203 files changed, 4427 insertions, 2661 deletions

diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 873802de21cd..fbb12dadba83 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -82,7 +82,7 @@ static match_table_t tokens = {
 
 static void v9fs_parse_options(struct v9fs_session_info *v9ses)
 {
-        char *options = v9ses->options;
+        char *options;
         substring_t args[MAX_OPT_ARGS];
         char *p;
         int option;
@@ -96,9 +96,10 @@ static void v9fs_parse_options(struct v9fs_session_info *v9ses)
         v9ses->cache = 0;
         v9ses->trans = v9fs_default_trans();
 
-        if (!options)
+        if (!v9ses->options)
                 return;
 
+        options = kstrdup(v9ses->options, GFP_KERNEL);
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
                 if (!*p)
@@ -162,12 +163,14 @@ static void v9fs_parse_options(struct v9fs_session_info *v9ses)
                                 if (*e != '\0')
                                         v9ses->uid = ~0;
                         }
+                        kfree(s);
                         break;
 
                 default:
                         continue;
                 }
         }
+        kfree(options);
 }
 
 /**
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 175b4d9bf3f8..23581bcb599b 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -687,10 +687,10 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         retval = p9_client_wstat(oldfid, &wstat);
 
 clunk_newdir:
-        p9_client_clunk(olddirfid);
+        p9_client_clunk(newdirfid);
 
 clunk_olddir:
-        p9_client_clunk(newdirfid);
+        p9_client_clunk(olddirfid);
 
 done:
         return retval;
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index bb0cef9a6b8a..678c02f1ae23 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -119,6 +119,7 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
 
         P9_DPRINTK(P9_DEBUG_VFS, " \n");
 
+        st = NULL;
         v9ses = kzalloc(sizeof(struct v9fs_session_info), GFP_KERNEL);
         if (!v9ses)
                 return -ENOMEM;
@@ -164,10 +165,12 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
         root->d_inode->i_ino = v9fs_qid2ino(&st->qid);
         v9fs_stat2inode(st, root->d_inode, sb);
         v9fs_fid_add(root, fid);
+        kfree(st);
 
         return simple_set_mnt(mnt, sb);
 
 error:
+        kfree(st);
         if (fid)
                 p9_client_clunk(fid);
 
diff --git a/fs/Kconfig b/fs/Kconfig
index e31f3691b151..635f3e286ad8 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -220,7 +220,7 @@ config JBD
 
 config JBD_DEBUG
         bool "JBD (ext3) debugging support"
-        depends on JBD
+        depends on JBD && DEBUG_FS
         help
           If you are using the ext3 journaled file system (or potentially any
           other file system/device using JBD), this option allows you to
@@ -229,10 +229,10 @@ config JBD_DEBUG
           debugging output will be turned off.
 
           If you select Y here, then you will be able to turn on debugging
-          with "echo N > /proc/sys/fs/jbd-debug", where N is a number between
-          1 and 5, the higher the number, the more debugging output is
-          generated.  To turn debugging off again, do
-          "echo 0 > /proc/sys/fs/jbd-debug".
+          with "echo N > /sys/kernel/debug/jbd/jbd-debug", where N is a
+          number between 1 and 5, the higher the number, the more debugging
+          output is generated.  To turn debugging off again, do
+          "echo 0 > /sys/kernel/debug/jbd/jbd-debug".
 
 config JBD2
         tristate
@@ -459,6 +459,15 @@ config OCFS2_DEBUG_MASKLOG
           This option will enlarge your kernel, but it allows debugging of
           ocfs2 filesystem issues.
 
+config OCFS2_DEBUG_FS
+        bool "OCFS2 expensive checks"
+        depends on OCFS2_FS
+        default n
+        help
+          This option will enable expensive consistency checks. Enable
+          this option for debugging only as it is likely to decrease
+          performance of the filesystem.
+
 config MINIX_FS
         tristate "Minix fs support"
         help
@@ -504,7 +513,7 @@ config INOTIFY
           including multiple file events, one-shot support, and unmount
           notification.
 
-          For more information, see Documentation/filesystems/inotify.txt
+          For more information, see <file:Documentation/filesystems/inotify.txt>
 
           If unsure, say Y.
 
@@ -518,7 +527,7 @@ config INOTIFY_USER
           directories via a single open fd.  Events are read from the file
           descriptor, which is also select()- and poll()-able.
 
-          For more information, see Documentation/filesystems/inotify.txt
+          For more information, see <file:Documentation/filesystems/inotify.txt>
 
           If unsure, say Y.
 
@@ -1089,7 +1098,7 @@ config ECRYPT_FS
         depends on EXPERIMENTAL && KEYS && CRYPTO && NET
         help
           Encrypted filesystem that operates on the VFS layer.  See
-          <file:Documentation/ecryptfs.txt> to learn more about
+          <file:Documentation/filesystems/ecryptfs.txt> to learn more about
           eCryptfs.  Userspace components are required and can be
           obtained from <http://ecryptfs.sf.net>.
 
@@ -2007,7 +2016,7 @@ config CIFS_EXPERIMENTAL
 config CIFS_UPCALL
           bool "Kerberos/SPNEGO advanced session setup (EXPERIMENTAL)"
           depends on CIFS_EXPERIMENTAL
-          depends on CONNECTOR
+          depends on KEYS
           help
             Enables an upcall mechanism for CIFS which will be used to contact
             userspace helper utilities to provide SPNEGO packaged Kerberos
diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c
index 7b4bbe48112d..849fc3160cb5 100644
--- a/fs/afs/vlocation.c
+++ b/fs/afs/vlocation.c
@@ -382,7 +382,7 @@ struct afs_vlocation *afs_vlocation_lookup(struct afs_cell *cell,
                cell->name, key_serial(key),
                (int) namesz, (int) namesz, name, namesz);
 
-        if (namesz > sizeof(vl->vldb.name)) {
+        if (namesz >= sizeof(vl->vldb.name)) {
                 _leave(" = -ENAMETOOLONG");
                 return ERR_PTR(-ENAMETOOLONG);
         }
diff --git a/fs/aio.c b/fs/aio.c
index f12db415c0f6..9dec7d2d546e 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1161,7 +1161,12 @@ retry:
                         ret = 0;
                         if (to.timed_out)       /* Only check after read evt */
                                 break;
-                        io_schedule();
+                        /* Try to only show up in io wait if there are ops
+                         *  in flight */
+                        if (ctx->reqs_active)
+                                io_schedule();
+                        else
+                                schedule();
                         if (signal_pending(tsk)) {
                                 ret = -EINTR;
                                 break;
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index e7204d71acc9..45f5992a0957 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -80,7 +80,7 @@ static int parse_options(char *options, int *pipefd, uid_t *uid, gid_t *gid,
 
         *uid = current->uid;
         *gid = current->gid;
-        *pgrp = process_group(current);
+        *pgrp = task_pgrp_nr(current);
 
         *minproto = *maxproto = AUTOFS_PROTO_VERSION;
 
diff --git a/fs/autofs/root.c b/fs/autofs/root.c
index c1489533277a..5efff3c0d886 100644
--- a/fs/autofs/root.c
+++ b/fs/autofs/root.c
@@ -214,8 +214,8 @@ static struct dentry *autofs_root_lookup(struct inode *dir, struct dentry *dentr
 
         oz_mode = autofs_oz_mode(sbi);
         DPRINTK(("autofs_lookup: pid = %u, pgrp = %u, catatonic = %d, "
-                                "oz_mode = %d\n", pid_nr(task_pid(current)),
-                                process_group(current), sbi->catatonic,
+                                "oz_mode = %d\n", task_pid_nr(current),
+                                task_pgrp_nr(current), sbi->catatonic,
                                 oz_mode));
 
         /*
@@ -536,7 +536,7 @@ static int autofs_root_ioctl(struct inode *inode, struct file *filp,
         struct autofs_sb_info *sbi = autofs_sbi(inode->i_sb);
         void __user *argp = (void __user *)arg;
 
-        DPRINTK(("autofs_ioctl: cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u\n",cmd,arg,sbi,process_group(current)));
+        DPRINTK(("autofs_ioctl: cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u\n",cmd,arg,sbi,task_pgrp_nr(current)));
 
         if (_IOC_TYPE(cmd) != _IOC_TYPE(AUTOFS_IOC_FIRST) ||
              _IOC_NR(cmd) - _IOC_NR(AUTOFS_IOC_FIRST) >= AUTOFS_IOC_COUNT)
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index d85f42fa9206..2d4ae40718d9 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -131,7 +131,7 @@ static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry)
    filesystem without "magic".) */
 
 static inline int autofs4_oz_mode(struct autofs_sb_info *sbi) {
-        return sbi->catatonic || process_group(current) == sbi->oz_pgrp;
+        return sbi->catatonic || task_pgrp_nr(current) == sbi->oz_pgrp;
 }
 
 /* Does a dentry have some pending activity? */
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index cd81f0836671..7f05d6ccdb13 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -226,7 +226,7 @@ static int parse_options(char *options, int *pipefd, uid_t *uid, gid_t *gid,
 
         *uid = current->uid;
         *gid = current->gid;
-        *pgrp = process_group(current);
+        *pgrp = task_pgrp_nr(current);
 
         *minproto = AUTOFS_MIN_PROTO_VERSION;
         *maxproto = AUTOFS_MAX_PROTO_VERSION;
@@ -323,7 +323,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         sbi->pipe = NULL;
         sbi->catatonic = 1;
         sbi->exp_timeout = 0;
-        sbi->oz_pgrp = process_group(current);
+        sbi->oz_pgrp = task_pgrp_nr(current);
         sbi->sb = s;
         sbi->version = 0;
         sbi->sub_version = 0;
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 45ff3d63b758..2bbcc8151dc3 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -582,7 +582,7 @@ static struct dentry *autofs4_lookup(struct inode *dir, struct dentry *dentry, s
         oz_mode = autofs4_oz_mode(sbi);
 
         DPRINTK("pid = %u, pgrp = %u, catatonic = %d, oz_mode = %d",
-                 current->pid, process_group(current), sbi->catatonic, oz_mode);
+                 current->pid, task_pgrp_nr(current), sbi->catatonic, oz_mode);
 
         unhashed = autofs4_lookup_unhashed(sbi, dentry->d_parent, &dentry->d_name);
         if (!unhashed) {
@@ -976,7 +976,7 @@ static int autofs4_root_ioctl(struct inode *inode, struct file *filp,
         void __user *p = (void __user *)arg;
 
         DPRINTK("cmd = 0x%08x, arg = 0x%08lx, sbi = %p, pgrp = %u",
-                cmd,arg,sbi,process_group(current));
+                cmd,arg,sbi,task_pgrp_nr(current));
 
         if (_IOC_TYPE(cmd) != _IOC_TYPE(AUTOFS_IOC_FIRST) ||
              _IOC_NR(cmd) - _IOC_NR(AUTOFS_IOC_FIRST) >= AUTOFS_IOC_COUNT)
diff --git a/fs/bfs/bfs.h b/fs/bfs/bfs.h
index 130f6c66c5ba..ac7a8b1d6c3a 100644
--- a/fs/bfs/bfs.h
+++ b/fs/bfs/bfs.h
@@ -14,8 +14,6 @@ struct bfs_sb_info {
         unsigned long si_blocks;
         unsigned long si_freeb;
         unsigned long si_freei;
-        unsigned long si_lf_ioff;
-        unsigned long si_lf_sblk;
         unsigned long si_lf_eblk;
         unsigned long si_lasti;
         unsigned long * si_imap;
@@ -39,7 +37,7 @@ static inline struct bfs_sb_info *BFS_SB(struct super_block *sb)
 
 static inline struct bfs_inode_info *BFS_I(struct inode *inode)
 {
-        return list_entry(inode, struct bfs_inode_info, vfs_inode);
+        return container_of(inode, struct bfs_inode_info, vfs_inode);
 }
 
 
diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c
index 097f1497f743..1fd056d0fc3d 100644
--- a/fs/bfs/dir.c
+++ b/fs/bfs/dir.c
@@ -21,29 +21,32 @@
 #define dprintf(x...)
 #endif
 
-static int bfs_add_entry(struct inode * dir, const unsigned char * name, int namelen, int ino);
-static struct buffer_head * bfs_find_entry(struct inode * dir, 
-        const unsigned char * name, int namelen, struct bfs_dirent ** res_dir);
+static int bfs_add_entry(struct inode *dir, const unsigned char *name,
+                                                int namelen, int ino);
+static struct buffer_head *bfs_find_entry(struct inode *dir,
+                                const unsigned char *name, int namelen,
+                                struct bfs_dirent **res_dir);
 
-static int bfs_readdir(struct file * f, void * dirent, filldir_t filldir)
+static int bfs_readdir(struct file *f, void *dirent, filldir_t filldir)
 {
-        struct inode * dir = f->f_path.dentry->d_inode;
-        struct buffer_head * bh;
-        struct bfs_dirent * de;
+        struct inode *dir = f->f_path.dentry->d_inode;
+        struct buffer_head *bh;
+        struct bfs_dirent *de;
         unsigned int offset;
         int block;
 
         lock_kernel();
 
-        if (f->f_pos & (BFS_DIRENT_SIZE-1)) {
-                printf("Bad f_pos=%08lx for %s:%08lx\n", (unsigned long)f->f_pos, 
-                        dir->i_sb->s_id, dir->i_ino);
+        if (f->f_pos & (BFS_DIRENT_SIZE - 1)) {
+                printf("Bad f_pos=%08lx for %s:%08lx\n",
+                                        (unsigned long)f->f_pos,
+                                        dir->i_sb->s_id, dir->i_ino);
                 unlock_kernel();
                 return -EBADF;
         }
 
         while (f->f_pos < dir->i_size) {
-                offset = f->f_pos & (BFS_BSIZE-1);
+                offset = f->f_pos & (BFS_BSIZE - 1);
                 block = BFS_I(dir)->i_sblock + (f->f_pos >> BFS_BSIZE_BITS);
                 bh = sb_bread(dir->i_sb, block);
                 if (!bh) {
@@ -54,7 +57,9 @@ static int bfs_readdir(struct file * f, void * dirent, filldir_t filldir)
                         de = (struct bfs_dirent *)(bh->b_data + offset);
                         if (de->ino) {
                                 int size = strnlen(de->name, BFS_NAMELEN);
-                                if (filldir(dirent, de->name, size, f->f_pos, le16_to_cpu(de->ino), DT_UNKNOWN) < 0) {
+                                if (filldir(dirent, de->name, size, f->f_pos,
+                                                le16_to_cpu(de->ino),
+                                                DT_UNKNOWN) < 0) {
                                         brelse(bh);
                                         unlock_kernel();
                                         return 0;
@@ -62,7 +67,7 @@ static int bfs_readdir(struct file * f, void * dirent, filldir_t filldir)
                         }
                         offset += BFS_DIRENT_SIZE;
                         f->f_pos += BFS_DIRENT_SIZE;
-                } while (offset < BFS_BSIZE && f->f_pos < dir->i_size);
+                } while ((offset < BFS_BSIZE) && (f->f_pos < dir->i_size));
                 brelse(bh);
         }
 
@@ -78,13 +83,13 @@ const struct file_operations bfs_dir_operations = {
 
 extern void dump_imap(const char *, struct super_block *);
 
-static int bfs_create(struct inode * dir, struct dentry * dentry, int mode,
-                struct nameidata *nd)
+static int bfs_create(struct inode *dir, struct dentry *dentry, int mode,
+                                                struct nameidata *nd)
 {
         int err;
-        struct inode * inode;
-        struct super_block * s = dir->i_sb;
-        struct bfs_sb_info * info = BFS_SB(s);
+        struct inode *inode;
+        struct super_block *s = dir->i_sb;
+        struct bfs_sb_info *info = BFS_SB(s);
         unsigned long ino;
 
         inode = new_inode(s);
@@ -97,7 +102,7 @@ static int bfs_create(struct inode * dir, struct dentry * dentry, int mode,
                 iput(inode);
                 return -ENOSPC;
         }
-        set_bit(ino, info->si_imap);    
+        set_bit(ino, info->si_imap);
         info->si_freei--;
         inode->i_uid = current->fsuid;
         inode->i_gid = (dir->i_mode & S_ISGID) ? dir->i_gid : current->fsgid;
@@ -113,9 +118,10 @@ static int bfs_create(struct inode * dir, struct dentry * dentry, int mode,
         BFS_I(inode)->i_eblock = 0;
         insert_inode_hash(inode);
         mark_inode_dirty(inode);
-        dump_imap("create",s);
+        dump_imap("create", s);
 
-        err = bfs_add_entry(dir, dentry->d_name.name, dentry->d_name.len, inode->i_ino);
+        err = bfs_add_entry(dir, dentry->d_name.name, dentry->d_name.len,
+                                                        inode->i_ino);
         if (err) {
                 inode_dec_link_count(inode);
                 iput(inode);
@@ -127,11 +133,12 @@ static int bfs_create(struct inode * dir, struct dentry * dentry, int mode,
         return 0;
 }
 
-static struct dentry * bfs_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd)
+static struct dentry *bfs_lookup(struct inode *dir, struct dentry *dentry,
+                                                struct nameidata *nd)
 {
-        struct inode * inode = NULL;
-        struct buffer_head * bh;
-        struct bfs_dirent * de;
+        struct inode *inode = NULL;
+        struct buffer_head *bh;
+        struct bfs_dirent *de;
 
         if (dentry->d_name.len > BFS_NAMELEN)
                 return ERR_PTR(-ENAMETOOLONG);
@@ -152,13 +159,15 @@ static struct dentry * bfs_lookup(struct inode * dir, struct dentry * dentry, st
         return NULL;
 }
 
-static int bfs_link(struct dentry * old, struct inode * dir, struct dentry * new)
+static int bfs_link(struct dentry *old, struct inode *dir,
+                                                struct dentry *new)
 {
-        struct inode * inode = old->d_inode;
+        struct inode *inode = old->d_inode;
         int err;
 
         lock_kernel();
-        err = bfs_add_entry(dir, new->d_name.name, new->d_name.len, inode->i_ino);
+        err = bfs_add_entry(dir, new->d_name.name, new->d_name.len,
+                                                        inode->i_ino);
         if (err) {
                 unlock_kernel();
                 return err;
@@ -172,23 +181,23 @@ static int bfs_link(struct dentry * old, struct inode * dir, struct dentry * new
         return 0;
 }
 
-
-static int bfs_unlink(struct inode * dir, struct dentry * dentry)
+static int bfs_unlink(struct inode *dir, struct dentry *dentry)
 {
         int error = -ENOENT;
-        struct inode * inode;
-        struct buffer_head * bh;
-        struct bfs_dirent * de;
+        struct inode *inode;
+        struct buffer_head *bh;
+        struct bfs_dirent *de;
 
         inode = dentry->d_inode;
         lock_kernel();
         bh = bfs_find_entry(dir, dentry->d_name.name, dentry->d_name.len, &de);
-        if (!bh || le16_to_cpu(de->ino) != inode->i_ino)
+        if (!bh || (le16_to_cpu(de->ino) != inode->i_ino))
                 goto out_brelse;
 
         if (!inode->i_nlink) {
-                printf("unlinking non-existent file %s:%lu (nlink=%d)\n", inode->i_sb->s_id, 
-                                inode->i_ino, inode->i_nlink);
+                printf("unlinking non-existent file %s:%lu (nlink=%d)\n",
+                                        inode->i_sb->s_id, inode->i_ino,
+                                        inode->i_nlink);
                 inode->i_nlink = 1;
         }
         de->ino = 0;
@@ -205,12 +214,12 @@ out_brelse:
         return error;
 }
 
-static int bfs_rename(struct inode * old_dir, struct dentry * old_dentry, 
-                        struct inode * new_dir, struct dentry * new_dentry)
+static int bfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+                        struct inode *new_dir, struct dentry *new_dentry)
 {
-        struct inode * old_inode, * new_inode;
-        struct buffer_head * old_bh, * new_bh;
-        struct bfs_dirent * old_de, * new_de;           
+        struct inode *old_inode, *new_inode;
+        struct buffer_head *old_bh, *new_bh;
+        struct bfs_dirent *old_de, *new_de;
         int error = -ENOENT;
 
         old_bh = new_bh = NULL;
@@ -223,7 +232,7 @@ static int bfs_rename(struct inode * old_dir, struct dentry * old_dentry,
                                 old_dentry->d_name.name, 
                                 old_dentry->d_name.len, &old_de);
 
-        if (!old_bh || le16_to_cpu(old_de->ino) != old_inode->i_ino)
+        if (!old_bh || (le16_to_cpu(old_de->ino) != old_inode->i_ino))
                 goto end_rename;
 
         error = -EPERM;
@@ -239,7 +248,8 @@ static int bfs_rename(struct inode * old_dir, struct dentry * old_dentry,
         if (!new_bh) {
                 error = bfs_add_entry(new_dir, 
                                         new_dentry->d_name.name,
-                                        new_dentry->d_name.len, old_inode->i_ino);
+                                        new_dentry->d_name.len,
+                                        old_inode->i_ino);
                 if (error)
                         goto end_rename;
         }
@@ -268,11 +278,12 @@ const struct inode_operations bfs_dir_inops = {
         .rename                 = bfs_rename,
 };
 
-static int bfs_add_entry(struct inode * dir, const unsigned char * name, int namelen, int ino)
+static int bfs_add_entry(struct inode *dir, const unsigned char *name,
+                                                        int namelen, int ino)
 {
-        struct buffer_head * bh;
-        struct bfs_dirent * de;
-        int block, sblock, eblock, off, eoff;
+        struct buffer_head *bh;
+        struct bfs_dirent *de;
+        int block, sblock, eblock, off, pos;
         int i;
 
         dprintf("name=%s, namelen=%d\n", name, namelen);
@@ -284,27 +295,24 @@ static int bfs_add_entry(struct inode * dir, const unsigned char * name, int nam
 
         sblock = BFS_I(dir)->i_sblock;
         eblock = BFS_I(dir)->i_eblock;
-        eoff = dir->i_size % BFS_BSIZE;
-        for (block=sblock; block<=eblock; block++) {
+        for (block = sblock; block <= eblock; block++) {
                 bh = sb_bread(dir->i_sb, block);
-                if(!bh) 
+                if (!bh)
                         return -ENOSPC;
-                for (off=0; off<BFS_BSIZE; off+=BFS_DIRENT_SIZE) {
+                for (off = 0; off < BFS_BSIZE; off += BFS_DIRENT_SIZE) {
                         de = (struct bfs_dirent *)(bh->b_data + off);
-                        if (block==eblock && off>=eoff) {
-                                /* Do not read/interpret the garbage in the end of eblock. */
-                                de->ino = 0;
-                        }
                         if (!de->ino) {
-                                if ((block-sblock)*BFS_BSIZE + off >= dir->i_size) {
+                                pos = (block - sblock) * BFS_BSIZE + off;
+                                if (pos >= dir->i_size) {
                                         dir->i_size += BFS_DIRENT_SIZE;
                                         dir->i_ctime = CURRENT_TIME_SEC;
                                 }
                                 dir->i_mtime = CURRENT_TIME_SEC;
                                 mark_inode_dirty(dir);
                                 de->ino = cpu_to_le16((u16)ino);
-                                for (i=0; i<BFS_NAMELEN; i++)
-                                        de->name[i] = (i < namelen) ? name[i] : 0;
+                                for (i = 0; i < BFS_NAMELEN; i++)
+                                        de->name[i] =
+                                                (i < namelen) ? name[i] : 0;
                                 mark_buffer_dirty(bh);
                                 brelse(bh);
                                 return 0;
@@ -315,25 +323,26 @@ static int bfs_add_entry(struct inode * dir, const unsigned char * name, int nam
         return -ENOSPC;
 }
 
-static inline int bfs_namecmp(int len, const unsigned char * name, const char * buffer)
+static inline int bfs_namecmp(int len, const unsigned char *name,
+                                                        const char *buffer)
 {
-        if (len < BFS_NAMELEN && buffer[len])
+        if ((len < BFS_NAMELEN) && buffer[len])
                 return 0;
         return !memcmp(name, buffer, len);
 }
 
-static struct buffer_head * bfs_find_entry(struct inode * dir, 
-        const unsigned char * name, int namelen, struct bfs_dirent ** res_dir)
+static struct buffer_head *bfs_find_entry(struct inode *dir,
+                        const unsigned char *name, int namelen,
+                        struct bfs_dirent **res_dir)
 {
-        unsigned long block, offset;
-        struct buffer_head * bh;
-        struct bfs_dirent * de;
+        unsigned long block = 0, offset = 0;
+        struct buffer_head *bh = NULL;
+        struct bfs_dirent *de;
 
         *res_dir = NULL;
         if (namelen > BFS_NAMELEN)
                 return NULL;
-        bh = NULL;
-        block = offset = 0;
+
         while (block * BFS_BSIZE + offset < dir->i_size) {
                 if (!bh) {
                         bh = sb_bread(dir->i_sb, BFS_I(dir)->i_sblock + block);
@@ -344,7 +353,8 @@ static struct buffer_head * bfs_find_entry(struct inode * dir,
                 }
                 de = (struct bfs_dirent *)(bh->b_data + offset);
                 offset += BFS_DIRENT_SIZE;
-                if (le16_to_cpu(de->ino) && bfs_namecmp(namelen, name, de->name)) {
+                if (le16_to_cpu(de->ino) &&
+                                bfs_namecmp(namelen, name, de->name)) {
                         *res_dir = de;
                         return bh;
                 }
diff --git a/fs/bfs/file.c b/fs/bfs/file.c
index 911b4ccf470f..b11e63e8fbcd 100644
--- a/fs/bfs/file.c
+++ b/fs/bfs/file.c
@@ -2,6 +2,11 @@
  *      fs/bfs/file.c
  *      BFS file operations.
  *      Copyright (C) 1999,2000 Tigran Aivazian <tigran@veritas.com>
+ *
+ *      Make the file block allocation algorithm understand the size
+ *      of the underlying block device.
+ *      Copyright (C) 2007 Dmitri Vorobiev <dmitri.vorobiev@gmail.com>
+ *
  */
 
 #include <linux/fs.h>
@@ -27,7 +32,8 @@ const struct file_operations bfs_file_operations = {
         .splice_read    = generic_file_splice_read,
 };
 
-static int bfs_move_block(unsigned long from, unsigned long to, struct super_block *sb)
+static int bfs_move_block(unsigned long from, unsigned long to,
+                                        struct super_block *sb)
 {
         struct buffer_head *bh, *new;
 
@@ -43,21 +49,22 @@ static int bfs_move_block(unsigned long from, unsigned long to, struct super_blo
 }
 
 static int bfs_move_blocks(struct super_block *sb, unsigned long start,
-                           unsigned long end, unsigned long where)
+                                unsigned long end, unsigned long where)
 {
         unsigned long i;
 
         dprintf("%08lx-%08lx->%08lx\n", start, end, where);
         for (i = start; i <= end; i++)
                 if(bfs_move_block(i, where + i, sb)) {
-                        dprintf("failed to move block %08lx -> %08lx\n", i, where + i);
+                        dprintf("failed to move block %08lx -> %08lx\n", i,
+                                                                where + i);
                         return -EIO;
                 }
         return 0;
 }
 
-static int bfs_get_block(struct inode * inode, sector_t block, 
-        struct buffer_head * bh_result, int create)
+static int bfs_get_block(struct inode *inode, sector_t block,
+                        struct buffer_head *bh_result, int create)
 {
         unsigned long phys;
         int err;
@@ -66,9 +73,6 @@ static int bfs_get_block(struct inode * inode, sector_t block,
         struct bfs_inode_info *bi = BFS_I(inode);
         struct buffer_head *sbh = info->si_sbh;
 
-        if (block > info->si_blocks)
-                return -EIO;
-
         phys = bi->i_sblock + block;
         if (!create) {
                 if (phys <= bi->i_eblock) {
@@ -79,21 +83,29 @@ static int bfs_get_block(struct inode * inode, sector_t block,
                 return 0;
         }
 
-        /* if the file is not empty and the requested block is within the range
-           of blocks allocated for this file, we can grant it */
-        if (inode->i_size && phys <= bi->i_eblock) {
+        /*
+         * If the file is not empty and the requested block is within the
+         * range of blocks allocated for this file, we can grant it.
+         */
+        if (bi->i_sblock && (phys <= bi->i_eblock)) {
                 dprintf("c=%d, b=%08lx, phys=%08lx (interim block granted)\n", 
                                 create, (unsigned long)block, phys);
                 map_bh(bh_result, sb, phys);
                 return 0;
         }
 
-        /* the rest has to be protected against itself */
+        /* The file will be extended, so let's see if there is enough space. */
+        if (phys >= info->si_blocks)
+                return -ENOSPC;
+
+        /* The rest has to be protected against itself. */
         lock_kernel();
 
-        /* if the last data block for this file is the last allocated
-           block, we can extend the file trivially, without moving it
-           anywhere */
+        /*
+         * If the last data block for this file is the last allocated
+         * block, we can extend the file trivially, without moving it
+         * anywhere.
+         */
         if (bi->i_eblock == info->si_lf_eblk) {
                 dprintf("c=%d, b=%08lx, phys=%08lx (simple extension)\n", 
                                 create, (unsigned long)block, phys);
@@ -106,13 +118,19 @@ static int bfs_get_block(struct inode * inode, sector_t block,
                 goto out;
         }
 
-        /* Ok, we have to move this entire file to the next free block */
+        /* Ok, we have to move this entire file to the next free block. */
         phys = info->si_lf_eblk + 1;
-        if (bi->i_sblock) { /* if data starts on block 0 then there is no data */
+        if (phys + block >= info->si_blocks) {
+                err = -ENOSPC;
+                goto out;
+        }
+
+        if (bi->i_sblock) {
                 err = bfs_move_blocks(inode->i_sb, bi->i_sblock, 
-                                bi->i_eblock, phys);
+                                                bi->i_eblock, phys);
                 if (err) {
-                        dprintf("failed to move ino=%08lx -> fs corruption\n", inode->i_ino);
+                        dprintf("failed to move ino=%08lx -> fs corruption\n",
+                                                                inode->i_ino);
                         goto out;
                 }
         } else
@@ -124,8 +142,10 @@ static int bfs_get_block(struct inode * inode, sector_t block,
         phys += block;
         info->si_lf_eblk = bi->i_eblock = phys;
 
-        /* this assumes nothing can write the inode back while we are here
-         * and thus update inode->i_blocks! (XXX)*/
+        /*
+         * This assumes nothing can write the inode back while we are here
+         * and thus update inode->i_blocks! (XXX)
+         */
         info->si_freeb -= bi->i_eblock - bi->i_sblock + 1 - inode->i_blocks;
         mark_inode_dirty(inode);
         mark_buffer_dirty(sbh);
diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
index 7bd9c2bbe6ee..a64a71d444f5 100644
--- a/fs/bfs/inode.c
+++ b/fs/bfs/inode.c
@@ -30,25 +30,26 @@ MODULE_LICENSE("GPL");
 #define dprintf(x...)
 #endif
 
-void dump_imap(const char *prefix, struct super_block * s);
+void dump_imap(const char *prefix, struct super_block *s);
 
-static void bfs_read_inode(struct inode * inode)
+static void bfs_read_inode(struct inode *inode)
 {
         unsigned long ino = inode->i_ino;
-        struct bfs_inode * di;
-        struct buffer_head * bh;
+        struct bfs_inode *di;
+        struct buffer_head *bh;
         int block, off;
 
-        if (ino < BFS_ROOT_INO || ino > BFS_SB(inode->i_sb)->si_lasti) {
+        if ((ino < BFS_ROOT_INO) || (ino > BFS_SB(inode->i_sb)->si_lasti)) {
                 printf("Bad inode number %s:%08lx\n", inode->i_sb->s_id, ino);
                 make_bad_inode(inode);
                 return;
         }
 
-        block = (ino - BFS_ROOT_INO)/BFS_INODES_PER_BLOCK + 1;
+        block = (ino - BFS_ROOT_INO) / BFS_INODES_PER_BLOCK + 1;
         bh = sb_bread(inode->i_sb, block);
         if (!bh) {
-                printf("Unable to read inode %s:%08lx\n", inode->i_sb->s_id, ino);
+                printf("Unable to read inode %s:%08lx\n", inode->i_sb->s_id,
+                                                                        ino);
                 make_bad_inode(inode);
                 return;
         }
@@ -56,7 +57,7 @@ static void bfs_read_inode(struct inode * inode)
         off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
         di = (struct bfs_inode *)bh->b_data + off;
 
-        inode->i_mode = 0x0000FFFF &  le32_to_cpu(di->i_mode);
+        inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
         if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
                 inode->i_mode |= S_IFDIR;
                 inode->i_op = &bfs_dir_inops;
@@ -70,48 +71,48 @@ static void bfs_read_inode(struct inode * inode)
 
         BFS_I(inode)->i_sblock =  le32_to_cpu(di->i_sblock);
         BFS_I(inode)->i_eblock =  le32_to_cpu(di->i_eblock);
+        BFS_I(inode)->i_dsk_ino = le16_to_cpu(di->i_ino);
         inode->i_uid =  le32_to_cpu(di->i_uid);
         inode->i_gid =  le32_to_cpu(di->i_gid);
         inode->i_nlink =  le32_to_cpu(di->i_nlink);
         inode->i_size = BFS_FILESIZE(di);
         inode->i_blocks = BFS_FILEBLOCKS(di);
-        if (inode->i_size || inode->i_blocks) dprintf("Registered inode with %lld size, %ld blocks\n", inode->i_size, inode->i_blocks);
         inode->i_atime.tv_sec =  le32_to_cpu(di->i_atime);
         inode->i_mtime.tv_sec =  le32_to_cpu(di->i_mtime);
         inode->i_ctime.tv_sec =  le32_to_cpu(di->i_ctime);
         inode->i_atime.tv_nsec = 0;
         inode->i_mtime.tv_nsec = 0;
         inode->i_ctime.tv_nsec = 0;
-        BFS_I(inode)->i_dsk_ino = le16_to_cpu(di->i_ino); /* can be 0 so we store a copy */
 
         brelse(bh);
 }
 
-static int bfs_write_inode(struct inode * inode, int unused)
+static int bfs_write_inode(struct inode *inode, int unused)
 {
         unsigned int ino = (u16)inode->i_ino;
         unsigned long i_sblock;
-        struct bfs_inode * di;
-        struct buffer_head * bh;
+        struct bfs_inode *di;
+        struct buffer_head *bh;
         int block, off;
 
         dprintf("ino=%08x\n", ino);
 
-        if (ino < BFS_ROOT_INO || ino > BFS_SB(inode->i_sb)->si_lasti) {
+        if ((ino < BFS_ROOT_INO) || (ino > BFS_SB(inode->i_sb)->si_lasti)) {
                 printf("Bad inode number %s:%08x\n", inode->i_sb->s_id, ino);
                 return -EIO;
         }
 
         lock_kernel();
-        block = (ino - BFS_ROOT_INO)/BFS_INODES_PER_BLOCK + 1;
+        block = (ino - BFS_ROOT_INO) / BFS_INODES_PER_BLOCK + 1;
         bh = sb_bread(inode->i_sb, block);
         if (!bh) {
-                printf("Unable to read inode %s:%08x\n", inode->i_sb->s_id, ino);
+                printf("Unable to read inode %s:%08x\n",
+                                inode->i_sb->s_id, ino);
                 unlock_kernel();
                 return -EIO;
         }
 
-        off = (ino - BFS_ROOT_INO)%BFS_INODES_PER_BLOCK;
+        off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
         di = (struct bfs_inode *)bh->b_data + off;
 
         if (ino == BFS_ROOT_INO)
@@ -133,27 +134,26 @@ static int bfs_write_inode(struct inode * inode, int unused)
         di->i_eoffset = cpu_to_le32(i_sblock * BFS_BSIZE + inode->i_size - 1);
 
         mark_buffer_dirty(bh);
-        dprintf("Written ino=%d into %d:%d\n",le16_to_cpu(di->i_ino),block,off);
         brelse(bh);
         unlock_kernel();
         return 0;
 }
 
-static void bfs_delete_inode(struct inode * inode)
+static void bfs_delete_inode(struct inode *inode)
 {
         unsigned long ino = inode->i_ino;
-        struct bfs_inode * di;
-        struct buffer_head * bh;
+        struct bfs_inode *di;
+        struct buffer_head *bh;
         int block, off;
-        struct super_block * s = inode->i_sb;
-        struct bfs_sb_info * info = BFS_SB(s);
-        struct bfs_inode_info * bi = BFS_I(inode);
+        struct super_block *s = inode->i_sb;
+        struct bfs_sb_info *info = BFS_SB(s);
+        struct bfs_inode_info *bi = BFS_I(inode);
 
         dprintf("ino=%08lx\n", ino);
 
         truncate_inode_pages(&inode->i_data, 0);
 
-        if (ino < BFS_ROOT_INO || ino > info->si_lasti) {
+        if ((ino < BFS_ROOT_INO) || (ino > info->si_lasti)) {
                 printf("invalid ino=%08lx\n", ino);
                 return;
         }
@@ -162,31 +162,36 @@ static void bfs_delete_inode(struct inode * inode)
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME_SEC;
         lock_kernel();
         mark_inode_dirty(inode);
-        block = (ino - BFS_ROOT_INO)/BFS_INODES_PER_BLOCK + 1;
+
+        block = (ino - BFS_ROOT_INO) / BFS_INODES_PER_BLOCK + 1;
         bh = sb_bread(s, block);
         if (!bh) {
-                printf("Unable to read inode %s:%08lx\n", inode->i_sb->s_id, ino);
+                printf("Unable to read inode %s:%08lx\n",
+                                        inode->i_sb->s_id, ino);
                 unlock_kernel();
                 return;
         }
-        off = (ino - BFS_ROOT_INO)%BFS_INODES_PER_BLOCK;
-        di = (struct bfs_inode *) bh->b_data + off;
+        off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+        di = (struct bfs_inode *)bh->b_data + off;
+        memset((void *)di, 0, sizeof(struct bfs_inode));
+        mark_buffer_dirty(bh);
+        brelse(bh);
+
         if (bi->i_dsk_ino) {
-                info->si_freeb += 1 + bi->i_eblock - bi->i_sblock;
+                if (bi->i_sblock)
+                        info->si_freeb += bi->i_eblock + 1 - bi->i_sblock;
                 info->si_freei++;
                 clear_bit(ino, info->si_imap);
                 dump_imap("delete_inode", s);
         }
-        di->i_ino = 0;
-        di->i_sblock = 0;
-        mark_buffer_dirty(bh);
-        brelse(bh);
 
-        /* if this was the last file, make the previous 
-           block "last files last block" even if there is no real file there,
-           saves us 1 gap */
-        if (info->si_lf_eblk == BFS_I(inode)->i_eblock) {
-                info->si_lf_eblk = BFS_I(inode)->i_sblock - 1;
+        /*
+         * If this was the last file, make the previous block
+         * "last block of the last file" even if there is no
+         * real file there, saves us 1 gap.
+         */
+        if (info->si_lf_eblk == bi->i_eblock) {
+                info->si_lf_eblk = bi->i_sblock - 1;
                 mark_buffer_dirty(info->si_sbh);
         }
         unlock_kernel();
@@ -228,7 +233,7 @@ static void bfs_write_super(struct super_block *s)
         unlock_kernel();
 }
 
-static struct kmem_cache * bfs_inode_cachep;
+static struct kmem_cache *bfs_inode_cachep;
 
 static struct inode *bfs_alloc_inode(struct super_block *sb)
 {
@@ -279,7 +284,7 @@ static const struct super_operations bfs_sops = {
         .statfs         = bfs_statfs,
 };
 
-void dump_imap(const char *prefix, struct super_block * s)
+void dump_imap(const char *prefix, struct super_block *s)
 {
 #ifdef DEBUG
         int i;
@@ -287,25 +292,26 @@ void dump_imap(const char *prefix, struct super_block * s)
 
         if (!tmpbuf)
                 return;
-        for (i=BFS_SB(s)->si_lasti; i>=0; i--) {
-                if (i > PAGE_SIZE-100) break;
+        for (i = BFS_SB(s)->si_lasti; i >= 0; i--) {
+                if (i > PAGE_SIZE - 100) break;
                 if (test_bit(i, BFS_SB(s)->si_imap))
                         strcat(tmpbuf, "1");
                 else
                         strcat(tmpbuf, "0");
         }
-        printk(KERN_ERR "BFS-fs: %s: lasti=%08lx <%s>\n", prefix, BFS_SB(s)->si_lasti, tmpbuf);
+        printf("BFS-fs: %s: lasti=%08lx <%s>\n",
+                                prefix, BFS_SB(s)->si_lasti, tmpbuf);
         free_page((unsigned long)tmpbuf);
 #endif
 }
 
 static int bfs_fill_super(struct super_block *s, void *data, int silent)
 {
-        struct buffer_head * bh;
-        struct bfs_super_block * bfs_sb;
-        struct inode * inode;
+        struct buffer_head *bh;
+        struct bfs_super_block *bfs_sb;
+        struct inode *inode;
         unsigned i, imap_len;
-        struct bfs_sb_info * info;
+        struct bfs_sb_info *info;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
@@ -329,14 +335,14 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
 
         s->s_magic = BFS_MAGIC;
         info->si_sbh = bh;
-        info->si_lasti = (le32_to_cpu(bfs_sb->s_start) - BFS_BSIZE)/sizeof(struct bfs_inode)
-                        + BFS_ROOT_INO - 1;
-
-        imap_len = info->si_lasti/8 + 1;
+        info->si_lasti = (le32_to_cpu(bfs_sb->s_start) - BFS_BSIZE) /
+                                        sizeof(struct bfs_inode)
+                                        + BFS_ROOT_INO - 1;
+        imap_len = (info->si_lasti / 8) + 1;
         info->si_imap = kzalloc(imap_len, GFP_KERNEL);
         if (!info->si_imap)
                 goto out;
-        for (i=0; i<BFS_ROOT_INO; i++) 
+        for (i = 0; i < BFS_ROOT_INO; i++)
                 set_bit(i, info->si_imap);
 
         s->s_op = &bfs_sops;
@@ -352,16 +358,15 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
                 goto out;
         }
 
-        info->si_blocks = (le32_to_cpu(bfs_sb->s_end) + 1)>>BFS_BSIZE_BITS; /* for statfs(2) */
-        info->si_freeb = (le32_to_cpu(bfs_sb->s_end) + 1 -  le32_to_cpu(bfs_sb->s_start))>>BFS_BSIZE_BITS;
+        info->si_blocks = (le32_to_cpu(bfs_sb->s_end) + 1) >> BFS_BSIZE_BITS;
+        info->si_freeb = (le32_to_cpu(bfs_sb->s_end) + 1
+                        - le32_to_cpu(bfs_sb->s_start)) >> BFS_BSIZE_BITS;
         info->si_freei = 0;
         info->si_lf_eblk = 0;
-        info->si_lf_sblk = 0;
-        info->si_lf_ioff = 0;
         bh = NULL;
-        for (i=BFS_ROOT_INO; i<=info->si_lasti; i++) {
+        for (i = BFS_ROOT_INO; i <= info->si_lasti; i++) {
                 struct bfs_inode *di;
-                int block = (i - BFS_ROOT_INO)/BFS_INODES_PER_BLOCK + 1;
+                int block = (i - BFS_ROOT_INO) / BFS_INODES_PER_BLOCK + 1;
                 int off = (i - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
                 unsigned long sblock, eblock;
 
@@ -384,11 +389,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
 
                 sblock =  le32_to_cpu(di->i_sblock);
                 eblock =  le32_to_cpu(di->i_eblock);
-                if (eblock > info->si_lf_eblk) {
+                if (eblock > info->si_lf_eblk)
                         info->si_lf_eblk = eblock;
-                        info->si_lf_sblk = sblock;
-                        info->si_lf_ioff = BFS_INO2OFF(i);
-                }
         }
         brelse(bh);
         if (!(s->s_flags & MS_RDONLY)) {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 6e2f3b8dde7f..ba8de7ca260b 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1383,10 +1383,10 @@ static void fill_prstatus(struct elf_prstatus *prstatus,
         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
         prstatus->pr_sigpend = p->pending.signal.sig[0];
         prstatus->pr_sighold = p->blocked.sig[0];
-        prstatus->pr_pid = p->pid;
-        prstatus->pr_ppid = p->parent->pid;
-        prstatus->pr_pgrp = process_group(p);
-        prstatus->pr_sid = process_session(p);
+        prstatus->pr_pid = task_pid_vnr(p);
+        prstatus->pr_ppid = task_pid_vnr(p->parent);
+        prstatus->pr_pgrp = task_pgrp_vnr(p);
+        prstatus->pr_sid = task_session_vnr(p);
         if (thread_group_leader(p)) {
                 /*
                  * This is the record for the group leader.  Add in the
@@ -1429,10 +1429,10 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
                         psinfo->pr_psargs[i] = ' ';
         psinfo->pr_psargs[len] = 0;
 
-        psinfo->pr_pid = p->pid;
-        psinfo->pr_ppid = p->parent->pid;
-        psinfo->pr_pgrp = process_group(p);
-        psinfo->pr_sid = process_session(p);
+        psinfo->pr_pid = task_pid_vnr(p);
+        psinfo->pr_ppid = task_pid_vnr(p->parent);
+        psinfo->pr_pgrp = task_pgrp_vnr(p);
+        psinfo->pr_sid = task_session_vnr(p);
 
         i = p->state ? ffz(~p->state) + 1 : 0;
         psinfo->pr_state = i;
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 033861c6b8f1..32649f2a1654 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1342,10 +1342,10 @@ static void fill_prstatus(struct elf_prstatus *prstatus,
         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
         prstatus->pr_sigpend = p->pending.signal.sig[0];
         prstatus->pr_sighold = p->blocked.sig[0];
-        prstatus->pr_pid = p->pid;
-        prstatus->pr_ppid = p->parent->pid;
-        prstatus->pr_pgrp = process_group(p);
-        prstatus->pr_sid = process_session(p);
+        prstatus->pr_pid = task_pid_vnr(p);
+        prstatus->pr_ppid = task_pid_vnr(p->parent);
+        prstatus->pr_pgrp = task_pgrp_vnr(p);
+        prstatus->pr_sid = task_session_vnr(p);
         if (thread_group_leader(p)) {
                 /*
                  * This is the record for the group leader.  Add in the
@@ -1391,10 +1391,10 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
                         psinfo->pr_psargs[i] = ' ';
         psinfo->pr_psargs[len] = 0;
 
-        psinfo->pr_pid = p->pid;
-        psinfo->pr_ppid = p->parent->pid;
-        psinfo->pr_pgrp = process_group(p);
-        psinfo->pr_sid = process_session(p);
+        psinfo->pr_pid = task_pid_vnr(p);
+        psinfo->pr_ppid = task_pid_vnr(p->parent);
+        psinfo->pr_pgrp = task_pgrp_vnr(p);
+        psinfo->pr_sid = task_session_vnr(p);
 
         i = p->state ? ffz(~p->state) + 1 : 0;
         psinfo->pr_state = i;
diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
index 576dd7de2278..f95ae9789c91 100644
--- a/fs/binfmt_em86.c
+++ b/fs/binfmt_em86.c
@@ -2,7 +2,7 @@
  *  linux/fs/binfmt_em86.c
  *
  *  Based on linux/fs/binfmt_script.c
- *  Copyright (C) 1996  Martin von Löwis
+ *  Copyright (C) 1996  Martin von Löwis
  *  original #!-checking implemented by tytso.
  *
  *  em86 changes Copyright (C) 1997  Jim Paradis
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 42e94b3ab7be..b53c7e5f41bb 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -1,7 +1,7 @@
 /*
  *  binfmt_misc.c
  *
- *  Copyright (C) 1997 Richard Günther
+ *  Copyright (C) 1997 Richard Günther
  *
  *  binfmt_misc detects binaries via a magic or filename extension and invokes
  *  a specified wrapper. This should obsolete binfmt_java, binfmt_em86 and
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 4d0e0f6d3273..ab33939b12a7 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -1,7 +1,7 @@
 /*
  *  linux/fs/binfmt_script.c
  *
- *  Copyright (C) 1996  Martin von Löwis
+ *  Copyright (C) 1996  Martin von Löwis
  *  original #!-checking implemented by tytso.
  */
 
diff --git a/fs/buffer.c b/fs/buffer.c
index 76403b1764c5..7249e014819e 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2563,7 +2563,7 @@ int nobh_write_end(struct file *file, struct address_space *mapping,
                         struct page *page, void *fsdata)
 {
         struct inode *inode = page->mapping->host;
-        struct buffer_head *head = NULL;
+        struct buffer_head *head = fsdata;
         struct buffer_head *bh;
 
         if (!PageMappedToDisk(page)) {
@@ -2584,7 +2584,6 @@ int nobh_write_end(struct file *file, struct address_space *mapping,
         unlock_page(page);
         page_cache_release(page);
 
-        head = fsdata;
         while (head) {
                 bh = head;
                 head = head->b_this_page;
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index bed6215c0794..a609599287aa 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,31 @@
+Version 1.52
+------------
+Fix oops on second mount to server when null auth is used.
+Enable experimental Kerberos support.  Return writebehind errors on flush
+and sync so that events like out of disk space get reported properly on
+cached files.
+
+Version 1.51
+------------
+Fix memory leak in statfs when mounted to very old servers (e.g.
+Windows 9x).  Add new feature "POSIX open" which allows servers
+which support the current POSIX Extensions to provide better semantics
+(e.g. delete for open files opened with posix open).  Take into
+account umask on posix mkdir not just older style mkdir.  Add
+ability to mount to IPC$ share (which allows CIFS named pipes to be
+opened, read and written as if they were files).  When 1st tree
+connect fails (e.g. due to signing negotiation failure) fix
+leak that causes cifsd not to stop and rmmod to fail to cleanup
+cifs_request_buffers pool. Fix problem with POSIX Open/Mkdir on
+bigendian architectures. Fix possible memory corruption when
+EAGAIN returned on kern_recvmsg. Return better error if server
+requires packet signing but client has disabled it. When mounted
+with cifsacl mount option - mode bits are approximated based
+on the contents of the ACL of the file or directory. When cifs
+mount helper is missing convert make sure that UNC name 
+has backslash (not forward slash) between ip address of server
+and the share name.
+
 Version 1.50
 ------------
 Fix NTLMv2 signing. NFS server mounted over cifs works (if cifs mount is
@@ -6,7 +34,10 @@ done with "serverino" mount option).  Add support for POSIX Unlink
 Samba supports newer POSIX CIFS Protocol Extensions). Add "nounix"
 mount option to allow disabling the CIFS Unix Extensions for just
 that mount. Fix hang on spinlock in find_writable_file (race when
-reopening file after session crash).
+reopening file after session crash).  Byte range unlock request to
+windows server could unlock more bytes (on server copy of file)
+than intended if start of unlock request is well before start of
+a previous byte range lock that we issued.
 
 Version 1.49
 ------------
diff --git a/fs/cifs/Makefile b/fs/cifs/Makefile
index 6ecd9d6ba3f3..45e42fb97c19 100644
--- a/fs/cifs/Makefile
+++ b/fs/cifs/Makefile
@@ -3,4 +3,9 @@
 #
 obj-$(CONFIG_CIFS) += cifs.o
 
-cifs-objs := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o readdir.o ioctl.o sess.o export.o
+cifs-y := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o \
+          link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o \
+          md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o \
+          readdir.o ioctl.o sess.o export.o cifsacl.o
+
+cifs-$(CONFIG_CIFS_UPCALL) += cifs_spnego.o
diff --git a/fs/cifs/README b/fs/cifs/README
index b806b11b5560..bf11329ac784 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -225,12 +225,9 @@ If no password is provided, mount.cifs will prompt for password entry
 
 Restrictions
 ============
-Servers must support the NTLM SMB dialect (which is the most recent, supported 
-by Samba and Windows NT version 4, 2000 and XP and many other SMB/CIFS servers) 
 Servers must support either "pure-TCP" (port 445 TCP/IP CIFS connections) or RFC 
-1001/1002 support for "Netbios-Over-TCP/IP." Neither of these is likely to be a 
-problem as most servers support this.  IPv6 support is planned for the future,
-and is almost complete.
+1001/1002 support for "Netbios-Over-TCP/IP." This is not likely to be a 
+problem as most servers support this.
 
 Valid filenames differ between Windows and Linux.  Windows typically restricts
 filenames which contain certain reserved characters (e.g.the character : 
@@ -458,6 +455,8 @@ A partial list of the supported mount options follows:
                 byte range locks).
  remount        remount the share (often used to change from ro to rw mounts
                 or vice versa)
+ cifsacl        Report mode bits (e.g. on stat) based on the Windows ACL for
+                the file. (EXPERIMENTAL)
  servern        Specify the server 's netbios name (RFC1001 name) to use
                 when attempting to setup a session to the server.  This is
                 This is needed for mounting to some older servers (such
@@ -584,8 +583,8 @@ Experimental            When set to 1 used to enable certain experimental
                         performance enhancement was disabled when
                         signing turned on in case buffer was modified
                         just before it was sent, also this flag will
-                        be used to use the new experimental sessionsetup
-                        code).
+                        be used to use the new experimental directory change 
+                        notification code).
 
 These experimental features and tracing can be enabled by changing flags in 
 /proc/fs/cifs (after the cifs module has been installed or built into the 
@@ -608,7 +607,8 @@ the start of smb requests and responses can be enabled via:
 Two other experimental features are under development. To test these
 requires enabling CONFIG_CIFS_EXPERIMENTAL
 
-        ipv6 enablement
+        cifsacl support needed to retrieve approximated mode bits based on
+                the contents on the CIFS ACL.
 
         DNOTIFY fcntl: needed for support of directory change 
                             notification and perhaps later for file leases)
@@ -625,10 +625,7 @@ that they represent all for that share, not just those for which the server
 returned success.
         
 Also note that "cat /proc/fs/cifs/DebugData" will display information about 
-the active sessions and the shares that are mounted.  Note: NTLMv2 enablement 
-will not work since its implementation is not quite complete yet. Do not alter
-the ExtendedSecurity configuration value unless you are doing specific testing.
-Enabling extended security works to Windows 2000 Workstations and XP but not to 
-Windows 2000 server or Samba since it does not usually send "raw NTLMSSP" 
-(instead it sends NTLMSSP encapsulated in SPNEGO/GSSAPI, which support is not 
-complete in the CIFS VFS yet).  
+the active sessions and the shares that are mounted.
+Enabling Kerberos (extended security) works when CONFIG_CIFS_EXPERIMENTAL is enabled
+but requires a user space helper (from the Samba project). NTLM and NTLMv2 and
+LANMAN support do not require this helpr.
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index 29d4b2715254..a8852c200728 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -16,7 +16,7 @@ SecurityDescriptors
 c) Better pam/winbind integration (e.g. to handle uid mapping
 better)
 
-d) Kerberos/SPNEGO session setup support - (started)
+d) Verify that Kerberos signing works
 
 e) Cleanup now unneeded SessSetup code in
 fs/cifs/connect.c and add back in NTLMSSP code if any servers
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index f50a88d58f78..bcda2c6b6a04 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -77,8 +77,12 @@
 
 #define SPNEGO_OID_LEN 7
 #define NTLMSSP_OID_LEN  10
+#define KRB5_OID_LEN  7
+#define MSKRB5_OID_LEN  7
 static unsigned long SPNEGO_OID[7] = { 1, 3, 6, 1, 5, 5, 2 };
 static unsigned long NTLMSSP_OID[10] = { 1, 3, 6, 1, 4, 1, 311, 2, 2, 10 };
+static unsigned long KRB5_OID[7] = { 1, 2, 840, 113554, 1, 2, 2 };
+static unsigned long MSKRB5_OID[7] = { 1, 2, 840, 48018, 1, 2, 2 };
 
 /*
  * ASN.1 context.
@@ -385,10 +389,9 @@ asn1_oid_decode(struct asn1_ctx *ctx,
         unsigned long *optr;
 
         size = eoc - ctx->pointer + 1;
-        *oid = kmalloc(size * sizeof (unsigned long), GFP_ATOMIC);
-        if (*oid == NULL) {
+        *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+        if (*oid == NULL)
                 return 0;
-        }
 
         optr = *oid;
 
@@ -458,6 +461,7 @@ decode_negTokenInit(unsigned char *security_blob, int length,
         unsigned long *oid = NULL;
         unsigned int cls, con, tag, oidlen, rc;
         int use_ntlmssp = FALSE;
+        int use_kerberos = FALSE;
 
         *secType = NTLM; /* BB eventually make Kerberos or NLTMSSP the default*/
 
@@ -546,18 +550,28 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                                 return 0;
                         }
                         if ((tag == ASN1_OJI) && (con == ASN1_PRI)) {
-                                rc = asn1_oid_decode(&ctx, end, &oid, &oidlen);
-                                if (rc) {
+                                if (asn1_oid_decode(&ctx, end, &oid, &oidlen)) {
+
                                         cFYI(1,
                                           ("OID len = %d oid = 0x%lx 0x%lx "
                                            "0x%lx 0x%lx",
                                            oidlen, *oid, *(oid + 1),
                                            *(oid + 2), *(oid + 3)));
-                                        rc = compare_oid(oid, oidlen,
-                                                 NTLMSSP_OID, NTLMSSP_OID_LEN);
-                                        kfree(oid);
-                                        if (rc)
+
+                                        if (compare_oid(oid, oidlen,
+                                                        MSKRB5_OID,
+                                                        MSKRB5_OID_LEN))
+                                                use_kerberos = TRUE;
+                                        else if (compare_oid(oid, oidlen,
+                                                             KRB5_OID,
+                                                             KRB5_OID_LEN))
+                                                use_kerberos = TRUE;
+                                        else if (compare_oid(oid, oidlen,
+                                                             NTLMSSP_OID,
+                                                             NTLMSSP_OID_LEN))
                                                 use_ntlmssp = TRUE;
+
+                                        kfree(oid);
                                 }
                         } else {
                                 cFYI(1, ("Should be an oid what is going on?"));
@@ -581,9 +595,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                         return 0;
                 } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
                            || (tag != ASN1_SEQ)) {
-                        cFYI(1,
-                             ("Exit 6 cls = %d con = %d tag = %d end = %p (%d)",
-                              cls, con, tag, end, *end));
+                        cFYI(1, ("cls = %d con = %d tag = %d end = %p (%d)",
+                                cls, con, tag, end, *end));
                 }
 
                 if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
@@ -611,12 +624,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                          ctx.pointer)); /* is this UTF-8 or ASCII? */
         }
 
-        /* if (use_kerberos)
-           *secType = Kerberos
-           else */
-        if (use_ntlmssp) {
+        if (use_kerberos)
+                *secType = Kerberos;
+        else if (use_ntlmssp)
                 *secType = NTLMSSP;
-        }
 
         return 1;
 }
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 1bf8cf522ad6..73c4c419663c 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -209,13 +209,16 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                 i++;
                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
                 dev_type = le32_to_cpu(tcon->fsDevInfo.DeviceType);
-                length =
-                    sprintf(buf,
-                            "\n%d) %s Uses: %d Type: %s DevInfo: 0x%x "
-                            "Attributes: 0x%x\nPathComponentMax: %d Status: %d",
-                            i, tcon->treeName,
-                            atomic_read(&tcon->useCount),
-                            tcon->nativeFileSystem,
+                length = sprintf(buf, "\n%d) %s Uses: %d ", i,
+                                 tcon->treeName, atomic_read(&tcon->useCount));
+                buf += length;
+                if (tcon->nativeFileSystem) {
+                        length = sprintf(buf, "Type: %s ",
+                                         tcon->nativeFileSystem);
+                        buf += length;
+                }
+                length = sprintf(buf, "DevInfo: 0x%x Attributes: 0x%x"
+                                 "\nPathComponentMax: %d Status: %d",
                             le32_to_cpu(tcon->fsDevInfo.DeviceCharacteristics),
                             le32_to_cpu(tcon->fsAttrInfo.Attributes),
                             le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength),
@@ -876,11 +879,16 @@ security_flags_write(struct file *file, const char __user *buffer,
         if (count < 3) {
                 /* single char or single char followed by null */
                 c = flags_string[0];
-                if (c == '0' || c == 'n' || c == 'N')
+                if (c == '0' || c == 'n' || c == 'N') {
                         extended_security = CIFSSEC_DEF; /* default */
-                else if (c == '1' || c == 'y' || c == 'Y')
+                        return count;
+                } else if (c == '1' || c == 'y' || c == 'Y') {
                         extended_security = CIFSSEC_MAX;
-                return count;
+                        return count;
+                } else if (!isdigit(c)) {
+                        cERROR(1, ("invalid flag %c", c));
+                        return -EINVAL;
+                }
         }
         /* else we have a number */
 
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
new file mode 100644
index 000000000000..1529d2b12e9c
--- /dev/null
+++ b/fs/cifs/cifs_spnego.c
@@ -0,0 +1,134 @@
+/*
+ *   fs/cifs/cifs_spnego.c -- SPNEGO upcall management for CIFS
+ *
+ *   Copyright (c) 2007 Red Hat, Inc.
+ *   Author(s): Jeff Layton (jlayton@redhat.com)
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/list.h>
+#include <linux/string.h>
+#include <keys/user-type.h>
+#include <linux/key-type.h>
+#include "cifsglob.h"
+#include "cifs_spnego.h"
+#include "cifs_debug.h"
+
+/* create a new cifs key */
+static int
+cifs_spnego_key_instantiate(struct key *key, const void *data, size_t datalen)
+{
+        char *payload;
+        int ret;
+
+        ret = -ENOMEM;
+        payload = kmalloc(datalen, GFP_KERNEL);
+        if (!payload)
+                goto error;
+
+        /* attach the data */
+        memcpy(payload, data, datalen);
+        rcu_assign_pointer(key->payload.data, payload);
+        ret = 0;
+
+error:
+        return ret;
+}
+
+static void
+cifs_spnego_key_destroy(struct key *key)
+{
+        kfree(key->payload.data);
+}
+
+
+/*
+ * keytype for CIFS spnego keys
+ */
+struct key_type cifs_spnego_key_type = {
+        .name           = "cifs.spnego",
+        .instantiate    = cifs_spnego_key_instantiate,
+        .match          = user_match,
+        .destroy        = cifs_spnego_key_destroy,
+        .describe       = user_describe,
+};
+
+#define MAX_VER_STR_LEN   9 /* length of longest version string e.g.
+                                strlen(";ver=0xFF") */
+#define MAX_MECH_STR_LEN 13 /* length of longest security mechanism name, eg
+                               in future could have strlen(";sec=ntlmsspi") */
+#define MAX_IPV6_ADDR_LEN 42 /* eg FEDC:BA98:7654:3210:FEDC:BA98:7654:3210/60 */
+/* get a key struct with a SPNEGO security blob, suitable for session setup */
+struct key *
+cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
+{
+        struct TCP_Server_Info *server = sesInfo->server;
+        char *description, *dp;
+        size_t desc_len;
+        struct key *spnego_key;
+        const char *hostname = server->hostname;
+
+        /* BB: come up with better scheme for determining length */
+        /* length of fields (with semicolons): ver=0xyz ipv4= ipaddress host=
+           hostname sec=mechanism uid=0x uid */
+        desc_len = MAX_VER_STR_LEN + 5 + MAX_IPV6_ADDR_LEN + 1 + 6 +
+                  strlen(hostname) + MAX_MECH_STR_LEN + 8 + (sizeof(uid_t) * 2);
+        spnego_key = ERR_PTR(-ENOMEM);
+        description = kzalloc(desc_len, GFP_KERNEL);
+        if (description == NULL)
+                goto out;
+
+        dp = description;
+        /* start with version and hostname portion of UNC string */
+        spnego_key = ERR_PTR(-EINVAL);
+        sprintf(dp, "ver=0x%x;host=%s;", CIFS_SPNEGO_UPCALL_VERSION,
+                hostname);
+        dp = description + strlen(description);
+
+        /* add the server address */
+        if (server->addr.sockAddr.sin_family == AF_INET)
+                sprintf(dp, "ip4=" NIPQUAD_FMT,
+                        NIPQUAD(server->addr.sockAddr.sin_addr));
+        else if (server->addr.sockAddr.sin_family == AF_INET6)
+                sprintf(dp, "ip6=" NIP6_SEQFMT,
+                        NIP6(server->addr.sockAddr6.sin6_addr));
+        else
+                goto out;
+
+        dp = description + strlen(description);
+
+        /* for now, only sec=krb5 is valid */
+        if (server->secType == Kerberos)
+                sprintf(dp, ";sec=krb5");
+        else
+                goto out;
+
+        dp = description + strlen(description);
+        sprintf(dp, ";uid=0x%x", sesInfo->linux_uid);
+
+        cFYI(1, ("key description = %s", description));
+        spnego_key = request_key(&cifs_spnego_key_type, description, "");
+
+        if (cifsFYI && !IS_ERR(spnego_key)) {
+                struct cifs_spnego_msg *msg = spnego_key->payload.data;
+                cifs_dump_mem("SPNEGO reply blob:", msg->data,
+                                msg->secblob_len + msg->sesskey_len);
+        }
+
+out:
+        kfree(description);
+        return spnego_key;
+}
diff --git a/fs/cifs/cifs_spnego.h b/fs/cifs/cifs_spnego.h
new file mode 100644
index 000000000000..05a34b17a1ab
--- /dev/null
+++ b/fs/cifs/cifs_spnego.h
@@ -0,0 +1,47 @@
+/*
+ *   fs/cifs/cifs_spnego.h -- SPNEGO upcall management for CIFS
+ *
+ *   Copyright (c) 2007 Red Hat, Inc.
+ *   Author(s): Jeff Layton (jlayton@redhat.com)
+ *              Steve French (sfrench@us.ibm.com)
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _CIFS_SPNEGO_H
+#define _CIFS_SPNEGO_H
+
+#define CIFS_SPNEGO_UPCALL_VERSION 1
+
+/*
+ * The version field should always be set to CIFS_SPNEGO_UPCALL_VERSION.
+ * The flags field is for future use. The request-key callout should set
+ * sesskey_len and secblob_len, and then concatenate the SessKey+SecBlob
+ * and stuff it in the data field.
+ */
+struct cifs_spnego_msg {
+        uint32_t        version;
+        uint32_t        flags;
+        uint32_t        sesskey_len;
+        uint32_t        secblob_len;
+        uint8_t         data[1];
+};
+
+#ifdef __KERNEL__
+extern struct key_type cifs_spnego_key_type;
+extern struct key *cifs_get_spnego_key(struct cifsSesInfo *sesInfo);
+#endif /* KERNEL */
+
+#endif /* _CIFS_SPNEGO_H */
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
new file mode 100644
index 000000000000..c312adcba4fc
--- /dev/null
+++ b/fs/cifs/cifsacl.c
@@ -0,0 +1,533 @@
+/*
+ *   fs/cifs/cifsacl.c
+ *
+ *   Copyright (C) International Business Machines  Corp., 2007
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *
+ *   Contains the routines for mapping CIFS/NTFS ACLs
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/fs.h>
+#include "cifspdu.h"
+#include "cifsglob.h"
+#include "cifsacl.h"
+#include "cifsproto.h"
+#include "cifs_debug.h"
+
+
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+
+static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
+        {{1, 0, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0} }, "null user"},
+        {{1, 1, {0, 0, 0, 0, 0, 1}, {0, 0, 0, 0, 0} }, "nobody"},
+        {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(11), 0, 0, 0, 0} }, "net-users"},
+        {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"},
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"},
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} }
+;
+
+
+/* security id for everyone */
+static const struct cifs_sid sid_everyone = {
+        1, 1, {0, 0, 0, 0, 0, 1}, {0} };
+/* group users */
+static const struct cifs_sid sid_user =
+                {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
+
+
+int match_sid(struct cifs_sid *ctsid)
+{
+        int i, j;
+        int num_subauth, num_sat, num_saw;
+        struct cifs_sid *cwsid;
+
+        if (!ctsid)
+                return (-1);
+
+        for (i = 0; i < NUM_WK_SIDS; ++i) {
+                cwsid = &(wksidarr[i].cifssid);
+
+                /* compare the revision */
+                if (ctsid->revision != cwsid->revision)
+                        continue;
+
+                /* compare all of the six auth values */
+                for (j = 0; j < 6; ++j) {
+                        if (ctsid->authority[j] != cwsid->authority[j])
+                                break;
+                }
+                if (j < 6)
+                        continue; /* all of the auth values did not match */
+
+                /* compare all of the subauth values if any */
+                num_sat = ctsid->num_subauth;
+                num_saw = cwsid->num_subauth;
+                num_subauth = num_sat < num_saw ? num_sat : num_saw;
+                if (num_subauth) {
+                        for (j = 0; j < num_subauth; ++j) {
+                                if (ctsid->sub_auth[j] != cwsid->sub_auth[j])
+                                        break;
+                        }
+                        if (j < num_subauth)
+                                continue; /* all sub_auth values do not match */
+                }
+
+                cFYI(1, ("matching sid: %s\n", wksidarr[i].sidname));
+                return (0); /* sids compare/match */
+        }
+
+        cFYI(1, ("No matching sid"));
+        return (-1);
+}
+
+/* if the two SIDs (roughly equivalent to a UUID for a user or group) are
+   the same returns 1, if they do not match returns 0 */
+int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
+{
+        int i;
+        int num_subauth, num_sat, num_saw;
+
+        if ((!ctsid) || (!cwsid))
+                return (0);
+
+        /* compare the revision */
+        if (ctsid->revision != cwsid->revision)
+                return (0);
+
+        /* compare all of the six auth values */
+        for (i = 0; i < 6; ++i) {
+                if (ctsid->authority[i] != cwsid->authority[i])
+                        return (0);
+        }
+
+        /* compare all of the subauth values if any */
+        num_sat = ctsid->num_subauth;
+        num_saw = cwsid->num_subauth;
+        num_subauth = num_sat < num_saw ? num_sat : num_saw;
+        if (num_subauth) {
+                for (i = 0; i < num_subauth; ++i) {
+                        if (ctsid->sub_auth[i] != cwsid->sub_auth[i])
+                                return (0);
+                }
+        }
+
+        return (1); /* sids compare/match */
+}
+
+/*
+   change posix mode to reflect permissions
+   pmode is the existing mode (we only want to overwrite part of this
+   bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
+*/
+static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode,
+                                 umode_t *pbits_to_set)
+{
+        __u32 flags = le32_to_cpu(ace_flags);
+        /* the order of ACEs is important.  The canonical order is to begin with
+           DENY entries followed by ALLOW, otherwise an allow entry could be
+           encountered first, making the subsequent deny entry like "dead code"
+           which would be superflous since Windows stops when a match is made
+           for the operation you are trying to perform for your user */
+
+        /* For deny ACEs we change the mask so that subsequent allow access
+           control entries do not turn on the bits we are denying */
+        if (type == ACCESS_DENIED) {
+                if (flags & GENERIC_ALL) {
+                        *pbits_to_set &= ~S_IRWXUGO;
+                }
+                if ((flags & GENERIC_WRITE) ||
+                        ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
+                        *pbits_to_set &= ~S_IWUGO;
+                if ((flags & GENERIC_READ) ||
+                        ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
+                        *pbits_to_set &= ~S_IRUGO;
+                if ((flags & GENERIC_EXECUTE) ||
+                        ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
+                        *pbits_to_set &= ~S_IXUGO;
+                return;
+        } else if (type != ACCESS_ALLOWED) {
+                cERROR(1, ("unknown access control type %d", type));
+                return;
+        }
+        /* else ACCESS_ALLOWED type */
+
+        if (flags & GENERIC_ALL) {
+                *pmode |= (S_IRWXUGO & (*pbits_to_set));
+#ifdef CONFIG_CIFS_DEBUG2
+                cFYI(1, ("all perms"));
+#endif
+                return;
+        }
+        if ((flags & GENERIC_WRITE) ||
+                        ((flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
+                *pmode |= (S_IWUGO & (*pbits_to_set));
+        if ((flags & GENERIC_READ) ||
+                        ((flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
+                *pmode |= (S_IRUGO & (*pbits_to_set));
+        if ((flags & GENERIC_EXECUTE) ||
+                        ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
+                *pmode |= (S_IXUGO & (*pbits_to_set));
+
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("access flags 0x%x mode now 0x%x", flags, *pmode));
+#endif
+        return;
+}
+
+/*
+   Generate access flags to reflect permissions mode is the existing mode.
+   This function is called for every ACE in the DACL whose SID matches
+   with either owner or group or everyone.
+*/
+
+static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
+                                __u32 *pace_flags)
+{
+        /* reset access mask */
+        *pace_flags = 0x0;
+
+        /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
+        mode &= bits_to_use;
+
+        /* check for R/W/X UGO since we do not know whose flags
+           is this but we have cleared all the bits sans RWX for
+           either user or group or other as per bits_to_use */
+        if (mode & S_IRUGO)
+                *pace_flags |= SET_FILE_READ_RIGHTS;
+        if (mode & S_IWUGO)
+                *pace_flags |= SET_FILE_WRITE_RIGHTS;
+        if (mode & S_IXUGO)
+                *pace_flags |= SET_FILE_EXEC_RIGHTS;
+
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("mode: 0x%x, access flags now 0x%x", mode, *pace_flags));
+#endif
+        return;
+}
+
+
+#ifdef CONFIG_CIFS_DEBUG2
+static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
+{
+        int num_subauth;
+
+        /* validate that we do not go past end of acl */
+
+        if (le16_to_cpu(pace->size) < 16) {
+                cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
+                return;
+        }
+
+        if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
+                cERROR(1, ("ACL too small to parse ACE"));
+                return;
+        }
+
+        num_subauth = pace->sid.num_subauth;
+        if (num_subauth) {
+                int i;
+                cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
+                        pace->sid.revision, pace->sid.num_subauth, pace->type,
+                        pace->flags, pace->size));
+                for (i = 0; i < num_subauth; ++i) {
+                        cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
+                                le32_to_cpu(pace->sid.sub_auth[i])));
+                }
+
+                /* BB add length check to make sure that we do not have huge
+                        num auths and therefore go off the end */
+        }
+
+        return;
+}
+#endif
+
+
+static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
+                       struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
+                       struct inode *inode)
+{
+        int i;
+        int num_aces = 0;
+        int acl_size;
+        char *acl_base;
+        struct cifs_ace **ppace;
+
+        /* BB need to add parm so we can store the SID BB */
+
+        if (!pdacl) {
+                /* no DACL in the security descriptor, set
+                   all the permissions for user/group/other */
+                inode->i_mode |= S_IRWXUGO;
+                return;
+        }
+
+        /* validate that we do not go past end of acl */
+        if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
+                cERROR(1, ("ACL too small to parse DACL"));
+                return;
+        }
+
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("DACL revision %d size %d num aces %d",
+                le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size),
+                le32_to_cpu(pdacl->num_aces)));
+#endif
+
+        /* reset rwx permissions for user/group/other.
+           Also, if num_aces is 0 i.e. DACL has no ACEs,
+           user/group/other have no permissions */
+        inode->i_mode &= ~(S_IRWXUGO);
+
+        acl_base = (char *)pdacl;
+        acl_size = sizeof(struct cifs_acl);
+
+        num_aces = le32_to_cpu(pdacl->num_aces);
+        if (num_aces  > 0) {
+                umode_t user_mask = S_IRWXU;
+                umode_t group_mask = S_IRWXG;
+                umode_t other_mask = S_IRWXO;
+
+                ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
+                                GFP_KERNEL);
+
+/*              cifscred->cecount = pdacl->num_aces;
+                cifscred->aces = kmalloc(num_aces *
+                        sizeof(struct cifs_ace *), GFP_KERNEL);*/
+
+                for (i = 0; i < num_aces; ++i) {
+                        ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
+#ifdef CONFIG_CIFS_DEBUG2
+                        dump_ace(ppace[i], end_of_acl);
+#endif
+                        if (compare_sids(&(ppace[i]->sid), pownersid))
+                                access_flags_to_mode(ppace[i]->access_req,
+                                                     ppace[i]->type,
+                                                     &(inode->i_mode),
+                                                     &user_mask);
+                        if (compare_sids(&(ppace[i]->sid), pgrpsid))
+                                access_flags_to_mode(ppace[i]->access_req,
+                                                     ppace[i]->type,
+                                                     &(inode->i_mode),
+                                                     &group_mask);
+                        if (compare_sids(&(ppace[i]->sid), &sid_everyone))
+                                access_flags_to_mode(ppace[i]->access_req,
+                                                     ppace[i]->type,
+                                                     &(inode->i_mode),
+                                                     &other_mask);
+
+/*                      memcpy((void *)(&(cifscred->aces[i])),
+                                (void *)ppace[i],
+                                sizeof(struct cifs_ace)); */
+
+                        acl_base = (char *)ppace[i];
+                        acl_size = le16_to_cpu(ppace[i]->size);
+                }
+
+                kfree(ppace);
+        }
+
+        return;
+}
+
+
+static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
+{
+        /* BB need to add parm so we can store the SID BB */
+
+        /* validate that we do not go past end of ACL - sid must be at least 8
+           bytes long (assuming no sub-auths - e.g. the null SID */
+        if (end_of_acl < (char *)psid + 8) {
+                cERROR(1, ("ACL too small to parse SID %p", psid));
+                return -EINVAL;
+        }
+
+        if (psid->num_subauth) {
+#ifdef CONFIG_CIFS_DEBUG2
+                int i;
+                cFYI(1, ("SID revision %d num_auth %d",
+                        psid->revision, psid->num_subauth));
+
+                for (i = 0; i < psid->num_subauth; i++) {
+                        cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
+                                le32_to_cpu(psid->sub_auth[i])));
+                }
+
+                /* BB add length check to make sure that we do not have huge
+                        num auths and therefore go off the end */
+                cFYI(1, ("RID 0x%x",
+                        le32_to_cpu(psid->sub_auth[psid->num_subauth-1])));
+#endif
+        }
+
+        return 0;
+}
+
+
+/* Convert CIFS ACL to POSIX form */
+static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
+                          struct inode *inode)
+{
+        int rc;
+        struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
+        struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
+        char *end_of_acl = ((char *)pntsd) + acl_len;
+        __u32 dacloffset;
+
+        if ((inode == NULL) || (pntsd == NULL))
+                return -EIO;
+
+        owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+                                le32_to_cpu(pntsd->osidoffset));
+        group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
+                                le32_to_cpu(pntsd->gsidoffset));
+        dacloffset = le32_to_cpu(pntsd->dacloffset);
+        dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
+                 "sacloffset 0x%x dacloffset 0x%x",
+                 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
+                 le32_to_cpu(pntsd->gsidoffset),
+                 le32_to_cpu(pntsd->sacloffset), dacloffset));
+#endif
+/*      cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
+        rc = parse_sid(owner_sid_ptr, end_of_acl);
+        if (rc)
+                return rc;
+
+        rc = parse_sid(group_sid_ptr, end_of_acl);
+        if (rc)
+                return rc;
+
+        if (dacloffset)
+                parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
+                           group_sid_ptr, inode);
+        else
+                cFYI(1, ("no ACL")); /* BB grant all or default perms? */
+
+/*      cifscred->uid = owner_sid_ptr->rid;
+        cifscred->gid = group_sid_ptr->rid;
+        memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
+                        sizeof(struct cifs_sid));
+        memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
+                        sizeof(struct cifs_sid)); */
+
+
+        return (0);
+}
+
+
+/* Retrieve an ACL from the server */
+static struct cifs_ntsd *get_cifs_acl(u32 *pacllen, struct inode *inode,
+                                       const char *path)
+{
+        struct cifsFileInfo *open_file;
+        int unlock_file = FALSE;
+        int xid;
+        int rc = -EIO;
+        __u16 fid;
+        struct super_block *sb;
+        struct cifs_sb_info *cifs_sb;
+        struct cifs_ntsd *pntsd = NULL;
+
+        cFYI(1, ("get mode from ACL for %s", path));
+
+        if (inode == NULL)
+                return NULL;
+
+        xid = GetXid();
+        open_file = find_readable_file(CIFS_I(inode));
+        sb = inode->i_sb;
+        if (sb == NULL) {
+                FreeXid(xid);
+                return NULL;
+        }
+        cifs_sb = CIFS_SB(sb);
+
+        if (open_file) {
+                unlock_file = TRUE;
+                fid = open_file->netfid;
+        } else {
+                int oplock = FALSE;
+                /* open file */
+                rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN,
+                                READ_CONTROL, 0, &fid, &oplock, NULL,
+                                cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                if (rc != 0) {
+                        cERROR(1, ("Unable to open file to get ACL"));
+                        FreeXid(xid);
+                        return NULL;
+                }
+        }
+
+        rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
+        cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
+        if (unlock_file == TRUE)
+                atomic_dec(&open_file->wrtPending);
+        else
+                CIFSSMBClose(xid, cifs_sb->tcon, fid);
+
+        FreeXid(xid);
+        return pntsd;
+}
+
+/* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
+void acl_to_uid_mode(struct inode *inode, const char *path)
+{
+        struct cifs_ntsd *pntsd = NULL;
+        u32 acllen = 0;
+        int rc = 0;
+
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("converting ACL to mode for %s", path));
+#endif
+        pntsd = get_cifs_acl(&acllen, inode, path);
+
+        /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
+        if (pntsd)
+                rc = parse_sec_desc(pntsd, acllen, inode);
+        if (rc)
+                cFYI(1, ("parse sec desc failed rc = %d", rc));
+
+        kfree(pntsd);
+        return;
+}
+
+/* Convert mode bits to an ACL so we can update the ACL on the server */
+int mode_to_acl(struct inode *inode, const char *path)
+{
+        int rc = 0;
+        __u32 acllen = 0;
+        struct cifs_ntsd *pntsd = NULL;
+
+        cFYI(1, ("set ACL from mode for %s", path));
+
+        /* Get the security descriptor */
+        pntsd = get_cifs_acl(&acllen, inode, path);
+
+        /* Add/Modify the three ACEs for owner, group, everyone
+           while retaining the other ACEs */
+
+        /* Set the security descriptor */
+
+
+        kfree(pntsd);
+        return rc;
+}
+#endif /* CONFIG_CIFS_EXPERIMENTAL */
diff --git a/fs/cifs/cifsacl.h b/fs/cifs/cifsacl.h
index 5eff35d6e564..93a7c3462ea2 100644
--- a/fs/cifs/cifsacl.h
+++ b/fs/cifs/cifsacl.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsacl.h
  *
- *   Copyright (c) International Business Machines  Corp., 2005
+ *   Copyright (c) International Business Machines  Corp., 2007
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -22,17 +22,62 @@
 #ifndef _CIFSACL_H
 #define _CIFSACL_H
 
+
+#define NUM_AUTHS 6 /* number of authority fields */
+#define NUM_SUBAUTHS 5 /* number of sub authority fields */
+#define NUM_WK_SIDS 7 /* number of well known sids */
+#define SIDNAMELENGTH 20 /* long enough for the ones we care about */
+
+#define READ_BIT        0x4
+#define WRITE_BIT       0x2
+#define EXEC_BIT        0x1
+
+#define UBITSHIFT       6
+#define GBITSHIFT       3
+
+#define ACCESS_ALLOWED  0
+#define ACCESS_DENIED   1
+
+struct cifs_ntsd {
+        __le16 revision; /* revision level */
+        __le16 type;
+        __le32 osidoffset;
+        __le32 gsidoffset;
+        __le32 sacloffset;
+        __le32 dacloffset;
+} __attribute__((packed));
+
 struct cifs_sid {
         __u8 revision; /* revision level */
-        __u8 num_subauths;
+        __u8 num_subauth;
         __u8 authority[6];
-        __u32 sub_auth[4];
-        /* next sub_auth if any ... */
+        __le32 sub_auth[5]; /* sub_auth[num_subauth] */
 } __attribute__((packed));
 
-/* everyone */
-/* extern const struct cifs_sid sid_everyone;*/
-/* group users */
-/* extern const struct cifs_sid sid_user;*/
+struct cifs_acl {
+        __le16 revision; /* revision level */
+        __le16 size;
+        __le32 num_aces;
+} __attribute__((packed));
+
+struct cifs_ace {
+        __u8 type;
+        __u8 flags;
+        __le16 size;
+        __le32 access_req;
+        struct cifs_sid sid; /* ie UUID of user or group who gets these perms */
+} __attribute__((packed));
+
+struct cifs_wksid {
+        struct cifs_sid cifssid;
+        char sidname[SIDNAMELENGTH];
+} __attribute__((packed));
+
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+
+extern int match_sid(struct cifs_sid *);
+extern int compare_sids(const struct cifs_sid *, const struct cifs_sid *);
+
+#endif /*  CONFIG_CIFS_EXPERIMENTAL */
 
 #endif /* _CIFSACL_H */
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 36272293027d..4ff8939c6cc7 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -99,15 +99,16 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
         MD5Init(&context);
         MD5Update(&context, (char *)&key->data, key->len);
         for (i = 0; i < n_vec; i++) {
+                if (iov[i].iov_len == 0)
+                        continue;
                 if (iov[i].iov_base == NULL) {
                         cERROR(1, ("null iovec entry"));
                         return -EIO;
-                } else if (iov[i].iov_len == 0)
-                        break; /* bail out if we are sent nothing to sign */
+                }
                 /* The first entry includes a length field (which does not get
                    signed that occupies the first 4 bytes before the header */
                 if (i == 0) {
-                        if (iov[0].iov_len <= 8 ) /* cmd field at offset 9 */
+                        if (iov[0].iov_len <= 8) /* cmd field at offset 9 */
                                 break; /* nothing to sign or corrupt header */
                         MD5Update(&context, iov[0].iov_base+4,
                                   iov[0].iov_len-4);
@@ -122,7 +123,7 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
 
 
 int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
-                   __u32 * pexpected_response_sequence_number)
+                   __u32 *pexpected_response_sequence_number)
 {
         int rc = 0;
         char smb_signature[20];
@@ -345,7 +346,7 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses,
         user = kmalloc(2 + (len * 2), GFP_KERNEL);
         if (user == NULL)
                 goto calc_exit_2;
-        len = cifs_strtoUCS(user, ses->userName, len, nls_cp);
+        len = cifs_strtoUCS((__le16 *)user, ses->userName, len, nls_cp);
         UniStrupr(user);
         hmac_md5_update((char *)user, 2*len, pctxt);
 
@@ -356,7 +357,8 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses,
                 domain = kmalloc(2 + (len * 2), GFP_KERNEL);
                 if (domain == NULL)
                         goto calc_exit_1;
-                len = cifs_strtoUCS(domain, ses->domainName, len, nls_cp);
+                len = cifs_strtoUCS((__le16 *)domain, ses->domainName, len,
+                                        nls_cp);
                 /* the following line was removed since it didn't work well
                    with lower cased domain name that passed as an option.
                    Maybe converting the domain name earlier makes sense */
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index ba8f7868cb23..093beaa3900d 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -43,16 +43,14 @@
 #include "cifs_debug.h"
 #include "cifs_fs_sb.h"
 #include <linux/mm.h>
+#include <linux/key-type.h>
+#include "cifs_spnego.h"
 #define CIFS_MAGIC_NUMBER 0xFF534D42    /* the first four bytes of SMB PDUs */
 
 #ifdef CONFIG_CIFS_QUOTA
 static struct quotactl_ops cifs_quotactl_ops;
 #endif /* QUOTA */
 
-#ifdef CONFIG_CIFS_EXPERIMENTAL
-extern struct export_operations cifs_export_ops;
-#endif /* EXPERIMENTAL */
-
 int cifsFYI = 0;
 int cifsERROR = 1;
 int traceSMB = 0;
@@ -240,9 +238,9 @@ static int cifs_permission(struct inode *inode, int mask, struct nameidata *nd)
 
         cifs_sb = CIFS_SB(inode->i_sb);
 
-        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM) {
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM)
                 return 0;
-        } else /* file mode might have been restricted at mount time
+        else /* file mode might have been restricted at mount time
                 on the client (above and beyond ACL on servers) for
                 servers which do not support setting and viewing mode bits,
                 so allowing client to check permissions is useful */
@@ -268,6 +266,7 @@ cifs_alloc_inode(struct super_block *sb)
         cifs_inode->cifsAttrs = 0x20;   /* default */
         atomic_set(&cifs_inode->inUse, 0);
         cifs_inode->time = 0;
+        cifs_inode->write_behind_rc = 0;
         /* Until the file is open and we have gotten oplock
         info back from the server, can not assume caching of
         file data or metadata */
@@ -312,15 +311,15 @@ cifs_show_options(struct seq_file *s, struct vfsmount *m)
                                         seq_printf(s, ",domain=%s",
                                            cifs_sb->tcon->ses->domainName);
                         }
+                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID) ||
+                           !(cifs_sb->tcon->unix_ext))
+                                seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
+                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID) ||
+                           !(cifs_sb->tcon->unix_ext))
+                                seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
                 }
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)
                         seq_printf(s, ",posixpaths");
-                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID) ||
-                   !(cifs_sb->tcon->unix_ext))
-                        seq_printf(s, ",uid=%d", cifs_sb->mnt_uid);
-                if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID) ||
-                   !(cifs_sb->tcon->unix_ext))
-                        seq_printf(s, ",gid=%d", cifs_sb->mnt_gid);
                 seq_printf(s, ",rsize=%d", cifs_sb->rsize);
                 seq_printf(s, ",wsize=%d", cifs_sb->wsize);
         }
@@ -346,7 +345,7 @@ int cifs_xquota_set(struct super_block *sb, int quota_type, qid_t qid,
         if (pTcon) {
                 cFYI(1, ("set type: 0x%x id: %d", quota_type, qid));
         } else {
-                return -EIO;
+                rc = -EIO;
         }
 
         FreeXid(xid);
@@ -716,7 +715,7 @@ static int
 cifs_init_inodecache(void)
 {
         cifs_inode_cachep = kmem_cache_create("cifs_inode_cache",
-                                              sizeof (struct cifsInodeInfo),
+                                              sizeof(struct cifsInodeInfo),
                                               0, (SLAB_RECLAIM_ACCOUNT|
                                                 SLAB_MEM_SPREAD),
                                               cifs_init_once);
@@ -816,8 +815,8 @@ static int
 cifs_init_mids(void)
 {
         cifs_mid_cachep = kmem_cache_create("cifs_mpx_ids",
-                                sizeof (struct mid_q_entry), 0,
-                                SLAB_HWCACHE_ALIGN, NULL);
+                                            sizeof(struct mid_q_entry), 0,
+                                            SLAB_HWCACHE_ALIGN, NULL);
         if (cifs_mid_cachep == NULL)
                 return -ENOMEM;
 
@@ -829,8 +828,8 @@ cifs_init_mids(void)
         }
 
         cifs_oplock_cachep = kmem_cache_create("cifs_oplock_structs",
-                                sizeof (struct oplock_q_entry), 0,
-                                SLAB_HWCACHE_ALIGN, NULL);
+                                        sizeof(struct oplock_q_entry), 0,
+                                        SLAB_HWCACHE_ALIGN, NULL);
         if (cifs_oplock_cachep == NULL) {
                 mempool_destroy(cifs_mid_poolp);
                 kmem_cache_destroy(cifs_mid_cachep);
@@ -854,7 +853,7 @@ static int cifs_oplock_thread(void *dummyarg)
         struct cifsTconInfo *pTcon;
         struct inode *inode;
         __u16  netfid;
-        int rc;
+        int rc, waitrc = 0;
 
         set_freezable();
         do {
@@ -882,12 +881,15 @@ static int cifs_oplock_thread(void *dummyarg)
                                 the call */
                                 /* mutex_lock(&inode->i_mutex);*/
                                 if (S_ISREG(inode->i_mode)) {
-                                        rc = filemap_fdatawrite(inode->i_mapping);
+                                        rc =
+                                           filemap_fdatawrite(inode->i_mapping);
                                         if (CIFS_I(inode)->clientCanCacheRead
                                                                          == 0) {
-                                                filemap_fdatawait(inode->i_mapping);
+                                                waitrc = filemap_fdatawait(inode->i_mapping);
                                                 invalidate_remote_inode(inode);
                                         }
+                                        if (rc == 0)
+                                                rc = waitrc;
                                 } else
                                         rc = 0;
                                 /* mutex_unlock(&inode->i_mutex);*/
@@ -907,8 +909,7 @@ static int cifs_oplock_thread(void *dummyarg)
                                             0 /* len */ , 0 /* offset */, 0,
                                             0, LOCKING_ANDX_OPLOCK_RELEASE,
                                             0 /* wait flag */);
-                                        cFYI(1, 
-                                              ("Oplock release rc = %d ", rc));
+                                        cFYI(1, ("Oplock release rc = %d", rc));
                                 }
                         } else
                                 spin_unlock(&GlobalMid_Lock);
@@ -1009,12 +1010,16 @@ init_cifs(void)
         rc = register_filesystem(&cifs_fs_type);
         if (rc)
                 goto out_destroy_request_bufs;
-
+#ifdef CONFIG_CIFS_UPCALL
+        rc = register_key_type(&cifs_spnego_key_type);
+        if (rc)
+                goto out_unregister_filesystem;
+#endif
         oplockThread = kthread_run(cifs_oplock_thread, NULL, "cifsoplockd");
         if (IS_ERR(oplockThread)) {
                 rc = PTR_ERR(oplockThread);
                 cERROR(1, ("error %d create oplock thread", rc));
-                goto out_unregister_filesystem;
+                goto out_unregister_key_type;
         }
 
         dnotifyThread = kthread_run(cifs_dnotify_thread, NULL, "cifsdnotifyd");
@@ -1028,7 +1033,11 @@ init_cifs(void)
 
  out_stop_oplock_thread:
         kthread_stop(oplockThread);
+ out_unregister_key_type:
+#ifdef CONFIG_CIFS_UPCALL
+        unregister_key_type(&cifs_spnego_key_type);
  out_unregister_filesystem:
+#endif
         unregister_filesystem(&cifs_fs_type);
  out_destroy_request_bufs:
         cifs_destroy_request_bufs();
@@ -1050,6 +1059,9 @@ exit_cifs(void)
 #ifdef CONFIG_PROC_FS
         cifs_proc_clean();
 #endif
+#ifdef CONFIG_CIFS_UPCALL
+        unregister_key_type(&cifs_spnego_key_type);
+#endif
         unregister_filesystem(&cifs_fs_type);
         cifs_destroy_inodecache();
         cifs_destroy_mids();
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index a20de77a3856..2a21dc66f0de 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsfs.h
  *
- *   Copyright (c) International Business Machines  Corp., 2002, 2005
+ *   Copyright (c) International Business Machines  Corp., 2002, 2007
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -99,7 +99,12 @@ extern int 	cifs_setxattr(struct dentry *, const char *, const void *,
                         size_t, int);
 extern ssize_t  cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
-extern int cifs_ioctl (struct inode *inode, struct file *filep,
+extern int cifs_ioctl(struct inode *inode, struct file *filep,
                        unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.50"
+
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+extern const struct export_operations cifs_export_ops;
+#endif /* EXPERIMENTAL */
+
+#define CIFS_VERSION   "1.52"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index b98742fc3b5a..1fde2197ad76 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -19,6 +19,7 @@
 #include <linux/in.h>
 #include <linux/in6.h>
 #include "cifs_fs_sb.h"
+#include "cifsacl.h"
 /*
  * The sizes of various internal tables and strings
  */
@@ -89,7 +90,8 @@ enum statusEnum {
 };
 
 enum securityEnum {
-        LANMAN = 0,             /* Legacy LANMAN auth */
+        PLAINTXT = 0,           /* Legacy with Plaintext passwords */
+        LANMAN,                 /* Legacy LANMAN auth */
         NTLM,                   /* Legacy NTLM012 auth with NTLM hash */
         NTLMv2,                 /* Legacy NTLM auth with NTLMv2 hash */
         RawNTLMSSP,             /* NTLMSSP without SPNEGO */
@@ -108,6 +110,7 @@ struct mac_key {
         unsigned int len;
         union {
                 char ntlm[CIFS_SESS_KEY_SIZE + 16];
+                char krb5[CIFS_SESS_KEY_SIZE + 16]; /* BB: length correct? */
                 struct {
                         char key[16];
                         struct ntlmv2_resp resp;
@@ -115,6 +118,17 @@ struct mac_key {
         } data;
 };
 
+struct cifs_cred {
+        int uid;
+        int gid;
+        int mode;
+        int cecount;
+        struct cifs_sid osid;
+        struct cifs_sid gsid;
+        struct cifs_ntace *ntaces;
+        struct cifs_ace *aces;
+};
+
 /*
  *****************************************************************
  * Except the CIFS PDUs themselves all the
@@ -126,6 +140,7 @@ struct TCP_Server_Info {
         /* 15 character server name + 0x20 16th byte indicating type = srv */
         char server_RFC1001_name[SERVER_NAME_LEN_WITH_NULL];
         char unicode_server_Name[SERVER_NAME_LEN_WITH_NULL * 2];
+        char *hostname; /* hostname portion of UNC string */
         struct socket *ssocket;
         union {
                 struct sockaddr_in sockAddr;
@@ -279,6 +294,7 @@ struct cifsTconInfo {
         FILE_SYSTEM_DEVICE_INFO fsDevInfo;
         FILE_SYSTEM_ATTRIBUTE_INFO fsAttrInfo; /* ok if fs name truncated */
         FILE_SYSTEM_UNIX_INFO fsUnixInfo;
+        unsigned ipc:1;         /* set if connection to IPC$ eg for RPC/PIPES */
         unsigned retry:1;
         unsigned nocase:1;
         unsigned unix_ext:1; /* if off disable Linux extensions to CIFS protocol
@@ -329,6 +345,7 @@ struct cifsFileInfo {
         struct list_head llist; /* list of byte range locks we have. */
         unsigned closePend:1;   /* file is marked to close */
         unsigned invalidHandle:1;  /* file closed via session abend */
+        unsigned messageMode:1;    /* for pipes: message vs byte mode */
         atomic_t wrtPending;   /* handle in use - defer close */
         struct semaphore fh_sem; /* prevents reopen race after dead ses*/
         char *search_resume_name; /* BB removeme BB */
@@ -456,6 +473,17 @@ struct dir_notify_req {
 #define   CIFS_LARGE_BUFFER     2
 #define   CIFS_IOVEC            4    /* array of response buffers */
 
+/* Type of Request to SendReceive2 */
+#define   CIFS_STD_OP           0    /* normal request timeout */
+#define   CIFS_LONG_OP          1    /* long op (up to 45 sec, oplock time) */
+#define   CIFS_VLONG_OP         2    /* sloow op - can take up to 180 seconds */
+#define   CIFS_BLOCKING_OP      4    /* operation can block */
+#define   CIFS_ASYNC_OP         8    /* do not wait for response */
+#define   CIFS_TIMEOUT_MASK 0x00F    /* only one of 5 above set in req */
+#define   CIFS_LOG_ERROR    0x010    /* log NT STATUS if non-zero */
+#define   CIFS_LARGE_BUF_OP 0x020    /* large request buffer */
+#define   CIFS_NO_RESP      0x040    /* no response buffer required */
+
 /* Security Flags: indicate type of session setup needed */
 #define   CIFSSEC_MAY_SIGN      0x00001
 #define   CIFSSEC_MAY_NTLM      0x00002
@@ -464,6 +492,9 @@ struct dir_notify_req {
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 #define   CIFSSEC_MAY_LANMAN    0x00010
 #define   CIFSSEC_MAY_PLNTXT    0x00020
+#else
+#define   CIFSSEC_MAY_LANMAN    0
+#define   CIFSSEC_MAY_PLNTXT    0
 #endif /* weak passwords */
 #define   CIFSSEC_MAY_SEAL      0x00040 /* not supported yet */
 
@@ -477,14 +508,23 @@ require use of the stronger protocol */
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 #define   CIFSSEC_MUST_LANMAN   0x10010
 #define   CIFSSEC_MUST_PLNTXT   0x20020
+#ifdef CONFIG_CIFS_UPCALL
+#define   CIFSSEC_MASK          0x3F03F /* allows weak security but also krb5 */
+#else
 #define   CIFSSEC_MASK          0x37037 /* current flags supported if weak */
+#endif /* UPCALL */
+#else /* do not allow weak pw hash */
+#ifdef CONFIG_CIFS_UPCALL
+#define   CIFSSEC_MASK          0x0F00F /* flags supported if no weak allowed */
 #else
-#define   CIFSSEC_MASK          0x07007 /* flags supported if no weak config */
+#define   CIFSSEC_MASK          0x07007 /* flags supported if no weak allowed */
+#endif /* UPCALL */
 #endif /* WEAK_PW_HASH */
 #define   CIFSSEC_MUST_SEAL     0x40040 /* not supported yet */
 
 #define   CIFSSEC_DEF  CIFSSEC_MAY_SIGN | CIFSSEC_MAY_NTLM | CIFSSEC_MAY_NTLMV2
 #define   CIFSSEC_MAX  CIFSSEC_MUST_SIGN | CIFSSEC_MUST_NTLMV2
+#define   CIFSSEC_AUTH_MASK (CIFSSEC_MAY_NTLM | CIFSSEC_MAY_NTLMV2 | CIFSSEC_MAY_LANMAN | CIFSSEC_MAY_PLNTXT | CIFSSEC_MAY_KRB5)
 /*
  *****************************************************************
  * All constants go here
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 6a2056e58ceb..dbe6b846f37f 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -215,6 +215,29 @@
                                          /* file_execute, file_read_attributes*/
                                          /* write_dac, and delete.           */
 
+#define FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_READ_ATTRIBUTES)
+#define FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
+                                | FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES)
+#define FILE_EXEC_RIGHTS (FILE_EXECUTE)
+
+#define SET_FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_WRITE_EA \
+                                | FILE_READ_ATTRIBUTES \
+                                | FILE_WRITE_ATTRIBUTES \
+                                | DELETE | READ_CONTROL | WRITE_DAC \
+                                | WRITE_OWNER | SYNCHRONIZE)
+#define SET_FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
+                                | FILE_READ_EA | FILE_WRITE_EA \
+                                | FILE_DELETE_CHILD | FILE_READ_ATTRIBUTES \
+                                | FILE_WRITE_ATTRIBUTES \
+                                | DELETE | READ_CONTROL | WRITE_DAC \
+                                | WRITE_OWNER | SYNCHRONIZE)
+#define SET_FILE_EXEC_RIGHTS (FILE_READ_EA | FILE_WRITE_EA | FILE_EXECUTE \
+                                | FILE_READ_ATTRIBUTES \
+                                | FILE_WRITE_ATTRIBUTES \
+                                | DELETE | READ_CONTROL | WRITE_DAC \
+                                | WRITE_OWNER | SYNCHRONIZE)
+
+
 /*
  * Invalid readdir handle
  */
@@ -360,10 +383,10 @@ struct smb_hdr {
         __u8 WordCount;
 } __attribute__((packed));
 /* given a pointer to an smb_hdr retrieve the value of byte count */
-#define BCC(smb_var) ( *(__u16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2* smb_var->WordCount) ) )
-#define BCC_LE(smb_var) ( *(__le16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2* smb_var->WordCount) ) )
+#define BCC(smb_var) ( *(__u16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount)))
+#define BCC_LE(smb_var) ( *(__le16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount)))
 /* given a pointer to an smb_hdr retrieve the pointer to the byte area */
-#define pByteArea(smb_var) ((unsigned char *)smb_var + sizeof(struct smb_hdr) + (2* smb_var->WordCount) + 2 )
+#define pByteArea(smb_var) ((unsigned char *)smb_var + sizeof(struct smb_hdr) + (2 * smb_var->WordCount) + 2)
 
 /*
  * Computer Name Length (since Netbios name was length 16 with last byte 0x20)
@@ -716,6 +739,14 @@ typedef struct smb_com_findclose_req {
 #define REQ_OPENDIRONLY    0x00000008
 #define REQ_EXTENDED_INFO  0x00000010
 
+/* File type */
+#define DISK_TYPE               0x0000
+#define BYTE_PIPE_TYPE          0x0001
+#define MESSAGE_PIPE_TYPE       0x0002
+#define PRINTER_TYPE            0x0003
+#define COMM_DEV_TYPE           0x0004
+#define UNKNOWN_TYPE            0xFFFF
+
 typedef struct smb_com_open_req {       /* also handles create */
         struct smb_hdr hdr;     /* wct = 24 */
         __u8 AndXCommand;
@@ -1197,6 +1228,29 @@ typedef struct smb_com_transaction_qsec_req {
         __le32 AclFlags;
 } __attribute__((packed)) QUERY_SEC_DESC_REQ;
 
+
+typedef struct smb_com_transaction_ssec_req {
+        struct smb_hdr hdr;     /* wct = 19 */
+        __u8 MaxSetupCount;
+        __u16 Reserved;
+        __le32 TotalParameterCount;
+        __le32 TotalDataCount;
+        __le32 MaxParameterCount;
+        __le32 MaxDataCount;
+        __le32 ParameterCount;
+        __le32 ParameterOffset;
+        __le32 DataCount;
+        __le32 DataOffset;
+        __u8 SetupCount; /* no setup words follow subcommand */
+        /* SNIA spec incorrectly included spurious pad here */
+        __le16 SubCommand; /* 3 = SET_SECURITY_DESC */
+        __le16 ByteCount; /* bcc = 3 + 8 */
+        __u8 Pad[3];
+        __u16 Fid;
+        __u16 Reserved2;
+        __le32 AclFlags;
+} __attribute__((packed)) SET_SEC_DESC_REQ;
+
 typedef struct smb_com_transaction_change_notify_req {
         struct smb_hdr hdr;     /* wct = 23 */
         __u8 MaxSetupCount;
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 04a69dafedba..8350eec49663 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -48,9 +48,11 @@ extern int SendReceive(const unsigned int /* xid */ , struct cifsSesInfo *,
                         struct smb_hdr * /* input */ ,
                         struct smb_hdr * /* out */ ,
                         int * /* bytes returned */ , const int long_op);
+extern int SendReceiveNoRsp(const unsigned int xid, struct cifsSesInfo *ses,
+                        struct smb_hdr *in_buf, int flags);
 extern int SendReceive2(const unsigned int /* xid */ , struct cifsSesInfo *,
                         struct kvec *, int /* nvec to send */,
-                        int * /* type of buf returned */ , const int long_op);
+                        int * /* type of buf returned */ , const int flags);
 extern int SendReceiveBlockingLock(const unsigned int /* xid */ ,
                                         struct cifsTconInfo *,
                                 struct smb_hdr * /* input */ ,
@@ -60,12 +62,15 @@ extern int checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length);
 extern int is_valid_oplock_break(struct smb_hdr *smb, struct TCP_Server_Info *);
 extern int is_size_safe_to_change(struct cifsInodeInfo *, __u64 eof);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *);
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *);
+#endif
 extern unsigned int smbCalcSize(struct smb_hdr *ptr);
 extern unsigned int smbCalcSize_LE(struct smb_hdr *ptr);
 extern int decode_negTokenInit(unsigned char *security_blob, int length,
                         enum securityEnum *secType);
 extern int cifs_inet_pton(int, char *source, void *dst);
-extern int map_smb_to_linux_error(struct smb_hdr *smb);
+extern int map_smb_to_linux_error(struct smb_hdr *smb, int logErr);
 extern void header_assemble(struct smb_hdr *, char /* command */ ,
                             const struct cifsTconInfo *, int /* length of
                             fixed section (word count) in two byte units */);
@@ -91,6 +96,8 @@ extern int cifs_get_inode_info(struct inode **pinode,
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                         const unsigned char *search_path,
                         struct super_block *sb, int xid);
+extern void acl_to_uid_mode(struct inode *inode, const char *search_path);
+extern int mode_to_acl(struct inode *inode, const char *path);
 
 extern int cifs_mount(struct super_block *, struct cifs_sb_info *, char *,
                         const char *);
@@ -240,15 +247,15 @@ extern int CIFSSMBQueryReparseLinkInfo(const int xid,
 extern int CIFSSMBOpen(const int xid, struct cifsTconInfo *tcon,
                         const char *fileName, const int disposition,
                         const int access_flags, const int omode,
-                        __u16 * netfid, int *pOplock, FILE_ALL_INFO *,
+                        __u16 *netfid, int *pOplock, FILE_ALL_INFO *,
                         const struct nls_table *nls_codepage, int remap);
 extern int SMBLegacyOpen(const int xid, struct cifsTconInfo *tcon,
                         const char *fileName, const int disposition,
                         const int access_flags, const int omode,
-                        __u16 * netfid, int *pOplock, FILE_ALL_INFO *,
+                        __u16 *netfid, int *pOplock, FILE_ALL_INFO *,
                         const struct nls_table *nls_codepage, int remap);
 extern int CIFSPOSIXCreate(const int xid, struct cifsTconInfo *tcon,
-                        u32 posix_flags, __u64 mode, __u16 * netfid,
+                        u32 posix_flags, __u64 mode, __u16 *netfid,
                         FILE_UNIX_BASIC_INFO *pRetData,
                         __u32 *pOplock, const char *name,
                         const struct nls_table *nls_codepage, int remap);
@@ -269,7 +276,7 @@ extern int CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
                         const __u64 offset, unsigned int *nbytes,
                         struct kvec *iov, const int nvec, const int long_op);
 extern int CIFSGetSrvInodeNumber(const int xid, struct cifsTconInfo *tcon,
-                        const unsigned char *searchName, __u64 * inode_number,
+                        const unsigned char *searchName, __u64 *inode_number,
                         const struct nls_table *nls_codepage,
                         int remap_special_chars);
 extern int cifs_convertUCSpath(char *target, const __le16 *source, int maxlen,
@@ -304,7 +311,7 @@ extern int cifs_calculate_mac_key(struct mac_key *key, const char *rn,
                                  const char *pass);
 extern int CalcNTLMv2_partial_mac_key(struct cifsSesInfo *,
                         const struct nls_table *);
-extern void CalcNTLMv2_response(const struct cifsSesInfo *, char * );
+extern void CalcNTLMv2_response(const struct cifsSesInfo *, char *);
 extern void setup_ntlmv2_rsp(struct cifsSesInfo *, char *,
                              const struct nls_table *);
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
@@ -334,8 +341,7 @@ extern int CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon,
                 const void *ea_value, const __u16 ea_value_len,
                 const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon,
-                        __u16 fid, char *acl_inf, const int buflen,
-                        const int acl_type /* ACCESS vs. DEFAULT */);
+                        __u16 fid, struct cifs_ntsd **acl_inf, __u32 *buflen);
 extern int CIFSSMBGetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const unsigned char *searchName,
                 char *acl_inf, const int buflen, const int acl_type,
@@ -345,5 +351,5 @@ extern int CIFSSMBSetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const char *local_acl, const int buflen, const int acl_type,
                 const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
-                        const int netfid, __u64 * pExtAttrBits, __u64 *pMask);
+                        const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 8eb102f940d4..9e8a6bef029a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -34,10 +34,10 @@
 #include <asm/uaccess.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
+#include "cifsacl.h"
 #include "cifsproto.h"
 #include "cifs_unicode.h"
 #include "cifs_debug.h"
-#include "cifsacl.h"
 
 #ifdef CONFIG_CIFS_POSIX
 static struct {
@@ -94,9 +94,8 @@ static void mark_open_files_invalid(struct cifsTconInfo *pTcon)
         write_lock(&GlobalSMBSeslock);
         list_for_each_safe(tmp, tmp1, &pTcon->openFileList) {
                 open_file = list_entry(tmp, struct cifsFileInfo, tlist);
-                if (open_file) {
+                if (open_file)
                         open_file->invalidHandle = TRUE;
-                }
         }
         write_unlock(&GlobalSMBSeslock);
         /* BB Add call to invalidate_inodes(sb) for all superblocks mounted
@@ -439,8 +438,13 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
 
         pSMB->hdr.Mid = GetNextMid(server);
         pSMB->hdr.Flags2 |= (SMBFLG2_UNICODE | SMBFLG2_ERR_STATUS);
+
         if ((secFlags & CIFSSEC_MUST_KRB5) == CIFSSEC_MUST_KRB5)
                 pSMB->hdr.Flags2 |= SMBFLG2_EXT_SEC;
+        else if ((secFlags & CIFSSEC_AUTH_MASK) == CIFSSEC_MAY_KRB5) {
+                cFYI(1, ("Kerberos only mechanism, enable extended security"));
+                pSMB->hdr.Flags2 |= SMBFLG2_EXT_SEC;
+        }
 
         count = 0;
         for (i = 0; i < CIFS_NUM_PROT; i++) {
@@ -513,7 +517,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                                 (int)ts.tv_sec, (int)utc.tv_sec,
                                 (int)(utc.tv_sec - ts.tv_sec)));
                         val = (int)(utc.tv_sec - ts.tv_sec);
-                        seconds = val < 0 ? -val : val;
+                        seconds = abs(val);
                         result = (seconds / MIN_TZ_ADJ) * MIN_TZ_ADJ;
                         remain = seconds % MIN_TZ_ADJ;
                         if (remain >= (MIN_TZ_ADJ / 2))
@@ -574,7 +578,20 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                 server->secType = NTLM;
         else if (secFlags & CIFSSEC_MAY_NTLMV2)
                 server->secType = NTLMv2;
-        /* else krb5 ... any others ... */
+        else if (secFlags & CIFSSEC_MAY_KRB5)
+                server->secType = Kerberos;
+        else if (secFlags & CIFSSEC_MAY_LANMAN)
+                server->secType = LANMAN;
+/* #ifdef CONFIG_CIFS_EXPERIMENTAL
+        else if (secFlags & CIFSSEC_MAY_PLNTXT)
+                server->secType = ??
+#endif */
+        else {
+                rc = -EOPNOTSUPP;
+                cERROR(1, ("Invalid security type"));
+                goto neg_err_exit;
+        }
+        /* else ... any others ...? */
 
         /* one byte, so no need to convert this or EncryptionKeyLen from
            little endian */
@@ -604,30 +621,33 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
         if ((pSMBr->hdr.Flags2 & SMBFLG2_EXT_SEC) &&
                 (server->capabilities & CAP_EXTENDED_SECURITY)) {
                 count = pSMBr->ByteCount;
-                if (count < 16)
+                if (count < 16) {
                         rc = -EIO;
-                else if (count == 16) {
-                        server->secType = RawNTLMSSP;
-                        if (server->socketUseCount.counter > 1) {
-                                if (memcmp(server->server_GUID,
-                                           pSMBr->u.extended_response.
-                                           GUID, 16) != 0) {
-                                        cFYI(1, ("server UID changed"));
-                                        memcpy(server->server_GUID,
-                                                pSMBr->u.extended_response.GUID,
-                                                16);
-                                }
-                        } else
+                        goto neg_err_exit;
+                }
+
+                if (server->socketUseCount.counter > 1) {
+                        if (memcmp(server->server_GUID,
+                                   pSMBr->u.extended_response.
+                                   GUID, 16) != 0) {
+                                cFYI(1, ("server UID changed"));
                                 memcpy(server->server_GUID,
-                                       pSMBr->u.extended_response.GUID, 16);
+                                        pSMBr->u.extended_response.GUID,
+                                        16);
+                        }
+                } else
+                        memcpy(server->server_GUID,
+                               pSMBr->u.extended_response.GUID, 16);
+
+                if (count == 16) {
+                        server->secType = RawNTLMSSP;
                 } else {
                         rc = decode_negTokenInit(pSMBr->u.extended_response.
                                                  SecurityBlob,
                                                  count - 16,
                                                  &server->secType);
                         if (rc == 1) {
-                        /* BB Need to fill struct for sessetup here */
-                                rc = -EOPNOTSUPP;
+                                rc = 0;
                         } else {
                                 rc = -EINVAL;
                         }
@@ -642,10 +662,12 @@ signing_check:
                 /* MUST_SIGN already includes the MAY_SIGN FLAG
                    so if this is zero it means that signing is disabled */
                 cFYI(1, ("Signing disabled"));
-                if (server->secMode & SECMODE_SIGN_REQUIRED)
+                if (server->secMode & SECMODE_SIGN_REQUIRED) {
                         cERROR(1, ("Server requires "
-                                   "/proc/fs/cifs/PacketSigningEnabled "
-                                   "to be on"));
+                                   "packet signing to be enabled in "
+                                   "/proc/fs/cifs/SecurityFlags."));
+                        rc = -EOPNOTSUPP;
+                }
                 server->secMode &=
                         ~(SECMODE_SIGN_ENABLED | SECMODE_SIGN_REQUIRED);
         } else if ((secFlags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN) {
@@ -676,9 +698,7 @@ int
 CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
 {
         struct smb_hdr *smb_buffer;
-        struct smb_hdr *smb_buffer_response; /* BB removeme BB */
         int rc = 0;
-        int length;
 
         cFYI(1, ("In tree disconnect"));
         /*
@@ -715,16 +735,12 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
         if (rc) {
                 up(&tcon->tconSem);
                 return rc;
-        } else {
-                smb_buffer_response = smb_buffer; /* BB removeme BB */
         }
-        rc = SendReceive(xid, tcon->ses, smb_buffer, smb_buffer_response,
-                         &length, 0);
+
+        rc = SendReceiveNoRsp(xid, tcon->ses, smb_buffer, 0);
         if (rc)
                 cFYI(1, ("Tree disconnect failed %d", rc));
 
-        if (smb_buffer)
-                cifs_small_buf_release(smb_buffer);
         up(&tcon->tconSem);
 
         /* No need to return error on this operation if tid invalidated and
@@ -738,10 +754,8 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
 int
 CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
 {
-        struct smb_hdr *smb_buffer_response;
         LOGOFF_ANDX_REQ *pSMB;
         int rc = 0;
-        int length;
 
         cFYI(1, ("In SMBLogoff for session disconnect"));
         if (ses)
@@ -760,8 +774,6 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
                 return rc;
         }
 
-        smb_buffer_response = (struct smb_hdr *)pSMB; /* BB removeme BB */
-
         if (ses->server) {
                 pSMB->hdr.Mid = GetNextMid(ses->server);
 
@@ -773,8 +785,7 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
         pSMB->hdr.Uid = ses->Suid;
 
         pSMB->AndXCommand = 0xFF;
-        rc = SendReceive(xid, ses, (struct smb_hdr *) pSMB,
-                         smb_buffer_response, &length, 0);
+        rc = SendReceiveNoRsp(xid, ses, (struct smb_hdr *) pSMB, 0);
         if (ses->server) {
                 atomic_dec(&ses->server->socketUseCount);
                 if (atomic_read(&ses->server->socketUseCount) == 0) {
@@ -785,7 +796,6 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
                 }
         }
         up(&ses->sesSem);
-        cifs_small_buf_release(pSMB);
 
         /* if session dead then we do not need to do ulogoff,
                 since server closed smb session, no sense reporting
@@ -1052,7 +1062,7 @@ PsxCreat:
                                 InformationLevel) - 4;
         offset = param_offset + params;
         pdata = (OPEN_PSX_REQ *)(((char *)&pSMB->hdr.Protocol) + offset);
-        pdata->Level = SMB_QUERY_FILE_UNIX_BASIC;
+        pdata->Level = cpu_to_le16(SMB_QUERY_FILE_UNIX_BASIC);
         pdata->Permissions = cpu_to_le64(mode);
         pdata->PosixOpenFlags = cpu_to_le32(posix_flags);
         pdata->OpenFlags =  cpu_to_le32(*pOplock);
@@ -1098,8 +1108,8 @@ PsxCreat:
         if (cpu_to_le32(FILE_CREATE) == psx_rsp->CreateAction)
                 *pOplock |= CIFS_CREATE_ACTION;
         /* check to make sure response data is there */
-        if (psx_rsp->ReturnedLevel != SMB_QUERY_FILE_UNIX_BASIC) {
-                pRetData->Type = -1; /* unknown */
+        if (psx_rsp->ReturnedLevel != cpu_to_le16(SMB_QUERY_FILE_UNIX_BASIC)) {
+                pRetData->Type = cpu_to_le32(-1); /* unknown */
 #ifdef CONFIG_CIFS_DEBUG2
                 cFYI(1, ("unknown type"));
 #endif
@@ -1107,12 +1117,12 @@ PsxCreat:
                 if (pSMBr->ByteCount < sizeof(OPEN_PSX_RSP)
                                         + sizeof(FILE_UNIX_BASIC_INFO)) {
                         cERROR(1, ("Open response data too small"));
-                        pRetData->Type = -1;
+                        pRetData->Type = cpu_to_le32(-1);
                         goto psx_create_err;
                 }
                 memcpy((char *) pRetData,
                         (char *)psx_rsp + sizeof(OPEN_PSX_RSP),
-                        sizeof (FILE_UNIX_BASIC_INFO));
+                        sizeof(FILE_UNIX_BASIC_INFO));
         }
 
 psx_create_err:
@@ -1193,9 +1203,9 @@ OldOpenRetry:
         }
         if (*pOplock & REQ_OPLOCK)
                 pSMB->OpenFlags = cpu_to_le16(REQ_OPLOCK);
-        else if (*pOplock & REQ_BATCHOPLOCK) {
+        else if (*pOplock & REQ_BATCHOPLOCK)
                 pSMB->OpenFlags = cpu_to_le16(REQ_BATCHOPLOCK);
-        }
+
         pSMB->OpenFlags |= cpu_to_le16(REQ_MORE_INFO);
         /* BB fixme add conversion for access_flags to bits 0 - 2 of mode */
         /* 0 = read
@@ -1233,7 +1243,7 @@ OldOpenRetry:
         pSMB->ByteCount = cpu_to_le16(count);
         /* long_op set to 1 to allow for oplock break timeouts */
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 1);
+                        (struct smb_hdr *)pSMBr, &bytes_returned, CIFS_LONG_OP);
         cifs_stats_inc(&tcon->num_opens);
         if (rc) {
                 cFYI(1, ("Error in Open = %d", rc));
@@ -1310,9 +1320,8 @@ openRetry:
         }
         if (*pOplock & REQ_OPLOCK)
                 pSMB->OpenFlags = cpu_to_le32(REQ_OPLOCK);
-        else if (*pOplock & REQ_BATCHOPLOCK) {
+        else if (*pOplock & REQ_BATCHOPLOCK)
                 pSMB->OpenFlags = cpu_to_le32(REQ_BATCHOPLOCK);
-        }
         pSMB->DesiredAccess = cpu_to_le32(access_flags);
         pSMB->AllocationSize = 0;
         /* set file as system file if special file such
@@ -1347,7 +1356,7 @@ openRetry:
         pSMB->ByteCount = cpu_to_le16(count);
         /* long_op set to 1 to allow for oplock break timeouts */
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 1);
+                        (struct smb_hdr *)pSMBr, &bytes_returned, CIFS_LONG_OP);
         cifs_stats_inc(&tcon->num_opens);
         if (rc) {
                 cFYI(1, ("Error in Open = %d", rc));
@@ -1424,9 +1433,8 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon, const int netfid,
 
         iov[0].iov_base = (char *)pSMB;
         iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
-        rc = SendReceive2(xid, tcon->ses, iov,
-                          1 /* num iovecs */,
-                          &resp_buf_type, 0);
+        rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovecs */,
+                         &resp_buf_type, CIFS_STD_OP | CIFS_LOG_ERROR);
         cifs_stats_inc(&tcon->num_reads);
         pSMBr = (READ_RSP *)iov[0].iov_base;
         if (rc) {
@@ -1446,11 +1454,11 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon, const int netfid,
                         *nbytes = 0;
                 } else {
                         pReadData = (char *) (&pSMBr->hdr.Protocol) +
-                            le16_to_cpu(pSMBr->DataOffset);
-/*                      if (rc = copy_to_user(buf, pReadData, data_length)) {
+                                        le16_to_cpu(pSMBr->DataOffset);
+/*                      if (rc = copy_to_user(buf, pReadData, data_length)) {
                                 cERROR(1,("Faulting on read rc = %d",rc));
                                 rc = -EFAULT;
-                        }*/ /* can not use copy_to_user when using page cache*/
+                        }*/ /* can not use copy_to_user when using page cache*/
                         if (*buf)
                                 memcpy(*buf, pReadData, data_length);
                 }
@@ -1687,7 +1695,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         int timeout = 0;
         __u16 count;
 
-        cFYI(1, ("In CIFSSMBLock - timeout %d numLock %d", waitFlag, numLock));
+        cFYI(1, ("CIFSSMBLock timeout %d numLock %d", waitFlag, numLock));
         rc = small_smb_init(SMB_COM_LOCKING_ANDX, 8, tcon, (void **) &pSMB);
 
         if (rc)
@@ -1696,10 +1704,10 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         pSMBr = (LOCK_RSP *)pSMB; /* BB removeme BB */
 
         if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
-                timeout = -1; /* no response expected */
+                timeout = CIFS_ASYNC_OP; /* no response expected */
                 pSMB->Timeout = 0;
         } else if (waitFlag == TRUE) {
-                timeout = 3;  /* blocking operation, no timeout */
+                timeout = CIFS_BLOCKING_OP; /* blocking operation, no timeout */
                 pSMB->Timeout = cpu_to_le32(-1);/* blocking - do not time out */
         } else {
                 pSMB->Timeout = 0;
@@ -1729,15 +1737,16 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         if (waitFlag) {
                 rc = SendReceiveBlockingLock(xid, tcon, (struct smb_hdr *) pSMB,
                         (struct smb_hdr *) pSMBr, &bytes_returned);
+                cifs_small_buf_release(pSMB);
         } else {
-                rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, timeout);
+                rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *)pSMB,
+                                      timeout);
+                /* SMB buffer freed by function above */
         }
         cifs_stats_inc(&tcon->num_locks);
         if (rc) {
                 cFYI(1, ("Send error in Lock = %d", rc));
         }
-        cifs_small_buf_release(pSMB);
 
         /* Note: On -EAGAIN error only caller can retry on handle based calls
         since file handle passed in no longer valid */
@@ -1756,7 +1765,9 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
         int rc = 0;
         int timeout = 0;
         int bytes_returned = 0;
+        int resp_buf_type = 0;
         __u16 params, param_offset, offset, byte_count, count;
+        struct kvec iov[1];
 
         cFYI(1, ("Posix Lock"));
 
@@ -1798,7 +1809,7 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
 
         parm_data->lock_type = cpu_to_le16(lock_type);
         if (waitFlag) {
-                timeout = 3;  /* blocking operation, no timeout */
+                timeout = CIFS_BLOCKING_OP; /* blocking operation, no timeout */
                 parm_data->lock_flags = cpu_to_le16(1);
                 pSMB->Timeout = cpu_to_le32(-1);
         } else
@@ -1818,8 +1829,13 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                 rc = SendReceiveBlockingLock(xid, tcon, (struct smb_hdr *) pSMB,
                         (struct smb_hdr *) pSMBr, &bytes_returned);
         } else {
-                rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *) pSMBr, &bytes_returned, timeout);
+                iov[0].iov_base = (char *)pSMB;
+                iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
+                rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovecs */,
+                                &resp_buf_type, timeout);
+                pSMB = NULL; /* request buf already freed by SendReceive2. Do
+                                not try to free it twice below on exit */
+                pSMBr = (struct smb_com_transaction2_sfi_rsp *)iov[0].iov_base;
         }
 
         if (rc) {
@@ -1854,6 +1870,11 @@ plk_err_exit:
         if (pSMB)
                 cifs_small_buf_release(pSMB);
 
+        if (resp_buf_type == CIFS_SMALL_BUFFER)
+                cifs_small_buf_release(iov[0].iov_base);
+        else if (resp_buf_type == CIFS_LARGE_BUFFER)
+                cifs_buf_release(iov[0].iov_base);
+
         /* Note: On -EAGAIN error only caller can retry on handle based calls
            since file handle passed in no longer valid */
 
@@ -1866,8 +1887,6 @@ CIFSSMBClose(const int xid, struct cifsTconInfo *tcon, int smb_file_id)
 {
         int rc = 0;
         CLOSE_REQ *pSMB = NULL;
-        CLOSE_RSP *pSMBr = NULL;
-        int bytes_returned;
         cFYI(1, ("In CIFSSMBClose"));
 
 /* do not retry on dead session on close */
@@ -1877,13 +1896,10 @@ CIFSSMBClose(const int xid, struct cifsTconInfo *tcon, int smb_file_id)
         if (rc)
                 return rc;
 
-        pSMBr = (CLOSE_RSP *)pSMB; /* BB removeme BB */
-
         pSMB->FileID = (__u16) smb_file_id;
         pSMB->LastWriteTime = 0xFFFFFFFF;
         pSMB->ByteCount = 0;
-        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *) pSMB, 0);
         cifs_stats_inc(&tcon->num_closes);
         if (rc) {
                 if (rc != -EINTR) {
@@ -1892,8 +1908,6 @@ CIFSSMBClose(const int xid, struct cifsTconInfo *tcon, int smb_file_id)
                 }
         }
 
-        cifs_small_buf_release(pSMB);
-
         /* Since session is dead, file will be closed on server already */
         if (rc == -EAGAIN)
                 rc = 0;
@@ -2465,6 +2479,7 @@ querySymLinkRetry:
         return rc;
 }
 
+#ifdef CONFIG_CIFS_EXPERIMENTAL
 /* Initialize NT TRANSACT SMB into small smb request buffer.
    This assumes that all NT TRANSACTS that we init here have
    total parm and data under about 400 bytes (to fit in small cifs
@@ -2473,7 +2488,7 @@ querySymLinkRetry:
         MaxSetupCount (size of returned setup area) and
         MaxParameterCount (returned parms size) must be set by caller */
 static int
-smb_init_ntransact(const __u16 sub_command, const int setup_count,
+smb_init_nttransact(const __u16 sub_command, const int setup_count,
                    const int parm_len, struct cifsTconInfo *tcon,
                    void **ret_buf)
 {
@@ -2504,12 +2519,15 @@ smb_init_ntransact(const __u16 sub_command, const int setup_count,
 
 static int
 validate_ntransact(char *buf, char **ppparm, char **ppdata,
-                   int *pdatalen, int *pparmlen)
+                   __u32 *pparmlen, __u32 *pdatalen)
 {
         char *end_of_smb;
         __u32 data_count, data_offset, parm_count, parm_offset;
         struct smb_com_ntransact_rsp *pSMBr;
 
+        *pdatalen = 0;
+        *pparmlen = 0;
+
         if (buf == NULL)
                 return -EINVAL;
 
@@ -2538,7 +2556,7 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata,
                 cFYI(1, ("data starts after end of smb"));
                 return -EINVAL;
         } else if (data_count + *ppdata > end_of_smb) {
-                cFYI(1,("data %p + count %d (%p) ends after end of smb %p start %p",
+                cFYI(1, ("data %p + count %d (%p) ends after end of smb %p start %p",
                         *ppdata, data_count, (data_count + *ppdata),
                         end_of_smb, pSMBr));
                 return -EINVAL;
@@ -2546,8 +2564,11 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata,
                 cFYI(1, ("parm count and data count larger than SMB"));
                 return -EINVAL;
         }
+        *pdatalen = data_count;
+        *pparmlen = parm_count;
         return 0;
 }
+#endif /* CIFS_EXPERIMENTAL */
 
 int
 CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon,
@@ -2615,7 +2636,7 @@ CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon,
                                         reparse_buf->TargetNameOffset +
                                         reparse_buf->TargetNameLen) >
                                                 end_of_smb) {
-                                        cFYI(1,("reparse buf goes beyond SMB"));
+                                        cFYI(1, ("reparse buf beyond SMB"));
                                         rc = -EIO;
                                         goto qreparse_out;
                                 }
@@ -3042,25 +3063,11 @@ GetExtAttrOut:
 
 #endif /* CONFIG_POSIX */
 
-
-/* security id for everyone */
-static const struct cifs_sid sid_everyone =
-                {1, 1, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0}};
-/* group users */
-static const struct cifs_sid sid_user =
-                {1, 2 , {0, 0, 0, 0, 0, 5}, {32, 545, 0, 0}};
-
-/* Convert CIFS ACL to POSIX form */
-static int parse_sec_desc(struct cifs_sid *psec_desc, int acl_len)
-{
-        return 0;
-}
-
+#ifdef CONFIG_CIFS_EXPERIMENTAL
 /* Get Security Descriptor (by handle) from remote server for a file or dir */
 int
 CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
-                /* BB fix up return info */ char *acl_inf, const int buflen,
-                  const int acl_type /* ACCESS/DEFAULT not sure implication */)
+                  struct cifs_ntsd **acl_inf, __u32 *pbuflen)
 {
         int rc = 0;
         int buf_type = 0;
@@ -3069,7 +3076,10 @@ CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
 
         cFYI(1, ("GetCifsACL"));
 
-        rc = smb_init_ntransact(NT_TRANSACT_QUERY_SECURITY_DESC, 0,
+        *pbuflen = 0;
+        *acl_inf = NULL;
+
+        rc = smb_init_nttransact(NT_TRANSACT_QUERY_SECURITY_DESC, 0,
                         8 /* parm len */, tcon, (void **) &pSMB);
         if (rc)
                 return rc;
@@ -3085,40 +3095,58 @@ CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
         iov[0].iov_base = (char *)pSMB;
         iov[0].iov_len = pSMB->hdr.smb_buf_length + 4;
 
-        rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovec */, &buf_type, 0);
+        rc = SendReceive2(xid, tcon->ses, iov, 1 /* num iovec */, &buf_type,
+                         CIFS_STD_OP);
         cifs_stats_inc(&tcon->num_acl_get);
         if (rc) {
                 cFYI(1, ("Send error in QuerySecDesc = %d", rc));
         } else {                /* decode response */
-                struct cifs_sid *psec_desc;
                 __le32 * parm;
-                int parm_len;
-                int data_len;
-                int acl_len;
+                __u32 parm_len;
+                __u32 acl_len;
                 struct smb_com_ntransact_rsp *pSMBr;
+                char *pdata;
 
 /* validate_nttransact */
                 rc = validate_ntransact(iov[0].iov_base, (char **)&parm,
-                                        (char **)&psec_desc,
-                                        &parm_len, &data_len);
+                                        &pdata, &parm_len, pbuflen);
                 if (rc)
                         goto qsec_out;
                 pSMBr = (struct smb_com_ntransact_rsp *)iov[0].iov_base;
 
-                cERROR(1, ("smb %p parm %p data %p",
-                          pSMBr, parm, psec_desc));  /* BB removeme BB */
+                cFYI(1, ("smb %p parm %p data %p", pSMBr, parm, *acl_inf));
 
                 if (le32_to_cpu(pSMBr->ParameterCount) != 4) {
                         rc = -EIO;      /* bad smb */
+                        *pbuflen = 0;
                         goto qsec_out;
                 }
 
 /* BB check that data area is minimum length and as big as acl_len */
 
-                acl_len = le32_to_cpu(*(__le32 *)parm);
-                /* BB check if (acl_len > bufsize) */
+                acl_len = le32_to_cpu(*parm);
+                if (acl_len != *pbuflen) {
+                        cERROR(1, ("acl length %d does not match %d",
+                                   acl_len, *pbuflen));
+                        if (*pbuflen > acl_len)
+                                *pbuflen = acl_len;
+                }
 
-                parse_sec_desc(psec_desc, acl_len);
+                /* check if buffer is big enough for the acl
+                   header followed by the smallest SID */
+                if ((*pbuflen < sizeof(struct cifs_ntsd) + 8) ||
+                    (*pbuflen >= 64 * 1024)) {
+                        cERROR(1, ("bad acl length %d", *pbuflen));
+                        rc = -EINVAL;
+                        *pbuflen = 0;
+                } else {
+                        *acl_inf = kmalloc(*pbuflen, GFP_KERNEL);
+                        if (*acl_inf == NULL) {
+                                *pbuflen = 0;
+                                rc = -ENOMEM;
+                        }
+                        memcpy(*acl_inf, pdata, *pbuflen);
+                }
         }
 qsec_out:
         if (buf_type == CIFS_SMALL_BUFFER)
@@ -3128,6 +3156,7 @@ qsec_out:
 /*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         return rc;
 }
+#endif /* CONFIG_CIFS_EXPERIMENTAL */
 
 /* Legacy Query Path Information call for lookup to old servers such
    as Win9x/WinME */
@@ -3363,13 +3392,16 @@ UnixQPathInfoRetry:
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
                 if (rc || (pSMBr->ByteCount < sizeof(FILE_UNIX_BASIC_INFO))) {
+                        cERROR(1, ("Malformed FILE_UNIX_BASIC_INFO response.\n"
+                                   "Unix Extensions can be disabled on mount "
+                                   "by specifying the nosfu mount option."));
                         rc = -EIO;      /* bad smb */
                 } else {
                         __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
                         memcpy((char *) pFindData,
                                (char *) &pSMBr->hdr.Protocol +
                                data_offset,
-                               sizeof (FILE_UNIX_BASIC_INFO));
+                               sizeof(FILE_UNIX_BASIC_INFO));
                 }
         }
         cifs_buf_release(pSMB);
@@ -3637,7 +3669,7 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
         pSMB->SubCommand = cpu_to_le16(TRANS2_FIND_NEXT);
         pSMB->SearchHandle = searchHandle;      /* always kept as le */
         pSMB->SearchCount =
-                cpu_to_le16(CIFSMaxBufSize / sizeof (FILE_UNIX_INFO));
+                cpu_to_le16(CIFSMaxBufSize / sizeof(FILE_UNIX_INFO));
         pSMB->InformationLevel = cpu_to_le16(psrch_inf->info_level);
         pSMB->ResumeKey = psrch_inf->resume_key;
         pSMB->SearchFlags =
@@ -3725,8 +3757,6 @@ CIFSFindClose(const int xid, struct cifsTconInfo *tcon,
 {
         int rc = 0;
         FINDCLOSE_REQ *pSMB = NULL;
-        CLOSE_RSP *pSMBr = NULL; /* BB removeme BB */
-        int bytes_returned;
 
         cFYI(1, ("In CIFSSMBFindClose"));
         rc = small_smb_init(SMB_COM_FIND_CLOSE2, 1, tcon, (void **)&pSMB);
@@ -3738,16 +3768,13 @@ CIFSFindClose(const int xid, struct cifsTconInfo *tcon,
         if (rc)
                 return rc;
 
-        pSMBr = (CLOSE_RSP *)pSMB;  /* BB removeme BB */
         pSMB->FileID = searchHandle;
         pSMB->ByteCount = 0;
-        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *) pSMB, 0);
         if (rc) {
                 cERROR(1, ("Send error in FindClose = %d", rc));
         }
         cifs_stats_inc(&tcon->num_fclose);
-        cifs_small_buf_release(pSMB);
 
         /* Since session is dead, search handle closed on server already */
         if (rc == -EAGAIN)
@@ -3883,12 +3910,10 @@ getDFSRetry:
         pSMB->hdr.Mid = GetNextMid(ses->server);
         pSMB->hdr.Tid = ses->ipc_tid;
         pSMB->hdr.Uid = ses->Suid;
-        if (ses->capabilities & CAP_STATUS32) {
+        if (ses->capabilities & CAP_STATUS32)
                 pSMB->hdr.Flags2 |= SMBFLG2_ERR_STATUS;
-        }
-        if (ses->capabilities & CAP_DFS) {
+        if (ses->capabilities & CAP_DFS)
                 pSMB->hdr.Flags2 |= SMBFLG2_DFS;
-        }
 
         if (ses->capabilities & CAP_UNICODE) {
                 pSMB->hdr.Flags2 |= SMBFLG2_UNICODE;
@@ -4060,10 +4085,6 @@ oldQFSInfoRetry:
                 (void **) &pSMBr);
         if (rc)
                 return rc;
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
-        if (rc)
-                return rc;
 
         params = 2;     /* level */
         pSMB->TotalDataCount = 0;
@@ -4265,7 +4286,7 @@ QFSAttributeRetry:
                              *) (((char *) &pSMBr->hdr.Protocol) +
                                  data_offset);
                         memcpy(&tcon->fsAttrInfo, response_data,
-                               sizeof (FILE_SYSTEM_ATTRIBUTE_INFO));
+                               sizeof(FILE_SYSTEM_ATTRIBUTE_INFO));
                 }
         }
         cifs_buf_release(pSMB);
@@ -4325,7 +4346,7 @@ QFSDeviceRetry:
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
-                if (rc || (pSMBr->ByteCount < sizeof (FILE_SYSTEM_DEVICE_INFO)))
+                if (rc || (pSMBr->ByteCount < sizeof(FILE_SYSTEM_DEVICE_INFO)))
                         rc = -EIO;      /* bad smb */
                 else {
                         __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
@@ -4334,7 +4355,7 @@ QFSDeviceRetry:
                                 (((char *) &pSMBr->hdr.Protocol) +
                                  data_offset);
                         memcpy(&tcon->fsDevInfo, response_data,
-                               sizeof (FILE_SYSTEM_DEVICE_INFO));
+                               sizeof(FILE_SYSTEM_DEVICE_INFO));
                 }
         }
         cifs_buf_release(pSMB);
@@ -4402,7 +4423,7 @@ QFSUnixRetry:
                              *) (((char *) &pSMBr->hdr.Protocol) +
                                  data_offset);
                         memcpy(&tcon->fsUnixInfo, response_data,
-                               sizeof (FILE_SYSTEM_UNIX_INFO));
+                               sizeof(FILE_SYSTEM_UNIX_INFO));
                 }
         }
         cifs_buf_release(pSMB);
@@ -4612,7 +4633,7 @@ SetEOFRetry:
                 strncpy(pSMB->FileName, fileName, name_len);
         }
         params = 6 + name_len;
-        data_count = sizeof (struct file_end_of_file_info);
+        data_count = sizeof(struct file_end_of_file_info);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         pSMB->MaxDataCount = cpu_to_le16(4100);
         pSMB->MaxSetupCount = 0;
@@ -4675,11 +4696,9 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
                    __u16 fid, __u32 pid_of_opener, int SetAllocation)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        struct smb_com_transaction2_sfi_rsp *pSMBr = NULL;
         char *data_offset;
         struct file_end_of_file_info *parm_data;
         int rc = 0;
-        int bytes_returned = 0;
         __u16 params, param_offset, offset, byte_count, count;
 
         cFYI(1, ("SetFileSize (via SetFileInfo) %lld",
@@ -4689,8 +4708,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         if (rc)
                 return rc;
 
-        pSMBr = (struct smb_com_transaction2_sfi_rsp *)pSMB;
-
         pSMB->hdr.Pid = cpu_to_le16((__u16)pid_of_opener);
         pSMB->hdr.PidHigh = cpu_to_le16((__u16)(pid_of_opener >> 16));
 
@@ -4741,17 +4758,13 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         pSMB->Reserved4 = 0;
         pSMB->hdr.smb_buf_length += byte_count;
         pSMB->ByteCount = cpu_to_le16(byte_count);
-        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *) pSMB, 0);
         if (rc) {
                 cFYI(1,
                      ("Send error in SetFileInfo (SetFileSize) = %d",
                       rc));
         }
 
-        if (pSMB)
-                cifs_small_buf_release(pSMB);
-
         /* Note: On -EAGAIN error only caller can retry on handle based calls
                 since file handle passed in no longer valid */
 
@@ -4769,10 +4782,8 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
                     const FILE_BASIC_INFO *data, __u16 fid)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        struct smb_com_transaction2_sfi_rsp *pSMBr = NULL;
         char *data_offset;
         int rc = 0;
-        int bytes_returned = 0;
         __u16 params, param_offset, offset, byte_count, count;
 
         cFYI(1, ("Set Times (via SetFileInfo)"));
@@ -4781,8 +4792,6 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
         if (rc)
                 return rc;
 
-        pSMBr = (struct smb_com_transaction2_sfi_rsp *)pSMB;
-
         /* At this point there is no need to override the current pid
         with the pid of the opener, but that could change if we someday
         use an existing handle (rather than opening one on the fly) */
@@ -4800,7 +4809,7 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
 
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
 
-        count = sizeof (FILE_BASIC_INFO);
+        count = sizeof(FILE_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB PDU from sess */
         pSMB->SetupCount = 1;
@@ -4822,14 +4831,11 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
         pSMB->hdr.smb_buf_length += byte_count;
         pSMB->ByteCount = cpu_to_le16(byte_count);
         memcpy(data_offset, data, sizeof(FILE_BASIC_INFO));
-        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *) pSMB, 0);
         if (rc) {
                 cFYI(1, ("Send error in Set Time (SetFileInfo) = %d", rc));
         }
 
-        cifs_small_buf_release(pSMB);
-
         /* Note: On -EAGAIN error only caller can retry on handle based calls
                 since file handle passed in no longer valid */
 
@@ -4871,7 +4877,7 @@ SetTimesRetry:
         }
 
         params = 6 + name_len;
-        count = sizeof (FILE_BASIC_INFO);
+        count = sizeof(FILE_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
         pSMB->MaxSetupCount = 0;
@@ -4900,7 +4906,7 @@ SetTimesRetry:
                 pSMB->InformationLevel = cpu_to_le16(SMB_SET_FILE_BASIC_INFO);
         pSMB->Reserved4 = 0;
         pSMB->hdr.smb_buf_length += byte_count;
-        memcpy(data_offset, data, sizeof (FILE_BASIC_INFO));
+        memcpy(data_offset, data, sizeof(FILE_BASIC_INFO));
         pSMB->ByteCount = cpu_to_le16(byte_count);
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
@@ -5003,7 +5009,7 @@ setPermsRetry:
         }
 
         params = 6 + name_len;
-        count = sizeof (FILE_UNIX_BASIC_INFO);
+        count = sizeof(FILE_UNIX_BASIC_INFO);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find exact max SMB PDU from sess structure BB */
         pSMB->MaxSetupCount = 0;
@@ -5120,7 +5126,8 @@ int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon,
         pSMB->ByteCount = 0;
 
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *) pSMBr, &bytes_returned, -1);
+                         (struct smb_hdr *)pSMBr, &bytes_returned,
+                         CIFS_ASYNC_OP);
         if (rc) {
                 cFYI(1, ("Error in Notify = %d", rc));
         } else {
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 4af3588c1a96..fd9147cdb5a9 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -124,7 +124,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         struct mid_q_entry *mid_entry;
 
         spin_lock(&GlobalMid_Lock);
-        if ( kthread_should_stop() ) {
+        if (kthread_should_stop()) {
                 /* the demux thread will exit normally
                 next time through the loop */
                 spin_unlock(&GlobalMid_Lock);
@@ -151,9 +151,8 @@ cifs_reconnect(struct TCP_Server_Info *server)
         }
         list_for_each(tmp, &GlobalTreeConnectionList) {
                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if ((tcon) && (tcon->ses) && (tcon->ses->server == server)) {
+                if ((tcon) && (tcon->ses) && (tcon->ses->server == server))
                         tcon->tidStatus = CifsNeedReconnect;
-                }
         }
         read_unlock(&GlobalSMBSeslock);
         /* do not want to be sending data on a socket we are freeing */
@@ -161,7 +160,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         if (server->ssocket) {
                 cFYI(1, ("State: 0x%x Flags: 0x%lx", server->ssocket->state,
                         server->ssocket->flags));
-                server->ssocket->ops->shutdown(server->ssocket, SEND_SHUTDOWN);
+                kernel_sock_shutdown(server->ssocket, SHUT_WR);
                 cFYI(1, ("Post shutdown state: 0x%x Flags: 0x%lx",
                         server->ssocket->state,
                         server->ssocket->flags));
@@ -187,7 +186,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         spin_unlock(&GlobalMid_Lock);
         up(&server->tcpSem);
 
-        while ( (!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
+        while ((!kthread_should_stop()) && (server->tcpStatus != CifsGood)) {
                 try_to_freeze();
                 if (server->protocolType == IPV6) {
                         rc = ipv6_connect(&server->addr.sockAddr6,
@@ -204,7 +203,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
                 } else {
                         atomic_inc(&tcpSesReconnectCount);
                         spin_lock(&GlobalMid_Lock);
-                        if ( !kthread_should_stop() )
+                        if (!kthread_should_stop())
                                 server->tcpStatus = CifsGood;
                         server->sequence_number = 0;
                         spin_unlock(&GlobalMid_Lock);
@@ -352,17 +351,15 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
 
         current->flags |= PF_MEMALLOC;
         server->tsk = current;  /* save process info to wake at shutdown */
-        cFYI(1, ("Demultiplex PID: %d", current->pid));
+        cFYI(1, ("Demultiplex PID: %d", task_pid_nr(current)));
         write_lock(&GlobalSMBSeslock);
         atomic_inc(&tcpSesAllocCount);
         length = tcpSesAllocCount.counter;
         write_unlock(&GlobalSMBSeslock);
         complete(&cifsd_complete);
-        if (length  > 1) {
-                mempool_resize(cifs_req_poolp,
-                        length + cifs_min_rcv,
-                        GFP_KERNEL);
-        }
+        if (length  > 1)
+                mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
+                                GFP_KERNEL);
 
         set_freezable();
         while (!kthread_should_stop()) {
@@ -378,7 +375,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                         }
                 } else if (isLargeBuf) {
                         /* we are reusing a dirty large buf, clear its start */
-                        memset(bigbuf, 0, sizeof (struct smb_hdr));
+                        memset(bigbuf, 0, sizeof(struct smb_hdr));
                 }
 
                 if (smallbuf == NULL) {
@@ -391,7 +388,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                         }
                         /* beginning of smb buffer is cleared in our buf_get */
                 } else /* if existing small buf clear beginning */
-                        memset(smallbuf, 0, sizeof (struct smb_hdr));
+                        memset(smallbuf, 0, sizeof(struct smb_hdr));
 
                 isLargeBuf = FALSE;
                 isMultiRsp = FALSE;
@@ -400,11 +397,13 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 iov.iov_len = 4;
                 smb_msg.msg_control = NULL;
                 smb_msg.msg_controllen = 0;
+                pdu_length = 4; /* enough to get RFC1001 header */
+incomplete_rcv:
                 length =
                     kernel_recvmsg(csocket, &smb_msg,
-                                 &iov, 1, 4, 0 /* BB see socket.h flags */);
+                                &iov, 1, pdu_length, 0 /* BB other flags? */);
 
-                if ( kthread_should_stop() ) {
+                if (kthread_should_stop()) {
                         break;
                 } else if (server->tcpStatus == CifsNeedReconnect) {
                         cFYI(1, ("Reconnect after server stopped responding"));
@@ -416,7 +415,10 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                         msleep(1); /* minimum sleep to prevent looping
                                 allowing socket to clear and app threads to set
                                 tcpStatus CifsNeedReconnect if server hung */
-                        continue;
+                        if (pdu_length < 4)
+                                goto incomplete_rcv;
+                        else
+                                continue;
                 } else if (length <= 0) {
                         if (server->tcpStatus == CifsNew) {
                                 cFYI(1, ("tcp session abend after SMBnegprot"));
@@ -436,14 +438,12 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                         csocket = server->ssocket;
                         wake_up(&server->response_q);
                         continue;
-                } else if (length < 4) {
-                        cFYI(1,
-                            ("Frame under four bytes received (%d bytes long)",
-                              length));
-                        cifs_reconnect(server);
-                        csocket = server->ssocket;
-                        wake_up(&server->response_q);
-                        continue;
+                } else if (length < pdu_length) {
+                        cFYI(1, ("requested %d bytes but only got %d bytes",
+                                  pdu_length, length));
+                        pdu_length -= length;
+                        msleep(1);
+                        goto incomplete_rcv;
                 }
 
                 /* The right amount was read from socket - 4 bytes */
@@ -504,7 +504,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
 
                 /* else we have an SMB response */
                 if ((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
-                            (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
+                            (pdu_length < sizeof(struct smb_hdr) - 1 - 4)) {
                         cERROR(1, ("Invalid size SMB length %d pdu_length %d",
                                         length, pdu_length+4));
                         cifs_reconnect(server);
@@ -528,7 +528,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                      total_read += length) {
                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
                                                 pdu_length - total_read, 0);
-                        if ( kthread_should_stop() ||
+                        if (kthread_should_stop() ||
                             (length == -EINTR)) {
                                 /* then will exit */
                                 reconnect = 2;
@@ -546,6 +546,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                                               allowing socket to clear and app
                                               threads to set tcpStatus
                                               CifsNeedReconnect if server hung*/
+                                length = 0;
                                 continue;
                         } else if (length <= 0) {
                                 cERROR(1, ("Received no data, expecting %d",
@@ -631,9 +632,9 @@ multi_t2_fnd:
                         /* Was previous buf put in mpx struct for multi-rsp? */
                         if (!isMultiRsp) {
                                 /* smb buffer will be freed by user thread */
-                                if (isLargeBuf) {
+                                if (isLargeBuf)
                                         bigbuf = NULL;
-                                } else
+                                else
                                         smallbuf = NULL;
                         }
                         wake_up_process(task_to_wake);
@@ -676,9 +677,8 @@ multi_t2_fnd:
                 server->ssocket = NULL;
         }
         /* buffer usuallly freed in free_mid - need to free it here on exit */
-        if (bigbuf != NULL)
-                cifs_buf_release(bigbuf);
-        if (smallbuf != NULL)
+        cifs_buf_release(bigbuf);
+        if (smallbuf) /* no sense logging a debug message if NULL */
                 cifs_small_buf_release(smallbuf);
 
         read_lock(&GlobalSMBSeslock);
@@ -702,9 +702,8 @@ multi_t2_fnd:
                 list_for_each(tmp, &GlobalSMBSessionList) {
                         ses = list_entry(tmp, struct cifsSesInfo,
                                          cifsSessionList);
-                        if (ses->server == server) {
+                        if (ses->server == server)
                                 ses->status = CifsExiting;
-                        }
                 }
 
                 spin_lock(&GlobalMid_Lock);
@@ -714,9 +713,8 @@ multi_t2_fnd:
                                 cFYI(1, ("Clearing Mid 0x%x - waking up ",
                                          mid_entry->mid));
                                 task_to_wake = mid_entry->tsk;
-                                if (task_to_wake) {
+                                if (task_to_wake)
                                         wake_up_process(task_to_wake);
-                                }
                         }
                 }
                 spin_unlock(&GlobalMid_Lock);
@@ -749,22 +747,48 @@ multi_t2_fnd:
         list_for_each(tmp, &GlobalSMBSessionList) {
                 ses = list_entry(tmp, struct cifsSesInfo,
                                 cifsSessionList);
-                if (ses->server == server) {
+                if (ses->server == server)
                         ses->server = NULL;
-                }
         }
         write_unlock(&GlobalSMBSeslock);
 
+        kfree(server->hostname);
         kfree(server);
-        if (length  > 0) {
-                mempool_resize(cifs_req_poolp,
-                        length + cifs_min_rcv,
-                        GFP_KERNEL);
-        }
+        if (length  > 0)
+                mempool_resize(cifs_req_poolp, length + cifs_min_rcv,
+                                GFP_KERNEL);
 
         return 0;
 }
 
+/* extract the host portion of the UNC string */
+static char *
+extract_hostname(const char *unc)
+{
+        const char *src;
+        char *dst, *delim;
+        unsigned int len;
+
+        /* skip double chars at beginning of string */
+        /* BB: check validity of these bytes? */
+        src = unc + 2;
+
+        /* delimiter between hostname and sharename is always '\\' now */
+        delim = strchr(src, '\\');
+        if (!delim)
+                return ERR_PTR(-EINVAL);
+
+        len = delim - src;
+        dst = kmalloc((len + 1), GFP_KERNEL);
+        if (dst == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        memcpy(dst, src, len);
+        dst[len] = '\0';
+
+        return dst;
+}
+
 static int
 cifs_parse_mount_options(char *options, const char *devname,
                          struct smb_vol *vol)
@@ -798,7 +822,7 @@ cifs_parse_mount_options(char *options, const char *devname,
         vol->linux_gid = current->gid;
         vol->dir_mode = S_IRWXUGO;
         /* 2767 perms indicate mandatory locking support */
-        vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
+        vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
 
         /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
         vol->rw = TRUE;
@@ -1477,7 +1501,7 @@ ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
         if (psin_server->sin_port) { /* user overrode default port */
                 rc = (*csocket)->ops->connect(*csocket,
                                 (struct sockaddr *) psin_server,
-                                sizeof (struct sockaddr_in), 0);
+                                sizeof(struct sockaddr_in), 0);
                 if (rc >= 0)
                         connected = 1;
         }
@@ -1493,7 +1517,7 @@ ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
 
                         rc = (*csocket)->ops->connect(*csocket,
                                         (struct sockaddr *) psin_server,
-                                        sizeof (struct sockaddr_in), 0);
+                                        sizeof(struct sockaddr_in), 0);
                         if (rc >= 0)
                                 connected = 1;
                 }
@@ -1502,7 +1526,7 @@ ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
                 psin_server->sin_port = htons(RFC1001_PORT);
                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
                                               psin_server,
-                                              sizeof (struct sockaddr_in), 0);
+                                              sizeof(struct sockaddr_in), 0);
                 if (rc >= 0)
                         connected = 1;
         }
@@ -1610,7 +1634,7 @@ ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
         if (psin_server->sin6_port) { /* user overrode default port */
                 rc = (*csocket)->ops->connect(*csocket,
                                 (struct sockaddr *) psin_server,
-                                sizeof (struct sockaddr_in6), 0);
+                                sizeof(struct sockaddr_in6), 0);
                 if (rc >= 0)
                         connected = 1;
         }
@@ -1626,7 +1650,7 @@ ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
 
                         rc = (*csocket)->ops->connect(*csocket,
                                         (struct sockaddr *) psin_server,
-                                        sizeof (struct sockaddr_in6), 0);
+                                        sizeof(struct sockaddr_in6), 0);
                         if (rc >= 0)
                                 connected = 1;
                 }
@@ -1634,7 +1658,7 @@ ipv6_connect(struct sockaddr_in6 *psin_server, struct socket **csocket)
         if (!connected) {
                 psin_server->sin6_port = htons(RFC1001_PORT);
                 rc = (*csocket)->ops->connect(*csocket, (struct sockaddr *)
-                                 psin_server, sizeof (struct sockaddr_in6), 0);
+                                 psin_server, sizeof(struct sockaddr_in6), 0);
                 if (rc >= 0)
                         connected = 1;
         }
@@ -1750,7 +1774,16 @@ void reset_cifs_unix_caps(int xid, struct cifsTconInfo *tcon,
                         cFYI(1, ("very large write cap"));
 #endif /* CIFS_DEBUG2 */
                 if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
-                        cFYI(1, ("setting capabilities failed"));
+                        if (vol_info == NULL) {
+                                cFYI(1, ("resetting capabilities failed"));
+                        } else
+                                cERROR(1, ("Negotiating Unix capabilities "
+                                           "with the server failed.  Consider "
+                                           "mounting with the Unix Extensions\n"
+                                           "disabled, if problems are found, "
+                                           "by specifying the nounix mount "
+                                           "option."));
+
                 }
         }
 }
@@ -1777,16 +1810,13 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
         memset(&volume_info, 0, sizeof(struct smb_vol));
         if (cifs_parse_mount_options(mount_data, devname, &volume_info)) {
-                kfree(volume_info.UNC);
-                kfree(volume_info.password);
-                kfree(volume_info.prepath);
-                FreeXid(xid);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
         }
 
         if (volume_info.nullauth) {
                 cFYI(1, ("null user"));
-                volume_info.username = NULL;
+                volume_info.username = "";
         } else if (volume_info.username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, ("Username: %s", volume_info.username));
@@ -1794,11 +1824,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 cifserror("No username specified");
         /* In userspace mount helper we can get user name from alternate
            locations such as env variables and files on disk */
-                kfree(volume_info.UNC);
-                kfree(volume_info.password);
-                kfree(volume_info.prepath);
-                FreeXid(xid);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
         }
 
         if (volume_info.UNCip && volume_info.UNC) {
@@ -1817,11 +1844,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
                 if (rc <= 0) {
                         /* we failed translating address */
-                        kfree(volume_info.UNC);
-                        kfree(volume_info.password);
-                        kfree(volume_info.prepath);
-                        FreeXid(xid);
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                 }
 
                 cFYI(1, ("UNC: %s ip: %s", volume_info.UNC, volume_info.UNCip));
@@ -1831,20 +1855,14 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 /* BB using ip addr as server name to connect to the
                    DFS root below */
                 cERROR(1, ("Connecting to DFS root not implemented yet"));
-                kfree(volume_info.UNC);
-                kfree(volume_info.password);
-                kfree(volume_info.prepath);
-                FreeXid(xid);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
         } else /* which servers DFS root would we conect to */ {
                 cERROR(1,
                        ("CIFS mount error: No UNC path (e.g. -o "
                         "unc=//192.168.1.100/public) specified"));
-                kfree(volume_info.UNC);
-                kfree(volume_info.password);
-                kfree(volume_info.prepath);
-                FreeXid(xid);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
         }
 
         /* this is needed for ASCII cp to Unicode converts */
@@ -1856,11 +1874,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 if (cifs_sb->local_nls == NULL) {
                         cERROR(1, ("CIFS mount error: iocharset %s not found",
                                  volume_info.iocharset));
-                        kfree(volume_info.UNC);
-                        kfree(volume_info.password);
-                        kfree(volume_info.prepath);
-                        FreeXid(xid);
-                        return -ELIBACC;
+                        rc = -ELIBACC;
+                        goto out;
                 }
         }
 
@@ -1874,11 +1889,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         &sin_server6.sin6_addr,
                         volume_info.username, &srvTcp);
         } else {
-                kfree(volume_info.UNC);
-                kfree(volume_info.password);
-                kfree(volume_info.prepath);
-                FreeXid(xid);
-                return -EINVAL;
+                rc = -EINVAL;
+                goto out;
         }
 
         if (srvTcp) {
@@ -1902,30 +1914,27 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                    "Aborting operation"));
                         if (csocket != NULL)
                                 sock_release(csocket);
-                        kfree(volume_info.UNC);
-                        kfree(volume_info.password);
-                        kfree(volume_info.prepath);
-                        FreeXid(xid);
-                        return rc;
+                        goto out;
                 }
 
-                srvTcp = kmalloc(sizeof (struct TCP_Server_Info), GFP_KERNEL);
-                if (srvTcp == NULL) {
+                srvTcp = kzalloc(sizeof(struct TCP_Server_Info), GFP_KERNEL);
+                if (!srvTcp) {
                         rc = -ENOMEM;
                         sock_release(csocket);
-                        kfree(volume_info.UNC);
-                        kfree(volume_info.password);
-                        kfree(volume_info.prepath);
-                        FreeXid(xid);
-                        return rc;
+                        goto out;
                 } else {
-                        memset(srvTcp, 0, sizeof (struct TCP_Server_Info));
                         memcpy(&srvTcp->addr.sockAddr, &sin_server,
-                                sizeof (struct sockaddr_in));
+                                sizeof(struct sockaddr_in));
                         atomic_set(&srvTcp->inFlight, 0);
                         /* BB Add code for ipv6 case too */
                         srvTcp->ssocket = csocket;
                         srvTcp->protocolType = IPV4;
+                        srvTcp->hostname = extract_hostname(volume_info.UNC);
+                        if (IS_ERR(srvTcp->hostname)) {
+                                rc = PTR_ERR(srvTcp->hostname);
+                                sock_release(csocket);
+                                goto out;
+                        }
                         init_waitqueue_head(&srvTcp->response_q);
                         init_waitqueue_head(&srvTcp->request_q);
                         INIT_LIST_HEAD(&srvTcp->pending_mid_q);
@@ -1935,16 +1944,13 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         srvTcp->tcpStatus = CifsNew;
                         init_MUTEX(&srvTcp->tcpSem);
                         srvTcp->tsk = kthread_run((void *)(void *)cifs_demultiplex_thread, srvTcp, "cifsd");
-                        if ( IS_ERR(srvTcp->tsk) ) {
+                        if (IS_ERR(srvTcp->tsk)) {
                                 rc = PTR_ERR(srvTcp->tsk);
                                 cERROR(1, ("error %d create cifsd thread", rc));
                                 srvTcp->tsk = NULL;
                                 sock_release(csocket);
-                                kfree(volume_info.UNC);
-                                kfree(volume_info.password);
-                                kfree(volume_info.prepath);
-                                FreeXid(xid);
-                                return rc;
+                                kfree(srvTcp->hostname);
+                                goto out;
                         }
                         wait_for_completion(&cifsd_complete);
                         rc = 0;
@@ -1959,8 +1965,6 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         if (existingCifsSes) {
                 pSesInfo = existingCifsSes;
                 cFYI(1, ("Existing smb sess found"));
-                kfree(volume_info.password);
-                /* volume_info.UNC freed at end of function */
         } else if (!rc) {
                 cFYI(1, ("Existing smb sess not found"));
                 pSesInfo = sesInfoAlloc();
@@ -1974,8 +1978,11 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 
                 if (!rc) {
                         /* volume_info.password freed at unmount */
-                        if (volume_info.password)
+                        if (volume_info.password) {
                                 pSesInfo->password = volume_info.password;
+                                /* set to NULL to prevent freeing on exit */
+                                volume_info.password = NULL;
+                        }
                         if (volume_info.username)
                                 strncpy(pSesInfo->userName,
                                         volume_info.username,
@@ -1997,8 +2004,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         up(&pSesInfo->sesSem);
                         if (!rc)
                                 atomic_inc(&srvTcp->socketUseCount);
-                } else
-                        kfree(volume_info.password);
+                }
         }
 
         /* search for existing tcon to this server share */
@@ -2103,9 +2109,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                                 "", cifs_sb->local_nls,
                                                 cifs_sb->mnt_cifs_flags &
                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
-                                        kfree(volume_info.UNC);
-                                        FreeXid(xid);
-                                        return -ENODEV;
+                                        rc = -ENODEV;
+                                        goto out;
                                 } else {
                                         /* BB Do we need to wrap sesSem around
                                          * this TCon call and Unix SetFS as
@@ -2173,8 +2178,18 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                                 if (tsk)
                                                         kthread_stop(tsk);
                                         }
-                                } else
+                                } else {
                                         cFYI(1, ("No session or bad tcon"));
+                                        if ((pSesInfo->server) &&
+                                            (pSesInfo->server->tsk)) {
+                                                struct task_struct *tsk;
+                                                force_sig(SIGKILL,
+                                                        pSesInfo->server->tsk);
+                                                tsk = pSesInfo->server->tsk;
+                                                if (tsk)
+                                                        kthread_stop(tsk);
+                                        }
+                                }
                                 sesInfoFree(pSesInfo);
                                 /* pSesInfo = NULL; */
                         }
@@ -2185,8 +2200,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 tcon->ses = pSesInfo;
 
                 /* do not care if following two calls succeed - informational */
-                CIFSSMBQFSDeviceInfo(xid, tcon);
-                CIFSSMBQFSAttributeInfo(xid, tcon);
+                if (!tcon->ipc) {
+                        CIFSSMBQFSDeviceInfo(xid, tcon);
+                        CIFSSMBQFSAttributeInfo(xid, tcon);
+                }
 
                 /* tell server which Unix caps we support */
                 if (tcon->ses->capabilities & CAP_UNIX)
@@ -2216,6 +2233,12 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
         (in which case it is not needed anymore) but when new sesion is created
         the password ptr is put in the new session structure (in which case the
         password will be freed at unmount time) */
+out:
+        /* zero out password before freeing */
+        if (volume_info.password != NULL) {
+                memset(volume_info.password, 0, strlen(volume_info.password));
+                kfree(volume_info.password);
+        }
         kfree(volume_info.UNC);
         kfree(volume_info.prepath);
         FreeXid(xid);
@@ -2359,7 +2382,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
         pSMB->req_no_secext.ByteCount = cpu_to_le16(count);
 
         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
-                         &bytes_returned, 1);
+                         &bytes_returned, CIFS_LONG_OP);
         if (rc) {
 /* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */
         } else if ((smb_buffer_response->WordCount == 3)
@@ -2526,8 +2549,7 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 sesssetup_nomem:        /* do not return an error on nomem for the info strings,
                            since that could make reconnection harder, and
                            reconnection might be needed to free memory */
-        if (smb_buffer)
-                cifs_buf_release(smb_buffer);
+        cifs_buf_release(smb_buffer);
 
         return rc;
 }
@@ -2547,7 +2569,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
         int remaining_words = 0;
         int bytes_returned = 0;
         int len;
-        int SecurityBlobLength = sizeof (NEGOTIATE_MESSAGE);
+        int SecurityBlobLength = sizeof(NEGOTIATE_MESSAGE);
         PNEGOTIATE_MESSAGE SecurityBlob;
         PCHALLENGE_MESSAGE SecurityBlob2;
         __u32 negotiate_flags, capabilities;
@@ -2664,7 +2686,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
         pSMB->req.ByteCount = cpu_to_le16(count);
 
         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
-                         &bytes_returned, 1);
+                         &bytes_returned, CIFS_LONG_OP);
 
         if (smb_buffer_response->Status.CifsError ==
             cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
@@ -2865,15 +2887,14 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                 rc = -EIO;
         }
 
-        if (smb_buffer)
-                cifs_buf_release(smb_buffer);
+        cifs_buf_release(smb_buffer);
 
         return rc;
 }
 static int
 CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
-                char *ntlm_session_key, int ntlmv2_flag,
-                const struct nls_table *nls_codepage)
+                        char *ntlm_session_key, int ntlmv2_flag,
+                        const struct nls_table *nls_codepage)
 {
         struct smb_hdr *smb_buffer;
         struct smb_hdr *smb_buffer_response;
@@ -2886,7 +2907,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
         int remaining_words = 0;
         int bytes_returned = 0;
         int len;
-        int SecurityBlobLength = sizeof (AUTHENTICATE_MESSAGE);
+        int SecurityBlobLength = sizeof(AUTHENTICATE_MESSAGE);
         PAUTHENTICATE_MESSAGE SecurityBlob;
         __u32 negotiate_flags, capabilities;
         __u16 count;
@@ -2901,8 +2922,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                 return -ENOMEM;
         }
         smb_buffer_response = smb_buffer;
-        pSMB = (SESSION_SETUP_ANDX *) smb_buffer;
-        pSMBr = (SESSION_SETUP_ANDX *) smb_buffer_response;
+        pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
+        pSMBr = (SESSION_SETUP_ANDX *)smb_buffer_response;
 
         /* send SMBsessionSetup here */
         header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,
@@ -2921,7 +2942,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                 smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 
         capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
-            CAP_EXTENDED_SECURITY;
+                        CAP_EXTENDED_SECURITY;
         if (ses->capabilities & CAP_UNICODE) {
                 smb_buffer->Flags2 |= SMBFLG2_UNICODE;
                 capabilities |= CAP_UNICODE;
@@ -2936,15 +2957,14 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
         }
         pSMB->req.Capabilities = cpu_to_le32(capabilities);
 
-        bcc_ptr = (char *) &pSMB->req.SecurityBlob;
-        SecurityBlob = (PAUTHENTICATE_MESSAGE) bcc_ptr;
+        bcc_ptr = (char *)&pSMB->req.SecurityBlob;
+        SecurityBlob = (PAUTHENTICATE_MESSAGE)bcc_ptr;
         strncpy(SecurityBlob->Signature, NTLMSSP_SIGNATURE, 8);
         SecurityBlob->MessageType = NtLmAuthenticate;
         bcc_ptr += SecurityBlobLength;
-        negotiate_flags =
-            NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
-            NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
-            0x80000000 | NTLMSSP_NEGOTIATE_128;
+        negotiate_flags = NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_REQUEST_TARGET |
+                        NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_TARGET_INFO |
+                        0x80000000 | NTLMSSP_NEGOTIATE_128;
         if (sign_CIFS_PDUs)
                 negotiate_flags |= /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN |*/ NTLMSSP_NEGOTIATE_SIGN;
         if (ntlmv2_flag)
@@ -2979,36 +2999,32 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                         SecurityBlob->DomainName.Length = 0;
                         SecurityBlob->DomainName.MaximumLength = 0;
                 } else {
-                        __u16 len =
-                            cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
+                        __u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, domain, 64,
                                           nls_codepage);
-                        len *= 2;
+                        ln *= 2;
                         SecurityBlob->DomainName.MaximumLength =
-                            cpu_to_le16(len);
+                            cpu_to_le16(ln);
                         SecurityBlob->DomainName.Buffer =
                             cpu_to_le32(SecurityBlobLength);
-                        bcc_ptr += len;
-                        SecurityBlobLength += len;
-                        SecurityBlob->DomainName.Length =
-                            cpu_to_le16(len);
+                        bcc_ptr += ln;
+                        SecurityBlobLength += ln;
+                        SecurityBlob->DomainName.Length = cpu_to_le16(ln);
                 }
                 if (user == NULL) {
                         SecurityBlob->UserName.Buffer = 0;
                         SecurityBlob->UserName.Length = 0;
                         SecurityBlob->UserName.MaximumLength = 0;
                 } else {
-                        __u16 len =
-                            cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
+                        __u16 ln = cifs_strtoUCS((__le16 *) bcc_ptr, user, 64,
                                           nls_codepage);
-                        len *= 2;
+                        ln *= 2;
                         SecurityBlob->UserName.MaximumLength =
-                            cpu_to_le16(len);
+                            cpu_to_le16(ln);
                         SecurityBlob->UserName.Buffer =
                             cpu_to_le32(SecurityBlobLength);
-                        bcc_ptr += len;
-                        SecurityBlobLength += len;
-                        SecurityBlob->UserName.Length =
-                            cpu_to_le16(len);
+                        bcc_ptr += ln;
+                        SecurityBlobLength += ln;
+                        SecurityBlob->UserName.Length = cpu_to_le16(ln);
                 }
 
                 /* SecurityBlob->WorkstationName.Length =
@@ -3052,33 +3068,32 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                         SecurityBlob->DomainName.Length = 0;
                         SecurityBlob->DomainName.MaximumLength = 0;
                 } else {
-                        __u16 len;
+                        __u16 ln;
                         negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
                         strncpy(bcc_ptr, domain, 63);
-                        len = strnlen(domain, 64);
+                        ln = strnlen(domain, 64);
                         SecurityBlob->DomainName.MaximumLength =
-                            cpu_to_le16(len);
+                            cpu_to_le16(ln);
                         SecurityBlob->DomainName.Buffer =
                             cpu_to_le32(SecurityBlobLength);
-                        bcc_ptr += len;
-                        SecurityBlobLength += len;
-                        SecurityBlob->DomainName.Length = cpu_to_le16(len);
+                        bcc_ptr += ln;
+                        SecurityBlobLength += ln;
+                        SecurityBlob->DomainName.Length = cpu_to_le16(ln);
                 }
                 if (user == NULL) {
                         SecurityBlob->UserName.Buffer = 0;
                         SecurityBlob->UserName.Length = 0;
                         SecurityBlob->UserName.MaximumLength = 0;
                 } else {
-                        __u16 len;
+                        __u16 ln;
                         strncpy(bcc_ptr, user, 63);
-                        len = strnlen(user, 64);
-                        SecurityBlob->UserName.MaximumLength =
-                            cpu_to_le16(len);
+                        ln = strnlen(user, 64);
+                        SecurityBlob->UserName.MaximumLength = cpu_to_le16(ln);
                         SecurityBlob->UserName.Buffer =
-                            cpu_to_le32(SecurityBlobLength);
-                        bcc_ptr += len;
-                        SecurityBlobLength += len;
-                        SecurityBlob->UserName.Length = cpu_to_le16(len);
+                                                cpu_to_le32(SecurityBlobLength);
+                        bcc_ptr += ln;
+                        SecurityBlobLength += ln;
+                        SecurityBlob->UserName.Length = cpu_to_le16(ln);
                 }
                 /* BB fill in our workstation name if known BB */
 
@@ -3098,14 +3113,13 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
         pSMB->req.ByteCount = cpu_to_le16(count);
 
         rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,
-                         &bytes_returned, 1);
+                         &bytes_returned, CIFS_LONG_OP);
         if (rc) {
-/*    rc = map_smb_to_linux_error(smb_buffer_response);  *//* done in SendReceive now */
-        } else if ((smb_buffer_response->WordCount == 3)
-                   || (smb_buffer_response->WordCount == 4)) {
+/*   rc = map_smb_to_linux_error(smb_buffer_response) done in SendReceive now */
+        } else if ((smb_buffer_response->WordCount == 3) ||
+                   (smb_buffer_response->WordCount == 4)) {
                 __u16 action = le16_to_cpu(pSMBr->resp.Action);
-                __u16 blob_len =
-                    le16_to_cpu(pSMBr->resp.SecurityBlobLength);
+                __u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);
                 if (action & GUEST_LOGIN)
                         cFYI(1, (" Guest login")); /* BB Should we set anything
                                                          in SesInfo struct ? */
@@ -3145,8 +3159,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         } else {
                                                 remaining_words = BCC(smb_buffer_response) / 2;
                                         }
-                                        len =
-                                            UniStrnlen((wchar_t *) bcc_ptr,remaining_words - 1);
+                                        len = UniStrnlen((wchar_t *) bcc_ptr,
+                                                        remaining_words - 1);
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
@@ -3230,7 +3244,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 <= BCC(smb_buffer_response)) {
                                                 if (ses->serverOS)
                                                         kfree(ses->serverOS);
-                                                ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
+                                                ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
                                                 strncpy(ses->serverOS,bcc_ptr, len);
 
                                                 bcc_ptr += len;
@@ -3259,28 +3273,24 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 bcc_ptr[0] = 0;
                                                 bcc_ptr++;
                                         } else
-                                                cFYI(1,
-                                                     ("field of length %d "
+                                                cFYI(1, ("field of length %d "
                                                    "extends beyond end of smb ",
                                                       len));
                                 }
                         } else {
-                                cERROR(1,
-                                       (" Security Blob extends beyond end "
+                                cERROR(1, ("Security Blob extends beyond end "
                                         "of SMB"));
                         }
                 } else {
                         cERROR(1, ("No session structure passed in."));
                 }
         } else {
-                cERROR(1,
-                       (" Invalid Word count %d: ",
+                cERROR(1, ("Invalid Word count %d: ",
                         smb_buffer_response->WordCount));
                 rc = -EIO;
         }
 
-        if (smb_buffer)
-                cifs_buf_release(smb_buffer);
+        cifs_buf_release(smb_buffer);
 
         return rc;
 }
@@ -3379,7 +3389,8 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
         pSMB->hdr.smb_buf_length += count;
         pSMB->ByteCount = cpu_to_le16(count);
 
-        rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length, 0);
+        rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response, &length,
+                         CIFS_STD_OP);
 
         /* if (rc) rc = map_smb_to_linux_error(smb_buffer_response); */
         /* above now done in SendReceive */
@@ -3389,6 +3400,18 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                 bcc_ptr = pByteArea(smb_buffer_response);
                 length = strnlen(bcc_ptr, BCC(smb_buffer_response) - 2);
                 /* skip service field (NB: this field is always ASCII) */
+                if (length == 3) {
+                        if ((bcc_ptr[0] == 'I') && (bcc_ptr[1] == 'P') &&
+                            (bcc_ptr[2] == 'C')) {
+                                cFYI(1, ("IPC connection"));
+                                tcon->ipc = 1;
+                        }
+                } else if (length == 2) {
+                        if ((bcc_ptr[0] == 'A') && (bcc_ptr[1] == ':')) {
+                                /* the most common case */
+                                cFYI(1, ("disk share connection"));
+                        }
+                }
                 bcc_ptr += length + 1;
                 strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
                 if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {
@@ -3399,9 +3422,11 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                                 kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
                                     kzalloc(length + 2, GFP_KERNEL);
-                                cifs_strfromUCS_le(tcon->nativeFileSystem,
-                                                   (__le16 *) bcc_ptr,
-                                                   length, nls_codepage);
+                                if (tcon->nativeFileSystem)
+                                        cifs_strfromUCS_le(
+                                                tcon->nativeFileSystem,
+                                                (__le16 *) bcc_ptr,
+                                                length, nls_codepage);
                                 bcc_ptr += 2 * length;
                                 bcc_ptr[0] = 0; /* null terminate the string */
                                 bcc_ptr[1] = 0;
@@ -3416,8 +3441,9 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                                 kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
                                     kzalloc(length + 1, GFP_KERNEL);
-                                strncpy(tcon->nativeFileSystem, bcc_ptr,
-                                        length);
+                                if (tcon->nativeFileSystem)
+                                        strncpy(tcon->nativeFileSystem, bcc_ptr,
+                                                length);
                         }
                         /* else do not bother copying these information fields*/
                 }
@@ -3433,8 +3459,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                 ses->ipc_tid = smb_buffer_response->Tid;
         }
 
-        if (smb_buffer)
-                cifs_buf_release(smb_buffer);
+        cifs_buf_release(smb_buffer);
         return rc;
 }
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 4830acc86d74..37dc97af1487 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -3,7 +3,7 @@
  *
  *   vfs operations that deal with dentries
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2005
+ *   Copyright (C) International Business Machines  Corp., 2002,2007
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -269,7 +269,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                         CIFSSMBClose(xid, pTcon, fileHandle);
                 } else if (newinode) {
                         pCifsFile =
-                           kzalloc(sizeof (struct cifsFileInfo), GFP_KERNEL);
+                           kzalloc(sizeof(struct cifsFileInfo), GFP_KERNEL);
 
                         if (pCifsFile == NULL)
                                 goto cifs_create_out;
@@ -397,7 +397,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode,
                                 /* BB Do not bother to decode buf since no
                                    local inode yet to put timestamps in,
                                    but we can reuse it safely */
-                                int bytes_written;
+                                unsigned int bytes_written;
                                 struct win_dev *pdev;
                                 pdev = (struct win_dev *)buf;
                                 if (S_ISCHR(mode)) {
@@ -450,8 +450,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
 
         xid = GetXid();
 
-        cFYI(1,
-             (" parent inode = 0x%p name is: %s and dentry = 0x%p",
+        cFYI(1, (" parent inode = 0x%p name is: %s and dentry = 0x%p",
               parent_dir_inode, direntry->d_name.name, direntry));
 
         /* check whether path exists */
@@ -594,7 +593,7 @@ static int cifs_ci_compare(struct dentry *dentry, struct qstr *a,
                  * case take precedence.  If a is not a negative dentry, this
                  * should have no side effects
                  */
-                memcpy((unsigned char *)a->name, b->name, a->len);
+                memcpy(a->name, b->name, a->len);
                 return 0;
         }
         return 1;
diff --git a/fs/cifs/export.c b/fs/cifs/export.c
index 893fd0aebff8..75949d6a5f1b 100644
--- a/fs/cifs/export.c
+++ b/fs/cifs/export.c
@@ -43,6 +43,7 @@
 #include <linux/exportfs.h>
 #include "cifsglob.h"
 #include "cifs_debug.h"
+#include "cifsfs.h"
 
 #ifdef CONFIG_CIFS_EXPERIMENTAL
 static struct dentry *cifs_get_parent(struct dentry *dentry)
@@ -52,7 +53,7 @@ static struct dentry *cifs_get_parent(struct dentry *dentry)
         return ERR_PTR(-EACCES);
 }
 
-struct export_operations cifs_export_ops = {
+const struct export_operations cifs_export_ops = {
         .get_parent = cifs_get_parent,
 /*      Following five export operations are unneeded so far and can default:
         .get_dentry =
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 894b1f7b299d..dd26e2759b17 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -130,7 +130,9 @@ static inline int cifs_open_inode_helper(struct inode *inode, struct file *file,
                 if (file->f_path.dentry->d_inode->i_mapping) {
                 /* BB no need to lock inode until after invalidate
                    since namei code should already have it locked? */
-                        filemap_write_and_wait(file->f_path.dentry->d_inode->i_mapping);
+                        rc = filemap_write_and_wait(file->f_path.dentry->d_inode->i_mapping);
+                        if (rc != 0)
+                                CIFS_I(file->f_path.dentry->d_inode)->write_behind_rc = rc;
                 }
                 cFYI(1, ("invalidating remote inode since open detected it "
                          "changed"));
@@ -425,7 +427,9 @@ reopen_error_exit:
                 pCifsInode = CIFS_I(inode);
                 if (pCifsInode) {
                         if (can_flush) {
-                                filemap_write_and_wait(inode->i_mapping);
+                                rc = filemap_write_and_wait(inode->i_mapping);
+                                if (rc != 0)
+                                        CIFS_I(inode)->write_behind_rc = rc;
                         /* temporarily disable caching while we
                            go to server to get inode info */
                                 pCifsInode->clientCanCacheAll = FALSE;
@@ -467,7 +471,7 @@ reopen_error_exit:
 int cifs_close(struct inode *inode, struct file *file)
 {
         int rc = 0;
-        int xid;
+        int xid, timeout;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct cifsFileInfo *pSMBFile =
@@ -485,9 +489,9 @@ int cifs_close(struct inode *inode, struct file *file)
                         /* no sense reconnecting to close a file that is
                            already closed */
                         if (pTcon->tidStatus != CifsNeedReconnect) {
-                                int timeout = 2;
+                                timeout = 2;
                                 while ((atomic_read(&pSMBFile->wrtPending) != 0)
-                                         && (timeout < 1000) ) {
+                                        && (timeout <= 2048)) {
                                         /* Give write a better chance to get to
                                         server ahead of the close.  We do not
                                         want to add a wait_q here as it would
@@ -522,12 +526,30 @@ int cifs_close(struct inode *inode, struct file *file)
                 list_del(&pSMBFile->flist);
                 list_del(&pSMBFile->tlist);
                 write_unlock(&GlobalSMBSeslock);
+                timeout = 10;
+                /* We waited above to give the SMBWrite a chance to issue
+                   on the wire (so we do not get SMBWrite returning EBADF
+                   if writepages is racing with close.  Note that writepages
+                   does not specify a file handle, so it is possible for a file
+                   to be opened twice, and the application close the "wrong"
+                   file handle - in these cases we delay long enough to allow
+                   the SMBWrite to get on the wire before the SMB Close.
+                   We allow total wait here over 45 seconds, more than
+                   oplock break time, and more than enough to allow any write
+                   to complete on the server, or to time out on the client */
+                while ((atomic_read(&pSMBFile->wrtPending) != 0)
+                                && (timeout <= 50000)) {
+                        cERROR(1, ("writes pending, delay free of handle"));
+                        msleep(timeout);
+                        timeout *= 8;
+                }
                 kfree(pSMBFile->search_resume_name);
                 kfree(file->private_data);
                 file->private_data = NULL;
         } else
                 rc = -EBADF;
 
+        read_lock(&GlobalSMBSeslock);
         if (list_empty(&(CIFS_I(inode)->openFileList))) {
                 cFYI(1, ("closing last open instance for inode %p", inode));
                 /* if the file is not open we do not know if we can cache info
@@ -535,6 +557,7 @@ int cifs_close(struct inode *inode, struct file *file)
                 CIFS_I(inode)->clientCanCacheRead = FALSE;
                 CIFS_I(inode)->clientCanCacheAll  = FALSE;
         }
+        read_unlock(&GlobalSMBSeslock);
         if ((rc == 0) && CIFS_I(inode)->write_behind_rc)
                 rc = CIFS_I(inode)->write_behind_rc;
         FreeXid(xid);
@@ -767,7 +790,8 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                         mutex_lock(&fid->lock_mutex);
                         list_for_each_entry_safe(li, tmp, &fid->llist, llist) {
                                 if (pfLock->fl_start <= li->offset &&
-                                                length >= li->length) {
+                                                (pfLock->fl_start + length) >=
+                                                (li->offset + li->length)) {
                                         stored_rc = CIFSSMBLock(xid, pTcon,
                                                         netfid,
                                                         li->length, li->offset,
@@ -815,9 +839,9 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
         xid = GetXid();
 
         if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = 2; /* writes past end of file can take a long time */
+                long_op = CIFS_VLONG_OP; /* writes past EOF take long time */
         else
-                long_op = 1;
+                long_op = CIFS_LONG_OP;
 
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
@@ -864,7 +888,7 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
                         }
                 } else
                         *poffset += bytes_written;
-                long_op = FALSE; /* subsequent writes fast -
+                long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
 
@@ -914,9 +938,9 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
         xid = GetXid();
 
         if (*poffset > file->f_path.dentry->d_inode->i_size)
-                long_op = 2; /* writes past end of file can take a long time */
+                long_op = CIFS_VLONG_OP; /* writes past EOF can be slow */
         else
-                long_op = 1;
+                long_op = CIFS_LONG_OP;
 
         for (total_written = 0; write_size > total_written;
              total_written += bytes_written) {
@@ -982,7 +1006,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                         }
                 } else
                         *poffset += bytes_written;
-                long_op = FALSE; /* subsequent writes fast -
+                long_op = CIFS_STD_OP; /* subsequent writes fast -
                                     15 seconds is plenty */
         }
 
@@ -1006,6 +1030,37 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
         return total_written;
 }
 
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode)
+{
+        struct cifsFileInfo *open_file = NULL;
+
+        read_lock(&GlobalSMBSeslock);
+        /* we could simply get the first_list_entry since write-only entries
+           are always at the end of the list but since the first entry might
+           have a close pending, we go through the whole list */
+        list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+                if (open_file->closePend)
+                        continue;
+                if (open_file->pfile && ((open_file->pfile->f_flags & O_RDWR) ||
+                    (open_file->pfile->f_flags & O_RDONLY))) {
+                        if (!open_file->invalidHandle) {
+                                /* found a good file */
+                                /* lock it so it will not be closed on us */
+                                atomic_inc(&open_file->wrtPending);
+                                read_unlock(&GlobalSMBSeslock);
+                                return open_file;
+                        } /* else might as well continue, and look for
+                             another, or simply have the caller reopen it
+                             again rather than trying to fix this handle */
+                } else /* write only file */
+                        break; /* write only files are last so must be done */
+        }
+        read_unlock(&GlobalSMBSeslock);
+        return NULL;
+}
+#endif
+
 struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode)
 {
         struct cifsFileInfo *open_file;
@@ -1022,6 +1077,7 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode)
         }
 
         read_lock(&GlobalSMBSeslock);
+refind_writable:
         list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
                 if (open_file->closePend)
                         continue;
@@ -1029,24 +1085,49 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode)
                     ((open_file->pfile->f_flags & O_RDWR) ||
                      (open_file->pfile->f_flags & O_WRONLY))) {
                         atomic_inc(&open_file->wrtPending);
+
+                        if (!open_file->invalidHandle) {
+                                /* found a good writable file */
+                                read_unlock(&GlobalSMBSeslock);
+                                return open_file;
+                        }
+
                         read_unlock(&GlobalSMBSeslock);
-                        if ((open_file->invalidHandle) &&
-                           (!open_file->closePend) /* BB fixme -since the second clause can not be true remove it BB */) {
-                                rc = cifs_reopen_file(open_file->pfile, FALSE);
-                                /* if it fails, try another handle - might be */
-                                /* dangerous to hold up writepages with retry */
-                                if (rc) {
-                                        cFYI(1,
-                                              ("failed on reopen file in wp"));
+                        /* Had to unlock since following call can block */
+                        rc = cifs_reopen_file(open_file->pfile, FALSE);
+                        if (!rc) {
+                                if (!open_file->closePend)
+                                        return open_file;
+                                else { /* start over in case this was deleted */
+                                       /* since the list could be modified */
                                         read_lock(&GlobalSMBSeslock);
-                                        /* can not use this handle, no write
-                                        pending on this one after all */
-                                        atomic_dec
-                                             (&open_file->wrtPending);
-                                        continue;
+                                        atomic_dec(&open_file->wrtPending);
+                                        goto refind_writable;
                                 }
                         }
-                        return open_file;
+
+                        /* if it fails, try another handle if possible -
+                        (we can not do this if closePending since
+                        loop could be modified - in which case we
+                        have to start at the beginning of the list
+                        again. Note that it would be bad
+                        to hold up writepages here (rather than
+                        in caller) with continuous retries */
+                        cFYI(1, ("wp failed on reopen file"));
+                        read_lock(&GlobalSMBSeslock);
+                        /* can not use this handle, no write
+                           pending on this one after all */
+                        atomic_dec(&open_file->wrtPending);
+
+                        if (open_file->closePend) /* list could have changed */
+                                goto refind_writable;
+                        /* else we simply continue to the next entry. Thus
+                           we do not loop on reopen errors.  If we
+                           can not reopen the file, for example if we
+                           reconnected to a server with another client
+                           racing to delete or lock the file we would not
+                           make progress if we restarted before the beginning
+                           of the loop here. */
                 }
         }
         read_unlock(&GlobalSMBSeslock);
@@ -1283,14 +1364,17 @@ retry:
                                                    open_file->netfid,
                                                    bytes_to_write, offset,
                                                    &bytes_written, iov, n_iov,
-                                                   1);
+                                                   CIFS_LONG_OP);
                                 atomic_dec(&open_file->wrtPending);
                                 if (rc || bytes_written < bytes_to_write) {
                                         cERROR(1, ("Write2 ret %d, wrote %d",
                                                   rc, bytes_written));
                                         /* BB what if continued retry is
                                            requested via mount flags? */
-                                        set_bit(AS_EIO, &mapping->flags);
+                                        if (rc == -ENOSPC)
+                                                set_bit(AS_ENOSPC, &mapping->flags);
+                                        else
+                                                set_bit(AS_EIO, &mapping->flags);
                                 } else {
                                         cifs_stats_bytes_written(cifs_sb->tcon,
                                                                  bytes_written);
@@ -1422,9 +1506,11 @@ int cifs_fsync(struct file *file, struct dentry *dentry, int datasync)
         cFYI(1, ("Sync file - name: %s datasync: 0x%x",
                 dentry->d_name.name, datasync));
 
-        rc = filemap_fdatawrite(inode->i_mapping);
-        if (rc == 0)
+        rc = filemap_write_and_wait(inode->i_mapping);
+        if (rc == 0) {
+                rc = CIFS_I(inode)->write_behind_rc;
                 CIFS_I(inode)->write_behind_rc = 0;
+        }
         FreeXid(xid);
         return rc;
 }
@@ -1476,8 +1562,11 @@ int cifs_flush(struct file *file, fl_owner_t id)
            filemapfdatawrite appears easier for the time being */
 
         rc = filemap_fdatawrite(inode->i_mapping);
-        if (!rc) /* reset wb rc if we were able to write out dirty pages */
+        /* reset wb rc if we were able to write out dirty pages */
+        if (!rc) {
+                rc = CIFS_I(inode)->write_behind_rc;
                 CIFS_I(inode)->write_behind_rc = 0;
+        }
 
         cFYI(1, ("Flush inode %p file %p rc %d", inode, file, rc));
 
@@ -1709,7 +1798,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
         struct page *page;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
-        int bytes_read = 0;
+        unsigned int bytes_read = 0;
         unsigned int read_size, i;
         char *smb_read_data = NULL;
         struct smb_com_read_rsp *pSMBr;
@@ -1803,7 +1892,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
 
                         i +=  bytes_read >> PAGE_CACHE_SHIFT;
                         cifs_stats_bytes_read(pTcon, bytes_read);
-                        if ((int)(bytes_read & PAGE_CACHE_MASK) != bytes_read) {
+                        if ((bytes_read & PAGE_CACHE_MASK) != bytes_read) {
                                 i++; /* account for partial page */
 
                                 /* server copy of file can have smaller size
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 279f3c5e0ce3..e915eb1d2e66 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -115,7 +115,7 @@ int cifs_get_inode_info_unix(struct inode **pinode,
                 inode->i_mode = le64_to_cpu(findData.Permissions);
                 /* since we set the inode type below we need to mask off
                    to avoid strange results if bits set above */
-                        inode->i_mode &= ~S_IFMT;
+                inode->i_mode &= ~S_IFMT;
                 if (type == UNIX_FILE) {
                         inode->i_mode |= S_IFREG;
                 } else if (type == UNIX_SYMLINK) {
@@ -289,7 +289,7 @@ static int decode_sfu_inode(struct inode *inode, __u64 size,
 
 #define SFBITS_MASK (S_ISVTX | S_ISGID | S_ISUID)  /* SETFILEBITS valid bits */
 
-static int get_sfu_uid_mode(struct inode *inode,
+static int get_sfu_mode(struct inode *inode,
                         const unsigned char *path,
                         struct cifs_sb_info *cifs_sb, int xid)
 {
@@ -527,11 +527,16 @@ int cifs_get_inode_info(struct inode **pinode,
 
                 /* BB fill in uid and gid here? with help from winbind?
                    or retrieve from NTFS stream extended attribute */
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+                /* fill in 0777 bits from ACL */
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+                        cFYI(1, ("Getting mode bits from ACL"));
+                        acl_to_uid_mode(inode, search_path);
+                }
+#endif
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
-                        /* fill in uid, gid, mode from server ACL */
-                        /* BB FIXME this should also take into account the
-                         * default uid specified on mount if present */
-                        get_sfu_uid_mode(inode, search_path, cifs_sb, xid);
+                        /* fill in remaining high mode bits e.g. SUID, VTX */
+                        get_sfu_mode(inode, search_path, cifs_sb, xid);
                 } else if (atomic_read(&cifsInfo->inUse) == 0) {
                         inode->i_uid = cifs_sb->mnt_uid;
                         inode->i_gid = cifs_sb->mnt_gid;
@@ -575,19 +580,33 @@ int cifs_get_inode_info(struct inode **pinode,
         return rc;
 }
 
+static const struct inode_operations cifs_ipc_inode_ops = {
+        .lookup = cifs_lookup,
+};
+
 /* gets root inode */
 void cifs_read_inode(struct inode *inode)
 {
-        int xid;
+        int xid, rc;
         struct cifs_sb_info *cifs_sb;
 
         cifs_sb = CIFS_SB(inode->i_sb);
         xid = GetXid();
 
         if (cifs_sb->tcon->unix_ext)
-                cifs_get_inode_info_unix(&inode, "", inode->i_sb, xid);
+                rc = cifs_get_inode_info_unix(&inode, "", inode->i_sb, xid);
         else
-                cifs_get_inode_info(&inode, "", NULL, inode->i_sb, xid);
+                rc = cifs_get_inode_info(&inode, "", NULL, inode->i_sb, xid);
+        if (rc && cifs_sb->tcon->ipc) {
+                cFYI(1, ("ipc connection - fake read inode"));
+                inode->i_mode |= S_IFDIR;
+                inode->i_nlink = 2;
+                inode->i_op = &cifs_ipc_inode_ops;
+                inode->i_fop = &simple_dir_operations;
+                inode->i_uid = cifs_sb->mnt_uid;
+                inode->i_gid = cifs_sb->mnt_gid;
+        }
+
         /* can not call macro FreeXid here since in a void func */
         _FreeXid(xid);
 }
@@ -919,18 +938,25 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                         goto mkdir_out;
                 }
 
+                mode &= ~current->fs->umask;
                 rc = CIFSPOSIXCreate(xid, pTcon, SMB_O_DIRECTORY | SMB_O_CREAT,
                                 mode, NULL /* netfid */, pInfo, &oplock,
                                 full_path, cifs_sb->local_nls,
                                 cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
-                if (rc) {
+                if (rc == -EOPNOTSUPP) {
+                        kfree(pInfo);
+                        goto mkdir_retry_old;
+                } else if (rc) {
                         cFYI(1, ("posix mkdir returned 0x%x", rc));
                         d_drop(direntry);
                 } else {
                         int obj_type;
-                        if (pInfo->Type == -1) /* no return info - go query */
+                        if (pInfo->Type == cpu_to_le32(-1)) {
+                                /* no return info, go query for it */
+                                kfree(pInfo);
                                 goto mkdir_get_info;
+                        }
 /*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need
         to set uid/gid */
                         inc_nlink(inode);
@@ -940,8 +966,10 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                                 direntry->d_op = &cifs_dentry_ops;
 
                         newinode = new_inode(inode->i_sb);
-                        if (newinode == NULL)
+                        if (newinode == NULL) {
+                                kfree(pInfo);
                                 goto mkdir_get_info;
+                        }
                         /* Is an i_ino of zero legal? */
                         /* Are there sanity checks we can use to ensure that
                            the server is really filling in that field? */
@@ -972,7 +1000,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                 kfree(pInfo);
                 goto mkdir_out;
         }
-
+mkdir_retry_old:
         /* BB add setting the equivalent of mode via CreateX w/ACLs */
         rc = CIFSSMBMkDir(xid, pTcon, full_path, cifs_sb->local_nls,
                           cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -1205,7 +1233,7 @@ cifs_rename_exit:
 int cifs_revalidate(struct dentry *direntry)
 {
         int xid;
-        int rc = 0;
+        int rc = 0, wbrc = 0;
         char *full_path;
         struct cifs_sb_info *cifs_sb;
         struct cifsInodeInfo *cifsInode;
@@ -1305,7 +1333,9 @@ int cifs_revalidate(struct dentry *direntry)
         if (direntry->d_inode->i_mapping) {
                 /* do we need to lock inode until after invalidate completes
                    below? */
-                filemap_fdatawrite(direntry->d_inode->i_mapping);
+                wbrc = filemap_fdatawrite(direntry->d_inode->i_mapping);
+                if (wbrc)
+                        CIFS_I(direntry->d_inode)->write_behind_rc = wbrc;
         }
         if (invalidate_inode) {
         /* shrink_dcache not necessary now that cifs dentry ops
@@ -1314,7 +1344,9 @@ int cifs_revalidate(struct dentry *direntry)
                         shrink_dcache_parent(direntry); */
                 if (S_ISREG(direntry->d_inode->i_mode)) {
                         if (direntry->d_inode->i_mapping)
-                                filemap_fdatawait(direntry->d_inode->i_mapping);
+                                wbrc = filemap_fdatawait(direntry->d_inode->i_mapping);
+                                if (wbrc)
+                                        CIFS_I(direntry->d_inode)->write_behind_rc = wbrc;
                         /* may eventually have to do this for open files too */
                         if (list_empty(&(cifsInode->openFileList))) {
                                 /* changed on server - flush read ahead pages */
@@ -1377,8 +1409,17 @@ static int cifs_vmtruncate(struct inode *inode, loff_t offset)
         }
         i_size_write(inode, offset);
         spin_unlock(&inode->i_lock);
+        /*
+         * unmap_mapping_range is called twice, first simply for efficiency
+         * so that truncate_inode_pages does fewer single-page unmaps. However
+         * after this first call, and before truncate_inode_pages finishes,
+         * it is possible for private pages to be COWed, which remain after
+         * truncate_inode_pages finishes, hence the second unmap_mapping_range
+         * call must be made for correctness.
+         */
         unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
         truncate_inode_pages(mapping, offset);
+        unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
         goto out_truncate;
 
 do_expand:
@@ -1448,10 +1489,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 
         /* BB check if we need to refresh inode from server now ? BB */
 
-        /* need to flush data before changing file size on server */
-        filemap_write_and_wait(direntry->d_inode->i_mapping);
-
         if (attrs->ia_valid & ATTR_SIZE) {
+                /*
+                   Flush data before changing file size on server. If the
+                   flush returns error, store it to report later and continue.
+                   BB: This should be smarter. Why bother flushing pages that
+                   will be truncated anyway? Also, should we error out here if
+                   the flush returns error?
+                 */
+                rc = filemap_write_and_wait(direntry->d_inode->i_mapping);
+                if (rc != 0) {
+                        CIFS_I(direntry->d_inode)->write_behind_rc = rc;
+                        rc = 0;
+                }
+
                 /* To avoid spurious oplock breaks from server, in the case of
                    inodes that we already have open, avoid doing path based
                    setting of file size if we can do it by handle.
@@ -1469,7 +1520,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                         atomic_dec(&open_file->wrtPending);
                         cFYI(1, ("SetFSize for attrs rc = %d", rc));
                         if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
-                                int bytes_written;
+                                unsigned int bytes_written;
                                 rc = CIFSSMBWrite(xid, pTcon,
                                                   nfid, 0, attrs->ia_size,
                                                   &bytes_written, NULL, NULL,
@@ -1502,7 +1553,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                                         cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                                 if (rc == 0) {
-                                        int bytes_written;
+                                        unsigned int bytes_written;
                                         rc = CIFSSMBWrite(xid, pTcon,
                                                         netfid, 0,
                                                         attrs->ia_size,
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 6a85ef7b8797..11f265726db7 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -237,7 +237,7 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
         char *tmp_path = NULL;
         char *tmpbuffer;
         unsigned char *referrals = NULL;
-        int num_referrals = 0;
+        unsigned int num_referrals = 0;
         int len;
         __u16 fid;
 
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
index e5c3e1212697..f13f96d42fcf 100644
--- a/fs/cifs/md5.c
+++ b/fs/cifs/md5.c
@@ -276,8 +276,8 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
         }
 
         /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof (ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof (ctx->k_opad));
+        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
+        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
         memcpy(ctx->k_ipad, key, key_len);
         memcpy(ctx->k_opad, key, key_len);
 
@@ -307,8 +307,8 @@ hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
         }
 
         /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof (ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof (ctx->k_opad));
+        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
+        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
         memcpy(ctx->k_ipad, key, key_len);
         memcpy(ctx->k_opad, key, key_len);
 
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 0bcec0844bee..15546c2354c5 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -73,7 +73,7 @@ sesInfoAlloc(void)
 {
         struct cifsSesInfo *ret_buf;
 
-        ret_buf = kzalloc(sizeof (struct cifsSesInfo), GFP_KERNEL);
+        ret_buf = kzalloc(sizeof(struct cifsSesInfo), GFP_KERNEL);
         if (ret_buf) {
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&sesInfoAllocCount);
@@ -109,7 +109,7 @@ struct cifsTconInfo *
 tconInfoAlloc(void)
 {
         struct cifsTconInfo *ret_buf;
-        ret_buf = kzalloc(sizeof (struct cifsTconInfo), GFP_KERNEL);
+        ret_buf = kzalloc(sizeof(struct cifsTconInfo), GFP_KERNEL);
         if (ret_buf) {
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&tconInfoAllocCount);
@@ -169,7 +169,6 @@ cifs_buf_get(void)
 void
 cifs_buf_release(void *buf_to_free)
 {
-
         if (buf_to_free == NULL) {
                 /* cFYI(1, ("Null buffer passed to cifs_buf_release"));*/
                 return;
@@ -299,7 +298,7 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
         memset(temp, 0, 256); /* bigger than MAX_CIFS_HDR_SIZE */
 
         buffer->smb_buf_length =
-            (2 * word_count) + sizeof (struct smb_hdr) -
+            (2 * word_count) + sizeof(struct smb_hdr) -
             4 /*  RFC 1001 length field does not count */  +
             2 /* for bcc field itself */ ;
         /* Note that this is the only network field that has to be converted
@@ -423,8 +422,8 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
         __u32 clc_len;  /* calculated length */
         cFYI(0, ("checkSMB Length: 0x%x, smb_buf_length: 0x%x", length, len));
 
-        if (length < 2 + sizeof (struct smb_hdr)) {
-                if ((length >= sizeof (struct smb_hdr) - 1)
+        if (length < 2 + sizeof(struct smb_hdr)) {
+                if ((length >= sizeof(struct smb_hdr) - 1)
                             && (smb->Status.CifsError != 0)) {
                         smb->WordCount = 0;
                         /* some error cases do not return wct and bcc */
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index 2bfed3f45d0f..646e1f06941b 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -114,10 +114,16 @@ static const struct smb_to_posix_error mapping_table_ERRSRV[] = {
         {ERRusempx, -EIO},
         {ERRusestd, -EIO},
         {ERR_NOTIFY_ENUM_DIR, -ENOBUFS},
-        {ERRaccountexpired, -EACCES},
+        {ERRnoSuchUser, -EACCES},
+/*      {ERRaccountexpired, -EACCES},
         {ERRbadclient, -EACCES},
         {ERRbadLogonTime, -EACCES},
-        {ERRpasswordExpired, -EACCES},
+        {ERRpasswordExpired, -EACCES},*/
+        {ERRaccountexpired, -EKEYEXPIRED},
+        {ERRbadclient, -EACCES},
+        {ERRbadLogonTime, -EACCES},
+        {ERRpasswordExpired, -EKEYEXPIRED},
+
         {ERRnosupport, -EINVAL},
         {0, 0}
 };
@@ -126,6 +132,34 @@ static const struct smb_to_posix_error mapping_table_ERRHRD[] = {
         {0, 0}
 };
 
+
+/* if the mount helper is missing we need to reverse the 1st slash
+   from '/' to backslash in order to format the UNC properly for
+   ip address parsing and for tree connect (unless the user
+   remembered to put the UNC name in properly). Fortunately we do
+   not have to call this twice (we check for IPv4 addresses
+   first, so it is already converted by the time we
+   try IPv6 addresses */
+static int canonicalize_unc(char *cp)
+{
+        int i;
+
+        for (i = 0; i <= 46 /* INET6_ADDRSTRLEN */ ; i++) {
+                if (cp[i] == 0)
+                        break;
+                if (cp[i] == '\\')
+                        break;
+                if (cp[i] == '/') {
+#ifdef CONFIG_CIFS_DEBUG2
+                        cFYI(1, ("change slash to backslash in malformed UNC"));
+#endif
+                        cp[i] = '\\';
+                        return 1;
+                }
+        }
+        return 0;
+}
+
 /* Convert string containing dotted ip address to binary form */
 /* returns 0 if invalid address */
 
@@ -135,11 +169,13 @@ cifs_inet_pton(int address_family, char *cp, void *dst)
         int ret = 0;
 
         /* calculate length by finding first slash or NULL */
-        /* BB Should we convert '/' slash to '\' here since it seems already
-         * done before this */
-        if ( address_family == AF_INET ) {
-                ret = in4_pton(cp, -1 /* len */, dst , '\\', NULL);
-        } else if ( address_family == AF_INET6 ) {
+        if (address_family == AF_INET) {
+                ret = in4_pton(cp, -1 /* len */, dst, '\\', NULL);
+                if (ret == 0) {
+                        if (canonicalize_unc(cp))
+                                ret = in4_pton(cp, -1, dst, '\\', NULL);
+                }
+        } else if (address_family == AF_INET6) {
                 ret = in6_pton(cp, -1 /* len */, dst , '\\', NULL);
         }
 #ifdef CONFIG_CIFS_DEBUG2
@@ -270,7 +306,7 @@ static const struct {
          from NT_STATUS_NO_SUCH_USER to NT_STATUS_LOGON_FAILURE
          during the session setup } */
         {
-        ERRDOS, ERRnoaccess, NT_STATUS_NO_SUCH_USER}, {
+        ERRDOS, ERRnoaccess, NT_STATUS_NO_SUCH_USER}, { /* could map to 2238 */
         ERRHRD, ERRgeneral, NT_STATUS_GROUP_EXISTS}, {
         ERRHRD, ERRgeneral, NT_STATUS_NO_SUCH_GROUP}, {
         ERRHRD, ERRgeneral, NT_STATUS_MEMBER_IN_GROUP}, {
@@ -285,10 +321,10 @@ static const struct {
         ERRHRD, ERRgeneral, NT_STATUS_PASSWORD_RESTRICTION}, {
         ERRDOS, ERRnoaccess, NT_STATUS_LOGON_FAILURE}, {
         ERRHRD, ERRgeneral, NT_STATUS_ACCOUNT_RESTRICTION}, {
-        ERRSRV, 2241, NT_STATUS_INVALID_LOGON_HOURS}, {
-        ERRSRV, 2240, NT_STATUS_INVALID_WORKSTATION}, {
+        ERRSRV, ERRbadLogonTime, NT_STATUS_INVALID_LOGON_HOURS}, {
+        ERRSRV, ERRbadclient, NT_STATUS_INVALID_WORKSTATION}, {
         ERRSRV, ERRpasswordExpired, NT_STATUS_PASSWORD_EXPIRED}, {
-        ERRSRV, 2239, NT_STATUS_ACCOUNT_DISABLED}, {
+        ERRSRV, ERRaccountexpired, NT_STATUS_ACCOUNT_DISABLED}, {
         ERRHRD, ERRgeneral, NT_STATUS_NONE_MAPPED}, {
         ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_LUIDS_REQUESTED}, {
         ERRHRD, ERRgeneral, NT_STATUS_LUIDS_EXHAUSTED}, {
@@ -585,7 +621,7 @@ static const struct {
         ERRDOS, ERRnoaccess, NT_STATUS_TRUST_FAILURE}, {
         ERRHRD, ERRgeneral, NT_STATUS_MUTANT_LIMIT_EXCEEDED}, {
         ERRDOS, ERRnetlogonNotStarted, NT_STATUS_NETLOGON_NOT_STARTED}, {
-        ERRSRV, 2239, NT_STATUS_ACCOUNT_EXPIRED}, {
+        ERRSRV, ERRaccountexpired, NT_STATUS_ACCOUNT_EXPIRED}, {
         ERRHRD, ERRgeneral, NT_STATUS_POSSIBLE_DEADLOCK}, {
         ERRHRD, ERRgeneral, NT_STATUS_NETWORK_CREDENTIAL_CONFLICT}, {
         ERRHRD, ERRgeneral, NT_STATUS_REMOTE_SESSION_LIMIT}, {
@@ -734,7 +770,7 @@ cifs_print_status(__u32 status_code)
 
 
 static void
-ntstatus_to_dos(__u32 ntstatus, __u8 * eclass, __u16 * ecode)
+ntstatus_to_dos(__u32 ntstatus, __u8 *eclass, __u16 *ecode)
 {
         int i;
         if (ntstatus == 0) {
@@ -754,7 +790,7 @@ ntstatus_to_dos(__u32 ntstatus, __u8 * eclass, __u16 * ecode)
 }
 
 int
-map_smb_to_linux_error(struct smb_hdr *smb)
+map_smb_to_linux_error(struct smb_hdr *smb, int logErr)
 {
         unsigned int i;
         int rc = -EIO;  /* if transport error smb error may not be set */
@@ -771,7 +807,9 @@ map_smb_to_linux_error(struct smb_hdr *smb)
                 /* translate the newer STATUS codes to old style SMB errors
                  * and then to POSIX errors */
                 __u32 err = le32_to_cpu(smb->Status.CifsError);
-                if (cifsFYI & CIFS_RC)
+                if (logErr && (err != (NT_STATUS_MORE_PROCESSING_REQUIRED)))
+                        cifs_print_status(err);
+                else if (cifsFYI & CIFS_RC)
                         cifs_print_status(err);
                 ntstatus_to_dos(err, &smberrclass, &smberrcode);
         } else {
@@ -785,8 +823,8 @@ map_smb_to_linux_error(struct smb_hdr *smb)
         if (smberrclass == ERRDOS) {  /* 1 byte field no need to byte reverse */
                 for (i = 0;
                      i <
-                     sizeof (mapping_table_ERRDOS) /
-                     sizeof (struct smb_to_posix_error); i++) {
+                     sizeof(mapping_table_ERRDOS) /
+                     sizeof(struct smb_to_posix_error); i++) {
                         if (mapping_table_ERRDOS[i].smb_err == 0)
                                 break;
                         else if (mapping_table_ERRDOS[i].smb_err ==
@@ -799,8 +837,8 @@ map_smb_to_linux_error(struct smb_hdr *smb)
         } else if (smberrclass == ERRSRV) {   /* server class of error codes */
                 for (i = 0;
                      i <
-                     sizeof (mapping_table_ERRSRV) /
-                     sizeof (struct smb_to_posix_error); i++) {
+                     sizeof(mapping_table_ERRSRV) /
+                     sizeof(struct smb_to_posix_error); i++) {
                         if (mapping_table_ERRSRV[i].smb_err == 0)
                                 break;
                         else if (mapping_table_ERRSRV[i].smb_err ==
@@ -813,7 +851,7 @@ map_smb_to_linux_error(struct smb_hdr *smb)
         }
         /* else ERRHRD class errors or junk  - return EIO */
 
-        cFYI(1, (" !!Mapping smb error code %d to POSIX err %d !!",
+        cFYI(1, ("Mapping smb error code %d to POSIX err %d",
                  smberrcode, rc));
 
         /* generic corrective action e.g. reconnect SMB session on
@@ -829,14 +867,14 @@ map_smb_to_linux_error(struct smb_hdr *smb)
 unsigned int
 smbCalcSize(struct smb_hdr *ptr)
 {
-        return (sizeof (struct smb_hdr) + (2 * ptr->WordCount) +
+        return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
                 2 /* size of the bcc field */ + BCC(ptr));
 }
 
 unsigned int
 smbCalcSize_LE(struct smb_hdr *ptr)
 {
-        return (sizeof (struct smb_hdr) + (2 * ptr->WordCount) +
+        return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
                 2 /* size of the bcc field */ + le16_to_cpu(BCC_LE(ptr)));
 }
 
@@ -899,8 +937,11 @@ struct timespec cnvrtDosUnixTm(__u16 date, __u16 time)
                 cERROR(1, ("illegal hours %d", st->Hours));
         days = sd->Day;
         month = sd->Month;
-        if ((days > 31) || (month > 12))
+        if ((days > 31) || (month > 12)) {
                 cERROR(1, ("illegal date, month %d day: %d", month, days));
+                if (month > 12)
+                        month = 12;
+        }
         month -= 1;
         days += total_days_of_prev_months[month];
         days += 3652; /* account for difference in days between 1980 and 1970 */
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 916df9431336..0f22def4bdff 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -121,7 +121,7 @@ static void AdjustForTZ(struct cifsTconInfo *tcon, struct inode *inode)
 
 
 static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
-                          char *buf, int *pobject_type, int isNewInode)
+                          char *buf, unsigned int *pobject_type, int isNewInode)
 {
         loff_t local_size;
         struct timespec local_mtime;
@@ -171,7 +171,13 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         /* Linux can not store file creation time unfortunately so ignore it */
 
         cifsInfo->cifsAttrs = attr;
-        cifsInfo->time = jiffies;
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+                /* get more accurate mode via ACL - so force inode refresh */
+                cifsInfo->time = 0;
+        } else
+#endif /* CONFIG_CIFS_EXPERIMENTAL */
+                cifsInfo->time = jiffies;
 
         /* treat dos attribute of read-only as read-only mode bit e.g. 555? */
         /* 2767 perms - indicate mandatory locking */
@@ -294,7 +300,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
 }
 
 static void unix_fill_in_inode(struct inode *tmp_inode,
-        FILE_UNIX_INFO *pfindData, int *pobject_type, int isNewInode)
+        FILE_UNIX_INFO *pfindData, unsigned int *pobject_type, int isNewInode)
 {
         loff_t local_size;
         struct timespec local_mtime;
@@ -495,7 +501,7 @@ ffirst_retry:
 static int cifs_unicode_bytelen(char *str)
 {
         int len;
-        __le16 * ustr = (__le16 *)str;
+        __le16 *ustr = (__le16 *)str;
 
         for (len = 0; len <= PATH_MAX; len++) {
                 if (ustr[len] == 0)
@@ -826,7 +832,7 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
         int rc = 0;
         struct qstr qstring;
         struct cifsFileInfo *pCifsF;
-        unsigned obj_type;
+        unsigned int obj_type;
         ino_t  inum;
         struct cifs_sb_info *cifs_sb;
         struct inode *tmp_inode;
@@ -1067,7 +1073,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                 for (i = 0; (i < num_to_fill) && (rc == 0); i++) {
                         if (current_entry == NULL) {
                                 /* evaluate whether this case is an error */
-                                cERROR(1,("past end of SMB num to fill %d i %d",
+                                cERROR(1, ("past SMB end,  num to fill %d i %d",
                                           num_to_fill, i));
                                 break;
                         }
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 892be9b4d1f3..d0cb469daab7 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -29,6 +29,7 @@
 #include "ntlmssp.h"
 #include "nterr.h"
 #include <linux/utsname.h>
+#include "cifs_spnego.h"
 
 extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
                          unsigned char *p24);
@@ -67,14 +68,59 @@ static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
                 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
                 capabilities |= CAP_DFS;
         }
-        if (ses->capabilities & CAP_UNIX) {
+        if (ses->capabilities & CAP_UNIX)
                 capabilities |= CAP_UNIX;
-        }
 
         /* BB check whether to init vcnum BB */
         return capabilities;
 }
 
+static void
+unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
+{
+        char *bcc_ptr = *pbcc_area;
+        int bytes_ret = 0;
+
+        /* Copy OS version */
+        bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
+                                  nls_cp);
+        bcc_ptr += 2 * bytes_ret;
+        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release,
+                                  32, nls_cp);
+        bcc_ptr += 2 * bytes_ret;
+        bcc_ptr += 2; /* trailing null */
+
+        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
+                                  32, nls_cp);
+        bcc_ptr += 2 * bytes_ret;
+        bcc_ptr += 2; /* trailing null */
+
+        *pbcc_area = bcc_ptr;
+}
+
+static void unicode_domain_string(char **pbcc_area, struct cifsSesInfo *ses,
+                                   const struct nls_table *nls_cp)
+{
+        char *bcc_ptr = *pbcc_area;
+        int bytes_ret = 0;
+
+        /* copy domain */
+        if (ses->domainName == NULL) {
+                /* Sending null domain better than using a bogus domain name (as
+                we did briefly in 2.6.18) since server will use its default */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
+                bytes_ret = 0;
+        } else
+                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
+                                          256, nls_cp);
+        bcc_ptr += 2 * bytes_ret;
+        bcc_ptr += 2;  /* account for null terminator */
+
+        *pbcc_area = bcc_ptr;
+}
+
+
 static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
                                    const struct nls_table *nls_cp)
 {
@@ -100,32 +146,9 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
         }
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* account for null termination */
-        /* copy domain */
-        if (ses->domainName == NULL) {
-                /* Sending null domain better than using a bogus domain name (as
-                we did briefly in 2.6.18) since server will use its default */
-                *bcc_ptr = 0;
-                *(bcc_ptr+1) = 0;
-                bytes_ret = 0;
-        } else
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
-                                          256, nls_cp);
-        bcc_ptr += 2 * bytes_ret;
-        bcc_ptr += 2;  /* account for null terminator */
 
-        /* Copy OS version */
-        bytes_ret = cifs_strtoUCS((__le16 *)bcc_ptr, "Linux version ", 32,
-                                  nls_cp);
-        bcc_ptr += 2 * bytes_ret;
-        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, init_utsname()->release,
-                                  32, nls_cp);
-        bcc_ptr += 2 * bytes_ret;
-        bcc_ptr += 2; /* trailing null */
-
-        bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
-                                  32, nls_cp);
-        bcc_ptr += 2 * bytes_ret;
-        bcc_ptr += 2; /* trailing null */
+        unicode_domain_string(&bcc_ptr, ses, nls_cp);
+        unicode_oslm_strings(&bcc_ptr, nls_cp);
 
         *pbcc_area = bcc_ptr;
 }
@@ -203,14 +226,11 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         if (len >= words_left)
                 return rc;
 
-        if (ses->serverOS)
-                kfree(ses->serverOS);
+        kfree(ses->serverOS);
         /* UTF-8 string will not grow more than four times as big as UCS-16 */
         ses->serverOS = kzalloc(4 * len, GFP_KERNEL);
-        if (ses->serverOS != NULL) {
-                cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len,
-                                   nls_cp);
-        }
+        if (ses->serverOS != NULL)
+                cifs_strfromUCS_le(ses->serverOS, (__le16 *)data, len, nls_cp);
         data += 2 * (len + 1);
         words_left -= len + 1;
 
@@ -220,8 +240,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         if (len >= words_left)
                 return rc;
 
-        if (ses->serverNOS)
-                kfree(ses->serverNOS);
+        kfree(ses->serverNOS);
         ses->serverNOS = kzalloc(4 * len, GFP_KERNEL); /* BB this is wrong length FIXME BB */
         if (ses->serverNOS != NULL) {
                 cifs_strfromUCS_le(ses->serverNOS, (__le16 *)data, len,
@@ -240,8 +259,7 @@ static int decode_unicode_ssetup(char **pbcc_area, int bleft,
         if (len > words_left)
                 return rc;
 
-        if (ses->serverDomain)
-                kfree(ses->serverDomain);
+        kfree(ses->serverDomain);
         ses->serverDomain = kzalloc(2 * (len + 1), GFP_KERNEL); /* BB FIXME wrong length */
         if (ses->serverDomain != NULL) {
                 cifs_strfromUCS_le(ses->serverDomain, (__le16 *)data, len,
@@ -271,8 +289,7 @@ static int decode_ascii_ssetup(char **pbcc_area, int bleft,
         if (len >= bleft)
                 return rc;
 
-        if (ses->serverOS)
-                kfree(ses->serverOS);
+        kfree(ses->serverOS);
 
         ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
         if (ses->serverOS)
@@ -289,8 +306,7 @@ static int decode_ascii_ssetup(char **pbcc_area, int bleft,
         if (len >= bleft)
                 return rc;
 
-        if (ses->serverNOS)
-                kfree(ses->serverNOS);
+        kfree(ses->serverNOS);
 
         ses->serverNOS = kzalloc(len + 1, GFP_KERNEL);
         if (ses->serverNOS)
@@ -325,11 +341,12 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
         SESSION_SETUP_ANDX *pSMB;
         __u32 capabilities;
         int count;
-        int resp_buf_type = 0;
-        struct kvec iov[2];
+        int resp_buf_type;
+        struct kvec iov[3];
         enum securityEnum type;
         __u16 action;
         int bytes_remaining;
+        struct key *spnego_key = NULL;
 
         if (ses == NULL)
                 return -EINVAL;
@@ -362,24 +379,32 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
 
         capabilities = cifs_ssetup_hdr(ses, pSMB);
 
-        /* we will send the SMB in two pieces,
-        a fixed length beginning part, and a
-        second part which will include the strings
-        and rest of bcc area, in order to avoid having
-        to do a large buffer 17K allocation */
+        /* we will send the SMB in three pieces:
+        a fixed length beginning part, an optional
+        SPNEGO blob (which can be zero length), and a
+        last part which will include the strings
+        and rest of bcc area. This allows us to avoid
+        a large buffer 17K allocation */
         iov[0].iov_base = (char *)pSMB;
         iov[0].iov_len = smb_buf->smb_buf_length + 4;
 
+        /* setting this here allows the code at the end of the function
+           to free the request buffer if there's an error */
+        resp_buf_type = CIFS_SMALL_BUFFER;
+
         /* 2000 big enough to fit max user, domain, NOS name etc. */
         str_area = kmalloc(2000, GFP_KERNEL);
         if (str_area == NULL) {
-                cifs_small_buf_release(smb_buf);
-                return -ENOMEM;
+                rc = -ENOMEM;
+                goto ssetup_exit;
         }
         bcc_ptr = str_area;
 
         ses->flags &= ~CIFS_SES_LANMAN;
 
+        iov[1].iov_base = NULL;
+        iov[1].iov_len = 0;
+
         if (type == LANMAN) {
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
                 char lnm_session_key[CIFS_SESS_KEY_SIZE];
@@ -448,8 +473,8 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
                    struct ntlmv2_resp */
 
                 if (v2_sess_key == NULL) {
-                        cifs_small_buf_release(smb_buf);
-                        return -ENOMEM;
+                        rc = -ENOMEM;
+                        goto ssetup_exit;
                 }
 
                 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
@@ -479,25 +504,72 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
                 if (ses->capabilities & CAP_UNICODE) {
                         if (iov[0].iov_len % 2) {
                                 *bcc_ptr = 0;
-                        }       bcc_ptr++;
+                                bcc_ptr++;
+                        }
                         unicode_ssetup_strings(&bcc_ptr, ses, nls_cp);
                 } else
                         ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
-        } else /* NTLMSSP or SPNEGO */ {
+        } else if (type == Kerberos) {
+#ifdef CONFIG_CIFS_UPCALL
+                struct cifs_spnego_msg *msg;
+                spnego_key = cifs_get_spnego_key(ses);
+                if (IS_ERR(spnego_key)) {
+                        rc = PTR_ERR(spnego_key);
+                        spnego_key = NULL;
+                        goto ssetup_exit;
+                }
+
+                msg = spnego_key->payload.data;
+                /* bail out if key is too long */
+                if (msg->sesskey_len >
+                    sizeof(ses->server->mac_signing_key.data.krb5)) {
+                        cERROR(1, ("Kerberos signing key too long (%u bytes)",
+                                msg->sesskey_len));
+                        rc = -EOVERFLOW;
+                        goto ssetup_exit;
+                }
+                ses->server->mac_signing_key.len = msg->sesskey_len;
+                memcpy(ses->server->mac_signing_key.data.krb5, msg->data,
+                        msg->sesskey_len);
                 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
                 capabilities |= CAP_EXTENDED_SECURITY;
                 pSMB->req.Capabilities = cpu_to_le32(capabilities);
-                /* BB set password lengths */
+                iov[1].iov_base = msg->data + msg->sesskey_len;
+                iov[1].iov_len = msg->secblob_len;
+                pSMB->req.SecurityBlobLength = cpu_to_le16(iov[1].iov_len);
+
+                if (ses->capabilities & CAP_UNICODE) {
+                        /* unicode strings must be word aligned */
+                        if (iov[0].iov_len % 2) {
+                                *bcc_ptr = 0;
+                                bcc_ptr++;
+                        }
+                        unicode_oslm_strings(&bcc_ptr, nls_cp);
+                        unicode_domain_string(&bcc_ptr, ses, nls_cp);
+                } else
+                /* BB: is this right? */
+                        ascii_ssetup_strings(&bcc_ptr, ses, nls_cp);
+#else /* ! CONFIG_CIFS_UPCALL */
+                cERROR(1, ("Kerberos negotiated but upcall support disabled!"));
+                rc = -ENOSYS;
+                goto ssetup_exit;
+#endif /* CONFIG_CIFS_UPCALL */
+        } else {
+                cERROR(1, ("secType %d not supported!", type));
+                rc = -ENOSYS;
+                goto ssetup_exit;
         }
 
-        count = (long) bcc_ptr - (long) str_area;
+        iov[2].iov_base = str_area;
+        iov[2].iov_len = (long) bcc_ptr - (long) str_area;
+
+        count = iov[1].iov_len + iov[2].iov_len;
         smb_buf->smb_buf_length += count;
 
         BCC_LE(smb_buf) = cpu_to_le16(count);
 
-        iov[1].iov_base = str_area;
-        iov[1].iov_len = count;
-        rc = SendReceive2(xid, ses, iov, 2 /* num_iovecs */, &resp_buf_type, 0);
+        rc = SendReceive2(xid, ses, iov, 3 /* num_iovecs */, &resp_buf_type,
+                          CIFS_STD_OP /* not long */ | CIFS_LOG_ERROR);
         /* SMB request buf freed in SendReceive2 */
 
         cFYI(1, ("ssetup rc from sendrecv2 is %d", rc));
@@ -543,6 +615,8 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
                                          ses, nls_cp);
 
 ssetup_exit:
+        if (spnego_key)
+                key_put(spnego_key);
         kfree(str_area);
         if (resp_buf_type == CIFS_SMALL_BUFFER) {
                 cFYI(1, ("ssetup freeing small buf %p", iov[0].iov_base));
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 90542a39be17..58bbfd992cc0 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -80,7 +80,7 @@ SMBencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 
 /* Routines for Windows NT MD4 Hash functions. */
 static int
-_my_wcslen(__u16 * str)
+_my_wcslen(__u16 *str)
 {
         int len = 0;
         while (*str++ != 0)
@@ -96,7 +96,7 @@ _my_wcslen(__u16 * str)
  */
 
 static int
-_my_mbstowcs(__u16 * dst, const unsigned char *src, int len)
+_my_mbstowcs(__u16 *dst, const unsigned char *src, int len)
 {       /* BB not a very good conversion routine - change/fix */
         int i;
         __u16 val;
@@ -125,9 +125,9 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
         /* Password cannot be longer than 128 characters */
         if (passwd) {
                 len = strlen((char *) passwd);
-                if (len > 128) {
+                if (len > 128)
                         len = 128;
-                }
+
                 /* Password must be converted to NT unicode */
                 _my_mbstowcs(wpwd, passwd, len);
         } else
@@ -135,7 +135,7 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
 
         wpwd[len] = 0;  /* Ensure string is null terminated */
         /* Calculate length in bytes */
-        len = _my_wcslen(wpwd) * sizeof (__u16);
+        len = _my_wcslen(wpwd) * sizeof(__u16);
 
         mdfour(p16, (unsigned char *) wpwd, len);
         memset(wpwd, 0, 129 * 2);
@@ -167,7 +167,7 @@ nt_lm_owf_gen(char *pwd, unsigned char nt_p16[16], unsigned char p16[16])
         E_P16((unsigned char *) passwd, (unsigned char *) p16);
 
         /* clear out local copy of user's password (just being paranoid). */
-        memset(passwd, '\0', sizeof (passwd));
+        memset(passwd, '\0', sizeof(passwd));
 }
 #endif
 
@@ -189,8 +189,10 @@ ntv2_owf_gen(const unsigned char owf[16], const char *user_n,
                 return;
         dom_u = user_u + 1024;
 
-        /* push_ucs2(NULL, user_u, user_n, (user_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
-           push_ucs2(NULL, dom_u, domain_n, (domain_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER); */
+        /* push_ucs2(NULL, user_u, user_n, (user_l+1)*2,
+                        STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
+           push_ucs2(NULL, dom_u, domain_n, (domain_l+1)*2,
+                        STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER); */
 
         /* BB user and domain may need to be uppercased */
         user_l = cifs_strtoUCS(user_u, user_n, 511, nls_codepage);
diff --git a/fs/cifs/smberr.h b/fs/cifs/smberr.h
index 2ef0be288820..7f50e8577c1c 100644
--- a/fs/cifs/smberr.h
+++ b/fs/cifs/smberr.h
@@ -173,9 +173,10 @@
 #define ERRusestd               251     /* temporarily unable to use either raw
                                            or mpx */
 #define ERR_NOTIFY_ENUM_DIR     1024
+#define ERRnoSuchUser           2238    /* user account does not exist */
 #define ERRaccountexpired       2239
-#define ERRbadclient            2240
-#define ERRbadLogonTime         2241
+#define ERRbadclient            2240    /* can not logon from this client */
+#define ERRbadLogonTime         2241    /* logon hours do not allow this */
 #define ERRpasswordExpired      2242
 #define ERRnetlogonNotStarted   2455
 #define ERRnosupport            0xFFFF
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 746bc9405db1..50b623ad9320 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -55,7 +55,7 @@ AllocMidQEntry(const struct smb_hdr *smb_buffer, struct cifsSesInfo *ses)
         if (temp == NULL)
                 return temp;
         else {
-                memset(temp, 0, sizeof (struct mid_q_entry));
+                memset(temp, 0, sizeof(struct mid_q_entry));
                 temp->mid = smb_buffer->Mid;    /* always LE */
                 temp->pid = current->pid;
                 temp->command = smb_buffer->Command;
@@ -158,7 +158,7 @@ smb_send(struct socket *ssocket, struct smb_hdr *smb_buffer,
         iov.iov_len = len;
 
         smb_msg.msg_name = sin;
-        smb_msg.msg_namelen = sizeof (struct sockaddr);
+        smb_msg.msg_namelen = sizeof(struct sockaddr);
         smb_msg.msg_control = NULL;
         smb_msg.msg_controllen = 0;
         smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; /* BB add more flags?*/
@@ -228,7 +228,7 @@ smb_send2(struct socket *ssocket, struct kvec *iov, int n_vec,
                 return -ENOTSOCK; /* BB eventually add reconnect code here */
 
         smb_msg.msg_name = sin;
-        smb_msg.msg_namelen = sizeof (struct sockaddr);
+        smb_msg.msg_namelen = sizeof(struct sockaddr);
         smb_msg.msg_control = NULL;
         smb_msg.msg_controllen = 0;
         smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; /* BB add more flags?*/
@@ -308,7 +308,7 @@ smb_send2(struct socket *ssocket, struct kvec *iov, int n_vec,
 
 static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
 {
-        if (long_op == -1) {
+        if (long_op == CIFS_ASYNC_OP) {
                 /* oplock breaks must not be held up */
                 atomic_inc(&ses->server->inFlight);
         } else {
@@ -337,7 +337,7 @@ static int wait_for_free_request(struct cifsSesInfo *ses, const int long_op)
                                    as they are allowed to block on server */
 
                                 /* update # of requests on the wire to server */
-                                if (long_op < 3)
+                                if (long_op != CIFS_BLOCKING_OP)
                                         atomic_inc(&ses->server->inFlight);
                                 spin_unlock(&GlobalMid_Lock);
                                 break;
@@ -363,9 +363,8 @@ static int allocate_mid(struct cifsSesInfo *ses, struct smb_hdr *in_buf,
                 } /* else ok - we are setting up session */
         }
         *ppmidQ = AllocMidQEntry(in_buf, ses);
-        if (*ppmidQ == NULL) {
+        if (*ppmidQ == NULL)
                 return -ENOMEM;
-        }
         return 0;
 }
 
@@ -416,17 +415,48 @@ static int wait_for_response(struct cifsSesInfo *ses,
         }
 }
 
+
+/*
+ *
+ * Send an SMB Request.  No response info (other than return code)
+ * needs to be parsed.
+ *
+ * flags indicate the type of request buffer and how long to wait
+ * and whether to log NT STATUS code (error) before mapping it to POSIX error
+ *
+ */
+int
+SendReceiveNoRsp(const unsigned int xid, struct cifsSesInfo *ses,
+                struct smb_hdr *in_buf, int flags)
+{
+        int rc;
+        struct kvec iov[1];
+        int resp_buf_type;
+
+        iov[0].iov_base = (char *)in_buf;
+        iov[0].iov_len = in_buf->smb_buf_length + 4;
+        flags |= CIFS_NO_RESP;
+        rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags);
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("SendRcvNoR flags %d rc %d", flags, rc));
+#endif
+        return rc;
+}
+
 int
 SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
              struct kvec *iov, int n_vec, int *pRespBufType /* ret */,
-             const int long_op)
+             const int flags)
 {
         int rc = 0;
+        int long_op;
         unsigned int receive_len;
         unsigned long timeout;
         struct mid_q_entry *midQ;
         struct smb_hdr *in_buf = iov[0].iov_base;
 
+        long_op = flags & CIFS_TIMEOUT_MASK;
+
         *pRespBufType = CIFS_NO_BUFFER;  /* no response buf yet */
 
         if ((ses == NULL) || (ses->server == NULL)) {
@@ -465,7 +495,6 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                 wake_up(&ses->server->request_q);
                 return rc;
         }
-
         rc = cifs_sign_smb2(iov, n_vec, ses->server, &midQ->sequence_number);
 
         midQ->midState = MID_REQUEST_SUBMITTED;
@@ -485,15 +514,22 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         if (rc < 0)
                 goto out;
 
-        if (long_op == -1)
-                goto out;
-        else if (long_op == 2) /* writes past end of file can take loong time */
+        if (long_op == CIFS_STD_OP)
+                timeout = 15 * HZ;
+        else if (long_op == CIFS_VLONG_OP) /* e.g. slow writes past EOF */
                 timeout = 180 * HZ;
-        else if (long_op == 1)
+        else if (long_op == CIFS_LONG_OP)
                 timeout = 45 * HZ; /* should be greater than
                         servers oplock break timeout (about 43 seconds) */
-        else
-                timeout = 15 * HZ;
+        else if (long_op == CIFS_ASYNC_OP)
+                goto out;
+        else if (long_op == CIFS_BLOCKING_OP)
+                timeout = 0x7FFFFFFF; /*  large, but not so large as to wrap */
+        else {
+                cERROR(1, ("unknown timeout flag %d", long_op));
+                rc = -EIO;
+                goto out;
+        }
 
         /* wait for 15 seconds or until woken up due to response arriving or
            due to last connection to this server being unmounted */
@@ -568,18 +604,19 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                         }
 
                         /* BB special case reconnect tid and uid here? */
-                        /* BB special case Errbadpassword and pwdexpired here */
-                        rc = map_smb_to_linux_error(midQ->resp_buf);
+                        rc = map_smb_to_linux_error(midQ->resp_buf,
+                                                flags & CIFS_LOG_ERROR);
 
                         /* convert ByteCount if necessary */
-                        if (receive_len >=
-                            sizeof (struct smb_hdr) -
-                            4 /* do not count RFC1001 header */  +
+                        if (receive_len >= sizeof(struct smb_hdr) - 4
+                            /* do not count RFC1001 header */  +
                             (2 * midQ->resp_buf->WordCount) + 2 /* bcc */ )
                                 BCC(midQ->resp_buf) =
                                         le16_to_cpu(BCC_LE(midQ->resp_buf));
-                        midQ->resp_buf = NULL;  /* mark it so will not be freed
-                                                by DeleteMidQEntry */
+                        if ((flags & CIFS_NO_RESP) == 0)
+                                midQ->resp_buf = NULL;  /* mark it so buf will
+                                                           not be freed by
+                                                           DeleteMidQEntry */
                 } else {
                         rc = -EIO;
                         cFYI(1, ("Bad MID state?"));
@@ -667,17 +704,25 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
         if (rc < 0)
                 goto out;
 
-        if (long_op == -1)
+        if (long_op == CIFS_STD_OP)
+                timeout = 15 * HZ;
+        /* wait for 15 seconds or until woken up due to response arriving or
+           due to last connection to this server being unmounted */
+        else if (long_op == CIFS_ASYNC_OP)
                 goto out;
-        else if (long_op == 2) /* writes past end of file can take loong time */
+        else if (long_op == CIFS_VLONG_OP) /* writes past EOF can be slow */
                 timeout = 180 * HZ;
-        else if (long_op == 1)
+        else if (long_op == CIFS_LONG_OP)
                 timeout = 45 * HZ; /* should be greater than
                         servers oplock break timeout (about 43 seconds) */
-        else
-                timeout = 15 * HZ;
-        /* wait for 15 seconds or until woken up due to response arriving or
-           due to last connection to this server being unmounted */
+        else if (long_op == CIFS_BLOCKING_OP)
+                timeout = 0x7FFFFFFF; /* large but no so large as to wrap */
+        else {
+                cERROR(1, ("unknown timeout flag %d", long_op));
+                rc = -EIO;
+                goto out;
+        }
+
         if (signal_pending(current)) {
                 /* if signal pending do not hold up user for full smb timeout
                 but we still give response a chance to complete */
@@ -749,12 +794,11 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                         *pbytes_returned = out_buf->smb_buf_length;
 
                         /* BB special case reconnect tid and uid here? */
-                        rc = map_smb_to_linux_error(out_buf);
+                        rc = map_smb_to_linux_error(out_buf, 0 /* no log */ );
 
                         /* convert ByteCount if necessary */
-                        if (receive_len >=
-                            sizeof (struct smb_hdr) -
-                            4 /* do not count RFC1001 header */  +
+                        if (receive_len >= sizeof(struct smb_hdr) - 4
+                            /* do not count RFC1001 header */  +
                             (2 * out_buf->WordCount) + 2 /* bcc */ )
                                 BCC(out_buf) = le16_to_cpu(BCC_LE(out_buf));
                 } else {
@@ -817,7 +861,7 @@ send_lock_cancel(const unsigned int xid, struct cifsTconInfo *tcon,
         pSMB->hdr.Mid = GetNextMid(ses->server);
 
         return SendReceive(xid, ses, in_buf, out_buf,
-                        &bytes_returned, 0);
+                        &bytes_returned, CIFS_STD_OP);
 }
 
 int
@@ -849,7 +893,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
            to the same server. We may make this configurable later or
            use ses->maxReq */
 
-        rc = wait_for_free_request(ses, 3);
+        rc = wait_for_free_request(ses, CIFS_BLOCKING_OP);
         if (rc)
                 return rc;
 
@@ -993,12 +1037,11 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
                         *pbytes_returned = out_buf->smb_buf_length;
 
                         /* BB special case reconnect tid and uid here? */
-                        rc = map_smb_to_linux_error(out_buf);
+                        rc = map_smb_to_linux_error(out_buf, 0 /* no log */ );
 
                         /* convert ByteCount if necessary */
-                        if (receive_len >=
-                            sizeof (struct smb_hdr) -
-                            4 /* do not count RFC1001 header */  +
+                        if (receive_len >= sizeof(struct smb_hdr) - 4
+                            /* do not count RFC1001 header */  +
                             (2 * out_buf->WordCount) + 2 /* bcc */ )
                                 BCC(out_buf) = le16_to_cpu(BCC_LE(out_buf));
                 } else {
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index f61e433d281c..54e8ef96cb79 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -261,21 +261,27 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                                 cifs_sb->local_nls,
                                 cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
-/*              else if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+                else if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
                         __u16 fid;
                         int oplock = FALSE;
-                        rc = CIFSSMBOpen(xid, pTcon, full_path,
-                                         FILE_OPEN, GENERIC_READ, 0, &fid,
-                                         &oplock, NULL, cifs_sb->local_nls,
-                                         cifs_sb->mnt_cifs_flags &
-                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
-                        if(rc == 0) {
-                                rc = CIFSSMBGetCIFSACL(xid, pTcon, fid,
-                                        ea_value, buf_size,
-                                        ACL_TYPE_ACCESS);
+                        struct cifs_ntsd *pacl = NULL;
+                        __u32 buflen = 0;
+                        if (experimEnabled)
+                                rc = CIFSSMBOpen(xid, pTcon, full_path,
+                                        FILE_OPEN, GENERIC_READ, 0, &fid,
+                                        &oplock, NULL, cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags &
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                        /* else rc is EOPNOTSUPP from above */
+
+                        if (rc == 0) {
+                                rc = CIFSSMBGetCIFSACL(xid, pTcon, fid, &pacl,
+                                                      &buflen);
                                 CIFSSMBClose(xid, pTcon, fid);
                         }
-                } */  /* BB enable after fixing up return data */
+                }
+#endif /* EXPERIMENTAL */
 #else
                 cFYI(1, ("query POSIX ACL not supported yet"));
 #endif /* CONFIG_CIFS_POSIX */
diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c
index cdb4c07a7870..359e531094dd 100644
--- a/fs/coda/upcall.c
+++ b/fs/coda/upcall.c
@@ -51,7 +51,7 @@ static void *alloc_upcall(int opcode, int size)
 
         inp->ih.opcode = opcode;
         inp->ih.pid = current->pid;
-        inp->ih.pgid = process_group(current);
+        inp->ih.pgid = task_pgrp_nr(current);
 #ifdef CONFIG_CODA_FS_OLD_API
         memset(&inp->ih.cred, 0, sizeof(struct coda_cred));
         inp->ih.cred.cr_fsuid = current->fsuid;
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index a4284ccac1f9..e8b7c3a98a54 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -322,7 +322,7 @@ static int dev_ifname32(unsigned int fd, unsigned int cmd, unsigned long arg)
         int err;
 
         uifr = compat_alloc_user_space(sizeof(struct ifreq));
-        if (copy_in_user(uifr, compat_ptr(arg), sizeof(struct ifreq32)));
+        if (copy_in_user(uifr, compat_ptr(arg), sizeof(struct ifreq32)))
                 return -EFAULT;
 
         err = sys_ioctl(fd, SIOCGIFNAME, (unsigned long)uifr);
@@ -1954,6 +1954,12 @@ ULONG_IOCTL(TIOCSCTTY)
 COMPATIBLE_IOCTL(TIOCGPTN)
 COMPATIBLE_IOCTL(TIOCSPTLCK)
 COMPATIBLE_IOCTL(TIOCSERGETLSR)
+#ifdef TCGETS2
+COMPATIBLE_IOCTL(TCGETS2)
+COMPATIBLE_IOCTL(TCSETS2)
+COMPATIBLE_IOCTL(TCSETSW2)
+COMPATIBLE_IOCTL(TCSETSF2)
+#endif
 /* Little f */
 COMPATIBLE_IOCTL(FIOCLEX)
 COMPATIBLE_IOCTL(FIONCLEX)
diff --git a/fs/dcache.c b/fs/dcache.c
index 5489b2d98a00..d9ca1e5ceb92 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -38,7 +38,7 @@ int sysctl_vfs_cache_pressure __read_mostly = 100;
 EXPORT_SYMBOL_GPL(sysctl_vfs_cache_pressure);
 
  __cacheline_aligned_in_smp DEFINE_SPINLOCK(dcache_lock);
-static __cacheline_aligned_in_smp DEFINE_SEQLOCK(rename_lock);
+__cacheline_aligned_in_smp DEFINE_SEQLOCK(rename_lock);
 
 EXPORT_SYMBOL(dcache_lock);
 
@@ -1479,6 +1479,8 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
                          * dentry:internal, target:external.  Steal target's
                          * storage and make target internal.
                          */
+                        memcpy(target->d_iname, dentry->d_name.name,
+                                        dentry->d_name.len + 1);
                         dentry->d_name.name = target->d_name.name;
                         target->d_name.name = target->d_iname;
                 }
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 11be8a325e26..6a713b33992f 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -413,7 +413,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
         d_move(old_dentry, dentry);
         fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name,
                 old_dentry->d_name.name, S_ISDIR(old_dentry->d_inode->i_mode),
-                NULL, old_dentry->d_inode);
+                NULL, old_dentry);
         fsnotify_oldname_free(old_name);
         unlock_rename(new_dir, old_dir);
         dput(dentry);
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 58bf3f5cdbe2..e9923ca9c2d9 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -1062,7 +1062,7 @@ static int sctp_listen_for_all(void)
         subscribe.sctp_shutdown_event = 1;
         subscribe.sctp_partial_delivery_event = 1;
 
-        result = kernel_setsockopt(sock, SOL_SOCKET, SO_RCVBUF,
+        result = kernel_setsockopt(sock, SOL_SOCKET, SO_RCVBUFFORCE,
                                  (char *)&bufsize, sizeof(bufsize));
         if (result)
                 log_print("Error increasing buffer space on socket %d", result);
@@ -1454,10 +1454,6 @@ int dlm_lowcomms_start(void)
         if (!con_cache)
                 goto out;
 
-        /* Set some sysctl minima */
-        if (sysctl_rmem_max < NEEDED_RMEM)
-                sysctl_rmem_max = NEEDED_RMEM;
-
         /* Start listening */
         if (dlm_config.ci_protocol == 0)
                 error = tcp_listen_for_all();
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 6438941ab1f8..4f741546f4bb 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -456,7 +456,7 @@ static int check_version(struct dlm_write_request *req)
                 printk(KERN_DEBUG "dlm: process %s (%d) version mismatch "
                        "user (%d.%d.%d) kernel (%d.%d.%d)\n",
                        current->comm,
-                       current->pid,
+                       task_pid_nr(current),
                        req->version[0],
                        req->version[1],
                        req->version[2],
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 1ae90ef2c74d..bbed2fd40fdc 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -115,11 +115,29 @@ static int ecryptfs_calculate_md5(char *dst,
                 }
                 crypt_stat->hash_tfm = desc.tfm;
         }
-        crypto_hash_init(&desc);
-        crypto_hash_update(&desc, &sg, len);
-        crypto_hash_final(&desc, dst);
-        mutex_unlock(&crypt_stat->cs_hash_tfm_mutex);
+        rc = crypto_hash_init(&desc);
+        if (rc) {
+                printk(KERN_ERR
+                       "%s: Error initializing crypto hash; rc = [%d]\n",
+                       __FUNCTION__, rc);
+                goto out;
+        }
+        rc = crypto_hash_update(&desc, &sg, len);
+        if (rc) {
+                printk(KERN_ERR
+                       "%s: Error updating crypto hash; rc = [%d]\n",
+                       __FUNCTION__, rc);
+                goto out;
+        }
+        rc = crypto_hash_final(&desc, dst);
+        if (rc) {
+                printk(KERN_ERR
+                       "%s: Error finalizing crypto hash; rc = [%d]\n",
+                       __FUNCTION__, rc);
+                goto out;
+        }
 out:
+        mutex_unlock(&crypt_stat->cs_hash_tfm_mutex);
         return rc;
 }
 
@@ -279,13 +297,13 @@ int virt_to_scatterlist(const void *addr, int size, struct scatterlist *sg,
         int offset;
         int remainder_of_page;
 
+        sg_init_table(sg, sg_size);
+
         while (size > 0 && i < sg_size) {
                 pg = virt_to_page(addr);
                 offset = offset_in_page(addr);
-                if (sg) {
-                        sg[i].page = pg;
-                        sg[i].offset = offset;
-                }
+                if (sg)
+                        sg_set_page(&sg[i], pg, 0, offset);
                 remainder_of_page = PAGE_CACHE_SIZE - offset;
                 if (size >= remainder_of_page) {
                         if (sg)
@@ -504,7 +522,6 @@ int ecryptfs_encrypt_page(struct page *page)
                                         "\n", rc);
                         goto out;
                 }
-                extent_offset++;
         }
 out:
         kfree(enc_extent_virt);
@@ -640,7 +657,6 @@ int ecryptfs_decrypt_page(struct page *page)
                                "rc = [%d]\n", __FUNCTION__, rc);
                         goto out;
                 }
-                extent_offset++;
         }
 out:
         kfree(enc_extent_virt);
@@ -713,12 +729,11 @@ ecryptfs_encrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
 {
         struct scatterlist src_sg, dst_sg;
 
-        src_sg.page = src_page;
-        src_sg.offset = src_offset;
-        src_sg.length = size;
-        dst_sg.page = dst_page;
-        dst_sg.offset = dst_offset;
-        dst_sg.length = size;
+        sg_init_table(&src_sg, 1);
+        sg_init_table(&dst_sg, 1);
+
+        sg_set_page(&src_sg, src_page, size, src_offset);
+        sg_set_page(&dst_sg, dst_page, size, dst_offset);
         return encrypt_scatterlist(crypt_stat, &dst_sg, &src_sg, size, iv);
 }
 
@@ -742,12 +757,12 @@ ecryptfs_decrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
 {
         struct scatterlist src_sg, dst_sg;
 
-        src_sg.page = src_page;
-        src_sg.offset = src_offset;
-        src_sg.length = size;
-        dst_sg.page = dst_page;
-        dst_sg.offset = dst_offset;
-        dst_sg.length = size;
+        sg_init_table(&src_sg, 1);
+        sg_set_page(&src_sg, src_page, size, src_offset);
+
+        sg_init_table(&dst_sg, 1);
+        sg_set_page(&dst_sg, dst_page, size, dst_offset);
+
         return decrypt_scatterlist(crypt_stat, &dst_sg, &src_sg, size, iv);
 }
 
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 89d9710dd63d..263fed88c0ca 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1040,6 +1040,9 @@ decrypt_passphrase_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
         };
         int rc = 0;
 
+        sg_init_table(&dst_sg, 1);
+        sg_init_table(&src_sg, 1);
+
         if (unlikely(ecryptfs_verbosity > 0)) {
                 ecryptfs_printk(
                         KERN_DEBUG, "Session key encryption key (size [%d]):\n",
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index 2150edf9a58e..6b7474a4336a 100644
--- a/fs/ecryptfs/read_write.c
+++ b/fs/ecryptfs/read_write.c
@@ -87,7 +87,7 @@ int ecryptfs_write_lower_page_segment(struct inode *ecryptfs_inode,
         loff_t offset;
         int rc;
 
-        offset = ((((off_t)page_for_lower->index) << PAGE_CACHE_SHIFT)
+        offset = ((((loff_t)page_for_lower->index) << PAGE_CACHE_SHIFT)
                   + offset_in_page);
         virt = kmap(page_for_lower);
         rc = ecryptfs_write_lower(ecryptfs_inode, virt, offset, size);
diff --git a/fs/efs/namei.c b/fs/efs/namei.c
index 5276b19423c1..f7f407075be1 100644
--- a/fs/efs/namei.c
+++ b/fs/efs/namei.c
@@ -10,6 +10,8 @@
 #include <linux/string.h>
 #include <linux/efs_fs.h>
 #include <linux/smp_lock.h>
+#include <linux/exportfs.h>
+
 
 static efs_ino_t efs_find_entry(struct inode *inode, const char *name, int len) {
         struct buffer_head *bh;
@@ -75,13 +77,10 @@ struct dentry *efs_lookup(struct inode *dir, struct dentry *dentry, struct namei
         return NULL;
 }
 
-struct dentry *efs_get_dentry(struct super_block *sb, void *vobjp)
+static struct inode *efs_nfs_get_inode(struct super_block *sb, u64 ino,
+                u32 generation)
 {
-        __u32 *objp = vobjp;
-        unsigned long ino = objp[0];
-        __u32 generation = objp[1];
         struct inode *inode;
-        struct dentry *result;
 
         if (ino == 0)
                 return ERR_PTR(-ESTALE);
@@ -91,20 +90,25 @@ struct dentry *efs_get_dentry(struct super_block *sb, void *vobjp)
 
         if (is_bad_inode(inode) ||
             (generation && inode->i_generation != generation)) {
-                result = ERR_PTR(-ESTALE);
-                goto out_iput;
+                iput(inode);
+                return ERR_PTR(-ESTALE);
         }
 
-        result = d_alloc_anon(inode);
-        if (!result) {
-                result = ERR_PTR(-ENOMEM);
-                goto out_iput;
-        }
-        return result;
+        return inode;
+}
 
- out_iput:
-        iput(inode);
-        return result;
+struct dentry *efs_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    efs_nfs_get_inode);
+}
+
+struct dentry *efs_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    efs_nfs_get_inode);
 }
 
 struct dentry *efs_get_parent(struct dentry *child)
diff --git a/fs/efs/super.c b/fs/efs/super.c
index 25d0326c5f1c..c79bc627f107 100644
--- a/fs/efs/super.c
+++ b/fs/efs/super.c
@@ -113,8 +113,9 @@ static const struct super_operations efs_superblock_operations = {
         .remount_fs     = efs_remount,
 };
 
-static struct export_operations efs_export_ops = {
-        .get_dentry     = efs_get_dentry,
+static const struct export_operations efs_export_ops = {
+        .fh_to_dentry   = efs_fh_to_dentry,
+        .fh_to_parent   = efs_fh_to_parent,
         .get_parent     = efs_get_parent,
 };
 
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index de6189291954..34f68f3a069a 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -325,15 +325,14 @@ static void ep_poll_safewake(struct poll_safewake *psw, wait_queue_head_t *wq)
         int wake_nests = 0;
         unsigned long flags;
         struct task_struct *this_task = current;
-        struct list_head *lsthead = &psw->wake_task_list, *lnk;
+        struct list_head *lsthead = &psw->wake_task_list;
         struct wake_task_node *tncur;
         struct wake_task_node tnode;
 
         spin_lock_irqsave(&psw->lock, flags);
 
         /* Try to see if the current task is already inside this wakeup call */
-        list_for_each(lnk, lsthead) {
-                tncur = list_entry(lnk, struct wake_task_node, llink);
+        list_for_each_entry(tncur, lsthead, llink) {
 
                 if (tncur->wq == wq ||
                     (tncur->task == this_task && ++wake_nests > EP_MAX_POLLWAKE_NESTS)) {
diff --git a/fs/exec.c b/fs/exec.c
index 070ddf13cb71..282240afe99e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -234,7 +234,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
         vma->vm_start = vma->vm_end - PAGE_SIZE;
 
         vma->vm_flags = VM_STACK_FLAGS;
-        vma->vm_page_prot = protection_map[vma->vm_flags & 0x7];
+        vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
         err = insert_vm_struct(mm, vma);
         if (err) {
                 up_write(&mm->mmap_sem);
@@ -775,8 +775,8 @@ static int de_thread(struct task_struct *tsk)
          * Reparenting needs write_lock on tasklist_lock,
          * so it is safe to do it under read_lock.
          */
-        if (unlikely(tsk->group_leader == child_reaper(tsk)))
-                tsk->nsproxy->pid_ns->child_reaper = tsk;
+        if (unlikely(tsk->group_leader == task_child_reaper(tsk)))
+                task_active_pid_ns(tsk)->child_reaper = tsk;
 
         zap_other_threads(tsk);
         read_unlock(&tasklist_lock);
@@ -841,8 +841,8 @@ static int de_thread(struct task_struct *tsk)
                  */
                 tsk->start_time = leader->start_time;
 
-                BUG_ON(leader->tgid != tsk->tgid);
-                BUG_ON(tsk->pid == tsk->tgid);
+                BUG_ON(!same_thread_group(leader, tsk));
+                BUG_ON(has_group_leader_pid(tsk));
                 /*
                  * An exec() starts a new thread group with the
                  * TGID of the previous thread group. Rehash the
@@ -857,7 +857,7 @@ static int de_thread(struct task_struct *tsk)
                  */
                 detach_pid(tsk, PIDTYPE_PID);
                 tsk->pid = leader->pid;
-                attach_pid(tsk, PIDTYPE_PID,  find_pid(tsk->pid));
+                attach_pid(tsk, PIDTYPE_PID,  task_pid(leader));
                 transfer_pid(leader, tsk, PIDTYPE_PGID);
                 transfer_pid(leader, tsk, PIDTYPE_SID);
                 list_replace_rcu(&leader->tasks, &tsk->tasks);
@@ -1433,7 +1433,7 @@ static int format_corename(char *corename, const char *pattern, long signr)
                         case 'p':
                                 pid_in_pattern = 1;
                                 rc = snprintf(out_ptr, out_end - out_ptr,
-                                              "%d", current->tgid);
+                                              "%d", task_tgid_vnr(current));
                                 if (rc > out_end - out_ptr)
                                         goto out;
                                 out_ptr += rc;
@@ -1513,7 +1513,7 @@ static int format_corename(char *corename, const char *pattern, long signr)
         if (!ispipe && !pid_in_pattern
             && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
                 rc = snprintf(out_ptr, out_end - out_ptr,
-                              ".%d", current->tgid);
+                              ".%d", task_tgid_vnr(current));
                 if (rc > out_end - out_ptr)
                         goto out;
                 out_ptr += rc;
@@ -1692,7 +1692,10 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
         if (!binfmt || !binfmt->core_dump)
                 goto fail;
         down_write(&mm->mmap_sem);
-        if (!get_dumpable(mm)) {
+        /*
+         * If another thread got here first, or we are not dumpable, bail out.
+         */
+        if (mm->core_waiters || !get_dumpable(mm)) {
                 up_write(&mm->mmap_sem);
                 goto fail;
         }
@@ -1706,7 +1709,6 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
                 flag = O_EXCL;          /* Stop rewrite attacks */
                 current->fsuid = 0;     /* Dump root private */
         }
-        set_dumpable(mm, 0);
 
         retval = coredump_wait(exit_code);
         if (retval < 0)
@@ -1778,6 +1780,12 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
            but keep the previous behaviour for now. */
         if (!ispipe && !S_ISREG(inode->i_mode))
                 goto close_fail;
+        /*
+         * Dont allow local users get cute and trick others to coredump
+         * into their pre-created files:
+         */
+        if (inode->i_uid != current->fsuid)
+                goto close_fail;
         if (!file->f_op)
                 goto close_fail;
         if (!file->f_op->write)
diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
index 8adb32a9387a..109ab5e44eca 100644
--- a/fs/exportfs/expfs.c
+++ b/fs/exportfs/expfs.c
@@ -1,4 +1,13 @@
-
+/*
+ * Copyright (C) Neil Brown 2002
+ * Copyright (C) Christoph Hellwig 2007
+ *
+ * This file contains the code mapping from inodes to NFS file handles,
+ * and for mapping back from file handles to dentries.
+ *
+ * For details on why we do all the strange and hairy things in here
+ * take a look at Documentation/filesystems/Exporting.
+ */
 #include <linux/exportfs.h>
 #include <linux/fs.h>
 #include <linux/file.h>
@@ -9,32 +18,19 @@
 #define dprintk(fmt, args...) do{}while(0)
 
 
-static int get_name(struct dentry *dentry, char *name,
+static int get_name(struct vfsmount *mnt, struct dentry *dentry, char *name,
                 struct dentry *child);
 
 
-static struct dentry *exportfs_get_dentry(struct super_block *sb, void *obj)
+static int exportfs_get_name(struct vfsmount *mnt, struct dentry *dir,
+                char *name, struct dentry *child)
 {
-        struct dentry *result = ERR_PTR(-ESTALE);
-
-        if (sb->s_export_op->get_dentry) {
-                result = sb->s_export_op->get_dentry(sb, obj);
-                if (!result)
-                        result = ERR_PTR(-ESTALE);
-        }
-
-        return result;
-}
-
-static int exportfs_get_name(struct dentry *dir, char *name,
-                struct dentry *child)
-{
-        struct export_operations *nop = dir->d_sb->s_export_op;
+        const struct export_operations *nop = dir->d_sb->s_export_op;
 
         if (nop->get_name)
                 return nop->get_name(dir, name, child);
         else
-                return get_name(dir, name, child);
+                return get_name(mnt, dir, name, child);
 }
 
 /*
@@ -98,7 +94,7 @@ find_disconnected_root(struct dentry *dentry)
  * It may already be, as the flag isn't always updated when connection happens.
  */
 static int
-reconnect_path(struct super_block *sb, struct dentry *target_dir)
+reconnect_path(struct vfsmount *mnt, struct dentry *target_dir)
 {
         char nbuf[NAME_MAX+1];
         int noprogress = 0;
@@ -121,7 +117,7 @@ reconnect_path(struct super_block *sb, struct dentry *target_dir)
                         pd->d_flags &= ~DCACHE_DISCONNECTED;
                         spin_unlock(&pd->d_lock);
                         noprogress = 0;
-                } else if (pd == sb->s_root) {
+                } else if (pd == mnt->mnt_sb->s_root) {
                         printk(KERN_ERR "export: Eeek filesystem root is not connected, impossible\n");
                         spin_lock(&pd->d_lock);
                         pd->d_flags &= ~DCACHE_DISCONNECTED;
@@ -147,8 +143,8 @@ reconnect_path(struct super_block *sb, struct dentry *target_dir)
                         struct dentry *npd;
 
                         mutex_lock(&pd->d_inode->i_mutex);
-                        if (sb->s_export_op->get_parent)
-                                ppd = sb->s_export_op->get_parent(pd);
+                        if (mnt->mnt_sb->s_export_op->get_parent)
+                                ppd = mnt->mnt_sb->s_export_op->get_parent(pd);
                         mutex_unlock(&pd->d_inode->i_mutex);
 
                         if (IS_ERR(ppd)) {
@@ -161,7 +157,7 @@ reconnect_path(struct super_block *sb, struct dentry *target_dir)
 
                         dprintk("%s: find name of %lu in %lu\n", __FUNCTION__,
                                 pd->d_inode->i_ino, ppd->d_inode->i_ino);
-                        err = exportfs_get_name(ppd, nbuf, pd);
+                        err = exportfs_get_name(mnt, ppd, nbuf, pd);
                         if (err) {
                                 dput(ppd);
                                 dput(pd);
@@ -214,125 +210,6 @@ reconnect_path(struct super_block *sb, struct dentry *target_dir)
         return 0;
 }
 
-/**
- * find_exported_dentry - helper routine to implement export_operations->decode_fh
- * @sb:         The &super_block identifying the filesystem
- * @obj:        An opaque identifier of the object to be found - passed to
- *              get_inode
- * @parent:     An optional opqaue identifier of the parent of the object.
- * @acceptable: A function used to test possible &dentries to see if they are
- *              acceptable
- * @context:    A parameter to @acceptable so that it knows on what basis to
- *              judge.
- *
- * find_exported_dentry is the central helper routine to enable file systems
- * to provide the decode_fh() export_operation.  It's main task is to take
- * an &inode, find or create an appropriate &dentry structure, and possibly
- * splice this into the dcache in the correct place.
- *
- * The decode_fh() operation provided by the filesystem should call
- * find_exported_dentry() with the same parameters that it received except
- * that instead of the file handle fragment, pointers to opaque identifiers
- * for the object and optionally its parent are passed.  The default decode_fh
- * routine passes one pointer to the start of the filehandle fragment, and
- * one 8 bytes into the fragment.  It is expected that most filesystems will
- * take this approach, though the offset to the parent identifier may well be
- * different.
- *
- * find_exported_dentry() will call get_dentry to get an dentry pointer from
- * the file system.  If any &dentry in the d_alias list is acceptable, it will
- * be returned.  Otherwise find_exported_dentry() will attempt to splice a new
- * &dentry into the dcache using get_name() and get_parent() to find the
- * appropriate place.
- */
-
-struct dentry *
-find_exported_dentry(struct super_block *sb, void *obj, void *parent,
-                     int (*acceptable)(void *context, struct dentry *de),
-                     void *context)
-{
-        struct dentry *result, *alias;
-        int err = -ESTALE;
-
-        /*
-         * Attempt to find the inode.
-         */
-        result = exportfs_get_dentry(sb, obj);
-        if (IS_ERR(result))
-                return result;
-
-        if (S_ISDIR(result->d_inode->i_mode)) {
-                if (!(result->d_flags & DCACHE_DISCONNECTED)) {
-                        if (acceptable(context, result))
-                                return result;
-                        err = -EACCES;
-                        goto err_result;
-                }
-
-                err = reconnect_path(sb, result);
-                if (err)
-                        goto err_result;
-        } else {
-                struct dentry *target_dir, *nresult;
-                char nbuf[NAME_MAX+1];
-
-                alias = find_acceptable_alias(result, acceptable, context);
-                if (alias)
-                        return alias;
-
-                if (parent == NULL)
-                        goto err_result;
-
-                target_dir = exportfs_get_dentry(sb,parent);
-                if (IS_ERR(target_dir)) {
-                        err = PTR_ERR(target_dir);
-                        goto err_result;
-                }
-
-                err = reconnect_path(sb, target_dir);
-                if (err) {
-                        dput(target_dir);
-                        goto err_result;
-                }
-
-                /*
-                 * As we weren't after a directory, have one more step to go.
-                 */
-                err = exportfs_get_name(target_dir, nbuf, result);
-                if (!err) {
-                        mutex_lock(&target_dir->d_inode->i_mutex);
-                        nresult = lookup_one_len(nbuf, target_dir,
-                                                 strlen(nbuf));
-                        mutex_unlock(&target_dir->d_inode->i_mutex);
-                        if (!IS_ERR(nresult)) {
-                                if (nresult->d_inode) {
-                                        dput(result);
-                                        result = nresult;
-                                } else
-                                        dput(nresult);
-                        }
-                }
-                dput(target_dir);
-        }
-
-        alias = find_acceptable_alias(result, acceptable, context);
-        if (alias)
-                return alias;
-
-        /* drat - I just cannot find anything acceptable */
-        dput(result);
-        /* It might be justifiable to return ESTALE here,
-         * but the filehandle at-least looks reasonable good
-         * and it may just be a permission problem, so returning
-         * -EACCESS is safer
-         */
-        return ERR_PTR(-EACCES);
-
- err_result:
-        dput(result);
-        return ERR_PTR(err);
-}
-
 struct getdents_callback {
         char *name;             /* name that was found. It already points to a
                                    buffer NAME_MAX+1 is size */
@@ -370,8 +247,8 @@ static int filldir_one(void * __buf, const char * name, int len,
  * calls readdir on the parent until it finds an entry with
  * the same inode number as the child, and returns that.
  */
-static int get_name(struct dentry *dentry, char *name,
-                        struct dentry *child)
+static int get_name(struct vfsmount *mnt, struct dentry *dentry,
+                char *name, struct dentry *child)
 {
         struct inode *dir = dentry->d_inode;
         int error;
@@ -387,7 +264,7 @@ static int get_name(struct dentry *dentry, char *name,
         /*
          * Open the directory ...
          */
-        file = dentry_open(dget(dentry), NULL, O_RDONLY);
+        file = dentry_open(dget(dentry), mntget(mnt), O_RDONLY);
         error = PTR_ERR(file);
         if (IS_ERR(file))
                 goto out;
@@ -434,100 +311,177 @@ out:
  * can be used to check that it is still valid.  It places them in the
  * filehandle fragment where export_decode_fh expects to find them.
  */
-static int export_encode_fh(struct dentry *dentry, __u32 *fh, int *max_len,
-                   int connectable)
+static int export_encode_fh(struct dentry *dentry, struct fid *fid,
+                int *max_len, int connectable)
 {
         struct inode * inode = dentry->d_inode;
         int len = *max_len;
-        int type = 1;
+        int type = FILEID_INO32_GEN;
         
         if (len < 2 || (connectable && len < 4))
                 return 255;
 
         len = 2;
-        fh[0] = inode->i_ino;
-        fh[1] = inode->i_generation;
+        fid->i32.ino = inode->i_ino;
+        fid->i32.gen = inode->i_generation;
         if (connectable && !S_ISDIR(inode->i_mode)) {
                 struct inode *parent;
 
                 spin_lock(&dentry->d_lock);
                 parent = dentry->d_parent->d_inode;
-                fh[2] = parent->i_ino;
-                fh[3] = parent->i_generation;
+                fid->i32.parent_ino = parent->i_ino;
+                fid->i32.parent_gen = parent->i_generation;
                 spin_unlock(&dentry->d_lock);
                 len = 4;
-                type = 2;
+                type = FILEID_INO32_GEN_PARENT;
         }
         *max_len = len;
         return type;
 }
 
-
-/**
- * export_decode_fh - default export_operations->decode_fh function
- * @sb:  The superblock
- * @fh:  pointer to the file handle fragment
- * @fh_len: length of file handle fragment
- * @acceptable: function for testing acceptability of dentrys
- * @context:   context for @acceptable
- *
- * This is the default decode_fh() function.
- * a fileid_type of 1 indicates that the filehandlefragment
- * just contains an object identifier understood by  get_dentry.
- * a fileid_type of 2 says that there is also a directory
- * identifier 8 bytes in to the filehandlefragement.
- */
-static struct dentry *export_decode_fh(struct super_block *sb, __u32 *fh, int fh_len,
-                              int fileid_type,
-                         int (*acceptable)(void *context, struct dentry *de),
-                         void *context)
-{
-        __u32 parent[2];
-        parent[0] = parent[1] = 0;
-        if (fh_len < 2 || fileid_type > 2)
-                return NULL;
-        if (fileid_type == 2) {
-                if (fh_len > 2) parent[0] = fh[2];
-                if (fh_len > 3) parent[1] = fh[3];
-        }
-        return find_exported_dentry(sb, fh, parent,
-                                   acceptable, context);
-}
-
-int exportfs_encode_fh(struct dentry *dentry, __u32 *fh, int *max_len,
+int exportfs_encode_fh(struct dentry *dentry, struct fid *fid, int *max_len,
                 int connectable)
 {
-        struct export_operations *nop = dentry->d_sb->s_export_op;
+        const struct export_operations *nop = dentry->d_sb->s_export_op;
         int error;
 
         if (nop->encode_fh)
-                error = nop->encode_fh(dentry, fh, max_len, connectable);
+                error = nop->encode_fh(dentry, fid->raw, max_len, connectable);
         else
-                error = export_encode_fh(dentry, fh, max_len, connectable);
+                error = export_encode_fh(dentry, fid, max_len, connectable);
 
         return error;
 }
 EXPORT_SYMBOL_GPL(exportfs_encode_fh);
 
-struct dentry *exportfs_decode_fh(struct vfsmount *mnt, __u32 *fh, int fh_len,
-                int fileid_type, int (*acceptable)(void *, struct dentry *),
-                void *context)
+struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
+                int fh_len, int fileid_type,
+                int (*acceptable)(void *, struct dentry *), void *context)
 {
-        struct export_operations *nop = mnt->mnt_sb->s_export_op;
-        struct dentry *result;
+        const struct export_operations *nop = mnt->mnt_sb->s_export_op;
+        struct dentry *result, *alias;
+        int err;
 
-        if (nop->decode_fh) {
-                result = nop->decode_fh(mnt->mnt_sb, fh, fh_len, fileid_type,
-                        acceptable, context);
+        /*
+         * Try to get any dentry for the given file handle from the filesystem.
+         */
+        result = nop->fh_to_dentry(mnt->mnt_sb, fid, fh_len, fileid_type);
+        if (!result)
+                result = ERR_PTR(-ESTALE);
+        if (IS_ERR(result))
+                return result;
+
+        if (S_ISDIR(result->d_inode->i_mode)) {
+                /*
+                 * This request is for a directory.
+                 *
+                 * On the positive side there is only one dentry for each
+                 * directory inode.  On the negative side this implies that we
+                 * to ensure our dentry is connected all the way up to the
+                 * filesystem root.
+                 */
+                if (result->d_flags & DCACHE_DISCONNECTED) {
+                        err = reconnect_path(mnt, result);
+                        if (err)
+                                goto err_result;
+                }
+
+                if (!acceptable(context, result)) {
+                        err = -EACCES;
+                        goto err_result;
+                }
+
+                return result;
         } else {
-                result = export_decode_fh(mnt->mnt_sb, fh, fh_len, fileid_type,
-                        acceptable, context);
+                /*
+                 * It's not a directory.  Life is a little more complicated.
+                 */
+                struct dentry *target_dir, *nresult;
+                char nbuf[NAME_MAX+1];
+
+                /*
+                 * See if either the dentry we just got from the filesystem
+                 * or any alias for it is acceptable.  This is always true
+                 * if this filesystem is exported without the subtreecheck
+                 * option.  If the filesystem is exported with the subtree
+                 * check option there's a fair chance we need to look at
+                 * the parent directory in the file handle and make sure
+                 * it's connected to the filesystem root.
+                 */
+                alias = find_acceptable_alias(result, acceptable, context);
+                if (alias)
+                        return alias;
+
+                /*
+                 * Try to extract a dentry for the parent directory from the
+                 * file handle.  If this fails we'll have to give up.
+                 */
+                err = -ESTALE;
+                if (!nop->fh_to_parent)
+                        goto err_result;
+
+                target_dir = nop->fh_to_parent(mnt->mnt_sb, fid,
+                                fh_len, fileid_type);
+                if (!target_dir)
+                        goto err_result;
+                err = PTR_ERR(target_dir);
+                if (IS_ERR(target_dir))
+                        goto err_result;
+
+                /*
+                 * And as usual we need to make sure the parent directory is
+                 * connected to the filesystem root.  The VFS really doesn't
+                 * like disconnected directories..
+                 */
+                err = reconnect_path(mnt, target_dir);
+                if (err) {
+                        dput(target_dir);
+                        goto err_result;
+                }
+
+                /*
+                 * Now that we've got both a well-connected parent and a
+                 * dentry for the inode we're after, make sure that our
+                 * inode is actually connected to the parent.
+                 */
+                err = exportfs_get_name(mnt, target_dir, nbuf, result);
+                if (!err) {
+                        mutex_lock(&target_dir->d_inode->i_mutex);
+                        nresult = lookup_one_len(nbuf, target_dir,
+                                                 strlen(nbuf));
+                        mutex_unlock(&target_dir->d_inode->i_mutex);
+                        if (!IS_ERR(nresult)) {
+                                if (nresult->d_inode) {
+                                        dput(result);
+                                        result = nresult;
+                                } else
+                                        dput(nresult);
+                        }
+                }
+
+                /*
+                 * At this point we are done with the parent, but it's pinned
+                 * by the child dentry anyway.
+                 */
+                dput(target_dir);
+
+                /*
+                 * And finally make sure the dentry is actually acceptable
+                 * to NFSD.
+                 */
+                alias = find_acceptable_alias(result, acceptable, context);
+                if (!alias) {
+                        err = -EACCES;
+                        goto err_result;
+                }
+
+                return alias;
         }
 
-        return result;
+ err_result:
+        dput(result);
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(exportfs_decode_fh);
 
-EXPORT_SYMBOL(find_exported_dentry);
-
 MODULE_LICENSE("GPL");
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 18a42de25b55..377ad172d74b 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -69,14 +69,6 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
         return desc + offset;
 }
 
-static inline int
-block_in_use(unsigned long block, struct super_block *sb, unsigned char *map)
-{
-        return ext2_test_bit ((block -
-                le32_to_cpu(EXT2_SB(sb)->s_es->s_first_data_block)) %
-                         EXT2_BLOCKS_PER_GROUP(sb), map);
-}
-
 /*
  * Read the bitmap for a given block_group, reading into the specified 
  * slot in the superblock's bitmap cache.
@@ -86,51 +78,20 @@ block_in_use(unsigned long block, struct super_block *sb, unsigned char *map)
 static struct buffer_head *
 read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
-        int i;
         struct ext2_group_desc * desc;
         struct buffer_head * bh = NULL;
-        unsigned int bitmap_blk;
-
+        
         desc = ext2_get_group_desc (sb, block_group, NULL);
         if (!desc)
-                return NULL;
-        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
-        bh = sb_bread(sb, bitmap_blk);
+                goto error_out;
+        bh = sb_bread(sb, le32_to_cpu(desc->bg_block_bitmap));
         if (!bh)
-                ext2_error (sb, __FUNCTION__,
+                ext2_error (sb, "read_block_bitmap",
                             "Cannot read block bitmap - "
                             "block_group = %d, block_bitmap = %u",
                             block_group, le32_to_cpu(desc->bg_block_bitmap));
-
-        /* check whether block bitmap block number is set */
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode bitmap block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode table block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_table);
-        for (i = 0; i < EXT2_SB(sb)->s_itb_per_group; i++, bitmap_blk++) {
-                if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                        /* bad block bitmap */
-                        goto error_out;
-                }
-        }
-
-        return bh;
-
 error_out:
-        brelse(bh);
-        ext2_error(sb, __FUNCTION__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %u",
-                        block_group, bitmap_blk);
-        return NULL;
+        return bh;
 }
 
 static void release_blocks(struct super_block *sb, int count)
@@ -1461,7 +1422,6 @@ unsigned long ext2_count_free_blocks (struct super_block * sb)
 #endif
 }
 
-
 static inline int test_root(int a, int b)
 {
         int num = b;
diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
index 05d9342bb64e..d868e26c15eb 100644
--- a/fs/ext2/dir.c
+++ b/fs/ext2/dir.c
@@ -28,6 +28,24 @@
 
 typedef struct ext2_dir_entry_2 ext2_dirent;
 
+static inline unsigned ext2_rec_len_from_disk(__le16 dlen)
+{
+        unsigned len = le16_to_cpu(dlen);
+
+        if (len == EXT2_MAX_REC_LEN)
+                return 1 << 16;
+        return len;
+}
+
+static inline __le16 ext2_rec_len_to_disk(unsigned len)
+{
+        if (len == (1 << 16))
+                return cpu_to_le16(EXT2_MAX_REC_LEN);
+        else if (len > (1 << 16))
+                BUG();
+        return cpu_to_le16(len);
+}
+
 /*
  * ext2 uses block-sized chunks. Arguably, sector-sized ones would be
  * more robust, but we have what we have
@@ -106,7 +124,7 @@ static void ext2_check_page(struct page *page)
         }
         for (offs = 0; offs <= limit - EXT2_DIR_REC_LEN(1); offs += rec_len) {
                 p = (ext2_dirent *)(kaddr + offs);
-                rec_len = le16_to_cpu(p->rec_len);
+                rec_len = ext2_rec_len_from_disk(p->rec_len);
 
                 if (rec_len < EXT2_DIR_REC_LEN(1))
                         goto Eshort;
@@ -204,7 +222,8 @@ static inline int ext2_match (int len, const char * const name,
  */
 static inline ext2_dirent *ext2_next_entry(ext2_dirent *p)
 {
-        return (ext2_dirent *)((char*)p + le16_to_cpu(p->rec_len));
+        return (ext2_dirent *)((char *)p +
+                        ext2_rec_len_from_disk(p->rec_len));
 }
 
 static inline unsigned 
@@ -316,7 +335,7 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                                         return 0;
                                 }
                         }
-                        filp->f_pos += le16_to_cpu(de->rec_len);
+                        filp->f_pos += ext2_rec_len_from_disk(de->rec_len);
                 }
                 ext2_put_page(page);
         }
@@ -425,7 +444,7 @@ void ext2_set_link(struct inode *dir, struct ext2_dir_entry_2 *de,
 {
         loff_t pos = page_offset(page) +
                         (char *) de - (char *) page_address(page);
-        unsigned len = le16_to_cpu(de->rec_len);
+        unsigned len = ext2_rec_len_from_disk(de->rec_len);
         int err;
 
         lock_page(page);
@@ -482,7 +501,7 @@ int ext2_add_link (struct dentry *dentry, struct inode *inode)
                                 /* We hit i_size */
                                 name_len = 0;
                                 rec_len = chunk_size;
-                                de->rec_len = cpu_to_le16(chunk_size);
+                                de->rec_len = ext2_rec_len_to_disk(chunk_size);
                                 de->inode = 0;
                                 goto got_it;
                         }
@@ -496,7 +515,7 @@ int ext2_add_link (struct dentry *dentry, struct inode *inode)
                         if (ext2_match (namelen, name, de))
                                 goto out_unlock;
                         name_len = EXT2_DIR_REC_LEN(de->name_len);
-                        rec_len = le16_to_cpu(de->rec_len);
+                        rec_len = ext2_rec_len_from_disk(de->rec_len);
                         if (!de->inode && rec_len >= reclen)
                                 goto got_it;
                         if (rec_len >= name_len + reclen)
@@ -518,8 +537,8 @@ got_it:
                 goto out_unlock;
         if (de->inode) {
                 ext2_dirent *de1 = (ext2_dirent *) ((char *) de + name_len);
-                de1->rec_len = cpu_to_le16(rec_len - name_len);
-                de->rec_len = cpu_to_le16(name_len);
+                de1->rec_len = ext2_rec_len_to_disk(rec_len - name_len);
+                de->rec_len = ext2_rec_len_to_disk(name_len);
                 de = de1;
         }
         de->name_len = namelen;
@@ -550,7 +569,8 @@ int ext2_delete_entry (struct ext2_dir_entry_2 * dir, struct page * page )
         struct inode *inode = mapping->host;
         char *kaddr = page_address(page);
         unsigned from = ((char*)dir - kaddr) & ~(ext2_chunk_size(inode)-1);
-        unsigned to = ((char*)dir - kaddr) + le16_to_cpu(dir->rec_len);
+        unsigned to = ((char *)dir - kaddr) +
+                                ext2_rec_len_from_disk(dir->rec_len);
         loff_t pos;
         ext2_dirent * pde = NULL;
         ext2_dirent * de = (ext2_dirent *) (kaddr + from);
@@ -574,7 +594,7 @@ int ext2_delete_entry (struct ext2_dir_entry_2 * dir, struct page * page )
                                                         &page, NULL);
         BUG_ON(err);
         if (pde)
-                pde->rec_len = cpu_to_le16(to - from);
+                pde->rec_len = ext2_rec_len_to_disk(to - from);
         dir->inode = 0;
         err = ext2_commit_chunk(page, pos, to - from);
         inode->i_ctime = inode->i_mtime = CURRENT_TIME_SEC;
@@ -610,14 +630,14 @@ int ext2_make_empty(struct inode *inode, struct inode *parent)
         memset(kaddr, 0, chunk_size);
         de = (struct ext2_dir_entry_2 *)kaddr;
         de->name_len = 1;
-        de->rec_len = cpu_to_le16(EXT2_DIR_REC_LEN(1));
+        de->rec_len = ext2_rec_len_to_disk(EXT2_DIR_REC_LEN(1));
         memcpy (de->name, ".\0\0", 4);
         de->inode = cpu_to_le32(inode->i_ino);
         ext2_set_de_type (de, inode);
 
         de = (struct ext2_dir_entry_2 *)(kaddr + EXT2_DIR_REC_LEN(1));
         de->name_len = 2;
-        de->rec_len = cpu_to_le16(chunk_size - EXT2_DIR_REC_LEN(1));
+        de->rec_len = ext2_rec_len_to_disk(chunk_size - EXT2_DIR_REC_LEN(1));
         de->inode = cpu_to_le32(parent->i_ino);
         memcpy (de->name, "..\0", 4);
         ext2_set_de_type (de, inode);
diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
index 7730388c4931..c87ae29c19cb 100644
--- a/fs/ext2/ext2.h
+++ b/fs/ext2/ext2.h
@@ -178,3 +178,10 @@ extern const struct inode_operations ext2_special_inode_operations;
 /* symlink.c */
 extern const struct inode_operations ext2_fast_symlink_inode_operations;
 extern const struct inode_operations ext2_symlink_inode_operations;
+
+static inline ext2_fsblk_t
+ext2_group_first_block_no(struct super_block *sb, unsigned long group_no)
+{
+        return group_no * (ext2_fsblk_t)EXT2_BLOCKS_PER_GROUP(sb) +
+                le32_to_cpu(EXT2_SB(sb)->s_es->s_first_data_block);
+}
diff --git a/fs/ext2/ioctl.c b/fs/ext2/ioctl.c
index c2324d5fe4ac..320b2cb3d4d2 100644
--- a/fs/ext2/ioctl.c
+++ b/fs/ext2/ioctl.c
@@ -47,6 +47,11 @@ int ext2_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                         flags &= ~EXT2_DIRSYNC_FL;
 
                 mutex_lock(&inode->i_mutex);
+                /* Is it quota file? Do not allow user to mess with it */
+                if (IS_NOQUOTA(inode)) {
+                        mutex_unlock(&inode->i_mutex);
+                        return -EPERM;
+                }
                 oldflags = ei->i_flags;
 
                 /*
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 77bd5f9262f9..154e25f13d77 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -311,13 +311,10 @@ static const struct super_operations ext2_sops = {
 #endif
 };
 
-static struct dentry *ext2_get_dentry(struct super_block *sb, void *vobjp)
+static struct inode *ext2_nfs_get_inode(struct super_block *sb,
+                u64 ino, u32 generation)
 {
-        __u32 *objp = vobjp;
-        unsigned long ino = objp[0];
-        __u32 generation = objp[1];
         struct inode *inode;
-        struct dentry *result;
 
         if (ino < EXT2_FIRST_INO(sb) && ino != EXT2_ROOT_INO)
                 return ERR_PTR(-ESTALE);
@@ -338,15 +335,21 @@ static struct dentry *ext2_get_dentry(struct super_block *sb, void *vobjp)
                 iput(inode);
                 return ERR_PTR(-ESTALE);
         }
-        /* now to find a dentry.
-         * If possible, get a well-connected one
-         */
-        result = d_alloc_anon(inode);
-        if (!result) {
-                iput(inode);
-                return ERR_PTR(-ENOMEM);
-        }
-        return result;
+        return inode;
+}
+
+static struct dentry *ext2_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    ext2_nfs_get_inode);
+}
+
+static struct dentry *ext2_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    ext2_nfs_get_inode);
 }
 
 /* Yes, most of these are left as NULL!!
@@ -354,9 +357,10 @@ static struct dentry *ext2_get_dentry(struct super_block *sb, void *vobjp)
  * systems, but can be improved upon.
  * Currently only get_parent is required.
  */
-static struct export_operations ext2_export_ops = {
+static const struct export_operations ext2_export_ops = {
+        .fh_to_dentry = ext2_fh_to_dentry,
+        .fh_to_parent = ext2_fh_to_parent,
         .get_parent = ext2_get_parent,
-        .get_dentry = ext2_get_dentry,
 };
 
 static unsigned long get_sb_block(void **data)
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index 7a87d15523be..a8ba7e831278 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -80,14 +80,6 @@ struct ext3_group_desc * ext3_get_group_desc(struct super_block * sb,
         return desc + offset;
 }
 
-static inline int
-block_in_use(ext3_fsblk_t block, struct super_block *sb, unsigned char *map)
-{
-        return ext3_test_bit ((block -
-                le32_to_cpu(EXT3_SB(sb)->s_es->s_first_data_block)) %
-                         EXT3_BLOCKS_PER_GROUP(sb), map);
-}
-
 /**
  * read_block_bitmap()
  * @sb:                 super block
@@ -101,51 +93,20 @@ block_in_use(ext3_fsblk_t block, struct super_block *sb, unsigned char *map)
 static struct buffer_head *
 read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
-        int i;
         struct ext3_group_desc * desc;
         struct buffer_head * bh = NULL;
-        ext3_fsblk_t bitmap_blk;
 
         desc = ext3_get_group_desc (sb, block_group, NULL);
         if (!desc)
-                return NULL;
-        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
-        bh = sb_bread(sb, bitmap_blk);
+                goto error_out;
+        bh = sb_bread(sb, le32_to_cpu(desc->bg_block_bitmap));
         if (!bh)
-                ext3_error (sb, __FUNCTION__,
+                ext3_error (sb, "read_block_bitmap",
                             "Cannot read block bitmap - "
                             "block_group = %d, block_bitmap = %u",
                             block_group, le32_to_cpu(desc->bg_block_bitmap));
-
-        /* check whether block bitmap block number is set */
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode bitmap block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode table block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_table);
-        for (i = 0; i < EXT3_SB(sb)->s_itb_per_group; i++, bitmap_blk++) {
-                if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                        /* bad block bitmap */
-                        goto error_out;
-                }
-        }
-
-        return bh;
-
 error_out:
-        brelse(bh);
-        ext3_error(sb, __FUNCTION__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %lu",
-                        block_group, bitmap_blk);
-        return NULL;
+        return bh;
 }
 /*
  * The reservation window structure operations
@@ -1772,7 +1733,6 @@ ext3_fsblk_t ext3_count_free_blocks(struct super_block *sb)
 #endif
 }
 
-
 static inline int test_root(int a, int b)
 {
         int num = b;
diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
index c8e4ee3af1d0..8ca3bfd72427 100644
--- a/fs/ext3/dir.c
+++ b/fs/ext3/dir.c
@@ -67,7 +67,7 @@ int ext3_check_dir_entry (const char * function, struct inode * dir,
                           unsigned long offset)
 {
         const char * error_msg = NULL;
-        const int rlen = le16_to_cpu(de->rec_len);
+        const int rlen = ext3_rec_len_from_disk(de->rec_len);
 
         if (rlen < EXT3_DIR_REC_LEN(1))
                 error_msg = "rec_len is smaller than minimal";
@@ -173,10 +173,10 @@ revalidate:
                                  * least that it is non-zero.  A
                                  * failure will be detected in the
                                  * dirent test below. */
-                                if (le16_to_cpu(de->rec_len) <
+                                if (ext3_rec_len_from_disk(de->rec_len) <
                                                 EXT3_DIR_REC_LEN(1))
                                         break;
-                                i += le16_to_cpu(de->rec_len);
+                                i += ext3_rec_len_from_disk(de->rec_len);
                         }
                         offset = i;
                         filp->f_pos = (filp->f_pos & ~(sb->s_blocksize - 1))
@@ -197,7 +197,7 @@ revalidate:
                                 ret = stored;
                                 goto out;
                         }
-                        offset += le16_to_cpu(de->rec_len);
+                        offset += ext3_rec_len_from_disk(de->rec_len);
                         if (le32_to_cpu(de->inode)) {
                                 /* We might block in the next section
                                  * if the data destination is
@@ -219,7 +219,7 @@ revalidate:
                                         goto revalidate;
                                 stored ++;
                         }
-                        filp->f_pos += le16_to_cpu(de->rec_len);
+                        filp->f_pos += ext3_rec_len_from_disk(de->rec_len);
                 }
                 offset = 0;
                 brelse (bh);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 3dec003b773e..9b162cd6c16c 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -2954,7 +2954,7 @@ int ext3_write_inode(struct inode *inode, int wait)
                 return 0;
 
         if (ext3_journal_current_handle()) {
-                jbd_debug(0, "called recursively, non-PF_MEMALLOC!\n");
+                jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
                 dump_stack();
                 return -EIO;
         }
diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
index 4a2a02c95bf9..023a070f55f1 100644
--- a/fs/ext3/ioctl.c
+++ b/fs/ext3/ioctl.c
@@ -51,6 +51,11 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                         flags &= ~EXT3_DIRSYNC_FL;
 
                 mutex_lock(&inode->i_mutex);
+                /* Is it quota file? Do not allow user to mess with it */
+                if (IS_NOQUOTA(inode)) {
+                        mutex_unlock(&inode->i_mutex);
+                        return -EPERM;
+                }
                 oldflags = ei->i_flags;
 
                 /* The JOURNAL_DATA flag is modifiable only by root */
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index ec8170adac53..4ab6f76e63d0 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -177,6 +177,16 @@ static int ext3_dx_add_entry(handle_t *handle, struct dentry *dentry,
                              struct inode *inode);
 
 /*
+ * p is at least 6 bytes before the end of page
+ */
+static inline struct ext3_dir_entry_2 *
+ext3_next_entry(struct ext3_dir_entry_2 *p)
+{
+        return (struct ext3_dir_entry_2 *)((char *)p +
+                ext3_rec_len_from_disk(p->rec_len));
+}
+
+/*
  * Future: use high four bits of block for coalesce-on-delete flags
  * Mask them off for now.
  */
@@ -280,7 +290,7 @@ static struct stats dx_show_leaf(struct dx_hash_info *hinfo, struct ext3_dir_ent
                         space += EXT3_DIR_REC_LEN(de->name_len);
                         names++;
                 }
-                de = (struct ext3_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len));
+                de = ext3_next_entry(de);
         }
         printk("(%i)\n", names);
         return (struct stats) { names, space, 1 };
@@ -547,14 +557,6 @@ static int ext3_htree_next_block(struct inode *dir, __u32 hash,
 
 
 /*
- * p is at least 6 bytes before the end of page
- */
-static inline struct ext3_dir_entry_2 *ext3_next_entry(struct ext3_dir_entry_2 *p)
-{
-        return (struct ext3_dir_entry_2 *)((char*)p + le16_to_cpu(p->rec_len));
-}
-
-/*
  * This function fills a red-black tree with information from a
  * directory block.  It returns the number directory entries loaded
  * into the tree.  If there is an error it is returned in err.
@@ -720,7 +722,7 @@ static int dx_make_map (struct ext3_dir_entry_2 *de, int size,
                         cond_resched();
                 }
                 /* XXX: do we need to check rec_len == 0 case? -Chris */
-                de = (struct ext3_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len));
+                de = ext3_next_entry(de);
         }
         return count;
 }
@@ -822,7 +824,7 @@ static inline int search_dirblock(struct buffer_head * bh,
                         return 1;
                 }
                 /* prevent looping on a bad block */
-                de_len = le16_to_cpu(de->rec_len);
+                de_len = ext3_rec_len_from_disk(de->rec_len);
                 if (de_len <= 0)
                         return -1;
                 offset += de_len;
@@ -1130,7 +1132,7 @@ dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
                 rec_len = EXT3_DIR_REC_LEN(de->name_len);
                 memcpy (to, de, rec_len);
                 ((struct ext3_dir_entry_2 *) to)->rec_len =
-                                cpu_to_le16(rec_len);
+                                ext3_rec_len_to_disk(rec_len);
                 de->inode = 0;
                 map++;
                 to += rec_len;
@@ -1149,13 +1151,12 @@ static struct ext3_dir_entry_2* dx_pack_dirents(char *base, int size)
 
         prev = to = de;
         while ((char*)de < base + size) {
-                next = (struct ext3_dir_entry_2 *) ((char *) de +
-                                                    le16_to_cpu(de->rec_len));
+                next = ext3_next_entry(de);
                 if (de->inode && de->name_len) {
                         rec_len = EXT3_DIR_REC_LEN(de->name_len);
                         if (de > to)
                                 memmove(to, de, rec_len);
-                        to->rec_len = cpu_to_le16(rec_len);
+                        to->rec_len = ext3_rec_len_to_disk(rec_len);
                         prev = to;
                         to = (struct ext3_dir_entry_2 *) (((char *) to) + rec_len);
                 }
@@ -1229,8 +1230,8 @@ static struct ext3_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
         /* Fancy dance to stay within two buffers */
         de2 = dx_move_dirents(data1, data2, map + split, count - split);
         de = dx_pack_dirents(data1,blocksize);
-        de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de);
-        de2->rec_len = cpu_to_le16(data2 + blocksize - (char *) de2);
+        de->rec_len = ext3_rec_len_to_disk(data1 + blocksize - (char *) de);
+        de2->rec_len = ext3_rec_len_to_disk(data2 + blocksize - (char *) de2);
         dxtrace(dx_show_leaf (hinfo, (struct ext3_dir_entry_2 *) data1, blocksize, 1));
         dxtrace(dx_show_leaf (hinfo, (struct ext3_dir_entry_2 *) data2, blocksize, 1));
 
@@ -1300,7 +1301,7 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
                                 return -EEXIST;
                         }
                         nlen = EXT3_DIR_REC_LEN(de->name_len);
-                        rlen = le16_to_cpu(de->rec_len);
+                        rlen = ext3_rec_len_from_disk(de->rec_len);
                         if ((de->inode? rlen - nlen: rlen) >= reclen)
                                 break;
                         de = (struct ext3_dir_entry_2 *)((char *)de + rlen);
@@ -1319,11 +1320,11 @@ static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
 
         /* By now the buffer is marked for journaling */
         nlen = EXT3_DIR_REC_LEN(de->name_len);
-        rlen = le16_to_cpu(de->rec_len);
+        rlen = ext3_rec_len_from_disk(de->rec_len);
         if (de->inode) {
                 struct ext3_dir_entry_2 *de1 = (struct ext3_dir_entry_2 *)((char *)de + nlen);
-                de1->rec_len = cpu_to_le16(rlen - nlen);
-                de->rec_len = cpu_to_le16(nlen);
+                de1->rec_len = ext3_rec_len_to_disk(rlen - nlen);
+                de->rec_len = ext3_rec_len_to_disk(nlen);
                 de = de1;
         }
         de->file_type = EXT3_FT_UNKNOWN;
@@ -1400,17 +1401,18 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
 
         /* The 0th block becomes the root, move the dirents out */
         fde = &root->dotdot;
-        de = (struct ext3_dir_entry_2 *)((char *)fde + le16_to_cpu(fde->rec_len));
+        de = (struct ext3_dir_entry_2 *)((char *)fde +
+                        ext3_rec_len_from_disk(fde->rec_len));
         len = ((char *) root) + blocksize - (char *) de;
         memcpy (data1, de, len);
         de = (struct ext3_dir_entry_2 *) data1;
         top = data1 + len;
-        while ((char *)(de2=(void*)de+le16_to_cpu(de->rec_len)) < top)
+        while ((char *)(de2 = ext3_next_entry(de)) < top)
                 de = de2;
-        de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de);
+        de->rec_len = ext3_rec_len_to_disk(data1 + blocksize - (char *) de);
         /* Initialize the root; the dot dirents already exist */
         de = (struct ext3_dir_entry_2 *) (&root->dotdot);
-        de->rec_len = cpu_to_le16(blocksize - EXT3_DIR_REC_LEN(2));
+        de->rec_len = ext3_rec_len_to_disk(blocksize - EXT3_DIR_REC_LEN(2));
         memset (&root->info, 0, sizeof(root->info));
         root->info.info_length = sizeof(root->info);
         root->info.hash_version = EXT3_SB(dir->i_sb)->s_def_hash_version;
@@ -1490,7 +1492,7 @@ static int ext3_add_entry (handle_t *handle, struct dentry *dentry,
                 return retval;
         de = (struct ext3_dir_entry_2 *) bh->b_data;
         de->inode = 0;
-        de->rec_len = cpu_to_le16(blocksize);
+        de->rec_len = ext3_rec_len_to_disk(blocksize);
         return add_dirent_to_buf(handle, dentry, inode, de, bh);
 }
 
@@ -1553,7 +1555,7 @@ static int ext3_dx_add_entry(handle_t *handle, struct dentry *dentry,
                         goto cleanup;
                 node2 = (struct dx_node *)(bh2->b_data);
                 entries2 = node2->entries;
-                node2->fake.rec_len = cpu_to_le16(sb->s_blocksize);
+                node2->fake.rec_len = ext3_rec_len_to_disk(sb->s_blocksize);
                 node2->fake.inode = 0;
                 BUFFER_TRACE(frame->bh, "get_write_access");
                 err = ext3_journal_get_write_access(handle, frame->bh);
@@ -1651,9 +1653,9 @@ static int ext3_delete_entry (handle_t *handle,
                         BUFFER_TRACE(bh, "get_write_access");
                         ext3_journal_get_write_access(handle, bh);
                         if (pde)
-                                pde->rec_len =
-                                        cpu_to_le16(le16_to_cpu(pde->rec_len) +
-                                                    le16_to_cpu(de->rec_len));
+                                pde->rec_len = ext3_rec_len_to_disk(
+                                        ext3_rec_len_from_disk(pde->rec_len) +
+                                        ext3_rec_len_from_disk(de->rec_len));
                         else
                                 de->inode = 0;
                         dir->i_version++;
@@ -1661,10 +1663,9 @@ static int ext3_delete_entry (handle_t *handle,
                         ext3_journal_dirty_metadata(handle, bh);
                         return 0;
                 }
-                i += le16_to_cpu(de->rec_len);
+                i += ext3_rec_len_from_disk(de->rec_len);
                 pde = de;
-                de = (struct ext3_dir_entry_2 *)
-                        ((char *) de + le16_to_cpu(de->rec_len));
+                de = ext3_next_entry(de);
         }
         return -ENOENT;
 }
@@ -1798,13 +1799,13 @@ retry:
         de = (struct ext3_dir_entry_2 *) dir_block->b_data;
         de->inode = cpu_to_le32(inode->i_ino);
         de->name_len = 1;
-        de->rec_len = cpu_to_le16(EXT3_DIR_REC_LEN(de->name_len));
+        de->rec_len = ext3_rec_len_to_disk(EXT3_DIR_REC_LEN(de->name_len));
         strcpy (de->name, ".");
         ext3_set_de_type(dir->i_sb, de, S_IFDIR);
-        de = (struct ext3_dir_entry_2 *)
-                        ((char *) de + le16_to_cpu(de->rec_len));
+        de = ext3_next_entry(de);
         de->inode = cpu_to_le32(dir->i_ino);
-        de->rec_len = cpu_to_le16(inode->i_sb->s_blocksize-EXT3_DIR_REC_LEN(1));
+        de->rec_len = ext3_rec_len_to_disk(inode->i_sb->s_blocksize -
+                                        EXT3_DIR_REC_LEN(1));
         de->name_len = 2;
         strcpy (de->name, "..");
         ext3_set_de_type(dir->i_sb, de, S_IFDIR);
@@ -1856,8 +1857,7 @@ static int empty_dir (struct inode * inode)
                 return 1;
         }
         de = (struct ext3_dir_entry_2 *) bh->b_data;
-        de1 = (struct ext3_dir_entry_2 *)
-                        ((char *) de + le16_to_cpu(de->rec_len));
+        de1 = ext3_next_entry(de);
         if (le32_to_cpu(de->inode) != inode->i_ino ||
                         !le32_to_cpu(de1->inode) ||
                         strcmp (".", de->name) ||
@@ -1868,9 +1868,9 @@ static int empty_dir (struct inode * inode)
                 brelse (bh);
                 return 1;
         }
-        offset = le16_to_cpu(de->rec_len) + le16_to_cpu(de1->rec_len);
-        de = (struct ext3_dir_entry_2 *)
-                        ((char *) de1 + le16_to_cpu(de1->rec_len));
+        offset = ext3_rec_len_from_disk(de->rec_len) +
+                        ext3_rec_len_from_disk(de1->rec_len);
+        de = ext3_next_entry(de1);
         while (offset < inode->i_size ) {
                 if (!bh ||
                         (void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
@@ -1899,9 +1899,8 @@ static int empty_dir (struct inode * inode)
                         brelse (bh);
                         return 0;
                 }
-                offset += le16_to_cpu(de->rec_len);
-                de = (struct ext3_dir_entry_2 *)
-                                ((char *) de + le16_to_cpu(de->rec_len));
+                offset += ext3_rec_len_from_disk(de->rec_len);
+                de = ext3_next_entry(de);
         }
         brelse (bh);
         return 1;
@@ -2255,8 +2254,7 @@ retry:
 }
 
 #define PARENT_INO(buffer) \
-        ((struct ext3_dir_entry_2 *) ((char *) buffer + \
-        le16_to_cpu(((struct ext3_dir_entry_2 *) buffer)->rec_len)))->inode
+        (ext3_next_entry((struct ext3_dir_entry_2 *)(buffer))->inode)
 
 /*
  * Anybody can rename anything with this: the permission checks are left to the
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 81868c0bc40e..de55da9e28ba 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -631,13 +631,10 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
 }
 
 
-static struct dentry *ext3_get_dentry(struct super_block *sb, void *vobjp)
+static struct inode *ext3_nfs_get_inode(struct super_block *sb,
+                u64 ino, u32 generation)
 {
-        __u32 *objp = vobjp;
-        unsigned long ino = objp[0];
-        __u32 generation = objp[1];
         struct inode *inode;
-        struct dentry *result;
 
         if (ino < EXT3_FIRST_INO(sb) && ino != EXT3_ROOT_INO)
                 return ERR_PTR(-ESTALE);
@@ -660,15 +657,22 @@ static struct dentry *ext3_get_dentry(struct super_block *sb, void *vobjp)
                 iput(inode);
                 return ERR_PTR(-ESTALE);
         }
-        /* now to find a dentry.
-         * If possible, get a well-connected one
-         */
-        result = d_alloc_anon(inode);
-        if (!result) {
-                iput(inode);
-                return ERR_PTR(-ENOMEM);
-        }
-        return result;
+
+        return inode;
+}
+
+static struct dentry *ext3_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    ext3_nfs_get_inode);
+}
+
+static struct dentry *ext3_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    ext3_nfs_get_inode);
 }
 
 #ifdef CONFIG_QUOTA
@@ -737,9 +741,10 @@ static const struct super_operations ext3_sops = {
 #endif
 };
 
-static struct export_operations ext3_export_ops = {
+static const struct export_operations ext3_export_ops = {
+        .fh_to_dentry = ext3_fh_to_dentry,
+        .fh_to_parent = ext3_fh_to_parent,
         .get_parent = ext3_get_parent,
-        .get_dentry = ext3_get_dentry,
 };
 
 enum {
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index f58cbb26323e..408373819e34 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -741,12 +741,11 @@ ext3_xattr_block_set(handle_t *handle, struct inode *inode,
                 }
         } else {
                 /* Allocate a buffer where we construct the new block. */
-                s->base = kmalloc(sb->s_blocksize, GFP_KERNEL);
+                s->base = kzalloc(sb->s_blocksize, GFP_KERNEL);
                 /* assert(header == s->base) */
                 error = -ENOMEM;
                 if (s->base == NULL)
                         goto cleanup;
-                memset(s->base, 0, sb->s_blocksize);
                 header(s->base)->h_magic = cpu_to_le32(EXT3_XATTR_MAGIC);
                 header(s->base)->h_blocks = cpu_to_le32(1);
                 header(s->base)->h_refcount = cpu_to_le32(1);
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index e906b65448e2..71ee95e534fd 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -189,15 +189,6 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
         return desc;
 }
 
-static inline int
-block_in_use(ext4_fsblk_t block, struct super_block *sb, unsigned char *map)
-{
-        ext4_grpblk_t offset;
-
-        ext4_get_group_no_and_offset(sb, block, NULL, &offset);
-        return ext4_test_bit (offset, map);
-}
-
 /**
  * read_block_bitmap()
  * @sb:                 super block
@@ -211,7 +202,6 @@ block_in_use(ext4_fsblk_t block, struct super_block *sb, unsigned char *map)
 struct buffer_head *
 read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
-        int i;
         struct ext4_group_desc * desc;
         struct buffer_head * bh = NULL;
         ext4_fsblk_t bitmap_blk;
@@ -239,38 +229,7 @@ read_block_bitmap(struct super_block *sb, unsigned int block_group)
                             "Cannot read block bitmap - "
                             "block_group = %d, block_bitmap = %llu",
                             block_group, bitmap_blk);
-
-        /* check whether block bitmap block number is set */
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-
-        /* check whether the inode bitmap block number is set */
-        bitmap_blk = ext4_inode_bitmap(sb, desc);
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode table block number is set */
-        bitmap_blk = ext4_inode_table(sb, desc);
-        for (i = 0; i < EXT4_SB(sb)->s_itb_per_group; i++, bitmap_blk++) {
-                if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                        /* bad block bitmap */
-                        goto error_out;
-                }
-        }
-
         return bh;
-
-error_out:
-        brelse(bh);
-        ext4_error(sb, __FUNCTION__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %llu",
-                        block_group, bitmap_blk);
-        return NULL;
-
 }
 /*
  * The reservation window structure operations
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index c04c7ccba9e3..e7f894bdb420 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -51,6 +51,11 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                         flags &= ~EXT4_DIRSYNC_FL;
 
                 mutex_lock(&inode->i_mutex);
+                /* Is it quota file? Do not allow user to mess with it */
+                if (IS_NOQUOTA(inode)) {
+                        mutex_unlock(&inode->i_mutex);
+                        return -EPERM;
+                }
                 oldflags = ei->i_flags;
 
                 /* The JOURNAL_DATA flag is modifiable only by root */
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index b11e9e2bcd01..8031dc0e24e5 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -686,13 +686,10 @@ static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
 }
 
 
-static struct dentry *ext4_get_dentry(struct super_block *sb, void *vobjp)
+static struct inode *ext4_nfs_get_inode(struct super_block *sb,
+                u64 ino, u32 generation)
 {
-        __u32 *objp = vobjp;
-        unsigned long ino = objp[0];
-        __u32 generation = objp[1];
         struct inode *inode;
-        struct dentry *result;
 
         if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
                 return ERR_PTR(-ESTALE);
@@ -715,15 +712,22 @@ static struct dentry *ext4_get_dentry(struct super_block *sb, void *vobjp)
                 iput(inode);
                 return ERR_PTR(-ESTALE);
         }
-        /* now to find a dentry.
-         * If possible, get a well-connected one
-         */
-        result = d_alloc_anon(inode);
-        if (!result) {
-                iput(inode);
-                return ERR_PTR(-ENOMEM);
-        }
-        return result;
+
+        return inode;
+}
+
+static struct dentry *ext4_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    ext4_nfs_get_inode);
+}
+
+static struct dentry *ext4_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    ext4_nfs_get_inode);
 }
 
 #ifdef CONFIG_QUOTA
@@ -792,9 +796,10 @@ static const struct super_operations ext4_sops = {
 #endif
 };
 
-static struct export_operations ext4_export_ops = {
+static const struct export_operations ext4_export_ops = {
+        .fh_to_dentry = ext4_fh_to_dentry,
+        .fh_to_parent = ext4_fh_to_parent,
         .get_parent = ext4_get_parent,
-        .get_dentry = ext4_get_dentry,
 };
 
 enum {
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index c0c5e9c55b58..920a576e1c25 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -653,24 +653,15 @@ static const struct super_operations fat_sops = {
  * of i_logstart is used to store the directory entry offset.
  */
 
-static struct dentry *
-fat_decode_fh(struct super_block *sb, __u32 *fh, int len, int fhtype,
-              int (*acceptable)(void *context, struct dentry *de),
-              void *context)
-{
-        if (fhtype != 3)
-                return ERR_PTR(-ESTALE);
-        if (len < 5)
-                return ERR_PTR(-ESTALE);
-
-        return sb->s_export_op->find_exported_dentry(sb, fh, NULL, acceptable, context);
-}
-
-static struct dentry *fat_get_dentry(struct super_block *sb, void *inump)
+static struct dentry *fat_fh_to_dentry(struct super_block *sb,
+                struct fid *fid, int fh_len, int fh_type)
 {
         struct inode *inode = NULL;
         struct dentry *result;
-        __u32 *fh = inump;
+        u32 *fh = fid->raw;
+
+        if (fh_len < 5 || fh_type != 3)
+                return NULL;
 
         inode = iget(sb, fh[0]);
         if (!inode || is_bad_inode(inode) || inode->i_generation != fh[1]) {
@@ -783,10 +774,9 @@ out:
         return parent;
 }
 
-static struct export_operations fat_export_ops = {
-        .decode_fh      = fat_decode_fh,
+static const struct export_operations fat_export_ops = {
         .encode_fh      = fat_encode_fh,
-        .get_dentry     = fat_get_dentry,
+        .fh_to_dentry   = fat_fh_to_dentry,
         .get_parent     = fat_get_parent,
 };
 
diff --git a/fs/fcntl.c b/fs/fcntl.c
index c9db73fc5e3d..8685263ccc4a 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -18,6 +18,7 @@
 #include <linux/ptrace.h>
 #include <linux/signal.h>
 #include <linux/rcupdate.h>
+#include <linux/pid_namespace.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -292,7 +293,7 @@ int f_setown(struct file *filp, unsigned long arg, int force)
                 who = -who;
         }
         rcu_read_lock();
-        pid = find_pid(who);
+        pid = find_vpid(who);
         result = __f_setown(filp, pid, type, force);
         rcu_read_unlock();
         return result;
@@ -308,7 +309,7 @@ pid_t f_getown(struct file *filp)
 {
         pid_t pid;
         read_lock(&filp->f_owner.lock);
-        pid = pid_nr(filp->f_owner.pid);
+        pid = pid_nr_ns(filp->f_owner.pid, current->nsproxy->pid_ns);
         if (filp->f_owner.pid_type == PIDTYPE_PGID)
                 pid = -pid;
         read_unlock(&filp->f_owner.lock);
diff --git a/fs/file_table.c b/fs/file_table.c
index 3176fefc92e1..664e3f2309b8 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -323,12 +323,11 @@ void file_kill(struct file *file)
 
 int fs_may_remount_ro(struct super_block *sb)
 {
-        struct list_head *p;
+        struct file *file;
 
         /* Check that no files are currently opened for writing. */
         file_list_lock();
-        list_for_each(p, &sb->s_files) {
-                struct file *file = list_entry(p, struct file, f_u.fu_list);
+        list_for_each_entry(file, &sb->s_files, f_u.fu_list) {
                 struct inode *inode = file->f_path.dentry->d_inode;
 
                 /* File with pending delete? */
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 686734ff973d..0fca82021d76 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -89,7 +89,7 @@ void __mark_inode_dirty(struct inode *inode, int flags)
                 if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev"))
                         printk(KERN_DEBUG
                                "%s(%d): dirtied inode %lu (%s) on %s\n",
-                               current->comm, current->pid, inode->i_ino,
+                               current->comm, task_pid_nr(current), inode->i_ino,
                                name, inode->i_sb->s_id);
         }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 3763757f9fe7..80d2f5292cf9 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -132,6 +132,21 @@ static void fuse_lookup_init(struct fuse_req *req, struct inode *dir,
         req->out.args[0].value = outarg;
 }
 
+static u64 fuse_get_attr_version(struct fuse_conn *fc)
+{
+        u64 curr_version;
+
+        /*
+         * The spin lock isn't actually needed on 64bit archs, but we
+         * don't yet care too much about such optimizations.
+         */
+        spin_lock(&fc->lock);
+        curr_version = fc->attr_version;
+        spin_unlock(&fc->lock);
+
+        return curr_version;
+}
+
 /*
  * Check whether the dentry is still valid
  *
@@ -171,9 +186,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                         return 0;
                 }
 
-                spin_lock(&fc->lock);
-                attr_version = fc->attr_version;
-                spin_unlock(&fc->lock);
+                attr_version = fuse_get_attr_version(fc);
 
                 parent = dget_parent(entry);
                 fuse_lookup_init(req, parent->d_inode, entry, &outarg);
@@ -264,9 +277,7 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
                 return ERR_PTR(PTR_ERR(forget_req));
         }
 
-        spin_lock(&fc->lock);
-        attr_version = fc->attr_version;
-        spin_unlock(&fc->lock);
+        attr_version = fuse_get_attr_version(fc);
 
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
@@ -646,6 +657,9 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
         err = req->out.h.error;
         fuse_put_request(fc, req);
         if (!err) {
+                /* ctime changes */
+                fuse_invalidate_attr(oldent->d_inode);
+
                 fuse_invalidate_attr(olddir);
                 if (olddir != newdir)
                         fuse_invalidate_attr(newdir);
@@ -733,9 +747,7 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
-        spin_lock(&fc->lock);
-        attr_version = fc->attr_version;
-        spin_unlock(&fc->lock);
+        attr_version = fuse_get_attr_version(fc);
 
         memset(&inarg, 0, sizeof(inarg));
         memset(&outarg, 0, sizeof(outarg));
@@ -775,6 +787,31 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
         return err;
 }
 
+int fuse_update_attributes(struct inode *inode, struct kstat *stat,
+                           struct file *file, bool *refreshed)
+{
+        struct fuse_inode *fi = get_fuse_inode(inode);
+        int err;
+        bool r;
+
+        if (fi->i_time < get_jiffies_64()) {
+                r = true;
+                err = fuse_do_getattr(inode, stat, file);
+        } else {
+                r = false;
+                err = 0;
+                if (stat) {
+                        generic_fillattr(inode, stat);
+                        stat->mode = fi->orig_i_mode;
+                }
+        }
+
+        if (refreshed != NULL)
+                *refreshed = r;
+
+        return err;
+}
+
 /*
  * Calling into a user-controlled filesystem gives the filesystem
  * daemon ptrace-like capabilities over the requester process.  This
@@ -862,14 +899,9 @@ static int fuse_permission(struct inode *inode, int mask, struct nameidata *nd)
          */
         if ((fc->flags & FUSE_DEFAULT_PERMISSIONS) ||
             ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
-                struct fuse_inode *fi = get_fuse_inode(inode);
-                if (fi->i_time < get_jiffies_64()) {
-                        err = fuse_do_getattr(inode, NULL, NULL);
-                        if (err)
-                                return err;
-
-                        refreshed = true;
-                }
+                err = fuse_update_attributes(inode, NULL, NULL, &refreshed);
+                if (err)
+                        return err;
         }
 
         if (fc->flags & FUSE_DEFAULT_PERMISSIONS) {
@@ -935,7 +967,6 @@ static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
         struct page *page;
         struct inode *inode = file->f_path.dentry->d_inode;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_file *ff = file->private_data;
         struct fuse_req *req;
 
         if (is_bad_inode(inode))
@@ -952,7 +983,7 @@ static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
         }
         req->num_pages = 1;
         req->pages[0] = page;
-        fuse_read_fill(req, ff, inode, file->f_pos, PAGE_SIZE, FUSE_READDIR);
+        fuse_read_fill(req, file, inode, file->f_pos, PAGE_SIZE, FUSE_READDIR);
         request_send(fc, req);
         nbytes = req->out.args[0].size;
         err = req->out.h.error;
@@ -1173,22 +1204,12 @@ static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
                         struct kstat *stat)
 {
         struct inode *inode = entry->d_inode;
-        struct fuse_inode *fi = get_fuse_inode(inode);
         struct fuse_conn *fc = get_fuse_conn(inode);
-        int err;
 
         if (!fuse_allow_task(fc, current))
                 return -EACCES;
 
-        if (fi->i_time < get_jiffies_64())
-                err = fuse_do_getattr(inode, stat, NULL);
-        else {
-                err = 0;
-                generic_fillattr(inode, stat);
-                stat->mode = fi->orig_i_mode;
-        }
-
-        return err;
+        return fuse_update_attributes(inode, stat, NULL, NULL);
 }
 
 static int fuse_setxattr(struct dentry *entry, const char *name,
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 0fcdba9d47c0..bb05d227cf30 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -55,9 +55,10 @@ struct fuse_file *fuse_file_alloc(void)
                 if (!ff->reserved_req) {
                         kfree(ff);
                         ff = NULL;
+                } else {
+                        INIT_LIST_HEAD(&ff->write_entry);
+                        atomic_set(&ff->count, 0);
                 }
-                INIT_LIST_HEAD(&ff->write_entry);
-                atomic_set(&ff->count, 0);
         }
         return ff;
 }
@@ -288,14 +289,16 @@ static int fuse_fsync(struct file *file, struct dentry *de, int datasync)
         return fuse_fsync_common(file, de, datasync, 0);
 }
 
-void fuse_read_fill(struct fuse_req *req, struct fuse_file *ff,
+void fuse_read_fill(struct fuse_req *req, struct file *file,
                     struct inode *inode, loff_t pos, size_t count, int opcode)
 {
         struct fuse_read_in *inarg = &req->misc.read_in;
+        struct fuse_file *ff = file->private_data;
 
         inarg->fh = ff->fh;
         inarg->offset = pos;
         inarg->size = count;
+        inarg->flags = file->f_flags;
         req->in.h.opcode = opcode;
         req->in.h.nodeid = get_node_id(inode);
         req->in.numargs = 1;
@@ -312,9 +315,8 @@ static size_t fuse_send_read(struct fuse_req *req, struct file *file,
                              fl_owner_t owner)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_file *ff = file->private_data;
 
-        fuse_read_fill(req, ff, inode, pos, count, FUSE_READ);
+        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
         if (owner != NULL) {
                 struct fuse_read_in *inarg = &req->misc.read_in;
 
@@ -375,15 +377,16 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
         fuse_put_request(fc, req);
 }
 
-static void fuse_send_readpages(struct fuse_req *req, struct fuse_file *ff,
+static void fuse_send_readpages(struct fuse_req *req, struct file *file,
                                 struct inode *inode)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
         loff_t pos = page_offset(req->pages[0]);
         size_t count = req->num_pages << PAGE_CACHE_SHIFT;
         req->out.page_zeroing = 1;
-        fuse_read_fill(req, ff, inode, pos, count, FUSE_READ);
+        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
         if (fc->async_read) {
+                struct fuse_file *ff = file->private_data;
                 req->ff = fuse_file_get(ff);
                 req->end = fuse_readpages_end;
                 request_send_background(fc, req);
@@ -395,7 +398,7 @@ static void fuse_send_readpages(struct fuse_req *req, struct fuse_file *ff,
 
 struct fuse_fill_data {
         struct fuse_req *req;
-        struct fuse_file *ff;
+        struct file *file;
         struct inode *inode;
 };
 
@@ -410,7 +413,7 @@ static int fuse_readpages_fill(void *_data, struct page *page)
             (req->num_pages == FUSE_MAX_PAGES_PER_REQ ||
              (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
              req->pages[req->num_pages - 1]->index + 1 != page->index)) {
-                fuse_send_readpages(req, data->ff, inode);
+                fuse_send_readpages(req, data->file, inode);
                 data->req = req = fuse_get_req(fc);
                 if (IS_ERR(req)) {
                         unlock_page(page);
@@ -434,7 +437,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
         if (is_bad_inode(inode))
                 goto out;
 
-        data.ff = file->private_data;
+        data.file = file;
         data.inode = inode;
         data.req = fuse_get_req(fc);
         err = PTR_ERR(data.req);
@@ -444,7 +447,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
         if (!err) {
                 if (data.req->num_pages)
-                        fuse_send_readpages(data.req, data.ff, inode);
+                        fuse_send_readpages(data.req, file, inode);
                 else
                         fuse_put_request(fc, data.req);
         }
@@ -452,11 +455,31 @@ out:
         return err;
 }
 
-static void fuse_write_fill(struct fuse_req *req, struct fuse_file *ff,
+static ssize_t fuse_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
+                                  unsigned long nr_segs, loff_t pos)
+{
+        struct inode *inode = iocb->ki_filp->f_mapping->host;
+
+        if (pos + iov_length(iov, nr_segs) > i_size_read(inode)) {
+                int err;
+                /*
+                 * If trying to read past EOF, make sure the i_size
+                 * attribute is up-to-date.
+                 */
+                err = fuse_update_attributes(inode, NULL, iocb->ki_filp, NULL);
+                if (err)
+                        return err;
+        }
+
+        return generic_file_aio_read(iocb, iov, nr_segs, pos);
+}
+
+static void fuse_write_fill(struct fuse_req *req, struct file *file,
                             struct inode *inode, loff_t pos, size_t count,
                             int writepage)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
+        struct fuse_file *ff = file->private_data;
         struct fuse_write_in *inarg = &req->misc.write.in;
         struct fuse_write_out *outarg = &req->misc.write.out;
 
@@ -465,6 +488,7 @@ static void fuse_write_fill(struct fuse_req *req, struct fuse_file *ff,
         inarg->offset = pos;
         inarg->size = count;
         inarg->write_flags = writepage ? FUSE_WRITE_CACHE : 0;
+        inarg->flags = file->f_flags;
         req->in.h.opcode = FUSE_WRITE;
         req->in.h.nodeid = get_node_id(inode);
         req->in.argpages = 1;
@@ -485,7 +509,7 @@ static size_t fuse_send_write(struct fuse_req *req, struct file *file,
                               fl_owner_t owner)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
-        fuse_write_fill(req, file->private_data, inode, pos, count, 0);
+        fuse_write_fill(req, file, inode, pos, count, 0);
         if (owner != NULL) {
                 struct fuse_write_in *inarg = &req->misc.write.in;
                 inarg->write_flags |= FUSE_WRITE_LOCKOWNER;
@@ -886,7 +910,7 @@ static sector_t fuse_bmap(struct address_space *mapping, sector_t block)
 static const struct file_operations fuse_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
-        .aio_read       = generic_file_aio_read,
+        .aio_read       = fuse_file_aio_read,
         .write          = do_sync_write,
         .aio_write      = generic_file_aio_write,
         .mmap           = fuse_file_mmap,
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 6c5461de1a5f..3ab8a3048e8b 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -447,7 +447,7 @@ void fuse_send_forget(struct fuse_conn *fc, struct fuse_req *req,
 /**
  * Initialize READ or READDIR request
  */
-void fuse_read_fill(struct fuse_req *req, struct fuse_file *ff,
+void fuse_read_fill(struct fuse_req *req, struct file *file,
                     struct inode *inode, loff_t pos, size_t count, int opcode);
 
 /**
@@ -593,3 +593,6 @@ int fuse_valid_type(int m);
 int fuse_allow_task(struct fuse_conn *fc, struct task_struct *task);
 
 u64 fuse_lock_owner_id(struct fuse_conn *fc, fl_owner_t id);
+
+int fuse_update_attributes(struct inode *inode, struct kstat *stat,
+                           struct file *file, bool *refreshed);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 9a68d6970845..84f9f7dfdf5b 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -56,6 +56,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
         fi->i_time = 0;
         fi->nodeid = 0;
         fi->nlookup = 0;
+        fi->attr_version = 0;
         INIT_LIST_HEAD(&fi->write_files);
         fi->forget_req = fuse_request_alloc();
         if (!fi->forget_req) {
@@ -562,8 +563,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
         arg->major = FUSE_KERNEL_VERSION;
         arg->minor = FUSE_KERNEL_MINOR_VERSION;
         arg->max_readahead = fc->bdi.ra_pages * PAGE_CACHE_SIZE;
-        arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_FILE_OPS |
-                FUSE_ATOMIC_O_TRUNC;
+        arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC;
         req->in.h.opcode = FUSE_INIT;
         req->in.numargs = 1;
         req->in.args[0].size = sizeof(*arg);
diff --git a/fs/gfs2/ops_export.c b/fs/gfs2/ops_export.c
index e2d1347796a9..b9da62348a87 100644
--- a/fs/gfs2/ops_export.c
+++ b/fs/gfs2/ops_export.c
@@ -31,40 +31,6 @@
 #define GFS2_LARGE_FH_SIZE 8
 #define GFS2_OLD_FH_SIZE 10
 
-static struct dentry *gfs2_decode_fh(struct super_block *sb,
-                                     __u32 *p,
-                                     int fh_len,
-                                     int fh_type,
-                                     int (*acceptable)(void *context,
-                                                       struct dentry *dentry),
-                                     void *context)
-{
-        __be32 *fh = (__force __be32 *)p;
-        struct gfs2_inum_host inum, parent;
-
-        memset(&parent, 0, sizeof(struct gfs2_inum));
-
-        switch (fh_len) {
-        case GFS2_LARGE_FH_SIZE:
-        case GFS2_OLD_FH_SIZE:
-                parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32;
-                parent.no_formal_ino |= be32_to_cpu(fh[5]);
-                parent.no_addr = ((u64)be32_to_cpu(fh[6])) << 32;
-                parent.no_addr |= be32_to_cpu(fh[7]);
-        case GFS2_SMALL_FH_SIZE:
-                inum.no_formal_ino = ((u64)be32_to_cpu(fh[0])) << 32;
-                inum.no_formal_ino |= be32_to_cpu(fh[1]);
-                inum.no_addr = ((u64)be32_to_cpu(fh[2])) << 32;
-                inum.no_addr |= be32_to_cpu(fh[3]);
-                break;
-        default:
-                return NULL;
-        }
-
-        return gfs2_export_ops.find_exported_dentry(sb, &inum, &parent,
-                                                    acceptable, context);
-}
-
 static int gfs2_encode_fh(struct dentry *dentry, __u32 *p, int *len,
                           int connectable)
 {
@@ -189,10 +155,10 @@ static struct dentry *gfs2_get_parent(struct dentry *child)
         return dentry;
 }
 
-static struct dentry *gfs2_get_dentry(struct super_block *sb, void *inum_obj)
+static struct dentry *gfs2_get_dentry(struct super_block *sb,
+                struct gfs2_inum_host *inum)
 {
         struct gfs2_sbd *sdp = sb->s_fs_info;
-        struct gfs2_inum_host *inum = inum_obj;
         struct gfs2_holder i_gh, ri_gh, rgd_gh;
         struct gfs2_rgrpd *rgd;
         struct inode *inode;
@@ -289,11 +255,50 @@ fail:
         return ERR_PTR(error);
 }
 
-struct export_operations gfs2_export_ops = {
-        .decode_fh = gfs2_decode_fh,
+static struct dentry *gfs2_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        struct gfs2_inum_host this;
+        __be32 *fh = (__force __be32 *)fid->raw;
+
+        switch (fh_type) {
+        case GFS2_SMALL_FH_SIZE:
+        case GFS2_LARGE_FH_SIZE:
+        case GFS2_OLD_FH_SIZE:
+                this.no_formal_ino = ((u64)be32_to_cpu(fh[0])) << 32;
+                this.no_formal_ino |= be32_to_cpu(fh[1]);
+                this.no_addr = ((u64)be32_to_cpu(fh[2])) << 32;
+                this.no_addr |= be32_to_cpu(fh[3]);
+                return gfs2_get_dentry(sb, &this);
+        default:
+                return NULL;
+        }
+}
+
+static struct dentry *gfs2_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        struct gfs2_inum_host parent;
+        __be32 *fh = (__force __be32 *)fid->raw;
+
+        switch (fh_type) {
+        case GFS2_LARGE_FH_SIZE:
+        case GFS2_OLD_FH_SIZE:
+                parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32;
+                parent.no_formal_ino |= be32_to_cpu(fh[5]);
+                parent.no_addr = ((u64)be32_to_cpu(fh[6])) << 32;
+                parent.no_addr |= be32_to_cpu(fh[7]);
+                return gfs2_get_dentry(sb, &parent);
+        default:
+                return NULL;
+        }
+}
+
+const struct export_operations gfs2_export_ops = {
         .encode_fh = gfs2_encode_fh,
+        .fh_to_dentry = gfs2_fh_to_dentry,
+        .fh_to_parent = gfs2_fh_to_parent,
         .get_name = gfs2_get_name,
         .get_parent = gfs2_get_parent,
-        .get_dentry = gfs2_get_dentry,
 };
 
diff --git a/fs/gfs2/ops_fstype.h b/fs/gfs2/ops_fstype.h
index 407029b3b2b3..da8490511836 100644
--- a/fs/gfs2/ops_fstype.h
+++ b/fs/gfs2/ops_fstype.h
@@ -14,6 +14,6 @@
 
 extern struct file_system_type gfs2_fs_type;
 extern struct file_system_type gfs2meta_fs_type;
-extern struct export_operations gfs2_export_ops;
+extern const struct export_operations gfs2_export_ops;
 
 #endif /* __OPS_FSTYPE_DOT_H__ */
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 12aca8ed605f..09ee07f02663 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -364,7 +364,6 @@ static void truncate_hugepages(struct inode *inode, loff_t lstart)
                         ++next;
                         truncate_huge_page(page);
                         unlock_page(page);
-                        hugetlb_put_quota(mapping);
                         freed++;
                 }
                 huge_pagevec_release(&pvec);
@@ -859,15 +858,15 @@ out_free:
         return -ENOMEM;
 }
 
-int hugetlb_get_quota(struct address_space *mapping)
+int hugetlb_get_quota(struct address_space *mapping, long delta)
 {
         int ret = 0;
         struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
 
         if (sbinfo->free_blocks > -1) {
                 spin_lock(&sbinfo->stat_lock);
-                if (sbinfo->free_blocks > 0)
-                        sbinfo->free_blocks--;
+                if (sbinfo->free_blocks - delta >= 0)
+                        sbinfo->free_blocks -= delta;
                 else
                         ret = -ENOMEM;
                 spin_unlock(&sbinfo->stat_lock);
@@ -876,13 +875,13 @@ int hugetlb_get_quota(struct address_space *mapping)
         return ret;
 }
 
-void hugetlb_put_quota(struct address_space *mapping)
+void hugetlb_put_quota(struct address_space *mapping, long delta)
 {
         struct hugetlbfs_sb_info *sbinfo = HUGETLBFS_SB(mapping->host->i_sb);
 
         if (sbinfo->free_blocks > -1) {
                 spin_lock(&sbinfo->stat_lock);
-                sbinfo->free_blocks++;
+                sbinfo->free_blocks += delta;
                 spin_unlock(&sbinfo->stat_lock);
         }
 }
diff --git a/fs/inotify.c b/fs/inotify.c
index 7457501b9565..2c5b92152876 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -667,6 +667,49 @@ out:
 EXPORT_SYMBOL_GPL(inotify_add_watch);
 
 /**
+ * inotify_clone_watch - put the watch next to existing one
+ * @old: already installed watch
+ * @new: new watch
+ *
+ * Caller must hold the inotify_mutex of inode we are dealing with;
+ * it is expected to remove the old watch before unlocking the inode.
+ */
+s32 inotify_clone_watch(struct inotify_watch *old, struct inotify_watch *new)
+{
+        struct inotify_handle *ih = old->ih;
+        int ret = 0;
+
+        new->mask = old->mask;
+        new->ih = ih;
+
+        mutex_lock(&ih->mutex);
+
+        /* Initialize a new watch */
+        ret = inotify_handle_get_wd(ih, new);
+        if (unlikely(ret))
+                goto out;
+        ret = new->wd;
+
+        get_inotify_handle(ih);
+
+        new->inode = igrab(old->inode);
+
+        list_add(&new->h_list, &ih->watches);
+        list_add(&new->i_list, &old->inode->inotify_watches);
+out:
+        mutex_unlock(&ih->mutex);
+        return ret;
+}
+
+void inotify_evict_watch(struct inotify_watch *watch)
+{
+        get_inotify_watch(watch);
+        mutex_lock(&watch->ih->mutex);
+        inotify_remove_watch_locked(watch->ih, watch);
+        mutex_unlock(&watch->ih->mutex);
+}
+
+/**
  * inotify_rm_wd - remove a watch from an inotify instance
  * @ih: inotify handle
  * @wd: watch descriptor to remove
diff --git a/fs/ioprio.c b/fs/ioprio.c
index 10d2c211d18b..e4e01bc7f338 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -25,6 +25,7 @@
 #include <linux/capability.h>
 #include <linux/syscalls.h>
 #include <linux/security.h>
+#include <linux/pid_namespace.h>
 
 static int set_task_ioprio(struct task_struct *task, int ioprio)
 {
@@ -77,6 +78,10 @@ asmlinkage long sys_ioprio_set(int which, int who, int ioprio)
                         if (!capable(CAP_SYS_ADMIN))
                                 return -EPERM;
                         break;
+                case IOPRIO_CLASS_NONE:
+                        if (data)
+                                return -EINVAL;
+                        break;
                 default:
                         return -EINVAL;
         }
@@ -93,7 +98,7 @@ asmlinkage long sys_ioprio_set(int which, int who, int ioprio)
                         if (!who)
                                 p = current;
                         else
-                                p = find_task_by_pid(who);
+                                p = find_task_by_vpid(who);
                         if (p)
                                 ret = set_task_ioprio(p, ioprio);
                         break;
@@ -101,7 +106,7 @@ asmlinkage long sys_ioprio_set(int which, int who, int ioprio)
                         if (!who)
                                 pgrp = task_pgrp(current);
                         else
-                                pgrp = find_pid(who);
+                                pgrp = find_vpid(who);
                         do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
                                 ret = set_task_ioprio(p, ioprio);
                                 if (ret)
@@ -180,7 +185,7 @@ asmlinkage long sys_ioprio_get(int which, int who)
                         if (!who)
                                 p = current;
                         else
-                                p = find_task_by_pid(who);
+                                p = find_task_by_vpid(who);
                         if (p)
                                 ret = get_task_ioprio(p);
                         break;
@@ -188,7 +193,7 @@ asmlinkage long sys_ioprio_get(int which, int who)
                         if (!who)
                                 pgrp = task_pgrp(current);
                         else
-                                pgrp = find_pid(who);
+                                pgrp = find_vpid(who);
                         do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
                                 tmpio = get_task_ioprio(p);
                                 if (tmpio < 0)
diff --git a/fs/isofs/export.c b/fs/isofs/export.c
index 4af856a7fda7..29f9753ae5e5 100644
--- a/fs/isofs/export.c
+++ b/fs/isofs/export.c
@@ -42,16 +42,6 @@ isofs_export_iget(struct super_block *sb,
         return result;
 }
 
-static struct dentry *
-isofs_export_get_dentry(struct super_block *sb, void *vobjp)
-{
-        __u32 *objp = vobjp;
-        unsigned long block = objp[0];
-        unsigned long offset = objp[1];
-        __u32 generation = objp[2];
-        return isofs_export_iget(sb, block, offset, generation);
-}
-
 /* This function is surprisingly simple.  The trick is understanding
  * that "child" is always a directory. So, to find its parent, you
  * simply need to find its ".." entry, normalize its block and offset,
@@ -182,43 +172,44 @@ isofs_export_encode_fh(struct dentry *dentry,
         return type;
 }
 
+struct isofs_fid {
+        u32 block;
+        u16 offset;
+        u16 parent_offset;
+        u32 generation;
+        u32 parent_block;
+        u32 parent_generation;
+};
 
-static struct dentry *
-isofs_export_decode_fh(struct super_block *sb,
-                       __u32 *fh32,
-                       int fh_len,
-                       int fileid_type,
-                       int (*acceptable)(void *context, struct dentry *de),
-                       void *context)
+static struct dentry *isofs_fh_to_dentry(struct super_block *sb,
+        struct fid *fid, int fh_len, int fh_type)
 {
-        __u16 *fh16 = (__u16*)fh32;
-        __u32 child[3];   /* The child is what triggered all this. */
-        __u32 parent[3];  /* The parent is just along for the ride. */
+        struct isofs_fid *ifid = (struct isofs_fid *)fid;
 
-        if (fh_len < 3 || fileid_type > 2)
+        if (fh_len < 3 || fh_type > 2)
                 return NULL;
 
-        child[0] = fh32[0];
-        child[1] = fh16[2];  /* fh16 [sic] */
-        child[2] = fh32[2];
-
-        parent[0] = 0;
-        parent[1] = 0;
-        parent[2] = 0;
-        if (fileid_type == 2) {
-                if (fh_len > 2) parent[0] = fh32[3];
-                parent[1] = fh16[3];  /* fh16 [sic] */
-                if (fh_len > 4) parent[2] = fh32[4];
-        }
-
-        return sb->s_export_op->find_exported_dentry(sb, child, parent,
-                                                     acceptable, context);
+        return isofs_export_iget(sb, ifid->block, ifid->offset,
+                        ifid->generation);
 }
 
+static struct dentry *isofs_fh_to_parent(struct super_block *sb,
+                struct fid *fid, int fh_len, int fh_type)
+{
+        struct isofs_fid *ifid = (struct isofs_fid *)fid;
+
+        if (fh_type != 2)
+                return NULL;
+
+        return isofs_export_iget(sb,
+                        fh_len > 2 ? ifid->parent_block : 0,
+                        ifid->parent_offset,
+                        fh_len > 4 ? ifid->parent_generation : 0);
+}
 
-struct export_operations isofs_export_ops = {
-        .decode_fh      = isofs_export_decode_fh,
+const struct export_operations isofs_export_ops = {
         .encode_fh      = isofs_export_encode_fh,
-        .get_dentry     = isofs_export_get_dentry,
+        .fh_to_dentry   = isofs_fh_to_dentry,
+        .fh_to_parent   = isofs_fh_to_parent,
         .get_parent     = isofs_export_get_parent,
 };
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index aa359a2e4ce6..09e3d306e96f 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -3,7 +3,7 @@
  *
  *  (C) 1991  Linus Torvalds - minix filesystem
  *      1992, 1993, 1994  Eric Youngdale Modified for ISO 9660 filesystem.
- *      1994  Eberhard Moenkeberg - multi session handling.
+ *      1994  Eberhard Mönkeberg - multi session handling.
  *      1995  Mark Dobie - allow mounting of some weird VideoCDs and PhotoCDs.
  *      1997  Gordon Chaffee - Joliet CDs
  *      1998  Eric Lammerts - ISO 9660 Level 3
diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
index a07e67b1ea7f..f3213f9f89af 100644
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -178,4 +178,4 @@ isofs_normalize_block_and_offset(struct iso_directory_record* de,
 extern const struct inode_operations isofs_dir_inode_operations;
 extern const struct file_operations isofs_dir_operations;
 extern const struct address_space_operations isofs_symlink_aops;
-extern struct export_operations isofs_export_ops;
+extern const struct export_operations isofs_export_ops;
diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
index 47552d4a6324..0f69c416eebc 100644
--- a/fs/jbd/checkpoint.c
+++ b/fs/jbd/checkpoint.c
@@ -602,15 +602,15 @@ int __journal_remove_checkpoint(struct journal_head *jh)
 
         /*
          * There is one special case to worry about: if we have just pulled the
-         * buffer off a committing transaction's forget list, then even if the
-         * checkpoint list is empty, the transaction obviously cannot be
-         * dropped!
+         * buffer off a running or committing transaction's checkpoing list,
+         * then even if the checkpoint list is empty, the transaction obviously
+         * cannot be dropped!
          *
-         * The locking here around j_committing_transaction is a bit sleazy.
+         * The locking here around t_state is a bit sleazy.
          * See the comment at the end of journal_commit_transaction().
          */
-        if (transaction == journal->j_committing_transaction) {
-                JBUFFER_TRACE(jh, "belongs to committing transaction");
+        if (transaction->t_state != T_FINISHED) {
+                JBUFFER_TRACE(jh, "belongs to running/committing transaction");
                 goto out;
         }
 
diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
index a263d82761df..610264b99a8e 100644
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -466,7 +466,7 @@ void journal_commit_transaction(journal_t *journal)
         spin_unlock(&journal->j_list_lock);
 
         if (err)
-                __journal_abort_hard(journal);
+                journal_abort(journal, err);
 
         journal_write_revoke_records(journal, commit_transaction);
 
@@ -524,7 +524,7 @@ void journal_commit_transaction(journal_t *journal)
 
                         descriptor = journal_get_descriptor_buffer(journal);
                         if (!descriptor) {
-                                __journal_abort_hard(journal);
+                                journal_abort(journal, -EIO);
                                 continue;
                         }
 
@@ -557,7 +557,7 @@ void journal_commit_transaction(journal_t *journal)
                    and repeat this loop: we'll fall into the
                    refile-on-abort condition above. */
                 if (err) {
-                        __journal_abort_hard(journal);
+                        journal_abort(journal, err);
                         continue;
                 }
 
@@ -748,7 +748,7 @@ wait_for_iobuf:
                 err = -EIO;
 
         if (err)
-                __journal_abort_hard(journal);
+                journal_abort(journal, err);
 
         /* End of a transaction!  Finally, we can do checkpoint
            processing: any buffers committed as a result of this
@@ -858,10 +858,10 @@ restart_loop:
         }
         spin_unlock(&journal->j_list_lock);
         /*
-         * This is a bit sleazy.  We borrow j_list_lock to protect
-         * journal->j_committing_transaction in __journal_remove_checkpoint.
-         * Really, __journal_remove_checkpoint should be using j_state_lock but
-         * it's a bit hassle to hold that across __journal_remove_checkpoint
+         * This is a bit sleazy.  We use j_list_lock to protect transition
+         * of a transaction into T_FINISHED state and calling
+         * __journal_drop_transaction(). Otherwise we could race with
+         * other checkpointing code processing the transaction...
          */
         spin_lock(&journal->j_state_lock);
         spin_lock(&journal->j_list_lock);
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 5d9fec0b7ebd..5d14243499d4 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -35,6 +35,7 @@
 #include <linux/kthread.h>
 #include <linux/poison.h>
 #include <linux/proc_fs.h>
+#include <linux/debugfs.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -654,10 +655,9 @@ static journal_t * journal_init_common (void)
         journal_t *journal;
         int err;
 
-        journal = kmalloc(sizeof(*journal), GFP_KERNEL);
+        journal = kzalloc(sizeof(*journal), GFP_KERNEL);
         if (!journal)
                 goto fail;
-        memset(journal, 0, sizeof(*journal));
 
         init_waitqueue_head(&journal->j_wait_transaction_locked);
         init_waitqueue_head(&journal->j_wait_logspace);
@@ -1852,64 +1852,41 @@ void journal_put_journal_head(struct journal_head *jh)
 }
 
 /*
- * /proc tunables
+ * debugfs tunables
  */
-#if defined(CONFIG_JBD_DEBUG)
-int journal_enable_debug;
-EXPORT_SYMBOL(journal_enable_debug);
-#endif
+#ifdef CONFIG_JBD_DEBUG
 
-#if defined(CONFIG_JBD_DEBUG) && defined(CONFIG_PROC_FS)
+u8 journal_enable_debug __read_mostly;
+EXPORT_SYMBOL(journal_enable_debug);
 
-static struct proc_dir_entry *proc_jbd_debug;
+static struct dentry *jbd_debugfs_dir;
+static struct dentry *jbd_debug;
 
-static int read_jbd_debug(char *page, char **start, off_t off,
-                          int count, int *eof, void *data)
+static void __init jbd_create_debugfs_entry(void)
 {
-        int ret;
-
-        ret = sprintf(page + off, "%d\n", journal_enable_debug);
-        *eof = 1;
-        return ret;
+        jbd_debugfs_dir = debugfs_create_dir("jbd", NULL);
+        if (jbd_debugfs_dir)
+                jbd_debug = debugfs_create_u8("jbd-debug", S_IRUGO,
+                                               jbd_debugfs_dir,
+                                               &journal_enable_debug);
 }
 
-static int write_jbd_debug(struct file *file, const char __user *buffer,
-                           unsigned long count, void *data)
+static void __exit jbd_remove_debugfs_entry(void)
 {
-        char buf[32];
-
-        if (count > ARRAY_SIZE(buf) - 1)
-                count = ARRAY_SIZE(buf) - 1;
-        if (copy_from_user(buf, buffer, count))
-                return -EFAULT;
-        buf[ARRAY_SIZE(buf) - 1] = '\0';
-        journal_enable_debug = simple_strtoul(buf, NULL, 10);
-        return count;
+        debugfs_remove(jbd_debug);
+        debugfs_remove(jbd_debugfs_dir);
 }
 
-#define JBD_PROC_NAME "sys/fs/jbd-debug"
+#else
 
-static void __init create_jbd_proc_entry(void)
+static inline void jbd_create_debugfs_entry(void)
 {
-        proc_jbd_debug = create_proc_entry(JBD_PROC_NAME, 0644, NULL);
-        if (proc_jbd_debug) {
-                /* Why is this so hard? */
-                proc_jbd_debug->read_proc = read_jbd_debug;
-                proc_jbd_debug->write_proc = write_jbd_debug;
-        }
 }
 
-static void __exit remove_jbd_proc_entry(void)
+static inline void jbd_remove_debugfs_entry(void)
 {
-        if (proc_jbd_debug)
-                remove_proc_entry(JBD_PROC_NAME, NULL);
 }
 
-#else
-
-#define create_jbd_proc_entry() do {} while (0)
-#define remove_jbd_proc_entry() do {} while (0)
-
 #endif
 
 struct kmem_cache *jbd_handle_cache;
@@ -1966,7 +1943,7 @@ static int __init journal_init(void)
         ret = journal_init_caches();
         if (ret != 0)
                 journal_destroy_caches();
-        create_jbd_proc_entry();
+        jbd_create_debugfs_entry();
         return ret;
 }
 
@@ -1977,7 +1954,7 @@ static void __exit journal_exit(void)
         if (n)
                 printk(KERN_EMERG "JBD: leaked %d journal_heads!\n", n);
 #endif
-        remove_jbd_proc_entry();
+        jbd_remove_debugfs_entry();
         journal_destroy_caches();
 }
 
diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
index 2a5f4b833e35..c5d9694b6a2f 100644
--- a/fs/jbd/recovery.c
+++ b/fs/jbd/recovery.c
@@ -250,10 +250,10 @@ int journal_recover(journal_t *journal)
         if (!err)
                 err = do_one_pass(journal, &info, PASS_REPLAY);
 
-        jbd_debug(0, "JBD: recovery, exit status %d, "
+        jbd_debug(1, "JBD: recovery, exit status %d, "
                   "recovered transactions %u to %u\n",
                   err, info.start_transaction, info.end_transaction);
-        jbd_debug(0, "JBD: Replayed %d and revoked %d/%d blocks\n",
+        jbd_debug(1, "JBD: Replayed %d and revoked %d/%d blocks\n",
                   info.nr_replays, info.nr_revoke_hits, info.nr_revokes);
 
         /* Restart the log at the next transaction ID, thus invalidating
@@ -297,7 +297,7 @@ int journal_skip_recovery(journal_t *journal)
 #ifdef CONFIG_JBD_DEBUG
                 int dropped = info.end_transaction - be32_to_cpu(sb->s_sequence);
 #endif
-                jbd_debug(0,
+                jbd_debug(1,
                           "JBD: ignoring %d transaction%s from the journal.\n",
                           dropped, (dropped == 1) ? "" : "s");
                 journal->j_transaction_sequence = ++info.end_transaction;
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 9841b1e5af03..08ff6c7028cc 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -96,13 +96,12 @@ static int start_this_handle(journal_t *journal, handle_t *handle)
 
 alloc_transaction:
         if (!journal->j_running_transaction) {
-                new_transaction = kmalloc(sizeof(*new_transaction),
+                new_transaction = kzalloc(sizeof(*new_transaction),
                                                 GFP_NOFS|__GFP_NOFAIL);
                 if (!new_transaction) {
                         ret = -ENOMEM;
                         goto out;
                 }
-                memset(new_transaction, 0, sizeof(*new_transaction));
         }
 
         jbd_debug(3, "New handle %p going live.\n", handle);
diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index 8ec9323e830a..77fc5838609c 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -228,11 +228,28 @@ struct posix_acl *jffs2_get_acl(struct inode *inode, int type)
         return acl;
 }
 
+static int __jffs2_set_acl(struct inode *inode, int xprefix, struct posix_acl *acl)
+{
+        char *value = NULL;
+        size_t size = 0;
+        int rc;
+
+        if (acl) {
+                value = jffs2_acl_to_medium(acl, &size);
+                if (IS_ERR(value))
+                        return PTR_ERR(value);
+        }
+        rc = do_jffs2_setxattr(inode, xprefix, "", value, size, 0);
+        if (!value && rc == -ENODATA)
+                rc = 0;
+        kfree(value);
+
+        return rc;
+}
+
 static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
 {
         struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
-        size_t size = 0;
-        char *value = NULL;
         int rc, xprefix;
 
         if (S_ISLNK(inode->i_mode))
@@ -267,17 +284,7 @@ static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
         default:
                 return -EINVAL;
         }
-        if (acl) {
-                value = jffs2_acl_to_medium(acl, &size);
-                if (IS_ERR(value))
-                        return PTR_ERR(value);
-        }
-
-        rc = do_jffs2_setxattr(inode, xprefix, "", value, size, 0);
-        if (!value && rc == -ENODATA)
-                rc = 0;
-        if (value)
-                kfree(value);
+        rc = __jffs2_set_acl(inode, xprefix, acl);
         if (!rc) {
                 switch(type) {
                 case ACL_TYPE_ACCESS:
@@ -312,38 +319,60 @@ int jffs2_permission(struct inode *inode, int mask, struct nameidata *nd)
         return generic_permission(inode, mask, jffs2_check_acl);
 }
 
-int jffs2_init_acl(struct inode *inode, struct posix_acl *acl)
+int jffs2_init_acl_pre(struct inode *dir_i, struct inode *inode, int *i_mode)
 {
         struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
-        struct posix_acl *clone;
-        mode_t mode;
-        int rc = 0;
+        struct posix_acl *acl, *clone;
+        int rc;
 
-        f->i_acl_access = JFFS2_ACL_NOT_CACHED;
-        f->i_acl_default = JFFS2_ACL_NOT_CACHED;
+        f->i_acl_default = NULL;
+        f->i_acl_access = NULL;
+
+        if (S_ISLNK(*i_mode))
+                return 0;       /* Symlink always has no-ACL */
+
+        acl = jffs2_get_acl(dir_i, ACL_TYPE_DEFAULT);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+
+        if (!acl) {
+                *i_mode &= ~current->fs->umask;
+        } else {
+                if (S_ISDIR(*i_mode))
+                        jffs2_iset_acl(inode, &f->i_acl_default, acl);
 
-        if (acl) {
-                if (S_ISDIR(inode->i_mode)) {
-                        rc = jffs2_set_acl(inode, ACL_TYPE_DEFAULT, acl);
-                        if (rc)
-                                goto cleanup;
-                }
                 clone = posix_acl_clone(acl, GFP_KERNEL);
-                rc = -ENOMEM;
                 if (!clone)
-                        goto cleanup;
-                mode = inode->i_mode;
-                rc = posix_acl_create_masq(clone, &mode);
-                if (rc >= 0) {
-                        inode->i_mode = mode;
-                        if (rc > 0)
-                                rc = jffs2_set_acl(inode, ACL_TYPE_ACCESS, clone);
-                }
+                        return -ENOMEM;
+                rc = posix_acl_create_masq(clone, (mode_t *)i_mode);
+                if (rc < 0)
+                        return rc;
+                if (rc > 0)
+                        jffs2_iset_acl(inode, &f->i_acl_access, clone);
+
                 posix_acl_release(clone);
         }
- cleanup:
-        posix_acl_release(acl);
-        return rc;
+        return 0;
+}
+
+int jffs2_init_acl_post(struct inode *inode)
+{
+        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        int rc;
+
+        if (f->i_acl_default) {
+                rc = __jffs2_set_acl(inode, JFFS2_XPREFIX_ACL_DEFAULT, f->i_acl_default);
+                if (rc)
+                        return rc;
+        }
+
+        if (f->i_acl_access) {
+                rc = __jffs2_set_acl(inode, JFFS2_XPREFIX_ACL_ACCESS, f->i_acl_access);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
 }
 
 void jffs2_clear_acl(struct jffs2_inode_info *f)
diff --git a/fs/jffs2/acl.h b/fs/jffs2/acl.h
index 90a2dbf59051..76c6ebd1acd9 100644
--- a/fs/jffs2/acl.h
+++ b/fs/jffs2/acl.h
@@ -31,7 +31,8 @@ struct jffs2_acl_header {
 extern struct posix_acl *jffs2_get_acl(struct inode *inode, int type);
 extern int jffs2_permission(struct inode *, int, struct nameidata *);
 extern int jffs2_acl_chmod(struct inode *);
-extern int jffs2_init_acl(struct inode *, struct posix_acl *);
+extern int jffs2_init_acl_pre(struct inode *, struct inode *, int *);
+extern int jffs2_init_acl_post(struct inode *);
 extern void jffs2_clear_acl(struct jffs2_inode_info *);
 
 extern struct xattr_handler jffs2_acl_access_xattr_handler;
@@ -39,10 +40,11 @@ extern struct xattr_handler jffs2_acl_default_xattr_handler;
 
 #else
 
-#define jffs2_get_acl(inode, type)      (NULL)
-#define jffs2_permission NULL
-#define jffs2_acl_chmod(inode)          (0)
-#define jffs2_init_acl(inode,dir)       (0)
+#define jffs2_get_acl(inode, type)              (NULL)
+#define jffs2_permission                        (NULL)
+#define jffs2_acl_chmod(inode)                  (0)
+#define jffs2_init_acl_pre(dir_i,inode,mode)    (0)
+#define jffs2_init_acl_post(inode)              (0)
 #define jffs2_clear_acl(f)
 
 #endif  /* CONFIG_JFFS2_FS_POSIX_ACL */
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index d568ae846741..8adebd3e43c6 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -105,7 +105,7 @@ static int jffs2_garbage_collect_thread(void *_c)
 
                 /* Put_super will send a SIGKILL and then wait on the sem.
                  */
-                while (signal_pending(current)) {
+                while (signal_pending(current) || freezing(current)) {
                         siginfo_t info;
                         unsigned long signr;
 
diff --git a/fs/jffs2/debug.h b/fs/jffs2/debug.h
index 2a49f2c51a9f..4130adabd76e 100644
--- a/fs/jffs2/debug.h
+++ b/fs/jffs2/debug.h
@@ -80,28 +80,28 @@
 #define JFFS2_ERROR(fmt, ...)                                           \
         do {                                                            \
                 printk(JFFS2_ERR_MSG_PREFIX                             \
-                        " (%d) %s: " fmt, current->pid,                 \
+                        " (%d) %s: " fmt, task_pid_nr(current),         \
                         __FUNCTION__ , ##__VA_ARGS__);                  \
         } while(0)
 
 #define JFFS2_WARNING(fmt, ...)                                         \
         do {                                                            \
                 printk(JFFS2_WARN_MSG_PREFIX                            \
-                        " (%d) %s: " fmt, current->pid,                 \
+                        " (%d) %s: " fmt, task_pid_nr(current),         \
                         __FUNCTION__ , ##__VA_ARGS__);                  \
         } while(0)
 
 #define JFFS2_NOTICE(fmt, ...)                                          \
         do {                                                            \
                 printk(JFFS2_NOTICE_MSG_PREFIX                          \
-                        " (%d) %s: " fmt, current->pid,                 \
+                        " (%d) %s: " fmt, task_pid_nr(current),         \
                         __FUNCTION__ , ##__VA_ARGS__);                  \
         } while(0)
 
 #define JFFS2_DEBUG(fmt, ...)                                           \
         do {                                                            \
                 printk(JFFS2_DBG_MSG_PREFIX                             \
-                        " (%d) %s: " fmt, current->pid,                 \
+                        " (%d) %s: " fmt, task_pid_nr(current),         \
                         __FUNCTION__ , ##__VA_ARGS__);                  \
         } while(0)
 
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index 8353eb9c1799..787e392ffd41 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -182,7 +182,6 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
         struct jffs2_inode_info *f, *dir_f;
         struct jffs2_sb_info *c;
         struct inode *inode;
-        struct posix_acl *acl;
         int ret;
 
         ri = jffs2_alloc_raw_inode();
@@ -193,7 +192,7 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
 
         D1(printk(KERN_DEBUG "jffs2_create()\n"));
 
-        inode = jffs2_new_inode(dir_i, mode, ri, &acl);
+        inode = jffs2_new_inode(dir_i, mode, ri);
 
         if (IS_ERR(inode)) {
                 D1(printk(KERN_DEBUG "jffs2_new_inode() failed\n"));
@@ -211,14 +210,6 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
 
         ret = jffs2_do_create(c, dir_f, f, ri,
                               dentry->d_name.name, dentry->d_name.len);
-
-        if (ret)
-                goto fail_acl;
-
-        ret = jffs2_init_security(inode, dir_i);
-        if (ret)
-                goto fail_acl;
-        ret = jffs2_init_acl(inode, acl);
         if (ret)
                 goto fail;
 
@@ -231,8 +222,6 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
                   inode->i_ino, inode->i_mode, inode->i_nlink, f->inocache->nlink, inode->i_mapping->nrpages));
         return 0;
 
- fail_acl:
-        posix_acl_release(acl);
  fail:
         make_bad_inode(inode);
         iput(inode);
@@ -309,7 +298,6 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         struct jffs2_full_dirent *fd;
         int namelen;
         uint32_t alloclen;
-        struct posix_acl *acl;
         int ret, targetlen = strlen(target);
 
         /* FIXME: If you care. We'd need to use frags for the target
@@ -336,7 +324,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 return ret;
         }
 
-        inode = jffs2_new_inode(dir_i, S_IFLNK | S_IRWXUGO, ri, &acl);
+        inode = jffs2_new_inode(dir_i, S_IFLNK | S_IRWXUGO, ri);
 
         if (IS_ERR(inode)) {
                 jffs2_free_raw_inode(ri);
@@ -366,7 +354,6 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 up(&f->sem);
                 jffs2_complete_reservation(c);
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return PTR_ERR(fn);
         }
 
@@ -377,7 +364,6 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 up(&f->sem);
                 jffs2_complete_reservation(c);
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return -ENOMEM;
         }
 
@@ -395,10 +381,9 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         ret = jffs2_init_security(inode, dir_i);
         if (ret) {
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return ret;
         }
-        ret = jffs2_init_acl(inode, acl);
+        ret = jffs2_init_acl_post(inode);
         if (ret) {
                 jffs2_clear_inode(inode);
                 return ret;
@@ -476,7 +461,6 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         struct jffs2_full_dirent *fd;
         int namelen;
         uint32_t alloclen;
-        struct posix_acl *acl;
         int ret;
 
         mode |= S_IFDIR;
@@ -499,7 +483,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 return ret;
         }
 
-        inode = jffs2_new_inode(dir_i, mode, ri, &acl);
+        inode = jffs2_new_inode(dir_i, mode, ri);
 
         if (IS_ERR(inode)) {
                 jffs2_free_raw_inode(ri);
@@ -526,7 +510,6 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 up(&f->sem);
                 jffs2_complete_reservation(c);
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return PTR_ERR(fn);
         }
         /* No data here. Only a metadata node, which will be
@@ -540,10 +523,9 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         ret = jffs2_init_security(inode, dir_i);
         if (ret) {
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return ret;
         }
-        ret = jffs2_init_acl(inode, acl);
+        ret = jffs2_init_acl_post(inode);
         if (ret) {
                 jffs2_clear_inode(inode);
                 return ret;
@@ -639,7 +621,6 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         union jffs2_device_node dev;
         int devlen = 0;
         uint32_t alloclen;
-        struct posix_acl *acl;
         int ret;
 
         if (!new_valid_dev(rdev))
@@ -666,7 +647,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 return ret;
         }
 
-        inode = jffs2_new_inode(dir_i, mode, ri, &acl);
+        inode = jffs2_new_inode(dir_i, mode, ri);
 
         if (IS_ERR(inode)) {
                 jffs2_free_raw_inode(ri);
@@ -695,7 +676,6 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 up(&f->sem);
                 jffs2_complete_reservation(c);
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return PTR_ERR(fn);
         }
         /* No data here. Only a metadata node, which will be
@@ -709,10 +689,9 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         ret = jffs2_init_security(inode, dir_i);
         if (ret) {
                 jffs2_clear_inode(inode);
-                posix_acl_release(acl);
                 return ret;
         }
-        ret = jffs2_init_acl(inode, acl);
+        ret = jffs2_init_acl_post(inode);
         if (ret) {
                 jffs2_clear_inode(inode);
                 return ret;
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 023a17539dd4..f9c5dd6f4b64 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -255,7 +255,7 @@ static int jffs2_write_end(struct file *filp, struct address_space *mapping,
                    _whole_ page. This helps to reduce the number of
                    nodes in files which have many short writes, like
                    syslog files. */
-                start = aligned_start = 0;
+                aligned_start = 0;
         }
 
         ri = jffs2_alloc_raw_inode();
@@ -291,14 +291,11 @@ static int jffs2_write_end(struct file *filp, struct address_space *mapping,
         }
 
         /* Adjust writtenlen for the padding we did, so we don't confuse our caller */
-        if (writtenlen < (start&3))
-                writtenlen = 0;
-        else
-                writtenlen -= (start&3);
+        writtenlen -= min(writtenlen, (start - aligned_start));
 
         if (writtenlen) {
-                if (inode->i_size < (pg->index << PAGE_CACHE_SHIFT) + start + writtenlen) {
-                        inode->i_size = (pg->index << PAGE_CACHE_SHIFT) + start + writtenlen;
+                if (inode->i_size < pos + writtenlen) {
+                        inode->i_size = pos + writtenlen;
                         inode->i_blocks = (inode->i_size + 511) >> 9;
 
                         inode->i_ctime = inode->i_mtime = ITIME(je32_to_cpu(ri->ctime));
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index ed85f9afdbc8..d2e06f7ea96f 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -402,8 +402,7 @@ void jffs2_write_super (struct super_block *sb)
 
 /* jffs2_new_inode: allocate a new inode and inocache, add it to the hash,
    fill in the raw_inode while you're at it. */
-struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_inode *ri,
-                               struct posix_acl **acl)
+struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_inode *ri)
 {
         struct inode *inode;
         struct super_block *sb = dir_i->i_sb;
@@ -438,19 +437,11 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
 
         /* POSIX ACLs have to be processed now, at least partly.
            The umask is only applied if there's no default ACL */
-        if (!S_ISLNK(mode)) {
-                *acl = jffs2_get_acl(dir_i, ACL_TYPE_DEFAULT);
-                if (IS_ERR(*acl)) {
-                        make_bad_inode(inode);
-                        iput(inode);
-                        inode = (void *)*acl;
-                        *acl = NULL;
-                        return inode;
-                }
-                if (!(*acl))
-                        mode &= ~current->fs->umask;
-        } else {
-                *acl = NULL;
+        ret = jffs2_init_acl_pre(dir_i, inode, &mode);
+        if (ret) {
+            make_bad_inode(inode);
+            iput(inode);
+            return ERR_PTR(ret);
         }
         ret = jffs2_do_new_inode (c, f, mode, ri);
         if (ret) {
diff --git a/fs/jffs2/os-linux.h b/fs/jffs2/os-linux.h
index f6743a915cf3..bf64686cf098 100644
--- a/fs/jffs2/os-linux.h
+++ b/fs/jffs2/os-linux.h
@@ -173,15 +173,13 @@ int jffs2_ioctl(struct inode *, struct file *, unsigned int, unsigned long);
 extern const struct inode_operations jffs2_symlink_inode_operations;
 
 /* fs.c */
-struct posix_acl;
-
 int jffs2_setattr (struct dentry *, struct iattr *);
 int jffs2_do_setattr (struct inode *, struct iattr *);
 void jffs2_read_inode (struct inode *);
 void jffs2_clear_inode (struct inode *);
 void jffs2_dirty_inode(struct inode *inode);
 struct inode *jffs2_new_inode (struct inode *dir_i, int mode,
-                               struct jffs2_raw_inode *ri, struct posix_acl **acl);
+                               struct jffs2_raw_inode *ri);
 int jffs2_statfs (struct dentry *, struct kstatfs *);
 void jffs2_write_super (struct super_block *);
 int jffs2_remount_fs (struct super_block *, int *, char *);
diff --git a/fs/jffs2/write.c b/fs/jffs2/write.c
index 2f5695446d0f..147e2cbee9e4 100644
--- a/fs/jffs2/write.c
+++ b/fs/jffs2/write.c
@@ -465,6 +465,14 @@ int jffs2_do_create(struct jffs2_sb_info *c, struct jffs2_inode_info *dir_f, str
 
         up(&f->sem);
         jffs2_complete_reservation(c);
+
+        ret = jffs2_init_security(&f->vfs_inode, &dir_f->vfs_inode);
+        if (ret)
+                return ret;
+        ret = jffs2_init_acl_post(&f->vfs_inode);
+        if (ret)
+                return ret;
+
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                 ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
 
diff --git a/fs/jfs/ioctl.c b/fs/jfs/ioctl.c
index 3c8663bea98c..dfda12a073e1 100644
--- a/fs/jfs/ioctl.c
+++ b/fs/jfs/ioctl.c
@@ -79,6 +79,9 @@ int jfs_ioctl(struct inode * inode, struct file * filp, unsigned int cmd,
                 if (!S_ISDIR(inode->i_mode))
                         flags &= ~JFS_DIRSYNC_FL;
 
+                /* Is it quota file? Do not allow user to mess with it */
+                if (IS_NOQUOTA(inode))
+                        return -EPERM;
                 jfs_get_inode_flags(jfs_inode);
                 oldflags = jfs_inode->mode2;
 
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index df0b8535de84..df25ecc418af 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -773,7 +773,7 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
               getChild:
                 /* update max. number of pages to split */
                 if (BT_STACK_FULL(btstack)) {
-                        /* Something's corrupted, mark filesytem dirty so
+                        /* Something's corrupted, mark filesystem dirty so
                          * chkdsk will fix it.
                          */
                         jfs_error(sb, "stack overrun in dtSearch!");
diff --git a/fs/jfs/jfs_inode.h b/fs/jfs/jfs_inode.h
index f0ec72b263f1..8e2cf2cde185 100644
--- a/fs/jfs/jfs_inode.h
+++ b/fs/jfs/jfs_inode.h
@@ -18,6 +18,8 @@
 #ifndef _H_JFS_INODE
 #define _H_JFS_INODE
 
+struct fid;
+
 extern struct inode *ialloc(struct inode *, umode_t);
 extern int jfs_fsync(struct file *, struct dentry *, int);
 extern int jfs_ioctl(struct inode *, struct file *,
@@ -32,7 +34,10 @@ extern void jfs_truncate_nolock(struct inode *, loff_t);
 extern void jfs_free_zero_link(struct inode *);
 extern struct dentry *jfs_get_parent(struct dentry *dentry);
 extern void jfs_get_inode_flags(struct jfs_inode_info *);
-extern struct dentry *jfs_get_dentry(struct super_block *sb, void *vobjp);
+extern struct dentry *jfs_fh_to_dentry(struct super_block *sb, struct fid *fid,
+        int fh_len, int fh_type);
+extern struct dentry *jfs_fh_to_parent(struct super_block *sb, struct fid *fid,
+        int fh_len, int fh_type);
 extern void jfs_set_inode_flags(struct inode *);
 extern int jfs_get_block(struct inode *, sector_t, struct buffer_head *, int);
 
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 932797ba433b..4e0a8493cef6 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -20,6 +20,7 @@
 #include <linux/fs.h>
 #include <linux/ctype.h>
 #include <linux/quotaops.h>
+#include <linux/exportfs.h>
 #include "jfs_incore.h"
 #include "jfs_superblock.h"
 #include "jfs_inode.h"
@@ -1477,13 +1478,10 @@ static struct dentry *jfs_lookup(struct inode *dip, struct dentry *dentry, struc
         return dentry;
 }
 
-struct dentry *jfs_get_dentry(struct super_block *sb, void *vobjp)
+static struct inode *jfs_nfs_get_inode(struct super_block *sb,
+                u64 ino, u32 generation)
 {
-        __u32 *objp = vobjp;
-        unsigned long ino = objp[0];
-        __u32 generation = objp[1];
         struct inode *inode;
-        struct dentry *result;
 
         if (ino == 0)
                 return ERR_PTR(-ESTALE);
@@ -1493,20 +1491,25 @@ struct dentry *jfs_get_dentry(struct super_block *sb, void *vobjp)
 
         if (is_bad_inode(inode) ||
             (generation && inode->i_generation != generation)) {
-                result = ERR_PTR(-ESTALE);
-                goto out_iput;
+                iput(inode);
+                return ERR_PTR(-ESTALE);
         }
 
-        result = d_alloc_anon(inode);
-        if (!result) {
-                result = ERR_PTR(-ENOMEM);
-                goto out_iput;
-        }
-        return result;
+        return inode;
+}
 
- out_iput:
-        iput(inode);
-        return result;
+struct dentry *jfs_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    jfs_nfs_get_inode);
+}
+
+struct dentry *jfs_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    jfs_nfs_get_inode);
 }
 
 struct dentry *jfs_get_parent(struct dentry *dentry)
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index cff60c171943..314bb4ff1ba8 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -48,7 +48,7 @@ MODULE_LICENSE("GPL");
 static struct kmem_cache * jfs_inode_cachep;
 
 static const struct super_operations jfs_super_operations;
-static struct export_operations jfs_export_operations;
+static const struct export_operations jfs_export_operations;
 static struct file_system_type jfs_fs_type;
 
 #define MAX_COMMIT_THREADS 64
@@ -737,8 +737,9 @@ static const struct super_operations jfs_super_operations = {
 #endif
 };
 
-static struct export_operations jfs_export_operations = {
-        .get_dentry     = jfs_get_dentry,
+static const struct export_operations jfs_export_operations = {
+        .fh_to_dentry   = jfs_fh_to_dentry,
+        .fh_to_parent   = jfs_fh_to_parent,
         .get_parent     = jfs_get_parent,
 };
 
diff --git a/fs/libfs.c b/fs/libfs.c
index ae51481e45e5..6e68b700958d 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -8,6 +8,7 @@
 #include <linux/mount.h>
 #include <linux/vfs.h>
 #include <linux/mutex.h>
+#include <linux/exportfs.h>
 
 #include <asm/uaccess.h>
 
@@ -678,6 +679,93 @@ out:
         return ret;
 }
 
+/*
+ * This is what d_alloc_anon should have been.  Once the exportfs
+ * argument transition has been finished I will update d_alloc_anon
+ * to this prototype and this wrapper will go away.   --hch
+ */
+static struct dentry *exportfs_d_alloc(struct inode *inode)
+{
+        struct dentry *dentry;
+
+        if (!inode)
+                return NULL;
+        if (IS_ERR(inode))
+                return ERR_PTR(PTR_ERR(inode));
+
+        dentry = d_alloc_anon(inode);
+        if (!dentry) {
+                iput(inode);
+                dentry = ERR_PTR(-ENOMEM);
+        }
+        return dentry;
+}
+
+/**
+ * generic_fh_to_dentry - generic helper for the fh_to_dentry export operation
+ * @sb:         filesystem to do the file handle conversion on
+ * @fid:        file handle to convert
+ * @fh_len:     length of the file handle in bytes
+ * @fh_type:    type of file handle
+ * @get_inode:  filesystem callback to retrieve inode
+ *
+ * This function decodes @fid as long as it has one of the well-known
+ * Linux filehandle types and calls @get_inode on it to retrieve the
+ * inode for the object specified in the file handle.
+ */
+struct dentry *generic_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type, struct inode *(*get_inode)
+                        (struct super_block *sb, u64 ino, u32 gen))
+{
+        struct inode *inode = NULL;
+
+        if (fh_len < 2)
+                return NULL;
+
+        switch (fh_type) {
+        case FILEID_INO32_GEN:
+        case FILEID_INO32_GEN_PARENT:
+                inode = get_inode(sb, fid->i32.ino, fid->i32.gen);
+                break;
+        }
+
+        return exportfs_d_alloc(inode);
+}
+EXPORT_SYMBOL_GPL(generic_fh_to_dentry);
+
+/**
+ * generic_fh_to_dentry - generic helper for the fh_to_parent export operation
+ * @sb:         filesystem to do the file handle conversion on
+ * @fid:        file handle to convert
+ * @fh_len:     length of the file handle in bytes
+ * @fh_type:    type of file handle
+ * @get_inode:  filesystem callback to retrieve inode
+ *
+ * This function decodes @fid as long as it has one of the well-known
+ * Linux filehandle types and calls @get_inode on it to retrieve the
+ * inode for the _parent_ object specified in the file handle if it
+ * is specified in the file handle, or NULL otherwise.
+ */
+struct dentry *generic_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type, struct inode *(*get_inode)
+                        (struct super_block *sb, u64 ino, u32 gen))
+{
+        struct inode *inode = NULL;
+
+        if (fh_len <= 2)
+                return NULL;
+
+        switch (fh_type) {
+        case FILEID_INO32_GEN_PARENT:
+                inode = get_inode(sb, fid->i32.parent_ino,
+                                  (fh_len > 3 ? fid->i32.parent_gen : 0));
+                break;
+        }
+
+        return exportfs_d_alloc(inode);
+}
+EXPORT_SYMBOL_GPL(generic_fh_to_parent);
+
 EXPORT_SYMBOL(dcache_dir_close);
 EXPORT_SYMBOL(dcache_dir_lseek);
 EXPORT_SYMBOL(dcache_dir_open);
diff --git a/fs/locks.c b/fs/locks.c
index 0127a2846819..8b8388eca05e 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -696,17 +696,28 @@ EXPORT_SYMBOL(posix_test_lock);
  * Note: the above assumption may not be true when handling lock requests
  * from a broken NFS client. But broken NFS clients have a lot more to
  * worry about than proper deadlock detection anyway... --okir
+ *
+ * However, the failure of this assumption (also possible in the case of
+ * multiple tasks sharing the same open file table) also means there's no
+ * guarantee that the loop below will terminate.  As a hack, we give up
+ * after a few iterations.
  */
+
+#define MAX_DEADLK_ITERATIONS 10
+
 static int posix_locks_deadlock(struct file_lock *caller_fl,
                                 struct file_lock *block_fl)
 {
         struct file_lock *fl;
+        int i = 0;
 
 next_task:
         if (posix_same_owner(caller_fl, block_fl))
                 return 1;
         list_for_each_entry(fl, &blocked_list, fl_link) {
                 if (posix_same_owner(fl, block_fl)) {
+                        if (i++ > MAX_DEADLK_ITERATIONS)
+                                return 0;
                         fl = fl->fl_next;
                         block_fl = fl;
                         goto next_task;
diff --git a/fs/mbcache.c b/fs/mbcache.c
index 1046cbefbfbf..eb31b73e7d69 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -403,9 +403,9 @@ mb_cache_entry_alloc(struct mb_cache *cache)
 {
         struct mb_cache_entry *ce;
 
-        atomic_inc(&cache->c_entry_count);
         ce = kmem_cache_alloc(cache->c_entry_cache, GFP_KERNEL);
         if (ce) {
+                atomic_inc(&cache->c_entry_count);
                 INIT_LIST_HEAD(&ce->e_lru_list);
                 INIT_LIST_HEAD(&ce->e_block_list);
                 ce->e_cache = cache;
diff --git a/fs/namei.c b/fs/namei.c
index 1e5c71669164..3b993db26cee 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1174,7 +1174,7 @@ static int fastcall do_path_lookup(int dfd, const char *name,
 out:
         if (unlikely(!retval && !audit_dummy_context() && nd->dentry &&
                                 nd->dentry->d_inode))
-                audit_inode(name, nd->dentry->d_inode);
+                audit_inode(name, nd->dentry);
 out_fail:
         return retval;
 
@@ -1214,7 +1214,7 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
         retval = path_walk(name, nd);
         if (unlikely(!retval && !audit_dummy_context() && nd->dentry &&
                                 nd->dentry->d_inode))
-                audit_inode(name, nd->dentry->d_inode);
+                audit_inode(name, nd->dentry);
 
         return retval;
 
@@ -1469,7 +1469,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
                 return -ENOENT;
 
         BUG_ON(victim->d_parent->d_inode != dir);
-        audit_inode_child(victim->d_name.name, victim->d_inode, dir);
+        audit_inode_child(victim->d_name.name, victim, dir);
 
         error = permission(dir,MAY_WRITE | MAY_EXEC, NULL);
         if (error)
@@ -1783,7 +1783,7 @@ do_last:
          * It already exists.
          */
         mutex_unlock(&dir->d_inode->i_mutex);
-        audit_inode(pathname, path.dentry->d_inode);
+        audit_inode(pathname, path.dentry);
 
         error = -EEXIST;
         if (flag & O_EXCL)
@@ -2562,7 +2562,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (!error) {
                 const char *new_name = old_dentry->d_name.name;
                 fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
-                              new_dentry->d_inode, old_dentry->d_inode);
+                              new_dentry->d_inode, old_dentry);
         }
         fsnotify_oldname_free(old_name);
 
diff --git a/fs/namespace.c b/fs/namespace.c
index 07daa7972591..06083885b21e 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -246,7 +246,7 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
                         list_add(&mnt->mnt_slave, &old->mnt_slave_list);
                         mnt->mnt_master = old;
                         CLEAR_MNT_SHARED(mnt);
-                } else {
+                } else if (!(flag & CL_PRIVATE)) {
                         if ((flag & CL_PROPAGATION) || IS_MNT_SHARED(old))
                                 list_add(&mnt->mnt_share, &old->mnt_share);
                         if (IS_MNT_SLAVE(old))
@@ -746,6 +746,26 @@ Enomem:
         return NULL;
 }
 
+struct vfsmount *collect_mounts(struct vfsmount *mnt, struct dentry *dentry)
+{
+        struct vfsmount *tree;
+        down_read(&namespace_sem);
+        tree = copy_tree(mnt, dentry, CL_COPY_ALL | CL_PRIVATE);
+        up_read(&namespace_sem);
+        return tree;
+}
+
+void drop_collected_mounts(struct vfsmount *mnt)
+{
+        LIST_HEAD(umount_list);
+        down_read(&namespace_sem);
+        spin_lock(&vfsmount_lock);
+        umount_tree(mnt, 0, &umount_list);
+        spin_unlock(&vfsmount_lock);
+        up_read(&namespace_sem);
+        release_mounts(&umount_list);
+}
+
 /*
  *  @source_mnt : mount tree to be attached
  *  @nd         : place the mount tree @source_mnt is attached
@@ -1411,7 +1431,7 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
                 mnt_flags |= MNT_RELATIME;
 
         flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
-                   MS_NOATIME | MS_NODIRATIME | MS_RELATIME);
+                   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT);
 
         /* ... and get the mountpoint */
         retval = path_lookup(dir_name, LOOKUP_FOLLOW, &nd);
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index af8b235d405d..11833f4caeaa 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -168,7 +168,8 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
         spin_unlock(&inode->i_lock);
 
         spin_unlock(&clp->cl_lock);
-        kfree(delegation);
+        if (delegation != NULL)
+                nfs_free_delegation(delegation);
         return status;
 }
 
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 8ec7fbd8240c..f697b5c74b7c 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -38,6 +38,7 @@
 #include "nfs4_fs.h"
 #include "delegation.h"
 #include "iostat.h"
+#include "internal.h"
 
 /* #define NFS_DEBUG_VERBOSE 1 */
 
@@ -562,6 +563,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         nfs_fattr_init(&fattr);
         desc->entry = &my_entry;
 
+        nfs_block_sillyrename(dentry);
         while(!desc->entry->eof) {
                 res = readdir_search_pagecache(desc);
 
@@ -592,6 +594,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         break;
                 }
         }
+        nfs_unblock_sillyrename(dentry);
         unlock_kernel();
         if (res > 0)
                 res = 0;
@@ -866,6 +869,7 @@ struct dentry_operations nfs_dentry_operations = {
 static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, struct nameidata *nd)
 {
         struct dentry *res;
+        struct dentry *parent;
         struct inode *inode = NULL;
         int error;
         struct nfs_fh fhandle;
@@ -894,26 +898,31 @@ static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, stru
                 goto out_unlock;
         }
 
+        parent = dentry->d_parent;
+        /* Protect against concurrent sillydeletes */
+        nfs_block_sillyrename(parent);
         error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, &fhandle, &fattr);
         if (error == -ENOENT)
                 goto no_entry;
         if (error < 0) {
                 res = ERR_PTR(error);
-                goto out_unlock;
+                goto out_unblock_sillyrename;
         }
         inode = nfs_fhget(dentry->d_sb, &fhandle, &fattr);
         res = (struct dentry *)inode;
         if (IS_ERR(res))
-                goto out_unlock;
+                goto out_unblock_sillyrename;
 
 no_entry:
         res = d_materialise_unique(dentry, inode);
         if (res != NULL) {
                 if (IS_ERR(res))
-                        goto out_unlock;
+                        goto out_unblock_sillyrename;
                 dentry = res;
         }
         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
+out_unblock_sillyrename:
+        nfs_unblock_sillyrename(parent);
 out_unlock:
         unlock_kernel();
 out:
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 32fe97211eea..5e8d82f6666b 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -263,17 +263,19 @@ static const struct rpc_call_ops nfs_read_direct_ops = {
  * handled automatically by nfs_direct_read_result().  Otherwise, if
  * no requests have been sent, just return an error.
  */
-static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos)
+static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
+                                                const struct iovec *iov,
+                                                loff_t pos)
 {
         struct nfs_open_context *ctx = dreq->ctx;
         struct inode *inode = ctx->path.dentry->d_inode;
+        unsigned long user_addr = (unsigned long)iov->iov_base;
+        size_t count = iov->iov_len;
         size_t rsize = NFS_SERVER(inode)->rsize;
         unsigned int pgbase;
         int result;
         ssize_t started = 0;
 
-        get_dreq(dreq);
-
         do {
                 struct nfs_read_data *data;
                 size_t bytes;
@@ -347,15 +349,46 @@ static ssize_t nfs_direct_read_schedule(struct nfs_direct_req *dreq, unsigned lo
                 count -= bytes;
         } while (count != 0);
 
+        if (started)
+                return started;
+        return result < 0 ? (ssize_t) result : -EFAULT;
+}
+
+static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+                                              const struct iovec *iov,
+                                              unsigned long nr_segs,
+                                              loff_t pos)
+{
+        ssize_t result = -EINVAL;
+        size_t requested_bytes = 0;
+        unsigned long seg;
+
+        get_dreq(dreq);
+
+        for (seg = 0; seg < nr_segs; seg++) {
+                const struct iovec *vec = &iov[seg];
+                result = nfs_direct_read_schedule_segment(dreq, vec, pos);
+                if (result < 0)
+                        break;
+                requested_bytes += result;
+                if ((size_t)result < vec->iov_len)
+                        break;
+                pos += vec->iov_len;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_complete(dreq);
 
-        if (started)
+        if (requested_bytes != 0)
                 return 0;
-        return result < 0 ? (ssize_t) result : -EFAULT;
+
+        if (result < 0)
+                return result;
+        return -EIO;
 }
 
-static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos)
+static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
+                               unsigned long nr_segs, loff_t pos)
 {
         ssize_t result = 0;
         sigset_t oldset;
@@ -372,9 +405,8 @@ static ssize_t nfs_direct_read(struct kiocb *iocb, unsigned long user_addr, size
         if (!is_sync_kiocb(iocb))
                 dreq->iocb = iocb;
 
-        nfs_add_stats(inode, NFSIOS_DIRECTREADBYTES, count);
         rpc_clnt_sigmask(clnt, &oldset);
-        result = nfs_direct_read_schedule(dreq, user_addr, count, pos);
+        result = nfs_direct_read_schedule_iovec(dreq, iov, nr_segs, pos);
         if (!result)
                 result = nfs_direct_wait(dreq);
         rpc_clnt_sigunmask(clnt, &oldset);
@@ -549,13 +581,13 @@ static void nfs_direct_write_result(struct rpc_task *task, void *calldata)
 
         spin_lock(&dreq->lock);
 
-        if (unlikely(dreq->error != 0))
-                goto out_unlock;
         if (unlikely(status < 0)) {
-                /* An error has occured, so we should not commit */
+                /* An error has occurred, so we should not commit */
                 dreq->flags = 0;
                 dreq->error = status;
         }
+        if (unlikely(dreq->error != 0))
+                goto out_unlock;
 
         dreq->count += data->res.count;
 
@@ -601,17 +633,19 @@ static const struct rpc_call_ops nfs_write_direct_ops = {
  * handled automatically by nfs_direct_write_result().  Otherwise, if
  * no requests have been sent, just return an error.
  */
-static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned long user_addr, size_t count, loff_t pos, int sync)
+static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
+                                                 const struct iovec *iov,
+                                                 loff_t pos, int sync)
 {
         struct nfs_open_context *ctx = dreq->ctx;
         struct inode *inode = ctx->path.dentry->d_inode;
+        unsigned long user_addr = (unsigned long)iov->iov_base;
+        size_t count = iov->iov_len;
         size_t wsize = NFS_SERVER(inode)->wsize;
         unsigned int pgbase;
         int result;
         ssize_t started = 0;
 
-        get_dreq(dreq);
-
         do {
                 struct nfs_write_data *data;
                 size_t bytes;
@@ -689,15 +723,48 @@ static ssize_t nfs_direct_write_schedule(struct nfs_direct_req *dreq, unsigned l
                 count -= bytes;
         } while (count != 0);
 
+        if (started)
+                return started;
+        return result < 0 ? (ssize_t) result : -EFAULT;
+}
+
+static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+                                               const struct iovec *iov,
+                                               unsigned long nr_segs,
+                                               loff_t pos, int sync)
+{
+        ssize_t result = 0;
+        size_t requested_bytes = 0;
+        unsigned long seg;
+
+        get_dreq(dreq);
+
+        for (seg = 0; seg < nr_segs; seg++) {
+                const struct iovec *vec = &iov[seg];
+                result = nfs_direct_write_schedule_segment(dreq, vec,
+                                                           pos, sync);
+                if (result < 0)
+                        break;
+                requested_bytes += result;
+                if ((size_t)result < vec->iov_len)
+                        break;
+                pos += vec->iov_len;
+        }
+
         if (put_dreq(dreq))
-                nfs_direct_write_complete(dreq, inode);
+                nfs_direct_write_complete(dreq, dreq->inode);
 
-        if (started)
+        if (requested_bytes != 0)
                 return 0;
-        return result < 0 ? (ssize_t) result : -EFAULT;
+
+        if (result < 0)
+                return result;
+        return -EIO;
 }
 
-static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, size_t count, loff_t pos)
+static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
+                                unsigned long nr_segs, loff_t pos,
+                                size_t count)
 {
         ssize_t result = 0;
         sigset_t oldset;
@@ -720,10 +787,8 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, unsigned long user_addr, siz
         if (!is_sync_kiocb(iocb))
                 dreq->iocb = iocb;
 
-        nfs_add_stats(inode, NFSIOS_DIRECTWRITTENBYTES, count);
-
         rpc_clnt_sigmask(clnt, &oldset);
-        result = nfs_direct_write_schedule(dreq, user_addr, count, pos, sync);
+        result = nfs_direct_write_schedule_iovec(dreq, iov, nr_segs, pos, sync);
         if (!result)
                 result = nfs_direct_wait(dreq);
         rpc_clnt_sigunmask(clnt, &oldset);
@@ -759,21 +824,16 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, const struct iovec *iov,
         ssize_t retval = -EINVAL;
         struct file *file = iocb->ki_filp;
         struct address_space *mapping = file->f_mapping;
-        /* XXX: temporary */
-        const char __user *buf = iov[0].iov_base;
-        size_t count = iov[0].iov_len;
+        size_t count;
+
+        count = iov_length(iov, nr_segs);
+        nfs_add_stats(mapping->host, NFSIOS_DIRECTREADBYTES, count);
 
-        dprintk("nfs: direct read(%s/%s, %lu@%Ld)\n",
+        dprintk("nfs: direct read(%s/%s, %zd@%Ld)\n",
                 file->f_path.dentry->d_parent->d_name.name,
                 file->f_path.dentry->d_name.name,
-                (unsigned long) count, (long long) pos);
+                count, (long long) pos);
 
-        if (nr_segs != 1)
-                goto out;
-
-        retval = -EFAULT;
-        if (!access_ok(VERIFY_WRITE, buf, count))
-                goto out;
         retval = 0;
         if (!count)
                 goto out;
@@ -782,7 +842,7 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, const struct iovec *iov,
         if (retval)
                 goto out;
 
-        retval = nfs_direct_read(iocb, (unsigned long) buf, count, pos);
+        retval = nfs_direct_read(iocb, iov, nr_segs, pos);
         if (retval > 0)
                 iocb->ki_pos = pos + retval;
 
@@ -821,21 +881,21 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
         ssize_t retval = -EINVAL;
         struct file *file = iocb->ki_filp;
         struct address_space *mapping = file->f_mapping;
-        /* XXX: temporary */
-        const char __user *buf = iov[0].iov_base;
-        size_t count = iov[0].iov_len;
+        size_t count;
 
-        dprintk("nfs: direct write(%s/%s, %lu@%Ld)\n",
+        count = iov_length(iov, nr_segs);
+        nfs_add_stats(mapping->host, NFSIOS_DIRECTWRITTENBYTES, count);
+
+        dfprintk(VFS, "nfs: direct write(%s/%s, %zd@%Ld)\n",
                 file->f_path.dentry->d_parent->d_name.name,
                 file->f_path.dentry->d_name.name,
-                (unsigned long) count, (long long) pos);
-
-        if (nr_segs != 1)
-                goto out;
+                count, (long long) pos);
 
         retval = generic_write_checks(file, &pos, &count, 0);
         if (retval)
                 goto out;
+        if (!count)
+                goto out;       /* return 0 */
 
         retval = -EINVAL;
         if ((ssize_t) count < 0)
@@ -844,15 +904,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
         if (!count)
                 goto out;
 
-        retval = -EFAULT;
-        if (!access_ok(VERIFY_READ, buf, count))
-                goto out;
-
         retval = nfs_sync_mapping(mapping);
         if (retval)
                 goto out;
 
-        retval = nfs_direct_write(iocb, (unsigned long) buf, count, pos);
+        retval = nfs_direct_write(iocb, iov, nr_segs, pos, count);
 
         if (retval > 0)
                 iocb->ki_pos = pos + retval;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index d29f90d00aa2..b3bb89f7d5d2 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -131,7 +131,7 @@ nfs_file_release(struct inode *inode, struct file *filp)
 {
         /* Ensure that dirty pages are flushed out with the right creds */
         if (filp->f_mode & FMODE_WRITE)
-                filemap_fdatawrite(filp->f_mapping);
+                nfs_wb_all(filp->f_path.dentry->d_inode);
         nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
         return NFS_PROTO(inode)->file_release(inode, filp);
 }
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 522e5ad4d8ad..0ee43843f4ec 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -43,6 +43,25 @@
 #define NFSDBG_FACILITY         NFSDBG_CLIENT
 
 /*
+ * Set the superblock root dentry.
+ * Note that this function frees the inode in case of error.
+ */
+static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *inode)
+{
+        /* The mntroot acts as the dummy root dentry for this superblock */
+        if (sb->s_root == NULL) {
+                sb->s_root = d_alloc_root(inode);
+                if (sb->s_root == NULL) {
+                        iput(inode);
+                        return -ENOMEM;
+                }
+                /* Circumvent igrab(): we know the inode is not being freed */
+                atomic_inc(&inode->i_count);
+        }
+        return 0;
+}
+
+/*
  * get an NFS2/NFS3 root dentry from the root filehandle
  */
 struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh)
@@ -54,33 +73,6 @@ struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh)
         struct inode *inode;
         int error;
 
-        /* create a dummy root dentry with dummy inode for this superblock */
-        if (!sb->s_root) {
-                struct nfs_fh dummyfh;
-                struct dentry *root;
-                struct inode *iroot;
-
-                memset(&dummyfh, 0, sizeof(dummyfh));
-                memset(&fattr, 0, sizeof(fattr));
-                nfs_fattr_init(&fattr);
-                fattr.valid = NFS_ATTR_FATTR;
-                fattr.type = NFDIR;
-                fattr.mode = S_IFDIR | S_IRUSR | S_IWUSR;
-                fattr.nlink = 2;
-
-                iroot = nfs_fhget(sb, &dummyfh, &fattr);
-                if (IS_ERR(iroot))
-                        return ERR_PTR(PTR_ERR(iroot));
-
-                root = d_alloc_root(iroot);
-                if (!root) {
-                        iput(iroot);
-                        return ERR_PTR(-ENOMEM);
-                }
-
-                sb->s_root = root;
-        }
-
         /* get the actual root for this mount */
         fsinfo.fattr = &fattr;
 
@@ -96,6 +88,10 @@ struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh)
                 return ERR_PTR(PTR_ERR(inode));
         }
 
+        error = nfs_superblock_set_dummy_root(sb, inode);
+        if (error != 0)
+                return ERR_PTR(error);
+
         /* root dentries normally start off anonymous and get spliced in later
          * if the dentry tree reaches them; however if the dentry already
          * exists, we'll pick it up at this point and use it as the root
@@ -241,33 +237,6 @@ struct dentry *nfs4_get_root(struct super_block *sb, struct nfs_fh *mntfh)
 
         dprintk("--> nfs4_get_root()\n");
 
-        /* create a dummy root dentry with dummy inode for this superblock */
-        if (!sb->s_root) {
-                struct nfs_fh dummyfh;
-                struct dentry *root;
-                struct inode *iroot;
-
-                memset(&dummyfh, 0, sizeof(dummyfh));
-                memset(&fattr, 0, sizeof(fattr));
-                nfs_fattr_init(&fattr);
-                fattr.valid = NFS_ATTR_FATTR;
-                fattr.type = NFDIR;
-                fattr.mode = S_IFDIR | S_IRUSR | S_IWUSR;
-                fattr.nlink = 2;
-
-                iroot = nfs_fhget(sb, &dummyfh, &fattr);
-                if (IS_ERR(iroot))
-                        return ERR_PTR(PTR_ERR(iroot));
-
-                root = d_alloc_root(iroot);
-                if (!root) {
-                        iput(iroot);
-                        return ERR_PTR(-ENOMEM);
-                }
-
-                sb->s_root = root;
-        }
-
         /* get the info about the server and filesystem */
         error = nfs4_server_capabilities(server, mntfh);
         if (error < 0) {
@@ -289,6 +258,10 @@ struct dentry *nfs4_get_root(struct super_block *sb, struct nfs_fh *mntfh)
                 return ERR_PTR(PTR_ERR(inode));
         }
 
+        error = nfs_superblock_set_dummy_root(sb, inode);
+        if (error != 0)
+                return ERR_PTR(error);
+
         /* root dentries normally start off anonymous and get spliced in later
          * if the dentry tree reaches them; however if the dentry already
          * exists, we'll pick it up at this point and use it as the root
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6d2f2a3eccf8..db5d96dc6107 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -514,7 +514,7 @@ struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx)
         return ctx;
 }
 
-void put_nfs_open_context(struct nfs_open_context *ctx)
+static void __put_nfs_open_context(struct nfs_open_context *ctx, int wait)
 {
         struct inode *inode = ctx->path.dentry->d_inode;
 
@@ -522,8 +522,12 @@ void put_nfs_open_context(struct nfs_open_context *ctx)
                 return;
         list_del(&ctx->list);
         spin_unlock(&inode->i_lock);
-        if (ctx->state != NULL)
-                nfs4_close_state(&ctx->path, ctx->state, ctx->mode);
+        if (ctx->state != NULL) {
+                if (wait)
+                        nfs4_close_sync(&ctx->path, ctx->state, ctx->mode);
+                else
+                        nfs4_close_state(&ctx->path, ctx->state, ctx->mode);
+        }
         if (ctx->cred != NULL)
                 put_rpccred(ctx->cred);
         dput(ctx->path.dentry);
@@ -531,6 +535,16 @@ void put_nfs_open_context(struct nfs_open_context *ctx)
         kfree(ctx);
 }
 
+void put_nfs_open_context(struct nfs_open_context *ctx)
+{
+        __put_nfs_open_context(ctx, 0);
+}
+
+static void put_nfs_open_context_sync(struct nfs_open_context *ctx)
+{
+        __put_nfs_open_context(ctx, 1);
+}
+
 /*
  * Ensure that mmap has a recent RPC credential for use when writing out
  * shared pages
@@ -577,7 +591,7 @@ static void nfs_file_clear_open_context(struct file *filp)
                 spin_lock(&inode->i_lock);
                 list_move_tail(&ctx->list, &NFS_I(inode)->open_files);
                 spin_unlock(&inode->i_lock);
-                put_nfs_open_context(ctx);
+                put_nfs_open_context_sync(ctx);
         }
 }
 
@@ -1169,6 +1183,9 @@ static void init_once(struct kmem_cache * cachep, void *foo)
         INIT_RADIX_TREE(&nfsi->nfs_page_tree, GFP_ATOMIC);
         nfsi->ncommit = 0;
         nfsi->npages = 0;
+        atomic_set(&nfsi->silly_count, 1);
+        INIT_HLIST_HEAD(&nfsi->silly_list);
+        init_waitqueue_head(&nfsi->waitqueue);
         nfs4_init_once(nfsi);
 }
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index d2802b1ca3b9..b35069a2aa9e 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -178,7 +178,7 @@ extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struc
 extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_proc_async_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_proc_renew(struct nfs_client *, struct rpc_cred *);
-extern int nfs4_do_close(struct path *path, struct nfs4_state *state);
+extern int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait);
 extern struct dentry *nfs4_atomic_open(struct inode *, struct dentry *, struct nameidata *);
 extern int nfs4_open_revalidate(struct inode *, struct dentry *, int, struct nameidata *);
 extern int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle);
@@ -209,6 +209,7 @@ extern void nfs4_drop_state_owner(struct nfs4_state_owner *);
 extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *);
 extern void nfs4_put_open_state(struct nfs4_state *);
 extern void nfs4_close_state(struct path *, struct nfs4_state *, mode_t);
+extern void nfs4_close_sync(struct path *, struct nfs4_state *, mode_t);
 extern void nfs4_state_set_mode_locked(struct nfs4_state *, mode_t);
 extern void nfs4_schedule_state_recovery(struct nfs_client *);
 extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
@@ -235,6 +236,7 @@ extern struct svc_version nfs4_callback_version1;
 #else
 
 #define nfs4_close_state(a, b, c) do { } while (0)
+#define nfs4_close_sync(a, b, c) do { } while (0)
 
 #endif /* CONFIG_NFS_V4 */
 #endif /* __LINUX_FS_NFS_NFS4_FS.H */
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index cb99fd90a9ac..f03d9d5f5ba4 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1305,7 +1305,7 @@ static const struct rpc_call_ops nfs4_close_ops = {
  *
  * NOTE: Caller must be holding the sp->so_owner semaphore!
  */
-int nfs4_do_close(struct path *path, struct nfs4_state *state)
+int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
         struct nfs4_closedata *calldata;
@@ -1333,8 +1333,11 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state)
         task = rpc_run_task(server->client, RPC_TASK_ASYNC, &nfs4_close_ops, calldata);
         if (IS_ERR(task))
                 return PTR_ERR(task);
+        status = 0;
+        if (wait)
+                status = rpc_wait_for_completion_task(task);
         rpc_put_task(task);
-        return 0;
+        return status;
 out_free_calldata:
         kfree(calldata);
 out:
@@ -1365,13 +1368,14 @@ static int nfs4_intent_set_file(struct nameidata *nd, struct path *path, struct
         }
         ret = PTR_ERR(filp);
 out_close:
-        nfs4_close_state(path, state, nd->intent.open.flags);
+        nfs4_close_sync(path, state, nd->intent.open.flags);
         return ret;
 }
 
 struct dentry *
 nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
+        struct dentry *parent;
         struct path path = {
                 .mnt = nd->mnt,
                 .dentry = dentry,
@@ -1394,6 +1398,9 @@ nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
         cred = rpcauth_lookupcred(NFS_CLIENT(dir)->cl_auth, 0);
         if (IS_ERR(cred))
                 return (struct dentry *)cred;
+        parent = dentry->d_parent;
+        /* Protect against concurrent sillydeletes */
+        nfs_block_sillyrename(parent);
         state = nfs4_do_open(dir, &path, nd->intent.open.flags, &attr, cred);
         put_rpccred(cred);
         if (IS_ERR(state)) {
@@ -1401,12 +1408,14 @@ nfs4_atomic_open(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
                         d_add(dentry, NULL);
                         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                 }
+                nfs_unblock_sillyrename(parent);
                 return (struct dentry *)state;
         }
         res = d_add_unique(dentry, igrab(state->inode));
         if (res != NULL)
                 path.dentry = res;
         nfs_set_verifier(path.dentry, nfs_save_change_attribute(dir));
+        nfs_unblock_sillyrename(parent);
         nfs4_intent_set_file(nd, &path, state);
         return res;
 }
@@ -1444,7 +1453,7 @@ nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags, st
                 nfs4_intent_set_file(nd, &path, state);
                 return 1;
         }
-        nfs4_close_state(&path, state, openflags);
+        nfs4_close_sync(&path, state, openflags);
 out_drop:
         d_drop(dentry);
         return 0;
@@ -1898,7 +1907,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
         if (status == 0 && (nd->flags & LOOKUP_OPEN) != 0)
                 status = nfs4_intent_set_file(nd, &path, state);
         else
-                nfs4_close_state(&path, state, flags);
+                nfs4_close_sync(&path, state, flags);
 out:
         return status;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index bfb36261cecb..23a9a36556bf 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -425,7 +425,7 @@ void nfs4_put_open_state(struct nfs4_state *state)
 /*
  * Close the current file.
  */
-void nfs4_close_state(struct path *path, struct nfs4_state *state, mode_t mode)
+static void __nfs4_close(struct path *path, struct nfs4_state *state, mode_t mode, int wait)
 {
         struct nfs4_state_owner *owner = state->owner;
         int call_close = 0;
@@ -466,7 +466,17 @@ void nfs4_close_state(struct path *path, struct nfs4_state *state, mode_t mode)
                 nfs4_put_open_state(state);
                 nfs4_put_state_owner(owner);
         } else
-                nfs4_do_close(path, state);
+                nfs4_do_close(path, state, wait);
+}
+
+void nfs4_close_state(struct path *path, struct nfs4_state *state, mode_t mode)
+{
+        __nfs4_close(path, state, mode, 0);
+}
+
+void nfs4_close_sync(struct path *path, struct nfs4_state *state, mode_t mode)
+{
+        __nfs4_close(path, state, mode, 1);
 }
 
 /*
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index e87b44ee9ac9..4b0334590ee5 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -43,7 +43,7 @@
  *                              from being used (thanks to Leo Spiekman)
  *      Andy Walker     :       Allow to specify the NFS server in nfs_root
  *                              without giving a path name
- *      Swen Thümmler   :       Allow to specify the NFS options in nfs_root
+ *      Swen Thümmler  :       Allow to specify the NFS options in nfs_root
  *                              without giving a path name. Fix BOOTP request
  *                              for domainname (domainname is NIS domain, not
  *                              DNS domain!). Skip dummy devices for BOOTP.
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index 97669ed05500..4f80d88e9fee 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -211,6 +211,7 @@ nfs_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
         nfs_fattr_init(&fattr);
         dprintk("NFS call  create %s\n", dentry->d_name.name);
         status = rpc_call_sync(NFS_CLIENT(dir), &msg, 0);
+        nfs_mark_for_revalidate(dir);
         if (status == 0)
                 status = nfs_instantiate(dentry, &fhandle, &fattr);
         dprintk("NFS reply create: %d\n", status);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index fa517ae9207f..2426e713b77f 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1054,10 +1054,11 @@ static int nfs_validate_mount_data(void *options,
 {
         struct nfs_mount_data *data = (struct nfs_mount_data *)options;
 
+        memset(args, 0, sizeof(*args));
+
         if (data == NULL)
                 goto out_no_data;
 
-        memset(args, 0, sizeof(*args));
         args->flags             = (NFS_MOUNT_VER3 | NFS_MOUNT_TCP);
         args->rsize             = NFS_MAX_FILE_IO_SIZE;
         args->wsize             = NFS_MAX_FILE_IO_SIZE;
@@ -1474,6 +1475,11 @@ static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
+        if (mntroot->d_inode->i_op != &nfs_dir_inode_operations) {
+                dput(mntroot);
+                error = -ESTALE;
+                goto error_splat_super;
+        }
 
         s->s_flags |= MS_ACTIVE;
         mnt->mnt_sb = s;
@@ -1531,10 +1537,11 @@ static int nfs4_validate_mount_data(void *options,
         struct nfs4_mount_data *data = (struct nfs4_mount_data *)options;
         char *c;
 
+        memset(args, 0, sizeof(*args));
+
         if (data == NULL)
                 goto out_no_data;
 
-        memset(args, 0, sizeof(*args));
         args->rsize             = NFS_MAX_FILE_IO_SIZE;
         args->wsize             = NFS_MAX_FILE_IO_SIZE;
         args->timeo             = 600;
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 1aed850d18f2..233ad38161f9 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -11,9 +11,11 @@
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs_fs.h>
-
+#include <linux/sched.h>
+#include <linux/wait.h>
 
 struct nfs_unlinkdata {
+        struct hlist_node list;
         struct nfs_removeargs args;
         struct nfs_removeres res;
         struct inode *dir;
@@ -52,6 +54,20 @@ static int nfs_copy_dname(struct dentry *dentry, struct nfs_unlinkdata *data)
         return 0;
 }
 
+static void nfs_free_dname(struct nfs_unlinkdata *data)
+{
+        kfree(data->args.name.name);
+        data->args.name.name = NULL;
+        data->args.name.len = 0;
+}
+
+static void nfs_dec_sillycount(struct inode *dir)
+{
+        struct nfs_inode *nfsi = NFS_I(dir);
+        if (atomic_dec_return(&nfsi->silly_count) == 1)
+                wake_up(&nfsi->waitqueue);
+}
+
 /**
  * nfs_async_unlink_init - Initialize the RPC info
  * task: rpc_task of the sillydelete
@@ -95,6 +111,8 @@ static void nfs_async_unlink_done(struct rpc_task *task, void *calldata)
 static void nfs_async_unlink_release(void *calldata)
 {
         struct nfs_unlinkdata   *data = calldata;
+
+        nfs_dec_sillycount(data->dir);
         nfs_free_unlinkdata(data);
 }
 
@@ -104,33 +122,100 @@ static const struct rpc_call_ops nfs_unlink_ops = {
         .rpc_release = nfs_async_unlink_release,
 };
 
-static int nfs_call_unlink(struct dentry *dentry, struct nfs_unlinkdata *data)
+static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct nfs_unlinkdata *data)
 {
         struct rpc_task *task;
+        struct dentry *alias;
+
+        alias = d_lookup(parent, &data->args.name);
+        if (alias != NULL) {
+                int ret = 0;
+                /*
+                 * Hey, we raced with lookup... See if we need to transfer
+                 * the sillyrename information to the aliased dentry.
+                 */
+                nfs_free_dname(data);
+                spin_lock(&alias->d_lock);
+                if (!(alias->d_flags & DCACHE_NFSFS_RENAMED)) {
+                        alias->d_fsdata = data;
+                        alias->d_flags ^= DCACHE_NFSFS_RENAMED;
+                        ret = 1;
+                }
+                spin_unlock(&alias->d_lock);
+                nfs_dec_sillycount(dir);
+                dput(alias);
+                return ret;
+        }
+        data->dir = igrab(dir);
+        if (!data->dir) {
+                nfs_dec_sillycount(dir);
+                return 0;
+        }
+        data->args.fh = NFS_FH(dir);
+        nfs_fattr_init(&data->res.dir_attr);
+
+        task = rpc_run_task(NFS_CLIENT(dir), RPC_TASK_ASYNC, &nfs_unlink_ops, data);
+        if (!IS_ERR(task))
+                rpc_put_task(task);
+        return 1;
+}
+
+static int nfs_call_unlink(struct dentry *dentry, struct nfs_unlinkdata *data)
+{
         struct dentry *parent;
         struct inode *dir;
+        int ret = 0;
 
-        if (nfs_copy_dname(dentry, data) < 0)
-                goto out_free;
 
         parent = dget_parent(dentry);
         if (parent == NULL)
                 goto out_free;
-        dir = igrab(parent->d_inode);
+        dir = parent->d_inode;
+        if (nfs_copy_dname(dentry, data) != 0)
+                goto out_dput;
+        /* Non-exclusive lock protects against concurrent lookup() calls */
+        spin_lock(&dir->i_lock);
+        if (atomic_inc_not_zero(&NFS_I(dir)->silly_count) == 0) {
+                /* Deferred delete */
+                hlist_add_head(&data->list, &NFS_I(dir)->silly_list);
+                spin_unlock(&dir->i_lock);
+                ret = 1;
+                goto out_dput;
+        }
+        spin_unlock(&dir->i_lock);
+        ret = nfs_do_call_unlink(parent, dir, data);
+out_dput:
         dput(parent);
-        if (dir == NULL)
-                goto out_free;
+out_free:
+        return ret;
+}
 
-        data->dir = dir;
-        data->args.fh = NFS_FH(dir);
-        nfs_fattr_init(&data->res.dir_attr);
+void nfs_block_sillyrename(struct dentry *dentry)
+{
+        struct nfs_inode *nfsi = NFS_I(dentry->d_inode);
 
-        task = rpc_run_task(NFS_CLIENT(dir), RPC_TASK_ASYNC, &nfs_unlink_ops, data);
-        if (!IS_ERR(task))
-                rpc_put_task(task);
-        return 1;
-out_free:
-        return 0;
+        wait_event(nfsi->waitqueue, atomic_cmpxchg(&nfsi->silly_count, 1, 0) == 1);
+}
+
+void nfs_unblock_sillyrename(struct dentry *dentry)
+{
+        struct inode *dir = dentry->d_inode;
+        struct nfs_inode *nfsi = NFS_I(dir);
+        struct nfs_unlinkdata *data;
+
+        atomic_inc(&nfsi->silly_count);
+        spin_lock(&dir->i_lock);
+        while (!hlist_empty(&nfsi->silly_list)) {
+                if (!atomic_inc_not_zero(&nfsi->silly_count))
+                        break;
+                data = hlist_entry(nfsi->silly_list.first, struct nfs_unlinkdata, list);
+                hlist_del(&data->list);
+                spin_unlock(&dir->i_lock);
+                if (nfs_do_call_unlink(dentry, dir, data) == 0)
+                        nfs_free_unlinkdata(data);
+                spin_lock(&dir->i_lock);
+        }
+        spin_unlock(&dir->i_lock);
 }
 
 /**
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 0cf9d1cd9bd2..51cc1bd6a116 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -174,8 +174,6 @@ static void nfs_mark_uptodate(struct page *page, unsigned int base, unsigned int
                 return;
         if (count != nfs_page_length(page))
                 return;
-        if (count != PAGE_CACHE_SIZE)
-                zero_user_page(page, count, PAGE_CACHE_SIZE - count, KM_USER0);
         SetPageUptodate(page);
 }
 
@@ -627,7 +625,8 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
                                 return ERR_PTR(error);
                         }
                         spin_unlock(&inode->i_lock);
-                        return new;
+                        req = new;
+                        goto zero_page;
                 }
                 spin_unlock(&inode->i_lock);
 
@@ -655,13 +654,23 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
         if (offset < req->wb_offset) {
                 req->wb_offset = offset;
                 req->wb_pgbase = offset;
-                req->wb_bytes = rqend - req->wb_offset;
+                req->wb_bytes = max(end, rqend) - req->wb_offset;
+                goto zero_page;
         }
 
         if (end > rqend)
                 req->wb_bytes = end - req->wb_offset;
 
         return req;
+zero_page:
+        /* If this page might potentially be marked as up to date,
+         * then we need to zero any uninitalised data. */
+        if (req->wb_pgbase == 0 && req->wb_bytes != PAGE_CACHE_SIZE
+                        && !PageUptodate(req->wb_page))
+                zero_user_page(req->wb_page, req->wb_bytes,
+                                PAGE_CACHE_SIZE - req->wb_bytes,
+                                KM_USER0);
+        return req;
 }
 
 int nfs_flush_incompatible(struct file *file, struct page *page)
@@ -1427,7 +1436,8 @@ out:
         return ret;
 }
 
-int nfs_wb_page_priority(struct inode *inode, struct page *page, int how)
+static int nfs_wb_page_priority(struct inode *inode, struct page *page,
+                                int how)
 {
         loff_t range_start = page_offset(page);
         loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 04b266729802..66d0aeb32a47 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -386,15 +386,13 @@ static int check_export(struct inode *inode, int flags, unsigned char *uuid)
                 dprintk("exp_export: export of non-dev fs without fsid\n");
                 return -EINVAL;
         }
-        if (!inode->i_sb->s_export_op) {
+
+        if (!inode->i_sb->s_export_op ||
+            !inode->i_sb->s_export_op->fh_to_dentry) {
                 dprintk("exp_export: export of invalid fs type.\n");
                 return -EINVAL;
         }
 
-        /* Ok, we can export it */;
-        if (!inode->i_sb->s_export_op->find_exported_dentry)
-                inode->i_sb->s_export_op->find_exported_dentry =
-                        find_exported_dentry;
         return 0;
 
 }
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index b61742885011..0e5fa11e6b44 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -41,7 +41,7 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst * rqstp,
 
         fh = fh_copy(&resp->fh, &argp->fh);
         if ((nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP)))
-                RETURN_STATUS(nfserr_inval);
+                RETURN_STATUS(nfserr);
 
         if (argp->mask & ~(NFS_ACL|NFS_ACLCNT|NFS_DFACL|NFS_DFACLCNT))
                 RETURN_STATUS(nfserr_inval);
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index 3e3f2de82c36..b647f2f872dc 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -37,7 +37,7 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst * rqstp,
 
         fh = fh_copy(&resp->fh, &argp->fh);
         if ((nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP)))
-                RETURN_STATUS(nfserr_inval);
+                RETURN_STATUS(nfserr);
 
         if (argp->mask & ~(NFS_ACL|NFS_ACLCNT|NFS_DFACL|NFS_DFACLCNT))
                 RETURN_STATUS(nfserr_inval);
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index ebd03cc07479..1602cd00dd45 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -43,7 +43,7 @@
 #include <linux/file.h>
 #include <linux/namei.h>
 #include <asm/uaccess.h>
-#include <asm/scatterlist.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/sched.h>
 
@@ -88,7 +88,7 @@ nfs4_make_rec_clidname(char *dname, struct xdr_netobj *clname)
 {
         struct xdr_netobj cksum;
         struct hash_desc desc;
-        struct scatterlist sg[1];
+        struct scatterlist sg;
         __be32 status = nfserr_resource;
 
         dprintk("NFSD: nfs4_make_rec_clidname for %.*s\n",
@@ -102,11 +102,9 @@ nfs4_make_rec_clidname(char *dname, struct xdr_netobj *clname)
         if (cksum.data == NULL)
                 goto out;
 
-        sg[0].page = virt_to_page(clname->data);
-        sg[0].offset = offset_in_page(clname->data);
-        sg[0].length = clname->len;
+        sg_init_one(&sg, clname->data, clname->len);
 
-        if (crypto_hash_digest(&desc, sg, sg->length, cksum.data))
+        if (crypto_hash_digest(&desc, &sg, sg.length, cksum.data))
                 goto out;
 
         md5_to_hex(dname, cksum.data);
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 7011d62acfc8..468f17a78441 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -95,6 +95,22 @@ nfsd_mode_check(struct svc_rqst *rqstp, umode_t mode, int type)
         return 0;
 }
 
+static __be32 nfsd_setuser_and_check_port(struct svc_rqst *rqstp,
+                                          struct svc_export *exp)
+{
+        /* Check if the request originated from a secure port. */
+        if (!rqstp->rq_secure && EX_SECURE(exp)) {
+                char buf[RPC_MAX_ADDRBUFLEN];
+                dprintk(KERN_WARNING
+                       "nfsd: request from insecure port %s!\n",
+                       svc_print_addr(rqstp, buf, sizeof(buf)));
+                return nfserr_perm;
+        }
+
+        /* Set user creds for this exportpoint */
+        return nfserrno(nfsd_setuser(rqstp, exp));
+}
+
 /*
  * Perform sanity checks on the dentry in a client's file handle.
  *
@@ -115,8 +131,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
         dprintk("nfsd: fh_verify(%s)\n", SVCFH_fmt(fhp));
 
         if (!fhp->fh_dentry) {
-                __u32 *datap=NULL;
-                __u32 tfh[3];           /* filehandle fragment for oldstyle filehandles */
+                struct fid *fid = NULL, sfid;
                 int fileid_type;
                 int data_left = fh->fh_size/4;
 
@@ -128,7 +143,6 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
 
                 if (fh->fh_version == 1) {
                         int len;
-                        datap = fh->fh_auth;
                         if (--data_left<0) goto out;
                         switch (fh->fh_auth_type) {
                         case 0: break;
@@ -144,9 +158,11 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                                 fh->fh_fsid[1] = fh->fh_fsid[2];
                         }
                         if ((data_left -= len)<0) goto out;
-                        exp = rqst_exp_find(rqstp, fh->fh_fsid_type, datap);
-                        datap += len;
+                        exp = rqst_exp_find(rqstp, fh->fh_fsid_type,
+                                            fh->fh_auth);
+                        fid = (struct fid *)(fh->fh_auth + len);
                 } else {
+                        __u32 tfh[2];
                         dev_t xdev;
                         ino_t xino;
                         if (fh->fh_size != NFS_FHSIZE)
@@ -167,18 +183,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                         goto out;
                 }
 
-                /* Check if the request originated from a secure port. */
-                error = nfserr_perm;
-                if (!rqstp->rq_secure && EX_SECURE(exp)) {
-                        char buf[RPC_MAX_ADDRBUFLEN];
-                        printk(KERN_WARNING
-                               "nfsd: request from insecure port %s!\n",
-                               svc_print_addr(rqstp, buf, sizeof(buf)));
-                        goto out;
-                }
-
-                /* Set user creds for this exportpoint */
-                error = nfserrno(nfsd_setuser(rqstp, exp));
+                error = nfsd_setuser_and_check_port(rqstp, exp);
                 if (error)
                         goto out;
 
@@ -190,22 +195,22 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                         error = nfserr_badhandle;
 
                 if (fh->fh_version != 1) {
-                        tfh[0] = fh->ofh_ino;
-                        tfh[1] = fh->ofh_generation;
-                        tfh[2] = fh->ofh_dirino;
-                        datap = tfh;
+                        sfid.i32.ino = fh->ofh_ino;
+                        sfid.i32.gen = fh->ofh_generation;
+                        sfid.i32.parent_ino = fh->ofh_dirino;
+                        fid = &sfid;
                         data_left = 3;
                         if (fh->ofh_dirino == 0)
-                                fileid_type = 1;
+                                fileid_type = FILEID_INO32_GEN;
                         else
-                                fileid_type = 2;
+                                fileid_type = FILEID_INO32_GEN_PARENT;
                 } else
                         fileid_type = fh->fh_fileid_type;
 
-                if (fileid_type == 0)
+                if (fileid_type == FILEID_ROOT)
                         dentry = dget(exp->ex_dentry);
                 else {
-                        dentry = exportfs_decode_fh(exp->ex_mnt, datap,
+                        dentry = exportfs_decode_fh(exp->ex_mnt, fid,
                                         data_left, fileid_type,
                                         nfsd_acceptable, exp);
                 }
@@ -227,18 +232,22 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 fhp->fh_export = exp;
                 nfsd_nr_verified++;
         } else {
-                /* just rechecking permissions
-                 * (e.g. nfsproc_create calls fh_verify, then nfsd_create does as well)
+                /*
+                 * just rechecking permissions
+                 * (e.g. nfsproc_create calls fh_verify, then nfsd_create
+                 * does as well)
                  */
                 dprintk("nfsd: fh_verify - just checking\n");
                 dentry = fhp->fh_dentry;
                 exp = fhp->fh_export;
-                /* Set user creds for this exportpoint; necessary even
+                /*
+                 * Set user creds for this exportpoint; necessary even
                  * in the "just checking" case because this may be a
                  * filehandle that was created by fh_compose, and that
                  * is about to be used in another nfsv4 compound
-                 * operation */
-                error = nfserrno(nfsd_setuser(rqstp, exp));
+                 * operation.
+                 */
+                error = nfsd_setuser_and_check_port(rqstp, exp);
                 if (error)
                         goto out;
         }
@@ -286,16 +295,21 @@ out:
  * an inode.  In this case a call to fh_update should be made
  * before the fh goes out on the wire ...
  */
-static inline int _fh_update(struct dentry *dentry, struct svc_export *exp,
-                             __u32 *datap, int *maxsize)
+static void _fh_update(struct svc_fh *fhp, struct svc_export *exp,
+                struct dentry *dentry)
 {
-        if (dentry == exp->ex_dentry) {
-                *maxsize = 0;
-                return 0;
-        }
+        if (dentry != exp->ex_dentry) {
+                struct fid *fid = (struct fid *)
+                        (fhp->fh_handle.fh_auth + fhp->fh_handle.fh_size/4 - 1);
+                int maxsize = (fhp->fh_maxsize - fhp->fh_handle.fh_size)/4;
+                int subtreecheck = !(exp->ex_flags & NFSEXP_NOSUBTREECHECK);
 
-        return exportfs_encode_fh(dentry, datap, maxsize,
-                          !(exp->ex_flags & NFSEXP_NOSUBTREECHECK));
+                fhp->fh_handle.fh_fileid_type =
+                        exportfs_encode_fh(dentry, fid, &maxsize, subtreecheck);
+                fhp->fh_handle.fh_size += maxsize * 4;
+        } else {
+                fhp->fh_handle.fh_fileid_type = FILEID_ROOT;
+        }
 }
 
 /*
@@ -457,12 +471,8 @@ fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry,
                 datap += len/4;
                 fhp->fh_handle.fh_size = 4 + len;
 
-                if (inode) {
-                        int size = (fhp->fh_maxsize-len-4)/4;
-                        fhp->fh_handle.fh_fileid_type =
-                                _fh_update(dentry, exp, datap, &size);
-                        fhp->fh_handle.fh_size += size*4;
-                }
+                if (inode)
+                        _fh_update(fhp, exp, dentry);
                 if (fhp->fh_handle.fh_fileid_type == 255)
                         return nfserr_opnotsupp;
         }
@@ -479,7 +489,6 @@ __be32
 fh_update(struct svc_fh *fhp)
 {
         struct dentry *dentry;
-        __u32 *datap;
 
         if (!fhp->fh_dentry)
                 goto out_bad;
@@ -490,15 +499,10 @@ fh_update(struct svc_fh *fhp)
         if (fhp->fh_handle.fh_version != 1) {
                 _fh_update_old(dentry, fhp->fh_export, &fhp->fh_handle);
         } else {
-                int size;
-                if (fhp->fh_handle.fh_fileid_type != 0)
+                if (fhp->fh_handle.fh_fileid_type != FILEID_ROOT)
                         goto out;
-                datap = fhp->fh_handle.fh_auth+
-                        fhp->fh_handle.fh_size/4 -1;
-                size = (fhp->fh_maxsize - fhp->fh_handle.fh_size)/4;
-                fhp->fh_handle.fh_fileid_type =
-                        _fh_update(dentry, fhp->fh_export, datap, &size);
-                fhp->fh_handle.fh_size += size*4;
+
+                _fh_update(fhp, fhp->fh_export, dentry);
                 if (fhp->fh_handle.fh_fileid_type == 255)
                         return nfserr_opnotsupp;
         }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 46934c97f8f7..d0199189924c 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1029,13 +1029,13 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
                 if (EX_WGATHER(exp)) {
                         if (atomic_read(&inode->i_writecount) > 1
                             || (last_ino == inode->i_ino && last_dev == inode->i_sb->s_dev)) {
-                                dprintk("nfsd: write defer %d\n", current->pid);
+                                dprintk("nfsd: write defer %d\n", task_pid_nr(current));
                                 msleep(10);
-                                dprintk("nfsd: write resume %d\n", current->pid);
+                                dprintk("nfsd: write resume %d\n", task_pid_nr(current));
                         }
 
                         if (inode->i_state & I_DIRTY) {
-                                dprintk("nfsd: write sync %d\n", current->pid);
+                                dprintk("nfsd: write sync %d\n", task_pid_nr(current));
                                 host_err=nfsd_sync(file);
                         }
 #if 0
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 345798ebd366..37c11e194372 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -382,7 +382,7 @@ ToDo/Notes:
           own locking so it does not matter if the vfs inode is locked.
         - Fix bug in mft record writing where we forgot to set the device in
           the buffers when mapping them after the VM had discarded them.
-          Thanks to Martin MOKREJÅ  for the bug report.
+          Thanks to Martin MOKREJÃ… for the bug report.
 
 2.1.22 - Many bug and race fixes and error handling improvements.
 
@@ -1585,7 +1585,7 @@ tng-0.0.4 - Big changes, getting in line with Al Viro's comments.
           for reading $MFT (ntfs_mft_readpage). In the process create dedicated
           address space operations (ntfs_mft_aops) for $MFT inode mapping. Also
           removed the now superfluous exports from the kernel core patch.
-        - Fix a bug where kfree() was used insted of ntfs_free().
+        - Fix a bug where kfree() was used instead of ntfs_free().
         - Change map_mft_record() to take ntfs_inode as argument instead of
           vfs inode. Dito for unmap_mft_record(). Adapt all callers.
         - Add pointer to ntfs_volume to ntfs_inode.
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index cfdc7900d271..ad87cb01299b 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -405,6 +405,15 @@ static int ntfs_readpage(struct file *file, struct page *page)
 
 retry_readpage:
         BUG_ON(!PageLocked(page));
+        vi = page->mapping->host;
+        i_size = i_size_read(vi);
+        /* Is the page fully outside i_size? (truncate in progress) */
+        if (unlikely(page->index >= (i_size + PAGE_CACHE_SIZE - 1) >>
+                        PAGE_CACHE_SHIFT)) {
+                zero_user_page(page, 0, PAGE_CACHE_SIZE, KM_USER0);
+                ntfs_debug("Read outside i_size - truncated?");
+                goto done;
+        }
         /*
          * This can potentially happen because we clear PageUptodate() during
          * ntfs_writepage() of MstProtected() attributes.
@@ -413,7 +422,6 @@ retry_readpage:
                 unlock_page(page);
                 return 0;
         }
-        vi = page->mapping->host;
         ni = NTFS_I(vi);
         /*
          * Only $DATA attributes can be encrypted and only unnamed $DATA
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index 92dabdcf2b80..50d3b0c258e3 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -179,10 +179,7 @@ int ntfs_map_runlist_nolock(ntfs_inode *ni, VCN vcn, ntfs_attr_search_ctx *ctx)
          * ntfs_mapping_pairs_decompress() fails.
          */
         end_vcn = sle64_to_cpu(a->data.non_resident.highest_vcn) + 1;
-        if (!a->data.non_resident.lowest_vcn && end_vcn == 1)
-                end_vcn = sle64_to_cpu(a->data.non_resident.allocated_size) >>
-                                ni->vol->cluster_size_bits;
-        if (unlikely(vcn >= end_vcn)) {
+        if (unlikely(vcn && vcn >= end_vcn)) {
                 err = -ENOENT;
                 goto err_out;
         }
diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c
index d98daf59e0b6..d1619d05eb23 100644
--- a/fs/ntfs/compress.c
+++ b/fs/ntfs/compress.c
@@ -561,6 +561,16 @@ int ntfs_read_compressed_block(struct page *page)
         read_unlock_irqrestore(&ni->size_lock, flags);
         max_page = ((i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT) -
                         offset;
+        /* Is the page fully outside i_size? (truncate in progress) */
+        if (xpage >= max_page) {
+                kfree(bhs);
+                kfree(pages);
+                zero_user_page(page, 0, PAGE_CACHE_SIZE, KM_USER0);
+                ntfs_debug("Compressed read outside i_size - truncated?");
+                SetPageUptodate(page);
+                unlock_page(page);
+                return 0;
+        }
         if (nr_pages < max_page)
                 max_page = nr_pages;
         for (i = 0; i < max_page; i++, offset++) {
diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index e93c6142b23c..e1781c8b1650 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -450,58 +450,40 @@ try_next:
         return parent_dent;
 }
 
-/**
- * ntfs_get_dentry - find a dentry for the inode from a file handle sub-fragment
- * @sb:         super block identifying the mounted ntfs volume
- * @fh:         the file handle sub-fragment
- *
- * Find a dentry for the inode given a file handle sub-fragment.  This function
- * is called from fs/exportfs/expfs.c::find_exported_dentry() which in turn is
- * called from the default ->decode_fh() which is export_decode_fh() in the
- * same file.  The code is closely based on the default ->get_dentry() helper
- * fs/exportfs/expfs.c::get_object().
- *
- * The @fh contains two 32-bit unsigned values, the first one is the inode
- * number and the second one is the inode generation.
- *
- * Return the dentry on success or the error code on error (IS_ERR() is true).
- */
-static struct dentry *ntfs_get_dentry(struct super_block *sb, void *fh)
+static struct inode *ntfs_nfs_get_inode(struct super_block *sb,
+                u64 ino, u32 generation)
 {
-        struct inode *vi;
-        struct dentry *dent;
-        unsigned long ino = ((u32 *)fh)[0];
-        u32 gen = ((u32 *)fh)[1];
+        struct inode *inode;
 
-        ntfs_debug("Entering for inode 0x%lx, generation 0x%x.", ino, gen);
-        vi = ntfs_iget(sb, ino);
-        if (IS_ERR(vi)) {
-                ntfs_error(sb, "Failed to get inode 0x%lx.", ino);
-                return (struct dentry *)vi;
-        }
-        if (unlikely(is_bad_inode(vi) || vi->i_generation != gen)) {
-                /* We didn't find the right inode. */
-                ntfs_error(sb, "Inode 0x%lx, bad count: %d %d or version 0x%x "
-                                "0x%x.", vi->i_ino, vi->i_nlink,
-                                atomic_read(&vi->i_count), vi->i_generation,
-                                gen);
-                iput(vi);
-                return ERR_PTR(-ESTALE);
-        }
-        /* Now find a dentry.  If possible, get a well-connected one. */
-        dent = d_alloc_anon(vi);
-        if (unlikely(!dent)) {
-                iput(vi);
-                return ERR_PTR(-ENOMEM);
+        inode = ntfs_iget(sb, ino);
+        if (!IS_ERR(inode)) {
+                if (is_bad_inode(inode) || inode->i_generation != generation) {
+                        iput(inode);
+                        inode = ERR_PTR(-ESTALE);
+                }
         }
-        ntfs_debug("Done for inode 0x%lx, generation 0x%x.", ino, gen);
-        return dent;
+
+        return inode;
+}
+
+static struct dentry *ntfs_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_dentry(sb, fid, fh_len, fh_type,
+                                    ntfs_nfs_get_inode);
+}
+
+static struct dentry *ntfs_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        return generic_fh_to_parent(sb, fid, fh_len, fh_type,
+                                    ntfs_nfs_get_inode);
 }
 
 /**
  * Export operations allowing NFS exporting of mounted NTFS partitions.
  *
- * We use the default ->decode_fh() and ->encode_fh() for now.  Note that they
+ * We use the default ->encode_fh() for now.  Note that they
  * use 32 bits to store the inode number which is an unsigned long so on 64-bit
  * architectures is usually 64 bits so it would all fail horribly on huge
  * volumes.  I guess we need to define our own encode and decode fh functions
@@ -517,10 +499,9 @@ static struct dentry *ntfs_get_dentry(struct super_block *sb, void *fh)
  * allowing the inode number 0 which is used in NTFS for the system file $MFT
  * and due to using iget() whereas NTFS needs ntfs_iget().
  */
-struct export_operations ntfs_export_ops = {
+const struct export_operations ntfs_export_ops = {
         .get_parent     = ntfs_get_parent,      /* Find the parent of a given
                                                    directory. */
-        .get_dentry     = ntfs_get_dentry,      /* Find a dentry for the inode
-                                                   given a file handle
-                                                   sub-fragment. */
+        .fh_to_dentry   = ntfs_fh_to_dentry,
+        .fh_to_parent   = ntfs_fh_to_parent,
 };
diff --git a/fs/ntfs/ntfs.h b/fs/ntfs/ntfs.h
index d73f5a9ac341..d6a340bf80fc 100644
--- a/fs/ntfs/ntfs.h
+++ b/fs/ntfs/ntfs.h
@@ -69,7 +69,7 @@ extern const struct inode_operations ntfs_dir_inode_ops;
 extern const struct  file_operations ntfs_empty_file_ops;
 extern const struct inode_operations ntfs_empty_inode_ops;
 
-extern struct export_operations ntfs_export_ops;
+extern const struct export_operations ntfs_export_ops;
 
 /**
  * NTFS_SB - return the ntfs volume given a vfs super block
diff --git a/fs/ntfs/sysctl.c b/fs/ntfs/sysctl.c
index 4847fbfb0107..9ef85e628fe1 100644
--- a/fs/ntfs/sysctl.c
+++ b/fs/ntfs/sysctl.c
@@ -1,7 +1,7 @@
 /*
  * sysctl.c - Code for sysctl handling in NTFS Linux kernel driver. Part of
  *            the Linux-NTFS project. Adapted from the old NTFS driver,
- *            Copyright (C) 1997 Martin von Löwis, Régis Duchesne
+ *            Copyright (C) 1997 Martin von Löwis, Régis Duchesne
  *
  * Copyright (c) 2002-2005 Anton Altaparmakov
  *
diff --git a/fs/ntfs/sysctl.h b/fs/ntfs/sysctl.h
index beda5bf96405..d4f8ce920d95 100644
--- a/fs/ntfs/sysctl.h
+++ b/fs/ntfs/sysctl.h
@@ -1,7 +1,7 @@
 /*
  * sysctl.h - Defines for sysctl handling in NTFS Linux kernel driver. Part of
  *            the Linux-NTFS project. Adapted from the old NTFS driver,
- *            Copyright (C) 1997 Martin von Löwis, Régis Duchesne
+ *            Copyright (C) 1997 Martin von Löwis, Régis Duchesne
  *
  * Copyright (c) 2002-2004 Anton Altaparmakov
  *
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 4ba7f0bdc248..ce62c152823d 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -3946,7 +3946,7 @@ static int __ocfs2_mark_extent_written(struct inode *inode,
         struct ocfs2_merge_ctxt ctxt;
         struct ocfs2_extent_list *rightmost_el;
 
-        if (!rec->e_flags & OCFS2_EXT_UNWRITTEN) {
+        if (!(rec->e_flags & OCFS2_EXT_UNWRITTEN)) {
                 ret = -EIO;
                 mlog_errno(ret);
                 goto out;
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index c69c1b300155..56f7790cad46 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -729,6 +729,27 @@ static void ocfs2_clear_page_regions(struct page *page,
 }
 
 /*
+ * Nonsparse file systems fully allocate before we get to the write
+ * code. This prevents ocfs2_write() from tagging the write as an
+ * allocating one, which means ocfs2_map_page_blocks() might try to
+ * read-in the blocks at the tail of our file. Avoid reading them by
+ * testing i_size against each block offset.
+ */
+static int ocfs2_should_read_blk(struct inode *inode, struct page *page,
+                                 unsigned int block_start)
+{
+        u64 offset = page_offset(page) + block_start;
+
+        if (ocfs2_sparse_alloc(OCFS2_SB(inode->i_sb)))
+                return 1;
+
+        if (i_size_read(inode) > offset)
+                return 1;
+
+        return 0;
+}
+
+/*
  * Some of this taken from block_prepare_write(). We already have our
  * mapping by now though, and the entire write will be allocating or
  * it won't, so not much need to use BH_New.
@@ -781,6 +802,7 @@ int ocfs2_map_page_blocks(struct page *page, u64 *p_blkno,
                                 set_buffer_uptodate(bh);
                 } else if (!buffer_uptodate(bh) && !buffer_delay(bh) &&
                            !buffer_new(bh) &&
+                           ocfs2_should_read_blk(inode, page, block_start) &&
                            (block_start < from || block_end > to)) {
                         ll_rw_block(READ, 1, &bh);
                         *wait_bh++=bh;
@@ -1492,7 +1514,7 @@ int ocfs2_size_fits_inline_data(struct buffer_head *di_bh, u64 new_size)
 {
         struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
 
-        if (new_size < le16_to_cpu(di->id2.i_data.id_count))
+        if (new_size <= le16_to_cpu(di->id2.i_data.id_count))
                 return 1;
         return 0;
 }
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index f14b541fab95..f02ccb34604d 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -267,7 +267,7 @@ static struct bio *o2hb_setup_one_bio(struct o2hb_region *reg,
                 current_page = cs / spp;
                 page = reg->hr_slot_data[current_page];
 
-                vec_len = min(PAGE_CACHE_SIZE,
+                vec_len = min(PAGE_CACHE_SIZE - vec_start,
                               (max_slots-cs) * (PAGE_CACHE_SIZE/spp) );
 
                 mlog(ML_HB_BIO, "page %d, vec_len = %u, vec_start = %u\n",
@@ -1372,7 +1372,7 @@ static ssize_t o2hb_region_pid_read(struct o2hb_region *reg,
 
         spin_lock(&o2hb_live_lock);
         if (reg->hr_task)
-                pid = reg->hr_task->pid;
+                pid = task_pid_nr(reg->hr_task);
         spin_unlock(&o2hb_live_lock);
 
         if (!pid)
diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
index 75cd877f6d42..597e064bb94f 100644
--- a/fs/ocfs2/cluster/masklog.h
+++ b/fs/ocfs2/cluster/masklog.h
@@ -192,7 +192,7 @@ extern struct mlog_bits mlog_and_bits, mlog_not_bits;
  * previous token if args expands to nothing.
  */
 #define __mlog_printk(level, fmt, args...)                              \
-        printk(level "(%u,%lu):%s:%d " fmt, current->pid,               \
+        printk(level "(%u,%lu):%s:%d " fmt, task_pid_nr(current),       \
                __mlog_cpu_guess, __PRETTY_FUNCTION__, __LINE__ ,        \
                ##args)
 
@@ -212,7 +212,7 @@ extern struct mlog_bits mlog_and_bits, mlog_not_bits;
 #define mlog_errno(st) do {                                             \
         int _st = (st);                                                 \
         if (_st != -ERESTARTSYS && _st != -EINTR &&                     \
-            _st != AOP_TRUNCATED_PAGE)                                  \
+            _st != AOP_TRUNCATED_PAGE && _st != -ENOSPC)                \
                 mlog(ML_ERROR, "status = %lld\n", (long long)_st);      \
 } while (0)
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 685c18065c82..ee50c9610e7f 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -58,6 +58,7 @@
 #include <linux/slab.h>
 #include <linux/idr.h>
 #include <linux/kref.h>
+#include <linux/net.h>
 #include <net/tcp.h>
 
 #include <asm/uaccess.h>
@@ -71,14 +72,6 @@
 
 #include "tcp_internal.h"
 
-/* 
- * The linux network stack isn't sparse endian clean.. It has macros like
- * ntohs() which perform the endian checks and structs like sockaddr_in
- * which aren't annotated.  So __force is found here to get the build
- * clean.  When they emerge from the dark ages and annotate the code
- * we can remove these.
- */
-
 #define SC_NODEF_FMT "node %s (num %u) at %u.%u.%u.%u:%u"
 #define SC_NODEF_ARGS(sc) sc->sc_node->nd_name, sc->sc_node->nd_num,    \
                           NIPQUAD(sc->sc_node->nd_ipv4_address),        \
@@ -616,8 +609,7 @@ static void o2net_shutdown_sc(struct work_struct *work)
                 del_timer_sync(&sc->sc_idle_timeout);
                 o2net_sc_cancel_delayed_work(sc, &sc->sc_keepalive_work);
                 sc_put(sc);
-                sc->sc_sock->ops->shutdown(sc->sc_sock,
-                                           RCV_SHUTDOWN|SEND_SHUTDOWN);
+                kernel_sock_shutdown(sc->sc_sock, SHUT_RDWR);
         }
 
         /* not fatal so failed connects before the other guy has our
@@ -1500,7 +1492,7 @@ static void o2net_start_connect(struct work_struct *work)
 
         myaddr.sin_family = AF_INET;
         myaddr.sin_addr.s_addr = mynode->nd_ipv4_address;
-        myaddr.sin_port = (__force u16)htons(0); /* any port */
+        myaddr.sin_port = htons(0); /* any port */
 
         ret = sock->ops->bind(sock, (struct sockaddr *)&myaddr,
                               sizeof(myaddr));
@@ -1701,11 +1693,11 @@ static int o2net_accept_one(struct socket *sock)
         if (ret < 0)
                 goto out;
 
-        node = o2nm_get_node_by_ip((__force __be32)sin.sin_addr.s_addr);
+        node = o2nm_get_node_by_ip(sin.sin_addr.s_addr);
         if (node == NULL) {
                 mlog(ML_NOTICE, "attempt to connect from unknown node at "
                      "%u.%u.%u.%u:%d\n", NIPQUAD(sin.sin_addr.s_addr),
-                     ntohs((__force __be16)sin.sin_port));
+                     ntohs(sin.sin_port));
                 ret = -EINVAL;
                 goto out;
         }
@@ -1714,7 +1706,7 @@ static int o2net_accept_one(struct socket *sock)
                 mlog(ML_NOTICE, "unexpected connect attempted from a lower "
                      "numbered node '%s' at " "%u.%u.%u.%u:%d with num %u\n",
                      node->nd_name, NIPQUAD(sin.sin_addr.s_addr),
-                     ntohs((__force __be16)sin.sin_port), node->nd_num);
+                     ntohs(sin.sin_port), node->nd_num);
                 ret = -EINVAL;
                 goto out;
         }
@@ -1725,7 +1717,7 @@ static int o2net_accept_one(struct socket *sock)
                 mlog(ML_CONN, "attempt to connect from node '%s' at "
                      "%u.%u.%u.%u:%d but it isn't heartbeating\n",
                      node->nd_name, NIPQUAD(sin.sin_addr.s_addr),
-                     ntohs((__force __be16)sin.sin_port));
+                     ntohs(sin.sin_port));
                 ret = -EINVAL;
                 goto out;
         }
@@ -1742,7 +1734,7 @@ static int o2net_accept_one(struct socket *sock)
                 mlog(ML_NOTICE, "attempt to connect from node '%s' at "
                      "%u.%u.%u.%u:%d but it already has an open connection\n",
                      node->nd_name, NIPQUAD(sin.sin_addr.s_addr),
-                     ntohs((__force __be16)sin.sin_port));
+                     ntohs(sin.sin_port));
                 goto out;
         }
 
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index 014e73978dac..9923278ea6d4 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -318,9 +318,9 @@ out_attach:
 static void ocfs2_drop_dentry_lock(struct ocfs2_super *osb,
                                    struct ocfs2_dentry_lock *dl)
 {
+        iput(dl->dl_inode);
         ocfs2_simple_drop_lockres(osb, &dl->dl_lockres);
         ocfs2_lock_res_free(&dl->dl_lockres);
-        iput(dl->dl_inode);
         kfree(dl);
 }
 
@@ -344,12 +344,24 @@ static void ocfs2_dentry_iput(struct dentry *dentry, struct inode *inode)
 {
         struct ocfs2_dentry_lock *dl = dentry->d_fsdata;
 
-        mlog_bug_on_msg(!dl && !(dentry->d_flags & DCACHE_DISCONNECTED),
-                        "dentry: %.*s\n", dentry->d_name.len,
-                        dentry->d_name.name);
+        if (!dl) {
+                /*
+                 * No dentry lock is ok if we're disconnected or
+                 * unhashed.
+                 */
+                if (!(dentry->d_flags & DCACHE_DISCONNECTED) &&
+                    !d_unhashed(dentry)) {
+                        unsigned long long ino = 0ULL;
+                        if (inode)
+                                ino = (unsigned long long)OCFS2_I(inode)->ip_blkno;
+                        mlog(ML_ERROR, "Dentry is missing cluster lock. "
+                             "inode: %llu, d_flags: 0x%x, d_name: %.*s\n",
+                             ino, dentry->d_flags, dentry->d_name.len,
+                             dentry->d_name.name);
+                }
 
-        if (!dl)
                 goto out;
+        }
 
         mlog_bug_on_msg(dl->dl_count == 0, "dentry: %.*s, count: %u\n",
                         dentry->d_name.len, dentry->d_name.name,
@@ -376,7 +388,7 @@ out:
  * directory locks. The dentries have already been deleted on other
  * nodes via ocfs2_remote_dentry_delete().
  *
- * Normally, the VFS handles the d_move() for the file sytem, after
+ * Normally, the VFS handles the d_move() for the file system, after
  * the ->rename() callback. OCFS2 wants to handle this internally, so
  * the new lock can be created atomically with respect to the cluster.
  */
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 6a2f143e269c..63b28fdceb4a 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -208,9 +208,9 @@ out:
         return NULL;
 }
 
-struct buffer_head *ocfs2_find_entry_el(const char *name, int namelen,
-                                        struct inode *dir,
-                                        struct ocfs2_dir_entry **res_dir)
+static struct buffer_head *ocfs2_find_entry_el(const char *name, int namelen,
+                                               struct inode *dir,
+                                               struct ocfs2_dir_entry **res_dir)
 {
         struct super_block *sb;
         struct buffer_head *bh_use[NAMEI_RA_SIZE];
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 62e4a7daa286..a54d33d95ada 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -908,7 +908,7 @@ lookup:
                  * but they might own this lockres.  wait on them. */
                 bit = find_next_bit(dlm->recovery_map, O2NM_MAX_NODES, 0);
                 if (bit < O2NM_MAX_NODES) {
-                        mlog(ML_NOTICE, "%s:%.*s: at least one node (%d) to"
+                        mlog(ML_NOTICE, "%s:%.*s: at least one node (%d) to "
                              "recover before lock mastery can begin\n",
                              dlm->name, namelen, (char *)lockid, bit);
                         wait_on_recovery = 1;
@@ -962,7 +962,7 @@ redo_request:
                 spin_lock(&dlm->spinlock);
                 bit = find_next_bit(dlm->recovery_map, O2NM_MAX_NODES, 0);
                 if (bit < O2NM_MAX_NODES) {
-                        mlog(ML_NOTICE, "%s:%.*s: at least one node (%d) to"
+                        mlog(ML_NOTICE, "%s:%.*s: at least one node (%d) to "
                              "recover before lock mastery can begin\n",
                              dlm->name, namelen, (char *)lockid, bit);
                         wait_on_recovery = 1;
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index a2c33160bfd6..2fde7bf91434 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -259,7 +259,7 @@ static void dlm_print_reco_node_status(struct dlm_ctxt *dlm)
         struct dlm_lock_resource *res;
 
         mlog(ML_NOTICE, "%s(%d): recovery info, state=%s, dead=%u, master=%u\n",
-             dlm->name, dlm->dlm_reco_thread_task->pid,
+             dlm->name, task_pid_nr(dlm->dlm_reco_thread_task),
              dlm->reco.state & DLM_RECO_STATE_ACTIVE ? "ACTIVE" : "inactive",
              dlm->reco.dead_node, dlm->reco.new_master);
 
@@ -420,7 +420,7 @@ void dlm_wait_for_recovery(struct dlm_ctxt *dlm)
         if (dlm_in_recovery(dlm)) {
                 mlog(0, "%s: reco thread %d in recovery: "
                      "state=%d, master=%u, dead=%u\n",
-                     dlm->name, dlm->dlm_reco_thread_task->pid,
+                     dlm->name, task_pid_nr(dlm->dlm_reco_thread_task),
                      dlm->reco.state, dlm->reco.new_master,
                      dlm->reco.dead_node);
         }
@@ -483,7 +483,7 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
                 return 0;
         }
         mlog(0, "%s(%d):recovery thread found node %u in the recovery map!\n",
-             dlm->name, dlm->dlm_reco_thread_task->pid,
+             dlm->name, task_pid_nr(dlm->dlm_reco_thread_task),
              dlm->reco.dead_node);
         spin_unlock(&dlm->spinlock);
 
@@ -507,7 +507,7 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
                 mlog(0, "another node will master this recovery session.\n");
         }
         mlog(0, "dlm=%s (%d), new_master=%u, this node=%u, dead_node=%u\n",
-             dlm->name, dlm->dlm_reco_thread_task->pid, dlm->reco.new_master,
+             dlm->name, task_pid_nr(dlm->dlm_reco_thread_task), dlm->reco.new_master,
              dlm->node_num, dlm->reco.dead_node);
 
         /* it is safe to start everything back up here
@@ -520,7 +520,7 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
 
 master_here:
         mlog(0, "(%d) mastering recovery of %s:%u here(this=%u)!\n",
-             dlm->dlm_reco_thread_task->pid,
+             task_pid_nr(dlm->dlm_reco_thread_task),
              dlm->name, dlm->reco.dead_node, dlm->node_num);
 
         status = dlm_remaster_locks(dlm, dlm->reco.dead_node);
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 41c76ff2fcfb..4e97dcceaf8f 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -670,7 +670,7 @@ static inline void ocfs2_generic_handle_attach_action(struct ocfs2_lock_res *loc
 {
         mlog_entry_void();
 
-        BUG_ON((!lockres->l_flags & OCFS2_LOCK_BUSY));
+        BUG_ON((!(lockres->l_flags & OCFS2_LOCK_BUSY)));
         BUG_ON(lockres->l_flags & OCFS2_LOCK_ATTACHED);
 
         if (lockres->l_requested > LKM_NLMODE &&
@@ -980,18 +980,6 @@ again:
                 goto unlock;
         }
 
-        if (!(lockres->l_flags & OCFS2_LOCK_ATTACHED)) {
-                /* lock has not been created yet. */
-                spin_unlock_irqrestore(&lockres->l_lock, flags);
-
-                ret = ocfs2_lock_create(osb, lockres, LKM_NLMODE, 0);
-                if (ret < 0) {
-                        mlog_errno(ret);
-                        goto out;
-                }
-                goto again;
-        }
-
         if (lockres->l_flags & OCFS2_LOCK_BLOCKED &&
             !ocfs2_may_continue_on_blocked_lock(lockres, level)) {
                 /* is the lock is currently blocked on behalf of
@@ -1006,7 +994,14 @@ again:
                         mlog(ML_ERROR, "lockres %s has action %u pending\n",
                              lockres->l_name, lockres->l_action);
 
-                lockres->l_action = OCFS2_AST_CONVERT;
+                if (!(lockres->l_flags & OCFS2_LOCK_ATTACHED)) {
+                        lockres->l_action = OCFS2_AST_ATTACH;
+                        lkm_flags &= ~LKM_CONVERT;
+                } else {
+                        lockres->l_action = OCFS2_AST_CONVERT;
+                        lkm_flags |= LKM_CONVERT;
+                }
+
                 lockres->l_requested = level;
                 lockres_or_flags(lockres, OCFS2_LOCK_BUSY);
                 spin_unlock_irqrestore(&lockres->l_lock, flags);
@@ -1021,7 +1016,7 @@ again:
                 status = dlmlock(osb->dlm,
                                  level,
                                  &lockres->l_lksb,
-                                 lkm_flags|LKM_CONVERT,
+                                 lkm_flags,
                                  lockres->l_name,
                                  OCFS2_LOCK_ID_MAX_LEN - 1,
                                  ocfs2_locking_ast,
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index c3bbc198f9ce..535bfa9568a4 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -45,9 +45,9 @@ struct ocfs2_inode_handle
         u32 ih_generation;
 };
 
-static struct dentry *ocfs2_get_dentry(struct super_block *sb, void *vobjp)
+static struct dentry *ocfs2_get_dentry(struct super_block *sb,
+                struct ocfs2_inode_handle *handle)
 {
-        struct ocfs2_inode_handle *handle = vobjp;
         struct inode *inode;
         struct dentry *result;
 
@@ -194,54 +194,37 @@ bail:
         return type;
 }
 
-static struct dentry *ocfs2_decode_fh(struct super_block *sb, u32 *fh_in,
-                                      int fh_len, int fileid_type,
-                                      int (*acceptable)(void *context,
-                                                        struct dentry *de),
-                                      void *context)
+static struct dentry *ocfs2_fh_to_dentry(struct super_block *sb,
+                struct fid *fid, int fh_len, int fh_type)
 {
-        struct ocfs2_inode_handle handle, parent;
-        struct dentry *ret = NULL;
-        __le32 *fh = (__force __le32 *) fh_in;
-
-        mlog_entry("(0x%p, 0x%p, %d, %d, 0x%p, 0x%p)\n",
-                   sb, fh, fh_len, fileid_type, acceptable, context);
-
-        if (fh_len < 3 || fileid_type > 2)
-                goto bail;
-
-        if (fileid_type == 2) {
-                if (fh_len < 6)
-                        goto bail;
-
-                parent.ih_blkno = (u64)le32_to_cpu(fh[3]) << 32;
-                parent.ih_blkno |= (u64)le32_to_cpu(fh[4]);
-                parent.ih_generation = le32_to_cpu(fh[5]);
+        struct ocfs2_inode_handle handle;
 
-                mlog(0, "Decoding parent: blkno: %llu, generation: %u\n",
-                     (unsigned long long)parent.ih_blkno,
-                     parent.ih_generation);
-        }
+        if (fh_len < 3 || fh_type > 2)
+                return NULL;
 
-        handle.ih_blkno = (u64)le32_to_cpu(fh[0]) << 32;
-        handle.ih_blkno |= (u64)le32_to_cpu(fh[1]);
-        handle.ih_generation = le32_to_cpu(fh[2]);
+        handle.ih_blkno = (u64)le32_to_cpu(fid->raw[0]) << 32;
+        handle.ih_blkno |= (u64)le32_to_cpu(fid->raw[1]);
+        handle.ih_generation = le32_to_cpu(fid->raw[2]);
+        return ocfs2_get_dentry(sb, &handle);
+}
 
-        mlog(0, "Encoding fh: blkno: %llu, generation: %u\n",
-             (unsigned long long)handle.ih_blkno, handle.ih_generation);
+static struct dentry *ocfs2_fh_to_parent(struct super_block *sb,
+                struct fid *fid, int fh_len, int fh_type)
+{
+        struct ocfs2_inode_handle parent;
 
-        ret = ocfs2_export_ops.find_exported_dentry(sb, &handle, &parent,
-                                                    acceptable, context);
+        if (fh_type != 2 || fh_len < 6)
+                return NULL;
 
-bail:
-        mlog_exit_ptr(ret);
-        return ret;
+        parent.ih_blkno = (u64)le32_to_cpu(fid->raw[3]) << 32;
+        parent.ih_blkno |= (u64)le32_to_cpu(fid->raw[4]);
+        parent.ih_generation = le32_to_cpu(fid->raw[5]);
+        return ocfs2_get_dentry(sb, &parent);
 }
 
-struct export_operations ocfs2_export_ops = {
-        .decode_fh      = ocfs2_decode_fh,
+const struct export_operations ocfs2_export_ops = {
         .encode_fh      = ocfs2_encode_fh,
-
+        .fh_to_dentry   = ocfs2_fh_to_dentry,
+        .fh_to_parent   = ocfs2_fh_to_parent,
         .get_parent     = ocfs2_get_parent,
-        .get_dentry     = ocfs2_get_dentry,
 };
diff --git a/fs/ocfs2/export.h b/fs/ocfs2/export.h
index e08bed9e45a0..41a738678c37 100644
--- a/fs/ocfs2/export.h
+++ b/fs/ocfs2/export.h
@@ -28,6 +28,6 @@
 
 #include <linux/exportfs.h>
 
-extern struct export_operations ocfs2_export_ops;
+extern const struct export_operations ocfs2_export_ops;
 
 #endif /* OCFS2_EXPORT_H */
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index f92fe91ff260..b75b2e1f0e42 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -399,7 +399,7 @@ static int ocfs2_truncate_file(struct inode *inode,
 
         if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
                 status = ocfs2_truncate_inline(inode, di_bh, new_i_size,
-                                               i_size_read(inode), 0);
+                                               i_size_read(inode), 1);
                 if (status)
                         mlog_errno(status);
 
@@ -1521,6 +1521,7 @@ static int ocfs2_remove_inode_range(struct inode *inode,
         u32 trunc_start, trunc_len, cpos, phys_cpos, alloc_size;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct ocfs2_cached_dealloc_ctxt dealloc;
+        struct address_space *mapping = inode->i_mapping;
 
         ocfs2_init_dealloc_ctxt(&dealloc);
 
@@ -1529,10 +1530,20 @@ static int ocfs2_remove_inode_range(struct inode *inode,
 
         if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
                 ret = ocfs2_truncate_inline(inode, di_bh, byte_start,
-                                            byte_start + byte_len, 1);
-                if (ret)
+                                            byte_start + byte_len, 0);
+                if (ret) {
                         mlog_errno(ret);
-                return ret;
+                        goto out;
+                }
+                /*
+                 * There's no need to get fancy with the page cache
+                 * truncate of an inline-data inode. We're talking
+                 * about less than a page here, which will be cached
+                 * in the dinode buffer anyway.
+                 */
+                unmap_mapping_range(mapping, 0, 0, 0);
+                truncate_inode_pages(mapping, 0);
+                goto out;
         }
 
         trunc_start = ocfs2_clusters_for_bytes(osb->sb, byte_start);
@@ -1891,9 +1902,11 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
         ssize_t written = 0;
         size_t ocount;          /* original count */
         size_t count;           /* after file limit checks */
-        loff_t *ppos = &iocb->ki_pos;
+        loff_t old_size, *ppos = &iocb->ki_pos;
+        u32 old_clusters;
         struct file *file = iocb->ki_filp;
         struct inode *inode = file->f_path.dentry->d_inode;
+        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 
         mlog_entry("(0x%p, %u, '%.*s')\n", file,
                    (unsigned int)nr_segs,
@@ -1949,6 +1962,13 @@ relock:
                 goto relock;
         }
 
+        /*
+         * To later detect whether a journal commit for sync writes is
+         * necessary, we sample i_size, and cluster count here.
+         */
+        old_size = i_size_read(inode);
+        old_clusters = OCFS2_I(inode)->ip_clusters;
+
         /* communicate with ocfs2_dio_end_io */
         ocfs2_iocb_set_rw_locked(iocb, rw_level);
 
@@ -1978,6 +1998,21 @@ out_dio:
         /* buffered aio wouldn't have proper lock coverage today */
         BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
 
+        if ((file->f_flags & O_SYNC && !direct_io) || IS_SYNC(inode)) {
+                /*
+                 * The generic write paths have handled getting data
+                 * to disk, but since we don't make use of the dirty
+                 * inode list, a manual journal commit is necessary
+                 * here.
+                 */
+                if (old_size != i_size_read(inode) ||
+                    old_clusters != OCFS2_I(inode)->ip_clusters) {
+                        ret = journal_force_commit(osb->journal->j_journal);
+                        if (ret < 0)
+                                written = ret;
+                }
+        }
+
         /* 
          * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
          * function pointer which is called when o_direct io completes so that
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 1d5e0cb0fda1..ebb2bbe30f35 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -455,8 +455,8 @@ static int ocfs2_read_locked_inode(struct inode *inode,
         status = -EINVAL;
         fe = (struct ocfs2_dinode *) bh->b_data;
         if (!OCFS2_IS_VALID_DINODE(fe)) {
-                mlog(ML_ERROR, "Invalid dinode #%llu: signature = %.*s\n",
-                     (unsigned long long)le64_to_cpu(fe->i_blkno), 7,
+                mlog(0, "Invalid dinode #%llu: signature = %.*s\n",
+                     (unsigned long long)args->fi_blkno, 7,
                      fe->i_signature);
                 goto bail;
         }
@@ -863,7 +863,7 @@ static int ocfs2_query_inode_wipe(struct inode *inode,
         status = ocfs2_try_open_lock(inode, 1);
         if (status == -EAGAIN) {
                 status = 0;
-                mlog(0, "Skipping delete of %llu because it is in use on"
+                mlog(0, "Skipping delete of %llu because it is in use on "
                      "other nodes\n", (unsigned long long)oi->ip_blkno);
                 goto bail;
         }
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index d272847d5a07..58ea88b5af36 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -484,6 +484,7 @@ int ocfs2_reserve_local_alloc_bits(struct ocfs2_super *osb,
 
         alloc = (struct ocfs2_dinode *) osb->local_alloc_bh->b_data;
 
+#ifdef OCFS2_DEBUG_FS
         if (le32_to_cpu(alloc->id1.bitmap1.i_used) !=
             ocfs2_local_alloc_count_bits(alloc)) {
                 ocfs2_error(osb->sb, "local alloc inode %llu says it has "
@@ -494,6 +495,7 @@ int ocfs2_reserve_local_alloc_bits(struct ocfs2_super *osb,
                 status = -EIO;
                 goto bail;
         }
+#endif
 
         free_bits = le32_to_cpu(alloc->id1.bitmap1.i_total) -
                 le32_to_cpu(alloc->id1.bitmap1.i_used);
@@ -712,9 +714,8 @@ static int ocfs2_sync_local_to_main(struct ocfs2_super *osb,
         void *bitmap;
         struct ocfs2_local_alloc *la = OCFS2_LOCAL_ALLOC(alloc);
 
-        mlog_entry("total = %u, COUNT = %u, used = %u\n",
+        mlog_entry("total = %u, used = %u\n",
                    le32_to_cpu(alloc->id1.bitmap1.i_total),
-                   ocfs2_local_alloc_count_bits(alloc),
                    le32_to_cpu(alloc->id1.bitmap1.i_used));
 
         if (!alloc->id1.bitmap1.i_total) {
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 729259016c18..989ac2718587 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1105,9 +1105,16 @@ static int ocfs2_rename(struct inode *old_dir,
                 goto bail;
         }
 
-        if (!new_de && new_inode)
-                mlog(ML_ERROR, "inode %lu does not exist in it's parent "
-                     "directory!", new_inode->i_ino);
+        if (!new_de && new_inode) {
+                /*
+                 * Target was unlinked by another node while we were
+                 * waiting to get to ocfs2_rename(). There isn't
+                 * anything we can do here to help the situation, so
+                 * bubble up the appropriate error.
+                 */
+                status = -ENOENT;
+                goto bail;
+        }
 
         /* In case we need to overwrite an existing file, we blow it
          * away first */
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index be562ac3e89c..5ee775420665 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -438,14 +438,14 @@ unlock_osb:
         }
 
         if (!ret) {
-                if (!ocfs2_is_hard_readonly(osb))
-                        ocfs2_set_journal_params(osb);
-
                 /* Only save off the new mount options in case of a successful
                  * remount. */
                 osb->s_mount_opt = parsed_options.mount_opt;
                 osb->s_atime_quantum = parsed_options.atime_quantum;
                 osb->preferred_slot = parsed_options.slot;
+
+                if (!ocfs2_is_hard_readonly(osb))
+                        ocfs2_set_journal_params(osb);
         }
 out:
         return ret;
diff --git a/fs/open.c b/fs/open.c
index 75385144df7d..4932b4d1da05 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -569,7 +569,7 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
         dentry = file->f_path.dentry;
         inode = dentry->d_inode;
 
-        audit_inode(NULL, inode);
+        audit_inode(NULL, dentry);
 
         err = -EROFS;
         if (IS_RDONLY(inode))
@@ -727,7 +727,7 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
                 goto out;
 
         dentry = file->f_path.dentry;
-        audit_inode(NULL, dentry->d_inode);
+        audit_inode(NULL, dentry);
         error = chown_common(dentry, user, group);
         fput(file);
 out:
@@ -1061,7 +1061,7 @@ asmlinkage long sys_open(const char __user *filename, int flags, int mode)
         prevent_tail_call(ret);
         return ret;
 }
-EXPORT_SYMBOL_GPL(sys_open);
+EXPORT_UNUSED_SYMBOL_GPL(sys_open); /* To be deleted for 2.6.25 */
 
 asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
                            int mode)
diff --git a/fs/pnode.h b/fs/pnode.h
index d45bd8ec36bf..f249be2fee7a 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -22,6 +22,7 @@
 #define CL_COPY_ALL             0x04
 #define CL_MAKE_SHARED          0x08
 #define CL_PROPAGATION          0x10
+#define CL_PRIVATE              0x20
 
 static inline void set_mnt_shared(struct vfsmount *mnt)
 {
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 27b59f5f3bd1..65c62e1bfd6f 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -77,6 +77,7 @@
 #include <linux/cpuset.h>
 #include <linux/rcupdate.h>
 #include <linux/delayacct.h>
+#include <linux/pid_namespace.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -145,8 +146,7 @@ static inline const char *get_task_state(struct task_struct *tsk)
                                             TASK_UNINTERRUPTIBLE |
                                             TASK_STOPPED |
                                             TASK_TRACED)) |
-                        (tsk->exit_state & (EXIT_ZOMBIE |
-                                            EXIT_DEAD));
+                                           tsk->exit_state;
         const char **p = &task_state_array[0];
 
         while (state) {
@@ -161,8 +161,15 @@ static inline char *task_state(struct task_struct *p, char *buffer)
         struct group_info *group_info;
         int g;
         struct fdtable *fdt = NULL;
+        struct pid_namespace *ns;
+        pid_t ppid, tpid;
 
+        ns = current->nsproxy->pid_ns;
         rcu_read_lock();
+        ppid = pid_alive(p) ?
+                task_tgid_nr_ns(rcu_dereference(p->real_parent), ns) : 0;
+        tpid = pid_alive(p) && p->ptrace ?
+                task_ppid_nr_ns(rcu_dereference(p->parent), ns) : 0;
         buffer += sprintf(buffer,
                 "State:\t%s\n"
                 "Tgid:\t%d\n"
@@ -172,9 +179,9 @@ static inline char *task_state(struct task_struct *p, char *buffer)
                 "Uid:\t%d\t%d\t%d\t%d\n"
                 "Gid:\t%d\t%d\t%d\t%d\n",
                 get_task_state(p),
-                p->tgid, p->pid,
-                pid_alive(p) ? rcu_dereference(p->real_parent)->tgid : 0,
-                pid_alive(p) && p->ptrace ? rcu_dereference(p->parent)->pid : 0,
+                task_tgid_nr_ns(p, ns),
+                task_pid_nr_ns(p, ns),
+                ppid, tpid,
                 p->uid, p->euid, p->suid, p->fsuid,
                 p->gid, p->egid, p->sgid, p->fsgid);
 
@@ -351,7 +358,8 @@ static cputime_t task_utime(struct task_struct *p)
         }
         utime = (clock_t)temp;
 
-        return clock_t_to_cputime(utime);
+        p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
+        return p->prev_utime;
 }
 
 static cputime_t task_stime(struct task_struct *p)
@@ -366,7 +374,10 @@ static cputime_t task_stime(struct task_struct *p)
         stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
                         cputime_to_clock_t(task_utime(p));
 
-        return clock_t_to_cputime(stime);
+        if (stime >= 0)
+                p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
+
+        return p->prev_stime;
 }
 #endif
 
@@ -394,6 +405,9 @@ static int do_task_stat(struct task_struct *task, char *buffer, int whole)
         unsigned long rsslim = 0;
         char tcomm[sizeof(task->comm)];
         unsigned long flags;
+        struct pid_namespace *ns;
+
+        ns = current->nsproxy->pid_ns;
 
         state = *get_task_state(task);
         vsize = eip = esp = 0;
@@ -416,7 +430,7 @@ static int do_task_stat(struct task_struct *task, char *buffer, int whole)
                 struct signal_struct *sig = task->signal;
 
                 if (sig->tty) {
-                        tty_pgrp = pid_nr(sig->tty->pgrp);
+                        tty_pgrp = pid_nr_ns(sig->tty->pgrp, ns);
                         tty_nr = new_encode_dev(tty_devnum(sig->tty));
                 }
 
@@ -446,12 +460,12 @@ static int do_task_stat(struct task_struct *task, char *buffer, int whole)
                         maj_flt += sig->maj_flt;
                         utime = cputime_add(utime, sig->utime);
                         stime = cputime_add(stime, sig->stime);
-                        gtime += cputime_add(gtime, sig->gtime);
+                        gtime = cputime_add(gtime, sig->gtime);
                 }
 
-                sid = signal_session(sig);
-                pgid = process_group(task);
-                ppid = rcu_dereference(task->real_parent)->tgid;
+                sid = task_session_nr_ns(task, ns);
+                pgid = task_pgrp_nr_ns(task, ns);
+                ppid = task_ppid_nr_ns(task, ns);
 
                 unlock_task_sighand(task, &flags);
         }
@@ -483,7 +497,7 @@ static int do_task_stat(struct task_struct *task, char *buffer, int whole)
         res = sprintf(buffer, "%d (%s) %c %d %d %d %d %d %u %lu \
 %lu %lu %lu %lu %lu %ld %ld %ld %ld %d 0 %llu %lu %ld %lu %lu %lu %lu %lu \
 %lu %lu %lu %lu %lu %lu %lu %lu %d %d %u %u %llu %lu %ld\n",
-                task->pid,
+                task_pid_nr_ns(task, ns),
                 tcomm,
                 state,
                 ppid,
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4fe74d156416..02a63ac04178 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -63,16 +63,19 @@
 #include <linux/mm.h>
 #include <linux/rcupdate.h>
 #include <linux/kallsyms.h>
+#include <linux/resource.h>
 #include <linux/module.h>
 #include <linux/mount.h>
 #include <linux/security.h>
 #include <linux/ptrace.h>
+#include <linux/cgroup.h>
 #include <linux/cpuset.h>
 #include <linux/audit.h>
 #include <linux/poll.h>
 #include <linux/nsproxy.h>
 #include <linux/oom.h>
 #include <linux/elf.h>
+#include <linux/pid_namespace.h>
 #include "internal.h"
 
 /* NOTE:
@@ -301,6 +304,78 @@ static int proc_oom_score(struct task_struct *task, char *buffer)
         return sprintf(buffer, "%lu\n", points);
 }
 
+struct limit_names {
+        char *name;
+        char *unit;
+};
+
+static const struct limit_names lnames[RLIM_NLIMITS] = {
+        [RLIMIT_CPU] = {"Max cpu time", "ms"},
+        [RLIMIT_FSIZE] = {"Max file size", "bytes"},
+        [RLIMIT_DATA] = {"Max data size", "bytes"},
+        [RLIMIT_STACK] = {"Max stack size", "bytes"},
+        [RLIMIT_CORE] = {"Max core file size", "bytes"},
+        [RLIMIT_RSS] = {"Max resident set", "bytes"},
+        [RLIMIT_NPROC] = {"Max processes", "processes"},
+        [RLIMIT_NOFILE] = {"Max open files", "files"},
+        [RLIMIT_MEMLOCK] = {"Max locked memory", "bytes"},
+        [RLIMIT_AS] = {"Max address space", "bytes"},
+        [RLIMIT_LOCKS] = {"Max file locks", "locks"},
+        [RLIMIT_SIGPENDING] = {"Max pending signals", "signals"},
+        [RLIMIT_MSGQUEUE] = {"Max msgqueue size", "bytes"},
+        [RLIMIT_NICE] = {"Max nice priority", NULL},
+        [RLIMIT_RTPRIO] = {"Max realtime priority", NULL},
+};
+
+/* Display limits for a process */
+static int proc_pid_limits(struct task_struct *task, char *buffer)
+{
+        unsigned int i;
+        int count = 0;
+        unsigned long flags;
+        char *bufptr = buffer;
+
+        struct rlimit rlim[RLIM_NLIMITS];
+
+        rcu_read_lock();
+        if (!lock_task_sighand(task,&flags)) {
+                rcu_read_unlock();
+                return 0;
+        }
+        memcpy(rlim, task->signal->rlim, sizeof(struct rlimit) * RLIM_NLIMITS);
+        unlock_task_sighand(task, &flags);
+        rcu_read_unlock();
+
+        /*
+         * print the file header
+         */
+        count += sprintf(&bufptr[count], "%-25s %-20s %-20s %-10s\n",
+                        "Limit", "Soft Limit", "Hard Limit", "Units");
+
+        for (i = 0; i < RLIM_NLIMITS; i++) {
+                if (rlim[i].rlim_cur == RLIM_INFINITY)
+                        count += sprintf(&bufptr[count], "%-25s %-20s ",
+                                         lnames[i].name, "unlimited");
+                else
+                        count += sprintf(&bufptr[count], "%-25s %-20lu ",
+                                         lnames[i].name, rlim[i].rlim_cur);
+
+                if (rlim[i].rlim_max == RLIM_INFINITY)
+                        count += sprintf(&bufptr[count], "%-20s ", "unlimited");
+                else
+                        count += sprintf(&bufptr[count], "%-20lu ",
+                                         rlim[i].rlim_max);
+
+                if (lnames[i].unit)
+                        count += sprintf(&bufptr[count], "%-10s\n",
+                                         lnames[i].unit);
+                else
+                        count += sprintf(&bufptr[count], "\n");
+        }
+
+        return count;
+}
+
 /************************************************************************/
 /*                       Here the fs part begins                        */
 /************************************************************************/
@@ -349,18 +424,21 @@ struct proc_mounts {
 static int mounts_open(struct inode *inode, struct file *file)
 {
         struct task_struct *task = get_proc_task(inode);
+        struct nsproxy *nsp;
         struct mnt_namespace *ns = NULL;
         struct proc_mounts *p;
         int ret = -EINVAL;
 
         if (task) {
-                task_lock(task);
-                if (task->nsproxy) {
-                        ns = task->nsproxy->mnt_ns;
+                rcu_read_lock();
+                nsp = task_nsproxy(task);
+                if (nsp) {
+                        ns = nsp->mnt_ns;
                         if (ns)
                                 get_mnt_ns(ns);
                 }
-                task_unlock(task);
+                rcu_read_unlock();
+
                 put_task_struct(task);
         }
 
@@ -423,16 +501,20 @@ static int mountstats_open(struct inode *inode, struct file *file)
 
         if (!ret) {
                 struct seq_file *m = file->private_data;
+                struct nsproxy *nsp;
                 struct mnt_namespace *mnt_ns = NULL;
                 struct task_struct *task = get_proc_task(inode);
 
                 if (task) {
-                        task_lock(task);
-                        if (task->nsproxy)
-                                mnt_ns = task->nsproxy->mnt_ns;
-                        if (mnt_ns)
-                                get_mnt_ns(mnt_ns);
-                        task_unlock(task);
+                        rcu_read_lock();
+                        nsp = task_nsproxy(task);
+                        if (nsp) {
+                                mnt_ns = nsp->mnt_ns;
+                                if (mnt_ns)
+                                        get_mnt_ns(mnt_ns);
+                        }
+                        rcu_read_unlock();
+
                         put_task_struct(task);
                 }
 
@@ -1437,7 +1519,7 @@ static int proc_readfd_common(struct file * filp, void * dirent,
         struct dentry *dentry = filp->f_path.dentry;
         struct inode *inode = dentry->d_inode;
         struct task_struct *p = get_proc_task(inode);
-        unsigned int fd, tid, ino;
+        unsigned int fd, ino;
         int retval;
         struct files_struct * files;
         struct fdtable *fdt;
@@ -1446,7 +1528,6 @@ static int proc_readfd_common(struct file * filp, void * dirent,
         if (!p)
                 goto out_no_task;
         retval = 0;
-        tid = p->pid;
 
         fd = filp->f_pos;
         switch (fd) {
@@ -1681,7 +1762,6 @@ static int proc_pident_readdir(struct file *filp,
                 const struct pid_entry *ents, unsigned int nents)
 {
         int i;
-        int pid;
         struct dentry *dentry = filp->f_path.dentry;
         struct inode *inode = dentry->d_inode;
         struct task_struct *task = get_proc_task(inode);
@@ -1694,7 +1774,6 @@ static int proc_pident_readdir(struct file *filp,
                 goto out_no_task;
 
         ret = 0;
-        pid = task->pid;
         i = filp->f_pos;
         switch (i) {
         case 0:
@@ -1928,14 +2007,14 @@ static int proc_self_readlink(struct dentry *dentry, char __user *buffer,
                               int buflen)
 {
         char tmp[PROC_NUMBUF];
-        sprintf(tmp, "%d", current->tgid);
+        sprintf(tmp, "%d", task_tgid_vnr(current));
         return vfs_readlink(dentry,buffer,buflen,tmp);
 }
 
 static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         char tmp[PROC_NUMBUF];
-        sprintf(tmp, "%d", current->tgid);
+        sprintf(tmp, "%d", task_tgid_vnr(current));
         return ERR_PTR(vfs_follow_link(nd,tmp));
 }
 
@@ -2101,6 +2180,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("environ",    S_IRUSR, environ),
         INF("auxv",       S_IRUSR, pid_auxv),
         INF("status",     S_IRUGO, pid_status),
+        INF("limits",     S_IRUSR, pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
         REG("sched",      S_IRUGO|S_IWUSR, pid_sched),
 #endif
@@ -2130,9 +2210,12 @@ static const struct pid_entry tgid_base_stuff[] = {
 #ifdef CONFIG_SCHEDSTATS
         INF("schedstat",  S_IRUGO, pid_schedstat),
 #endif
-#ifdef CONFIG_CPUSETS
+#ifdef CONFIG_PROC_PID_CPUSET
         REG("cpuset",     S_IRUGO, cpuset),
 #endif
+#ifdef CONFIG_CGROUPS
+        REG("cgroup",  S_IRUGO, cgroup),
+#endif
         INF("oom_score",  S_IRUGO, oom_score),
         REG("oom_adj",    S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
@@ -2172,48 +2255,27 @@ static const struct inode_operations proc_tgid_base_inode_operations = {
         .setattr        = proc_setattr,
 };
 
-/**
- * proc_flush_task -  Remove dcache entries for @task from the /proc dcache.
- *
- * @task: task that should be flushed.
- *
- * Looks in the dcache for
- * /proc/@pid
- * /proc/@tgid/task/@pid
- * if either directory is present flushes it and all of it'ts children
- * from the dcache.
- *
- * It is safe and reasonable to cache /proc entries for a task until
- * that task exits.  After that they just clog up the dcache with
- * useless entries, possibly causing useful dcache entries to be
- * flushed instead.  This routine is proved to flush those useless
- * dcache entries at process exit time.
- *
- * NOTE: This routine is just an optimization so it does not guarantee
- *       that no dcache entries will exist at process exit time it
- *       just makes it very unlikely that any will persist.
- */
-void proc_flush_task(struct task_struct *task)
+static void proc_flush_task_mnt(struct vfsmount *mnt, pid_t pid, pid_t tgid)
 {
         struct dentry *dentry, *leader, *dir;
         char buf[PROC_NUMBUF];
         struct qstr name;
 
         name.name = buf;
-        name.len = snprintf(buf, sizeof(buf), "%d", task->pid);
-        dentry = d_hash_and_lookup(proc_mnt->mnt_root, &name);
+        name.len = snprintf(buf, sizeof(buf), "%d", pid);
+        dentry = d_hash_and_lookup(mnt->mnt_root, &name);
         if (dentry) {
                 shrink_dcache_parent(dentry);
                 d_drop(dentry);
                 dput(dentry);
         }
 
-        if (thread_group_leader(task))
+        if (tgid == 0)
                 goto out;
 
         name.name = buf;
-        name.len = snprintf(buf, sizeof(buf), "%d", task->tgid);
-        leader = d_hash_and_lookup(proc_mnt->mnt_root, &name);
+        name.len = snprintf(buf, sizeof(buf), "%d", tgid);
+        leader = d_hash_and_lookup(mnt->mnt_root, &name);
         if (!leader)
                 goto out;
 
@@ -2224,7 +2286,7 @@ void proc_flush_task(struct task_struct *task)
                 goto out_put_leader;
 
         name.name = buf;
-        name.len = snprintf(buf, sizeof(buf), "%d", task->pid);
+        name.len = snprintf(buf, sizeof(buf), "%d", pid);
         dentry = d_hash_and_lookup(dir, &name);
         if (dentry) {
                 shrink_dcache_parent(dentry);
@@ -2239,6 +2301,52 @@ out:
         return;
 }
 
+/**
+ * proc_flush_task -  Remove dcache entries for @task from the /proc dcache.
+ * @task: task that should be flushed.
+ *
+ * When flushing dentries from proc, one needs to flush them from global
+ * proc (proc_mnt) and from all the namespaces' procs this task was seen
+ * in. This call is supposed to do all of this job.
+ *
+ * Looks in the dcache for
+ * /proc/@pid
+ * /proc/@tgid/task/@pid
+ * if either directory is present flushes it and all of it'ts children
+ * from the dcache.
+ *
+ * It is safe and reasonable to cache /proc entries for a task until
+ * that task exits.  After that they just clog up the dcache with
+ * useless entries, possibly causing useful dcache entries to be
+ * flushed instead.  This routine is proved to flush those useless
+ * dcache entries at process exit time.
+ *
+ * NOTE: This routine is just an optimization so it does not guarantee
+ *       that no dcache entries will exist at process exit time it
+ *       just makes it very unlikely that any will persist.
+ */
+
+void proc_flush_task(struct task_struct *task)
+{
+        int i;
+        struct pid *pid, *tgid = NULL;
+        struct upid *upid;
+
+        pid = task_pid(task);
+        if (thread_group_leader(task))
+                tgid = task_tgid(task);
+
+        for (i = 0; i <= pid->level; i++) {
+                upid = &pid->numbers[i];
+                proc_flush_task_mnt(upid->ns->proc_mnt, upid->nr,
+                        tgid ? tgid->numbers[i].nr : 0);
+        }
+
+        upid = &pid->numbers[pid->level];
+        if (upid->nr == 1)
+                pid_ns_release_proc(upid->ns);
+}
+
 static struct dentry *proc_pid_instantiate(struct inode *dir,
                                            struct dentry * dentry,
                                            struct task_struct *task, const void *ptr)
@@ -2274,6 +2382,7 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
         struct dentry *result = ERR_PTR(-ENOENT);
         struct task_struct *task;
         unsigned tgid;
+        struct pid_namespace *ns;
 
         result = proc_base_lookup(dir, dentry);
         if (!IS_ERR(result) || PTR_ERR(result) != -ENOENT)
@@ -2283,8 +2392,9 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
         if (tgid == ~0U)
                 goto out;
 
+        ns = dentry->d_sb->s_fs_info;
         rcu_read_lock();
-        task = find_task_by_pid(tgid);
+        task = find_task_by_pid_ns(tgid, ns);
         if (task)
                 get_task_struct(task);
         rcu_read_unlock();
@@ -2301,18 +2411,23 @@ out:
  * Find the first task with tgid >= tgid
  *
  */
-static struct task_struct *next_tgid(unsigned int tgid)
-{
+struct tgid_iter {
+        unsigned int tgid;
         struct task_struct *task;
+};
+static struct tgid_iter next_tgid(struct pid_namespace *ns, struct tgid_iter iter)
+{
         struct pid *pid;
 
+        if (iter.task)
+                put_task_struct(iter.task);
         rcu_read_lock();
 retry:
-        task = NULL;
-        pid = find_ge_pid(tgid);
+        iter.task = NULL;
+        pid = find_ge_pid(iter.tgid, ns);
         if (pid) {
-                tgid = pid->nr + 1;
-                task = pid_task(pid, PIDTYPE_PID);
+                iter.tgid = pid_nr_ns(pid, ns);
+                iter.task = pid_task(pid, PIDTYPE_PID);
                 /* What we to know is if the pid we have find is the
                  * pid of a thread_group_leader.  Testing for task
                  * being a thread_group_leader is the obvious thing
@@ -2325,23 +2440,25 @@ retry:
                  * found doesn't happen to be a thread group leader.
                  * As we don't care in the case of readdir.
                  */
-                if (!task || !has_group_leader_pid(task))
+                if (!iter.task || !has_group_leader_pid(iter.task)) {
+                        iter.tgid += 1;
                         goto retry;
-                get_task_struct(task);
+                }
+                get_task_struct(iter.task);
         }
         rcu_read_unlock();
-        return task;
+        return iter;
 }
 
 #define TGID_OFFSET (FIRST_PROCESS_ENTRY + ARRAY_SIZE(proc_base_stuff))
 
 static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldir,
-        struct task_struct *task, int tgid)
+        struct tgid_iter iter)
 {
         char name[PROC_NUMBUF];
-        int len = snprintf(name, sizeof(name), "%d", tgid);
+        int len = snprintf(name, sizeof(name), "%d", iter.tgid);
         return proc_fill_cache(filp, dirent, filldir, name, len,
-                                proc_pid_instantiate, task, NULL);
+                                proc_pid_instantiate, iter.task, NULL);
 }
 
 /* for the /proc/ directory itself, after non-process stuff has been done */
@@ -2349,8 +2466,8 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
 {
         unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
         struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
-        struct task_struct *task;
-        int tgid;
+        struct tgid_iter iter;
+        struct pid_namespace *ns;
 
         if (!reaper)
                 goto out_no_task;
@@ -2361,14 +2478,15 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
                         goto out;
         }
 
-        tgid = filp->f_pos - TGID_OFFSET;
-        for (task = next_tgid(tgid);
-             task;
-             put_task_struct(task), task = next_tgid(tgid + 1)) {
-                tgid = task->pid;
-                filp->f_pos = tgid + TGID_OFFSET;
-                if (proc_pid_fill_cache(filp, dirent, filldir, task, tgid) < 0) {
-                        put_task_struct(task);
+        ns = filp->f_dentry->d_sb->s_fs_info;
+        iter.task = NULL;
+        iter.tgid = filp->f_pos - TGID_OFFSET;
+        for (iter = next_tgid(ns, iter);
+             iter.task;
+             iter.tgid += 1, iter = next_tgid(ns, iter)) {
+                filp->f_pos = iter.tgid + TGID_OFFSET;
+                if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
+                        put_task_struct(iter.task);
                         goto out;
                 }
         }
@@ -2388,6 +2506,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("environ",   S_IRUSR, environ),
         INF("auxv",      S_IRUSR, pid_auxv),
         INF("status",    S_IRUGO, pid_status),
+        INF("limits",    S_IRUSR, pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
         REG("sched",     S_IRUGO|S_IWUSR, pid_sched),
 #endif
@@ -2416,9 +2535,12 @@ static const struct pid_entry tid_base_stuff[] = {
 #ifdef CONFIG_SCHEDSTATS
         INF("schedstat", S_IRUGO, pid_schedstat),
 #endif
-#ifdef CONFIG_CPUSETS
+#ifdef CONFIG_PROC_PID_CPUSET
         REG("cpuset",    S_IRUGO, cpuset),
 #endif
+#ifdef CONFIG_CGROUPS
+        REG("cgroup",  S_IRUGO, cgroup),
+#endif
         INF("oom_score", S_IRUGO, oom_score),
         REG("oom_adj",   S_IRUGO|S_IWUSR, oom_adjust),
 #ifdef CONFIG_AUDITSYSCALL
@@ -2486,6 +2608,7 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
         struct task_struct *task;
         struct task_struct *leader = get_proc_task(dir);
         unsigned tid;
+        struct pid_namespace *ns;
 
         if (!leader)
                 goto out_no_task;
@@ -2494,14 +2617,15 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
         if (tid == ~0U)
                 goto out;
 
+        ns = dentry->d_sb->s_fs_info;
         rcu_read_lock();
-        task = find_task_by_pid(tid);
+        task = find_task_by_pid_ns(tid, ns);
         if (task)
                 get_task_struct(task);
         rcu_read_unlock();
         if (!task)
                 goto out;
-        if (leader->tgid != task->tgid)
+        if (!same_thread_group(leader, task))
                 goto out_drop_task;
 
         result = proc_task_instantiate(dir, dentry, task, NULL);
@@ -2526,14 +2650,14 @@ out_no_task:
  * threads past it.
  */
 static struct task_struct *first_tid(struct task_struct *leader,
-                                        int tid, int nr)
+                int tid, int nr, struct pid_namespace *ns)
 {
         struct task_struct *pos;
 
         rcu_read_lock();
         /* Attempt to start with the pid of a thread */
         if (tid && (nr > 0)) {
-                pos = find_task_by_pid(tid);
+                pos = find_task_by_pid_ns(tid, ns);
                 if (pos && (pos->group_leader == leader))
                         goto found;
         }
@@ -2602,6 +2726,7 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
         ino_t ino;
         int tid;
         unsigned long pos = filp->f_pos;  /* avoiding "long long" filp->f_pos */
+        struct pid_namespace *ns;
 
         task = get_proc_task(inode);
         if (!task)
@@ -2635,12 +2760,13 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
         /* f_version caches the tgid value that the last readdir call couldn't
          * return. lseek aka telldir automagically resets f_version to 0.
          */
+        ns = filp->f_dentry->d_sb->s_fs_info;
         tid = (int)filp->f_version;
         filp->f_version = 0;
-        for (task = first_tid(leader, tid, pos - 2);
+        for (task = first_tid(leader, tid, pos - 2, ns);
              task;
              task = next_tid(task), pos++) {
-                tid = task->pid;
+                tid = task_pid_nr_ns(task, ns);
                 if (proc_task_fill_cache(filp, dirent, filldir, task, tid) < 0) {
                         /* returning this tgid failed, save it as the first
                          * pid for the next readir call */
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 1bdb62435758..8d49838e5554 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -374,9 +374,16 @@ static int proc_delete_dentry(struct dentry * dentry)
         return 1;
 }
 
+static int proc_revalidate_dentry(struct dentry *dentry, struct nameidata *nd)
+{
+        d_drop(dentry);
+        return 0;
+}
+
 static struct dentry_operations proc_dentry_operations =
 {
         .d_delete       = proc_delete_dentry,
+        .d_revalidate   = proc_revalidate_dentry,
 };
 
 /*
@@ -397,8 +404,11 @@ struct dentry *proc_lookup(struct inode * dir, struct dentry *dentry, struct nam
                         if (de->namelen != dentry->d_name.len)
                                 continue;
                         if (!memcmp(dentry->d_name.name, de->name, de->namelen)) {
-                                unsigned int ino = de->low_ino;
+                                unsigned int ino;
 
+                                if (de->shadow_proc)
+                                        de = de->shadow_proc(current, de);
+                                ino = de->low_ino;
                                 de_get(de);
                                 spin_unlock(&proc_subdir_lock);
                                 error = -EINVAL;
@@ -555,36 +565,6 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
         return 0;
 }
 
-/*
- * Kill an inode that got unregistered..
- */
-static void proc_kill_inodes(struct proc_dir_entry *de)
-{
-        struct list_head *p;
-        struct super_block *sb = proc_mnt->mnt_sb;
-
-        /*
-         * Actually it's a partial revoke().
-         */
-        file_list_lock();
-        list_for_each(p, &sb->s_files) {
-                struct file * filp = list_entry(p, struct file, f_u.fu_list);
-                struct dentry * dentry = filp->f_path.dentry;
-                struct inode * inode;
-                const struct file_operations *fops;
-
-                if (dentry->d_op != &proc_dentry_operations)
-                        continue;
-                inode = dentry->d_inode;
-                if (PDE(inode) != de)
-                        continue;
-                fops = filp->f_op;
-                filp->f_op = NULL;
-                fops_put(fops);
-        }
-        file_list_unlock();
-}
-
 static struct proc_dir_entry *proc_create(struct proc_dir_entry **parent,
                                           const char *name,
                                           mode_t mode,
@@ -615,6 +595,7 @@ static struct proc_dir_entry *proc_create(struct proc_dir_entry **parent,
         ent->namelen = len;
         ent->mode = mode;
         ent->nlink = nlink;
+        atomic_set(&ent->count, 1);
         ent->pde_users = 0;
         spin_lock_init(&ent->pde_unload_lock);
         ent->pde_unload_completion = NULL;
@@ -712,7 +693,6 @@ void free_proc_entry(struct proc_dir_entry *de)
 
 /*
  * Remove a /proc entry and free it if it's not currently in use.
- * If it is in use, we set the 'deleted' flag.
  */
 void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
 {
@@ -759,17 +739,10 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)
 continue_removing:
                 if (S_ISDIR(de->mode))
                         parent->nlink--;
-                if (!S_ISREG(de->mode))
-                        proc_kill_inodes(de);
                 de->nlink = 0;
                 WARN_ON(de->subdir);
-                if (!atomic_read(&de->count))
+                if (atomic_dec_and_test(&de->count))
                         free_proc_entry(de);
-                else {
-                        de->deleted = 1;
-                        printk("remove_proc_entry: %s/%s busy, count=%d\n",
-                                parent->name, de->name, atomic_read(&de->count));
-                }
                 break;
         }
         spin_unlock(&proc_subdir_lock);
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 99ca00485fc3..1a551d92e1d8 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -43,13 +43,8 @@ void de_put(struct proc_dir_entry *de)
                         return;
                 }
 
-                if (atomic_dec_and_test(&de->count)) {
-                        if (de->deleted) {
-                                printk("de_put: deferred delete of %s\n",
-                                        de->name);
-                                free_proc_entry(de);
-                        }
-                }               
+                if (atomic_dec_and_test(&de->count))
+                        free_proc_entry(de);
                 unlock_kernel();
         }
 }
@@ -448,7 +443,7 @@ out_mod:
         return NULL;
 }                       
 
-int proc_fill_super(struct super_block *s, void *data, int silent)
+int proc_fill_super(struct super_block *s)
 {
         struct inode * root_inode;
 
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index d6dc72c78bc1..e0d064e9764e 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -91,7 +91,8 @@ static int loadavg_read_proc(char *page, char **start, off_t off,
                 LOAD_INT(a), LOAD_FRAC(a),
                 LOAD_INT(b), LOAD_FRAC(b),
                 LOAD_INT(c), LOAD_FRAC(c),
-                nr_running(), nr_threads, current->nsproxy->pid_ns->last_pid);
+                nr_running(), nr_threads,
+                task_active_pid_ns(current)->last_pid);
         return proc_calc_metrics(page, start, off, count, eof, len);
 }
 
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 2e91fb756e9a..0afe21ee0607 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -26,13 +26,6 @@
 #include "internal.h"
 
 
-struct proc_dir_entry *proc_net_create(struct net *net,
-        const char *name, mode_t mode, get_info_t *get_info)
-{
-        return create_proc_info_entry(name,mode, net->proc_net, get_info);
-}
-EXPORT_SYMBOL_GPL(proc_net_create);
-
 struct proc_dir_entry *proc_net_fops_create(struct net *net,
         const char *name, mode_t mode, const struct file_operations *fops)
 {
@@ -57,89 +50,14 @@ struct net *get_proc_net(const struct inode *inode)
 }
 EXPORT_SYMBOL_GPL(get_proc_net);
 
-static struct proc_dir_entry *proc_net_shadow;
+static struct proc_dir_entry *shadow_pde;
 
-static struct dentry *proc_net_shadow_dentry(struct dentry *parent,
+static struct proc_dir_entry *proc_net_shadow(struct task_struct *task,
                                                 struct proc_dir_entry *de)
 {
-        struct dentry *shadow = NULL;
-        struct inode *inode;
-        if (!de)
-                goto out;
-        de_get(de);
-        inode = proc_get_inode(parent->d_inode->i_sb, de->low_ino, de);
-        if (!inode)
-                goto out_de_put;
-        shadow = d_alloc_name(parent, de->name);
-        if (!shadow)
-                goto out_iput;
-        shadow->d_op = parent->d_op; /* proc_dentry_operations */
-        d_instantiate(shadow, inode);
-out:
-        return shadow;
-out_iput:
-        iput(inode);
-out_de_put:
-        de_put(de);
-        goto out;
-}
-
-static void *proc_net_follow_link(struct dentry *parent, struct nameidata *nd)
-{
-        struct net *net = current->nsproxy->net_ns;
-        struct dentry *shadow;
-        shadow = proc_net_shadow_dentry(parent, net->proc_net);
-        if (!shadow)
-                return ERR_PTR(-ENOENT);
-
-        dput(nd->dentry);
-        /* My dentry count is 1 and that should be enough as the
-         * shadow dentry is thrown away immediately.
-         */
-        nd->dentry = shadow;
-        return NULL;
-}
-
-static struct dentry *proc_net_lookup(struct inode *dir, struct dentry *dentry,
-                                      struct nameidata *nd)
-{
-        struct net *net = current->nsproxy->net_ns;
-        struct dentry *shadow;
-
-        shadow = proc_net_shadow_dentry(nd->dentry, net->proc_net);
-        if (!shadow)
-                return ERR_PTR(-ENOENT);
-
-        dput(nd->dentry);
-        nd->dentry = shadow;
-
-        return shadow->d_inode->i_op->lookup(shadow->d_inode, dentry, nd);
+        return task->nsproxy->net_ns->proc_net;
 }
 
-static int proc_net_setattr(struct dentry *dentry, struct iattr *iattr)
-{
-        struct net *net = current->nsproxy->net_ns;
-        struct dentry *shadow;
-        int ret;
-
-        shadow = proc_net_shadow_dentry(dentry->d_parent, net->proc_net);
-        if (!shadow)
-                return -ENOENT;
-        ret = shadow->d_inode->i_op->setattr(shadow, iattr);
-        dput(shadow);
-        return ret;
-}
-
-static const struct file_operations proc_net_dir_operations = {
-        .read                   = generic_read_dir,
-};
-
-static struct inode_operations proc_net_dir_inode_operations = {
-        .follow_link    = proc_net_follow_link,
-        .lookup         = proc_net_lookup,
-        .setattr        = proc_net_setattr,
-};
-
 static __net_init int proc_net_ns_init(struct net *net)
 {
         struct proc_dir_entry *root, *netd, *net_statd;
@@ -185,16 +103,15 @@ static __net_exit void proc_net_ns_exit(struct net *net)
         kfree(net->proc_net_root);
 }
 
-struct pernet_operations __net_initdata proc_net_ns_ops = {
+static struct pernet_operations __net_initdata proc_net_ns_ops = {
         .init = proc_net_ns_init,
         .exit = proc_net_ns_exit,
 };
 
 int __init proc_net_init(void)
 {
-        proc_net_shadow = proc_mkdir("net", NULL);
-        proc_net_shadow->proc_iops = &proc_net_dir_inode_operations;
-        proc_net_shadow->proc_fops = &proc_net_dir_operations;
+        shadow_pde = proc_mkdir("net", NULL);
+        shadow_pde->shadow_proc = proc_net_shadow;
 
         return register_pernet_subsys(&proc_net_ns_ops);
 }
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 680c429bfa22..4e57fcf85982 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -171,7 +171,8 @@ static ssize_t proc_sys_read(struct file *filp, char __user *buf,
         struct dentry *dentry = filp->f_dentry;
         struct ctl_table_header *head;
         struct ctl_table *table;
-        ssize_t error, res;
+        ssize_t error;
+        size_t res;
 
         table = do_proc_sys_lookup(dentry->d_parent, &dentry->d_name, &head);
         /* Has the sysctl entry disappeared on us? */
@@ -209,7 +210,8 @@ static ssize_t proc_sys_write(struct file *filp, const char __user *buf,
         struct dentry *dentry = filp->f_dentry;
         struct ctl_table_header *head;
         struct ctl_table *table;
-        ssize_t error, res;
+        ssize_t error;
+        size_t res;
 
         table = do_proc_sys_lookup(dentry->d_parent, &dentry->d_name, &head);
         /* Has the sysctl entry disappeared on us? */
diff --git a/fs/proc/root.c b/fs/proc/root.c
index cf3046638b09..81f99e691f99 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -18,32 +18,90 @@
 #include <linux/bitops.h>
 #include <linux/smp_lock.h>
 #include <linux/mount.h>
+#include <linux/pid_namespace.h>
 
 #include "internal.h"
 
 struct proc_dir_entry *proc_bus, *proc_root_fs, *proc_root_driver;
 
+static int proc_test_super(struct super_block *sb, void *data)
+{
+        return sb->s_fs_info == data;
+}
+
+static int proc_set_super(struct super_block *sb, void *data)
+{
+        struct pid_namespace *ns;
+
+        ns = (struct pid_namespace *)data;
+        sb->s_fs_info = get_pid_ns(ns);
+        return set_anon_super(sb, NULL);
+}
+
 static int proc_get_sb(struct file_system_type *fs_type,
         int flags, const char *dev_name, void *data, struct vfsmount *mnt)
 {
+        int err;
+        struct super_block *sb;
+        struct pid_namespace *ns;
+        struct proc_inode *ei;
+
         if (proc_mnt) {
                 /* Seed the root directory with a pid so it doesn't need
                  * to be special in base.c.  I would do this earlier but
                  * the only task alive when /proc is mounted the first time
                  * is the init_task and it doesn't have any pids.
                  */
-                struct proc_inode *ei;
                 ei = PROC_I(proc_mnt->mnt_sb->s_root->d_inode);
                 if (!ei->pid)
                         ei->pid = find_get_pid(1);
         }
-        return get_sb_single(fs_type, flags, data, proc_fill_super, mnt);
+
+        if (flags & MS_KERNMOUNT)
+                ns = (struct pid_namespace *)data;
+        else
+                ns = current->nsproxy->pid_ns;
+
+        sb = sget(fs_type, proc_test_super, proc_set_super, ns);
+        if (IS_ERR(sb))
+                return PTR_ERR(sb);
+
+        if (!sb->s_root) {
+                sb->s_flags = flags;
+                err = proc_fill_super(sb);
+                if (err) {
+                        up_write(&sb->s_umount);
+                        deactivate_super(sb);
+                        return err;
+                }
+
+                ei = PROC_I(sb->s_root->d_inode);
+                if (!ei->pid) {
+                        rcu_read_lock();
+                        ei->pid = get_pid(find_pid_ns(1, ns));
+                        rcu_read_unlock();
+                }
+
+                sb->s_flags |= MS_ACTIVE;
+                ns->proc_mnt = mnt;
+        }
+
+        return simple_set_mnt(mnt, sb);
+}
+
+static void proc_kill_sb(struct super_block *sb)
+{
+        struct pid_namespace *ns;
+
+        ns = (struct pid_namespace *)sb->s_fs_info;
+        kill_anon_super(sb);
+        put_pid_ns(ns);
 }
 
 static struct file_system_type proc_fs_type = {
         .name           = "proc",
         .get_sb         = proc_get_sb,
-        .kill_sb        = kill_anon_super,
+        .kill_sb        = proc_kill_sb,
 };
 
 void __init proc_root_init(void)
@@ -54,12 +112,13 @@ void __init proc_root_init(void)
         err = register_filesystem(&proc_fs_type);
         if (err)
                 return;
-        proc_mnt = kern_mount(&proc_fs_type);
+        proc_mnt = kern_mount_data(&proc_fs_type, &init_pid_ns);
         err = PTR_ERR(proc_mnt);
         if (IS_ERR(proc_mnt)) {
                 unregister_filesystem(&proc_fs_type);
                 return;
         }
+
         proc_misc_init();
 
         proc_net_init();
@@ -148,11 +207,28 @@ struct proc_dir_entry proc_root = {
         .name           = "/proc",
         .mode           = S_IFDIR | S_IRUGO | S_IXUGO, 
         .nlink          = 2, 
+        .count          = ATOMIC_INIT(1),
         .proc_iops      = &proc_root_inode_operations, 
         .proc_fops      = &proc_root_operations,
         .parent         = &proc_root,
 };
 
+int pid_ns_prepare_proc(struct pid_namespace *ns)
+{
+        struct vfsmount *mnt;
+
+        mnt = kern_mount_data(&proc_fs_type, ns);
+        if (IS_ERR(mnt))
+                return PTR_ERR(mnt);
+
+        return 0;
+}
+
+void pid_ns_release_proc(struct pid_namespace *ns)
+{
+        mntput(ns->proc_mnt);
+}
+
 EXPORT_SYMBOL(proc_symlink);
 EXPORT_SYMBOL(proc_mkdir);
 EXPORT_SYMBOL(create_proc_entry);
diff --git a/fs/read_write.c b/fs/read_write.c
index 124693e8d3fa..ea1f94cc722e 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -370,7 +370,7 @@ asmlinkage ssize_t sys_read(unsigned int fd, char __user * buf, size_t count)
 
         return ret;
 }
-EXPORT_SYMBOL_GPL(sys_read);
+EXPORT_UNUSED_SYMBOL_GPL(sys_read); /* to be deleted for 2.6.25 */
 
 asmlinkage ssize_t sys_write(unsigned int fd, const char __user * buf, size_t count)
 {
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index 2a5dd34649b3..16b331dd9913 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -47,7 +47,9 @@
     test_bit(_ALLOC_ ## optname , &SB_ALLOC_OPTS(s))
 
 static inline void get_bit_address(struct super_block *s,
-                                   b_blocknr_t block, int *bmap_nr, int *offset)
+                                   b_blocknr_t block,
+                                   unsigned int *bmap_nr,
+                                   unsigned int *offset)
 {
         /* It is in the bitmap block number equal to the block
          * number divided by the number of bits in a block. */
@@ -56,10 +58,10 @@ static inline void get_bit_address(struct super_block *s,
         *offset = block & ((s->s_blocksize << 3) - 1);
 }
 
-#ifdef CONFIG_REISERFS_CHECK
 int is_reusable(struct super_block *s, b_blocknr_t block, int bit_value)
 {
-        int bmap, offset;
+        unsigned int bmap, offset;
+        unsigned int bmap_count = reiserfs_bmap_count(s);
 
         if (block == 0 || block >= SB_BLOCK_COUNT(s)) {
                 reiserfs_warning(s,
@@ -75,25 +77,26 @@ int is_reusable(struct super_block *s, b_blocknr_t block, int bit_value)
         if (unlikely(test_bit(REISERFS_OLD_FORMAT,
                               &(REISERFS_SB(s)->s_properties)))) {
                 b_blocknr_t bmap1 = REISERFS_SB(s)->s_sbh->b_blocknr + 1;
-                if (block >= bmap1 && block <= bmap1 + SB_BMAP_NR(s)) {
+                if (block >= bmap1 &&
+                    block <= bmap1 + bmap_count) {
                         reiserfs_warning(s, "vs: 4019: is_reusable: "
                                          "bitmap block %lu(%u) can't be freed or reused",
-                                         block, SB_BMAP_NR(s));
+                                         block, bmap_count);
                         return 0;
                 }
         } else {
                 if (offset == 0) {
                         reiserfs_warning(s, "vs: 4020: is_reusable: "
                                          "bitmap block %lu(%u) can't be freed or reused",
-                                         block, SB_BMAP_NR(s));
+                                         block, bmap_count);
                         return 0;
                 }
         }
 
-        if (bmap >= SB_BMAP_NR(s)) {
+        if (bmap >= bmap_count) {
                 reiserfs_warning(s,
                                  "vs-4030: is_reusable: there is no so many bitmap blocks: "
-                                 "block=%lu, bitmap_nr=%d", block, bmap);
+                                 "block=%lu, bitmap_nr=%u", block, bmap);
                 return 0;
         }
 
@@ -106,12 +109,11 @@ int is_reusable(struct super_block *s, b_blocknr_t block, int bit_value)
 
         return 1;
 }
-#endif                          /* CONFIG_REISERFS_CHECK */
 
 /* searches in journal structures for a given block number (bmap, off). If block
    is found in reiserfs journal it suggests next free block candidate to test. */
-static inline int is_block_in_journal(struct super_block *s, int bmap, int
-                                      off, int *next)
+static inline int is_block_in_journal(struct super_block *s, unsigned int bmap,
+                                      int off, int *next)
 {
         b_blocknr_t tmp;
 
@@ -132,8 +134,8 @@ static inline int is_block_in_journal(struct super_block *s, int bmap, int
 /* it searches for a window of zero bits with given minimum and maximum lengths in one bitmap
  * block; */
 static int scan_bitmap_block(struct reiserfs_transaction_handle *th,
-                             int bmap_n, int *beg, int boundary, int min,
-                             int max, int unfm)
+                             unsigned int bmap_n, int *beg, int boundary,
+                             int min, int max, int unfm)
 {
         struct super_block *s = th->t_super;
         struct reiserfs_bitmap_info *bi = &SB_AP_BITMAP(s)[bmap_n];
@@ -143,8 +145,8 @@ static int scan_bitmap_block(struct reiserfs_transaction_handle *th,
 
         BUG_ON(!th->t_trans_id);
 
-        RFALSE(bmap_n >= SB_BMAP_NR(s), "Bitmap %d is out of range (0..%d)",
-               bmap_n, SB_BMAP_NR(s) - 1);
+        RFALSE(bmap_n >= reiserfs_bmap_count(s), "Bitmap %u is out of "
+               "range (0..%u)", bmap_n, reiserfs_bmap_count(s) - 1);
         PROC_INFO_INC(s, scan_bitmap.bmap);
 /* this is unclear and lacks comments, explain how journal bitmaps
    work here for the reader.  Convey a sense of the design here. What
@@ -249,12 +251,12 @@ static int bmap_hash_id(struct super_block *s, u32 id)
         } else {
                 hash_in = (char *)(&id);
                 hash = keyed_hash(hash_in, 4);
-                bm = hash % SB_BMAP_NR(s);
+                bm = hash % reiserfs_bmap_count(s);
                 if (!bm)
                         bm = 1;
         }
         /* this can only be true when SB_BMAP_NR = 1 */
-        if (bm >= SB_BMAP_NR(s))
+        if (bm >= reiserfs_bmap_count(s))
                 bm = 0;
         return bm;
 }
@@ -273,7 +275,7 @@ static inline int block_group_used(struct super_block *s, u32 id)
          * to make a better decision. This favors long-term performace gain
          * with a better on-disk layout vs. a short term gain of skipping the
          * read and potentially having a bad placement. */
-        if (info->first_zero_hint == 0) {
+        if (info->free_count == UINT_MAX) {
                 struct buffer_head *bh = reiserfs_read_bitmap_block(s, bm);
                 brelse(bh);
         }
@@ -309,16 +311,16 @@ __le32 reiserfs_choose_packing(struct inode * dir)
  * bitmap and place new blocks there. Returns number of allocated blocks. */
 static int scan_bitmap(struct reiserfs_transaction_handle *th,
                        b_blocknr_t * start, b_blocknr_t finish,
-                       int min, int max, int unfm, unsigned long file_block)
+                       int min, int max, int unfm, sector_t file_block)
 {
         int nr_allocated = 0;
         struct super_block *s = th->t_super;
         /* find every bm and bmap and bmap_nr in this file, and change them all to bitmap_blocknr
          * - Hans, it is not a block number - Zam. */
 
-        int bm, off;
-        int end_bm, end_off;
-        int off_max = s->s_blocksize << 3;
+        unsigned int bm, off;
+        unsigned int end_bm, end_off;
+        unsigned int off_max = s->s_blocksize << 3;
 
         BUG_ON(!th->t_trans_id);
 
@@ -328,10 +330,10 @@ static int scan_bitmap(struct reiserfs_transaction_handle *th,
 
         get_bit_address(s, *start, &bm, &off);
         get_bit_address(s, finish, &end_bm, &end_off);
-        if (bm > SB_BMAP_NR(s))
+        if (bm > reiserfs_bmap_count(s))
                 return 0;
-        if (end_bm > SB_BMAP_NR(s))
-                end_bm = SB_BMAP_NR(s);
+        if (end_bm > reiserfs_bmap_count(s))
+                end_bm = reiserfs_bmap_count(s);
 
         /* When the bitmap is more than 10% free, anyone can allocate.
          * When it's less than 10% free, only files that already use the
@@ -385,7 +387,7 @@ static void _reiserfs_free_block(struct reiserfs_transaction_handle *th,
         struct reiserfs_super_block *rs;
         struct buffer_head *sbh, *bmbh;
         struct reiserfs_bitmap_info *apbi;
-        int nr, offset;
+        unsigned int nr, offset;
 
         BUG_ON(!th->t_trans_id);
 
@@ -397,10 +399,12 @@ static void _reiserfs_free_block(struct reiserfs_transaction_handle *th,
 
         get_bit_address(s, block, &nr, &offset);
 
-        if (nr >= sb_bmap_nr(rs)) {
+        if (nr >= reiserfs_bmap_count(s)) {
                 reiserfs_warning(s, "vs-4075: reiserfs_free_block: "
-                                 "block %lu is out of range on %s",
-                                 block, reiserfs_bdevname(s));
+                                 "block %lu is out of range on %s "
+                                 "(nr=%u,max=%u)", block,
+                                 reiserfs_bdevname(s), nr,
+                                 reiserfs_bmap_count(s));
                 return;
         }
 
@@ -434,12 +438,19 @@ void reiserfs_free_block(struct reiserfs_transaction_handle *th,
                          int for_unformatted)
 {
         struct super_block *s = th->t_super;
-
         BUG_ON(!th->t_trans_id);
 
         RFALSE(!s, "vs-4061: trying to free block on nonexistent device");
-        RFALSE(is_reusable(s, block, 1) == 0,
-               "vs-4071: can not free such block");
+        if (!is_reusable(s, block, 1))
+                return;
+
+        if (block > sb_block_count(REISERFS_SB(s)->s_rs)) {
+                reiserfs_panic(th->t_super, "bitmap-4072",
+                               "Trying to free block outside file system "
+                               "boundaries (%lu > %lu)",
+                               block, sb_block_count(REISERFS_SB(s)->s_rs));
+                return;
+        }
         /* mark it before we clear it, just in case */
         journal_mark_freed(th, s, block);
         _reiserfs_free_block(th, inode, block, for_unformatted);
@@ -449,11 +460,11 @@ void reiserfs_free_block(struct reiserfs_transaction_handle *th,
 static void reiserfs_free_prealloc_block(struct reiserfs_transaction_handle *th,
                                          struct inode *inode, b_blocknr_t block)
 {
+        BUG_ON(!th->t_trans_id);
         RFALSE(!th->t_super,
                "vs-4060: trying to free block on nonexistent device");
-        RFALSE(is_reusable(th->t_super, block, 1) == 0,
-               "vs-4070: can not free such block");
-        BUG_ON(!th->t_trans_id);
+        if (!is_reusable(th->t_super, block, 1))
+                return;
         _reiserfs_free_block(th, inode, block, 1);
 }
 
@@ -1207,27 +1218,22 @@ void reiserfs_cache_bitmap_metadata(struct super_block *sb,
 {
         unsigned long *cur = (unsigned long *)(bh->b_data + bh->b_size);
 
-        info->first_zero_hint = 1 << (sb->s_blocksize_bits + 3);
+        /* The first bit must ALWAYS be 1 */
+        BUG_ON(!reiserfs_test_le_bit(0, (unsigned long *)bh->b_data));
+
+        info->free_count = 0;
 
         while (--cur >= (unsigned long *)bh->b_data) {
-                int base = ((char *)cur - bh->b_data) << 3;
+                int i;
 
                 /* 0 and ~0 are special, we can optimize for them */
-                if (*cur == 0) {
-                        info->first_zero_hint = base;
+                if (*cur == 0)
                         info->free_count += BITS_PER_LONG;
-                } else if (*cur != ~0L) {       /* A mix, investigate */
-                        int b;
-                        for (b = BITS_PER_LONG - 1; b >= 0; b--) {
-                                if (!reiserfs_test_le_bit(b, cur)) {
-                                        info->first_zero_hint = base + b;
+                else if (*cur != ~0L)   /* A mix, investigate */
+                        for (i = BITS_PER_LONG - 1; i >= 0; i--)
+                                if (!reiserfs_test_le_bit(i, cur))
                                         info->free_count++;
-                                }
-                        }
-                }
         }
-        /* The first bit must ALWAYS be 1 */
-        BUG_ON(info->first_zero_hint == 0);
 }
 
 struct buffer_head *reiserfs_read_bitmap_block(struct super_block *sb,
@@ -1257,7 +1263,7 @@ struct buffer_head *reiserfs_read_bitmap_block(struct super_block *sb,
                 BUG_ON(!buffer_uptodate(bh));
                 BUG_ON(atomic_read(&bh->b_count) == 0);
 
-                if (info->first_zero_hint == 0)
+                if (info->free_count == UINT_MAX)
                         reiserfs_cache_bitmap_metadata(sb, bh, info);
         }
 
@@ -1267,12 +1273,13 @@ struct buffer_head *reiserfs_read_bitmap_block(struct super_block *sb,
 int reiserfs_init_bitmap_cache(struct super_block *sb)
 {
         struct reiserfs_bitmap_info *bitmap;
+        unsigned int bmap_nr = reiserfs_bmap_count(sb);
 
-        bitmap = vmalloc(sizeof (*bitmap) * SB_BMAP_NR(sb));
+        bitmap = vmalloc(sizeof(*bitmap) * bmap_nr);
         if (bitmap == NULL)
                 return -ENOMEM;
 
-        memset(bitmap, 0, sizeof (*bitmap) * SB_BMAP_NR(sb));
+        memset(bitmap, 0xff, sizeof(*bitmap) * bmap_nr);
 
         SB_AP_BITMAP(sb) = bitmap;
 
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 0804289d355d..231fd5ccadc5 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -199,7 +199,7 @@ static inline void set_block_dev_mapped(struct buffer_head *bh,
 // files which were created in the earlier version can not be longer,
 // than 2 gb
 //
-static int file_capable(struct inode *inode, long block)
+static int file_capable(struct inode *inode, sector_t block)
 {
         if (get_inode_item_key_version(inode) != KEY_FORMAT_3_5 ||      // it is new file.
             block < (1 << (31 - inode->i_sb->s_blocksize_bits)))        // old file, but 'block' is inside of 2gb
@@ -242,7 +242,7 @@ static int restart_transaction(struct reiserfs_transaction_handle *th,
 // Please improve the english/clarity in the comment above, as it is
 // hard to understand.
 
-static int _get_block_create_0(struct inode *inode, long block,
+static int _get_block_create_0(struct inode *inode, sector_t block,
                                struct buffer_head *bh_result, int args)
 {
         INITIALIZE_PATH(path);
@@ -250,7 +250,7 @@ static int _get_block_create_0(struct inode *inode, long block,
         struct buffer_head *bh;
         struct item_head *ih, tmp_ih;
         int fs_gen;
-        int blocknr;
+        b_blocknr_t blocknr;
         char *p = NULL;
         int chars;
         int ret;
@@ -569,7 +569,7 @@ static int convert_tail_for_hole(struct inode *inode,
 }
 
 static inline int _allocate_block(struct reiserfs_transaction_handle *th,
-                                  long block,
+                                  sector_t block,
                                   struct inode *inode,
                                   b_blocknr_t * allocated_block_nr,
                                   struct treepath *path, int flags)
@@ -1515,19 +1515,20 @@ struct inode *reiserfs_iget(struct super_block *s, const struct cpu_key *key)
         return inode;
 }
 
-struct dentry *reiserfs_get_dentry(struct super_block *sb, void *vobjp)
+static struct dentry *reiserfs_get_dentry(struct super_block *sb,
+        u32 objectid, u32 dir_id, u32 generation)
+
 {
-        __u32 *data = vobjp;
         struct cpu_key key;
         struct dentry *result;
         struct inode *inode;
 
-        key.on_disk_key.k_objectid = data[0];
-        key.on_disk_key.k_dir_id = data[1];
+        key.on_disk_key.k_objectid = objectid;
+        key.on_disk_key.k_dir_id = dir_id;
         reiserfs_write_lock(sb);
         inode = reiserfs_iget(sb, &key);
-        if (inode && !IS_ERR(inode) && data[2] != 0 &&
-            data[2] != inode->i_generation) {
+        if (inode && !IS_ERR(inode) && generation != 0 &&
+            generation != inode->i_generation) {
                 iput(inode);
                 inode = NULL;
         }
@@ -1544,14 +1545,9 @@ struct dentry *reiserfs_get_dentry(struct super_block *sb, void *vobjp)
         return result;
 }
 
-struct dentry *reiserfs_decode_fh(struct super_block *sb, __u32 * data,
-                                  int len, int fhtype,
-                                  int (*acceptable) (void *contect,
-                                                     struct dentry * de),
-                                  void *context)
+struct dentry *reiserfs_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
 {
-        __u32 obj[3], parent[3];
-
         /* fhtype happens to reflect the number of u32s encoded.
          * due to a bug in earlier code, fhtype might indicate there
          * are more u32s then actually fitted.
@@ -1564,32 +1560,28 @@ struct dentry *reiserfs_decode_fh(struct super_block *sb, __u32 * data,
          *   6 - as above plus generation of directory
          * 6 does not fit in NFSv2 handles
          */
-        if (fhtype > len) {
-                if (fhtype != 6 || len != 5)
+        if (fh_type > fh_len) {
+                if (fh_type != 6 || fh_len != 5)
                         reiserfs_warning(sb,
-                                         "nfsd/reiserfs, fhtype=%d, len=%d - odd",
-                                         fhtype, len);
-                fhtype = 5;
+                                "nfsd/reiserfs, fhtype=%d, len=%d - odd",
+                                fh_type, fh_len);
+                fh_type = 5;
         }
 
-        obj[0] = data[0];
-        obj[1] = data[1];
-        if (fhtype == 3 || fhtype >= 5)
-                obj[2] = data[2];
-        else
-                obj[2] = 0;     /* generation number */
+        return reiserfs_get_dentry(sb, fid->raw[0], fid->raw[1],
+                (fh_type == 3 || fh_type >= 5) ? fid->raw[2] : 0);
+}
 
-        if (fhtype >= 4) {
-                parent[0] = data[fhtype >= 5 ? 3 : 2];
-                parent[1] = data[fhtype >= 5 ? 4 : 3];
-                if (fhtype == 6)
-                        parent[2] = data[5];
-                else
-                        parent[2] = 0;
-        }
-        return sb->s_export_op->find_exported_dentry(sb, obj,
-                                                     fhtype < 4 ? NULL : parent,
-                                                     acceptable, context);
+struct dentry *reiserfs_fh_to_parent(struct super_block *sb, struct fid *fid,
+                int fh_len, int fh_type)
+{
+        if (fh_type < 4)
+                return NULL;
+
+        return reiserfs_get_dentry(sb,
+                (fh_type >= 5) ? fid->raw[3] : fid->raw[2],
+                (fh_type >= 5) ? fid->raw[4] : fid->raw[3],
+                (fh_type == 6) ? fid->raw[5] : 0);
 }
 
 int reiserfs_encode_fh(struct dentry *dentry, __u32 * data, int *lenp,
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index c438a8f83f26..e0f0f098a523 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -57,6 +57,9 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                         if (get_user(flags, (int __user *)arg))
                                 return -EFAULT;
 
+                        /* Is it quota file? Do not allow user to mess with it. */
+                        if (IS_NOQUOTA(inode))
+                                return -EPERM;
                         if (((flags ^ REISERFS_I(inode)->
                               i_attrs) & (REISERFS_IMMUTABLE_FL |
                                           REISERFS_APPEND_FL))
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 4cad9e75ef56..bb05a3e51b93 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -219,11 +219,12 @@ static void allocate_bitmap_nodes(struct super_block *p_s_sb)
         }
 }
 
-static int set_bit_in_list_bitmap(struct super_block *p_s_sb, int block,
+static int set_bit_in_list_bitmap(struct super_block *p_s_sb,
+                                  b_blocknr_t block,
                                   struct reiserfs_list_bitmap *jb)
 {
-        int bmap_nr = block / (p_s_sb->s_blocksize << 3);
-        int bit_nr = block % (p_s_sb->s_blocksize << 3);
+        unsigned int bmap_nr = block / (p_s_sb->s_blocksize << 3);
+        unsigned int bit_nr = block % (p_s_sb->s_blocksize << 3);
 
         if (!jb->bitmaps[bmap_nr]) {
                 jb->bitmaps[bmap_nr] = get_bitmap_node(p_s_sb);
@@ -239,7 +240,7 @@ static void cleanup_bitmap_list(struct super_block *p_s_sb,
         if (jb->bitmaps == NULL)
                 return;
 
-        for (i = 0; i < SB_BMAP_NR(p_s_sb); i++) {
+        for (i = 0; i < reiserfs_bmap_count(p_s_sb); i++) {
                 if (jb->bitmaps[i]) {
                         free_bitmap_node(p_s_sb, jb->bitmaps[i]);
                         jb->bitmaps[i] = NULL;
@@ -289,7 +290,7 @@ static int free_bitmap_nodes(struct super_block *p_s_sb)
 */
 int reiserfs_allocate_list_bitmaps(struct super_block *p_s_sb,
                                    struct reiserfs_list_bitmap *jb_array,
-                                   int bmap_nr)
+                                   unsigned int bmap_nr)
 {
         int i;
         int failed = 0;
@@ -483,7 +484,7 @@ static inline struct reiserfs_journal_cnode *get_journal_hash_dev(struct
 **
 */
 int reiserfs_in_journal(struct super_block *p_s_sb,
-                        int bmap_nr, int bit_nr, int search_all,
+                        unsigned int bmap_nr, int bit_nr, int search_all,
                         b_blocknr_t * next_zero_bit)
 {
         struct reiserfs_journal *journal = SB_JOURNAL(p_s_sb);
@@ -1013,7 +1014,7 @@ static int flush_commit_list(struct super_block *s,
                              struct reiserfs_journal_list *jl, int flushall)
 {
         int i;
-        int bn;
+        b_blocknr_t bn;
         struct buffer_head *tbh = NULL;
         unsigned long trans_id = jl->j_trans_id;
         struct reiserfs_journal *journal = SB_JOURNAL(s);
@@ -2307,8 +2308,9 @@ static int journal_read_transaction(struct super_block *p_s_sb,
    Right now it is only used from journal code. But later we might use it
    from other places.
    Note: Do not use journal_getblk/sb_getblk functions here! */
-static struct buffer_head *reiserfs_breada(struct block_device *dev, int block,
-                                           int bufsize, unsigned int max_block)
+static struct buffer_head *reiserfs_breada(struct block_device *dev,
+                                           b_blocknr_t block, int bufsize,
+                                           b_blocknr_t max_block)
 {
         struct buffer_head *bhlist[BUFNR];
         unsigned int blocks = BUFNR;
@@ -2732,7 +2734,7 @@ int journal_init(struct super_block *p_s_sb, const char *j_dev_name,
         journal->j_persistent_trans = 0;
         if (reiserfs_allocate_list_bitmaps(p_s_sb,
                                            journal->j_list_bitmap,
-                                           SB_BMAP_NR(p_s_sb)))
+                                           reiserfs_bmap_count(p_s_sb)))
                 goto free_and_return;
         allocate_bitmap_nodes(p_s_sb);
 
@@ -2740,7 +2742,7 @@ int journal_init(struct super_block *p_s_sb, const char *j_dev_name,
         SB_JOURNAL_1st_RESERVED_BLOCK(p_s_sb) = (old_format ?
                                                  REISERFS_OLD_DISK_OFFSET_IN_BYTES
                                                  / p_s_sb->s_blocksize +
-                                                 SB_BMAP_NR(p_s_sb) +
+                                                 reiserfs_bmap_count(p_s_sb) +
                                                  1 :
                                                  REISERFS_DISK_OFFSET_IN_BYTES /
                                                  p_s_sb->s_blocksize + 2);
diff --git a/fs/reiserfs/prints.c b/fs/reiserfs/prints.c
index bc808a91eeaa..5e7388b32d02 100644
--- a/fs/reiserfs/prints.c
+++ b/fs/reiserfs/prints.c
@@ -356,13 +356,11 @@ extern struct tree_balance *cur_tb;
 void reiserfs_panic(struct super_block *sb, const char *fmt, ...)
 {
         do_reiserfs_warning(fmt);
-        printk(KERN_EMERG "REISERFS: panic (device %s): %s\n",
-               reiserfs_bdevname(sb), error_buf);
-        BUG();
 
-        /* this is not actually called, but makes reiserfs_panic() "noreturn" */
-        panic("REISERFS: panic (device %s): %s\n",
-              reiserfs_bdevname(sb), error_buf);
+        dump_stack();
+
+        panic(KERN_EMERG "REISERFS: panic (device %s): %s\n",
+               reiserfs_bdevname(sb), error_buf);
 }
 
 void reiserfs_abort(struct super_block *sb, int errno, const char *fmt, ...)
diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
index 9aa7a06e093f..001144621672 100644
--- a/fs/reiserfs/procfs.c
+++ b/fs/reiserfs/procfs.c
@@ -420,12 +420,6 @@ static void *r_start(struct seq_file *m, loff_t * pos)
                 return NULL;
 
         up_write(&s->s_umount);
-
-        if (de->deleted) {
-                deactivate_super(s);
-                return NULL;
-        }
-
         return s;
 }
 
diff --git a/fs/reiserfs/resize.c b/fs/reiserfs/resize.c
index 976cc7887a0d..f71c3948edef 100644
--- a/fs/reiserfs/resize.c
+++ b/fs/reiserfs/resize.c
@@ -61,7 +61,8 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
         }
 
         /* count used bits in last bitmap block */
-        block_r = SB_BLOCK_COUNT(s) - (SB_BMAP_NR(s) - 1) * s->s_blocksize * 8;
+        block_r = SB_BLOCK_COUNT(s) -
+                        (reiserfs_bmap_count(s) - 1) * s->s_blocksize * 8;
 
         /* count bitmap blocks in new fs */
         bmap_nr_new = block_count_new / (s->s_blocksize * 8);
@@ -73,7 +74,7 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
 
         /* save old values */
         block_count = SB_BLOCK_COUNT(s);
-        bmap_nr = SB_BMAP_NR(s);
+        bmap_nr = reiserfs_bmap_count(s);
 
         /* resizing of reiserfs bitmaps (journal and real), if needed */
         if (bmap_nr_new > bmap_nr) {
@@ -119,7 +120,7 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
                         return -ENOMEM;
                 }
                 memset(bitmap, 0,
-                       sizeof(struct reiserfs_bitmap_info) * SB_BMAP_NR(s));
+                       sizeof(struct reiserfs_bitmap_info) * bmap_nr_new);
                 for (i = 0; i < bmap_nr; i++)
                         bitmap[i] = old_bitmap[i];
 
@@ -143,7 +144,6 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
                         mark_buffer_dirty(bh);
                         sync_dirty_buffer(bh);
                         // update bitmap_info stuff
-                        bitmap[i].first_zero_hint = 1;
                         bitmap[i].free_count = sb_blocksize(sb) * 8 - 1;
                         brelse(bh);
                 }
@@ -173,8 +173,6 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
         for (i = block_r; i < s->s_blocksize * 8; i++)
                 reiserfs_test_and_clear_le_bit(i, bh->b_data);
         info->free_count += s->s_blocksize * 8 - block_r;
-        if (!info->first_zero_hint)
-                info->first_zero_hint = block_r;
 
         journal_mark_dirty(&th, s, bh);
         brelse(bh);
@@ -196,9 +194,6 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
         brelse(bh);
 
         info->free_count -= s->s_blocksize * 8 - block_r_new;
-        /* Extreme case where last bitmap is the only valid block in itself. */
-        if (!info->free_count)
-                info->first_zero_hint = 0;
         /* update super */
         reiserfs_prepare_for_journal(s, SB_BUFFER_WITH_SB(s), 1);
         free_blocks = SB_FREE_BLOCKS(s);
@@ -206,7 +201,7 @@ int reiserfs_resize(struct super_block *s, unsigned long block_count_new)
                            free_blocks + (block_count_new - block_count -
                                           (bmap_nr_new - bmap_nr)));
         PUT_SB_BLOCK_COUNT(s, block_count_new);
-        PUT_SB_BMAP_NR(s, bmap_nr_new);
+        PUT_SB_BMAP_NR(s, bmap_would_wrap(bmap_nr_new) ? : bmap_nr_new);
         s->s_dirt = 1;
 
         journal_mark_dirty(&th, s, SB_BUFFER_WITH_SB(s));
diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index 981027d1187b..d2db2417b2bd 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -559,7 +559,7 @@ static int is_tree_node(struct buffer_head *bh, int level)
 /* The function is NOT SCHEDULE-SAFE! */
 static void search_by_key_reada(struct super_block *s,
                                 struct buffer_head **bh,
-                                unsigned long *b, int num)
+                                b_blocknr_t *b, int num)
 {
         int i, j;
 
@@ -611,7 +611,7 @@ int search_by_key(struct super_block *p_s_sb, const struct cpu_key *p_s_key,	/*
                                            DISK_LEAF_NODE_LEVEL */
     )
 {
-        int n_block_number;
+        b_blocknr_t n_block_number;
         int expected_level;
         struct buffer_head *p_s_bh;
         struct path_element *p_s_last_element;
@@ -619,7 +619,7 @@ int search_by_key(struct super_block *p_s_sb, const struct cpu_key *p_s_key,	/*
         int right_neighbor_of_leaf_node;
         int fs_gen;
         struct buffer_head *reada_bh[SEARCH_BY_KEY_READA];
-        unsigned long reada_blocks[SEARCH_BY_KEY_READA];
+        b_blocknr_t reada_blocks[SEARCH_BY_KEY_READA];
         int reada_count = 0;
 
 #ifdef CONFIG_REISERFS_CHECK
@@ -1458,9 +1458,6 @@ static void unmap_buffers(struct page *page, loff_t pos)
                                 }
                                 bh = next;
                         } while (bh != head);
-                        if (PAGE_SIZE == bh->b_size) {
-                                cancel_dirty_page(page, PAGE_CACHE_SIZE);
-                        }
                 }
         }
 }
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index b82897ae090b..5cd85fe5df5d 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -319,7 +319,7 @@ static int finish_unfinished(struct super_block *s)
 
 /* to protect file being unlinked from getting lost we "safe" link files
    being unlinked. This link will be deleted in the same transaction with last
-   item of file. mounting the filesytem we scan all these links and remove
+   item of file. mounting the filesystem we scan all these links and remove
    files which almost got lost */
 void add_save_link(struct reiserfs_transaction_handle *th,
                    struct inode *inode, int truncate)
@@ -661,11 +661,11 @@ static struct quotactl_ops reiserfs_qctl_operations = {
 };
 #endif
 
-static struct export_operations reiserfs_export_ops = {
+static const struct export_operations reiserfs_export_ops = {
         .encode_fh = reiserfs_encode_fh,
-        .decode_fh = reiserfs_decode_fh,
+        .fh_to_dentry = reiserfs_fh_to_dentry,
+        .fh_to_parent = reiserfs_fh_to_parent,
         .get_parent = reiserfs_get_parent,
-        .get_dentry = reiserfs_get_dentry,
 };
 
 /* this struct is used in reiserfs_getopt () for containing the value for those
@@ -1725,6 +1725,21 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
                 set_sb_umount_state(rs, REISERFS_ERROR_FS);
                 set_sb_fs_state(rs, 0);
 
+                /* Clear out s_bmap_nr if it would wrap. We can handle this
+                 * case, but older revisions can't. This will cause the
+                 * file system to fail mount on those older implementations,
+                 * avoiding corruption. -jeffm */
+                if (bmap_would_wrap(reiserfs_bmap_count(s)) &&
+                    sb_bmap_nr(rs) != 0) {
+                        reiserfs_warning(s, "super-2030: This file system "
+                                        "claims to use %u bitmap blocks in "
+                                        "its super block, but requires %u. "
+                                        "Clearing to zero.", sb_bmap_nr(rs),
+                                        reiserfs_bmap_count(s));
+
+                        set_sb_bmap_nr(rs, 0);
+                }
+
                 if (old_format_only(s)) {
                         /* filesystem of format 3.5 either with standard or non-standard
                            journal */
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index fab4b9b2664f..1597f6b649e0 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -484,7 +484,7 @@ reiserfs_xattr_set(struct inode *inode, const char *name, const void *buffer,
         /* Resize it so we're ok to write there */
         newattrs.ia_size = buffer_size;
         newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
-        mutex_lock(&xinode->i_mutex);
+        mutex_lock_nested(&xinode->i_mutex, I_MUTEX_XATTR);
         err = notify_change(fp->f_path.dentry, &newattrs);
         if (err)
                 goto out_filp;
@@ -1223,7 +1223,8 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags)
                 if (!IS_ERR(dentry)) {
                         if (!(mount_flags & MS_RDONLY) && !dentry->d_inode) {
                                 struct inode *inode = dentry->d_parent->d_inode;
-                                mutex_lock(&inode->i_mutex);
+                                mutex_lock_nested(&inode->i_mutex,
+                                                  I_MUTEX_XATTR);
                                 err = inode->i_op->mkdir(inode, dentry, 0700);
                                 mutex_unlock(&inode->i_mutex);
                                 if (err) {
diff --git a/fs/select.c b/fs/select.c
index 7dede89658f5..47f47925aea2 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -177,11 +177,6 @@ get_max:
         return max;
 }
 
-#define BIT(i)          (1UL << ((i)&(__NFDBITS-1)))
-#define MEM(i,m)        ((m)+(unsigned)(i)/__NFDBITS)
-#define ISSET(i,m)      (((i)&*(m)) != 0)
-#define SET(i,m)        (*(m) |= (i))
-
 #define POLLIN_SET (POLLRDNORM | POLLRDBAND | POLLIN | POLLHUP | POLLERR)
 #define POLLOUT_SET (POLLWRBAND | POLLWRNORM | POLLOUT | POLLERR)
 #define POLLEX_SET (POLLPRI)
diff --git a/fs/smbfs/file.c b/fs/smbfs/file.c
index f5d14cebc75a..efbe29af3d7a 100644
--- a/fs/smbfs/file.c
+++ b/fs/smbfs/file.c
@@ -234,7 +234,7 @@ smb_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
 
         VERBOSE("before read, size=%ld, flags=%x, atime=%ld\n",
                 (long)dentry->d_inode->i_size,
-                dentry->d_inode->i_flags, dentry->d_inode->i_atime);
+                dentry->d_inode->i_flags, dentry->d_inode->i_atime.tv_sec);
 
         status = generic_file_aio_read(iocb, iov, nr_segs, pos);
 out:
@@ -269,7 +269,7 @@ smb_file_splice_read(struct file *file, loff_t *ppos,
         struct dentry *dentry = file->f_path.dentry;
         ssize_t status;
 
-        VERBOSE("file %s/%s, pos=%Ld, count=%d\n",
+        VERBOSE("file %s/%s, pos=%Ld, count=%lu\n",
                 DENTRY_PATH(dentry), *ppos, count);
 
         status = smb_revalidate_inode(dentry);
@@ -363,7 +363,8 @@ smb_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                 result = generic_file_aio_write(iocb, iov, nr_segs, pos);
                 VERBOSE("pos=%ld, size=%ld, mtime=%ld, atime=%ld\n",
                         (long) file->f_pos, (long) dentry->d_inode->i_size,
-                        dentry->d_inode->i_mtime, dentry->d_inode->i_atime);
+                        dentry->d_inode->i_mtime.tv_sec,
+                        dentry->d_inode->i_atime.tv_sec);
         }
 out:
         return result;
diff --git a/fs/smbfs/inode.c b/fs/smbfs/inode.c
index ab517755ece0..9416ead0c7aa 100644
--- a/fs/smbfs/inode.c
+++ b/fs/smbfs/inode.c
@@ -536,7 +536,7 @@ static int smb_fill_super(struct super_block *sb, void *raw_data, int silent)
 
         /* Allocate the global temp buffer and some superblock helper structs */
         /* FIXME: move these to the smb_sb_info struct */
-        VERBOSE("alloc chunk = %d\n", sizeof(struct smb_ops) +
+        VERBOSE("alloc chunk = %lu\n", sizeof(struct smb_ops) +
                 sizeof(struct smb_mount_data_kernel));
         mem = kmalloc(sizeof(struct smb_ops) +
                       sizeof(struct smb_mount_data_kernel), GFP_KERNEL);
diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c
index feac46050619..d517a27b7f4b 100644
--- a/fs/smbfs/proc.c
+++ b/fs/smbfs/proc.c
@@ -2593,7 +2593,7 @@ smb_proc_getattr_ff(struct smb_sb_info *server, struct dentry *dentry,
         fattr->f_mtime.tv_sec = date_dos2unix(server, date, time);
         fattr->f_mtime.tv_nsec = 0;
         VERBOSE("name=%s, date=%x, time=%x, mtime=%ld\n",
-                mask, date, time, fattr->f_mtime);
+                mask, date, time, fattr->f_mtime.tv_sec);
         fattr->f_size = DVAL(req->rq_data, 12);
         /* ULONG allocation size */
         fattr->attr = WVAL(req->rq_data, 20);
diff --git a/fs/smbfs/smbiod.c b/fs/smbfs/smbiod.c
index 283c5720c9de..fae8e85af0ed 100644
--- a/fs/smbfs/smbiod.c
+++ b/fs/smbfs/smbiod.c
@@ -227,7 +227,7 @@ int smbiod_retry(struct smb_sb_info *server)
                 printk(KERN_ERR "smb_retry: signal failed [%d]\n", result);
                 goto out;
         }
-        VERBOSE("signalled pid %d\n", pid);
+        VERBOSE("signalled pid %d\n", pid_nr(pid));
 
         /* FIXME: The retried requests should perhaps get a "time boost". */
 
diff --git a/fs/super.c b/fs/super.c
index 1bfcca2104be..ceaf2e3d594c 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -15,7 +15,7 @@
  *  Added kerneld support: Jacques Gelinas and Bjorn Ekwall
  *  Added change_root: Werner Almesberger & Hans Lermen, Feb '96
  *  Added options to /proc/mounts:
- *    Torbjörn Lindh (torbjorn.lindh@gopta.se), April 14, 1996.
+ *    Torbjörn Lindh (torbjorn.lindh@gopta.se), April 14, 1996.
  *  Added devfs support: Richard Gooch <rgooch@atnf.csiro.au>, 13-JAN-1998
  *  Heavily rewritten for 'one fs - one tree' dcache architecture. AV, Mar 2000
  */
@@ -40,10 +40,6 @@
 #include <asm/uaccess.h>
 
 
-void get_filesystem(struct file_system_type *fs);
-void put_filesystem(struct file_system_type *fs);
-struct file_system_type *get_fs_type(const char *name);
-
 LIST_HEAD(super_blocks);
 DEFINE_SPINLOCK(sb_lock);
 
@@ -336,21 +332,21 @@ struct super_block *sget(struct file_system_type *type,
                         void *data)
 {
         struct super_block *s = NULL;
-        struct list_head *p;
+        struct super_block *old;
         int err;
 
 retry:
         spin_lock(&sb_lock);
-        if (test) list_for_each(p, &type->fs_supers) {
-                struct super_block *old;
-                old = list_entry(p, struct super_block, s_instances);
-                if (!test(old, data))
-                        continue;
-                if (!grab_super(old))
-                        goto retry;
-                if (s)
-                        destroy_super(s);
-                return old;
+        if (test) {
+                list_for_each_entry(old, &type->fs_supers, s_instances) {
+                        if (!test(old, data))
+                                continue;
+                        if (!grab_super(old))
+                                goto retry;
+                        if (s)
+                                destroy_super(s);
+                        return old;
+                }
         }
         if (!s) {
                 spin_unlock(&sb_lock);
@@ -421,7 +417,7 @@ restart:
 }
 
 /*
- * Call the ->sync_fs super_op against all filesytems which are r/w and
+ * Call the ->sync_fs super_op against all filesystems which are r/w and
  * which implement it.
  *
  * This operation is careful to avoid the livelock which could easily happen
@@ -429,7 +425,7 @@ restart:
  * is used only here.  We set it against all filesystems and then clear it as
  * we sync them.  So redirtied filesystems are skipped.
  *
- * But if process A is currently running sync_filesytems and then process B
+ * But if process A is currently running sync_filesystems and then process B
  * calls sync_filesystems as well, process B will set all the s_need_sync_fs
  * flags again, which will cause process A to resync everything.  Fix that with
  * a local mutex.
@@ -948,9 +944,9 @@ do_kern_mount(const char *fstype, int flags, const char *name, void *data)
         return mnt;
 }
 
-struct vfsmount *kern_mount(struct file_system_type *type)
+struct vfsmount *kern_mount_data(struct file_system_type *type, void *data)
 {
-        return vfs_kern_mount(type, 0, type->name, NULL);
+        return vfs_kern_mount(type, MS_KERNMOUNT, type->name, data);
 }
 
-EXPORT_SYMBOL(kern_mount);
+EXPORT_SYMBOL_GPL(kern_mount_data);
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index 7a8ce9e98b32..337162935d21 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -132,7 +132,7 @@ struct dentry *sysfs_get_dentry(struct sysfs_dirent *sd)
  *      RETURNS:
  *      Pointer to @sd on success, NULL on failure.
  */
-struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
+static struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
 {
         if (unlikely(!sd))
                 return NULL;
@@ -161,7 +161,7 @@ struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd)
  *      Put an active reference to @sd.  This function is noop if @sd
  *      is NULL.
  */
-void sysfs_put_active(struct sysfs_dirent *sd)
+static void sysfs_put_active(struct sysfs_dirent *sd)
 {
         struct completion *cmpl;
         int v;
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index d3be1e7fb48b..4045bdcc4b33 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -119,7 +119,11 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
 
         sysfs_put_active_two(attr_sd);
 
-        BUG_ON(count > (ssize_t)PAGE_SIZE);
+        /*
+         * The code works fine with PAGE_SIZE return but it's likely to
+         * indicate truncated result or overflow in normal use cases.
+         */
+        BUG_ON(count >= (ssize_t)PAGE_SIZE);
         if (count >= 0) {
                 buffer->needs_read_fill = 0;
                 buffer->count = count;
@@ -540,7 +544,7 @@ int sysfs_add_file(struct sysfs_dirent *dir_sd, const struct attribute *attr,
 /**
  *      sysfs_create_file - create an attribute file for an object.
  *      @kobj:  object we're creating for. 
- *      @attr:  atrribute descriptor.
+ *      @attr:  attribute descriptor.
  */
 
 int sysfs_create_file(struct kobject * kobj, const struct attribute * attr)
diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index f8417988f6b0..ff17f8da9b43 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -103,8 +103,6 @@ extern const struct file_operations sysfs_dir_operations;
 extern const struct inode_operations sysfs_dir_inode_operations;
 
 struct dentry *sysfs_get_dentry(struct sysfs_dirent *sd);
-struct sysfs_dirent *sysfs_get_active(struct sysfs_dirent *sd);
-void sysfs_put_active(struct sysfs_dirent *sd);
 struct sysfs_dirent *sysfs_get_active_two(struct sysfs_dirent *sd);
 void sysfs_put_active_two(struct sysfs_dirent *sd);
 void sysfs_addrm_start(struct sysfs_addrm_cxt *acxt,
diff --git a/fs/ufs/dir.c b/fs/ufs/dir.c
index 30f8c2bb0c3e..aaf2878305ce 100644
--- a/fs/ufs/dir.c
+++ b/fs/ufs/dir.c
@@ -179,7 +179,7 @@ bad_entry:
         goto fail;
 Eend:
         p = (struct ufs_dir_entry *)(kaddr + offs);
-        ufs_error (sb, "ext2_check_page",
+        ufs_error(sb, __FUNCTION__,
                    "entry in directory #%lu spans the page boundary"
                    "offset=%lu",
                    dir->i_ino, (page->index<<PAGE_CACHE_SHIFT)+offs);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 584cf12cc40f..0072cb33ebec 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -755,13 +755,13 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
                 break;
         
         case UFS_MOUNT_UFSTYPE_NEXTSTEP:
-                /*TODO: check may be we need set special dir block size?*/
                 UFSD("ufstype=nextstep\n");
                 uspi->s_fsize = block_size = 1024;
                 uspi->s_fmask = ~(1024 - 1);
                 uspi->s_fshift = 10;
                 uspi->s_sbsize = super_block_size = 2048;
                 uspi->s_sbbase = 0;
+                uspi->s_dirblksize = 1024;
                 flags |= UFS_DE_OLD | UFS_UID_OLD | UFS_ST_OLD | UFS_CG_OLD;
                 if (!(sb->s_flags & MS_RDONLY)) {
                         if (!silent)
@@ -771,13 +771,13 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
                 break;
         
         case UFS_MOUNT_UFSTYPE_NEXTSTEP_CD:
-                /*TODO: check may be we need set special dir block size?*/
                 UFSD("ufstype=nextstep-cd\n");
                 uspi->s_fsize = block_size = 2048;
                 uspi->s_fmask = ~(2048 - 1);
                 uspi->s_fshift = 11;
                 uspi->s_sbsize = super_block_size = 2048;
                 uspi->s_sbbase = 0;
+                uspi->s_dirblksize = 1024;
                 flags |= UFS_DE_OLD | UFS_UID_OLD | UFS_ST_OLD | UFS_CG_OLD;
                 if (!(sb->s_flags & MS_RDONLY)) {
                         if (!silent)
@@ -933,20 +933,19 @@ magic_found:
                 goto again;
         }
 
-        /* Set sbi->s_flags here, used by ufs_get_fs_state() below */
-        sbi->s_flags = flags;
+        sbi->s_flags = flags;/*after that line some functions use s_flags*/
         ufs_print_super_stuff(sb, usb1, usb2, usb3);
 
         /*
          * Check, if file system was correctly unmounted.
          * If not, make it read only.
          */
-        if ((((flags & UFS_ST_MASK) == UFS_ST_44BSD)    ||
-             ((flags & UFS_ST_MASK) == UFS_ST_OLD)      ||
-             ((flags & UFS_ST_MASK) == UFS_ST_SUN)      ||
-             ((flags & UFS_ST_MASK) == UFS_ST_SUNOS)    ||
-             ((flags & UFS_ST_MASK) == UFS_ST_SUNx86))  &&
-            (ufs_get_fs_state(sb, usb1, usb3) == (UFS_FSOK - fs32_to_cpu(sb, usb1->fs_time)))) {
+        if (((flags & UFS_ST_MASK) == UFS_ST_44BSD) ||
+          ((flags & UFS_ST_MASK) == UFS_ST_OLD) ||
+          (((flags & UFS_ST_MASK) == UFS_ST_SUN ||
+            (flags & UFS_ST_MASK) == UFS_ST_SUNOS ||
+          (flags & UFS_ST_MASK) == UFS_ST_SUNx86) &&
+          (ufs_get_fs_state(sb, usb1, usb3) == (UFS_FSOK - fs32_to_cpu(sb, usb1->fs_time))))) {
                 switch(usb1->fs_clean) {
                 case UFS_FSCLEAN:
                         UFSD("fs is clean\n");
diff --git a/fs/xattr.c b/fs/xattr.c
index a44fd92caca3..6645b7313b33 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -267,7 +267,7 @@ sys_fsetxattr(int fd, char __user *name, void __user *value,
         if (!f)
                 return error;
         dentry = f->f_path.dentry;
-        audit_inode(NULL, dentry->d_inode);
+        audit_inode(NULL, dentry);
         error = setxattr(dentry, name, value, size, flags);
         fput(f);
         return error;
@@ -349,7 +349,7 @@ sys_fgetxattr(int fd, char __user *name, void __user *value, size_t size)
         f = fget(fd);
         if (!f)
                 return error;
-        audit_inode(NULL, f->f_path.dentry->d_inode);
+        audit_inode(NULL, f->f_path.dentry);
         error = getxattr(f->f_path.dentry, name, value, size);
         fput(f);
         return error;
@@ -422,7 +422,7 @@ sys_flistxattr(int fd, char __user *list, size_t size)
         f = fget(fd);
         if (!f)
                 return error;
-        audit_inode(NULL, f->f_path.dentry->d_inode);
+        audit_inode(NULL, f->f_path.dentry);
         error = listxattr(f->f_path.dentry, list, size);
         fput(f);
         return error;
@@ -485,7 +485,7 @@ sys_fremovexattr(int fd, char __user *name)
         if (!f)
                 return error;
         dentry = f->f_path.dentry;
-        audit_inode(NULL, dentry->d_inode);
+        audit_inode(NULL, dentry);
         error = removexattr(dentry, name);
         fput(f);
         return error;
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index 3586c7a28d2c..15bd4948832c 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -33,62 +33,25 @@
 static struct dentry dotdot = { .d_name.name = "..", .d_name.len = 2, };
 
 /*
- * XFS encodes and decodes the fileid portion of NFS filehandles
- * itself instead of letting the generic NFS code do it.  This
- * allows filesystems with 64 bit inode numbers to be exported.
- *
- * Note that a side effect is that xfs_vget() won't be passed a
- * zero inode/generation pair under normal circumstances.  As
- * however a malicious client could send us such data, the check
- * remains in that code.
+ * Note that we only accept fileids which are long enough rather than allow
+ * the parent generation number to default to zero.  XFS considers zero a
+ * valid generation number not an invalid/wildcard value.
  */
-
-STATIC struct dentry *
-xfs_fs_decode_fh(
-        struct super_block      *sb,
-        __u32                   *fh,
-        int                     fh_len,
-        int                     fileid_type,
-        int (*acceptable)(
-                void            *context,
-                struct dentry   *de),
-        void                    *context)
+static int xfs_fileid_length(int fileid_type)
 {
-        xfs_fid_t               ifid;
-        xfs_fid_t               pfid;
-        void                    *parent = NULL;
-        int                     is64 = 0;
-        __u32                   *p = fh;
-
-#if XFS_BIG_INUMS
-        is64 = (fileid_type & XFS_FILEID_TYPE_64FLAG);
-        fileid_type &= ~XFS_FILEID_TYPE_64FLAG;
-#endif
-
-        /*
-         * Note that we only accept fileids which are long enough
-         * rather than allow the parent generation number to default
-         * to zero.  XFS considers zero a valid generation number not
-         * an invalid/wildcard value.  There's little point printk'ing
-         * a warning here as we don't have the client information
-         * which would make such a warning useful.
-         */
-        if (fileid_type > 2 ||
-            fh_len < xfs_fileid_length((fileid_type == 2), is64))
-                return NULL;
-
-        p = xfs_fileid_decode_fid2(p, &ifid, is64);
-
-        if (fileid_type == 2) {
-                p = xfs_fileid_decode_fid2(p, &pfid, is64);
-                parent = &pfid;
+        switch (fileid_type) {
+        case FILEID_INO32_GEN:
+                return 2;
+        case FILEID_INO32_GEN_PARENT:
+                return 4;
+        case FILEID_INO32_GEN | XFS_FILEID_TYPE_64FLAG:
+                return 3;
+        case FILEID_INO32_GEN_PARENT | XFS_FILEID_TYPE_64FLAG:
+                return 6;
         }
-
-        fh = (__u32 *)&ifid;
-        return sb->s_export_op->find_exported_dentry(sb, fh, parent, acceptable, context);
+        return 255; /* invalid */
 }
 
-
 STATIC int
 xfs_fs_encode_fh(
         struct dentry           *dentry,
@@ -96,21 +59,21 @@ xfs_fs_encode_fh(
         int                     *max_len,
         int                     connectable)
 {
+        struct fid              *fid = (struct fid *)fh;
+        struct xfs_fid64        *fid64 = (struct xfs_fid64 *)fh;
         struct inode            *inode = dentry->d_inode;
-        int                     type = 1;
-        __u32                   *p = fh;
+        int                     fileid_type;
         int                     len;
-        int                     is64 = 0;
-#if XFS_BIG_INUMS
-        if (!(XFS_M(inode->i_sb)->m_flags & XFS_MOUNT_SMALL_INUMS)) {
-                /* filesystem may contain 64bit inode numbers */
-                is64 = XFS_FILEID_TYPE_64FLAG;
-        }
-#endif
 
         /* Directories don't need their parent encoded, they have ".." */
         if (S_ISDIR(inode->i_mode))
-            connectable = 0;
+                fileid_type = FILEID_INO32_GEN;
+        else
+                fileid_type = FILEID_INO32_GEN_PARENT;
+
+        /* filesystem may contain 64bit inode numbers */
+        if (!(XFS_M(inode->i_sb)->m_flags & XFS_MOUNT_SMALL_INUMS))
+                fileid_type |= XFS_FILEID_TYPE_64FLAG;
 
         /*
          * Only encode if there is enough space given.  In practice
@@ -118,39 +81,118 @@ xfs_fs_encode_fh(
          * over NFSv2 with the subtree_check export option; the other
          * seven combinations work.  The real answer is "don't use v2".
          */
-        len = xfs_fileid_length(connectable, is64);
+        len = xfs_fileid_length(fileid_type);
         if (*max_len < len)
                 return 255;
         *max_len = len;
 
-        p = xfs_fileid_encode_inode(p, inode, is64);
-        if (connectable) {
+        switch (fileid_type) {
+        case FILEID_INO32_GEN_PARENT:
                 spin_lock(&dentry->d_lock);
-                p = xfs_fileid_encode_inode(p, dentry->d_parent->d_inode, is64);
+                fid->i32.parent_ino = dentry->d_parent->d_inode->i_ino;
+                fid->i32.parent_gen = dentry->d_parent->d_inode->i_generation;
                 spin_unlock(&dentry->d_lock);
-                type = 2;
+                /*FALLTHRU*/
+        case FILEID_INO32_GEN:
+                fid->i32.ino = inode->i_ino;
+                fid->i32.gen = inode->i_generation;
+                break;
+        case FILEID_INO32_GEN_PARENT | XFS_FILEID_TYPE_64FLAG:
+                spin_lock(&dentry->d_lock);
+                fid64->parent_ino = dentry->d_parent->d_inode->i_ino;
+                fid64->parent_gen = dentry->d_parent->d_inode->i_generation;
+                spin_unlock(&dentry->d_lock);
+                /*FALLTHRU*/
+        case FILEID_INO32_GEN | XFS_FILEID_TYPE_64FLAG:
+                fid64->ino = inode->i_ino;
+                fid64->gen = inode->i_generation;
+                break;
         }
-        BUG_ON((p - fh) != len);
-        return type | is64;
+
+        return fileid_type;
 }
 
-STATIC struct dentry *
-xfs_fs_get_dentry(
+STATIC struct inode *
+xfs_nfs_get_inode(
         struct super_block      *sb,
-        void                    *data)
-{
+        u64                     ino,
+        u32                     generation)
+ {
+        xfs_fid_t               xfid;
         bhv_vnode_t             *vp;
-        struct inode            *inode;
-        struct dentry           *result;
         int                     error;
 
-        error = xfs_vget(XFS_M(sb), &vp, data);
-        if (error || vp == NULL)
-                return ERR_PTR(-ESTALE) ;
+        xfid.fid_len = sizeof(xfs_fid_t) - sizeof(xfid.fid_len);
+        xfid.fid_pad = 0;
+        xfid.fid_ino = ino;
+        xfid.fid_gen = generation;
 
-        inode = vn_to_inode(vp);
+        error = xfs_vget(XFS_M(sb), &vp, &xfid);
+        if (error)
+                return ERR_PTR(-error);
+
+        return vp ? vn_to_inode(vp) : NULL;
+}
+
+STATIC struct dentry *
+xfs_fs_fh_to_dentry(struct super_block *sb, struct fid *fid,
+                 int fh_len, int fileid_type)
+{
+        struct xfs_fid64        *fid64 = (struct xfs_fid64 *)fid;
+        struct inode            *inode = NULL;
+        struct dentry           *result;
+
+        if (fh_len < xfs_fileid_length(fileid_type))
+                return NULL;
+
+        switch (fileid_type) {
+        case FILEID_INO32_GEN_PARENT:
+        case FILEID_INO32_GEN:
+                inode = xfs_nfs_get_inode(sb, fid->i32.ino, fid->i32.gen);
+                break;
+        case FILEID_INO32_GEN_PARENT | XFS_FILEID_TYPE_64FLAG:
+        case FILEID_INO32_GEN | XFS_FILEID_TYPE_64FLAG:
+                inode = xfs_nfs_get_inode(sb, fid64->ino, fid64->gen);
+                break;
+        }
+
+        if (!inode)
+                return NULL;
+        if (IS_ERR(inode))
+                return ERR_PTR(PTR_ERR(inode));
+        result = d_alloc_anon(inode);
+        if (!result) {
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        return result;
+}
+
+STATIC struct dentry *
+xfs_fs_fh_to_parent(struct super_block *sb, struct fid *fid,
+                 int fh_len, int fileid_type)
+{
+        struct xfs_fid64        *fid64 = (struct xfs_fid64 *)fid;
+        struct inode            *inode = NULL;
+        struct dentry           *result;
+
+        switch (fileid_type) {
+        case FILEID_INO32_GEN_PARENT:
+                inode = xfs_nfs_get_inode(sb, fid->i32.parent_ino,
+                                              fid->i32.parent_gen);
+                break;
+        case FILEID_INO32_GEN_PARENT | XFS_FILEID_TYPE_64FLAG:
+                inode = xfs_nfs_get_inode(sb, fid64->parent_ino,
+                                              fid64->parent_gen);
+                break;
+        }
+
+        if (!inode)
+                return NULL;
+        if (IS_ERR(inode))
+                return ERR_PTR(PTR_ERR(inode));
         result = d_alloc_anon(inode);
-        if (!result) {
+        if (!result) {
                 iput(inode);
                 return ERR_PTR(-ENOMEM);
         }
@@ -178,9 +220,9 @@ xfs_fs_get_parent(
         return parent;
 }
 
-struct export_operations xfs_export_operations = {
-        .decode_fh              = xfs_fs_decode_fh,
+const struct export_operations xfs_export_operations = {
         .encode_fh              = xfs_fs_encode_fh,
+        .fh_to_dentry           = xfs_fs_fh_to_dentry,
+        .fh_to_parent           = xfs_fs_fh_to_parent,
         .get_parent             = xfs_fs_get_parent,
-        .get_dentry             = xfs_fs_get_dentry,
 };
diff --git a/fs/xfs/linux-2.6/xfs_export.h b/fs/xfs/linux-2.6/xfs_export.h
index 2f36071a86f7..3272b6ae7a35 100644
--- a/fs/xfs/linux-2.6/xfs_export.h
+++ b/fs/xfs/linux-2.6/xfs_export.h
@@ -59,50 +59,14 @@
  * a subdirectory) or use the "fsid" export option.
  */
 
+struct xfs_fid64 {
+        u64 ino;
+        u32 gen;
+        u64 parent_ino;
+        u32 parent_gen;
+} __attribute__((packed));
+
 /* This flag goes on the wire.  Don't play with it. */
 #define XFS_FILEID_TYPE_64FLAG  0x80    /* NFS fileid has 64bit inodes */
 
-/* Calculate the length in u32 units of the fileid data */
-static inline int
-xfs_fileid_length(int hasparent, int is64)
-{
-        return hasparent ? (is64 ? 6 : 4) : (is64 ? 3 : 2);
-}
-
-/*
- * Decode encoded inode information (either for the inode itself
- * or the parent) into an xfs_fid_t structure.  Advances and
- * returns the new data pointer
- */
-static inline __u32 *
-xfs_fileid_decode_fid2(__u32 *p, xfs_fid_t *fid, int is64)
-{
-        fid->fid_len = sizeof(xfs_fid_t) - sizeof(fid->fid_len);
-        fid->fid_pad = 0;
-        fid->fid_ino = *p++;
-#if XFS_BIG_INUMS
-        if (is64)
-                fid->fid_ino |= (((__u64)(*p++)) << 32);
-#endif
-        fid->fid_gen = *p++;
-        return p;
-}
-
-/*
- * Encode inode information (either for the inode itself or the
- * parent) into a fileid buffer.  Advances and returns the new
- * data pointer.
- */
-static inline __u32 *
-xfs_fileid_encode_inode(__u32 *p, struct inode *inode, int is64)
-{
-        *p++ = (__u32)inode->i_ino;
-#if XFS_BIG_INUMS
-        if (is64)
-                *p++ = (__u32)(inode->i_ino >> 32);
-#endif
-        *p++ = inode->i_generation;
-        return p;
-}
-
 #endif  /* __XFS_EXPORT_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_super.h b/fs/xfs/linux-2.6/xfs_super.h
index c78c23310fe8..3efcf45b14ab 100644
--- a/fs/xfs/linux-2.6/xfs_super.h
+++ b/fs/xfs/linux-2.6/xfs_super.h
@@ -118,7 +118,7 @@ extern int  xfs_blkdev_get(struct xfs_mount *, const char *,
 extern void xfs_blkdev_put(struct block_device *);
 extern void xfs_blkdev_issue_flush(struct xfs_buftarg *);
 
-extern struct export_operations xfs_export_operations;
+extern const struct export_operations xfs_export_operations;
 
 #define XFS_M(sb)               ((struct xfs_mount *)((sb)->s_fs_info))