diff --git a/debian/changelog b/debian/changelog
index 75ebaaf15..511b3714a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -49,7 +49,7 @@ linux (3.11-1~exp1) UNRELEASED; urgency=low
   * [armhf/armmp] Enable PINCTRL_WM8850, replacing GPIO_VT8500
   * [powerpc/powerpc64] Enable CPU_FREQ_CBE (previously CBE_CPUFREQ) as module
   * [armel] Re-enable iop32x and ixp4xx flavours
-  * aufs: Update to aufs3.x-rcN-20130826
+  * aufs: Update to aufs3.x-rcN-20130909
 
   [ Bastian Blank ]
   * Symlink doc directory in linux-headers packages.
diff --git a/debian/patches/features/all/aufs3/aufs-mvdown-don-t-let-unprivileged-users-provoke-a-W.patch b/debian/patches/features/all/aufs3/aufs-mvdown-don-t-let-unprivileged-users-provoke-a-W.patch
deleted file mode 100644
index fe5732b28..000000000
--- a/debian/patches/features/all/aufs3/aufs-mvdown-don-t-let-unprivileged-users-provoke-a-W.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Sat, 31 Aug 2013 18:34:51 +0100
-Subject: aufs: mvdown, don't let unprivileged users provoke a WARNING
-Forwarded: 
-
-Move the WARN_ONCE() about mvdown after the capability check.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- fs/aufs/ioctl.c  | 1 -
- fs/aufs/mvdown.c | 2 ++
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/fs/aufs/ioctl.c b/fs/aufs/ioctl.c
-index 628d627..1ac7688 100644
---- a/fs/aufs/ioctl.c
-+++ b/fs/aufs/ioctl.c
-@@ -152,7 +152,6 @@ long aufs_ioctl_nondir(struct file *file, unsigned int cmd, unsigned long arg)
- 
- 	switch (cmd) {
- 	case AUFS_CTL_MVDOWN:
--		WARN_ONCE(1, "move-down is still testing...\n");
- 		err = au_mvdown(file->f_dentry, (void __user *)arg);
- 		break;
- 
-diff --git a/fs/aufs/mvdown.c b/fs/aufs/mvdown.c
-index e68002e..5f56645 100644
---- a/fs/aufs/mvdown.c
-+++ b/fs/aufs/mvdown.c
-@@ -489,6 +489,8 @@ int au_mvdown(struct dentry *dentry, struct aufs_mvdown __user *uarg)
- 	if (unlikely(!capable(CAP_SYS_ADMIN)))
- 		goto out;
- 
-+	WARN_ONCE(1, "move-down is still testing...\n");
-+
- 	err = -ENOMEM;
- 	args = kmalloc(sizeof(*args), GFP_NOFS);
- 	if (unlikely(!args))
diff --git a/debian/patches/features/all/aufs3/aufs3-add.patch b/debian/patches/features/all/aufs3/aufs3-add.patch
index 84ccbe63e..04ecc8b13 100644
--- a/debian/patches/features/all/aufs3/aufs3-add.patch
+++ b/debian/patches/features/all/aufs3/aufs3-add.patch
@@ -1,7 +1,7 @@
 From: J. R. Okajima <hooanon05@yahoo.co.jp>
-Date: Wed Aug 21 18:26:56 2013 +0900
-Subject: aufs3.x-rcN-20130826
-Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/3c1c777b882a35eecf81c5417d281cd5c302542c/tree/
+Date: Sun Sep 8 00:42:31 2013 +0900
+Subject: aufs3.x-rcN-20130909
+Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/afb98f82a779f3be9e999202fc72a0768d015004/tree/
 Bug-Debian: http://bugs.debian.org/541828
 
 Patch generated by debian/patches/features/all/aufs3/gen-patch
@@ -60,8 +60,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		When the aufs mount option 'noxino' is specified, it
 +		will be empty. About XINO files, see the aufs manual.
 --- a/Documentation/ABI/testing/sysfs-aufs	1970-01-01 01:00:00.000000000 +0100
-+++ b/Documentation/ABI/testing/sysfs-aufs	2013-09-11 02:44:49.673763497 +0100
-@@ -0,0 +1,24 @@
++++ b/Documentation/ABI/testing/sysfs-aufs	2013-09-12 03:25:05.317963426 +0100
+@@ -0,0 +1,31 @@
 +What:		/sys/fs/aufs/si_<id>/
 +Date:		March 2009
 +Contact:	J. R. Okajima <hooanon05@yahoo.co.jp>
@@ -77,6 +77,13 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		It shows the abolute path of a member directory (which
 +		is called branch) in aufs, and its permission.
 +
++What:		/sys/fs/aufs/si_<id>/brid0, brid1 ... bridN
++Date:		July 2013
++Contact:	J. R. Okajima <hooanon05@yahoo.co.jp>
++Description:
++		It shows the id of a member directory (which is called
++		branch) in aufs.
++
 +What:		/sys/fs/aufs/si_<id>/xi_path
 +Date:		March 2009
 +Contact:	J. R. Okajima <hooanon05@yahoo.co.jp>
@@ -1733,8 +1740,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_H__ */
 --- a/fs/aufs/branch.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/branch.c	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,1213 @@
++++ b/fs/aufs/branch.c	2013-09-12 03:25:05.321963426 +0100
+@@ -0,0 +1,1212 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -2136,7 +2143,6 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	spin_lock_init(&br->br_dykey_lock);
 +	memset(br->br_dykey, 0, sizeof(br->br_dykey));
 +	atomic_set(&br->br_count, 0);
-+	br->br_xino_upper = AUFS_XINO_TRUNC_INIT;
 +	atomic_set(&br->br_xino_running, 0);
 +	br->br_id = au_new_br_id(sb);
 +	AuDebugOn(br->br_id < 0);
@@ -2949,8 +2955,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return err;
 +}
 --- a/fs/aufs/branch.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/branch.h	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,255 @@
++++ b/fs/aufs/branch.h	2013-09-12 03:25:05.321963426 +0100
+@@ -0,0 +1,265 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -3021,6 +3027,18 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +};
 +#endif
 +
++/* sysfs entries */
++struct au_brsysfs {
++	char			name[16];
++	struct attribute	attr;
++};
++
++enum {
++	AuBrSysfs_BR,
++	AuBrSysfs_BRID,
++	AuBrSysfs_Last
++};
++
 +/* protected by superblock rwsem */
 +struct au_branch {
 +	struct au_xino_file	br_xino;
@@ -3037,7 +3055,6 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	struct au_wbr		*br_wbr;
 +
 +	/* xino truncation */
-+	blkcnt_t		br_xino_upper;	/* watermark in blocks */
 +	atomic_t		br_xino_running;
 +
 +#ifdef CONFIG_AUFS_HFSNOTIFY
@@ -3045,9 +3062,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif
 +
 +#ifdef CONFIG_SYSFS
-+	/* an entry under sysfs per mount-point */
-+	char			br_name[8];
-+	struct attribute	br_attr;
++	/* entries under sysfs per mount-point */
++	struct au_brsysfs	br_sysfs[AuBrSysfs_Last];
 +#endif
 +};
 +
@@ -3248,8 +3264,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +-include ${srctree}/${src}/conf_priv.mk
 --- a/fs/aufs/cpup.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/cpup.c	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,1266 @@
++++ b/fs/aufs/cpup.c	2013-09-12 03:25:05.321963426 +0100
+@@ -0,0 +1,1268 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -3518,6 +3534,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +				wbytes -= b;
 +				p += b;
 +			}
++			if (unlikely(err < 0))
++				break;
 +		} else {
 +			loff_t res;
 +
@@ -3609,20 +3627,20 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		aufs_bindex_t bindex;
 +		unsigned int flags;
 +		struct dentry *dentry;
++		int force_wr;
 +		struct file *file;
 +		void *label, *label_file;
 +	} *f, file[] = {
 +		{
 +			.bindex = cpg->bsrc,
 +			.flags = O_RDONLY | O_NOATIME | O_LARGEFILE,
-+			.file = NULL,
 +			.label = &&out,
 +			.label_file = &&out_src
 +		},
 +		{
 +			.bindex = cpg->bdst,
 +			.flags = O_WRONLY | O_NOATIME | O_LARGEFILE,
-+			.file = NULL,
++			.force_wr = !!au_ftest_cpup(cpg->flags, RWDST),
 +			.label = &&out_src,
 +			.label_file = &&out_dst
 +		}
@@ -3635,7 +3653,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	for (i = 0; i < 2; i++, f++) {
 +		f->dentry = au_h_dptr(cpg->dentry, f->bindex);
 +		f->file = au_h_open(cpg->dentry, f->bindex, f->flags,
-+				    /*file*/NULL);
++				    /*file*/NULL, f->force_wr);
 +		err = PTR_ERR(f->file);
 +		if (IS_ERR(f->file))
 +			goto *f->label;
@@ -4170,7 +4188,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	h_file = NULL;
 +	if (au_ftest_cpup(cpg->flags, HOPEN)) {
 +		AuDebugOn(cpg->bsrc < 0);
-+		h_file = au_h_open_pre(dentry, cpg->bsrc);
++		h_file = au_h_open_pre(dentry, cpg->bsrc, /*force_wr*/0);
 +		err = PTR_ERR(h_file);
 +		if (IS_ERR(h_file))
 +			goto out;
@@ -4517,8 +4535,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return err;
 +}
 --- a/fs/aufs/cpup.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/cpup.h	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,93 @@
++++ b/fs/aufs/cpup.h	2013-09-12 03:25:05.325963427 +0100
+@@ -0,0 +1,95 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -4578,6 +4596,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +						   cpup */
 +#define AuCpup_OVERWRITE	(1 << 4)	/* allow overwriting the
 +						   existing entry */
++#define AuCpup_RWDST		(1 << 5)	/* force write target even if
++						   the branch is marked as RO */
 +
 +#define au_ftest_cpup(flags, name)	((flags) & AuCpup_##name)
 +#define au_fset_cpup(flags, name) \
@@ -8034,7 +8054,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return -1;
 +}
 --- a/fs/aufs/dir.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/dir.c	2013-09-11 02:44:49.677763497 +0100
++++ b/fs/aufs/dir.c	2013-09-12 03:25:05.325963427 +0100
 @@ -0,0 +1,645 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
@@ -8167,7 +8187,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		if (h_file)
 +			continue;
 +
-+		h_file = au_h_open(dentry, bindex, flags, file);
++		h_file = au_h_open(dentry, bindex, flags, file, /*force_wr*/0);
 +		err = PTR_ERR(h_file);
 +		if (IS_ERR(h_file))
 +			goto out; /* close all? */
@@ -8206,7 +8226,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		if (!h_dentry)
 +			continue;
 +
-+		h_file = au_h_open(dentry, bindex, flags, file);
++		h_file = au_h_open(dentry, bindex, flags, file, /*force_wr*/0);
 +		if (IS_ERR(h_file)) {
 +			err = PTR_ERR(h_file);
 +			break;
@@ -8518,7 +8538,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +	h_file = au_h_open(dentry, arg->bindex,
 +			   O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_LARGEFILE,
-+			   /*file*/NULL);
++			   /*file*/NULL, /*force_wr*/0);
 +	err = PTR_ERR(h_file);
 +	if (IS_ERR(h_file))
 +		goto out;
@@ -10119,7 +10139,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	atomic_set(&sbinfo->si_xigen_next, u);
 +}
 --- a/fs/aufs/f_op.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/f_op.c	2013-09-11 02:44:49.677763497 +0100
++++ b/fs/aufs/f_op.c	2013-09-12 03:25:05.325963427 +0100
 @@ -0,0 +1,721 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
@@ -10168,7 +10188,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	memset(&finfo->fi_htop, 0, sizeof(finfo->fi_htop));
 +	atomic_set(&finfo->fi_mmapped, 0);
 +	bindex = au_dbstart(dentry);
-+	h_file = au_h_open(dentry, bindex, flags, file);
++	h_file = au_h_open(dentry, bindex, flags, file, /*force_wr*/0);
 +	if (IS_ERR(h_file))
 +		err = PTR_ERR(h_file);
 +	else {
@@ -11229,8 +11249,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return ret;
 +}
 --- a/fs/aufs/file.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/file.c	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,713 @@
++++ b/fs/aufs/file.c	2013-09-12 03:25:05.325963427 +0100
+@@ -0,0 +1,725 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -11269,7 +11289,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +/* common functions to regular file and dir */
 +struct file *au_h_open(struct dentry *dentry, aufs_bindex_t bindex, int flags,
-+		       struct file *file)
++		       struct file *file, int force_wr)
 +{
 +	struct file *h_file;
 +	struct dentry *h_dentry;
@@ -11304,8 +11324,20 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		goto out;
 +
 +	/* drop flags for writing */
-+	if (au_test_ro(sb, bindex, dentry->d_inode))
++	if (au_test_ro(sb, bindex, dentry->d_inode)) {
++		if (force_wr && !(flags & O_WRONLY))
++			force_wr = 0;
 +		flags = au_file_roflags(flags);
++		if (force_wr) {
++			h_file = ERR_PTR(-EROFS);
++			flags = au_file_roflags(flags);
++			if (unlikely(vfsub_native_ro(h_inode)
++				     || IS_APPEND(h_inode)))
++				goto out;
++			flags &= ~O_ACCMODE;
++			flags |= O_WRONLY;
++		}
++	}
 +	flags &= ~O_CREAT;
 +	atomic_inc(&br->br_count);
 +	h_path.dentry = h_dentry;
@@ -11400,7 +11432,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	/* AuDebugOn(au_fbstart(file) < bstart); */
 +
 +	h_file = au_h_open(dentry, bstart, vfsub_file_flags(file) & ~O_TRUNC,
-+			   file);
++			   file, /*force_wr*/0);
 +	err = PTR_ERR(h_file);
 +	if (IS_ERR(h_file)) {
 +		if (h_file_tmp) {
@@ -11550,7 +11582,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	if (dbstart <= cpg.bdst		/* just reopen */
 +	    || !d_unhashed(cpg.dentry)	/* copyup and reopen */
 +		) {
-+		h_file = au_h_open_pre(cpg.dentry, cpg.bsrc);
++		h_file = au_h_open_pre(cpg.dentry, cpg.bsrc, /*force_wr*/0);
 +		if (IS_ERR(h_file))
 +			err = PTR_ERR(h_file);
 +		else {
@@ -11945,8 +11977,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* CONFIG_AUFS_DEBUG */
 +};
 --- a/fs/aufs/file.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/file.h	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,310 @@
++++ b/fs/aufs/file.h	2013-09-12 03:25:05.325963427 +0100
+@@ -0,0 +1,312 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -12019,7 +12051,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +extern const struct address_space_operations aufs_aop;
 +unsigned int au_file_roflags(unsigned int flags);
 +struct file *au_h_open(struct dentry *dentry, aufs_bindex_t bindex, int flags,
-+		       struct file *file);
++		       struct file *file, int force_wr);
 +int au_do_open(struct file *file, int (*open)(struct file *file, int flags),
 +	       struct au_fidir *fidir);
 +int au_reopen_nondir(struct file *file);
@@ -12037,12 +12069,14 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +#ifdef CONFIG_AUFS_BR_HFSPLUS
 +/* hfsplus.c */
-+struct file *au_h_open_pre(struct dentry *dentry, aufs_bindex_t bindex);
++struct file *au_h_open_pre(struct dentry *dentry, aufs_bindex_t bindex,
++			   int force_wr);
 +void au_h_open_post(struct dentry *dentry, aufs_bindex_t bindex,
 +		    struct file *h_file);
 +#else
 +static inline
-+struct file *au_h_open_pre(struct dentry *dentry, aufs_bindex_t bindex)
++struct file *au_h_open_pre(struct dentry *dentry, aufs_bindex_t bindex,
++			   int force_wr)
 +{
 +	return NULL;
 +}
@@ -13190,8 +13224,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	.init_br	= au_hfsn_init_br
 +};
 --- a/fs/aufs/hfsplus.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/hfsplus.c	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,56 @@
++++ b/fs/aufs/hfsplus.c	2013-09-12 03:25:05.325963427 +0100
+@@ -0,0 +1,57 @@
 +/*
 + * Copyright (C) 2010-2013 Junjiro R. Okajima
 + *
@@ -13222,7 +13256,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +#include "aufs.h"
 +
-+struct file *au_h_open_pre(struct dentry *dentry, aufs_bindex_t bindex)
++struct file *au_h_open_pre(struct dentry *dentry, aufs_bindex_t bindex,
++			   int force_wr)
 +{
 +	struct file *h_file;
 +	struct dentry *h_dentry;
@@ -13236,7 +13271,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	    && S_ISREG(h_dentry->d_inode->i_mode))
 +		h_file = au_h_open(dentry, bindex,
 +				   O_RDONLY | O_NOATIME | O_LARGEFILE,
-+				   /*file*/NULL);
++				   /*file*/NULL, force_wr);
 +	return h_file;
 +}
 +
@@ -13964,8 +13999,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		au_hn_destroy_cache();
 +}
 --- a/fs/aufs/i_op.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/i_op.c	2013-09-11 02:44:49.677763497 +0100
-@@ -0,0 +1,1115 @@
++++ b/fs/aufs/i_op.c	2013-09-12 03:25:05.325963427 +0100
+@@ -0,0 +1,1118 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -14270,6 +14305,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	      struct au_wr_dir_args *args)
 +{
 +	int err;
++	unsigned int flags;
 +	aufs_bindex_t bcpup, bstart, src_bstart;
 +	const unsigned char add_entry
 +		= au_ftest_wrdir(args->flags, ADD_ENTRY)
@@ -14289,8 +14325,10 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +			if (src_bstart < bstart)
 +				bcpup = src_bstart;
 +		} else if (add_entry) {
-+			err = AuWbrCreate(sbinfo, dentry,
-+					  au_ftest_wrdir(args->flags, ISDIR));
++			flags = 0;
++			if (au_ftest_wrdir(args->flags, ISDIR))
++				au_fset_wbr(flags, DIR);
++			err = AuWbrCreate(sbinfo, dentry, flags);
 +			bcpup = err;
 +		}
 +
@@ -15082,7 +15120,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	.update_time	= aufs_update_time
 +};
 --- a/fs/aufs/i_op_add.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/i_op_add.c	2013-09-11 02:44:49.681763498 +0100
++++ b/fs/aufs/i_op_add.c	2013-09-12 03:25:05.329963427 +0100
 @@ -0,0 +1,739 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
@@ -15511,7 +15549,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		dget(a->h_path.dentry);
 +		au_set_h_dptr(dentry, a->bdst, NULL);
 +		dentry->d_inode = src_dentry->d_inode; /* tmp */
-+		h_file = au_h_open_pre(dentry, a->bsrc);
++		h_file = au_h_open_pre(dentry, a->bsrc, /*force_wr*/0);
 +		if (IS_ERR(h_file))
 +			err = PTR_ERR(h_file);
 +		else {
@@ -18718,7 +18756,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_INODE_H__ */
 --- a/fs/aufs/ioctl.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/ioctl.c	2013-09-11 02:44:49.681763498 +0100
++++ b/fs/aufs/ioctl.c	2013-09-12 03:25:05.329963427 +0100
 @@ -0,0 +1,202 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
@@ -18818,7 +18856,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	}
 +	AuDbg("wbi %d\n", wbi);
 +	if (wbi >= 0)
-+		h_file = au_h_open(root, wbi, wbrfd.oflags, NULL);
++		h_file = au_h_open(root, wbi, wbrfd.oflags, NULL,
++				   /*force_wr*/0);
 +
 +out_unlock:
 +	aufs_read_unlock(root, AuLock_IR);
@@ -18874,7 +18913,6 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +	switch (cmd) {
 +	case AUFS_CTL_MVDOWN:
-+		WARN_ONCE(1, "move-down is still testing...\n");
 +		err = au_mvdown(file->f_dentry, (void __user *)arg);
 +		break;
 +
@@ -19500,8 +19538,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_MODULE_H__ */
 --- a/fs/aufs/mvdown.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/mvdown.c	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,562 @@
++++ b/fs/aufs/mvdown.c	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,610 @@
 +/*
 + * Copyright (C) 2011-2013 Junjiro R. Okajima
 + *
@@ -19522,18 +19560,12 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +#include "aufs.h"
 +
-+enum {
-+	AUFS_MVDOWN_SRC,
-+	AUFS_MVDOWN_DST,
-+	AUFS_MVDOWN_NARRAY
-+};
-+
 +struct au_mvd_args {
 +	struct {
 +		struct super_block *h_sb;
 +		struct dentry *h_parent;
 +		struct au_hinode *hdir;
-+		struct inode *h_dir;
++		struct inode *h_dir, *h_inode;
 +	} info[AUFS_MVDOWN_NARRAY];
 +
 +	struct aufs_mvdown mvdown;
@@ -19545,19 +19577,23 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	struct au_pin pin;
 +};
 +
-+#define mvd_errno		mvdown.output.au_errno
-+#define mvd_bsrc		mvdown.output.bsrc
-+#define mvd_bdst		mvdown.output.bdst
++#define mvd_errno		mvdown.au_errno
++#define mvd_bsrc		mvdown.a[AUFS_MVDOWN_UPPER].bindex
++#define mvd_src_brid		mvdown.a[AUFS_MVDOWN_UPPER].brid
++#define mvd_bdst		mvdown.a[AUFS_MVDOWN_LOWER].bindex
++#define mvd_dst_brid		mvdown.a[AUFS_MVDOWN_LOWER].brid
 +
-+#define mvd_h_src_sb		info[AUFS_MVDOWN_SRC].h_sb
-+#define mvd_h_src_parent	info[AUFS_MVDOWN_SRC].h_parent
-+#define mvd_hdir_src		info[AUFS_MVDOWN_SRC].hdir
-+#define mvd_h_src_dir		info[AUFS_MVDOWN_SRC].h_dir
++#define mvd_h_src_sb		info[AUFS_MVDOWN_UPPER].h_sb
++#define mvd_h_src_parent	info[AUFS_MVDOWN_UPPER].h_parent
++#define mvd_hdir_src		info[AUFS_MVDOWN_UPPER].hdir
++#define mvd_h_src_dir		info[AUFS_MVDOWN_UPPER].h_dir
++#define mvd_h_src_inode		info[AUFS_MVDOWN_UPPER].h_inode
 +
-+#define mvd_h_dst_sb		info[AUFS_MVDOWN_DST].h_sb
-+#define mvd_h_dst_parent	info[AUFS_MVDOWN_DST].h_parent
-+#define mvd_hdir_dst		info[AUFS_MVDOWN_DST].hdir
-+#define mvd_h_dst_dir		info[AUFS_MVDOWN_DST].h_dir
++#define mvd_h_dst_sb		info[AUFS_MVDOWN_LOWER].h_sb
++#define mvd_h_dst_parent	info[AUFS_MVDOWN_LOWER].h_parent
++#define mvd_hdir_dst		info[AUFS_MVDOWN_LOWER].hdir
++#define mvd_h_dst_dir		info[AUFS_MVDOWN_LOWER].h_dir
++#define mvd_h_dst_inode		info[AUFS_MVDOWN_LOWER].h_inode
 +
 +#define AU_MVD_PR(flag, ...) do {			\
 +		if (flag)				\
@@ -19654,6 +19690,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	AuDbg("b%d, b%d\n", cpg.bsrc, cpg.bdst);
 +	if (a->mvdown.flags & AUFS_MVDOWN_OWLOWER)
 +		au_fset_cpup(cpg.flags, OVERWRITE);
++	if (a->mvdown.flags & AUFS_MVDOWN_ROLOWER)
++		au_fset_cpup(cpg.flags, RWDST);
 +	err = au_sio_cpdown_simple(&cpg);
 +	if (unlikely(err))
 +		AU_MVD_PR(dmsg, "cpdown failed\n");
@@ -19765,16 +19803,31 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +/* ---------------------------------------------------------------------- */
 +
-+static int find_lower_writable(struct super_block *sb, aufs_bindex_t bindex)
++static int find_lower_writable(struct au_mvd_args *a)
 +{
-+	aufs_bindex_t bend;
++	struct super_block *sb;
++	aufs_bindex_t bindex, bend;
 +	struct au_branch *br;
 +
++	sb = a->sb;
++	bindex = a->mvd_bsrc;
 +	bend = au_sbend(sb);
-+	for (bindex++; bindex <= bend; bindex++) {
-+		br = au_sbr(sb, bindex);
-+		if (!au_br_rdonly(br))
-+			return bindex;
++	if (!(a->mvdown.flags & AUFS_MVDOWN_ROLOWER)) {
++		for (bindex++; bindex <= bend; bindex++) {
++			br = au_sbr(sb, bindex);
++			if (!au_br_rdonly(br))
++				return bindex;
++		}
++	} else {
++		for (bindex++; bindex <= bend; bindex++) {
++			br = au_sbr(sb, bindex);
++			if (!(au_br_sb(br)->s_flags & MS_RDONLY)) {
++				if (au_br_rdonly(br))
++					a->mvdown.flags
++						|= AUFS_MVDOWN_ROLOWER_R;
++				return bindex;
++			}
++		}
 +	}
 +
 +	return -1;
@@ -19784,15 +19837,13 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +static int au_mvd_args_busy(const unsigned char dmsg, struct au_mvd_args *a)
 +{
 +	int err, plinked;
-+	struct inode *h_src_inode;
 +
 +	err = 0;
-+	h_src_inode = au_h_iptr(a->inode, a->mvd_bsrc);
 +	plinked = !!au_opt_test(au_mntflags(a->sb), PLINK);
 +	if (au_dbstart(a->dentry) == a->mvd_bsrc
-+	    && a->dentry->d_count == 1
++	    && d_count(a->dentry) == 1
 +	    && atomic_read(&a->inode->i_count) == 1
-+	    /* && h_src_inode->i_nlink == 1 */
++	    /* && a->mvd_h_src_inode->i_nlink == 1 */
 +	    && (!plinked || !au_plink_test(a->inode))
 +	    && a->inode->i_nlink == 1)
 +		goto out;
@@ -19800,9 +19851,9 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	err = -EBUSY;
 +	AU_MVD_PR(dmsg,
 +		  "b%d, d{b%d, c%u?}, i{c%d?, l%u}, hi{l%u}, p{%d, %d}\n",
-+		  a->mvd_bsrc, au_dbstart(a->dentry), a->dentry->d_count,
++		  a->mvd_bsrc, au_dbstart(a->dentry), d_count(a->dentry),
 +		  atomic_read(&a->inode->i_count), a->inode->i_nlink,
-+		  h_src_inode->i_nlink,
++		  a->mvd_h_src_inode->i_nlink,
 +		  plinked, plinked ? au_plink_test(a->inode) : 0);
 +
 +out:
@@ -19949,23 +20000,57 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		goto out;
 +
 +	err = -EINVAL;
-+	a->mvd_bsrc = au_ibstart(a->inode);
++	if (!(a->mvdown.flags & AUFS_MVDOWN_BRID_UPPER))
++		a->mvd_bsrc = au_ibstart(a->inode);
++	else {
++		a->mvd_bsrc = au_br_index(a->sb, a->mvd_src_brid);
++		if (unlikely(a->mvd_bsrc < 0
++			     || (a->mvd_bsrc < au_dbstart(a->dentry)
++				 || au_dbend(a->dentry) < a->mvd_bsrc
++				 || !au_h_dptr(a->dentry, a->mvd_bsrc))
++			     || (a->mvd_bsrc < au_ibstart(a->inode)
++				 || au_ibend(a->inode) < a->mvd_bsrc
++				 || !au_h_iptr(a->inode, a->mvd_bsrc)))) {
++			a->mvd_errno = EAU_MVDOWN_NOUPPER;
++			AU_MVD_PR(dmsg, "no upper\n");
++			goto out;
++		}
++	}
 +	if (unlikely(a->mvd_bsrc == au_sbend(a->sb))) {
 +		a->mvd_errno = EAU_MVDOWN_BOTTOM;
 +		AU_MVD_PR(dmsg, "on the bottom\n");
 +		goto out;
 +	}
++	a->mvd_h_src_inode = au_h_iptr(a->inode, a->mvd_bsrc);
 +	br = au_sbr(a->sb, a->mvd_bsrc);
 +	err = au_br_rdonly(br);
-+	if (unlikely(err))
++	if (!(a->mvdown.flags & AUFS_MVDOWN_ROUPPER)) {
++		if (unlikely(err))
++			goto out;
++	} else if (!(vfsub_native_ro(a->mvd_h_src_inode)
++		     || IS_APPEND(a->mvd_h_src_inode))) {
++		if (err)
++			a->mvdown.flags |= AUFS_MVDOWN_ROUPPER_R;
++		/* go on */
++	} else
 +		goto out;
 +
 +	err = -EINVAL;
-+	a->mvd_bdst = find_lower_writable(a->sb, a->mvd_bsrc);
-+	if (unlikely(a->mvd_bdst < 0)) {
-+		a->mvd_errno = EAU_MVDOWN_BOTTOM;
-+		AU_MVD_PR(dmsg, "no writable lower branch\n");
-+		goto out;
++	if (!(a->mvdown.flags & AUFS_MVDOWN_BRID_LOWER)) {
++		a->mvd_bdst = find_lower_writable(a);
++		if (unlikely(a->mvd_bdst < 0)) {
++			a->mvd_errno = EAU_MVDOWN_BOTTOM;
++			AU_MVD_PR(dmsg, "no writable lower branch\n");
++			goto out;
++		}
++	} else {
++		a->mvd_bdst = au_br_index(a->sb, a->mvd_dst_brid);
++		if (unlikely(a->mvd_bdst < 0
++			     || au_sbend(a->sb) < a->mvd_bdst)) {
++			a->mvd_errno = EAU_MVDOWN_NOLOWERBR;
++			AU_MVD_PR(dmsg, "no lower brid\n");
++			goto out;
++		}
 +	}
 +
 +	err = au_mvd_args_busy(dmsg, a);
@@ -19993,6 +20078,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	if (unlikely(!capable(CAP_SYS_ADMIN)))
 +		goto out;
 +
++	WARN_ONCE(1, "move-down is still testing...\n");
++
 +	err = -ENOMEM;
 +	args = kmalloc(sizeof(*args), GFP_NOFS);
 +	if (unlikely(!args))
@@ -20000,15 +20087,15 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +	err = copy_from_user(&args->mvdown, uarg, sizeof(args->mvdown));
 +	if (!err)
-+		err = !access_ok(VERIFY_WRITE, &uarg->output,
-+				 sizeof(uarg->output));
++		err = !access_ok(VERIFY_WRITE, uarg, sizeof(*uarg));
 +	if (unlikely(err)) {
 +		err = -EFAULT;
 +		AuTraceErr(err);
 +		goto out_free;
 +	}
 +	AuDbg("flags 0x%x\n", args->mvdown.flags);
-+	args->mvdown.output.au_errno = 0;
++	args->mvdown.flags &= ~(AUFS_MVDOWN_ROLOWER_R | AUFS_MVDOWN_ROUPPER_R);
++	args->mvdown.au_errno = 0;
 +	args->dentry = dentry;
 +	args->inode = dentry->d_inode;
 +	args->sb = dentry->d_sb;
@@ -20055,8 +20142,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +out_dir:
 +	mutex_unlock(&args->dir->i_mutex);
 +out_free:
-+	e = copy_to_user(&uarg->output, &args->mvdown.output,
-+			 sizeof(args->mvdown.output));
++	e = copy_to_user(uarg, &args->mvdown, sizeof(args->mvdown));
 +	if (unlikely(e))
 +		err = -EFAULT;
 +	kfree(args);
@@ -20065,8 +20151,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return err;
 +}
 --- a/fs/aufs/opts.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/opts.c	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,1697 @@
++++ b/fs/aufs/opts.c	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,1704 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -20433,6 +20519,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	{AuWbrCreate_MFSRRV, "mfsrr:%d:%d"},
 +	{AuWbrCreate_PMFS, "pmfs"},
 +	{AuWbrCreate_PMFSV, "pmfs:%d"},
++	{AuWbrCreate_PMFSRR, "pmfsrr:%d"},
++	{AuWbrCreate_PMFSRRV, "pmfsrr:%d:%d"},
 +
 +	{-1, NULL}
 +};
@@ -20502,6 +20590,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	create->wbr_create = err;
 +	switch (err) {
 +	case AuWbrCreate_MFSRRV:
++	case AuWbrCreate_PMFSRRV:
 +		e = au_wbr_mfs_wmark(&args[0], str, create);
 +		if (!e)
 +			e = au_wbr_mfs_sec(&args[1], str, create);
@@ -20509,6 +20598,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +			err = e;
 +		break;
 +	case AuWbrCreate_MFSRR:
++	case AuWbrCreate_PMFSRR:
 +		e = au_wbr_mfs_wmark(&args[0], str, create);
 +		if (unlikely(e)) {
 +			err = e;
@@ -20725,6 +20815,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +					  u.create->mfsrr_watermark);
 +				break;
 +			case AuWbrCreate_MFSRRV:
++			case AuWbrCreate_PMFSRRV:
 +				AuDbg("%llu watermark, %d sec\n",
 +					  u.create->mfsrr_watermark,
 +					  u.create->mfs_second);
@@ -21264,6 +21355,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	switch (create->wbr_create) {
 +	case AuWbrCreate_MFSRRV:
 +	case AuWbrCreate_MFSRR:
++	case AuWbrCreate_PMFSRR:
++	case AuWbrCreate_PMFSRRV:
 +		sbinfo->si_wbr_mfs.mfsrr_watermark = create->mfsrr_watermark;
 +		/*FALLTHROUGH*/
 +	case AuWbrCreate_MFS:
@@ -21765,8 +21858,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return au_mntflags(sb) & AuOptMask_UDBA;
 +}
 --- a/fs/aufs/opts.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/opts.h	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,209 @@
++++ b/fs/aufs/opts.h	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,211 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -21871,6 +21964,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	AuWbrCreate_MFSRRV,	/* mfs then rr with seconds */
 +	AuWbrCreate_PMFS,	/* parent and mfs */
 +	AuWbrCreate_PMFSV,	/* parent and mfs with seconds */
++	AuWbrCreate_PMFSRR,	/* parent, mfs and round-robin */
++	AuWbrCreate_PMFSRRV,	/* plus seconds */
 +
 +	AuWbrCreate_Def = AuWbrCreate_TDP
 +};
@@ -23315,8 +23410,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_RWSEM_H__ */
 --- a/fs/aufs/sbinfo.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/sbinfo.c	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,346 @@
++++ b/fs/aufs/sbinfo.c	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,350 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -23410,6 +23505,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	atomic_long_set(&sbinfo->si_nfiles, 0);
 +
 +	sbinfo->si_bend = -1;
++	sbinfo->si_last_br_id = AUFS_BRANCH_MAX / 2;
 +
 +	sbinfo->si_wbr_copyup = AuWbrCopyup_Def;
 +	sbinfo->si_wbr_create = AuWbrCreate_Def;
@@ -23418,6 +23514,9 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +	sbinfo->si_mntflags = au_opts_plink(AuOpt_Def);
 +
++	sbinfo->si_xino_jiffy = jiffies;
++	sbinfo->si_xino_expire
++		= msecs_to_jiffies(AUFS_XINO_DEF_SEC * MSEC_PER_SEC);
 +	mutex_init(&sbinfo->si_xib_mtx);
 +	sbinfo->si_xino_brid = -1;
 +	/* leave si_xib_last_pindex and si_xib_next_bit */
@@ -23779,8 +23878,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_SPL_H__ */
 --- a/fs/aufs/super.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/super.c	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,992 @@
++++ b/fs/aufs/super.c	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,1002 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -23943,6 +24042,16 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +			   jiffies_to_msecs(sbinfo->si_wbr_mfs.mfs_expire)
 +			   / MSEC_PER_SEC);
 +		break;
++	case AuWbrCreate_PMFSRR:
++		seq_printf(m, /*pat*/"pmfsrr:%llu",
++			   sbinfo->si_wbr_mfs.mfsrr_watermark);
++		break;
++	case AuWbrCreate_PMFSRRV:
++		seq_printf(m, /*pat*/"pmfsrr:%llu:%lu",
++			   sbinfo->si_wbr_mfs.mfsrr_watermark,
++			   jiffies_to_msecs(sbinfo->si_wbr_mfs.mfs_expire)
++			   / MSEC_PER_SEC);
++		break;
 +	}
 +}
 +
@@ -24774,8 +24883,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	.owner		= THIS_MODULE,
 +};
 --- a/fs/aufs/super.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/super.h	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,559 @@
++++ b/fs/aufs/super.h	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,568 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -24817,8 +24926,15 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	int (*copyup)(struct dentry *dentry);
 +};
 +
++#define AuWbr_DIR	1		/* target is a dir */
++#define AuWbr_PARENT	(1 << 1)	/* always require a parent */
++
++#define au_ftest_wbr(flags, name)	((flags) & AuWbr_##name)
++#define au_fset_wbr(flags, name)	{ (flags) |= AuWbr_##name; }
++#define au_fclr_wbr(flags, name)	{ (flags) &= ~AuWbr_##name; }
++
 +struct au_wbr_create_operations {
-+	int (*create)(struct dentry *dentry, int isdir);
++	int (*create)(struct dentry *dentry, unsigned int flags);
 +	int (*init)(struct super_block *sb);
 +	int (*fin)(struct super_block *sb);
 +};
@@ -24908,6 +25024,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	unsigned long		si_xib_last_pindex;
 +	int			si_xib_next_bit;
 +	aufs_bindex_t		si_xino_brid;
++	unsigned long		si_xino_jiffy;
++	unsigned long		si_xino_expire;
 +	/* reserved for future use */
 +	/* unsigned long long	si_xib_limit; */	/* Max xib file size */
 +
@@ -25551,8 +25669,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __SYSAUFS_H__ */
 --- a/fs/aufs/sysfs.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/sysfs.c	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,257 @@
++++ b/fs/aufs/sysfs.c	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,297 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -25633,7 +25751,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 + * unlinked.
 + */
 +static int sysaufs_si_br(struct seq_file *seq, struct super_block *sb,
-+			 aufs_bindex_t bindex)
++			 aufs_bindex_t bindex, int idx)
 +{
 +	int err;
 +	struct path path;
@@ -25647,18 +25765,30 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	root = sb->s_root;
 +	di_read_lock_parent(root, !AuLock_IR);
 +	br = au_sbr(sb, bindex);
-+	path.mnt = au_br_mnt(br);
-+	path.dentry = au_h_dptr(root, bindex);
-+	au_seq_path(seq, &path);
-+	di_read_unlock(root, !AuLock_IR);
-+	perm = au_optstr_br_perm(br->br_perm);
-+	if (perm) {
-+		err = seq_printf(seq, "=%s\n", perm);
-+		kfree(perm);
++
++	switch (idx) {
++	case AuBrSysfs_BR:
++		path.mnt = au_br_mnt(br);
++		path.dentry = au_h_dptr(root, bindex);
++		au_seq_path(seq, &path);
++		di_read_unlock(root, !AuLock_IR);
++		perm = au_optstr_br_perm(br->br_perm);
++		if (perm) {
++			err = seq_printf(seq, "=%s\n", perm);
++			kfree(perm);
++			if (err == -1)
++				err = -E2BIG;
++		} else
++			err = -ENOMEM;
++		break;
++	case AuBrSysfs_BRID:
++		err = seq_printf(seq, "%d\n", br->br_id);
++		di_read_unlock(root, !AuLock_IR);
 +		if (err == -1)
 +			err = -E2BIG;
-+	} else
-+		err = -ENOMEM;
++		break;
++	}
++
 +	return err;
 +}
 +
@@ -25680,13 +25810,15 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return seq;
 +}
 +
-+#define SysaufsBr_PREFIX "br"
++#define SysaufsBr_PREFIX	"br"
++#define SysaufsBrid_PREFIX	"brid"
 +
 +/* todo: file size may exceed PAGE_SIZE */
 +ssize_t sysaufs_si_show(struct kobject *kobj, struct attribute *attr,
 +			char *buf)
 +{
 +	ssize_t err;
++	int idx;
 +	long l;
 +	aufs_bindex_t bend;
 +	struct au_sbinfo *sbinfo;
@@ -25728,19 +25860,25 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		cattr++;
 +	}
 +
-+	bend = au_sbend(sb);
-+	if (!strncmp(name, SysaufsBr_PREFIX, sizeof(SysaufsBr_PREFIX) - 1)) {
++	if (!strncmp(name, SysaufsBrid_PREFIX,
++		     sizeof(SysaufsBrid_PREFIX) - 1)) {
++		idx = AuBrSysfs_BRID;
++		name += sizeof(SysaufsBrid_PREFIX) - 1;
++	} else if (!strncmp(name, SysaufsBr_PREFIX,
++			    sizeof(SysaufsBr_PREFIX) - 1)) {
++		idx = AuBrSysfs_BR;
 +		name += sizeof(SysaufsBr_PREFIX) - 1;
-+		err = kstrtol(name, 10, &l);
-+		if (!err) {
-+			if (l <= bend)
-+				err = sysaufs_si_br(seq, sb, (aufs_bindex_t)l);
-+			else
-+				err = -ENOENT;
-+		}
-+		goto out_seq;
++	} else
++		  BUG();
++
++	err = kstrtol(name, 10, &l);
++	if (!err) {
++		bend = au_sbend(sb);
++		if (l <= bend)
++			err = sysaufs_si_br(seq, sb, (aufs_bindex_t)l, idx);
++		else
++			err = -ENOENT;
 +	}
-+	BUG();
 +
 +out_seq:
 +	if (!err) {
@@ -25760,17 +25898,26 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +void sysaufs_br_init(struct au_branch *br)
 +{
-+	struct attribute *attr = &br->br_attr;
++	int i;
++	struct au_brsysfs *br_sysfs;
++	struct attribute *attr;
 +
-+	sysfs_attr_init(attr);
-+	attr->name = br->br_name;
-+	attr->mode = S_IRUGO;
++	br_sysfs = br->br_sysfs;
++	for (i = 0; i < ARRAY_SIZE(br->br_sysfs); i++) {
++		attr = &br_sysfs->attr;
++		sysfs_attr_init(attr);
++		attr->name = br_sysfs->name;
++		attr->mode = S_IRUGO;
++		br_sysfs++;
++	}
 +}
 +
 +void sysaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex)
 +{
 +	struct au_branch *br;
 +	struct kobject *kobj;
++	struct au_brsysfs *br_sysfs;
++	int i;
 +	aufs_bindex_t bend;
 +
 +	dbgaufs_brs_del(sb, bindex);
@@ -25782,16 +25929,21 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	bend = au_sbend(sb);
 +	for (; bindex <= bend; bindex++) {
 +		br = au_sbr(sb, bindex);
-+		sysfs_remove_file(kobj, &br->br_attr);
++		br_sysfs = br->br_sysfs;
++		for (i = 0; i < ARRAY_SIZE(br->br_sysfs); i++) {
++			sysfs_remove_file(kobj, &br_sysfs->attr);
++			br_sysfs++;
++		}
 +	}
 +}
 +
 +void sysaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex)
 +{
-+	int err;
++	int err, i;
 +	aufs_bindex_t bend;
 +	struct kobject *kobj;
 +	struct au_branch *br;
++	struct au_brsysfs *br_sysfs;
 +
 +	dbgaufs_brs_add(sb, bindex);
 +
@@ -25802,12 +25954,18 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	bend = au_sbend(sb);
 +	for (; bindex <= bend; bindex++) {
 +		br = au_sbr(sb, bindex);
-+		snprintf(br->br_name, sizeof(br->br_name), SysaufsBr_PREFIX
-+			 "%d", bindex);
-+		err = sysfs_create_file(kobj, &br->br_attr);
-+		if (unlikely(err))
-+			pr_warn("failed %s under sysfs(%d)\n",
-+				br->br_name, err);
++		br_sysfs = br->br_sysfs;
++		snprintf(br_sysfs[AuBrSysfs_BR].name, sizeof(br_sysfs->name),
++			 SysaufsBr_PREFIX "%d", bindex);
++		snprintf(br_sysfs[AuBrSysfs_BRID].name, sizeof(br_sysfs->name),
++			 SysaufsBrid_PREFIX "%d", bindex);
++		for (i = 0; i < ARRAY_SIZE(br->br_sysfs); i++) {
++			err = sysfs_create_file(kobj, &br_sysfs->attr);
++			if (unlikely(err))
++				pr_warn("failed %s under sysfs(%d)\n",
++					br_sysfs->name, err);
++			br_sysfs++;
++		}
 +	}
 +}
 --- a/fs/aufs/sysrq.c	1970-01-01 01:00:00.000000000 +0100
@@ -27631,8 +27789,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return err;
 +}
 --- a/fs/aufs/vfsub.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/vfsub.h	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,303 @@
++++ b/fs/aufs/vfsub.h	2013-09-12 03:25:05.329963427 +0100
+@@ -0,0 +1,311 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -27736,6 +27894,14 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	clear_nlink(inode);
 +}
 +
++static inline int vfsub_native_ro(struct inode *inode)
++{
++	return (inode->i_sb->s_flags & MS_RDONLY)
++		|| IS_RDONLY(inode)
++		/* || IS_APPEND(inode) */
++		|| IS_IMMUTABLE(inode);
++}
++
 +/* ---------------------------------------------------------------------- */
 +
 +int vfsub_update_h_iattr(struct path *h_path, int *did);
@@ -27937,8 +28103,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_VFSUB_H__ */
 --- a/fs/aufs/wbr_policy.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/wbr_policy.c	2013-09-11 02:44:49.681763498 +0100
-@@ -0,0 +1,693 @@
++++ b/fs/aufs/wbr_policy.c	2013-09-12 03:25:05.333963427 +0100
+@@ -0,0 +1,756 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -28201,7 +28367,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +}
 +
 +/* top down parent */
-+static int au_wbr_create_tdp(struct dentry *dentry, int isdir __maybe_unused)
++static int au_wbr_create_tdp(struct dentry *dentry,
++			     unsigned int flags __maybe_unused)
 +{
 +	int err;
 +	aufs_bindex_t bstart, bindex;
@@ -28290,7 +28457,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	return err;
 +}
 +
-+static int au_wbr_create_rr(struct dentry *dentry, int isdir)
++static int au_wbr_create_rr(struct dentry *dentry, unsigned int flags)
 +{
 +	int err, nbr;
 +	unsigned int u;
@@ -28307,7 +28474,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	bend = au_sbend(sb);
 +	nbr = bend + 1;
 +	for (bindex = 0; bindex <= bend; bindex++) {
-+		if (!isdir) {
++		if (!au_ftest_wbr(flags, DIR)) {
 +			err = atomic_dec_return(next) + 1;
 +			/* modulo for 0 is meaningless */
 +			if (unlikely(!err))
@@ -28334,11 +28501,12 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +/* ---------------------------------------------------------------------- */
 +
 +/* most free space */
-+static void au_mfs(struct dentry *dentry)
++static void au_mfs(struct dentry *dentry, struct dentry *parent)
 +{
 +	struct super_block *sb;
 +	struct au_branch *br;
 +	struct au_wbr_mfs *mfs;
++	struct dentry *h_parent;
 +	aufs_bindex_t bindex, bend;
 +	int err;
 +	unsigned long long b, bavail;
@@ -28358,8 +28526,20 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	MtxMustLock(&mfs->mfs_lock);
 +	mfs->mfs_bindex = -EROFS;
 +	mfs->mfsrr_bytes = 0;
-+	bend = au_sbend(sb);
-+	for (bindex = 0; bindex <= bend; bindex++) {
++	if (!parent) {
++		bindex = 0;
++		bend = au_sbend(sb);
++	} else {
++		bindex = au_dbstart(parent);
++		bend = au_dbtaildir(parent);
++	}
++
++	for (; bindex <= bend; bindex++) {
++		if (parent) {
++			h_parent = au_h_dptr(parent, bindex);
++			if (!h_parent || !h_parent->d_inode)
++				continue;
++		}
 +		br = au_sbr(sb, bindex);
 +		if (au_br_rdonly(br))
 +			continue;
@@ -28390,9 +28570,10 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	kfree(st);
 +}
 +
-+static int au_wbr_create_mfs(struct dentry *dentry, int isdir __maybe_unused)
++static int au_wbr_create_mfs(struct dentry *dentry, unsigned int flags)
 +{
 +	int err;
++	struct dentry *parent;
 +	struct super_block *sb;
 +	struct au_wbr_mfs *mfs;
 +
@@ -28401,14 +28582,18 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		goto out;
 +
 +	sb = dentry->d_sb;
++	parent = NULL;
++	if (au_ftest_wbr(flags, PARENT))
++		parent = dget_parent(dentry);
 +	mfs = &au_sbi(sb)->si_wbr_mfs;
 +	mutex_lock(&mfs->mfs_lock);
 +	if (time_after(jiffies, mfs->mfs_jiffy + mfs->mfs_expire)
 +	    || mfs->mfs_bindex < 0
 +	    || au_br_rdonly(au_sbr(sb, mfs->mfs_bindex)))
-+		au_mfs(dentry);
++		au_mfs(dentry, parent);
 +	mutex_unlock(&mfs->mfs_lock);
 +	err = mfs->mfs_bindex;
++	dput(parent);
 +
 +	if (err >= 0)
 +		err = au_wbr_nonopq(dentry, err);
@@ -28439,17 +28624,17 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +/* ---------------------------------------------------------------------- */
 +
 +/* most free space and then round robin */
-+static int au_wbr_create_mfsrr(struct dentry *dentry, int isdir)
++static int au_wbr_create_mfsrr(struct dentry *dentry, unsigned int flags)
 +{
 +	int err;
 +	struct au_wbr_mfs *mfs;
 +
-+	err = au_wbr_create_mfs(dentry, isdir);
++	err = au_wbr_create_mfs(dentry, flags);
 +	if (err >= 0) {
 +		mfs = &au_sbi(dentry->d_sb)->si_wbr_mfs;
 +		mutex_lock(&mfs->mfs_lock);
 +		if (mfs->mfsrr_bytes < mfs->mfsrr_watermark)
-+			err = au_wbr_create_rr(dentry, isdir);
++			err = au_wbr_create_rr(dentry, flags);
 +		mutex_unlock(&mfs->mfs_lock);
 +	}
 +
@@ -28470,7 +28655,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +/* ---------------------------------------------------------------------- */
 +
 +/* top down parent and most free space */
-+static int au_wbr_create_pmfs(struct dentry *dentry, int isdir)
++static int au_wbr_create_pmfs(struct dentry *dentry, unsigned int flags)
 +{
 +	int err, e2;
 +	unsigned long long b;
@@ -28479,7 +28664,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	struct dentry *parent, *h_parent;
 +	struct au_branch *br;
 +
-+	err = au_wbr_create_tdp(dentry, isdir);
++	err = au_wbr_create_tdp(dentry, flags);
 +	if (unlikely(err < 0))
 +		goto out;
 +	parent = dget_parent(dentry);
@@ -28488,7 +28673,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	if (bstart == bend)
 +		goto out_parent; /* success */
 +
-+	e2 = au_wbr_create_mfs(dentry, isdir);
++	e2 = au_wbr_create_mfs(dentry, flags);
 +	if (e2 < 0)
 +		goto out_parent; /* success */
 +
@@ -28523,12 +28708,46 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +/* ---------------------------------------------------------------------- */
 +
++/*
++ * - top down parent
++ * - most free space with parent
++ * - most free space round-robin regardless parent
++ */
++static int au_wbr_create_pmfsrr(struct dentry *dentry, unsigned int flags)
++{
++	int err;
++	unsigned long long watermark;
++	struct super_block *sb;
++	struct au_branch *br;
++	struct au_wbr_mfs *mfs;
++
++	err = au_wbr_create_pmfs(dentry, flags | AuWbr_PARENT);
++	if (unlikely(err < 0))
++		goto out;
++
++	sb = dentry->d_sb;
++	br = au_sbr(sb, err);
++	mfs = &au_sbi(sb)->si_wbr_mfs;
++	mutex_lock(&mfs->mfs_lock);
++	watermark = mfs->mfsrr_watermark;
++	mutex_unlock(&mfs->mfs_lock);
++	if (br->br_wbr->wbr_bytes < watermark)
++		/* regardless the parent dir */
++		err = au_wbr_create_mfsrr(dentry, flags);
++
++out:
++	AuDbg("b%d\n", err);
++	return err;
++}
++
++/* ---------------------------------------------------------------------- */
++
 +/* policies for copyup */
 +
 +/* top down parent */
 +static int au_wbr_copyup_tdp(struct dentry *dentry)
 +{
-+	return au_wbr_create_tdp(dentry, /*isdir, anything is ok*/0);
++	return au_wbr_create_tdp(dentry, /*flags, anything is ok*/0);
 +}
 +
 +/* bottom up parent */
@@ -28630,6 +28849,16 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		.create	= au_wbr_create_pmfs,
 +		.init	= au_wbr_create_init_mfs,
 +		.fin	= au_wbr_create_fin_mfs
++	},
++	[AuWbrCreate_PMFSRR] = {
++		.create	= au_wbr_create_pmfsrr,
++		.init	= au_wbr_create_init_mfsrr,
++		.fin	= au_wbr_create_fin_mfs
++	},
++	[AuWbrCreate_PMFSRRV] = {
++		.create	= au_wbr_create_pmfsrr,
++		.init	= au_wbr_create_init_mfsrr,
++		.fin	= au_wbr_create_fin_mfs
 +	}
 +};
 --- a/fs/aufs/whout.c	1970-01-01 01:00:00.000000000 +0100
@@ -30059,8 +30288,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#endif /* __KERNEL__ */
 +#endif /* __AUFS_WKQ_H__ */
 --- a/fs/aufs/xino.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/fs/aufs/xino.c	2013-09-11 02:44:49.685763498 +0100
-@@ -0,0 +1,1264 @@
++++ b/fs/aufs/xino.c	2013-09-12 03:25:05.333963427 +0100
+@@ -0,0 +1,1305 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -30084,6 +30313,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 + */
 +
 +#include <linux/seq_file.h>
++#include <linux/statfs.h>
 +#include "aufs.h"
 +
 +/* todo: unnecessary to support mmap_sem since kernel-space? */
@@ -30305,7 +30535,10 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +int au_xino_trunc(struct super_block *sb, aufs_bindex_t bindex)
 +{
 +	int err;
++	unsigned long jiffy;
++	blkcnt_t blocks;
 +	aufs_bindex_t bi, bend;
++	struct kstatfs st;
 +	struct au_branch *br;
 +	struct file *new_xino, *file;
 +	struct super_block *h_sb;
@@ -30320,13 +30553,23 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	if (!file)
 +		goto out;
 +
++	err = vfs_statfs(&file->f_path, &st);
++	if (unlikely(err))
++		AuErr1("statfs err %d, ignored\n", err);
++	jiffy = jiffies;
++	blocks = file_inode(file)->i_blocks;
++	pr_info("begin truncating xino(b%d), ib%llu, %llu/%llu free blks\n",
++		bindex, (u64)blocks, st.f_bfree, st.f_blocks);
++
 +	au_xino_lock_dir(sb, file, &ldir);
 +	/* mnt_want_write() is unnecessary here */
 +	new_xino = au_xino_create2(file, file);
 +	au_xino_unlock_dir(&ldir);
 +	err = PTR_ERR(new_xino);
-+	if (IS_ERR(new_xino))
++	if (IS_ERR(new_xino)) {
++		pr_err("err %d, ignored\n", err);
 +		goto out;
++	}
 +	err = 0;
 +	fput(file);
 +	br->br_xino.xi_file = new_xino;
@@ -30344,6 +30587,16 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +		get_file(new_xino);
 +	}
 +
++	err = vfs_statfs(&new_xino->f_path, &st);
++	if (!err) {
++		pr_info("end truncating xino(b%d), ib%llu, %llu/%llu free blks\n",
++			bindex, (u64)file_inode(new_xino)->i_blocks,
++			st.f_bfree, st.f_blocks);
++		if (file_inode(new_xino)->i_blocks < blocks)
++			au_sbi(sb)->si_xino_jiffy = jiffy;
++	} else
++		AuErr1("statfs err %d, ignored\n", err);
++
 +out:
 +	return err;
 +}
@@ -30371,15 +30624,9 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	ii_read_lock_parent(dir);
 +	bindex = au_br_index(sb, br->br_id);
 +	err = au_xino_trunc(sb, bindex);
-+	if (!err
-+	    && file_inode(br->br_xino.xi_file)->i_blocks
-+	    >= br->br_xino_upper)
-+		br->br_xino_upper += AUFS_XINO_TRUNC_STEP;
-+
 +	ii_read_unlock(dir);
 +	if (unlikely(err))
-+		pr_warn("err b%d, upper %llu, (%d)\n",
-+			bindex, (unsigned long long)br->br_xino_upper, err);
++		pr_warn("err b%d, (%d)\n", bindex, err);
 +	atomic_dec(&br->br_xino_running);
 +	atomic_dec(&br->br_count);
 +	si_write_unlock(sb);
@@ -30387,13 +30634,36 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	kfree(args);
 +}
 +
++static int xino_trunc_test(struct super_block *sb, struct au_branch *br)
++{
++	int err;
++	struct kstatfs st;
++	struct au_sbinfo *sbinfo;
++
++	/* todo: si_xino_expire and the ratio should be customizable */
++	sbinfo = au_sbi(sb);
++	if (time_before(jiffies,
++			sbinfo->si_xino_jiffy + sbinfo->si_xino_expire))
++		return 0;
++
++	/* truncation border */
++	err = vfs_statfs(&br->br_xino.xi_file->f_path, &st);
++	if (unlikely(err)) {
++		AuErr1("statfs err %d, ignored\n", err);
++		return 0;
++	}
++	if (div64_u64(st.f_bfree * 100, st.f_blocks) >= AUFS_XINO_DEF_TRUNC)
++		return 0;
++
++	return 1;
++}
++
 +static void xino_try_trunc(struct super_block *sb, struct au_branch *br)
 +{
 +	struct xino_do_trunc_args *args;
 +	int wkq_err;
 +
-+	if (file_inode(br->br_xino.xi_file)->i_blocks
-+	    < br->br_xino_upper)
++	if (!xino_trunc_test(sb, br))
 +		return;
 +
 +	if (atomic_inc_return(&br->br_xino_running) > 1)
@@ -31348,8 +31618,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +#include <uapi/linux/aufs_type.h>
 --- a/include/uapi/linux/aufs_type.h	1970-01-01 01:00:00.000000000 +0100
-+++ b/include/uapi/linux/aufs_type.h	2013-09-11 02:44:49.685763498 +0100
-@@ -0,0 +1,270 @@
++++ b/include/uapi/linux/aufs_type.h	2013-09-12 03:25:05.333963427 +0100
+@@ -0,0 +1,282 @@
 +/*
 + * Copyright (C) 2005-2013 Junjiro R. Okajima
 + *
@@ -31392,7 +31662,7 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +
 +#include <linux/limits.h>
 +
-+#define AUFS_VERSION	"3.x-rcN-20130826"
++#define AUFS_VERSION	"3.x-rcN-20130909"
 +
 +/* todo? move this to linux-2.6.19/include/magic.h */
 +#define AUFS_SUPER_MAGIC	('a' << 24 | 'u' << 16 | 'f' << 8 | 's')
@@ -31436,8 +31706,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +				- AUFS_WH_TMP_LEN)	/* hex */
 +#define AUFS_XINO_FNAME		"." AUFS_NAME ".xino"
 +#define AUFS_XINO_DEFPATH	"/tmp/" AUFS_XINO_FNAME
-+#define AUFS_XINO_TRUNC_INIT	64 /* blocks */
-+#define AUFS_XINO_TRUNC_STEP	4  /* blocks */
++#define AUFS_XINO_DEF_SEC	30 /* seconds */
++#define AUFS_XINO_DEF_TRUNC	45 /* percentage */
 +#define AUFS_DIRWH_DEF		3
 +#define AUFS_RDCACHE_DEF	10 /* seconds */
 +#define AUFS_RDCACHE_MAX	3600 /* seconds */
@@ -31587,6 +31857,8 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +	EAU_MVDOWN_WHITEOUT,
 +	EAU_MVDOWN_UPPER,
 +	EAU_MVDOWN_BOTTOM,
++	EAU_MVDOWN_NOUPPER,
++	EAU_MVDOWN_NOLOWERBR,
 +	EAU_Last
 +};
 +
@@ -31594,18 +31866,28 @@ Patch generated by debian/patches/features/all/aufs3/gen-patch
 +#define AUFS_MVDOWN_DMSG	1
 +#define AUFS_MVDOWN_OWLOWER	(1 << 1)	/* overwrite lower */
 +#define AUFS_MVDOWN_KUPPER	(1 << 2)	/* keep upper */
++#define AUFS_MVDOWN_ROLOWER	(1 << 3)	/* do even if lower is RO */
++#define AUFS_MVDOWN_ROLOWER_R	(1 << 4)	/* did on lower RO */
++#define AUFS_MVDOWN_ROUPPER	(1 << 5)	/* do even if upper is RO */
++#define AUFS_MVDOWN_ROUPPER_R	(1 << 6)	/* did on upper RO */
++#define AUFS_MVDOWN_BRID_UPPER	(1 << 7)	/* upper brid */
++#define AUFS_MVDOWN_BRID_LOWER	(1 << 8)	/* lower brid */
 +/* will be added more */
 +
-+struct aufs_mvdown {
-+	/* input */
-+	uint8_t		flags;
-+	/* will be added more */
++enum {
++	AUFS_MVDOWN_UPPER,
++	AUFS_MVDOWN_LOWER,
++	AUFS_MVDOWN_NARRAY
++};
 +
-+	/* output */
++struct aufs_mvdown {
++	uint32_t	flags;
 +	struct {
-+		int16_t	bsrc, bdst;
-+		int8_t	au_errno;
-+	} output;
++		int16_t		bindex;
++		int16_t		brid;
++	} a[AUFS_MVDOWN_NARRAY];
++	int8_t		au_errno;
++	/* will be added more */
 +} __aligned(8);
 +
 +/* ---------------------------------------------------------------------- */
diff --git a/debian/patches/features/all/aufs3/aufs3-base.patch b/debian/patches/features/all/aufs3/aufs3-base.patch
index abab0c297..1d6918d64 100644
--- a/debian/patches/features/all/aufs3/aufs3-base.patch
+++ b/debian/patches/features/all/aufs3/aufs3-base.patch
@@ -1,13 +1,42 @@
 From: J. R. Okajima <hooanon05@yahoo.co.jp>
-Date: Fri Jul 19 11:54:34 2013 +0900
+Date: Sun Sep 8 00:42:31 2013 +0900
 Subject: aufs3.x-rcN base patch
-Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/3c1c777b882a35eecf81c5417d281cd5c302542c/tree/
+Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/afb98f82a779f3be9e999202fc72a0768d015004/tree/
 Bug-Debian: http://bugs.debian.org/541828
 
 Patch headers added by debian/patches/features/all/aufs3/gen-patch
 
 aufs3.x-rcN base patch
 
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 40e7155..6e43ab0 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -691,6 +691,24 @@ static inline int is_loop_device(struct file *file)
+ 	return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
+ }
+ 
++/*
++ * for AUFS
++ * no get/put for file.
++ */
++struct file *loop_backing_file(struct super_block *sb)
++{
++	struct file *ret;
++	struct loop_device *l;
++
++	ret = NULL;
++	if (MAJOR(sb->s_dev) == LOOP_MAJOR) {
++		l = sb->s_bdev->bd_disk->private_data;
++		ret = l->lo_backing_file;
++	}
++	return ret;
++}
++EXPORT_SYMBOL_GPL(loop_backing_file);
++
+ /* loop sysfs attributes */
+ 
+ static ssize_t loop_attr_show(struct device *dev, char *page,
 diff --git a/fs/file_table.c b/fs/file_table.c
 index b44e4c5..aa91109 100644
 --- a/fs/file_table.c
diff --git a/debian/patches/features/all/aufs3/aufs3-kbuild.patch b/debian/patches/features/all/aufs3/aufs3-kbuild.patch
index 1475168b5..e5f583544 100644
--- a/debian/patches/features/all/aufs3/aufs3-kbuild.patch
+++ b/debian/patches/features/all/aufs3/aufs3-kbuild.patch
@@ -1,7 +1,7 @@
 From: J. R. Okajima <hooanon05@yahoo.co.jp>
 Date: Fri Jul 19 11:54:34 2013 +0900
 Subject: aufs3.x-rcN kbuild patch
-Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/3c1c777b882a35eecf81c5417d281cd5c302542c/tree/
+Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/afb98f82a779f3be9e999202fc72a0768d015004/tree/
 Bug-Debian: http://bugs.debian.org/541828
 
 Patch headers added by debian/patches/features/all/aufs3/gen-patch
diff --git a/debian/patches/features/all/aufs3/aufs3-standalone.patch b/debian/patches/features/all/aufs3/aufs3-standalone.patch
index 34d910124..15b5442fa 100644
--- a/debian/patches/features/all/aufs3/aufs3-standalone.patch
+++ b/debian/patches/features/all/aufs3/aufs3-standalone.patch
@@ -1,7 +1,7 @@
 From: J. R. Okajima <hooanon05@yahoo.co.jp>
-Date: Thu Aug 15 21:26:42 2013 +0900
+Date: Sun Sep 8 00:42:31 2013 +0900
 Subject: aufs3.x-rcN standalone patch
-Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/3c1c777b882a35eecf81c5417d281cd5c302542c/tree/
+Origin: http://sourceforge.net/p/aufs/aufs3-standalone/ci/afb98f82a779f3be9e999202fc72a0768d015004/tree/
 Bug-Debian: http://bugs.debian.org/541828
 
 Patch headers added by debian/patches/features/all/aufs3/gen-patch
@@ -50,7 +50,7 @@ index cc35712..16e2667 100644
  /**
   *	touch_atime	-	update the access time
 diff --git a/fs/namespace.c b/fs/namespace.c
-index 7b1ca9b..51db6ad 100644
+index a45ba4f..f32874b 100644
 --- a/fs/namespace.c
 +++ b/fs/namespace.c
 @@ -54,6 +54,7 @@ EXPORT_SYMBOL_GPL(fs_kobj);
diff --git a/debian/patches/series b/debian/patches/series
index bbf5d49bb..f2f799bc2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -27,8 +27,6 @@ features/all/aufs3/aufs3-add.patch
 debian/aufs3-mark-as-staging.patch
 # hide broken config option
 debian/AUFS_PROC_MAP-is-BROKEN.patch
-# security fix
-features/all/aufs3/aufs-mvdown-don-t-let-unprivileged-users-provoke-a-W.patch
 
 # Change some defaults for security reasons
 features/all/sysrq-mask.patch