Merge tag 'nfsd-4.21' of git://linux-nfs.org/~bfields/linux

Pull nfsd updates from Bruce Fields:
 "Thanks to Vasily Averin for fixing a use-after-free in the
  containerized NFSv4.2 client, and cleaning up some convoluted
  backchannel server code in the process.

  Otherwise, miscellaneous smaller bugfixes and cleanup"

* tag 'nfsd-4.21' of git://linux-nfs.org/~bfields/linux: (25 commits)
  nfs: fixed broken compilation in nfs_callback_up_net()
  nfs: minor typo in nfs4_callback_up_net()
  sunrpc: fix debug message in svc_create_xprt()
  sunrpc: make visible processing error in bc_svc_process()
  sunrpc: remove unused xpo_prep_reply_hdr callback
  sunrpc: remove svc_rdma_bc_class
  sunrpc: remove svc_tcp_bc_class
  sunrpc: remove unused bc_up operation from rpc_xprt_ops
  sunrpc: replace svc_serv->sv_bc_xprt by boolean flag
  sunrpc: use-after-free in svc_process_common()
  sunrpc: use SVC_NET() in svcauth_gss_* functions
  nfsd: drop useless LIST_HEAD
  lockd: Show pid of lockd for remote locks
  NFSD remove OP_CACHEME from 4.2 op_flags
  nfsd: Return EPERM, not EACCES, in some SETATTR cases
  sunrpc: fix cache_head leak due to queued request
  nfsd: clean up indentation, increase indentation in switch statement
  svcrdma: Optimize the logic that selects the R_key to invalidate
  nfsd: fix a warning in __cld_pipe_upcall()
  nfsd4: fix crash on writing v4_end_grace before nfsd startup
  ...

13 files changed, 112 insertions, 278 deletions

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 1ece4bc3eb8d..152790ed309c 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1142,7 +1142,7 @@ static int svcauth_gss_legacy_init(struct svc_rqst *rqstp,
         struct kvec *resv = &rqstp->rq_res.head[0];
         struct rsi *rsip, rsikey;
         int ret;
-        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+        struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
         memset(&rsikey, 0, sizeof(rsikey));
         ret = gss_read_verf(gc, argv, authp,
@@ -1253,7 +1253,7 @@ static int svcauth_gss_proxy_init(struct svc_rqst *rqstp,
         uint64_t handle;
         int status;
         int ret;
-        struct net *net = rqstp->rq_xprt->xpt_net;
+        struct net *net = SVC_NET(rqstp);
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
         memset(&ud, 0, sizeof(ud));
@@ -1444,7 +1444,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
         __be32          *rpcstart;
         __be32          *reject_stat = resv->iov_base + resv->iov_len;
         int             ret;
-        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+        struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
         dprintk("RPC:       svcauth_gss: argv->iov_len = %zd\n",
                         argv->iov_len);
@@ -1734,7 +1734,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
         struct rpc_gss_wire_cred *gc = &gsd->clcred;
         struct xdr_buf *resbuf = &rqstp->rq_res;
         int stat = -EINVAL;
-        struct sunrpc_net *sn = net_generic(rqstp->rq_xprt->xpt_net, sunrpc_net_id);
+        struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
 
         if (gc->gc_proc != RPC_GSS_PROC_DATA)
                 goto out;
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index f96345b1180e..12bb23b8e0c5 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -54,6 +54,11 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail)
         h->last_refresh = now;
 }
 
+static void cache_fresh_locked(struct cache_head *head, time_t expiry,
+                                struct cache_detail *detail);
+static void cache_fresh_unlocked(struct cache_head *head,
+                                struct cache_detail *detail);
+
 static struct cache_head *sunrpc_cache_find_rcu(struct cache_detail *detail,
                                                 struct cache_head *key,
                                                 int hash)
@@ -100,6 +105,7 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,
                         if (cache_is_expired(detail, tmp)) {
                                 hlist_del_init_rcu(&tmp->cache_list);
                                 detail->entries --;
+                                cache_fresh_locked(tmp, 0, detail);
                                 freeme = tmp;
                                 break;
                         }
@@ -115,8 +121,10 @@ static struct cache_head *sunrpc_cache_add_entry(struct cache_detail *detail,
         cache_get(new);
         spin_unlock(&detail->hash_lock);
 
-        if (freeme)
+        if (freeme) {
+                cache_fresh_unlocked(freeme, detail);
                 cache_put(freeme, detail);
+        }
         return new;
 }
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index d13e05f1a990..e87ddb9f7feb 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1145,6 +1145,17 @@ static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ..
 #endif
 
 /*
+ * Setup response header for TCP, it has a 4B record length field.
+ */
+static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+{
+        struct kvec *resv = &rqstp->rq_res.head[0];
+
+        /* tcp needs a space for the record length... */
+        svc_putnl(resv, 0);
+}
+
+/*
  * Common routine for processing the RPC request.
  */
 static int
@@ -1172,7 +1183,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
         clear_bit(RQ_DROPME, &rqstp->rq_flags);
 
         /* Setup reply header */
-        rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
+        if (rqstp->rq_prot == IPPROTO_TCP)
+                svc_tcp_prep_reply_hdr(rqstp);
 
         svc_putu32(resv, rqstp->rq_xid);
 
@@ -1244,7 +1256,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
          * for lower versions. RPC_PROG_MISMATCH seems to be the closest
          * fit.
          */
-        if (versp->vs_need_cong_ctrl &&
+        if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
             !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
                 goto err_bad_vers;
 
@@ -1336,7 +1348,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
         return 0;
 
  close:
-        if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+        if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
                 svc_close_xprt(rqstp->rq_xprt);
         dprintk("svc: svc_process close\n");
         return 0;
@@ -1459,10 +1471,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
         dprintk("svc: %s(%p)\n", __func__, req);
 
         /* Build the svc_rqst used by the common processing routine */
-        rqstp->rq_xprt = serv->sv_bc_xprt;
         rqstp->rq_xid = req->rq_xid;
         rqstp->rq_prot = req->rq_xprt->prot;
         rqstp->rq_server = serv;
+        rqstp->rq_bc_net = req->rq_xprt->xprt_net;
 
         rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
         memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
@@ -1499,9 +1511,9 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
         if (!proc_error) {
                 /* Processing error: drop the request */
                 xprt_free_bc_request(req);
-                return 0;
+                error = -EINVAL;
+                goto out;
         }
-
         /* Finally, send the reply synchronously */
         memcpy(&req->rq_snd_buf, &rqstp->rq_res, sizeof(req->rq_snd_buf));
         task = rpc_run_bc_task(req);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 51d36230b6e3..4eb8fbf2508d 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -296,9 +296,9 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
                 request_module("svc%s", xprt_name);
                 err = _svc_create_xprt(serv, xprt_name, net, family, port, flags);
         }
-        if (err)
+        if (err < 0)
                 dprintk("svc: transport %s not found, err %d\n",
-                        xprt_name, err);
+                        xprt_name, -err);
         return err;
 }
 EXPORT_SYMBOL_GPL(svc_create_xprt);
@@ -468,10 +468,11 @@ out:
  */
 void svc_reserve(struct svc_rqst *rqstp, int space)
 {
+        struct svc_xprt *xprt = rqstp->rq_xprt;
+
         space += rqstp->rq_res.head[0].iov_len;
 
-        if (space < rqstp->rq_reserved) {
-                struct svc_xprt *xprt = rqstp->rq_xprt;
+        if (xprt && space < rqstp->rq_reserved) {
                 atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
                 rqstp->rq_reserved = space;
 
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 986f3ed7d1a2..c7ae1ed5324f 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -70,13 +70,6 @@ static void		svc_sock_free(struct svc_xprt *);
 static struct svc_xprt *svc_create_socket(struct svc_serv *, int,
                                           struct net *, struct sockaddr *,
                                           int, int);
-#if defined(CONFIG_SUNRPC_BACKCHANNEL)
-static struct svc_xprt *svc_bc_create_socket(struct svc_serv *, int,
-                                             struct net *, struct sockaddr *,
-                                             int, int);
-static void svc_bc_sock_free(struct svc_xprt *xprt);
-#endif /* CONFIG_SUNRPC_BACKCHANNEL */
-
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key svc_key[2];
 static struct lock_class_key svc_slock_key[2];
@@ -617,10 +610,6 @@ svc_udp_sendto(struct svc_rqst *rqstp)
         return error;
 }
 
-static void svc_udp_prep_reply_hdr(struct svc_rqst *rqstp)
-{
-}
-
 static int svc_udp_has_wspace(struct svc_xprt *xprt)
 {
         struct svc_sock *svsk = container_of(xprt, struct svc_sock, sk_xprt);
@@ -664,7 +653,6 @@ static const struct svc_xprt_ops svc_udp_ops = {
         .xpo_release_rqst = svc_release_udp_skb,
         .xpo_detach = svc_sock_detach,
         .xpo_free = svc_sock_free,
-        .xpo_prep_reply_hdr = svc_udp_prep_reply_hdr,
         .xpo_has_wspace = svc_udp_has_wspace,
         .xpo_accept = svc_udp_accept,
         .xpo_secure_port = svc_sock_secure_port,
@@ -1170,17 +1158,6 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
         return sent;
 }
 
-/*
- * Setup response header. TCP has a 4B record length field.
- */
-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
-{
-        struct kvec *resv = &rqstp->rq_res.head[0];
-
-        /* tcp needs a space for the record length... */
-        svc_putnl(resv, 0);
-}
-
 static struct svc_xprt *svc_tcp_create(struct svc_serv *serv,
                                        struct net *net,
                                        struct sockaddr *sa, int salen,
@@ -1189,58 +1166,6 @@ static struct svc_xprt *svc_tcp_create(struct svc_serv *serv,
         return svc_create_socket(serv, IPPROTO_TCP, net, sa, salen, flags);
 }
 
-#if defined(CONFIG_SUNRPC_BACKCHANNEL)
-static struct svc_xprt *svc_bc_create_socket(struct svc_serv *, int,
-                                             struct net *, struct sockaddr *,
-                                             int, int);
-static void svc_bc_sock_free(struct svc_xprt *xprt);
-
-static struct svc_xprt *svc_bc_tcp_create(struct svc_serv *serv,
-                                       struct net *net,
-                                       struct sockaddr *sa, int salen,
-                                       int flags)
-{
-        return svc_bc_create_socket(serv, IPPROTO_TCP, net, sa, salen, flags);
-}
-
-static void svc_bc_tcp_sock_detach(struct svc_xprt *xprt)
-{
-}
-
-static const struct svc_xprt_ops svc_tcp_bc_ops = {
-        .xpo_create = svc_bc_tcp_create,
-        .xpo_detach = svc_bc_tcp_sock_detach,
-        .xpo_free = svc_bc_sock_free,
-        .xpo_prep_reply_hdr = svc_tcp_prep_reply_hdr,
-        .xpo_secure_port = svc_sock_secure_port,
-};
-
-static struct svc_xprt_class svc_tcp_bc_class = {
-        .xcl_name = "tcp-bc",
-        .xcl_owner = THIS_MODULE,
-        .xcl_ops = &svc_tcp_bc_ops,
-        .xcl_max_payload = RPCSVC_MAXPAYLOAD_TCP,
-};
-
-static void svc_init_bc_xprt_sock(void)
-{
-        svc_reg_xprt_class(&svc_tcp_bc_class);
-}
-
-static void svc_cleanup_bc_xprt_sock(void)
-{
-        svc_unreg_xprt_class(&svc_tcp_bc_class);
-}
-#else /* CONFIG_SUNRPC_BACKCHANNEL */
-static void svc_init_bc_xprt_sock(void)
-{
-}
-
-static void svc_cleanup_bc_xprt_sock(void)
-{
-}
-#endif /* CONFIG_SUNRPC_BACKCHANNEL */
-
 static const struct svc_xprt_ops svc_tcp_ops = {
         .xpo_create = svc_tcp_create,
         .xpo_recvfrom = svc_tcp_recvfrom,
@@ -1248,7 +1173,6 @@ static const struct svc_xprt_ops svc_tcp_ops = {
         .xpo_release_rqst = svc_release_skb,
         .xpo_detach = svc_tcp_sock_detach,
         .xpo_free = svc_sock_free,
-        .xpo_prep_reply_hdr = svc_tcp_prep_reply_hdr,
         .xpo_has_wspace = svc_tcp_has_wspace,
         .xpo_accept = svc_tcp_accept,
         .xpo_secure_port = svc_sock_secure_port,
@@ -1267,14 +1191,12 @@ void svc_init_xprt_sock(void)
 {
         svc_reg_xprt_class(&svc_tcp_class);
         svc_reg_xprt_class(&svc_udp_class);
-        svc_init_bc_xprt_sock();
 }
 
 void svc_cleanup_xprt_sock(void)
 {
         svc_unreg_xprt_class(&svc_tcp_class);
         svc_unreg_xprt_class(&svc_udp_class);
-        svc_cleanup_bc_xprt_sock();
 }
 
 static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
@@ -1595,45 +1517,3 @@ static void svc_sock_free(struct svc_xprt *xprt)
                 sock_release(svsk->sk_sock);
         kfree(svsk);
 }
-
-#if defined(CONFIG_SUNRPC_BACKCHANNEL)
-/*
- * Create a back channel svc_xprt which shares the fore channel socket.
- */
-static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
-                                             int protocol,
-                                             struct net *net,
-                                             struct sockaddr *sin, int len,
-                                             int flags)
-{
-        struct svc_sock *svsk;
-        struct svc_xprt *xprt;
-
-        if (protocol != IPPROTO_TCP) {
-                printk(KERN_WARNING "svc: only TCP sockets"
-                        " supported on shared back channel\n");
-                return ERR_PTR(-EINVAL);
-        }
-
-        svsk = kzalloc(sizeof(*svsk), GFP_KERNEL);
-        if (!svsk)
-                return ERR_PTR(-ENOMEM);
-
-        xprt = &svsk->sk_xprt;
-        svc_xprt_init(net, &svc_tcp_bc_class, xprt, serv);
-        set_bit(XPT_CONG_CTRL, &svsk->sk_xprt.xpt_flags);
-
-        serv->sv_bc_xprt = xprt;
-
-        return xprt;
-}
-
-/*
- * Free a back channel svc_sock.
- */
-static void svc_bc_sock_free(struct svc_xprt *xprt)
-{
-        if (xprt)
-                kfree(container_of(xprt, struct svc_sock, sk_xprt));
-}
-#endif /* CONFIG_SUNRPC_BACKCHANNEL */
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index e5b367a3e517..edba0d35776b 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -114,26 +114,6 @@ out_err:
 }
 
 /**
- * xprt_rdma_bc_up - Create transport endpoint for backchannel service
- * @serv: server endpoint
- * @net: network namespace
- *
- * The "xprt" is an implied argument: it supplies the name of the
- * backchannel transport class.
- *
- * Returns zero on success, negative errno on failure
- */
-int xprt_rdma_bc_up(struct svc_serv *serv, struct net *net)
-{
-        int ret;
-
-        ret = svc_create_xprt(serv, "rdma-bc", net, PF_INET, 0, 0);
-        if (ret < 0)
-                return ret;
-        return 0;
-}
-
-/**
  * xprt_rdma_bc_maxpayload - Return maximum backchannel message size
  * @xprt: transport
  *
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 134bef6a451e..abdb3004a1e3 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -235,9 +235,6 @@ void svc_rdma_cleanup(void)
                 unregister_sysctl_table(svcrdma_table_header);
                 svcrdma_table_header = NULL;
         }
-#if defined(CONFIG_SUNRPC_BACKCHANNEL)
-        svc_unreg_xprt_class(&svc_rdma_bc_class);
-#endif
         svc_unreg_xprt_class(&svc_rdma_class);
 }
 
@@ -259,8 +256,5 @@ int svc_rdma_init(void)
 
         /* Register RDMA with the SVC transport switch */
         svc_reg_xprt_class(&svc_rdma_class);
-#if defined(CONFIG_SUNRPC_BACKCHANNEL)
-        svc_reg_xprt_class(&svc_rdma_bc_class);
-#endif
         return 0;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index b24d5b8f2fee..828b149eaaef 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -485,6 +485,68 @@ static __be32 *xdr_check_reply_chunk(__be32 *p, const __be32 *end)
         return p;
 }
 
+/* RPC-over-RDMA Version One private extension: Remote Invalidation.
+ * Responder's choice: requester signals it can handle Send With
+ * Invalidate, and responder chooses one R_key to invalidate.
+ *
+ * If there is exactly one distinct R_key in the received transport
+ * header, set rc_inv_rkey to that R_key. Otherwise, set it to zero.
+ *
+ * Perform this operation while the received transport header is
+ * still in the CPU cache.
+ */
+static void svc_rdma_get_inv_rkey(struct svcxprt_rdma *rdma,
+                                  struct svc_rdma_recv_ctxt *ctxt)
+{
+        __be32 inv_rkey, *p;
+        u32 i, segcount;
+
+        ctxt->rc_inv_rkey = 0;
+
+        if (!rdma->sc_snd_w_inv)
+                return;
+
+        inv_rkey = xdr_zero;
+        p = ctxt->rc_recv_buf;
+        p += rpcrdma_fixed_maxsz;
+
+        /* Read list */
+        while (*p++ != xdr_zero) {
+                p++;    /* position */
+                if (inv_rkey == xdr_zero)
+                        inv_rkey = *p;
+                else if (inv_rkey != *p)
+                        return;
+                p += 4;
+        }
+
+        /* Write list */
+        while (*p++ != xdr_zero) {
+                segcount = be32_to_cpup(p++);
+                for (i = 0; i < segcount; i++) {
+                        if (inv_rkey == xdr_zero)
+                                inv_rkey = *p;
+                        else if (inv_rkey != *p)
+                                return;
+                        p += 4;
+                }
+        }
+
+        /* Reply chunk */
+        if (*p++ != xdr_zero) {
+                segcount = be32_to_cpup(p++);
+                for (i = 0; i < segcount; i++) {
+                        if (inv_rkey == xdr_zero)
+                                inv_rkey = *p;
+                        else if (inv_rkey != *p)
+                                return;
+                        p += 4;
+                }
+        }
+
+        ctxt->rc_inv_rkey = be32_to_cpu(inv_rkey);
+}
+
 /* On entry, xdr->head[0].iov_base points to first byte in the
  * RPC-over-RDMA header.
  *
@@ -746,6 +808,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
                 svc_rdma_recv_ctxt_put(rdma_xprt, ctxt);
                 return ret;
         }
+        svc_rdma_get_inv_rkey(rdma_xprt, ctxt);
 
         p += rpcrdma_fixed_maxsz;
         if (*p != xdr_zero)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 8602a5f1b515..cf51b8f9b15f 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -484,32 +484,6 @@ static void svc_rdma_get_write_arrays(__be32 *rdma_argp,
                 *reply = NULL;
 }
 
-/* RPC-over-RDMA Version One private extension: Remote Invalidation.
- * Responder's choice: requester signals it can handle Send With
- * Invalidate, and responder chooses one rkey to invalidate.
- *
- * Find a candidate rkey to invalidate when sending a reply.  Picks the
- * first R_key it finds in the chunk lists.
- *
- * Returns zero if RPC's chunk lists are empty.
- */
-static u32 svc_rdma_get_inv_rkey(__be32 *rdma_argp,
-                                 __be32 *wr_lst, __be32 *rp_ch)
-{
-        __be32 *p;
-
-        p = rdma_argp + rpcrdma_fixed_maxsz;
-        if (*p != xdr_zero)
-                p += 2;
-        else if (wr_lst && be32_to_cpup(wr_lst + 1))
-                p = wr_lst + 2;
-        else if (rp_ch && be32_to_cpup(rp_ch + 1))
-                p = rp_ch + 2;
-        else
-                return 0;
-        return be32_to_cpup(p);
-}
-
 static int svc_rdma_dma_map_page(struct svcxprt_rdma *rdma,
                                  struct svc_rdma_send_ctxt *ctxt,
                                  struct page *page,
@@ -672,7 +646,7 @@ static void svc_rdma_save_io_pages(struct svc_rqst *rqstp,
  *
  * RDMA Send is the last step of transmitting an RPC reply. Pages
  * involved in the earlier RDMA Writes are here transferred out
- * of the rqstp and into the ctxt's page array. These pages are
+ * of the rqstp and into the sctxt's page array. These pages are
  * DMA unmapped by each Write completion, but the subsequent Send
  * completion finally releases these pages.
  *
@@ -680,32 +654,31 @@ static void svc_rdma_save_io_pages(struct svc_rqst *rqstp,
  * - The Reply's transport header will never be larger than a page.
  */
 static int svc_rdma_send_reply_msg(struct svcxprt_rdma *rdma,
-                                   struct svc_rdma_send_ctxt *ctxt,
-                                   __be32 *rdma_argp,
+                                   struct svc_rdma_send_ctxt *sctxt,
+                                   struct svc_rdma_recv_ctxt *rctxt,
                                    struct svc_rqst *rqstp,
                                    __be32 *wr_lst, __be32 *rp_ch)
 {
         int ret;
 
         if (!rp_ch) {
-                ret = svc_rdma_map_reply_msg(rdma, ctxt,
+                ret = svc_rdma_map_reply_msg(rdma, sctxt,
                                              &rqstp->rq_res, wr_lst);
                 if (ret < 0)
                         return ret;
         }
 
-        svc_rdma_save_io_pages(rqstp, ctxt);
+        svc_rdma_save_io_pages(rqstp, sctxt);
 
-        ctxt->sc_send_wr.opcode = IB_WR_SEND;
-        if (rdma->sc_snd_w_inv) {
-                ctxt->sc_send_wr.ex.invalidate_rkey =
-                        svc_rdma_get_inv_rkey(rdma_argp, wr_lst, rp_ch);
-                if (ctxt->sc_send_wr.ex.invalidate_rkey)
-                        ctxt->sc_send_wr.opcode = IB_WR_SEND_WITH_INV;
+        if (rctxt->rc_inv_rkey) {
+                sctxt->sc_send_wr.opcode = IB_WR_SEND_WITH_INV;
+                sctxt->sc_send_wr.ex.invalidate_rkey = rctxt->rc_inv_rkey;
+        } else {
+                sctxt->sc_send_wr.opcode = IB_WR_SEND;
         }
         dprintk("svcrdma: posting Send WR with %u sge(s)\n",
-                ctxt->sc_send_wr.num_sge);
-        return svc_rdma_send(rdma, &ctxt->sc_send_wr);
+                sctxt->sc_send_wr.num_sge);
+        return svc_rdma_send(rdma, &sctxt->sc_send_wr);
 }
 
 /* Given the client-provided Write and Reply chunks, the server was not
@@ -741,10 +714,6 @@ static int svc_rdma_send_error_msg(struct svcxprt_rdma *rdma,
         return 0;
 }
 
-void svc_rdma_prep_reply_hdr(struct svc_rqst *rqstp)
-{
-}
-
 /**
  * svc_rdma_sendto - Transmit an RPC reply
  * @rqstp: processed RPC request, reply XDR already in ::rq_res
@@ -809,7 +778,7 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
         }
 
         svc_rdma_sync_reply_hdr(rdma, sctxt, svc_rdma_reply_hdr_len(rdma_resp));
-        ret = svc_rdma_send_reply_msg(rdma, sctxt, rdma_argp, rqstp,
+        ret = svc_rdma_send_reply_msg(rdma, sctxt, rctxt, rqstp,
                                       wr_lst, rp_ch);
         if (ret < 0)
                 goto err1;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 2f7ec8912f49..924c17d46903 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -85,7 +85,6 @@ static const struct svc_xprt_ops svc_rdma_ops = {
         .xpo_release_rqst = svc_rdma_release_rqst,
         .xpo_detach = svc_rdma_detach,
         .xpo_free = svc_rdma_free,
-        .xpo_prep_reply_hdr = svc_rdma_prep_reply_hdr,
         .xpo_has_wspace = svc_rdma_has_wspace,
         .xpo_accept = svc_rdma_accept,
         .xpo_secure_port = svc_rdma_secure_port,
@@ -100,64 +99,6 @@ struct svc_xprt_class svc_rdma_class = {
         .xcl_ident = XPRT_TRANSPORT_RDMA,
 };
 
-#if defined(CONFIG_SUNRPC_BACKCHANNEL)
-static struct svc_xprt *svc_rdma_bc_create(struct svc_serv *, struct net *,
-                                           struct sockaddr *, int, int);
-static void svc_rdma_bc_detach(struct svc_xprt *);
-static void svc_rdma_bc_free(struct svc_xprt *);
-
-static const struct svc_xprt_ops svc_rdma_bc_ops = {
-        .xpo_create = svc_rdma_bc_create,
-        .xpo_detach = svc_rdma_bc_detach,
-        .xpo_free = svc_rdma_bc_free,
-        .xpo_prep_reply_hdr = svc_rdma_prep_reply_hdr,
-        .xpo_secure_port = svc_rdma_secure_port,
-};
-
-struct svc_xprt_class svc_rdma_bc_class = {
-        .xcl_name = "rdma-bc",
-        .xcl_owner = THIS_MODULE,
-        .xcl_ops = &svc_rdma_bc_ops,
-        .xcl_max_payload = (1024 - RPCRDMA_HDRLEN_MIN)
-};
-
-static struct svc_xprt *svc_rdma_bc_create(struct svc_serv *serv,
-                                           struct net *net,
-                                           struct sockaddr *sa, int salen,
-                                           int flags)
-{
-        struct svcxprt_rdma *cma_xprt;
-        struct svc_xprt *xprt;
-
-        cma_xprt = svc_rdma_create_xprt(serv, net);
-        if (!cma_xprt)
-                return ERR_PTR(-ENOMEM);
-        xprt = &cma_xprt->sc_xprt;
-
-        svc_xprt_init(net, &svc_rdma_bc_class, xprt, serv);
-        set_bit(XPT_CONG_CTRL, &xprt->xpt_flags);
-        serv->sv_bc_xprt = xprt;
-
-        dprintk("svcrdma: %s(%p)\n", __func__, xprt);
-        return xprt;
-}
-
-static void svc_rdma_bc_detach(struct svc_xprt *xprt)
-{
-        dprintk("svcrdma: %s(%p)\n", __func__, xprt);
-}
-
-static void svc_rdma_bc_free(struct svc_xprt *xprt)
-{
-        struct svcxprt_rdma *rdma =
-                container_of(xprt, struct svcxprt_rdma, sc_xprt);
-
-        dprintk("svcrdma: %s(%p)\n", __func__, xprt);
-        if (xprt)
-                kfree(rdma);
-}
-#endif  /* CONFIG_SUNRPC_BACKCHANNEL */
-
 /* QP event handler */
 static void qp_event_handler(struct ib_event *event, void *context)
 {
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index ae2a83828953..9141068693fa 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -827,7 +827,6 @@ static const struct rpc_xprt_ops xprt_rdma_procs = {
         .inject_disconnect      = xprt_rdma_inject_disconnect,
 #if defined(CONFIG_SUNRPC_BACKCHANNEL)
         .bc_setup               = xprt_rdma_bc_setup,
-        .bc_up                  = xprt_rdma_bc_up,
         .bc_maxpayload          = xprt_rdma_bc_maxpayload,
         .bc_free_rqst           = xprt_rdma_bc_free_rqst,
         .bc_destroy             = xprt_rdma_bc_destroy,
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index a13ccb643ce0..9218dbebedce 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -661,7 +661,6 @@ void xprt_rdma_cleanup(void);
  */
 #if defined(CONFIG_SUNRPC_BACKCHANNEL)
 int xprt_rdma_bc_setup(struct rpc_xprt *, unsigned int);
-int xprt_rdma_bc_up(struct svc_serv *, struct net *);
 size_t xprt_rdma_bc_maxpayload(struct rpc_xprt *);
 int rpcrdma_bc_post_recv(struct rpcrdma_xprt *, unsigned int);
 void rpcrdma_bc_receive_call(struct rpcrdma_xprt *, struct rpcrdma_rep *);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index f0b3700cec95..44467caf3cd8 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1400,17 +1400,6 @@ static void xs_tcp_force_close(struct rpc_xprt *xprt)
 }
 
 #if defined(CONFIG_SUNRPC_BACKCHANNEL)
-static int xs_tcp_bc_up(struct svc_serv *serv, struct net *net)
-{
-        int ret;
-
-        ret = svc_create_xprt(serv, "tcp-bc", net, PF_INET, 0,
-                              SVC_SOCK_ANONYMOUS);
-        if (ret < 0)
-                return ret;
-        return 0;
-}
-
 static size_t xs_tcp_bc_maxpayload(struct rpc_xprt *xprt)
 {
         return PAGE_SIZE;
@@ -2665,7 +2654,6 @@ static const struct rpc_xprt_ops xs_tcp_ops = {
         .inject_disconnect      = xs_inject_disconnect,
 #ifdef CONFIG_SUNRPC_BACKCHANNEL
         .bc_setup               = xprt_setup_bc,
-        .bc_up                  = xs_tcp_bc_up,
         .bc_maxpayload          = xs_tcp_bc_maxpayload,
         .bc_free_rqst           = xprt_free_bc_rqst,
         .bc_destroy             = xprt_destroy_bc,