Merge commit 'v2.6.35' into kbuild/kbuild

Conflicts: arch/powerpc/Makefile
author: Michal Marek <mmarek@suse.cz> 2010-08-04 07:59:13 -0400
committer: Michal Marek <mmarek@suse.cz> 2010-08-04 07:59:13 -0400
commit: 772320e84588dcbe1600ffb83e5f328f2209ac2a (patch)
tree: a7de21b79340aeaa17c58126f6b801b82c77b53a /fs/nfs
parent: 1ce53adf13a54375d2a5c7cdbe341b2558389615 (diff)
parent: 9fe6206f400646a2322096b56c59891d530e8d51 (diff)
39 files changed, 1720 insertions, 1130 deletions
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 59e5673b4597..a43d07e7b924 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -95,8 +95,7 @@ config ROOT_NFS
          Most people say N here.
 config NFS_FSCACHE
-        bool "Provide NFS client caching support (EXPERIMENTAL)"
+        bool "Provide NFS client caching support"
-        depends on EXPERIMENTAL
        depends on NFS_FS=m && FSCACHE || NFS_FS=y && FSCACHE=y
        help
          Say Y here if you want NFS data to be cached locally on disc through
diff --git a/fs/nfs/cache_lib.c b/fs/nfs/cache_lib.c
index b4ffd0146ea6..84690319e625 100644
--- a/fs/nfs/cache_lib.c
+++ b/fs/nfs/cache_lib.c
@@ -10,6 +10,7 @@
 #include <linux/moduleparam.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/cache.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 73ab220354df..36dfdae95123 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -118,7 +118,6 @@ nfs4_callback_up(struct svc_serv *serv)
        dprintk("NFS: Callback listener port = %u (af %u)\n",
                        nfs_callback_tcpport, PF_INET);
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
        ret = svc_create_xprt(serv, "tcp", PF_INET6,
                                nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
        if (ret > 0) {
@@ -129,7 +128,6 @@ nfs4_callback_up(struct svc_serv *serv)
                ret = 0;
        else
                goto out_err;
-#endif  /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
        return svc_prepare_thread(serv, &serv->sv_pools[0]);
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index d4036be0b589..85a7cfd1b8dd 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -119,6 +119,14 @@ struct cb_recallanyargs {
 };
 extern unsigned nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy);
+struct cb_recallslotargs {
+        struct sockaddr *crsa_addr;
+        uint32_t        crsa_target_max_slots;
+};
+extern unsigned nfs4_callback_recallslot(struct cb_recallslotargs *args,
+                                          void *dummy);
 #endif /* CONFIG_NFS_V4_1 */
 extern __be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index defa9b4c470e..a08770a7e857 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -7,6 +7,7 @@
 */
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include "nfs4_fs.h"
 #include "callback.h"
 #include "delegation.h"
@@ -143,44 +144,49 @@ int nfs41_validate_delegation_stateid(struct nfs_delegation *delegation, const n
 * Return success if the sequenceID is one more than what we last saw on
 * this slot, accounting for wraparound.  Increments the slot's sequence.
 *
- * We don't yet implement a duplicate request cache, so at this time
+ * We don't yet implement a duplicate request cache, instead we set the
- * we will log replays, and process them as if we had not seen them before,
+ * back channel ca_maxresponsesize_cached to zero. This is OK for now
- * but we don't bump the sequence in the slot.  Not too worried about it,
 * since we only currently implement idempotent callbacks anyway.
 *
 * We have a single slot backchannel at this time, so we don't bother
 * checking the used_slots bit array on the table.  The lower layer guarantees
 * a single outstanding callback request at a time.
 */
-static int
+static __be32
-validate_seqid(struct nfs4_slot_table *tbl, u32 slotid, u32 seqid)
+validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
 {
        struct nfs4_slot *slot;
        dprintk("%s enter. slotid %d seqid %d\n",
-                __func__, slotid, seqid);
+                __func__, args->csa_slotid, args->csa_sequenceid);
-        if (slotid > NFS41_BC_MAX_CALLBACKS)
+        if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
                return htonl(NFS4ERR_BADSLOT);
-        slot = tbl->slots + slotid;
+        slot = tbl->slots + args->csa_slotid;
        dprintk("%s slot table seqid: %d\n", __func__, slot->seq_nr);
        /* Normal */
-        if (likely(seqid == slot->seq_nr + 1)) {
+        if (likely(args->csa_sequenceid == slot->seq_nr + 1)) {
                slot->seq_nr++;
                return htonl(NFS4_OK);
        }
        /* Replay */
-        if (seqid == slot->seq_nr) {
+        if (args->csa_sequenceid == slot->seq_nr) {
-                dprintk("%s seqid %d is a replay - no DRC available\n",
+                dprintk("%s seqid %d is a replay\n",
-                        __func__, seqid);
+                        __func__, args->csa_sequenceid);
-                return htonl(NFS4_OK);
+                /* Signal process_op to set this error on next op */
+                if (args->csa_cachethis == 0)
+                        return htonl(NFS4ERR_RETRY_UNCACHED_REP);
+                /* The ca_maxresponsesize_cached is 0 with no DRC */
+                else if (args->csa_cachethis == 1)
+                        return htonl(NFS4ERR_REP_TOO_BIG_TO_CACHE);
        }
        /* Wraparound */
-        if (seqid == 1 && (slot->seq_nr + 1) == 0) {
+        if (args->csa_sequenceid == 1 && (slot->seq_nr + 1) == 0) {
                slot->seq_nr = 1;
                return htonl(NFS4_OK);
        }
@@ -225,27 +231,87 @@ validate_seqid(struct nfs4_slot_table *tbl, u32 slotid, u32 seqid)
        return NULL;
 }
-/* FIXME: referring calls should be processed */
+/*
-unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
+ * For each referring call triple, check the session's slot table for
+ * a match.  If the slot is in use and the sequence numbers match, the
+ * client is still waiting for a response to the original request.
+ */
+static bool referring_call_exists(struct nfs_client *clp,
+                                  uint32_t nrclists,
+                                  struct referring_call_list *rclists)
+{
+        bool status = 0;
+        int i, j;
+        struct nfs4_session *session;
+        struct nfs4_slot_table *tbl;
+        struct referring_call_list *rclist;
+        struct referring_call *ref;
+        /*
+         * XXX When client trunking is implemented, this becomes
+         * a session lookup from within the loop
+         */
+        session = clp->cl_session;
+        tbl = &session->fc_slot_table;
+        for (i = 0; i < nrclists; i++) {
+                rclist = &rclists[i];
+                if (memcmp(session->sess_id.data,
+                           rclist->rcl_sessionid.data,
+                           NFS4_MAX_SESSIONID_LEN) != 0)
+                        continue;
+                for (j = 0; j < rclist->rcl_nrefcalls; j++) {
+                        ref = &rclist->rcl_refcalls[j];
+                        dprintk("%s: sessionid %x:%x:%x:%x sequenceid %u "
+                                "slotid %u\n", __func__,
+                                ((u32 *)&rclist->rcl_sessionid.data)[0],
+                                ((u32 *)&rclist->rcl_sessionid.data)[1],
+                                ((u32 *)&rclist->rcl_sessionid.data)[2],
+                                ((u32 *)&rclist->rcl_sessionid.data)[3],
+                                ref->rc_sequenceid, ref->rc_slotid);
+                        spin_lock(&tbl->slot_tbl_lock);
+                        status = (test_bit(ref->rc_slotid, tbl->used_slots) &&
+                                  tbl->slots[ref->rc_slotid].seq_nr ==
+                                        ref->rc_sequenceid);
+                        spin_unlock(&tbl->slot_tbl_lock);
+                        if (status)
+                                goto out;
+                }
+        }
+out:
+        return status;
+}
+__be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                                struct cb_sequenceres *res)
 {
        struct nfs_client *clp;
-        int i, status;
+        int i;
+        __be32 status;
-        for (i = 0; i < args->csa_nrclists; i++)
-                kfree(args->csa_rclists[i].rcl_refcalls);
-        kfree(args->csa_rclists);
        status = htonl(NFS4ERR_BADSESSION);
        clp = find_client_with_session(args->csa_addr, 4, &args->csa_sessionid);
        if (clp == NULL)
                goto out;
-        status = validate_seqid(&clp->cl_session->bc_slot_table,
+        status = validate_seqid(&clp->cl_session->bc_slot_table, args);
-                                args->csa_slotid, args->csa_sequenceid);
        if (status)
                goto out_putclient;
+        /*
+         * Check for pending referring calls.  If a match is found, a
+         * related callback was received before the response to the original
+         * call.
+         */
+        if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists)) {
+                status = htonl(NFS4ERR_DELAY);
+                goto out_putclient;
+        }
        memcpy(&res->csr_sessionid, &args->csa_sessionid,
               sizeof(res->csr_sessionid));
        res->csr_sequenceid = args->csa_sequenceid;
@@ -256,15 +322,23 @@ unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
 out_putclient:
        nfs_put_client(clp);
 out:
-        dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
+        for (i = 0; i < args->csa_nrclists; i++)
-        res->csr_status = status;
+                kfree(args->csa_rclists[i].rcl_refcalls);
-        return res->csr_status;
+        kfree(args->csa_rclists);
+        if (status == htonl(NFS4ERR_RETRY_UNCACHED_REP))
+                res->csr_status = 0;
+        else
+                res->csr_status = status;
+        dprintk("%s: exit with status = %d res->csr_status %d\n", __func__,
+                ntohl(status), ntohl(res->csr_status));
+        return status;
 }
-unsigned nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy)
+__be32 nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy)
 {
        struct nfs_client *clp;
-        int status;
+        __be32 status;
        fmode_t flags = 0;
        status = htonl(NFS4ERR_OP_NOT_IN_SESSION);
@@ -289,4 +363,40 @@ out:
        dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
        return status;
 }
+/* Reduce the fore channel's max_slots to the target value */
+__be32 nfs4_callback_recallslot(struct cb_recallslotargs *args, void *dummy)
+{
+        struct nfs_client *clp;
+        struct nfs4_slot_table *fc_tbl;
+        __be32 status;
+        status = htonl(NFS4ERR_OP_NOT_IN_SESSION);
+        clp = nfs_find_client(args->crsa_addr, 4);
+        if (clp == NULL)
+                goto out;
+        dprintk("NFS: CB_RECALL_SLOT request from %s target max slots %d\n",
+                rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR),
+                args->crsa_target_max_slots);
+        fc_tbl = &clp->cl_session->fc_slot_table;
+        status = htonl(NFS4ERR_BAD_HIGH_SLOT);
+        if (args->crsa_target_max_slots > fc_tbl->max_slots ||
+            args->crsa_target_max_slots < 1)
+                goto out_putclient;
+        status = htonl(NFS4_OK);
+        if (args->crsa_target_max_slots == fc_tbl->max_slots)
+                goto out_putclient;
+        fc_tbl->target_max_slots = args->crsa_target_max_slots;
+        nfs41_handle_recall_slot(clp);
+out_putclient:
+        nfs_put_client(clp);    /* balance nfs_find_client */
+out:
+        dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
+        return status;
+}
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 8e1a2511c8be..05af212f0edf 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -9,6 +9,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include "nfs4_fs.h"
 #include "callback.h"
@@ -24,10 +25,14 @@
 #define CB_OP_SEQUENCE_RES_MAXSZ        (CB_OP_HDR_RES_MAXSZ + \
                                        4 + 1 + 3)
 #define CB_OP_RECALLANY_RES_MAXSZ       (CB_OP_HDR_RES_MAXSZ)
+#define CB_OP_RECALLSLOT_RES_MAXSZ      (CB_OP_HDR_RES_MAXSZ)
 #endif /* CONFIG_NFS_V4_1 */
 #define NFSDBG_FACILITY NFSDBG_CALLBACK
+/* Internal error code */
+#define NFS4ERR_RESOURCE_HDR    11050
 typedef __be32 (*callback_process_op_t)(void *, void *);
 typedef __be32 (*callback_decode_arg_t)(struct svc_rqst *, struct xdr_stream *, void *);
 typedef __be32 (*callback_encode_res_t)(struct svc_rqst *, struct xdr_stream *, void *);
@@ -173,7 +178,7 @@ static __be32 decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
        __be32 *p;
        p = read_buf(xdr, 4);
        if (unlikely(p == NULL))
-                return htonl(NFS4ERR_RESOURCE);
+                return htonl(NFS4ERR_RESOURCE_HDR);
        *op = ntohl(*p);
        return 0;
 }
@@ -215,10 +220,10 @@ out:
 #if defined(CONFIG_NFS_V4_1)
-static unsigned decode_sessionid(struct xdr_stream *xdr,
+static __be32 decode_sessionid(struct xdr_stream *xdr,
                                 struct nfs4_sessionid *sid)
 {
-        uint32_t *p;
+        __be32 *p;
        int len = NFS4_MAX_SESSIONID_LEN;
        p = read_buf(xdr, len);
@@ -229,12 +234,12 @@ static unsigned decode_sessionid(struct xdr_stream *xdr,
        return 0;
 }
-static unsigned decode_rc_list(struct xdr_stream *xdr,
+static __be32 decode_rc_list(struct xdr_stream *xdr,
                               struct referring_call_list *rc_list)
 {
-        uint32_t *p;
+        __be32 *p;
        int i;
-        unsigned status;
+        __be32 status;
        status = decode_sessionid(xdr, &rc_list->rcl_sessionid);
        if (status)
@@ -267,13 +272,13 @@ out:
        return status;
 }
-static unsigned decode_cb_sequence_args(struct svc_rqst *rqstp,
+static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
                                        struct xdr_stream *xdr,
                                        struct cb_sequenceargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
        int i;
-        unsigned status;
+        __be32 status;
        status = decode_sessionid(xdr, &args->csa_sessionid);
        if (status)
@@ -327,11 +332,11 @@ out_free:
        goto out;
 }
-static unsigned decode_recallany_args(struct svc_rqst *rqstp,
+static __be32 decode_recallany_args(struct svc_rqst *rqstp,
                                      struct xdr_stream *xdr,
                                      struct cb_recallanyargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
        args->craa_addr = svc_addr(rqstp);
        p = read_buf(xdr, 4);
@@ -346,6 +351,20 @@ static unsigned decode_recallany_args(struct svc_rqst *rqstp,
        return 0;
 }
+static __be32 decode_recallslot_args(struct svc_rqst *rqstp,
+                                        struct xdr_stream *xdr,
+                                        struct cb_recallslotargs *args)
+{
+        __be32 *p;
+        args->crsa_addr = svc_addr(rqstp);
+        p = read_buf(xdr, 4);
+        if (unlikely(p == NULL))
+                return htonl(NFS4ERR_BADXDR);
+        args->crsa_target_max_slots = ntohl(*p++);
+        return 0;
+}
 #endif /* CONFIG_NFS_V4_1 */
 static __be32 encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
@@ -465,7 +484,7 @@ static __be32 encode_op_hdr(struct xdr_stream *xdr, uint32_t op, __be32 res)
        
        p = xdr_reserve_space(xdr, 8);
        if (unlikely(p == NULL))
-                return htonl(NFS4ERR_RESOURCE);
+                return htonl(NFS4ERR_RESOURCE_HDR);
        *p++ = htonl(op);
        *p = res;
        return 0;
@@ -499,10 +518,10 @@ out:
 #if defined(CONFIG_NFS_V4_1)
-static unsigned encode_sessionid(struct xdr_stream *xdr,
+static __be32 encode_sessionid(struct xdr_stream *xdr,
                                 const struct nfs4_sessionid *sid)
 {
-        uint32_t *p;
+        __be32 *p;
        int len = NFS4_MAX_SESSIONID_LEN;
        p = xdr_reserve_space(xdr, len);
@@ -513,11 +532,11 @@ static unsigned encode_sessionid(struct xdr_stream *xdr,
        return 0;
 }
-static unsigned encode_cb_sequence_res(struct svc_rqst *rqstp,
+static __be32 encode_cb_sequence_res(struct svc_rqst *rqstp,
                                       struct xdr_stream *xdr,
                                       const struct cb_sequenceres *res)
 {
-        uint32_t *p;
+        __be32 *p;
        unsigned status = res->csr_status;
        if (unlikely(status != 0))
@@ -554,6 +573,7 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
        case OP_CB_RECALL:
        case OP_CB_SEQUENCE:
        case OP_CB_RECALL_ANY:
+        case OP_CB_RECALL_SLOT:
                *op = &callback_ops[op_nr];
                break;
@@ -562,7 +582,6 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
        case OP_CB_NOTIFY:
        case OP_CB_PUSH_DELEG:
        case OP_CB_RECALLABLE_OBJ_AVAIL:
-        case OP_CB_RECALL_SLOT:
        case OP_CB_WANTS_CANCELLED:
        case OP_CB_NOTIFY_LOCK:
                return htonl(NFS4ERR_NOTSUPP);
@@ -602,20 +621,18 @@ preprocess_nfs4_op(unsigned int op_nr, struct callback_op **op)
 static __be32 process_op(uint32_t minorversion, int nop,
                struct svc_rqst *rqstp,
                struct xdr_stream *xdr_in, void *argp,
-                struct xdr_stream *xdr_out, void *resp)
+                struct xdr_stream *xdr_out, void *resp, int* drc_status)
 {
        struct callback_op *op = &callback_ops[0];
-        unsigned int op_nr = OP_CB_ILLEGAL;
+        unsigned int op_nr;
        __be32 status;
        long maxlen;
        __be32 res;
        dprintk("%s: start\n", __func__);
        status = decode_op_hdr(xdr_in, &op_nr);
-        if (unlikely(status)) {
+        if (unlikely(status))
-                status = htonl(NFS4ERR_OP_ILLEGAL);
+                return status;
-                goto out;
-        }
        dprintk("%s: minorversion=%d nop=%d op_nr=%u\n",
                __func__, minorversion, nop, op_nr);
@@ -624,19 +641,32 @@ static __be32 process_op(uint32_t minorversion, int nop,
                                preprocess_nfs4_op(op_nr, &op);
        if (status == htonl(NFS4ERR_OP_ILLEGAL))
                op_nr = OP_CB_ILLEGAL;
-out:
+        if (status)
+                goto encode_hdr;
+        if (*drc_status) {
+                status = *drc_status;
+                goto encode_hdr;
+        }
        maxlen = xdr_out->end - xdr_out->p;
        if (maxlen > 0 && maxlen < PAGE_SIZE) {
-                if (likely(status == 0 && op->decode_args != NULL))
+                status = op->decode_args(rqstp, xdr_in, argp);
-                        status = op->decode_args(rqstp, xdr_in, argp);
+                if (likely(status == 0))
-                if (likely(status == 0 && op->process_op != NULL))
                        status = op->process_op(argp, resp);
        } else
                status = htonl(NFS4ERR_RESOURCE);
+        /* Only set by OP_CB_SEQUENCE processing */
+        if (status == htonl(NFS4ERR_RETRY_UNCACHED_REP)) {
+                *drc_status = status;
+                status = 0;
+        }
+encode_hdr:
        res = encode_op_hdr(xdr_out, op_nr, status);
-        if (status == 0)
+        if (unlikely(res))
-                status = res;
+                return res;
        if (op->encode_res != NULL && status == 0)
                status = op->encode_res(rqstp, xdr_out, resp);
        dprintk("%s: done, status = %d\n", __func__, ntohl(status));
@@ -652,7 +682,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
        struct cb_compound_hdr_res hdr_res = { NULL };
        struct xdr_stream xdr_in, xdr_out;
        __be32 *p;
-        __be32 status;
+        __be32 status, drc_status = 0;
        unsigned int nops = 0;
        dprintk("%s: start\n", __func__);
@@ -672,11 +702,18 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
                return rpc_system_err;
        while (status == 0 && nops != hdr_arg.nops) {
-                status = process_op(hdr_arg.minorversion, nops,
+                status = process_op(hdr_arg.minorversion, nops, rqstp,
-                                    rqstp, &xdr_in, argp, &xdr_out, resp);
+                                    &xdr_in, argp, &xdr_out, resp, &drc_status);
                nops++;
        }
+        /* Buffer overflow in decode_ops_hdr or encode_ops_hdr. Return
+        * resource error in cb_compound status without returning op */
+        if (unlikely(status == htonl(NFS4ERR_RESOURCE_HDR))) {
+                status = htonl(NFS4ERR_RESOURCE);
+                nops--;
+        }
        *hdr_res.status = status;
        *hdr_res.nops = htonl(nops);
        dprintk("%s: done, status = %u\n", __func__, ntohl(status));
@@ -713,6 +750,11 @@ static struct callback_op callback_ops[] = {
                .decode_args = (callback_decode_arg_t)decode_recallany_args,
                .res_maxsize = CB_OP_RECALLANY_RES_MAXSZ,
        },
+        [OP_CB_RECALL_SLOT] = {
+                .process_op = (callback_process_op_t)nfs4_callback_recallslot,
+                .decode_args = (callback_decode_arg_t)decode_recallslot_args,
+                .res_maxsize = CB_OP_RECALLSLOT_RES_MAXSZ,
+        },
 #endif /* CONFIG_NFS_V4_1 */
 };
@@ -741,6 +783,7 @@ struct svc_version nfs4_callback_version1 = {
        .vs_proc = nfs4_callback_procedures1,
        .vs_xdrsize = NFS4_CALLBACK_XDRSIZE,
        .vs_dispatch = NULL,
+        .vs_hidden = 1,
 };
 struct svc_version nfs4_callback_version4 = {
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index ee77713ce68b..d25b5257b7a1 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -35,6 +35,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/nfs_xdr.h>
 #include <linux/sunrpc/bc_xprt.h>
@@ -164,30 +165,7 @@ error_0:
        return ERR_PTR(err);
 }
-static void nfs4_shutdown_client(struct nfs_client *clp)
-{
-#ifdef CONFIG_NFS_V4
-        if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
-                nfs4_kill_renewd(clp);
-        BUG_ON(!RB_EMPTY_ROOT(&clp->cl_state_owners));
-        if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
-                nfs_idmap_delete(clp);
-        rpc_destroy_wait_queue(&clp->cl_rpcwaitq);
-#endif
-}
-/*
- * Destroy the NFS4 callback service
- */
-static void nfs4_destroy_callback(struct nfs_client *clp)
-{
 #ifdef CONFIG_NFS_V4
-        if (__test_and_clear_bit(NFS_CS_CALLBACK, &clp->cl_res_state))
-                nfs_callback_down(clp->cl_minorversion);
-#endif /* CONFIG_NFS_V4 */
-}
 /*
 * Clears/puts all minor version specific parts from an nfs_client struct
 * reverting it to minorversion 0.
@@ -202,9 +180,33 @@ static void nfs4_clear_client_minor_version(struct nfs_client *clp)
        clp->cl_call_sync = _nfs4_call_sync;
 #endif /* CONFIG_NFS_V4_1 */
+}
+/*
+ * Destroy the NFS4 callback service
+ */
+static void nfs4_destroy_callback(struct nfs_client *clp)
+{
+        if (__test_and_clear_bit(NFS_CS_CALLBACK, &clp->cl_res_state))
+                nfs_callback_down(clp->cl_minorversion);
+}
+static void nfs4_shutdown_client(struct nfs_client *clp)
+{
+        if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
+                nfs4_kill_renewd(clp);
+        nfs4_clear_client_minor_version(clp);
        nfs4_destroy_callback(clp);
+        if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
+                nfs_idmap_delete(clp);
+        rpc_destroy_wait_queue(&clp->cl_rpcwaitq);
 }
+#else
+static void nfs4_shutdown_client(struct nfs_client *clp)
+{
+}
+#endif /* CONFIG_NFS_V4 */
 /*
 * Destroy a shared client record
@@ -213,7 +215,6 @@ static void nfs_free_client(struct nfs_client *clp)
 {
        dprintk("--> nfs_free_client(%u)\n", clp->rpc_ops->version);
-        nfs4_clear_client_minor_version(clp);
        nfs4_shutdown_client(clp);
        nfs_fscache_release_client_cookie(clp);
@@ -933,7 +934,6 @@ static int nfs_probe_fsinfo(struct nfs_server *server, struct nfs_fh *mntfh, str
        }
        fsinfo.fattr = fattr;
-        nfs_fattr_init(fattr);
        error = clp->rpc_ops->fsinfo(server, mntfh, &fsinfo);
        if (error < 0)
                goto out_error;
@@ -965,6 +965,8 @@ out_error:
 static void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source)
 {
        target->flags = source->flags;
+        target->rsize = source->rsize;
+        target->wsize = source->wsize;
        target->acregmin = source->acregmin;
        target->acregmax = source->acregmax;
        target->acdirmin = source->acdirmin;
@@ -1044,13 +1046,18 @@ struct nfs_server *nfs_create_server(const struct nfs_parsed_mount_data *data,
                                     struct nfs_fh *mntfh)
 {
        struct nfs_server *server;
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr;
        int error;
        server = nfs_alloc_server();
        if (!server)
                return ERR_PTR(-ENOMEM);
+        error = -ENOMEM;
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                goto error;
        /* Get a client representation */
        error = nfs_init_server(server, data);
        if (error < 0)
@@ -1061,7 +1068,7 @@ struct nfs_server *nfs_create_server(const struct nfs_parsed_mount_data *data,
        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
        /* Probe the root fh to retrieve its FSID */
-        error = nfs_probe_fsinfo(server, mntfh, &fattr);
+        error = nfs_probe_fsinfo(server, mntfh, fattr);
        if (error < 0)
                goto error;
        if (server->nfs_client->rpc_ops->version == 3) {
@@ -1074,14 +1081,14 @@ struct nfs_server *nfs_create_server(const struct nfs_parsed_mount_data *data,
                        server->namelen = NFS2_MAXNAMLEN;
        }
-        if (!(fattr.valid & NFS_ATTR_FATTR)) {
+        if (!(fattr->valid & NFS_ATTR_FATTR)) {
-                error = server->nfs_client->rpc_ops->getattr(server, mntfh, &fattr);
+                error = server->nfs_client->rpc_ops->getattr(server, mntfh, fattr);
                if (error < 0) {
                        dprintk("nfs_create_server: getattr error = %d\n", -error);
                        goto error;
                }
        }
-        memcpy(&server->fsid, &fattr.fsid, sizeof(server->fsid));
+        memcpy(&server->fsid, &fattr->fsid, sizeof(server->fsid));
        dprintk("Server FSID: %llx:%llx\n",
                (unsigned long long) server->fsid.major,
@@ -1093,9 +1100,11 @@ struct nfs_server *nfs_create_server(const struct nfs_parsed_mount_data *data,
        spin_unlock(&nfs_client_lock);
        server->mount_time = jiffies;
+        nfs_free_fattr(fattr);
        return server;
 error:
+        nfs_free_fattr(fattr);
        nfs_free_server(server);
        return ERR_PTR(error);
 }
@@ -1277,6 +1286,55 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
 #endif /* CONFIG_NFS_V4_1 */
 }
+static int nfs4_server_common_setup(struct nfs_server *server,
+                struct nfs_fh *mntfh)
+{
+        struct nfs_fattr *fattr;
+        int error;
+        BUG_ON(!server->nfs_client);
+        BUG_ON(!server->nfs_client->rpc_ops);
+        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                return -ENOMEM;
+        /* We must ensure the session is initialised first */
+        error = nfs4_init_session(server);
+        if (error < 0)
+                goto out;
+        /* Probe the root fh to retrieve its FSID and filehandle */
+        error = nfs4_get_rootfh(server, mntfh);
+        if (error < 0)
+                goto out;
+        dprintk("Server FSID: %llx:%llx\n",
+                        (unsigned long long) server->fsid.major,
+                        (unsigned long long) server->fsid.minor);
+        dprintk("Mount FH: %d\n", mntfh->size);
+        nfs4_session_set_rwsize(server);
+        error = nfs_probe_fsinfo(server, mntfh, fattr);
+        if (error < 0)
+                goto out;
+        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+                server->namelen = NFS4_MAXNAMLEN;
+        spin_lock(&nfs_client_lock);
+        list_add_tail(&server->client_link, &server->nfs_client->cl_superblocks);
+        list_add_tail(&server->master_link, &nfs_volume_list);
+        spin_unlock(&nfs_client_lock);
+        server->mount_time = jiffies;
+out:
+        nfs_free_fattr(fattr);
+        return error;
+}
 /*
 * Create a version 4 volume record
 */
@@ -1293,7 +1351,8 @@ static int nfs4_init_server(struct nfs_server *server,
        /* Initialise the client representation from the mount data */
        server->flags = data->flags;
-        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR;
+        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR|
+                NFS_CAP_POSIX_LOCK;
        server->options = data->options;
        /* Get a client record */
@@ -1336,7 +1395,6 @@ error:
 struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
                                      struct nfs_fh *mntfh)
 {
-        struct nfs_fattr fattr;
        struct nfs_server *server;
        int error;
@@ -1351,39 +1409,10 @@ struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
        if (error < 0)
                goto error;
-        BUG_ON(!server->nfs_client);
+        error = nfs4_server_common_setup(server, mntfh);
-        BUG_ON(!server->nfs_client->rpc_ops);
-        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
-        error = nfs4_init_session(server);
-        if (error < 0)
-                goto error;
-        /* Probe the root fh to retrieve its FSID */
-        error = nfs4_path_walk(server, mntfh, data->nfs_server.export_path);
-        if (error < 0)
-                goto error;
-        dprintk("Server FSID: %llx:%llx\n",
-                (unsigned long long) server->fsid.major,
-                (unsigned long long) server->fsid.minor);
-        dprintk("Mount FH: %d\n", mntfh->size);
-        nfs4_session_set_rwsize(server);
-        error = nfs_probe_fsinfo(server, mntfh, &fattr);
        if (error < 0)
                goto error;
-        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
-                server->namelen = NFS4_MAXNAMLEN;
-        spin_lock(&nfs_client_lock);
-        list_add_tail(&server->client_link, &server->nfs_client->cl_superblocks);
-        list_add_tail(&server->master_link, &nfs_volume_list);
-        spin_unlock(&nfs_client_lock);
-        server->mount_time = jiffies;
        dprintk("<-- nfs4_create_server() = %p\n", server);
        return server;
@@ -1401,7 +1430,6 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
 {
        struct nfs_client *parent_client;
        struct nfs_server *server, *parent_server;
-        struct nfs_fattr fattr;
        int error;
        dprintk("--> nfs4_create_referral_server()\n");
@@ -1434,34 +1462,10 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
        if (error < 0)
                goto error;
-        BUG_ON(!server->nfs_client);
+        error = nfs4_server_common_setup(server, mntfh);
-        BUG_ON(!server->nfs_client->rpc_ops);
-        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
-        /* Probe the root fh to retrieve its FSID and filehandle */
-        error = nfs4_path_walk(server, mntfh, data->mnt_path);
        if (error < 0)
                goto error;
-        /* probe the filesystem info for this server filesystem */
-        error = nfs_probe_fsinfo(server, mntfh, &fattr);
-        if (error < 0)
-                goto error;
-        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
-                server->namelen = NFS4_MAXNAMLEN;
-        dprintk("Referral FSID: %llx:%llx\n",
-                (unsigned long long) server->fsid.major,
-                (unsigned long long) server->fsid.minor);
-        spin_lock(&nfs_client_lock);
-        list_add_tail(&server->client_link, &server->nfs_client->cl_superblocks);
-        list_add_tail(&server->master_link, &nfs_volume_list);
-        spin_unlock(&nfs_client_lock);
-        server->mount_time = jiffies;
        dprintk("<-- nfs_create_referral_server() = %p\n", server);
        return server;
@@ -1481,7 +1485,7 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
                                    struct nfs_fattr *fattr)
 {
        struct nfs_server *server;
-        struct nfs_fattr fattr_fsinfo;
+        struct nfs_fattr *fattr_fsinfo;
        int error;
        dprintk("--> nfs_clone_server(,%llx:%llx,)\n",
@@ -1492,6 +1496,11 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
        if (!server)
                return ERR_PTR(-ENOMEM);
+        error = -ENOMEM;
+        fattr_fsinfo = nfs_alloc_fattr();
+        if (fattr_fsinfo == NULL)
+                goto out_free_server;
        /* Copy data from the source */
        server->nfs_client = source->nfs_client;
        atomic_inc(&server->nfs_client->cl_count);
@@ -1508,7 +1517,7 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
                nfs_init_server_aclclient(server);
        /* probe the filesystem info for this server filesystem */
-        error = nfs_probe_fsinfo(server, fh, &fattr_fsinfo);
+        error = nfs_probe_fsinfo(server, fh, fattr_fsinfo);
        if (error < 0)
                goto out_free_server;
@@ -1530,10 +1539,12 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
        server->mount_time = jiffies;
+        nfs_free_fattr(fattr_fsinfo);
        dprintk("<-- nfs_clone_server() = %p\n", server);
        return server;
 out_free_server:
+        nfs_free_fattr(fattr_fsinfo);
        nfs_free_server(server);
        dprintk("<-- nfs_clone_server() = error %d\n", error);
        return ERR_PTR(error);
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 2563bebc4c67..301634543974 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -10,6 +10,7 @@
 #include <linux/kthread.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/spinlock.h>
@@ -23,6 +24,8 @@
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
+        if (delegation->cred)
+                put_rpccred(delegation->cred);
        kfree(delegation);
 }
@@ -35,13 +38,7 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
-        struct rpc_cred *cred;
-        cred = rcu_dereference(delegation->cred);
-        rcu_assign_pointer(delegation->cred, NULL);
        call_rcu(&delegation->rcu, nfs_free_delegation_callback);
-        if (cred)
-                put_rpccred(cred);
 }
 void nfs_mark_delegation_referenced(struct nfs_delegation *delegation)
@@ -128,21 +125,35 @@ again:
 */
 void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res)
 {
-        struct nfs_delegation *delegation = NFS_I(inode)->delegation;
+        struct nfs_delegation *delegation;
-        struct rpc_cred *oldcred;
+        struct rpc_cred *oldcred = NULL;
-        if (delegation == NULL)
+        rcu_read_lock();
-                return;
+        delegation = rcu_dereference(NFS_I(inode)->delegation);
-        memcpy(delegation->stateid.data, res->delegation.data,
+        if (delegation != NULL) {
-                        sizeof(delegation->stateid.data));
+                spin_lock(&delegation->lock);
-        delegation->type = res->delegation_type;
+                if (delegation->inode != NULL) {
-        delegation->maxsize = res->maxsize;
+                        memcpy(delegation->stateid.data, res->delegation.data,
-        oldcred = delegation->cred;
+                               sizeof(delegation->stateid.data));
-        delegation->cred = get_rpccred(cred);
+                        delegation->type = res->delegation_type;
-        clear_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags);
+                        delegation->maxsize = res->maxsize;
-        NFS_I(inode)->delegation_state = delegation->type;
+                        oldcred = delegation->cred;
-        smp_wmb();
+                        delegation->cred = get_rpccred(cred);
-        put_rpccred(oldcred);
+                        clear_bit(NFS_DELEGATION_NEED_RECLAIM,
+                                  &delegation->flags);
+                        NFS_I(inode)->delegation_state = delegation->type;
+                        spin_unlock(&delegation->lock);
+                        put_rpccred(oldcred);
+                        rcu_read_unlock();
+                } else {
+                        /* We appear to have raced with a delegation return. */
+                        spin_unlock(&delegation->lock);
+                        rcu_read_unlock();
+                        nfs_inode_set_delegation(inode, cred, res);
+                }
+        } else {
+                rcu_read_unlock();
+        }
 }
 static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *delegation, int issync)
@@ -165,9 +176,13 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
        return inode;
 }
-static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi, const nfs4_stateid *stateid)
+static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi,
+                                                           const nfs4_stateid *stateid,
+                                                           struct nfs_client *clp)
 {
-        struct nfs_delegation *delegation = rcu_dereference(nfsi->delegation);
+        struct nfs_delegation *delegation =
+                rcu_dereference_protected(nfsi->delegation,
+                                          lockdep_is_held(&clp->cl_lock));
        if (delegation == NULL)
                goto nomatch;
@@ -194,11 +209,11 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
 {
        struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
        struct nfs_inode *nfsi = NFS_I(inode);
-        struct nfs_delegation *delegation;
+        struct nfs_delegation *delegation, *old_delegation;
        struct nfs_delegation *freeme = NULL;
        int status = 0;
-        delegation = kmalloc(sizeof(*delegation), GFP_KERNEL);
+        delegation = kmalloc(sizeof(*delegation), GFP_NOFS);
        if (delegation == NULL)
                return -ENOMEM;
        memcpy(delegation->stateid.data, res->delegation.data,
@@ -212,10 +227,12 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
        spin_lock_init(&delegation->lock);
        spin_lock(&clp->cl_lock);
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        old_delegation = rcu_dereference_protected(nfsi->delegation,
-                if (memcmp(&delegation->stateid, &nfsi->delegation->stateid,
+                                                   lockdep_is_held(&clp->cl_lock));
-                                        sizeof(delegation->stateid)) == 0 &&
+        if (old_delegation != NULL) {
-                                delegation->type == nfsi->delegation->type) {
+                if (memcmp(&delegation->stateid, &old_delegation->stateid,
+                                        sizeof(old_delegation->stateid)) == 0 &&
+                                delegation->type == old_delegation->type) {
                        goto out;
                }
                /*
@@ -225,12 +242,12 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
                dfprintk(FILE, "%s: server %s handed out "
                                "a duplicate delegation!\n",
                                __func__, clp->cl_hostname);
-                if (delegation->type <= nfsi->delegation->type) {
+                if (delegation->type <= old_delegation->type) {
                        freeme = delegation;
                        delegation = NULL;
                        goto out;
                }
-                freeme = nfs_detach_delegation_locked(nfsi, NULL);
+                freeme = nfs_detach_delegation_locked(nfsi, NULL, clp);
        }
        list_add_rcu(&delegation->super_list, &clp->cl_delegations);
        nfsi->delegation_state = delegation->type;
@@ -300,7 +317,7 @@ restart:
                if (inode == NULL)
                        continue;
                spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL);
+                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL, clp);
                spin_unlock(&clp->cl_lock);
                rcu_read_unlock();
                if (delegation != NULL) {
@@ -329,9 +346,9 @@ void nfs_inode_return_delegation_noreclaim(struct inode *inode)
        struct nfs_inode *nfsi = NFS_I(inode);
        struct nfs_delegation *delegation;
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        if (rcu_access_pointer(nfsi->delegation) != NULL) {
                spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL, clp);
                spin_unlock(&clp->cl_lock);
                if (delegation != NULL)
                        nfs_do_return_delegation(inode, delegation, 0);
@@ -345,9 +362,9 @@ int nfs_inode_return_delegation(struct inode *inode)
        struct nfs_delegation *delegation;
        int err = 0;
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        if (rcu_access_pointer(nfsi->delegation) != NULL) {
                spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL, clp);
                spin_unlock(&clp->cl_lock);
                if (delegation != NULL) {
                        nfs_msync_inode(inode);
@@ -525,7 +542,7 @@ restart:
                if (inode == NULL)
                        continue;
                spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL);
+                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL, clp);
                spin_unlock(&clp->cl_lock);
                rcu_read_unlock();
                if (delegation != NULL)
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 944b627ec6e1..69e7b8140122 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -71,4 +71,10 @@ static inline int nfs_inode_return_delegation(struct inode *inode)
 }
 #endif
+static inline int nfs_have_delegated_attributes(struct inode *inode)
+{
+        return nfs_have_delegation(inode, FMODE_READ) &&
+                !(NFS_I(inode)->cache_validity & NFS_INO_REVAL_FORCED);
+}
 #endif
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 3c7f03b669fb..e60416d3f818 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -53,7 +53,7 @@ static int nfs_link(struct dentry *, struct inode *, struct dentry *);
 static int nfs_mknod(struct inode *, struct dentry *, int, dev_t);
 static int nfs_rename(struct inode *, struct dentry *,
                      struct inode *, struct dentry *);
-static int nfs_fsync_dir(struct file *, struct dentry *, int);
+static int nfs_fsync_dir(struct file *, int);
 static loff_t nfs_llseek_dir(struct file *, loff_t, int);
 const struct file_operations nfs_dir_operations = {
@@ -530,9 +530,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
        nfs_readdir_descriptor_t my_desc,
                        *desc = &my_desc;
        struct nfs_entry my_entry;
-        struct nfs_fh    fh;
+        int res = -ENOMEM;
-        struct nfs_fattr fattr;
-        long            res;
        dfprintk(FILE, "NFS: readdir(%s/%s) starting at cookie %llu\n",
                        dentry->d_parent->d_name.name, dentry->d_name.name,
@@ -554,13 +552,15 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
        my_entry.cookie = my_entry.prev_cookie = 0;
        my_entry.eof = 0;
-        my_entry.fh = &fh;
+        my_entry.fh = nfs_alloc_fhandle();
-        my_entry.fattr = &fattr;
+        my_entry.fattr = nfs_alloc_fattr();
-        nfs_fattr_init(&fattr);
+        if (my_entry.fh == NULL || my_entry.fattr == NULL)
+                goto out_alloc_failed;
        desc->entry = &my_entry;
        nfs_block_sillyrename(dentry);
-        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping(inode, filp->f_mapping);
        if (res < 0)
                goto out;
@@ -598,7 +598,10 @@ out:
        nfs_unblock_sillyrename(dentry);
        if (res > 0)
                res = 0;
-        dfprintk(FILE, "NFS: readdir(%s/%s) returns %ld\n",
+out_alloc_failed:
+        nfs_free_fattr(my_entry.fattr);
+        nfs_free_fhandle(my_entry.fh);
+        dfprintk(FILE, "NFS: readdir(%s/%s) returns %d\n",
                        dentry->d_parent->d_name.name, dentry->d_name.name,
                        res);
        return res;
@@ -638,8 +641,10 @@ out:
 * All directory operations under NFS are synchronous, so fsync()
 * is a dummy operation.
 */
-static int nfs_fsync_dir(struct file *filp, struct dentry *dentry, int datasync)
+static int nfs_fsync_dir(struct file *filp, int datasync)
 {
+        struct dentry *dentry = filp->f_path.dentry;
        dfprintk(FILE, "NFS: fsync dir(%s/%s) datasync %d\n",
                        dentry->d_parent->d_name.name, dentry->d_name.name,
                        datasync);
@@ -776,9 +781,9 @@ static int nfs_lookup_revalidate(struct dentry * dentry, struct nameidata *nd)
        struct inode *dir;
        struct inode *inode;
        struct dentry *parent;
+        struct nfs_fh *fhandle = NULL;
+        struct nfs_fattr *fattr = NULL;
        int error;
-        struct nfs_fh fhandle;
-        struct nfs_fattr fattr;
        parent = dget_parent(dentry);
        dir = parent->d_inode;
@@ -811,14 +816,22 @@ static int nfs_lookup_revalidate(struct dentry * dentry, struct nameidata *nd)
        if (NFS_STALE(inode))
                goto out_bad;
-        error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, &fhandle, &fattr);
+        error = -ENOMEM;
+        fhandle = nfs_alloc_fhandle();
+        fattr = nfs_alloc_fattr();
+        if (fhandle == NULL || fattr == NULL)
+                goto out_error;
+        error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr);
        if (error)
                goto out_bad;
-        if (nfs_compare_fh(NFS_FH(inode), &fhandle))
+        if (nfs_compare_fh(NFS_FH(inode), fhandle))
                goto out_bad;
-        if ((error = nfs_refresh_inode(inode, &fattr)) != 0)
+        if ((error = nfs_refresh_inode(inode, fattr)) != 0)
                goto out_bad;
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fhandle);
 out_set_verifier:
        nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
 out_valid:
@@ -837,14 +850,26 @@ out_zap_parent:
                /* If we have submounts, don't unhash ! */
                if (have_submounts(dentry))
                        goto out_valid;
+                if (dentry->d_flags & DCACHE_DISCONNECTED)
+                        goto out_valid;
                shrink_dcache_parent(dentry);
        }
        d_drop(dentry);
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fhandle);
        dput(parent);
        dfprintk(LOOKUPCACHE, "NFS: %s(%s/%s) is invalid\n",
                        __func__, dentry->d_parent->d_name.name,
                        dentry->d_name.name);
        return 0;
+out_error:
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fhandle);
+        dput(parent);
+        dfprintk(LOOKUPCACHE, "NFS: %s(%s/%s) lookup returned error %d\n",
+                        __func__, dentry->d_parent->d_name.name,
+                        dentry->d_name.name, error);
+        return error;
 }
 /*
@@ -909,9 +934,9 @@ static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, stru
        struct dentry *res;
        struct dentry *parent;
        struct inode *inode = NULL;
+        struct nfs_fh *fhandle = NULL;
+        struct nfs_fattr *fattr = NULL;
        int error;
-        struct nfs_fh fhandle;
-        struct nfs_fattr fattr;
        dfprintk(VFS, "NFS: lookup(%s/%s)\n",
                dentry->d_parent->d_name.name, dentry->d_name.name);
@@ -921,7 +946,6 @@ static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, stru
        if (dentry->d_name.len > NFS_SERVER(dir)->namelen)
                goto out;
-        res = ERR_PTR(-ENOMEM);
        dentry->d_op = NFS_PROTO(dir)->dentry_ops;
        /*
@@ -934,17 +958,23 @@ static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, stru
                goto out;
        }
+        res = ERR_PTR(-ENOMEM);
+        fhandle = nfs_alloc_fhandle();
+        fattr = nfs_alloc_fattr();
+        if (fhandle == NULL || fattr == NULL)
+                goto out;
        parent = dentry->d_parent;
        /* Protect against concurrent sillydeletes */
        nfs_block_sillyrename(parent);
-        error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, &fhandle, &fattr);
+        error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr);
        if (error == -ENOENT)
                goto no_entry;
        if (error < 0) {
                res = ERR_PTR(error);
                goto out_unblock_sillyrename;
        }
-        inode = nfs_fhget(dentry->d_sb, &fhandle, &fattr);
+        inode = nfs_fhget(dentry->d_sb, fhandle, fattr);
        res = (struct dentry *)inode;
        if (IS_ERR(res))
                goto out_unblock_sillyrename;
@@ -960,6 +990,8 @@ no_entry:
 out_unblock_sillyrename:
        nfs_unblock_sillyrename(parent);
 out:
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fhandle);
        return res;
 }
@@ -1025,12 +1057,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                res = NULL;
                                goto out;
                        /* This turned out not to be a regular file */
+                        case -EISDIR:
                        case -ENOTDIR:
                                goto no_open;
                        case -ELOOP:
                                if (!(nd->intent.open.flags & O_NOFOLLOW))
                                        goto no_open;
-                        /* case -EISDIR: */
                        /* case -EINVAL: */
                        default:
                                goto out;
@@ -1050,7 +1082,7 @@ static int nfs_open_revalidate(struct dentry *dentry, struct nameidata *nd)
        struct inode *dir;
        int openflags, ret = 0;
-        if (!is_atomic_open(nd))
+        if (!is_atomic_open(nd) || d_mountpoint(dentry))
                goto no_open;
        parent = dget_parent(dentry);
        dir = parent->d_inode;
@@ -1667,28 +1699,33 @@ static void nfs_access_free_entry(struct nfs_access_entry *entry)
        smp_mb__after_atomic_dec();
 }
-int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask)
+static void nfs_access_free_list(struct list_head *head)
+{
+        struct nfs_access_entry *cache;
+        while (!list_empty(head)) {
+                cache = list_entry(head->next, struct nfs_access_entry, lru);
+                list_del(&cache->lru);
+                nfs_access_free_entry(cache);
+        }
+}
+int nfs_access_cache_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
 {
        LIST_HEAD(head);
        struct nfs_inode *nfsi;
        struct nfs_access_entry *cache;
-restart:
+        if ((gfp_mask & GFP_KERNEL) != GFP_KERNEL)
+                return (nr_to_scan == 0) ? 0 : -1;
        spin_lock(&nfs_access_lru_lock);
        list_for_each_entry(nfsi, &nfs_access_lru_list, access_cache_inode_lru) {
-                struct rw_semaphore *s_umount;
                struct inode *inode;
                if (nr_to_scan-- == 0)
                        break;
-                s_umount = &nfsi->vfs_inode.i_sb->s_umount;
+                inode = &nfsi->vfs_inode;
-                if (!down_read_trylock(s_umount))
-                        continue;
-                inode = igrab(&nfsi->vfs_inode);
-                if (inode == NULL) {
-                        up_read(s_umount);
-                        continue;
-                }
                spin_lock(&inode->i_lock);
                if (list_empty(&nfsi->access_cache_entry_lru))
                        goto remove_lru_entry;
@@ -1702,61 +1739,48 @@ restart:
                else {
 remove_lru_entry:
                        list_del_init(&nfsi->access_cache_inode_lru);
+                        smp_mb__before_clear_bit();
                        clear_bit(NFS_INO_ACL_LRU_SET, &nfsi->flags);
+                        smp_mb__after_clear_bit();
                }
                spin_unlock(&inode->i_lock);
-                spin_unlock(&nfs_access_lru_lock);
-                iput(inode);
-                up_read(s_umount);
-                goto restart;
        }
        spin_unlock(&nfs_access_lru_lock);
-        while (!list_empty(&head)) {
+        nfs_access_free_list(&head);
-                cache = list_entry(head.next, struct nfs_access_entry, lru);
-                list_del(&cache->lru);
-                nfs_access_free_entry(cache);
-        }
        return (atomic_long_read(&nfs_access_nr_entries) / 100) * sysctl_vfs_cache_pressure;
 }
-static void __nfs_access_zap_cache(struct inode *inode)
+static void __nfs_access_zap_cache(struct nfs_inode *nfsi, struct list_head *head)
 {
-        struct nfs_inode *nfsi = NFS_I(inode);
        struct rb_root *root_node = &nfsi->access_cache;
-        struct rb_node *n, *dispose = NULL;
+        struct rb_node *n;
        struct nfs_access_entry *entry;
        /* Unhook entries from the cache */
        while ((n = rb_first(root_node)) != NULL) {
                entry = rb_entry(n, struct nfs_access_entry, rb_node);
                rb_erase(n, root_node);
-                list_del(&entry->lru);
+                list_move(&entry->lru, head);
-                n->rb_left = dispose;
-                dispose = n;
        }
        nfsi->cache_validity &= ~NFS_INO_INVALID_ACCESS;
-        spin_unlock(&inode->i_lock);
-        /* Now kill them all! */
-        while (dispose != NULL) {
-                n = dispose;
-                dispose = n->rb_left;
-                nfs_access_free_entry(rb_entry(n, struct nfs_access_entry, rb_node));
-        }
 }
 void nfs_access_zap_cache(struct inode *inode)
 {
+        LIST_HEAD(head);
+        if (test_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags) == 0)
+                return;
        /* Remove from global LRU init */
-        if (test_and_clear_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags)) {
+        spin_lock(&nfs_access_lru_lock);
-                spin_lock(&nfs_access_lru_lock);
+        if (test_and_clear_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags))
                list_del_init(&NFS_I(inode)->access_cache_inode_lru);
-                spin_unlock(&nfs_access_lru_lock);
-        }
        spin_lock(&inode->i_lock);
-        /* This will release the spinlock */
+        __nfs_access_zap_cache(NFS_I(inode), &head);
-        __nfs_access_zap_cache(inode);
+        spin_unlock(&inode->i_lock);
+        spin_unlock(&nfs_access_lru_lock);
+        nfs_access_free_list(&head);
 }
 static struct nfs_access_entry *nfs_access_search_rbtree(struct inode *inode, struct rpc_cred *cred)
@@ -1789,7 +1813,7 @@ static int nfs_access_get_cached(struct inode *inode, struct rpc_cred *cred, str
        cache = nfs_access_search_rbtree(inode, cred);
        if (cache == NULL)
                goto out;
-        if (!nfs_have_delegation(inode, FMODE_READ) &&
+        if (!nfs_have_delegated_attributes(inode) &&
            !time_in_range_open(jiffies, cache->jiffies, cache->jiffies + nfsi->attrtimeo))
                goto out_stale;
        res->jiffies = cache->jiffies;
@@ -1807,8 +1831,8 @@ out_stale:
        nfs_access_free_entry(cache);
        return -ENOENT;
 out_zap:
-        /* This will release the spinlock */
+        spin_unlock(&inode->i_lock);
-        __nfs_access_zap_cache(inode);
+        nfs_access_zap_cache(inode);
        return -ENOENT;
 }
@@ -1863,9 +1887,11 @@ static void nfs_access_add_cache(struct inode *inode, struct nfs_access_entry *s
        smp_mb__after_atomic_inc();
        /* Add inode to global LRU list */
-        if (!test_and_set_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags)) {
+        if (!test_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags)) {
                spin_lock(&nfs_access_lru_lock);
-                list_add_tail(&NFS_I(inode)->access_cache_inode_lru, &nfs_access_lru_list);
+                if (!test_and_set_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags))
+                        list_add_tail(&NFS_I(inode)->access_cache_inode_lru,
+                                        &nfs_access_lru_list);
                spin_unlock(&nfs_access_lru_lock);
        }
 }
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index e1d415e97849..ad4cd31d6050 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -44,6 +44,7 @@
 #include <linux/file.h>
 #include <linux/pagemap.h>
 #include <linux/kref.h>
+#include <linux/slab.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
@@ -342,6 +343,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                data->res.fattr = &data->fattr;
                data->res.eof = 0;
                data->res.count = bytes;
+                nfs_fattr_init(&data->fattr);
                msg.rpc_argp = &data->args;
                msg.rpc_resp = &data->res;
@@ -575,6 +577,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
        data->res.count = 0;
        data->res.fattr = &data->fattr;
        data->res.verf = &data->verf;
+        nfs_fattr_init(&data->fattr);
        NFS_PROTO(data->inode)->commit_setup(data, &msg);
@@ -766,6 +769,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                data->res.fattr = &data->fattr;
                data->res.count = bytes;
                data->res.verf = &data->verf;
+                nfs_fattr_init(&data->fattr);
                task_setup_data.task = &data->task;
                task_setup_data.callback_data = data;
diff --git a/fs/nfs/dns_resolve.c b/fs/nfs/dns_resolve.c
index 95e1ca765d47..76fd235d0024 100644
--- a/fs/nfs/dns_resolve.c
+++ b/fs/nfs/dns_resolve.c
@@ -9,6 +9,7 @@
 #include <linux/hash.h>
 #include <linux/string.h>
 #include <linux/kmod.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/socket.h>
 #include <linux/seq_file.h>
@@ -36,6 +37,19 @@ struct nfs_dns_ent {
 };
+static void nfs_dns_ent_update(struct cache_head *cnew,
+                struct cache_head *ckey)
+{
+        struct nfs_dns_ent *new;
+        struct nfs_dns_ent *key;
+        new = container_of(cnew, struct nfs_dns_ent, h);
+        key = container_of(ckey, struct nfs_dns_ent, h);
+        memcpy(&new->addr, &key->addr, key->addrlen);
+        new->addrlen = key->addrlen;
+}
 static void nfs_dns_ent_init(struct cache_head *cnew,
                struct cache_head *ckey)
 {
@@ -49,8 +63,7 @@ static void nfs_dns_ent_init(struct cache_head *cnew,
        new->hostname = kstrndup(key->hostname, key->namelen, GFP_KERNEL);
        if (new->hostname) {
                new->namelen = key->namelen;
-                memcpy(&new->addr, &key->addr, key->addrlen);
+                nfs_dns_ent_update(cnew, ckey);
-                new->addrlen = key->addrlen;
        } else {
                new->namelen = 0;
                new->addrlen = 0;
@@ -234,7 +247,7 @@ static struct cache_detail nfs_dns_resolve = {
        .cache_show = nfs_dns_show,
        .match = nfs_dns_match,
        .init = nfs_dns_ent_init,
-        .update = nfs_dns_ent_init,
+        .update = nfs_dns_ent_update,
        .alloc = nfs_dns_ent_alloc,
 };
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 6b891328f332..f036153d9f50 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -24,9 +24,10 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/aio.h>
+#include <linux/gfp.h>
+#include <linux/swap.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -53,7 +54,7 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
 static ssize_t nfs_file_write(struct kiocb *, const struct iovec *iov,
                                unsigned long nr_segs, loff_t pos);
 static int  nfs_file_flush(struct file *, fl_owner_t id);
-static int  nfs_file_fsync(struct file *, struct dentry *dentry, int datasync);
+static int  nfs_file_fsync(struct file *, int datasync);
 static int nfs_check_flags(int flags);
 static int nfs_lock(struct file *filp, int cmd, struct file_lock *fl);
 static int nfs_flock(struct file *filp, int cmd, struct file_lock *fl);
@@ -123,11 +124,11 @@ nfs_file_open(struct inode *inode, struct file *filp)
                        filp->f_path.dentry->d_parent->d_name.name,
                        filp->f_path.dentry->d_name.name);
+        nfs_inc_stats(inode, NFSIOS_VFSOPEN);
        res = nfs_check_flags(filp->f_flags);
        if (res)
                return res;
-        nfs_inc_stats(inode, NFSIOS_VFSOPEN);
        res = nfs_open(inode, filp);
        return res;
 }
@@ -161,14 +162,17 @@ static int nfs_revalidate_file_size(struct inode *inode, struct file *filp)
        struct nfs_server *server = NFS_SERVER(inode);
        struct nfs_inode *nfsi = NFS_I(inode);
-        if (server->flags & NFS_MOUNT_NOAC)
+        if (nfs_have_delegated_attributes(inode))
-                goto force_reval;
+                goto out_noreval;
        if (filp->f_flags & O_DIRECT)
                goto force_reval;
-        if (nfsi->npages != 0)
+        if (nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                return 0;
+                goto force_reval;
-        if (!(nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE) && !nfs_attribute_timeout(inode))
+        if (nfs_attribute_timeout(inode))
-                return 0;
+                goto force_reval;
+out_noreval:
+        return 0;
 force_reval:
        return __nfs_revalidate_inode(server, inode);
 }
@@ -237,9 +241,9 @@ nfs_file_flush(struct file *file, fl_owner_t id)
                        dentry->d_parent->d_name.name,
                        dentry->d_name.name);
+        nfs_inc_stats(inode, NFSIOS_VFSFLUSH);
        if ((file->f_mode & FMODE_WRITE) == 0)
                return 0;
-        nfs_inc_stats(inode, NFSIOS_VFSFLUSH);
        /* Flush writes to the server and return any errors */
        return nfs_do_fsync(ctx, inode);
@@ -262,9 +266,11 @@ nfs_file_read(struct kiocb *iocb, const struct iovec *iov,
                (unsigned long) count, (unsigned long) pos);
        result = nfs_revalidate_mapping(inode, iocb->ki_filp->f_mapping);
-        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, count);
+        if (!result) {
-        if (!result)
                result = generic_file_aio_read(iocb, iov, nr_segs, pos);
+                if (result > 0)
+                        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, result);
+        }
        return result;
 }
@@ -282,8 +288,11 @@ nfs_file_splice_read(struct file *filp, loff_t *ppos,
                (unsigned long) count, (unsigned long long) *ppos);
        res = nfs_revalidate_mapping(inode, filp->f_mapping);
-        if (!res)
+        if (!res) {
                res = generic_file_splice_read(filp, ppos, pipe, count, flags);
+                if (res > 0)
+                        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, res);
+        }
        return res;
 }
@@ -314,8 +323,9 @@ nfs_file_mmap(struct file * file, struct vm_area_struct * vma)
 * whether any write errors occurred for this process.
 */
 static int
-nfs_file_fsync(struct file *file, struct dentry *dentry, int datasync)
+nfs_file_fsync(struct file *file, int datasync)
 {
+        struct dentry *dentry = file->f_path.dentry;
        struct nfs_open_context *ctx = nfs_file_open_context(file);
        struct inode *inode = dentry->d_inode;
@@ -484,8 +494,19 @@ static void nfs_invalidate_page(struct page *page, unsigned long offset)
 */
 static int nfs_release_page(struct page *page, gfp_t gfp)
 {
+        struct address_space *mapping = page->mapping;
        dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
+        /* Only do I/O if gfp is a superset of GFP_KERNEL */
+        if (mapping && (gfp & GFP_KERNEL) == GFP_KERNEL) {
+                int how = FLUSH_SYNC;
+                /* Don't let kswapd deadlock waiting for OOM RPC calls */
+                if (current_is_kswapd())
+                        how = 0;
+                nfs_commit_inode(mapping->host, how);
+        }
        /* If PagePrivate() is set, then the page is not freeable */
        if (PagePrivate(page))
                return 0;
@@ -594,6 +615,7 @@ static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
 {
        struct dentry * dentry = iocb->ki_filp->f_path.dentry;
        struct inode * inode = dentry->d_inode;
+        unsigned long written = 0;
        ssize_t result;
        size_t count = iov_length(iov, nr_segs);
@@ -620,14 +642,18 @@ static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
        if (!count)
                goto out;
-        nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, count);
        result = generic_file_aio_write(iocb, iov, nr_segs, pos);
+        if (result > 0)
+                written = result;
        /* Return error values for O_DSYNC and IS_SYNC() */
        if (result >= 0 && nfs_need_sync_write(iocb->ki_filp, inode)) {
                int err = nfs_do_fsync(nfs_file_open_context(iocb->ki_filp), inode);
                if (err < 0)
                        result = err;
        }
+        if (result > 0)
+                nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
 out:
        return result;
@@ -642,6 +668,7 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
 {
        struct dentry *dentry = filp->f_path.dentry;
        struct inode *inode = dentry->d_inode;
+        unsigned long written = 0;
        ssize_t ret;
        dprintk("NFS splice_write(%s/%s, %lu@%llu)\n",
@@ -652,14 +679,17 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
         * The combination of splice and an O_APPEND destination is disallowed.
         */
-        nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, count);
        ret = generic_file_splice_write(pipe, filp, ppos, count, flags);
+        if (ret > 0)
+                written = ret;
        if (ret >= 0 && nfs_need_sync_write(filp, inode)) {
                int err = nfs_do_fsync(nfs_file_open_context(filp), inode);
                if (err < 0)
                        ret = err;
        }
+        if (ret > 0)
+                nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
        return ret;
 }
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index fa588006588d..ce153a6b3aec 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -17,6 +17,7 @@
 #include <linux/nfs_fs_sb.h>
 #include <linux/in6.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include "internal.h"
 #include "iostat.h"
@@ -354,12 +355,11 @@ void nfs_fscache_reset_inode_cookie(struct inode *inode)
 */
 int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 {
-        struct nfs_inode *nfsi = NFS_I(page->mapping->host);
-        struct fscache_cookie *cookie = nfsi->fscache;
-        BUG_ON(!cookie);
        if (PageFsCache(page)) {
+                struct nfs_inode *nfsi = NFS_I(page->mapping->host);
+                struct fscache_cookie *cookie = nfsi->fscache;
+                BUG_ON(!cookie);
                dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                         cookie, page, nfsi);
@@ -467,7 +467,8 @@ int __nfs_readpages_from_fscache(struct nfs_open_context *ctx,
                                 struct list_head *pages,
                                 unsigned *nr_pages)
 {
-        int ret, npages = *nr_pages;
+        unsigned npages = *nr_pages;
+        int ret;
        dfprintk(FSCACHE, "NFS: nfs_getpages_from_fscache (0x%p/%u/0x%p)\n",
                 NFS_I(inode)->fscache, npages, inode);
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index b35d2a616066..a70e446e1605 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -78,159 +78,94 @@ struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh)
 {
        struct nfs_server *server = NFS_SB(sb);
        struct nfs_fsinfo fsinfo;
-        struct nfs_fattr fattr;
+        struct dentry *ret;
-        struct dentry *mntroot;
        struct inode *inode;
        int error;
        /* get the actual root for this mount */
-        fsinfo.fattr = &fattr;
+        fsinfo.fattr = nfs_alloc_fattr();
+        if (fsinfo.fattr == NULL)
+                return ERR_PTR(-ENOMEM);
        error = server->nfs_client->rpc_ops->getroot(server, mntfh, &fsinfo);
        if (error < 0) {
                dprintk("nfs_get_root: getattr error = %d\n", -error);
-                return ERR_PTR(error);
+                ret = ERR_PTR(error);
+                goto out;
        }
        inode = nfs_fhget(sb, mntfh, fsinfo.fattr);
        if (IS_ERR(inode)) {
                dprintk("nfs_get_root: get root inode failed\n");
-                return ERR_CAST(inode);
+                ret = ERR_CAST(inode);
+                goto out;
        }
        error = nfs_superblock_set_dummy_root(sb, inode);
-        if (error != 0)
+        if (error != 0) {
-                return ERR_PTR(error);
+                ret = ERR_PTR(error);
+                goto out;
+        }
        /* root dentries normally start off anonymous and get spliced in later
         * if the dentry tree reaches them; however if the dentry already
         * exists, we'll pick it up at this point and use it as the root
         */
-        mntroot = d_obtain_alias(inode);
+        ret = d_obtain_alias(inode);
-        if (IS_ERR(mntroot)) {
+        if (IS_ERR(ret)) {
                dprintk("nfs_get_root: get root dentry failed\n");
-                return mntroot;
+                goto out;
        }
-        security_d_instantiate(mntroot, inode);
+        security_d_instantiate(ret, inode);
-        if (!mntroot->d_op)
-                mntroot->d_op = server->nfs_client->rpc_ops->dentry_ops;
-        return mntroot;
+        if (ret->d_op == NULL)
+                ret->d_op = server->nfs_client->rpc_ops->dentry_ops;
+out:
+        nfs_free_fattr(fsinfo.fattr);
+        return ret;
 }
 #ifdef CONFIG_NFS_V4
-/*
+int nfs4_get_rootfh(struct nfs_server *server, struct nfs_fh *mntfh)
- * Do a simple pathwalk from the root FH of the server to the nominated target
- * of the mountpoint
- * - give error on symlinks
- * - give error on ".." occurring in the path
- * - follow traversals
- */
-int nfs4_path_walk(struct nfs_server *server,
-                   struct nfs_fh *mntfh,
-                   const char *path)
 {
        struct nfs_fsinfo fsinfo;
-        struct nfs_fattr fattr;
+        int ret = -ENOMEM;
-        struct nfs_fh lastfh;
-        struct qstr name;
-        int ret;
-        dprintk("--> nfs4_path_walk(,,%s)\n", path);
+        dprintk("--> nfs4_get_rootfh()\n");
-        fsinfo.fattr = &fattr;
+        fsinfo.fattr = nfs_alloc_fattr();
-        nfs_fattr_init(&fattr);
+        if (fsinfo.fattr == NULL)
+                goto out;
-        /* Eat leading slashes */
-        while (*path == '/')
-                path++;
        /* Start by getting the root filehandle from the server */
        ret = server->nfs_client->rpc_ops->getroot(server, mntfh, &fsinfo);
        if (ret < 0) {
-                dprintk("nfs4_get_root: getroot error = %d\n", -ret);
+                dprintk("nfs4_get_rootfh: getroot error = %d\n", -ret);
-                return ret;
+                goto out;
        }
-        if (!S_ISDIR(fattr.mode)) {
+        if (!(fsinfo.fattr->valid & NFS_ATTR_FATTR_TYPE)
-                printk(KERN_ERR "nfs4_get_root:"
+                        || !S_ISDIR(fsinfo.fattr->mode)) {
+                printk(KERN_ERR "nfs4_get_rootfh:"
                       " getroot encountered non-directory\n");
-                return -ENOTDIR;
+                ret = -ENOTDIR;
+                goto out;
        }
-        /* FIXME: It is quite valid for the server to return a referral here */
+        if (fsinfo.fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL) {
-        if (fattr.valid & NFS_ATTR_FATTR_V4_REFERRAL) {
+                printk(KERN_ERR "nfs4_get_rootfh:"
-                printk(KERN_ERR "nfs4_get_root:"
                       " getroot obtained referral\n");
-                return -EREMOTE;
+                ret = -EREMOTE;
-        }
+                goto out;
-next_component:
-        dprintk("Next: %s\n", path);
-        /* extract the next bit of the path */
-        if (!*path)
-                goto path_walk_complete;
-        name.name = path;
-        while (*path && *path != '/')
-                path++;
-        name.len = path - (const char *) name.name;
-        if (name.len > NFS4_MAXNAMLEN)
-                return -ENAMETOOLONG;
-eat_dot_dir:
-        while (*path == '/')
-                path++;
-        if (path[0] == '.' && (path[1] == '/' || !path[1])) {
-                path += 2;
-                goto eat_dot_dir;
-        }
-        /* FIXME: Why shouldn't the user be able to use ".." in the path? */
-        if (path[0] == '.' && path[1] == '.' && (path[2] == '/' || !path[2])
-            ) {
-                printk(KERN_ERR "nfs4_get_root:"
-                       " Mount path contains reference to \"..\"\n");
-                return -EINVAL;
        }
-        /* lookup the next FH in the sequence */
+        memcpy(&server->fsid, &fsinfo.fattr->fsid, sizeof(server->fsid));
-        memcpy(&lastfh, mntfh, sizeof(lastfh));
+out:
+        nfs_free_fattr(fsinfo.fattr);
-        dprintk("LookupFH: %*.*s [%s]\n", name.len, name.len, name.name, path);
+        dprintk("<-- nfs4_get_rootfh() = %d\n", ret);
+        return ret;
-        ret = server->nfs_client->rpc_ops->lookupfh(server, &lastfh, &name,
-                                                    mntfh, &fattr);
-        if (ret < 0) {
-                dprintk("nfs4_get_root: getroot error = %d\n", -ret);
-                return ret;
-        }
-        if (!S_ISDIR(fattr.mode)) {
-                printk(KERN_ERR "nfs4_get_root:"
-                       " lookupfh encountered non-directory\n");
-                return -ENOTDIR;
-        }
-        /* FIXME: Referrals are quite valid here too */
-        if (fattr.valid & NFS_ATTR_FATTR_V4_REFERRAL) {
-                printk(KERN_ERR "nfs4_get_root:"
-                       " lookupfh obtained referral\n");
-                return -EREMOTE;
-        }
-        goto next_component;
-path_walk_complete:
-        memcpy(&server->fsid, &fattr.fsid, sizeof(server->fsid));
-        dprintk("<-- nfs4_path_walk() = 0\n");
-        return 0;
 }
 /*
@@ -239,8 +174,8 @@ path_walk_complete:
 struct dentry *nfs4_get_root(struct super_block *sb, struct nfs_fh *mntfh)
 {
        struct nfs_server *server = NFS_SB(sb);
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr = NULL;
-        struct dentry *mntroot;
+        struct dentry *ret;
        struct inode *inode;
        int error;
@@ -254,40 +189,50 @@ struct dentry *nfs4_get_root(struct super_block *sb, struct nfs_fh *mntfh)
                return ERR_PTR(error);
        }
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                return ERR_PTR(-ENOMEM);;
        /* get the actual root for this mount */
-        error = server->nfs_client->rpc_ops->getattr(server, mntfh, &fattr);
+        error = server->nfs_client->rpc_ops->getattr(server, mntfh, fattr);
        if (error < 0) {
                dprintk("nfs_get_root: getattr error = %d\n", -error);
-                return ERR_PTR(error);
+                ret = ERR_PTR(error);
+                goto out;
        }
-        inode = nfs_fhget(sb, mntfh, &fattr);
+        inode = nfs_fhget(sb, mntfh, fattr);
        if (IS_ERR(inode)) {
                dprintk("nfs_get_root: get root inode failed\n");
-                return ERR_CAST(inode);
+                ret = ERR_CAST(inode);
+                goto out;
        }
        error = nfs_superblock_set_dummy_root(sb, inode);
-        if (error != 0)
+        if (error != 0) {
-                return ERR_PTR(error);
+                ret = ERR_PTR(error);
+                goto out;
+        }
        /* root dentries normally start off anonymous and get spliced in later
         * if the dentry tree reaches them; however if the dentry already
         * exists, we'll pick it up at this point and use it as the root
         */
-        mntroot = d_obtain_alias(inode);
+        ret = d_obtain_alias(inode);
-        if (IS_ERR(mntroot)) {
+        if (IS_ERR(ret)) {
                dprintk("nfs_get_root: get root dentry failed\n");
-                return mntroot;
+                goto out;
        }
-        security_d_instantiate(mntroot, inode);
+        security_d_instantiate(ret, inode);
-        if (!mntroot->d_op)
+        if (ret->d_op == NULL)
-                mntroot->d_op = server->nfs_client->rpc_ops->dentry_ops;
+                ret->d_op = server->nfs_client->rpc_ops->dentry_ops;
+out:
+        nfs_free_fattr(fattr);
        dprintk("<-- nfs4_get_root()\n");
-        return mntroot;
+        return ret;
 }
 #endif /* CONFIG_NFS_V4 */
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index faa091865ad0..099b3518feea 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -36,6 +36,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/nfs_xdr.h>
+#include <linux/slab.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -97,22 +98,6 @@ u64 nfs_compat_user_ino64(u64 fileid)
        return ino;
 }
-int nfs_write_inode(struct inode *inode, int sync)
-{
-        int ret;
-        if (sync) {
-                ret = filemap_fdatawait(inode->i_mapping);
-                if (ret == 0)
-                        ret = nfs_commit_inode(inode, FLUSH_SYNC);
-        } else
-                ret = nfs_commit_inode(inode, 0);
-        if (ret >= 0)
-                return 0;
-        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        return ret;
-}
 void nfs_clear_inode(struct inode *inode)
 {
        /*
@@ -130,16 +115,12 @@ void nfs_clear_inode(struct inode *inode)
 */
 int nfs_sync_mapping(struct address_space *mapping)
 {
-        int ret;
+        int ret = 0;
-        if (mapping->nrpages == 0)
+        if (mapping->nrpages != 0) {
-                return 0;
+                unmap_mapping_range(mapping, 0, 0, 0);
-        unmap_mapping_range(mapping, 0, 0, 0);
+                ret = nfs_wb_all(mapping->host);
-        ret = filemap_write_and_wait(mapping);
+        }
-        if (ret != 0)
-                goto out;
-        ret = nfs_wb_all(mapping->host);
-out:
        return ret;
 }
@@ -412,8 +393,8 @@ int
 nfs_setattr(struct dentry *dentry, struct iattr *attr)
 {
        struct inode *inode = dentry->d_inode;
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr;
-        int error;
+        int error = -ENOMEM;
        nfs_inc_stats(inode, NFSIOS_VFSSETATTR);
@@ -436,14 +417,20 @@ nfs_setattr(struct dentry *dentry, struct iattr *attr)
                filemap_write_and_wait(inode->i_mapping);
                nfs_wb_all(inode);
        }
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                goto out;
        /*
         * Return any delegations if we're going to change ACLs
         */
        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0)
                nfs_inode_return_delegation(inode);
-        error = NFS_PROTO(inode)->setattr(dentry, &fattr, attr);
+        error = NFS_PROTO(inode)->setattr(dentry, fattr, attr);
        if (error == 0)
-                nfs_refresh_inode(inode, &fattr);
+                nfs_refresh_inode(inode, fattr);
+        nfs_free_fattr(fattr);
+out:
        return error;
 }
@@ -511,17 +498,11 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
        int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
        int err;
-        /*
+        /* Flush out writes to the server in order to update c/mtime.  */
-         * Flush out writes to the server in order to update c/mtime.
-         *
-         * Hold the i_mutex to suspend application writes temporarily;
-         * this prevents long-running writing applications from blocking
-         * nfs_wb_nocommit.
-         */
        if (S_ISREG(inode->i_mode)) {
-                mutex_lock(&inode->i_mutex);
+                err = filemap_write_and_wait(inode->i_mapping);
-                nfs_wb_nocommit(inode);
+                if (err)
-                mutex_unlock(&inode->i_mutex);
+                        goto out;
        }
        /*
@@ -545,6 +526,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
                generic_fillattr(inode, stat);
                stat->ino = nfs_compat_user_ino64(NFS_FILEID(inode));
        }
+out:
        return err;
 }
@@ -574,14 +556,14 @@ void nfs_close_context(struct nfs_open_context *ctx, int is_sync)
        nfs_revalidate_inode(server, inode);
 }
-static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, struct dentry *dentry, struct rpc_cred *cred)
+static struct nfs_open_context *alloc_nfs_open_context(struct path *path, struct rpc_cred *cred)
 {
        struct nfs_open_context *ctx;
        ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
        if (ctx != NULL) {
-                ctx->path.dentry = dget(dentry);
+                ctx->path = *path;
-                ctx->path.mnt = mntget(mnt);
+                path_get(&ctx->path);
                ctx->cred = get_rpccred(cred);
                ctx->state = NULL;
                ctx->lockowner = current->files;
@@ -620,11 +602,6 @@ void put_nfs_open_context(struct nfs_open_context *ctx)
        __put_nfs_open_context(ctx, 0);
 }
-static void put_nfs_open_context_sync(struct nfs_open_context *ctx)
-{
-        __put_nfs_open_context(ctx, 1);
-}
 /*
 * Ensure that mmap has a recent RPC credential for use when writing out
 * shared pages
@@ -652,10 +629,10 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c
        list_for_each_entry(pos, &nfsi->open_files, list) {
                if (cred != NULL && pos->cred != cred)
                        continue;
-                if ((pos->mode & mode) == mode) {
+                if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode)
-                        ctx = get_nfs_open_context(pos);
+                        continue;
-                        break;
+                ctx = get_nfs_open_context(pos);
-                }
+                break;
        }
        spin_unlock(&inode->i_lock);
        return ctx;
@@ -671,7 +648,7 @@ static void nfs_file_clear_open_context(struct file *filp)
                spin_lock(&inode->i_lock);
                list_move_tail(&ctx->list, &NFS_I(inode)->open_files);
                spin_unlock(&inode->i_lock);
-                put_nfs_open_context_sync(ctx);
+                __put_nfs_open_context(ctx, filp->f_flags & O_DIRECT ? 0 : 1);
        }
 }
@@ -686,7 +663,7 @@ int nfs_open(struct inode *inode, struct file *filp)
        cred = rpc_lookup_cred();
        if (IS_ERR(cred))
                return PTR_ERR(cred);
-        ctx = alloc_nfs_open_context(filp->f_path.mnt, filp->f_path.dentry, cred);
+        ctx = alloc_nfs_open_context(&filp->f_path, cred);
        put_rpccred(cred);
        if (ctx == NULL)
                return -ENOMEM;
@@ -711,7 +688,7 @@ int
 __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
 {
        int              status = -ESTALE;
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr = NULL;
        struct nfs_inode *nfsi = NFS_I(inode);
        dfprintk(PAGECACHE, "NFS: revalidating (%s/%Ld)\n",
@@ -722,8 +699,13 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
        if (NFS_STALE(inode))
                goto out;
+        status = -ENOMEM;
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                goto out;
        nfs_inc_stats(inode, NFSIOS_INODEREVALIDATE);
-        status = NFS_PROTO(inode)->getattr(server, NFS_FH(inode), &fattr);
+        status = NFS_PROTO(inode)->getattr(server, NFS_FH(inode), fattr);
        if (status != 0) {
                dfprintk(PAGECACHE, "nfs_revalidate_inode: (%s/%Ld) getattr failed, error=%d\n",
                         inode->i_sb->s_id,
@@ -736,7 +718,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
                goto out;
        }
-        status = nfs_refresh_inode(inode, &fattr);
+        status = nfs_refresh_inode(inode, fattr);
        if (status) {
                dfprintk(PAGECACHE, "nfs_revalidate_inode: (%s/%Ld) refresh failed, error=%d\n",
                         inode->i_sb->s_id,
@@ -752,6 +734,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
                (long long)NFS_FILEID(inode));
 out:
+        nfs_free_fattr(fattr);
        return status;
 }
@@ -759,11 +742,16 @@ int nfs_attribute_timeout(struct inode *inode)
 {
        struct nfs_inode *nfsi = NFS_I(inode);
-        if (nfs_have_delegation(inode, FMODE_READ))
-                return 0;
        return !time_in_range_open(jiffies, nfsi->read_cache_jiffies, nfsi->read_cache_jiffies + nfsi->attrtimeo);
 }
+static int nfs_attribute_cache_expired(struct inode *inode)
+{
+        if (nfs_have_delegated_attributes(inode))
+                return 0;
+        return nfs_attribute_timeout(inode);
+}
 /**
 * nfs_revalidate_inode - Revalidate the inode attributes
 * @server - pointer to nfs_server struct
@@ -774,12 +762,12 @@ int nfs_attribute_timeout(struct inode *inode)
 int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
 {
        if (!(NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATTR)
-                        && !nfs_attribute_timeout(inode))
+                        && !nfs_attribute_cache_expired(inode))
                return NFS_STALE(inode) ? -ESTALE : 0;
        return __nfs_revalidate_inode(server, inode);
 }
-static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
+static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
        struct nfs_inode *nfsi = NFS_I(inode);
        
@@ -800,49 +788,10 @@ static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_spa
        return 0;
 }
-static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
-{
-        int ret = 0;
-        mutex_lock(&inode->i_mutex);
-        if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_DATA) {
-                ret = nfs_sync_mapping(mapping);
-                if (ret == 0)
-                        ret = nfs_invalidate_mapping_nolock(inode, mapping);
-        }
-        mutex_unlock(&inode->i_mutex);
-        return ret;
-}
-/**
- * nfs_revalidate_mapping_nolock - Revalidate the pagecache
- * @inode - pointer to host inode
- * @mapping - pointer to mapping
- */
-int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
-{
-        struct nfs_inode *nfsi = NFS_I(inode);
-        int ret = 0;
-        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
-                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-                if (ret < 0)
-                        goto out;
-        }
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-                ret = nfs_invalidate_mapping_nolock(inode, mapping);
-out:
-        return ret;
-}
 /**
 * nfs_revalidate_mapping - Revalidate the pagecache
 * @inode - pointer to host inode
 * @mapping - pointer to mapping
- *
- * This version of the function will take the inode->i_mutex and attempt to
- * flush out all dirty data if it needs to invalidate the page cache.
 */
 int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
@@ -850,7 +799,8 @@ int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
        int ret = 0;
        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
+                        || nfs_attribute_cache_expired(inode)
+                        || NFS_STALE(inode)) {
                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
                if (ret < 0)
                        goto out;
@@ -984,6 +934,26 @@ void nfs_fattr_init(struct nfs_fattr *fattr)
        fattr->gencount = nfs_inc_attr_generation_counter();
 }
+struct nfs_fattr *nfs_alloc_fattr(void)
+{
+        struct nfs_fattr *fattr;
+        fattr = kmalloc(sizeof(*fattr), GFP_NOFS);
+        if (fattr != NULL)
+                nfs_fattr_init(fattr);
+        return fattr;
+}
+struct nfs_fh *nfs_alloc_fhandle(void)
+{
+        struct nfs_fh *fh;
+        fh = kmalloc(sizeof(struct nfs_fh), GFP_NOFS);
+        if (fh != NULL)
+                fh->size = 0;
+        return fh;
+}
 /**
 * nfs_inode_attrs_need_update - check if the inode attributes need updating
 * @inode - pointer to inode
@@ -1261,8 +1231,10 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
        if (fattr->valid & NFS_ATTR_FATTR_MODE) {
                if ((inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO)) {
+                        umode_t newmode = inode->i_mode & S_IFMT;
+                        newmode |= fattr->mode & S_IALLUGO;
+                        inode->i_mode = newmode;
                        invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-                        inode->i_mode = fattr->mode;
                }
        } else if (server->caps & NFS_CAP_MODE)
                invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
@@ -1418,6 +1390,7 @@ static void init_once(void *foo)
        INIT_LIST_HEAD(&nfsi->access_cache_inode_lru);
        INIT_RADIX_TREE(&nfsi->nfs_page_tree, GFP_ATOMIC);
        nfsi->npages = 0;
+        nfsi->ncommit = 0;
        atomic_set(&nfsi->silly_count, 1);
        INIT_HLIST_HEAD(&nfsi->silly_list);
        init_waitqueue_head(&nfsi->waitqueue);
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 29e464d23b32..e70f44b9b3f4 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -205,13 +205,14 @@ extern struct rpc_procinfo nfs4_procedures[];
 void nfs_close_context(struct nfs_open_context *ctx, int is_sync);
 /* dir.c */
-extern int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask);
+extern int nfs_access_cache_shrinker(struct shrinker *shrink,
+                                        int nr_to_scan, gfp_t gfp_mask);
 /* inode.c */
 extern struct workqueue_struct *nfsiod_workqueue;
 extern struct inode *nfs_alloc_inode(struct super_block *sb);
 extern void nfs_destroy_inode(struct inode *);
-extern int nfs_write_inode(struct inode *,int);
+extern int nfs_write_inode(struct inode *, struct writeback_control *);
 extern void nfs_clear_inode(struct inode *);
 #ifdef CONFIG_NFS_V4
 extern void nfs4_clear_inode(struct inode *);
@@ -244,9 +245,7 @@ extern struct dentry *nfs_get_root(struct super_block *, struct nfs_fh *);
 #ifdef CONFIG_NFS_V4
 extern struct dentry *nfs4_get_root(struct super_block *, struct nfs_fh *);
-extern int nfs4_path_walk(struct nfs_server *server,
+extern int nfs4_get_rootfh(struct nfs_server *server, struct nfs_fh *mntfh);
-                          struct nfs_fh *mntfh,
-                          const char *path);
 #endif
 /* read.c */
diff --git a/fs/nfs/iostat.h b/fs/nfs/iostat.h
index 46d779abafd3..c5832487c456 100644
--- a/fs/nfs/iostat.h
+++ b/fs/nfs/iostat.h
@@ -36,14 +36,14 @@ static inline void nfs_inc_stats(const struct inode *inode,
 static inline void nfs_add_server_stats(const struct nfs_server *server,
                                        enum nfs_stat_bytecounters stat,
-                                        unsigned long addend)
+                                        long addend)
 {
        this_cpu_add(server->io_stats->bytes[stat], addend);
 }
 static inline void nfs_add_stats(const struct inode *inode,
                                 enum nfs_stat_bytecounters stat,
-                                 unsigned long addend)
+                                 long addend)
 {
        nfs_add_server_stats(NFS_SERVER(inode), stat, addend);
 }
@@ -51,18 +51,18 @@ static inline void nfs_add_stats(const struct inode *inode,
 #ifdef CONFIG_NFS_FSCACHE
 static inline void nfs_add_fscache_stats(struct inode *inode,
                                         enum nfs_stat_fscachecounters stat,
-                                         unsigned long addend)
+                                         long addend)
 {
        this_cpu_add(NFS_SERVER(inode)->io_stats->fscache[stat], addend);
 }
 #endif
-static inline struct nfs_iostats *nfs_alloc_iostats(void)
+static inline struct nfs_iostats __percpu *nfs_alloc_iostats(void)
 {
        return alloc_percpu(struct nfs_iostats);
 }
-static inline void nfs_free_iostats(struct nfs_iostats *stats)
+static inline void nfs_free_iostats(struct nfs_iostats __percpu *stats)
 {
        if (stats != NULL)
                free_percpu(stats);
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 0adefc40cc89..59047f8d7d72 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -120,7 +120,7 @@ static struct {
        { .status = MNT3ERR_INVAL,              .errno = -EINVAL,       },
        { .status = MNT3ERR_NAMETOOLONG,        .errno = -ENAMETOOLONG, },
        { .status = MNT3ERR_NOTSUPP,            .errno = -ENOTSUPP,     },
-        { .status = MNT3ERR_SERVERFAULT,        .errno = -ESERVERFAULT, },
+        { .status = MNT3ERR_SERVERFAULT,        .errno = -EREMOTEIO,    },
 };
 struct mountres {
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 40c766782891..db6aa3673cf3 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -8,6 +8,7 @@
 */
 #include <linux/dcache.h>
+#include <linux/gfp.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nfs_fs.h>
@@ -104,8 +105,8 @@ static void * nfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
        struct vfsmount *mnt;
        struct nfs_server *server = NFS_SERVER(dentry->d_inode);
        struct dentry *parent;
-        struct nfs_fh fh;
+        struct nfs_fh *fh = NULL;
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr = NULL;
        int err;
        dprintk("--> nfs_follow_mountpoint()\n");
@@ -114,6 +115,12 @@ static void * nfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
        if (IS_ROOT(dentry))
                goto out_err;
+        err = -ENOMEM;
+        fh = nfs_alloc_fhandle();
+        fattr = nfs_alloc_fattr();
+        if (fh == NULL || fattr == NULL)
+                goto out_err;
        dprintk("%s: enter\n", __func__);
        dput(nd->path.dentry);
        nd->path.dentry = dget(dentry);
@@ -122,16 +129,16 @@ static void * nfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
        parent = dget_parent(nd->path.dentry);
        err = server->nfs_client->rpc_ops->lookup(parent->d_inode,
                                                  &nd->path.dentry->d_name,
-                                                  &fh, &fattr);
+                                                  fh, fattr);
        dput(parent);
        if (err != 0)
                goto out_err;
-        if (fattr.valid & NFS_ATTR_FATTR_V4_REFERRAL)
+        if (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)
                mnt = nfs_do_refmount(nd->path.mnt, nd->path.dentry);
        else
-                mnt = nfs_do_submount(nd->path.mnt, nd->path.dentry, &fh,
+                mnt = nfs_do_submount(nd->path.mnt, nd->path.dentry, fh,
-                                      &fattr);
+                                      fattr);
        err = PTR_ERR(mnt);
        if (IS_ERR(mnt))
                goto out_err;
@@ -150,6 +157,8 @@ static void * nfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
        nd->path.dentry = dget(mnt->mnt_root);
        schedule_delayed_work(&nfs_automount_task, nfs_mountpoint_expiry_timeout);
 out:
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fh);
        dprintk("%s: done, returned %d\n", __func__, err);
        dprintk("<-- nfs_follow_mountpoint() = %d\n", err);
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index 5e078b222b4e..81cf14257916 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -12,7 +12,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -699,7 +698,7 @@ static struct {
        { NFSERR_BAD_COOKIE,    -EBADCOOKIE     },
        { NFSERR_NOTSUPP,       -ENOTSUPP       },
        { NFSERR_TOOSMALL,      -ETOOSMALL      },
-        { NFSERR_SERVERFAULT,   -ESERVERFAULT   },
+        { NFSERR_SERVERFAULT,   -EREMOTEIO      },
        { NFSERR_BADTYPE,       -EBADTYPE       },
        { NFSERR_JUKEBOX,       -EJUKEBOX       },
        { -1,                   -EIO            }
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index bac60515a4b3..9f88c5f4c7e2 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -1,4 +1,5 @@
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/nfs.h>
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
@@ -184,7 +185,6 @@ static void nfs3_cache_acls(struct inode *inode, struct posix_acl *acl,
 struct posix_acl *nfs3_proc_getacl(struct inode *inode, int type)
 {
        struct nfs_server *server = NFS_SERVER(inode);
-        struct nfs_fattr fattr;
        struct page *pages[NFSACL_MAXPAGES] = { };
        struct nfs3_getaclargs args = {
                .fh = NFS_FH(inode),
@@ -192,7 +192,7 @@ struct posix_acl *nfs3_proc_getacl(struct inode *inode, int type)
                .pages = pages,
        };
        struct nfs3_getaclres res = {
-                .fattr =        &fattr,
+                0
        };
        struct rpc_message msg = {
                .rpc_argp       = &args,
@@ -227,7 +227,10 @@ struct posix_acl *nfs3_proc_getacl(struct inode *inode, int type)
        dprintk("NFS call getacl\n");
        msg.rpc_proc = &server->client_acl->cl_procinfo[ACLPROC3_GETACL];
-        nfs_fattr_init(&fattr);
+        res.fattr = nfs_alloc_fattr();
+        if (res.fattr == NULL)
+                return ERR_PTR(-ENOMEM);
        status = rpc_call_sync(server->client_acl, &msg, 0);
        dprintk("NFS reply getacl: %d\n", status);
@@ -237,7 +240,7 @@ struct posix_acl *nfs3_proc_getacl(struct inode *inode, int type)
        switch (status) {
                case 0:
-                        status = nfs_refresh_inode(inode, &fattr);
+                        status = nfs_refresh_inode(inode, res.fattr);
                        break;
                case -EPFNOSUPPORT:
                case -EPROTONOSUPPORT:
@@ -277,6 +280,7 @@ struct posix_acl *nfs3_proc_getacl(struct inode *inode, int type)
 getout:
        posix_acl_release(res.acl_access);
        posix_acl_release(res.acl_default);
+        nfs_free_fattr(res.fattr);
        if (status != 0) {
                posix_acl_release(acl);
@@ -289,7 +293,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                  struct posix_acl *dfacl)
 {
        struct nfs_server *server = NFS_SERVER(inode);
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr;
        struct page *pages[NFSACL_MAXPAGES];
        struct nfs3_setaclargs args = {
                .inode = inode,
@@ -334,8 +338,13 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
        }
        dprintk("NFS call setacl\n");
+        status = -ENOMEM;
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                goto out_freepages;
        msg.rpc_proc = &server->client_acl->cl_procinfo[ACLPROC3_SETACL];
-        nfs_fattr_init(&fattr);
+        msg.rpc_resp = fattr;
        status = rpc_call_sync(server->client_acl, &msg, 0);
        nfs_access_zap_cache(inode);
        nfs_zap_acl_cache(inode);
@@ -343,7 +352,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
        switch (status) {
                case 0:
-                        status = nfs_refresh_inode(inode, &fattr);
+                        status = nfs_refresh_inode(inode, fattr);
                        nfs3_cache_acls(inode, acl, dfacl);
                        break;
                case -EPFNOSUPPORT:
@@ -354,6 +363,7 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                case -ENOTSUPP:
                        status = -EOPNOTSUPP;
        }
+        nfs_free_fattr(fattr);
 out_freepages:
        while (args.npages != 0) {
                args.npages--;
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 3f8881d1a050..fabb4f2849a1 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
+#include <linux/slab.h>
 #include <linux/nfs.h>
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
@@ -22,14 +23,14 @@
 #define NFSDBG_FACILITY         NFSDBG_PROC
-/* A wrapper to handle the EJUKEBOX error message */
+/* A wrapper to handle the EJUKEBOX and EKEYEXPIRED error messages */
 static int
 nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 {
        int res;
        do {
                res = rpc_call_sync(clnt, msg, flags);
-                if (res != -EJUKEBOX)
+                if (res != -EJUKEBOX && res != -EKEYEXPIRED)
                        break;
                schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
                res = -ERESTARTSYS;
@@ -42,9 +43,10 @@ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 static int
 nfs3_async_handle_jukebox(struct rpc_task *task, struct inode *inode)
 {
-        if (task->tk_status != -EJUKEBOX)
+        if (task->tk_status != -EJUKEBOX && task->tk_status != -EKEYEXPIRED)
                return 0;
-        nfs_inc_stats(inode, NFSIOS_DELAY);
+        if (task->tk_status == -EJUKEBOX)
+                nfs_inc_stats(inode, NFSIOS_DELAY);
        task->tk_status = 0;
        rpc_restart_call(task);
        rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
@@ -142,14 +144,12 @@ static int
 nfs3_proc_lookup(struct inode *dir, struct qstr *name,
                 struct nfs_fh *fhandle, struct nfs_fattr *fattr)
 {
-        struct nfs_fattr        dir_attr;
        struct nfs3_diropargs   arg = {
                .fh             = NFS_FH(dir),
                .name           = name->name,
                .len            = name->len
        };
        struct nfs3_diropres    res = {
-                .dir_attr       = &dir_attr,
                .fh             = fhandle,
                .fattr          = fattr
        };
@@ -161,29 +161,30 @@ nfs3_proc_lookup(struct inode *dir, struct qstr *name,
        int                     status;
        dprintk("NFS call  lookup %s\n", name->name);
-        nfs_fattr_init(&dir_attr);
+        res.dir_attr = nfs_alloc_fattr();
+        if (res.dir_attr == NULL)
+                return -ENOMEM;
        nfs_fattr_init(fattr);
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_refresh_inode(dir, res.dir_attr);
        if (status >= 0 && !(fattr->valid & NFS_ATTR_FATTR)) {
                msg.rpc_proc = &nfs3_procedures[NFS3PROC_GETATTR];
                msg.rpc_argp = fhandle;
                msg.rpc_resp = fattr;
                status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        }
+        nfs_free_fattr(res.dir_attr);
        dprintk("NFS reply lookup: %d\n", status);
        return status;
 }
 static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
 {
-        struct nfs_fattr        fattr;
        struct nfs3_accessargs  arg = {
                .fh             = NFS_FH(inode),
        };
-        struct nfs3_accessres   res = {
+        struct nfs3_accessres   res;
-                .fattr          = &fattr,
-        };
        struct rpc_message msg = {
                .rpc_proc       = &nfs3_procedures[NFS3PROC_ACCESS],
                .rpc_argp       = &arg,
@@ -191,7 +192,7 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
                .rpc_cred       = entry->cred,
        };
        int mode = entry->mask;
-        int status;
+        int status = -ENOMEM;
        dprintk("NFS call  access\n");
@@ -208,9 +209,13 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
                if (mode & MAY_EXEC)
                        arg.access |= NFS3_ACCESS_EXECUTE;
        }
-        nfs_fattr_init(&fattr);
+        res.fattr = nfs_alloc_fattr();
+        if (res.fattr == NULL)
+                goto out;
        status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
-        nfs_refresh_inode(inode, &fattr);
+        nfs_refresh_inode(inode, res.fattr);
        if (status == 0) {
                entry->mask = 0;
                if (res.access & NFS3_ACCESS_READ)
@@ -220,6 +225,8 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
                if (res.access & (NFS3_ACCESS_LOOKUP|NFS3_ACCESS_EXECUTE))
                        entry->mask |= MAY_EXEC;
        }
+        nfs_free_fattr(res.fattr);
+out:
        dprintk("NFS reply access: %d\n", status);
        return status;
 }
@@ -227,7 +234,7 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
 static int nfs3_proc_readlink(struct inode *inode, struct page *page,
                unsigned int pgbase, unsigned int pglen)
 {
-        struct nfs_fattr        fattr;
+        struct nfs_fattr        *fattr;
        struct nfs3_readlinkargs args = {
                .fh             = NFS_FH(inode),
                .pgbase         = pgbase,
@@ -237,14 +244,19 @@ static int nfs3_proc_readlink(struct inode *inode, struct page *page,
        struct rpc_message msg = {
                .rpc_proc       = &nfs3_procedures[NFS3PROC_READLINK],
                .rpc_argp       = &args,
-                .rpc_resp       = &fattr,
        };
-        int                     status;
+        int status = -ENOMEM;
        dprintk("NFS call  readlink\n");
-        nfs_fattr_init(&fattr);
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                goto out;
+        msg.rpc_resp = fattr;
        status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
-        nfs_refresh_inode(inode, &fattr);
+        nfs_refresh_inode(inode, fattr);
+        nfs_free_fattr(fattr);
+out:
        dprintk("NFS reply readlink: %d\n", status);
        return status;
 }
@@ -394,12 +406,17 @@ nfs3_proc_remove(struct inode *dir, struct qstr *name)
                .rpc_argp = &arg,
                .rpc_resp = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
        dprintk("NFS call  remove %s\n", name->name);
-        nfs_fattr_init(&res.dir_attr);
+        res.dir_attr = nfs_alloc_fattr();
+        if (res.dir_attr == NULL)
+                goto out;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
-        nfs_post_op_update_inode(dir, &res.dir_attr);
+        nfs_post_op_update_inode(dir, res.dir_attr);
+        nfs_free_fattr(res.dir_attr);
+out:
        dprintk("NFS reply remove: %d\n", status);
        return status;
 }
@@ -417,7 +434,7 @@ nfs3_proc_unlink_done(struct rpc_task *task, struct inode *dir)
        if (nfs3_async_handle_jukebox(task, dir))
                return 0;
        res = task->tk_msg.rpc_resp;
-        nfs_post_op_update_inode(dir, &res->dir_attr);
+        nfs_post_op_update_inode(dir, res->dir_attr);
        return 1;
 }
@@ -425,7 +442,6 @@ static int
 nfs3_proc_rename(struct inode *old_dir, struct qstr *old_name,
                 struct inode *new_dir, struct qstr *new_name)
 {
-        struct nfs_fattr        old_dir_attr, new_dir_attr;
        struct nfs3_renameargs  arg = {
                .fromfh         = NFS_FH(old_dir),
                .fromname       = old_name->name,
@@ -434,23 +450,27 @@ nfs3_proc_rename(struct inode *old_dir, struct qstr *old_name,
                .toname         = new_name->name,
                .tolen          = new_name->len
        };
-        struct nfs3_renameres   res = {
+        struct nfs3_renameres res;
-                .fromattr       = &old_dir_attr,
-                .toattr         = &new_dir_attr
-        };
        struct rpc_message msg = {
                .rpc_proc       = &nfs3_procedures[NFS3PROC_RENAME],
                .rpc_argp       = &arg,
                .rpc_resp       = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
        dprintk("NFS call  rename %s -> %s\n", old_name->name, new_name->name);
-        nfs_fattr_init(&old_dir_attr);
-        nfs_fattr_init(&new_dir_attr);
+        res.fromattr = nfs_alloc_fattr();
+        res.toattr = nfs_alloc_fattr();
+        if (res.fromattr == NULL || res.toattr == NULL)
+                goto out;
        status = rpc_call_sync(NFS_CLIENT(old_dir), &msg, 0);
-        nfs_post_op_update_inode(old_dir, &old_dir_attr);
+        nfs_post_op_update_inode(old_dir, res.fromattr);
-        nfs_post_op_update_inode(new_dir, &new_dir_attr);
+        nfs_post_op_update_inode(new_dir, res.toattr);
+out:
+        nfs_free_fattr(res.toattr);
+        nfs_free_fattr(res.fromattr);
        dprintk("NFS reply rename: %d\n", status);
        return status;
 }
@@ -458,30 +478,32 @@ nfs3_proc_rename(struct inode *old_dir, struct qstr *old_name,
 static int
 nfs3_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
 {
-        struct nfs_fattr        dir_attr, fattr;
        struct nfs3_linkargs    arg = {
                .fromfh         = NFS_FH(inode),
                .tofh           = NFS_FH(dir),
                .toname         = name->name,
                .tolen          = name->len
        };
-        struct nfs3_linkres     res = {
+        struct nfs3_linkres     res;
-                .dir_attr       = &dir_attr,
-                .fattr          = &fattr
-        };
        struct rpc_message msg = {
                .rpc_proc       = &nfs3_procedures[NFS3PROC_LINK],
                .rpc_argp       = &arg,
                .rpc_resp       = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
        dprintk("NFS call  link %s\n", name->name);
-        nfs_fattr_init(&dir_attr);
+        res.fattr = nfs_alloc_fattr();
-        nfs_fattr_init(&fattr);
+        res.dir_attr = nfs_alloc_fattr();
+        if (res.fattr == NULL || res.dir_attr == NULL)
+                goto out;
        status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
-        nfs_post_op_update_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, res.dir_attr);
-        nfs_post_op_update_inode(inode, &fattr);
+        nfs_post_op_update_inode(inode, res.fattr);
+out:
+        nfs_free_fattr(res.dir_attr);
+        nfs_free_fattr(res.fattr);
        dprintk("NFS reply link: %d\n", status);
        return status;
 }
@@ -552,7 +574,7 @@ out:
 static int
 nfs3_proc_rmdir(struct inode *dir, struct qstr *name)
 {
-        struct nfs_fattr        dir_attr;
+        struct nfs_fattr        *dir_attr;
        struct nfs3_diropargs   arg = {
                .fh             = NFS_FH(dir),
                .name           = name->name,
@@ -561,14 +583,19 @@ nfs3_proc_rmdir(struct inode *dir, struct qstr *name)
        struct rpc_message msg = {
                .rpc_proc       = &nfs3_procedures[NFS3PROC_RMDIR],
                .rpc_argp       = &arg,
-                .rpc_resp       = &dir_attr,
        };
-        int                     status;
+        int status = -ENOMEM;
        dprintk("NFS call  rmdir %s\n", name->name);
-        nfs_fattr_init(&dir_attr);
+        dir_attr = nfs_alloc_fattr();
+        if (dir_attr == NULL)
+                goto out;
+        msg.rpc_resp = dir_attr;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
-        nfs_post_op_update_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, dir_attr);
+        nfs_free_fattr(dir_attr);
+out:
        dprintk("NFS reply rmdir: %d\n", status);
        return status;
 }
@@ -587,7 +614,6 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                  u64 cookie, struct page *page, unsigned int count, int plus)
 {
        struct inode            *dir = dentry->d_inode;
-        struct nfs_fattr        dir_attr;
        __be32                  *verf = NFS_COOKIEVERF(dir);
        struct nfs3_readdirargs arg = {
                .fh             = NFS_FH(dir),
@@ -598,7 +624,6 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                .pages          = &page
        };
        struct nfs3_readdirres  res = {
-                .dir_attr       = &dir_attr,
                .verf           = verf,
                .plus           = plus
        };
@@ -608,7 +633,7 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
                .rpc_resp       = &res,
                .rpc_cred       = cred
        };
-        int                     status;
+        int status = -ENOMEM;
        if (plus)
                msg.rpc_proc = &nfs3_procedures[NFS3PROC_READDIRPLUS];
@@ -616,12 +641,17 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
        dprintk("NFS call  readdir%s %d\n",
                        plus? "plus" : "", (unsigned int) cookie);
-        nfs_fattr_init(&dir_attr);
+        res.dir_attr = nfs_alloc_fattr();
+        if (res.dir_attr == NULL)
+                goto out;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        nfs_invalidate_atime(dir);
+        nfs_refresh_inode(dir, res.dir_attr);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_free_fattr(res.dir_attr);
+out:
        dprintk("NFS reply readdir: %d\n", status);
        return status;
 }
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 5fe5492fbd29..75dcfc7da365 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -9,7 +9,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -763,7 +762,7 @@ nfs3_xdr_wccstat(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 static int
 nfs3_xdr_removeres(struct rpc_rqst *req, __be32 *p, struct nfs_removeres *res)
 {
-        return nfs3_xdr_wccstat(req, p, &res->dir_attr);
+        return nfs3_xdr_wccstat(req, p, res->dir_attr);
 }
 /*
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 865265bdca03..c538c6106e16 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -46,6 +46,7 @@ enum nfs4_client_state {
        NFS4CLNT_DELEGRETURN,
        NFS4CLNT_SESSION_RESET,
        NFS4CLNT_SESSION_DRAINING,
+        NFS4CLNT_RECALL_SLOT,
 };
 /*
@@ -146,6 +147,7 @@ enum {
        NFS_O_RDWR_STATE,               /* OPEN stateid has read/write state */
        NFS_STATE_RECLAIM_REBOOT,       /* OPEN stateid server rebooted */
        NFS_STATE_RECLAIM_NOGRACE,      /* OPEN stateid needs to recover state */
+        NFS_STATE_POSIX_LOCKS,          /* Posix locks are supported */
 };
 struct nfs4_state {
@@ -204,14 +206,14 @@ extern ssize_t nfs4_listxattr(struct dentry *, char *, size_t);
 /* nfs4proc.c */
-extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *);
+extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *, struct nfs4_setclientid_res *);
-extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct rpc_cred *);
+extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct nfs4_setclientid_res *arg, struct rpc_cred *);
 extern int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred);
 extern int nfs4_proc_async_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_proc_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs41_init_clientid(struct nfs_client *, struct rpc_cred *);
-extern int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait);
+extern int nfs4_do_close(struct path *path, struct nfs4_state *state, gfp_t gfp_mask, int wait);
 extern struct dentry *nfs4_atomic_open(struct inode *, struct dentry *, struct nameidata *);
 extern int nfs4_open_revalidate(struct inode *, struct dentry *, int, struct nameidata *);
 extern int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle);
@@ -277,12 +279,14 @@ extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
 extern void nfs4_schedule_state_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
 extern int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state);
+extern int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state);
 extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
+extern void nfs41_handle_recall_slot(struct nfs_client *clp);
 extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
 extern int nfs4_set_lock_state(struct nfs4_state *state, struct file_lock *fl);
 extern void nfs4_copy_stateid(nfs4_stateid *, struct nfs4_state *, fl_owner_t);
-extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter);
+extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_t gfp_mask);
 extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);
 extern void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid);
 extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid);
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index fa3408f20112..3c2a1724fbd2 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -11,6 +11,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/vfs.h>
@@ -114,6 +115,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                                     char *page, char *page2,
                                     const struct nfs4_fs_location *location)
 {
+        const size_t addr_bufsize = sizeof(struct sockaddr_storage);
        struct vfsmount *mnt = ERR_PTR(-ENOENT);
        char *mnt_path;
        unsigned int maxbuflen;
@@ -125,9 +127,12 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
        mountdata->mnt_path = mnt_path;
        maxbuflen = mnt_path - 1 - page2;
+        mountdata->addr = kmalloc(addr_bufsize, GFP_KERNEL);
+        if (mountdata->addr == NULL)
+                return ERR_PTR(-ENOMEM);
        for (s = 0; s < location->nservers; s++) {
                const struct nfs4_string *buf = &location->servers[s];
-                struct sockaddr_storage addr;
                if (buf->len <= 0 || buf->len >= maxbuflen)
                        continue;
@@ -136,11 +141,10 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                        continue;
                mountdata->addrlen = nfs_parse_server_name(buf->data, buf->len,
-                                (struct sockaddr *)&addr, sizeof(addr));
+                                mountdata->addr, addr_bufsize);
                if (mountdata->addrlen == 0)
                        continue;
-                mountdata->addr = (struct sockaddr *)&addr;
                rpc_set_port(mountdata->addr, NFS_PORT);
                memcpy(page2, buf->data, buf->len);
@@ -155,6 +159,7 @@ static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                if (!IS_ERR(mnt))
                        break;
        }
+        kfree(mountdata->addr);
        return mnt;
 }
@@ -220,8 +225,8 @@ out:
 /*
 * nfs_do_refmount - handle crossing a referral on server
+ * @mnt_parent - mountpoint of referral
 * @dentry - dentry of referral
- * @nd - nameidata info
 *
 */
 struct vfsmount *nfs_do_refmount(const struct vfsmount *mnt_parent, struct dentry *dentry)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 198d51d17c13..70015dd60a98 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -39,6 +39,7 @@
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs.h>
 #include <linux/nfs4.h>
@@ -69,6 +70,9 @@ static int nfs4_do_fsinfo(struct nfs_server *, struct nfs_fh *, struct nfs_fsinf
 static int nfs4_async_handle_error(struct rpc_task *, const struct nfs_server *, struct nfs4_state *);
 static int _nfs4_proc_lookup(struct inode *dir, const struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr);
 static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr);
+static int nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred,
+                            struct nfs_fattr *fattr, struct iattr *sattr,
+                            struct nfs4_state *state);
 /* Prevent leaks of NFSv4 errors into userland */
 static int nfs4_map_errors(int err)
@@ -249,19 +253,15 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                        if (state == NULL)
                                break;
                        nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                case -NFS4ERR_STALE_STATEID:
-                case -NFS4ERR_EXPIRED:
+                        if (state == NULL)
-                        nfs4_schedule_state_recovery(clp);
-                        ret = nfs4_wait_clnt_recover(clp);
-                        if (ret == 0)
-                                exception->retry = 1;
-#if !defined(CONFIG_NFS_V4_1)
-                        break;
-#else /* !defined(CONFIG_NFS_V4_1) */
-                        if (!nfs4_has_session(server->nfs_client))
                                break;
-                        /* FALLTHROUGH */
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
+                case -NFS4ERR_EXPIRED:
+                        goto do_state_recovery;
+#if defined(CONFIG_NFS_V4_1)
                case -NFS4ERR_BADSESSION:
                case -NFS4ERR_BADSLOT:
                case -NFS4ERR_BAD_HIGH_SLOT:
@@ -274,7 +274,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                        nfs4_schedule_state_recovery(clp);
                        exception->retry = 1;
                        break;
-#endif /* !defined(CONFIG_NFS_V4_1) */
+#endif /* defined(CONFIG_NFS_V4_1) */
                case -NFS4ERR_FILE_OPEN:
                        if (exception->timeout > HZ) {
                                /* We have retried a decent amount, time to
@@ -285,6 +285,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                        }
                case -NFS4ERR_GRACE:
                case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                        ret = nfs4_delay(server->client, &exception->timeout);
                        if (ret != 0)
                                break;
@@ -293,6 +294,12 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
        }
        /* We failed to handle the error */
        return nfs4_map_errors(ret);
+do_state_recovery:
+        nfs4_schedule_state_recovery(clp);
+        ret = nfs4_wait_clnt_recover(clp);
+        if (ret == 0)
+                exception->retry = 1;
+        return ret;
 }
@@ -416,7 +423,8 @@ static void nfs41_sequence_done(struct nfs_client *clp,
                        clp->cl_last_renewal = timestamp;
                spin_unlock(&clp->cl_lock);
                /* Check sequence flags */
-                nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
+                if (atomic_read(&clp->cl_count) > 1)
+                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
        }
 out:
        /* The session may be reset by one of the error handlers. */
@@ -709,21 +717,22 @@ static void nfs4_init_opendata_res(struct nfs4_opendata *p)
 static struct nfs4_opendata *nfs4_opendata_alloc(struct path *path,
                struct nfs4_state_owner *sp, fmode_t fmode, int flags,
-                const struct iattr *attrs)
+                const struct iattr *attrs,
+                gfp_t gfp_mask)
 {
        struct dentry *parent = dget_parent(path->dentry);
        struct inode *dir = parent->d_inode;
        struct nfs_server *server = NFS_SERVER(dir);
        struct nfs4_opendata *p;
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), gfp_mask);
        if (p == NULL)
                goto err;
-        p->o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
+        p->o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid, gfp_mask);
        if (p->o_arg.seqid == NULL)
                goto err_free;
-        p->path.mnt = mntget(path->mnt);
+        path_get(path);
-        p->path.dentry = dget(path->dentry);
+        p->path = *path;
        p->dir = parent;
        p->owner = sp;
        atomic_inc(&sp->so_count);
@@ -1055,7 +1064,7 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context
 {
        struct nfs4_opendata *opendata;
-        opendata = nfs4_opendata_alloc(&ctx->path, state->owner, 0, 0, NULL);
+        opendata = nfs4_opendata_alloc(&ctx->path, state->owner, 0, 0, NULL, GFP_NOFS);
        if (opendata == NULL)
                return ERR_PTR(-ENOMEM);
        opendata->state = state;
@@ -1161,7 +1170,7 @@ static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state
        int err;
        do {
                err = _nfs4_do_open_reclaim(ctx, state);
-                if (err != -NFS4ERR_DELAY)
+                if (err != -NFS4ERR_DELAY && err != -EKEYEXPIRED)
                        break;
                nfs4_handle_exception(server, err, &exception);
        } while (exception.retry);
@@ -1518,6 +1527,8 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
                nfs_post_op_update_inode(dir, o_res->dir_attr);
        } else
                nfs_refresh_inode(dir, o_res->dir_attr);
+        if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
+                server->caps &= ~NFS_CAP_POSIX_LOCK;
        if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
                status = _nfs4_proc_open_confirm(data);
                if (status != 0)
@@ -1580,6 +1591,7 @@ static int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state
                        goto out;
                case -NFS4ERR_GRACE:
                case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                        nfs4_handle_exception(server, err, &exception);
                        err = 0;
                }
@@ -1640,7 +1652,7 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
        if (path->dentry->d_inode != NULL)
                nfs4_return_incompatible_delegation(path->dentry->d_inode, fmode);
        status = -ENOMEM;
-        opendata = nfs4_opendata_alloc(path, sp, fmode, flags, sattr);
+        opendata = nfs4_opendata_alloc(path, sp, fmode, flags, sattr, GFP_KERNEL);
        if (opendata == NULL)
                goto err_put_state_owner;
@@ -1651,13 +1663,24 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
        if (status != 0)
                goto err_opendata_put;
-        if (opendata->o_arg.open_flags & O_EXCL)
-                nfs4_exclusive_attrset(opendata, sattr);
        state = nfs4_opendata_to_nfs4_state(opendata);
        status = PTR_ERR(state);
        if (IS_ERR(state))
                goto err_opendata_put;
+        if (server->caps & NFS_CAP_POSIX_LOCK)
+                set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
+        if (opendata->o_arg.open_flags & O_EXCL) {
+                nfs4_exclusive_attrset(opendata, sattr);
+                nfs_fattr_init(opendata->o_res.f_attr);
+                status = nfs4_do_setattr(state->inode, cred,
+                                opendata->o_res.f_attr, sattr,
+                                state);
+                if (status == 0)
+                        nfs_setattr_update_inode(state->inode, sattr);
+                nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
+        }
        nfs4_opendata_put(opendata);
        nfs4_put_state_owner(sp);
        *res = state;
@@ -1904,7 +1927,7 @@ static const struct rpc_call_ops nfs4_close_ops = {
 *
 * NOTE: Caller must be holding the sp->so_owner semaphore!
 */
-int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
+int nfs4_do_close(struct path *path, struct nfs4_state *state, gfp_t gfp_mask, int wait)
 {
        struct nfs_server *server = NFS_SERVER(state->inode);
        struct nfs4_closedata *calldata;
@@ -1923,7 +1946,7 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
        };
        int status = -ENOMEM;
-        calldata = kzalloc(sizeof(*calldata), GFP_KERNEL);
+        calldata = kzalloc(sizeof(*calldata), gfp_mask);
        if (calldata == NULL)
                goto out;
        calldata->inode = state->inode;
@@ -1931,7 +1954,7 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
        calldata->arg.fh = NFS_FH(state->inode);
        calldata->arg.stateid = &state->open_stateid;
        /* Serialization for the sequence id */
-        calldata->arg.seqid = nfs_alloc_seqid(&state->owner->so_seqid);
+        calldata->arg.seqid = nfs_alloc_seqid(&state->owner->so_seqid, gfp_mask);
        if (calldata->arg.seqid == NULL)
                goto out_free_calldata;
        calldata->arg.fmode = 0;
@@ -1940,8 +1963,8 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
        calldata->res.seqid = calldata->arg.seqid;
        calldata->res.server = server;
        calldata->res.seq_res.sr_slotid = NFS4_MAX_SLOT_TABLE;
-        calldata->path.mnt = mntget(path->mnt);
+        path_get(path);
-        calldata->path.dentry = dget(path->dentry);
+        calldata->path = *path;
        msg.rpc_argp = &calldata->arg,
        msg.rpc_resp = &calldata->res,
@@ -2060,8 +2083,7 @@ nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags, st
                        case -EDQUOT:
                        case -ENOSPC:
                        case -EROFS:
-                                lookup_instantiate_filp(nd, (struct dentry *)state, NULL);
+                                return PTR_ERR(state);
-                                return 1;
                        default:
                                goto out_drop;
                }
@@ -2395,14 +2417,12 @@ static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh
 static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
 {
        struct nfs_server *server = NFS_SERVER(inode);
-        struct nfs_fattr fattr;
        struct nfs4_accessargs args = {
                .fh = NFS_FH(inode),
                .bitmask = server->attr_bitmask,
        };
        struct nfs4_accessres res = {
                .server = server,
-                .fattr = &fattr,
        };
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_ACCESS],
@@ -2429,7 +2449,11 @@ static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry
                if (mode & MAY_EXEC)
                        args.access |= NFS4_ACCESS_EXECUTE;
        }
-        nfs_fattr_init(&fattr);
+        res.fattr = nfs_alloc_fattr();
+        if (res.fattr == NULL)
+                return -ENOMEM;
        status = nfs4_call_sync(server, &msg, &args, &res, 0);
        if (!status) {
                entry->mask = 0;
@@ -2439,8 +2463,9 @@ static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry
                        entry->mask |= MAY_WRITE;
                if (res.access & (NFS4_ACCESS_LOOKUP|NFS4_ACCESS_EXECUTE))
                        entry->mask |= MAY_EXEC;
-                nfs_refresh_inode(inode, &fattr);
+                nfs_refresh_inode(inode, res.fattr);
        }
+        nfs_free_fattr(res.fattr);
        return status;
 }
@@ -2553,13 +2578,6 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
        }
        d_add(dentry, igrab(state->inode));
        nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
-        if (flags & O_EXCL) {
-                struct nfs_fattr fattr;
-                status = nfs4_do_setattr(state->inode, cred, &fattr, sattr, state);
-                if (status == 0)
-                        nfs_setattr_update_inode(state->inode, sattr);
-                nfs_post_op_update_inode(state->inode, &fattr);
-        }
        if (status == 0 && (nd->flags & LOOKUP_OPEN) != 0)
                status = nfs4_intent_set_file(nd, &path, state, fmode);
        else
@@ -2587,14 +2605,19 @@ static int _nfs4_proc_remove(struct inode *dir, struct qstr *name)
                .rpc_argp = &args,
                .rpc_resp = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
+        res.dir_attr = nfs_alloc_fattr();
+        if (res.dir_attr == NULL)
+                goto out;
-        nfs_fattr_init(&res.dir_attr);
        status = nfs4_call_sync(server, &msg, &args, &res, 1);
        if (status == 0) {
                update_changeattr(dir, &res.cinfo);
-                nfs_post_op_update_inode(dir, &res.dir_attr);
+                nfs_post_op_update_inode(dir, res.dir_attr);
        }
+        nfs_free_fattr(res.dir_attr);
+out:
        return status;
 }
@@ -2629,7 +2652,7 @@ static int nfs4_proc_unlink_done(struct rpc_task *task, struct inode *dir)
        if (nfs4_async_handle_error(task, res->server, NULL) == -EAGAIN)
                return 0;
        update_changeattr(dir, &res->cinfo);
-        nfs_post_op_update_inode(dir, &res->dir_attr);
+        nfs_post_op_update_inode(dir, res->dir_attr);
        return 1;
 }
@@ -2644,29 +2667,31 @@ static int _nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
                .new_name = new_name,
                .bitmask = server->attr_bitmask,
        };
-        struct nfs_fattr old_fattr, new_fattr;
        struct nfs4_rename_res res = {
                .server = server,
-                .old_fattr = &old_fattr,
-                .new_fattr = &new_fattr,
        };
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_RENAME],
                .rpc_argp = &arg,
                .rpc_resp = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
        
-        nfs_fattr_init(res.old_fattr);
+        res.old_fattr = nfs_alloc_fattr();
-        nfs_fattr_init(res.new_fattr);
+        res.new_fattr = nfs_alloc_fattr();
-        status = nfs4_call_sync(server, &msg, &arg, &res, 1);
+        if (res.old_fattr == NULL || res.new_fattr == NULL)
+                goto out;
+        status = nfs4_call_sync(server, &msg, &arg, &res, 1);
        if (!status) {
                update_changeattr(old_dir, &res.old_cinfo);
                nfs_post_op_update_inode(old_dir, res.old_fattr);
                update_changeattr(new_dir, &res.new_cinfo);
                nfs_post_op_update_inode(new_dir, res.new_fattr);
        }
+out:
+        nfs_free_fattr(res.new_fattr);
+        nfs_free_fattr(res.old_fattr);
        return status;
 }
@@ -2693,28 +2718,30 @@ static int _nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *
                .name   = name,
                .bitmask = server->attr_bitmask,
        };
-        struct nfs_fattr fattr, dir_attr;
        struct nfs4_link_res res = {
                .server = server,
-                .fattr = &fattr,
-                .dir_attr = &dir_attr,
        };
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LINK],
                .rpc_argp = &arg,
                .rpc_resp = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
+        res.fattr = nfs_alloc_fattr();
+        res.dir_attr = nfs_alloc_fattr();
+        if (res.fattr == NULL || res.dir_attr == NULL)
+                goto out;
-        nfs_fattr_init(res.fattr);
-        nfs_fattr_init(res.dir_attr);
        status = nfs4_call_sync(server, &msg, &arg, &res, 1);
        if (!status) {
                update_changeattr(dir, &res.cinfo);
                nfs_post_op_update_inode(dir, res.dir_attr);
                nfs_post_op_update_inode(inode, res.fattr);
        }
+out:
+        nfs_free_fattr(res.dir_attr);
+        nfs_free_fattr(res.fattr);
        return status;
 }
@@ -3137,14 +3164,31 @@ static void nfs4_proc_commit_setup(struct nfs_write_data *data, struct rpc_messa
        msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COMMIT];
 }
+struct nfs4_renewdata {
+        struct nfs_client       *client;
+        unsigned long           timestamp;
+};
 /*
 * nfs4_proc_async_renew(): This is not one of the nfs_rpc_ops; it is a special
 * standalone procedure for queueing an asynchronous RENEW.
 */
-static void nfs4_renew_done(struct rpc_task *task, void *data)
+static void nfs4_renew_release(void *calldata)
 {
-        struct nfs_client *clp = (struct nfs_client *)task->tk_msg.rpc_argp;
+        struct nfs4_renewdata *data = calldata;
-        unsigned long timestamp = (unsigned long)data;
+        struct nfs_client *clp = data->client;
+        if (atomic_read(&clp->cl_count) > 1)
+                nfs4_schedule_state_renewal(clp);
+        nfs_put_client(clp);
+        kfree(data);
+}
+static void nfs4_renew_done(struct rpc_task *task, void *calldata)
+{
+        struct nfs4_renewdata *data = calldata;
+        struct nfs_client *clp = data->client;
+        unsigned long timestamp = data->timestamp;
        if (task->tk_status < 0) {
                /* Unless we're shutting down, schedule state recovery! */
@@ -3160,6 +3204,7 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
 static const struct rpc_call_ops nfs4_renew_ops = {
        .rpc_call_done = nfs4_renew_done,
+        .rpc_release = nfs4_renew_release,
 };
 int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
@@ -3169,9 +3214,17 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
                .rpc_argp       = clp,
                .rpc_cred       = cred,
        };
+        struct nfs4_renewdata *data;
+        if (!atomic_inc_not_zero(&clp->cl_count))
+                return -EIO;
+        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        if (data == NULL)
+                return -ENOMEM;
+        data->client = clp;
+        data->timestamp = jiffies;
        return rpc_call_async(clp->cl_rpcclient, &msg, RPC_TASK_SOFT,
-                        &nfs4_renew_ops, (void *)jiffies);
+                        &nfs4_renew_ops, data);
 }
 int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
@@ -3422,15 +3475,14 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                        if (state == NULL)
                                break;
                        nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                case -NFS4ERR_STALE_STATEID:
+                        if (state == NULL)
+                                break;
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
                case -NFS4ERR_EXPIRED:
-                        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+                        goto do_state_recovery;
-                        nfs4_schedule_state_recovery(clp);
-                        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
-                                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
-                        task->tk_status = 0;
-                        return -EAGAIN;
 #if defined(CONFIG_NFS_V4_1)
                case -NFS4ERR_BADSESSION:
                case -NFS4ERR_BADSLOT:
@@ -3449,6 +3501,7 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                        if (server)
                                nfs_inc_server_stats(server, NFSIOS_DELAY);
                case -NFS4ERR_GRACE:
+                case -EKEYEXPIRED:
                        rpc_delay(task, NFS4_POLL_RETRY_MAX);
                        task->tk_status = 0;
                        return -EAGAIN;
@@ -3458,6 +3511,13 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
        }
        task->tk_status = nfs4_map_errors(task->tk_status);
        return 0;
+do_state_recovery:
+        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+        nfs4_schedule_state_recovery(clp);
+        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
+                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
+        task->tk_status = 0;
+        return -EAGAIN;
 }
 static int
@@ -3466,7 +3526,9 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
        return _nfs4_async_handle_error(task, server, server->nfs_client, state);
 }
-int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, unsigned short port, struct rpc_cred *cred)
+int nfs4_proc_setclientid(struct nfs_client *clp, u32 program,
+                unsigned short port, struct rpc_cred *cred,
+                struct nfs4_setclientid_res *res)
 {
        nfs4_verifier sc_verifier;
        struct nfs4_setclientid setclientid = {
@@ -3476,7 +3538,7 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, unsigned short po
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_SETCLIENTID],
                .rpc_argp = &setclientid,
-                .rpc_resp = clp,
+                .rpc_resp = res,
                .rpc_cred = cred,
        };
        __be32 *p;
@@ -3519,12 +3581,14 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, unsigned short po
        return status;
 }
-static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp, struct rpc_cred *cred)
+static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
+                struct nfs4_setclientid_res *arg,
+                struct rpc_cred *cred)
 {
        struct nfs_fsinfo fsinfo;
        struct rpc_message msg = {
                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_SETCLIENTID_CONFIRM],
-                .rpc_argp = clp,
+                .rpc_argp = arg,
                .rpc_resp = &fsinfo,
                .rpc_cred = cred,
        };
@@ -3542,18 +3606,21 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp, struct rpc_cre
        return status;
 }
-int nfs4_proc_setclientid_confirm(struct nfs_client *clp, struct rpc_cred *cred)
+int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
+                struct nfs4_setclientid_res *arg,
+                struct rpc_cred *cred)
 {
        long timeout = 0;
        int err;
        do {
-                err = _nfs4_proc_setclientid_confirm(clp, cred);
+                err = _nfs4_proc_setclientid_confirm(clp, arg, cred);
                switch (err) {
                        case 0:
                                return err;
                        case -NFS4ERR_RESOURCE:
                                /* The IBM lawyers misread another document! */
                        case -NFS4ERR_DELAY:
+                        case -EKEYEXPIRED:
                                err = nfs4_delay(clp->cl_rpcclient, &timeout);
                }
        } while (err == 0);
@@ -3638,7 +3705,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co
        };
        int status = 0;
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_NOFS);
        if (data == NULL)
                return -ENOMEM;
        data->args.fhandle = &data->fh;
@@ -3794,7 +3861,7 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
        struct nfs4_unlockdata *p;
        struct inode *inode = lsp->ls_state->inode;
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), GFP_NOFS);
        if (p == NULL)
                return NULL;
        p->arg.fh = NFS_FH(inode);
@@ -3932,7 +3999,7 @@ static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *
        if (test_bit(NFS_DELEGATED_STATE, &state->flags))
                goto out;
        lsp = request->fl_u.nfs4_fl.owner;
-        seqid = nfs_alloc_seqid(&lsp->ls_seqid);
+        seqid = nfs_alloc_seqid(&lsp->ls_seqid, GFP_KERNEL);
        status = -ENOMEM;
        if (seqid == NULL)
                goto out;
@@ -3960,22 +4027,23 @@ struct nfs4_lockdata {
 };
 static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
-                struct nfs_open_context *ctx, struct nfs4_lock_state *lsp)
+                struct nfs_open_context *ctx, struct nfs4_lock_state *lsp,
+                gfp_t gfp_mask)
 {
        struct nfs4_lockdata *p;
        struct inode *inode = lsp->ls_state->inode;
        struct nfs_server *server = NFS_SERVER(inode);
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
+        p = kzalloc(sizeof(*p), gfp_mask);
        if (p == NULL)
                return NULL;
        p->arg.fh = NFS_FH(inode);
        p->arg.fl = &p->fl;
-        p->arg.open_seqid = nfs_alloc_seqid(&lsp->ls_state->owner->so_seqid);
+        p->arg.open_seqid = nfs_alloc_seqid(&lsp->ls_state->owner->so_seqid, gfp_mask);
        if (p->arg.open_seqid == NULL)
                goto out_free;
-        p->arg.lock_seqid = nfs_alloc_seqid(&lsp->ls_seqid);
+        p->arg.lock_seqid = nfs_alloc_seqid(&lsp->ls_seqid, gfp_mask);
        if (p->arg.lock_seqid == NULL)
                goto out_free_seqid;
        p->arg.lock_stateid = &lsp->ls_stateid;
@@ -4088,6 +4156,28 @@ static const struct rpc_call_ops nfs4_recover_lock_ops = {
        .rpc_release = nfs4_lock_release,
 };
+static void nfs4_handle_setlk_error(struct nfs_server *server, struct nfs4_lock_state *lsp, int new_lock_owner, int error)
+{
+        struct nfs_client *clp = server->nfs_client;
+        struct nfs4_state *state = lsp->ls_state;
+        switch (error) {
+        case -NFS4ERR_ADMIN_REVOKED:
+        case -NFS4ERR_BAD_STATEID:
+        case -NFS4ERR_EXPIRED:
+                if (new_lock_owner != 0 ||
+                   (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_nograce(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+                break;
+        case -NFS4ERR_STALE_STATEID:
+                if (new_lock_owner != 0 ||
+                    (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+        };
+}
 static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *fl, int recovery_type)
 {
        struct nfs4_lockdata *data;
@@ -4107,7 +4197,8 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
        dprintk("%s: begin!\n", __func__);
        data = nfs4_alloc_lockdata(fl, nfs_file_open_context(fl->fl_file),
-                        fl->fl_u.nfs4_fl.owner);
+                        fl->fl_u.nfs4_fl.owner,
+                        recovery_type == NFS_LOCK_NEW ? GFP_KERNEL : GFP_NOFS);
        if (data == NULL)
                return -ENOMEM;
        if (IS_SETLKW(cmd))
@@ -4126,6 +4217,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
        ret = nfs4_wait_for_completion_rpc_task(task);
        if (ret == 0) {
                ret = data->rpc_status;
+                if (ret)
+                        nfs4_handle_setlk_error(data->server, data->lsp,
+                                        data->arg.new_lock_owner, ret);
        } else
                data->cancelled = 1;
        rpc_put_task(task);
@@ -4144,7 +4238,7 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
                if (test_bit(NFS_DELEGATED_STATE, &state->flags) != 0)
                        return 0;
                err = _nfs4_do_setlk(state, F_SETLK, request, NFS_LOCK_RECLAIM);
-                if (err != -NFS4ERR_DELAY)
+                if (err != -NFS4ERR_DELAY && err != -EKEYEXPIRED)
                        break;
                nfs4_handle_exception(server, err, &exception);
        } while (exception.retry);
@@ -4169,6 +4263,7 @@ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request
                        goto out;
                case -NFS4ERR_GRACE:
                case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                        nfs4_handle_exception(server, err, &exception);
                        err = 0;
                }
@@ -4181,8 +4276,11 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
 {
        struct nfs_inode *nfsi = NFS_I(state->inode);
        unsigned char fl_flags = request->fl_flags;
-        int status;
+        int status = -ENOLCK;
+        if ((fl_flags & FL_POSIX) &&
+                        !test_bit(NFS_STATE_POSIX_LOCKS, &state->flags))
+                goto out;
        /* Is this a delegated open? */
        status = nfs4_set_lock_state(state, request);
        if (status != 0)
@@ -4317,6 +4415,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                                err = 0;
                                goto out;
                        case -NFS4ERR_DELAY:
+                        case -EKEYEXPIRED:
                                break;
                }
                err = nfs4_handle_exception(server, err, &exception);
@@ -4462,7 +4561,7 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
-                if (status != NFS4ERR_CLID_INUSE)
+                if (status != -NFS4ERR_CLID_INUSE)
                        break;
                if (signalled())
@@ -4516,6 +4615,7 @@ static void nfs4_get_lease_time_done(struct rpc_task *task, void *calldata)
        switch (task->tk_status) {
        case -NFS4ERR_DELAY:
        case -NFS4ERR_GRACE:
+        case -EKEYEXPIRED:
                dprintk("%s Retry: tk_status %d\n", __func__, task->tk_status);
                rpc_delay(task, NFS4_POLL_RETRY_MIN);
                task->tk_status = 0;
@@ -4573,26 +4673,32 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
 /*
 * Reset a slot table
 */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, int max_slots,
+static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
-                int old_max_slots, int ivalue)
+                                 int ivalue)
 {
+        struct nfs4_slot *new = NULL;
        int i;
        int ret = 0;
-        dprintk("--> %s: max_reqs=%u, tbl %p\n", __func__, max_slots, tbl);
+        dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
+                max_reqs, tbl->max_slots);
-        /*
+        /* Does the newly negotiated max_reqs match the existing slot table? */
-         * Until we have dynamic slot table adjustment, insist
+        if (max_reqs != tbl->max_slots) {
-         * upon the same slot table size
+                ret = -ENOMEM;
-         */
+                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
-        if (max_slots != old_max_slots) {
+                              GFP_NOFS);
-                dprintk("%s reset slot table does't match old\n",
+                if (!new)
-                        __func__);
+                        goto out;
-                ret = -EINVAL; /*XXX NFS4ERR_REQ_TOO_BIG ? */
+                ret = 0;
-                goto out;
+                kfree(tbl->slots);
        }
        spin_lock(&tbl->slot_tbl_lock);
-        for (i = 0; i < max_slots; ++i)
+        if (new) {
+                tbl->slots = new;
+                tbl->max_slots = max_reqs;
+        }
+        for (i = 0; i < tbl->max_slots; ++i)
                tbl->slots[i].seq_nr = ivalue;
        spin_unlock(&tbl->slot_tbl_lock);
        dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
@@ -4610,16 +4716,12 @@ static int nfs4_reset_slot_tables(struct nfs4_session *session)
        int status;
        status = nfs4_reset_slot_table(&session->fc_slot_table,
-                        session->fc_attrs.max_reqs,
+                        session->fc_attrs.max_reqs, 1);
-                        session->fc_slot_table.max_slots,
-                        1);
        if (status)
                return status;
        status = nfs4_reset_slot_table(&session->bc_slot_table,
-                        session->bc_attrs.max_reqs,
+                        session->bc_attrs.max_reqs, 0);
-                        session->bc_slot_table.max_slots,
-                        0);
        return status;
 }
@@ -4650,7 +4752,7 @@ static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
        dprintk("--> %s: max_reqs=%u\n", __func__, max_slots);
-        slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_KERNEL);
+        slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_NOFS);
        if (!slot)
                goto out;
        ret = 0;
@@ -4699,7 +4801,7 @@ struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp)
        struct nfs4_session *session;
        struct nfs4_slot_table *tbl;
-        session = kzalloc(sizeof(struct nfs4_session), GFP_KERNEL);
+        session = kzalloc(sizeof(struct nfs4_session), GFP_NOFS);
        if (!session)
                return NULL;
@@ -4760,16 +4862,14 @@ static void nfs4_init_channel_attrs(struct nfs41_create_session_args *args)
        args->fc_attrs.headerpadsz = 0;
        args->fc_attrs.max_rqst_sz = mxrqst_sz;
        args->fc_attrs.max_resp_sz = mxresp_sz;
-        args->fc_attrs.max_resp_sz_cached = mxresp_sz;
        args->fc_attrs.max_ops = NFS4_MAX_OPS;
        args->fc_attrs.max_reqs = session->clp->cl_rpcclient->cl_xprt->max_reqs;
        dprintk("%s: Fore Channel : max_rqst_sz=%u max_resp_sz=%u "
-                "max_resp_sz_cached=%u max_ops=%u max_reqs=%u\n",
+                "max_ops=%u max_reqs=%u\n",
                __func__,
                args->fc_attrs.max_rqst_sz, args->fc_attrs.max_resp_sz,
-                args->fc_attrs.max_resp_sz_cached, args->fc_attrs.max_ops,
+                args->fc_attrs.max_ops, args->fc_attrs.max_reqs);
-                args->fc_attrs.max_reqs);
        /* Back channel attributes */
        args->bc_attrs.headerpadsz = 0;
@@ -4978,7 +5078,16 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
                                       &res, args.sa_cache_this, 1);
 }
-void nfs41_sequence_call_done(struct rpc_task *task, void *data)
+static void nfs41_sequence_release(void *data)
+{
+        struct nfs_client *clp = (struct nfs_client *)data;
+        if (atomic_read(&clp->cl_count) > 1)
+                nfs4_schedule_state_renewal(clp);
+        nfs_put_client(clp);
+}
+static void nfs41_sequence_call_done(struct rpc_task *task, void *data)
 {
        struct nfs_client *clp = (struct nfs_client *)data;
@@ -4986,6 +5095,8 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
        if (task->tk_status < 0) {
                dprintk("%s ERROR %d\n", __func__, task->tk_status);
+                if (atomic_read(&clp->cl_count) == 1)
+                        goto out;
                if (_nfs4_async_handle_error(task, NULL, clp, NULL)
                                                                == -EAGAIN) {
@@ -4994,7 +5105,7 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
                }
        }
        dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
+out:
        kfree(task->tk_msg.rpc_argp);
        kfree(task->tk_msg.rpc_resp);
@@ -5019,6 +5130,7 @@ static void nfs41_sequence_prepare(struct rpc_task *task, void *data)
 static const struct rpc_call_ops nfs41_sequence_ops = {
        .rpc_call_done = nfs41_sequence_call_done,
        .rpc_call_prepare = nfs41_sequence_prepare,
+        .rpc_release = nfs41_sequence_release,
 };
 static int nfs41_proc_async_sequence(struct nfs_client *clp,
@@ -5031,12 +5143,14 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp,
                .rpc_cred = cred,
        };
-        args = kzalloc(sizeof(*args), GFP_KERNEL);
+        if (!atomic_inc_not_zero(&clp->cl_count))
-        if (!args)
+                return -EIO;
-                return -ENOMEM;
+        args = kzalloc(sizeof(*args), GFP_NOFS);
-        res = kzalloc(sizeof(*res), GFP_KERNEL);
+        res = kzalloc(sizeof(*res), GFP_NOFS);
-        if (!res) {
+        if (!args || !res) {
                kfree(args);
+                kfree(res);
+                nfs_put_client(clp);
                return -ENOMEM;
        }
        res->sr_slotid = NFS4_MAX_SLOT_TABLE;
@@ -5133,7 +5247,7 @@ static int nfs41_proc_reclaim_complete(struct nfs_client *clp)
        int status = -ENOMEM;
        dprintk("--> %s\n", __func__);
-        calldata = kzalloc(sizeof(*calldata), GFP_KERNEL);
+        calldata = kzalloc(sizeof(*calldata), GFP_NOFS);
        if (calldata == NULL)
                goto out;
        calldata->clp = clp;
@@ -5144,9 +5258,12 @@ static int nfs41_proc_reclaim_complete(struct nfs_client *clp)
        msg.rpc_resp = &calldata->res;
        task_setup_data.callback_data = calldata;
        task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task))
+        if (IS_ERR(task)) {
                status = PTR_ERR(task);
+                goto out;
+        }
        rpc_put_task(task);
+        return 0;
 out:
        dprintk("<-- %s status=%d\n", __func__, status);
        return status;
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index 0156c01c212c..d87f10327b72 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -36,11 +36,6 @@
 * as an rpc_task, not a real kernel thread, so it always runs in rpciod's
 * context.  There is one renewd per nfs_server.
 *
- * TODO: If the send queue gets backlogged (e.g., if the server goes down),
- * we will keep filling the queue with periodic RENEW requests.  We need a
- * mechanism for ensuring that if renewd successfully sends off a request,
- * then it only wakes up when the request is finished.  Maybe use the
- * child task framework of the RPC layer?
 */
 #include <linux/mm.h>
@@ -63,7 +58,7 @@ nfs4_renew_state(struct work_struct *work)
        struct nfs_client *clp =
                container_of(work, struct nfs_client, cl_renewd.work);
        struct rpc_cred *cred;
-        long lease, timeout;
+        long lease;
        unsigned long last, now;
        ops = nfs4_state_renewal_ops[clp->cl_minorversion];
@@ -75,7 +70,6 @@ nfs4_renew_state(struct work_struct *work)
        lease = clp->cl_lease_time;
        last = clp->cl_last_renewal;
        now = jiffies;
-        timeout = (2 * lease) / 3 + (long)last - (long)now;
        /* Are we close to a lease timeout? */
        if (time_after(now, last + lease/3)) {
                cred = ops->get_state_renewal_cred_locked(clp);
@@ -90,19 +84,15 @@ nfs4_renew_state(struct work_struct *work)
                        /* Queue an asynchronous RENEW. */
                        ops->sched_state_renewal(clp, cred);
                        put_rpccred(cred);
+                        goto out_exp;
                }
-                timeout = (2 * lease) / 3;
+        } else {
-                spin_lock(&clp->cl_lock);
-        } else
                dprintk("%s: failed to call renewd. Reason: lease not expired \n",
                                __func__);
-        if (timeout < 5 * HZ)    /* safeguard */
+                spin_unlock(&clp->cl_lock);
-                timeout = 5 * HZ;
+        }
-        dprintk("%s: requeueing work. Lease period = %ld\n",
+        nfs4_schedule_state_renewal(clp);
-                        __func__, (timeout + HZ - 1) / HZ);
+out_exp:
-        cancel_delayed_work(&clp->cl_renewd);
-        schedule_delayed_work(&clp->cl_renewd, timeout);
-        spin_unlock(&clp->cl_lock);
        nfs_expire_unreferenced_delegations(clp);
 out:
        dprintk("%s: done\n", __func__);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6d263ed79e92..34acf5926fdc 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -62,6 +62,7 @@ static LIST_HEAD(nfs4_clientid_list);
 int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
+        struct nfs4_setclientid_res clid;
        unsigned short port;
        int status;
@@ -69,11 +70,15 @@ int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
        if (clp->cl_addr.ss_family == AF_INET6)
                port = nfs_callback_tcpport6;
-        status = nfs4_proc_setclientid(clp, NFS4_CALLBACK, port, cred);
+        status = nfs4_proc_setclientid(clp, NFS4_CALLBACK, port, cred, &clid);
-        if (status == 0)
+        if (status != 0)
-                status = nfs4_proc_setclientid_confirm(clp, cred);
+                goto out;
-        if (status == 0)
+        status = nfs4_proc_setclientid_confirm(clp, &clid, cred);
-                nfs4_schedule_state_renewal(clp);
+        if (status != 0)
+                goto out;
+        clp->cl_clientid = clid.clientid;
+        nfs4_schedule_state_renewal(clp);
+out:
        return status;
 }
@@ -361,7 +366,7 @@ nfs4_alloc_state_owner(void)
 {
        struct nfs4_state_owner *sp;
-        sp = kzalloc(sizeof(*sp),GFP_KERNEL);
+        sp = kzalloc(sizeof(*sp),GFP_NOFS);
        if (!sp)
                return NULL;
        spin_lock_init(&sp->so_lock);
@@ -435,7 +440,7 @@ nfs4_alloc_open_state(void)
 {
        struct nfs4_state *state;
-        state = kzalloc(sizeof(*state), GFP_KERNEL);
+        state = kzalloc(sizeof(*state), GFP_NOFS);
        if (!state)
                return NULL;
        atomic_set(&state->count, 1);
@@ -537,7 +542,8 @@ void nfs4_put_open_state(struct nfs4_state *state)
 /*
 * Close the current file.
 */
-static void __nfs4_close(struct path *path, struct nfs4_state *state, fmode_t fmode, int wait)
+static void __nfs4_close(struct path *path, struct nfs4_state *state,
+                fmode_t fmode, gfp_t gfp_mask, int wait)
 {
        struct nfs4_state_owner *owner = state->owner;
        int call_close = 0;
@@ -578,17 +584,17 @@ static void __nfs4_close(struct path *path, struct nfs4_state *state, fmode_t fm
                nfs4_put_open_state(state);
                nfs4_put_state_owner(owner);
        } else
-                nfs4_do_close(path, state, wait);
+                nfs4_do_close(path, state, gfp_mask, wait);
 }
 void nfs4_close_state(struct path *path, struct nfs4_state *state, fmode_t fmode)
 {
-        __nfs4_close(path, state, fmode, 0);
+        __nfs4_close(path, state, fmode, GFP_NOFS, 0);
 }
 void nfs4_close_sync(struct path *path, struct nfs4_state *state, fmode_t fmode)
 {
-        __nfs4_close(path, state, fmode, 1);
+        __nfs4_close(path, state, fmode, GFP_KERNEL, 1);
 }
 /*
@@ -618,7 +624,7 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
        struct nfs4_lock_state *lsp;
        struct nfs_client *clp = state->owner->so_client;
-        lsp = kzalloc(sizeof(*lsp), GFP_KERNEL);
+        lsp = kzalloc(sizeof(*lsp), GFP_NOFS);
        if (lsp == NULL)
                return NULL;
        rpc_init_wait_queue(&lsp->ls_sequence.wait, "lock_seqid_waitqueue");
@@ -754,11 +760,11 @@ void nfs4_copy_stateid(nfs4_stateid *dst, struct nfs4_state *state, fl_owner_t f
        nfs4_put_lock_state(lsp);
 }
-struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter)
+struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter, gfp_t gfp_mask)
 {
        struct nfs_seqid *new;
-        new = kmalloc(sizeof(*new), GFP_KERNEL);
+        new = kmalloc(sizeof(*new), gfp_mask);
        if (new != NULL) {
                new->sequence = counter;
                INIT_LIST_HEAD(&new->list);
@@ -901,7 +907,7 @@ void nfs4_schedule_state_recovery(struct nfs_client *clp)
        nfs4_schedule_state_manager(clp);
 }
-static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
+int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
        set_bit(NFS_STATE_RECLAIM_REBOOT, &state->flags);
@@ -1249,26 +1255,65 @@ static int nfs4_reclaim_lease(struct nfs_client *clp)
 }
 #ifdef CONFIG_NFS_V4_1
+void nfs41_handle_recall_slot(struct nfs_client *clp)
+{
+        set_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+        nfs4_schedule_state_recovery(clp);
+}
+static void nfs4_reset_all_state(struct nfs_client *clp)
+{
+        if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
+                clp->cl_boot_time = CURRENT_TIME;
+                nfs4_state_start_reclaim_nograce(clp);
+                nfs4_schedule_state_recovery(clp);
+        }
+}
+static void nfs41_handle_server_reboot(struct nfs_client *clp)
+{
+        if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
+                nfs4_state_start_reclaim_reboot(clp);
+                nfs4_schedule_state_recovery(clp);
+        }
+}
+static void nfs41_handle_state_revoked(struct nfs_client *clp)
+{
+        /* Temporary */
+        nfs4_reset_all_state(clp);
+}
+static void nfs41_handle_recallable_state_revoked(struct nfs_client *clp)
+{
+        /* This will need to handle layouts too */
+        nfs_expire_all_delegations(clp);
+}
+static void nfs41_handle_cb_path_down(struct nfs_client *clp)
+{
+        nfs_expire_all_delegations(clp);
+        if (test_and_set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) == 0)
+                nfs4_schedule_state_recovery(clp);
+}
 void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
 {
        if (!flags)
                return;
-        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED) {
+        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
-                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
+                nfs41_handle_server_reboot(clp);
-                nfs4_state_start_reclaim_reboot(clp);
+        else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
-                nfs4_schedule_state_recovery(clp);
-        } else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
                            SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
                            SEQ4_STATUS_ADMIN_STATE_REVOKED |
-                            SEQ4_STATUS_RECALLABLE_STATE_REVOKED |
+                            SEQ4_STATUS_LEASE_MOVED))
-                            SEQ4_STATUS_LEASE_MOVED)) {
+                nfs41_handle_state_revoked(clp);
-                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
+        else if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
-                nfs4_state_start_reclaim_nograce(clp);
+                nfs41_handle_recallable_state_revoked(clp);
-                nfs4_schedule_state_recovery(clp);
+        else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
-        } else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
                            SEQ4_STATUS_BACKCHANNEL_FAULT |
                            SEQ4_STATUS_CB_PATH_DOWN_SESSION))
-                nfs_expire_all_delegations(clp);
+                nfs41_handle_cb_path_down(clp);
 }
 static int nfs4_reset_session(struct nfs_client *clp)
@@ -1285,23 +1330,52 @@ static int nfs4_reset_session(struct nfs_client *clp)
        memset(clp->cl_session->sess_id.data, 0, NFS4_MAX_SESSIONID_LEN);
        status = nfs4_proc_create_session(clp);
-        if (status)
+        if (status) {
                status = nfs4_recovery_handle_error(clp, status);
+                goto out;
+        }
+        /* create_session negotiated new slot table */
+        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
-out:
+         /* Let the state manager reestablish state */
-        /*
+        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
-         * Let the state manager reestablish state
-         */
-        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) &&
-            status == 0)
                nfs41_setup_state_renewal(clp);
+out:
        return status;
 }
+static int nfs4_recall_slot(struct nfs_client *clp)
+{
+        struct nfs4_slot_table *fc_tbl = &clp->cl_session->fc_slot_table;
+        struct nfs4_channel_attrs *fc_attrs = &clp->cl_session->fc_attrs;
+        struct nfs4_slot *new, *old;
+        int i;
+        nfs4_begin_drain_session(clp);
+        new = kmalloc(fc_tbl->target_max_slots * sizeof(struct nfs4_slot),
+                      GFP_NOFS);
+        if (!new)
+                return -ENOMEM;
+        spin_lock(&fc_tbl->slot_tbl_lock);
+        for (i = 0; i < fc_tbl->target_max_slots; i++)
+                new[i].seq_nr = fc_tbl->slots[i].seq_nr;
+        old = fc_tbl->slots;
+        fc_tbl->slots = new;
+        fc_tbl->max_slots = fc_tbl->target_max_slots;
+        fc_tbl->target_max_slots = 0;
+        fc_attrs->max_reqs = fc_tbl->max_slots;
+        spin_unlock(&fc_tbl->slot_tbl_lock);
+        kfree(old);
+        nfs4_end_drain_session(clp);
+        return 0;
+}
 #else /* CONFIG_NFS_V4_1 */
 static int nfs4_reset_session(struct nfs_client *clp) { return 0; }
 static int nfs4_end_drain_session(struct nfs_client *clp) { return 0; }
+static int nfs4_recall_slot(struct nfs_client *clp) { return 0; }
 #endif /* CONFIG_NFS_V4_1 */
 /* Set NFS4CLNT_LEASE_EXPIRED for all v4.0 errors and for recoverable errors
@@ -1314,6 +1388,7 @@ static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
                case -NFS4ERR_DELAY:
                case -NFS4ERR_CLID_INUSE:
                case -EAGAIN:
+                case -EKEYEXPIRED:
                        break;
                case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
@@ -1397,6 +1472,15 @@ static void nfs4_state_manager(struct nfs_client *clp)
                        nfs_client_return_marked_delegations(clp);
                        continue;
                }
+                /* Recall session slots */
+                if (test_and_clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state)
+                   && nfs4_has_session(clp)) {
+                        status = nfs4_recall_slot(clp);
+                        if (status < 0)
+                                goto out_error;
+                        continue;
+                }
                nfs4_clear_state_manager_bit(clp);
                /* Did we race with an attempt to give us more work? */
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index e437fd6a819f..65c8dae4b267 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -38,7 +38,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -863,8 +862,8 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, const
                bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
                *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME);
                *p++ = cpu_to_be32(0);
-                *p++ = cpu_to_be32(iap->ia_mtime.tv_sec);
+                *p++ = cpu_to_be32(iap->ia_atime.tv_sec);
-                *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec);
+                *p++ = cpu_to_be32(iap->ia_atime.tv_nsec);
        }
        else if (iap->ia_valid & ATTR_ATIME) {
                bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
@@ -1505,14 +1504,14 @@ static void encode_setclientid(struct xdr_stream *xdr, const struct nfs4_setclie
        hdr->replen += decode_setclientid_maxsz;
 }
-static void encode_setclientid_confirm(struct xdr_stream *xdr, const struct nfs_client *client_state, struct compound_hdr *hdr)
+static void encode_setclientid_confirm(struct xdr_stream *xdr, const struct nfs4_setclientid_res *arg, struct compound_hdr *hdr)
 {
        __be32 *p;
        p = reserve_space(xdr, 12 + NFS4_VERIFIER_SIZE);
        *p++ = cpu_to_be32(OP_SETCLIENTID_CONFIRM);
-        p = xdr_encode_hyper(p, client_state->cl_clientid);
+        p = xdr_encode_hyper(p, arg->clientid);
-        xdr_encode_opaque_fixed(p, client_state->cl_confirm.data, NFS4_VERIFIER_SIZE);
+        xdr_encode_opaque_fixed(p, arg->confirm.data, NFS4_VERIFIER_SIZE);
        hdr->nops++;
        hdr->replen += decode_setclientid_confirm_maxsz;
 }
@@ -1578,6 +1577,14 @@ static void encode_create_session(struct xdr_stream *xdr,
        char machine_name[NFS4_MAX_MACHINE_NAME_LEN];
        uint32_t len;
        struct nfs_client *clp = args->client;
+        u32 max_resp_sz_cached;
+        /*
+         * Assumes OPEN is the biggest non-idempotent compound.
+         * 2 is the verifier.
+         */
+        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE +
+                              RPC_MAX_AUTH_SIZE + 2) * XDR_UNIT;
        len = scnprintf(machine_name, sizeof(machine_name), "%s",
                        clp->cl_ipaddr);
@@ -1592,7 +1599,7 @@ static void encode_create_session(struct xdr_stream *xdr,
        *p++ = cpu_to_be32(args->fc_attrs.headerpadsz); /* header padding size */
        *p++ = cpu_to_be32(args->fc_attrs.max_rqst_sz); /* max req size */
        *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz); /* max resp size */
-        *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz_cached);  /* Max resp sz cached */
+        *p++ = cpu_to_be32(max_resp_sz_cached);         /* Max resp sz cached */
        *p++ = cpu_to_be32(args->fc_attrs.max_ops);     /* max operations */
        *p++ = cpu_to_be32(args->fc_attrs.max_reqs);    /* max requests */
        *p++ = cpu_to_be32(0);                          /* rdmachannel_attrs */
@@ -2317,7 +2324,7 @@ static int nfs4_xdr_enc_setclientid(struct rpc_rqst *req, __be32 *p, struct nfs4
 /*
 * a SETCLIENTID_CONFIRM request
 */
-static int nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req, __be32 *p, struct nfs_client *clp)
+static int nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req, __be32 *p, struct nfs4_setclientid_res *arg)
 {
        struct xdr_stream xdr;
        struct compound_hdr hdr = {
@@ -2327,7 +2334,7 @@ static int nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req, __be32 *p, str
        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
        encode_compound_hdr(&xdr, req, &hdr);
-        encode_setclientid_confirm(&xdr, clp, &hdr);
+        encode_setclientid_confirm(&xdr, arg, &hdr);
        encode_putrootfh(&xdr, &hdr);
        encode_fsinfo(&xdr, lease_bitmap, &hdr);
        encode_nops(&hdr);
@@ -4390,7 +4397,7 @@ out_overflow:
        return -EIO;
 }
-static int decode_setclientid(struct xdr_stream *xdr, struct nfs_client *clp)
+static int decode_setclientid(struct xdr_stream *xdr, struct nfs4_setclientid_res *res)
 {
        __be32 *p;
        uint32_t opnum;
@@ -4410,8 +4417,8 @@ static int decode_setclientid(struct xdr_stream *xdr, struct nfs_client *clp)
                p = xdr_inline_decode(xdr, 8 + NFS4_VERIFIER_SIZE);
                if (unlikely(!p))
                        goto out_overflow;
-                p = xdr_decode_hyper(p, &clp->cl_clientid);
+                p = xdr_decode_hyper(p, &res->clientid);
-                memcpy(clp->cl_confirm.data, p, NFS4_VERIFIER_SIZE);
+                memcpy(res->confirm.data, p, NFS4_VERIFIER_SIZE);
        } else if (nfserr == NFSERR_CLID_INUSE) {
                uint32_t len;
@@ -4631,7 +4638,7 @@ static int decode_sequence(struct xdr_stream *xdr,
         * If the server returns different values for sessionID, slotID or
         * sequence number, the server is looney tunes.
         */
-        status = -ESERVERFAULT;
+        status = -EREMOTEIO;
        if (memcmp(id.data, res->sr_session->sess_id.data,
                   NFS4_MAX_SESSIONID_LEN)) {
@@ -4808,7 +4815,7 @@ static int nfs4_xdr_dec_remove(struct rpc_rqst *rqstp, __be32 *p, struct nfs_rem
                goto out;
        if ((status = decode_remove(&xdr, &res->cinfo)) != 0)
                goto out;
-        decode_getfattr(&xdr, &res->dir_attr, res->server,
+        decode_getfattr(&xdr, res->dir_attr, res->server,
                        !RPC_IS_ASYNC(rqstp->rq_task));
 out:
        return status;
@@ -5491,7 +5498,7 @@ static int nfs4_xdr_dec_renew(struct rpc_rqst *rqstp, __be32 *p, void *dummy)
 * Decode SETCLIENTID response
 */
 static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, __be32 *p,
-                struct nfs_client *clp)
+                struct nfs4_setclientid_res *res)
 {
        struct xdr_stream xdr;
        struct compound_hdr hdr;
@@ -5500,7 +5507,7 @@ static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, __be32 *p,
        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
        status = decode_compound_hdr(&xdr, &hdr);
        if (!status)
-                status = decode_setclientid(&xdr, clp);
+                status = decode_setclientid(&xdr, res);
        return status;
 }
@@ -5544,6 +5551,8 @@ static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, __be32 *p, struct nf
        if (status != 0)
                goto out;
        status = decode_delegreturn(&xdr);
+        if (status != 0)
+                goto out;
        decode_getfattr(&xdr, res->fattr, res->server,
                        !RPC_IS_ASYNC(rqstp->rq_task));
 out:
@@ -5774,7 +5783,7 @@ static struct {
        { NFS4ERR_BAD_COOKIE,   -EBADCOOKIE     },
        { NFS4ERR_NOTSUPP,      -ENOTSUPP       },
        { NFS4ERR_TOOSMALL,     -ETOOSMALL      },
-        { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
+        { NFS4ERR_SERVERFAULT,  -EREMOTEIO      },
        { NFS4ERR_BADTYPE,      -EBADTYPE       },
        { NFS4ERR_LOCKED,       -EAGAIN         },
        { NFS4ERR_SYMLINK,      -ELOOP          },
@@ -5801,7 +5810,7 @@ nfs4_stat_to_errno(int stat)
        }
        if (stat <= 10000 || stat > 10100) {
                /* The server is looney tunes. */
-                return -ESERVERFAULT;
+                return -EREMOTEIO;
        }
        /* If we cannot translate the error, the recovery routines should
         * handle it.
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index 8c55b27c0de4..df101d9f546a 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -105,7 +105,7 @@ static char nfs_root_name[256] __initdata = "";
 static __be32 servaddr __initdata = 0;
 /* Name of directory to mount */
-static char nfs_export_path[NFS_MAXPATHLEN] __initdata = { 0, };
+static char nfs_export_path[NFS_MAXPATHLEN + 1] __initdata = { 0, };
 /* NFS-related data */
 static struct nfs_mount_data nfs_data __initdata = { 0, };/* NFS mount info */
@@ -488,7 +488,6 @@ static int __init root_nfs_ports(void)
 */
 static int __init root_nfs_get_handle(void)
 {
-        struct nfs_fh fh;
        struct sockaddr_in sin;
        unsigned int auth_flav_len = 0;
        struct nfs_mount_request request = {
@@ -499,21 +498,24 @@ static int __init root_nfs_get_handle(void)
                                        NFS_MNT3_VERSION : NFS_MNT_VERSION,
                .protocol       = (nfs_data.flags & NFS_MOUNT_TCP) ?
                                        XPRT_TRANSPORT_TCP : XPRT_TRANSPORT_UDP,
-                .fh             = &fh,
                .auth_flav_len  = &auth_flav_len,
        };
-        int status;
+        int status = -ENOMEM;
+        request.fh = nfs_alloc_fhandle();
+        if (!request.fh)
+                goto out;
        set_sockaddr(&sin, servaddr, htons(mount_port));
        status = nfs_mount(&request);
        if (status < 0)
                printk(KERN_ERR "Root-NFS: Server returned error %d "
                                "while mounting %s\n", status, nfs_export_path);
        else {
-                nfs_data.root.size = fh.size;
+                nfs_data.root.size = request.fh->size;
-                memcpy(nfs_data.root.data, fh.data, fh.size);
+                memcpy(&nfs_data.root.data, request.fh->data, request.fh->size);
        }
+        nfs_free_fhandle(request.fh);
+out:
        return status;
 }
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index e2975939126a..a3654e57b589 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -60,16 +60,10 @@ nfs_create_request(struct nfs_open_context *ctx, struct inode *inode,
 {
        struct nfs_page         *req;
-        for (;;) {
+        /* try to allocate the request struct */
-                /* try to allocate the request struct */
+        req = nfs_page_alloc();
-                req = nfs_page_alloc();
+        if (req == NULL)
-                if (req != NULL)
+                return ERR_PTR(-ENOMEM);
-                        break;
-                if (fatal_signal_pending(current))
-                        return ERR_PTR(-ERESTARTSYS);
-                yield();
-        }
        /* Initialize the request struct. Initially, we assume a
         * long write-back delay. This will be adjusted in
@@ -112,12 +106,10 @@ void nfs_unlock_request(struct nfs_page *req)
 */
 int nfs_set_page_tag_locked(struct nfs_page *req)
 {
-        struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
        if (!nfs_lock_request_dontget(req))
                return 0;
        if (req->wb_page != NULL)
-                radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+                radix_tree_tag_set(&NFS_I(req->wb_context->path.dentry->d_inode)->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
        return 1;
 }
@@ -126,10 +118,10 @@ int nfs_set_page_tag_locked(struct nfs_page *req)
 */
 void nfs_clear_page_tag_locked(struct nfs_page *req)
 {
-        struct inode *inode = req->wb_context->path.dentry->d_inode;
-        struct nfs_inode *nfsi = NFS_I(inode);
        if (req->wb_page != NULL) {
+                struct inode *inode = req->wb_context->path.dentry->d_inode;
+                struct nfs_inode *nfsi = NFS_I(inode);
                spin_lock(&inode->i_lock);
                radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
                nfs_unlock_request(req);
@@ -142,16 +134,22 @@ void nfs_clear_page_tag_locked(struct nfs_page *req)
 * nfs_clear_request - Free up all resources allocated to the request
 * @req:
 *
- * Release page resources associated with a write request after it
+ * Release page and open context resources associated with a read/write
- * has completed.
+ * request after it has completed.
 */
 void nfs_clear_request(struct nfs_page *req)
 {
        struct page *page = req->wb_page;
+        struct nfs_open_context *ctx = req->wb_context;
        if (page != NULL) {
                page_cache_release(page);
                req->wb_page = NULL;
        }
+        if (ctx != NULL) {
+                put_nfs_open_context(ctx);
+                req->wb_context = NULL;
+        }
 }
@@ -165,9 +163,8 @@ static void nfs_free_request(struct kref *kref)
 {
        struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
-        /* Release struct file or cached credential */
+        /* Release struct file and open context */
        nfs_clear_request(req);
-        put_nfs_open_context(req->wb_context);
        nfs_page_free(req);
 }
@@ -176,6 +173,12 @@ void nfs_release_request(struct nfs_page *req)
        kref_put(&req->wb_kref, nfs_free_request);
 }
+static int nfs_wait_bit_uninterruptible(void *word)
+{
+        io_schedule();
+        return 0;
+}
 /**
 * nfs_wait_on_request - Wait for a request to complete.
 * @req: request to wait upon.
@@ -186,14 +189,9 @@ void nfs_release_request(struct nfs_page *req)
 int
 nfs_wait_on_request(struct nfs_page *req)
 {
-        int ret = 0;
+        return wait_on_bit(&req->wb_flags, PG_BUSY,
+                        nfs_wait_bit_uninterruptible,
-        if (!test_bit(PG_BUSY, &req->wb_flags))
+                        TASK_UNINTERRUPTIBLE);
-                goto out;
-        ret = out_of_line_wait_on_bit(&req->wb_flags, PG_BUSY,
-                        nfs_wait_bit_killable, TASK_KILLABLE);
-out:
-        return ret;
 }
 /**
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index ef583854d8d0..611bec22f552 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -29,7 +29,6 @@
 #include <linux/types.h>
 #include <linux/param.h>
-#include <linux/slab.h>
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/errno.h>
@@ -47,6 +46,39 @@
 #define NFSDBG_FACILITY         NFSDBG_PROC
 /*
+ * wrapper to handle the -EKEYEXPIRED error message. This should generally
+ * only happen if using krb5 auth and a user's TGT expires. NFSv2 doesn't
+ * support the NFSERR_JUKEBOX error code, but we handle this situation in the
+ * same way that we handle that error with NFSv3.
+ */
+static int
+nfs_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
+{
+        int res;
+        do {
+                res = rpc_call_sync(clnt, msg, flags);
+                if (res != -EKEYEXPIRED)
+                        break;
+                schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
+                res = -ERESTARTSYS;
+        } while (!fatal_signal_pending(current));
+        return res;
+}
+#define rpc_call_sync(clnt, msg, flags) nfs_rpc_wrapper(clnt, msg, flags)
+static int
+nfs_async_handle_expired_key(struct rpc_task *task)
+{
+        if (task->tk_status != -EKEYEXPIRED)
+                return 0;
+        task->tk_status = 0;
+        rpc_restart_call(task);
+        rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
+        return 1;
+}
+/*
 * Bare-bones access to getattr: this is for nfs_read_super.
 */
 static int
@@ -192,35 +224,60 @@ static int nfs_proc_readlink(struct inode *inode, struct page *page,
        return status;
 }
+struct nfs_createdata {
+        struct nfs_createargs arg;
+        struct nfs_diropok res;
+        struct nfs_fh fhandle;
+        struct nfs_fattr fattr;
+};
+static struct nfs_createdata *nfs_alloc_createdata(struct inode *dir,
+                struct dentry *dentry, struct iattr *sattr)
+{
+        struct nfs_createdata *data;
+        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        if (data != NULL) {
+                data->arg.fh = NFS_FH(dir);
+                data->arg.name = dentry->d_name.name;
+                data->arg.len = dentry->d_name.len;
+                data->arg.sattr = sattr;
+                nfs_fattr_init(&data->fattr);
+                data->fhandle.size = 0;
+                data->res.fh = &data->fhandle;
+                data->res.fattr = &data->fattr;
+        }
+        return data;
+};
+static void nfs_free_createdata(const struct nfs_createdata *data)
+{
+        kfree(data);
+}
 static int
 nfs_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                int flags, struct nameidata *nd)
 {
-        struct nfs_fh           fhandle;
+        struct nfs_createdata *data;
-        struct nfs_fattr        fattr;
-        struct nfs_createargs   arg = {
-                .fh             = NFS_FH(dir),
-                .name           = dentry->d_name.name,
-                .len            = dentry->d_name.len,
-                .sattr          = sattr
-        };
-        struct nfs_diropok      res = {
-                .fh             = &fhandle,
-                .fattr          = &fattr
-        };
        struct rpc_message msg = {
                .rpc_proc       = &nfs_procedures[NFSPROC_CREATE],
-                .rpc_argp       = &arg,
-                .rpc_resp       = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
-        nfs_fattr_init(&fattr);
        dprintk("NFS call  create %s\n", dentry->d_name.name);
+        data = nfs_alloc_createdata(dir, dentry, sattr);
+        if (data == NULL)
+                goto out;
+        msg.rpc_argp = &data->arg;
+        msg.rpc_resp = &data->res;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        nfs_mark_for_revalidate(dir);
        if (status == 0)
-                status = nfs_instantiate(dentry, &fhandle, &fattr);
+                status = nfs_instantiate(dentry, data->res.fh, data->res.fattr);
+        nfs_free_createdata(data);
+out:
        dprintk("NFS reply create: %d\n", status);
        return status;
 }
@@ -232,24 +289,12 @@ static int
 nfs_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
               dev_t rdev)
 {
-        struct nfs_fh fhandle;
+        struct nfs_createdata *data;
-        struct nfs_fattr fattr;
-        struct nfs_createargs   arg = {
-                .fh             = NFS_FH(dir),
-                .name           = dentry->d_name.name,
-                .len            = dentry->d_name.len,
-                .sattr          = sattr
-        };
-        struct nfs_diropok      res = {
-                .fh             = &fhandle,
-                .fattr          = &fattr
-        };
        struct rpc_message msg = {
                .rpc_proc       = &nfs_procedures[NFSPROC_CREATE],
-                .rpc_argp       = &arg,
-                .rpc_resp       = &res,
        };
-        int status, mode;
+        umode_t mode;
+        int status = -ENOMEM;
        dprintk("NFS call  mknod %s\n", dentry->d_name.name);
@@ -262,17 +307,24 @@ nfs_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                sattr->ia_size = new_encode_dev(rdev);/* get out your barf bag */
        }
-        nfs_fattr_init(&fattr);
+        data = nfs_alloc_createdata(dir, dentry, sattr);
+        if (data == NULL)
+                goto out;
+        msg.rpc_argp = &data->arg;
+        msg.rpc_resp = &data->res;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        nfs_mark_for_revalidate(dir);
        if (status == -EINVAL && S_ISFIFO(mode)) {
                sattr->ia_mode = mode;
-                nfs_fattr_init(&fattr);
+                nfs_fattr_init(data->res.fattr);
                status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        }
        if (status == 0)
-                status = nfs_instantiate(dentry, &fhandle, &fattr);
+                status = nfs_instantiate(dentry, data->res.fh, data->res.fattr);
+        nfs_free_createdata(data);
+out:
        dprintk("NFS reply mknod: %d\n", status);
        return status;
 }
@@ -307,6 +359,8 @@ nfs_proc_unlink_setup(struct rpc_message *msg, struct inode *dir)
 static int nfs_proc_unlink_done(struct rpc_task *task, struct inode *dir)
 {
+        if (nfs_async_handle_expired_key(task))
+                return 0;
        nfs_mark_for_revalidate(dir);
        return 1;
 }
@@ -364,8 +418,8 @@ static int
 nfs_proc_symlink(struct inode *dir, struct dentry *dentry, struct page *page,
                 unsigned int len, struct iattr *sattr)
 {
-        struct nfs_fh fhandle;
+        struct nfs_fh *fh;
-        struct nfs_fattr fattr;
+        struct nfs_fattr *fattr;
        struct nfs_symlinkargs  arg = {
                .fromfh         = NFS_FH(dir),
                .fromname       = dentry->d_name.name,
@@ -378,12 +432,18 @@ nfs_proc_symlink(struct inode *dir, struct dentry *dentry, struct page *page,
                .rpc_proc       = &nfs_procedures[NFSPROC_SYMLINK],
                .rpc_argp       = &arg,
        };
-        int                     status;
+        int status = -ENAMETOOLONG;
+        dprintk("NFS call  symlink %s\n", dentry->d_name.name);
        if (len > NFS2_MAXPATHLEN)
-                return -ENAMETOOLONG;
+                goto out;
-        dprintk("NFS call  symlink %s\n", dentry->d_name.name);
+        fh = nfs_alloc_fhandle();
+        fattr = nfs_alloc_fattr();
+        status = -ENOMEM;
+        if (fh == NULL || fattr == NULL)
+                goto out;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        nfs_mark_for_revalidate(dir);
@@ -393,12 +453,12 @@ nfs_proc_symlink(struct inode *dir, struct dentry *dentry, struct page *page,
         * filehandle size to zero indicates to nfs_instantiate that it
         * should fill in the data with a LOOKUP call on the wire.
         */
-        if (status == 0) {
+        if (status == 0)
-                nfs_fattr_init(&fattr);
+                status = nfs_instantiate(dentry, fh, fattr);
-                fhandle.size = 0;
-                status = nfs_instantiate(dentry, &fhandle, &fattr);
-        }
+        nfs_free_fattr(fattr);
+        nfs_free_fhandle(fh);
+out:
        dprintk("NFS reply symlink: %d\n", status);
        return status;
 }
@@ -406,31 +466,25 @@ nfs_proc_symlink(struct inode *dir, struct dentry *dentry, struct page *page,
 static int
 nfs_proc_mkdir(struct inode *dir, struct dentry *dentry, struct iattr *sattr)
 {
-        struct nfs_fh fhandle;
+        struct nfs_createdata *data;
-        struct nfs_fattr fattr;
-        struct nfs_createargs   arg = {
-                .fh             = NFS_FH(dir),
-                .name           = dentry->d_name.name,
-                .len            = dentry->d_name.len,
-                .sattr          = sattr
-        };
-        struct nfs_diropok      res = {
-                .fh             = &fhandle,
-                .fattr          = &fattr
-        };
        struct rpc_message msg = {
                .rpc_proc       = &nfs_procedures[NFSPROC_MKDIR],
-                .rpc_argp       = &arg,
-                .rpc_resp       = &res,
        };
-        int                     status;
+        int status = -ENOMEM;
        dprintk("NFS call  mkdir %s\n", dentry->d_name.name);
-        nfs_fattr_init(&fattr);
+        data = nfs_alloc_createdata(dir, dentry, sattr);
+        if (data == NULL)
+                goto out;
+        msg.rpc_argp = &data->arg;
+        msg.rpc_resp = &data->res;
        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
        nfs_mark_for_revalidate(dir);
        if (status == 0)
-                status = nfs_instantiate(dentry, &fhandle, &fattr);
+                status = nfs_instantiate(dentry, data->res.fh, data->res.fattr);
+        nfs_free_createdata(data);
+out:
        dprintk("NFS reply mkdir: %d\n", status);
        return status;
 }
@@ -560,6 +614,9 @@ nfs_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
 static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
 {
+        if (nfs_async_handle_expired_key(task))
+                return -EAGAIN;
        nfs_invalidate_atime(data->inode);
        if (task->tk_status >= 0) {
                nfs_refresh_inode(data->inode, data->res.fattr);
@@ -579,6 +636,9 @@ static void nfs_proc_read_setup(struct nfs_read_data *data, struct rpc_message *
 static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
 {
+        if (nfs_async_handle_expired_key(task))
+                return -EAGAIN;
        if (task->tk_status >= 0)
                nfs_post_op_update_inode_force_wcc(data->inode, data->res.fattr);
        return 0;
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index db9b360ae19d..6e2b06e6ca79 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -40,7 +40,7 @@ static mempool_t *nfs_rdata_mempool;
 struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
 {
-        struct nfs_read_data *p = mempool_alloc(nfs_rdata_mempool, GFP_NOFS);
+        struct nfs_read_data *p = mempool_alloc(nfs_rdata_mempool, GFP_KERNEL);
        if (p) {
                memset(p, 0, sizeof(*p));
@@ -50,7 +50,7 @@ struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
                if (pagecount <= ARRAY_SIZE(p->page_array))
                        p->pagevec = p->page_array;
                else {
-                        p->pagevec = kcalloc(pagecount, sizeof(struct page *), GFP_NOFS);
+                        p->pagevec = kcalloc(pagecount, sizeof(struct page *), GFP_KERNEL);
                        if (!p->pagevec) {
                                mempool_free(p, nfs_rdata_mempool);
                                p = NULL;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ce907efc5508..f9df16de4a56 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -48,6 +48,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/netdevice.h>
 #include <linux/nfs_xdr.h>
@@ -140,7 +141,6 @@ static const match_table_t nfs_mount_option_tokens = {
        { Opt_resvport, "resvport" },
        { Opt_noresvport, "noresvport" },
        { Opt_fscache, "fsc" },
-        { Opt_fscache_uniq, "fsc=%s" },
        { Opt_nofscache, "nofsc" },
        { Opt_port, "port=%s" },
@@ -170,6 +170,7 @@ static const match_table_t nfs_mount_option_tokens = {
        { Opt_mountaddr, "mountaddr=%s" },
        { Opt_lookupcache, "lookupcache=%s" },
+        { Opt_fscache_uniq, "fsc=%s" },
        { Opt_err, NULL }
 };
@@ -243,6 +244,7 @@ static int  nfs_show_stats(struct seq_file *, struct vfsmount *);
 static int nfs_get_sb(struct file_system_type *, int, const char *, void *, struct vfsmount *);
 static int nfs_xdev_get_sb(struct file_system_type *fs_type,
                int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt);
+static void nfs_put_super(struct super_block *);
 static void nfs_kill_super(struct super_block *);
 static int nfs_remount(struct super_block *sb, int *flags, char *raw_data);
@@ -266,6 +268,7 @@ static const struct super_operations nfs_sops = {
        .alloc_inode    = nfs_alloc_inode,
        .destroy_inode  = nfs_destroy_inode,
        .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
        .statfs         = nfs_statfs,
        .clear_inode    = nfs_clear_inode,
        .umount_begin   = nfs_umount_begin,
@@ -335,6 +338,7 @@ static const struct super_operations nfs4_sops = {
        .alloc_inode    = nfs_alloc_inode,
        .destroy_inode  = nfs_destroy_inode,
        .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
        .statfs         = nfs_statfs,
        .clear_inode    = nfs4_clear_inode,
        .umount_begin   = nfs_umount_begin,
@@ -419,15 +423,19 @@ static int nfs_statfs(struct dentry *dentry, struct kstatfs *buf)
        unsigned char blockbits;
        unsigned long blockres;
        struct nfs_fh *fh = NFS_FH(dentry->d_inode);
-        struct nfs_fattr fattr;
+        struct nfs_fsstat res;
-        struct nfs_fsstat res = {
+        int error = -ENOMEM;
-                        .fattr = &fattr,
-        };
+        res.fattr = nfs_alloc_fattr();
-        int error;
+        if (res.fattr == NULL)
+                goto out_err;
        error = server->nfs_client->rpc_ops->statfs(server, fh, &res);
+        nfs_free_fattr(res.fattr);
        if (error < 0)
                goto out_err;
        buf->f_type = NFS_SUPER_MAGIC;
        /*
@@ -562,6 +570,22 @@ static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
        nfs_show_mountd_netid(m, nfss, showdefaults);
 }
+#ifdef CONFIG_NFS_V4
+static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
+                                    int showdefaults)
+{
+        struct nfs_client *clp = nfss->nfs_client;
+        seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
+        seq_printf(m, ",minorversion=%u", clp->cl_minorversion);
+}
+#else
+static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
+                                    int showdefaults)
+{
+}
+#endif
 /*
 * Describe the mount options in force on this server representation
 */
@@ -623,11 +647,9 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,
        if (version != 4)
                nfs_show_mountd_options(m, nfss, showdefaults);
+        else
+                nfs_show_nfsv4_options(m, nfss, showdefaults);
-#ifdef CONFIG_NFS_V4
-        if (clp->rpc_ops->version == 4)
-                seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
-#endif
        if (nfss->options & NFS_OPTION_FSCACHE)
                seq_printf(m, ",fsc");
 }
@@ -1042,14 +1064,6 @@ static int nfs_parse_mount_options(char *raw,
                        kfree(mnt->fscache_uniq);
                        mnt->fscache_uniq = NULL;
                        break;
-                case Opt_fscache_uniq:
-                        string = match_strdup(args);
-                        if (!string)
-                                goto out_nomem;
-                        kfree(mnt->fscache_uniq);
-                        mnt->fscache_uniq = string;
-                        mnt->options |= NFS_OPTION_FSCACHE;
-                        break;
                /*
                 * options that take numeric values
@@ -1060,7 +1074,7 @@ static int nfs_parse_mount_options(char *raw,
                                goto out_nomem;
                        rc = strict_strtoul(string, 10, &option);
                        kfree(string);
-                        if (rc != 0 || option > USHORT_MAX)
+                        if (rc != 0 || option > USHRT_MAX)
                                goto out_invalid_value;
                        mnt->nfs_server.port = option;
                        break;
@@ -1181,7 +1195,7 @@ static int nfs_parse_mount_options(char *raw,
                                goto out_nomem;
                        rc = strict_strtoul(string, 10, &option);
                        kfree(string);
-                        if (rc != 0 || option > USHORT_MAX)
+                        if (rc != 0 || option > USHRT_MAX)
                                goto out_invalid_value;
                        mnt->mount_server.port = option;
                        break;
@@ -1380,6 +1394,14 @@ static int nfs_parse_mount_options(char *raw,
                                        return 0;
                        };
                        break;
+                case Opt_fscache_uniq:
+                        string = match_strdup(args);
+                        if (string == NULL)
+                                goto out_nomem;
+                        kfree(mnt->fscache_uniq);
+                        mnt->fscache_uniq = string;
+                        mnt->options |= NFS_OPTION_FSCACHE;
+                        break;
                /*
                 * Special options
@@ -2168,7 +2190,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        int error = -ENOMEM;
        data = nfs_alloc_parsed_mount_data(3);
-        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        mntfh = nfs_alloc_fhandle();
        if (data == NULL || mntfh == NULL)
                goto out_free_fh;
@@ -2183,6 +2205,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        if (data->version == 4) {
                error = nfs4_try_mount(flags, dev_name, data, mnt);
                kfree(data->client_address);
+                kfree(data->nfs_server.export_path);
                goto out;
        }
 #endif  /* CONFIG_NFS_V4 */
@@ -2211,7 +2234,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        } else {
                error = nfs_bdi_register(server);
                if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
        }
        if (!s->s_root) {
@@ -2242,7 +2265,7 @@ out:
        kfree(data->fscache_uniq);
        security_free_mnt_opts(&data->lsm_opts);
 out_free_fh:
-        kfree(mntfh);
+        nfs_free_fhandle(mntfh);
        kfree(data);
        return error;
@@ -2253,11 +2276,25 @@ out_err_nosb:
 error_splat_root:
        dput(mntroot);
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
        deactivate_locked_super(s);
        goto out;
 }
 /*
+ * Ensure that we unregister the bdi before kill_anon_super
+ * releases the device name
+ */
+static void nfs_put_super(struct super_block *s)
+{
+        struct nfs_server *server = NFS_SB(s);
+        bdi_unregister(&server->backing_dev_info);
+}
+/*
 * Destroy an NFS2/3 superblock
 */
 static void nfs_kill_super(struct super_block *s)
@@ -2265,7 +2302,6 @@ static void nfs_kill_super(struct super_block *s)
        struct nfs_server *server = NFS_SB(s);
        kill_anon_super(s);
-        bdi_unregister(&server->backing_dev_info);
        nfs_fscache_release_super_cookie(s);
        nfs_free_server(server);
 }
@@ -2313,7 +2349,7 @@ static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
        } else {
                error = nfs_bdi_register(server);
                if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
        }
        if (!s->s_root) {
@@ -2350,6 +2386,9 @@ out_err_noserver:
        return error;
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
        deactivate_locked_super(s);
        dprintk("<-- nfs_xdev_get_sb() = %d [splat]\n", error);
        return error;
@@ -2535,7 +2574,7 @@ static int nfs4_remote_get_sb(struct file_system_type *fs_type,
        };
        int error = -ENOMEM;
-        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        mntfh = nfs_alloc_fhandle();
        if (data == NULL || mntfh == NULL)
                goto out_free_fh;
@@ -2565,7 +2604,7 @@ static int nfs4_remote_get_sb(struct file_system_type *fs_type,
        } else {
                error = nfs_bdi_register(server);
                if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
        }
        if (!s->s_root) {
@@ -2593,7 +2632,7 @@ static int nfs4_remote_get_sb(struct file_system_type *fs_type,
 out:
        security_free_mnt_opts(&data->lsm_opts);
 out_free_fh:
-        kfree(mntfh);
+        nfs_free_fhandle(mntfh);
        return error;
 out_free:
@@ -2603,6 +2642,9 @@ out_free:
 error_splat_root:
        dput(mntroot);
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
        deactivate_locked_super(s);
        goto out;
 }
@@ -2634,7 +2676,7 @@ static void nfs_fix_devname(const struct path *path, struct vfsmount *mnt)
        devname = nfs_path(path->mnt->mnt_devname,
                        path->mnt->mnt_root, path->dentry,
                        page, PAGE_SIZE);
-        if (devname == NULL)
+        if (IS_ERR(devname))
                goto out_freepage;
        tmp = kstrdup(devname, GFP_KERNEL);
        if (tmp == NULL)
@@ -2645,41 +2687,120 @@ out_freepage:
        free_page((unsigned long)page);
 }
+struct nfs_referral_count {
+        struct list_head list;
+        const struct task_struct *task;
+        unsigned int referral_count;
+};
+static LIST_HEAD(nfs_referral_count_list);
+static DEFINE_SPINLOCK(nfs_referral_count_list_lock);
+static struct nfs_referral_count *nfs_find_referral_count(void)
+{
+        struct nfs_referral_count *p;
+        list_for_each_entry(p, &nfs_referral_count_list, list) {
+                if (p->task == current)
+                        return p;
+        }
+        return NULL;
+}
+#define NFS_MAX_NESTED_REFERRALS 2
+static int nfs_referral_loop_protect(void)
+{
+        struct nfs_referral_count *p, *new;
+        int ret = -ENOMEM;
+        new = kmalloc(sizeof(*new), GFP_KERNEL);
+        if (!new)
+                goto out;
+        new->task = current;
+        new->referral_count = 1;
+        ret = 0;
+        spin_lock(&nfs_referral_count_list_lock);
+        p = nfs_find_referral_count();
+        if (p != NULL) {
+                if (p->referral_count >= NFS_MAX_NESTED_REFERRALS)
+                        ret = -ELOOP;
+                else
+                        p->referral_count++;
+        } else {
+                list_add(&new->list, &nfs_referral_count_list);
+                new = NULL;
+        }
+        spin_unlock(&nfs_referral_count_list_lock);
+        kfree(new);
+out:
+        return ret;
+}
+static void nfs_referral_loop_unprotect(void)
+{
+        struct nfs_referral_count *p;
+        spin_lock(&nfs_referral_count_list_lock);
+        p = nfs_find_referral_count();
+        p->referral_count--;
+        if (p->referral_count == 0)
+                list_del(&p->list);
+        else
+                p = NULL;
+        spin_unlock(&nfs_referral_count_list_lock);
+        kfree(p);
+}
 static int nfs_follow_remote_path(struct vfsmount *root_mnt,
                const char *export_path, struct vfsmount *mnt_target)
 {
+        struct nameidata *nd = NULL;
        struct mnt_namespace *ns_private;
-        struct nameidata nd;
        struct super_block *s;
        int ret;
+        nd = kmalloc(sizeof(*nd), GFP_KERNEL);
+        if (nd == NULL)
+                return -ENOMEM;
        ns_private = create_mnt_ns(root_mnt);
        ret = PTR_ERR(ns_private);
        if (IS_ERR(ns_private))
                goto out_mntput;
+        ret = nfs_referral_loop_protect();
+        if (ret != 0)
+                goto out_put_mnt_ns;
        ret = vfs_path_lookup(root_mnt->mnt_root, root_mnt,
-                        export_path, LOOKUP_FOLLOW, &nd);
+                        export_path, LOOKUP_FOLLOW, nd);
+        nfs_referral_loop_unprotect();
        put_mnt_ns(ns_private);
        if (ret != 0)
                goto out_err;
-        s = nd.path.mnt->mnt_sb;
+        s = nd->path.mnt->mnt_sb;
        atomic_inc(&s->s_active);
        mnt_target->mnt_sb = s;
-        mnt_target->mnt_root = dget(nd.path.dentry);
+        mnt_target->mnt_root = dget(nd->path.dentry);
        /* Correct the device pathname */
-        nfs_fix_devname(&nd.path, mnt_target);
+        nfs_fix_devname(&nd->path, mnt_target);
-        path_put(&nd.path);
+        path_put(&nd->path);
+        kfree(nd);
        down_write(&s->s_umount);
        return 0;
+out_put_mnt_ns:
+        put_mnt_ns(ns_private);
 out_mntput:
        mntput(root_mnt);
 out_err:
+        kfree(nd);
        return ret;
 }
@@ -2798,7 +2919,7 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags,
        } else {
                error = nfs_bdi_register(server);
                if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
        }
        if (!s->s_root) {
@@ -2834,6 +2955,9 @@ out_err_noserver:
        return error;
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
        deactivate_locked_super(s);
        dprintk("<-- nfs4_xdev_get_sb() = %d [splat]\n", error);
        return error;
@@ -2847,17 +2971,21 @@ static int nfs4_remote_referral_get_sb(struct file_system_type *fs_type,
        struct super_block *s;
        struct nfs_server *server;
        struct dentry *mntroot;
-        struct nfs_fh mntfh;
+        struct nfs_fh *mntfh;
        int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
        struct nfs_sb_mountdata sb_mntdata = {
                .mntflags = flags,
        };
-        int error;
+        int error = -ENOMEM;
        dprintk("--> nfs4_referral_get_sb()\n");
+        mntfh = nfs_alloc_fhandle();
+        if (mntfh == NULL)
+                goto out_err_nofh;
        /* create a new volume representation */
-        server = nfs4_create_referral_server(data, &mntfh);
+        server = nfs4_create_referral_server(data, mntfh);
        if (IS_ERR(server)) {
                error = PTR_ERR(server);
                goto out_err_noserver;
@@ -2880,7 +3008,7 @@ static int nfs4_remote_referral_get_sb(struct file_system_type *fs_type,
        } else {
                error = nfs_bdi_register(server);
                if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
        }
        if (!s->s_root) {
@@ -2889,7 +3017,7 @@ static int nfs4_remote_referral_get_sb(struct file_system_type *fs_type,
                nfs_fscache_get_super_cookie(s, NULL, data);
        }
-        mntroot = nfs4_get_root(s, &mntfh);
+        mntroot = nfs4_get_root(s, mntfh);
        if (IS_ERR(mntroot)) {
                error = PTR_ERR(mntroot);
                goto error_splat_super;
@@ -2906,17 +3034,24 @@ static int nfs4_remote_referral_get_sb(struct file_system_type *fs_type,
        security_sb_clone_mnt_opts(data->sb, s);
+        nfs_free_fhandle(mntfh);
        dprintk("<-- nfs4_referral_get_sb() = 0\n");
        return 0;
 out_err_nosb:
        nfs_free_server(server);
 out_err_noserver:
+        nfs_free_fhandle(mntfh);
+out_err_nofh:
        dprintk("<-- nfs4_referral_get_sb() = %d [error]\n", error);
        return error;
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
        deactivate_locked_super(s);
+        nfs_free_fhandle(mntfh);
        dprintk("<-- nfs4_referral_get_sb() = %d [splat]\n", error);
        return error;
 }
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 412738dbfbc7..05c9e02f4153 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -19,7 +19,6 @@
 #include <linux/pagemap.h>
 #include <linux/stat.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/namei.h>
@@ -50,7 +49,7 @@ static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
        struct page *page;
        void *err;
-        err = ERR_PTR(nfs_revalidate_mapping_nolock(inode, inode->i_mapping));
+        err = ERR_PTR(nfs_revalidate_mapping(inode, inode->i_mapping));
        if (err)
                goto read_failed;
        page = read_cache_page(&inode->i_data, 0,
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index 70e1fbbaaeab..ad4d2e787b20 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -15,8 +15,10 @@
 #include "callback.h"
+#ifdef CONFIG_NFS_V4
 static const int nfs_set_port_min = 0;
 static const int nfs_set_port_max = 65535;
+#endif
 static struct ctl_table_header *nfs_callback_sysctl_table;
 static ctl_table nfs_cb_sysctls[] = {
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 6da3d3ff6edd..a2242af6a17d 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -23,6 +23,7 @@ struct nfs_unlinkdata {
        struct nfs_removeres res;
        struct inode *dir;
        struct rpc_cred *cred;
+        struct nfs_fattr dir_attr;
 };
 /**
@@ -169,7 +170,7 @@ static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct n
        }
        nfs_sb_active(dir->i_sb);
        data->args.fh = NFS_FH(dir);
-        nfs_fattr_init(&data->res.dir_attr);
+        nfs_fattr_init(data->res.dir_attr);
        NFS_PROTO(dir)->unlink_setup(&msg, dir);
@@ -259,6 +260,7 @@ nfs_async_unlink(struct inode *dir, struct dentry *dentry)
                goto out_free;
        }
        data->res.seq_res.sr_slotid = NFS4_MAX_SLOT_TABLE;
+        data->res.dir_attr = &data->dir_attr;
        status = -EBUSY;
        spin_lock(&dentry->d_lock);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index d171696017f4..9f81bdd91c55 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -201,6 +201,7 @@ static int nfs_set_page_writeback(struct page *page)
                struct inode *inode = page->mapping->host;
                struct nfs_server *nfss = NFS_SERVER(inode);
+                page_cache_get(page);
                if (atomic_long_inc_return(&nfss->writeback) >
                                NFS_CONGESTION_ON_THRESH) {
                        set_bdi_congested(&nfss->backing_dev_info,
@@ -216,11 +217,12 @@ static void nfs_end_page_writeback(struct page *page)
        struct nfs_server *nfss = NFS_SERVER(inode);
        end_page_writeback(page);
+        page_cache_release(page);
        if (atomic_long_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH)
                clear_bdi_congested(&nfss->backing_dev_info, BLK_RW_ASYNC);
 }
-static struct nfs_page *nfs_find_and_lock_request(struct page *page)
+static struct nfs_page *nfs_find_and_lock_request(struct page *page, bool nonblock)
 {
        struct inode *inode = page->mapping->host;
        struct nfs_page *req;
@@ -239,7 +241,10 @@ static struct nfs_page *nfs_find_and_lock_request(struct page *page)
                 *       request as dirty (in which case we don't care).
                 */
                spin_unlock(&inode->i_lock);
-                ret = nfs_wait_on_request(req);
+                if (!nonblock)
+                        ret = nfs_wait_on_request(req);
+                else
+                        ret = -EAGAIN;
                nfs_release_request(req);
                if (ret != 0)
                        return ERR_PTR(ret);
@@ -254,12 +259,12 @@ static struct nfs_page *nfs_find_and_lock_request(struct page *page)
 * May return an error if the user signalled nfs_wait_on_request().
 */
 static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
-                                struct page *page)
+                                struct page *page, bool nonblock)
 {
        struct nfs_page *req;
        int ret = 0;
-        req = nfs_find_and_lock_request(page);
+        req = nfs_find_and_lock_request(page, nonblock);
        if (!req)
                goto out;
        ret = PTR_ERR(req);
@@ -281,12 +286,20 @@ out:
 static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, struct nfs_pageio_descriptor *pgio)
 {
        struct inode *inode = page->mapping->host;
+        int ret;
        nfs_inc_stats(inode, NFSIOS_VFSWRITEPAGE);
        nfs_add_stats(inode, NFSIOS_WRITEPAGES, 1);
        nfs_pageio_cond_complete(pgio, page->index);
-        return nfs_page_async_flush(pgio, page);
+        ret = nfs_page_async_flush(pgio, page,
+                        wbc->sync_mode == WB_SYNC_NONE ||
+                        wbc->nonblocking != 0);
+        if (ret == -EAGAIN) {
+                redirty_page_for_writepage(wbc, page);
+                ret = 0;
+        }
+        return ret;
 }
 /*
@@ -421,6 +434,7 @@ static void
 nfs_mark_request_dirty(struct nfs_page *req)
 {
        __set_page_dirty_nobuffers(req->wb_page);
+        __mark_inode_dirty(req->wb_page->mapping->host, I_DIRTY_DATASYNC);
 }
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
@@ -438,6 +452,7 @@ nfs_mark_request_commit(struct nfs_page *req)
        radix_tree_tag_set(&nfsi->nfs_page_tree,
                        req->wb_index,
                        NFS_PAGE_TAG_COMMIT);
+        nfsi->ncommit++;
        spin_unlock(&inode->i_lock);
        inc_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
        inc_bdi_stat(req->wb_page->mapping->backing_dev_info, BDI_RECLAIMABLE);
@@ -501,57 +516,6 @@ int nfs_reschedule_unstable_write(struct nfs_page *req)
 }
 #endif
-/*
- * Wait for a request to complete.
- *
- * Interruptible by fatal signals only.
- */
-static int nfs_wait_on_requests_locked(struct inode *inode, pgoff_t idx_start, unsigned int npages)
-{
-        struct nfs_inode *nfsi = NFS_I(inode);
-        struct nfs_page *req;
-        pgoff_t idx_end, next;
-        unsigned int            res = 0;
-        int                     error;
-        if (npages == 0)
-                idx_end = ~0;
-        else
-                idx_end = idx_start + npages - 1;
-        next = idx_start;
-        while (radix_tree_gang_lookup_tag(&nfsi->nfs_page_tree, (void **)&req, next, 1, NFS_PAGE_TAG_LOCKED)) {
-                if (req->wb_index > idx_end)
-                        break;
-                next = req->wb_index + 1;
-                BUG_ON(!NFS_WBACK_BUSY(req));
-                kref_get(&req->wb_kref);
-                spin_unlock(&inode->i_lock);
-                error = nfs_wait_on_request(req);
-                nfs_release_request(req);
-                spin_lock(&inode->i_lock);
-                if (error < 0)
-                        return error;
-                res++;
-        }
-        return res;
-}
-static void nfs_cancel_commit_list(struct list_head *head)
-{
-        struct nfs_page *req;
-        while(!list_empty(head)) {
-                req = nfs_list_entry(head->next);
-                nfs_list_remove_request(req);
-                nfs_clear_request_commit(req);
-                nfs_inode_remove_request(req);
-                nfs_unlock_request(req);
-        }
-}
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
 static int
 nfs_need_commit(struct nfs_inode *nfsi)
@@ -573,11 +537,17 @@ static int
 nfs_scan_commit(struct inode *inode, struct list_head *dst, pgoff_t idx_start, unsigned int npages)
 {
        struct nfs_inode *nfsi = NFS_I(inode);
+        int ret;
        if (!nfs_need_commit(nfsi))
                return 0;
-        return nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
+        ret = nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
+        if (ret > 0)
+                nfsi->ncommit -= ret;
+        if (nfs_need_commit(NFS_I(inode)))
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+        return ret;
 }
 #else
 static inline int nfs_need_commit(struct nfs_inode *nfsi)
@@ -642,9 +612,10 @@ static struct nfs_page *nfs_try_to_update_request(struct inode *inode,
                spin_lock(&inode->i_lock);
        }
-        if (nfs_clear_request_commit(req))
+        if (nfs_clear_request_commit(req) &&
-                radix_tree_tag_clear(&NFS_I(inode)->nfs_page_tree,
+                        radix_tree_tag_clear(&NFS_I(inode)->nfs_page_tree,
-                                req->wb_index, NFS_PAGE_TAG_COMMIT);
+                                req->wb_index, NFS_PAGE_TAG_COMMIT) != NULL)
+                NFS_I(inode)->ncommit--;
        /* Okay, the request matches. Update the region */
        if (offset < req->wb_offset) {
@@ -703,9 +674,11 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
        req = nfs_setup_write_request(ctx, page, offset, count);
        if (IS_ERR(req))
                return PTR_ERR(req);
+        nfs_mark_request_dirty(req);
        /* Update file length */
        nfs_grow_file(page, offset, count);
        nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
+        nfs_mark_request_dirty(req);
        nfs_clear_page_tag_locked(req);
        return 0;
 }
@@ -782,8 +755,6 @@ int nfs_updatepage(struct file *file, struct page *page,
        status = nfs_writepage_setup(ctx, page, offset, count);
        if (status < 0)
                nfs_set_pageerror(page);
-        else
-                __set_page_dirty_nobuffers(page);
        dprintk("NFS:       nfs_updatepage returns %d (isize %lld)\n",
                        status, (long long)i_size_read(inode));
@@ -792,13 +763,12 @@ int nfs_updatepage(struct file *file, struct page *page,
 static void nfs_writepage_release(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
-        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req)) {
+        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req))
-                nfs_end_page_writeback(req->wb_page);
                nfs_inode_remove_request(req);
-        } else
-                nfs_end_page_writeback(req->wb_page);
        nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 static int flush_task_priority(int how)
@@ -822,7 +792,6 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                int how)
 {
        struct inode *inode = req->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
        int priority = flush_task_priority(how);
        struct rpc_task *task;
        struct rpc_message msg = {
@@ -837,9 +806,10 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                .callback_ops = call_ops,
                .callback_data = data,
                .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                .priority = priority,
        };
+        int ret = 0;
        /* Set up the RPC argument and reply structs
         * NB: take care not to mess about with data->commit et al. */
@@ -878,10 +848,18 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                (unsigned long long)data->args.offset);
        task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task))
+        if (IS_ERR(task)) {
-                return PTR_ERR(task);
+                ret = PTR_ERR(task);
+                goto out;
+        }
+        if (how & FLUSH_SYNC) {
+                ret = rpc_wait_for_completion_task(task);
+                if (ret == 0)
+                        ret = task->tk_status;
+        }
        rpc_put_task(task);
-        return 0;
+out:
+        return ret;
 }
 /* If a nfs_flush_* function fails, it should remove reqs from @head and
@@ -890,9 +868,11 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
 */
 static void nfs_redirty_request(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
        nfs_mark_request_dirty(req);
-        nfs_end_page_writeback(req->wb_page);
        nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 /*
@@ -1127,16 +1107,15 @@ static void nfs_writeback_release_full(void *calldata)
                if (nfs_write_need_commit(data)) {
                        memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
                        nfs_mark_request_commit(req);
-                        nfs_end_page_writeback(page);
                        dprintk(" marked for commit\n");
                        goto next;
                }
                dprintk(" OK\n");
 remove_request:
-                nfs_end_page_writeback(page);
                nfs_inode_remove_request(req);
        next:
                nfs_clear_page_tag_locked(req);
+                nfs_end_page_writeback(page);
        }
        nfs_writedata_release(calldata);
 }
@@ -1233,7 +1212,26 @@ int nfs_writeback_done(struct rpc_task *task, struct nfs_write_data *data)
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-void nfs_commitdata_release(void *data)
+static int nfs_commit_set_lock(struct nfs_inode *nfsi, int may_wait)
+{
+        if (!test_and_set_bit(NFS_INO_COMMIT, &nfsi->flags))
+                return 1;
+        if (may_wait && !out_of_line_wait_on_bit_lock(&nfsi->flags,
+                                NFS_INO_COMMIT, nfs_wait_bit_killable,
+                                TASK_KILLABLE))
+                return 1;
+        return 0;
+}
+static void nfs_commit_clear_lock(struct nfs_inode *nfsi)
+{
+        clear_bit(NFS_INO_COMMIT, &nfsi->flags);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&nfsi->flags, NFS_INO_COMMIT);
+}
+static void nfs_commitdata_release(void *data)
 {
        struct nfs_write_data *wdata = data;
@@ -1250,7 +1248,6 @@ static int nfs_commit_rpcsetup(struct list_head *head,
 {
        struct nfs_page *first = nfs_list_entry(head->next);
        struct inode *inode = first->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
        int priority = flush_task_priority(how);
        struct rpc_task *task;
        struct rpc_message msg = {
@@ -1265,7 +1262,7 @@ static int nfs_commit_rpcsetup(struct list_head *head,
                .callback_ops = &nfs_commit_ops,
                .callback_data = data,
                .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                .priority = priority,
        };
@@ -1325,6 +1322,7 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how)
                                BDI_RECLAIMABLE);
                nfs_clear_page_tag_locked(req);
        }
+        nfs_commit_clear_lock(NFS_I(inode));
        return -ENOMEM;
 }
@@ -1380,6 +1378,7 @@ static void nfs_commit_release(void *calldata)
        next:
                nfs_clear_page_tag_locked(req);
        }
+        nfs_commit_clear_lock(NFS_I(data->inode));
        nfs_commitdata_release(calldata);
 }
@@ -1394,8 +1393,11 @@ static const struct rpc_call_ops nfs_commit_ops = {
 int nfs_commit_inode(struct inode *inode, int how)
 {
        LIST_HEAD(head);
-        int res;
+        int may_wait = how & FLUSH_SYNC;
+        int res = 0;
+        if (!nfs_commit_set_lock(NFS_I(inode), may_wait))
+                goto out_mark_dirty;
        spin_lock(&inode->i_lock);
        res = nfs_scan_commit(inode, &head, 0, 0);
        spin_unlock(&inode->i_lock);
@@ -1403,95 +1405,64 @@ int nfs_commit_inode(struct inode *inode, int how)
                int error = nfs_commit_list(inode, &head, how);
                if (error < 0)
                        return error;
-        }
+                if (may_wait)
+                        wait_on_bit(&NFS_I(inode)->flags, NFS_INO_COMMIT,
+                                        nfs_wait_bit_killable,
+                                        TASK_KILLABLE);
+                else
+                        goto out_mark_dirty;
+        } else
+                nfs_commit_clear_lock(NFS_I(inode));
+        return res;
+        /* Note: If we exit without ensuring that the commit is complete,
+         * we must mark the inode as dirty. Otherwise, future calls to
+         * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure
+         * that the data is on the disk.
+         */
+out_mark_dirty:
+        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
        return res;
 }
-#else
-static inline int nfs_commit_list(struct inode *inode, struct list_head *head, int how)
-{
-        return 0;
-}
-#endif
-long nfs_sync_mapping_wait(struct address_space *mapping, struct writeback_control *wbc, int how)
+static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
-        struct inode *inode = mapping->host;
+        struct nfs_inode *nfsi = NFS_I(inode);
-        pgoff_t idx_start, idx_end;
+        int flags = FLUSH_SYNC;
-        unsigned int npages = 0;
+        int ret = 0;
-        LIST_HEAD(head);
-        int nocommit = how & FLUSH_NOCOMMIT;
+        /* Don't commit yet if this is a non-blocking flush and there are
-        long pages, ret;
+         * lots of outstanding writes for this mapping.
+         */
-        /* FIXME */
+        if (wbc->sync_mode == WB_SYNC_NONE &&
-        if (wbc->range_cyclic)
+            nfsi->ncommit <= (nfsi->npages >> 1))
-                idx_start = 0;
+                goto out_mark_dirty;
-        else {
-                idx_start = wbc->range_start >> PAGE_CACHE_SHIFT;
+        if (wbc->nonblocking || wbc->for_background)
-                idx_end = wbc->range_end >> PAGE_CACHE_SHIFT;
+                flags = 0;
-                if (idx_end > idx_start) {
+        ret = nfs_commit_inode(inode, flags);
-                        pgoff_t l_npages = 1 + idx_end - idx_start;
+        if (ret >= 0) {
-                        npages = l_npages;
+                if (wbc->sync_mode == WB_SYNC_NONE) {
-                        if (sizeof(npages) != sizeof(l_npages) &&
+                        if (ret < wbc->nr_to_write)
-                                        (pgoff_t)npages != l_npages)
+                                wbc->nr_to_write -= ret;
-                                npages = 0;
+                        else
+                                wbc->nr_to_write = 0;
                }
+                return 0;
        }
-        how &= ~FLUSH_NOCOMMIT;
+out_mark_dirty:
-        spin_lock(&inode->i_lock);
+        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        do {
-                ret = nfs_wait_on_requests_locked(inode, idx_start, npages);
-                if (ret != 0)
-                        continue;
-                if (nocommit)
-                        break;
-                pages = nfs_scan_commit(inode, &head, idx_start, npages);
-                if (pages == 0)
-                        break;
-                if (how & FLUSH_INVALIDATE) {
-                        spin_unlock(&inode->i_lock);
-                        nfs_cancel_commit_list(&head);
-                        ret = pages;
-                        spin_lock(&inode->i_lock);
-                        continue;
-                }
-                pages += nfs_scan_commit(inode, &head, 0, 0);
-                spin_unlock(&inode->i_lock);
-                ret = nfs_commit_list(inode, &head, how);
-                spin_lock(&inode->i_lock);
-        } while (ret >= 0);
-        spin_unlock(&inode->i_lock);
        return ret;
 }
+#else
-static int __nfs_write_mapping(struct address_space *mapping, struct writeback_control *wbc, int how)
+static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
-        int ret;
-        ret = nfs_writepages(mapping, wbc);
-        if (ret < 0)
-                goto out;
-        ret = nfs_sync_mapping_wait(mapping, wbc, how);
-        if (ret < 0)
-                goto out;
        return 0;
-out:
-        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
-        return ret;
 }
+#endif
-/* Two pass sync: first using WB_SYNC_NONE, then WB_SYNC_ALL */
+int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
-static int nfs_write_mapping(struct address_space *mapping, int how)
 {
-        struct writeback_control wbc = {
+        return nfs_commit_unstable_pages(inode, wbc);
-                .bdi = mapping->backing_dev_info,
-                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
-                .range_start = 0,
-                .range_end = LLONG_MAX,
-        };
-        return __nfs_write_mapping(mapping, &wbc, how);
 }
 /*
@@ -1499,37 +1470,27 @@ static int nfs_write_mapping(struct address_space *mapping, int how)
 */
 int nfs_wb_all(struct inode *inode)
 {
-        return nfs_write_mapping(inode->i_mapping, 0);
+        struct writeback_control wbc = {
-}
+                .sync_mode = WB_SYNC_ALL,
+                .nr_to_write = LONG_MAX,
+                .range_start = 0,
+                .range_end = LLONG_MAX,
+        };
-int nfs_wb_nocommit(struct inode *inode)
+        return sync_inode(inode, &wbc);
-{
-        return nfs_write_mapping(inode->i_mapping, FLUSH_NOCOMMIT);
 }
 int nfs_wb_page_cancel(struct inode *inode, struct page *page)
 {
        struct nfs_page *req;
-        loff_t range_start = page_offset(page);
-        loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
-        struct writeback_control wbc = {
-                .bdi = page->mapping->backing_dev_info,
-                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
-                .range_start = range_start,
-                .range_end = range_end,
-        };
        int ret = 0;
        BUG_ON(!PageLocked(page));
        for (;;) {
+                wait_on_page_writeback(page);
                req = nfs_page_find_request(page);
                if (req == NULL)
-                        goto out;
-                if (test_bit(PG_CLEAN, &req->wb_flags)) {
-                        nfs_release_request(req);
                        break;
-                }
                if (nfs_lock_request_dontget(req)) {
                        nfs_inode_remove_request(req);
                        /*
@@ -1541,55 +1502,47 @@ int nfs_wb_page_cancel(struct inode *inode, struct page *page)
                        break;
                }
                ret = nfs_wait_on_request(req);
+                nfs_release_request(req);
                if (ret < 0)
-                        goto out;
+                        break;
        }
-        if (!PagePrivate(page))
-                return 0;
-        ret = nfs_sync_mapping_wait(page->mapping, &wbc, FLUSH_INVALIDATE);
-out:
        return ret;
 }
-static int nfs_wb_page_priority(struct inode *inode, struct page *page,
+/*
-                                int how)
+ * Write back all requests on one page - we do this before reading it.
+ */
+int nfs_wb_page(struct inode *inode, struct page *page)
 {
        loff_t range_start = page_offset(page);
        loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
        struct writeback_control wbc = {
-                .bdi = page->mapping->backing_dev_info,
                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
+                .nr_to_write = 0,
                .range_start = range_start,
                .range_end = range_end,
        };
        int ret;
-        do {
+        for (;;) {
+                wait_on_page_writeback(page);
                if (clear_page_dirty_for_io(page)) {
                        ret = nfs_writepage_locked(page, &wbc);
                        if (ret < 0)
                                goto out_error;
-                } else if (!PagePrivate(page))
+                        continue;
+                }
+                if (!PagePrivate(page))
                        break;
-                ret = nfs_sync_mapping_wait(page->mapping, &wbc, how);
+                ret = nfs_commit_inode(inode, FLUSH_SYNC);
                if (ret < 0)
                        goto out_error;
-        } while (PagePrivate(page));
+        }
        return 0;
 out_error:
-        __mark_inode_dirty(inode, I_DIRTY_PAGES);
        return ret;
 }
-/*
- * Write back all requests on one page - we do this before reading it.
- */
-int nfs_wb_page(struct inode *inode, struct page* page)
-{
-        return nfs_wb_page_priority(inode, page, FLUSH_STABLE);
-}
 #ifdef CONFIG_MIGRATION
 int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
                struct page *page)
@@ -1597,10 +1550,9 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
        struct nfs_page *req;
        int ret;
-        if (PageFsCache(page))
+        nfs_fscache_release_page(page, GFP_KERNEL);
-                nfs_fscache_release_page(page, GFP_KERNEL);
-        req = nfs_find_and_lock_request(page);
+        req = nfs_find_and_lock_request(page, false);
        ret = PTR_ERR(req);
        if (IS_ERR(req))
                goto out;
author	Michal Marek <mmarek@suse.cz>	2010-08-04 07:59:13 -0400
committer	Michal Marek <mmarek@suse.cz>	2010-08-04 07:59:13 -0400
commit	772320e84588dcbe1600ffb83e5f328f2209ac2a (patch)
tree	a7de21b79340aeaa17c58126f6b801b82c77b53a /fs/nfs
parent	1ce53adf13a54375d2a5c7cdbe341b2558389615 (diff)
parent	9fe6206f400646a2322096b56c59891d530e8d51 (diff)