Merge branch 'master'

89 files changed, 2019 insertions, 1304 deletions

diff --git a/fs/9p/conv.c b/fs/9p/conv.c
index 1554731bd653..18121af99d3e 100644
--- a/fs/9p/conv.c
+++ b/fs/9p/conv.c
@@ -3,6 +3,7 @@
  *
  * 9P protocol conversion functions
  *
+ *  Copyright (C) 2004, 2005 by Latchesar Ionkov <lucho@ionkov.net>
  *  Copyright (C) 2004 by Eric Van Hensbergen <ericvh@gmail.com>
  *  Copyright (C) 2002 by Ron Minnich <rminnich@lanl.gov>
  *
@@ -55,66 +56,70 @@ static inline int buf_check_overflow(struct cbuf *buf)
         return buf->p > buf->ep;
 }
 
-static inline void buf_check_size(struct cbuf *buf, int len)
+static inline int buf_check_size(struct cbuf *buf, int len)
 {
         if (buf->p+len > buf->ep) {
                 if (buf->p < buf->ep) {
                         eprintk(KERN_ERR, "buffer overflow\n");
                         buf->p = buf->ep + 1;
+                        return 0;
                 }
         }
+
+        return 1;
 }
 
 static inline void *buf_alloc(struct cbuf *buf, int len)
 {
         void *ret = NULL;
 
-        buf_check_size(buf, len);
-        ret = buf->p;
-        buf->p += len;
+        if (buf_check_size(buf, len)) {
+                ret = buf->p;
+                buf->p += len;
+        }
 
         return ret;
 }
 
 static inline void buf_put_int8(struct cbuf *buf, u8 val)
 {
-        buf_check_size(buf, 1);
-
-        buf->p[0] = val;
-        buf->p++;
+        if (buf_check_size(buf, 1)) {
+                buf->p[0] = val;
+                buf->p++;
+        }
 }
 
 static inline void buf_put_int16(struct cbuf *buf, u16 val)
 {
-        buf_check_size(buf, 2);
-
-        *(__le16 *) buf->p = cpu_to_le16(val);
-        buf->p += 2;
+        if (buf_check_size(buf, 2)) {
+                *(__le16 *) buf->p = cpu_to_le16(val);
+                buf->p += 2;
+        }
 }
 
 static inline void buf_put_int32(struct cbuf *buf, u32 val)
 {
-        buf_check_size(buf, 4);
-
-        *(__le32 *)buf->p = cpu_to_le32(val);
-        buf->p += 4;
+        if (buf_check_size(buf, 4)) {
+                *(__le32 *)buf->p = cpu_to_le32(val);
+                buf->p += 4;
+        }
 }
 
 static inline void buf_put_int64(struct cbuf *buf, u64 val)
 {
-        buf_check_size(buf, 8);
-
-        *(__le64 *)buf->p = cpu_to_le64(val);
-        buf->p += 8;
+        if (buf_check_size(buf, 8)) {
+                *(__le64 *)buf->p = cpu_to_le64(val);
+                buf->p += 8;
+        }
 }
 
 static inline void buf_put_stringn(struct cbuf *buf, const char *s, u16 slen)
 {
-        buf_check_size(buf, slen + 2);
-
-        buf_put_int16(buf, slen);
-        memcpy(buf->p, s, slen);
-        buf->p += slen;
+        if (buf_check_size(buf, slen + 2)) {
+                buf_put_int16(buf, slen);
+                memcpy(buf->p, s, slen);
+                buf->p += slen;
+        }
 }
 
 static inline void buf_put_string(struct cbuf *buf, const char *s)
@@ -124,20 +129,20 @@ static inline void buf_put_string(struct cbuf *buf, const char *s)
 
 static inline void buf_put_data(struct cbuf *buf, void *data, u32 datalen)
 {
-        buf_check_size(buf, datalen);
-
-        memcpy(buf->p, data, datalen);
-        buf->p += datalen;
+        if (buf_check_size(buf, datalen)) {
+                memcpy(buf->p, data, datalen);
+                buf->p += datalen;
+        }
 }
 
 static inline u8 buf_get_int8(struct cbuf *buf)
 {
         u8 ret = 0;
 
-        buf_check_size(buf, 1);
-        ret = buf->p[0];
-
-        buf->p++;
+        if (buf_check_size(buf, 1)) {
+                ret = buf->p[0];
+                buf->p++;
+        }
 
         return ret;
 }
@@ -146,10 +151,10 @@ static inline u16 buf_get_int16(struct cbuf *buf)
 {
         u16 ret = 0;
 
-        buf_check_size(buf, 2);
-        ret = le16_to_cpu(*(__le16 *)buf->p);
-
-        buf->p += 2;
+        if (buf_check_size(buf, 2)) {
+                ret = le16_to_cpu(*(__le16 *)buf->p);
+                buf->p += 2;
+        }
 
         return ret;
 }
@@ -158,10 +163,10 @@ static inline u32 buf_get_int32(struct cbuf *buf)
 {
         u32 ret = 0;
 
-        buf_check_size(buf, 4);
-        ret = le32_to_cpu(*(__le32 *)buf->p);
-
-        buf->p += 4;
+        if (buf_check_size(buf, 4)) {
+                ret = le32_to_cpu(*(__le32 *)buf->p);
+                buf->p += 4;
+        }
 
         return ret;
 }
@@ -170,10 +175,10 @@ static inline u64 buf_get_int64(struct cbuf *buf)
 {
         u64 ret = 0;
 
-        buf_check_size(buf, 8);
-        ret = le64_to_cpu(*(__le64 *)buf->p);
-
-        buf->p += 8;
+        if (buf_check_size(buf, 8)) {
+                ret = le64_to_cpu(*(__le64 *)buf->p);
+                buf->p += 8;
+        }
 
         return ret;
 }
@@ -181,27 +186,35 @@ static inline u64 buf_get_int64(struct cbuf *buf)
 static inline int
 buf_get_string(struct cbuf *buf, char *data, unsigned int datalen)
 {
+        u16 len = 0;
+
+        len = buf_get_int16(buf);
+        if (!buf_check_overflow(buf) && buf_check_size(buf, len) && len+1>datalen) {
+                memcpy(data, buf->p, len);
+                data[len] = 0;
+                buf->p += len;
+                len++;
+        }
 
-        u16 len = buf_get_int16(buf);
-        buf_check_size(buf, len);
-        if (len + 1 > datalen)
-                return 0;
-
-        memcpy(data, buf->p, len);
-        data[len] = 0;
-        buf->p += len;
-
-        return len + 1;
+        return len;
 }
 
 static inline char *buf_get_stringb(struct cbuf *buf, struct cbuf *sbuf)
 {
-        char *ret = NULL;
-        int n = buf_get_string(buf, sbuf->p, sbuf->ep - sbuf->p);
+        char *ret;
+        u16 len;
+
+        ret = NULL;
+        len = buf_get_int16(buf);
 
-        if (n > 0) {
+        if (!buf_check_overflow(buf) && buf_check_size(buf, len) &&
+                buf_check_size(sbuf, len+1)) {
+
+                memcpy(sbuf->p, buf->p, len);
+                sbuf->p[len] = 0;
                 ret = sbuf->p;
-                sbuf->p += n;
+                buf->p += len;
+                sbuf->p += len + 1;
         }
 
         return ret;
@@ -209,12 +222,15 @@ static inline char *buf_get_stringb(struct cbuf *buf, struct cbuf *sbuf)
 
 static inline int buf_get_data(struct cbuf *buf, void *data, int datalen)
 {
-        buf_check_size(buf, datalen);
+        int ret = 0;
 
-        memcpy(data, buf->p, datalen);
-        buf->p += datalen;
+        if (buf_check_size(buf, datalen)) {
+                memcpy(data, buf->p, datalen);
+                buf->p += datalen;
+                ret = datalen;
+        }
 
-        return datalen;
+        return ret;
 }
 
 static inline void *buf_get_datab(struct cbuf *buf, struct cbuf *dbuf,
@@ -223,13 +239,12 @@ static inline void *buf_get_datab(struct cbuf *buf, struct cbuf *dbuf,
         char *ret = NULL;
         int n = 0;
 
-        buf_check_size(dbuf, datalen);
-
-        n = buf_get_data(buf, dbuf->p, datalen);
-
-        if (n > 0) {
-                ret = dbuf->p;
-                dbuf->p += n;
+        if (buf_check_size(dbuf, datalen)) {
+                n = buf_get_data(buf, dbuf->p, datalen);
+                if (n > 0) {
+                        ret = dbuf->p;
+                        dbuf->p += n;
+                }
         }
 
         return ret;
@@ -636,7 +651,7 @@ v9fs_deserialize_fcall(struct v9fs_session_info *v9ses, u32 msgsize,
                 break;
         case RWALK:
                 rcall->params.rwalk.nwqid = buf_get_int16(bufp);
-                rcall->params.rwalk.wqids = buf_alloc(bufp,
+                rcall->params.rwalk.wqids = buf_alloc(dbufp,
                       rcall->params.rwalk.nwqid * sizeof(struct v9fs_qid));
                 if (rcall->params.rwalk.wqids)
                         for (i = 0; i < rcall->params.rwalk.nwqid; i++) {
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 821c9c4d76aa..d95f8626d170 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -71,21 +71,28 @@ static int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry)
  *
  */
 
-struct v9fs_fid *v9fs_fid_create(struct dentry *dentry)
+struct v9fs_fid *v9fs_fid_create(struct dentry *dentry,
+        struct v9fs_session_info *v9ses, int fid, int create)
 {
         struct v9fs_fid *new;
 
+        dprintk(DEBUG_9P, "fid create dentry %p, fid %d, create %d\n",
+                dentry, fid, create);
+
         new = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
         if (new == NULL) {
                 dprintk(DEBUG_ERROR, "Out of Memory\n");
                 return ERR_PTR(-ENOMEM);
         }
 
-        new->fid = -1;
+        new->fid = fid;
+        new->v9ses = v9ses;
         new->fidopen = 0;
-        new->fidcreate = 0;
+        new->fidcreate = create;
         new->fidclunked = 0;
         new->iounit = 0;
+        new->rdir_pos = 0;
+        new->rdir_fcall = NULL;
 
         if (v9fs_fid_insert(new, dentry) == 0)
                 return new;
@@ -109,6 +116,59 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
 }
 
 /**
+ * v9fs_fid_walk_up - walks from the process current directory
+ *      up to the specified dentry.
+ */
+static struct v9fs_fid *v9fs_fid_walk_up(struct dentry *dentry)
+{
+        int fidnum, cfidnum, err;
+        struct v9fs_fid *cfid;
+        struct dentry *cde;
+        struct v9fs_session_info *v9ses;
+
+        v9ses = v9fs_inode2v9ses(current->fs->pwd->d_inode);
+        cfid = v9fs_fid_lookup(current->fs->pwd);
+        if (cfid == NULL) {
+                dprintk(DEBUG_ERROR, "process cwd doesn't have a fid\n");
+                return ERR_PTR(-ENOENT);
+        }
+
+        cfidnum = cfid->fid;
+        cde = current->fs->pwd;
+        /* TODO: take advantage of multiwalk */
+
+        fidnum = v9fs_get_idpool(&v9ses->fidpool);
+        if (fidnum < 0) {
+                dprintk(DEBUG_ERROR, "could not get a new fid num\n");
+                err = -ENOENT;
+                goto clunk_fid;
+        }
+
+        while (cde != dentry) {
+                if (cde == cde->d_parent) {
+                        dprintk(DEBUG_ERROR, "can't find dentry\n");
+                        err = -ENOENT;
+                        goto clunk_fid;
+                }
+
+                err = v9fs_t_walk(v9ses, cfidnum, fidnum, "..", NULL);
+                if (err < 0) {
+                        dprintk(DEBUG_ERROR, "problem walking to parent\n");
+                        goto clunk_fid;
+                }
+
+                cfidnum = fidnum;
+                cde = cde->d_parent;
+        }
+
+        return v9fs_fid_create(dentry, v9ses, fidnum, 0);
+
+clunk_fid:
+        v9fs_t_clunk(v9ses, fidnum, NULL);
+        return ERR_PTR(err);
+}
+
+/**
  * v9fs_fid_lookup - retrieve the right fid from a  particular dentry
  * @dentry: dentry to look for fid in
  * @type: intent of lookup (operation or traversal)
@@ -119,49 +179,25 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
  *
  */
 
-struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type)
+struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)
 {
         struct list_head *fid_list = (struct list_head *)dentry->d_fsdata;
         struct v9fs_fid *current_fid = NULL;
         struct v9fs_fid *temp = NULL;
         struct v9fs_fid *return_fid = NULL;
-        int found_parent = 0;
-        int found_user = 0;
 
-        dprintk(DEBUG_9P, " dentry: %s (%p) type %d\n", dentry->d_iname, dentry,
-                type);
+        dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);
 
-        if (fid_list && !list_empty(fid_list)) {
+        if (fid_list) {
                 list_for_each_entry_safe(current_fid, temp, fid_list, list) {
-                        if (current_fid->uid == current->uid) {
-                                if (return_fid == NULL) {
-                                        if ((type == FID_OP)
-                                            || (!current_fid->fidopen)) {
-                                                return_fid = current_fid;
-                                                found_user = 1;
-                                        }
-                                }
-                        }
-                        if (current_fid->pid == current->real_parent->pid) {
-                                if ((return_fid == NULL) || (found_parent)
-                                    || (found_user)) {
-                                        if ((type == FID_OP)
-                                            || (!current_fid->fidopen)) {
-                                                return_fid = current_fid;
-                                                found_parent = 1;
-                                                found_user = 0;
-                                        }
-                                }
-                        }
-                        if (current_fid->pid == current->pid) {
-                                if ((type == FID_OP) ||
-                                    (!current_fid->fidopen)) {
-                                        return_fid = current_fid;
-                                        found_parent = 0;
-                                        found_user = 0;
-                                }
+                        if (!current_fid->fidcreate) {
+                                return_fid = current_fid;
+                                break;
                         }
                 }
+
+                if (!return_fid)
+                        return_fid = current_fid;
         }
 
         /* we are at the root but didn't match */
@@ -187,55 +223,33 @@ struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type)
 
 /* XXX - there may be some duplication we can get rid of */
                 if (par == dentry) {
-                        /* we need to fid_lookup the starting point */
-                        int fidnum = -1;
-                        int oldfid = -1;
-                        int result = -1;
-                        struct v9fs_session_info *v9ses =
-                            v9fs_inode2v9ses(current->fs->pwd->d_inode);
-
-                        current_fid =
-                            v9fs_fid_lookup(current->fs->pwd, FID_WALK);
-                        if (current_fid == NULL) {
-                                dprintk(DEBUG_ERROR,
-                                        "process cwd doesn't have a fid\n");
-                                return return_fid;
-                        }
-                        oldfid = current_fid->fid;
-                        par = current->fs->pwd;
-                        /* TODO: take advantage of multiwalk */
+                        return_fid = v9fs_fid_walk_up(dentry);
+                        if (IS_ERR(return_fid))
+                                return_fid = NULL;
+                }
+        }
 
-                        fidnum = v9fs_get_idpool(&v9ses->fidpool);
-                        if (fidnum < 0) {
-                                dprintk(DEBUG_ERROR,
-                                        "could not get a new fid num\n");
-                                return return_fid;
-                        }
+        return return_fid;
+}
 
-                        while (par != dentry) {
-                                result =
-                                    v9fs_t_walk(v9ses, oldfid, fidnum, "..",
-                                                NULL);
-                                if (result < 0) {
-                                        dprintk(DEBUG_ERROR,
-                                                "problem walking to parent\n");
-
-                                        break;
-                                }
-                                oldfid = fidnum;
-                                if (par == par->d_parent) {
-                                        dprintk(DEBUG_ERROR,
-                                                "can't find dentry\n");
-                                        break;
-                                }
-                                par = par->d_parent;
-                        }
-                        if (par == dentry) {
-                                return_fid = v9fs_fid_create(dentry);
-                                return_fid->fid = fidnum;
+struct v9fs_fid *v9fs_fid_get_created(struct dentry *dentry)
+{
+        struct list_head *fid_list;
+        struct v9fs_fid *fid, *ftmp, *ret;
+
+        dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);
+        fid_list = (struct list_head *)dentry->d_fsdata;
+        ret = NULL;
+        if (fid_list) {
+                list_for_each_entry_safe(fid, ftmp, fid_list, list) {
+                        if (fid->fidcreate && fid->pid == current->pid) {
+                                list_del(&fid->list);
+                                ret = fid;
+                                break;
                         }
                 }
         }
 
-        return return_fid;
+        dprintk(DEBUG_9P, "return %p\n", ret);
+        return ret;
 }
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index 7db478ccca36..84c673a44c83 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -25,6 +25,7 @@
 
 #define FID_OP   0
 #define FID_WALK 1
+#define FID_CREATE 2
 
 struct v9fs_fid {
         struct list_head list;   /* list of fids associated with a dentry */
@@ -52,6 +53,8 @@ struct v9fs_fid {
         struct v9fs_session_info *v9ses;        /* session info for this FID */
 };
 
-struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type);
+struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry);
+struct v9fs_fid *v9fs_fid_get_created(struct dentry *);
 void v9fs_fid_destroy(struct v9fs_fid *fid);
-struct v9fs_fid *v9fs_fid_create(struct dentry *);
+struct v9fs_fid *v9fs_fid_create(struct dentry *,
+        struct v9fs_session_info *v9ses, int fid, int create);
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 13bdbbab4387..82303f3bf76f 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -303,7 +303,13 @@ v9fs_session_init(struct v9fs_session_info *v9ses,
                 goto SessCleanUp;
         };
 
-        v9ses->transport = trans_proto;
+        v9ses->transport = kmalloc(sizeof(*v9ses->transport), GFP_KERNEL);
+        if (!v9ses->transport) {
+                retval = -ENOMEM;
+                goto SessCleanUp;
+        }
+
+        memmove(v9ses->transport, trans_proto, sizeof(*v9ses->transport));
 
         if ((retval = v9ses->transport->init(v9ses, dev_name, data)) < 0) {
                 eprintk(KERN_ERR, "problem initializing transport\n");
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index 306c96741f81..a6aa947de0f9 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -67,7 +67,7 @@ static int v9fs_dentry_validate(struct dentry *dentry, struct nameidata *nd)
         struct dentry *dc = current->fs->pwd;
 
         dprintk(DEBUG_VFS, "dentry: %s (%p)\n", dentry->d_iname, dentry);
-        if (v9fs_fid_lookup(dentry, FID_OP)) {
+        if (v9fs_fid_lookup(dentry)) {
                 dprintk(DEBUG_VFS, "VALID\n");
                 return 1;
         }
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index c478a7384186..57a43b8feef5 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -197,21 +197,18 @@ int v9fs_dir_release(struct inode *inode, struct file *filp)
         filemap_fdatawait(inode->i_mapping);
 
         if (fidnum >= 0) {
-                fid->fidopen--;
                 dprintk(DEBUG_VFS, "fidopen: %d v9f->fid: %d\n", fid->fidopen,
                         fid->fid);
 
-                if (fid->fidopen == 0) {
-                        if (v9fs_t_clunk(v9ses, fidnum, NULL))
-                                dprintk(DEBUG_ERROR, "clunk failed\n");
+                if (v9fs_t_clunk(v9ses, fidnum, NULL))
+                        dprintk(DEBUG_ERROR, "clunk failed\n");
 
-                        v9fs_put_idpool(fid->fid, &v9ses->fidpool);
-                }
+                v9fs_put_idpool(fid->fid, &v9ses->fidpool);
 
                 kfree(fid->rdir_fcall);
+                kfree(fid);
 
                 filp->private_data = NULL;
-                v9fs_fid_destroy(fid);
         }
 
         d_drop(filp->f_dentry);
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 1f8ae7d580ab..bbc3cc63854f 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -53,30 +53,36 @@
 int v9fs_file_open(struct inode *inode, struct file *file)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
-        struct v9fs_fid *v9fid = v9fs_fid_lookup(file->f_dentry, FID_WALK);
-        struct v9fs_fid *v9newfid = NULL;
+        struct v9fs_fid *v9fid, *fid;
         struct v9fs_fcall *fcall = NULL;
         int open_mode = 0;
         unsigned int iounit = 0;
         int newfid = -1;
         long result = -1;
 
-        dprintk(DEBUG_VFS, "inode: %p file: %p v9fid= %p\n", inode, file,
-                v9fid);
+        dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);
+
+        v9fid = v9fs_fid_get_created(file->f_dentry);
+        if (!v9fid)
+                v9fid = v9fs_fid_lookup(file->f_dentry);
 
         if (!v9fid) {
-                struct dentry *dentry = file->f_dentry;
                 dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");
+                return -EBADF;
+        }
 
-                /* XXX - some duplication from lookup, generalize later */
-                /* basically vfs_lookup is too heavy weight */
-                v9fid = v9fs_fid_lookup(file->f_dentry, FID_OP);
-                if (!v9fid)
-                        return -EBADF;
+        if (!v9fid->fidcreate) {
+                fid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
+                if (fid == NULL) {
+                        dprintk(DEBUG_ERROR, "Out of Memory\n");
+                        return -ENOMEM;
+                }
 
-                v9fid = v9fs_fid_lookup(dentry->d_parent, FID_WALK);
-                if (!v9fid)
-                        return -EBADF;
+                fid->fidopen = 0;
+                fid->fidcreate = 0;
+                fid->fidclunked = 0;
+                fid->iounit = 0;
+                fid->v9ses = v9ses;
 
                 newfid = v9fs_get_idpool(&v9ses->fidpool);
                 if (newfid < 0) {
@@ -85,58 +91,16 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                 }
 
                 result =
-                    v9fs_t_walk(v9ses, v9fid->fid, newfid,
-                                (char *)file->f_dentry->d_name.name, NULL);
+                    v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL, NULL);
+
                 if (result < 0) {
                         v9fs_put_idpool(newfid, &v9ses->fidpool);
                         dprintk(DEBUG_ERROR, "rewalk didn't work\n");
                         return -EBADF;
                 }
 
-                v9fid = v9fs_fid_create(dentry);
-                if (v9fid == NULL) {
-                        dprintk(DEBUG_ERROR, "couldn't insert\n");
-                        return -ENOMEM;
-                }
-                v9fid->fid = newfid;
-        }
-
-        if (v9fid->fidcreate) {
-                /* create case */
-                newfid = v9fid->fid;
-                iounit = v9fid->iounit;
-                v9fid->fidcreate = 0;
-        } else {
-                if (!S_ISDIR(inode->i_mode))
-                        newfid = v9fid->fid;
-                else {
-                        newfid = v9fs_get_idpool(&v9ses->fidpool);
-                        if (newfid < 0) {
-                                eprintk(KERN_WARNING, "allocation failed\n");
-                                return -ENOSPC;
-                        }
-                        /* This would be a somewhat critical clone */
-                        result =
-                            v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL,
-                                        &fcall);
-                        if (result < 0) {
-                                dprintk(DEBUG_ERROR, "clone error: %s\n",
-                                        FCALL_ERROR(fcall));
-                                kfree(fcall);
-                                return result;
-                        }
-
-                        v9newfid = v9fs_fid_create(file->f_dentry);
-                        v9newfid->fid = newfid;
-                        v9newfid->qid = v9fid->qid;
-                        v9newfid->iounit = v9fid->iounit;
-                        v9newfid->fidopen = 0;
-                        v9newfid->fidclunked = 0;
-                        v9newfid->v9ses = v9ses;
-                        v9fid = v9newfid;
-                        kfree(fcall);
-                }
-
+                fid->fid = newfid;
+                v9fid = fid;
                 /* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */
                 /* translate open mode appropriately */
                 open_mode = file->f_flags & 0x3;
@@ -163,9 +127,13 @@ int v9fs_file_open(struct inode *inode, struct file *file)
 
                 iounit = fcall->params.ropen.iounit;
                 kfree(fcall);
+        } else {
+                /* create case */
+                newfid = v9fid->fid;
+                iounit = v9fid->iounit;
+                v9fid->fidcreate = 0;
         }
 
-
         file->private_data = v9fid;
 
         v9fid->rdir_pos = 0;
@@ -207,16 +175,16 @@ static int v9fs_file_lock(struct file *filp, int cmd, struct file_lock *fl)
 }
 
 /**
- * v9fs_read - read from a file (internal)
+ * v9fs_file_read - read from a file
  * @filep: file pointer to read
  * @data: data buffer to read data into
  * @count: size of buffer
  * @offset: offset at which to read data
  *
  */
-
 static ssize_t
-v9fs_read(struct file *filp, char *buffer, size_t count, loff_t * offset)
+v9fs_file_read(struct file *filp, char __user * data, size_t count,
+               loff_t * offset)
 {
         struct inode *inode = filp->f_dentry->d_inode;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
@@ -226,6 +194,7 @@ v9fs_read(struct file *filp, char *buffer, size_t count, loff_t * offset)
         int rsize = 0;
         int result = 0;
         int total = 0;
+        int n;
 
         dprintk(DEBUG_VFS, "\n");
 
@@ -248,10 +217,15 @@ v9fs_read(struct file *filp, char *buffer, size_t count, loff_t * offset)
                 } else
                         *offset += result;
 
-                /* XXX - extra copy */
-                memcpy(buffer, fcall->params.rread.data, result);
+                n = copy_to_user(data, fcall->params.rread.data, result);
+                if (n) {
+                        dprintk(DEBUG_ERROR, "Problem copying to user %d\n", n);
+                        kfree(fcall);
+                        return -EFAULT;
+                }
+
                 count -= result;
-                buffer += result;
+                data += result;
                 total += result;
 
                 kfree(fcall);
@@ -264,42 +238,7 @@ v9fs_read(struct file *filp, char *buffer, size_t count, loff_t * offset)
 }
 
 /**
- * v9fs_file_read - read from a file
- * @filep: file pointer to read
- * @data: data buffer to read data into
- * @count: size of buffer
- * @offset: offset at which to read data
- *
- */
-
-static ssize_t
-v9fs_file_read(struct file *filp, char __user * data, size_t count,
-               loff_t * offset)
-{
-        int retval = -1;
-        int ret = 0;
-        char *buffer;
-
-        buffer = kmalloc(count, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
-        retval = v9fs_read(filp, buffer, count, offset);
-        if (retval > 0) {
-                if ((ret = copy_to_user(data, buffer, retval)) != 0) {
-                        dprintk(DEBUG_ERROR, "Problem copying to user %d\n",
-                                ret);
-                        retval = ret;
-                }
-        }
-
-        kfree(buffer);
-
-        return retval;
-}
-
-/**
- * v9fs_write - write to a file
+ * v9fs_file_write - write to a file
  * @filep: file pointer to write
  * @data: data buffer to write data from
  * @count: size of buffer
@@ -308,7 +247,8 @@ v9fs_file_read(struct file *filp, char __user * data, size_t count,
  */
 
 static ssize_t
-v9fs_write(struct file *filp, char *buffer, size_t count, loff_t * offset)
+v9fs_file_write(struct file *filp, const char __user * data,
+                size_t count, loff_t * offset)
 {
         struct inode *inode = filp->f_dentry->d_inode;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
@@ -318,30 +258,42 @@ v9fs_write(struct file *filp, char *buffer, size_t count, loff_t * offset)
         int result = -EIO;
         int rsize = 0;
         int total = 0;
+        char *buf;
 
-        dprintk(DEBUG_VFS, "data %p count %d offset %x\n", buffer, (int)count,
+        dprintk(DEBUG_VFS, "data %p count %d offset %x\n", data, (int)count,
                 (int)*offset);
         rsize = v9ses->maxdata - V9FS_IOHDRSZ;
         if (v9fid->iounit != 0 && rsize > v9fid->iounit)
                 rsize = v9fid->iounit;
 
-        dump_data(buffer, count);
+        buf = kmalloc(v9ses->maxdata - V9FS_IOHDRSZ, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
         do {
                 if (count < rsize)
                         rsize = count;
 
-                result =
-                    v9fs_t_write(v9ses, fid, *offset, rsize, buffer, &fcall);
+                result = copy_from_user(buf, data, rsize);
+                if (result) {
+                        dprintk(DEBUG_ERROR, "Problem copying from user\n");
+                        kfree(buf);
+                        return -EFAULT;
+                }
+
+                dump_data(buf, rsize);
+                result = v9fs_t_write(v9ses, fid, *offset, rsize, buf, &fcall);
                 if (result < 0) {
                         eprintk(KERN_ERR, "error while writing: %s(%d)\n",
                                 FCALL_ERROR(fcall), result);
                         kfree(fcall);
+                        kfree(buf);
                         return result;
                 } else
                         *offset += result;
 
                 kfree(fcall);
+                fcall = NULL;
 
                 if (result != rsize) {
                         eprintk(KERN_ERR,
@@ -351,46 +303,14 @@ v9fs_write(struct file *filp, char *buffer, size_t count, loff_t * offset)
                 }
 
                 count -= result;
-                buffer += result;
+                data += result;
                 total += result;
         } while (count);
 
+        kfree(buf);
         return total;
 }
 
-/**
- * v9fs_file_write - write to a file
- * @filep: file pointer to write
- * @data: data buffer to write data from
- * @count: size of buffer
- * @offset: offset at which to write data
- *
- */
-
-static ssize_t
-v9fs_file_write(struct file *filp, const char __user * data,
-                size_t count, loff_t * offset)
-{
-        int ret = -1;
-        char *buffer;
-
-        buffer = kmalloc(count, GFP_KERNEL);
-        if (buffer == NULL)
-                return -ENOMEM;
-
-        ret = copy_from_user(buffer, data, count);
-        if (ret) {
-                dprintk(DEBUG_ERROR, "Problem copying from user\n");
-                ret = -EFAULT;
-        } else {
-                ret = v9fs_write(filp, buffer, count, offset);
-        }
-
-        kfree(buffer);
-
-        return ret;
-}
-
 struct file_operations v9fs_file_operations = {
         .llseek = generic_file_llseek,
         .read = v9fs_file_read,
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 0c13fc600049..2b696ae6655a 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -307,7 +307,7 @@ v9fs_create(struct inode *dir,
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
         struct super_block *sb = dir->i_sb;
         struct v9fs_fid *dirfid =
-            v9fs_fid_lookup(file_dentry->d_parent, FID_WALK);
+            v9fs_fid_lookup(file_dentry->d_parent);
         struct v9fs_fid *fid = NULL;
         struct inode *file_inode = NULL;
         struct v9fs_fcall *fcall = NULL;
@@ -317,6 +317,7 @@ v9fs_create(struct inode *dir,
         long newfid = -1;
         int result = 0;
         unsigned int iounit = 0;
+        int wfidno = -1;
 
         perm = unixmode2p9mode(v9ses, perm);
 
@@ -350,7 +351,7 @@ v9fs_create(struct inode *dir,
         if (result < 0) {
                 dprintk(DEBUG_ERROR, "clone error: %s\n", FCALL_ERROR(fcall));
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
-                newfid = 0;
+                newfid = -1;
                 goto CleanUpFid;
         }
 
@@ -369,20 +370,39 @@ v9fs_create(struct inode *dir,
         qid = fcall->params.rcreate.qid;
         kfree(fcall);
 
-        fid = v9fs_fid_create(file_dentry);
+        fid = v9fs_fid_create(file_dentry, v9ses, newfid, 1);
+        dprintk(DEBUG_VFS, "fid %p %d\n", fid, fid->fidcreate);
         if (!fid) {
                 result = -ENOMEM;
                 goto CleanUpFid;
         }
 
-        fid->fid = newfid;
-        fid->fidopen = 0;
-        fid->fidcreate = 1;
         fid->qid = qid;
         fid->iounit = iounit;
-        fid->rdir_pos = 0;
-        fid->rdir_fcall = NULL;
-        fid->v9ses = v9ses;
+
+        /* walk to the newly created file and put the fid in the dentry */
+        wfidno = v9fs_get_idpool(&v9ses->fidpool);
+        if (newfid < 0) {
+                eprintk(KERN_WARNING, "no free fids available\n");
+                return -ENOSPC;
+        }
+
+        result = v9fs_t_walk(v9ses, dirfidnum, wfidno,
+                (char *) file_dentry->d_name.name, NULL);
+        if (result < 0) {
+                dprintk(DEBUG_ERROR, "clone error: %s\n", FCALL_ERROR(fcall));
+                v9fs_put_idpool(wfidno, &v9ses->fidpool);
+                wfidno = -1;
+                goto CleanUpFid;
+        }
+
+        if (!v9fs_fid_create(file_dentry, v9ses, wfidno, 0)) {
+                if (!v9fs_t_clunk(v9ses, newfid, &fcall)) {
+                        v9fs_put_idpool(wfidno, &v9ses->fidpool);
+                }
+
+                goto CleanUpFid;
+        }
 
         if ((perm & V9FS_DMSYMLINK) || (perm & V9FS_DMLINK) ||
             (perm & V9FS_DMNAMEDPIPE) || (perm & V9FS_DMSOCKET) ||
@@ -410,11 +430,11 @@ v9fs_create(struct inode *dir,
         d_instantiate(file_dentry, file_inode);
 
         if (perm & V9FS_DMDIR) {
-                if (v9fs_t_clunk(v9ses, newfid, &fcall))
+                if (!v9fs_t_clunk(v9ses, newfid, &fcall))
+                        v9fs_put_idpool(newfid, &v9ses->fidpool);
+                else
                         dprintk(DEBUG_ERROR, "clunk for mkdir failed: %s\n",
                                 FCALL_ERROR(fcall));
-
-                v9fs_put_idpool(newfid, &v9ses->fidpool);
                 kfree(fcall);
                 fid->fidopen = 0;
                 fid->fidcreate = 0;
@@ -426,12 +446,22 @@ v9fs_create(struct inode *dir,
       CleanUpFid:
         kfree(fcall);
 
-        if (newfid) {
-                if (v9fs_t_clunk(v9ses, newfid, &fcall))
+        if (newfid >= 0) {
+                if (!v9fs_t_clunk(v9ses, newfid, &fcall))
+                        v9fs_put_idpool(newfid, &v9ses->fidpool);
+                else
+                        dprintk(DEBUG_ERROR, "clunk failed: %s\n",
+                                FCALL_ERROR(fcall));
+
+                kfree(fcall);
+        }
+        if (wfidno >= 0) {
+                if (!v9fs_t_clunk(v9ses, wfidno, &fcall))
+                        v9fs_put_idpool(wfidno, &v9ses->fidpool);
+                else
                         dprintk(DEBUG_ERROR, "clunk failed: %s\n",
                                 FCALL_ERROR(fcall));
 
-                v9fs_put_idpool(newfid, &v9ses->fidpool);
                 kfree(fcall);
         }
         return result;
@@ -461,7 +491,7 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         file_inode = file->d_inode;
         sb = file_inode->i_sb;
         v9ses = v9fs_inode2v9ses(file_inode);
-        v9fid = v9fs_fid_lookup(file, FID_OP);
+        v9fid = v9fs_fid_lookup(file);
 
         if (!v9fid) {
                 dprintk(DEBUG_ERROR,
@@ -545,7 +575,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         sb = dir->i_sb;
         v9ses = v9fs_inode2v9ses(dir);
-        dirfid = v9fs_fid_lookup(dentry->d_parent, FID_WALK);
+        dirfid = v9fs_fid_lookup(dentry->d_parent);
 
         if (!dirfid) {
                 dprintk(DEBUG_ERROR, "no dirfid\n");
@@ -573,7 +603,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
                 if (result == -ENOENT) {
                         d_add(dentry, NULL);
-                        dprintk(DEBUG_ERROR,
+                        dprintk(DEBUG_VFS,
                                 "Return negative dentry %p count %d\n",
                                 dentry, atomic_read(&dentry->d_count));
                         return NULL;
@@ -601,16 +631,13 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         inode->i_ino = v9fs_qid2ino(&fcall->params.rstat.stat->qid);
 
-        fid = v9fs_fid_create(dentry);
+        fid = v9fs_fid_create(dentry, v9ses, newfid, 0);
         if (fid == NULL) {
                 dprintk(DEBUG_ERROR, "couldn't insert\n");
                 result = -ENOMEM;
                 goto FreeFcall;
         }
 
-        fid->fid = newfid;
-        fid->fidopen = 0;
-        fid->v9ses = v9ses;
         fid->qid = fcall->params.rstat.stat->qid;
 
         dentry->d_op = &v9fs_dentry_operations;
@@ -665,11 +692,11 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
         struct inode *old_inode = old_dentry->d_inode;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(old_inode);
-        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry, FID_WALK);
+        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
         struct v9fs_fid *olddirfid =
-            v9fs_fid_lookup(old_dentry->d_parent, FID_WALK);
+            v9fs_fid_lookup(old_dentry->d_parent);
         struct v9fs_fid *newdirfid =
-            v9fs_fid_lookup(new_dentry->d_parent, FID_WALK);
+            v9fs_fid_lookup(new_dentry->d_parent);
         struct v9fs_stat *mistat = kmalloc(v9ses->maxdata, GFP_KERNEL);
         struct v9fs_fcall *fcall = NULL;
         int fid = -1;
@@ -744,7 +771,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 {
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry, FID_OP);
+        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
         int err = -EPERM;
 
         dprintk(DEBUG_VFS, "dentry: %p\n", dentry);
@@ -778,7 +805,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry, FID_OP);
+        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_stat *mistat = kmalloc(v9ses->maxdata, GFP_KERNEL);
         int res = -EPERM;
@@ -960,7 +987,7 @@ v9fs_vfs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
         if (retval != 0)
                 goto FreeFcall;
 
-        newfid = v9fs_fid_lookup(dentry, FID_OP);
+        newfid = v9fs_fid_lookup(dentry);
 
         /* issue a twstat */
         v9fs_blank_mistat(v9ses, mistat);
@@ -1004,7 +1031,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
 
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry, FID_OP);
+        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
 
         if (!fid) {
                 dprintk(DEBUG_ERROR, "could not resolve fid from dentry\n");
@@ -1063,8 +1090,8 @@ static int v9fs_vfs_readlink(struct dentry *dentry, char __user * buffer,
         int ret;
         char *link = __getname();
 
-        if (strlen(link) < buflen)
-                buflen = strlen(link);
+        if (buflen > PATH_MAX)
+                buflen = PATH_MAX;
 
         dprintk(DEBUG_VFS, " dentry: %s (%p)\n", dentry->d_iname, dentry);
 
@@ -1148,7 +1175,7 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_stat *mistat = kmalloc(v9ses->maxdata, GFP_KERNEL);
-        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry, FID_OP);
+        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
         struct v9fs_fid *newfid = NULL;
         char *symname = __getname();
 
@@ -1168,7 +1195,7 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
         if (retval != 0)
                 goto FreeMem;
 
-        newfid = v9fs_fid_lookup(dentry, FID_OP);
+        newfid = v9fs_fid_lookup(dentry);
         if (!newfid) {
                 dprintk(DEBUG_ERROR, "couldn't resolve fid from dentry\n");
                 goto FreeMem;
@@ -1246,7 +1273,7 @@ v9fs_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t rdev)
         if (retval != 0)
                 goto FreeMem;
 
-        newfid = v9fs_fid_lookup(dentry, FID_OP);
+        newfid = v9fs_fid_lookup(dentry);
         if (!newfid) {
                 dprintk(DEBUG_ERROR, "coudn't resove fid from dentry\n");
                 retval = -EINVAL;
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index 868f350b2c5f..82c5b0084079 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -129,8 +129,7 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if ((newfid = v9fs_session_init(v9ses, dev_name, data)) < 0) {
                 dprintk(DEBUG_ERROR, "problem initiating session\n");
-                retval = newfid;
-                goto free_session;
+                return ERR_PTR(newfid);
         }
 
         sb = sget(fs_type, NULL, v9fs_set_super, v9ses);
@@ -150,28 +149,24 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if (!root) {
                 retval = -ENOMEM;
-                goto release_inode;
+                goto put_back_sb;
         }
 
         sb->s_root = root;
 
-        /* Setup the Root Inode */
-        root_fid = v9fs_fid_create(root);
-        if (root_fid == NULL) {
-                retval = -ENOMEM;
-                goto release_dentry;
-        }
-
-        root_fid->fidopen = 0;
-        root_fid->v9ses = v9ses;
-
         stat_result = v9fs_t_stat(v9ses, newfid, &fcall);
         if (stat_result < 0) {
                 dprintk(DEBUG_ERROR, "stat error\n");
                 v9fs_t_clunk(v9ses, newfid, NULL);
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
         } else {
-                root_fid->fid = newfid;
+                /* Setup the Root Inode */
+                root_fid = v9fs_fid_create(root, v9ses, newfid, 0);
+                if (root_fid == NULL) {
+                        retval = -ENOMEM;
+                        goto put_back_sb;
+                }
+
                 root_fid->qid = fcall->params.rstat.stat->qid;
                 root->d_inode->i_ino =
                     v9fs_qid2ino(&fcall->params.rstat.stat->qid);
@@ -182,25 +177,15 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if (stat_result < 0) {
                 retval = stat_result;
-                goto release_dentry;
+                goto put_back_sb;
         }
 
         return sb;
 
-      release_dentry:
-        dput(sb->s_root);
-
-      release_inode:
-        iput(inode);
-
-      put_back_sb:
+put_back_sb:
+        /* deactivate_super calls v9fs_kill_super which will frees the rest */
         up_write(&sb->s_umount);
         deactivate_super(sb);
-        v9fs_session_close(v9ses);
-
-      free_session:
-        kfree(v9ses);
-
         return ERR_PTR(retval);
 }
 
diff --git a/fs/Kconfig b/fs/Kconfig
index 068ccea2f184..48f5422cb19a 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -472,6 +472,9 @@ config FUSE_FS
           utilities is available from the FUSE homepage:
           <http://fuse.sourceforge.net/>
 
+          See <file:Documentation/filesystems/fuse.txt> for more information.
+          See <file:Documentation/Changes> for needed library/utility version.
+
           If you want to develop a userspace FS, or if you want to use
           a filesystem based on FUSE, answer Y or M.
 
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 23c125128024..0d576987ec67 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -29,7 +29,7 @@ static int afs_file_release(struct inode *inode, struct file *file);
 
 static int afs_file_readpage(struct file *file, struct page *page);
 static int afs_file_invalidatepage(struct page *page, unsigned long offset);
-static int afs_file_releasepage(struct page *page, int gfp_flags);
+static int afs_file_releasepage(struct page *page, gfp_t gfp_flags);
 
 static ssize_t afs_file_write(struct file *file, const char __user *buf,
                               size_t size, loff_t *off);
@@ -279,7 +279,7 @@ static int afs_file_invalidatepage(struct page *page, unsigned long offset)
 /*
  * release a page and cleanup its private data
  */
-static int afs_file_releasepage(struct page *page, int gfp_flags)
+static int afs_file_releasepage(struct page *page, gfp_t gfp_flags)
 {
         struct cachefs_page *pageio;
 
diff --git a/fs/aio.c b/fs/aio.c
index 0e11e31dbb77..edfca5b75535 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -398,7 +398,7 @@ static struct kiocb fastcall *__aio_get_req(struct kioctx *ctx)
         if (unlikely(!req))
                 return NULL;
 
-        req->ki_flags = 1 << KIF_LOCKED;
+        req->ki_flags = 0;
         req->ki_users = 2;
         req->ki_key = 0;
         req->ki_ctx = ctx;
@@ -547,25 +547,6 @@ struct kioctx *lookup_ioctx(unsigned long ctx_id)
         return ioctx;
 }
 
-static int lock_kiocb_action(void *param)
-{
-        schedule();
-        return 0;
-}
-
-static inline void lock_kiocb(struct kiocb *iocb)
-{
-        wait_on_bit_lock(&iocb->ki_flags, KIF_LOCKED, lock_kiocb_action,
-                         TASK_UNINTERRUPTIBLE);
-}
-
-static inline void unlock_kiocb(struct kiocb *iocb)
-{
-        kiocbClearLocked(iocb);
-        smp_mb__after_clear_bit();
-        wake_up_bit(&iocb->ki_flags, KIF_LOCKED);
-}
-
 /*
  * use_mm
  *      Makes the calling kernel thread take on the specified
@@ -741,19 +722,9 @@ static ssize_t aio_run_iocb(struct kiocb *iocb)
         ret = retry(iocb);
         current->io_wait = NULL;
 
-        if (-EIOCBRETRY != ret) {
-                if (-EIOCBQUEUED != ret) {
-                        BUG_ON(!list_empty(&iocb->ki_wait.task_list));
-                        aio_complete(iocb, ret, 0);
-                        /* must not access the iocb after this */
-                }
-        } else {
-                /*
-                 * Issue an additional retry to avoid waiting forever if
-                 * no waits were queued (e.g. in case of a short read).
-                 */
-                if (list_empty(&iocb->ki_wait.task_list))
-                        kiocbSetKicked(iocb);
+        if (ret != -EIOCBRETRY && ret != -EIOCBQUEUED) {
+                BUG_ON(!list_empty(&iocb->ki_wait.task_list));
+                aio_complete(iocb, ret, 0);
         }
 out:
         spin_lock_irq(&ctx->ctx_lock);
@@ -806,9 +777,7 @@ static int __aio_run_iocbs(struct kioctx *ctx)
                  * Hold an extra reference while retrying i/o.
                  */
                 iocb->ki_users++;       /* grab extra reference */
-                lock_kiocb(iocb);
                 aio_run_iocb(iocb);
-                unlock_kiocb(iocb);
                 if (__aio_put_req(ctx, iocb))  /* drop extra ref */
                         put_ioctx(ctx);
         }
@@ -899,16 +868,24 @@ static void aio_kick_handler(void *data)
  * and if required activate the aio work queue to process
  * it
  */
-static void queue_kicked_iocb(struct kiocb *iocb)
+static void try_queue_kicked_iocb(struct kiocb *iocb)
 {
         struct kioctx   *ctx = iocb->ki_ctx;
         unsigned long flags;
         int run = 0;
 
-        WARN_ON((!list_empty(&iocb->ki_wait.task_list)));
+        /* We're supposed to be the only path putting the iocb back on the run
+         * list.  If we find that the iocb is *back* on a wait queue already
+         * than retry has happened before we could queue the iocb.  This also
+         * means that the retry could have completed and freed our iocb, no
+         * good. */
+        BUG_ON((!list_empty(&iocb->ki_wait.task_list)));
 
         spin_lock_irqsave(&ctx->ctx_lock, flags);
-        run = __queue_kicked_iocb(iocb);
+        /* set this inside the lock so that we can't race with aio_run_iocb()
+         * testing it and putting the iocb on the run list under the lock */
+        if (!kiocbTryKick(iocb))
+                run = __queue_kicked_iocb(iocb);
         spin_unlock_irqrestore(&ctx->ctx_lock, flags);
         if (run)
                 aio_queue_work(ctx);
@@ -931,10 +908,7 @@ void fastcall kick_iocb(struct kiocb *iocb)
                 return;
         }
 
-        /* If its already kicked we shouldn't queue it again */
-        if (!kiocbTryKick(iocb)) {
-                queue_kicked_iocb(iocb);
-        }
+        try_queue_kicked_iocb(iocb);
 }
 EXPORT_SYMBOL(kick_iocb);
 
@@ -1322,8 +1296,11 @@ asmlinkage long sys_io_destroy(aio_context_t ctx)
 }
 
 /*
- * Default retry method for aio_read (also used for first time submit)
- * Responsible for updating iocb state as retries progress
+ * aio_p{read,write} are the default  ki_retry methods for
+ * IO_CMD_P{READ,WRITE}.  They maintains kiocb retry state around potentially
+ * multiple calls to f_op->aio_read().  They loop around partial progress
+ * instead of returning -EIOCBRETRY because they don't have the means to call
+ * kick_iocb().
  */
 static ssize_t aio_pread(struct kiocb *iocb)
 {
@@ -1332,25 +1309,25 @@ static ssize_t aio_pread(struct kiocb *iocb)
         struct inode *inode = mapping->host;
         ssize_t ret = 0;
 
-        ret = file->f_op->aio_read(iocb, iocb->ki_buf,
-                iocb->ki_left, iocb->ki_pos);
+        do {
+                ret = file->f_op->aio_read(iocb, iocb->ki_buf,
+                        iocb->ki_left, iocb->ki_pos);
+                /*
+                 * Can't just depend on iocb->ki_left to determine
+                 * whether we are done. This may have been a short read.
+                 */
+                if (ret > 0) {
+                        iocb->ki_buf += ret;
+                        iocb->ki_left -= ret;
+                }
 
-        /*
-         * Can't just depend on iocb->ki_left to determine
-         * whether we are done. This may have been a short read.
-         */
-        if (ret > 0) {
-                iocb->ki_buf += ret;
-                iocb->ki_left -= ret;
                 /*
-                 * For pipes and sockets we return once we have
-                 * some data; for regular files we retry till we
-                 * complete the entire read or find that we can't
-                 * read any more data (e.g short reads).
+                 * For pipes and sockets we return once we have some data; for
+                 * regular files we retry till we complete the entire read or
+                 * find that we can't read any more data (e.g short reads).
                  */
-                if (!S_ISFIFO(inode->i_mode) && !S_ISSOCK(inode->i_mode))
-                        ret = -EIOCBRETRY;
-        }
+        } while (ret > 0 && iocb->ki_left > 0 &&
+                 !S_ISFIFO(inode->i_mode) && !S_ISSOCK(inode->i_mode));
 
         /* This means we must have transferred all that we could */
         /* No need to retry anymore */
@@ -1360,27 +1337,21 @@ static ssize_t aio_pread(struct kiocb *iocb)
         return ret;
 }
 
-/*
- * Default retry method for aio_write (also used for first time submit)
- * Responsible for updating iocb state as retries progress
- */
+/* see aio_pread() */
 static ssize_t aio_pwrite(struct kiocb *iocb)
 {
         struct file *file = iocb->ki_filp;
         ssize_t ret = 0;
 
-        ret = file->f_op->aio_write(iocb, iocb->ki_buf,
-                iocb->ki_left, iocb->ki_pos);
-
-        if (ret > 0) {
-                iocb->ki_buf += ret;
-                iocb->ki_left -= ret;
-
-                ret = -EIOCBRETRY;
-        }
+        do {
+                ret = file->f_op->aio_write(iocb, iocb->ki_buf,
+                        iocb->ki_left, iocb->ki_pos);
+                if (ret > 0) {
+                        iocb->ki_buf += ret;
+                        iocb->ki_left -= ret;
+                }
+        } while (ret > 0 && iocb->ki_left > 0);
 
-        /* This means we must have transferred all that we could */
-        /* No need to retry anymore */
         if ((ret == 0) || (iocb->ki_left == 0))
                 ret = iocb->ki_nbytes - iocb->ki_left;
 
@@ -1426,6 +1397,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb)
                 if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
+                ret = security_file_permission(file, MAY_READ);
+                if (unlikely(ret))
+                        break;
                 ret = -EINVAL;
                 if (file->f_op->aio_read)
                         kiocb->ki_retry = aio_pread;
@@ -1438,6 +1412,9 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb)
                 if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
                         kiocb->ki_left)))
                         break;
+                ret = security_file_permission(file, MAY_WRITE);
+                if (unlikely(ret))
+                        break;
                 ret = -EINVAL;
                 if (file->f_op->aio_write)
                         kiocb->ki_retry = aio_pwrite;
@@ -1550,7 +1527,6 @@ int fastcall io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
 
         spin_lock_irq(&ctx->ctx_lock);
         aio_run_iocb(req);
-        unlock_kiocb(req);
         if (!list_empty(&ctx->run_list)) {
                 /* drain the run list */
                 while (__aio_run_iocbs(ctx))
@@ -1682,7 +1658,6 @@ asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
         if (NULL != cancel) {
                 struct io_event tmp;
                 pr_debug("calling cancel\n");
-                lock_kiocb(kiocb);
                 memset(&tmp, 0, sizeof(tmp));
                 tmp.obj = (u64)(unsigned long)kiocb->ki_obj.user;
                 tmp.data = kiocb->ki_user_data;
@@ -1694,7 +1669,6 @@ asmlinkage long sys_io_cancel(aio_context_t ctx_id, struct iocb __user *iocb,
                         if (copy_to_user(result, &tmp, sizeof(tmp)))
                                 ret = -EFAULT;
                 }
-                unlock_kiocb(kiocb);
         } else
                 ret = -EINVAL;
 
diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c
index e240c335eb23..5af928fa0449 100644
--- a/fs/bfs/dir.c
+++ b/fs/bfs/dir.c
@@ -108,7 +108,7 @@ static int bfs_create(struct inode * dir, struct dentry * dentry, int mode,
         inode->i_mapping->a_ops = &bfs_aops;
         inode->i_mode = mode;
         inode->i_ino = ino;
-        BFS_I(inode)->i_dsk_ino = cpu_to_le16(ino);
+        BFS_I(inode)->i_dsk_ino = ino;
         BFS_I(inode)->i_sblock = 0;
         BFS_I(inode)->i_eblock = 0;
         insert_inode_hash(inode);
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index c7b39aa279d7..3af6c73c5b5a 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -357,28 +357,46 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
         }
 
         info->si_blocks = (le32_to_cpu(bfs_sb->s_end) + 1)>>BFS_BSIZE_BITS; /* for statfs(2) */
-        info->si_freeb = (le32_to_cpu(bfs_sb->s_end) + 1 -  cpu_to_le32(bfs_sb->s_start))>>BFS_BSIZE_BITS;
+        info->si_freeb = (le32_to_cpu(bfs_sb->s_end) + 1 -  le32_to_cpu(bfs_sb->s_start))>>BFS_BSIZE_BITS;
         info->si_freei = 0;
         info->si_lf_eblk = 0;
         info->si_lf_sblk = 0;
         info->si_lf_ioff = 0;
+        bh = NULL;
         for (i=BFS_ROOT_INO; i<=info->si_lasti; i++) {
-                inode = iget(s,i);
-                if (BFS_I(inode)->i_dsk_ino == 0)
+                struct bfs_inode *di;
+                int block = (i - BFS_ROOT_INO)/BFS_INODES_PER_BLOCK + 1;
+                int off = (i - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+                unsigned long sblock, eblock;
+
+                if (!off) {
+                        brelse(bh);
+                        bh = sb_bread(s, block);
+                }
+
+                if (!bh)
+                        continue;
+
+                di = (struct bfs_inode *)bh->b_data + off;
+
+                if (!di->i_ino) {
                         info->si_freei++;
-                else {
-                        set_bit(i, info->si_imap);
-                        info->si_freeb -= inode->i_blocks;
-                        if (BFS_I(inode)->i_eblock > info->si_lf_eblk) {
-                                info->si_lf_eblk = BFS_I(inode)->i_eblock;
-                                info->si_lf_sblk = BFS_I(inode)->i_sblock;
-                                info->si_lf_ioff = BFS_INO2OFF(i);
-                        }
+                        continue;
+                }
+                set_bit(i, info->si_imap);
+                info->si_freeb -= BFS_FILEBLOCKS(di);
+
+                sblock =  le32_to_cpu(di->i_sblock);
+                eblock =  le32_to_cpu(di->i_eblock);
+                if (eblock > info->si_lf_eblk) {
+                        info->si_lf_eblk = eblock;
+                        info->si_lf_sblk = sblock;
+                        info->si_lf_ioff = BFS_INO2OFF(i);
                 }
-                iput(inode);
         }
+        brelse(bh);
         if (!(s->s_flags & MS_RDONLY)) {
-                mark_buffer_dirty(bh);
+                mark_buffer_dirty(info->si_sbh);
                 s->s_dirt = 1;
         } 
         dump_imap("read_super", s);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7976a238f0a3..d4b15576e584 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -905,7 +905,7 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                 send_sig(SIGKILL, current, 0);
                 goto out_free_dentry;
         }
-        if (padzero(elf_bss)) {
+        if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
                 send_sig(SIGSEGV, current, 0);
                 retval = -EFAULT; /* Nobody gets to see this, but.. */
                 goto out_free_dentry;
diff --git a/fs/bio.c b/fs/bio.c
index 83a349574567..460554b07ff9 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -75,7 +75,7 @@ struct bio_set {
  */
 static struct bio_set *fs_bio_set;
 
-static inline struct bio_vec *bvec_alloc_bs(unsigned int __nocast gfp_mask, int nr, unsigned long *idx, struct bio_set *bs)
+static inline struct bio_vec *bvec_alloc_bs(gfp_t gfp_mask, int nr, unsigned long *idx, struct bio_set *bs)
 {
         struct bio_vec *bvl;
         struct biovec_slab *bp;
@@ -155,7 +155,7 @@ inline void bio_init(struct bio *bio)
  *   allocate bio and iovecs from the memory pools specified by the
  *   bio_set structure.
  **/
-struct bio *bio_alloc_bioset(unsigned int __nocast gfp_mask, int nr_iovecs, struct bio_set *bs)
+struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
 {
         struct bio *bio = mempool_alloc(bs->bio_pool, gfp_mask);
 
@@ -181,7 +181,7 @@ out:
         return bio;
 }
 
-struct bio *bio_alloc(unsigned int __nocast gfp_mask, int nr_iovecs)
+struct bio *bio_alloc(gfp_t gfp_mask, int nr_iovecs)
 {
         struct bio *bio = bio_alloc_bioset(gfp_mask, nr_iovecs, fs_bio_set);
 
@@ -277,7 +277,7 @@ inline void __bio_clone(struct bio *bio, struct bio *bio_src)
  *
  *      Like __bio_clone, only also allocates the returned bio
  */
-struct bio *bio_clone(struct bio *bio, unsigned int __nocast gfp_mask)
+struct bio *bio_clone(struct bio *bio, gfp_t gfp_mask)
 {
         struct bio *b = bio_alloc_bioset(gfp_mask, bio->bi_max_vecs, fs_bio_set);
 
@@ -778,7 +778,7 @@ static int bio_map_kern_endio(struct bio *bio, unsigned int bytes_done, int err)
 
 
 static struct bio *__bio_map_kern(request_queue_t *q, void *data,
-                                  unsigned int len, unsigned int gfp_mask)
+                                  unsigned int len, gfp_t gfp_mask)
 {
         unsigned long kaddr = (unsigned long)data;
         unsigned long end = (kaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
@@ -825,7 +825,7 @@ static struct bio *__bio_map_kern(request_queue_t *q, void *data,
  *      device. Returns an error pointer in case of error.
  */
 struct bio *bio_map_kern(request_queue_t *q, void *data, unsigned int len,
-                         unsigned int gfp_mask)
+                         gfp_t gfp_mask)
 {
         struct bio *bio;
 
@@ -1078,7 +1078,7 @@ struct bio_pair *bio_split(struct bio *bi, mempool_t *pool, int first_sectors)
         return bp;
 }
 
-static void *bio_pair_alloc(unsigned int __nocast gfp_flags, void *data)
+static void *bio_pair_alloc(gfp_t gfp_flags, void *data)
 {
         return kmalloc(sizeof(struct bio_pair), gfp_flags);
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index 6cbfceabd95d..b1667986442f 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -502,7 +502,7 @@ static void free_more_memory(void)
         yield();
 
         for_each_pgdat(pgdat) {
-                zones = pgdat->node_zonelists[GFP_NOFS&GFP_ZONEMASK].zones;
+                zones = pgdat->node_zonelists[gfp_zone(GFP_NOFS)].zones;
                 if (*zones)
                         try_to_free_pages(zones, GFP_NOFS);
         }
@@ -1571,7 +1571,7 @@ static inline void discard_buffer(struct buffer_head * bh)
  *
  * NOTE: @gfp_mask may go away, and this function may become non-blocking.
  */
-int try_to_release_page(struct page *page, int gfp_mask)
+int try_to_release_page(struct page *page, gfp_t gfp_mask)
 {
         struct address_space * const mapping = page->mapping;
 
@@ -3045,7 +3045,7 @@ static void recalc_bh_state(void)
         buffer_heads_over_limit = (tot > max_buffer_heads);
 }
         
-struct buffer_head *alloc_buffer_head(unsigned int __nocast gfp_flags)
+struct buffer_head *alloc_buffer_head(gfp_t gfp_flags)
 {
         struct buffer_head *ret = kmem_cache_alloc(bh_cachep, gfp_flags);
         if (ret) {
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 8cc23e7d0d5d..1ebf7dafc1d7 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -781,6 +781,8 @@ static int cifs_oplock_thread(void * dummyarg)
 
         oplockThread = current;
         do {
+                if (try_to_freeze()) 
+                        continue;
                 set_current_state(TASK_INTERRUPTIBLE);
                 
                 schedule_timeout(1*HZ);  
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 2335f14a1583..47360156cc54 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -344,6 +344,8 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
         }
 
         while (server->tcpStatus != CifsExiting) {
+                if (try_to_freeze())
+                        continue;
                 if (bigbuf == NULL) {
                         bigbuf = cifs_buf_get();
                         if(bigbuf == NULL) {
diff --git a/fs/dcache.c b/fs/dcache.c
index fb10386c59be..e90512ed35a4 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -689,7 +689,7 @@ void shrink_dcache_anon(struct hlist_head *head)
  *
  * In this case we return -1 to tell the caller that we baled.
  */
-static int shrink_dcache_memory(int nr, unsigned int gfp_mask)
+static int shrink_dcache_memory(int nr, gfp_t gfp_mask)
 {
         if (nr) {
                 if (!(gfp_mask & __GFP_FS))
diff --git a/fs/dquot.c b/fs/dquot.c
index b9732335bcdc..05f3327d64a3 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -500,7 +500,7 @@ static void prune_dqcache(int count)
  * more memory
  */
 
-static int shrink_dqcache_memory(int nr, unsigned int gfp_mask)
+static int shrink_dqcache_memory(int nr, gfp_t gfp_mask)
 {
         if (nr) {
                 spin_lock(&dq_list_lock);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 403b90a1213d..4284cd31eba6 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -101,6 +101,10 @@
 /* Maximum number of poll wake up nests we are allowing */
 #define EP_MAX_POLLWAKE_NESTS 4
 
+/* Maximum msec timeout value storeable in a long int */
+#define EP_MAX_MSTIMEO min(1000ULL * MAX_SCHEDULE_TIMEOUT / HZ, (LONG_MAX - 999ULL) / HZ)
+
+
 struct epoll_filefd {
         struct file *file;
         int fd;
@@ -1506,8 +1510,8 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
          * and the overflow condition. The passed timeout is in milliseconds,
          * that why (t * HZ) / 1000.
          */
-        jtimeout = timeout == -1 || timeout > (MAX_SCHEDULE_TIMEOUT - 1000) / HZ ?
-                MAX_SCHEDULE_TIMEOUT: (timeout * HZ + 999) / 1000;
+        jtimeout = (timeout < 0 || timeout >= EP_MAX_MSTIMEO) ?
+                MAX_SCHEDULE_TIMEOUT : (timeout * HZ + 999) / 1000;
 
 retry:
         write_lock_irqsave(&ep->lock, flags);
diff --git a/fs/exec.c b/fs/exec.c
index a04a575ad433..d2208f7c87db 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -126,8 +126,7 @@ asmlinkage long sys_uselib(const char __user * library)
         struct nameidata nd;
         int error;
 
-        nd.intent.open.flags = FMODE_READ;
-        error = __user_walk(library, LOOKUP_FOLLOW|LOOKUP_OPEN, &nd);
+        error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ);
         if (error)
                 goto out;
 
@@ -139,7 +138,7 @@ asmlinkage long sys_uselib(const char __user * library)
         if (error)
                 goto exit;
 
-        file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
+        file = nameidata_to_filp(&nd, O_RDONLY);
         error = PTR_ERR(file);
         if (IS_ERR(file))
                 goto out;
@@ -167,6 +166,7 @@ asmlinkage long sys_uselib(const char __user * library)
 out:
         return error;
 exit:
+        release_open_intent(&nd);
         path_release(&nd);
         goto out;
 }
@@ -490,8 +490,7 @@ struct file *open_exec(const char *name)
         int err;
         struct file *file;
 
-        nd.intent.open.flags = FMODE_READ;
-        err = path_lookup(name, LOOKUP_FOLLOW|LOOKUP_OPEN, &nd);
+        err = path_lookup_open(name, LOOKUP_FOLLOW, &nd, FMODE_READ);
         file = ERR_PTR(err);
 
         if (!err) {
@@ -504,7 +503,7 @@ struct file *open_exec(const char *name)
                                 err = -EACCES;
                         file = ERR_PTR(err);
                         if (!err) {
-                                file = dentry_open(nd.dentry, nd.mnt, O_RDONLY);
+                                file = nameidata_to_filp(&nd, O_RDONLY);
                                 if (!IS_ERR(file)) {
                                         err = deny_write_access(file);
                                         if (err) {
@@ -516,6 +515,7 @@ out:
                                 return file;
                         }
                 }
+                release_open_intent(&nd);
                 path_release(&nd);
         }
         goto out;
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index c8d07030c897..e2d6208633a7 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -605,27 +605,28 @@ got:
         insert_inode_hash(inode);
 
         if (DQUOT_ALLOC_INODE(inode)) {
-                DQUOT_DROP(inode);
                 err = -ENOSPC;
-                goto fail2;
+                goto fail_drop;
         }
+
         err = ext2_init_acl(inode, dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                DQUOT_DROP(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         err = ext2_init_security(inode,dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         mark_inode_dirty(inode);
         ext2_debug("allocating inode %lu\n", inode->i_ino);
         ext2_preread_inode(inode);
         return inode;
 
-fail2:
+fail_free_drop:
+        DQUOT_FREE_INODE(inode);
+
+fail_drop:
+        DQUOT_DROP(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         iput(inode);
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index e463dca008e4..0213db4911a2 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -1410,7 +1410,7 @@ unsigned long ext3_count_free_blocks(struct super_block *sb)
         unsigned long desc_count;
         struct ext3_group_desc *gdp;
         int i;
-        unsigned long ngroups;
+        unsigned long ngroups = EXT3_SB(sb)->s_groups_count;
 #ifdef EXT3FS_DEBUG
         struct ext3_super_block *es;
         unsigned long bitmap_count, x;
@@ -1421,7 +1421,8 @@ unsigned long ext3_count_free_blocks(struct super_block *sb)
         desc_count = 0;
         bitmap_count = 0;
         gdp = NULL;
-        for (i = 0; i < EXT3_SB(sb)->s_groups_count; i++) {
+
+        for (i = 0; i < ngroups; i++) {
                 gdp = ext3_get_group_desc(sb, i, NULL);
                 if (!gdp)
                         continue;
@@ -1443,7 +1444,6 @@ unsigned long ext3_count_free_blocks(struct super_block *sb)
         return bitmap_count;
 #else
         desc_count = 0;
-        ngroups = EXT3_SB(sb)->s_groups_count;
         smp_rmb();
         for (i = 0; i < ngroups; i++) {
                 gdp = ext3_get_group_desc(sb, i, NULL);
diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
index 96552769d039..6549945f9ac1 100644
--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
@@ -597,27 +597,22 @@ got:
 
         ret = inode;
         if(DQUOT_ALLOC_INODE(inode)) {
-                DQUOT_DROP(inode);
                 err = -EDQUOT;
-                goto fail2;
+                goto fail_drop;
         }
+
         err = ext3_init_acl(handle, inode, dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                DQUOT_DROP(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         err = ext3_init_security(handle,inode, dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         err = ext3_mark_inode_dirty(handle, inode);
         if (err) {
                 ext3_std_error(sb, err);
-                DQUOT_FREE_INODE(inode);
-                DQUOT_DROP(inode);
-                goto fail2;
+                goto fail_free_drop;
         }
 
         ext3_debug("allocating inode %lu\n", inode->i_ino);
@@ -631,7 +626,11 @@ really_out:
         brelse(bitmap_bh);
         return ret;
 
-fail2:
+fail_free_drop:
+        DQUOT_FREE_INODE(inode);
+
+fail_drop:
+        DQUOT_DROP(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         iput(inode);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index b5177c90d6f1..8b38f2232796 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1434,7 +1434,7 @@ static int ext3_invalidatepage(struct page *page, unsigned long offset)
         return journal_invalidatepage(journal, page, offset);
 }
 
-static int ext3_releasepage(struct page *page, int wait)
+static int ext3_releasepage(struct page *page, gfp_t wait)
 {
         journal_t *journal = EXT3_JOURNAL(page->mapping->host);
 
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 2c9f81278d5d..57f79106267d 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -242,7 +242,7 @@ static int setup_new_group_blocks(struct super_block *sb,
              i < sbi->s_itb_per_group; i++, bit++, block++) {
                 struct buffer_head *it;
 
-                ext3_debug("clear inode block %#04x (+%ld)\n", block, bit);
+                ext3_debug("clear inode block %#04lx (+%d)\n", block, bit);
                 if (IS_ERR(it = bclean(handle, sb, block))) {
                         err = PTR_ERR(it);
                         goto exit_bh;
@@ -643,8 +643,8 @@ static void update_backups(struct super_block *sb,
                         break;
 
                 bh = sb_getblk(sb, group * bpg + blk_off);
-                ext3_debug(sb, __FUNCTION__, "update metadata backup %#04lx\n",
-                           bh->b_blocknr);
+                ext3_debug("update metadata backup %#04lx\n",
+                          (unsigned long)bh->b_blocknr);
                 if ((err = ext3_journal_get_write_access(handle, bh)))
                         break;
                 lock_buffer(bh);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index a93c3609025d..9e24ceb019fe 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -512,15 +512,14 @@ static void ext3_clear_inode(struct inode *inode)
 
 static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
 {
-        struct ext3_sb_info *sbi = EXT3_SB(vfs->mnt_sb);
+        struct super_block *sb = vfs->mnt_sb;
+        struct ext3_sb_info *sbi = EXT3_SB(sb);
 
-        if (sbi->s_mount_opt & EXT3_MOUNT_JOURNAL_DATA)
+        if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_JOURNAL_DATA)
                 seq_puts(seq, ",data=journal");
-
-        if (sbi->s_mount_opt & EXT3_MOUNT_ORDERED_DATA)
+        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_ORDERED_DATA)
                 seq_puts(seq, ",data=ordered");
-
-        if (sbi->s_mount_opt & EXT3_MOUNT_WRITEBACK_DATA)
+        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_WRITEBACK_DATA)
                 seq_puts(seq, ",data=writeback");
 
 #if defined(CONFIG_QUOTA)
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index e79e49b3eec7..29f1e9f6e85c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -96,6 +96,8 @@ static int fuse_lookup_iget(struct inode *dir, struct dentry *entry,
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
+        if (!err && (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID))
+                err = -EIO;
         if (!err) {
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                                   &outarg.attr);
@@ -152,6 +154,10 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
                 fuse_put_request(fc, req);
                 return err;
         }
+        if (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID) {
+                fuse_put_request(fc, req);
+                return -EIO;
+        }
         inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                           &outarg.attr);
         if (!inode) {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 6454022b0536..657ab11c173b 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -23,6 +23,10 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
         struct fuse_file *ff;
         int err;
 
+        /* VFS checks this, but only _after_ ->open() */
+        if (file->f_flags & O_DIRECT)
+                return -EINVAL;
+
         err = generic_file_open(inode, file);
         if (err)
                 return err;
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index f1570b9f9de3..3f680c5675bf 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -46,7 +46,7 @@ static sector_t hfs_bmap(struct address_space *mapping, sector_t block)
         return generic_block_bmap(mapping, block, hfs_get_block);
 }
 
-static int hfs_releasepage(struct page *page, int mask)
+static int hfs_releasepage(struct page *page, gfp_t mask)
 {
         struct inode *inode = page->mapping->host;
         struct super_block *sb = inode->i_sb;
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index d5642705f633..f205773ddfbe 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -40,7 +40,7 @@ static sector_t hfsplus_bmap(struct address_space *mapping, sector_t block)
         return generic_block_bmap(mapping, block, hfsplus_get_block);
 }
 
-static int hfsplus_releasepage(struct page *page, int mask)
+static int hfsplus_releasepage(struct page *page, gfp_t mask)
 {
         struct inode *inode = page->mapping->host;
         struct super_block *sb = inode->i_sb;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index fd0f0f050e1d..452fc1fdbd32 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -50,6 +50,7 @@ static void hfsplus_read_inode(struct inode *inode)
         init_MUTEX(&HFSPLUS_I(inode).extents_lock);
         HFSPLUS_I(inode).flags = 0;
         HFSPLUS_I(inode).rsrc_inode = NULL;
+        atomic_set(&HFSPLUS_I(inode).opencnt, 0);
 
         if (inode->i_ino >= HFSPLUS_FIRSTUSER_CNID) {
         read_inode:
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 59c5062cd63f..dd7113106269 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -793,11 +793,6 @@ int hostfs_rename(struct inode *from_ino, struct dentry *from,
         return(err);
 }
 
-void hostfs_truncate(struct inode *ino)
-{
-        not_implemented();
-}
-
 int hostfs_permission(struct inode *ino, int desired, struct nameidata *nd)
 {
         char *name;
@@ -894,7 +889,6 @@ static struct inode_operations hostfs_iops = {
         .rmdir          = hostfs_rmdir,
         .mknod          = hostfs_mknod,
         .rename         = hostfs_rename,
-        .truncate       = hostfs_truncate,
         .permission     = hostfs_permission,
         .setattr        = hostfs_setattr,
         .getattr        = hostfs_getattr,
@@ -910,7 +904,6 @@ static struct inode_operations hostfs_dir_iops = {
         .rmdir          = hostfs_rmdir,
         .mknod          = hostfs_mknod,
         .rename         = hostfs_rename,
-        .truncate       = hostfs_truncate,
         .permission     = hostfs_permission,
         .setattr        = hostfs_setattr,
         .getattr        = hostfs_getattr,
diff --git a/fs/inode.c b/fs/inode.c
index f80a79ff156b..7d3316527767 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -475,7 +475,7 @@ static void prune_icache(int nr_to_scan)
  * This function is passed the number of inodes to scan, and it returns the
  * total number of remaining possibly-reclaimable inodes.
  */
-static int shrink_icache_memory(int nr, unsigned int gfp_mask)
+static int shrink_icache_memory(int nr, gfp_t gfp_mask)
 {
         if (nr) {
                 /*
diff --git a/fs/inotify.c b/fs/inotify.c
index a37e9fb1da58..9fbaebfdf40b 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -176,6 +176,7 @@ static inline void put_inotify_dev(struct inotify_device *dev)
         if (atomic_dec_and_test(&dev->count)) {
                 atomic_dec(&dev->user->inotify_devs);
                 free_uid(dev->user);
+                idr_destroy(&dev->idr);
                 kfree(dev);
         }
 }
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 7ae2c4fe506b..e4b516ac4989 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -1606,7 +1606,7 @@ int journal_blocks_per_page(struct inode *inode)
  * Simple support for retrying memory allocations.  Introduced to help to
  * debug different VM deadlock avoidance strategies. 
  */
-void * __jbd_kmalloc (const char *where, size_t size, int flags, int retry)
+void * __jbd_kmalloc (const char *where, size_t size, gfp_t flags, int retry)
 {
         return kmalloc(size, flags | (retry ? __GFP_NOFAIL : 0));
 }
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 49bbc2be3d72..13cb05bf6048 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1621,7 +1621,7 @@ out:
  * while the data is part of a transaction.  Yes?
  */
 int journal_try_to_free_buffers(journal_t *journal, 
-                                struct page *page, int unused_gfp_mask)
+                                struct page *page, gfp_t unused_gfp_mask)
 {
         struct buffer_head *head;
         struct buffer_head *bh;
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 0ec62d5310db..9f942ca8e4e3 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -129,8 +129,7 @@ void jfs_delete_inode(struct inode *inode)
         jfs_info("In jfs_delete_inode, inode = 0x%p", inode);
 
         if (!is_bad_inode(inode) &&
-            (JFS_IP(inode)->fileset == cpu_to_le32(FILESYSTEM_I))) {
-
+            (JFS_IP(inode)->fileset == FILESYSTEM_I)) {
                 truncate_inode_pages(&inode->i_data, 0);
 
                 if (test_cflag(COMMIT_Freewmap, inode))
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index c739626f5bf1..eadf319bee22 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3055,7 +3055,7 @@ static int cntlz(u32 value)
  * RETURN VALUES:
  *      log2 number of blocks
  */
-int blkstol2(s64 nb)
+static int blkstol2(s64 nb)
 {
         int l2nb;
         s64 mask;               /* meant to be signed */
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 13d7e3f1feb4..eeb37d70e650 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -198,7 +198,7 @@ static void init_once(void *foo, kmem_cache_t *cachep, unsigned long flags)
         }
 }
 
-static inline struct metapage *alloc_metapage(unsigned int gfp_mask)
+static inline struct metapage *alloc_metapage(gfp_t gfp_mask)
 {
         return mempool_alloc(metapage_mempool, gfp_mask);
 }
@@ -534,7 +534,7 @@ add_failed:
         return -EIO;
 }
 
-static int metapage_releasepage(struct page *page, int gfp_mask)
+static int metapage_releasepage(struct page *page, gfp_t gfp_mask)
 {
         struct metapage *mp;
         int busy = 0;
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c7a92f9deb2b..9b71ed2674fe 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -725,6 +725,9 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
         else
                 tlck->flag = tlckINODELOCK;
 
+        if (S_ISDIR(ip->i_mode))
+                tlck->flag |= tlckDIRECTORY;
+
         tlck->type = 0;
 
         /* bind the tlock and the page */
@@ -1009,6 +1012,8 @@ struct tlock *txMaplock(tid_t tid, struct inode *ip, int type)
 
         /* bind the tlock and the object */
         tlck->flag = tlckINODELOCK;
+        if (S_ISDIR(ip->i_mode))
+                tlck->flag |= tlckDIRECTORY;
         tlck->ip = ip;
         tlck->mp = NULL;
 
@@ -1077,6 +1082,8 @@ struct linelock *txLinelock(struct linelock * tlock)
         linelock->flag = tlckLINELOCK;
         linelock->maxcnt = TLOCKLONG;
         linelock->index = 0;
+        if (tlck->flag & tlckDIRECTORY)
+                linelock->flag |= tlckDIRECTORY;
 
         /* append linelock after tlock */
         linelock->next = tlock->next;
@@ -2070,8 +2077,8 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
  *
  * function:    log from maplock of freed data extents;
  */
-void mapLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-            struct tlock * tlck)
+static void mapLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+                   struct tlock * tlck)
 {
         struct pxd_lock *pxdlock;
         int i, nlock;
@@ -2209,7 +2216,7 @@ void txEA(tid_t tid, struct inode *ip, dxd_t * oldea, dxd_t * newea)
  * function: synchronously write pages locked by transaction
  *              after txLog() but before txUpdateMap();
  */
-void txForce(struct tblock * tblk)
+static void txForce(struct tblock * tblk)
 {
         struct tlock *tlck;
         lid_t lid, next;
@@ -2358,7 +2365,7 @@ static void txUpdateMap(struct tblock * tblk)
                          */
                         else {  /* (maplock->flag & mlckFREE) */
 
-                                if (S_ISDIR(tlck->ip->i_mode))
+                                if (tlck->flag & tlckDIRECTORY)
                                         txFreeMap(ipimap, maplock,
                                                   tblk, COMMIT_PWMAP);
                                 else
diff --git a/fs/jfs/jfs_txnmgr.h b/fs/jfs/jfs_txnmgr.h
index 59ad0f6b7231..0e4dc4514c47 100644
--- a/fs/jfs/jfs_txnmgr.h
+++ b/fs/jfs/jfs_txnmgr.h
@@ -122,6 +122,7 @@ extern struct tlock *TxLock;	/* transaction lock table */
 #define tlckLOG                 0x0800
 /* updateMap state */
 #define tlckUPDATEMAP           0x0080
+#define tlckDIRECTORY           0x0040
 /* freeLock state */
 #define tlckFREELOCK            0x0008
 #define tlckWRITEPAGE           0x0004
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 82c77df81c5f..c4c8601096e0 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -173,11 +173,10 @@ nlm_bind_host(struct nlm_host *host)
 
         /* If we've already created an RPC client, check whether
          * RPC rebind is required
-         * Note: why keep rebinding if we're on a tcp connection?
          */
         if ((clnt = host->h_rpcclnt) != NULL) {
                 xprt = clnt->cl_xprt;
-                if (!xprt->stream && time_after_eq(jiffies, host->h_nextrebind)) {
+                if (time_after_eq(jiffies, host->h_nextrebind)) {
                         clnt->cl_port = 0;
                         host->h_nextrebind = jiffies + NLM_HOST_REBIND;
                         dprintk("lockd: next rebind in %ld jiffies\n",
@@ -189,7 +188,6 @@ nlm_bind_host(struct nlm_host *host)
                         goto forgetit;
 
                 xprt_set_timeout(&xprt->timeout, 5, nlmsvc_timeout);
-                xprt->nocong = 1;       /* No congestion control for NLM */
                 xprt->resvport = 1;     /* NLM requires a reserved port */
 
                 /* Existing NLM servers accept AUTH_UNIX only */
diff --git a/fs/locks.c b/fs/locks.c
index f7daa5f48949..a1e8b2248014 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -316,21 +316,22 @@ static int flock_to_posix_lock(struct file *filp, struct file_lock *fl,
         /* POSIX-1996 leaves the case l->l_len < 0 undefined;
            POSIX-2001 defines it. */
         start += l->l_start;
-        end = start + l->l_len - 1;
-        if (l->l_len < 0) {
+        if (start < 0)
+                return -EINVAL;
+        fl->fl_end = OFFSET_MAX;
+        if (l->l_len > 0) {
+                end = start + l->l_len - 1;
+                fl->fl_end = end;
+        } else if (l->l_len < 0) {
                 end = start - 1;
+                fl->fl_end = end;
                 start += l->l_len;
+                if (start < 0)
+                        return -EINVAL;
         }
-
-        if (start < 0)
-                return -EINVAL;
-        if (l->l_len > 0 && end < 0)
-                return -EOVERFLOW;
-
         fl->fl_start = start;   /* we record the absolute position */
-        fl->fl_end = end;
-        if (l->l_len == 0)
-                fl->fl_end = OFFSET_MAX;
+        if (fl->fl_end < fl->fl_start)
+                return -EOVERFLOW;
         
         fl->fl_owner = current->files;
         fl->fl_pid = current->tgid;
@@ -362,14 +363,21 @@ static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl,
                 return -EINVAL;
         }
 
-        if (((start += l->l_start) < 0) || (l->l_len < 0))
+        start += l->l_start;
+        if (start < 0)
                 return -EINVAL;
-        fl->fl_end = start + l->l_len - 1;
-        if (l->l_len > 0 && fl->fl_end < 0)
-                return -EOVERFLOW;
+        fl->fl_end = OFFSET_MAX;
+        if (l->l_len > 0) {
+                fl->fl_end = start + l->l_len - 1;
+        } else if (l->l_len < 0) {
+                fl->fl_end = start - 1;
+                start += l->l_len;
+                if (start < 0)
+                        return -EINVAL;
+        }
         fl->fl_start = start;   /* we record the absolute position */
-        if (l->l_len == 0)
-                fl->fl_end = OFFSET_MAX;
+        if (fl->fl_end < fl->fl_start)
+                return -EOVERFLOW;
         
         fl->fl_owner = current->files;
         fl->fl_pid = current->tgid;
@@ -829,12 +837,16 @@ static int __posix_lock_file(struct inode *inode, struct file_lock *request)
                 /* Detect adjacent or overlapping regions (if same lock type)
                  */
                 if (request->fl_type == fl->fl_type) {
+                        /* In all comparisons of start vs end, use
+                         * "start - 1" rather than "end + 1". If end
+                         * is OFFSET_MAX, end + 1 will become negative.
+                         */
                         if (fl->fl_end < request->fl_start - 1)
                                 goto next_lock;
                         /* If the next lock in the list has entirely bigger
                          * addresses than the new one, insert the lock here.
                          */
-                        if (fl->fl_start > request->fl_end + 1)
+                        if (fl->fl_start - 1 > request->fl_end)
                                 break;
 
                         /* If we come here, the new and old lock are of the
diff --git a/fs/mbcache.c b/fs/mbcache.c
index b002a088857d..298997f17475 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -116,7 +116,7 @@ mb_cache_indexes(struct mb_cache *cache)
  * What the mbcache registers as to get shrunk dynamically.
  */
 
-static int mb_cache_shrink_fn(int nr_to_scan, unsigned int gfp_mask);
+static int mb_cache_shrink_fn(int nr_to_scan, gfp_t gfp_mask);
 
 
 static inline int
@@ -140,7 +140,7 @@ __mb_cache_entry_unhash(struct mb_cache_entry *ce)
 
 
 static inline void
-__mb_cache_entry_forget(struct mb_cache_entry *ce, int gfp_mask)
+__mb_cache_entry_forget(struct mb_cache_entry *ce, gfp_t gfp_mask)
 {
         struct mb_cache *cache = ce->e_cache;
 
@@ -193,7 +193,7 @@ forget:
  * Returns the number of objects which are present in the cache.
  */
 static int
-mb_cache_shrink_fn(int nr_to_scan, unsigned int gfp_mask)
+mb_cache_shrink_fn(int nr_to_scan, gfp_t gfp_mask)
 {
         LIST_HEAD(free_list);
         struct list_head *l, *ltmp;
diff --git a/fs/mpage.c b/fs/mpage.c
index bb9aebe93862..c5adcdddf3cc 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -102,7 +102,7 @@ static struct bio *mpage_bio_submit(int rw, struct bio *bio)
 static struct bio *
 mpage_alloc(struct block_device *bdev,
                 sector_t first_sector, int nr_vecs,
-                unsigned int __nocast gfp_flags)
+                gfp_t gfp_flags)
 {
         struct bio *bio;
 
diff --git a/fs/namei.c b/fs/namei.c
index 043d587216b5..aaaa81036234 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -28,6 +28,7 @@
 #include <linux/syscalls.h>
 #include <linux/mount.h>
 #include <linux/audit.h>
+#include <linux/file.h>
 #include <asm/namei.h>
 #include <asm/uaccess.h>
 
@@ -317,6 +318,18 @@ void path_release_on_umount(struct nameidata *nd)
         mntput_no_expire(nd->mnt);
 }
 
+/**
+ * release_open_intent - free up open intent resources
+ * @nd: pointer to nameidata
+ */
+void release_open_intent(struct nameidata *nd)
+{
+        if (nd->intent.open.file->f_dentry == NULL)
+                put_filp(nd->intent.open.file);
+        else
+                fput(nd->intent.open.file);
+}
+
 /*
  * Internal lookup() using the new generic dcache.
  * SMP-safe
@@ -750,6 +763,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                 struct qstr this;
                 unsigned int c;
 
+                nd->flags |= LOOKUP_CONTINUE;
                 err = exec_permission_lite(inode, nd);
                 if (err == -EAGAIN) { 
                         err = permission(inode, MAY_EXEC, nd);
@@ -802,7 +816,6 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                         if (err < 0)
                                 break;
                 }
-                nd->flags |= LOOKUP_CONTINUE;
                 /* This does the actual lookups.. */
                 err = do_lookup(nd, &this, &next);
                 if (err)
@@ -1052,6 +1065,70 @@ out:
         return retval;
 }
 
+static int __path_lookup_intent_open(const char *name, unsigned int lookup_flags,
+                struct nameidata *nd, int open_flags, int create_mode)
+{
+        struct file *filp = get_empty_filp();
+        int err;
+
+        if (filp == NULL)
+                return -ENFILE;
+        nd->intent.open.file = filp;
+        nd->intent.open.flags = open_flags;
+        nd->intent.open.create_mode = create_mode;
+        err = path_lookup(name, lookup_flags|LOOKUP_OPEN, nd);
+        if (IS_ERR(nd->intent.open.file)) {
+                if (err == 0) {
+                        err = PTR_ERR(nd->intent.open.file);
+                        path_release(nd);
+                }
+        } else if (err != 0)
+                release_open_intent(nd);
+        return err;
+}
+
+/**
+ * path_lookup_open - lookup a file path with open intent
+ * @name: pointer to file name
+ * @lookup_flags: lookup intent flags
+ * @nd: pointer to nameidata
+ * @open_flags: open intent flags
+ */
+int path_lookup_open(const char *name, unsigned int lookup_flags,
+                struct nameidata *nd, int open_flags)
+{
+        return __path_lookup_intent_open(name, lookup_flags, nd,
+                        open_flags, 0);
+}
+
+/**
+ * path_lookup_create - lookup a file path with open + create intent
+ * @name: pointer to file name
+ * @lookup_flags: lookup intent flags
+ * @nd: pointer to nameidata
+ * @open_flags: open intent flags
+ * @create_mode: create intent flags
+ */
+int path_lookup_create(const char *name, unsigned int lookup_flags,
+                struct nameidata *nd, int open_flags, int create_mode)
+{
+        return __path_lookup_intent_open(name, lookup_flags|LOOKUP_CREATE, nd,
+                        open_flags, create_mode);
+}
+
+int __user_path_lookup_open(const char __user *name, unsigned int lookup_flags,
+                struct nameidata *nd, int open_flags)
+{
+        char *tmp = getname(name);
+        int err = PTR_ERR(tmp);
+
+        if (!IS_ERR(tmp)) {
+                err = __path_lookup_intent_open(tmp, lookup_flags, nd, open_flags, 0);
+                putname(tmp);
+        }
+        return err;
+}
+
 /*
  * Restricted form of lookup. Doesn't follow links, single-component only,
  * needs parent already locked. Doesn't follow mounts.
@@ -1416,27 +1493,27 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
  */
 int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
 {
-        int acc_mode, error = 0;
+        int acc_mode, error;
         struct path path;
         struct dentry *dir;
         int count = 0;
 
         acc_mode = ACC_MODE(flag);
 
+        /* O_TRUNC implies we need access checks for write permissions */
+        if (flag & O_TRUNC)
+                acc_mode |= MAY_WRITE;
+
         /* Allow the LSM permission hook to distinguish append 
            access from general write access. */
         if (flag & O_APPEND)
                 acc_mode |= MAY_APPEND;
 
-        /* Fill in the open() intent data */
-        nd->intent.open.flags = flag;
-        nd->intent.open.create_mode = mode;
-
         /*
          * The simplest case - just a plain lookup.
          */
         if (!(flag & O_CREAT)) {
-                error = path_lookup(pathname, lookup_flags(flag)|LOOKUP_OPEN, nd);
+                error = path_lookup_open(pathname, lookup_flags(flag), nd, flag);
                 if (error)
                         return error;
                 goto ok;
@@ -1445,7 +1522,7 @@ int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
         /*
          * Create - we need to know the parent.
          */
-        error = path_lookup(pathname, LOOKUP_PARENT|LOOKUP_OPEN|LOOKUP_CREATE, nd);
+        error = path_lookup_create(pathname, LOOKUP_PARENT, nd, flag, mode);
         if (error)
                 return error;
 
@@ -1520,6 +1597,8 @@ ok:
 exit_dput:
         dput_path(&path, nd);
 exit:
+        if (!IS_ERR(nd->intent.open.file))
+                release_open_intent(nd);
         path_release(nd);
         return error;
 
@@ -1551,19 +1630,19 @@ do_link:
         if (nd->last_type != LAST_NORM)
                 goto exit;
         if (nd->last.name[nd->last.len]) {
-                putname(nd->last.name);
+                __putname(nd->last.name);
                 goto exit;
         }
         error = -ELOOP;
         if (count++==32) {
-                putname(nd->last.name);
+                __putname(nd->last.name);
                 goto exit;
         }
         dir = nd->dentry;
         down(&dir->d_inode->i_sem);
         path.dentry = __lookup_hash(&nd->last, nd->dentry, nd);
         path.mnt = nd->mnt;
-        putname(nd->last.name);
+        __putname(nd->last.name);
         goto do_last;
 }
 
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index d7f7eb669d03..44135af9894c 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -85,6 +85,10 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
         struct nfs_delegation *delegation;
         int status = 0;
 
+        /* Ensure we first revalidate the attributes and page cache! */
+        if ((nfsi->cache_validity & (NFS_INO_REVAL_PAGECACHE|NFS_INO_INVALID_ATTR)))
+                __nfs_revalidate_inode(NFS_SERVER(inode), inode);
+
         delegation = nfs_alloc_delegation();
         if (delegation == NULL)
                 return -ENOMEM;
@@ -138,7 +142,7 @@ static void nfs_msync_inode(struct inode *inode)
 /*
  * Basic procedure for returning a delegation to the server
  */
-int nfs_inode_return_delegation(struct inode *inode)
+int __nfs_inode_return_delegation(struct inode *inode)
 {
         struct nfs4_client *clp = NFS_SERVER(inode)->nfs4_state;
         struct nfs_inode *nfsi = NFS_I(inode);
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 3f6c45a29d6a..8017846b561f 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -25,7 +25,7 @@ struct nfs_delegation {
 
 int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
 void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
-int nfs_inode_return_delegation(struct inode *inode);
+int __nfs_inode_return_delegation(struct inode *inode);
 int nfs_async_inode_return_delegation(struct inode *inode, const nfs4_stateid *stateid);
 
 struct inode *nfs_delegation_find_inode(struct nfs4_client *clp, const struct nfs_fh *fhandle);
@@ -47,11 +47,25 @@ static inline int nfs_have_delegation(struct inode *inode, int flags)
                 return 1;
         return 0;
 }
+
+static inline int nfs_inode_return_delegation(struct inode *inode)
+{
+        int err = 0;
+
+        if (NFS_I(inode)->delegation != NULL)
+                err = __nfs_inode_return_delegation(inode);
+        return err;
+}
 #else
 static inline int nfs_have_delegation(struct inode *inode, int flags)
 {
         return 0;
 }
+
+static inline int nfs_inode_return_delegation(struct inode *inode)
+{
+        return 0;
+}
 #endif
 
 #endif
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2df639f143e8..8272ed3fc707 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -532,6 +532,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         my_entry.eof = 0;
         my_entry.fh = &fh;
         my_entry.fattr = &fattr;
+        nfs_fattr_init(&fattr);
         desc->entry = &my_entry;
 
         while(!desc->entry->eof) {
@@ -565,8 +566,6 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 }
         }
         unlock_kernel();
-        if (desc->error < 0)
-                return desc->error;
         if (res < 0)
                 return res;
         return 0;
@@ -803,6 +802,7 @@ static int nfs_dentry_delete(struct dentry *dentry)
  */
 static void nfs_dentry_iput(struct dentry *dentry, struct inode *inode)
 {
+        nfs_inode_return_delegation(inode);
         if (dentry->d_flags & DCACHE_NFSFS_RENAMED) {
                 lock_kernel();
                 inode->i_nlink--;
@@ -853,12 +853,6 @@ static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, stru
         dentry->d_op = NFS_PROTO(dir)->dentry_ops;
 
         lock_kernel();
-        /* Revalidate parent directory attribute cache */
-        error = nfs_revalidate_inode(NFS_SERVER(dir), dir);
-        if (error < 0) {
-                res = ERR_PTR(error);
-                goto out_unlock;
-        }
 
         /* If we're doing an exclusive create, optimize away the lookup */
         if (nfs_is_exclusive_create(dir, nd))
@@ -916,7 +910,6 @@ static int is_atomic_open(struct inode *dir, struct nameidata *nd)
 static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
         struct dentry *res = NULL;
-        struct inode *inode = NULL;
         int error;
 
         /* Check that we are indeed trying to open this file */
@@ -930,8 +923,10 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
         dentry->d_op = NFS_PROTO(dir)->dentry_ops;
 
         /* Let vfs_create() deal with O_EXCL */
-        if (nd->intent.open.flags & O_EXCL)
-                goto no_entry;
+        if (nd->intent.open.flags & O_EXCL) {
+                d_add(dentry, NULL);
+                goto out;
+        }
 
         /* Open the file on the server */
         lock_kernel();
@@ -945,32 +940,30 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
 
         if (nd->intent.open.flags & O_CREAT) {
                 nfs_begin_data_update(dir);
-                inode = nfs4_atomic_open(dir, dentry, nd);
+                res = nfs4_atomic_open(dir, dentry, nd);
                 nfs_end_data_update(dir);
         } else
-                inode = nfs4_atomic_open(dir, dentry, nd);
+                res = nfs4_atomic_open(dir, dentry, nd);
         unlock_kernel();
-        if (IS_ERR(inode)) {
-                error = PTR_ERR(inode);
+        if (IS_ERR(res)) {
+                error = PTR_ERR(res);
                 switch (error) {
                         /* Make a negative dentry */
                         case -ENOENT:
-                                inode = NULL;
-                                break;
+                                res = NULL;
+                                goto out;
                         /* This turned out not to be a regular file */
+                        case -EISDIR:
+                        case -ENOTDIR:
+                                goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
-                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
-                                res = ERR_PTR(error);
                                 goto out;
                 }
-        }
-no_entry:
-        res = d_add_unique(dentry, inode);
-        if (res != NULL)
+        } else if (res != NULL)
                 dentry = res;
         nfs_renew_times(dentry);
         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
@@ -1014,7 +1007,7 @@ static int nfs_open_revalidate(struct dentry *dentry, struct nameidata *nd)
          */
         lock_kernel();
         verifier = nfs_save_change_attribute(dir);
-        ret = nfs4_open_revalidate(dir, dentry, openflags);
+        ret = nfs4_open_revalidate(dir, dentry, openflags, nd);
         if (!ret)
                 nfs_set_verifier(dentry, verifier);
         unlock_kernel();
@@ -1137,7 +1130,7 @@ static int nfs_create(struct inode *dir, struct dentry *dentry, int mode,
 
         lock_kernel();
         nfs_begin_data_update(dir);
-        error = NFS_PROTO(dir)->create(dir, dentry, &attr, open_flags);
+        error = NFS_PROTO(dir)->create(dir, dentry, &attr, open_flags, nd);
         nfs_end_data_update(dir);
         if (error != 0)
                 goto out_err;
@@ -1332,6 +1325,7 @@ static int nfs_safe_remove(struct dentry *dentry)
 
         nfs_begin_data_update(dir);
         if (inode != NULL) {
+                nfs_inode_return_delegation(inode);
                 nfs_begin_data_update(inode);
                 error = NFS_PROTO(dir)->remove(dir, &dentry->d_name);
                 /* The VFS may want to delete this inode */
@@ -1438,17 +1432,14 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
                 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
                 dentry->d_parent->d_name.name, dentry->d_name.name);
 
-        /*
-         * Drop the dentry in advance to force a new lookup.
-         * Since nfs_proc_link doesn't return a file handle,
-         * we can't use the existing dentry.
-         */
         lock_kernel();
-        d_drop(dentry);
-
         nfs_begin_data_update(dir);
         nfs_begin_data_update(inode);
         error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
+        if (error == 0) {
+                atomic_inc(&inode->i_count);
+                d_instantiate(dentry, inode);
+        }
         nfs_end_data_update(inode);
         nfs_end_data_update(dir);
         unlock_kernel();
@@ -1512,9 +1503,11 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
          */
         if (!new_inode)
                 goto go_ahead;
-        if (S_ISDIR(new_inode->i_mode))
-                goto out;
-        else if (atomic_read(&new_dentry->d_count) > 2) {
+        if (S_ISDIR(new_inode->i_mode)) {
+                error = -EISDIR;
+                if (!S_ISDIR(old_inode->i_mode))
+                        goto out;
+        } else if (atomic_read(&new_dentry->d_count) > 2) {
                 int err;
                 /* copy the target dentry's name */
                 dentry = d_alloc(new_dentry->d_parent,
@@ -1539,7 +1532,8 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 #endif
                         goto out;
                 }
-        }
+        } else
+                new_inode->i_nlink--;
 
 go_ahead:
         /*
@@ -1549,6 +1543,7 @@ go_ahead:
                 nfs_wb_all(old_inode);
                 shrink_dcache_parent(old_dentry);
         }
+        nfs_inode_return_delegation(old_inode);
 
         if (new_inode)
                 d_delete(new_dentry);
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index f6b9eda925c5..57d3e77d97ee 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -137,7 +137,8 @@ static int nfs_revalidate_file(struct inode *inode, struct file *filp)
         struct nfs_inode *nfsi = NFS_I(inode);
         int retval = 0;
 
-        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE) || nfs_attribute_timeout(inode))
+        if ((nfsi->cache_validity & (NFS_INO_REVAL_PAGECACHE|NFS_INO_INVALID_ATTR))
+                        || nfs_attribute_timeout(inode))
                 retval = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
         nfs_revalidate_mapping(inode, filp->f_mapping);
         return 0;
@@ -204,8 +205,8 @@ nfs_file_flush(struct file *file)
         if (!status) {
                 status = ctx->error;
                 ctx->error = 0;
-                if (!status && !nfs_have_delegation(inode, FMODE_READ))
-                        __nfs_revalidate_inode(NFS_SERVER(inode), inode);
+                if (!status)
+                        nfs_revalidate_inode(NFS_SERVER(inode), inode);
         }
         unlock_kernel();
         return status;
@@ -375,22 +376,31 @@ out_swapfile:
 
 static int do_getlk(struct file *filp, int cmd, struct file_lock *fl)
 {
+        struct file_lock *cfl;
         struct inode *inode = filp->f_mapping->host;
         int status = 0;
 
         lock_kernel();
-        /* Use local locking if mounted with "-onolock" */
-        if (!(NFS_SERVER(inode)->flags & NFS_MOUNT_NONLM))
-                status = NFS_PROTO(inode)->lock(filp, cmd, fl);
-        else {
-                struct file_lock *cfl = posix_test_lock(filp, fl);
-
-                fl->fl_type = F_UNLCK;
-                if (cfl != NULL)
-                        memcpy(fl, cfl, sizeof(*fl));
+        /* Try local locking first */
+        cfl = posix_test_lock(filp, fl);
+        if (cfl != NULL) {
+                locks_copy_lock(fl, cfl);
+                goto out;
         }
+
+        if (nfs_have_delegation(inode, FMODE_READ))
+                goto out_noconflict;
+
+        if (NFS_SERVER(inode)->flags & NFS_MOUNT_NONLM)
+                goto out_noconflict;
+
+        status = NFS_PROTO(inode)->lock(filp, cmd, fl);
+out:
         unlock_kernel();
         return status;
+out_noconflict:
+        fl->fl_type = F_UNLCK;
+        goto out;
 }
 
 static int do_vfs_lock(struct file *file, struct file_lock *fl)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6922469d6fc5..f2781ca42761 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -358,6 +358,35 @@ out_no_root:
         return no_root_error;
 }
 
+static void nfs_init_timeout_values(struct rpc_timeout *to, int proto, unsigned int timeo, unsigned int retrans)
+{
+        to->to_initval = timeo * HZ / 10;
+        to->to_retries = retrans;
+        if (!to->to_retries)
+                to->to_retries = 2;
+
+        switch (proto) {
+        case IPPROTO_TCP:
+                if (!to->to_initval)
+                        to->to_initval = 60 * HZ;
+                if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
+                        to->to_initval = NFS_MAX_TCP_TIMEOUT;
+                to->to_increment = to->to_initval;
+                to->to_maxval = to->to_initval + (to->to_increment * to->to_retries);
+                to->to_exponential = 0;
+                break;
+        case IPPROTO_UDP:
+        default:
+                if (!to->to_initval)
+                        to->to_initval = 11 * HZ / 10;
+                if (to->to_initval > NFS_MAX_UDP_TIMEOUT)
+                        to->to_initval = NFS_MAX_UDP_TIMEOUT;
+                to->to_maxval = NFS_MAX_UDP_TIMEOUT;
+                to->to_exponential = 1;
+                break;
+        }
+}
+
 /*
  * Create an RPC client handle.
  */
@@ -367,22 +396,12 @@ nfs_create_client(struct nfs_server *server, const struct nfs_mount_data *data)
         struct rpc_timeout      timeparms;
         struct rpc_xprt         *xprt = NULL;
         struct rpc_clnt         *clnt = NULL;
-        int                     tcp   = (data->flags & NFS_MOUNT_TCP);
+        int                     proto = (data->flags & NFS_MOUNT_TCP) ? IPPROTO_TCP : IPPROTO_UDP;
 
-        /* Initialize timeout values */
-        timeparms.to_initval = data->timeo * HZ / 10;
-        timeparms.to_retries = data->retrans;
-        timeparms.to_maxval  = tcp ? RPC_MAX_TCP_TIMEOUT : RPC_MAX_UDP_TIMEOUT;
-        timeparms.to_exponential = 1;
-
-        if (!timeparms.to_initval)
-                timeparms.to_initval = (tcp ? 600 : 11) * HZ / 10;
-        if (!timeparms.to_retries)
-                timeparms.to_retries = 5;
+        nfs_init_timeout_values(&timeparms, proto, data->timeo, data->retrans);
 
         /* create transport and client */
-        xprt = xprt_create_proto(tcp ? IPPROTO_TCP : IPPROTO_UDP,
-                                 &server->addr, &timeparms);
+        xprt = xprt_create_proto(proto, &server->addr, &timeparms);
         if (IS_ERR(xprt)) {
                 dprintk("%s: cannot create RPC transport. Error = %ld\n",
                                 __FUNCTION__, PTR_ERR(xprt));
@@ -576,7 +595,6 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
                 { NFS_MOUNT_SOFT, ",soft", ",hard" },
                 { NFS_MOUNT_INTR, ",intr", "" },
                 { NFS_MOUNT_POSIX, ",posix", "" },
-                { NFS_MOUNT_TCP, ",tcp", ",udp" },
                 { NFS_MOUNT_NOCTO, ",nocto", "" },
                 { NFS_MOUNT_NOAC, ",noac", "" },
                 { NFS_MOUNT_NONLM, ",nolock", ",lock" },
@@ -585,6 +603,8 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
         };
         struct proc_nfs_info *nfs_infop;
         struct nfs_server *nfss = NFS_SB(mnt->mnt_sb);
+        char buf[12];
+        char *proto;
 
         seq_printf(m, ",v%d", nfss->rpc_ops->version);
         seq_printf(m, ",rsize=%d", nfss->rsize);
@@ -603,6 +623,18 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
                 else
                         seq_puts(m, nfs_infop->nostr);
         }
+        switch (nfss->client->cl_xprt->prot) {
+                case IPPROTO_TCP:
+                        proto = "tcp";
+                        break;
+                case IPPROTO_UDP:
+                        proto = "udp";
+                        break;
+                default:
+                        snprintf(buf, sizeof(buf), "%u", nfss->client->cl_xprt->prot);
+                        proto = buf;
+        }
+        seq_printf(m, ",proto=%s", proto);
         seq_puts(m, ",addr=");
         seq_escape(m, nfss->hostname, " \t\n\\");
         return 0;
@@ -753,7 +785,8 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr)
                 else
                         init_special_inode(inode, inode->i_mode, fattr->rdev);
 
-                nfsi->read_cache_jiffies = fattr->timestamp;
+                nfsi->read_cache_jiffies = fattr->time_start;
+                nfsi->last_updated = jiffies;
                 inode->i_atime = fattr->atime;
                 inode->i_mtime = fattr->mtime;
                 inode->i_ctime = fattr->ctime;
@@ -821,6 +854,11 @@ nfs_setattr(struct dentry *dentry, struct iattr *attr)
                         filemap_fdatawait(inode->i_mapping);
                 nfs_wb_all(inode);
         }
+        /*
+         * Return any delegations if we're going to change ACLs
+         */
+        if ((attr->ia_valid & (ATTR_MODE|ATTR_UID|ATTR_GID)) != 0)
+                nfs_inode_return_delegation(inode);
         error = NFS_PROTO(inode)->setattr(dentry, &fattr, attr);
         if (error == 0)
                 nfs_refresh_inode(inode, &fattr);
@@ -877,12 +915,10 @@ static int nfs_wait_on_inode(struct inode *inode)
         sigset_t oldmask;
         int error;
 
-        atomic_inc(&inode->i_count);
         rpc_clnt_sigmask(clnt, &oldmask);
         error = wait_on_bit_lock(&nfsi->flags, NFS_INO_REVALIDATING,
                                         nfs_wait_schedule, TASK_INTERRUPTIBLE);
         rpc_clnt_sigunmask(clnt, &oldmask);
-        iput(inode);
 
         return error;
 }
@@ -1021,15 +1057,11 @@ int nfs_open(struct inode *inode, struct file *filp)
         ctx->mode = filp->f_mode;
         nfs_file_set_open_context(filp, ctx);
         put_nfs_open_context(ctx);
-        if ((filp->f_mode & FMODE_WRITE) != 0)
-                nfs_begin_data_update(inode);
         return 0;
 }
 
 int nfs_release(struct inode *inode, struct file *filp)
 {
-        if ((filp->f_mode & FMODE_WRITE) != 0)
-                nfs_end_data_update(inode);
         nfs_file_clear_open_context(filp);
         return 0;
 }
@@ -1085,14 +1117,15 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
                 goto out;
         }
 
+        spin_lock(&inode->i_lock);
         status = nfs_update_inode(inode, &fattr, verifier);
         if (status) {
+                spin_unlock(&inode->i_lock);
                 dfprintk(PAGECACHE, "nfs_revalidate_inode: (%s/%Ld) refresh failed, error=%d\n",
                          inode->i_sb->s_id,
                          (long long)NFS_FILEID(inode), status);
                 goto out;
         }
-        spin_lock(&inode->i_lock);
         cache_validity = nfsi->cache_validity;
         nfsi->cache_validity &= ~NFS_INO_REVAL_PAGECACHE;
 
@@ -1100,7 +1133,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
          * We may need to keep the attributes marked as invalid if
          * we raced with nfs_end_attr_update().
          */
-        if (verifier == nfsi->cache_change_attribute)
+        if (time_after_eq(verifier, nfsi->cache_change_attribute))
                 nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME);
         spin_unlock(&inode->i_lock);
 
@@ -1167,7 +1200,7 @@ void nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
                 if (S_ISDIR(inode->i_mode)) {
                         memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
                         /* This ensures we revalidate child dentries */
-                        nfsi->cache_change_attribute++;
+                        nfsi->cache_change_attribute = jiffies;
                 }
                 spin_unlock(&inode->i_lock);
 
@@ -1199,20 +1232,19 @@ void nfs_end_data_update(struct inode *inode)
         struct nfs_inode *nfsi = NFS_I(inode);
 
         if (!nfs_have_delegation(inode, FMODE_READ)) {
-                /* Mark the attribute cache for revalidation */
-                spin_lock(&inode->i_lock);
-                nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
-                /* Directories and symlinks: invalidate page cache too */
-                if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))
+                /* Directories and symlinks: invalidate page cache */
+                if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) {
+                        spin_lock(&inode->i_lock);
                         nfsi->cache_validity |= NFS_INO_INVALID_DATA;
-                spin_unlock(&inode->i_lock);
+                        spin_unlock(&inode->i_lock);
+                }
         }
-        nfsi->cache_change_attribute ++;
+        nfsi->cache_change_attribute = jiffies;
         atomic_dec(&nfsi->data_updates);
 }
 
 /**
- * nfs_refresh_inode - verify consistency of the inode attribute cache
+ * nfs_check_inode_attributes - verify consistency of the inode attribute cache
  * @inode - pointer to inode
  * @fattr - updated attributes
  *
@@ -1220,17 +1252,12 @@ void nfs_end_data_update(struct inode *inode)
  * so that fattr carries weak cache consistency data, then it may
  * also update the ctime/mtime/change_attribute.
  */
-int nfs_refresh_inode(struct inode *inode, struct nfs_fattr *fattr)
+static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         loff_t cur_size, new_isize;
         int data_unstable;
 
-        /* Do we hold a delegation? */
-        if (nfs_have_delegation(inode, FMODE_READ))
-                return 0;
-
-        spin_lock(&inode->i_lock);
 
         /* Are we in the process of updating data on the server? */
         data_unstable = nfs_caches_unstable(inode);
@@ -1294,11 +1321,67 @@ int nfs_refresh_inode(struct inode *inode, struct nfs_fattr *fattr)
         if (!timespec_equal(&inode->i_atime, &fattr->atime))
                 nfsi->cache_validity |= NFS_INO_INVALID_ATIME;
 
-        nfsi->read_cache_jiffies = fattr->timestamp;
-        spin_unlock(&inode->i_lock);
+        nfsi->read_cache_jiffies = fattr->time_start;
         return 0;
 }
 
+/**
+ * nfs_refresh_inode - try to update the inode attribute cache
+ * @inode - pointer to inode
+ * @fattr - updated attributes
+ *
+ * Check that an RPC call that returned attributes has not overlapped with
+ * other recent updates of the inode metadata, then decide whether it is
+ * safe to do a full update of the inode attributes, or whether just to
+ * call nfs_check_inode_attributes.
+ */
+int nfs_refresh_inode(struct inode *inode, struct nfs_fattr *fattr)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+        int status;
+
+        if ((fattr->valid & NFS_ATTR_FATTR) == 0)
+                return 0;
+        spin_lock(&inode->i_lock);
+        nfsi->cache_validity &= ~NFS_INO_REVAL_PAGECACHE;
+        if (nfs_verify_change_attribute(inode, fattr->time_start))
+                nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME);
+        if (time_after(fattr->time_start, nfsi->last_updated))
+                status = nfs_update_inode(inode, fattr, fattr->time_start);
+        else
+                status = nfs_check_inode_attributes(inode, fattr);
+
+        spin_unlock(&inode->i_lock);
+        return status;
+}
+
+/**
+ * nfs_post_op_update_inode - try to update the inode attribute cache
+ * @inode - pointer to inode
+ * @fattr - updated attributes
+ *
+ * After an operation that has changed the inode metadata, mark the
+ * attribute cache as being invalid, then try to update it.
+ */
+int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+{
+        struct nfs_inode *nfsi = NFS_I(inode);
+        int status = 0;
+
+        spin_lock(&inode->i_lock);
+        if (unlikely((fattr->valid & NFS_ATTR_FATTR) == 0)) {
+                nfsi->cache_validity |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS;
+                goto out;
+        }
+        status = nfs_update_inode(inode, fattr, fattr->time_start);
+        if (time_after_eq(fattr->time_start, nfsi->cache_change_attribute))
+                nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ATIME|NFS_INO_REVAL_PAGECACHE);
+        nfsi->cache_change_attribute = jiffies;
+out:
+        spin_unlock(&inode->i_lock);
+        return status;
+}
+
 /*
  * Many nfs protocol calls return the new file attributes after
  * an operation.  Here we update the inode to reflect the state
@@ -1334,23 +1417,21 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
                 goto out_err;
         }
 
-        spin_lock(&inode->i_lock);
-
         /*
          * Make sure the inode's type hasn't changed.
          */
-        if ((inode->i_mode & S_IFMT) != (fattr->mode & S_IFMT)) {
-                spin_unlock(&inode->i_lock);
+        if ((inode->i_mode & S_IFMT) != (fattr->mode & S_IFMT))
                 goto out_changed;
-        }
 
         /*
          * Update the read time so we don't revalidate too often.
          */
-        nfsi->read_cache_jiffies = fattr->timestamp;
+        nfsi->read_cache_jiffies = fattr->time_start;
+        nfsi->last_updated = jiffies;
 
         /* Are we racing with known updates of the metadata on the server? */
-        data_unstable = ! nfs_verify_change_attribute(inode, verifier);
+        data_unstable = ! (nfs_verify_change_attribute(inode, verifier) ||
+                (nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE));
 
         /* Check if our cached file size is stale */
         new_isize = nfs_size_to_loff_t(fattr->size);
@@ -1359,7 +1440,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
                 /* Do we perhaps have any outstanding writes? */
                 if (nfsi->npages == 0) {
                         /* No, but did we race with nfs_end_data_update()? */
-                        if (verifier  ==  nfsi->cache_change_attribute) {
+                        if (time_after_eq(verifier,  nfsi->cache_change_attribute)) {
                                 inode->i_size = new_isize;
                                 invalid |= NFS_INO_INVALID_DATA;
                         }
@@ -1435,7 +1516,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr, unsign
         if (!nfs_have_delegation(inode, FMODE_READ))
                 nfsi->cache_validity |= invalid;
 
-        spin_unlock(&inode->i_lock);
         return 0;
  out_changed:
         /*
@@ -1644,8 +1724,7 @@ static void nfs4_clear_inode(struct inode *inode)
         struct nfs_inode *nfsi = NFS_I(inode);
 
         /* If we are holding a delegation, return it! */
-        if (nfsi->delegation != NULL)
-                nfs_inode_return_delegation(inode);
+        nfs_inode_return_delegation(inode);
         /* First call standard NFS clear_inode() code */
         nfs_clear_inode(inode);
         /* Now clear out any remaining state */
@@ -1674,7 +1753,7 @@ static int nfs4_fill_super(struct super_block *sb, struct nfs4_mount_data *data,
         struct rpc_clnt *clnt = NULL;
         struct rpc_timeout timeparms;
         rpc_authflavor_t authflavour;
-        int proto, err = -EIO;
+        int err = -EIO;
 
         sb->s_blocksize_bits = 0;
         sb->s_blocksize = 0;
@@ -1692,30 +1771,8 @@ static int nfs4_fill_super(struct super_block *sb, struct nfs4_mount_data *data,
         server->acdirmax = data->acdirmax*HZ;
 
         server->rpc_ops = &nfs_v4_clientops;
-        /* Initialize timeout values */
-
-        timeparms.to_initval = data->timeo * HZ / 10;
-        timeparms.to_retries = data->retrans;
-        timeparms.to_exponential = 1;
-        if (!timeparms.to_retries)
-                timeparms.to_retries = 5;
 
-        proto = data->proto;
-        /* Which IP protocol do we use? */
-        switch (proto) {
-        case IPPROTO_TCP:
-                timeparms.to_maxval  = RPC_MAX_TCP_TIMEOUT;
-                if (!timeparms.to_initval)
-                        timeparms.to_initval = 600 * HZ / 10;
-                break;
-        case IPPROTO_UDP:
-                timeparms.to_maxval  = RPC_MAX_UDP_TIMEOUT;
-                if (!timeparms.to_initval)
-                        timeparms.to_initval = 11 * HZ / 10;
-                break;
-        default:
-                return -EINVAL;
-        }
+        nfs_init_timeout_values(&timeparms, data->proto, data->timeo, data->retrans);
 
         clp = nfs4_get_client(&server->addr.sin_addr);
         if (!clp) {
@@ -1740,7 +1797,7 @@ static int nfs4_fill_super(struct super_block *sb, struct nfs4_mount_data *data,
 
         down_write(&clp->cl_sem);
         if (IS_ERR(clp->cl_rpcclient)) {
-                xprt = xprt_create_proto(proto, &server->addr, &timeparms);
+                xprt = xprt_create_proto(data->proto, &server->addr, &timeparms);
                 if (IS_ERR(xprt)) {
                         up_write(&clp->cl_sem);
                         err = PTR_ERR(xprt);
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index d91b69044a4d..59049e864ca7 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -143,7 +143,6 @@ xdr_decode_fattr(u32 *p, struct nfs_fattr *fattr)
                 fattr->mode = (fattr->mode & ~S_IFMT) | S_IFIFO;
                 fattr->rdev = 0;
         }
-        fattr->timestamp = jiffies;
         return p;
 }
 
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index edc95514046d..92c870d19ccd 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -78,7 +78,7 @@ nfs3_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("%s: call  fsinfo\n", __FUNCTION__);
-        info->fattr->valid = 0;
+        nfs_fattr_init(info->fattr);
         status = rpc_call(server->client_sys, NFS3PROC_FSINFO, fhandle, info, 0);
         dprintk("%s: reply fsinfo: %d\n", __FUNCTION__, status);
         if (!(info->fattr->valid & NFS_ATTR_FATTR)) {
@@ -98,7 +98,7 @@ nfs3_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  getattr\n");
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call(server->client, NFS3PROC_GETATTR,
                           fhandle, fattr, 0);
         dprintk("NFS reply getattr: %d\n", status);
@@ -117,7 +117,7 @@ nfs3_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         int     status;
 
         dprintk("NFS call  setattr\n");
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call(NFS_CLIENT(inode), NFS3PROC_SETATTR, &arg, fattr, 0);
         if (status == 0)
                 nfs_setattr_update_inode(inode, sattr);
@@ -143,8 +143,8 @@ nfs3_proc_lookup(struct inode *dir, struct qstr *name,
         int                     status;
 
         dprintk("NFS call  lookup %s\n", name->name);
-        dir_attr.valid = 0;
-        fattr->valid = 0;
+        nfs_fattr_init(&dir_attr);
+        nfs_fattr_init(fattr);
         status = rpc_call(NFS_CLIENT(dir), NFS3PROC_LOOKUP, &arg, &res, 0);
         if (status >= 0 && !(fattr->valid & NFS_ATTR_FATTR))
                 status = rpc_call(NFS_CLIENT(dir), NFS3PROC_GETATTR,
@@ -174,7 +174,6 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
         int status;
 
         dprintk("NFS call  access\n");
-        fattr.valid = 0;
 
         if (mode & MAY_READ)
                 arg.access |= NFS3_ACCESS_READ;
@@ -189,6 +188,7 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
                 if (mode & MAY_EXEC)
                         arg.access |= NFS3_ACCESS_EXECUTE;
         }
+        nfs_fattr_init(&fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
         nfs_refresh_inode(inode, &fattr);
         if (status == 0) {
@@ -217,7 +217,7 @@ static int nfs3_proc_readlink(struct inode *inode, struct page *page,
         int                     status;
 
         dprintk("NFS call  readlink\n");
-        fattr.valid = 0;
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(inode), NFS3PROC_READLINK,
                           &args, &fattr, 0);
         nfs_refresh_inode(inode, &fattr);
@@ -240,7 +240,7 @@ static int nfs3_proc_read(struct nfs_read_data *rdata)
 
         dprintk("NFS call  read %d @ %Ld\n", rdata->args.count,
                         (long long) rdata->args.offset);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, flags);
         if (status >= 0)
                 nfs_refresh_inode(inode, fattr);
@@ -263,10 +263,10 @@ static int nfs3_proc_write(struct nfs_write_data *wdata)
 
         dprintk("NFS call  write %d @ %Ld\n", wdata->args.count,
                         (long long) wdata->args.offset);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, rpcflags);
         if (status >= 0)
-                nfs_refresh_inode(inode, fattr);
+                nfs_post_op_update_inode(inode, fattr);
         dprintk("NFS reply write: %d\n", status);
         return status < 0? status : wdata->res.count;
 }
@@ -285,10 +285,10 @@ static int nfs3_proc_commit(struct nfs_write_data *cdata)
 
         dprintk("NFS call  commit %d @ %Ld\n", cdata->args.count,
                         (long long) cdata->args.offset);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
         if (status >= 0)
-                nfs_refresh_inode(inode, fattr);
+                nfs_post_op_update_inode(inode, fattr);
         dprintk("NFS reply commit: %d\n", status);
         return status;
 }
@@ -299,7 +299,7 @@ static int nfs3_proc_commit(struct nfs_write_data *cdata)
  */
 static int
 nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
-                 int flags)
+                 int flags, struct nameidata *nd)
 {
         struct nfs_fh           fhandle;
         struct nfs_fattr        fattr;
@@ -329,10 +329,10 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
         sattr->ia_mode &= ~current->fs->umask;
 
 again:
-        dir_attr.valid = 0;
-        fattr.valid = 0;
+        nfs_fattr_init(&dir_attr);
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(dir), NFS3PROC_CREATE, &arg, &res, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, &dir_attr);
 
         /* If the server doesn't support the exclusive creation semantics,
          * try again with simple 'guarded' mode. */
@@ -401,9 +401,9 @@ nfs3_proc_remove(struct inode *dir, struct qstr *name)
         int                     status;
 
         dprintk("NFS call  remove %s\n", name->name);
-        dir_attr.valid = 0;
+        nfs_fattr_init(&dir_attr);
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, &dir_attr);
         dprintk("NFS reply remove: %d\n", status);
         return status;
 }
@@ -422,7 +422,7 @@ nfs3_proc_unlink_setup(struct rpc_message *msg, struct dentry *dir, struct qstr
         ptr->arg.fh = NFS_FH(dir->d_inode);
         ptr->arg.name = name->name;
         ptr->arg.len = name->len;
-        ptr->res.valid = 0;
+        nfs_fattr_init(&ptr->res);
         msg->rpc_proc = &nfs3_procedures[NFS3PROC_REMOVE];
         msg->rpc_argp = &ptr->arg;
         msg->rpc_resp = &ptr->res;
@@ -439,7 +439,7 @@ nfs3_proc_unlink_done(struct dentry *dir, struct rpc_task *task)
                 return 1;
         if (msg->rpc_argp) {
                 dir_attr = (struct nfs_fattr*)msg->rpc_resp;
-                nfs_refresh_inode(dir->d_inode, dir_attr);
+                nfs_post_op_update_inode(dir->d_inode, dir_attr);
                 kfree(msg->rpc_argp);
         }
         return 0;
@@ -465,11 +465,11 @@ nfs3_proc_rename(struct inode *old_dir, struct qstr *old_name,
         int                     status;
 
         dprintk("NFS call  rename %s -> %s\n", old_name->name, new_name->name);
-        old_dir_attr.valid = 0;
-        new_dir_attr.valid = 0;
+        nfs_fattr_init(&old_dir_attr);
+        nfs_fattr_init(&new_dir_attr);
         status = rpc_call(NFS_CLIENT(old_dir), NFS3PROC_RENAME, &arg, &res, 0);
-        nfs_refresh_inode(old_dir, &old_dir_attr);
-        nfs_refresh_inode(new_dir, &new_dir_attr);
+        nfs_post_op_update_inode(old_dir, &old_dir_attr);
+        nfs_post_op_update_inode(new_dir, &new_dir_attr);
         dprintk("NFS reply rename: %d\n", status);
         return status;
 }
@@ -491,11 +491,11 @@ nfs3_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
         int                     status;
 
         dprintk("NFS call  link %s\n", name->name);
-        dir_attr.valid = 0;
-        fattr.valid = 0;
+        nfs_fattr_init(&dir_attr);
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(inode), NFS3PROC_LINK, &arg, &res, 0);
-        nfs_refresh_inode(dir, &dir_attr);
-        nfs_refresh_inode(inode, &fattr);
+        nfs_post_op_update_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(inode, &fattr);
         dprintk("NFS reply link: %d\n", status);
         return status;
 }
@@ -524,10 +524,10 @@ nfs3_proc_symlink(struct inode *dir, struct qstr *name, struct qstr *path,
         if (path->len > NFS3_MAXPATHLEN)
                 return -ENAMETOOLONG;
         dprintk("NFS call  symlink %s -> %s\n", name->name, path->name);
-        dir_attr.valid = 0;
-        fattr->valid = 0;
+        nfs_fattr_init(&dir_attr);
+        nfs_fattr_init(fattr);
         status = rpc_call(NFS_CLIENT(dir), NFS3PROC_SYMLINK, &arg, &res, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, &dir_attr);
         dprintk("NFS reply symlink: %d\n", status);
         return status;
 }
@@ -552,13 +552,13 @@ nfs3_proc_mkdir(struct inode *dir, struct dentry *dentry, struct iattr *sattr)
         int status;
 
         dprintk("NFS call  mkdir %s\n", dentry->d_name.name);
-        dir_attr.valid = 0;
-        fattr.valid = 0;
 
         sattr->ia_mode &= ~current->fs->umask;
 
+        nfs_fattr_init(&dir_attr);
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(dir), NFS3PROC_MKDIR, &arg, &res, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, &dir_attr);
         if (status != 0)
                 goto out;
         status = nfs_instantiate(dentry, &fhandle, &fattr);
@@ -582,9 +582,9 @@ nfs3_proc_rmdir(struct inode *dir, struct qstr *name)
         int                     status;
 
         dprintk("NFS call  rmdir %s\n", name->name);
-        dir_attr.valid = 0;
+        nfs_fattr_init(&dir_attr);
         status = rpc_call(NFS_CLIENT(dir), NFS3PROC_RMDIR, &arg, &dir_attr, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, &dir_attr);
         dprintk("NFS reply rmdir: %d\n", status);
         return status;
 }
@@ -634,7 +634,7 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
         dprintk("NFS call  readdir%s %d\n",
                         plus? "plus" : "", (unsigned int) cookie);
 
-        dir_attr.valid = 0;
+        nfs_fattr_init(&dir_attr);
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
         nfs_refresh_inode(dir, &dir_attr);
         dprintk("NFS reply readdir: %d\n", status);
@@ -676,10 +676,10 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
 
         sattr->ia_mode &= ~current->fs->umask;
 
-        dir_attr.valid = 0;
-        fattr.valid = 0;
+        nfs_fattr_init(&dir_attr);
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(dir), NFS3PROC_MKNOD, &arg, &res, 0);
-        nfs_refresh_inode(dir, &dir_attr);
+        nfs_post_op_update_inode(dir, &dir_attr);
         if (status != 0)
                 goto out;
         status = nfs_instantiate(dentry, &fh, &fattr);
@@ -698,7 +698,7 @@ nfs3_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  fsstat\n");
-        stat->fattr->valid = 0;
+        nfs_fattr_init(stat->fattr);
         status = rpc_call(server->client, NFS3PROC_FSSTAT, fhandle, stat, 0);
         dprintk("NFS reply statfs: %d\n", status);
         return status;
@@ -711,7 +711,7 @@ nfs3_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  fsinfo\n");
-        info->fattr->valid = 0;
+        nfs_fattr_init(info->fattr);
         status = rpc_call(server->client_sys, NFS3PROC_FSINFO, fhandle, info, 0);
         dprintk("NFS reply fsinfo: %d\n", status);
         return status;
@@ -724,7 +724,7 @@ nfs3_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  pathconf\n");
-        info->fattr->valid = 0;
+        nfs_fattr_init(info->fattr);
         status = rpc_call(server->client, NFS3PROC_PATHCONF, fhandle, info, 0);
         dprintk("NFS reply pathconf: %d\n", status);
         return status;
@@ -735,7 +735,7 @@ extern u32 *nfs3_decode_dirent(u32 *, struct nfs_entry *, int);
 static void
 nfs3_read_done(struct rpc_task *task)
 {
-        struct nfs_write_data *data = (struct nfs_write_data *) task->tk_calldata;
+        struct nfs_read_data *data = (struct nfs_read_data *) task->tk_calldata;
 
         if (nfs3_async_handle_jukebox(task))
                 return;
@@ -775,7 +775,7 @@ nfs3_write_done(struct rpc_task *task)
                 return;
         data = (struct nfs_write_data *)task->tk_calldata;
         if (task->tk_status >= 0)
-                nfs_refresh_inode(data->inode, data->res.fattr);
+                nfs_post_op_update_inode(data->inode, data->res.fattr);
         nfs_writeback_done(task);
 }
 
@@ -819,7 +819,7 @@ nfs3_commit_done(struct rpc_task *task)
                 return;
         data = (struct nfs_write_data *)task->tk_calldata;
         if (task->tk_status >= 0)
-                nfs_refresh_inode(data->inode, data->res.fattr);
+                nfs_post_op_update_inode(data->inode, data->res.fattr);
         nfs_commit_done(task);
 }
 
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index db4a904810a4..0498bd36602c 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -174,7 +174,6 @@ xdr_decode_fattr(u32 *p, struct nfs_fattr *fattr)
 
         /* Update the mode bits */
         fattr->valid |= (NFS_ATTR_FATTR | NFS_ATTR_FATTR_V3);
-        fattr->timestamp = jiffies;
         return p;
 }
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index ec1a22d7b876..78a53f5a9f18 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -93,25 +93,50 @@ struct nfs4_client {
 };
 
 /*
+ * struct rpc_sequence ensures that RPC calls are sent in the exact
+ * order that they appear on the list.
+ */
+struct rpc_sequence {
+        struct rpc_wait_queue   wait;   /* RPC call delay queue */
+        spinlock_t lock;                /* Protects the list */
+        struct list_head list;          /* Defines sequence of RPC calls */
+};
+
+#define NFS_SEQID_CONFIRMED 1
+struct nfs_seqid_counter {
+        struct rpc_sequence *sequence;
+        int flags;
+        u32 counter;
+};
+
+struct nfs_seqid {
+        struct nfs_seqid_counter *sequence;
+        struct list_head list;
+};
+
+static inline void nfs_confirm_seqid(struct nfs_seqid_counter *seqid, int status)
+{
+        if (seqid_mutating_err(-status))
+                seqid->flags |= NFS_SEQID_CONFIRMED;
+}
+
+/*
  * NFS4 state_owners and lock_owners are simply labels for ordered
  * sequences of RPC calls. Their sole purpose is to provide once-only
  * semantics by allowing the server to identify replayed requests.
- *
- * The ->so_sema is held during all state_owner seqid-mutating operations:
- * OPEN, OPEN_DOWNGRADE, and CLOSE. Its purpose is to properly serialize
- * so_seqid.
  */
 struct nfs4_state_owner {
+        spinlock_t           so_lock;
         struct list_head     so_list;    /* per-clientid list of state_owners */
         struct nfs4_client   *so_client;
         u32                  so_id;      /* 32-bit identifier, unique */
-        struct semaphore     so_sema;
-        u32                  so_seqid;   /* protected by so_sema */
         atomic_t             so_count;
 
         struct rpc_cred      *so_cred;   /* Associated cred */
         struct list_head     so_states;
         struct list_head     so_delegations;
+        struct nfs_seqid_counter so_seqid;
+        struct rpc_sequence  so_sequence;
 };
 
 /*
@@ -132,7 +157,7 @@ struct nfs4_lock_state {
         fl_owner_t              ls_owner;       /* POSIX lock owner */
 #define NFS_LOCK_INITIALIZED 1
         int                     ls_flags;
-        u32                     ls_seqid;
+        struct nfs_seqid_counter        ls_seqid;
         u32                     ls_id;
         nfs4_stateid            ls_stateid;
         atomic_t                ls_count;
@@ -153,7 +178,6 @@ struct nfs4_state {
         struct inode *inode;            /* Pointer to the inode */
 
         unsigned long flags;            /* Do we hold any locks? */
-        struct semaphore lock_sema;     /* Serializes file locking operations */
         spinlock_t state_lock;          /* Protects the lock_states list */
 
         nfs4_stateid stateid;
@@ -191,8 +215,8 @@ extern int nfs4_proc_setclientid_confirm(struct nfs4_client *);
 extern int nfs4_proc_async_renew(struct nfs4_client *);
 extern int nfs4_proc_renew(struct nfs4_client *);
 extern int nfs4_do_close(struct inode *inode, struct nfs4_state *state, mode_t mode);
-extern struct inode *nfs4_atomic_open(struct inode *, struct dentry *, struct nameidata *);
-extern int nfs4_open_revalidate(struct inode *, struct dentry *, int);
+extern struct dentry *nfs4_atomic_open(struct inode *, struct dentry *, struct nameidata *);
+extern int nfs4_open_revalidate(struct inode *, struct dentry *, int, struct nameidata *);
 
 extern struct nfs4_state_recovery_ops nfs4_reboot_recovery_ops;
 extern struct nfs4_state_recovery_ops nfs4_network_partition_recovery_ops;
@@ -224,12 +248,17 @@ extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state
 extern void nfs4_put_open_state(struct nfs4_state *);
 extern void nfs4_close_state(struct nfs4_state *, mode_t);
 extern struct nfs4_state *nfs4_find_state(struct inode *, struct rpc_cred *, mode_t mode);
-extern void nfs4_increment_seqid(int status, struct nfs4_state_owner *sp);
 extern void nfs4_schedule_state_recovery(struct nfs4_client *);
+extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
 extern int nfs4_set_lock_state(struct nfs4_state *state, struct file_lock *fl);
-extern void nfs4_increment_lock_seqid(int status, struct nfs4_lock_state *ls);
 extern void nfs4_copy_stateid(nfs4_stateid *, struct nfs4_state *, fl_owner_t);
 
+extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter);
+extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);
+extern void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid);
+extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid);
+extern void nfs_free_seqid(struct nfs_seqid *seqid);
+
 extern const nfs4_stateid zero_stateid;
 
 /* nfs4xdr.c */
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9701ca8c9428..933e13b383f8 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -47,6 +47,7 @@
 #include <linux/nfs_page.h>
 #include <linux/smp_lock.h>
 #include <linux/namei.h>
+#include <linux/mount.h>
 
 #include "nfs4_fs.h"
 #include "delegation.h"
@@ -56,10 +57,11 @@
 #define NFS4_POLL_RETRY_MIN     (1*HZ)
 #define NFS4_POLL_RETRY_MAX     (15*HZ)
 
+static int _nfs4_proc_open_confirm(struct rpc_clnt *clnt, const struct nfs_fh *fh, struct nfs4_state_owner *sp, nfs4_stateid *stateid, struct nfs_seqid *seqid);
 static int nfs4_do_fsinfo(struct nfs_server *, struct nfs_fh *, struct nfs_fsinfo *);
-static int nfs4_async_handle_error(struct rpc_task *, struct nfs_server *);
+static int nfs4_async_handle_error(struct rpc_task *, const struct nfs_server *);
 static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry);
-static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struct nfs4_exception *exception);
+static int nfs4_handle_exception(const struct nfs_server *server, int errorcode, struct nfs4_exception *exception);
 extern u32 *nfs4_decode_dirent(u32 *p, struct nfs_entry *entry, int plus);
 extern struct rpc_procinfo nfs4_procedures[];
 
@@ -185,8 +187,26 @@ static void update_changeattr(struct inode *inode, struct nfs4_change_info *cinf
 {
         struct nfs_inode *nfsi = NFS_I(inode);
 
+        spin_lock(&inode->i_lock);
+        nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
         if (cinfo->before == nfsi->change_attr && cinfo->atomic)
                 nfsi->change_attr = cinfo->after;
+        spin_unlock(&inode->i_lock);
+}
+
+/* Helper for asynchronous RPC calls */
+static int nfs4_call_async(struct rpc_clnt *clnt, rpc_action tk_begin,
+                rpc_action tk_exit, void *calldata)
+{
+        struct rpc_task *task;
+
+        if (!(task = rpc_new_task(clnt, tk_exit, RPC_TASK_ASYNC)))
+                return -ENOMEM;
+
+        task->tk_calldata = calldata;
+        task->tk_action = tk_begin;
+        rpc_execute(task);
+        return 0;
 }
 
 static void update_open_stateid(struct nfs4_state *state, nfs4_stateid *stateid, int open_flags)
@@ -195,6 +215,7 @@ static void update_open_stateid(struct nfs4_state *state, nfs4_stateid *stateid,
 
         open_flags &= (FMODE_READ|FMODE_WRITE);
         /* Protect against nfs4_find_state() */
+        spin_lock(&state->owner->so_lock);
         spin_lock(&inode->i_lock);
         state->state |= open_flags;
         /* NB! List reordering - see the reclaim code for why.  */
@@ -204,12 +225,12 @@ static void update_open_stateid(struct nfs4_state *state, nfs4_stateid *stateid,
                 state->nreaders++;
         memcpy(&state->stateid, stateid, sizeof(state->stateid));
         spin_unlock(&inode->i_lock);
+        spin_unlock(&state->owner->so_lock);
 }
 
 /*
  * OPEN_RECLAIM:
  *      reclaim state on the server after a reboot.
- *      Assumes caller is holding the sp->so_sem
  */
 static int _nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *state)
 {
@@ -218,7 +239,6 @@ static int _nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *st
         struct nfs_delegation *delegation = NFS_I(inode)->delegation;
         struct nfs_openargs o_arg = {
                 .fh = NFS_FH(inode),
-                .seqid = sp->so_seqid,
                 .id = sp->so_id,
                 .open_flags = state->state,
                 .clientid = server->nfs4_state->cl_clientid,
@@ -245,8 +265,13 @@ static int _nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *st
                 }
                 o_arg.u.delegation_type = delegation->type;
         }
+        o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
+        if (o_arg.seqid == NULL)
+                return -ENOMEM;
         status = rpc_call_sync(server->client, &msg, RPC_TASK_NOINTR);
-        nfs4_increment_seqid(status, sp);
+        /* Confirm the sequence as being established */
+        nfs_confirm_seqid(&sp->so_seqid, status);
+        nfs_increment_open_seqid(status, o_arg.seqid);
         if (status == 0) {
                 memcpy(&state->stateid, &o_res.stateid, sizeof(state->stateid));
                 if (o_res.delegation_type != 0) {
@@ -256,6 +281,7 @@ static int _nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *st
                                 nfs_async_inode_return_delegation(inode, &o_res.stateid);
                 }
         }
+        nfs_free_seqid(o_arg.seqid);
         clear_bit(NFS_DELEGATED_STATE, &state->flags);
         /* Ensure we update the inode attributes */
         NFS_CACHEINV(inode);
@@ -302,23 +328,35 @@ static int _nfs4_open_delegation_recall(struct dentry *dentry, struct nfs4_state
         };
         int status = 0;
 
-        down(&sp->so_sema);
         if (!test_bit(NFS_DELEGATED_STATE, &state->flags))
                 goto out;
         if (state->state == 0)
                 goto out;
-        arg.seqid = sp->so_seqid;
+        arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
+        status = -ENOMEM;
+        if (arg.seqid == NULL)
+                goto out;
         arg.open_flags = state->state;
         memcpy(arg.u.delegation.data, state->stateid.data, sizeof(arg.u.delegation.data));
         status = rpc_call_sync(server->client, &msg, RPC_TASK_NOINTR);
-        nfs4_increment_seqid(status, sp);
+        nfs_increment_open_seqid(status, arg.seqid);
+        if (status != 0)
+                goto out_free;
+        if(res.rflags & NFS4_OPEN_RESULT_CONFIRM) {
+                status = _nfs4_proc_open_confirm(server->client, NFS_FH(inode),
+                                sp, &res.stateid, arg.seqid);
+                if (status != 0)
+                        goto out_free;
+        }
+        nfs_confirm_seqid(&sp->so_seqid, 0);
         if (status >= 0) {
                 memcpy(state->stateid.data, res.stateid.data,
                                 sizeof(state->stateid.data));
                 clear_bit(NFS_DELEGATED_STATE, &state->flags);
         }
+out_free:
+        nfs_free_seqid(arg.seqid);
 out:
-        up(&sp->so_sema);
         dput(parent);
         return status;
 }
@@ -345,11 +383,11 @@ int nfs4_open_delegation_recall(struct dentry *dentry, struct nfs4_state *state)
         return err;
 }
 
-static inline int _nfs4_proc_open_confirm(struct rpc_clnt *clnt, const struct nfs_fh *fh, struct nfs4_state_owner *sp, nfs4_stateid *stateid)
+static int _nfs4_proc_open_confirm(struct rpc_clnt *clnt, const struct nfs_fh *fh, struct nfs4_state_owner *sp, nfs4_stateid *stateid, struct nfs_seqid *seqid)
 {
         struct nfs_open_confirmargs arg = {
                 .fh             = fh,
-                .seqid          = sp->so_seqid,
+                .seqid          = seqid,
                 .stateid        = *stateid,
         };
         struct nfs_open_confirmres res;
@@ -362,7 +400,9 @@ static inline int _nfs4_proc_open_confirm(struct rpc_clnt *clnt, const struct nf
         int status;
 
         status = rpc_call_sync(clnt, &msg, RPC_TASK_NOINTR);
-        nfs4_increment_seqid(status, sp);
+        /* Confirm the sequence as being established */
+        nfs_confirm_seqid(&sp->so_seqid, status);
+        nfs_increment_open_seqid(status, seqid);
         if (status >= 0)
                 memcpy(stateid, &res.stateid, sizeof(*stateid));
         return status;
@@ -380,21 +420,41 @@ static int _nfs4_proc_open(struct inode *dir, struct nfs4_state_owner  *sp, stru
         int status;
 
         /* Update sequence id. The caller must serialize! */
-        o_arg->seqid = sp->so_seqid;
         o_arg->id = sp->so_id;
         o_arg->clientid = sp->so_client->cl_clientid;
 
         status = rpc_call_sync(server->client, &msg, RPC_TASK_NOINTR);
-        nfs4_increment_seqid(status, sp);
+        if (status == 0) {
+                /* OPEN on anything except a regular file is disallowed in NFSv4 */
+                switch (o_res->f_attr->mode & S_IFMT) {
+                        case S_IFREG:
+                                break;
+                        case S_IFLNK:
+                                status = -ELOOP;
+                                break;
+                        case S_IFDIR:
+                                status = -EISDIR;
+                                break;
+                        default:
+                                status = -ENOTDIR;
+                }
+        }
+
+        nfs_increment_open_seqid(status, o_arg->seqid);
         if (status != 0)
                 goto out;
-        update_changeattr(dir, &o_res->cinfo);
+        if (o_arg->open_flags & O_CREAT) {
+                update_changeattr(dir, &o_res->cinfo);
+                nfs_post_op_update_inode(dir, o_res->dir_attr);
+        } else
+                nfs_refresh_inode(dir, o_res->dir_attr);
         if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
                 status = _nfs4_proc_open_confirm(server->client, &o_res->fh,
-                                sp, &o_res->stateid);
+                                sp, &o_res->stateid, o_arg->seqid);
                 if (status != 0)
                         goto out;
         }
+        nfs_confirm_seqid(&sp->so_seqid, 0);
         if (!(o_res->f_attr->valid & NFS_ATTR_FATTR))
                 status = server->rpc_ops->getattr(server, &o_res->fh, o_res->f_attr);
 out:
@@ -441,9 +501,7 @@ static int _nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
         struct inode *inode = state->inode;
         struct nfs_server *server = NFS_SERVER(dir);
         struct nfs_delegation *delegation = NFS_I(inode)->delegation;
-        struct nfs_fattr        f_attr = {
-                .valid = 0,
-        };
+        struct nfs_fattr f_attr, dir_attr;
         struct nfs_openargs o_arg = {
                 .fh = NFS_FH(dir),
                 .open_flags = state->state,
@@ -453,6 +511,7 @@ static int _nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
         };
         struct nfs_openres o_res = {
                 .f_attr = &f_attr,
+                .dir_attr = &dir_attr,
                 .server = server,
         };
         int status = 0;
@@ -465,6 +524,12 @@ static int _nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
                 set_bit(NFS_DELEGATED_STATE, &state->flags);
                 goto out;
         }
+        o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
+        status = -ENOMEM;
+        if (o_arg.seqid == NULL)
+                goto out;
+        nfs_fattr_init(&f_attr);
+        nfs_fattr_init(&dir_attr);
         status = _nfs4_proc_open(dir, sp, &o_arg, &o_res);
         if (status != 0)
                 goto out_nodeleg;
@@ -490,6 +555,7 @@ static int _nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
                         nfs_inode_reclaim_delegation(inode, sp->so_cred, &o_res);
         }
 out_nodeleg:
+        nfs_free_seqid(o_arg.seqid);
         clear_bit(NFS_DELEGATED_STATE, &state->flags);
 out:
         dput(parent);
@@ -564,7 +630,6 @@ static int _nfs4_open_delegated(struct inode *inode, int flags, struct rpc_cred
                 dprintk("%s: nfs4_get_state_owner failed!\n", __FUNCTION__);
                 goto out_err;
         }
-        down(&sp->so_sema);
         state = nfs4_get_open_state(inode, sp);
         if (state == NULL)
                 goto out_err;
@@ -589,7 +654,6 @@ static int _nfs4_open_delegated(struct inode *inode, int flags, struct rpc_cred
         set_bit(NFS_DELEGATED_STATE, &state->flags);
         update_open_stateid(state, &delegation->stateid, open_flags);
 out_ok:
-        up(&sp->so_sema);
         nfs4_put_state_owner(sp);
         up_read(&nfsi->rwsem);
         up_read(&clp->cl_sem);
@@ -600,11 +664,12 @@ out_err:
         if (sp != NULL) {
                 if (state != NULL)
                         nfs4_put_open_state(state);
-                up(&sp->so_sema);
                 nfs4_put_state_owner(sp);
         }
         up_read(&nfsi->rwsem);
         up_read(&clp->cl_sem);
+        if (err != -EACCES)
+                nfs_inode_return_delegation(inode);
         return err;
 }
 
@@ -635,9 +700,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
         struct nfs4_client *clp = server->nfs4_state;
         struct inode *inode = NULL;
         int                     status;
-        struct nfs_fattr        f_attr = {
-                .valid          = 0,
-        };
+        struct nfs_fattr f_attr, dir_attr;
         struct nfs_openargs o_arg = {
                 .fh             = NFS_FH(dir),
                 .open_flags     = flags,
@@ -648,6 +711,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
         };
         struct nfs_openres o_res = {
                 .f_attr         = &f_attr,
+                .dir_attr       = &dir_attr,
                 .server         = server,
         };
 
@@ -665,8 +729,12 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
         } else
                 o_arg.u.attrs = sattr;
         /* Serialization for the sequence id */
-        down(&sp->so_sema);
 
+        o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
+        if (o_arg.seqid == NULL)
+                return -ENOMEM;
+        nfs_fattr_init(&f_attr);
+        nfs_fattr_init(&dir_attr);
         status = _nfs4_proc_open(dir, sp, &o_arg, &o_res);
         if (status != 0)
                 goto out_err;
@@ -681,7 +749,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, int flags, st
         update_open_stateid(state, &o_res.stateid, flags);
         if (o_res.delegation_type != 0)
                 nfs_inode_set_delegation(inode, cred, &o_res);
-        up(&sp->so_sema);
+        nfs_free_seqid(o_arg.seqid);
         nfs4_put_state_owner(sp);
         up_read(&clp->cl_sem);
         *res = state;
@@ -690,7 +758,7 @@ out_err:
         if (sp != NULL) {
                 if (state != NULL)
                         nfs4_put_open_state(state);
-                up(&sp->so_sema);
+                nfs_free_seqid(o_arg.seqid);
                 nfs4_put_state_owner(sp);
         }
         /* Note: clp->cl_sem must be released before nfs4_put_open_state()! */
@@ -718,7 +786,7 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir, struct dentry *dentry,
                  * It is actually a sign of a bug on the client or on the server.
                  *
                  * If we receive a BAD_SEQID error in the particular case of
-                 * doing an OPEN, we assume that nfs4_increment_seqid() will
+                 * doing an OPEN, we assume that nfs_increment_open_seqid() will
                  * have unhashed the old state_owner for us, and that we can
                  * therefore safely retry using a new one. We should still warn
                  * the user though...
@@ -728,6 +796,16 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir, struct dentry *dentry,
                         exception.retry = 1;
                         continue;
                 }
+                /*
+                 * BAD_STATEID on OPEN means that the server cancelled our
+                 * state before it received the OPEN_CONFIRM.
+                 * Recover by retrying the request as per the discussion
+                 * on Page 181 of RFC3530.
+                 */
+                if (status == -NFS4ERR_BAD_STATEID) {
+                        exception.retry = 1;
+                        continue;
+                }
                 res = ERR_PTR(nfs4_handle_exception(NFS_SERVER(dir),
                                         status, &exception));
         } while (exception.retry);
@@ -755,7 +833,7 @@ static int _nfs4_do_setattr(struct nfs_server *server, struct nfs_fattr *fattr,
         };
         int status;
 
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
 
         if (state != NULL) {
                 msg.rpc_cred = state->owner->so_cred;
@@ -787,19 +865,30 @@ struct nfs4_closedata {
         struct nfs4_state *state;
         struct nfs_closeargs arg;
         struct nfs_closeres res;
+        struct nfs_fattr fattr;
 };
 
+static void nfs4_free_closedata(struct nfs4_closedata *calldata)
+{
+        struct nfs4_state *state = calldata->state;
+        struct nfs4_state_owner *sp = state->owner;
+
+        nfs4_put_open_state(calldata->state);
+        nfs_free_seqid(calldata->arg.seqid);
+        nfs4_put_state_owner(sp);
+        kfree(calldata);
+}
+
 static void nfs4_close_done(struct rpc_task *task)
 {
         struct nfs4_closedata *calldata = (struct nfs4_closedata *)task->tk_calldata;
         struct nfs4_state *state = calldata->state;
-        struct nfs4_state_owner *sp = state->owner;
         struct nfs_server *server = NFS_SERVER(calldata->inode);
 
         /* hmm. we are done with the inode, and in the process of freeing
          * the state_owner. we keep this around to process errors
          */
-        nfs4_increment_seqid(task->tk_status, sp);
+        nfs_increment_open_seqid(task->tk_status, calldata->arg.seqid);
         switch (task->tk_status) {
                 case 0:
                         memcpy(&state->stateid, &calldata->res.stateid,
@@ -816,25 +905,49 @@ static void nfs4_close_done(struct rpc_task *task)
                                 return;
                         }
         }
+        nfs_refresh_inode(calldata->inode, calldata->res.fattr);
         state->state = calldata->arg.open_flags;
-        nfs4_put_open_state(state);
-        up(&sp->so_sema);
-        nfs4_put_state_owner(sp);
-        up_read(&server->nfs4_state->cl_sem);
-        kfree(calldata);
+        nfs4_free_closedata(calldata);
 }
 
-static inline int nfs4_close_call(struct rpc_clnt *clnt, struct nfs4_closedata *calldata)
+static void nfs4_close_begin(struct rpc_task *task)
 {
+        struct nfs4_closedata *calldata = (struct nfs4_closedata *)task->tk_calldata;
+        struct nfs4_state *state = calldata->state;
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CLOSE],
                 .rpc_argp = &calldata->arg,
                 .rpc_resp = &calldata->res,
-                .rpc_cred = calldata->state->owner->so_cred,
+                .rpc_cred = state->owner->so_cred,
         };
-        if (calldata->arg.open_flags != 0)
+        int mode = 0;
+        int status;
+
+        status = nfs_wait_on_sequence(calldata->arg.seqid, task);
+        if (status != 0)
+                return;
+        /* Don't reorder reads */
+        smp_rmb();
+        /* Recalculate the new open mode in case someone reopened the file
+         * while we were waiting in line to be scheduled.
+         */
+        if (state->nreaders != 0)
+                mode |= FMODE_READ;
+        if (state->nwriters != 0)
+                mode |= FMODE_WRITE;
+        if (test_bit(NFS_DELEGATED_STATE, &state->flags))
+                state->state = mode;
+        if (mode == state->state) {
+                nfs4_free_closedata(calldata);
+                task->tk_exit = NULL;
+                rpc_exit(task, 0);
+                return;
+        }
+        nfs_fattr_init(calldata->res.fattr);
+        if (mode != 0)
                 msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
-        return rpc_call_async(clnt, &msg, 0, nfs4_close_done, calldata);
+        calldata->arg.open_flags = mode;
+        rpc_call_setup(task, &msg, 0);
 }
 
 /* 
@@ -850,40 +963,57 @@ static inline int nfs4_close_call(struct rpc_clnt *clnt, struct nfs4_closedata *
  */
 int nfs4_do_close(struct inode *inode, struct nfs4_state *state, mode_t mode) 
 {
+        struct nfs_server *server = NFS_SERVER(inode);
         struct nfs4_closedata *calldata;
-        int status;
+        int status = -ENOMEM;
 
-        /* Tell caller we're done */
-        if (test_bit(NFS_DELEGATED_STATE, &state->flags)) {
-                state->state = mode;
-                return 0;
-        }
-        calldata = (struct nfs4_closedata *)kmalloc(sizeof(*calldata), GFP_KERNEL);
+        calldata = kmalloc(sizeof(*calldata), GFP_KERNEL);
         if (calldata == NULL)
-                return -ENOMEM;
+                goto out;
         calldata->inode = inode;
         calldata->state = state;
         calldata->arg.fh = NFS_FH(inode);
+        calldata->arg.stateid = &state->stateid;
         /* Serialization for the sequence id */
-        calldata->arg.seqid = state->owner->so_seqid;
-        calldata->arg.open_flags = mode;
-        memcpy(&calldata->arg.stateid, &state->stateid,
-                        sizeof(calldata->arg.stateid));
-        status = nfs4_close_call(NFS_SERVER(inode)->client, calldata);
-        /*
-         * Return -EINPROGRESS on success in order to indicate to the
-         * caller that an asynchronous RPC call has been launched, and
-         * that it will release the semaphores on completion.
-         */
-        return (status == 0) ? -EINPROGRESS : status;
+        calldata->arg.seqid = nfs_alloc_seqid(&state->owner->so_seqid);
+        if (calldata->arg.seqid == NULL)
+                goto out_free_calldata;
+        calldata->arg.bitmask = server->attr_bitmask;
+        calldata->res.fattr = &calldata->fattr;
+        calldata->res.server = server;
+
+        status = nfs4_call_async(server->client, nfs4_close_begin,
+                        nfs4_close_done, calldata);
+        if (status == 0)
+                goto out;
+
+        nfs_free_seqid(calldata->arg.seqid);
+out_free_calldata:
+        kfree(calldata);
+out:
+        return status;
 }
 
-struct inode *
+static void nfs4_intent_set_file(struct nameidata *nd, struct dentry *dentry, struct nfs4_state *state)
+{
+        struct file *filp;
+
+        filp = lookup_instantiate_filp(nd, dentry, NULL);
+        if (!IS_ERR(filp)) {
+                struct nfs_open_context *ctx;
+                ctx = (struct nfs_open_context *)filp->private_data;
+                ctx->state = state;
+        } else
+                nfs4_close_state(state, nd->intent.open.flags);
+}
+
+struct dentry *
 nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
         struct iattr attr;
         struct rpc_cred *cred;
         struct nfs4_state *state;
+        struct dentry *res;
 
         if (nd->flags & LOOKUP_CREATE) {
                 attr.ia_mode = nd->intent.open.create_mode;
@@ -897,16 +1027,23 @@ nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 
         cred = rpcauth_lookupcred(NFS_SERVER(dir)->client->cl_auth, 0);
         if (IS_ERR(cred))
-                return (struct inode *)cred;
+                return (struct dentry *)cred;
         state = nfs4_do_open(dir, dentry, nd->intent.open.flags, &attr, cred);
         put_rpccred(cred);
-        if (IS_ERR(state))
-                return (struct inode *)state;
-        return state->inode;
+        if (IS_ERR(state)) {
+                if (PTR_ERR(state) == -ENOENT)
+                        d_add(dentry, NULL);
+                return (struct dentry *)state;
+        }
+        res = d_add_unique(dentry, state->inode);
+        if (res != NULL)
+                dentry = res;
+        nfs4_intent_set_file(nd, dentry, state);
+        return res;
 }
 
 int
-nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags)
+nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags, struct nameidata *nd)
 {
         struct rpc_cred *cred;
         struct nfs4_state *state;
@@ -919,18 +1056,30 @@ nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags)
         if (IS_ERR(state))
                 state = nfs4_do_open(dir, dentry, openflags, NULL, cred);
         put_rpccred(cred);
-        if (state == ERR_PTR(-ENOENT) && dentry->d_inode == 0)
-                return 1;
-        if (IS_ERR(state))
-                return 0;
+        if (IS_ERR(state)) {
+                switch (PTR_ERR(state)) {
+                        case -EPERM:
+                        case -EACCES:
+                        case -EDQUOT:
+                        case -ENOSPC:
+                        case -EROFS:
+                                lookup_instantiate_filp(nd, (struct dentry *)state, NULL);
+                                return 1;
+                        case -ENOENT:
+                                if (dentry->d_inode == NULL)
+                                        return 1;
+                }
+                goto out_drop;
+        }
         inode = state->inode;
+        iput(inode);
         if (inode == dentry->d_inode) {
-                iput(inode);
+                nfs4_intent_set_file(nd, dentry, state);
                 return 1;
         }
-        d_drop(dentry);
         nfs4_close_state(state, openflags);
-        iput(inode);
+out_drop:
+        d_drop(dentry);
         return 0;
 }
 
@@ -974,13 +1123,12 @@ static int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fh
 static int _nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
                 struct nfs_fsinfo *info)
 {
-        struct nfs_fattr *      fattr = info->fattr;
         struct nfs4_lookup_root_arg args = {
                 .bitmask = nfs4_fattr_bitmap,
         };
         struct nfs4_lookup_res res = {
                 .server = server,
-                .fattr = fattr,
+                .fattr = info->fattr,
                 .fh = fhandle,
         };
         struct rpc_message msg = {
@@ -988,7 +1136,7 @@ static int _nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
                 .rpc_argp = &args,
                 .rpc_resp = &res,
         };
-        fattr->valid = 0;
+        nfs_fattr_init(info->fattr);
         return rpc_call_sync(server->client, &msg, 0);
 }
 
@@ -1051,7 +1199,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
                 q.len = p - q.name;
 
                 do {
-                        fattr->valid = 0;
+                        nfs_fattr_init(fattr);
                         status = nfs4_handle_exception(server,
                                         rpc_call_sync(server->client, &msg, 0),
                                         &exception);
@@ -1088,7 +1236,7 @@ static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
                 .rpc_resp = &res,
         };
         
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         return rpc_call_sync(server->client, &msg, 0);
 }
 
@@ -1130,7 +1278,7 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         struct nfs4_state *state;
         int status;
 
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         
         cred = rpcauth_lookupcred(NFS_SERVER(inode)->client->cl_auth, 0);
         if (IS_ERR(cred))
@@ -1176,7 +1324,7 @@ static int _nfs4_proc_lookup(struct inode *dir, struct qstr *name,
                 .rpc_resp = &res,
         };
         
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         
         dprintk("NFS call  lookup %s\n", name->name);
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
@@ -1325,7 +1473,7 @@ static int _nfs4_proc_read(struct nfs_read_data *rdata)
         dprintk("NFS call  read %d @ %Ld\n", rdata->args.count,
                         (long long) rdata->args.offset);
 
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(server->client, &msg, flags);
         if (!status)
                 renew_lease(server, timestamp);
@@ -1362,7 +1510,7 @@ static int _nfs4_proc_write(struct nfs_write_data *wdata)
         dprintk("NFS call  write %d @ %Ld\n", wdata->args.count,
                         (long long) wdata->args.offset);
 
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(server->client, &msg, rpcflags);
         dprintk("NFS reply write: %d\n", status);
         return status;
@@ -1396,7 +1544,7 @@ static int _nfs4_proc_commit(struct nfs_write_data *cdata)
         dprintk("NFS call  commit %d @ %Ld\n", cdata->args.count,
                         (long long) cdata->args.offset);
 
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(server->client, &msg, 0);
         dprintk("NFS reply commit: %d\n", status);
         return status;
@@ -1431,7 +1579,7 @@ static int nfs4_proc_commit(struct nfs_write_data *cdata)
 
 static int
 nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
-                 int flags)
+                 int flags, struct nameidata *nd)
 {
         struct nfs4_state *state;
         struct rpc_cred *cred;
@@ -1453,24 +1601,30 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                 struct nfs_fattr fattr;
                 status = nfs4_do_setattr(NFS_SERVER(dir), &fattr,
                                      NFS_FH(state->inode), sattr, state);
-                if (status == 0) {
+                if (status == 0)
                         nfs_setattr_update_inode(state->inode, sattr);
-                        goto out;
-                }
-        } else if (flags != 0)
-                goto out;
-        nfs4_close_state(state, flags);
+        }
+        if (status == 0 && nd != NULL && (nd->flags & LOOKUP_OPEN))
+                nfs4_intent_set_file(nd, dentry, state);
+        else
+                nfs4_close_state(state, flags);
 out:
         return status;
 }
 
 static int _nfs4_proc_remove(struct inode *dir, struct qstr *name)
 {
+        struct nfs_server *server = NFS_SERVER(dir);
         struct nfs4_remove_arg args = {
                 .fh = NFS_FH(dir),
                 .name = name,
+                .bitmask = server->attr_bitmask,
+        };
+        struct nfs_fattr dir_attr;
+        struct nfs4_remove_res  res = {
+                .server = server,
+                .dir_attr = &dir_attr,
         };
-        struct nfs4_change_info res;
         struct rpc_message msg = {
                 .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_REMOVE],
                 .rpc_argp       = &args,
@@ -1478,9 +1632,12 @@ static int _nfs4_proc_remove(struct inode *dir, struct qstr *name)
         };
         int                     status;
 
-        status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
-        if (status == 0)
-                update_changeattr(dir, &res);
+        nfs_fattr_init(res.dir_attr);
+        status = rpc_call_sync(server->client, &msg, 0);
+        if (status == 0) {
+                update_changeattr(dir, &res.cinfo);
+                nfs_post_op_update_inode(dir, res.dir_attr);
+        }
         return status;
 }
 
@@ -1498,12 +1655,14 @@ static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
 
 struct unlink_desc {
         struct nfs4_remove_arg  args;
-        struct nfs4_change_info res;
+        struct nfs4_remove_res  res;
+        struct nfs_fattr dir_attr;
 };
 
 static int nfs4_proc_unlink_setup(struct rpc_message *msg, struct dentry *dir,
                 struct qstr *name)
 {
+        struct nfs_server *server = NFS_SERVER(dir->d_inode);
         struct unlink_desc *up;
 
         up = (struct unlink_desc *) kmalloc(sizeof(*up), GFP_KERNEL);
@@ -1512,6 +1671,9 @@ static int nfs4_proc_unlink_setup(struct rpc_message *msg, struct dentry *dir,
         
         up->args.fh = NFS_FH(dir->d_inode);
         up->args.name = name;
+        up->args.bitmask = server->attr_bitmask;
+        up->res.server = server;
+        up->res.dir_attr = &up->dir_attr;
         
         msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_REMOVE];
         msg->rpc_argp = &up->args;
@@ -1526,7 +1688,8 @@ static int nfs4_proc_unlink_done(struct dentry *dir, struct rpc_task *task)
         
         if (msg->rpc_resp != NULL) {
                 up = container_of(msg->rpc_resp, struct unlink_desc, res);
-                update_changeattr(dir->d_inode, &up->res);
+                update_changeattr(dir->d_inode, &up->res.cinfo);
+                nfs_post_op_update_inode(dir->d_inode, up->res.dir_attr);
                 kfree(up);
                 msg->rpc_resp = NULL;
                 msg->rpc_argp = NULL;
@@ -1537,13 +1700,20 @@ static int nfs4_proc_unlink_done(struct dentry *dir, struct rpc_task *task)
 static int _nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
                 struct inode *new_dir, struct qstr *new_name)
 {
+        struct nfs_server *server = NFS_SERVER(old_dir);
         struct nfs4_rename_arg arg = {
                 .old_dir = NFS_FH(old_dir),
                 .new_dir = NFS_FH(new_dir),
                 .old_name = old_name,
                 .new_name = new_name,
+                .bitmask = server->attr_bitmask,
+        };
+        struct nfs_fattr old_fattr, new_fattr;
+        struct nfs4_rename_res res = {
+                .server = server,
+                .old_fattr = &old_fattr,
+                .new_fattr = &new_fattr,
         };
-        struct nfs4_rename_res res = { };
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_RENAME],
                 .rpc_argp = &arg,
@@ -1551,11 +1721,15 @@ static int _nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
         };
         int                     status;
         
-        status = rpc_call_sync(NFS_CLIENT(old_dir), &msg, 0);
+        nfs_fattr_init(res.old_fattr);
+        nfs_fattr_init(res.new_fattr);
+        status = rpc_call_sync(server->client, &msg, 0);
 
         if (!status) {
                 update_changeattr(old_dir, &res.old_cinfo);
+                nfs_post_op_update_inode(old_dir, res.old_fattr);
                 update_changeattr(new_dir, &res.new_cinfo);
+                nfs_post_op_update_inode(new_dir, res.new_fattr);
         }
         return status;
 }
@@ -1576,22 +1750,34 @@ static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
 
 static int _nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
 {
+        struct nfs_server *server = NFS_SERVER(inode);
         struct nfs4_link_arg arg = {
                 .fh     = NFS_FH(inode),
                 .dir_fh = NFS_FH(dir),
                 .name   = name,
+                .bitmask = server->attr_bitmask,
+        };
+        struct nfs_fattr fattr, dir_attr;
+        struct nfs4_link_res res = {
+                .server = server,
+                .fattr = &fattr,
+                .dir_attr = &dir_attr,
         };
-        struct nfs4_change_info cinfo = { };
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LINK],
                 .rpc_argp = &arg,
-                .rpc_resp = &cinfo,
+                .rpc_resp = &res,
         };
         int                     status;
 
-        status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
-        if (!status)
-                update_changeattr(dir, &cinfo);
+        nfs_fattr_init(res.fattr);
+        nfs_fattr_init(res.dir_attr);
+        status = rpc_call_sync(server->client, &msg, 0);
+        if (!status) {
+                update_changeattr(dir, &res.cinfo);
+                nfs_post_op_update_inode(dir, res.dir_attr);
+                nfs_refresh_inode(inode, res.fattr);
+        }
 
         return status;
 }
@@ -1613,6 +1799,7 @@ static int _nfs4_proc_symlink(struct inode *dir, struct qstr *name,
                 struct nfs_fattr *fattr)
 {
         struct nfs_server *server = NFS_SERVER(dir);
+        struct nfs_fattr dir_fattr;
         struct nfs4_create_arg arg = {
                 .dir_fh = NFS_FH(dir),
                 .server = server,
@@ -1625,6 +1812,7 @@ static int _nfs4_proc_symlink(struct inode *dir, struct qstr *name,
                 .server = server,
                 .fh = fhandle,
                 .fattr = fattr,
+                .dir_fattr = &dir_fattr,
         };
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_SYMLINK],
@@ -1636,11 +1824,13 @@ static int _nfs4_proc_symlink(struct inode *dir, struct qstr *name,
         if (path->len > NFS4_MAXPATHLEN)
                 return -ENAMETOOLONG;
         arg.u.symlink = path;
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
+        nfs_fattr_init(&dir_fattr);
         
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
         if (!status)
                 update_changeattr(dir, &res.dir_cinfo);
+        nfs_post_op_update_inode(dir, res.dir_fattr);
         return status;
 }
 
@@ -1664,7 +1854,7 @@ static int _nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
 {
         struct nfs_server *server = NFS_SERVER(dir);
         struct nfs_fh fhandle;
-        struct nfs_fattr fattr;
+        struct nfs_fattr fattr, dir_fattr;
         struct nfs4_create_arg arg = {
                 .dir_fh = NFS_FH(dir),
                 .server = server,
@@ -1677,6 +1867,7 @@ static int _nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
                 .server = server,
                 .fh = &fhandle,
                 .fattr = &fattr,
+                .dir_fattr = &dir_fattr,
         };
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CREATE],
@@ -1685,11 +1876,13 @@ static int _nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
         };
         int                     status;
 
-        fattr.valid = 0;
+        nfs_fattr_init(&fattr);
+        nfs_fattr_init(&dir_fattr);
         
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
         if (!status) {
                 update_changeattr(dir, &res.dir_cinfo);
+                nfs_post_op_update_inode(dir, res.dir_fattr);
                 status = nfs_instantiate(dentry, &fhandle, &fattr);
         }
         return status;
@@ -1762,7 +1955,7 @@ static int _nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
 {
         struct nfs_server *server = NFS_SERVER(dir);
         struct nfs_fh fh;
-        struct nfs_fattr fattr;
+        struct nfs_fattr fattr, dir_fattr;
         struct nfs4_create_arg arg = {
                 .dir_fh = NFS_FH(dir),
                 .server = server,
@@ -1774,6 +1967,7 @@ static int _nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
                 .server = server,
                 .fh = &fh,
                 .fattr = &fattr,
+                .dir_fattr = &dir_fattr,
         };
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CREATE],
@@ -1783,7 +1977,8 @@ static int _nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
         int                     status;
         int                     mode = sattr->ia_mode;
 
-        fattr.valid = 0;
+        nfs_fattr_init(&fattr);
+        nfs_fattr_init(&dir_fattr);
 
         BUG_ON(!(sattr->ia_valid & ATTR_MODE));
         BUG_ON(!S_ISFIFO(mode) && !S_ISBLK(mode) && !S_ISCHR(mode) && !S_ISSOCK(mode));
@@ -1805,6 +2000,7 @@ static int _nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
         if (status == 0) {
                 update_changeattr(dir, &res.dir_cinfo);
+                nfs_post_op_update_inode(dir, res.dir_fattr);
                 status = nfs_instantiate(dentry, &fh, &fattr);
         }
         return status;
@@ -1836,7 +2032,7 @@ static int _nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle,
                 .rpc_resp = fsstat,
         };
 
-        fsstat->fattr->valid = 0;
+        nfs_fattr_init(fsstat->fattr);
         return rpc_call_sync(server->client, &msg, 0);
 }
 
@@ -1883,7 +2079,7 @@ static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, str
 
 static int nfs4_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
 {
-        fsinfo->fattr->valid = 0;
+        nfs_fattr_init(fsinfo->fattr);
         return nfs4_do_fsinfo(server, fhandle, fsinfo);
 }
 
@@ -1906,7 +2102,7 @@ static int _nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle
                 return 0;
         }
 
-        pathconf->fattr->valid = 0;
+        nfs_fattr_init(pathconf->fattr);
         return rpc_call_sync(server->client, &msg, 0);
 }
 
@@ -1973,8 +2169,10 @@ nfs4_write_done(struct rpc_task *task)
                 rpc_restart_call(task);
                 return;
         }
-        if (task->tk_status >= 0)
+        if (task->tk_status >= 0) {
                 renew_lease(NFS_SERVER(inode), data->timestamp);
+                nfs_post_op_update_inode(inode, data->res.fattr);
+        }
         /* Call back common NFS writeback processing */
         nfs_writeback_done(task);
 }
@@ -1990,6 +2188,7 @@ nfs4_proc_write_setup(struct nfs_write_data *data, int how)
                 .rpc_cred = data->cred,
         };
         struct inode *inode = data->inode;
+        struct nfs_server *server = NFS_SERVER(inode);
         int stable;
         int flags;
         
@@ -2001,6 +2200,8 @@ nfs4_proc_write_setup(struct nfs_write_data *data, int how)
         } else
                 stable = NFS_UNSTABLE;
         data->args.stable = stable;
+        data->args.bitmask = server->attr_bitmask;
+        data->res.server = server;
 
         data->timestamp   = jiffies;
 
@@ -2022,6 +2223,8 @@ nfs4_commit_done(struct rpc_task *task)
                 rpc_restart_call(task);
                 return;
         }
+        if (task->tk_status >= 0)
+                nfs_post_op_update_inode(inode, data->res.fattr);
         /* Call back common NFS writeback processing */
         nfs_commit_done(task);
 }
@@ -2037,8 +2240,12 @@ nfs4_proc_commit_setup(struct nfs_write_data *data, int how)
                 .rpc_cred = data->cred,
         };      
         struct inode *inode = data->inode;
+        struct nfs_server *server = NFS_SERVER(inode);
         int flags;
         
+        data->args.bitmask = server->attr_bitmask;
+        data->res.server = server;
+
         /* Set the initial flags for the task.  */
         flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
 
@@ -2106,65 +2313,6 @@ nfs4_proc_renew(struct nfs4_client *clp)
         return 0;
 }
 
-/*
- * We will need to arrange for the VFS layer to provide an atomic open.
- * Until then, this open method is prone to inefficiency and race conditions
- * due to the lookup, potential create, and open VFS calls from sys_open()
- * placed on the wire.
- */
-static int
-nfs4_proc_file_open(struct inode *inode, struct file *filp)
-{
-        struct dentry *dentry = filp->f_dentry;
-        struct nfs_open_context *ctx;
-        struct nfs4_state *state = NULL;
-        struct rpc_cred *cred;
-        int status = -ENOMEM;
-
-        dprintk("nfs4_proc_file_open: starting on (%.*s/%.*s)\n",
-                               (int)dentry->d_parent->d_name.len,
-                               dentry->d_parent->d_name.name,
-                               (int)dentry->d_name.len, dentry->d_name.name);
-
-
-        /* Find our open stateid */
-        cred = rpcauth_lookupcred(NFS_SERVER(inode)->client->cl_auth, 0);
-        if (IS_ERR(cred))
-                return PTR_ERR(cred);
-        ctx = alloc_nfs_open_context(dentry, cred);
-        put_rpccred(cred);
-        if (unlikely(ctx == NULL))
-                return -ENOMEM;
-        status = -EIO; /* ERACE actually */
-        state = nfs4_find_state(inode, cred, filp->f_mode);
-        if (unlikely(state == NULL))
-                goto no_state;
-        ctx->state = state;
-        nfs4_close_state(state, filp->f_mode);
-        ctx->mode = filp->f_mode;
-        nfs_file_set_open_context(filp, ctx);
-        put_nfs_open_context(ctx);
-        if (filp->f_mode & FMODE_WRITE)
-                nfs_begin_data_update(inode);
-        return 0;
-no_state:
-        printk(KERN_WARNING "NFS: v4 raced in function %s\n", __FUNCTION__);
-        put_nfs_open_context(ctx);
-        return status;
-}
-
-/*
- * Release our state
- */
-static int
-nfs4_proc_file_release(struct inode *inode, struct file *filp)
-{
-        if (filp->f_mode & FMODE_WRITE)
-                nfs_end_data_update(inode);
-        nfs_file_clear_open_context(filp);
-        return 0;
-}
-
 static inline int nfs4_server_supports_acls(struct nfs_server *server)
 {
         return (server->caps & NFS_CAP_ACLS)
@@ -2285,7 +2433,7 @@ static inline ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size
                         return -ENOMEM;
                 args.acl_pages[0] = localpage;
                 args.acl_pgbase = 0;
-                args.acl_len = PAGE_SIZE;
+                resp_len = args.acl_len = PAGE_SIZE;
         } else {
                 resp_buf = buf;
                 buf_to_pages(buf, buflen, args.acl_pages, &args.acl_pgbase);
@@ -2345,6 +2493,7 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen
 
         if (!nfs4_server_supports_acls(server))
                 return -EOPNOTSUPP;
+        nfs_inode_return_delegation(inode);
         buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
         ret = rpc_call_sync(NFS_SERVER(inode)->client, &msg, 0);
         if (ret == 0)
@@ -2353,7 +2502,7 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen
 }
 
 static int
-nfs4_async_handle_error(struct rpc_task *task, struct nfs_server *server)
+nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server)
 {
         struct nfs4_client *clp = server->nfs4_state;
 
@@ -2431,7 +2580,7 @@ static int nfs4_delay(struct rpc_clnt *clnt, long *timeout)
 /* This is the error handling routine for processes that are allowed
  * to sleep.
  */
-int nfs4_handle_exception(struct nfs_server *server, int errorcode, struct nfs4_exception *exception)
+int nfs4_handle_exception(const struct nfs_server *server, int errorcode, struct nfs4_exception *exception)
 {
         struct nfs4_client *clp = server->nfs4_state;
         int ret = errorcode;
@@ -2632,7 +2781,6 @@ static int _nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock
 
         down_read(&clp->cl_sem);
         nlo.clientid = clp->cl_clientid;
-        down(&state->lock_sema);
         status = nfs4_set_lock_state(state, request);
         if (status != 0)
                 goto out;
@@ -2659,7 +2807,6 @@ static int _nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock
                 status = 0;
         }
 out:
-        up(&state->lock_sema);
         up_read(&clp->cl_sem);
         return status;
 }
@@ -2696,79 +2843,149 @@ static int do_vfs_lock(struct file *file, struct file_lock *fl)
         return res;
 }
 
-static int _nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *request)
+struct nfs4_unlockdata {
+        struct nfs_lockargs arg;
+        struct nfs_locku_opargs luargs;
+        struct nfs_lockres res;
+        struct nfs4_lock_state *lsp;
+        struct nfs_open_context *ctx;
+        atomic_t refcount;
+        struct completion completion;
+};
+
+static void nfs4_locku_release_calldata(struct nfs4_unlockdata *calldata)
 {
-        struct inode *inode = state->inode;
-        struct nfs_server *server = NFS_SERVER(inode);
-        struct nfs4_client *clp = server->nfs4_state;
-        struct nfs_lockargs arg = {
-                .fh = NFS_FH(inode),
-                .type = nfs4_lck_type(cmd, request),
-                .offset = request->fl_start,
-                .length = nfs4_lck_length(request),
-        };
-        struct nfs_lockres res = {
-                .server = server,
-        };
+        if (atomic_dec_and_test(&calldata->refcount)) {
+                nfs_free_seqid(calldata->luargs.seqid);
+                nfs4_put_lock_state(calldata->lsp);
+                put_nfs_open_context(calldata->ctx);
+                kfree(calldata);
+        }
+}
+
+static void nfs4_locku_complete(struct nfs4_unlockdata *calldata)
+{
+        complete(&calldata->completion);
+        nfs4_locku_release_calldata(calldata);
+}
+
+static void nfs4_locku_done(struct rpc_task *task)
+{
+        struct nfs4_unlockdata *calldata = (struct nfs4_unlockdata *)task->tk_calldata;
+
+        nfs_increment_lock_seqid(task->tk_status, calldata->luargs.seqid);
+        switch (task->tk_status) {
+                case 0:
+                        memcpy(calldata->lsp->ls_stateid.data,
+                                        calldata->res.u.stateid.data,
+                                        sizeof(calldata->lsp->ls_stateid.data));
+                        break;
+                case -NFS4ERR_STALE_STATEID:
+                case -NFS4ERR_EXPIRED:
+                        nfs4_schedule_state_recovery(calldata->res.server->nfs4_state);
+                        break;
+                default:
+                        if (nfs4_async_handle_error(task, calldata->res.server) == -EAGAIN) {
+                                rpc_restart_call(task);
+                                return;
+                        }
+        }
+        nfs4_locku_complete(calldata);
+}
+
+static void nfs4_locku_begin(struct rpc_task *task)
+{
+        struct nfs4_unlockdata *calldata = (struct nfs4_unlockdata *)task->tk_calldata;
         struct rpc_message msg = {
                 .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_LOCKU],
-                .rpc_argp       = &arg,
-                .rpc_resp       = &res,
-                .rpc_cred       = state->owner->so_cred,
+                .rpc_argp       = &calldata->arg,
+                .rpc_resp       = &calldata->res,
+                .rpc_cred       = calldata->lsp->ls_state->owner->so_cred,
         };
+        int status;
+
+        status = nfs_wait_on_sequence(calldata->luargs.seqid, task);
+        if (status != 0)
+                return;
+        if ((calldata->lsp->ls_flags & NFS_LOCK_INITIALIZED) == 0) {
+                nfs4_locku_complete(calldata);
+                task->tk_exit = NULL;
+                rpc_exit(task, 0);
+                return;
+        }
+        rpc_call_setup(task, &msg, 0);
+}
+
+static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *request)
+{
+        struct nfs4_unlockdata *calldata;
+        struct inode *inode = state->inode;
+        struct nfs_server *server = NFS_SERVER(inode);
         struct nfs4_lock_state *lsp;
-        struct nfs_locku_opargs luargs;
         int status;
-                        
-        down_read(&clp->cl_sem);
-        down(&state->lock_sema);
+
         status = nfs4_set_lock_state(state, request);
         if (status != 0)
-                goto out;
+                return status;
         lsp = request->fl_u.nfs4_fl.owner;
         /* We might have lost the locks! */
         if ((lsp->ls_flags & NFS_LOCK_INITIALIZED) == 0)
-                goto out;
-        luargs.seqid = lsp->ls_seqid;
-        memcpy(&luargs.stateid, &lsp->ls_stateid, sizeof(luargs.stateid));
-        arg.u.locku = &luargs;
-        status = rpc_call_sync(server->client, &msg, RPC_TASK_NOINTR);
-        nfs4_increment_lock_seqid(status, lsp);
-
-        if (status == 0)
-                memcpy(&lsp->ls_stateid,  &res.u.stateid, 
-                                sizeof(lsp->ls_stateid));
-out:
-        up(&state->lock_sema);
+                return 0;
+        calldata = kmalloc(sizeof(*calldata), GFP_KERNEL);
+        if (calldata == NULL)
+                return -ENOMEM;
+        calldata->luargs.seqid = nfs_alloc_seqid(&lsp->ls_seqid);
+        if (calldata->luargs.seqid == NULL) {
+                kfree(calldata);
+                return -ENOMEM;
+        }
+        calldata->luargs.stateid = &lsp->ls_stateid;
+        calldata->arg.fh = NFS_FH(inode);
+        calldata->arg.type = nfs4_lck_type(cmd, request);
+        calldata->arg.offset = request->fl_start;
+        calldata->arg.length = nfs4_lck_length(request);
+        calldata->arg.u.locku = &calldata->luargs;
+        calldata->res.server = server;
+        calldata->lsp = lsp;
+        atomic_inc(&lsp->ls_count);
+
+        /* Ensure we don't close file until we're done freeing locks! */
+        calldata->ctx = get_nfs_open_context((struct nfs_open_context*)request->fl_file->private_data);
+
+        atomic_set(&calldata->refcount, 2);
+        init_completion(&calldata->completion);
+
+        status = nfs4_call_async(NFS_SERVER(inode)->client, nfs4_locku_begin,
+                        nfs4_locku_done, calldata);
         if (status == 0)
-                do_vfs_lock(request->fl_file, request);
-        up_read(&clp->cl_sem);
+                wait_for_completion_interruptible(&calldata->completion);
+        do_vfs_lock(request->fl_file, request);
+        nfs4_locku_release_calldata(calldata);
         return status;
 }
 
-static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *request)
-{
-        struct nfs4_exception exception = { };
-        int err;
-
-        do {
-                err = nfs4_handle_exception(NFS_SERVER(state->inode),
-                                _nfs4_proc_unlck(state, cmd, request),
-                                &exception);
-        } while (exception.retry);
-        return err;
-}
-
 static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *request, int reclaim)
 {
         struct inode *inode = state->inode;
         struct nfs_server *server = NFS_SERVER(inode);
         struct nfs4_lock_state *lsp = request->fl_u.nfs4_fl.owner;
+        struct nfs_lock_opargs largs = {
+                .lock_stateid = &lsp->ls_stateid,
+                .open_stateid = &state->stateid,
+                .lock_owner = {
+                        .clientid = server->nfs4_state->cl_clientid,
+                        .id = lsp->ls_id,
+                },
+                .reclaim = reclaim,
+        };
         struct nfs_lockargs arg = {
                 .fh = NFS_FH(inode),
                 .type = nfs4_lck_type(cmd, request),
                 .offset = request->fl_start,
                 .length = nfs4_lck_length(request),
+                .u = {
+                        .lock = &largs,
+                },
         };
         struct nfs_lockres res = {
                 .server = server,
@@ -2779,53 +2996,39 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *r
                 .rpc_resp       = &res,
                 .rpc_cred       = state->owner->so_cred,
         };
-        struct nfs_lock_opargs largs = {
-                .reclaim = reclaim,
-                .new_lock_owner = 0,
-        };
-        int status;
+        int status = -ENOMEM;
 
-        if (!(lsp->ls_flags & NFS_LOCK_INITIALIZED)) {
+        largs.lock_seqid = nfs_alloc_seqid(&lsp->ls_seqid);
+        if (largs.lock_seqid == NULL)
+                return -ENOMEM;
+        if (!(lsp->ls_seqid.flags & NFS_SEQID_CONFIRMED)) {
                 struct nfs4_state_owner *owner = state->owner;
-                struct nfs_open_to_lock otl = {
-                        .lock_owner = {
-                                .clientid = server->nfs4_state->cl_clientid,
-                        },
-                };
-
-                otl.lock_seqid = lsp->ls_seqid;
-                otl.lock_owner.id = lsp->ls_id;
-                memcpy(&otl.open_stateid, &state->stateid, sizeof(otl.open_stateid));
-                largs.u.open_lock = &otl;
+
+                largs.open_seqid = nfs_alloc_seqid(&owner->so_seqid);
+                if (largs.open_seqid == NULL)
+                        goto out;
                 largs.new_lock_owner = 1;
-                arg.u.lock = &largs;
-                down(&owner->so_sema);
-                otl.open_seqid = owner->so_seqid;
                 status = rpc_call_sync(server->client, &msg, RPC_TASK_NOINTR);
-                /* increment open_owner seqid on success, and 
-                * seqid mutating errors */
-                nfs4_increment_seqid(status, owner);
-                up(&owner->so_sema);
-                if (status == 0) {
-                        lsp->ls_flags |= NFS_LOCK_INITIALIZED;
-                        lsp->ls_seqid++;
+                /* increment open seqid on success, and seqid mutating errors */
+                if (largs.new_lock_owner != 0) {
+                        nfs_increment_open_seqid(status, largs.open_seqid);
+                        if (status == 0)
+                                nfs_confirm_seqid(&lsp->ls_seqid, 0);
                 }
-        } else {
-                struct nfs_exist_lock el = {
-                        .seqid = lsp->ls_seqid,
-                };
-                memcpy(&el.stateid, &lsp->ls_stateid, sizeof(el.stateid));
-                largs.u.exist_lock = &el;
-                arg.u.lock = &largs;
+                nfs_free_seqid(largs.open_seqid);
+        } else
                 status = rpc_call_sync(server->client, &msg, RPC_TASK_NOINTR);
-                /* increment seqid on success, and * seqid mutating errors*/
-                nfs4_increment_lock_seqid(status, lsp);
-        }
+        /* increment lock seqid on success, and seqid mutating errors*/
+        nfs_increment_lock_seqid(status, largs.lock_seqid);
         /* save the returned stateid. */
-        if (status == 0)
-                memcpy(&lsp->ls_stateid, &res.u.stateid, sizeof(nfs4_stateid));
-        else if (status == -NFS4ERR_DENIED)
+        if (status == 0) {
+                memcpy(lsp->ls_stateid.data, res.u.stateid.data,
+                                sizeof(lsp->ls_stateid.data));
+                lsp->ls_flags |= NFS_LOCK_INITIALIZED;
+        } else if (status == -NFS4ERR_DENIED)
                 status = -EAGAIN;
+out:
+        nfs_free_seqid(largs.lock_seqid);
         return status;
 }
 
@@ -2865,11 +3068,9 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
         int status;
 
         down_read(&clp->cl_sem);
-        down(&state->lock_sema);
         status = nfs4_set_lock_state(state, request);
         if (status == 0)
                 status = _nfs4_do_setlk(state, cmd, request, 0);
-        up(&state->lock_sema);
         if (status == 0) {
                 /* Note: we always want to sleep here! */
                 request->fl_flags |= FL_SLEEP;
@@ -3024,8 +3225,8 @@ struct nfs_rpc_ops	nfs_v4_clientops = {
         .read_setup     = nfs4_proc_read_setup,
         .write_setup    = nfs4_proc_write_setup,
         .commit_setup   = nfs4_proc_commit_setup,
-        .file_open      = nfs4_proc_file_open,
-        .file_release   = nfs4_proc_file_release,
+        .file_open      = nfs_open,
+        .file_release   = nfs_release,
         .lock           = nfs4_proc_lock,
         .clear_acl_cache = nfs4_zap_acl_attr,
 };
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index afe587d82f1e..2d5a6a2b9dec 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -264,13 +264,16 @@ nfs4_alloc_state_owner(void)
 {
         struct nfs4_state_owner *sp;
 
-        sp = kmalloc(sizeof(*sp),GFP_KERNEL);
+        sp = kzalloc(sizeof(*sp),GFP_KERNEL);
         if (!sp)
                 return NULL;
-        init_MUTEX(&sp->so_sema);
-        sp->so_seqid = 0;                 /* arbitrary */
+        spin_lock_init(&sp->so_lock);
         INIT_LIST_HEAD(&sp->so_states);
         INIT_LIST_HEAD(&sp->so_delegations);
+        rpc_init_wait_queue(&sp->so_sequence.wait, "Seqid_waitqueue");
+        sp->so_seqid.sequence = &sp->so_sequence;
+        spin_lock_init(&sp->so_sequence.lock);
+        INIT_LIST_HEAD(&sp->so_sequence.list);
         atomic_set(&sp->so_count, 1);
         return sp;
 }
@@ -359,7 +362,6 @@ nfs4_alloc_open_state(void)
         memset(state->stateid.data, 0, sizeof(state->stateid.data));
         atomic_set(&state->count, 1);
         INIT_LIST_HEAD(&state->lock_states);
-        init_MUTEX(&state->lock_sema);
         spin_lock_init(&state->state_lock);
         return state;
 }
@@ -437,21 +439,23 @@ nfs4_get_open_state(struct inode *inode, struct nfs4_state_owner *owner)
         if (state)
                 goto out;
         new = nfs4_alloc_open_state();
+        spin_lock(&owner->so_lock);
         spin_lock(&inode->i_lock);
         state = __nfs4_find_state_byowner(inode, owner);
         if (state == NULL && new != NULL) {
                 state = new;
-                /* Caller *must* be holding owner->so_sem */
-                /* Note: The reclaim code dictates that we add stateless
-                 * and read-only stateids to the end of the list */
-                list_add_tail(&state->open_states, &owner->so_states);
                 state->owner = owner;
                 atomic_inc(&owner->so_count);
                 list_add(&state->inode_states, &nfsi->open_states);
                 state->inode = igrab(inode);
                 spin_unlock(&inode->i_lock);
+                /* Note: The reclaim code dictates that we add stateless
+                 * and read-only stateids to the end of the list */
+                list_add_tail(&state->open_states, &owner->so_states);
+                spin_unlock(&owner->so_lock);
         } else {
                 spin_unlock(&inode->i_lock);
+                spin_unlock(&owner->so_lock);
                 if (new)
                         nfs4_free_open_state(new);
         }
@@ -461,19 +465,21 @@ out:
 
 /*
  * Beware! Caller must be holding exactly one
- * reference to clp->cl_sem and owner->so_sema!
+ * reference to clp->cl_sem!
  */
 void nfs4_put_open_state(struct nfs4_state *state)
 {
         struct inode *inode = state->inode;
         struct nfs4_state_owner *owner = state->owner;
 
-        if (!atomic_dec_and_lock(&state->count, &inode->i_lock))
+        if (!atomic_dec_and_lock(&state->count, &owner->so_lock))
                 return;
+        spin_lock(&inode->i_lock);
         if (!list_empty(&state->inode_states))
                 list_del(&state->inode_states);
-        spin_unlock(&inode->i_lock);
         list_del(&state->open_states);
+        spin_unlock(&inode->i_lock);
+        spin_unlock(&owner->so_lock);
         iput(inode);
         BUG_ON (state->state != 0);
         nfs4_free_open_state(state);
@@ -481,20 +487,17 @@ void nfs4_put_open_state(struct nfs4_state *state)
 }
 
 /*
- * Beware! Caller must be holding no references to clp->cl_sem!
- * of owner->so_sema!
+ * Close the current file.
  */
 void nfs4_close_state(struct nfs4_state *state, mode_t mode)
 {
         struct inode *inode = state->inode;
         struct nfs4_state_owner *owner = state->owner;
-        struct nfs4_client *clp = owner->so_client;
         int newstate;
 
         atomic_inc(&owner->so_count);
-        down_read(&clp->cl_sem);
-        down(&owner->so_sema);
         /* Protect against nfs4_find_state() */
+        spin_lock(&owner->so_lock);
         spin_lock(&inode->i_lock);
         if (mode & FMODE_READ)
                 state->nreaders--;
@@ -507,6 +510,7 @@ void nfs4_close_state(struct nfs4_state *state, mode_t mode)
                 list_move_tail(&state->open_states, &owner->so_states);
         }
         spin_unlock(&inode->i_lock);
+        spin_unlock(&owner->so_lock);
         newstate = 0;
         if (state->state != 0) {
                 if (state->nreaders)
@@ -515,14 +519,16 @@ void nfs4_close_state(struct nfs4_state *state, mode_t mode)
                         newstate |= FMODE_WRITE;
                 if (state->state == newstate)
                         goto out;
-                if (nfs4_do_close(inode, state, newstate) == -EINPROGRESS)
+                if (test_bit(NFS_DELEGATED_STATE, &state->flags)) {
+                        state->state = newstate;
+                        goto out;
+                }
+                if (nfs4_do_close(inode, state, newstate) == 0)
                         return;
         }
 out:
         nfs4_put_open_state(state);
-        up(&owner->so_sema);
         nfs4_put_state_owner(owner);
-        up_read(&clp->cl_sem);
 }
 
 /*
@@ -546,19 +552,16 @@ __nfs4_find_lock_state(struct nfs4_state *state, fl_owner_t fl_owner)
  * Return a compatible lock_state. If no initialized lock_state structure
  * exists, return an uninitialized one.
  *
- * The caller must be holding state->lock_sema
  */
 static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, fl_owner_t fl_owner)
 {
         struct nfs4_lock_state *lsp;
         struct nfs4_client *clp = state->owner->so_client;
 
-        lsp = kmalloc(sizeof(*lsp), GFP_KERNEL);
+        lsp = kzalloc(sizeof(*lsp), GFP_KERNEL);
         if (lsp == NULL)
                 return NULL;
-        lsp->ls_flags = 0;
-        lsp->ls_seqid = 0;      /* arbitrary */
-        memset(lsp->ls_stateid.data, 0, sizeof(lsp->ls_stateid.data));
+        lsp->ls_seqid.sequence = &state->owner->so_sequence;
         atomic_set(&lsp->ls_count, 1);
         lsp->ls_owner = fl_owner;
         spin_lock(&clp->cl_lock);
@@ -572,7 +575,7 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
  * Return a compatible lock_state. If no initialized lock_state structure
  * exists, return an uninitialized one.
  *
- * The caller must be holding state->lock_sema and clp->cl_sem
+ * The caller must be holding clp->cl_sem
  */
 static struct nfs4_lock_state *nfs4_get_lock_state(struct nfs4_state *state, fl_owner_t owner)
 {
@@ -605,7 +608,7 @@ static struct nfs4_lock_state *nfs4_get_lock_state(struct nfs4_state *state, fl_
  * Release reference to lock_state, and free it if we see that
  * it is no longer in use
  */
-static void nfs4_put_lock_state(struct nfs4_lock_state *lsp)
+void nfs4_put_lock_state(struct nfs4_lock_state *lsp)
 {
         struct nfs4_state *state;
 
@@ -673,29 +676,94 @@ void nfs4_copy_stateid(nfs4_stateid *dst, struct nfs4_state *state, fl_owner_t f
         nfs4_put_lock_state(lsp);
 }
 
-/*
-* Called with state->lock_sema and clp->cl_sem held.
-*/
-void nfs4_increment_lock_seqid(int status, struct nfs4_lock_state *lsp)
+struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter)
 {
-        if (status == NFS_OK || seqid_mutating_err(-status))
-                lsp->ls_seqid++;
+        struct nfs_seqid *new;
+
+        new = kmalloc(sizeof(*new), GFP_KERNEL);
+        if (new != NULL) {
+                new->sequence = counter;
+                INIT_LIST_HEAD(&new->list);
+        }
+        return new;
+}
+
+void nfs_free_seqid(struct nfs_seqid *seqid)
+{
+        struct rpc_sequence *sequence = seqid->sequence->sequence;
+
+        if (!list_empty(&seqid->list)) {
+                spin_lock(&sequence->lock);
+                list_del(&seqid->list);
+                spin_unlock(&sequence->lock);
+        }
+        rpc_wake_up_next(&sequence->wait);
+        kfree(seqid);
 }
 
 /*
-* Called with sp->so_sema and clp->cl_sem held.
-*
-* Increment the seqid if the OPEN/OPEN_DOWNGRADE/CLOSE succeeded, or
-* failed with a seqid incrementing error -
-* see comments nfs_fs.h:seqid_mutating_error()
-*/
-void nfs4_increment_seqid(int status, struct nfs4_state_owner *sp)
-{
-        if (status == NFS_OK || seqid_mutating_err(-status))
-                sp->so_seqid++;
-        /* If the server returns BAD_SEQID, unhash state_owner here */
-        if (status == -NFS4ERR_BAD_SEQID)
+ * Increment the seqid if the OPEN/OPEN_DOWNGRADE/CLOSE succeeded, or
+ * failed with a seqid incrementing error -
+ * see comments nfs_fs.h:seqid_mutating_error()
+ */
+static inline void nfs_increment_seqid(int status, struct nfs_seqid *seqid)
+{
+        switch (status) {
+                case 0:
+                        break;
+                case -NFS4ERR_BAD_SEQID:
+                case -NFS4ERR_STALE_CLIENTID:
+                case -NFS4ERR_STALE_STATEID:
+                case -NFS4ERR_BAD_STATEID:
+                case -NFS4ERR_BADXDR:
+                case -NFS4ERR_RESOURCE:
+                case -NFS4ERR_NOFILEHANDLE:
+                        /* Non-seqid mutating errors */
+                        return;
+        };
+        /*
+         * Note: no locking needed as we are guaranteed to be first
+         * on the sequence list
+         */
+        seqid->sequence->counter++;
+}
+
+void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid)
+{
+        if (status == -NFS4ERR_BAD_SEQID) {
+                struct nfs4_state_owner *sp = container_of(seqid->sequence,
+                                struct nfs4_state_owner, so_seqid);
                 nfs4_drop_state_owner(sp);
+        }
+        return nfs_increment_seqid(status, seqid);
+}
+
+/*
+ * Increment the seqid if the LOCK/LOCKU succeeded, or
+ * failed with a seqid incrementing error -
+ * see comments nfs_fs.h:seqid_mutating_error()
+ */
+void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid)
+{
+        return nfs_increment_seqid(status, seqid);
+}
+
+int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task)
+{
+        struct rpc_sequence *sequence = seqid->sequence->sequence;
+        int status = 0;
+
+        if (sequence->list.next == &seqid->list)
+                goto out;
+        spin_lock(&sequence->lock);
+        if (!list_empty(&sequence->list)) {
+                rpc_sleep_on(&sequence->wait, task, NULL, NULL);
+                status = -EAGAIN;
+        } else
+                list_add(&seqid->list, &sequence->list);
+        spin_unlock(&sequence->lock);
+out:
+        return status;
 }
 
 static int reclaimer(void *);
@@ -791,8 +859,6 @@ static int nfs4_reclaim_open_state(struct nfs4_state_recovery_ops *ops, struct n
                 if (state->state == 0)
                         continue;
                 status = ops->recover_open(sp, state);
-                list_for_each_entry(lock, &state->lock_states, ls_locks)
-                        lock->ls_flags &= ~NFS_LOCK_INITIALIZED;
                 if (status >= 0) {
                         status = nfs4_reclaim_locks(ops, state);
                         if (status < 0)
@@ -831,6 +897,28 @@ out_err:
         return status;
 }
 
+static void nfs4_state_mark_reclaim(struct nfs4_client *clp)
+{
+        struct nfs4_state_owner *sp;
+        struct nfs4_state *state;
+        struct nfs4_lock_state *lock;
+
+        /* Reset all sequence ids to zero */
+        list_for_each_entry(sp, &clp->cl_state_owners, so_list) {
+                sp->so_seqid.counter = 0;
+                sp->so_seqid.flags = 0;
+                spin_lock(&sp->so_lock);
+                list_for_each_entry(state, &sp->so_states, open_states) {
+                        list_for_each_entry(lock, &state->lock_states, ls_locks) {
+                                lock->ls_seqid.counter = 0;
+                                lock->ls_seqid.flags = 0;
+                                lock->ls_flags &= ~NFS_LOCK_INITIALIZED;
+                        }
+                }
+                spin_unlock(&sp->so_lock);
+        }
+}
+
 static int reclaimer(void *ptr)
 {
         struct reclaimer_args *args = (struct reclaimer_args *)ptr;
@@ -864,6 +952,7 @@ restart_loop:
                 default:
                         ops = &nfs4_network_partition_recovery_ops;
         };
+        nfs4_state_mark_reclaim(clp);
         status = __nfs4_init_client(clp);
         if (status)
                 goto out_error;
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 6c564ef9489e..fbbace8a30c4 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -95,6 +95,8 @@ static int nfs_stat_to_errno(int);
 #define decode_getattr_maxsz    (op_decode_hdr_maxsz + nfs4_fattr_maxsz)
 #define encode_savefh_maxsz     (op_encode_hdr_maxsz)
 #define decode_savefh_maxsz     (op_decode_hdr_maxsz)
+#define encode_restorefh_maxsz  (op_encode_hdr_maxsz)
+#define decode_restorefh_maxsz  (op_decode_hdr_maxsz)
 #define encode_fsinfo_maxsz     (op_encode_hdr_maxsz + 2)
 #define decode_fsinfo_maxsz     (op_decode_hdr_maxsz + 11)
 #define encode_renew_maxsz      (op_encode_hdr_maxsz + 3)
@@ -157,16 +159,20 @@ static int nfs_stat_to_errno(int);
                                 op_decode_hdr_maxsz + 2)
 #define NFS4_enc_write_sz       (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
-                                op_encode_hdr_maxsz + 8)
+                                op_encode_hdr_maxsz + 8 + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_write_sz       (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
-                                op_decode_hdr_maxsz + 4)
+                                op_decode_hdr_maxsz + 4 + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_commit_sz      (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
-                                op_encode_hdr_maxsz + 3)
+                                op_encode_hdr_maxsz + 3 + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_commit_sz      (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
-                                op_decode_hdr_maxsz + 2)
+                                op_decode_hdr_maxsz + 2 + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_open_sz        (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
                                 op_encode_hdr_maxsz + \
@@ -196,17 +202,21 @@ static int nfs_stat_to_errno(int);
 #define NFS4_enc_open_downgrade_sz \
                                 (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
-                                op_encode_hdr_maxsz + 7)
+                                op_encode_hdr_maxsz + 7 + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_open_downgrade_sz \
                                 (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
-                                op_decode_hdr_maxsz + 4)
+                                op_decode_hdr_maxsz + 4 + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_close_sz       (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
-                                op_encode_hdr_maxsz + 5)
+                                op_encode_hdr_maxsz + 5 + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_close_sz       (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
-                                op_decode_hdr_maxsz + 4)
+                                op_decode_hdr_maxsz + 4 + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_setattr_sz     (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
                                 op_encode_hdr_maxsz + 4 + \
@@ -300,30 +310,44 @@ static int nfs_stat_to_errno(int);
                                 decode_getfh_maxsz)
 #define NFS4_enc_remove_sz      (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
-                                encode_remove_maxsz)
+                                encode_remove_maxsz + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_remove_sz      (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
-                                op_decode_hdr_maxsz + 5)
+                                op_decode_hdr_maxsz + 5 + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_rename_sz      (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
                                 encode_savefh_maxsz + \
                                 encode_putfh_maxsz + \
-                                encode_rename_maxsz)
+                                encode_rename_maxsz + \
+                                encode_getattr_maxsz + \
+                                encode_restorefh_maxsz + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_rename_sz      (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
                                 decode_savefh_maxsz + \
                                 decode_putfh_maxsz + \
-                                decode_rename_maxsz)
+                                decode_rename_maxsz + \
+                                decode_getattr_maxsz + \
+                                decode_restorefh_maxsz + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_link_sz        (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
                                 encode_savefh_maxsz + \
                                 encode_putfh_maxsz + \
-                                encode_link_maxsz)
+                                encode_link_maxsz + \
+                                decode_getattr_maxsz + \
+                                encode_restorefh_maxsz + \
+                                decode_getattr_maxsz)
 #define NFS4_dec_link_sz        (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
                                 decode_savefh_maxsz + \
                                 decode_putfh_maxsz + \
-                                decode_link_maxsz)
+                                decode_link_maxsz + \
+                                decode_getattr_maxsz + \
+                                decode_restorefh_maxsz + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_symlink_sz     (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
                                 encode_symlink_maxsz + \
@@ -336,14 +360,20 @@ static int nfs_stat_to_errno(int);
                                 decode_getfh_maxsz)
 #define NFS4_enc_create_sz      (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
+                                encode_savefh_maxsz + \
                                 encode_create_maxsz + \
+                                encode_getfh_maxsz + \
                                 encode_getattr_maxsz + \
-                                encode_getfh_maxsz)
+                                encode_restorefh_maxsz + \
+                                encode_getattr_maxsz)
 #define NFS4_dec_create_sz      (compound_decode_hdr_maxsz + \
                                 decode_putfh_maxsz + \
+                                decode_savefh_maxsz + \
                                 decode_create_maxsz + \
+                                decode_getfh_maxsz + \
                                 decode_getattr_maxsz + \
-                                decode_getfh_maxsz)
+                                decode_restorefh_maxsz + \
+                                decode_getattr_maxsz)
 #define NFS4_enc_pathconf_sz    (compound_encode_hdr_maxsz + \
                                 encode_putfh_maxsz + \
                                 encode_getattr_maxsz)
@@ -602,10 +632,10 @@ static int encode_close(struct xdr_stream *xdr, const struct nfs_closeargs *arg)
 {
         uint32_t *p;
 
-        RESERVE_SPACE(8+sizeof(arg->stateid.data));
+        RESERVE_SPACE(8+sizeof(arg->stateid->data));
         WRITE32(OP_CLOSE);
-        WRITE32(arg->seqid);
-        WRITEMEM(arg->stateid.data, sizeof(arg->stateid.data));
+        WRITE32(arg->seqid->sequence->counter);
+        WRITEMEM(arg->stateid->data, sizeof(arg->stateid->data));
         
         return 0;
 }
@@ -729,22 +759,18 @@ static int encode_lock(struct xdr_stream *xdr, const struct nfs_lockargs *arg)
         WRITE64(arg->length);
         WRITE32(opargs->new_lock_owner);
         if (opargs->new_lock_owner){
-                struct nfs_open_to_lock *ol = opargs->u.open_lock;
-
                 RESERVE_SPACE(40);
-                WRITE32(ol->open_seqid);
-                WRITEMEM(&ol->open_stateid, sizeof(ol->open_stateid));
-                WRITE32(ol->lock_seqid);
-                WRITE64(ol->lock_owner.clientid);
+                WRITE32(opargs->open_seqid->sequence->counter);
+                WRITEMEM(opargs->open_stateid->data, sizeof(opargs->open_stateid->data));
+                WRITE32(opargs->lock_seqid->sequence->counter);
+                WRITE64(opargs->lock_owner.clientid);
                 WRITE32(4);
-                WRITE32(ol->lock_owner.id);
+                WRITE32(opargs->lock_owner.id);
         }
         else {
-                struct nfs_exist_lock *el = opargs->u.exist_lock;
-
                 RESERVE_SPACE(20);
-                WRITEMEM(&el->stateid, sizeof(el->stateid));
-                WRITE32(el->seqid);
+                WRITEMEM(opargs->lock_stateid->data, sizeof(opargs->lock_stateid->data));
+                WRITE32(opargs->lock_seqid->sequence->counter);
         }
 
         return 0;
@@ -775,8 +801,8 @@ static int encode_locku(struct xdr_stream *xdr, const struct nfs_lockargs *arg)
         RESERVE_SPACE(44);
         WRITE32(OP_LOCKU);
         WRITE32(arg->type);
-        WRITE32(opargs->seqid);
-        WRITEMEM(&opargs->stateid, sizeof(opargs->stateid));
+        WRITE32(opargs->seqid->sequence->counter);
+        WRITEMEM(opargs->stateid->data, sizeof(opargs->stateid->data));
         WRITE64(arg->offset);
         WRITE64(arg->length);
 
@@ -826,7 +852,7 @@ static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_opena
  */
         RESERVE_SPACE(8);
         WRITE32(OP_OPEN);
-        WRITE32(arg->seqid);
+        WRITE32(arg->seqid->sequence->counter);
         encode_share_access(xdr, arg->open_flags);
         RESERVE_SPACE(16);
         WRITE64(arg->clientid);
@@ -941,7 +967,7 @@ static int encode_open_confirm(struct xdr_stream *xdr, const struct nfs_open_con
         RESERVE_SPACE(8+sizeof(arg->stateid.data));
         WRITE32(OP_OPEN_CONFIRM);
         WRITEMEM(arg->stateid.data, sizeof(arg->stateid.data));
-        WRITE32(arg->seqid);
+        WRITE32(arg->seqid->sequence->counter);
 
         return 0;
 }
@@ -950,10 +976,10 @@ static int encode_open_downgrade(struct xdr_stream *xdr, const struct nfs_closea
 {
         uint32_t *p;
 
-        RESERVE_SPACE(8+sizeof(arg->stateid.data));
+        RESERVE_SPACE(8+sizeof(arg->stateid->data));
         WRITE32(OP_OPEN_DOWNGRADE);
-        WRITEMEM(arg->stateid.data, sizeof(arg->stateid.data));
-        WRITE32(arg->seqid);
+        WRITEMEM(arg->stateid->data, sizeof(arg->stateid->data));
+        WRITE32(arg->seqid->sequence->counter);
         encode_share_access(xdr, arg->open_flags);
         return 0;
 }
@@ -1117,6 +1143,17 @@ static int encode_renew(struct xdr_stream *xdr, const struct nfs4_client *client
 }
 
 static int
+encode_restorefh(struct xdr_stream *xdr)
+{
+        uint32_t *p;
+
+        RESERVE_SPACE(4);
+        WRITE32(OP_RESTOREFH);
+
+        return 0;
+}
+
+static int
 encode_setacl(struct xdr_stream *xdr, struct nfs_setaclargs *arg)
 {
         uint32_t *p;
@@ -1296,14 +1333,18 @@ static int nfs4_xdr_enc_remove(struct rpc_rqst *req, uint32_t *p, const struct n
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 2,
+                .nops = 3,
         };
         int status;
 
         xdr_init_encode(&xdr, &req->rq_snd_buf, p);
         encode_compound_hdr(&xdr, &hdr);
-        if ((status = encode_putfh(&xdr, args->fh)) == 0)
-                status = encode_remove(&xdr, args->name);
+        if ((status = encode_putfh(&xdr, args->fh)) != 0)
+                goto out;
+        if ((status = encode_remove(&xdr, args->name)) != 0)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
+out:
         return status;
 }
 
@@ -1314,7 +1355,7 @@ static int nfs4_xdr_enc_rename(struct rpc_rqst *req, uint32_t *p, const struct n
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 4,
+                .nops = 7,
         };
         int status;
 
@@ -1326,7 +1367,13 @@ static int nfs4_xdr_enc_rename(struct rpc_rqst *req, uint32_t *p, const struct n
                 goto out;
         if ((status = encode_putfh(&xdr, args->new_dir)) != 0)
                 goto out;
-        status = encode_rename(&xdr, args->old_name, args->new_name);
+        if ((status = encode_rename(&xdr, args->old_name, args->new_name)) != 0)
+                goto out;
+        if ((status = encode_getfattr(&xdr, args->bitmask)) != 0)
+                goto out;
+        if ((status = encode_restorefh(&xdr)) != 0)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -1338,7 +1385,7 @@ static int nfs4_xdr_enc_link(struct rpc_rqst *req, uint32_t *p, const struct nfs
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 4,
+                .nops = 7,
         };
         int status;
 
@@ -1350,7 +1397,13 @@ static int nfs4_xdr_enc_link(struct rpc_rqst *req, uint32_t *p, const struct nfs
                 goto out;
         if ((status = encode_putfh(&xdr, args->dir_fh)) != 0)
                 goto out;
-        status = encode_link(&xdr, args->name);
+        if ((status = encode_link(&xdr, args->name)) != 0)
+                goto out;
+        if ((status = encode_getfattr(&xdr, args->bitmask)) != 0)
+                goto out;
+        if ((status = encode_restorefh(&xdr)) != 0)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -1362,7 +1415,7 @@ static int nfs4_xdr_enc_create(struct rpc_rqst *req, uint32_t *p, const struct n
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 4,
+                .nops = 7,
         };
         int status;
 
@@ -1370,10 +1423,16 @@ static int nfs4_xdr_enc_create(struct rpc_rqst *req, uint32_t *p, const struct n
         encode_compound_hdr(&xdr, &hdr);
         if ((status = encode_putfh(&xdr, args->dir_fh)) != 0)
                 goto out;
+        if ((status = encode_savefh(&xdr)) != 0)
+                goto out;
         if ((status = encode_create(&xdr, args)) != 0)
                 goto out;
         if ((status = encode_getfh(&xdr)) != 0)
                 goto out;
+        if ((status = encode_getfattr(&xdr, args->bitmask)) != 0)
+                goto out;
+        if ((status = encode_restorefh(&xdr)) != 0)
+                goto out;
         status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
@@ -1412,7 +1471,7 @@ static int nfs4_xdr_enc_close(struct rpc_rqst *req, uint32_t *p, struct nfs_clos
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops   = 2,
+                .nops   = 3,
         };
         int status;
 
@@ -1422,6 +1481,9 @@ static int nfs4_xdr_enc_close(struct rpc_rqst *req, uint32_t *p, struct nfs_clos
         if(status)
                 goto out;
         status = encode_close(&xdr, args);
+        if (status != 0)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -1433,15 +1495,21 @@ static int nfs4_xdr_enc_open(struct rpc_rqst *req, uint32_t *p, struct nfs_opena
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 4,
+                .nops = 7,
         };
         int status;
 
+        status = nfs_wait_on_sequence(args->seqid, req->rq_task);
+        if (status != 0)
+                goto out;
         xdr_init_encode(&xdr, &req->rq_snd_buf, p);
         encode_compound_hdr(&xdr, &hdr);
         status = encode_putfh(&xdr, args->fh);
         if (status)
                 goto out;
+        status = encode_savefh(&xdr);
+        if (status)
+                goto out;
         status = encode_open(&xdr, args);
         if (status)
                 goto out;
@@ -1449,6 +1517,12 @@ static int nfs4_xdr_enc_open(struct rpc_rqst *req, uint32_t *p, struct nfs_opena
         if (status)
                 goto out;
         status = encode_getfattr(&xdr, args->bitmask);
+        if (status)
+                goto out;
+        status = encode_restorefh(&xdr);
+        if (status)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -1464,6 +1538,9 @@ static int nfs4_xdr_enc_open_confirm(struct rpc_rqst *req, uint32_t *p, struct n
         };
         int status;
 
+        status = nfs_wait_on_sequence(args->seqid, req->rq_task);
+        if (status != 0)
+                goto out;
         xdr_init_encode(&xdr, &req->rq_snd_buf, p);
         encode_compound_hdr(&xdr, &hdr);
         status = encode_putfh(&xdr, args->fh);
@@ -1485,6 +1562,9 @@ static int nfs4_xdr_enc_open_noattr(struct rpc_rqst *req, uint32_t *p, struct nf
         };
         int status;
 
+        status = nfs_wait_on_sequence(args->seqid, req->rq_task);
+        if (status != 0)
+                goto out;
         xdr_init_encode(&xdr, &req->rq_snd_buf, p);
         encode_compound_hdr(&xdr, &hdr);
         status = encode_putfh(&xdr, args->fh);
@@ -1502,7 +1582,7 @@ static int nfs4_xdr_enc_open_downgrade(struct rpc_rqst *req, uint32_t *p, struct
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops   = 2,
+                .nops   = 3,
         };
         int status;
 
@@ -1512,6 +1592,9 @@ static int nfs4_xdr_enc_open_downgrade(struct rpc_rqst *req, uint32_t *p, struct
         if (status)
                 goto out;
         status = encode_open_downgrade(&xdr, args);
+        if (status != 0)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -1525,8 +1608,15 @@ static int nfs4_xdr_enc_lock(struct rpc_rqst *req, uint32_t *p, struct nfs_locka
         struct compound_hdr hdr = {
                 .nops   = 2,
         };
+        struct nfs_lock_opargs *opargs = args->u.lock;
         int status;
 
+        status = nfs_wait_on_sequence(opargs->lock_seqid, req->rq_task);
+        if (status != 0)
+                goto out;
+        /* Do we need to do an open_to_lock_owner? */
+        if (opargs->lock_seqid->sequence->flags & NFS_SEQID_CONFIRMED)
+                opargs->new_lock_owner = 0;
         xdr_init_encode(&xdr, &req->rq_snd_buf, p);
         encode_compound_hdr(&xdr, &hdr);
         status = encode_putfh(&xdr, args->fh);
@@ -1713,7 +1803,7 @@ static int nfs4_xdr_enc_write(struct rpc_rqst *req, uint32_t *p, struct nfs_writ
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 2,
+                .nops = 3,
         };
         int status;
 
@@ -1723,6 +1813,9 @@ static int nfs4_xdr_enc_write(struct rpc_rqst *req, uint32_t *p, struct nfs_writ
         if (status)
                 goto out;
         status = encode_write(&xdr, args);
+        if (status)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -1734,7 +1827,7 @@ static int nfs4_xdr_enc_commit(struct rpc_rqst *req, uint32_t *p, struct nfs_wri
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
-                .nops = 2,
+                .nops = 3,
         };
         int status;
 
@@ -1744,6 +1837,9 @@ static int nfs4_xdr_enc_commit(struct rpc_rqst *req, uint32_t *p, struct nfs_wri
         if (status)
                 goto out;
         status = encode_commit(&xdr, args);
+        if (status)
+                goto out;
+        status = encode_getfattr(&xdr, args->bitmask);
 out:
         return status;
 }
@@ -2670,8 +2766,7 @@ static int decode_server_caps(struct xdr_stream *xdr, struct nfs4_server_caps_re
                 goto xdr_error;
         status = verify_attr_len(xdr, savep, attrlen);
 xdr_error:
-        if (status != 0)
-                printk(KERN_NOTICE "%s: xdr error %d!\n", __FUNCTION__, -status);
+        dprintk("%s: xdr returned %d!\n", __FUNCTION__, -status);
         return status;
 }
         
@@ -2704,8 +2799,7 @@ static int decode_statfs(struct xdr_stream *xdr, struct nfs_fsstat *fsstat)
 
         status = verify_attr_len(xdr, savep, attrlen);
 xdr_error:
-        if (status != 0)
-                printk(KERN_NOTICE "%s: xdr error %d!\n", __FUNCTION__, -status);
+        dprintk("%s: xdr returned %d!\n", __FUNCTION__, -status);
         return status;
 }
 
@@ -2730,8 +2824,7 @@ static int decode_pathconf(struct xdr_stream *xdr, struct nfs_pathconf *pathconf
 
         status = verify_attr_len(xdr, savep, attrlen);
 xdr_error:
-        if (status != 0)
-                printk(KERN_NOTICE "%s: xdr error %d!\n", __FUNCTION__, -status);
+        dprintk("%s: xdr returned %d!\n", __FUNCTION__, -status);
         return status;
 }
 
@@ -2787,13 +2880,10 @@ static int decode_getfattr(struct xdr_stream *xdr, struct nfs_fattr *fattr, cons
                 goto xdr_error;
         if ((status = decode_attr_time_modify(xdr, bitmap, &fattr->mtime)) != 0)
                 goto xdr_error;
-        if ((status = verify_attr_len(xdr, savep, attrlen)) == 0) {
+        if ((status = verify_attr_len(xdr, savep, attrlen)) == 0)
                 fattr->valid = NFS_ATTR_FATTR | NFS_ATTR_FATTR_V3 | NFS_ATTR_FATTR_V4;
-                fattr->timestamp = jiffies;
-        }
 xdr_error:
-        if (status != 0)
-                printk(KERN_NOTICE "%s: xdr error %d!\n", __FUNCTION__, -status);
+        dprintk("%s: xdr returned %d\n", __FUNCTION__, -status);
         return status;
 }
 
@@ -2826,8 +2916,7 @@ static int decode_fsinfo(struct xdr_stream *xdr, struct nfs_fsinfo *fsinfo)
 
         status = verify_attr_len(xdr, savep, attrlen);
 xdr_error:
-        if (status != 0)
-                printk(KERN_NOTICE "%s: xdr error %d!\n", __FUNCTION__, -status);
+        dprintk("%s: xdr returned %d!\n", __FUNCTION__, -status);
         return status;
 }
 
@@ -2890,8 +2979,8 @@ static int decode_lock(struct xdr_stream *xdr, struct nfs_lockres *res)
 
         status = decode_op_hdr(xdr, OP_LOCK);
         if (status == 0) {
-                READ_BUF(sizeof(nfs4_stateid));
-                COPYMEM(&res->u.stateid, sizeof(res->u.stateid));
+                READ_BUF(sizeof(res->u.stateid.data));
+                COPYMEM(res->u.stateid.data, sizeof(res->u.stateid.data));
         } else if (status == -NFS4ERR_DENIED)
                 return decode_lock_denied(xdr, &res->u.denied);
         return status;
@@ -2913,8 +3002,8 @@ static int decode_locku(struct xdr_stream *xdr, struct nfs_lockres *res)
 
         status = decode_op_hdr(xdr, OP_LOCKU);
         if (status == 0) {
-                READ_BUF(sizeof(nfs4_stateid));
-                COPYMEM(&res->u.stateid, sizeof(res->u.stateid));
+                READ_BUF(sizeof(res->u.stateid.data));
+                COPYMEM(res->u.stateid.data, sizeof(res->u.stateid.data));
         }
         return status;
 }
@@ -2994,7 +3083,7 @@ static int decode_open(struct xdr_stream *xdr, struct nfs_openres *res)
         p += bmlen;
         return decode_delegation(xdr, res);
 xdr_error:
-        printk(KERN_NOTICE "%s: xdr error!\n", __FUNCTION__);
+        dprintk("%s: Bitmap too large! Length = %u\n", __FUNCTION__, bmlen);
         return -EIO;
 }
 
@@ -3208,6 +3297,12 @@ static int decode_renew(struct xdr_stream *xdr)
         return decode_op_hdr(xdr, OP_RENEW);
 }
 
+static int
+decode_restorefh(struct xdr_stream *xdr)
+{
+        return decode_op_hdr(xdr, OP_RESTOREFH);
+}
+
 static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                 size_t *acl_len)
 {
@@ -3243,7 +3338,8 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                 if (attrlen <= *acl_len)
                         xdr_read_pages(xdr, attrlen);
                 *acl_len = attrlen;
-        }
+        } else
+                status = -EOPNOTSUPP;
 
 out:
         return status;
@@ -3352,6 +3448,9 @@ static int nfs4_xdr_dec_open_downgrade(struct rpc_rqst *rqstp, uint32_t *p, stru
         if (status)
                 goto out;
         status = decode_open_downgrade(&xdr, res);
+        if (status != 0)
+                goto out;
+        decode_getfattr(&xdr, res->fattr, res->server);
 out:
         return status;
 }
@@ -3424,7 +3523,7 @@ out:
 /*
  * Decode REMOVE response
  */
-static int nfs4_xdr_dec_remove(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_change_info *cinfo)
+static int nfs4_xdr_dec_remove(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_remove_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3433,8 +3532,11 @@ static int nfs4_xdr_dec_remove(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_
         xdr_init_decode(&xdr, &rqstp->rq_rcv_buf, p);
         if ((status = decode_compound_hdr(&xdr, &hdr)) != 0)
                 goto out;
-        if ((status = decode_putfh(&xdr)) == 0)
-                status = decode_remove(&xdr, cinfo);
+        if ((status = decode_putfh(&xdr)) != 0)
+                goto out;
+        if ((status = decode_remove(&xdr, &res->cinfo)) != 0)
+                goto out;
+        decode_getfattr(&xdr, res->dir_attr, res->server);
 out:
         return status;
 }
@@ -3457,7 +3559,14 @@ static int nfs4_xdr_dec_rename(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_
                 goto out;
         if ((status = decode_putfh(&xdr)) != 0)
                 goto out;
-        status = decode_rename(&xdr, &res->old_cinfo, &res->new_cinfo);
+        if ((status = decode_rename(&xdr, &res->old_cinfo, &res->new_cinfo)) != 0)
+                goto out;
+        /* Current FH is target directory */
+        if (decode_getfattr(&xdr, res->new_fattr, res->server) != 0)
+                goto out;
+        if ((status = decode_restorefh(&xdr)) != 0)
+                goto out;
+        decode_getfattr(&xdr, res->old_fattr, res->server);
 out:
         return status;
 }
@@ -3465,7 +3574,7 @@ out:
 /*
  * Decode LINK response
  */
-static int nfs4_xdr_dec_link(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_change_info *cinfo)
+static int nfs4_xdr_dec_link(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_link_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3480,7 +3589,17 @@ static int nfs4_xdr_dec_link(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_ch
                 goto out;
         if ((status = decode_putfh(&xdr)) != 0)
                 goto out;
-        status = decode_link(&xdr, cinfo);
+        if ((status = decode_link(&xdr, &res->cinfo)) != 0)
+                goto out;
+        /*
+         * Note order: OP_LINK leaves the directory as the current
+         *             filehandle.
+         */
+        if (decode_getfattr(&xdr, res->dir_attr, res->server) != 0)
+                goto out;
+        if ((status = decode_restorefh(&xdr)) != 0)
+                goto out;
+        decode_getfattr(&xdr, res->fattr, res->server);
 out:
         return status;
 }
@@ -3499,13 +3618,17 @@ static int nfs4_xdr_dec_create(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_
                 goto out;
         if ((status = decode_putfh(&xdr)) != 0)
                 goto out;
+        if ((status = decode_savefh(&xdr)) != 0)
+                goto out;
         if ((status = decode_create(&xdr,&res->dir_cinfo)) != 0)
                 goto out;
         if ((status = decode_getfh(&xdr, res->fh)) != 0)
                 goto out;
-        status = decode_getfattr(&xdr, res->fattr, res->server);
-        if (status == NFS4ERR_DELAY)
-                status = 0;
+        if (decode_getfattr(&xdr, res->fattr, res->server) != 0)
+                goto out;
+        if ((status = decode_restorefh(&xdr)) != 0)
+                goto out;
+        decode_getfattr(&xdr, res->dir_fattr, res->server);
 out:
         return status;
 }
@@ -3623,6 +3746,15 @@ static int nfs4_xdr_dec_close(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_cl
         if (status)
                 goto out;
         status = decode_close(&xdr, res);
+        if (status != 0)
+                goto out;
+        /*
+         * Note: Server may do delete on close for this file
+         *      in which case the getattr call will fail with
+         *      an ESTALE error. Shouldn't be a problem,
+         *      though, since fattr->valid will remain unset.
+         */
+        decode_getfattr(&xdr, res->fattr, res->server);
 out:
         return status;
 }
@@ -3643,15 +3775,20 @@ static int nfs4_xdr_dec_open(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_ope
         status = decode_putfh(&xdr);
         if (status)
                 goto out;
+        status = decode_savefh(&xdr);
+        if (status)
+                goto out;
         status = decode_open(&xdr, res);
         if (status)
                 goto out;
         status = decode_getfh(&xdr, &res->fh);
         if (status)
                 goto out;
-        status = decode_getfattr(&xdr, res->f_attr, res->server);
-        if (status == NFS4ERR_DELAY)
-                status = 0;
+        if (decode_getfattr(&xdr, res->f_attr, res->server) != 0)
+                goto out;
+        if ((status = decode_restorefh(&xdr)) != 0)
+                goto out;
+        decode_getfattr(&xdr, res->dir_attr, res->server);
 out:
         return status;
 }
@@ -3869,6 +4006,9 @@ static int nfs4_xdr_dec_write(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_wr
         if (status)
                 goto out;
         status = decode_write(&xdr, res);
+        if (status)
+                goto out;
+        decode_getfattr(&xdr, res->fattr, res->server);
         if (!status)
                 status = res->count;
 out:
@@ -3892,6 +4032,9 @@ static int nfs4_xdr_dec_commit(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_w
         if (status)
                 goto out;
         status = decode_commit(&xdr, res);
+        if (status)
+                goto out;
+        decode_getfattr(&xdr, res->fattr, res->server);
 out:
         return status;
 }
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index be23c3fb9260..a48a003242c0 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -61,7 +61,7 @@ nfs_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
         int status;
 
         dprintk("%s: call getattr\n", __FUNCTION__);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call(server->client_sys, NFSPROC_GETATTR, fhandle, fattr, 0);
         dprintk("%s: reply getattr: %d\n", __FUNCTION__, status);
         if (status)
@@ -93,7 +93,7 @@ nfs_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  getattr\n");
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call(server->client, NFSPROC_GETATTR,
                                 fhandle, fattr, 0);
         dprintk("NFS reply getattr: %d\n", status);
@@ -112,7 +112,7 @@ nfs_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
         int     status;
 
         dprintk("NFS call  setattr\n");
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call(NFS_CLIENT(inode), NFSPROC_SETATTR, &arg, fattr, 0);
         if (status == 0)
                 nfs_setattr_update_inode(inode, sattr);
@@ -136,7 +136,7 @@ nfs_proc_lookup(struct inode *dir, struct qstr *name,
         int                     status;
 
         dprintk("NFS call  lookup %s\n", name->name);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call(NFS_CLIENT(dir), NFSPROC_LOOKUP, &arg, &res, 0);
         dprintk("NFS reply lookup: %d\n", status);
         return status;
@@ -174,7 +174,7 @@ static int nfs_proc_read(struct nfs_read_data *rdata)
 
         dprintk("NFS call  read %d @ %Ld\n", rdata->args.count,
                         (long long) rdata->args.offset);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, flags);
         if (status >= 0) {
                 nfs_refresh_inode(inode, fattr);
@@ -203,10 +203,10 @@ static int nfs_proc_write(struct nfs_write_data *wdata)
 
         dprintk("NFS call  write %d @ %Ld\n", wdata->args.count,
                         (long long) wdata->args.offset);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         status = rpc_call_sync(NFS_CLIENT(inode), &msg, flags);
         if (status >= 0) {
-                nfs_refresh_inode(inode, fattr);
+                nfs_post_op_update_inode(inode, fattr);
                 wdata->res.count = wdata->args.count;
                 wdata->verf.committed = NFS_FILE_SYNC;
         }
@@ -216,7 +216,7 @@ static int nfs_proc_write(struct nfs_write_data *wdata)
 
 static int
 nfs_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
-                int flags)
+                int flags, struct nameidata *nd)
 {
         struct nfs_fh           fhandle;
         struct nfs_fattr        fattr;
@@ -232,7 +232,7 @@ nfs_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
         };
         int                     status;
 
-        fattr.valid = 0;
+        nfs_fattr_init(&fattr);
         dprintk("NFS call  create %s\n", dentry->d_name.name);
         status = rpc_call(NFS_CLIENT(dir), NFSPROC_CREATE, &arg, &res, 0);
         if (status == 0)
@@ -273,12 +273,13 @@ nfs_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
                 sattr->ia_size = new_encode_dev(rdev);/* get out your barf bag */
         }
 
-        fattr.valid = 0;
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(dir), NFSPROC_CREATE, &arg, &res, 0);
+        nfs_mark_for_revalidate(dir);
 
         if (status == -EINVAL && S_ISFIFO(mode)) {
                 sattr->ia_mode = mode;
-                fattr.valid = 0;
+                nfs_fattr_init(&fattr);
                 status = rpc_call(NFS_CLIENT(dir), NFSPROC_CREATE, &arg, &res, 0);
         }
         if (status == 0)
@@ -305,6 +306,7 @@ nfs_proc_remove(struct inode *dir, struct qstr *name)
 
         dprintk("NFS call  remove %s\n", name->name);
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
+        nfs_mark_for_revalidate(dir);
 
         dprintk("NFS reply remove: %d\n", status);
         return status;
@@ -331,8 +333,10 @@ nfs_proc_unlink_done(struct dentry *dir, struct rpc_task *task)
 {
         struct rpc_message *msg = &task->tk_msg;
         
-        if (msg->rpc_argp)
+        if (msg->rpc_argp) {
+                nfs_mark_for_revalidate(dir->d_inode);
                 kfree(msg->rpc_argp);
+        }
         return 0;
 }
 
@@ -352,6 +356,8 @@ nfs_proc_rename(struct inode *old_dir, struct qstr *old_name,
 
         dprintk("NFS call  rename %s -> %s\n", old_name->name, new_name->name);
         status = rpc_call(NFS_CLIENT(old_dir), NFSPROC_RENAME, &arg, NULL, 0);
+        nfs_mark_for_revalidate(old_dir);
+        nfs_mark_for_revalidate(new_dir);
         dprintk("NFS reply rename: %d\n", status);
         return status;
 }
@@ -369,6 +375,7 @@ nfs_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
 
         dprintk("NFS call  link %s\n", name->name);
         status = rpc_call(NFS_CLIENT(inode), NFSPROC_LINK, &arg, NULL, 0);
+        nfs_mark_for_revalidate(dir);
         dprintk("NFS reply link: %d\n", status);
         return status;
 }
@@ -391,9 +398,10 @@ nfs_proc_symlink(struct inode *dir, struct qstr *name, struct qstr *path,
         if (path->len > NFS2_MAXPATHLEN)
                 return -ENAMETOOLONG;
         dprintk("NFS call  symlink %s -> %s\n", name->name, path->name);
-        fattr->valid = 0;
+        nfs_fattr_init(fattr);
         fhandle->size = 0;
         status = rpc_call(NFS_CLIENT(dir), NFSPROC_SYMLINK, &arg, NULL, 0);
+        nfs_mark_for_revalidate(dir);
         dprintk("NFS reply symlink: %d\n", status);
         return status;
 }
@@ -416,8 +424,9 @@ nfs_proc_mkdir(struct inode *dir, struct dentry *dentry, struct iattr *sattr)
         int                     status;
 
         dprintk("NFS call  mkdir %s\n", dentry->d_name.name);
-        fattr.valid = 0;
+        nfs_fattr_init(&fattr);
         status = rpc_call(NFS_CLIENT(dir), NFSPROC_MKDIR, &arg, &res, 0);
+        nfs_mark_for_revalidate(dir);
         if (status == 0)
                 status = nfs_instantiate(dentry, &fhandle, &fattr);
         dprintk("NFS reply mkdir: %d\n", status);
@@ -436,6 +445,7 @@ nfs_proc_rmdir(struct inode *dir, struct qstr *name)
 
         dprintk("NFS call  rmdir %s\n", name->name);
         status = rpc_call(NFS_CLIENT(dir), NFSPROC_RMDIR, &arg, NULL, 0);
+        nfs_mark_for_revalidate(dir);
         dprintk("NFS reply rmdir: %d\n", status);
         return status;
 }
@@ -484,7 +494,7 @@ nfs_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  statfs\n");
-        stat->fattr->valid = 0;
+        nfs_fattr_init(stat->fattr);
         status = rpc_call(server->client, NFSPROC_STATFS, fhandle, &fsinfo, 0);
         dprintk("NFS reply statfs: %d\n", status);
         if (status)
@@ -507,7 +517,7 @@ nfs_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,
         int     status;
 
         dprintk("NFS call  fsinfo\n");
-        info->fattr->valid = 0;
+        nfs_fattr_init(info->fattr);
         status = rpc_call(server->client, NFSPROC_STATFS, fhandle, &fsinfo, 0);
         dprintk("NFS reply fsinfo: %d\n", status);
         if (status)
@@ -579,7 +589,7 @@ nfs_write_done(struct rpc_task *task)
         struct nfs_write_data *data = (struct nfs_write_data *) task->tk_calldata;
 
         if (task->tk_status >= 0)
-                nfs_refresh_inode(data->inode, data->res.fattr);
+                nfs_post_op_update_inode(data->inode, data->res.fattr);
         nfs_writeback_done(task);
 }
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 6ceb1d471f20..43b03b19731b 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -184,14 +184,13 @@ static void nfs_readpage_release(struct nfs_page *req)
 {
         unlock_page(req->wb_page);
 
-        nfs_clear_request(req);
-        nfs_release_request(req);
-
         dprintk("NFS: read done (%s/%Ld %d@%Ld)\n",
                         req->wb_context->dentry->d_inode->i_sb->s_id,
                         (long long)NFS_FILEID(req->wb_context->dentry->d_inode),
                         req->wb_bytes,
                         (long long)req_offset(req));
+        nfs_clear_request(req);
+        nfs_release_request(req);
 }
 
 /*
@@ -216,6 +215,7 @@ static void nfs_read_rpcsetup(struct nfs_page *req, struct nfs_read_data *data,
         data->res.fattr   = &data->fattr;
         data->res.count   = count;
         data->res.eof     = 0;
+        nfs_fattr_init(&data->fattr);
 
         NFS_PROTO(inode)->read_setup(data);
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5130eda231d7..819a65f5071f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -870,6 +870,7 @@ static void nfs_write_rpcsetup(struct nfs_page *req,
         data->res.fattr   = &data->fattr;
         data->res.count   = count;
         data->res.verf    = &data->verf;
+        nfs_fattr_init(&data->fattr);
 
         NFS_PROTO(inode)->write_setup(data, how);
 
@@ -1237,6 +1238,7 @@ static void nfs_commit_rpcsetup(struct list_head *head,
         data->res.count   = 0;
         data->res.fattr   = &data->fattr;
         data->res.verf    = &data->verf;
+        nfs_fattr_init(&data->fattr);
         
         NFS_PROTO(inode)->commit_setup(data, how);
 
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 251e5a1bb1c4..0c2be8c0307d 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -48,43 +48,26 @@ xdr_nfsace_encode(struct xdr_array2_desc *desc, void *elem)
                 (struct nfsacl_encode_desc *) desc;
         u32 *p = (u32 *) elem;
 
-        if (nfsacl_desc->count < nfsacl_desc->acl->a_count) {
-                struct posix_acl_entry *entry =
-                        &nfsacl_desc->acl->a_entries[nfsacl_desc->count++];
+        struct posix_acl_entry *entry =
+                &nfsacl_desc->acl->a_entries[nfsacl_desc->count++];
 
-                *p++ = htonl(entry->e_tag | nfsacl_desc->typeflag);
-                switch(entry->e_tag) {
-                        case ACL_USER_OBJ:
-                                *p++ = htonl(nfsacl_desc->uid);
-                                break;
-                        case ACL_GROUP_OBJ:
-                                *p++ = htonl(nfsacl_desc->gid);
-                                break;
-                        case ACL_USER:
-                        case ACL_GROUP:
-                                *p++ = htonl(entry->e_id);
-                                break;
-                        default:  /* Solaris depends on that! */
-                                *p++ = 0;
-                                break;
-                }
-                *p++ = htonl(entry->e_perm & S_IRWXO);
-        } else {
-                const struct posix_acl_entry *pa, *pe;
-                int group_obj_perm = ACL_READ|ACL_WRITE|ACL_EXECUTE;
-
-                FOREACH_ACL_ENTRY(pa, nfsacl_desc->acl, pe) {
-                        if (pa->e_tag == ACL_GROUP_OBJ) {
-                                group_obj_perm = pa->e_perm & S_IRWXO;
-                                break;
-                        }
-                }
-                /* fake up ACL_MASK entry */
-                *p++ = htonl(ACL_MASK | nfsacl_desc->typeflag);
-                *p++ = htonl(0);
-                *p++ = htonl(group_obj_perm);
+        *p++ = htonl(entry->e_tag | nfsacl_desc->typeflag);
+        switch(entry->e_tag) {
+                case ACL_USER_OBJ:
+                        *p++ = htonl(nfsacl_desc->uid);
+                        break;
+                case ACL_GROUP_OBJ:
+                        *p++ = htonl(nfsacl_desc->gid);
+                        break;
+                case ACL_USER:
+                case ACL_GROUP:
+                        *p++ = htonl(entry->e_id);
+                        break;
+                default:  /* Solaris depends on that! */
+                        *p++ = 0;
+                        break;
         }
-
+        *p++ = htonl(entry->e_perm & S_IRWXO);
         return 0;
 }
 
@@ -105,11 +88,28 @@ nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
                 .gid = inode->i_gid,
         };
         int err;
+        struct posix_acl *acl2 = NULL;
 
         if (entries > NFS_ACL_MAX_ENTRIES ||
             xdr_encode_word(buf, base, entries))
                 return -EINVAL;
+        if (encode_entries && acl && acl->a_count == 3) {
+                /* Fake up an ACL_MASK entry. */
+                acl2 = posix_acl_alloc(4, GFP_KERNEL);
+                if (!acl2)
+                        return -ENOMEM;
+                /* Insert entries in canonical order: other orders seem
+                 to confuse Solaris VxFS. */
+                acl2->a_entries[0] = acl->a_entries[0];  /* ACL_USER_OBJ */
+                acl2->a_entries[1] = acl->a_entries[1];  /* ACL_GROUP_OBJ */
+                acl2->a_entries[2] = acl->a_entries[1];  /* ACL_MASK */
+                acl2->a_entries[2].e_tag = ACL_MASK;
+                acl2->a_entries[3] = acl->a_entries[2];  /* ACL_OTHER */
+                nfsacl_desc.acl = acl2;
+        }
         err = xdr_encode_array2(buf, base + 4, &nfsacl_desc.desc);
+        if (acl2)
+                posix_acl_release(acl2);
         if (!err)
                 err = 8 + nfsacl_desc.desc.elem_size *
                           nfsacl_desc.desc.array_len;
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index c7e9237379c2..de58579a1d0e 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -29,7 +29,8 @@ ToDo/Notes:
           The Windows boot will run chkdsk and then reboot.  The user can then
           immediately boot into Linux rather than having to do a full Windows
           boot first before rebooting into Linux and we will recognize such a
-          journal and empty it as it is clean by definition.
+          journal and empty it as it is clean by definition.  Note, this only
+          works if chkdsk left the journal in an obviously clean state.
         - Support journals ($LogFile) with only one restart page as well as
           journals with two different restart pages.  We sanity check both and
           either use the only sane one or the more recent one of the two in the
@@ -94,6 +95,16 @@ ToDo/Notes:
           my ways.
         - Fix various bugs in the runlist merging code.  (Based on libntfs
           changes by Richard Russon.)
+        - Fix sparse warnings that have crept in over time.
+        - Change ntfs_cluster_free() to require a write locked runlist on entry
+          since we otherwise get into a lock reversal deadlock if a read locked
+          runlist is passed in. In the process also change it to take an ntfs
+          inode instead of a vfs inode as parameter.
+        - Fix the definition of the CHKD ntfs record magic.  It had an off by
+          two error causing it to be CHKB instead of CHKD.
+        - Fix a stupid bug in __ntfs_bitmap_set_bits_in_run() which caused the
+          count to become negative and hence we had a wild memset() scribbling
+          all over the system's ram.
 
 2.1.23 - Implement extension of resident files and make writing safe as well as
          many bug fixes, cleanups, and enhancements...
diff --git a/fs/ntfs/bitmap.c b/fs/ntfs/bitmap.c
index 12cf2e30c7dd..7a190cdc60e2 100644
--- a/fs/ntfs/bitmap.c
+++ b/fs/ntfs/bitmap.c
@@ -1,7 +1,7 @@
 /*
  * bitmap.c - NTFS kernel bitmap handling.  Part of the Linux-NTFS project.
  *
- * Copyright (c) 2004 Anton Altaparmakov
+ * Copyright (c) 2004-2005 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -90,7 +90,8 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, const s64 start_bit,
         /* If the first byte is partial, modify the appropriate bits in it. */
         if (bit) {
                 u8 *byte = kaddr + pos;
-                while ((bit & 7) && cnt--) {
+                while ((bit & 7) && cnt) {
+                        cnt--;
                         if (value)
                                 *byte |= 1 << bit++;
                         else
diff --git a/fs/ntfs/layout.h b/fs/ntfs/layout.h
index 609ad1728ce4..5c248d404f05 100644
--- a/fs/ntfs/layout.h
+++ b/fs/ntfs/layout.h
@@ -123,7 +123,7 @@ enum {
         magic_RCRD = const_cpu_to_le32(0x44524352), /* Log record page. */
 
         /* Found in $LogFile/$DATA.  (May be found in $MFT/$DATA, also?) */
-        magic_CHKD = const_cpu_to_le32(0x424b4843), /* Modified by chkdsk. */
+        magic_CHKD = const_cpu_to_le32(0x444b4843), /* Modified by chkdsk. */
 
         /* Found in all ntfs record containing records. */
         magic_BAAD = const_cpu_to_le32(0x44414142), /* Failed multi sector
@@ -308,10 +308,8 @@ typedef le16 MFT_RECORD_FLAGS;
  * The _LE versions are to be applied on little endian MFT_REFs.
  * Note: The _LE versions will return a CPU endian formatted value!
  */
-typedef enum {
-        MFT_REF_MASK_CPU        = 0x0000ffffffffffffULL,
-        MFT_REF_MASK_LE         = const_cpu_to_le64(0x0000ffffffffffffULL),
-} MFT_REF_CONSTS;
+#define MFT_REF_MASK_CPU 0x0000ffffffffffffULL
+#define MFT_REF_MASK_LE const_cpu_to_le64(MFT_REF_MASK_CPU)
 
 typedef u64 MFT_REF;
 typedef le64 leMFT_REF;
diff --git a/fs/ntfs/lcnalloc.c b/fs/ntfs/lcnalloc.c
index 7b5934290685..5af3bf0b7eee 100644
--- a/fs/ntfs/lcnalloc.c
+++ b/fs/ntfs/lcnalloc.c
@@ -779,14 +779,13 @@ out:
 
 /**
  * __ntfs_cluster_free - free clusters on an ntfs volume
- * @vi:         vfs inode whose runlist describes the clusters to free
- * @start_vcn:  vcn in the runlist of @vi at which to start freeing clusters
+ * @ni:         ntfs inode whose runlist describes the clusters to free
+ * @start_vcn:  vcn in the runlist of @ni at which to start freeing clusters
  * @count:      number of clusters to free or -1 for all clusters
- * @write_locked:       true if the runlist is locked for writing
  * @is_rollback:        true if this is a rollback operation
  *
  * Free @count clusters starting at the cluster @start_vcn in the runlist
- * described by the vfs inode @vi.
+ * described by the vfs inode @ni.
  *
  * If @count is -1, all clusters from @start_vcn to the end of the runlist are
  * deallocated.  Thus, to completely free all clusters in a runlist, use
@@ -801,31 +800,28 @@ out:
  * Return the number of deallocated clusters (not counting sparse ones) on
  * success and -errno on error.
  *
- * Locking: - The runlist described by @vi must be locked on entry and is
- *            locked on return.  Note if the runlist is locked for reading the
- *            lock may be dropped and reacquired.  Note the runlist may be
- *            modified when needed runlist fragments need to be mapped.
+ * Locking: - The runlist described by @ni must be locked for writing on entry
+ *            and is locked on return.  Note the runlist may be modified when
+ *            needed runlist fragments need to be mapped.
  *          - The volume lcn bitmap must be unlocked on entry and is unlocked
  *            on return.
  *          - This function takes the volume lcn bitmap lock for writing and
  *            modifies the bitmap contents.
  */
-s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn, s64 count,
-                const BOOL write_locked, const BOOL is_rollback)
+s64 __ntfs_cluster_free(ntfs_inode *ni, const VCN start_vcn, s64 count,
+                const BOOL is_rollback)
 {
         s64 delta, to_free, total_freed, real_freed;
-        ntfs_inode *ni;
         ntfs_volume *vol;
         struct inode *lcnbmp_vi;
         runlist_element *rl;
         int err;
 
-        BUG_ON(!vi);
+        BUG_ON(!ni);
         ntfs_debug("Entering for i_ino 0x%lx, start_vcn 0x%llx, count "
-                        "0x%llx.%s", vi->i_ino, (unsigned long long)start_vcn,
+                        "0x%llx.%s", ni->mft_no, (unsigned long long)start_vcn,
                         (unsigned long long)count,
                         is_rollback ? " (rollback)" : "");
-        ni = NTFS_I(vi);
         vol = ni->vol;
         lcnbmp_vi = vol->lcnbmp_ino;
         BUG_ON(!lcnbmp_vi);
@@ -843,7 +839,7 @@ s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn, s64 count,
 
         total_freed = real_freed = 0;
 
-        rl = ntfs_attr_find_vcn_nolock(ni, start_vcn, write_locked);
+        rl = ntfs_attr_find_vcn_nolock(ni, start_vcn, TRUE);
         if (IS_ERR(rl)) {
                 if (!is_rollback)
                         ntfs_error(vol->sb, "Failed to find first runlist "
@@ -897,7 +893,7 @@ s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn, s64 count,
 
                         /* Attempt to map runlist. */
                         vcn = rl->vcn;
-                        rl = ntfs_attr_find_vcn_nolock(ni, vcn, write_locked);
+                        rl = ntfs_attr_find_vcn_nolock(ni, vcn, TRUE);
                         if (IS_ERR(rl)) {
                                 err = PTR_ERR(rl);
                                 if (!is_rollback)
@@ -965,8 +961,7 @@ err_out:
          * If rollback fails, set the volume errors flag, emit an error
          * message, and return the error code.
          */
-        delta = __ntfs_cluster_free(vi, start_vcn, total_freed, write_locked,
-                        TRUE);
+        delta = __ntfs_cluster_free(ni, start_vcn, total_freed, TRUE);
         if (delta < 0) {
                 ntfs_error(vol->sb, "Failed to rollback (error %i).  Leaving "
                                 "inconsistent metadata!  Unmount and run "
diff --git a/fs/ntfs/lcnalloc.h b/fs/ntfs/lcnalloc.h
index e4d7fb98d685..a6a8827882e7 100644
--- a/fs/ntfs/lcnalloc.h
+++ b/fs/ntfs/lcnalloc.h
@@ -2,7 +2,7 @@
  * lcnalloc.h - Exports for NTFS kernel cluster (de)allocation.  Part of the
  *              Linux-NTFS project.
  *
- * Copyright (c) 2004 Anton Altaparmakov
+ * Copyright (c) 2004-2005 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -28,6 +28,7 @@
 #include <linux/fs.h>
 
 #include "types.h"
+#include "inode.h"
 #include "runlist.h"
 #include "volume.h"
 
@@ -42,18 +43,17 @@ extern runlist_element *ntfs_cluster_alloc(ntfs_volume *vol,
                 const VCN start_vcn, const s64 count, const LCN start_lcn,
                 const NTFS_CLUSTER_ALLOCATION_ZONES zone);
 
-extern s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn,
-                s64 count, const BOOL write_locked, const BOOL is_rollback);
+extern s64 __ntfs_cluster_free(ntfs_inode *ni, const VCN start_vcn,
+                s64 count, const BOOL is_rollback);
 
 /**
  * ntfs_cluster_free - free clusters on an ntfs volume
- * @vi:         vfs inode whose runlist describes the clusters to free
- * @start_vcn:  vcn in the runlist of @vi at which to start freeing clusters
+ * @ni:         ntfs inode whose runlist describes the clusters to free
+ * @start_vcn:  vcn in the runlist of @ni at which to start freeing clusters
  * @count:      number of clusters to free or -1 for all clusters
- * @write_locked:       true if the runlist is locked for writing
  *
  * Free @count clusters starting at the cluster @start_vcn in the runlist
- * described by the vfs inode @vi.
+ * described by the ntfs inode @ni.
  *
  * If @count is -1, all clusters from @start_vcn to the end of the runlist are
  * deallocated.  Thus, to completely free all clusters in a runlist, use
@@ -65,19 +65,18 @@ extern s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn,
  * Return the number of deallocated clusters (not counting sparse ones) on
  * success and -errno on error.
  *
- * Locking: - The runlist described by @vi must be locked on entry and is
- *            locked on return.  Note if the runlist is locked for reading the
- *            lock may be dropped and reacquired.  Note the runlist may be
- *            modified when needed runlist fragments need to be mapped.
+ * Locking: - The runlist described by @ni must be locked for writing on entry
+ *            and is locked on return.  Note the runlist may be modified when
+ *            needed runlist fragments need to be mapped.
  *          - The volume lcn bitmap must be unlocked on entry and is unlocked
  *            on return.
  *          - This function takes the volume lcn bitmap lock for writing and
  *            modifies the bitmap contents.
  */
-static inline s64 ntfs_cluster_free(struct inode *vi, const VCN start_vcn,
-                s64 count, const BOOL write_locked)
+static inline s64 ntfs_cluster_free(ntfs_inode *ni, const VCN start_vcn,
+                s64 count)
 {
-        return __ntfs_cluster_free(vi, start_vcn, count, write_locked, FALSE);
+        return __ntfs_cluster_free(ni, start_vcn, count, FALSE);
 }
 
 extern int ntfs_cluster_free_from_rl_nolock(ntfs_volume *vol,
diff --git a/fs/ntfs/logfile.c b/fs/ntfs/logfile.c
index 0173e95500d9..0fd70295cca6 100644
--- a/fs/ntfs/logfile.c
+++ b/fs/ntfs/logfile.c
@@ -51,7 +51,8 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
                 RESTART_PAGE_HEADER *rp, s64 pos)
 {
         u32 logfile_system_page_size, logfile_log_page_size;
-        u16 usa_count, usa_ofs, usa_end, ra_ofs;
+        u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
+        BOOL have_usa = TRUE;
 
         ntfs_debug("Entering.");
         /*
@@ -86,6 +87,14 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
                                 (int)sle16_to_cpu(rp->minor_ver));
                 return FALSE;
         }
+        /*
+         * If chkdsk has been run the restart page may not be protected by an
+         * update sequence array.
+         */
+        if (ntfs_is_chkd_record(rp->magic) && !le16_to_cpu(rp->usa_count)) {
+                have_usa = FALSE;
+                goto skip_usa_checks;
+        }
         /* Verify the size of the update sequence array. */
         usa_count = 1 + (logfile_system_page_size >> NTFS_BLOCK_SIZE_BITS);
         if (usa_count != le16_to_cpu(rp->usa_count)) {
@@ -102,6 +111,7 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
                                 "inconsistent update sequence array offset.");
                 return FALSE;
         }
+skip_usa_checks:
         /*
          * Verify the position of the restart area.  It must be:
          *      - aligned to 8-byte boundary,
@@ -109,7 +119,8 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
          *      - within the system page size.
          */
         ra_ofs = le16_to_cpu(rp->restart_area_offset);
-        if (ra_ofs & 7 || ra_ofs < usa_end ||
+        if (ra_ofs & 7 || (have_usa ? ra_ofs < usa_end :
+                        ra_ofs < sizeof(RESTART_PAGE_HEADER)) ||
                         ra_ofs > logfile_system_page_size) {
                 ntfs_error(vi->i_sb, "$LogFile restart page specifies "
                                 "inconsistent restart area offset.");
@@ -402,8 +413,12 @@ static int ntfs_check_and_load_restart_page(struct inode *vi,
                         idx++;
                 } while (to_read > 0);
         }
-        /* Perform the multi sector transfer deprotection on the buffer. */
-        if (post_read_mst_fixup((NTFS_RECORD*)trp,
+        /*
+         * Perform the multi sector transfer deprotection on the buffer if the
+         * restart page is protected.
+         */
+        if ((!ntfs_is_chkd_record(trp->magic) || le16_to_cpu(trp->usa_count))
+                        && post_read_mst_fixup((NTFS_RECORD*)trp,
                         le32_to_cpu(rp->system_page_size))) {
                 /*
                  * A multi sector tranfer error was detected.  We only need to
@@ -615,11 +630,16 @@ is_empty:
                  * Otherwise just throw it away.
                  */
                 if (rstr2_lsn > rstr1_lsn) {
+                        ntfs_debug("Using second restart page as it is more "
+                                        "recent.");
                         ntfs_free(rstr1_ph);
                         rstr1_ph = rstr2_ph;
                         /* rstr1_lsn = rstr2_lsn; */
-                } else
+                } else {
+                        ntfs_debug("Using first restart page as it is more "
+                                        "recent.");
                         ntfs_free(rstr2_ph);
+                }
                 rstr2_ph = NULL;
         }
         /* All consistency checks passed. */
diff --git a/fs/ntfs/logfile.h b/fs/ntfs/logfile.h
index 42388f95ea6d..a51f3dd0e9eb 100644
--- a/fs/ntfs/logfile.h
+++ b/fs/ntfs/logfile.h
@@ -113,7 +113,7 @@ typedef struct {
  */
 enum {
         RESTART_VOLUME_IS_CLEAN = const_cpu_to_le16(0x0002),
-        RESTART_SPACE_FILLER    = 0xffff, /* gcc: Force enum bit width to 16. */
+        RESTART_SPACE_FILLER    = const_cpu_to_le16(0xffff), /* gcc: Force enum bit width to 16. */
 } __attribute__ ((__packed__));
 
 typedef le16 RESTART_AREA_FLAGS;
diff --git a/fs/ntfs/malloc.h b/fs/ntfs/malloc.h
index 006946efca8c..590887b943f5 100644
--- a/fs/ntfs/malloc.h
+++ b/fs/ntfs/malloc.h
@@ -40,7 +40,7 @@
  * Depending on @gfp_mask the allocation may be guaranteed to succeed.
  */
 static inline void *__ntfs_malloc(unsigned long size,
-                unsigned int __nocast gfp_mask)
+                gfp_t gfp_mask)
 {
         if (likely(size <= PAGE_SIZE)) {
                 BUG_ON(!size);
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 2c32b84385a8..b011369b5956 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -58,7 +58,8 @@ static inline MFT_RECORD *map_mft_record_page(ntfs_inode *ni)
          * overflowing the unsigned long, but I don't think we would ever get
          * here if the volume was that big...
          */
-        index = ni->mft_no << vol->mft_record_size_bits >> PAGE_CACHE_SHIFT;
+        index = (u64)ni->mft_no << vol->mft_record_size_bits >>
+                        PAGE_CACHE_SHIFT;
         ofs = (ni->mft_no << vol->mft_record_size_bits) & ~PAGE_CACHE_MASK;
 
         i_size = i_size_read(mft_vi);
@@ -1953,7 +1954,7 @@ restore_undo_alloc:
         a = ctx->attr;
         a->data.non_resident.highest_vcn = cpu_to_sle64(old_last_vcn - 1);
 undo_alloc:
-        if (ntfs_cluster_free(vol->mft_ino, old_last_vcn, -1, TRUE) < 0) {
+        if (ntfs_cluster_free(mft_ni, old_last_vcn, -1) < 0) {
                 ntfs_error(vol->sb, "Failed to free clusters from mft data "
                                 "attribute.%s", es);
                 NVolSetErrors(vol);
diff --git a/fs/ntfs/unistr.c b/fs/ntfs/unistr.c
index a389a5a16c84..0ea887fc859c 100644
--- a/fs/ntfs/unistr.c
+++ b/fs/ntfs/unistr.c
@@ -1,7 +1,7 @@
 /*
  * unistr.c - NTFS Unicode string handling. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2004 Anton Altaparmakov
+ * Copyright (c) 2001-2005 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
diff --git a/fs/open.c b/fs/open.c
index f0d90cf0495c..8d06ec911fd9 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -739,7 +739,8 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
 }
 
 static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
-                                        int flags, struct file *f)
+                                        int flags, struct file *f,
+                                        int (*open)(struct inode *, struct file *))
 {
         struct inode *inode;
         int error;
@@ -761,11 +762,14 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
         f->f_op = fops_get(inode->i_fop);
         file_move(f, &inode->i_sb->s_files);
 
-        if (f->f_op && f->f_op->open) {
-                error = f->f_op->open(inode,f);
+        if (!open && f->f_op)
+                open = f->f_op->open;
+        if (open) {
+                error = open(inode, f);
                 if (error)
                         goto cleanup_all;
         }
+
         f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
 
         file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
@@ -814,28 +818,75 @@ struct file *filp_open(const char * filename, int flags, int mode)
 {
         int namei_flags, error;
         struct nameidata nd;
-        struct file *f;
 
         namei_flags = flags;
         if ((namei_flags+1) & O_ACCMODE)
                 namei_flags++;
-        if (namei_flags & O_TRUNC)
-                namei_flags |= 2;
-
-        error = -ENFILE;
-        f = get_empty_filp();
-        if (f == NULL)
-                return ERR_PTR(error);
 
         error = open_namei(filename, namei_flags, mode, &nd);
         if (!error)
-                return __dentry_open(nd.dentry, nd.mnt, flags, f);
+                return nameidata_to_filp(&nd, flags);
 
-        put_filp(f);
         return ERR_PTR(error);
 }
 EXPORT_SYMBOL(filp_open);
 
+/**
+ * lookup_instantiate_filp - instantiates the open intent filp
+ * @nd: pointer to nameidata
+ * @dentry: pointer to dentry
+ * @open: open callback
+ *
+ * Helper for filesystems that want to use lookup open intents and pass back
+ * a fully instantiated struct file to the caller.
+ * This function is meant to be called from within a filesystem's
+ * lookup method.
+ * Note that in case of error, nd->intent.open.file is destroyed, but the
+ * path information remains valid.
+ * If the open callback is set to NULL, then the standard f_op->open()
+ * filesystem callback is substituted.
+ */
+struct file *lookup_instantiate_filp(struct nameidata *nd, struct dentry *dentry,
+                int (*open)(struct inode *, struct file *))
+{
+        if (IS_ERR(nd->intent.open.file))
+                goto out;
+        if (IS_ERR(dentry))
+                goto out_err;
+        nd->intent.open.file = __dentry_open(dget(dentry), mntget(nd->mnt),
+                                             nd->intent.open.flags - 1,
+                                             nd->intent.open.file,
+                                             open);
+out:
+        return nd->intent.open.file;
+out_err:
+        release_open_intent(nd);
+        nd->intent.open.file = (struct file *)dentry;
+        goto out;
+}
+EXPORT_SYMBOL_GPL(lookup_instantiate_filp);
+
+/**
+ * nameidata_to_filp - convert a nameidata to an open filp.
+ * @nd: pointer to nameidata
+ * @flags: open flags
+ *
+ * Note that this function destroys the original nameidata
+ */
+struct file *nameidata_to_filp(struct nameidata *nd, int flags)
+{
+        struct file *filp;
+
+        /* Pick up the filp from the open intent */
+        filp = nd->intent.open.file;
+        /* Has the filesystem initialised the file for us? */
+        if (filp->f_dentry == NULL)
+                filp = __dentry_open(nd->dentry, nd->mnt, flags, filp, NULL);
+        else
+                path_release(nd);
+        return filp;
+}
+
 struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
 {
         int error;
@@ -846,7 +897,7 @@ struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
         if (f == NULL)
                 return ERR_PTR(error);
 
-        return __dentry_open(dentry, mnt, flags, f);
+        return __dentry_open(dentry, mnt, flags, f, NULL);
 }
 EXPORT_SYMBOL(dentry_open);
 
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 77e178f13162..1e848648a322 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -430,7 +430,7 @@ void del_gendisk(struct gendisk *disk)
         disk->flags &= ~GENHD_FL_UP;
         unlink_gendisk(disk);
         disk_stat_set_all(disk, 0);
-        disk->stamp = disk->stamp_idle = 0;
+        disk->stamp = 0;
 
         devfs_remove_disk(disk);
 
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 296480e96dd5..6c8dcf7613fd 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -35,7 +35,7 @@ EXPORT_SYMBOL(posix_acl_permission);
  * Allocate a new ACL with the specified number of entries.
  */
 struct posix_acl *
-posix_acl_alloc(int count, unsigned int __nocast flags)
+posix_acl_alloc(int count, gfp_t flags)
 {
         const size_t size = sizeof(struct posix_acl) +
                             count * sizeof(struct posix_acl_entry);
@@ -51,7 +51,7 @@ posix_acl_alloc(int count, unsigned int __nocast flags)
  * Clone an ACL.
  */
 struct posix_acl *
-posix_acl_clone(const struct posix_acl *acl, unsigned int __nocast flags)
+posix_acl_clone(const struct posix_acl *acl, gfp_t flags)
 {
         struct posix_acl *clone = NULL;
 
@@ -185,7 +185,7 @@ posix_acl_equiv_mode(const struct posix_acl *acl, mode_t *mode_p)
  * Create an ACL representing the file mode permission bits of an inode.
  */
 struct posix_acl *
-posix_acl_from_mode(mode_t mode, unsigned int __nocast flags)
+posix_acl_from_mode(mode_t mode, gfp_t flags)
 {
         struct posix_acl *acl = posix_acl_alloc(3, flags);
         if (!acl)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index fb34f88a4a74..a170450aadb1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -103,7 +103,9 @@ enum pid_directory_inos {
         PROC_TGID_NUMA_MAPS,
         PROC_TGID_MOUNTS,
         PROC_TGID_WCHAN,
+#ifdef CONFIG_MMU
         PROC_TGID_SMAPS,
+#endif
 #ifdef CONFIG_SCHEDSTATS
         PROC_TGID_SCHEDSTAT,
 #endif
@@ -141,7 +143,9 @@ enum pid_directory_inos {
         PROC_TID_NUMA_MAPS,
         PROC_TID_MOUNTS,
         PROC_TID_WCHAN,
+#ifdef CONFIG_MMU
         PROC_TID_SMAPS,
+#endif
 #ifdef CONFIG_SCHEDSTATS
         PROC_TID_SCHEDSTAT,
 #endif
@@ -195,7 +199,9 @@ static struct pid_entry tgid_base_stuff[] = {
         E(PROC_TGID_ROOT,      "root",    S_IFLNK|S_IRWXUGO),
         E(PROC_TGID_EXE,       "exe",     S_IFLNK|S_IRWXUGO),
         E(PROC_TGID_MOUNTS,    "mounts",  S_IFREG|S_IRUGO),
+#ifdef CONFIG_MMU
         E(PROC_TGID_SMAPS,     "smaps",   S_IFREG|S_IRUGO),
+#endif
 #ifdef CONFIG_SECURITY
         E(PROC_TGID_ATTR,      "attr",    S_IFDIR|S_IRUGO|S_IXUGO),
 #endif
@@ -235,7 +241,9 @@ static struct pid_entry tid_base_stuff[] = {
         E(PROC_TID_ROOT,       "root",    S_IFLNK|S_IRWXUGO),
         E(PROC_TID_EXE,        "exe",     S_IFLNK|S_IRWXUGO),
         E(PROC_TID_MOUNTS,     "mounts",  S_IFREG|S_IRUGO),
+#ifdef CONFIG_MMU
         E(PROC_TID_SMAPS,      "smaps",   S_IFREG|S_IRUGO),
+#endif
 #ifdef CONFIG_SECURITY
         E(PROC_TID_ATTR,       "attr",    S_IFDIR|S_IRUGO|S_IXUGO),
 #endif
@@ -343,7 +351,8 @@ static int proc_root_link(struct inode *inode, struct dentry **dentry, struct vf
 
 /* Same as proc_root_link, but this addionally tries to get fs from other
  * threads in the group */
-static int proc_task_root_link(struct inode *inode, struct dentry **dentry, struct vfsmount **mnt)
+static int proc_task_root_link(struct inode *inode, struct dentry **dentry,
+                                struct vfsmount **mnt)
 {
         struct fs_struct *fs;
         int result = -ENOENT;
@@ -357,9 +366,10 @@ static int proc_task_root_link(struct inode *inode, struct dentry **dentry, stru
         } else {
                 /* Try to get fs from other threads */
                 task_unlock(leader);
-                struct task_struct *task = leader;
                 read_lock(&tasklist_lock);
-                if (pid_alive(task)) {
+                if (pid_alive(leader)) {
+                        struct task_struct *task = leader;
+
                         while ((task = next_thread(task)) != leader) {
                                 task_lock(task);
                                 fs = task->fs;
@@ -628,6 +638,7 @@ static struct file_operations proc_numa_maps_operations = {
 };
 #endif
 
+#ifdef CONFIG_MMU
 extern struct seq_operations proc_pid_smaps_op;
 static int smaps_open(struct inode *inode, struct file *file)
 {
@@ -646,6 +657,7 @@ static struct file_operations proc_smaps_operations = {
         .llseek         = seq_lseek,
         .release        = seq_release,
 };
+#endif
 
 extern struct seq_operations mounts_op;
 static int mounts_open(struct inode *inode, struct file *file)
@@ -1679,10 +1691,12 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
                 case PROC_TGID_MOUNTS:
                         inode->i_fop = &proc_mounts_operations;
                         break;
+#ifdef CONFIG_MMU
                 case PROC_TID_SMAPS:
                 case PROC_TGID_SMAPS:
                         inode->i_fop = &proc_smaps_operations;
                         break;
+#endif
 #ifdef CONFIG_SECURITY
                 case PROC_TID_ATTR:
                         inode->i_nlink = 2;
diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
index f3bf016d5ee3..cff10ab1af63 100644
--- a/fs/proc/nommu.c
+++ b/fs/proc/nommu.c
@@ -91,6 +91,7 @@ static void *nommu_vma_list_start(struct seq_file *m, loff_t *_pos)
                         next = _rb;
                         break;
                 }
+                pos--;
         }
 
         return next;
diff --git a/fs/read_write.c b/fs/read_write.c
index b60324aaa2b6..a091ee4f430d 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -499,6 +499,9 @@ static ssize_t do_readv_writev(int type, struct file *file,
         ret = rw_verify_area(type, file, pos, tot_len);
         if (ret)
                 goto out;
+        ret = security_file_permission(file, type == READ ? MAY_READ : MAY_WRITE);
+        if (ret)
+                goto out;
 
         fnv = NULL;
         if (type == READ) {
diff --git a/fs/reiserfs/fix_node.c b/fs/reiserfs/fix_node.c
index 2706e2adffab..45829889dcdc 100644
--- a/fs/reiserfs/fix_node.c
+++ b/fs/reiserfs/fix_node.c
@@ -2022,7 +2022,7 @@ static int get_neighbors(struct tree_balance *p_s_tb, int n_h)
 }
 
 #ifdef CONFIG_REISERFS_CHECK
-void *reiserfs_kmalloc(size_t size, int flags, struct super_block *s)
+void *reiserfs_kmalloc(size_t size, gfp_t flags, struct super_block *s)
 {
         void *vp;
         static size_t malloced;
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index d76ee6c4f9b8..5f82352b97e1 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -2842,7 +2842,7 @@ static int reiserfs_set_page_dirty(struct page *page)
  * even in -o notail mode, we can't be sure an old mount without -o notail
  * didn't create files with tails.
  */
-static int reiserfs_releasepage(struct page *page, int unused_gfp_flags)
+static int reiserfs_releasepage(struct page *page, gfp_t unused_gfp_flags)
 {
         struct inode *inode = page->mapping->host;
         struct reiserfs_journal *j = SB_JOURNAL(inode->i_sb);
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index 87ac9dc8b381..72e120798677 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -453,7 +453,7 @@ static struct page *reiserfs_get_page(struct inode *dir, unsigned long n)
         struct page *page;
         /* We can deadlock if we try to free dentries,
            and an unlink/rmdir has just occured - GFP_NOFS avoids this */
-        mapping->flags = (mapping->flags & ~__GFP_BITS_MASK) | GFP_NOFS;
+        mapping_set_gfp_mask(mapping, GFP_NOFS);
         page = read_cache_page(mapping, n,
                                (filler_t *) mapping->a_ops->readpage, NULL);
         if (!IS_ERR(page)) {
diff --git a/fs/relayfs/buffers.c b/fs/relayfs/buffers.c
index 2aa8e2719999..84e21ffa5ca8 100644
--- a/fs/relayfs/buffers.c
+++ b/fs/relayfs/buffers.c
@@ -109,7 +109,7 @@ static void *relay_alloc_buf(struct rchan_buf *buf, unsigned long size)
                 if (unlikely(!buf->page_array[i]))
                         goto depopulate;
         }
-        mem = vmap(buf->page_array, n_pages, GFP_KERNEL, PAGE_KERNEL);
+        mem = vmap(buf->page_array, n_pages, VM_MAP, PAGE_KERNEL);
         if (!mem)
                 goto depopulate;
 
diff --git a/fs/xfs/linux-2.6/kmem.c b/fs/xfs/linux-2.6/kmem.c
index 4b184559f231..3c92162dc728 100644
--- a/fs/xfs/linux-2.6/kmem.c
+++ b/fs/xfs/linux-2.6/kmem.c
@@ -47,9 +47,9 @@
 void *
 kmem_alloc(size_t size, unsigned int __nocast flags)
 {
-        int             retries = 0;
-        unsigned int    lflags = kmem_flags_convert(flags);
-        void            *ptr;
+        int     retries = 0;
+        gfp_t   lflags = kmem_flags_convert(flags);
+        void    *ptr;
 
         do {
                 if (size < MAX_SLAB_SIZE || retries > MAX_VMALLOCS)
@@ -107,9 +107,9 @@ kmem_realloc(void *ptr, size_t newsize, size_t oldsize,
 void *
 kmem_zone_alloc(kmem_zone_t *zone, unsigned int __nocast flags)
 {
-        int             retries = 0;
-        unsigned int    lflags = kmem_flags_convert(flags);
-        void            *ptr;
+        int     retries = 0;
+        gfp_t   lflags = kmem_flags_convert(flags);
+        void    *ptr;
 
         do {
                 ptr = kmem_cache_alloc(zone, lflags);
diff --git a/fs/xfs/linux-2.6/kmem.h b/fs/xfs/linux-2.6/kmem.h
index 109fcf27e256..f4bb78c268c0 100644
--- a/fs/xfs/linux-2.6/kmem.h
+++ b/fs/xfs/linux-2.6/kmem.h
@@ -81,9 +81,9 @@ typedef unsigned long xfs_pflags_t;
         *(NSTATEP) = *(OSTATEP);        \
 } while (0)
 
-static __inline unsigned int kmem_flags_convert(unsigned int __nocast flags)
+static __inline gfp_t kmem_flags_convert(unsigned int __nocast flags)
 {
-        unsigned int    lflags = __GFP_NOWARN;  /* we'll report problems, if need be */
+        gfp_t lflags = __GFP_NOWARN;    /* we'll report problems, if need be */
 
 #ifdef DEBUG
         if (unlikely(flags & ~(KM_SLEEP|KM_NOSLEEP|KM_NOFS|KM_MAYFAIL))) {
@@ -129,13 +129,12 @@ extern void	    *kmem_zone_zalloc(kmem_zone_t *, unsigned int __nocast);
 extern void         *kmem_zone_alloc(kmem_zone_t *, unsigned int __nocast);
 
 extern void         *kmem_alloc(size_t, unsigned int __nocast);
-extern void         *kmem_realloc(void *, size_t, size_t,
-                                  unsigned int __nocast);
+extern void         *kmem_realloc(void *, size_t, size_t, unsigned int __nocast);
 extern void         *kmem_zalloc(size_t, unsigned int __nocast);
 extern void         kmem_free(void *, size_t);
 
 typedef struct shrinker *kmem_shaker_t;
-typedef int (*kmem_shake_func_t)(int, unsigned int);
+typedef int (*kmem_shake_func_t)(int, gfp_t);
 
 static __inline kmem_shaker_t
 kmem_shake_register(kmem_shake_func_t sfunc)
@@ -150,7 +149,7 @@ kmem_shake_deregister(kmem_shaker_t shrinker)
 }
 
 static __inline int
-kmem_shake_allow(unsigned int gfp_mask)
+kmem_shake_allow(gfp_t gfp_mask)
 {
         return (gfp_mask & __GFP_WAIT);
 }
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index c6c077978fe3..7aa398724706 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1296,7 +1296,7 @@ linvfs_invalidate_page(
 STATIC int
 linvfs_release_page(
         struct page             *page,
-        int                     gfp_mask)
+        gfp_t                   gfp_mask)
 {
         struct inode            *inode = page->mapping->host;
         int                     dirty, delalloc, unmapped, unwritten;
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index e82cf72ac599..ba4767c04adf 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -64,7 +64,7 @@
 
 STATIC kmem_cache_t *pagebuf_zone;
 STATIC kmem_shaker_t pagebuf_shake;
-STATIC int xfsbufd_wakeup(int, unsigned int);
+STATIC int xfsbufd_wakeup(int, gfp_t);
 STATIC void pagebuf_delwri_queue(xfs_buf_t *, int);
 
 STATIC struct workqueue_struct *xfslogd_workqueue;
@@ -383,7 +383,7 @@ _pagebuf_lookup_pages(
         size_t                  blocksize = bp->pb_target->pbr_bsize;
         size_t                  size = bp->pb_count_desired;
         size_t                  nbytes, offset;
-        int                     gfp_mask = pb_to_gfp(flags);
+        gfp_t                   gfp_mask = pb_to_gfp(flags);
         unsigned short          page_count, i;
         pgoff_t                 first;
         loff_t                  end;
@@ -1749,8 +1749,8 @@ STATIC int xfsbufd_force_sleep;
 
 STATIC int
 xfsbufd_wakeup(
-        int                     priority,
-        unsigned int            mask)
+        int             priority,
+        gfp_t           mask)
 {
         if (xfsbufd_force_sleep)
                 return 0;