 		list_add(&entry->d_alias, &inode->i_dentry);
 	entry->d_inode = inode;
+	spin_unlock(&dcache_lock);
 }
 
 /**
@@ -659,10 +683,10 @@ struct dentry * d_lookup(struct dentry * parent, struct qstr * name)
 	unsigned int hash = name->hash;
 	const unsigned char *str = name->name;
 	struct list_head *head = d_hash(parent,hash);
-	struct list_head *tmp = head->next;
-
-	check_lock();
+	struct list_head *tmp;
 
+	spin_lock(&dcache_lock);
+	tmp = head->next;
 	for (;;) {
 		struct dentry * dentry = list_entry(tmp, struct dentry, d_hash);
 		if (tmp == head)
@@ -681,8 +705,11 @@ struct dentry * d_lookup(struct dentry * parent, struct qstr * name)
 			if (memcmp(dentry->d_name.name, str, len))
 				continue;
 		}
-		return dget(dentry);
+		dget(dentry);
+		spin_unlock(&dcache_lock);
+		return dentry;
 	}
+	spin_unlock(&dcache_lock);
 	return NULL;
 }
 
@@ -693,7 +720,7 @@ struct dentry * d_lookup(struct dentry * parent, struct qstr * name)
  * @hash: Hash of the dentry
  * @len: Length of the name
  *
- * An insecure source has sent us a dentry, here we verify it.
+ * An insecure source has sent us a dentry, here we verify it and dget() it.
  * This is used by ncpfs in its readdir implementation.
  * Zero is returned in the dentry is invalid.
  *
@@ -709,14 +736,15 @@ int d_validate(struct dentry *dentry, struct dentry *dparent,
 	struct list_head *base, *lhp;
 	int valid = 1;
 
-	check_lock();
-
+	spin_lock(&dcache_lock);
 	if (dentry != dparent) {
 		base = d_hash(dparent, hash);
 		lhp = base;
 		while ((lhp = lhp->next) != base) {
-			if (dentry == list_entry(lhp, struct dentry, d_hash))
+			if (dentry == list_entry(lhp, struct dentry, d_hash)) {
+				dget(dentry);
 				goto out;
+			}
 		}
 	} else {
 		/*
@@ -729,12 +757,15 @@ int d_validate(struct dentry *dentry, struct dentry *dparent,
 		     sb = sb_entry(sb->s_list.next)) {
 			if (!sb->s_dev)
 				continue;
-			if (sb->s_root == dentry)
+			if (sb->s_root == dentry) {
+				dget(dentry);
 				goto out;
+			}
 		}
 	}
 	valid = 0;
 out:
+	spin_unlock(&dcache_lock);
 	return valid;
 }
 
@@ -761,15 +792,15 @@ out:
  
 void d_delete(struct dentry * dentry)
 {
-	check_lock();
-
 	/*
 	 * Are we the only user?
 	 */
-	if (dentry->d_count == 1) {
+	spin_lock(&dcache_lock);
+	if (atomic_read(&dentry->d_count) == 1) {
 		dentry_iput(dentry);
 		return;
 	}
+	spin_unlock(&dcache_lock);
 
 	/*
 	 * If not, just drop the dentry and let dput
@@ -787,9 +818,10 @@ void d_delete(struct dentry * dentry)
  
 void d_rehash(struct dentry * entry)
 {
-	struct dentry * parent = entry->d_parent;
-
-	list_add(&entry->d_hash, d_hash(parent, entry->d_name.hash));
+	struct list_head *list = d_hash(entry->d_parent, entry->d_name.hash);
+	spin_lock(&dcache_lock);
+	list_add(&entry->d_hash, list);
+	spin_unlock(&dcache_lock);
 }
 
 #define do_switch(x,y) do { \
@@ -855,6 +887,7 @@ void d_move(struct dentry * dentry, struct dentry * target)
 	if (!dentry->d_inode)
 		printk(KERN_WARNING "VFS: moving negative dcache entry\n");
 
+	spin_lock(&dcache_lock);
 	/* Move the dentry to the target hash queue */
 	list_del(&dentry->d_hash);
 	list_add(&dentry->d_hash, &target->d_hash);
@@ -875,6 +908,7 @@ void d_move(struct dentry * dentry, struct dentry * target)
 	/* And add them back to the (new) parent lists */
 	list_add(&target->d_child, &target->d_parent->d_subdirs);
 	list_add(&dentry->d_child, &dentry->d_parent->d_subdirs);
+	spin_unlock(&dcache_lock);
 }
 
 /**
@@ -887,7 +921,7 @@ void d_move(struct dentry * dentry, struct dentry * target)
  * the string " (deleted)" is appended. Note that this is ambiguous. Returns
  * the buffer.
  *
- * "buflen" should be %PAGE_SIZE or more.
+ * "buflen" should be %PAGE_SIZE or more. Caller holds the dcache_lock.
  */
 char * __d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
 		struct dentry *root, struct vfsmount *rootmnt,
@@ -938,10 +972,10 @@ global_root:
 	namelen = dentry->d_name.len;
 	buflen -= namelen;
 	if (buflen >= 0) {
-		end -= namelen;
-		memcpy(end, dentry->d_name.name, namelen);
+		retval -= namelen-1;	/* hit the slash */
+		memcpy(retval, dentry->d_name.name, namelen);
 	}
-	return end;
+	return retval;
 }
 
 /*
@@ -965,37 +999,44 @@ global_root:
 asmlinkage long sys_getcwd(char *buf, unsigned long size)
 {
 	int error;
-	struct vfsmount *pwdmnt;
-	struct dentry *pwd;
+	struct vfsmount *pwdmnt, *rootmnt;
+	struct dentry *pwd, *root;
+	char *page = (char *) __get_free_page(GFP_USER);
+
+	if (!page)
+		return -ENOMEM;
 
-	lock_kernel();
+	read_lock(&current->fs->lock);
 	pwdmnt = mntget(current->fs->pwdmnt);
 	pwd = dget(current->fs->pwd);
+	rootmnt = mntget(current->fs->rootmnt);
+	root = dget(current->fs->root);
+	read_unlock(&current->fs->lock);
 
 	error = -ENOENT;
 	/* Has the current directory has been unlinked? */
+	spin_lock(&dcache_lock);
 	if (pwd->d_parent == pwd || !list_empty(&pwd->d_hash)) {
-		char *page = (char *) __get_free_page(GFP_USER);
-		error = -ENOMEM;
-		if (page) {
-			unsigned long len;
-			char * cwd;
-
-			cwd = d_path(pwd, current->fs->pwdmnt, page, PAGE_SIZE);
-
-			error = -ERANGE;
-			len = PAGE_SIZE + page - cwd;
-			if (len <= size) {
-				error = len;
-				if (copy_to_user(buf, cwd, len))
-					error = -EFAULT;
-			}
-			free_page((unsigned long) page);
+		unsigned long len;
+		char * cwd;
+
+		cwd = __d_path(pwd, pwdmnt, root, rootmnt, page, PAGE_SIZE);
+		spin_unlock(&dcache_lock);
+
+		error = -ERANGE;
+		len = PAGE_SIZE + page - cwd;
+		if (len <= size) {
+			error = len;
+			if (copy_to_user(buf, cwd, len))
+				error = -EFAULT;
 		}
-	}
+	} else
+		spin_unlock(&dcache_lock);
 	dput(pwd);
 	mntput(pwdmnt);
-	unlock_kernel();
+	dput(root);
+	mntput(rootmnt);
+	free_page((unsigned long) page);
 	return error;
 }
 
@@ -1038,6 +1079,7 @@ void d_genocide(struct dentry *root)
 	struct dentry *this_parent = root;
 	struct list_head *next;
 
+	spin_lock(&dcache_lock);
 repeat:
 	next = this_parent->d_subdirs.next;
 resume:
@@ -1051,14 +1093,15 @@ resume:
 			this_parent = dentry;
 			goto repeat;
 		}
-		dentry->d_count--;
+		atomic_dec(&dentry->d_count);
 	}
 	if (this_parent != root) {
 		next = this_parent->d_child.next; 
-		this_parent->d_count--;
+		atomic_dec(&this_parent->d_count);
 		this_parent = this_parent->d_parent;
 		goto resume;
 	}
+	spin_unlock(&dcache_lock);
 }
 
 /**
diff --git a/fs/devfs/base.c b/fs/devfs/base.c
index 0d3d15177..18c51e28c 100644
--- a/fs/devfs/base.c
+++ b/fs/devfs/base.c
@@ -476,6 +476,11 @@
 	       Changed interface to <devfs_register>.
 	       Work sponsored by SGI.
   v0.101
+    20000622   Richard Gooch <rgooch@atnf.csiro.au>
+	       Simplified interface to <devfs_mk_symlink> and <devfs_mk_dir>.
+	       Simplified interface to <devfs_find_handle>.
+	       Work sponsored by SGI.
+  v0.102
 */
 #include <linux/types.h>
 #include <linux/errno.h>
@@ -510,7 +515,7 @@
 #include <asm/bitops.h>
 #include <asm/atomic.h>
 
-#define DEVFS_VERSION            "0.101 (20000621)"
+#define DEVFS_VERSION            "0.102 (20000622)"
 
 #define DEVFS_NAME "devfs"
 
@@ -1440,27 +1445,19 @@ void devfs_unregister (devfs_handle_t de)
  *	@dir: The handle to the parent devfs directory entry. If this is %NULL the
  *		new name is relative to the root of the devfs.
  *	@name: The name of the entry.
- *	@namelen: The number of characters in @name, not including a %NULL
- *		terminator. If this is 0, then @name must be %NULL-terminated and the
- *		length is computed internally.
  *	@flags: A set of bitwise-ORed flags (DEVFS_FL_*).
  *	@link: The destination name.
- *	@linklength: The number of characters in @link, not including a %NULL
- *		terminator. If this is 0, then @link must be %NULL-terminated and the
- *		length is computed internally.
  *	@handle: The handle to the symlink entry is written here. This may be %NULL.
  *	@info: An arbitrary pointer which will be associated with the entry.
  *
  *	Returns 0 on success, else a negative error code is returned.
  */
 
-int devfs_mk_symlink (devfs_handle_t dir,
-		      const char *name, unsigned int namelen,
-		      unsigned int flags,
-		      const char *link, unsigned int linklength,
-		      devfs_handle_t *handle, void *info)
+int devfs_mk_symlink (devfs_handle_t dir, const char *name, unsigned int flags,
+		      const char *link, devfs_handle_t *handle, void *info)
 {
     int is_new;
+    unsigned int linklength;
     char *newname;
     struct devfs_entry *de;
 
@@ -1474,14 +1471,14 @@ int devfs_mk_symlink (devfs_handle_t dir,
     if (devfs_debug & DEBUG_REGISTER)
 	printk ("%s: devfs_mk_symlink(%s)\n", DEVFS_NAME, name);
 #endif
-    if (namelen < 1) namelen = strlen (name);
     if (link == NULL)
     {
 	printk ("%s: devfs_mk_symlink(): NULL link pointer\n", DEVFS_NAME);
 	return -EINVAL;
     }
-    if (linklength < 1) linklength = strlen (link);
-    de = search_for_entry (dir, name, namelen, TRUE, TRUE, &is_new, FALSE);
+    linklength = strlen (link);
+    de = search_for_entry (dir, name, strlen (name), TRUE, TRUE, &is_new,
+			   FALSE);
     if (de == NULL) return -ENOMEM;
     if (!S_ISLNK (de->mode) && de->registered)
     {
@@ -1493,7 +1490,7 @@ int devfs_mk_symlink (devfs_handle_t dir,
     de->mode = S_IFLNK | S_IRUGO | S_IXUGO;
     de->info = info;
     de->show_unreg = ( (boot_options & OPTION_SHOW)
-			|| (flags & DEVFS_FL_SHOW_UNREG) ) ? TRUE : FALSE;
+		       || (flags & DEVFS_FL_SHOW_UNREG) ) ? TRUE : FALSE;
     de->hide = (flags & DEVFS_FL_HIDE) ? TRUE : FALSE;
     /*  Note there is no need to fiddle the dentry cache if the symlink changes
 	as the symlink follow method is called every time it's needed  */
@@ -1533,9 +1530,6 @@ int devfs_mk_symlink (devfs_handle_t dir,
  *	@dir: The handle to the parent devfs directory entry. If this is %NULL the
  *		new name is relative to the root of the devfs.
  *	@name: The name of the entry.
- *	@namelen: The number of characters in @name, not including a %NULL
- *		terminator. If this is 0, then @name must be %NULL-terminated and the
- *		length is computed internally.
  *	@info: An arbitrary pointer which will be associated with the entry.
  *
  *	Use of this function is optional. The devfs_register() function
@@ -1545,8 +1539,7 @@ int devfs_mk_symlink (devfs_handle_t dir,
  *	On failure %NULL is returned.
  */
 
-devfs_handle_t devfs_mk_dir (devfs_handle_t dir, const char *name,
-			     unsigned int namelen, void *info)
+devfs_handle_t devfs_mk_dir (devfs_handle_t dir, const char *name, void *info)
 {
     int is_new;
     struct devfs_entry *de;
@@ -1556,8 +1549,8 @@ devfs_handle_t devfs_mk_dir (devfs_handle_t dir, const char *name,
 	printk ("%s: devfs_mk_dir(): NULL name pointer\n", DEVFS_NAME);
 	return NULL;
     }
-    if (namelen < 1) namelen = strlen (name);
-    de = search_for_entry (dir, name, namelen, TRUE, TRUE, &is_new, FALSE);
+    de = search_for_entry (dir, name, strlen (name), TRUE, TRUE, &is_new,
+			   FALSE);
     if (de == NULL)
     {
 	printk ("%s: devfs_mk_dir(): could not create entry: \"%s\"\n",
@@ -1596,9 +1589,6 @@ devfs_handle_t devfs_mk_dir (devfs_handle_t dir, const char *name,
  *	@dir: The handle to the parent devfs directory entry. If this is %NULL the
  *		name is relative to the root of the devfs.
  *	@name: The name of the entry.
- *	@namelen: The number of characters in @name, not including a %NULL
- *		terminator. If this is 0, then @name must be %NULL-terminated and the
- *		length is computed internally.
  *	@major: The major number. This is used if @name is %NULL.
  *	@minor: The minor number. This is used if @name is %NULL.
  *	@type: The type of special file to search for. This may be either
@@ -1611,15 +1601,14 @@ devfs_handle_t devfs_mk_dir (devfs_handle_t dir, const char *name,
  *	devfs_get_flags(), or devfs_set_flags(). On failure %NULL is returned.
  */
 
-devfs_handle_t devfs_find_handle (devfs_handle_t dir,
-				  const char *name, unsigned int namelen,
+devfs_handle_t devfs_find_handle (devfs_handle_t dir, const char *name,
 				  unsigned int major, unsigned int minor,
 				  char type, int traverse_symlinks)
 {
     devfs_handle_t de;
 
     if ( (name != NULL) && (name[0] == '\0') ) name = NULL;
-    de = find_entry (dir, name, namelen, major, minor, type,
+    de = find_entry (dir, name, 0, major, minor, type,
 		     traverse_symlinks);
     if (de == NULL) return NULL;
     if (!de->registered) return NULL;
@@ -2306,7 +2295,7 @@ static void devfs_read_inode (struct inode *inode)
 #endif
 }   /*  End Function devfs_read_inode  */
 
-static void devfs_write_inode (struct inode *inode, int unused)
+static void devfs_write_inode (struct inode *inode)
 {
     int index;
     struct devfs_entry *de;
@@ -2564,6 +2553,7 @@ static void devfs_d_iput (struct dentry *dentry, struct inode *inode)
 {
     struct devfs_entry *de;
 
+    lock_kernel();
     de = get_devfs_entry_from_vfs_inode (inode);
 #ifdef CONFIG_DEVFS_DEBUG
     if (devfs_debug & DEBUG_D_IPUT)
@@ -2574,6 +2564,7 @@ static void devfs_d_iput (struct dentry *dentry, struct inode *inode)
     {
 	de->inode.dentry = NULL;
     }
+    unlock_kernel();
     iput (inode);
 }   /*  End Function devfs_d_iput  */
 
@@ -2647,9 +2638,12 @@ static int devfs_d_delete (struct dentry *dentry)
 static int devfs_d_revalidate_wait (struct dentry *dentry, int flags)
 {
     devfs_handle_t de = dentry->d_fsdata;
-    struct inode *dir = dentry->d_parent->d_inode;
-    struct fs_info *fs_info = dir->i_sb->u.generic_sbp;
+    struct inode *dir;
+    struct fs_info *fs_info;
 
+    lock_kernel();
+    dir = dentry->d_parent->d_inode;
+    fs_info = dir->i_sb->u.generic_sbp;
     if (!de || de->registered)
     {
 	if ( !dentry->d_inode && is_devfsd_or_child (fs_info) )
@@ -2675,7 +2669,7 @@ static int devfs_d_revalidate_wait (struct dentry *dentry, int flags)
 		de = search_for_entry_in_dir (parent, dentry->d_name.name,
 					      dentry->d_name.len, FALSE);
 	    }
-	    if (de == NULL) return 1;
+	    if (de == NULL) goto out;
 	    /*  Create an inode, now that the driver information is available
 	     */
 	    if (de->no_persistence) update_devfs_inode_from_entry (de);
@@ -2683,17 +2677,19 @@ static int devfs_d_revalidate_wait (struct dentry *dentry, int flags)
 	    else de->inode.mode =
 		     (de->mode & ~S_IALLUGO) | (de->inode.mode & S_IALLUGO);
 	    if ( ( inode = get_vfs_inode (dir->i_sb, de, dentry) ) == NULL )
-		return 1;
+		goto out;
 #ifdef CONFIG_DEVFS_DEBUG
 	    if (devfs_debug & DEBUG_I_LOOKUP)
 		printk ("%s: d_revalidate(): new VFS inode(%u): %p  devfs_entry: %p\n",
 			DEVFS_NAME, de->inode.ino, inode, de);
 #endif
 	    d_instantiate (dentry, inode);
-	    return 1;
+	    goto out;
 	}
     }
     if ( wait_for_devfsd_finished (fs_info) ) dentry->d_op = &devfs_dops;
+out:
+    unlock_kernel();
     return 1;
 }   /*  End Function devfs_d_revalidate_wait  */
 
@@ -2857,8 +2853,8 @@ static int devfs_symlink (struct inode *dir, struct dentry *dentry,
     parent = get_devfs_entry_from_vfs_inode (dir);
     if (parent == NULL) return -EINVAL;
     if (!parent->registered) return -ENOENT;
-    err = devfs_mk_symlink (parent, dentry->d_name.name, dentry->d_name.len,
-			    DEVFS_FL_NONE, symname, 0, &de, NULL);
+    err = devfs_mk_symlink (parent, dentry->d_name.name, DEVFS_FL_NONE,
+			    symname, &de, NULL);
 #ifdef CONFIG_DEVFS_DEBUG
     if (devfs_debug & DEBUG_DISABLED)
 	printk ("%s: symlink(): errcode from <devfs_mk_symlink>: %d\n",
@@ -3046,14 +3042,20 @@ static int devfs_mknod (struct inode *dir, struct dentry *dentry, int mode,
 
 static int devfs_readlink (struct dentry *dentry, char *buffer, int buflen)
 {
-    struct devfs_entry *de = get_devfs_entry_from_vfs_inode (dentry->d_inode);
+    struct devfs_entry *de;
+    lock_kernel();
+    de = get_devfs_entry_from_vfs_inode (dentry->d_inode);
+    unlock_kernel();
 
     return vfs_readlink (dentry, buffer, buflen, de->u.symlink.linkname);
 }   /*  End Function devfs_readlink  */
 
 static int devfs_follow_link (struct dentry *dentry, struct nameidata *nd)
 {
-    struct devfs_entry *de = get_devfs_entry_from_vfs_inode (dentry->d_inode);
+    struct devfs_entry *de;
+    lock_kernel();
+    de = get_devfs_entry_from_vfs_inode (dentry->d_inode);
+    unlock_kernel();
 
     return vfs_follow_link (nd, de->u.symlink.linkname);
 }   /*  End Function devfs_follow_link  */
diff --git a/fs/devfs/util.c b/fs/devfs/util.c
index 6e3f2f782..9f71763b1 100644
--- a/fs/devfs/util.c
+++ b/fs/devfs/util.c
@@ -30,6 +30,9 @@
                Changed operations pointer type to void *.
     20000621   Richard Gooch <rgooch@atnf.csiro.au>
                Changed interface to <devfs_register_series>.
+    20000622   Richard Gooch <rgooch@atnf.csiro.au>
+               Took account of interface change to <devfs_mk_symlink>.
+               Took account of interface change to <devfs_mk_dir>.
 */
 #include <linux/module.h>
 #include <linux/init.h>
@@ -97,7 +100,7 @@ void __init devfs_make_root (const char *name)
 	_devfs_convert_name (dest + 2, name + 7, (name[4] == 'h') ? 1 : 0);
     }
     else return;
-    devfs_mk_symlink (NULL, name, 0, DEVFS_FL_DEFAULT, dest, 0, NULL,NULL);
+    devfs_mk_symlink (NULL, name, DEVFS_FL_DEFAULT, dest, NULL, NULL);
 }   /*  End Function devfs_make_root  */
 
 
@@ -114,13 +117,13 @@ void devfs_register_tape (devfs_handle_t de)
     static unsigned int tape_counter = 0;
     static devfs_handle_t tape_dir = NULL;
 
-    if (tape_dir == NULL) tape_dir = devfs_mk_dir (NULL, "tapes", 5, NULL);
+    if (tape_dir == NULL) tape_dir = devfs_mk_dir (NULL, "tapes", NULL);
     parent = devfs_get_parent (de);
     pos = devfs_generate_path (parent, dest + 3, sizeof dest - 3);
     if (pos < 0) return;
     strncpy (dest + pos, "../", 3);
     sprintf (name, "tape%u", tape_counter++);
-    devfs_mk_symlink (tape_dir, name, 0, DEVFS_FL_DEFAULT, dest + pos, 0,
+    devfs_mk_symlink (tape_dir, name, DEVFS_FL_DEFAULT, dest + pos,
 		      &slave, NULL);
     devfs_auto_unregister (de, slave);
 }   /*  End Function devfs_register_tape  */
diff --git a/fs/devices.c b/fs/devices.c
index d119b1c75..9e37e5c68 100644
--- a/fs/devices.c
+++ b/fs/devices.c
@@ -183,6 +183,15 @@ const char * cdevname(kdev_t dev)
 	sprintf(buffer, "%s(%d,%d)", name, MAJOR(dev), MINOR(dev));
 	return buffer;
 }
+  
+static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
+{
+	return -ENXIO;
+}
+
+static struct file_operations bad_sock_fops = {
+	open:		sock_no_open
+};
 
 void init_special_inode(struct inode *inode, umode_t mode, int rdev)
 {
@@ -197,7 +206,7 @@ void init_special_inode(struct inode *inode, umode_t mode, int rdev)
 	} else if (S_ISFIFO(mode))
 		inode->i_fop = &def_fifo_fops;
 	else if (S_ISSOCK(mode))
-		;
+		inode->i_fop = &bad_sock_fops;
 	else
 		printk(KERN_DEBUG "init_special_inode: bogus imode (%o)\n", mode);
 }
diff --git a/fs/dquot.c b/fs/dquot.c
index 56824a73a..022dd3423 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -1027,40 +1027,43 @@ void dquot_initialize(struct inode *inode, short type)
 	unsigned int id = 0;
 	short cnt;
 
-	if (S_ISREG(inode->i_mode) ||
-            S_ISDIR(inode->i_mode) ||
-            S_ISLNK(inode->i_mode)) {
-		/* We don't want to have quotas on quota files - nasty deadlocks possible */
-		if (is_quotafile(inode))
-			return;
-		for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-			if (type != -1 && cnt != type)
-				continue;
+	if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode) &&
+            !S_ISLNK(inode->i_mode))
+		return;
+	lock_kernel();
+	/* We don't want to have quotas on quota files - nasty deadlocks possible */
+	if (is_quotafile(inode)) {
+		unlock_kernel();
+		return;
+	}
+	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+		if (type != -1 && cnt != type)
+			continue;
 
-			if (!sb_has_quota_enabled(inode->i_sb, cnt))
-				continue;
+		if (!sb_has_quota_enabled(inode->i_sb, cnt))
+			continue;
 
-			if (inode->i_dquot[cnt] == NODQUOT) {
-				switch (cnt) {
-					case USRQUOTA:
-						id = inode->i_uid;
-						break;
-					case GRPQUOTA:
-						id = inode->i_gid;
-						break;
-				}
-				dquot = dqget(inode->i_sb, id, cnt);
-				if (dquot == NODQUOT)
-					continue;
-				if (inode->i_dquot[cnt] != NODQUOT) {
-					dqput(dquot);
-					continue;
-				} 
-				inode->i_dquot[cnt] = dquot;
-				inode->i_flags |= S_QUOTA;
+		if (inode->i_dquot[cnt] == NODQUOT) {
+			switch (cnt) {
+				case USRQUOTA:
+					id = inode->i_uid;
+					break;
+				case GRPQUOTA:
+					id = inode->i_gid;
+					break;
 			}
+			dquot = dqget(inode->i_sb, id, cnt);
+			if (dquot == NODQUOT)
+				continue;
+			if (inode->i_dquot[cnt] != NODQUOT) {
+				dqput(dquot);
+				continue;
+			} 
+			inode->i_dquot[cnt] = dquot;
+			inode->i_flags |= S_QUOTA;
 		}
 	}
+	unlock_kernel();
 }
 
 /*
@@ -1073,6 +1076,7 @@ void dquot_drop(struct inode *inode)
 	struct dquot *dquot;
 	short cnt;
 
+	lock_kernel();
 	inode->i_flags &= ~S_QUOTA;
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
 		if (inode->i_dquot[cnt] == NODQUOT)
@@ -1081,6 +1085,7 @@ void dquot_drop(struct inode *inode)
 		inode->i_dquot[cnt] = NODQUOT;
 		dqput(dquot);
 	}
+	unlock_kernel();
 }
 
 /*
@@ -1208,6 +1213,8 @@ int dquot_transfer(struct dentry *dentry, struct iattr *iattr)
 	/* Arguably we could consider that as error, but... no fs - no quota */
 	if (!inode->i_sb)
 		return 0;
+
+	lock_kernel();
 	/*
 	 * Find out if this filesystem uses i_blocks.
 	 */
@@ -1315,6 +1322,7 @@ int dquot_transfer(struct dentry *dentry, struct iattr *iattr)
 		}
 	}
 
+	unlock_kernel();
 	return 0;
 put_all:
 	for (disc = 0; disc < cnt; disc++) {
@@ -1328,6 +1336,7 @@ put_all:
 			dqput(transfer_from[disc]);
 		}
 	}
+	unlock_kernel();
 	return error;
 }
 
diff --git a/fs/efs/symlink.c b/fs/efs/symlink.c
index 69b3e77b4..20840409d 100644
--- a/fs/efs/symlink.c
+++ b/fs/efs/symlink.c
@@ -9,6 +9,7 @@
 #include <linux/string.h>
 #include <linux/efs_fs.h>
 #include <linux/pagemap.h>
+#include <linux/smp_lock.h>
 
 static int efs_symlink_readpage(struct file *file, struct page *page)
 {
@@ -22,6 +23,7 @@ static int efs_symlink_readpage(struct file *file, struct page *page)
 	if (size > 2 * EFS_BLOCKSIZE)
 		goto fail;
   
+	lock_kernel();
 	/* read first 512 bytes of link target */
 	err = -EIO;
 	bh = bread(inode->i_dev, efs_bmap(inode, 0), EFS_BLOCKSIZE);
@@ -37,11 +39,13 @@ static int efs_symlink_readpage(struct file *file, struct page *page)
 		brelse(bh);
 	}
 	link[size] = '\0';
+	unlock_kernel();
 	SetPageUptodate(page);
 	kunmap(page);
 	UnlockPage(page);
 	return 0;
 fail:
+	unlock_kernel();
 	SetPageError(page);
 	kunmap(page);
 	UnlockPage(page);
diff --git a/fs/exec.c b/fs/exec.c
index ce1031e3b..d28aaec82 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -117,9 +117,7 @@ asmlinkage long sys_uselib(const char * library)
 	if (error)
 		goto exit;
 
-	lock_kernel();
 	file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
-	unlock_kernel();
 	error = PTR_ERR(file);
 	if (IS_ERR(file))
 		goto out;
@@ -340,10 +338,8 @@ struct file *open_exec(const char *name)
 	struct file *file;
 	int err = 0;
 
-	lock_kernel();
 	if (path_init(name, LOOKUP_FOLLOW|LOOKUP_POSITIVE, &nd))
 		err = path_walk(name, &nd);
-	unlock_kernel();
 	file = ERR_PTR(err);
 	if (!err) {
 		inode = nd.dentry->d_inode;
@@ -352,9 +348,7 @@ struct file *open_exec(const char *name)
 			int err = permission(inode, MAY_EXEC);
 			file = ERR_PTR(err);
 			if (!err) {
-				lock_kernel();
 				file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
-				unlock_kernel();
 				if (!IS_ERR(file)) {
 					err = deny_write_access(file);
 					if (err) {
@@ -936,8 +930,8 @@ int do_coredump(long signr, struct pt_regs * regs)
 		goto close_fail;
 	if (!binfmt->core_dump(signr, regs, file))
 		goto close_fail;
-	filp_close(file, NULL);
 	unlock_kernel();
+	filp_close(file, NULL);
 	return 1;
 
 close_fail:
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index d3af3b992..19511a1fe 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -205,7 +205,7 @@ static int parse_options (char * options, unsigned long * sb_block,
 		else if (!strcmp (this_char, "resgid")) {
 			if (!value || !*value) {
 				printk ("EXT2-fs: the resgid option requires "
-					"an argument");
+					"an argument\n");
 				return 0;
 			}
 			*resgid = simple_strtoul (value, &value, 0);
diff --git a/fs/file_table.c b/fs/file_table.c
index 5c722143d..a64bef65c 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -124,8 +124,11 @@ static void __fput(struct file *filp)
 	struct vfsmount * mnt = filp->f_vfsmnt;
 	struct inode * inode = dentry->d_inode;
 
-	if (filp->f_op && filp->f_op->release)
+	if (filp->f_op && filp->f_op->release) {
+		lock_kernel();
 		filp->f_op->release(inode, filp);
+		unlock_kernel();
+	}
 	fops_put(filp->f_op);
 	filp->f_dentry = NULL;
 	filp->f_vfsmnt = NULL;
@@ -138,10 +141,8 @@ static void __fput(struct file *filp)
 
 void _fput(struct file *file)
 {
-	lock_kernel();
-	locks_remove_flock(file);	/* Still need the */
-	__fput(file);			/* big lock here. */
-	unlock_kernel();
+	locks_remove_flock(file);
+	__fput(file);
 
 	file_list_lock();
 	list_del(&file->f_list);
diff --git a/fs/hfs/sysdep.c b/fs/hfs/sysdep.c
index 0caa01ad0..344856064 100644
--- a/fs/hfs/sysdep.c
+++ b/fs/hfs/sysdep.c
@@ -17,6 +17,7 @@
 #include <linux/hfs_fs_sb.h>
 #include <linux/hfs_fs_i.h>
 #include <linux/hfs_fs.h>
+#include <linux/smp_lock.h>
 
 static int hfs_revalidate_dentry(struct dentry *, int);
 static int hfs_hash_dentry(struct dentry *, struct qstr *);
@@ -83,7 +84,9 @@ static void hfs_dentry_iput(struct dentry *dentry, struct inode *inode)
 {
 	struct hfs_cat_entry *entry = HFS_I(inode)->entry;
 
+	lock_kernel();
 	entry->sys_entry[HFS_ITYPE_TO_INT(HFS_ITYPE(inode->i_ino))] = NULL;
+	unlock_kernel();
 	iput(inode);
 }
 
@@ -93,6 +96,7 @@ static int hfs_revalidate_dentry(struct dentry *dentry, int flags)
 	int diff;
 
 	/* fix up inode on a timezone change */
+	lock_kernel();
 	if (inode && 
 	    (diff = (hfs_to_utc(0) - HFS_I(inode)->tz_secondswest))) {
 		inode->i_ctime += diff;
@@ -100,5 +104,6 @@ static int hfs_revalidate_dentry(struct dentry *dentry, int flags)
 		inode->i_mtime += diff;
 		HFS_I(inode)->tz_secondswest += diff;
 	}
+	unlock_kernel();
 	return 1;
 }
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 5684801df..c912126d7 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -333,7 +333,7 @@ int hpfs_unlink(struct inode *dir, struct dentry *dentry)
 		if (rep)
 			goto ret;
 		d_drop(dentry);
-		if (dentry->d_count > 1 ||
+		if (atomic_read(&dentry->d_count) > 1 ||
 		    permission(inode, MAY_WRITE) ||
 		    get_write_access(inode)) {
 			d_rehash(dentry);
@@ -408,18 +408,21 @@ int hpfs_symlink_readpage(struct file *file, struct page *page)
 	int err;
 
 	err = -EIO;
+	lock_kernel();
 	if (!(fnode = hpfs_map_fnode(i->i_sb, i->i_ino, &bh)))
 		goto fail;
 	err = hpfs_read_ea(i->i_sb, fnode, "SYMLINK", link, PAGE_SIZE);
 	brelse(bh);
 	if (err)
 		goto fail;
+	unlock_kernel();
 	SetPageUptodate(page);
 	kunmap(page);
 	UnlockPage(page);
 	return 0;
 
 fail:
+	unlock_kernel();
 	SetPageError(page);
 	kunmap(page);
 	UnlockPage(page);
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
index 925c8e2fd..4413b9989 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -13,6 +13,7 @@
 #include <linux/mm.h>
 #include <linux/malloc.h>
 #include <linux/pagemap.h>
+#include <linux/smp_lock.h>
 
 #include "rock.h"
 
@@ -466,6 +467,7 @@ static int rock_ridge_symlink_readpage(struct file *file, struct page *page)
 		panic ("Cannot have symlink with high sierra variant of iso filesystem\n");
 
 	block = inode->i_ino >> bufbits;
+	lock_kernel();
 	bh = bread(inode->i_dev, block, bufsize);
 	if (!bh)
 		goto out_noread;
@@ -518,6 +520,7 @@ static int rock_ridge_symlink_readpage(struct file *file, struct page *page)
 		goto fail;
 	brelse(bh);
 	*rpnt = '\0';
+	unlock_kernel();
 	SetPageUptodate(page);
 	kunmap(page);
 	UnlockPage(page);
@@ -535,6 +538,7 @@ static int rock_ridge_symlink_readpage(struct file *file, struct page *page)
 	printk("symlink spans iso9660 blocks\n");
       fail:
 	brelse(bh);
+	unlock_kernel();
 	SetPageError(page);
 	kunmap(page);
 	UnlockPage(page);
diff --git a/fs/jffs/.cvsignore b/fs/jffs/.cvsignore
new file mode 100644
index 000000000..857dd22e9
--- /dev/null
+++ b/fs/jffs/.cvsignore
@@ -0,0 +1,2 @@
+.depend
+.*.flags
diff --git a/fs/jffs/Makefile b/fs/jffs/Makefile
new file mode 100644
index 000000000..63d25594a
--- /dev/null
+++ b/fs/jffs/Makefile
@@ -0,0 +1,33 @@
+#
+# Makefile for the linux Journalling Flash FileSystem (JFFS) routines.
+#
+# Note! Dependencies are done automagically by 'make dep', which also
+# removes any old dependencies. DON'T put your own dependencies here
+# unless it's something special (ie not a .c file).
+#
+# Note 2! The CFLAGS definitions are now in the main makefile...
+
+ifndef CONFIG_MTD
+
+# We're being invoked outside a normal kernel build. Fake it
+EXTRA_CFLAGS= -I$(shell pwd)/../../include
+
+# You need to change this to build for 2.2, dunno how to check for it.
+#INODE_O := inode-v22.o
+INODE_O := inode-v23.o
+
+else
+
+ifeq ($(PATCHLEVEL),2)
+	INODE_O := inode-v22.o
+else
+	INODE_O := inode-v23.o
+endif
+
+endif
+
+O_TARGET := jffs.o
+M_OBJS   := $(O_TARGET)
+O_OBJS   := jffs_fm.o intrep.o $(INODE_O)
+
+include $(TOPDIR)/Rules.make
diff --git a/fs/jffs/inode-v23.c b/fs/jffs/inode-v23.c
new file mode 100644
index 000000000..704c1fde5
--- /dev/null
+++ b/fs/jffs/inode-v23.c
@@ -0,0 +1,1573 @@
+/*
+ * JFFS -- Journalling Flash File System, Linux implementation.
+ *
+ * Copyright (C) 1999, 2000  Finn Hakansson, Axis Communications, Inc.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * $Id: inode-v23.c,v 1.15 2000/06/16 16:23:02 dwmw2 Exp $
+ *
+ *
+ * Ported to Linux 2.3.x and MTD:
+ * Copyright (C) 2000  Alexander Larsson (alex@cendio.se), Cendio Systems AB
+ * 
+ */
+
+/* inode.c -- Contains the code that is called from the VFS.  */
+
+/* TODO-ALEX:
+ * uid and gid are just 16 bit.
+ * jffs_file_write reads from user-space pointers without xx_from_user
+ * maybe other stuff do to.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/malloc.h>
+#include <linux/jffs.h>
+#include <linux/fs.h>
+#include <linux/locks.h>
+#include <linux/smp_lock.h>
+#include <linux/sched.h>
+#include <linux/ioctl.h>
+#include <linux/stat.h>
+#include <linux/blkdev.h>
+#include <linux/quotaops.h>
+#include <asm/semaphore.h>
+#include <asm/byteorder.h>
+#include <asm/uaccess.h>
+#include "jffs_fm.h"
+#include "intrep.h"
+
+#if defined(CONFIG_JFFS_FS_VERBOSE) && CONFIG_JFFS_FS_VERBOSE
+#define D(x) x
+#else
+#define D(x)
+#endif
+#define D1(x) D(x)
+#define D2(x) 
+#define D3(x) 
+#define ASSERT(x) x
+
+static int jffs_remove(struct inode *dir, struct dentry *dentry, int type);
+
+static struct super_operations jffs_ops;
+static struct file_operations jffs_file_operations;
+static struct inode_operations jffs_file_inode_operations;
+static struct file_operations jffs_dir_operations;
+static struct inode_operations jffs_dir_inode_operations;
+static struct address_space_operations jffs_address_operations;
+
+/* Called by the VFS at mount time to initialize the whole file system.  */
+static struct super_block *
+jffs_read_super(struct super_block *sb, void *data, int silent)
+{
+	kdev_t dev = sb->s_dev;
+	struct inode *root_inode;
+
+	printk(KERN_NOTICE "JFFS: Trying to mount device %s.\n",
+	       kdevname(dev));
+
+	if (MAJOR(dev)!=MTD_BLOCK_MAJOR) {
+	  printk(KERN_WARNING "JFFS: Trying to mount non-mtd device.\n");
+	  return 0;
+	}
+
+	set_blocksize(dev, PAGE_CACHE_SIZE);
+	sb->s_blocksize = PAGE_CACHE_SIZE;
+	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
+	sb->u.generic_sbp = (void *) 0;
+
+	/* Build the file system.  */
+	if (jffs_build_fs(sb) < 0) {
+		goto jffs_sb_err1;
+	}
+
+	/*
+	 * set up enough so that we can read an inode
+	 */
+	sb->s_magic = JFFS_MAGIC_SB_BITMASK;
+	sb->s_op = &jffs_ops;
+
+	root_inode = iget(sb, JFFS_MIN_INO);
+	if (!root_inode)
+	        goto jffs_sb_err2;
+	
+	/* Get the root directory of this file system.  */
+	if (!(sb->s_root = d_alloc_root(root_inode))) {
+		goto jffs_sb_err3;
+	}
+
+#ifdef USE_GC
+	/* Do a garbage collect every time we mount.  */
+	jffs_garbage_collect((struct jffs_control *)sb->u.generic_sbp);
+#endif
+
+	printk(KERN_NOTICE "JFFS: Successfully mounted device %s.\n",
+	       kdevname(dev));
+	return sb;
+
+jffs_sb_err3:
+	iput(root_inode);
+jffs_sb_err2:
+	jffs_cleanup_control((struct jffs_control *)sb->u.generic_sbp);
+jffs_sb_err1:
+	
+	printk(KERN_WARNING "JFFS: Failed to mount device %s.\n",
+	       kdevname(dev));
+	return 0;
+}
+
+
+/* This function is called when the file system is umounted.  */
+static void
+jffs_put_super(struct super_block *sb)
+{
+	kdev_t dev = sb->s_dev;
+	D2(printk("jffs_put_super()\n"));
+	sb->s_dev = 0;
+	jffs_cleanup_control((struct jffs_control *)sb->u.generic_sbp);
+	printk(KERN_NOTICE "JFFS: Successfully unmounted device %s.\n",
+	       kdevname(dev));
+}
+
+/* This function is called when user commands like chmod, chgrp and
+   chown are executed. System calls like trunc() results in a call
+   to this function.  */
+static int
+jffs_setattr(struct dentry *dentry, struct iattr *iattr)
+{
+	struct inode *inode = dentry->d_inode;
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_fmcontrol *fmc;
+	struct jffs_file *f;
+	struct jffs_node *new_node;
+	char *name = 0;
+	int update_all;
+	int res;
+
+	f = (struct jffs_file *)inode->u.generic_ip;
+	ASSERT(if (!f) {
+		printk("jffs_setattr(): Invalid inode number: %lu\n",
+		       inode->i_ino);
+		return -1;
+	});
+
+	D1(printk("***jffs_setattr(): file: \"%s\", ino: %u\n",
+		  f->name, f->ino));
+
+	c = f->c;
+	fmc = c->fmc;
+        update_all = iattr->ia_valid & ATTR_FORCE;
+
+	if (!JFFS_ENOUGH_SPACE(fmc)) {
+		if ( (update_all || iattr->ia_valid & ATTR_SIZE)
+		     && (iattr->ia_size < f->size) ) {
+			/* See this case where someone is trying to
+			   shrink the size of a file as an exception.
+			   Accept it.  */
+			/* TODO: Might just shrink it a bit?
+			   check f->size - ia_size */
+		} else {
+			D1(printk("jffs_setattr(): Free size = %u\n",
+				  jffs_free_size1(fmc)
+				  + jffs_free_size2(fmc)));
+			D(printk(KERN_NOTICE "JFFS: No space left on "
+				 "device\n"));
+			return -ENOSPC;
+		}
+	}
+
+	if (!(new_node = (struct jffs_node *)
+			 kmalloc(sizeof(struct jffs_node), GFP_KERNEL))) {
+		D(printk("jffs_setattr(): Allocation failed!\n"));
+		return -ENOMEM;
+	}
+	DJM(no_jffs_node++);
+	new_node->data_offset = 0;
+	new_node->removed_size = 0;
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = f->ino;
+	raw_inode.pino = f->pino;
+	raw_inode.version = f->highest_version + 1;
+	raw_inode.mode = f->mode;
+	raw_inode.uid = f->uid;
+	raw_inode.gid = f->gid;
+	raw_inode.atime = f->atime;
+	raw_inode.mtime = f->mtime;
+	raw_inode.ctime = f->ctime;
+	raw_inode.dsize = 0;
+	raw_inode.offset = 0;
+	raw_inode.rsize = 0;
+	raw_inode.dsize = 0;
+	raw_inode.nsize = 0;
+	raw_inode.nlink = f->nlink;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+	
+	if (update_all || iattr->ia_valid & ATTR_MODE) {
+		raw_inode.mode = iattr->ia_mode;
+		inode->i_mode = iattr->ia_mode;
+	}
+	if (update_all || iattr->ia_valid & ATTR_UID) {
+		raw_inode.uid = iattr->ia_uid;
+		inode->i_uid = iattr->ia_uid;
+	}
+	if (update_all || iattr->ia_valid & ATTR_GID) {
+		raw_inode.gid = iattr->ia_gid;
+		inode->i_gid = iattr->ia_gid;
+	}
+	if (update_all || iattr->ia_valid & ATTR_SIZE) {
+		int len;
+		D1(printk("jffs_notify_change(): Changing size "
+			  "to %lu bytes!\n", (long)iattr->ia_size));
+		raw_inode.offset = iattr->ia_size;
+
+		/* Calculate how many bytes need to be removed from
+		   the end.  */
+		if (f->size < iattr->ia_size) {
+			len = 0;
+		}
+		else {
+			len = f->size - iattr->ia_size;
+		}
+
+		raw_inode.rsize = len;
+
+		/* The updated node will be a removal node, with
+		   base at the new size and size of the nbr of bytes
+		   to be removed.  */
+		new_node->data_offset = iattr->ia_size;
+		new_node->removed_size = len;
+		inode->i_size = iattr->ia_size;
+
+		/* If we truncate a file we want to add the name.  If we
+		   always do that, we could perhaps free more space on
+		   the flash (and besides it doesn't hurt).  */
+		name = f->name;
+		raw_inode.nsize = f->nsize;
+		if (len) {
+			invalidate_inode_pages(inode);
+		}
+		inode->i_ctime = CURRENT_TIME;
+		inode->i_mtime = inode->i_ctime;
+	}
+	if (update_all || iattr->ia_valid & ATTR_ATIME) {
+		raw_inode.atime = iattr->ia_atime;
+		inode->i_atime = iattr->ia_atime;
+	}
+	if (update_all || iattr->ia_valid & ATTR_MTIME) {
+		raw_inode.mtime = iattr->ia_mtime;
+		inode->i_mtime = iattr->ia_mtime;
+	}
+	if (update_all || iattr->ia_valid & ATTR_CTIME) {
+		raw_inode.ctime = iattr->ia_ctime;
+		inode->i_ctime = iattr->ia_ctime;
+	}
+
+	/* Write this node to the flash.  */
+	if ((res = jffs_write_node(c, new_node, &raw_inode, name, 0)) < 0) {
+		D(printk("jffs_notify_change(): The write failed!\n"));
+		kfree(new_node);
+		DJM(no_jffs_node--);
+		return res;
+	}
+
+	jffs_insert_node(c, f, &raw_inode, 0, new_node);
+	
+	mark_inode_dirty(inode);
+	
+	return 0;
+} /* jffs_notify_change()  */
+
+struct inode * jffs_new_inode(const struct inode * dir, struct jffs_raw_inode *raw_inode, int * err)
+{
+	struct super_block * sb;
+	struct inode * inode;
+	struct jffs_control *c;
+
+	inode = get_empty_inode();
+	if (!inode) {
+		*err = -ENOMEM;
+		return NULL;
+	}
+	
+	sb = dir->i_sb;
+	c = (struct jffs_control *)sb->u.generic_sbp;
+
+	inode->i_sb = sb;
+	inode->i_dev = sb->s_dev;
+	inode->i_ino = raw_inode->ino;
+	inode->i_mode = raw_inode->mode;
+	inode->i_nlink = raw_inode->nlink;
+	inode->i_uid = raw_inode->uid;
+	inode->i_gid = raw_inode->gid;
+	inode->i_rdev = 0;
+	inode->i_size = raw_inode->dsize;
+	inode->i_atime = raw_inode->atime;
+	inode->i_mtime = raw_inode->mtime;
+	inode->i_ctime = raw_inode->ctime;
+	inode->i_blksize = PAGE_SIZE; /* This is the optimal IO size (for stat), not the fs block size */
+	inode->i_blocks = 0;
+	inode->i_version = 0;
+	inode->i_flags = sb->s_flags;
+	inode->u.generic_ip = (void *)jffs_find_file(c, raw_inode->ino);
+	
+	insert_inode_hash(inode);
+
+	return inode;
+}
+
+/* Get statistics of the file system.  */
+int
+jffs_statfs(struct super_block *sb, struct statfs *buf)
+{
+	struct jffs_control *c = (struct jffs_control *) sb->u.generic_sbp;
+	struct jffs_fmcontrol *fmc = c->fmc;
+
+	D2(printk("jffs_statfs()\n"));
+
+	buf->f_type = JFFS_MAGIC_SB_BITMASK;
+	buf->f_bsize = PAGE_CACHE_SIZE;
+	buf->f_blocks = (fmc->flash_size / PAGE_CACHE_SIZE)
+		       - (fmc->min_free_size / PAGE_CACHE_SIZE);
+	buf->f_bfree = (jffs_free_size1(fmc) / PAGE_CACHE_SIZE
+		       + jffs_free_size2(fmc) / PAGE_CACHE_SIZE)
+		      - (fmc->min_free_size / PAGE_CACHE_SIZE);
+	buf->f_bavail = buf->f_bfree;
+	
+	/* Find out how many files there are in the filesystem.  */
+	buf->f_files = jffs_foreach_file(c, jffs_file_count);
+	buf->f_ffree = buf->f_bfree;
+	/* buf->f_fsid = 0; */
+	buf->f_namelen = JFFS_MAX_NAME_LEN;
+	return 0;
+}
+
+/* Rename a file.  */
+int
+jffs_rename(struct inode *old_dir, struct dentry *old_dentry,
+            struct inode *new_dir, struct dentry *new_dentry)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_file *old_dir_f;
+	struct jffs_file *new_dir_f;
+	struct jffs_file *del_f;
+	struct jffs_file *f;
+	struct jffs_node *node;
+	struct inode *inode;
+	int result = 0;
+	__u32 rename_data = 0;
+
+	D2(printk("***jffs_rename()\n"));
+
+	D(printk("jffs_rename(): old_dir: 0x%p, old name: 0x%p, "
+		 "new_dir: 0x%p, new name: 0x%p\n",
+		 old_dir, old_dentry->d_name.name,
+		 new_dir, new_dentry->d_name.name));
+
+	c = (struct jffs_control *)old_dir->i_sb->u.generic_sbp;
+	ASSERT(if (!c) {
+		printk(KERN_ERR "jffs_rename(): The old_dir inode "
+		       "didn't have a reference to a jffs_file struct\n");
+		return -1;
+	});
+
+	if (!JFFS_ENOUGH_SPACE(c->fmc)) {
+		D1(printk("jffs_rename(): Free size = %u\n",
+			  jffs_free_size1(c->fmc) + jffs_free_size2(c->fmc)));
+		D(printk(KERN_NOTICE "JFFS: No space left on device\n"));
+		return -ENOSPC;
+	}
+	
+	/* Find the the old directory.  */
+	result = -ENOTDIR;
+	if (!(old_dir_f = (struct jffs_file *)old_dir->u.generic_ip)) {
+		D(printk("jffs_rename(): Old dir invalid.\n"));
+		goto jffs_rename_end;
+	}
+
+	/* Try to find the file to move.  */
+	result = -ENOENT;
+	if (!(f = jffs_find_child(old_dir_f, old_dentry->d_name.name,
+				  old_dentry->d_name.len))) {
+		goto jffs_rename_end;
+	}
+	
+	/* Try to find the new directory's node.  */
+	result = -ENOTDIR;
+	if (!(new_dir_f = (struct jffs_file *)new_dir->u.generic_ip)) {
+		D(printk("jffs_rename(): New dir invalid.\n"));
+		goto jffs_rename_end;
+	}
+
+	/* Create a node and initialize as much as needed.  */
+	result = -ENOMEM;
+	if (!(node = (struct jffs_node *) kmalloc(sizeof(struct jffs_node),
+						  GFP_KERNEL))) {
+		D(printk("jffs_rename(): Allocation failed: node == 0\n"));
+		goto jffs_rename_end;
+	}
+	DJM(no_jffs_node++);
+	node->data_offset = 0;
+	node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = f->ino;
+	raw_inode.pino = new_dir_f->ino;
+	raw_inode.version = f->highest_version + 1;
+	raw_inode.mode = f->mode;
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = current->fsgid;
+#if 0
+	raw_inode.uid = f->uid;
+	raw_inode.gid = f->gid;
+#endif
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = raw_inode.atime;
+	raw_inode.ctime = f->ctime;
+	raw_inode.offset = 0;
+	raw_inode.dsize = 0;
+	raw_inode.rsize = 0;
+	raw_inode.nsize = new_dentry->d_name.len;
+	raw_inode.nlink = f->nlink;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+
+	/* See if there already exists a file with the same name as
+	   new_name.  */
+	if ((del_f = jffs_find_child(new_dir_f, new_dentry->d_name.name,
+				     new_dentry->d_name.len))) {
+		raw_inode.rename = 1;
+		/*raw_inode.mode = del_f->ino;*/
+	}
+
+	/* Write the new node to the flash memory.  */
+	if ((result = jffs_write_node(c, node, &raw_inode, new_dentry->d_name.name,
+				      (unsigned char*)&rename_data)) < 0) {
+		D(printk("jffs_rename(): Failed to write node to flash.\n"));
+		kfree(node);
+		DJM(no_jffs_node--);
+		goto jffs_rename_end;
+	}
+
+	if (raw_inode.rename) {
+		/* The file with the same name must be deleted.  */
+	        c->fmc->no_call_gc = 1; /* TODO: What kind of locking is this? */
+		if ((result = jffs_remove(new_dir, new_dentry, del_f->mode)) < 0) {
+			/* This is really bad.  */
+			printk(KERN_ERR "JFFS: An error occurred in "
+			       "rename().\n");
+		}
+		c->fmc->no_call_gc = 0;
+	}
+
+	if (old_dir_f != new_dir_f) {
+		/* Remove the file from its old position in the
+		   filesystem tree.  */
+		jffs_unlink_file_from_tree(f);
+	}
+
+	/* Insert the new node into the file system.  */
+	if ((result = jffs_insert_node(c, f, &raw_inode,
+				       new_dentry->d_name.name, node)) < 0) {
+		D(printk(KERN_ERR "jffs_rename(): jffs_insert_node() "
+			 "failed!\n"));
+	}
+
+	if (old_dir_f != new_dir_f) {
+		/* Insert the file to its new position in the
+		   file system.  */
+		jffs_insert_file_into_tree(f);
+	}
+
+	/* This is a kind of update of the inode we're about to make
+	   here.  This is what they do in ext2fs.  Kind of.  */
+	if ((inode = iget(new_dir->i_sb, f->ino))) {
+		inode->i_ctime = CURRENT_TIME;
+		mark_inode_dirty(inode);
+		iput(inode);
+	}
+
+jffs_rename_end:
+	
+	return result;
+} /* jffs_rename()  */
+
+
+/* Read the contents of a directory.  Used by programs like `ls'
+   for instance.  */
+static int
+jffs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+{
+	struct jffs_file *f;
+	struct dentry *dentry = filp->f_dentry;
+	struct inode *inode = dentry->d_inode;
+	int j;
+	int ddino;
+
+	D2(printk("jffs_readdir(): inode: 0x%p, filp: 0x%p\n", inode, filp));
+	if (filp->f_pos == 0) {
+		D3(printk("jffs_readdir(): \".\" %lu\n", inode->i_ino));
+		if (filldir(dirent, ".", 1, filp->f_pos, inode->i_ino) < 0) {
+			return 0;
+		}
+		filp->f_pos = 1;
+	} 
+	if (filp->f_pos == 1) {
+		if (inode->i_ino == JFFS_MIN_INO) {
+			ddino = JFFS_MIN_INO;
+		}
+		else {
+			ddino = ((struct jffs_file *)inode->u.generic_ip)->pino;
+		}
+		D3(printk("jffs_readdir(): \"..\" %u\n", ddino));
+		if (filldir(dirent, "..", 2, filp->f_pos, ddino) < 0)
+			return 0;
+		filp->f_pos++;
+	}
+	f = ((struct jffs_file *)inode->u.generic_ip)->children;
+	for (j = 2; (j < filp->f_pos) && f; j++) {
+	        f = f->sibling_next;
+	}
+	for (; f ; f = f->sibling_next) {
+		D3(printk("jffs_readdir(): \"%s\" ino: %u\n",
+			  (f->name ? f->name : ""), f->ino));
+		if (filldir(dirent, f->name, f->nsize,
+			    filp->f_pos , f->ino) < 0)
+			return 0;
+		filp->f_pos++;
+	}
+	
+	return filp->f_pos;
+} /* jffs_readdir()  */
+
+
+/* Find a file in a directory. If the file exists, return its
+   corresponding dentry.  */
+static struct dentry *
+jffs_lookup(struct inode *dir, struct dentry *dentry)
+{
+	struct jffs_file *d;
+	struct jffs_file *f;
+	int len;
+	int r = 0;
+	const char *name;
+	struct inode *inode = NULL;
+	
+	len = dentry->d_name.len;
+	name = dentry->d_name.name;
+	
+	D3({
+		char *s = (char *)kmalloc(len + 1, GFP_KERNEL);
+		memcpy(s, name, len);
+		s[len] = '\0';
+		printk("jffs_lookup(): dir: 0x%p, name: \"%s\"\n", dir, s);
+		kfree(s);
+	});
+	
+	r = -ENAMETOOLONG;
+	if (len > JFFS_MAX_NAME_LEN) {
+		goto jffs_lookup_end;
+	}
+
+	r = -EACCES;
+	if (!(d = (struct jffs_file *)dir->u.generic_ip)) {
+		D(printk("jffs_lookup(): No such inode! (%lu)\n", dir->i_ino));
+		goto jffs_lookup_end;
+	}
+
+	/* Get the corresponding inode to the file.  */
+	if ((len == 1) && (name[0] == '.')) {
+		if (!(inode = iget(dir->i_sb, d->ino))) {
+			D(printk("jffs_lookup(): . iget() ==> NULL\n"));
+			goto jffs_lookup_end;
+		}
+	} else if ((len == 2) && (name[0] == '.') && (name[1] == '.')) {
+		if (!(inode = iget(dir->i_sb, d->pino))) {
+			D(printk("jffs_lookup(): .. iget() ==> NULL\n"));
+			goto jffs_lookup_end;
+		}
+	} else if ((f = jffs_find_child(d, name, len))) {
+		if (!(inode = iget(dir->i_sb, f->ino))) {
+			D(printk("jffs_lookup(): iget() ==> NULL\n"));
+			goto jffs_lookup_end;
+		}
+	} else {
+		D3(printk("jffs_lookup(): Couldn't find the file. "
+			  "f = 0x%p, name = \"%s\", d = 0x%p, d->ino = %u\n",
+			  f, name, d, d->ino));
+		inode = NULL;
+	}
+	
+	d_add(dentry, inode);
+	return NULL;
+	
+jffs_lookup_end:
+	return ERR_PTR(r);
+} /* jffs_lookup()  */
+
+
+/* Try to read a page of data from a file.  */
+static int
+jffs_readpage(struct file *file, struct page *page)
+{
+	unsigned long buf;
+	unsigned long read_len;
+	int result = -EIO;
+	struct inode *inode = (struct inode*)page->mapping->host;
+	struct jffs_file *f = (struct jffs_file *)inode->u.generic_ip;
+	int r;
+	loff_t offset;
+
+	D2(printk("***jffs_readpage(): file = \"%s\", page->index = %lu\n",
+		  (f->name ? f->name : ""), (long)page->index));
+
+	get_page(page);
+	/* Don't LockPage(page), should be locked already */
+	buf = page_address(page);
+	ClearPageUptodate(page);
+	ClearPageError(page);
+
+	offset = page->index << PAGE_CACHE_SHIFT;
+	if (offset < inode->i_size) {
+		read_len = jffs_min(inode->i_size - offset, PAGE_SIZE);
+		r = jffs_read_data(f, (char *)buf, offset, read_len);
+		if (r == read_len) {
+			if (read_len < PAGE_SIZE) {
+				memset((void *)(buf + read_len), 0,
+				       PAGE_SIZE - read_len);
+			}
+			SetPageUptodate(page);
+			result = 0;
+		}
+		D(else {
+			printk("***jffs_readpage(): Read error! "
+			       "Wanted to read %lu bytes but only "
+			       "read %d bytes.\n", read_len, r);
+		});
+	}
+	if (result) {
+		memset((void *)buf, 0, PAGE_SIZE);
+	        SetPageError(page);
+	}
+
+	UnlockPage(page);
+	
+	put_page(page);
+	
+	D3(printk("jffs_readpage(): Leaving...\n"));
+
+	return result;
+} /* jffs_readpage()  */
+
+
+/* Create a new directory.  */
+static int
+jffs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_node *node;
+	struct jffs_file *dir_f;
+	struct inode *inode;
+	int dir_mode;
+	int result = 0;
+	int err;
+	
+	D1({
+	        int len = dentry->d_name.len;
+		char *_name = (char *) kmalloc(len + 1, GFP_KERNEL);
+		memcpy(_name, dentry->d_name.name, len);
+		_name[len] = '\0';
+		printk("***jffs_mkdir(): dir = 0x%p, name = \"%s\", "
+		       "len = %d, mode = 0x%08x\n", dir, _name, len, mode);
+		kfree(_name);
+	});
+
+	dir_f = (struct jffs_file *)dir->u.generic_ip;
+	ASSERT(if (!dir_f) {
+		printk(KERN_ERR "jffs_mkdir(): No reference to a "
+		       "jffs_file struct in inode.\n");
+		result = -1;
+		goto jffs_mkdir_end;
+	});
+
+	c = dir_f->c;
+
+	if (!JFFS_ENOUGH_SPACE(c->fmc)) {
+		D1(printk("jffs_mkdir(): Free size = %u\n",
+			  jffs_free_size1(c->fmc) + jffs_free_size2(c->fmc)));
+		D(printk(KERN_NOTICE "JFFS: No space left on device\n"));
+		result = -ENOSPC;
+		goto jffs_mkdir_end;
+	}
+
+	dir_mode = S_IFDIR | (mode & (S_IRWXUGO|S_ISVTX)
+			      & ~current->fs->umask);
+	if (dir->i_mode & S_ISGID) {
+                dir_mode |= S_ISGID;
+	}
+
+	/* Create a node and initialize it as much as needed.  */
+	if (!(node = (struct jffs_node *) kmalloc(sizeof(struct jffs_node),
+						  GFP_KERNEL))) {
+		D(printk("jffs_mkdir(): Allocation failed: node == 0\n"));
+		result = -ENOMEM;
+		goto jffs_mkdir_end;
+	}
+	DJM(no_jffs_node++);
+	node->data_offset = 0;
+	node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = c->next_ino++;
+	raw_inode.pino = dir_f->ino;
+	raw_inode.version = 1;
+	raw_inode.mode = dir_mode;
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = (dir->i_mode & S_ISGID) ? dir->i_gid : current->fsgid;
+	/*	raw_inode.gid = current->fsgid; */
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = raw_inode.atime;
+	raw_inode.ctime = raw_inode.atime;
+	raw_inode.offset = 0;
+	raw_inode.dsize = 0;
+	raw_inode.rsize = 0;
+	raw_inode.nsize = dentry->d_name.len;
+	raw_inode.nlink = 1;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+
+	/* Write the new node to the flash.  */
+	if ((result = jffs_write_node(c, node, &raw_inode, dentry->d_name.name, 0)) < 0) {
+		D(printk("jffs_mkdir(): jffs_write_node() failed.\n"));
+		kfree(node);
+		DJM(no_jffs_node--);
+		goto jffs_mkdir_end;
+	}
+
+	/* Insert the new node into the file system.  */
+	if ((result = jffs_insert_node(c, 0, &raw_inode, dentry->d_name.name, node))<0)
+	  goto jffs_mkdir_end;
+	
+	inode = jffs_new_inode(dir, &raw_inode, &err);
+	if (inode == NULL) {
+		result = err;
+		goto jffs_mkdir_end;
+	}
+	
+	inode->i_op = &jffs_dir_inode_operations;
+	inode->i_fop = &jffs_dir_operations;
+
+	mark_inode_dirty(dir);
+	d_instantiate(dentry, inode);
+
+	result = 0;
+jffs_mkdir_end:
+	return result;
+} /* jffs_mkdir()  */
+
+
+/* Remove a directory.  */
+static int
+jffs_rmdir(struct inode *dir, struct dentry *dentry)
+{
+	D3(printk("***jffs_rmdir()\n"));
+	return jffs_remove(dir, dentry, S_IFDIR);
+}
+
+
+/* Remove any kind of file except for directories.  */
+static int
+jffs_unlink(struct inode *dir, struct dentry *dentry)
+{
+	D3(printk("***jffs_unlink()\n"));
+	return jffs_remove(dir, dentry, 0);
+}
+
+
+/* Remove a JFFS entry, i.e. plain files, directories, etc.  Here we
+   shouldn't test for free space on the device.  */
+static int
+jffs_remove(struct inode *dir, struct dentry *dentry, int type)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_file *dir_f; /* The file-to-remove's parent.  */
+	struct jffs_file *del_f; /* The file to remove.  */
+	struct jffs_node *del_node;
+	struct inode *inode = 0;
+	int result = 0;
+
+	D1({
+	        int len = dentry->d_name.len;
+	        const char *name = dentry->d_name.name;
+		char *_name = (char *) kmalloc(len + 1, GFP_KERNEL);
+		memcpy(_name, name, len);
+		_name[len] = '\0';
+		printk("***jffs_remove(): file = \"%s\"\n", _name);
+		kfree(_name);
+	});
+
+	dir_f = (struct jffs_file *) dir->u.generic_ip;
+	c = dir_f->c;
+
+	result = -ENOENT;
+	if (!(del_f = jffs_find_child(dir_f, dentry->d_name.name,
+				      dentry->d_name.len))) {
+		D(printk("jffs_remove(): jffs_find_child() failed.\n"));
+		goto jffs_remove_end;
+	}
+
+	if (S_ISDIR(type)) {
+		if (del_f->children) {
+			result = -ENOTEMPTY;
+			goto jffs_remove_end;
+		}
+        } else if (S_ISDIR(del_f->mode)) {
+		D(printk("jffs_remove(): node is a directory "
+			 "but it shouldn't be.\n"));
+		result = -EPERM;
+		goto jffs_remove_end;
+	}
+
+	inode = dentry->d_inode;
+	
+	result = -EIO;
+	if (del_f->ino != inode->i_ino)
+		goto jffs_remove_end;
+
+	if (!inode->i_nlink) {
+		printk("Deleting nonexistent file inode: %lu, nlink: %d\n",
+		       inode->i_ino, inode->i_nlink);
+		inode->i_nlink=1;
+	}
+
+	/* Create a node for the deletion.  */
+	result = -ENOMEM;
+	if (!(del_node = (struct jffs_node *)
+			 kmalloc(sizeof(struct jffs_node), GFP_KERNEL))) {
+		D(printk("jffs_remove(): Allocation failed!\n"));
+		goto jffs_remove_end;
+	}
+	DJM(no_jffs_node++);
+	del_node->data_offset = 0;
+	del_node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = del_f->ino;
+	raw_inode.pino = del_f->pino;
+	raw_inode.version = del_f->highest_version + 1;
+	raw_inode.mode = del_f->mode;
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = current->fsgid;
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = del_f->mtime;
+	raw_inode.ctime = raw_inode.atime;
+	raw_inode.offset = 0;
+	raw_inode.dsize = 0;
+	raw_inode.rsize = 0;
+	raw_inode.nsize = 0;
+	raw_inode.nlink = del_f->nlink;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 1;
+
+	/* Write the new node to the flash memory.  */
+	if (jffs_write_node(c, del_node, &raw_inode, 0, 0) < 0) {
+		kfree(del_node);
+		DJM(no_jffs_node--);
+		result = -EIO;
+		goto jffs_remove_end;
+	}
+
+	/* Update the file.  This operation will make the file disappear
+	   from the in-memory file system structures.  */
+	jffs_insert_node(c, del_f, &raw_inode, 0, del_node);
+
+	dir->i_version = ++event;
+	dir->i_ctime = dir->i_mtime = CURRENT_TIME;
+	mark_inode_dirty(dir);
+	inode->i_nlink--;
+	if (inode->i_nlink == 0) {
+		inode->u.generic_ip = 0;
+	}
+	inode->i_ctime = dir->i_ctime;
+	mark_inode_dirty(inode);
+
+	d_delete(dentry);	/* This also frees the inode */
+
+	result = 0;
+jffs_remove_end:
+	return result;
+} /* jffs_remove()  */
+
+
+static int
+jffs_mknod(struct inode *dir, struct dentry *dentry, int mode, int rdev)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_file *dir_f;
+	struct jffs_node *node = 0;
+	struct jffs_control *c;
+	struct inode *inode;
+	int result = 0;
+	kdev_t dev = to_kdev_t(rdev);
+	int err;
+
+	D1(printk("***jffs_mknod()\n"));
+
+	dir_f = (struct jffs_file *)dir->u.generic_ip;
+	c = dir_f->c;
+
+	if (!JFFS_ENOUGH_SPACE(c->fmc)) {
+		D1(printk("jffs_mknod(): Free size = %u\n",
+			  jffs_free_size1(c->fmc) + jffs_free_size2(c->fmc)));
+		D(printk(KERN_NOTICE "JFFS: No space left on device\n"));
+		result = -ENOSPC;
+		goto jffs_mknod_end;
+	}
+
+	/* Create and initialize a new node.  */
+	if (!(node = (struct jffs_node *) kmalloc(sizeof(struct jffs_node),
+						  GFP_KERNEL))) {
+		D(printk("jffs_mknod(): Allocation failed!\n"));
+		result = -ENOMEM;
+		goto jffs_mknod_err;
+	}
+	DJM(no_jffs_node++);
+	node->data_offset = 0;
+	node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = c->next_ino++;
+	raw_inode.pino = dir_f->ino;
+	raw_inode.version = 1;
+	raw_inode.mode = mode;
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = (dir->i_mode & S_ISGID) ? dir->i_gid : current->fsgid;
+	/*	raw_inode.gid = current->fsgid; */
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = raw_inode.atime;
+	raw_inode.ctime = raw_inode.atime;
+	raw_inode.offset = 0;
+	raw_inode.dsize = sizeof(kdev_t);
+	raw_inode.rsize = 0;
+	raw_inode.nsize = dentry->d_name.len;
+	raw_inode.nlink = 1;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+
+	/* Write the new node to the flash.  */
+	if ((err = jffs_write_node(c, node, &raw_inode, dentry->d_name.name,
+				  (unsigned char *)&dev)) < 0) {
+		D(printk("jffs_mknod(): jffs_write_node() failed.\n"));
+		result = err;
+		goto jffs_mknod_err;
+	}
+
+	/* Insert the new node into the file system.  */
+	if ((err = jffs_insert_node(c, 0, &raw_inode, dentry->d_name.name, node)) < 0) {
+		result = err;
+		goto jffs_mknod_end;
+	}
+
+	inode = jffs_new_inode(dir, &raw_inode, &err);
+	if (inode == NULL) {
+		result = err;
+		goto jffs_mknod_end;
+	}
+	
+	init_special_inode(inode, mode, rdev);
+
+	d_instantiate(dentry, inode);
+	
+	goto jffs_mknod_end;
+
+jffs_mknod_err:
+	if (node) {
+		kfree(node);
+		DJM(no_jffs_node--);
+	}
+
+jffs_mknod_end:
+	return result;
+} /* jffs_mknod()  */
+
+
+static int
+jffs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_file *dir_f;
+	struct jffs_node *node;
+	struct inode *inode;
+	
+	int symname_len = strlen(symname);
+	int err;
+
+	D1({
+	        int len = dentry->d_name.len;
+		char *_name = (char *)kmalloc(len + 1, GFP_KERNEL);
+		char *_symname = (char *)kmalloc(symname_len + 1, GFP_KERNEL);
+		memcpy(_name, dentry->d_name.name, len);
+		_name[len] = '\0';
+		memcpy(_symname, symname, symname_len);
+		_symname[symname_len] = '\0';
+		printk("***jffs_symlink(): dir = 0x%p, dentry->dname.name = \"%s\", "
+		       "symname = \"%s\"\n", dir, _name, _symname);
+		kfree(_name);
+		kfree(_symname);
+	});
+
+	dir_f = (struct jffs_file *)dir->u.generic_ip;
+	ASSERT(if (!dir_f) {
+		printk(KERN_ERR "jffs_symlink(): No reference to a "
+		       "jffs_file struct in inode.\n");
+		return -1;
+	});
+
+	c = dir_f->c;
+
+	if (!JFFS_ENOUGH_SPACE(c->fmc)) {
+		D1(printk("jffs_symlink(): Free size = %u\n",
+			  jffs_free_size1(c->fmc) + jffs_free_size2(c->fmc)));
+		D(printk(KERN_NOTICE "JFFS: No space left on device\n"));
+		return -ENOSPC;
+	}
+
+	/* Create a node and initialize it as much as needed.  */
+	if (!(node = (struct jffs_node *) kmalloc(sizeof(struct jffs_node),
+						  GFP_KERNEL))) {
+		D(printk("jffs_symlink(): Allocation failed: node == NULL\n"));
+		return -ENOMEM;
+	}
+	DJM(no_jffs_node++);
+	node->data_offset = 0;
+	node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = c->next_ino++;
+	raw_inode.pino = dir_f->ino;
+	raw_inode.version = 1;
+	raw_inode.mode = S_IFLNK | S_IRWXUGO;
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = (dir->i_mode & S_ISGID) ? dir->i_gid : current->fsgid;
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = raw_inode.atime;
+	raw_inode.ctime = raw_inode.atime;
+	raw_inode.offset = 0;
+	raw_inode.dsize = symname_len;
+	raw_inode.rsize = 0;
+	raw_inode.nsize = dentry->d_name.len;
+	raw_inode.nlink = 1;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+
+	/* Write the new node to the flash.  */
+	if ((err = jffs_write_node(c, node, &raw_inode, dentry->d_name.name,
+				   (const unsigned char *)symname)) < 0) {
+		D(printk("jffs_symlink(): jffs_write_node() failed.\n"));
+		kfree(node);
+		DJM(no_jffs_node--);
+		return err;
+	}
+
+	/* Insert the new node into the file system.  */
+	if ((err = jffs_insert_node(c, 0, &raw_inode, dentry->d_name.name, node)) < 0) {
+		return err;
+	}
+
+	inode = jffs_new_inode(dir, &raw_inode, &err);
+	if (inode == NULL) {
+		return err;
+	}
+	
+	inode->i_op = &page_symlink_inode_operations;
+	inode->i_mapping->a_ops = &jffs_address_operations;
+
+	d_instantiate(dentry, inode);
+
+	return 0;
+} /* jffs_symlink()  */
+
+/* Create an inode inside a JFFS directory (dir) and return it.  
+ *
+ * By the time this is called, we already have created
+ * the directory cache entry for the new file, but it
+ * is so far negative - it has no inode.
+ *
+ * If the create succeeds, we fill in the inode information
+ * with d_instantiate(). 
+ */
+static int
+jffs_create(struct inode *dir, struct dentry *dentry, int mode)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_node *node;
+	struct jffs_file *dir_f; /* JFFS representation of the directory.  */
+	struct inode *inode;
+	int err;
+
+	D1({
+	        int len = dentry->d_name.len;
+		char *s = (char *)kmalloc(len + 1, GFP_KERNEL);
+		memcpy(s, dentry->d_name.name, len);
+		s[len] = '\0';
+		printk("jffs_create(): dir: 0x%p, name: \"%s\"\n", dir, s);
+		kfree(s);
+	});
+
+	dir_f = (struct jffs_file *)dir->u.generic_ip;
+	ASSERT(if (!dir_f) {
+		printk(KERN_ERR "jffs_create(): No reference to a "
+		       "jffs_file struct in inode.\n");
+		return -1;
+	});
+
+	c = dir_f->c;
+
+	if (!JFFS_ENOUGH_SPACE(c->fmc)) {
+		D1(printk("jffs_create(): Free size = %u\n",
+			  jffs_free_size1(c->fmc) + jffs_free_size2(c->fmc)));
+		D(printk(KERN_NOTICE "JFFS: No space left on device\n"));
+		return -ENOSPC;
+	}
+
+	/* Create a node and initialize as much as needed.  */
+	if (!(node = (struct jffs_node *) kmalloc(sizeof(struct jffs_node),
+						  GFP_KERNEL))) {
+		D(printk("jffs_create(): Allocation failed: node == 0\n"));
+		return -ENOMEM;
+	}
+	DJM(no_jffs_node++);
+	node->data_offset = 0;
+	node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = c->next_ino++;
+	raw_inode.pino = dir_f->ino;
+	raw_inode.version = 1;
+	raw_inode.mode = mode;
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = (dir->i_mode & S_ISGID) ? dir->i_gid : current->fsgid;
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = raw_inode.atime;
+	raw_inode.ctime = raw_inode.atime;
+	raw_inode.offset = 0;
+	raw_inode.dsize = 0;
+	raw_inode.rsize = 0;
+	raw_inode.nsize = dentry->d_name.len;
+	raw_inode.nlink = 1;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+
+	/* Write the new node to the flash.  */
+	if ((err = jffs_write_node(c, node, &raw_inode, dentry->d_name.name, 0)) < 0) {
+		D(printk("jffs_create(): jffs_write_node() failed.\n"));
+		kfree(node);
+		DJM(no_jffs_node--);
+		return err;
+	}
+
+	/* Insert the new node into the file system.  */
+	if ((err = jffs_insert_node(c, 0, &raw_inode, dentry->d_name.name, node)) < 0) {
+		return err;
+	}
+
+	/* Initialize an inode.  */
+	inode = jffs_new_inode(dir, &raw_inode, &err);
+	if (inode == NULL) {
+		return err;
+	}
+
+	inode->i_op = &jffs_file_inode_operations;
+	inode->i_fop = &jffs_file_operations;
+	inode->i_mapping->a_ops = &jffs_address_operations;
+	inode->i_mapping->nrpages = 0;
+
+	d_instantiate(dentry, inode);
+	
+	return 0;
+} /* jffs_create()  */
+
+
+/* Write, append or rewrite data to an existing file.  */
+static ssize_t
+jffs_file_write(struct file *filp, const char *buf, size_t count, loff_t *ppos)
+{
+	struct jffs_raw_inode raw_inode;
+	struct jffs_control *c;
+	struct jffs_file *f;
+	struct jffs_node *node;
+	struct dentry *dentry = filp->f_dentry; 
+	struct inode *inode = dentry->d_inode; 
+	unsigned long limit = current->rlim[RLIMIT_FSIZE].rlim_cur;
+	int written = 0;
+	loff_t pos;
+	int err;
+
+	inode = filp->f_dentry->d_inode;
+	
+	D2(printk("***jffs_file_write(): inode: 0x%p (ino: %lu), "
+		  "filp: 0x%p, buf: 0x%p, count: %d\n",
+		  inode, inode->i_ino, filp, buf, count));
+
+	down(&inode->i_sem);
+	
+	pos = *ppos;
+	err = -EINVAL;
+	if (pos < 0)
+		goto out;
+
+	err = filp->f_error;
+	if (err) {
+		filp->f_error = 0;
+		goto out;
+	}
+
+	if (inode->i_sb->s_flags & MS_RDONLY) {
+		D(printk("jffs_file_write(): MS_RDONLY\n"));
+		err = -ENOSPC;
+		goto out;
+	}
+	
+	if (!S_ISREG(inode->i_mode)) {
+		D(printk("jffs_file_write(): inode->i_mode == 0x%08x\n",
+			 inode->i_mode));
+		err = -EINVAL;
+		goto out;
+	}
+
+	if (!(f = (struct jffs_file *)inode->u.generic_ip)) {
+		D(printk("jffs_file_write(): inode->u.generic_ip = 0x%p\n",
+			 inode->u.generic_ip));
+		err = -EINVAL;
+		goto out;
+	}
+	
+	c = f->c;
+
+	if (!JFFS_ENOUGH_SPACE(c->fmc)) {
+		D1(printk("jffs_file_write(): Free size = %u\n",
+			  jffs_free_size1(c->fmc) + jffs_free_size2(c->fmc)));
+		D(printk(KERN_NOTICE "JFFS: No space left on device\n"));
+		err = -ENOSPC;
+		goto out;
+	}
+
+	if (filp->f_flags & O_APPEND)
+		pos = inode->i_size;
+
+
+	/*
+	 * Check whether we've reached the file size limit.
+	 */
+	err = -EFBIG;
+	if (limit != RLIM_INFINITY) {
+		if (pos >= limit) {
+			send_sig(SIGXFSZ, current, 0);
+			goto out;
+		}
+		if (count > limit - pos) {
+			send_sig(SIGXFSZ, current, 0);
+			count = limit - pos;
+		}
+	}
+	
+	/* Things are going to be written so we could allocate and
+	   initialize the necessary data structures now.  */
+	if (!(node = (struct jffs_node *) kmalloc(sizeof(struct jffs_node),
+						  GFP_KERNEL))) {
+		D(printk("jffs_file_write(): node == 0\n"));
+		err = -ENOMEM;
+		goto out;
+	}
+	DJM(no_jffs_node++);
+	node->data_offset = f->size;
+	node->removed_size = 0;
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = f->ino;
+	raw_inode.pino = f->pino;
+	raw_inode.version = f->highest_version + 1;
+	raw_inode.mode = f->mode;
+	
+	raw_inode.uid = f->uid;
+	raw_inode.gid = f->gid;
+	/*
+	raw_inode.uid = current->fsuid;
+	raw_inode.gid = current->fsgid;
+	*/
+	raw_inode.atime = CURRENT_TIME;
+	raw_inode.mtime = raw_inode.atime;
+	raw_inode.ctime = f->ctime;
+	raw_inode.offset = f->size;
+	raw_inode.dsize = count;
+	raw_inode.rsize = 0;
+	raw_inode.nsize = 0;
+	raw_inode.nlink = f->nlink;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+
+
+	/* TODO: BAAAAAAAAD! buf is a userspace-pointer, and should be
+	         treated as such, with copy_from_user etc...
+         */
+	/* Write the new node to the flash.  */
+	if ((written = jffs_write_node(c, node, &raw_inode, 0,
+				       (const unsigned char *)buf)) < 0) {
+		D(printk("jffs_file_write(): jffs_write_node() failed.\n"));
+		kfree(node);
+		DJM(no_jffs_node--);
+		err = written;
+		goto out;
+	}
+
+	/* Insert the new node into the file system.  */
+	if ((err = jffs_insert_node(c, f, &raw_inode, 0, node)) < 0) {
+		goto out;
+	}
+	
+	pos += written;
+	*ppos = pos;
+
+	D3(printk("jffs_file_write(): new f_pos %ld.\n", (long)pos));
+
+	/* Fix things in the real inode.  */
+	if (pos > inode->i_size) {
+		inode->i_size = pos;
+	}
+	inode->i_ctime = inode->i_mtime = CURRENT_TIME;
+	mark_inode_dirty(inode);
+
+	err = written;
+out:
+	up(&inode->i_sem);
+	return err;
+} /* jffs_file_write()  */
+
+
+/* This is our ioctl() routine.  */
+static int
+jffs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
+	   unsigned long arg)
+{
+	struct jffs_control *c;
+
+	D2(printk("***jffs_ioctl(): cmd = 0x%08x, arg = 0x%08lx\n", cmd, arg));
+
+	if (!(c = (struct jffs_control *)inode->i_sb->u.generic_sbp)) {
+		printk(KERN_ERR "JFFS: Bad inode in ioctl() call. "
+		       "(cmd = 0x%08x)\n", cmd);
+		return -EIO;
+	}
+
+	switch (cmd) {
+	case JFFS_PRINT_HASH:
+		jffs_print_hash_table(c);
+		break;
+	case JFFS_PRINT_TREE:
+		jffs_print_tree(c->root, 0);
+		break;
+	case JFFS_GET_STATUS:
+		{
+			struct jffs_flash_status fst;
+			struct jffs_fmcontrol *fmc = c->fmc;
+			printk("Flash status -- ");
+			if (!access_ok(VERIFY_WRITE,
+				       (struct jffs_flash_status *)arg,
+				       sizeof(struct jffs_flash_status))) {
+				D(printk("jffs_ioctl(): Bad arg in "
+					 "JFFS_GET_STATUS ioctl!\n"));
+				return -EFAULT;
+			}
+			fst.size = fmc->flash_size;
+			fst.used = fmc->used_size;
+			fst.dirty = fmc->dirty_size;
+			fst.begin = fmc->head->offset;
+			fst.end = fmc->tail->offset + fmc->tail->size;
+			printk("size: %d, used: %d, dirty: %d, "
+			       "begin: %d, end: %d\n",
+			       fst.size, fst.used, fst.dirty,
+			       fst.begin, fst.end);
+			if (copy_to_user((struct jffs_flash_status *)arg,
+					 &fst, sizeof(struct jffs_flash_status))) {
+			  return -EFAULT;
+			}
+			
+		}
+		break;
+	default:
+		return -ENOTTY;
+	}
+
+	return 0;
+} /* jffs_ioctl()  */
+
+
+static struct address_space_operations jffs_address_operations = {
+        readpage: jffs_readpage,
+};
+
+
+static struct file_operations jffs_file_operations =
+{
+	read:  generic_file_read,    /* read */
+	write: jffs_file_write,      /* write */
+	ioctl: jffs_ioctl,           /* ioctl */
+	mmap:  generic_file_mmap,    /* mmap */
+};
+
+static struct inode_operations jffs_file_inode_operations =
+{
+	lookup:  jffs_lookup,          /* lookup */
+	setattr: jffs_setattr,
+};
+
+static struct file_operations jffs_dir_operations =
+{
+	readdir: jffs_readdir,
+};
+
+static struct inode_operations jffs_dir_inode_operations =
+{
+	create:   jffs_create,
+	lookup:   jffs_lookup,
+	unlink:   jffs_unlink,
+	symlink:  jffs_symlink,
+	mkdir:    jffs_mkdir,
+	rmdir:    jffs_rmdir,
+	mknod:    jffs_mknod,
+	rename:   jffs_rename,
+	setattr:  jffs_setattr,
+};
+
+/* Initialize an inode for the VFS.  */
+static void
+jffs_read_inode(struct inode *inode)
+{
+	struct jffs_file *f;
+	struct jffs_control *c;
+
+	D3(printk("jffs_read_inode(): inode->i_ino == %lu\n", inode->i_ino));
+
+	if (!inode->i_sb) {
+		D(printk("jffs_read_inode(): !inode->i_sb ==> "
+			 "No super block!\n"));
+		return;
+	}
+	c = (struct jffs_control *)inode->i_sb->u.generic_sbp;
+	if (!(f = jffs_find_file(c, inode->i_ino))) {
+		D(printk("jffs_read_inode(): No such inode (%lu).\n",
+			 inode->i_ino));
+		return;
+	}
+	inode->u.generic_ip = (void *)f;
+	inode->i_mode = f->mode;
+	inode->i_nlink = f->nlink;
+	inode->i_uid = f->uid;
+	inode->i_gid = f->gid;
+	inode->i_size = f->size;
+	inode->i_atime = f->atime;
+	inode->i_mtime = f->mtime;
+	inode->i_ctime = f->ctime;
+	inode->i_blksize = PAGE_SIZE;
+	inode->i_blocks = 0;
+	if (S_ISREG(inode->i_mode)) {
+		inode->i_op = &jffs_file_inode_operations;
+		inode->i_fop = &jffs_file_operations;
+		inode->i_mapping->a_ops = &jffs_address_operations;
+	}
+	else if (S_ISDIR(inode->i_mode)) {
+		inode->i_op = &jffs_dir_inode_operations;
+		inode->i_fop = &jffs_dir_operations;
+	}
+	else if (S_ISLNK(inode->i_mode)) {
+                inode->i_op = &page_symlink_inode_operations;
+		inode->i_mapping->a_ops = &jffs_address_operations;
+	} else {
+	  /* If the node is a device of some sort, then the number of the
+	     device should be read from the flash memory and then added
+	     to the inode's i_rdev member.  */
+		kdev_t rdev;
+		jffs_read_data(f, (char *)&rdev, 0, sizeof(kdev_t));
+		init_special_inode(inode, inode->i_mode, kdev_t_to_nr(rdev));
+	}
+}
+
+void
+jffs_delete_inode(struct inode *inode)
+{
+
+        D3(printk("jffs_delete_inode(): inode->i_ino == %lu\n", inode->i_ino));
+
+  	lock_kernel();
+	
+	inode->i_size = 0;
+
+	clear_inode(inode);
+
+	unlock_kernel();
+}
+
+void
+jffs_write_super(struct super_block *sb)
+{
+#ifdef USE_GC
+	jffs_garbage_collect((struct jffs_control *)sb->u.generic_sbp);
+#endif
+}
+
+static struct super_operations jffs_ops =
+{
+	read_inode:   jffs_read_inode,
+	delete_inode: jffs_delete_inode,
+	put_super:    jffs_put_super,
+	write_super:  jffs_write_super,
+	statfs:       jffs_statfs,
+};
+
+static DECLARE_FSTYPE_DEV(jffs_fs_type, "jffs", jffs_read_super);
+
+static int __init
+init_jffs_fs(void)
+{
+	printk("JFFS version " JFFS_VERSION_STRING ", (C) 1999, 2000  Axis Communications AB\n");
+	return register_filesystem(&jffs_fs_type);
+}
+
+static void __exit
+exit_jffs_fs(void)
+{
+	unregister_filesystem(&jffs_fs_type);
+}
+
+EXPORT_NO_SYMBOLS;
+
+module_init(init_jffs_fs)
+module_exit(exit_jffs_fs)
diff --git a/fs/jffs/intrep.c b/fs/jffs/intrep.c
new file mode 100644
index 000000000..c0073e255
--- /dev/null
+++ b/fs/jffs/intrep.c
@@ -0,0 +1,2558 @@
+/*
+ * JFFS -- Journaling Flash File System, Linux implementation.
+ *
+ * Copyright (C) 1999, 2000  Axis Communications, Inc.
+ *
+ * Created by Finn Hakansson <finn@axis.com>.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * $Id: intrep.c,v 1.15 2000/06/27 15:33:43 dwmw2 Exp $
+ *
+ * Ported to Linux 2.3.x and MTD:
+ * Copyright (C) 2000  Alexander Larsson (alex@cendio.se), Cendio Systems AB
+ *
+ */
+
+/* This file contains the code for the internal structure of the
+   Journaling Flash File System, JFFS.  */
+
+/*
+ * Todo list:
+ *
+ * memcpy_to_flash() and memcpy_from_flash()-functions.
+ *
+ * Implementation of hard links.
+ *
+ * Organize the source code in a better way. Against the VFS we could
+ * have jffs_ext.c, and against the block device jffs_int.c.
+ * A better file-internal organization too.
+ *
+ * A better checksum algorithm.
+ *
+ * Consider endianness stuff. ntohl() etc.
+ *
+ * Are we handling the atime, mtime, ctime members of the inode right?
+ *
+ * Remove some duplicated code. Take a look at jffs_write_node() and
+ * jffs_rewrite_data() for instance.
+ *
+ * Implement more meaning of the nlink member in various data structures.
+ * nlink could be used in conjunction with hard links for instance.
+ *
+ * Fix the rename stuff. (I.e. if we have two files `a' and `b' and we
+ * do a `mv b a'.) Half of this is already implemented.
+ *
+ * Better memory management. Allocate data structures in larger chunks
+ * if possible.
+ *
+ * If too much meta data is stored, a garbage collect should be issued.
+ * We have experienced problems with too much meta data with for instance
+ * log files.
+ *
+ * Improve the calls to jffs_ioctl(). We would like to retrieve more
+ * information to be able to debug (or to supervise) JFFS during run-time.
+ *
+ */
+#define __NO_VERSION__
+#include <linux/types.h>
+#include <linux/malloc.h>
+#include <linux/jffs.h>
+#include <linux/fs.h>
+#include <linux/stat.h>
+#include <linux/pagemap.h>
+#include <linux/locks.h>
+#include <asm/semaphore.h>
+#include <asm/byteorder.h>
+#include <linux/version.h>
+
+#include "intrep.h"
+#include "jffs_fm.h"
+
+#if LINUX_VERSION_CODE < 0x20300
+#define set_current_state(x) do{current->state = x;} while (0)
+#endif
+
+#if defined(CONFIG_JFFS_FS_VERBOSE) && CONFIG_JFFS_FS_VERBOSE
+#define D(x) x
+#else
+#define D(x)
+#endif
+#define D1(x) D(x)
+#define D2(x) 
+#define D3(x) 
+#define ASSERT(x) x
+
+#if defined(JFFS_MEMORY_DEBUG) && JFFS_MEMORY_DEBUG
+long no_jffs_file = 0;
+long no_jffs_node = 0;
+long no_jffs_control = 0;
+long no_jffs_raw_inode = 0;
+long no_jffs_node_ref = 0;
+long no_jffs_fm = 0;
+long no_jffs_fmcontrol = 0;
+long no_hash = 0;
+long no_name = 0;
+#endif
+
+static int jffs_scan_flash(struct jffs_control *c);
+static int jffs_update_file(struct jffs_file *f, struct jffs_node *node);
+static __u8 flash_read_u8(struct mtd_info *mtd, loff_t from);
+
+#if 1
+#define _U      01
+#define _L      02
+#define _N      04
+#define _S      010
+#define _P      020
+#define _C      040
+#define _X      0100
+#define _B      0200
+
+const unsigned char jffs_ctype_[1 + 256] = {
+	0,
+	_C,     _C,     _C,     _C,     _C,     _C,     _C,     _C,
+	_C,     _C|_S,  _C|_S,  _C|_S,  _C|_S,  _C|_S,  _C,     _C,
+	_C,     _C,     _C,     _C,     _C,     _C,     _C,     _C,
+	_C,     _C,     _C,     _C,     _C,     _C,     _C,     _C,
+	_S|_B,  _P,     _P,     _P,     _P,     _P,     _P,     _P,
+	_P,     _P,     _P,     _P,     _P,     _P,     _P,     _P,
+	_N,     _N,     _N,     _N,     _N,     _N,     _N,     _N,
+	_N,     _N,     _P,     _P,     _P,     _P,     _P,     _P,
+	_P,     _U|_X,  _U|_X,  _U|_X,  _U|_X,  _U|_X,  _U|_X,  _U,
+	_U,     _U,     _U,     _U,     _U,     _U,     _U,     _U,
+	_U,     _U,     _U,     _U,     _U,     _U,     _U,     _U,
+	_U,     _U,     _U,     _P,     _P,     _P,     _P,     _P,
+	_P,     _L|_X,  _L|_X,  _L|_X,  _L|_X,  _L|_X,  _L|_X,  _L,
+	_L,     _L,     _L,     _L,     _L,     _L,     _L,     _L,
+	_L,     _L,     _L,     _L,     _L,     _L,     _L,     _L,
+	_L,     _L,     _L,     _P,     _P,     _P,     _P,     _C
+};
+
+#define jffs_isalpha(c)      ((jffs_ctype_+1)[(int)c]&(_U|_L))
+#define jffs_isupper(c)      ((jffs_ctype_+1)[(int)c]&_U)
+#define jffs_islower(c)      ((jffs_ctype_+1)[(int)c]&_L)
+#define jffs_isdigit(c)      ((jffs_ctype_+1)[(int)c]&_N)
+#define jffs_isxdigit(c)     ((jffs_ctype_+1)[(int)c]&(_X|_N))
+#define jffs_isspace(c)      ((jffs_ctype_+1)[(int)c]&_S)
+#define jffs_ispunct(c)      ((jffs_ctype_+1)[(int)c]&_P)
+#define jffs_isalnum(c)      ((jffs_ctype_+1)[(int)c]&(_U|_L|_N))
+#define jffs_isprint(c)      ((jffs_ctype_+1)[(int)c]&(_P|_U|_L|_N|_B))
+#define jffs_isgraph(c)      ((jffs_ctype_+1)[(int)c]&(_P|_U|_L|_N))
+#define jffs_iscntrl(c)      ((jffs_ctype_+1)[(int)c]&_C)
+
+void
+jffs_hexdump(struct mtd_info *mtd, loff_t pos, int size)
+{
+	char line[16];
+	int j = 0;
+
+	while (size > 0) {
+		int i;
+
+		printk("%ld:", (long) pos);
+		for (j = 0; j < 16; j++) {
+			line[j] = flash_read_u8(mtd, pos++);
+		}
+		for (i = 0; i < j; i++) {
+			if (!(i & 1)) {
+				printk(" %.2x", line[i] & 0xff);
+			}
+			else {
+				printk("%.2x", line[i] & 0xff);
+			}
+		}
+
+		/* Print empty space */
+		for (; i < 16; i++) {
+			if (!(i & 1)) {
+				printk("   ");
+			}
+			else {
+				printk("  ");
+			}
+		}
+		printk("  ");
+
+		for (i = 0; i < j; i++) {
+			if (jffs_isgraph(line[i])) {
+				printk("%c", line[i]);
+			}
+			else {
+				printk(".");
+			}
+		}
+		printk("\n");
+		size -= 16;
+	}
+}
+#endif
+
+#define flash_safe_acquire(arg) 
+#define flash_safe_release(arg) 
+
+static int
+flash_safe_read(struct mtd_info *mtd, loff_t from,
+		u_char *buf, size_t count)
+{
+  size_t retlen;
+  
+  MTD_READ(mtd, from, count, &retlen, buf);
+  if (retlen != count) {
+    printk("Didn't read all bytes in flash_safe_read()\n");
+  }
+  return retlen;
+}
+
+static __u32
+flash_read_u32(struct mtd_info *mtd, loff_t from)
+{
+  size_t retlen;
+  __u32 ret;
+  
+  MTD_READ(mtd, from, 4, &retlen, (unsigned char *)&ret);
+  if (retlen != 4) {
+    printk("Didn't read all bytes in flash_read_u32()\n");
+    return 0;
+  }
+
+  return ret;
+}
+
+static __u8
+flash_read_u8(struct mtd_info *mtd, loff_t from)
+{
+  size_t retlen;
+  __u8 ret;
+  
+  MTD_READ(mtd, from, 1, &retlen, &ret);
+  if (retlen != 1) {
+    printk("Didn't read all bytes in flash_read_u32()\n");
+    return 0;
+  }
+
+  return ret;
+}
+
+
+static int
+flash_safe_write(struct mtd_info *mtd, loff_t to,
+		 const u_char *buf, size_t count)
+{
+  size_t retlen;
+
+  MTD_WRITE(mtd, to, count, &retlen, buf);
+  if (retlen != count) {
+    printk("Didn't write all bytes in flash_safe_write()\n");
+  }
+  return retlen;
+}
+
+static int
+flash_memset(struct mtd_info *mtd, loff_t to,
+	     const u_char c, size_t size)
+{
+  static unsigned char pattern[16];
+  int i;
+
+  /* fill up pattern */
+  
+  for(i = 0; i < 16; i++)
+    pattern[i] = c;
+
+  /* write as many 16-byte chunks as we can */
+  
+  while(size >= 16) {
+    flash_safe_write(mtd, to, pattern, 16);
+    size -= 16;
+    to += 16;
+  }
+
+  /* and the rest */
+  
+  if(size)
+    flash_safe_write(mtd, to, pattern, size);
+
+  return size;
+}
+
+static void intrep_erase_callback(struct erase_info *done)
+{
+  wait_queue_head_t *wait_q;
+
+  wait_q = (wait_queue_head_t *)done->priv;
+
+  wake_up(wait_q);
+}
+
+static int
+flash_erase_region(struct mtd_info *mtd, loff_t start,
+		   size_t size)
+{
+  struct erase_info *erase;
+  DECLARE_WAITQUEUE(wait, current);
+  wait_queue_head_t wait_q;
+
+  erase = kmalloc(sizeof(struct erase_info), GFP_KERNEL);
+  if (!erase) 
+    return -ENOMEM;
+
+  init_waitqueue_head(&wait_q);
+
+  erase->mtd = mtd;
+  erase->callback = intrep_erase_callback;
+  erase->addr = start;
+  erase->len = size;
+  erase->priv = (u_long)&wait_q;
+
+  set_current_state(TASK_INTERRUPTIBLE);
+  add_wait_queue(&wait_q, &wait);
+	
+  if (MTD_ERASE(mtd, erase) < 0) {
+    set_current_state(TASK_RUNNING);
+    remove_wait_queue(&wait_q, &wait);
+    kfree(erase);
+    
+    printk(KERN_WARNING "flash: erase of region [0x%ld, 0x%ld] totally failed\n",
+	   (long)start, (long)start + size);
+    
+    return -1;
+  }
+
+  schedule(); /* Wait for flash to finish. */
+  /* FIXME: We could have been interrupted here. We don't deal with it */
+  remove_wait_queue(&wait_q, &wait);
+
+  kfree(erase);
+
+  return 0;
+}
+
+inline int
+jffs_min(int a, int b)
+{
+	return (a < b ? a : b);
+}
+
+
+inline int
+jffs_max(int a, int b)
+{
+	return (a > b ? a : b);
+}
+
+
+/* This routine calculates checksums in JFFS.  */
+__u32
+jffs_checksum(const void *data, int size)
+{
+	__u32 sum = 0;
+	__u8 *ptr = (__u8 *)data;
+	while (size-- > 0) {
+		sum += *ptr++;
+	}
+	D3(printk(", result: 0x%08x\n", sum));
+	return sum;
+}
+
+__u32
+jffs_checksum_flash(struct mtd_info *mtd, loff_t start, int size)
+{
+	__u32 sum = 0;
+	loff_t ptr = start;
+	while (size-- > 0) {
+		sum += flash_read_u8(mtd, ptr++);
+	}
+	D3(printk("checksum result: 0x%08x\n", sum));
+	return sum;
+}
+
+/* Create and initialize a new struct jffs_file.  */
+static struct jffs_file *
+jffs_create_file(struct jffs_control *c,
+		 const struct jffs_raw_inode *raw_inode)
+{
+	struct jffs_file *f;
+
+	if (!(f = (struct jffs_file *)kmalloc(sizeof(struct jffs_file),
+					      GFP_KERNEL))) {
+		D(printk("jffs_create_file(): Failed!\n"));
+		return 0;
+	}
+	DJM(no_jffs_file++);
+	memset(f, 0, sizeof(struct jffs_file));
+	f->ino = raw_inode->ino;
+	f->pino = raw_inode->pino;
+	f->nlink = raw_inode->nlink;
+	f->deleted = raw_inode->deleted;
+	f->c = c;
+
+	return f;
+}
+
+
+/* Build a control block for the file system.  */
+static struct jffs_control *
+jffs_create_control(kdev_t dev)
+{
+	struct jffs_control *c;
+	register int s = sizeof(struct jffs_control);
+	int i;
+	D(char *t = 0);
+
+	D2(printk("jffs_create_control()\n"));
+
+	if (!(c = (struct jffs_control *)kmalloc(s, GFP_KERNEL))) {
+		goto fail_control;
+	}
+	DJM(no_jffs_control++);
+	c->root = 0;
+	c->hash_len = JFFS_HASH_SIZE;
+	s = sizeof(struct list_head) * c->hash_len;
+	if (!(c->hash = (struct list_head *)kmalloc(s, GFP_KERNEL))) {
+		goto fail_hash;
+	}
+	DJM(no_hash++);
+	for (i=0;i<c->hash_len;i++) 
+		INIT_LIST_HEAD(&c->hash[i]);
+	if (!(c->fmc = jffs_build_begin(c, dev))) {
+		goto fail_fminit;
+	}
+	c->next_ino = JFFS_MIN_INO + 1;
+	return c;
+
+fail_fminit:
+	D(t = "c->fmc");
+fail_hash:
+	kfree(c);
+	DJM(no_jffs_control--);
+	D(t = t ? t : "c->hash");
+fail_control:
+	D(t = t ? t : "control");
+	D(printk("jffs_create_control(): Allocation failed: (%s)\n", t));
+	return (struct jffs_control *)0;
+}
+
+
+/* Clean up all data structures associated with the file system.  */
+void
+jffs_cleanup_control(struct jffs_control *c)
+{
+	D2(printk("jffs_cleanup_control()\n"));
+
+	if (!c) {
+		D(printk("jffs_cleanup_control(): c == NULL !!!\n"));
+		return;
+	}
+
+	/* Free all files and nodes.  */
+	if (c->hash) {
+		jffs_foreach_file(c, jffs_free_node_list);
+		kfree(c->hash);
+		DJM(no_hash--);
+	}
+	jffs_cleanup_fmcontrol(c->fmc);
+	kfree(c);
+	DJM(no_jffs_control--);
+	D3(printk("jffs_cleanup_control(): Leaving...\n"));
+}
+
+
+/* This function adds a virtual root node to the in-RAM representation.
+   Called by jffs_build_fs().  */
+static int
+jffs_add_virtual_root(struct jffs_control *c)
+{
+	struct jffs_file *root;
+	struct jffs_node *node;
+
+	D2(printk("jffs_add_virtual_root(): "
+		  "Creating a virtual root directory.\n"));
+
+	if (!(root = (struct jffs_file *)kmalloc(sizeof(struct jffs_file),
+						 GFP_KERNEL))) {
+		return -ENOMEM;
+	}
+	DJM(no_jffs_file++);
+	if (!(node = (struct jffs_node *)kmalloc(sizeof(struct jffs_node),
+						 GFP_KERNEL))) {
+		kfree(root);
+		DJM(no_jffs_file--);
+		return -ENOMEM;
+	}
+	DJM(no_jffs_node++);
+	memset(node, 0, sizeof(struct jffs_node));
+	node->ino = JFFS_MIN_INO;
+	memset(root, 0, sizeof(struct jffs_file));
+	root->ino = JFFS_MIN_INO;
+	root->mode = S_IFDIR | S_IRWXU | S_IRGRP
+		     | S_IXGRP | S_IROTH | S_IXOTH;
+	root->atime = root->mtime = root->ctime = CURRENT_TIME;
+	root->nlink = 1;
+	root->c = c;
+	root->version_head = root->version_tail = node;
+	jffs_insert_file_into_hash(root);
+	return 0;
+}
+
+
+/* This is where the file system is built and initialized.  */
+int
+jffs_build_fs(struct super_block *sb)
+{
+	struct jffs_control *c;
+	int err = 0;
+
+	D2(printk("jffs_build_fs()\n"));
+
+	if (!(c = jffs_create_control(sb->s_dev))) {
+		return -ENOMEM;
+	}
+	c->building_fs = 1;
+	c->sb = sb;
+	if ((err = jffs_scan_flash(c)) < 0) {
+		goto jffs_build_fs_fail;
+	}
+
+	/* Add a virtual root node if no one exists.  */
+	if (!jffs_find_file(c, JFFS_MIN_INO)) {
+		if ((err = jffs_add_virtual_root(c)) < 0) {
+			goto jffs_build_fs_fail;
+		}
+	}
+
+	/* Remove deleted nodes.  */
+	if ((err = jffs_foreach_file(c, jffs_possibly_delete_file)) < 0) {
+		printk(KERN_ERR "JFFS: Failed to remove deleted nodes.\n");
+		goto jffs_build_fs_fail;
+	}
+	/* Remove redundant nodes.  (We are not interested in the
+	   return value in this case.)  */
+	jffs_foreach_file(c, jffs_remove_redundant_nodes);
+	/* Try to build a tree from all the nodes.  */
+	if ((err = jffs_foreach_file(c, jffs_insert_file_into_tree)) < 0) {
+		printk("JFFS: Failed to build tree.\n");
+		goto jffs_build_fs_fail;
+	}
+	/* Compute the sizes of all files in the filesystem.  Adjust if
+	   necessary.  */
+	if ((err = jffs_foreach_file(c, jffs_build_file)) < 0) {
+		printk("JFFS: Failed to build file system.\n");
+		goto jffs_build_fs_fail;
+	}
+	sb->u.generic_sbp = (void *)c;
+	c->building_fs = 0;
+
+	D1(jffs_print_hash_table(c));
+	D1(jffs_print_tree(c->root, 0));
+
+	return 0;
+
+jffs_build_fs_fail:
+	jffs_cleanup_control(c);
+	return err;
+} /* jffs_build_fs()  */
+
+
+/* Scan the whole flash memory in order to find all nodes in the
+   file systems.  */
+static int
+jffs_scan_flash(struct jffs_control *c)
+{
+	char name[JFFS_MAX_NAME_LEN + 2];
+	struct jffs_raw_inode raw_inode;
+	struct jffs_node *node = 0;
+	struct jffs_fmcontrol *fmc = c->fmc;
+	__u32 checksum;
+	__u8 tmp_accurate;
+	__u16 tmp_chksum;
+	loff_t pos = fmc->flash_start;
+	loff_t start;
+	loff_t end = fmc->flash_start + fmc->flash_size;
+
+	D1(printk("jffs_scan_flash(): start pos = 0x%ld, end = 0x%ld\n",
+		  (long)pos, (long)end));
+
+	flash_safe_acquire(fmc->mtd);
+
+	/* Start the scan.  */
+	while (pos < end) {
+
+		/* Remember the position from where we started this scan.  */
+		start = pos;
+
+		switch (flash_read_u32(fmc->mtd, pos)) {
+		case JFFS_EMPTY_BITMASK:
+			/* We have found 0xff on this block.  We have to
+			   scan the rest of the block to be sure it is
+			   filled with 0xff.  */
+			D1(printk("jffs_scan_flash(): 0xff at pos 0x%ld.\n",
+				  (long)pos));
+			for (; pos < end
+			       && JFFS_EMPTY_BITMASK == flash_read_u32(fmc->mtd, pos);
+			     pos += 4);
+			D1(printk("jffs_scan_flash(): 0xff ended at "
+				  "pos 0x%ld.\n", (long)pos));
+			continue;
+
+		case JFFS_DIRTY_BITMASK:
+			/* We have found 0x00 on this block.  We have to
+			   scan as far as possible to find out how much
+			   is dirty.  */
+			D1(printk("jffs_scan_flash(): 0x00 at pos 0x%ld.\n",
+				  (long)pos));
+			for (; pos < end
+			       && JFFS_DIRTY_BITMASK == flash_read_u32(fmc->mtd, pos);
+			     pos += 4);
+			D1(printk("jffs_scan_flash(): 0x00 ended at "
+				  "pos 0x%ld.\n", (long)pos));
+			jffs_fmalloced(fmc, (__u32) start,
+				       (__u32) (pos - start), 0);
+			continue;
+
+		case JFFS_MAGIC_BITMASK:
+			/* We have probably found a new raw inode.  */
+			break;
+
+		default:
+		bad_inode:
+			/* We're f*cked.  This is not solved yet.  We have
+			   to scan for the magic pattern.  */
+			D1(printk("*************** Dirty flash memory or bad inode: "
+				  "hexdump(pos = 0x%ld, len = 128):\n",
+				  (long)pos));
+			D1(jffs_hexdump(fmc->mtd, pos, 128));
+			for (pos += 4; pos < end; pos += 4) {
+				switch (flash_read_u32(fmc->mtd, pos)) {
+				case JFFS_MAGIC_BITMASK:
+					jffs_fmalloced(fmc, (__u32) start,
+						       (__u32) (pos - start),
+						       0);
+					goto cont_scan;
+				default:
+					break;
+				}
+			}
+			cont_scan:
+			continue;
+		}
+
+		/* We have found the beginning of an inode.  Create a
+		   node for it.  */
+		if (!node) {
+			if (!(node = (struct jffs_node *)
+				     kmalloc(sizeof(struct jffs_node),
+					     GFP_KERNEL))) {
+				flash_safe_release(fmc->mtd);
+				return -ENOMEM;
+			}
+			DJM(no_jffs_node++);
+		}
+
+		/* Read the next raw inode.  */
+
+		flash_safe_read(fmc->mtd, pos, (u_char *) &raw_inode, sizeof(struct jffs_raw_inode));
+
+		/* When we compute the checksum for the inode, we never
+		   count the 'accurate' or the 'checksum' fields.  */
+		tmp_accurate = raw_inode.accurate;
+		tmp_chksum = raw_inode.chksum;
+		raw_inode.accurate = 0;
+		raw_inode.chksum = 0;
+		checksum = jffs_checksum(&raw_inode,
+					 sizeof(struct jffs_raw_inode));
+		raw_inode.accurate = tmp_accurate;
+		raw_inode.chksum = tmp_chksum;
+
+		D3(printk("*** We have found this raw inode at pos 0x%ld "
+			  "on the flash:\n", (long)pos));
+		D3(jffs_print_raw_inode(&raw_inode));
+
+		if (checksum != raw_inode.chksum) {
+			D1(printk("jffs_scan_flash(): Bad checksum: "
+				  "checksum = %u, "
+				  "raw_inode.chksum = %u\n",
+				  checksum, raw_inode.chksum));
+			pos += sizeof(struct jffs_raw_inode);
+			jffs_fmalloced(fmc, (__u32) start,
+				       (__u32) (pos - start), 0);
+			/* Reuse this unused struct jffs_node.  */
+			continue;
+		}
+
+		/* Check the raw inode read so far.  Start with the
+		   maximum length of the filename.  */
+		if (raw_inode.nsize > JFFS_MAX_NAME_LEN) {
+			goto bad_inode;
+		}
+		/* The node's data segment should not exceed a
+		   certain length.  */
+		if (raw_inode.dsize > fmc->max_chunk_size) {
+			goto bad_inode;
+		}
+
+		pos += sizeof(struct jffs_raw_inode);
+
+		/* This shouldn't be necessary because a node that
+		   violates the flash boundaries shouldn't be written
+		   in the first place. */
+		if (pos >= end) {
+			goto check_node;
+		}
+
+		/* Read the name.  */
+		*name = 0;
+		if (raw_inode.nsize) {
+		        flash_safe_read(fmc->mtd, pos, name, raw_inode.nsize);
+			name[raw_inode.nsize] = '\0';
+			pos += raw_inode.nsize
+			       + JFFS_GET_PAD_BYTES(raw_inode.nsize);
+			D3(printk("name == \"%s\"\n", name));
+			checksum = jffs_checksum(name, raw_inode.nsize);
+			if (checksum != raw_inode.nchksum) {
+				D1(printk("jffs_scan_flash(): Bad checksum: "
+					  "checksum = %u, "
+					  "raw_inode.nchksum = %u\n",
+					  checksum, raw_inode.nchksum));
+				jffs_fmalloced(fmc, (__u32) start,
+					       (__u32) (pos - start), 0);
+				/* Reuse this unused struct jffs_node.  */
+				continue;
+			}
+			if (pos >= end) {
+				goto check_node;
+			}
+		}
+
+		/* Read the data in order to be sure it matches the
+		   checksum.  */
+		checksum = jffs_checksum_flash(fmc->mtd, pos, raw_inode.dsize);
+		pos += raw_inode.dsize + JFFS_GET_PAD_BYTES(raw_inode.dsize);
+
+		if (checksum != raw_inode.dchksum) {
+			D1(printk("jffs_scan_flash(): Bad checksum: "
+				  "checksum = %u, "
+				  "raw_inode.dchksum = %u\n",
+				  checksum, raw_inode.dchksum));
+			jffs_fmalloced(fmc, (__u32) start,
+				       (__u32) (pos - start), 0);
+			/* Reuse this unused struct jffs_node.  */
+			continue;
+		}
+
+		check_node:
+
+		/* Remember the highest inode number in the whole file
+		   system.  This information will be used when assigning
+		   new files new inode numbers.  */
+		if (c->next_ino <= raw_inode.ino) {
+			c->next_ino = raw_inode.ino + 1;
+		}
+
+		if (raw_inode.accurate) {
+			int err;
+			node->data_offset = raw_inode.offset;
+			node->data_size = raw_inode.dsize;
+			node->removed_size = raw_inode.rsize;
+			/* Compute the offset to the actual data in the
+			   on-flash node.  */
+			node->fm_offset
+			= sizeof(struct jffs_raw_inode)
+			  + raw_inode.nsize
+			  + JFFS_GET_PAD_BYTES(raw_inode.nsize);
+			node->fm = jffs_fmalloced(fmc, (__u32) start,
+						  (__u32) (pos - start),
+						  node);
+			if (!node->fm) {
+				D(printk("jffs_scan_flash(): !node->fm\n"));
+				kfree(node);
+				DJM(no_jffs_node--);
+				flash_safe_release(fmc->mtd);
+				return -ENOMEM;
+			}
+			if ((err = jffs_insert_node(c, 0, &raw_inode,
+						    name, node)) < 0) {
+				printk("JFFS: Failed to handle raw inode. "
+				       "(err = %d)\n", err);
+				break;
+			}
+			D3(jffs_print_node(node));
+			node = 0; /* Don't free the node!  */
+		}
+		else {
+			jffs_fmalloced(fmc, (__u32) start,
+				       (__u32) (pos - start), 0);
+			D3(printk("jffs_scan_flash(): Just found an obsolete "
+				  "raw_inode. Continuing the scan...\n"));
+			/* Reuse this unused struct jffs_node.  */
+		}
+	}
+
+	if (node) {
+		kfree(node);
+		DJM(no_jffs_node--);
+	}
+	jffs_build_end(fmc);
+	D3(printk("jffs_scan_flash(): Leaving...\n"));
+	flash_safe_release(fmc->mtd);
+	return 0;
+} /* jffs_scan_flash()  */
+
+
+/* Insert any kind of node into the file system.  Take care of data
+   insertions and deletions.  Also remove redundant information. The
+   memory allocated for the `name' is regarded as "given away" in the
+   caller's perspective.  */
+int
+jffs_insert_node(struct jffs_control *c, struct jffs_file *f,
+		 const struct jffs_raw_inode *raw_inode,
+		 const char *name, struct jffs_node *node)
+{
+	int update_name = 0;
+	int insert_into_tree = 0;
+
+	D2(printk("jffs_insert_node(): ino = %u, version = %u, name = \"%s\"\n",
+		  raw_inode->ino, raw_inode->version,
+		  ((name && *name) ? name : "")));
+
+	/* If there doesn't exist an associated jffs_file, then
+	   create, initialize and insert one into the file system.  */
+	if (!f && !(f = jffs_find_file(c, raw_inode->ino))) {
+		if (!(f = jffs_create_file(c, raw_inode))) {
+			return -ENOMEM;
+		}
+		jffs_insert_file_into_hash(f);
+		insert_into_tree = 1;
+	}
+
+	node->ino = raw_inode->ino;
+	node->version = raw_inode->version;
+	node->data_size = raw_inode->dsize;
+	node->fm_offset = sizeof(struct jffs_raw_inode) + raw_inode->nsize
+			  + JFFS_GET_PAD_BYTES(raw_inode->nsize);
+	node->name_size = raw_inode->nsize;
+
+	/* Now insert the node at the correct position into the file's
+	   version list.  */
+	if (!f->version_head) {
+		/* This is the first node.  */
+		f->version_head = node;
+		f->version_tail = node;
+		node->version_prev = 0;
+		node->version_next = 0;
+		f->highest_version = node->version;
+		update_name = 1;
+		f->mode = raw_inode->mode;
+		f->uid = raw_inode->uid;
+		f->gid = raw_inode->gid;
+		f->atime = raw_inode->atime;
+		f->mtime = raw_inode->mtime;
+		f->ctime = raw_inode->ctime;
+		f->deleted = raw_inode->deleted;
+	}
+	else if ((f->highest_version < node->version)
+		 || (node->version == 0)) {
+		/* Insert at the end of the list.  I.e. this node is the
+		   oldest one so far.  */
+		node->version_prev = f->version_tail;
+		node->version_next = 0;
+		f->version_tail->version_next = node;
+		f->version_tail = node;
+		f->highest_version = node->version;
+		update_name = 1;
+		f->pino = raw_inode->pino;
+		f->mode = raw_inode->mode;
+		f->uid = raw_inode->uid;
+		f->gid = raw_inode->gid;
+		f->atime = raw_inode->atime;
+		f->mtime = raw_inode->mtime;
+		f->ctime = raw_inode->ctime;
+		f->deleted = raw_inode->deleted;
+	}
+	else if (f->version_head->version > node->version) {
+		/* Insert at the bottom of the list.  */
+		node->version_prev = 0;
+		node->version_next = f->version_head;
+		f->version_head->version_prev = node;
+		f->version_head = node;
+		if (!f->name) {
+			update_name = 1;
+		}
+		if (raw_inode->deleted) {
+			f->deleted = raw_inode->deleted;
+		}
+	}
+	else {
+		struct jffs_node *n;
+		int newer_name = 0;
+		/* Search for the insertion position starting from
+		   the tail (newest node).  */
+		for (n = f->version_tail; n; n = n->version_prev) {
+			if (n->version < node->version) {
+				node->version_prev = n;
+				node->version_next = n->version_next;
+				node->version_next->version_prev = node;
+				n->version_next = node;
+				if (!newer_name) {
+					update_name = 1;
+				}
+				break;
+			}
+			if (n->name_size) {
+				newer_name = 1;
+			}
+		}
+	}
+
+	/* Perhaps update the name.  */
+	if (raw_inode->nsize && update_name && name && *name && (name != f->name)) {
+		if (f->name) {
+			kfree(f->name);
+			DJM(no_name--);
+		}
+		if (!(f->name = (char *) kmalloc(raw_inode->nsize + 1,
+						 GFP_KERNEL))) {
+			return -ENOMEM;
+		}
+		DJM(no_name++);
+		memcpy(f->name, name, raw_inode->nsize);
+		f->name[raw_inode->nsize] = '\0';
+		f->nsize = raw_inode->nsize;
+		D3(printk("jffs_insert_node(): Updated the name of "
+			  "the file to \"%s\".\n", name));
+	}
+
+	if (!c->building_fs) {
+		D3(printk("jffs_insert_node(): ---------------------------"
+			  "------------------------------------------- 1\n"));
+		if (insert_into_tree) {
+			jffs_insert_file_into_tree(f);
+		}
+		if (f->deleted) {
+			/* Mark all versions of the node as obsolete.  */
+			jffs_possibly_delete_file(f);
+		}
+		else {
+			if (node->data_size || node->removed_size) {
+				jffs_update_file(f, node);
+			}
+			jffs_remove_redundant_nodes(f);
+		}
+#ifdef USE_GC
+		if (!c->fmc->no_call_gc) {
+			jffs_garbage_collect(c);
+		}
+#endif
+		D3(printk("jffs_insert_node(): ---------------------------"
+			  "------------------------------------------- 2\n"));
+	}
+
+	return 0;
+} /* jffs_insert_node()  */
+
+
+/* Unlink a jffs_node from the version list it is in.  */
+static inline void
+jffs_unlink_node_from_version_list(struct jffs_file *f,
+				   struct jffs_node *node)
+{
+	if (node->version_prev) {
+		node->version_prev->version_next = node->version_next;
+	} else {
+		f->version_head = node->version_next;
+	}
+	if (node->version_next) {
+		node->version_next->version_prev = node->version_prev;
+	} else {
+		f->version_tail = node->version_prev;
+	}
+}
+
+
+/* Unlink a jffs_node from the range list it is in.  */
+static inline void
+jffs_unlink_node_from_range_list(struct jffs_file *f, struct jffs_node *node)
+{
+	if (node->range_prev) {
+		node->range_prev->range_next = node->range_next;
+	}
+	else {
+		f->range_head = node->range_next;
+	}
+	if (node->range_next) {
+		node->range_next->range_prev = node->range_prev;
+	}
+	else {
+		f->range_tail = node->range_prev;
+	}
+}
+
+
+/* Function used by jffs_remove_redundant_nodes() below.  This function
+   classifies what kind of information a node adds to a file.  */
+static inline __u8
+jffs_classify_node(struct jffs_node *node)
+{
+	__u8 mod_type = JFFS_MODIFY_INODE;
+
+	if (node->name_size) {
+		mod_type |= JFFS_MODIFY_NAME;
+	}
+	if (node->data_size || node->removed_size) {
+		mod_type |= JFFS_MODIFY_DATA;
+	}
+	return mod_type;
+}
+
+
+/* Remove redundant nodes from a file.  Mark the on-flash memory
+   as dirty.  */
+int
+jffs_remove_redundant_nodes(struct jffs_file *f)
+{
+	struct jffs_node *newest_node;
+	struct jffs_node *cur;
+	struct jffs_node *prev;
+	__u8 newest_type;
+	__u8 mod_type;
+	__u8 node_with_name_later = 0;
+
+	if (!(newest_node = f->version_tail)) {
+		return 0;
+	}
+
+	/* What does the `newest_node' modify?  */
+	newest_type = jffs_classify_node(newest_node);
+	node_with_name_later = newest_type & JFFS_MODIFY_NAME;
+
+	D3(printk("jffs_remove_redundant_nodes(): ino: %u, name: \"%s\", "
+		  "newest_type: %u\n", f->ino, (f->name ? f->name : ""),
+		  newest_type));
+
+	/* Traverse the file's nodes and determine which of them that are
+	   superfluous.  Yeah, this might look very complex at first
+	   glance but it is actually very simple.  */
+	for (cur = newest_node->version_prev; cur; cur = prev) {
+		prev = cur->version_prev;
+		mod_type = jffs_classify_node(cur);
+		if ((mod_type <= JFFS_MODIFY_INODE)
+		    || ((newest_type & JFFS_MODIFY_NAME)
+			&& (mod_type
+			    <= (JFFS_MODIFY_INODE + JFFS_MODIFY_NAME)))
+		    || (cur->data_size == 0 && cur->removed_size
+			&& !cur->version_prev && node_with_name_later)) {
+			/* Yes, this node is redundant. Remove it.  */
+			D2(printk("jffs_remove_redundant_nodes(): "
+				  "Removing node: ino: %u, version: %u, "
+				  "mod_type: %u\n", cur->ino, cur->version,
+				  mod_type));
+			jffs_unlink_node_from_version_list(f, cur);
+			jffs_fmfree(f->c->fmc, cur->fm, cur);
+			kfree(cur);
+			DJM(no_jffs_node--);
+		}
+		else {
+			node_with_name_later |= (mod_type & JFFS_MODIFY_NAME);
+		}
+	}
+
+	return 0;
+}
+
+
+/* Insert a file into the hash table.  */
+int
+jffs_insert_file_into_hash(struct jffs_file *f)
+{
+	int i = f->ino % f->c->hash_len;
+
+	D3(printk("jffs_insert_file_into_hash(): f->ino: %u\n", f->ino));
+
+	list_add(&f->hash, &f->c->hash[i]);
+	return 0;
+}
+
+
+/* Insert a file into the file system tree.  */
+int
+jffs_insert_file_into_tree(struct jffs_file *f)
+{
+	struct jffs_file *parent;
+
+	D3(printk("jffs_insert_file_into_tree(): name: \"%s\"\n",
+		  (f->name ? f->name : "")));
+
+	if (!(parent = jffs_find_file(f->c, f->pino))) {
+		if (f->pino == 0) {
+			f->c->root = f;
+			f->parent = 0;
+			f->sibling_prev = 0;
+			f->sibling_next = 0;
+			return 0;
+		}
+		else {
+			D1(printk("jffs_insert_file_into_tree(): Found "
+				  "inode with no parent and pino == %u\n",
+				  f->pino));
+			return -1;
+		}
+	}
+	f->parent = parent;
+	f->sibling_next = parent->children;
+	if (f->sibling_next) {
+		f->sibling_next->sibling_prev = f;
+	}
+	f->sibling_prev = 0;
+	parent->children = f;
+	return 0;
+}
+
+
+/* Remove a file from the hash table.  */
+int
+jffs_unlink_file_from_hash(struct jffs_file *f)
+{
+	D3(printk("jffs_unlink_file_from_hash(): f: 0x%p, "
+		  "ino %u\n", f, f->ino));
+
+	list_del(&f->hash);
+	return 0;
+}
+
+
+/* Just remove the file from the parent's children.  Don't free
+   any memory.  */
+int
+jffs_unlink_file_from_tree(struct jffs_file *f)
+{
+	D3(printk("jffs_unlink_file_from_tree(): ino: %d, pino: %d, name: "
+		  "\"%s\"\n", f->ino, f->pino, (f->name ? f->name : "")));
+
+	if (f->sibling_prev) {
+		f->sibling_prev->sibling_next = f->sibling_next;
+	}
+	else if (f->parent) {
+	        D3(printk("f->parent=%p\n", f->parent));
+		f->parent->children = f->sibling_next;
+	}
+	if (f->sibling_next) {
+		f->sibling_next->sibling_prev = f->sibling_prev;
+	}
+	return 0;
+}
+
+
+/* Find a file with its inode number.  */
+struct jffs_file *
+jffs_find_file(struct jffs_control *c, __u32 ino)
+{
+	struct jffs_file *f;
+	int i = ino % c->hash_len;
+	struct list_head *tmp;
+
+	D3(printk("jffs_find_file(): ino: %u\n", ino));
+
+	for (tmp = c->hash[i].next; tmp != &c->hash[i]; tmp = tmp->next) {
+		f = list_entry(tmp, struct jffs_file, hash);
+		if (ino != f->ino)
+			continue;
+		D3(printk("jffs_find_file(): Found file with ino "
+			       "%u. (name: \"%s\")\n",
+			       ino, (f->name ? f->name : ""));
+		);
+		return f;
+	}
+	D3(printk("jffs_find_file(): Didn't find file "
+			 "with ino %u.\n", ino);
+	);
+	return NULL;
+}
+
+
+/* Find a file in a directory.  We are comparing the names.  */
+struct jffs_file *
+jffs_find_child(struct jffs_file *dir, const char *name, int len)
+{
+	struct jffs_file *f;
+
+	D3(printk("jffs_find_child()\n"));
+
+	for (f = dir->children; f; f = f->sibling_next) {
+		if (f->name
+		    && !strncmp(f->name, name, len)
+		    && f->name[len] == '\0') {
+			break;
+		}
+	}
+
+	D3(if (f) {
+		printk("jffs_find_child(): Found \"%s\".\n", f->name);
+	}
+	else {
+		char *copy = (char *) kmalloc(len + 1, GFP_KERNEL);
+		if (copy) {
+			memcpy(copy, name, len);
+			copy[len] = '\0';
+		}
+		printk("jffs_find_child(): Didn't find the file \"%s\".\n",
+		       (copy ? copy : ""));
+		if (copy) {
+			kfree(copy);
+		}
+	});
+
+	return f;
+}
+
+
+/* Write a raw inode that takes up a certain amount of space in the flash
+   memory.  At the end of the flash device, there is often space that is
+   impossible to use.  At these times we want to mark this space as not
+   used.  In the cases when the amount of space is greater or equal than
+   a struct jffs_raw_inode, we write a "dummy node" that takes up this
+   space.  The space after the raw inode, if it exists, is left as it is.
+   Since this space after the raw inode contains JFFS_EMPTY_BITMASK bytes,
+   we can compute the checksum of it; we don't have to manipulate it any
+   further.
+
+   If the space left on the device is less than the size of a struct
+   jffs_raw_inode, this space is filled with JFFS_DIRTY_BITMASK bytes.
+   No raw inode is written this time.  */
+static int
+jffs_write_dummy_node(struct jffs_control *c, struct jffs_fm *dirty_fm)
+{
+	struct jffs_fmcontrol *fmc = c->fmc;
+	int err;
+
+	D1(printk("jffs_write_dummy_node(): dirty_fm->offset = 0x%08x, "
+		  "dirty_fm->size = %u\n",
+		  dirty_fm->offset, dirty_fm->size));
+
+	if (dirty_fm->size >= sizeof(struct jffs_raw_inode)) {
+		struct jffs_raw_inode raw_inode;
+		memset(&raw_inode, 0, sizeof(struct jffs_raw_inode));
+		raw_inode.magic = JFFS_MAGIC_BITMASK;
+		raw_inode.dsize = dirty_fm->size
+				  - sizeof(struct jffs_raw_inode);
+		raw_inode.dchksum = raw_inode.dsize * 0xff;
+		raw_inode.chksum
+		= jffs_checksum(&raw_inode, sizeof(struct jffs_raw_inode));
+
+		if ((err = flash_safe_write(fmc->mtd,
+					    dirty_fm->offset,
+					    (u_char *)&raw_inode,
+					    sizeof(struct jffs_raw_inode)))
+		    < 0) {
+                       printk(KERN_ERR "JFFS: jffs_write_dummy_node: "
+                              "flash_safe_write failed!\n");
+			return err;
+		}
+	}
+	else {
+		flash_safe_acquire(fmc->mtd);
+		flash_memset(fmc->mtd, dirty_fm->offset, 0, dirty_fm->size);
+		flash_safe_release(fmc->mtd);
+	}
+
+	D3(printk("jffs_write_dummy_node(): Leaving...\n"));
+	return 0;
+}
+
+/* Write a raw inode, possibly its name and possibly some data.  */
+int
+jffs_write_node(struct jffs_control *c, struct jffs_node *node,
+		struct jffs_raw_inode *raw_inode,
+		const char *name, const unsigned char *data)
+{
+	struct jffs_fmcontrol *fmc = c->fmc;
+	struct jffs_fm *fm;
+	__u32 pos;
+	int err;
+	__u32 total_name_size = raw_inode->nsize
+				+ JFFS_GET_PAD_BYTES(raw_inode->nsize);
+	__u32 total_data_size = raw_inode->dsize
+				+ JFFS_GET_PAD_BYTES(raw_inode->dsize);
+	__u32 total_size = sizeof(struct jffs_raw_inode)
+			   + total_name_size + total_data_size;
+
+	/* Fire the retrorockets and shoot the fruiton torpedoes, sir!  */
+
+	ASSERT(if (!node) {
+		printk("jffs_write_node(): node == NULL\n");
+		return -EINVAL;
+	});
+	ASSERT(if (raw_inode && raw_inode->nsize && !name) {
+		printk("*** jffs_write_node(): nsize = %u but name == NULL\n",
+		       raw_inode->nsize);
+		return -EINVAL;
+	});
+
+	D1(printk("jffs_write_node(): filename = \"%s\", ino = %u, "
+		  "version = %u, total_size = %u\n",
+		  (name ? name : ""), raw_inode->ino,
+		  raw_inode->version, total_size));
+
+	/* First try to allocate some flash memory.  */
+	if ((err = jffs_fmalloc(fmc, total_size, node, &fm)) < 0) {
+		D(printk("jffs_write_node(): jffs_fmalloc(0x%p, %u) "
+			 "failed!\n", fmc, total_size));
+		return err;
+	}
+	else if (!fm->nodes) {
+		/* The jffs_fm struct that we got is not good enough.
+		   Make that space dirty.  */
+		if ((err = jffs_write_dummy_node(c, fm)) < 0) {
+			D(printk("jffs_write_node(): "
+				 "jffs_write_dummy_node(): Failed!\n"));
+			kfree(fm);
+			DJM(no_jffs_fm--);
+			return err;
+		}
+		/* Get a new one.  */
+		if ((err = jffs_fmalloc(fmc, total_size, node, &fm)) < 0) {
+			D(printk("jffs_write_node(): Second "
+				 "jffs_fmalloc(0x%p, %u) failed!\n",
+				 fmc, total_size));
+			return err;
+		}
+	}
+	node->fm = fm;
+
+	ASSERT(if (fm->nodes == 0) {
+		printk(KERN_ERR "jffs_write_node(): fm->nodes == 0\n");
+	});
+
+	pos = node->fm->offset;
+
+	/* Compute the checksum for the data and name chunks.  */
+	raw_inode->dchksum = jffs_checksum(data, raw_inode->dsize);
+	raw_inode->nchksum = jffs_checksum(name, raw_inode->nsize);
+
+	/* The checksum is calculated without the chksum and accurate
+	   fields so set them to zero first.  */
+	raw_inode->accurate = 0;
+	raw_inode->chksum = 0;
+	raw_inode->chksum = jffs_checksum(raw_inode,
+					  sizeof(struct jffs_raw_inode));
+	raw_inode->accurate = 0xff;
+
+	D3(printk("jffs_write_node(): About to write this raw inode to the "
+		  "flash at pos 0x%ld:\n", (long)pos));
+	D3(jffs_print_raw_inode(raw_inode));
+
+	/* Step 1: Write the raw jffs inode to the flash.  */
+	if ((err = flash_safe_write(fmc->mtd, pos,
+				    (u_char *)raw_inode,
+				    sizeof(struct jffs_raw_inode))) < 0) {
+		jffs_fmfree_partly(fmc, fm,
+				   total_name_size + total_data_size);
+               printk(KERN_ERR "JFFS: jffs_write_node: Failed to write "
+                      "raw_inode.\n");
+		return err;
+	}
+	pos += sizeof(struct jffs_raw_inode);
+
+	/* Step 2: Write the name, if there is any.  */
+	if (raw_inode->nsize) {
+		if ((err = flash_safe_write(fmc->mtd, pos,
+                                 	    (u_char *)name,
+					    raw_inode->nsize)) < 0) {
+			jffs_fmfree_partly(fmc, fm, total_data_size);
+			printk(KERN_ERR "JFFS: jffs_write_node: Failed to "
+                              "write the name.\n");
+			return err;
+		}
+		pos += total_name_size;
+	}
+
+	/* Step 3: Append the actual data, if any.  */
+	if (raw_inode->dsize) {
+		if ((err = flash_safe_write(fmc->mtd, pos, data,
+					    raw_inode->dsize)) < 0) {
+			jffs_fmfree_partly(fmc, fm, 0);
+                        printk(KERN_ERR "JFFS: jffs_write_node: Failed to "
+			       "write the data.\n");
+			return err;
+		}
+	}
+
+	D3(printk("jffs_write_node(): Leaving...\n"));
+	return raw_inode->dsize;
+} /* jffs_write_node()  */
+
+
+/* Read data from the node and write it to the buffer.  'node_offset'
+   is how much we have read from this particular node before and which
+   shouldn't be read again.  'max_size' is how much space there is in
+   the buffer.  */
+static int
+jffs_get_node_data(struct jffs_file *f, struct jffs_node *node, char *buf,
+		   __u32 node_offset, __u32 max_size, kdev_t dev)
+{
+	struct jffs_fmcontrol *fmc = f->c->fmc;
+	__u32 pos = node->fm->offset + node->fm_offset + node_offset;
+	__u32 avail = node->data_size - node_offset;
+	__u32 r;
+
+	D2(printk("  jffs_get_node_data(): file: \"%s\", ino: %u, "
+		  "version: %u, node_offset: %u\n",
+		  f->name, node->ino, node->version, node_offset));
+
+	r = jffs_min(avail, max_size);
+	flash_safe_read(fmc->mtd, pos, buf, r);
+
+	D3(printk("  jffs_get_node_data(): Read %u byte%s.\n",
+		  r, (r == 1 ? "" : "s")));
+
+	return r;
+}
+
+
+/* Read data from the file's nodes.  Write the data to the buffer
+   'buf'.  'read_offset' tells how much data we should skip.  */
+int
+jffs_read_data(struct jffs_file *f, char *buf, __u32 read_offset, __u32 size)
+{
+	struct jffs_node *node;
+	__u32 read_data = 0; /* Total amount of read data.  */
+	__u32 node_offset = 0;
+	__u32 pos = 0; /* Number of bytes traversed.  */
+
+	D1(printk("jffs_read_data(): file = \"%s\", read_offset = %d, "
+		  "size = %u\n",
+		  (f->name ? f->name : ""), read_offset, size));
+
+	if (read_offset >= f->size) {
+		D(printk("  f->size: %d\n", f->size));
+		return 0;
+	}
+
+	/* First find the node to read data from.  */
+	node = f->range_head;
+	while (pos <= read_offset) {
+		node_offset = read_offset - pos;
+		if (node_offset >= node->data_size) {
+			pos += node->data_size;
+			node = node->range_next;
+		}
+		else {
+			break;
+		}
+	}
+
+	/* "Cats are living proof that not everything in nature
+	   has to be useful."
+	   - Garrison Keilor ('97)  */
+
+	/* Fill the buffer.  */
+	while (node && (read_data < size)) {
+		int r;
+		if (!node->fm) {
+			/* This node does not refer to real data.  */
+			r = jffs_min(size - read_data,
+				     node->data_size - node_offset);
+			memset(&buf[read_data], 0, r);
+		}
+		else if ((r = jffs_get_node_data(f, node, &buf[read_data],
+						 node_offset,
+						 size - read_data,
+						 f->c->sb->s_dev)) < 0) {
+			return r;
+		}
+		read_data += r;
+		node_offset = 0;
+		node = node->range_next;
+	}
+	D3(printk("  jffs_read_data(): Read %u bytes.\n", read_data));
+	return read_data;
+}
+
+
+/* Used for traversing all nodes in the hash table.  */
+int
+jffs_foreach_file(struct jffs_control *c, int (*func)(struct jffs_file *))
+{
+	int pos;
+	int r;
+	int result = 0;
+
+	for (pos = 0; pos < c->hash_len; pos++) {
+		struct list_head *p, *next;
+		for (p = c->hash[pos].next; p != &c->hash[pos]; p = next) {
+			/* We need a reference to the next file in the
+			   list because `func' might remove the current
+			   file `f'.  */
+			next = p->next;
+			r = func(list_entry(p, struct jffs_file, hash));
+			if (r < 0)
+				return r;
+			result += r;
+		}
+	}
+
+	return result;
+}
+
+
+/* Free all memory associated with a file.  */
+int
+jffs_free_node_list(struct jffs_file *f)
+{
+	struct jffs_node *node;
+	struct jffs_node *p;
+
+	D3(printk("jffs_free_node_list(): f #%u, \"%s\"\n",
+		  f->ino, (f->name ? f->name : "")));
+	node = f->version_head;
+	while (node) {
+		p = node;
+		node = node->version_next;
+		kfree(p);
+		DJM(no_jffs_node--);
+	}
+	return 0;
+}
+
+
+/* See if a file is deleted. If so, mark that file's nodes as obsolete.  */
+int
+jffs_possibly_delete_file(struct jffs_file *f)
+{
+	struct jffs_node *n;
+
+	D3(printk("jffs_possibly_delete_file(): ino: %u\n",
+		  f->ino));
+
+	ASSERT(if (!f) {
+		printk(KERN_ERR "jffs_possibly_delete_file(): f == NULL\n");
+		return -1;
+	});
+
+	if (f->deleted) {
+		/* First try to remove all older versions.  */
+		for (n = f->version_head; n; n = n->version_next) {
+			if (!n->fm) {
+				continue;
+			}
+			if (jffs_fmfree(f->c->fmc, n->fm, n) < 0) {
+				break;
+			}
+		}
+		/* Unlink the file from the filesystem.  */
+		jffs_unlink_file_from_tree(f);
+		jffs_unlink_file_from_hash(f);
+		jffs_free_node_list(f);
+		if (f->name) {
+			kfree(f->name);
+			DJM(no_name--);
+		}
+		kfree(f);
+		DJM(no_jffs_file--);
+	}
+	return 0;
+}
+
+
+/* Used in conjunction with jffs_foreach_file() to count the number
+   of files in the file system.  */
+int
+jffs_file_count(struct jffs_file *f)
+{
+	return 1;
+}
+
+
+/* Build up a file's range list from scratch by going through the
+   version list.  */
+int
+jffs_build_file(struct jffs_file *f)
+{
+	struct jffs_node *n;
+
+	D3(printk("jffs_build_file(): ino: %u, name: \"%s\"\n",
+		  f->ino, (f->name ? f->name : "")));
+
+	for (n = f->version_head; n; n = n->version_next) {
+		jffs_update_file(f, n);
+	}
+	return 0;
+}
+
+
+/* Remove an amount of data from a file. If this amount of data is
+   zero, that could mean that a node should be split in two parts.
+   We remove or change the appropriate nodes in the lists.
+
+   Starting offset of area to be removed is node->data_offset,
+   and the length of the area is in node->removed_size.   */
+static void
+jffs_delete_data(struct jffs_file *f, struct jffs_node *node)
+{
+	struct jffs_node *n;
+	__u32 offset = node->data_offset;
+	__u32 remove_size = node->removed_size;
+
+	D3(printk("jffs_delete_data(): offset = %u, remove_size = %u\n",
+		  offset, remove_size));
+
+	if (remove_size == 0
+	    && f->range_tail
+	    && f->range_tail->data_offset + f->range_tail->data_size
+	       == offset) {
+		/* A simple append; nothing to remove or no node to split.  */
+		return;
+	}
+
+	/* Find the node where we should begin the removal.  */
+	for (n = f->range_head; n; n = n->range_next) {
+		if (n->data_offset + n->data_size > offset) {
+			break;
+		}
+	}
+	if (!n) {
+		/* If there's no data in the file there's no data to
+		   remove either.  */
+		return;
+	}
+
+	if (n->data_offset > offset) {
+		/* XXX: Not implemented yet.  */
+		printk(KERN_WARNING "JFFS: An unexpected situation "
+		       "occurred in jffs_delete_data.\n");
+	}
+	else if (n->data_offset < offset) {
+		/* See if the node has to be split into two parts.  */
+		if (n->data_offset + n->data_size < offset + remove_size) {
+			/* Do the split.  */
+			struct jffs_node *new_node;
+			D3(printk("jffs_delete_data(): Split node with "
+				  "version number %u.\n", n->version));
+
+			if (!(new_node = (struct jffs_node *)
+					 kmalloc(sizeof(struct jffs_node),
+						 GFP_KERNEL))) {
+				D(printk("jffs_delete_data(): -ENOMEM\n"));
+				return;
+			}
+			DJM(no_jffs_node++);
+
+			new_node->ino = n->ino;
+			new_node->version = n->version;
+			new_node->data_offset = offset;
+			new_node->data_size = n->data_size
+					      - (remove_size
+						 + (offset - n->data_offset));
+			new_node->fm_offset = n->fm_offset + n->data_size
+					      + remove_size;
+			new_node->name_size = n->name_size;
+			new_node->fm = n->fm;
+			new_node->version_prev = n;
+			new_node->version_next = n->version_next;
+			if (new_node->version_next) {
+				new_node->version_next->version_prev
+				= new_node;
+			}
+			else {
+				f->version_tail = new_node;
+			}
+			n->version_next = new_node;
+			new_node->range_prev = n;
+			new_node->range_next = n->range_next;
+			if (new_node->range_next) {
+				new_node->range_next->range_prev = new_node;
+			}
+			else {
+				f->range_tail = new_node;
+			}
+			/* A very interesting can of worms.  */
+			n->range_next = new_node;
+			n->data_size = offset - n->data_offset;
+			jffs_add_node(new_node);
+			n = new_node->range_next;
+			remove_size = 0;
+		}
+		else {
+			/* No.  No need to split the node.  Just remove
+			   the end of the node.  */
+			int r = jffs_min(n->data_offset + n->data_size
+					 - offset, remove_size);
+			n->data_size -= r;
+			remove_size -= r;
+			n = n->range_next;
+		}
+	}
+
+	/* Remove as many nodes as necessary.  */
+	while (n && remove_size) {
+		if (n->data_size <= remove_size) {
+			struct jffs_node *p = n;
+			remove_size -= n->data_size;
+			n = n->range_next;
+			D3(printk("jffs_delete_data(): Removing node: "
+				  "ino: %u, version: %u\n",
+				  p->ino, p->version));
+			if (p->fm) {
+				jffs_fmfree(f->c->fmc, p->fm, p);
+			}
+			jffs_unlink_node_from_range_list(f, p);
+			jffs_unlink_node_from_version_list(f, p);
+			kfree(p);
+			DJM(no_jffs_node--);
+		}
+		else {
+			n->data_size -= remove_size;
+			n->fm_offset += remove_size;
+			n->data_offset -= (node->removed_size - remove_size);
+			n = n->range_next;
+			break;
+		}
+	}
+
+	/* Adjust the following nodes' information about offsets etc.  */
+	while (n && node->removed_size) {
+		n->data_offset -= node->removed_size;
+		n = n->range_next;
+	}
+
+	f->size -= node->removed_size;
+	D3(printk("jffs_delete_data(): f->size = %d\n", f->size));
+} /* jffs_delete_data()  */
+
+
+/* Insert some data into a file.  Prior to the call to this function,
+   jffs_delete_data() should be called.  */
+static void
+jffs_insert_data(struct jffs_file *f, struct jffs_node *node)
+{
+	D3(printk("jffs_insert_data(): node->data_offset = %u, "
+		  "node->data_size = %u, f->size = %u\n",
+		  node->data_offset, node->data_size, f->size));
+
+	/* Find the position where we should insert data.  */
+
+	if (node->data_offset == f->size) {
+		/* A simple append.  This is the most common operation.  */
+		node->range_next = 0;
+		node->range_prev = f->range_tail;
+		if (node->range_prev) {
+			node->range_prev->range_next = node;
+		}
+		f->range_tail = node;
+		f->size += node->data_size;
+		if (!f->range_head) {
+			f->range_head = node;
+		}
+	}
+	else if (node->data_offset < f->size) {
+		/* Trying to insert data into the middle of the file.  This
+		   means no problem because jffs_delete_data() has already
+		   prepared the range list for us.  */
+		struct jffs_node *n;
+
+		/* Find the correct place for the insertion and then insert
+		   the node.  */
+		for (n = f->range_head; n; n = n->range_next) {
+			D1(printk("Cool stuff's happening!\n"));
+
+			if (n->data_offset == node->data_offset) {
+				node->range_prev = n->range_prev;
+				if (node->range_prev) {
+					node->range_prev->range_next = node;
+				}
+				else {
+					f->range_head = node;
+				}
+				node->range_next = n;
+				n->range_prev = node;
+				break;
+			}
+			ASSERT(else if (n->data_offset + n->data_size >
+					node->data_offset) {
+				printk(KERN_ERR "jffs_insert_data(): "
+				       "Couldn't find a place to insert "
+				       "the data!\n");
+				return;
+			});
+		}
+
+		/* Adjust later nodes' offsets etc.  */
+		n = node->range_next;
+		while (n) {
+			n->data_offset += node->data_size;
+			n = n->range_next;
+		}
+		f->size += node->data_size;
+	}
+	else if (node->data_offset > f->size) {
+		/* Not implemented yet.  */
+#if 0
+		/* Below is some example code for future use if we decide
+		   to implement it.  */
+		/* This is code that isn't supported by VFS. So there aren't
+		   really any reasons to implement it yet.  */
+		if (!f->range_head) {
+			if (node->data_offset > f->size) {
+				if (!(nn = jffs_alloc_node())) {
+					D(printk("jffs_insert_data(): "
+						 "Allocation failed.\n"));
+					return;
+				}
+				nn->version = JFFS_MAGIC_BITMASK;
+				nn->data_offset = 0;
+				nn->data_size = node->data_offset;
+				nn->removed_size = 0;
+				nn->fm_offset = 0;
+				nn->name_size = 0;
+				nn->fm = 0; /* This is a virtual data holder.  */
+				nn->version_prev = 0;
+				nn->version_next = 0;
+				nn->range_prev = 0;
+				nn->range_next = 0;
+				nh->range_head = nn;
+				nh->range_tail = nn;
+			}
+		}
+#endif
+	}
+
+	D3(printk("jffs_insert_data(): f->size = %d\n", f->size));
+}
+
+
+/* A new node (with data) has been added to the file and now the range
+   list has to be modified.  */
+static int
+jffs_update_file(struct jffs_file *f, struct jffs_node *node)
+{
+	D3(printk("jffs_update_file(): ino: %u, version: %u\n",
+		  f->ino, node->version));
+
+	if (node->data_size == 0) {
+		if (node->removed_size == 0) {
+			/* data_offset == X  */
+			/* data_size == 0  */
+			/* remove_size == 0  */
+		}
+		else {
+			/* data_offset == X  */
+			/* data_size == 0  */
+			/* remove_size != 0  */
+			jffs_delete_data(f, node);
+		}
+	}
+	else {
+		/* data_offset == X  */
+		/* data_size != 0  */
+		/* remove_size == Y  */
+		jffs_delete_data(f, node);
+		jffs_insert_data(f, node);
+	}
+	return 0;
+}
+
+
+/* Print the contents of a node.  */
+void
+jffs_print_node(struct jffs_node *n)
+{
+	D(printk("jffs_node: 0x%p\n", n));
+	D(printk("{\n"));
+	D(printk("        0x%08x, /* version  */\n", n->version));
+	D(printk("        0x%08x, /* data_offset  */\n", n->data_offset));
+	D(printk("        0x%08x, /* data_size  */\n", n->data_size));
+	D(printk("        0x%08x, /* removed_size  */\n", n->removed_size));
+	D(printk("        0x%08x, /* fm_offset  */\n", n->fm_offset));
+	D(printk("        0x%02x,       /* name_size  */\n", n->name_size));
+	D(printk("        0x%p, /* fm,  fm->offset: %u  */\n",
+		 n->fm, n->fm->offset));
+	D(printk("        0x%p, /* version_prev  */\n", n->version_prev));
+	D(printk("        0x%p, /* version_next  */\n", n->version_next));
+	D(printk("        0x%p, /* range_prev  */\n", n->range_prev));
+	D(printk("        0x%p, /* range_next  */\n", n->range_next));
+	D(printk("}\n"));
+}
+
+
+/* Print the contents of a raw inode.  */
+void
+jffs_print_raw_inode(struct jffs_raw_inode *raw_inode)
+{
+	D(printk("jffs_raw_inode: inode number: %u\n", raw_inode->ino));
+	D(printk("{\n"));
+	D(printk("        0x%08x, /* magic  */\n", raw_inode->magic));
+	D(printk("        0x%08x, /* ino  */\n", raw_inode->ino));
+	D(printk("        0x%08x, /* pino  */\n", raw_inode->pino));
+	D(printk("        0x%08x, /* version  */\n", raw_inode->version));
+	D(printk("        0x%08x, /* mode  */\n", raw_inode->mode));
+	D(printk("        0x%04x,     /* uid  */\n", raw_inode->uid));
+	D(printk("        0x%04x,     /* gid  */\n", raw_inode->gid));
+	D(printk("        0x%08x, /* atime  */\n", raw_inode->atime));
+	D(printk("        0x%08x, /* mtime  */\n", raw_inode->mtime));
+	D(printk("        0x%08x, /* ctime  */\n", raw_inode->ctime));
+	D(printk("        0x%08x, /* offset  */\n", raw_inode->offset));
+	D(printk("        0x%08x, /* dsize  */\n", raw_inode->dsize));
+	D(printk("        0x%08x, /* rsize  */\n", raw_inode->rsize));
+	D(printk("        0x%02x,       /* nsize  */\n", raw_inode->nsize));
+	D(printk("        0x%02x,       /* nlink  */\n", raw_inode->nlink));
+	D(printk("        0x%02x,       /* spare  */\n",
+		 raw_inode->spare));
+	D(printk("        %u,          /* rename  */\n",
+		 raw_inode->rename));
+	D(printk("        %u,          /* deleted  */\n",
+		 raw_inode->deleted));
+	D(printk("        0x%02x,       /* accurate  */\n",
+		 raw_inode->accurate));
+	D(printk("        0x%08x, /* dchksum  */\n", raw_inode->dchksum));
+	D(printk("        0x%04x,     /* nchksum  */\n", raw_inode->nchksum));
+	D(printk("        0x%04x,     /* chksum  */\n", raw_inode->chksum));
+	D(printk("}\n"));
+}
+
+
+/* Print the contents of a file.  */
+int
+jffs_print_file(struct jffs_file *f)
+{
+	D(int i);
+	D(printk("jffs_file: 0x%p\n", f));
+	D(printk("{\n"));
+	D(printk("        0x%08x, /* ino  */\n", f->ino));
+	D(printk("        0x%08x, /* pino  */\n", f->pino));
+	D(printk("        0x%08x, /* mode  */\n", f->mode));
+	D(printk("        0x%04x,     /* uid  */\n", f->uid));
+	D(printk("        0x%04x,     /* gid  */\n", f->gid));
+	D(printk("        0x%08x, /* atime  */\n", f->atime));
+	D(printk("        0x%08x, /* mtime  */\n", f->mtime));
+	D(printk("        0x%08x, /* ctime  */\n", f->ctime));
+	D(printk("        0x%02x,       /* nsize  */\n", f->nsize));
+	D(printk("        0x%02x,       /* nlink  */\n", f->nlink));
+	D(printk("        0x%02x,       /* deleted  */\n", f->deleted));
+	D(printk("        \"%s\", ", (f->name ? f->name : "")));
+	D(for (i = strlen(f->name ? f->name : ""); i < 8; ++i) {
+		printk(" ");
+	});
+	D(printk("/* name  */\n"));
+	D(printk("        0x%08x, /* size  */\n", f->size));
+	D(printk("        0x%08x, /* highest_version  */\n",
+		 f->highest_version));
+	D(printk("        0x%p, /* c  */\n", f->c));
+	D(printk("        0x%p, /* parent  */\n", f->parent));
+	D(printk("        0x%p, /* children  */\n", f->children));
+	D(printk("        0x%p, /* sibling_prev  */\n", f->sibling_prev));
+	D(printk("        0x%p, /* sibling_next  */\n", f->sibling_next));
+	D(printk("        0x%p, /* hash_prev  */\n", f->hash.prev));
+	D(printk("        0x%p, /* hash_next  */\n", f->hash.next));
+	D(printk("        0x%p, /* range_head  */\n", f->range_head));
+	D(printk("        0x%p, /* range_tail  */\n", f->range_tail));
+	D(printk("        0x%p, /* version_head  */\n", f->version_head));
+	D(printk("        0x%p, /* version_tail  */\n", f->version_tail));
+	D(printk("}\n"));
+	return 0;
+}
+
+
+void
+jffs_print_hash_table(struct jffs_control *c)
+{
+	int i;
+
+	printk("JFFS: Dumping the file system's hash table...\n");
+	for (i = 0; i < c->hash_len; i++) {
+		struct list_head *p;
+		for (p = c->hash[i].next; p != &c->hash[i]; p = p->next) {
+			struct jffs_file *f=list_entry(p,struct jffs_file,hash);
+			printk("*** c->hash[%u]: \"%s\" "
+			       "(ino: %u, pino: %u)\n",
+			       i, (f->name ? f->name : ""),
+			       f->ino, f->pino);
+		}
+	}
+}
+
+
+void
+jffs_print_tree(struct jffs_file *first_file, int indent)
+{
+	struct jffs_file *f;
+	char *space;
+
+	if (!first_file) {
+		return;
+	}
+
+	if (!(space = (char *) kmalloc(indent + 1, GFP_KERNEL))) {
+		printk("jffs_print_tree(): Out of memory!\n");
+		return;
+	}
+
+	memset(space, ' ', indent);
+	space[indent] = '\0';
+
+	for (f = first_file; f; f = f->sibling_next) {
+		printk("%s%s (ino: %u, highest_version: %u, size: %u)\n",
+		       space, (f->name ? f->name : "/"),
+		       f->ino, f->highest_version, f->size);
+		if (S_ISDIR(f->mode)) {
+			jffs_print_tree(f->children, indent + 2);
+		}
+	}
+
+	kfree(space);
+}
+
+
+#if defined(JFFS_MEMORY_DEBUG) && JFFS_MEMORY_DEBUG
+void
+jffs_print_memory_allocation_statistics(void)
+{
+	static long printout = 0;
+	printk("________ Memory printout #%ld ________\n", ++printout);
+	printk("no_jffs_file = %ld\n", no_jffs_file);
+	printk("no_jffs_node = %ld\n", no_jffs_node);
+	printk("no_jffs_control = %ld\n", no_jffs_control);
+	printk("no_jffs_raw_inode = %ld\n", no_jffs_raw_inode);
+	printk("no_jffs_node_ref = %ld\n", no_jffs_node_ref);
+	printk("no_jffs_fm = %ld\n", no_jffs_fm);
+	printk("no_jffs_fmcontrol = %ld\n", no_jffs_fmcontrol);
+	printk("no_hash = %ld\n", no_hash);
+	printk("no_name = %ld\n", no_name);
+	printk("\n");
+}
+#endif
+
+
+/* Rewrite `size' bytes, and begin at `node'.  */
+int
+jffs_rewrite_data(struct jffs_file *f, struct jffs_node *node, int size)
+{
+	struct jffs_control *c = f->c;
+	struct jffs_fmcontrol *fmc = c->fmc;
+	struct jffs_raw_inode raw_inode;
+	struct jffs_node *new_node;
+	struct jffs_fm *fm;
+	__u32 pos;
+	__u32 pos_dchksum;
+	__u32 total_name_size;
+	__u32 total_data_size;
+	__u32 total_size;
+	int err;
+
+	D1(printk("***jffs_rewrite_data(): node: %u, name: \"%s\", size: %u\n",
+		  f->ino, (f->name ? f->name : ""), size));
+
+	/* Create and initialize the new node.  */
+	if (!(new_node = (struct jffs_node *)
+			 kmalloc(sizeof(struct jffs_node), GFP_KERNEL))) {
+		D(printk("jffs_rewrite_data(): "
+			 "Failed to allocate node.\n"));
+		return -ENOMEM;
+	}
+	DJM(no_jffs_node++);
+	new_node->data_offset = node->data_offset;
+	new_node->data_size = size;
+	new_node->removed_size = size;
+	total_name_size = f->nsize + JFFS_GET_PAD_BYTES(f->nsize);
+	total_data_size = size + JFFS_GET_PAD_BYTES(size);
+	total_size = sizeof(struct jffs_raw_inode)
+		     + total_name_size + total_data_size;
+	new_node->fm_offset = sizeof(struct jffs_raw_inode)
+			      + total_name_size;
+
+	if ((err = jffs_fmalloc(fmc, total_size, new_node, &fm)) < 0) {
+		D(printk("jffs_rewrite_data(): Failed to allocate fm.\n"));
+		kfree(new_node);
+		DJM(no_jffs_node--);
+		return err;
+	}
+	else if (!fm->nodes) {
+		/* The jffs_fm struct that we got is not good enough.  */
+		if ((err = jffs_write_dummy_node(c, fm)) < 0) {
+			D(printk("jffs_rewrite_data(): "
+				 "jffs_write_dummy_node() Failed!\n"));
+			kfree(fm);
+			DJM(no_jffs_fm--);
+			return err;
+		}
+		/* Get a new one.  */
+		if ((err = jffs_fmalloc(fmc, total_size, node, &fm)) < 0) {
+			D(printk("jffs_rewrite_data(): Second "
+				 "jffs_fmalloc(0x%p, %u) failed!\n",
+				 fmc, total_size));
+			return err;
+		}
+	}
+	new_node->fm = fm;
+
+	ASSERT(if (new_node->fm->nodes == 0) {
+		printk(KERN_ERR "jffs_rewrite_data(): "
+		       "new_node->fm->nodes == 0\n");
+	});
+
+	/* Initialize the raw inode.  */
+	raw_inode.magic = JFFS_MAGIC_BITMASK;
+	raw_inode.ino = f->ino;
+	raw_inode.pino = f->pino;
+	raw_inode.version = f->highest_version + 1;
+	raw_inode.mode = f->mode;
+	raw_inode.uid = f->uid;
+	raw_inode.gid = f->gid;
+	raw_inode.atime = f->atime;
+	raw_inode.mtime = f->mtime;
+	raw_inode.ctime = f->ctime;
+	raw_inode.offset = node->data_offset;
+	raw_inode.dsize = size;
+	raw_inode.rsize = size;
+	raw_inode.nsize = f->nsize;
+	raw_inode.nlink = f->nlink;
+	raw_inode.spare = 0;
+	raw_inode.rename = 0;
+	raw_inode.deleted = 0;
+	raw_inode.accurate = 0xff;
+	raw_inode.dchksum = 0;
+	raw_inode.nchksum = 0;
+
+	pos = new_node->fm->offset;
+	pos_dchksum = pos +JFFS_RAW_INODE_DCHKSUM_OFFSET;
+
+	D3(printk("jffs_rewrite_data(): Writing this raw inode "
+		  "to pos 0x%ul.\n", pos));
+	D3(jffs_print_raw_inode(&raw_inode));
+
+	if ((err = flash_safe_write(fmc->mtd, pos,
+				    (u_char *) &raw_inode,
+				    sizeof(struct jffs_raw_inode)
+				    - sizeof(__u32)
+				    - sizeof(__u16) - sizeof(__u16))) < 0) {
+                printk(KERN_ERR "JFFS: jffs_rewrite_data: Write error during "
+                         "rewrite. (raw inode)\n");
+		jffs_fmfree_partly(fmc, fm,
+				   total_name_size + total_data_size);
+		return err;
+	}
+	pos += sizeof(struct jffs_raw_inode);
+
+	/* Write the name to the flash memory.  */
+	if (f->nsize) {
+		D3(printk("jffs_rewrite_data(): Writing name \"%s\" to "
+			  "pos 0x%ul.\n", f->name, (long)pos));
+		if ((err = flash_safe_write(fmc->mtd, pos,
+					    (u_char *)f->name,
+					    f->nsize)) < 0) {
+                        printk(KERN_ERR "JFFS: jffs_rewrite_data: Write "
+                               "error during rewrite. (name)\n");
+			jffs_fmfree_partly(fmc, fm, total_data_size);
+			return err;
+		}
+		pos += total_name_size;
+		raw_inode.nchksum = jffs_checksum(f->name, f->nsize);
+	}
+
+	/* Write the data.  */
+	if (size) {
+		int r;
+		unsigned char *page;
+		__u32 offset = node->data_offset;
+
+		if (!(page = (unsigned char *)__get_free_page(GFP_KERNEL))) {
+			jffs_fmfree_partly(fmc, fm, 0);
+			return -1;
+		}
+
+		while (size) {
+			__u32 s = jffs_min(size, PAGE_SIZE);
+			if ((r = jffs_read_data(f, (char *)page,
+						offset, s)) < s) {
+                                printk(KERN_ERR "JFFS: jffs_rewrite_data: "
+					 "jffs_read_data() "
+					 "failed! (r = %d)\n", r);
+				jffs_fmfree_partly(fmc, fm, 0);
+				return -1;
+			}
+			if ((err = flash_safe_write(fmc->mtd,
+						    pos, page, r)) < 0) {
+                                printk(KERN_ERR "JFFS: jffs_rewrite_data: "
+                                       "Write error during rewrite. "
+                                       "(data)\n");
+				free_page((unsigned long)page);
+				jffs_fmfree_partly(fmc, fm, 0);
+				return err;
+			}
+			pos += r;
+			size -= r;
+			offset += r;
+			raw_inode.dchksum += jffs_checksum(page, r);
+		}
+
+	        free_page((unsigned long)page);
+	}
+
+	raw_inode.accurate = 0;
+	raw_inode.chksum = jffs_checksum(&raw_inode,
+					 sizeof(struct jffs_raw_inode)
+					 - sizeof(__u16));
+
+	/* Add the checksum.  */
+	if ((err
+	     = flash_safe_write(fmc->mtd, pos_dchksum,
+				&((u_char *)
+				&raw_inode)[JFFS_RAW_INODE_DCHKSUM_OFFSET],
+				sizeof(__u32) + sizeof(__u16)
+				+ sizeof(__u16))) < 0) {
+                printk(KERN_ERR "JFFS: jffs_rewrite_data: Write error during "
+                         "rewrite. (checksum)\n");
+		jffs_fmfree_partly(fmc, fm, 0);
+		return err;
+	}
+
+	/* Now make the file system aware of the newly written node.  */
+	jffs_insert_node(c, f, &raw_inode, f->name, new_node);
+
+	D3(printk("jffs_rewrite_data(): Leaving...\n"));
+	return 0;
+} /* jffs_rewrite_data()  */
+
+
+/* jffs_garbage_collect_next implements one step in the garbage collect
+   process and is often called multiple times at each occasion of a
+   garbage collect.  */
+int
+jffs_garbage_collect_next(struct jffs_control *c)
+{
+	struct jffs_fmcontrol *fmc = c->fmc;
+	struct jffs_node *node;
+	struct jffs_file *f;
+	int size;
+        int data_size;
+        int total_name_size;
+	int free_size = fmc->flash_size	- (fmc->used_size + fmc->dirty_size);
+	__u32 free_chunk_size1 = jffs_free_size1(fmc);
+	D2(__u32 free_chunk_size2 = jffs_free_size2(fmc));
+
+	/* Get the oldest node in the flash.  */
+	node = jffs_get_oldest_node(fmc);
+	ASSERT(if (!node) {
+                printk(KERN_ERR "JFFS: jffs_garbage_collect_next: "
+                       "No oldest node found!\n");
+		return -1;
+	});
+
+	/* Find its corresponding file too.  */
+	f = jffs_find_file(c, node->ino);
+	ASSERT(if (!f) {
+                printk(KERN_ERR "JFFS: jffs_garbage_collect_next: "
+                       "No file to garbage collect! "
+                       "(ino = 0x%08x)\n", node->ino);
+		return -1;
+	});
+
+	D1(printk("jffs_garbage_collect_next(): \"%s\", "
+		  "ino: %u, version: %u\n",
+		  (f->name ? f->name : ""), node->ino, node->version));
+
+	/* Compute how much we want to rewrite at the moment.  */
+        data_size = f->size - node->data_offset;
+        total_name_size = f->nsize + JFFS_GET_PAD_BYTES(f->nsize);
+        size = sizeof(struct jffs_raw_inode) + total_name_size
+               + data_size + JFFS_GET_PAD_BYTES(data_size);
+
+        D2(printk("  total_name_size: %u\n", total_name_size));
+        D2(printk("  data_size: %u\n", data_size));
+	D2(printk("  size: %u\n", size));
+	D2(printk("  f->nsize: %u\n", f->nsize));
+	D2(printk("  f->size: %u\n", f->size));
+	D2(printk("  free_chunk_size1: %u\n", free_chunk_size1));
+	D2(printk("  free_chunk_size2: %u\n", free_chunk_size2));
+
+	if (size > fmc->max_chunk_size) {
+		size = fmc->max_chunk_size;
+                data_size = size - sizeof(struct jffs_raw_inode)
+                            - total_name_size;
+	}
+	if (size > free_chunk_size1) {
+
+		if (free_chunk_size1 <
+		    (sizeof(struct jffs_raw_inode) + f->nsize + BLOCK_SIZE)) {
+			/* The space left is too small to be of any
+			   use really.  */
+			struct jffs_fm *dirty_fm
+			= jffs_fmalloced(fmc,
+					 fmc->tail->offset + fmc->tail->size,
+					 free_chunk_size1, NULL);
+                        if (!dirty_fm) {
+                                printk(KERN_ERR "JFFS: "
+                                       "jffs_garbage_collect_next: "
+                                       "Failed to allocate `dirty' "
+                                       "flash memory!\n");
+				return -1;
+			}
+			jffs_write_dummy_node(c, dirty_fm);
+			goto jffs_garbage_collect_next_end;
+		}
+
+		size = free_chunk_size1;
+                data_size = size - sizeof(struct jffs_raw_inode)
+                            - total_name_size;
+	}
+
+	D2(printk("  size: %u (again)\n", size));
+
+	if (free_size - size < fmc->sector_size) {
+		/* Just rewrite that node (or even less).  */
+                jffs_rewrite_data(f, node,
+                                  jffs_min(node->data_size, data_size));
+	}
+	else {
+		size -= (sizeof(struct jffs_raw_inode) + f->nsize);
+                jffs_rewrite_data(f, node, data_size);
+	}
+
+jffs_garbage_collect_next_end:
+        D3(printk("jffs_garbage_collect_next: Leaving...\n"));
+	return 0;
+} /* jffs_garbage_collect_next */
+
+
+/* If an obsolete node is partly going to be erased due to garbage
+   collection, the part that isn't going to be erased must be filled
+   with zeroes so that the scan of the flash will work smoothly next
+   time.
+     There are two phases in this procedure: First, the clearing of
+   the name and data parts of the node. Second, possibly also clearing
+   a part of the raw inode as well.  If the box is power cycled during
+   the first phase, only the checksum of this node-to-be-cleared-at-
+   the-end will be wrong.  If the box is power cycled during, or after,
+   the clearing of the raw inode, the information like the length of
+   the name and data parts are zeroed.  The next time the box is
+   powered up, the scanning algorithm manages this faulty data too
+   because:
+
+   - The checksum is invalid and thus the raw inode must be discarded
+     in any case.
+   - If the lengths of the data part or the name part are zeroed, the
+     scanning just continues after the raw inode.  But after the inode
+     the scanning procedure just finds zeroes which is the same as
+     dirt.
+
+   So, in the end, this could never fail. :-)  Even if it does fail,
+   the scanning algorithm should manage that too.  */
+
+static int
+jffs_clear_end_of_node(struct jffs_control *c, __u32 erase_size)
+{
+	struct jffs_fm *fm;
+	struct jffs_fmcontrol *fmc = c->fmc;
+	__u32 zero_offset;
+	__u32 zero_size;
+	__u32 zero_offset_data;
+	__u32 zero_size_data;
+	__u32 cutting_raw_inode = 0;
+
+	if (!(fm = jffs_cut_node(fmc, erase_size))) {
+		D3(printk("jffs_clear_end_of_node(): fm == NULL\n"));
+		return 0;
+	}
+
+	/* Where and how much shall we clear?  */
+	zero_offset = fmc->head->offset + erase_size;
+	zero_size = fm->offset + fm->size - zero_offset;
+
+	/* Do we have to clear the raw_inode explicitly?  */
+	if (fm->size - zero_size < sizeof(struct jffs_raw_inode)) {
+		cutting_raw_inode = sizeof(struct jffs_raw_inode)
+				    - (fm->size - zero_size);
+	}
+
+	/* First, clear the name and data fields.  */
+	zero_offset_data = zero_offset + cutting_raw_inode;
+	zero_size_data = zero_size - cutting_raw_inode;
+	flash_safe_acquire(fmc->mtd);
+	flash_memset(fmc->mtd, zero_offset_data, 0, zero_size_data);
+	flash_safe_release(fmc->mtd);
+
+	/* Should we clear a part of the raw inode?  */
+	if (cutting_raw_inode) {
+		/* I guess it is ok to clear the raw inode in this order.  */
+		flash_safe_acquire(fmc->mtd);
+		flash_memset(fmc->mtd, zero_offset, 0,
+			     cutting_raw_inode);
+		flash_safe_release(fmc->mtd);
+	}
+
+	return 0;
+} /* jffs_clear_end_of_node()  */
+
+/* Try to erase as much as possible of the dirt in the flash memory.  */
+long
+jffs_try_to_erase(struct jffs_control *c)
+{
+	struct jffs_fmcontrol *fmc = c->fmc;
+	long erase_size;
+	int err;
+	__u32 offset;
+
+	D3(printk("jffs_try_to_erase()\n"));
+
+	erase_size = jffs_erasable_size(fmc);
+
+	D2(printk("jffs_try_to_erase(): erase_size = %ld\n", erase_size));
+
+        if (erase_size == 0) {
+                return 0;
+        }
+        else if (erase_size < 0) {
+                printk(KERN_ERR "JFFS: jffs_try_to_erase: "
+                       "jffs_erasable_size returned %ld.\n", erase_size);
+		return erase_size;
+	}
+
+        if ((err = jffs_clear_end_of_node(c, erase_size)) < 0) {
+                printk(KERN_ERR "JFFS: jffs_try_to_erase: "
+                       "Clearing of node failed.\n");
+                return err;
+	}
+
+	offset = fmc->head->offset - fmc->flash_start;
+
+	/* Now, let's try to do the erase.  */
+	if ((err = flash_erase_region(fmc->mtd,
+				      offset, erase_size)) < 0) {
+		printk(KERN_ERR "JFFS: Erase of flash failed. "
+		       "offset = %u, erase_size = %ld\n",
+		       offset, erase_size);
+		/* XXX: Here we should allocate this area as dirty
+		   with jffs_fmalloced or something similar.  Now
+		   we just report the error.  */
+		return err;
+	}
+
+#if 0
+	/* Check if the erased sectors really got erased.  */
+	{
+		__u32 pos;
+		__u32 end;
+
+		pos = (__u32)flash_get_direct_pointer(c->sb->s_dev, offset);
+		end = pos + erase_size;
+
+		D2(printk("JFFS: Checking erased sector(s)...\n"));
+
+		flash_safe_acquire(fmc->mtd);
+
+		for (; pos < end; pos += 4) {
+			if (*(__u32 *)pos != JFFS_EMPTY_BITMASK) {
+				printk("JFFS: Erase failed! pos = 0x%ld\n",
+				       (long)pos);
+				jffs_hexdump(fmc->mtd, pos,
+					     jffs_min(256, end - pos));
+				err = -1;
+				break;
+			}
+		}
+
+		flash_safe_release(fmc->mtd);
+
+		if (!err) {
+			D2(printk("JFFS: Erase succeeded.\n"));
+		}
+		else {
+			/* XXX: Here we should allocate the memory
+			   with jffs_fmalloced() in order to prevent
+			   JFFS from using this area accidentally.  */
+			return err;
+		}
+	}
+#endif
+
+	/* Update the flash memory data structures.  */
+	jffs_sync_erase(fmc, erase_size);
+
+	return erase_size;
+}
+
+
+/* There are different criteria that should trigger a garbage collect:
+   
+   1. There is too much dirt in the memory.
+   2. The free space is becoming small.
+   3. There are many versions of a node.
+
+   The garbage collect should always be done in a manner that guarantees
+   that future garbage collects cannot be locked.  E.g. Rewritten chunks
+   should not be too large (span more than one sector in the flash memory
+   for exemple).  Of course there is a limit on how intelligent this garbage
+   collection can be.  */
+int
+jffs_garbage_collect(struct jffs_control *c)
+{
+	struct jffs_fmcontrol *fmc = c->fmc;
+	long erased_total = 0;
+	long erased;
+	int result = 0;
+	D1(int i = 1);
+
+	D2(printk("***jffs_garbage_collect(): fmc->dirty_size = %u\n",
+		  fmc->dirty_size));
+	D2(jffs_print_fmcontrol(fmc));
+
+	c->fmc->no_call_gc = 1;
+
+	/* While there is too much dirt left and it is possible
+	   to garbage collect, do so.  */
+
+	while (fmc->dirty_size >= fmc->sector_size) {
+
+		D1(printk("***jffs_garbage_collect(): round #%u, "
+			 "fmc->dirty_size = %u\n", i++, fmc->dirty_size));
+		D2(jffs_print_fmcontrol(fmc));
+
+		/* At least one sector should be able to free now.  */
+		if ((erased = jffs_try_to_erase(c)) < 0) {
+			printk(KERN_WARNING "JFFS: Error in "
+			       "garbage collector.\n");
+			result = erased;
+			goto gc_end;
+		}
+		else if (erased == 0) {
+			__u32 free_size = fmc->flash_size
+					  - (fmc->used_size
+					     + fmc->dirty_size);
+
+			if (free_size > 0) {
+				/* Let's dare to make a garbage collect.  */
+				if ((result = jffs_garbage_collect_next(c))
+				    < 0) {
+					printk(KERN_ERR "JFFS: Something "
+					       "has gone seriously wrong "
+					       "with a garbage collect.\n");
+					goto gc_end;
+				}
+			}
+			else {
+				/* What should we do here?  */
+				D(printk("   jffs_garbage_collect(): "
+					 "erased: %ld, free_size: %u\n",
+					 erased, free_size));
+				result = -1;
+				goto gc_end;
+			}
+		}
+
+		D1(printk("   jffs_garbage_collect(): erased: %ld\n", erased));
+		erased_total += erased;
+		DJM(jffs_print_memory_allocation_statistics());
+	}
+
+
+gc_end:
+	c->fmc->no_call_gc = 0;
+
+	D3(printk("   jffs_garbage_collect(): Leaving...\n"));
+	D1(if (erased_total) {
+		printk("erased_total = %ld\n", erased_total);
+		jffs_print_fmcontrol(fmc);
+	});
+	return result;
+}
diff --git a/fs/jffs/intrep.h b/fs/jffs/intrep.h
new file mode 100644
index 000000000..3336c69e6
--- /dev/null
+++ b/fs/jffs/intrep.h
@@ -0,0 +1,64 @@
+/*
+ * JFFS -- Journaling Flash File System, Linux implementation.
+ *
+ * Copyright (C) 1999, 2000  Axis Communications AB.
+ *
+ * Created by Finn Hakansson <finn@axis.com>.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * $Id: intrep.h,v 1.2 2000/05/24 13:13:56 alex Exp $
+ *
+ */
+
+#ifndef __LINUX_JFFS_INTREP_H__
+#define __LINUX_JFFS_INTREP_H__
+
+inline int jffs_min(int a, int b);
+inline int jffs_max(int a, int b);
+__u32 jffs_checksum(const void *data, int size);
+
+void jffs_cleanup_control(struct jffs_control *c);
+int jffs_build_fs(struct super_block *sb);
+
+int jffs_insert_node(struct jffs_control *c, struct jffs_file *f,
+		     const struct jffs_raw_inode *raw_inode,
+		     const char *name, struct jffs_node *node);
+struct jffs_file *jffs_find_file(struct jffs_control *c, __u32 ino);
+struct jffs_file *jffs_find_child(struct jffs_file *dir, const char *name, int len);
+
+void jffs_free_node(struct jffs_node *node);
+
+int jffs_foreach_file(struct jffs_control *c, int (*func)(struct jffs_file *));
+int jffs_free_node_list(struct jffs_file *f);
+int jffs_possibly_delete_file(struct jffs_file *f);
+int jffs_build_file(struct jffs_file *f);
+int jffs_insert_file_into_hash(struct jffs_file *f);
+int jffs_insert_file_into_tree(struct jffs_file *f);
+int jffs_unlink_file_from_hash(struct jffs_file *f);
+int jffs_unlink_file_from_tree(struct jffs_file *f);
+int jffs_remove_redundant_nodes(struct jffs_file *f);
+int jffs_file_count(struct jffs_file *f);
+
+int jffs_write_node(struct jffs_control *c, struct jffs_node *node,
+		    struct jffs_raw_inode *raw_inode,
+		    const char *name, const unsigned char *buf);
+int jffs_read_data(struct jffs_file *f, char *buf, __u32 read_offset, __u32 size);
+
+/* Garbage collection stuff.  */
+int jffs_garbage_collect(struct jffs_control *c);
+
+/* For debugging purposes.  */
+void jffs_print_node(struct jffs_node *n);
+void jffs_print_raw_inode(struct jffs_raw_inode *raw_inode);
+int jffs_print_file(struct jffs_file *f);
+void jffs_print_hash_table(struct jffs_control *c);
+void jffs_print_tree(struct jffs_file *first_file, int indent);
+
+struct buffer_head *jffs_get_write_buffer(kdev_t dev, int block);
+void jffs_put_write_buffer(struct buffer_head *bh);
+
+#endif /* __LINUX_JFFS_INTREP_H__  */
diff --git a/fs/jffs/jffs_fm.c b/fs/jffs/jffs_fm.c
new file mode 100644
index 000000000..c1fe3a7b9
--- /dev/null
+++ b/fs/jffs/jffs_fm.c
@@ -0,0 +1,747 @@
+/*
+ * JFFS -- Journaling Flash File System, Linux implementation.
+ *
+ * Copyright (C) 1999, 2000  Axis Communications AB.
+ *
+ * Created by Finn Hakansson <finn@axis.com>.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * $Id: jffs_fm.c,v 1.6 2000/06/30 14:13:03 dwmw2 Exp $
+ *
+ * Ported to Linux 2.3.x and MTD:
+ * Copyright (C) 2000  Alexander Larsson (alex@cendio.se), Cendio Systems AB
+ *
+ */
+#define __NO_VERSION__
+#include <linux/malloc.h>
+#include <linux/blkdev.h>
+#include <linux/jffs.h>
+#include "jffs_fm.h"
+
+#if defined(CONFIG_JFFS_FS_VERBOSE) && CONFIG_JFFS_FS_VERBOSE
+#define D(x) x
+#else
+#define D(x)
+#endif
+#define D1(x) D(x)
+#define D2(x) 
+#define D3(x) 
+#define ASSERT(x) x
+
+#if defined(JFFS_MARK_OBSOLETE) && JFFS_MARK_OBSOLETE
+static int jffs_mark_obsolete(struct jffs_fmcontrol *fmc, __u32 fm_offset);
+#endif
+
+
+/* This function creates a new shiny flash memory control structure.  */
+struct jffs_fmcontrol *
+jffs_build_begin(struct jffs_control *c, kdev_t dev)
+{
+	struct jffs_fmcontrol *fmc;
+	struct mtd_info *mtd;
+	
+	D3(printk("jffs_build_begin()\n"));
+	fmc = (struct jffs_fmcontrol *)kmalloc(sizeof(struct jffs_fmcontrol),
+					       GFP_KERNEL);
+	if (!fmc) {
+		D(printk("jffs_build_begin(): Allocation of "
+			 "struct jffs_fmcontrol failed!\n"));
+		return (struct jffs_fmcontrol *)0;
+	}
+	DJM(no_jffs_fmcontrol++);
+
+	mtd = get_mtd_device(NULL, MINOR(dev));
+
+	if (!mtd)
+		return NULL;
+	
+	/* Retrieve the size of the flash memory.  */
+	fmc->flash_start = 0;
+	fmc->flash_size = mtd->size;
+	D3(printk("  fmc->flash_start = 0x%08x\n", fmc->flash_start));
+	D3(printk("  fmc->flash_size = %d bytes\n", fmc->flash_size));
+
+	fmc->used_size = 0;
+	fmc->dirty_size = 0;
+	fmc->sector_size = 65536;
+	fmc->max_chunk_size = fmc->sector_size >> 1;
+	fmc->min_free_size = (fmc->sector_size << 1) - fmc->max_chunk_size;
+	fmc->mtd = mtd;
+	fmc->no_call_gc = 0;
+	fmc->c = c;
+	fmc->head = 0;
+	fmc->tail = 0;
+	fmc->head_extra = 0;
+	fmc->tail_extra = 0;
+	return fmc;
+}
+
+
+/* When the flash memory scan has completed, this function should be called
+   before use of the control structure.  */
+void
+jffs_build_end(struct jffs_fmcontrol *fmc)
+{
+	D3(printk("jffs_build_end()\n"));
+
+	if (!fmc->head) {
+		fmc->head = fmc->head_extra;
+		fmc->tail = fmc->tail_extra;
+	}
+	else if (fmc->head_extra) {
+		fmc->tail_extra->next = fmc->head;
+		fmc->head->prev = fmc->tail_extra;
+		fmc->head = fmc->head_extra;
+	}
+	fmc->head_extra = 0; /* These two instructions should be omitted.  */
+	fmc->tail_extra = 0;
+	D3(jffs_print_fmcontrol(fmc));
+}
+
+
+/* Call this function when the file system is unmounted.  This function
+   frees all memory used by this module.  */
+void
+jffs_cleanup_fmcontrol(struct jffs_fmcontrol *fmc)
+{
+	if (fmc) {
+		struct jffs_fm *cur;
+		struct jffs_fm *next = fmc->head;
+
+		while ((cur = next)) {
+			next = next->next;
+			kfree(cur);
+			DJM(no_jffs_fm--);
+		}
+		put_mtd_device(fmc->mtd);
+		kfree(fmc);
+		DJM(no_jffs_fmcontrol--);
+	}
+}
+
+
+/* This function returns the size of the first chunk of free space on the
+   flash memory.  This function will return something nonzero if the flash
+   memory contains any free space.  */
+__u32
+jffs_free_size1(struct jffs_fmcontrol *fmc)
+{
+	__u32 head;
+	__u32 tail;
+	__u32 end = fmc->flash_start + fmc->flash_size;
+
+	if (!fmc->head) {
+		/* There is nothing on the flash.  */
+		return fmc->flash_size;
+	}
+
+	/* Compute the beginning and ending of the contents of the flash.  */
+	head = fmc->head->offset;
+	tail = fmc->tail->offset + fmc->tail->size;
+	if (tail == end) {
+		tail = fmc->flash_start;
+	}
+	ASSERT(else if (tail > end) {
+		printk(KERN_WARNING "jffs_free_size1(): tail > end\n");
+		tail = fmc->flash_start;
+	});
+
+	if (head <= tail) {
+		return end - tail;
+	}
+	else {
+		return head - tail;
+	}
+}
+
+/* This function will return something nonzero in case there are two free
+   areas on the flash.  Like this:
+
+     +----------------+------------------+----------------+
+     |     FREE 1     |   USED / DIRTY   |     FREE 2     |
+     +----------------+------------------+----------------+
+       fmc->head -----^
+       fmc->tail ------------------------^
+
+   The value returned, will be the size of the first empty area on the
+   flash, in this case marked "FREE 1".  */
+__u32
+jffs_free_size2(struct jffs_fmcontrol *fmc)
+{
+	if (fmc->head) {
+		__u32 head = fmc->head->offset;
+		__u32 tail = fmc->tail->offset + fmc->tail->size;
+		if (tail == fmc->flash_start + fmc->flash_size) {
+			tail = fmc->flash_start;
+		}
+
+		if (tail >= head) {
+			return head - fmc->flash_start;
+		}
+	}
+	return 0;
+}
+
+
+/* Allocate a chunk of flash memory.  If there is enough space on the
+   device, a reference to the associated node is stored in the jffs_fm
+   struct.  */
+int
+jffs_fmalloc(struct jffs_fmcontrol *fmc, __u32 size, struct jffs_node *node,
+	     struct jffs_fm **result)
+{
+	struct jffs_fm *fm;
+	__u32 free_chunk_size1;
+	__u32 free_chunk_size2;
+
+	D2(printk("jffs_fmalloc(): fmc = 0x%p, size = %d, "
+		  "node = 0x%p\n", fmc, size, node));
+
+	*result = 0;
+
+	if (!(fm = (struct jffs_fm*)kmalloc(sizeof(struct jffs_fm),
+					    GFP_KERNEL))) {
+		D(printk("jffs_fmalloc(): kmalloc() failed! (fm)\n"));
+		return -ENOMEM;
+	}
+	DJM(no_jffs_fm++);
+
+	free_chunk_size1 = jffs_free_size1(fmc);
+	free_chunk_size2 = jffs_free_size2(fmc);
+	D3(printk("jffs_fmalloc(): free_chunk_size1 = %u, "
+		  "free_chunk_size2 = %u\n",
+		  free_chunk_size1, free_chunk_size2));
+
+	if (size <= free_chunk_size1) {
+		if (!(fm->nodes = (struct jffs_node_ref *)
+				  kmalloc(sizeof(struct jffs_node_ref),
+					  GFP_KERNEL))) {
+			D(printk("jffs_fmalloc(): kmalloc() failed! "
+				 "(node_ref)\n"));
+			kfree(fm);
+			DJM(no_jffs_fm--);
+			return -ENOMEM;
+		}
+		DJM(no_jffs_node_ref++);
+		fm->nodes->node = node;
+		fm->nodes->next = 0;
+		if (fmc->tail) {
+			fm->offset = fmc->tail->offset + fmc->tail->size;
+			if (fm->offset
+			    == fmc->flash_start + fmc->flash_size) {
+				fm->offset = fmc->flash_start;
+			}
+			ASSERT(else if (fm->offset
+					> fmc->flash_start
+					  + fmc->flash_size) {
+				printk(KERN_WARNING "jffs_fmalloc(): "
+				       "offset > flash_end\n");
+				fm->offset = fmc->flash_start;
+			});
+		}
+		else {
+			/* There don't have to be files in the file
+			   system yet.  */
+			fm->offset = fmc->flash_start;
+		}
+		fm->size = size;
+		fmc->used_size += size;
+	}
+	else if (size > free_chunk_size2) {
+		printk(KERN_WARNING "JFFS: Tried to allocate a too "
+		       "large flash memory chunk. (size = %u)\n", size);
+		kfree(fm);
+		DJM(no_jffs_fm--);
+		return -ENOSPC;
+	}
+	else {
+		fm->offset = fmc->tail->offset + fmc->tail->size;
+		fm->size = free_chunk_size1;
+		fm->nodes = 0;
+		fmc->dirty_size += fm->size; /* Changed by simonk. This seemingly fixes a 
+						bug that caused infinite garbage collection.
+						It previously set fmc->dirty_size to size (which is the
+						size of the requested chunk).
+					     */
+	}
+
+	fm->next = 0;
+	if (!fmc->head) {
+		fm->prev = 0;
+		fmc->head = fm;
+		fmc->tail = fm;
+	}
+	else {
+		fm->prev = fmc->tail;
+		fmc->tail->next = fm;
+		fmc->tail = fm;
+	}
+
+	D3(jffs_print_fmcontrol(fmc));
+	D3(jffs_print_fm(fm));
+	*result = fm;
+	return 0;
+}
+
+
+/* The on-flash space is not needed anymore by the passed node.  Remove
+   the reference to the node from the node list.  If the data chunk in
+   the flash memory isn't used by any more nodes anymore (fm->nodes == 0),
+   then mark that chunk as dirty.  */
+int
+jffs_fmfree(struct jffs_fmcontrol *fmc, struct jffs_fm *fm, struct jffs_node *node)
+{
+	struct jffs_node_ref *ref;
+	struct jffs_node_ref *prev;
+	ASSERT(int del = 0);
+
+	D2(printk("jffs_fmfree(): node->ino = %u, node->version = %u\n",
+		 node->ino, node->version));
+
+	ASSERT(if (!fmc || !fm || !fm->nodes) {
+		printk(KERN_ERR "jffs_fmfree(): fmc: 0x%p, fm: 0x%p, "
+		       "fm->nodes: 0x%p\n",
+		       fmc, fm, (fm ? fm->nodes : 0));
+		return -1;
+	});
+
+	/* Find the reference to the node that is going to be removed
+	   and remove it.  */
+	for (ref = fm->nodes, prev = 0; ref; ref = ref->next) {
+		if (ref->node == node) {
+			if (prev) {
+				prev->next = ref->next;
+			}
+			else {
+				fm->nodes = ref->next;
+			}
+			kfree(ref);
+			DJM(no_jffs_node_ref--);
+			ASSERT(del = 1);
+			break;
+		}
+		prev = ref;
+	}
+
+	/* If the data chunk in the flash memory isn't used anymore
+	   just mark it as obsolete.  */
+	if (!fm->nodes) {
+		/* No node uses this chunk so let's remove it.  */
+		fmc->used_size -= fm->size;
+		fmc->dirty_size += fm->size;
+#if defined(JFFS_MARK_OBSOLETE) && JFFS_MARK_OBSOLETE
+		if (jffs_mark_obsolete(fmc, fm->offset) < 0) {
+			D1(printk("jffs_fmfree(): Failed to mark an on-flash "
+				  "node obsolete!\n"));
+			return -1;
+		}
+#endif
+		fmc->c->sb->s_dirt = 1;
+	}
+
+	ASSERT(if (!del) {
+		printk(KERN_WARNING "***jffs_fmfree(): "
+		       "Didn't delete any node reference!\n");
+	});
+
+	return 0;
+}
+
+
+/* This allocation function is used during the initialization of
+   the file system.  */
+struct jffs_fm *
+jffs_fmalloced(struct jffs_fmcontrol *fmc, __u32 offset, __u32 size,
+	       struct jffs_node *node)
+{
+	struct jffs_fm *fm;
+
+	D3(printk("jffs_fmalloced()\n"));
+
+	if (!(fm = (struct jffs_fm *)kmalloc(sizeof(struct jffs_fm),
+					     GFP_KERNEL))) {
+		D(printk("jffs_fmalloced(0x%p, %u, %u, 0x%p): failed!\n",
+			 fmc, offset, size, node));
+		return 0;
+	}
+	DJM(no_jffs_fm++);
+	fm->offset = offset;
+	fm->size = size;
+	fm->prev = 0;
+	fm->next = 0;
+	fm->nodes = 0;
+	if (node) {
+		/* `node' exists and it should be associated with the
+		    jffs_fm structure `fm'.  */
+		if (!(fm->nodes = (struct jffs_node_ref *)
+				  kmalloc(sizeof(struct jffs_node_ref),
+					  GFP_KERNEL))) {
+			D(printk("jffs_fmalloced(): !fm->nodes\n"));
+			kfree(fm);
+			DJM(no_jffs_fm--);
+			return 0;
+		}
+		DJM(no_jffs_node_ref++);
+		fm->nodes->node = node;
+		fm->nodes->next = 0;
+		fmc->used_size += size;
+	}
+	else {
+		/* If there is no node, then this is just a chunk of dirt.  */
+		fmc->dirty_size += size;
+	}
+
+	if (fmc->head_extra) {
+		fm->prev = fmc->tail_extra;
+		fmc->tail_extra->next = fm;
+		fmc->tail_extra = fm;
+	}
+	else if (!fmc->head) {
+		fmc->head = fm;
+		fmc->tail = fm;
+	}
+	else if (fmc->tail->offset + fmc->tail->size < offset) {
+		fmc->head_extra = fm;
+		fmc->tail_extra = fm;
+	}
+	else {
+		fm->prev = fmc->tail;
+		fmc->tail->next = fm;
+		fmc->tail = fm;
+	}
+	D3(jffs_print_fmcontrol(fmc));
+	D3(jffs_print_fm(fm));
+	return fm;
+}
+
+
+/* Add a new node to an already existing jffs_fm struct.  */
+int
+jffs_add_node(struct jffs_node *node)
+{
+	struct jffs_node_ref *ref;
+	struct jffs_fm *fm = node->fm;
+	int s = sizeof(struct jffs_node_ref);
+
+	D3(printk("jffs_add_node(): ino = %u\n", node->ino));
+
+	if (!(ref = (struct jffs_node_ref *)kmalloc(s, GFP_KERNEL))) {
+		return -ENOMEM;
+	}
+	DJM(no_jffs_node_ref++);
+	ref->node = node;
+	ref->next = fm->nodes;
+	fm->nodes = ref;
+	return 0;
+}
+
+
+/* Free a part of some allocated space.  */
+void
+jffs_fmfree_partly(struct jffs_fmcontrol *fmc, struct jffs_fm *fm, __u32 size)
+{
+	D1(printk("***jffs_fmfree_partly(): fm = 0x%p, fm->nodes = 0x%p, "
+		  "fm->nodes->node->ino = %u, size = %u\n",
+		  fm, (fm ? fm->nodes : 0),
+		  (!fm ? 0 : (!fm->nodes ? 0 : fm->nodes->node->ino)), size));
+
+	if (fm->nodes) {
+		kfree(fm->nodes);
+		DJM(no_jffs_node_ref--);
+		fm->nodes = 0;
+	}
+	fmc->used_size -= fm->size;
+	if (fm == fmc->tail) {
+		fm->size -= size;
+	}
+	fmc->dirty_size += fm->size;
+}
+
+
+/* Find the jffs_fm struct that contains the end of the data chunk that
+   begins at the logical beginning of the flash memory and spans `size'
+   bytes.  If we want to erase a sector of the flash memory, we use this
+   function to find where the sector limit cuts a chunk of data.  */
+struct jffs_fm *
+jffs_cut_node(struct jffs_fmcontrol *fmc, __u32 size)
+{
+	struct jffs_fm *fm;
+	__u32 pos = 0;
+
+	if (size == 0) {
+		return 0;
+	}
+
+	ASSERT(if (!fmc) {
+		printk(KERN_ERR "jffs_cut_node(): fmc == NULL\n");
+		return 0;
+	});
+
+	fm = fmc->head;
+
+	while (fm) {
+		pos += fm->size;
+		if (pos < size) {
+			fm = fm->next;
+		}
+		else if (pos > size) {
+			break;
+		}
+		else {
+			fm = 0;
+			break;
+		}
+	}
+
+	return fm;
+}
+
+
+/* Move the head of the fmc structures and delete the obsolete parts.  */
+void
+jffs_sync_erase(struct jffs_fmcontrol *fmc, int erased_size)
+{
+	struct jffs_fm *fm;
+	struct jffs_fm *del;
+
+	ASSERT(if (!fmc) {
+		printk(KERN_ERR "jffs_sync_erase(): fmc == NULL\n");
+		return;
+	});
+
+	fmc->dirty_size -= erased_size;
+
+	for (fm = fmc->head; fm && (erased_size > 0);) {
+		if (erased_size >= fm->size) {
+			erased_size -= fm->size;
+			del = fm;
+			fm = fm->next;
+			fm->prev = 0;
+			fmc->head = fm;
+			kfree(del);
+			DJM(no_jffs_fm--);
+		}
+		else {
+			fm->size -= erased_size;
+			fm->offset += erased_size;
+			break;
+		}
+	}
+}
+
+
+/* Return the oldest used node in the flash memory.  */
+struct jffs_node *
+jffs_get_oldest_node(struct jffs_fmcontrol *fmc)
+{
+	struct jffs_fm *fm;
+	struct jffs_node_ref *nref;
+	struct jffs_node *node = 0;
+
+	ASSERT(if (!fmc) {
+		printk(KERN_ERR "jffs_get_oldest_node(): fmc == NULL\n");
+		return 0;
+	});
+
+	for (fm = fmc->head; fm && !fm->nodes; fm = fm->next);
+
+	if (!fm) {
+		return 0;
+	}
+
+	/* The oldest node is the last one in the reference list.  This list
+	   shouldn't be too long; just one or perhaps two elements.  */
+	for (nref = fm->nodes; nref; nref = nref->next) {
+		node = nref->node;
+	}
+
+	D2(printk("jffs_get_oldest_node(): ino = %u, version = %u\n",
+		  (node ? node->ino : 0), (node ? node->version : 0)));
+
+	return node;
+}
+
+
+#if defined(JFFS_MARK_OBSOLETE) && JFFS_MARK_OBSOLETE
+
+/* Mark an on-flash node as obsolete.
+
+   Note that this is just an optimization that isn't necessary for the
+   filesystem to work.  */
+
+static int
+jffs_mark_obsolete(struct jffs_fmcontrol *fmc, __u32 fm_offset)
+{
+	/* The `accurate_pos' holds the position of the accurate byte
+	   in the jffs_raw_inode structure that we are going to mark
+	   as obsolete.  */
+	__u32 accurate_pos = fm_offset + JFFS_RAW_INODE_ACCURATE_OFFSET;
+	unsigned char zero = 0x00;
+	size_t len;
+
+	D3(printk("jffs_mark_obsolete(): accurate_pos = %u\n", accurate_pos));
+	ASSERT(if (!fmc) {
+		printk(KERN_ERR "jffs_mark_obsolete(): fmc == NULL\n");
+		return -1;
+	});
+
+	/* Write 0x00 to the raw inode's accurate member.  Don't care
+	   about the return value.  */
+	MTD_WRITE(fmc->mtd, accurate_pos, 1, &len, &zero);
+	return 0;
+}
+
+#endif /* JFFS_MARK_OBSOLETE  */
+
+/* check if it's possible to erase the wanted range, and if not, return
+ * the range that IS erasable, or a negative error code.
+ */
+long
+jffs_flash_erasable_size(struct mtd_info *mtd, __u32 offset, __u32 size)
+{
+         u_long ssize;
+
+	/* assume that sector size for a partition is constant even
+	 * if it spans more than one chip (you usually put the same
+	 * type of chips in a system)
+	 */
+
+        ssize = mtd->erasesize;
+
+	if (offset % ssize) {
+		/* The offset is not sector size aligned.  */
+		return -1;
+	}
+	else if (offset > mtd->size) {
+		return -2;
+	}
+	else if (offset + size > mtd->size) {
+		return -3;
+	}
+
+	return (size / ssize) * ssize;
+}
+
+
+/* How much dirty flash memory is possible to erase at the moment?  */
+long
+jffs_erasable_size(struct jffs_fmcontrol *fmc)
+{
+	struct jffs_fm *fm;
+	__u32 size = 0;
+	long ret;
+
+	ASSERT(if (!fmc) {
+		printk(KERN_ERR "jffs_erasable_size(): fmc = NULL\n");
+		return -1;
+	});
+
+	if (!fmc->head) {
+		/* The flash memory is totally empty. No nodes. No dirt.
+		   Just return.  */
+		return 0;
+	}
+
+	/* Calculate how much space that is dirty.  */
+	for (fm = fmc->head; fm && !fm->nodes; fm = fm->next) {
+		if (size && fm->offset == fmc->flash_start) {
+			/* We have reached the beginning of the flash.  */
+			break;
+		}
+		size += fm->size;
+	}
+
+	/* Someone's signature contained this:
+	   There's a fine line between fishing and just standing on
+	   the shore like an idiot...  */
+	ret = jffs_flash_erasable_size(fmc->mtd,
+				       fmc->head->offset - fmc->flash_start, size);
+
+	ASSERT(if (ret < 0) {
+		printk("jffs_erasable_size: flash_erasable_size() "
+		       "returned something less than zero (%ld).\n", ret);
+		printk("jffs_erasable_size: offset = 0x%08x\n",
+		       fmc->head->offset - fmc->flash_start);
+	});
+
+	/* If there is dirt on the flash (which is the reason to why
+	   this function was called in the first place) but no space is
+	   possible to erase right now, the initial part of the list of
+	   jffs_fm structs, that hold place for dirty space, could perhaps
+	   be shortened.  The list's initial "dirty" elements are merged
+	   into just one large dirty jffs_fm struct.  This operation must
+	   only be performed if nothing is possible to erase.  Otherwise,
+	   jffs_clear_end_of_node() won't work as expected.  */
+	if (ret == 0) {
+		struct jffs_fm *head = fmc->head;
+		struct jffs_fm *del;
+		/* While there are two dirty nodes beside each other.*/
+		while (head->nodes == 0
+		       && head->next
+		       && head->next->nodes == 0) {
+			del = head->next;
+			head->size += del->size;
+			head->next = del->next;
+			if (del->next) {
+				del->next->prev = head;
+			}
+			kfree(del);
+			DJM(no_jffs_fm--);
+		}
+	}
+
+	return (ret >= 0 ? ret : 0);
+}
+
+
+void
+jffs_print_fmcontrol(struct jffs_fmcontrol *fmc)
+{
+	D(printk("struct jffs_fmcontrol: 0x%p\n", fmc));
+	D(printk("{\n"));
+	D(printk("        0x%08x, /* flash_start  */\n", fmc->flash_start));
+	D(printk("        %u, /* flash_size  */\n", fmc->flash_size));
+	D(printk("        %u, /* used_size  */\n", fmc->used_size));
+	D(printk("        %u, /* dirty_size  */\n", fmc->dirty_size));
+	D(printk("        %u, /* sector_size  */\n", fmc->sector_size));
+	D(printk("        %u, /* min_free_size  */\n", fmc->min_free_size));
+	D(printk("        %u, /* max_chunk_size  */\n", fmc->max_chunk_size));
+	D(printk("        0x%p, /* mtd  */\n", fmc->mtd));
+	D(printk("        0x%p, /* head  */    "
+		 "(head->offset = 0x%08x)\n",
+		 fmc->head, (fmc->head ? fmc->head->offset : 0)));
+	D(printk("        0x%p, /* tail  */    "
+		 "(tail->offset + tail->size = 0x%08x)\n",
+		 fmc->tail,
+		 (fmc->tail ? fmc->tail->offset + fmc->tail->size : 0)));
+	D(printk("        0x%p, /* head_extra  */\n", fmc->head_extra));
+	D(printk("        0x%p, /* tail_extra  */\n", fmc->tail_extra));
+	D(printk("}\n"));
+}
+
+void
+jffs_print_fm(struct jffs_fm *fm)
+{
+	D(printk("struct jffs_fm: 0x%p\n", fm));
+	D(printk("{\n"));
+	D(printk("       0x%08x, /* offset  */\n", fm->offset));
+	D(printk("       %u, /* size  */\n", fm->size));
+	D(printk("       0x%p, /* prev  */\n", fm->prev));
+	D(printk("       0x%p, /* next  */\n", fm->next));
+	D(printk("       0x%p, /* nodes  */\n", fm->nodes));
+	D(printk("}\n"));
+}
+
+void
+jffs_print_node_ref(struct jffs_node_ref *ref)
+{
+	D(printk("struct jffs_node_ref: 0x%p\n", ref));
+	D(printk("{\n"));
+	D(printk("       0x%p, /* node  */\n", ref->node));
+	D(printk("       0x%p, /* next  */\n", ref->next));
+	D(printk("}\n"));
+}
diff --git a/fs/jffs/jffs_fm.h b/fs/jffs/jffs_fm.h
new file mode 100644
index 000000000..1461d788a
--- /dev/null
+++ b/fs/jffs/jffs_fm.h
@@ -0,0 +1,124 @@
+/*
+ * JFFS -- Journaling Flash File System, Linux implementation.
+ *
+ * Copyright (C) 1999, 2000  Axis Communications AB.
+ *
+ * Created by Finn Hakansson <finn@axis.com>.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * $Id: jffs_fm.h,v 1.3 2000/07/04 16:15:42 dwmw2 Exp $
+ *
+ * Ported to Linux 2.3.x and MTD:
+ * Copyright (C) 2000  Alexander Larsson (alex@cendio.se), Cendio Systems AB
+ *
+ */
+
+#ifndef __LINUX_JFFS_FM_H__
+#define __LINUX_JFFS_FM_H__
+
+#include <linux/types.h>
+#include <linux/jffs.h>
+#include <linux/mtd/mtd.h>
+
+/* The alignment between two nodes in the flash memory.  */
+#define JFFS_ALIGN_SIZE 4
+
+/* Mark the on-flash space as obsolete when appropriate.  */
+#define JFFS_MARK_OBSOLETE 0
+
+#define CONFIG_JFFS_FS_VERBOSE 0
+
+/* How many padding bytes should be inserted between two chunks of data
+   on the flash?  */
+#define JFFS_GET_PAD_BYTES(size) ((JFFS_ALIGN_SIZE                     \
+				  - ((__u32)(size) % JFFS_ALIGN_SIZE)) \
+				  % JFFS_ALIGN_SIZE)
+
+/* Is there enough space on the flash?  */
+#define JFFS_ENOUGH_SPACE(fmc) (((fmc)->flash_size - (fmc)->used_size \
+				 - (fmc)->dirty_size) >= (fmc)->min_free_size)
+
+
+struct jffs_node_ref
+{
+	struct jffs_node *node;
+	struct jffs_node_ref *next;
+};
+
+
+/* The struct jffs_fm represents a chunk of data in the flash memory.  */
+struct jffs_fm
+{
+	__u32 offset;
+	__u32 size;
+	struct jffs_fm *prev;
+	struct jffs_fm *next;
+	struct jffs_node_ref *nodes; /* USED if != 0.  */
+};
+
+struct jffs_fmcontrol
+{
+	__u32 flash_start;
+	__u32 flash_size;
+	__u32 used_size;
+	__u32 dirty_size;
+	__u32 sector_size;
+	__u32 min_free_size;  /* The minimum free space needed to be able
+				 to perform garbage collections.  */
+	__u32 max_chunk_size; /* The maximum size of a chunk of data.  */
+	struct mtd_info *mtd;
+	__u32 no_call_gc;
+	struct jffs_control *c;
+	struct jffs_fm *head;
+	struct jffs_fm *tail;
+	struct jffs_fm *head_extra;
+	struct jffs_fm *tail_extra;
+};
+
+/* Notice the two members head_extra and tail_extra in the jffs_control
+   structure above. Those are only used during the scanning of the flash
+   memory; while the file system is being built. If the data in the flash
+   memory is organized like
+
+      +----------------+------------------+----------------+
+      |  USED / DIRTY  |       FREE       |  USED / DIRTY  |
+      +----------------+------------------+----------------+
+
+   then the scan is split in two parts. The first scanned part of the
+   flash memory is organized through the members head and tail. The
+   second scanned part is organized with head_extra and tail_extra. When
+   the scan is completed, the two lists are merged together. The jffs_fm
+   struct that head_extra references is the logical beginning of the
+   flash memory so it will be referenced by the head member.  */
+
+
+struct jffs_fmcontrol *jffs_build_begin(struct jffs_control *c, kdev_t dev);
+void jffs_build_end(struct jffs_fmcontrol *fmc);
+void jffs_cleanup_fmcontrol(struct jffs_fmcontrol *fmc);
+
+int jffs_fmalloc(struct jffs_fmcontrol *fmc, __u32 size,
+		 struct jffs_node *node, struct jffs_fm **result);
+int jffs_fmfree(struct jffs_fmcontrol *fmc, struct jffs_fm *fm,
+		struct jffs_node *node);
+
+__u32 jffs_free_size1(struct jffs_fmcontrol *fmc);
+__u32 jffs_free_size2(struct jffs_fmcontrol *fmc);
+void jffs_sync_erase(struct jffs_fmcontrol *fmc, int erased_size);
+struct jffs_fm *jffs_cut_node(struct jffs_fmcontrol *fmc, __u32 size);
+struct jffs_node *jffs_get_oldest_node(struct jffs_fmcontrol *fmc);
+long jffs_erasable_size(struct jffs_fmcontrol *fmc);
+struct jffs_fm *jffs_fmalloced(struct jffs_fmcontrol *fmc, __u32 offset,
+			       __u32 size, struct jffs_node *node);
+int jffs_add_node(struct jffs_node *node);
+void jffs_fmfree_partly(struct jffs_fmcontrol *fmc, struct jffs_fm *fm,
+			__u32 size);
+
+void jffs_print_fmcontrol(struct jffs_fmcontrol *fmc);
+void jffs_print_fm(struct jffs_fm *fm);
+void jffs_print_node_ref(struct jffs_node_ref *ref);
+
+#endif /* __LINUX_JFFS_FM_H__  */
diff --git a/fs/locks.c b/fs/locks.c
index 6ce980735..c1054c341 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1057,6 +1057,16 @@ void locks_remove_posix(struct file *filp, fl_owner_t owner)
 	/*
 	 * For POSIX locks we free all locks on this file for the given task.
 	 */
+	if (!inode->i_flock) {
+		/*
+		 * Notice that something might be grabbing a lock right now.
+		 * Consider it as a race won by us - event is async, so even if
+		 * we miss the lock added we can trivially consider it as added
+		 * after we went through this call.
+		 */
+		return;
+	}
+	lock_kernel();
 repeat:
 	before = &inode->i_flock;
 	while ((fl = *before) != NULL) {
@@ -1066,6 +1076,7 @@ repeat:
 		}
 		before = &fl->fl_next;
 	}
+	unlock_kernel();
 }
 
 /*
@@ -1076,7 +1087,10 @@ void locks_remove_flock(struct file *filp)
 	struct inode * inode = filp->f_dentry->d_inode; 
 	struct file_lock file_lock, *fl;
 	struct file_lock **before;
+	if (!inode->i_flock)
+		return;
 
+	lock_kernel();
 repeat:
 	before = &inode->i_flock;
 	while ((fl = *before) != NULL) {
@@ -1099,6 +1113,7 @@ repeat:
 		}
 		before = &fl->fl_next;
 	}
+	unlock_kernel();
 }
 
 /* The following two are for the benefit of lockd.
diff --git a/fs/namei.c b/fs/namei.c
index fcda2fd61..41cfda556 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -230,14 +230,13 @@ int deny_write_access(struct file * file)
 
 void path_release(struct nameidata *nd)
 {
-	lock_kernel();
 	dput(nd->dentry);
 	mntput(nd->mnt);
-	unlock_kernel();
 }
 
 /*
  * Internal lookup() using the new generic dcache.
+ * SMP-safe
  */
 static struct dentry * cached_lookup(struct dentry * parent, struct qstr * name, int flags)
 {
@@ -258,6 +257,7 @@ static struct dentry * cached_lookup(struct dentry * parent, struct qstr * name,
  *
  * We get the directory semaphore, and after getting that we also
  * make sure that nobody added the entry to the dcache in the meantime..
+ * SMP-safe
  */
 static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, int flags)
 {
@@ -277,7 +277,9 @@ static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, i
 		struct dentry * dentry = d_alloc(parent, name);
 		result = ERR_PTR(-ENOMEM);
 		if (dentry) {
+			lock_kernel();
 			result = dir->i_op->lookup(dir, dentry);
+			unlock_kernel();
 			if (result)
 				dput(dentry);
 			else
@@ -316,12 +318,17 @@ loop:
 
 static inline int __follow_up(struct vfsmount **mnt, struct dentry **base)
 {
-	struct vfsmount *parent=(*mnt)->mnt_parent;
+	struct vfsmount *parent;
 	struct dentry *dentry;
-	if (parent == *mnt)
+	spin_lock(&dcache_lock);
+	parent=(*mnt)->mnt_parent;
+	if (parent == *mnt) {
+		spin_unlock(&dcache_lock);
 		return 0;
+	}
 	mntget(parent);
 	dentry=dget((*mnt)->mnt_mountpoint);
+	spin_unlock(&dcache_lock);
 	dput(*base);
 	*base = dentry;
 	mntput(*mnt);
@@ -336,12 +343,15 @@ int follow_up(struct vfsmount **mnt, struct dentry **dentry)
 
 static inline int __follow_down(struct vfsmount **mnt, struct dentry **dentry)
 {
-	struct list_head *p = (*dentry)->d_vfsmnt.next;
+	struct list_head *p;
+	spin_lock(&dcache_lock);
+	p = (*dentry)->d_vfsmnt.next;
 	while (p != &(*dentry)->d_vfsmnt) {
 		struct vfsmount *tmp;
 		tmp = list_entry(p, struct vfsmount, mnt_clash);
 		if (tmp->mnt_parent == *mnt) {
 			*mnt = mntget(tmp);
+			spin_unlock(&dcache_lock);
 			mntput(tmp->mnt_parent);
 			/* tmp holds the mountpoint, so... */
 			dput(*dentry);
@@ -350,6 +360,7 @@ static inline int __follow_down(struct vfsmount **mnt, struct dentry **dentry)
 		}
 		p = p->next;
 	}
+	spin_unlock(&dcache_lock);
 	return 0;
 }
 
@@ -363,22 +374,29 @@ static inline void follow_dotdot(struct nameidata *nd)
 	while(1) {
 		struct vfsmount *parent;
 		struct dentry *dentry;
+		read_lock(&current->fs->lock);
 		if (nd->dentry == current->fs->root &&
 		    nd->mnt == current->fs->rootmnt)  {
+			read_unlock(&current->fs->lock);
 			break;
 		}
+		read_unlock(&current->fs->lock);
+		spin_lock(&dcache_lock);
 		if (nd->dentry != nd->mnt->mnt_root) {
 			dentry = dget(nd->dentry->d_parent);
+			spin_unlock(&dcache_lock);
 			dput(nd->dentry);
 			nd->dentry = dentry;
 			break;
 		}
 		parent=nd->mnt->mnt_parent;
 		if (parent == nd->mnt) {
+			spin_unlock(&dcache_lock);
 			break;
 		}
 		mntget(parent);
 		dentry=dget(nd->mnt->mnt_mountpoint);
+		spin_unlock(&dcache_lock);
 		dput(nd->dentry);
 		nd->dentry = dentry;
 		mntput(nd->mnt);
@@ -584,11 +602,10 @@ return_err:
 	return err;
 }
 
+/* SMP-safe */
 /* returns 1 if everything is done */
 static int __emul_lookup_dentry(const char *name, struct nameidata *nd)
 {
-	nd->mnt = mntget(current->fs->altrootmnt);
-	nd->dentry = dget(current->fs->altroot);
 	if (path_walk(name, nd))
 		return 0;
 
@@ -596,8 +613,10 @@ static int __emul_lookup_dentry(const char *name, struct nameidata *nd)
 		struct nameidata nd_root;
 		nd_root.last_type = LAST_ROOT;
 		nd_root.flags = nd->flags;
+		read_lock(&current->fs->lock);
 		nd_root.mnt = mntget(current->fs->rootmnt);
 		nd_root.dentry = dget(current->fs->root);
+		read_unlock(&current->fs->lock);
 		if (path_walk(name, &nd_root))
 			return 1;
 		if (nd_root.dentry->d_inode) {
@@ -619,49 +638,65 @@ void set_fs_altroot(void)
 	struct vfsmount *mnt = NULL, *oldmnt;
 	struct dentry *dentry = NULL, *olddentry;
 	if (emul) {
+		read_lock(&current->fs->lock);
 		nd.mnt = mntget(current->fs->rootmnt);
 		nd.dentry = dget(current->fs->root);
+		read_unlock(&current->fs->lock);
 		nd.flags = LOOKUP_FOLLOW|LOOKUP_DIRECTORY|LOOKUP_POSITIVE;
 		if (path_walk(emul,&nd) == 0) {
 			mnt = nd.mnt;
 			dentry = nd.dentry;
 		}
 	}
+	write_lock(&current->fs->lock);
 	oldmnt = current->fs->altrootmnt;
 	olddentry = current->fs->altroot;
 	current->fs->altrootmnt = mnt;
 	current->fs->altroot = dentry;
+	write_unlock(&current->fs->lock);
 	if (olddentry) {
 		dput(olddentry);
 		mntput(oldmnt);
 	}
 }
 
+/* SMP-safe */
 static inline int
 walk_init_root(const char *name, struct nameidata *nd)
 {
-	if (current->fs->altroot && !(nd->flags & LOOKUP_NOALT))
+	read_lock(&current->fs->lock);
+	if (current->fs->altroot && !(nd->flags & LOOKUP_NOALT)) {
+		nd->mnt = mntget(current->fs->altrootmnt);
+		nd->dentry = dget(current->fs->altroot);
+		read_unlock(&current->fs->lock);
 		if (__emul_lookup_dentry(name,nd))
 			return 0;
+		read_lock(&current->fs->lock);
+	}
 	nd->mnt = mntget(current->fs->rootmnt);
 	nd->dentry = dget(current->fs->root);
+	read_unlock(&current->fs->lock);
 	return 1;
 }
 
+/* SMP-safe */
 int path_init(const char *name,unsigned int flags,struct nameidata *nd)
 {
 	nd->last_type = LAST_ROOT; /* if there are only slashes... */
 	nd->flags = flags;
 	if (*name=='/')
 		return walk_init_root(name,nd);
+	read_lock(&current->fs->lock);
 	nd->mnt = mntget(current->fs->pwdmnt);
 	nd->dentry = dget(current->fs->pwd);
+	read_unlock(&current->fs->lock);
 	return 1;
 }
 
 /*
  * Restricted form of lookup. Doesn't follow links, single-component only,
  * needs parent already locked. Doesn't follow mounts.
+ * SMP-safe.
  */
 struct dentry * lookup_hash(struct qstr *name, struct dentry * base)
 {
@@ -692,7 +727,9 @@ struct dentry * lookup_hash(struct qstr *name, struct dentry * base)
 		dentry = ERR_PTR(-ENOMEM);
 		if (!new)
 			goto out;
+		lock_kernel();
 		dentry = inode->i_op->lookup(inode, new);
+		unlock_kernel();
 		if (!dentry)
 			dentry = new;
 		else
@@ -702,6 +739,7 @@ out:
 	return dentry;
 }
 
+/* SMP-safe */
 struct dentry * lookup_one(const char * name, struct dentry * base)
 {
 	unsigned long hash;
@@ -738,6 +776,7 @@ access:
  *
  * namei exists in two versions: namei/lnamei. The only difference is
  * that namei follows links, while lnamei does not.
+ * SMP-safe
  */
 int __user_walk(const char *name, unsigned flags, struct nameidata *nd)
 {
@@ -748,10 +787,8 @@ int __user_walk(const char *name, unsigned flags, struct nameidata *nd)
 	err = PTR_ERR(tmp);
 	if (!IS_ERR(tmp)) {
 		err = 0;
-		lock_kernel();
 		if (path_init(tmp, flags, nd))
 			err = path_walk(tmp, nd);
-		unlock_kernel();
 		putname(tmp);
 	}
 	return err;
@@ -867,7 +904,9 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode)
 		goto exit_lock;
 
 	DQUOT_INIT(dir);
+	lock_kernel();
 	error = dir->i_op->create(dir, dentry, mode);
+	unlock_kernel();
 exit_lock:
 	up(&dir->i_zombie);
 	return error;
@@ -885,6 +924,7 @@ exit_lock:
  *			  11 - read/write permissions needed
  * which is a lot more logical, and also allows the "no perm" needed
  * for symlinks (where the permissions are checked later).
+ * SMP-safe
  */
 int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
 {
@@ -1094,6 +1134,7 @@ do_link:
 	goto do_last;
 }
 
+/* SMP-safe */
 static struct dentry *lookup_create(struct nameidata *nd, int is_dir)
 {
 	struct dentry *dentry;
@@ -1134,7 +1175,9 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
 		goto exit_lock;
 
 	DQUOT_INIT(dir);
+	lock_kernel();
 	error = dir->i_op->mknod(dir, dentry, mode, dev);
+	unlock_kernel();
 exit_lock:
 	up(&dir->i_zombie);
 	return error;
@@ -1153,7 +1196,6 @@ asmlinkage long sys_mknod(const char * filename, int mode, dev_t dev)
 	if (IS_ERR(tmp))
 		return PTR_ERR(tmp);
 
-	lock_kernel();
 	if (path_init(tmp, LOOKUP_PARENT, &nd))
 		error = path_walk(tmp, &nd);
 	if (error)
@@ -1179,7 +1221,6 @@ asmlinkage long sys_mknod(const char * filename, int mode, dev_t dev)
 	up(&nd.dentry->d_inode->i_sem);
 	path_release(&nd);
 out:
-	unlock_kernel();
 	putname(tmp);
 
 	return error;
@@ -1200,7 +1241,9 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
 	DQUOT_INIT(dir);
 	mode &= (S_IRWXUGO|S_ISVTX) & ~current->fs->umask;
+	lock_kernel();
 	error = dir->i_op->mkdir(dir, dentry, mode);
+	unlock_kernel();
 
 exit_lock:
 	up(&dir->i_zombie);
@@ -1218,7 +1261,6 @@ asmlinkage long sys_mkdir(const char * pathname, int mode)
 		struct dentry *dentry;
 		struct nameidata nd;
 
-		lock_kernel();
 		if (path_init(tmp, LOOKUP_PARENT, &nd))
 			error = path_walk(tmp, &nd);
 		if (error)
@@ -1232,7 +1274,6 @@ asmlinkage long sys_mkdir(const char * pathname, int mode)
 		up(&nd.dentry->d_inode->i_sem);
 		path_release(&nd);
 out:
-		unlock_kernel();
 		putname(tmp);
 	}
 
@@ -1257,10 +1298,10 @@ out:
 static void d_unhash(struct dentry *dentry)
 {
 	dget(dentry);
-	switch (dentry->d_count) {
+	switch (atomic_read(&dentry->d_count)) {
 	default:
 		shrink_dcache_parent(dentry);
-		if (dentry->d_count != 2)
+		if (atomic_read(&dentry->d_count) != 2)
 			break;
 	case 2:
 		d_drop(dentry);
@@ -1287,7 +1328,9 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
 	else if (d_mountpoint(dentry))
 		error = -EBUSY;
 	else {
+		lock_kernel();
 		error = dir->i_op->rmdir(dir, dentry);
+		unlock_kernel();
 		if (!error)
 			dentry->d_inode->i_flags |= S_DEAD;
 	}
@@ -1309,7 +1352,6 @@ asmlinkage long sys_rmdir(const char * pathname)
 	name = getname(pathname);
 	if(IS_ERR(name))
 		return PTR_ERR(name);
-	lock_kernel();
 
 	if (path_init(name, LOOKUP_PARENT, &nd))
 		error = path_walk(name, &nd);
@@ -1335,7 +1377,6 @@ asmlinkage long sys_rmdir(const char * pathname)
 exit1:
 	path_release(&nd);
 exit:
-	unlock_kernel();
 	putname(name);
 	return error;
 }
@@ -1353,7 +1394,9 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
 			if (d_mountpoint(dentry))
 				error = -EBUSY;
 			else {
+				lock_kernel();
 				error = dir->i_op->unlink(dir, dentry);
+				unlock_kernel();
 				if (!error)
 					d_delete(dentry);
 			}
@@ -1373,7 +1416,6 @@ asmlinkage long sys_unlink(const char * pathname)
 	name = getname(pathname);
 	if(IS_ERR(name))
 		return PTR_ERR(name);
-	lock_kernel();
 
 	if (path_init(name, LOOKUP_PARENT, &nd))
 		error = path_walk(name, &nd);
@@ -1397,7 +1439,6 @@ asmlinkage long sys_unlink(const char * pathname)
 exit1:
 	path_release(&nd);
 exit:
-	unlock_kernel();
 	putname(name);
 
 	return error;
@@ -1422,7 +1463,9 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname)
 		goto exit_lock;
 
 	DQUOT_INIT(dir);
+	lock_kernel();
 	error = dir->i_op->symlink(dir, dentry, oldname);
+	unlock_kernel();
 
 exit_lock:
 	up(&dir->i_zombie);
@@ -1444,7 +1487,6 @@ asmlinkage long sys_symlink(const char * oldname, const char * newname)
 		struct dentry *dentry;
 		struct nameidata nd;
 
-		lock_kernel();
 		if (path_init(to, LOOKUP_PARENT, &nd))
 			error = path_walk(to, &nd);
 		if (error)
@@ -1458,7 +1500,6 @@ asmlinkage long sys_symlink(const char * oldname, const char * newname)
 		up(&nd.dentry->d_inode->i_sem);
 		path_release(&nd);
 out:
-		unlock_kernel();
 		putname(to);
 	}
 	putname(from);
@@ -1494,7 +1535,9 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
 		goto exit_lock;
 
 	DQUOT_INIT(dir);
+	lock_kernel();
 	error = dir->i_op->link(old_dentry, dir, new_dentry);
+	unlock_kernel();
 
 exit_lock:
 	up(&dir->i_zombie);
@@ -1525,7 +1568,6 @@ asmlinkage long sys_link(const char * oldname, const char * newname)
 		struct dentry *new_dentry;
 		struct nameidata nd, old_nd;
 
-		lock_kernel();
 		error = 0;
 		if (path_init(from, LOOKUP_POSITIVE, &old_nd))
 			error = path_walk(from, &old_nd);
@@ -1549,7 +1591,6 @@ asmlinkage long sys_link(const char * oldname, const char * newname)
 out:
 		path_release(&old_nd);
 exit:
-		unlock_kernel();
 		putname(to);
 	}
 	putname(from);
@@ -1764,8 +1805,10 @@ static inline int do_rename(const char * oldname, const char * newname)
 	if (IS_ERR(new_dentry))
 		goto exit4;
 
+	lock_kernel();
 	error = vfs_rename(old_dir->d_inode, old_dentry,
 				   new_dir->d_inode, new_dentry);
+	unlock_kernel();
 
 	dput(new_dentry);
 exit4:
@@ -1792,9 +1835,7 @@ asmlinkage long sys_rename(const char * oldname, const char * newname)
 	to = getname(newname);
 	error = PTR_ERR(to);
 	if (!IS_ERR(to)) {
-		lock_kernel();
 		error = do_rename(from,to);
-		unlock_kernel();
 		putname(to);
 	}
 	putname(from);
diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
index 11694e79b..3ea18c96d 100644
--- a/fs/ncpfs/dir.c
+++ b/fs/ncpfs/dir.c
@@ -21,6 +21,7 @@
 #include <asm/uaccess.h>
 #include <asm/byteorder.h>
 #include <linux/locks.h>
+#include <linux/smp_lock.h>
 
 #include <linux/ncp_fs.h>
 
@@ -253,7 +254,7 @@ leave_me:;
 
 
 static int
-ncp_lookup_validate(struct dentry * dentry, int flags)
+__ncp_lookup_validate(struct dentry * dentry, int flags)
 {
 	struct ncp_server *server;
 	struct inode *dir = dentry->d_parent->d_inode;
@@ -315,6 +316,16 @@ finished:
 	return val;
 }
 
+static int
+ncp_lookup_validate(struct dentry * dentry, int flags)
+{
+	int res;
+	lock_kernel();
+	res = __ncp_lookup_validate(dentry, flags);
+	unlock_kernel();
+	return res;
+}
+
 /* most parts from nfsd_d_validate() */
 static int
 ncp_d_validate(struct dentry *dentry)
@@ -361,26 +372,38 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry *parent, unsigned long fpos)
 	struct dentry *dent = dentry;
 	struct list_head *next;
 
-	if (ncp_d_validate(dent))
-		if ((dent->d_parent == parent) &&
-		    ((unsigned long)dent->d_fsdata == fpos))
-			goto out;
+	if (ncp_d_validate(dent)) {
+		if (dent->d_parent == parent &&
+		   (unsigned long)dent->d_fsdata == fpos) {
+			if (!dent->d_inode) {
+				dput(dent);
+				dent = NULL;
+			}
+			return dent;
+		}
+		dput(dent);
+	}
 
 	/* If a pointer is invalid, we search the dentry. */
+	spin_lock(&dcache_lock);
 	next = parent->d_subdirs.next;
 	while (next != &parent->d_subdirs) {
 		dent = list_entry(next, struct dentry, d_child);
-		if ((unsigned long)dent->d_fsdata == fpos)
+		if ((unsigned long)dent->d_fsdata == fpos) {
+			if (dent->d_inode)
+				dget(dent);
+			else
+				dent = NULL;
+			spin_unlock(&dcache_lock);
 			goto out;
+		}
 		next = next->next;
 	}
+	spin_unlock(&dcache_lock);
 	return NULL;
 
 out:
-	if (dent->d_inode)
-		return dget(dent);
-
-	return NULL;
+	return dent;
 }
 
 static time_t ncp_obtain_mtime(struct dentry *dentry)
diff --git a/fs/ncpfs/file.c b/fs/ncpfs/file.c
index 3442c3f9f..a5c68e18c 100644
--- a/fs/ncpfs/file.c
+++ b/fs/ncpfs/file.c
@@ -17,6 +17,7 @@
 #include <linux/mm.h>
 #include <linux/locks.h>
 #include <linux/malloc.h>
+#include <linux/vmalloc.h>
 
 #include <linux/ncp_fs.h>
 #include "ncplib_kernel.h"
@@ -154,7 +155,7 @@ ncp_file_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 
 	error = -EIO;
 	freelen = ncp_read_bounce_size(bufsize);
-	freepage = kmalloc(freelen, GFP_NFS);
+	freepage = vmalloc(freelen);
 	if (!freepage)
 		goto outrel;
 	error = 0;
@@ -180,7 +181,7 @@ ncp_file_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 			break;
 		}
 	}
-	kfree(freepage);
+	vfree(freepage);
 
 	*ppos = pos;
 
@@ -239,7 +240,7 @@ ncp_file_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
 
 	already_written = 0;
 
-	bouncebuffer = kmalloc(bufsize, GFP_NFS);
+	bouncebuffer = vmalloc(bufsize);
 	if (!bouncebuffer) {
 		errno = -EIO;	/* -ENOMEM */
 		goto outrel;
@@ -267,7 +268,7 @@ ncp_file_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
 			break;
 		}
 	}
-	kfree(bouncebuffer);
+	vfree(bouncebuffer);
 	inode->i_mtime = inode->i_atime = CURRENT_TIME;
 	
 	*ppos = pos;
diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
index b6104831e..ff0c1fd03 100644
--- a/fs/ncpfs/inode.c
+++ b/fs/ncpfs/inode.c
@@ -25,6 +25,7 @@
 #include <linux/file.h>
 #include <linux/fcntl.h>
 #include <linux/malloc.h>
+#include <linux/vmalloc.h>
 #include <linux/init.h>
 
 #include <linux/ncp_fs.h>
@@ -261,7 +262,10 @@ ncp_read_super(struct super_block *sb, void *raw_data, int silent)
 	struct ncp_server *server;
 	struct file *ncp_filp;
 	struct inode *root_inode;
+	struct inode *sock_inode;
+	struct socket *sock;
 	int error;
+	int default_bufsize;
 #ifdef CONFIG_NCPFS_PACKET_SIGNING
 	int options;
 #endif
@@ -313,8 +317,17 @@ ncp_read_super(struct super_block *sb, void *raw_data, int silent)
 	ncp_filp = fget(data.ncp_fd);
 	if (!ncp_filp)
 		goto out_bad_file;
-	if (!S_ISSOCK(ncp_filp->f_dentry->d_inode->i_mode))
+	sock_inode = ncp_filp->f_dentry->d_inode;
+	if (!S_ISSOCK(sock_inode->i_mode))
 		goto out_bad_file2;
+	sock = &sock_inode->u.socket_i;
+	if (!sock)
+		goto out_bad_file2;
+		
+	if (sock->type == SOCK_STREAM)
+		default_bufsize = 61440;
+	else
+		default_bufsize = 1024;
 
 	sb->s_blocksize = 1024;	/* Eh...  Is this correct? */
 	sb->s_blocksize_bits = 10;
@@ -364,8 +377,10 @@ ncp_read_super(struct super_block *sb, void *raw_data, int silent)
 
 	server->dentry_ttl = 0;	/* no caching */
 
+#undef NCP_PACKET_SIZE
+#define NCP_PACKET_SIZE 65536
 	server->packet_size = NCP_PACKET_SIZE;
-	server->packet = ncp_kmalloc(NCP_PACKET_SIZE, GFP_KERNEL);
+	server->packet = vmalloc(NCP_PACKET_SIZE);
 	if (server->packet == NULL)
 		goto out_no_packet;
 
@@ -377,13 +392,13 @@ ncp_read_super(struct super_block *sb, void *raw_data, int silent)
 	DPRINTK("ncp_read_super: NCP_SBP(sb) = %x\n", (int) NCP_SBP(sb));
 
 #ifdef CONFIG_NCPFS_PACKET_SIGNING
-	if (ncp_negotiate_size_and_options(server, NCP_DEFAULT_BUFSIZE,
+	if (ncp_negotiate_size_and_options(server, default_bufsize,
 		NCP_DEFAULT_OPTIONS, &(server->buffer_size), &options) == 0)
 	{
 		if (options != NCP_DEFAULT_OPTIONS)
 		{
 			if (ncp_negotiate_size_and_options(server, 
-				NCP_DEFAULT_BUFSIZE,
+				default_bufsize,
 				options & 2, 
 				&(server->buffer_size), &options) != 0)
 				
@@ -396,7 +411,7 @@ ncp_read_super(struct super_block *sb, void *raw_data, int silent)
 	}
 	else 
 #endif	/* CONFIG_NCPFS_PACKET_SIGNING */
-	if (ncp_negotiate_buffersize(server, NCP_DEFAULT_BUFSIZE,
+	if (ncp_negotiate_buffersize(server, default_bufsize,
   				     &(server->buffer_size)) != 0)
 		goto out_no_bufsize;
 	DPRINTK("ncpfs: bufsize = %d\n", server->buffer_size);
@@ -447,7 +462,7 @@ out_disconnect:
 out_no_connect:
 	printk(KERN_ERR "ncp_read_super: Failed connection, error=%d\n", error);
 out_free_packet:
-	ncp_kfree_s(server->packet, server->packet_size);
+	vfree(server->packet);
 	goto out_free_server;
 out_no_packet:
 	printk(KERN_ERR "ncp_read_super: could not alloc packet\n");
@@ -508,7 +523,7 @@ static void ncp_put_super(struct super_block *sb)
 		ncp_kfree_s(server->priv.data, server->priv.len);
 	if (server->auth.object_name)
 		ncp_kfree_s(server->auth.object_name, server->auth.object_name_len);
-	ncp_kfree_s(server->packet, server->packet_size);
+	vfree(server->packet);
 
 }
 
diff --git a/fs/ncpfs/ncplib_kernel.c b/fs/ncpfs/ncplib_kernel.c
index 0353882b9..29e92ea12 100644
--- a/fs/ncpfs/ncplib_kernel.c
+++ b/fs/ncpfs/ncplib_kernel.c
@@ -86,11 +86,11 @@ static inline void ncp_init_request(struct ncp_server *server)
 	server->has_subfunction = 0;
 }
 
-static void ncp_init_request_s(struct ncp_server *server, int subfunction)
+static inline void ncp_init_request_s(struct ncp_server *server, int subfunction)
 {
-	ncp_init_request(server);
-	ncp_add_word(server, 0);	/* preliminary size */
-
+	ncp_lock_server(server);
+	
+	server->current_size = sizeof(struct ncp_request_header) + 2;
 	ncp_add_byte(server, subfunction);
 
 	server->has_subfunction = 1;
diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
index 31797a3c3..6d07ead73 100644
--- a/fs/ncpfs/ncplib_kernel.h
+++ b/fs/ncpfs/ncplib_kernel.h
@@ -157,9 +157,11 @@ static inline void
 ncp_renew_dentries(struct dentry *parent)
 {
 	struct ncp_server *server = NCP_SERVER(parent->d_inode);
-	struct list_head *next = parent->d_subdirs.next;
+	struct list_head *next;
 	struct dentry *dentry;
 
+	spin_lock(&dcache_lock);
+	next = parent->d_subdirs.next;
 	while (next != &parent->d_subdirs) {
 		dentry = list_entry(next, struct dentry, d_child);
 
@@ -170,21 +172,25 @@ ncp_renew_dentries(struct dentry *parent)
 
 		next = next->next;
 	}
+	spin_unlock(&dcache_lock);
 }
 
 static inline void
 ncp_invalidate_dircache_entries(struct dentry *parent)
 {
 	struct ncp_server *server = NCP_SERVER(parent->d_inode);
-	struct list_head *next = parent->d_subdirs.next;
+	struct list_head *next;
 	struct dentry *dentry;
 
+	spin_lock(&dcache_lock);
+	next = parent->d_subdirs.next;
 	while (next != &parent->d_subdirs) {
 		dentry = list_entry(next, struct dentry, d_child);
 		dentry->d_fsdata = NULL;
 		ncp_age_dentry(server, dentry);
 		next = next->next;
 	}
+	spin_unlock(&dcache_lock);
 }
 
 struct ncp_cache_head {
diff --git a/fs/ncpfs/sock.c b/fs/ncpfs/sock.c
index 3f36db262..c5923a78e 100644
--- a/fs/ncpfs/sock.c
+++ b/fs/ncpfs/sock.c
@@ -79,15 +79,11 @@ static int _send(struct socket *sock, const void *buff, int len)
 	return err;
 }
 
-#define NCP_SLACK_SPACE 1024
-
 static int do_ncp_rpc_call(struct ncp_server *server, int size,
 		struct ncp_reply_header* reply_buf, int max_reply_size)
 {
 	struct file *file;
-	struct inode *inode;
 	struct socket *sock;
-	mm_segment_t fs;
 	int result;
 	char *start = server->packet;
 	poll_table wait_table;
@@ -98,8 +94,6 @@ static int do_ncp_rpc_call(struct ncp_server *server, int size,
 	int major_timeout_seen;
 	int acknowledge_seen;
 	int n;
-	sigset_t old_set;
-	unsigned long mask, flags;
 
 	/* We have to check the result, so store the complete header */
 	struct ncp_request_header request =
@@ -108,13 +102,7 @@ static int do_ncp_rpc_call(struct ncp_server *server, int size,
 	struct ncp_reply_header reply;
 
 	file = server->ncp_filp;
-	inode = file->f_dentry->d_inode;
-	sock = &inode->u.socket_i;
-	/* N.B. this isn't needed ... check socket type? */
-	if (!sock) {
-		printk(KERN_ERR "ncp_rpc_call: socki_lookup failed\n");
-		return -EBADF;
-	}
+	sock = &file->f_dentry->d_inode->u.socket_i;
 
 	init_timeout = server->m.time_out;
 	max_timeout = NCP_MAX_RPC_TIMEOUT;
@@ -122,26 +110,6 @@ static int do_ncp_rpc_call(struct ncp_server *server, int size,
 	major_timeout_seen = 0;
 	acknowledge_seen = 0;
 
-	spin_lock_irqsave(&current->sigmask_lock, flags);
-	old_set = current->blocked;
-	mask = sigmask(SIGKILL) | sigmask(SIGSTOP);
-	if (server->m.flags & NCP_MOUNT_INTR) {
-		/* FIXME: This doesn't seem right at all.  So, like,
-		   we can't handle SIGINT and get whatever to stop?
-		   What if we've blocked it ourselves?  What about
-		   alarms?  Why, in fact, are we mucking with the
-		   sigmask at all? -- r~ */
-		if (current->sig->action[SIGINT - 1].sa.sa_handler == SIG_DFL)
-			mask |= sigmask(SIGINT);
-		if (current->sig->action[SIGQUIT - 1].sa.sa_handler == SIG_DFL)
-			mask |= sigmask(SIGQUIT);
-	}
-	siginitsetinv(&current->blocked, mask);
-	recalc_sigpending(current);
-	spin_unlock_irqrestore(&current->sigmask_lock, flags);
-
-	fs = get_fs();
-	set_fs(get_ds());
 	for (n = 0, timeout = init_timeout;; n++, timeout <<= 1) {
 		/*
 		DDPRINTK("ncpfs: %08lX:%02X%02X%02X%02X%02X%02X:%04X\n",
@@ -289,15 +257,169 @@ static int do_ncp_rpc_call(struct ncp_server *server, int size,
 		result = -EIO;
 	}
 
-	spin_lock_irqsave(&current->sigmask_lock, flags);
-	current->blocked = old_set;
-	recalc_sigpending(current);
-	spin_unlock_irqrestore(&current->sigmask_lock, flags);
-	
-	set_fs(fs);
 	return result;
 }
 
+static int do_tcp_rcv(struct ncp_server *server, void *buffer, size_t len) {
+	poll_table wait_table;
+	struct poll_table_entry entry;
+	struct file *file;
+	struct socket *sock;
+	int init_timeout;
+	size_t dataread;
+	int result = 0;
+	
+	file = server->ncp_filp;
+	sock = &file->f_dentry->d_inode->u.socket_i;
+	
+	dataread = 0;
+
+	init_timeout = server->m.time_out * 20;
+	
+	/* hard-mounted volumes have no timeout, except connection close... */
+	if (!(server->m.flags & NCP_MOUNT_SOFT))
+		init_timeout = 0x7FFF0000;
+
+	while (len) {
+		wait_table.nr = 0;
+		wait_table.entry = &entry;
+		/* mb() is not necessary because ->poll() will serialize
+		   instructions adding the wait_table waitqueues in the
+		   waitqueue-head before going to calculate the mask-retval. */
+		__set_current_state(TASK_INTERRUPTIBLE);
+		if (!(sock->ops->poll(file, sock, &wait_table) & POLLIN)) {
+			init_timeout = schedule_timeout(init_timeout);
+			remove_wait_queue(entry.wait_address, &entry.wait);
+			fput(file);
+			current->state = TASK_RUNNING;
+			if (signal_pending(current)) {
+				return -ERESTARTSYS;
+			}
+			if (!init_timeout) {
+				return -EIO;
+			}
+		} else if (wait_table.nr) {
+			remove_wait_queue(entry.wait_address, &entry.wait);
+			fput(file);
+		}
+		current->state = TASK_RUNNING;
+
+		result = _recv(sock, buffer, len, MSG_DONTWAIT);
+		if (result < 0) {
+			if (result == -EAGAIN) {
+				DDPRINTK("ncpfs: tcp: bad select ready\n");
+				continue;
+			}
+			return result;
+		}
+		if (result == 0) {
+			printk(KERN_ERR "ncpfs: tcp: EOF on socket\n");
+			return -EIO;
+		}
+		if (result > len) {
+			printk(KERN_ERR "ncpfs: tcp: bug in recvmsg\n");
+			return -EIO;			
+		}
+		dataread += result;
+		buffer += result;
+		len -= result;
+	}
+	return 0;
+}	
+
+#define NCP_TCP_XMIT_MAGIC	(0x446D6454)
+#define NCP_TCP_XMIT_VERSION	(1)
+#define NCP_TCP_RCVD_MAGIC	(0x744E6350)
+
+static int do_ncp_tcp_rpc_call(struct ncp_server *server, int size,
+		struct ncp_reply_header* reply_buf, int max_reply_size)
+{
+	struct file *file;
+	struct socket *sock;
+	int result;
+	struct iovec iov[2];
+	struct msghdr msg;
+	struct scm_cookie scm;
+	__u32 ncptcp_rcvd_hdr[2];
+	__u32 ncptcp_xmit_hdr[4];
+	int   datalen;
+
+	/* We have to check the result, so store the complete header */
+	struct ncp_request_header request =
+	*((struct ncp_request_header *) (server->packet));
+
+	file = server->ncp_filp;
+	sock = &file->f_dentry->d_inode->u.socket_i;
+	
+	ncptcp_xmit_hdr[0] = htonl(NCP_TCP_XMIT_MAGIC);
+	ncptcp_xmit_hdr[1] = htonl(size + 16);
+	ncptcp_xmit_hdr[2] = htonl(NCP_TCP_XMIT_VERSION);
+	ncptcp_xmit_hdr[3] = htonl(max_reply_size + 8);
+
+	DDPRINTK("ncpfs: req.typ: %04X, con: %d, "
+		 "seq: %d",
+		 request.type,
+		 (request.conn_high << 8) + request.conn_low,
+		 request.sequence);
+	DDPRINTK(" func: %d\n",
+		 request.function);
+
+	iov[1].iov_base = (void *) server->packet;
+	iov[1].iov_len = size;
+	iov[0].iov_base = ncptcp_xmit_hdr;
+	iov[0].iov_len = 16;
+	msg.msg_name = NULL;
+	msg.msg_namelen = 0;
+	msg.msg_control = NULL;
+	msg.msg_iov = iov;
+	msg.msg_iovlen = 2;
+	msg.msg_flags = MSG_NOSIGNAL;
+
+	result = scm_send(sock, &msg, &scm);
+	if (result < 0) {
+		return result;
+	}
+	result = sock->ops->sendmsg(sock, &msg, size + 16, &scm);
+	scm_destroy(&scm);
+	if (result < 0) {
+		printk(KERN_ERR "ncpfs: tcp: Send failed: %d\n", result);
+		return result;
+	}
+rstrcv:
+	result = do_tcp_rcv(server, ncptcp_rcvd_hdr, 8);
+	if (result)
+		return result;
+	if (ncptcp_rcvd_hdr[0] != htonl(NCP_TCP_RCVD_MAGIC)) {
+		printk(KERN_ERR "ncpfs: tcp: Unexpected reply type %08X\n", ntohl(ncptcp_rcvd_hdr[0]));
+		return -EIO;
+	}
+	datalen = ntohl(ncptcp_rcvd_hdr[1]);
+	if (datalen < 8 + sizeof(*reply_buf) || datalen > max_reply_size + 8) {
+		printk(KERN_ERR "ncpfs: tcp: Unexpected reply len %d\n", datalen);
+		return -EIO;
+	}
+	datalen -= 8;
+	result = do_tcp_rcv(server, reply_buf, datalen);
+	if (result)
+		return result;
+	if (reply_buf->type != NCP_REPLY) {
+		DDPRINTK("ncpfs: tcp: Unexpected NCP type %02X\n", reply_buf->type);
+		goto rstrcv;
+	}
+	if (request.type == NCP_ALLOC_SLOT_REQUEST)
+		return datalen;
+	if (reply_buf->sequence != request.sequence) {
+		printk(KERN_ERR "ncpfs: tcp: Bad sequence number\n");
+		return -EIO;
+	}
+	if ((reply_buf->conn_low != request.conn_low) ||
+	    (reply_buf->conn_high != request.conn_high)) {
+		printk(KERN_ERR "ncpfs: tcp: Connection number mismatch\n");
+		return -EIO;
+	}
+	return datalen;
+}
+
 /*
  * We need the server to be locked here, so check!
  */
@@ -305,6 +427,8 @@ static int do_ncp_rpc_call(struct ncp_server *server, int size,
 static int ncp_do_request(struct ncp_server *server, int size,
 		void* reply, int max_reply_size)
 {
+	struct file *file;
+	struct socket *sock;
 	int result;
 
 	if (server->lock == 0) {
@@ -320,7 +444,50 @@ static int ncp_do_request(struct ncp_server *server, int size,
 		sign_packet(server, &size);
 	}
 #endif /* CONFIG_NCPFS_PACKET_SIGNING */
-	result = do_ncp_rpc_call(server, size, reply, max_reply_size);
+	file = server->ncp_filp;
+	sock = &file->f_dentry->d_inode->u.socket_i;
+	/* N.B. this isn't needed ... check socket type? */
+	if (!sock) {
+		printk(KERN_ERR "ncp_rpc_call: socki_lookup failed\n");
+		result = -EBADF;
+	} else {
+		mm_segment_t fs;
+		sigset_t old_set;
+		unsigned long mask, flags;
+
+		spin_lock_irqsave(&current->sigmask_lock, flags);
+		old_set = current->blocked;
+		mask = sigmask(SIGKILL) | sigmask(SIGSTOP);
+		if (server->m.flags & NCP_MOUNT_INTR) {
+			/* FIXME: This doesn't seem right at all.  So, like,
+			   we can't handle SIGINT and get whatever to stop?
+			   What if we've blocked it ourselves?  What about
+			   alarms?  Why, in fact, are we mucking with the
+			   sigmask at all? -- r~ */
+			if (current->sig->action[SIGINT - 1].sa.sa_handler == SIG_DFL)
+				mask |= sigmask(SIGINT);
+			if (current->sig->action[SIGQUIT - 1].sa.sa_handler == SIG_DFL)
+				mask |= sigmask(SIGQUIT);
+		}
+		siginitsetinv(&current->blocked, mask);
+		recalc_sigpending(current);
+		spin_unlock_irqrestore(&current->sigmask_lock, flags);
+		
+		fs = get_fs();
+		set_fs(get_ds());
+
+		if (sock->type == SOCK_STREAM)
+			result = do_ncp_tcp_rpc_call(server, size, reply, max_reply_size);
+		else
+			result = do_ncp_rpc_call(server, size, reply, max_reply_size);
+
+		set_fs(fs);
+
+		spin_lock_irqsave(&current->sigmask_lock, flags);
+		current->blocked = old_set;
+		recalc_sigpending(current);
+		spin_unlock_irqrestore(&current->sigmask_lock, flags);
+	}
 
 	DDPRINTK("do_ncp_rpc_call returned %d\n", result);
 
@@ -424,12 +591,6 @@ int ncp_disconnect(struct ncp_server *server)
 
 void ncp_lock_server(struct ncp_server *server)
 {
-#if 0
-	/* For testing, only 1 process */
-	if (server->lock != 0) {
-		DPRINTK("ncpfs: server locked!!!\n");
-	}
-#endif
 	down(&server->sem);
 	if (server->lock)
 		printk(KERN_WARNING "ncp_lock_server: was locked!\n");
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2d6365cc7..5c5c3a95f 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -29,6 +29,7 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/pagemap.h>
+#include <linux/smp_lock.h>
 
 #define NFS_PARANOIA 1
 /* #define NFS_DEBUG_VERBOSE 1 */
@@ -489,6 +490,9 @@ static int nfs_lookup_revalidate(struct dentry * dentry, int flags)
 	struct nfs_fh fhandle;
 	struct nfs_fattr fattr;
 
+	lock_kernel();
+	dir = dentry->d_parent;
+	dir_i = dir->d_inode;
 	/*
 	 * If we don't have an inode, let's look at the parent
 	 * directory mtime to get a hint about how often we
@@ -538,10 +542,10 @@ static int nfs_lookup_revalidate(struct dentry * dentry, int flags)
  out_valid_renew:
 	nfs_renew_times(dentry);
 out_valid:
+	unlock_kernel();
 	return 1;
 out_bad:
-	if (!list_empty(&dentry->d_subdirs))
-		shrink_dcache_parent(dentry);
+	shrink_dcache_parent(dentry);
 	/* If we have submounts, don't unhash ! */
 	if (have_submounts(dentry))
 		goto out_valid;
@@ -550,6 +554,7 @@ out_bad:
 	nfs_zap_caches(dir_i);
 	if (inode && S_ISDIR(inode->i_mode))
 		nfs_zap_caches(inode);
+	unlock_kernel();
 	return 0;
 }
 
@@ -587,8 +592,11 @@ __inline__ void nfs_fh_free(struct nfs_fh *p)
  */
 static void nfs_dentry_release(struct dentry *dentry)
 {
-	if (dentry->d_fsdata)
+	if (dentry->d_fsdata) {
+		lock_kernel();
 		nfs_fh_free(dentry->d_fsdata);
+		unlock_kernel();
+	}
 }
 
 /*
@@ -602,9 +610,13 @@ static void nfs_dentry_iput(struct dentry *dentry, struct inode *inode)
 		struct inode *dir_i = dir->d_inode;
 		int error;
 		
+		lock_kernel();
+		dir = dentry->d_parent;
+		dir_i = dir->d_inode;
 		nfs_zap_caches(dir_i);
 		NFS_CACHEINV(inode);
 		error = NFS_PROTO(dir_i)->remove(dir, &dentry->d_name);
+		unlock_kernel();
 	}
 	iput(inode);
 }
@@ -803,13 +815,13 @@ static int nfs_sillyrename(struct inode *dir_i, struct dentry *dentry)
 
 	dfprintk(VFS, "NFS: silly-rename(%s/%s, ct=%d)\n",
 		dentry->d_parent->d_name.name, dentry->d_name.name, 
-		dentry->d_count);
+		atomic_read(&dentry->d_count));
 
 	/*
 	 * Note that a silly-renamed file can be deleted once it's
 	 * no longer in use -- it's just an ordinary file now.
 	 */
-	if (dentry->d_count == 1) {
+	if (atomic_read(&dentry->d_count) == 1) {
 		dentry->d_flags &= ~DCACHE_NFSFS_RENAMED;
 		goto out;  /* No need to silly rename. */
 	}
@@ -889,11 +901,11 @@ static int nfs_safe_remove(struct dentry *dentry)
 		d_drop(dentry);
 		rehash = 1;
 	}
-	if (dentry->d_count > 1) {
+	if (atomic_read(&dentry->d_count) > 1) {
 #ifdef NFS_PARANOIA
 		printk("nfs_safe_remove: %s/%s busy, d_count=%d\n",
 			dentry->d_parent->d_name.name, dentry->d_name.name,
-			dentry->d_count);
+			atomic_read(&dentry->d_count));
 #endif
 		goto out;
 	}
@@ -1051,7 +1063,7 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 	dfprintk(VFS, "NFS: rename(%s/%s -> %s/%s, ct=%d)\n",
 		 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
 		 new_dentry->d_parent->d_name.name, new_dentry->d_name.name,
-		 new_dentry->d_count);
+		 atomic_read(&new_dentry->d_count));
 
 	/*
 	 * First check whether the target is busy ... we can't
@@ -1065,7 +1077,7 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 		goto go_ahead;
 	if (S_ISDIR(new_inode->i_mode))
 		goto out;
-	else if (new_dentry->d_count > 1) {
+	else if (atomic_read(&new_dentry->d_count) > 1) {
 		int err;
 		/* copy the target dentry's name */
 		dentry = d_alloc(new_dentry->d_parent,
@@ -1083,12 +1095,12 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 		}
 
 		/* dentry still busy? */
-		if (new_dentry->d_count > 1) {
+		if (atomic_read(&new_dentry->d_count) > 1) {
 #ifdef NFS_PARANOIA
 			printk("nfs_rename: target %s/%s busy, d_count=%d\n",
 			       new_dentry->d_parent->d_name.name,
 			       new_dentry->d_name.name,
-			       new_dentry->d_count);
+			       atomic_read(&new_dentry->d_count));
 #endif
 			goto out;
 		}
@@ -1098,7 +1110,7 @@ go_ahead:
 	/*
 	 * ... prune child dentries and writebacks if needed.
 	 */
-	if (old_dentry->d_count > 1) {
+	if (atomic_read(&old_dentry->d_count) > 1) {
 		nfs_wb_all(old_inode);
 		shrink_dcache_parent(old_dentry);
 	}
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index aedda1e90..0a6c2fd26 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -542,7 +542,7 @@ nfs_statfs(struct super_block *sb, struct statfs *buf)
 static int
 nfs_free_dentries(struct inode *inode)
 {
-	struct list_head *tmp, *head = &inode->i_dentry;
+	struct list_head *tmp, *head;
 	int unhashed;
 
 	if (S_ISDIR(inode->i_mode)) {
@@ -553,13 +553,16 @@ nfs_free_dentries(struct inode *inode)
 		}
 	}
 	d_prune_aliases(inode);
+	spin_lock(&dcache_lock);
+	head = &inode->i_dentry;
 	tmp = head;
 	unhashed = 0;
 	while ((tmp = tmp->next) != head) {
 		struct dentry *dentry = list_entry(tmp, struct dentry, d_alias);
-		if (d_unhashed(dentry))
+		if (list_empty(&dentry->d_hash))
 			unhashed++;
 	}
+	spin_unlock(&dcache_lock);
 	return unhashed;
 }
 
@@ -913,15 +916,22 @@ __nfs_revalidate_inode(struct nfs_server *server, struct dentry *dentry)
 		dentry->d_parent->d_name.name, dentry->d_name.name,
 		inode->i_ino);
 
-	if (!inode || is_bad_inode(inode))
+	lock_kernel();
+	if (!inode || is_bad_inode(inode)) {
+		unlock_kernel();
 		return -ESTALE;
+	}
 
 	while (NFS_REVALIDATING(inode)) {
 		status = nfs_wait_on_inode(inode, NFS_INO_REVALIDATING);
-		if (status < 0)
+		if (status < 0) {
+			unlock_kernel();
 			return status;
-		if (time_before(jiffies,NFS_READTIME(inode)+NFS_ATTRTIMEO(inode)))
+		}
+		if (time_before(jiffies,NFS_READTIME(inode)+NFS_ATTRTIMEO(inode))) {
+			unlock_kernel();
 			return 0;
+		}
 	}
 	NFS_FLAGS(inode) |= NFS_INO_REVALIDATING;
 
@@ -968,6 +978,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct dentry *dentry)
 out:
 	NFS_FLAGS(inode) &= ~NFS_INO_REVALIDATING;
 	wake_up(&inode->i_wait);
+	unlock_kernel();
 	return status;
 }
 
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 6b4a94f44..4c9c45e2a 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -22,6 +22,7 @@
 #include <linux/mm.h>
 #include <linux/malloc.h>
 #include <linux/string.h>
+#include <linux/smp_lock.h>
 
 /* Symlink caching in the page cache is even more simplistic
  * and straight-forward than readdir caching.
@@ -36,8 +37,10 @@ static int nfs_symlink_filler(struct dentry *dentry, struct page *page)
 	 * in host byte order, followed by the string.  The
 	 * XDR response verification will NULL terminate it.
 	 */
+	lock_kernel();
 	error = NFS_PROTO(inode)->readlink(dentry, buffer,
 					   PAGE_CACHE_SIZE - sizeof(u32)-4);
+	unlock_kernel();
 	if (error < 0)
 		goto error;
 	SetPageUptodate(page);
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 78f399bd3..511a14dc9 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -152,14 +152,17 @@ static struct dentry *nfsd_iget(struct super_block *sb, unsigned long ino, __u32
 	/* now to find a dentry.
 	 * If possible, get a well-connected one
 	 */
+	spin_lock(&dcache_lock);
 	for (lp = inode->i_dentry.next; lp != &inode->i_dentry ; lp=lp->next) {
 		result = list_entry(lp,struct dentry, d_alias);
 		if (! (result->d_flags & DCACHE_NFSD_DISCONNECTED)) {
 			dget(result);
+			spin_unlock(&dcache_lock);
 			iput(inode);
 			return result;
 		}
 	}
+	spin_unlock(&dcache_lock);
 	result = d_alloc_root(inode);
 	if (result == NULL) {
 		iput(inode);
@@ -192,8 +195,10 @@ int d_splice(struct dentry *target, struct dentry *parent, struct qstr *name)
 	/* tdentry will have been made a "child" of target (the parent of target)
 	 * make it an IS_ROOT instead
 	 */
+	spin_lock(&dcache_lock);
 	list_del(&tdentry->d_child);
 	tdentry->d_parent = tdentry;
+	spin_unlock(&dcache_lock);
 	d_rehash(target);
 	dput(tdentry);
 
@@ -205,6 +210,7 @@ int d_splice(struct dentry *target, struct dentry *parent, struct qstr *name)
 		while (target) {
 			target->d_flags &= ~DCACHE_NFSD_DISCONNECTED;
 			parent = target;
+			spin_lock(&dcache_lock);
 			if (list_empty(&parent->d_subdirs))
 				target = NULL;
 			else {
@@ -217,6 +223,7 @@ int d_splice(struct dentry *target, struct dentry *parent, struct qstr *name)
 					       parent->d_name.name, target->d_name.name);
 #endif
 			}
+			spin_unlock(&dcache_lock);
 		}
 	}
 	return 0;
@@ -247,6 +254,7 @@ struct dentry *nfsd_findparent(struct dentry *child)
 		 * else make a root dentry
 		 */
 		struct list_head *aliases = &tdentry->d_inode->i_dentry;
+		spin_lock(&dcache_lock);
 		if (aliases->next != aliases) {
 			pdentry = list_entry(aliases->next, struct dentry, d_alias);
 			if (pdentry == tdentry)
@@ -255,6 +263,7 @@ struct dentry *nfsd_findparent(struct dentry *child)
 				pdentry = NULL;
 			if (pdentry) dget(pdentry);
 		}
+		spin_unlock(&dcache_lock);
 		if (pdentry == NULL) {
 			pdentry = d_alloc_root(igrab(tdentry->d_inode));
 			if (pdentry) {
@@ -289,16 +298,20 @@ static struct dentry *splice(struct dentry *child, struct dentry *parent)
 	 * to a lookup (though nobody does this yet).  In this case, just succeed.
 	 */
 	if (child->d_parent == parent) goto out;
-	/* Possibly a new dentry has been made for this child->d_inode in parent by
-	 * a lookup.  In this case return that dentry. caller must notice and act accordingly
+	/* Possibly a new dentry has been made for this child->d_inode in
+	 * parent by a lookup.  In this case return that dentry. caller must
+	 * notice and act accordingly
 	 */
+	spin_lock(&dcache_lock);
 	for (lp = child->d_inode->i_dentry.next; lp != &child->d_inode->i_dentry ; lp=lp->next) {
 		tmp = list_entry(lp,struct dentry, d_alias);
 		if (tmp->d_parent == parent) {
 			child = dget(tmp);
+			spin_unlock(&dcache_lock);
 			goto out;
 		}
 	}
+	spin_unlock(&dcache_lock);
 	/* well, if we can find a name for child in parent, it should be safe to splice it in */
 	err = get_ino_name(parent, &qs, child->d_inode->i_ino);
 	if (err)
diff --git a/fs/ntfs/Makefile b/fs/ntfs/Makefile
index 6f0e188d1..9e7ab2eaf 100644
--- a/fs/ntfs/Makefile
+++ b/fs/ntfs/Makefile
@@ -3,7 +3,7 @@
 O_TARGET := ntfs.o
 O_OBJS   := fs.o sysctl.o support.o util.o inode.o dir.o super.o attr.o
 M_OBJS   := $(O_TARGET)
-EXTRA_CFLAGS = -DNTFS_IN_LINUX_KERNEL -DNTFS_VERSION=\"000502\"
+EXTRA_CFLAGS = -DNTFS_IN_LINUX_KERNEL -DNTFS_VERSION=\"000607\"
 
 include $(TOPDIR)/Rules.make
 
diff --git a/fs/ntfs/fs.c b/fs/ntfs/fs.c
index 470f15c90..b81d6c031 100644
--- a/fs/ntfs/fs.c
+++ b/fs/ntfs/fs.c
@@ -80,7 +80,7 @@ ntfs_read(struct file * filp, char *buf, size_t count, loff_t *off)
 	io.param=buf;
 	io.size=count;
 	error=ntfs_read_attr(ino,ino->vol->at_data,NULL,*off,&io);
-	if(error)return -error;
+	if(error && !io.size)return -error;
 	
 	*off+=io.size;
 	return io.size;
diff --git a/fs/open.c b/fs/open.c
index b2f6f6ffa..2968decf9 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -114,7 +114,6 @@ static inline long do_sys_truncate(const char * path, loff_t length)
 	if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
 		goto dput_and_out;
 
-	lock_kernel();
 	error = get_write_access(inode);
 	if (error)
 		goto dput_and_out;
@@ -125,7 +124,6 @@ static inline long do_sys_truncate(const char * path, loff_t length)
 		error = do_truncate(nd.dentry, length);
 	}
 	put_write_access(inode);
-	unlock_kernel();
 
 dput_and_out:
 	path_release(&nd);
@@ -161,11 +159,9 @@ static inline long do_sys_ftruncate(unsigned int fd, loff_t length)
 	if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
 		goto out_putf;
 
-	lock_kernel();
 	error = locks_verify_truncate(inode, file, length);
 	if (!error)
 		error = do_truncate(dentry, length);
-	unlock_kernel();
 out_putf:
 	fput(file);
 out:
@@ -335,8 +331,6 @@ asmlinkage long sys_chdir(const char * filename)
 	struct nameidata nd;
 	char *name;
 
-	lock_kernel();
-	
 	name = getname(filename);
 	error = PTR_ERR(name);
 	if (IS_ERR(name))
@@ -358,7 +352,6 @@ asmlinkage long sys_chdir(const char * filename)
 dput_and_out:
 	path_release(&nd);
 out:
-	unlock_kernel();
 	return error;
 }
 
@@ -383,11 +376,9 @@ asmlinkage long sys_fchdir(unsigned int fd)
 	if (!S_ISDIR(inode->i_mode))
 		goto out_putf;
 
-	lock_kernel();
 	error = permission(inode, MAY_EXEC);
 	if (!error)
 		set_fs_pwd(current->fs, mnt, dentry);
-	unlock_kernel();
 out_putf:
 	fput(file);
 out:
@@ -400,8 +391,6 @@ asmlinkage long sys_chroot(const char * filename)
 	struct nameidata nd;
 	char *name;
 
-	lock_kernel();
-	
 	name = getname(filename);
 	error = PTR_ERR(name);
 	if (IS_ERR(name))
@@ -428,7 +417,6 @@ asmlinkage long sys_chroot(const char * filename)
 dput_and_out:
 	path_release(&nd);
 out:
-	unlock_kernel();
 	return error;
 }
 
@@ -457,9 +445,7 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
 		mode = inode->i_mode;
 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
-	lock_kernel();
 	err = notify_change(dentry, &newattrs);
-	unlock_kernel();
 
 out_putf:
 	fput(file);
@@ -658,7 +644,9 @@ struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
 	if (inode->i_sb)
 		file_move(f, &inode->i_sb->s_files);
 	if (f->f_op && f->f_op->open) {
+		lock_kernel();
 		error = f->f_op->open(inode,f);
+		unlock_kernel();
 		if (error)
 			goto cleanup_all;
 	}
@@ -755,10 +743,7 @@ asmlinkage long sys_open(const char * filename, int flags, int mode)
 	if (!IS_ERR(tmp)) {
 		fd = get_unused_fd();
 		if (fd >= 0) {
-			struct file * f;
-			lock_kernel();
-			f = filp_open(tmp, flags, mode);
-			unlock_kernel();
+			struct file *f = filp_open(tmp, flags, mode);
 			error = PTR_ERR(f);
 			if (IS_ERR(f))
 				goto out_error;
@@ -801,8 +786,11 @@ int filp_close(struct file *filp, fl_owner_t id)
 		return 0;
 	}
 	retval = 0;
-	if (filp->f_op && filp->f_op->flush)
+	if (filp->f_op && filp->f_op->flush) {
+		lock_kernel();
 		retval = filp->f_op->flush(filp);
+		unlock_kernel();
+	}
 	locks_remove_posix(filp, id);
 	fput(filp);
 	return retval;
@@ -832,9 +820,7 @@ int do_close(unsigned int fd, int release)
 	if (release)
 		__put_unused_fd(files, fd);
 	write_unlock(&files->file_lock);
-	lock_kernel();
 	error = filp_close(filp, files);
-	unlock_kernel();
 out:
 	return error;
 out_unlock:
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index b0941569b..291e8e67d 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -342,13 +342,13 @@ static void devfs_register_disc (struct gendisk *dev, int minor)
 	else {
 		/*  Unaware driver: construct "real" directory  */
 		sprintf (dirname, "../%s/disc%d", dev->major_name, devnum);
-		dir = devfs_mk_dir (NULL, dirname + 3, 0, NULL);
+		dir = devfs_mk_dir (NULL, dirname + 3, NULL);
 	}
 	if (!devfs_handle)
-		devfs_handle = devfs_mk_dir (NULL, "discs", 5, NULL);
+		devfs_handle = devfs_mk_dir (NULL, "discs", NULL);
 	sprintf (symlink, "disc%u", disc_counter++);
-	devfs_mk_symlink (devfs_handle, symlink, 0, DEVFS_FL_DEFAULT,
-			  dirname + pos, 0, &slave, NULL);
+	devfs_mk_symlink (devfs_handle, symlink, DEVFS_FL_DEFAULT,
+			  dirname + pos, &slave, NULL);
 	dev->part[minor].de =
 	    devfs_register (dir, "disc", devfs_flags, dev->major, minor,
 			    S_IFBLK | S_IRUSR | S_IWUSR, dev->fops, NULL);
diff --git a/fs/pipe.c b/fs/pipe.c
index a30985a53..0cd5f6b09 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -466,6 +466,13 @@ fail_page:
 }
 
 static struct vfsmount *pipe_mnt;
+static int pipefs_delete_dentry(struct dentry *dentry)
+{
+	return 1;
+}
+static struct dentry_operations pipefs_dentry_operations = {
+	d_delete:	pipefs_delete_dentry,
+};
 
 static struct inode * get_pipe_inode(void)
 {
@@ -534,14 +541,15 @@ int do_pipe(int *fd)
 	j = error;
 
 	error = -ENOMEM;
-	sprintf(name, "%lu", inode->i_ino);
+	sprintf(name, "[%lu]", inode->i_ino);
 	this.name = name;
 	this.len = strlen(name);
-	/* We don't care for hash - it will never be looked up */
+	this.hash = inode->i_ino; /* will go */
 	dentry = d_alloc(pipe_mnt->mnt_sb->s_root, &this);
+	dentry->d_op = &pipefs_dentry_operations;
 	if (!dentry)
 		goto close_f12_inode_i_j;
-	d_instantiate(dentry, inode);
+	d_add(dentry, inode);
 	f1->f_vfsmnt = f2->f_vfsmnt = mntget(mntget(pipe_mnt));
 	f1->f_dentry = f2->f_dentry = dget(dentry);
 
@@ -633,7 +641,9 @@ static int __init init_pipe_fs(void)
 	if (!err) {
 		pipe_mnt = kern_mount(&pipe_fs_type);
 		err = PTR_ERR(pipe_mnt);
-		if (!IS_ERR(pipe_mnt))
+		if (IS_ERR(pipe_mnt))
+			unregister_filesystem(&pipe_fs_type);
+		else
 			err = 0;
 	}
 	return err;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 01f5b22ea..23151f3d9 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -40,18 +40,9 @@ int proc_pid_status(struct task_struct*,char*);
 int proc_pid_statm(struct task_struct*,char*);
 int proc_pid_cpu(struct task_struct*,char*);
 
-/* MOUNT_REWRITE: make all files have non-NULL ->f_vfsmnt (pipefs, sockfs) */
-/* Until then... */
-#define NULL_VFSMNT	/* remove as soon as pipefs and sockfs will be there */
-
 static int proc_fd_link(struct inode *inode, struct dentry **dentry, struct vfsmount **mnt)
 {
 	if (inode->u.proc_i.file) {
-#ifdef NULL_VFSMNT
-		if (!inode->u.proc_i.file->f_vfsmnt)
-			mntget(*mnt);
-		else
-#endif
 		*mnt = mntget(inode->u.proc_i.file->f_vfsmnt);
 		*dentry = dget(inode->u.proc_i.file->f_dentry);
 		return 0;
@@ -101,8 +92,10 @@ static int proc_cwd_link(struct inode *inode, struct dentry **dentry, struct vfs
 		atomic_inc(&fs->count);
 	task_unlock(inode->u.proc_i.task);
 	if (fs) {
+		read_lock(&fs->lock);
 		*mnt = mntget(fs->pwdmnt);
 		*dentry = dget(fs->pwd);
+		read_unlock(&fs->lock);
 		result = 0;
 		put_fs_struct(fs);
 	}
@@ -119,8 +112,10 @@ static int proc_root_link(struct inode *inode, struct dentry **dentry, struct vf
 		atomic_inc(&fs->count);
 	task_unlock(inode->u.proc_i.task);
 	if (fs) {
+		read_lock(&fs->lock);
 		*mnt = mntget(fs->rootmnt);
 		*dentry = dget(fs->root);
+		read_unlock(&fs->lock);
 		result = 0;
 		put_fs_struct(fs);
 	}
@@ -216,15 +211,19 @@ static int proc_permission(struct inode *inode, int mask)
 {
 	struct dentry *de, *base, *root;
 	struct vfsmount *our_vfsmnt, *vfsmnt, *mnt;
+	int res = 0;
 
 	if (standard_permission(inode, mask) != 0)
 		return -EACCES;
 
-	base = current->fs->root;
-	our_vfsmnt = current->fs->rootmnt;
 	if (proc_root_link(inode, &root, &vfsmnt)) /* Ewww... */
 		return -ENOENT;
+	read_lock(&current->fs->lock);
+	our_vfsmnt = mntget(current->fs->rootmnt);
+	base = dget(current->fs->root);
+	read_unlock(&current->fs->lock);
 
+	spin_lock(&dcache_lock);
 	de = root;
 	mnt = vfsmnt;
 
@@ -237,14 +236,18 @@ static int proc_permission(struct inode *inode, int mask)
 
 	if (!is_subdir(de, base))
 		goto out;
+	spin_unlock(&dcache_lock);
 
+exit:
+	dput(base);
+	mntput(our_vfsmnt);
 	dput(root);
 	mntput(mnt);
-	return 0;
+	return res;
 out:
-	dput(root);
-	mntput(mnt);
-	return -EACCES;
+	spin_unlock(&dcache_lock);
+	res = -EACCES;
+	goto exit;
 }
 
 static ssize_t pid_maps_read(struct file * file, char * buf,
@@ -396,9 +399,6 @@ static int proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
 	struct inode *inode = dentry->d_inode;
 	int error;
-#ifdef NULL_VFSMNT
-	struct vfsmount *dummy = mntget(nd->mnt);
-#endif
 
 	/* We don't need a base pointer in the /proc filesystem */
 	path_release(nd);
@@ -410,9 +410,6 @@ static int proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
 	error = inode->u.proc_i.op.proc_get_link(inode, &nd->dentry, &nd->mnt);
 	nd->last_type = LAST_BIND;
 out:
-#ifdef NULL_VFSMNT
-	mntput(dummy);
-#endif
 	return error;
 }
 
@@ -420,29 +417,15 @@ static int do_proc_readlink(struct dentry *dentry, struct vfsmount *mnt,
 			    char * buffer, int buflen)
 {
 	struct inode * inode;
-	char * tmp = (char*)__get_free_page(GFP_KERNEL), *path, *pattern;
+	char * tmp = (char*)__get_free_page(GFP_KERNEL), *path;
 	int len;
 
 	if (!tmp)
 		return -ENOMEM;
 		
-	/* Check for special dentries.. */
-	pattern = NULL;
 	inode = dentry->d_inode;
-	if (inode && IS_ROOT(dentry)) {
-		if (S_ISSOCK(inode->i_mode))
-			pattern = "socket:[%lu]";
-		if (S_ISFIFO(inode->i_mode))
-			pattern = "pipe:[%lu]";
-	}
-	
-	if (pattern) {
-		len = sprintf(tmp, pattern, inode->i_ino);
-		path = tmp;
-	} else {
-		path = d_path(dentry, mnt, tmp, PAGE_SIZE);
-		len = tmp + PAGE_SIZE - 1 - path;
-	}
+	path = d_path(dentry, mnt, tmp, PAGE_SIZE);
+	len = tmp + PAGE_SIZE - 1 - path;
 
 	if (len < buflen)
 		buflen = len;
diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c
index 9bb7611c1..22833d064 100644
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -202,15 +202,21 @@ static inline int ramfs_positive(struct dentry *dentry)
  */
 static int ramfs_empty(struct dentry *dentry)
 {
-	struct list_head *list = dentry->d_subdirs.next;
+	struct list_head *list;
+
+	spin_lock(&dcache_lock);
+	list = dentry->d_subdirs.next;
 
 	while (list != &dentry->d_subdirs) {
 		struct dentry *de = list_entry(list, struct dentry, d_child);
 
-		if (ramfs_positive(de))
+		if (ramfs_positive(de)) {
+			spin_unlock(&dcache_lock);
 			return 0;
+		}
 		list = list->next;
 	}
+	spin_unlock(&dcache_lock);
 	return 1;
 }
 
diff --git a/fs/readdir.c b/fs/readdir.c
index 8f40d846a..e1e90c113 100644
--- a/fs/readdir.c
+++ b/fs/readdir.c
@@ -24,14 +24,23 @@ int vfs_readdir(struct file *file,
 	down(&inode->i_sem);
 	down(&inode->i_zombie);
 	res = -ENOENT;
-	if (!IS_DEADDIR(inode))
+	if (!IS_DEADDIR(inode)) {
+		lock_kernel();
 		res = file->f_op->readdir(file, buf, filler);
+		unlock_kernel();
+	}
 	up(&inode->i_zombie);
 	up(&inode->i_sem);
 out:
 	return res;
 }
 
+/*
+ * Directory is locked and all positive dentries in it are safe, since
+ * for ramfs-type trees they can't go away without unlink() or rmdir(),
+ * both impossible due to the lock on directory.
+ */
+
 int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
 {
 	int i;
@@ -52,28 +61,39 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
 			filp->f_pos++;
 			/* fallthrough */
 		default: {
-			struct list_head *list = dentry->d_subdirs.next;
-
+			struct list_head *list;
 			int j = i-2;
+
+			spin_lock(&dcache_lock);
+			list = dentry->d_subdirs.next;
+
 			for (;;) {
-				if (list == &dentry->d_subdirs)
+				if (list == &dentry->d_subdirs) {
+					spin_unlock(&dcache_lock);
 					return 0;
+				}
 				if (!j)
 					break;
 				j--;
 				list = list->next;
 			}
 
-			do {
+			while(1) {
 				struct dentry *de = list_entry(list, struct dentry, d_child);
 
-				if (!d_unhashed(de) && de->d_inode) {
+				if (!list_empty(&de->d_hash) && de->d_inode) {
+					spin_unlock(&dcache_lock);
 					if (filldir(dirent, de->d_name.name, de->d_name.len, filp->f_pos, de->d_inode->i_ino) < 0)
 						break;
+					spin_lock(&dcache_lock);
 				}
 				filp->f_pos++;
 				list = list->next;
-			} while (list != &dentry->d_subdirs);
+				if (list != &dentry->d_subdirs)
+					continue;
+				spin_unlock(&dcache_lock);
+				break;
+			}
 		}
 	}
 	return 0;
@@ -135,11 +155,9 @@ asmlinkage int old_readdir(unsigned int fd, void * dirent, unsigned int count)
 	buf.count = 0;
 	buf.dirent = dirent;
 
-	lock_kernel();
 	error = vfs_readdir(file, fillonedir, &buf);
 	if (error >= 0)
 		error = buf.count;
-	unlock_kernel();
 
 	fput(file);
 out:
@@ -207,7 +225,6 @@ asmlinkage long sys_getdents(unsigned int fd, void * dirent, unsigned int count)
 	buf.count = count;
 	buf.error = 0;
 
-	lock_kernel();
 	error = vfs_readdir(file, filldir, &buf);
 	if (error < 0)
 		goto out_putf;
@@ -219,7 +236,6 @@ asmlinkage long sys_getdents(unsigned int fd, void * dirent, unsigned int count)
 	}
 
 out_putf:
-	unlock_kernel();
 	fput(file);
 out:
 	return error;
diff --git a/fs/smbfs/dir.c b/fs/smbfs/dir.c
index b5715b220..00fefa101 100644
--- a/fs/smbfs/dir.c
+++ b/fs/smbfs/dir.c
@@ -9,6 +9,7 @@
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
+#include <linux/smp_lock.h>
 
 #include <linux/smb_fs.h>
 #include <linux/smbno.h>
@@ -202,6 +203,7 @@ dentry->d_parent->d_name.name, dentry->d_name.name, age);
 
 	if (inode)
 	{
+		lock_kernel();
 		if (is_bad_inode(inode))
 		{
 #ifdef SMBFS_PARANOIA
@@ -211,6 +213,7 @@ dentry->d_parent->d_name.name, dentry->d_name.name);
 			valid = 0;
 		} else if (!valid)
 			valid = (smb_revalidate_inode(dentry) == 0);
+		unlock_kernel();
 	} else
 	{
 	/*
diff --git a/fs/smbfs/inode.c b/fs/smbfs/inode.c
index 769aa7e56..89ddfb22a 100644
--- a/fs/smbfs/inode.c
+++ b/fs/smbfs/inode.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/file.h>
 #include <linux/dcache.h>
+#include <linux/smp_lock.h>
 
 #include <linux/smb_fs.h>
 #include <linux/smbno.h>
@@ -230,6 +231,7 @@ smb_revalidate_inode(struct dentry *dentry)
 	 * If this is a file opened with write permissions,
 	 * the inode will be up-to-date.
 	 */
+	lock_kernel();
 	if (S_ISREG(inode->i_mode) && smb_is_open(inode))
 	{
 		if (inode->u.smbfs_i.access != SMB_O_RDONLY)
@@ -267,6 +269,7 @@ dentry->d_parent->d_name.name, dentry->d_name.name,
 			smb_invalid_dir_cache(inode);
 	}
 out:
+	unlock_kernel();
 	return error;
 }
 
diff --git a/fs/stat.c b/fs/stat.c
index 49d53a538..3ca996ed1 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -36,10 +36,13 @@ static int cp_old_stat(struct inode * inode, struct __old_kernel_stat * statbuf)
 	static int warncount = 5;
 	struct __old_kernel_stat tmp;
 
-	if (warncount) {
+	if (warncount > 0) {
 		warncount--;
 		printk("VFS: Warning: %s using old stat() call. Recompile your binary.\n",
 			current->comm);
+	} else if (warncount < 0) {
+		/* it's laughable, but... */
+		warncount = 0;
 	}
 
 	tmp.st_dev = kdev_t_to_nr(inode->i_dev);
@@ -125,7 +128,6 @@ asmlinkage long sys_stat(char * filename, struct __old_kernel_stat * statbuf)
 	struct nameidata nd;
 	int error;
 
-	lock_kernel();
 	error = user_path_walk(filename, &nd);
 	if (!error) {
 		error = do_revalidate(nd.dentry);
@@ -133,7 +135,6 @@ asmlinkage long sys_stat(char * filename, struct __old_kernel_stat * statbuf)
 			error = cp_old_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 #endif
@@ -143,7 +144,6 @@ asmlinkage long sys_newstat(char * filename, struct stat * statbuf)
 	struct nameidata nd;
 	int error;
 
-	lock_kernel();
 	error = user_path_walk(filename, &nd);
 	if (!error) {
 		error = do_revalidate(nd.dentry);
@@ -151,7 +151,6 @@ asmlinkage long sys_newstat(char * filename, struct stat * statbuf)
 			error = cp_new_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 
@@ -166,7 +165,6 @@ asmlinkage long sys_lstat(char * filename, struct __old_kernel_stat * statbuf)
 	struct nameidata nd;
 	int error;
 
-	lock_kernel();
 	error = user_path_walk_link(filename, &nd);
 	if (!error) {
 		error = do_revalidate(nd.dentry);
@@ -174,7 +172,6 @@ asmlinkage long sys_lstat(char * filename, struct __old_kernel_stat * statbuf)
 			error = cp_old_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 
@@ -185,7 +182,6 @@ asmlinkage long sys_newlstat(char * filename, struct stat * statbuf)
 	struct nameidata nd;
 	int error;
 
-	lock_kernel();
 	error = user_path_walk_link(filename, &nd);
 	if (!error) {
 		error = do_revalidate(nd.dentry);
@@ -193,7 +189,6 @@ asmlinkage long sys_newlstat(char * filename, struct stat * statbuf)
 			error = cp_new_stat(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 
@@ -208,7 +203,6 @@ asmlinkage long sys_fstat(unsigned int fd, struct __old_kernel_stat * statbuf)
 	struct file * f;
 	int err = -EBADF;
 
-	lock_kernel();
 	f = fget(fd);
 	if (f) {
 		struct dentry * dentry = f->f_dentry;
@@ -218,7 +212,6 @@ asmlinkage long sys_fstat(unsigned int fd, struct __old_kernel_stat * statbuf)
 			err = cp_old_stat(dentry->d_inode, statbuf);
 		fput(f);
 	}
-	unlock_kernel();
 	return err;
 }
 
@@ -229,7 +222,6 @@ asmlinkage long sys_newfstat(unsigned int fd, struct stat * statbuf)
 	struct file * f;
 	int err = -EBADF;
 
-	lock_kernel();
 	f = fget(fd);
 	if (f) {
 		struct dentry * dentry = f->f_dentry;
@@ -239,7 +231,6 @@ asmlinkage long sys_newfstat(unsigned int fd, struct stat * statbuf)
 			err = cp_new_stat(dentry->d_inode, statbuf);
 		fput(f);
 	}
-	unlock_kernel();
 	return err;
 }
 
@@ -251,7 +242,6 @@ asmlinkage long sys_readlink(const char * path, char * buf, int bufsiz)
 	if (bufsiz <= 0)
 		return -EINVAL;
 
-	lock_kernel();
 	error = user_path_walk_link(path, &nd);
 	if (!error) {
 		struct inode * inode = nd.dentry->d_inode;
@@ -264,7 +254,6 @@ asmlinkage long sys_readlink(const char * path, char * buf, int bufsiz)
 		}
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 
@@ -333,7 +322,6 @@ asmlinkage long sys_stat64(char * filename, struct stat64 * statbuf, long flags)
 	struct nameidata nd;
 	int error;
 
-	lock_kernel();
 	error = user_path_walk(filename, &nd);
 	if (!error) {
 		error = do_revalidate(nd.dentry);
@@ -341,7 +329,6 @@ asmlinkage long sys_stat64(char * filename, struct stat64 * statbuf, long flags)
 			error = cp_new_stat64(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 
@@ -350,7 +337,6 @@ asmlinkage long sys_lstat64(char * filename, struct stat64 * statbuf, long flags
 	struct nameidata nd;
 	int error;
 
-	lock_kernel();
 	error = user_path_walk_link(filename, &nd);
 	if (!error) {
 		error = do_revalidate(nd.dentry);
@@ -358,7 +344,6 @@ asmlinkage long sys_lstat64(char * filename, struct stat64 * statbuf, long flags
 			error = cp_new_stat64(nd.dentry->d_inode, statbuf);
 		path_release(&nd);
 	}
-	unlock_kernel();
 	return error;
 }
 
@@ -367,7 +352,6 @@ asmlinkage long sys_fstat64(unsigned long fd, struct stat64 * statbuf, long flag
 	struct file * f;
 	int err = -EBADF;
 
-	lock_kernel();
 	f = fget(fd);
 	if (f) {
 		struct dentry * dentry = f->f_dentry;
@@ -377,7 +361,6 @@ asmlinkage long sys_fstat64(unsigned long fd, struct stat64 * statbuf, long flag
 			err = cp_new_stat64(dentry->d_inode, statbuf);
 		fput(f);
 	}
-	unlock_kernel();
 	return err;
 }
 
diff --git a/fs/super.c b/fs/super.c
index 8def1c9c4..3303789f6 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -322,6 +322,7 @@ static struct vfsmount *add_vfsmnt(struct nameidata *nd,
 	atomic_set(&mnt->mnt_count,1);
 	mnt->mnt_sb = sb;
 
+	spin_lock(&dcache_lock);
 	if (nd && !IS_ROOT(nd->dentry) && d_unhashed(nd->dentry))
 		goto fail;
 	mnt->mnt_root = dget(root);
@@ -338,9 +339,11 @@ static struct vfsmount *add_vfsmnt(struct nameidata *nd,
 	INIT_LIST_HEAD(&mnt->mnt_mounts);
 	list_add(&mnt->mnt_instances, &sb->s_mounts);
 	list_add(&mnt->mnt_list, vfsmntlist.prev);
+	spin_unlock(&dcache_lock);
 out:
 	return mnt;
 fail:
+	spin_unlock(&dcache_lock);
 	kfree(mnt->mnt_devname);
 	kfree(mnt);
 	return NULL;
@@ -361,6 +364,7 @@ static void move_vfsmnt(struct vfsmount *mnt,
 			strcpy(new_devname, dev_name);
 	}
 
+	spin_lock(&dcache_lock);
 	old_mountpoint = mnt->mnt_mountpoint;
 	old_parent = mnt->mnt_parent;
 
@@ -382,6 +386,7 @@ static void move_vfsmnt(struct vfsmount *mnt,
 		INIT_LIST_HEAD(&mnt->mnt_child);
 		INIT_LIST_HEAD(&mnt->mnt_clash);
 	}
+	spin_unlock(&dcache_lock);
 
 	/* put the old stuff */
 	dput(old_mountpoint);
@@ -389,6 +394,9 @@ static void move_vfsmnt(struct vfsmount *mnt,
 		mntput(old_parent);
 }
 
+/*
+ * Called with spinlock held, releases it.
+ */
 static void remove_vfsmnt(struct vfsmount *mnt)
 {
 	/* First of all, remove it from all lists */
@@ -396,6 +404,7 @@ static void remove_vfsmnt(struct vfsmount *mnt)
 	list_del(&mnt->mnt_clash);
 	list_del(&mnt->mnt_list);
 	list_del(&mnt->mnt_child);
+	spin_unlock(&dcache_lock);
 	/* Now we can work safely */
 	if (mnt->mnt_parent != mnt)
 		mntput(mnt->mnt_parent);
@@ -601,6 +610,7 @@ asmlinkage long sys_ustat(dev_t dev, struct ustat * ubuf)
 
 	lock_kernel();
         s = get_super(to_kdev_t(dev));
+	unlock_kernel();
         if (s == NULL)
                 goto out;
 	err = vfs_statfs(s, &sbuf);
@@ -613,7 +623,6 @@ asmlinkage long sys_ustat(dev_t dev, struct ustat * ubuf)
 
         err = copy_to_user(ubuf,&tmp,sizeof(struct ustat)) ? -EFAULT : 0;
 out:
-	unlock_kernel();
 	return err;
 }
 
@@ -927,6 +936,7 @@ struct vfsmount *kern_mount(struct file_system_type *type)
 void kern_umount(struct vfsmount *mnt)
 {
 	struct super_block *sb = mnt->mnt_sb;
+	spin_lock(&dcache_lock);
 	remove_vfsmnt(mnt);
 	kill_super(sb, 0);
 }
@@ -969,7 +979,9 @@ static int do_umount(struct vfsmount *mnt, int umount_root, int flags)
 		return retval;
 	}
 
+	spin_lock(&dcache_lock);
 	if (atomic_read(&mnt->mnt_count) > 2) {
+		spin_unlock(&dcache_lock);
 		mntput(mnt);
 		return -EBUSY;
 	}
@@ -982,6 +994,7 @@ static int do_umount(struct vfsmount *mnt, int umount_root, int flags)
 		remove_vfsmnt(mnt);
 		return 0;
 	}
+	spin_unlock(&dcache_lock);
 
 	/*
 	 * Before checking whether the filesystem is still busy,
@@ -1021,7 +1034,9 @@ static int do_umount(struct vfsmount *mnt, int umount_root, int flags)
 
 	/* Something might grab it again - redo checks */
 
+	spin_lock(&dcache_lock);
 	if (atomic_read(&mnt->mnt_count) > 2) {
+		spin_unlock(&dcache_lock);
 		mntput(mnt);
 		return -EBUSY;
 	}
@@ -1440,7 +1455,7 @@ skip_nfs:
 #endif
 
 	devfs_make_root (root_device_name);
-	handle = devfs_find_handle (NULL, ROOT_DEVICE_NAME, 0,
+	handle = devfs_find_handle (NULL, ROOT_DEVICE_NAME,
 	                            MAJOR (ROOT_DEV), MINOR (ROOT_DEV),
 				    DEVFS_SPECIAL_BLK, 1);
 	if (handle)  /*  Sigh: bd*() functions only paper over the cracks  */
@@ -1511,10 +1526,8 @@ mount_it:
 		fs_type->name,
 		(sb->s_flags & MS_RDONLY) ? " readonly" : "");
 	if (path_start >= 0) {
-		devfs_mk_symlink (NULL,
-				  "root", 0, DEVFS_FL_DEFAULT,
-				  path + 5 + path_start, 0,
-				  NULL, NULL);
+		devfs_mk_symlink (NULL, "root", DEVFS_FL_DEFAULT,
+				  path + 5 + path_start, NULL, NULL);
 		memcpy (path + path_start, "/dev/", 5);
 		vfsmnt = add_vfsmnt(NULL, sb->s_root, path + path_start);
 	}
@@ -1599,8 +1612,10 @@ asmlinkage long sys_pivot_root(const char *new_root, const char *put_old)
 	if (error)
 		goto out1;
 
+	read_lock(&current->fs->lock);
 	root_mnt = mntget(current->fs->rootmnt);
 	root = dget(current->fs->root);
+	read_unlock(&current->fs->lock);
 	down(&mount_sem);
 	down(&old_nd.dentry->d_inode->i_zombie);
 	error = -ENOENT;
@@ -1615,18 +1630,20 @@ asmlinkage long sys_pivot_root(const char *new_root, const char *put_old)
 		goto out2; /* loop */
 	error = -EINVAL;
 	tmp = old_nd.mnt; /* make sure we can reach put_old from new_root */
+	spin_lock(&dcache_lock);
 	if (tmp != new_nd.mnt) {
 		for (;;) {
 			if (tmp->mnt_parent == tmp)
-				goto out2;
+				goto out3;
 			if (tmp->mnt_parent == new_nd.mnt)
 				break;
 			tmp = tmp->mnt_parent;
 		}
 		if (!is_subdir(tmp->mnt_mountpoint, new_nd.dentry))
-			goto out2;
+			goto out3;
 	} else if (!is_subdir(old_nd.dentry, new_nd.dentry))
-		goto out2;
+		goto out3;
+	spin_unlock(&dcache_lock);
 
 	move_vfsmnt(new_nd.mnt, new_nd.dentry, NULL, NULL);
 	move_vfsmnt(root_mnt, old_nd.dentry, old_nd.mnt, NULL);
@@ -1643,6 +1660,9 @@ out1:
 out0:
 	unlock_kernel();
 	return error;
+out3:
+	spin_unlock(&dcache_lock);
+	goto out2;
 }
 
 
@@ -1650,18 +1670,17 @@ out0:
 
 int __init change_root(kdev_t new_root_dev,const char *put_old)
 {
-	kdev_t old_root_dev = ROOT_DEV;
 	struct vfsmount *old_rootmnt;
 	struct nameidata devfs_nd, nd;
 	int error = 0;
 
+	read_lock(&current->fs->lock);
 	old_rootmnt = mntget(current->fs->rootmnt);
+	read_unlock(&current->fs->lock);
 	/*  First unmount devfs if mounted  */
 	if (path_init("/dev", LOOKUP_FOLLOW|LOOKUP_POSITIVE, &devfs_nd))
 		error = path_walk("/dev", &devfs_nd);
 	if (!error) {
-		struct super_block *sb = devfs_nd.dentry->d_inode->i_sb;
-
 		if (devfs_nd.mnt->mnt_sb->s_magic == DEVFS_SUPER_MAGIC &&
 		    devfs_nd.dentry == devfs_nd.mnt->mnt_root) {
 			dput(devfs_nd.dentry);
@@ -1677,7 +1696,7 @@ int __init change_root(kdev_t new_root_dev,const char *put_old)
 #if 1
 	shrink_dcache();
 	printk("change_root: old root has d_count=%d\n", 
-	       old_rootmnt->mnt_root->d_count);
+	       atomic_read(&old_rootmnt->mnt_root->d_count));
 #endif
 	mount_devfs_fs ();
 	/*
@@ -1695,7 +1714,7 @@ int __init change_root(kdev_t new_root_dev,const char *put_old)
 			printk("okay\n");
 			return 0;
 		}
-		printk(KERN_ERR "error %ld\n",blivet);
+		printk(KERN_ERR "error %d\n",blivet);
 		return error;
 	}
 	/* FIXME: we should hold i_zombie on nd.dentry */
diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
index cb575cbf9..8a0dde5e4 100644
--- a/fs/udf/symlink.c
+++ b/fs/udf/symlink.c
@@ -34,6 +34,7 @@
 #include <linux/stat.h>
 #include <linux/malloc.h>
 #include <linux/pagemap.h>
+#include <linux/smp_lock.h>
 #include "udf_i.h"
 
 static void udf_pc_to_char(char *from, int fromlen, char *to)
@@ -84,6 +85,7 @@ static int udf_symlink_filler(struct file *file, struct page *page)
 	int err = -EIO;
 	char *p = (char *)kmap(page);
 	
+	lock_kernel();
 	if (UDF_I_ALLOCTYPE(inode) == ICB_FLAG_AD_IN_ICB)
 	{
 		bh = udf_tread(inode->i_sb, inode->i_ino, inode->i_sb->s_blocksize);
@@ -107,11 +109,13 @@ static int udf_symlink_filler(struct file *file, struct page *page)
 	udf_pc_to_char(symlink, inode->i_size, p);
 	udf_release_data(bh);
 
+	unlock_kernel();
 	SetPageUptodate(page);
 	kunmap(page);
 	UnlockPage(page);
 	return 0;
 out:
+	unlock_kernel();
 	SetPageError(page);
 	kunmap(page);
 	UnlockPage(page);
diff --git a/fs/umsdos/dir.c b/fs/umsdos/dir.c
index 2d8e60895..a8352917a 100644
--- a/fs/umsdos/dir.c
+++ b/fs/umsdos/dir.c
@@ -96,9 +96,8 @@ static int umsdos_dir_once (	void *buf,
  */
  
 static int umsdos_readdir_x (struct inode *dir, struct file *filp,
-				void *dirbuf, int internal_read,
-				struct umsdos_dirent *u_entry,
-				int follow_hlink, filldir_t filldir)
+				void *dirbuf, struct umsdos_dirent *u_entry,
+				filldir_t filldir)
 {
 	struct dentry *demd;
 	off_t start_fpos;
@@ -107,8 +106,7 @@ static int umsdos_readdir_x (struct inode *dir, struct file *filp,
 
 	umsdos_startlookup (dir);
 
-	if (filp->f_pos == UMSDOS_SPECIAL_DIRFPOS &&
-	    dir == pseudo_root && !internal_read) {
+	if (filp->f_pos == UMSDOS_SPECIAL_DIRFPOS && dir == pseudo_root) {
 
 		/*
 		 * We don't need to simulate this pseudo directory
@@ -218,7 +216,7 @@ Printk (("Found %s/%s, ino=%ld, flags=%x\n",
 dret->d_parent->d_name.name, info.fake.fname, dret->d_inode->i_ino,
 entry.flags));
 		/* check whether to resolve a hard-link */
-		if ((entry.flags & UMSDOS_HLINK) && follow_hlink &&
+		if ((entry.flags & UMSDOS_HLINK) &&
 		    !inode->u.umsdos_i.i_is_hlink) {
 			dret = umsdos_solve_hlink (dret);
 			ret = PTR_ERR(dret);
@@ -239,8 +237,7 @@ dret->d_parent->d_name.name, dret->d_name.name);
 		 * infinite recursion (/DOS/linux/DOS/linux/...) while
 		 * walking the file system.
 		 */
-		if (inode != pseudo_root &&
-		    (internal_read || !(entry.flags & UMSDOS_HIDDEN))) {
+		if (inode != pseudo_root && !(entry.flags & UMSDOS_HIDDEN)) {
 			if (filldir (dirbuf, entry.name, entry.name_len,
 				 cur_f_pos, inode->i_ino) < 0) {
 				new_filp.f_pos = cur_f_pos;
@@ -317,7 +314,7 @@ static int UMSDOS_readdir (struct file *filp, void *dirbuf, filldir_t filldir)
 		struct umsdos_dirent entry;
 
 		bufk.count = 0;
-		ret = umsdos_readdir_x (dir, filp, &bufk, 0, &entry, 1, 
+		ret = umsdos_readdir_x (dir, filp, &bufk, &entry, 
 					umsdos_dir_once);
 		if (bufk.count == 0)
 			break;
@@ -650,10 +647,15 @@ out_fail:
  */
 char * umsdos_d_path(struct dentry *dentry, char * buffer, int len)
 {
-	struct dentry * old_root = current->fs->root;
+	struct dentry * old_root;
 	char * path;
 
+	read_lock(&current->fs->lock);
+	old_root = dget(current->fs->root);
+	read_unlock(&current->fs->lock);
+	spin_lock(&dcache_lock);
 	path = __d_path(dentry, NULL, dentry->d_sb->s_root, NULL, buffer, len);
+	spin_unlock(&dcache_lock);
 
 	if (*path == '/')
 		path++; /* skip leading '/' */
@@ -664,6 +666,7 @@ char * umsdos_d_path(struct dentry *dentry, char * buffer, int len)
 		path -= (UMSDOS_PSDROOT_LEN+1);
 		memcpy(path, UMSDOS_PSDROOT_NAME, UMSDOS_PSDROOT_LEN);
 	}
+	dput(old_root);
 
 	return path;
 }
diff --git a/fs/umsdos/inode.c b/fs/umsdos/inode.c
index 8820a49dd..8c61dcaf8 100644
--- a/fs/umsdos/inode.c
+++ b/fs/umsdos/inode.c
@@ -68,8 +68,6 @@ void UMSDOS_put_super (struct super_block *sb)
 	Printk ((KERN_DEBUG "UMSDOS_put_super: entering\n"));
 	if (saved_root) {
 		shrink_dcache_parent(saved_root);
-printk("UMSDOS_put_super: freeing saved root, d_count=%d\n",
-saved_root->d_count);
 		dput(saved_root);
 		saved_root = NULL;
 		pseudo_root = NULL;
diff --git a/fs/vfat/namei.c b/fs/vfat/namei.c
index 0439d63fc..b54307e67 100644
--- a/fs/vfat/namei.c
+++ b/fs/vfat/namei.c
@@ -81,9 +81,12 @@ static struct dentry_operations vfat_dentry_ops[4] = {
 static int vfat_revalidate(struct dentry *dentry, int flags)
 {
 	PRINTK1(("vfat_revalidate: %s\n", dentry->d_name.name));
+	spin_lock(&dcache_lock);
 	if (dentry->d_time == dentry->d_parent->d_inode->i_version) {
+		spin_unlock(&dcache_lock);
 		return 1;
 	}
+	spin_unlock(&dcache_lock);
 	return 0;
 }