Merge branch 'for-3.7' of git://linux-nfs.org/~bfields/linux

Pull nfsd update from J Bruce Fields:
 "Another relatively quiet cycle.  There was some progress on my
  remaining 4.1 todo's, but a couple of them were just of the form
  "check that we do X correctly", so didn't have much affect on the
  code.

  Other than that, a bunch of cleanup and some bugfixes (including an
  annoying NFSv4.0 state leak and a busy-loop in the server that could
  cause it to peg the CPU without making progress)."

* 'for-3.7' of git://linux-nfs.org/~bfields/linux: (46 commits)
  UAPI: (Scripted) Disintegrate include/linux/sunrpc
  UAPI: (Scripted) Disintegrate include/linux/nfsd
  nfsd4: don't allow reclaims of expired clients
  nfsd4: remove redundant callback probe
  nfsd4: expire old client earlier
  nfsd4: separate session allocation and initialization
  nfsd4: clean up session allocation
  nfsd4: minor free_session cleanup
  nfsd4: new_conn_from_crses should only allocate
  nfsd4: separate connection allocation and initialization
  nfsd4: reject bad forechannel attrs earlier
  nfsd4: enforce per-client sessions/no-sessions distinction
  nfsd4: set cl_minorversion at create time
  nfsd4: don't pin clientids to pseudoflavors
  nfsd4: fix bind_conn_to_session xdr comment
  nfsd4: cast readlink() bug argument
  NFSD: pass null terminated buf to kstrtouint()
  nfsd: remove duplicate init in nfsd4_cb_recall
  nfsd4: eliminate redundant nfs4_free_stateid
  fs/nfsd/nfs4idmap.c: adjust inconsistent IS_ERR and PTR_ERR
  ...

15 files changed, 227 insertions, 305 deletions

diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 7e355870d519..a2aa97d45670 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -126,7 +126,7 @@ static void restart_grace(void)
 static int
 lockd(void *vrqstp)
 {
-        int             err = 0, preverr = 0;
+        int             err = 0;
         struct svc_rqst *rqstp = vrqstp;
 
         /* try_to_freeze() is called from svc_recv() */
@@ -165,21 +165,8 @@ lockd(void *vrqstp)
                  * recvfrom routine.
                  */
                 err = svc_recv(rqstp, timeout);
-                if (err == -EAGAIN || err == -EINTR) {
-                        preverr = err;
+                if (err == -EAGAIN || err == -EINTR)
                         continue;
-                }
-                if (err < 0) {
-                        if (err != preverr) {
-                                printk(KERN_WARNING "%s: unexpected error "
-                                        "from svc_recv (%d)\n", __func__, err);
-                                preverr = err;
-                        }
-                        schedule_timeout_interruptible(HZ);
-                        continue;
-                }
-                preverr = err;
-
                 dprintk("lockd: request from %s\n",
                                 svc_print_addr(rqstp, buf, sizeof(buf)));
 
diff --git a/fs/locks.c b/fs/locks.c
index abc7dc6c490b..a94e331a52a2 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1289,7 +1289,7 @@ EXPORT_SYMBOL(__break_lease);
 void lease_get_mtime(struct inode *inode, struct timespec *time)
 {
         struct file_lock *flock = inode->i_flock;
-        if (flock && IS_LEASE(flock) && (flock->fl_type & F_WRLCK))
+        if (flock && IS_LEASE(flock) && (flock->fl_type == F_WRLCK))
                 *time = current_fs_time(inode->i_sb);
         else
                 *time = inode->i_mtime;
@@ -2185,8 +2185,8 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
         } else {
                 seq_printf(f, "%s ",
                                (lease_breaking(fl))
-                               ? (fl->fl_type & F_UNLCK) ? "UNLCK" : "READ "
-                               : (fl->fl_type & F_WRLCK) ? "WRITE" : "READ ");
+                               ? (fl->fl_type == F_UNLCK) ? "UNLCK" : "READ "
+                               : (fl->fl_type == F_WRLCK) ? "WRITE" : "READ ");
         }
         if (inode) {
 #ifdef WE_CAN_BREAK_LSLK_NOW
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 2245bef50f37..9a521fb39869 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -72,7 +72,7 @@ out_err:
 static int
 nfs4_callback_svc(void *vrqstp)
 {
-        int err, preverr = 0;
+        int err;
         struct svc_rqst *rqstp = vrqstp;
 
         set_freezable();
@@ -82,20 +82,8 @@ nfs4_callback_svc(void *vrqstp)
                  * Listen for a request on the socket
                  */
                 err = svc_recv(rqstp, MAX_SCHEDULE_TIMEOUT);
-                if (err == -EAGAIN || err == -EINTR) {
-                        preverr = err;
+                if (err == -EAGAIN || err == -EINTR)
                         continue;
-                }
-                if (err < 0) {
-                        if (err != preverr) {
-                                printk(KERN_WARNING "NFS: %s: unexpected error "
-                                        "from svc_recv (%d)\n", __func__, err);
-                                preverr = err;
-                        }
-                        schedule_timeout_uninterruptible(HZ);
-                        continue;
-                }
-                preverr = err;
                 svc_process(rqstp);
         }
         return 0;
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 6aa5590c3679..b314888825d5 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -218,8 +218,7 @@ static int nfsaclsvc_decode_accessargs(struct svc_rqst *rqstp, __be32 *p,
  * There must be an encoding function for void results so svc_process
  * will work properly.
  */
-int
-nfsaclsvc_encode_voidres(struct svc_rqst *rqstp, __be32 *p, void *dummy)
+static int nfsaclsvc_encode_voidres(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index 9095f3c21df9..97d90d1c8608 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -247,7 +247,7 @@ nfsd3_proc_create(struct svc_rqst *rqstp, struct nfsd3_createargs *argp,
         /* Now create the file and set attributes */
         nfserr = do_nfsd_create(rqstp, dirfhp, argp->name, argp->len,
                                 attr, newfhp,
-                                argp->createmode, argp->verf, NULL, NULL);
+                                argp->createmode, (u32 *)argp->verf, NULL, NULL);
 
         RETURN_STATUS(nfserr);
 }
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 4c7bd35b1876..bdf29c96e4cd 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -1028,7 +1028,6 @@ void nfsd4_cb_recall(struct nfs4_delegation *dp)
         cb->cb_msg.rpc_cred = callback_cred;
 
         cb->cb_ops = &nfsd4_cb_recall_ops;
-        dp->dl_retries = 1;
 
         INIT_LIST_HEAD(&cb->cb_per_client);
         cb->cb_done = true;
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index fdc91a6fc9c4..a1f10c0a6255 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -478,7 +478,7 @@ nfsd_idmap_init(struct net *net)
                 goto destroy_idtoname_cache;
         nn->nametoid_cache = cache_create_net(&nametoid_cache_template, net);
         if (IS_ERR(nn->nametoid_cache)) {
-                rv = PTR_ERR(nn->idtoname_cache);
+                rv = PTR_ERR(nn->nametoid_cache);
                 goto unregister_idtoname_cache;
         }
         rv = cache_register_net(nn->nametoid_cache, net);
@@ -598,7 +598,7 @@ numeric_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namel
         /* Just to make sure it's null-terminated: */
         memcpy(buf, name, namelen);
         buf[namelen] = '\0';
-        ret = kstrtouint(name, 10, id);
+        ret = kstrtouint(buf, 10, id);
         return ret == 0;
 }
 
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index c9c1c0a25417..6c9a4b291dba 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -370,7 +370,7 @@ nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         break;
                 case NFS4_OPEN_CLAIM_PREVIOUS:
                         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
-                        status = nfs4_check_open_reclaim(&open->op_clientid);
+                        status = nfs4_check_open_reclaim(&open->op_clientid, cstate->minorversion);
                         if (status)
                                 goto out;
                 case NFS4_OPEN_CLAIM_FH:
@@ -1054,8 +1054,8 @@ struct nfsd4_operation {
         char *op_name;
         /* Try to get response size before operation */
         nfsd4op_rsize op_rsize_bop;
-        stateid_setter op_get_currentstateid;
-        stateid_getter op_set_currentstateid;
+        stateid_getter op_get_currentstateid;
+        stateid_setter op_set_currentstateid;
 };
 
 static struct nfsd4_operation nfsd4_ops[];
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 48a1bad37334..d0237f872cc4 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -758,7 +758,7 @@ static void nfsd4_put_drc_mem(int slotsize, int num)
         spin_unlock(&nfsd_drc_lock);
 }
 
-static struct nfsd4_session *alloc_session(int slotsize, int numslots)
+static struct nfsd4_session *__alloc_session(int slotsize, int numslots)
 {
         struct nfsd4_session *new;
         int mem, i;
@@ -852,35 +852,28 @@ static int nfsd4_register_conn(struct nfsd4_conn *conn)
         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
 }
 
-static __be32 nfsd4_new_conn(struct svc_rqst *rqstp, struct nfsd4_session *ses, u32 dir)
+static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
 {
-        struct nfsd4_conn *conn;
         int ret;
 
-        conn = alloc_conn(rqstp, dir);
-        if (!conn)
-                return nfserr_jukebox;
         nfsd4_hash_conn(conn, ses);
         ret = nfsd4_register_conn(conn);
         if (ret)
                 /* oops; xprt is already down: */
                 nfsd4_conn_lost(&conn->cn_xpt_user);
-        if (ses->se_client->cl_cb_state == NFSD4_CB_DOWN &&
-                dir & NFS4_CDFC4_BACK) {
+        if (conn->cn_flags & NFS4_CDFC4_BACK) {
                 /* callback channel may be back up */
                 nfsd4_probe_callback(ses->se_client);
         }
-        return nfs_ok;
 }
 
-static __be32 nfsd4_new_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_session *ses)
+static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
 {
         u32 dir = NFS4_CDFC4_FORE;
 
-        if (ses->se_flags & SESSION4_BACK_CHAN)
+        if (cses->flags & SESSION4_BACK_CHAN)
                 dir |= NFS4_CDFC4_BACK;
-
-        return nfsd4_new_conn(rqstp, ses, dir);
+        return alloc_conn(rqstp, dir);
 }
 
 /* must be called under client_lock */
@@ -903,20 +896,21 @@ static void nfsd4_del_conns(struct nfsd4_session *s)
         spin_unlock(&clp->cl_lock);
 }
 
+static void __free_session(struct nfsd4_session *ses)
+{
+        nfsd4_put_drc_mem(slot_bytes(&ses->se_fchannel), ses->se_fchannel.maxreqs);
+        free_session_slots(ses);
+        kfree(ses);
+}
+
 static void free_session(struct kref *kref)
 {
         struct nfsd4_session *ses;
-        int mem;
 
         lockdep_assert_held(&client_lock);
         ses = container_of(kref, struct nfsd4_session, se_ref);
         nfsd4_del_conns(ses);
-        spin_lock(&nfsd_drc_lock);
-        mem = ses->se_fchannel.maxreqs * slot_bytes(&ses->se_fchannel);
-        nfsd_drc_mem_used -= mem;
-        spin_unlock(&nfsd_drc_lock);
-        free_session_slots(ses);
-        kfree(ses);
+        __free_session(ses);
 }
 
 void nfsd4_put_session(struct nfsd4_session *ses)
@@ -926,14 +920,10 @@ void nfsd4_put_session(struct nfsd4_session *ses)
         spin_unlock(&client_lock);
 }
 
-static struct nfsd4_session *alloc_init_session(struct svc_rqst *rqstp, struct nfs4_client *clp, struct nfsd4_create_session *cses)
+static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fchan)
 {
         struct nfsd4_session *new;
-        struct nfsd4_channel_attrs *fchan = &cses->fore_channel;
         int numslots, slotsize;
-        __be32 status;
-        int idx;
-
         /*
          * Note decreasing slot size below client's request may
          * make it difficult for client to function correctly, whereas
@@ -946,12 +936,18 @@ static struct nfsd4_session *alloc_init_session(struct svc_rqst *rqstp, struct n
         if (numslots < 1)
                 return NULL;
 
-        new = alloc_session(slotsize, numslots);
+        new = __alloc_session(slotsize, numslots);
         if (!new) {
                 nfsd4_put_drc_mem(slotsize, fchan->maxreqs);
                 return NULL;
         }
         init_forechannel_attrs(&new->se_fchannel, fchan, numslots, slotsize);
+        return new;
+}
+
+static struct nfsd4_session *init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
+{
+        int idx;
 
         new->se_client = clp;
         gen_sessionid(new);
@@ -970,14 +966,6 @@ static struct nfsd4_session *alloc_init_session(struct svc_rqst *rqstp, struct n
         spin_unlock(&clp->cl_lock);
         spin_unlock(&client_lock);
 
-        status = nfsd4_new_conn_from_crses(rqstp, new);
-        /* whoops: benny points out, status is ignored! (err, or bogus) */
-        if (status) {
-                spin_lock(&client_lock);
-                free_session(&new->se_ref);
-                spin_unlock(&client_lock);
-                return NULL;
-        }
         if (cses->flags & SESSION4_BACK_CHAN) {
                 struct sockaddr *sa = svc_addr(rqstp);
                 /*
@@ -990,7 +978,6 @@ static struct nfsd4_session *alloc_init_session(struct svc_rqst *rqstp, struct n
                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
         }
-        nfsd4_probe_callback(clp);
         return new;
 }
 
@@ -1131,7 +1118,7 @@ unhash_client_locked(struct nfs4_client *clp)
 }
 
 static void
-expire_client(struct nfs4_client *clp)
+destroy_client(struct nfs4_client *clp)
 {
         struct nfs4_openowner *oo;
         struct nfs4_delegation *dp;
@@ -1165,6 +1152,12 @@ expire_client(struct nfs4_client *clp)
         spin_unlock(&client_lock);
 }
 
+static void expire_client(struct nfs4_client *clp)
+{
+        nfsd4_client_record_remove(clp);
+        destroy_client(clp);
+}
+
 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
 {
         memcpy(target->cl_verifier.data, source->data,
@@ -1223,10 +1216,26 @@ static bool groups_equal(struct group_info *g1, struct group_info *g2)
         return true;
 }
 
+/*
+ * RFC 3530 language requires clid_inuse be returned when the
+ * "principal" associated with a requests differs from that previously
+ * used.  We use uid, gid's, and gss principal string as our best
+ * approximation.  We also don't want to allow non-gss use of a client
+ * established using gss: in theory cr_principal should catch that
+ * change, but in practice cr_principal can be null even in the gss case
+ * since gssd doesn't always pass down a principal string.
+ */
+static bool is_gss_cred(struct svc_cred *cr)
+{
+        /* Is cr_flavor one of the gss "pseudoflavors"?: */
+        return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
+}
+
+
 static bool
 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
 {
-        if ((cr1->cr_flavor != cr2->cr_flavor)
+        if ((is_gss_cred(cr1) != is_gss_cred(cr2))
                 || (cr1->cr_uid != cr2->cr_uid)
                 || (cr1->cr_gid != cr2->cr_gid)
                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
@@ -1340,13 +1349,15 @@ move_to_confirmed(struct nfs4_client *clp)
 }
 
 static struct nfs4_client *
-find_confirmed_client(clientid_t *clid)
+find_confirmed_client(clientid_t *clid, bool sessions)
 {
         struct nfs4_client *clp;
         unsigned int idhashval = clientid_hashval(clid->cl_id);
 
         list_for_each_entry(clp, &conf_id_hashtbl[idhashval], cl_idhash) {
                 if (same_clid(&clp->cl_clientid, clid)) {
+                        if ((bool)clp->cl_minorversion != sessions)
+                                return NULL;
                         renew_client(clp);
                         return clp;
                 }
@@ -1355,14 +1366,17 @@ find_confirmed_client(clientid_t *clid)
 }
 
 static struct nfs4_client *
-find_unconfirmed_client(clientid_t *clid)
+find_unconfirmed_client(clientid_t *clid, bool sessions)
 {
         struct nfs4_client *clp;
         unsigned int idhashval = clientid_hashval(clid->cl_id);
 
         list_for_each_entry(clp, &unconf_id_hashtbl[idhashval], cl_idhash) {
-                if (same_clid(&clp->cl_clientid, clid))
+                if (same_clid(&clp->cl_clientid, clid)) {
+                        if ((bool)clp->cl_minorversion != sessions)
+                                return NULL;
                         return clp;
+                }
         }
         return NULL;
 }
@@ -1651,6 +1665,7 @@ out_new:
                 status = nfserr_jukebox;
                 goto out;
         }
+        new->cl_minorversion = 1;
 
         gen_clid(new);
         add_to_unconfirmed(new, strhashval);
@@ -1743,67 +1758,71 @@ nfsd4_create_session(struct svc_rqst *rqstp,
         struct sockaddr *sa = svc_addr(rqstp);
         struct nfs4_client *conf, *unconf;
         struct nfsd4_session *new;
+        struct nfsd4_conn *conn;
         struct nfsd4_clid_slot *cs_slot = NULL;
-        bool confirm_me = false;
         __be32 status = 0;
 
         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
                 return nfserr_inval;
+        if (check_forechannel_attrs(cr_ses->fore_channel))
+                return nfserr_toosmall;
+        new = alloc_session(&cr_ses->fore_channel);
+        if (!new)
+                return nfserr_jukebox;
+        status = nfserr_jukebox;
+        conn = alloc_conn_from_crses(rqstp, cr_ses);
+        if (!conn)
+                goto out_free_session;
 
         nfs4_lock_state();
-        unconf = find_unconfirmed_client(&cr_ses->clientid);
-        conf = find_confirmed_client(&cr_ses->clientid);
+        unconf = find_unconfirmed_client(&cr_ses->clientid, true);
+        conf = find_confirmed_client(&cr_ses->clientid, true);
 
         if (conf) {
                 cs_slot = &conf->cl_cs_slot;
                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
                 if (status == nfserr_replay_cache) {
                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
-                        goto out;
+                        goto out_free_conn;
                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
                         status = nfserr_seq_misordered;
-                        goto out;
+                        goto out_free_conn;
                 }
         } else if (unconf) {
+                unsigned int hash;
+                struct nfs4_client *old;
                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
                         status = nfserr_clid_inuse;
-                        goto out;
+                        goto out_free_conn;
                 }
                 cs_slot = &unconf->cl_cs_slot;
                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
                 if (status) {
                         /* an unconfirmed replay returns misordered */
                         status = nfserr_seq_misordered;
-                        goto out;
+                        goto out_free_conn;
                 }
-                confirm_me = true;
+                hash = clientstr_hashval(unconf->cl_recdir);
+                old = find_confirmed_client_by_str(unconf->cl_recdir, hash);
+                if (old)
+                        expire_client(old);
+                move_to_confirmed(unconf);
                 conf = unconf;
         } else {
                 status = nfserr_stale_clientid;
-                goto out;
+                goto out_free_conn;
         }
-
-        /*
-         * XXX: we should probably set this at creation time, and check
-         * for consistent minorversion use throughout:
-         */
-        conf->cl_minorversion = 1;
+        status = nfs_ok;
         /*
          * We do not support RDMA or persistent sessions
          */
         cr_ses->flags &= ~SESSION4_PERSIST;
         cr_ses->flags &= ~SESSION4_RDMA;
 
-        status = nfserr_toosmall;
-        if (check_forechannel_attrs(cr_ses->fore_channel))
-                goto out;
+        init_session(rqstp, new, conf, cr_ses);
+        nfsd4_init_conn(rqstp, conn, new);
 
-        status = nfserr_jukebox;
-        new = alloc_init_session(rqstp, conf, cr_ses);
-        if (!new)
-                goto out;
-        status = nfs_ok;
         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
                NFS4_MAX_SESSIONID_LEN);
         memcpy(&cr_ses->fore_channel, &new->se_fchannel,
@@ -1813,18 +1832,15 @@ nfsd4_create_session(struct svc_rqst *rqstp,
 
         /* cache solo and embedded create sessions under the state lock */
         nfsd4_cache_create_session(cr_ses, cs_slot, status);
-        if (confirm_me) {
-                unsigned int hash = clientstr_hashval(unconf->cl_recdir);
-                struct nfs4_client *old =
-                        find_confirmed_client_by_str(conf->cl_recdir, hash);
-                if (old)
-                        expire_client(old);
-                move_to_confirmed(conf);
-        }
 out:
         nfs4_unlock_state();
         dprintk("%s returns %d\n", __func__, ntohl(status));
         return status;
+out_free_conn:
+        free_conn(conn);
+out_free_session:
+        __free_session(new);
+        goto out;
 }
 
 static bool nfsd4_last_compound_op(struct svc_rqst *rqstp)
@@ -1854,6 +1870,7 @@ __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
                      struct nfsd4_bind_conn_to_session *bcts)
 {
         __be32 status;
+        struct nfsd4_conn *conn;
 
         if (!nfsd4_last_compound_op(rqstp))
                 return nfserr_not_only_op;
@@ -1870,9 +1887,13 @@ __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
                 return nfserr_badsession;
 
         status = nfsd4_map_bcts_dir(&bcts->dir);
-        if (!status)
-                nfsd4_new_conn(rqstp, cstate->session, bcts->dir);
-        return status;
+        if (status)
+                return status;
+        conn = alloc_conn(rqstp, bcts->dir);
+        if (!conn)
+                return nfserr_jukebox;
+        nfsd4_init_conn(rqstp, conn, cstate->session);
+        return nfs_ok;
 }
 
 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
@@ -2085,8 +2106,8 @@ nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *csta
         __be32 status = 0;
 
         nfs4_lock_state();
-        unconf = find_unconfirmed_client(&dc->clientid);
-        conf = find_confirmed_client(&dc->clientid);
+        unconf = find_unconfirmed_client(&dc->clientid, true);
+        conf = find_confirmed_client(&dc->clientid, true);
 
         if (conf) {
                 clp = conf;
@@ -2200,10 +2221,6 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 copy_clid(new, conf);
         else /* case 4 (new client) or cases 2, 3 (client reboot): */
                 gen_clid(new);
-        /*
-         * XXX: we should probably set this at creation time, and check
-         * for consistent minorversion use throughout:
-         */
         new->cl_minorversion = 0;
         gen_callback(new, setclid, rqstp);
         add_to_unconfirmed(new, strhashval);
@@ -2232,8 +2249,8 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                 return nfserr_stale_clientid;
         nfs4_lock_state();
 
-        conf = find_confirmed_client(clid);
-        unconf = find_unconfirmed_client(clid);
+        conf = find_confirmed_client(clid, false);
+        unconf = find_unconfirmed_client(clid, false);
         /*
          * We try hard to give out unique clientid's, so if we get an
          * attempt to confirm the same clientid with a different cred,
@@ -2262,10 +2279,8 @@ nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                 unsigned int hash = clientstr_hashval(unconf->cl_recdir);
 
                 conf = find_confirmed_client_by_str(unconf->cl_recdir, hash);
-                if (conf) {
-                        nfsd4_client_record_remove(conf);
+                if (conf)
                         expire_client(conf);
-                }
                 move_to_confirmed(unconf);
                 nfsd4_probe_callback(unconf);
         }
@@ -2447,16 +2462,20 @@ same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
 }
 
 static struct nfs4_openowner *
-find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open)
+find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open, bool sessions)
 {
         struct nfs4_stateowner *so;
         struct nfs4_openowner *oo;
+        struct nfs4_client *clp;
 
         list_for_each_entry(so, &ownerstr_hashtbl[hashval], so_strhash) {
                 if (!so->so_is_open_owner)
                         continue;
                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
                         oo = openowner(so);
+                        clp = oo->oo_owner.so_client;
+                        if ((bool)clp->cl_minorversion != sessions)
+                                return NULL;
                         renew_client(oo->oo_owner.so_client);
                         return oo;
                 }
@@ -2600,10 +2619,10 @@ nfsd4_process_open1(struct nfsd4_compound_state *cstate,
                 return nfserr_jukebox;
 
         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
-        oo = find_openstateowner_str(strhashval, open);
+        oo = find_openstateowner_str(strhashval, open, cstate->minorversion);
         open->op_openowner = oo;
         if (!oo) {
-                clp = find_confirmed_client(clientid);
+                clp = find_confirmed_client(clientid, cstate->minorversion);
                 if (clp == NULL)
                         return nfserr_expired;
                 goto new_owner;
@@ -2705,11 +2724,6 @@ nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_ol_st
         return nfs_ok;
 }
 
-static void nfs4_free_stateid(struct nfs4_ol_stateid *s)
-{
-        kmem_cache_free(stateid_slab, s);
-}
-
 static inline int nfs4_access_to_access(u32 nfs4_access)
 {
         int flags = 0;
@@ -3087,7 +3101,7 @@ void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
         if (open->op_file)
                 nfsd4_free_file(open->op_file);
         if (open->op_stp)
-                nfs4_free_stateid(open->op_stp);
+                free_generic_stateid(open->op_stp);
 }
 
 __be32
@@ -3104,7 +3118,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         status = nfserr_stale_clientid;
         if (STALE_CLIENTID(clid, nn))
                 goto out;
-        clp = find_confirmed_client(clid);
+        clp = find_confirmed_client(clid, cstate->minorversion);
         status = nfserr_expired;
         if (clp == NULL) {
                 /* We assume the client took too long to RENEW. */
@@ -3180,7 +3194,6 @@ nfs4_laundromat(void)
                 clp = list_entry(pos, struct nfs4_client, cl_lru);
                 dprintk("NFSD: purging unused client (clientid %08x)\n",
                         clp->cl_clientid.cl_id);
-                nfsd4_client_record_remove(clp);
                 expire_client(clp);
         }
         spin_lock(&recall_lock);
@@ -3372,7 +3385,7 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
         return nfs_ok;
 }
 
-static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
+static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s, bool sessions)
 {
         struct nfs4_client *cl;
         struct nfsd_net *nn = net_generic(&init_net, nfsd_net_id);
@@ -3381,7 +3394,7 @@ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, s
                 return nfserr_bad_stateid;
         if (STALE_STATEID(stateid, nn))
                 return nfserr_stale_stateid;
-        cl = find_confirmed_client(&stateid->si_opaque.so_clid);
+        cl = find_confirmed_client(&stateid->si_opaque.so_clid, sessions);
         if (!cl)
                 return nfserr_expired;
         *s = find_stateid_by_type(cl, stateid, typemask);
@@ -3414,7 +3427,7 @@ nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
                 return check_special_stateids(net, current_fh, stateid, flags);
 
-        status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID, &s);
+        status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID, &s, cstate->minorversion);
         if (status)
                 return status;
         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
@@ -3564,7 +3577,7 @@ nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
                 seqid, STATEID_VAL(stateid));
 
         *stpp = NULL;
-        status = nfsd4_lookup_stateid(stateid, typemask, &s);
+        status = nfsd4_lookup_stateid(stateid, typemask, &s, cstate->minorversion);
         if (status)
                 return status;
         *stpp = openlockstateid(s);
@@ -3765,6 +3778,7 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
 
         nfsd4_close_open_stateid(stp);
+        release_last_closed_stateid(oo);
         oo->oo_last_closed_stid = stp;
 
         if (list_empty(&oo->oo_owner.so_stateids)) {
@@ -3801,7 +3815,7 @@ nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         inode = cstate->current_fh.fh_dentry->d_inode;
 
         nfs4_lock_state();
-        status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID, &s);
+        status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID, &s, cstate->minorversion);
         if (status)
                 goto out;
         dp = delegstateid(s);
@@ -4045,8 +4059,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         struct nfs4_lockowner *lock_sop = NULL;
         struct nfs4_ol_stateid *lock_stp;
         struct file *filp = NULL;
-        struct file_lock file_lock;
-        struct file_lock conflock;
+        struct file_lock *file_lock = NULL;
+        struct file_lock *conflock = NULL;
         __be32 status = 0;
         bool new_state = false;
         int lkflg;
@@ -4116,21 +4130,28 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         if (!locks_in_grace(SVC_NET(rqstp)) && lock->lk_reclaim)
                 goto out;
 
-        locks_init_lock(&file_lock);
+        file_lock = locks_alloc_lock();
+        if (!file_lock) {
+                dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
+                status = nfserr_jukebox;
+                goto out;
+        }
+
+        locks_init_lock(file_lock);
         switch (lock->lk_type) {
                 case NFS4_READ_LT:
                 case NFS4_READW_LT:
                         filp = find_readable_file(lock_stp->st_file);
                         if (filp)
                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
-                        file_lock.fl_type = F_RDLCK;
+                        file_lock->fl_type = F_RDLCK;
                         break;
                 case NFS4_WRITE_LT:
                 case NFS4_WRITEW_LT:
                         filp = find_writeable_file(lock_stp->st_file);
                         if (filp)
                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
-                        file_lock.fl_type = F_WRLCK;
+                        file_lock->fl_type = F_WRLCK;
                         break;
                 default:
                         status = nfserr_inval;
@@ -4140,22 +4161,23 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 status = nfserr_openmode;
                 goto out;
         }
-        file_lock.fl_owner = (fl_owner_t)lock_sop;
-        file_lock.fl_pid = current->tgid;
-        file_lock.fl_file = filp;
-        file_lock.fl_flags = FL_POSIX;
-        file_lock.fl_lmops = &nfsd_posix_mng_ops;
-
-        file_lock.fl_start = lock->lk_offset;
-        file_lock.fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
-        nfs4_transform_lock_offset(&file_lock);
-
-        /*
-        * Try to lock the file in the VFS.
-        * Note: locks.c uses the BKL to protect the inode's lock list.
-        */
+        file_lock->fl_owner = (fl_owner_t)lock_sop;
+        file_lock->fl_pid = current->tgid;
+        file_lock->fl_file = filp;
+        file_lock->fl_flags = FL_POSIX;
+        file_lock->fl_lmops = &nfsd_posix_mng_ops;
+        file_lock->fl_start = lock->lk_offset;
+        file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
+        nfs4_transform_lock_offset(file_lock);
+
+        conflock = locks_alloc_lock();
+        if (!conflock) {
+                dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
+                status = nfserr_jukebox;
+                goto out;
+        }
 
-        err = vfs_lock_file(filp, F_SETLK, &file_lock, &conflock);
+        err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
         switch (-err) {
         case 0: /* success! */
                 update_stateid(&lock_stp->st_stid.sc_stateid);
@@ -4166,7 +4188,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         case (EAGAIN):          /* conflock holds conflicting lock */
                 status = nfserr_denied;
                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
-                nfs4_set_lock_denied(&conflock, &lock->lk_denied);
+                nfs4_set_lock_denied(conflock, &lock->lk_denied);
                 break;
         case (EDEADLK):
                 status = nfserr_deadlock;
@@ -4181,6 +4203,10 @@ out:
                 release_lockowner(lock_sop);
         if (!cstate->replay_owner)
                 nfs4_unlock_state();
+        if (file_lock)
+                locks_free_lock(file_lock);
+        if (conflock)
+                locks_free_lock(conflock);
         return status;
 }
 
@@ -4209,7 +4235,7 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
             struct nfsd4_lockt *lockt)
 {
         struct inode *inode;
-        struct file_lock file_lock;
+        struct file_lock *file_lock = NULL;
         struct nfs4_lockowner *lo;
         __be32 status;
         struct nfsd_net *nn = net_generic(&init_net, nfsd_net_id);
@@ -4230,15 +4256,21 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 goto out;
 
         inode = cstate->current_fh.fh_dentry->d_inode;
-        locks_init_lock(&file_lock);
+        file_lock = locks_alloc_lock();
+        if (!file_lock) {
+                dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
+                status = nfserr_jukebox;
+                goto out;
+        }
+        locks_init_lock(file_lock);
         switch (lockt->lt_type) {
                 case NFS4_READ_LT:
                 case NFS4_READW_LT:
-                        file_lock.fl_type = F_RDLCK;
+                        file_lock->fl_type = F_RDLCK;
                 break;
                 case NFS4_WRITE_LT:
                 case NFS4_WRITEW_LT:
-                        file_lock.fl_type = F_WRLCK;
+                        file_lock->fl_type = F_WRLCK;
                 break;
                 default:
                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
@@ -4248,25 +4280,27 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 
         lo = find_lockowner_str(inode, &lockt->lt_clientid, &lockt->lt_owner);
         if (lo)
-                file_lock.fl_owner = (fl_owner_t)lo;
-        file_lock.fl_pid = current->tgid;
-        file_lock.fl_flags = FL_POSIX;
+                file_lock->fl_owner = (fl_owner_t)lo;
+        file_lock->fl_pid = current->tgid;
+        file_lock->fl_flags = FL_POSIX;
 
-        file_lock.fl_start = lockt->lt_offset;
-        file_lock.fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
+        file_lock->fl_start = lockt->lt_offset;
+        file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
 
-        nfs4_transform_lock_offset(&file_lock);
+        nfs4_transform_lock_offset(file_lock);
 
-        status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+        status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
         if (status)
                 goto out;
 
-        if (file_lock.fl_type != F_UNLCK) {
+        if (file_lock->fl_type != F_UNLCK) {
                 status = nfserr_denied;
-                nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
+                nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
         }
 out:
         nfs4_unlock_state();
+        if (file_lock)
+                locks_free_lock(file_lock);
         return status;
 }
 
@@ -4276,7 +4310,7 @@ nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 {
         struct nfs4_ol_stateid *stp;
         struct file *filp = NULL;
-        struct file_lock file_lock;
+        struct file_lock *file_lock = NULL;
         __be32 status;
         int err;
                                                         
@@ -4298,23 +4332,29 @@ nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 status = nfserr_lock_range;
                 goto out;
         }
-        BUG_ON(!filp);
-        locks_init_lock(&file_lock);
-        file_lock.fl_type = F_UNLCK;
-        file_lock.fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
-        file_lock.fl_pid = current->tgid;
-        file_lock.fl_file = filp;
-        file_lock.fl_flags = FL_POSIX; 
-        file_lock.fl_lmops = &nfsd_posix_mng_ops;
-        file_lock.fl_start = locku->lu_offset;
-
-        file_lock.fl_end = last_byte_offset(locku->lu_offset, locku->lu_length);
-        nfs4_transform_lock_offset(&file_lock);
+        file_lock = locks_alloc_lock();
+        if (!file_lock) {
+                dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
+                status = nfserr_jukebox;
+                goto out;
+        }
+        locks_init_lock(file_lock);
+        file_lock->fl_type = F_UNLCK;
+        file_lock->fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
+        file_lock->fl_pid = current->tgid;
+        file_lock->fl_file = filp;
+        file_lock->fl_flags = FL_POSIX;
+        file_lock->fl_lmops = &nfsd_posix_mng_ops;
+        file_lock->fl_start = locku->lu_offset;
+
+        file_lock->fl_end = last_byte_offset(locku->lu_offset,
+                                                locku->lu_length);
+        nfs4_transform_lock_offset(file_lock);
 
         /*
         *  Try to unlock the file in the VFS.
         */
-        err = vfs_lock_file(filp, F_SETLK, &file_lock, NULL);
+        err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
         if (err) {
                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
                 goto out_nfserr;
@@ -4328,6 +4368,8 @@ nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 out:
         if (!cstate->replay_owner)
                 nfs4_unlock_state();
+        if (file_lock)
+                locks_free_lock(file_lock);
         return status;
 
 out_nfserr:
@@ -4501,12 +4543,12 @@ nfsd4_find_reclaim_client(struct nfs4_client *clp)
 * Called from OPEN. Look for clientid in reclaim list.
 */
 __be32
-nfs4_check_open_reclaim(clientid_t *clid)
+nfs4_check_open_reclaim(clientid_t *clid, bool sessions)
 {
         struct nfs4_client *clp;
 
         /* find clientid in conf_id_hashtbl */
-        clp = find_confirmed_client(clid);
+        clp = find_confirmed_client(clid, sessions);
         if (clp == NULL)
                 return nfserr_reclaim_bad;
 
@@ -4522,7 +4564,6 @@ void nfsd_forget_clients(u64 num)
 
         nfs4_lock_state();
         list_for_each_entry_safe(clp, next, &client_lru, cl_lru) {
-                nfsd4_client_record_remove(clp);
                 expire_client(clp);
                 if (++count == num)
                         break;
@@ -4582,7 +4623,7 @@ void nfsd_forget_openowners(u64 num)
         printk(KERN_INFO "NFSD: Forgot %d open owners", count);
 }
 
-int nfsd_process_n_delegations(u64 num, struct list_head *list)
+static int nfsd_process_n_delegations(u64 num, struct list_head *list)
 {
         int i, count = 0;
         struct nfs4_file *fp, *fnext;
@@ -4747,11 +4788,11 @@ __nfs4_state_shutdown(void)
         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
                 while (!list_empty(&conf_id_hashtbl[i])) {
                         clp = list_entry(conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
-                        expire_client(clp);
+                        destroy_client(clp);
                 }
                 while (!list_empty(&unconf_str_hashtbl[i])) {
                         clp = list_entry(unconf_str_hashtbl[i].next, struct nfs4_client, cl_strhash);
-                        expire_client(clp);
+                        destroy_client(clp);
                 }
         }
         INIT_LIST_HEAD(&reaplist);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 6322df36031f..fd548d155088 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2659,7 +2659,7 @@ static __be32 nfsd4_encode_bind_conn_to_session(struct nfsd4_compoundres *resp,
                 RESERVE_SPACE(NFS4_MAX_SESSIONID_LEN + 8);
                 WRITEMEM(bcts->sessionid.data, NFS4_MAX_SESSIONID_LEN);
                 WRITE32(bcts->dir);
-                /* XXX: ? */
+                /* Sorry, we do not yet support RDMA over 4.1: */
                 WRITE32(0);
                 ADJUST_ARGS();
         }
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index fa49cff5ee65..dab350dfc376 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -406,7 +406,7 @@ static ssize_t write_threads(struct file *file, char *buf, size_t size)
                         return rv;
                 if (newthreads < 0)
                         return -EINVAL;
-                rv = nfsd_svc(NFS_PORT, newthreads);
+                rv = nfsd_svc(newthreads);
                 if (rv < 0)
                         return rv;
         } else
@@ -683,25 +683,6 @@ static ssize_t __write_ports_addfd(char *buf)
 }
 
 /*
- * A '-' followed by the 'name' of a socket means we close the socket.
- */
-static ssize_t __write_ports_delfd(char *buf)
-{
-        char *toclose;
-        int len = 0;
-
-        toclose = kstrdup(buf + 1, GFP_KERNEL);
-        if (toclose == NULL)
-                return -ENOMEM;
-
-        if (nfsd_serv != NULL)
-                len = svc_sock_names(nfsd_serv, buf,
-                                        SIMPLE_TRANSACTION_LIMIT, toclose);
-        kfree(toclose);
-        return len;
-}
-
-/*
  * A transport listener is added by writing it's transport name and
  * a port number.
  */
@@ -712,7 +693,7 @@ static ssize_t __write_ports_addxprt(char *buf)
         int port, err;
         struct net *net = &init_net;
 
-        if (sscanf(buf, "%15s %4u", transport, &port) != 2)
+        if (sscanf(buf, "%15s %5u", transport, &port) != 2)
                 return -EINVAL;
 
         if (port < 1 || port > USHRT_MAX)
@@ -746,31 +727,6 @@ out_err:
         return err;
 }
 
-/*
- * A transport listener is removed by writing a "-", it's transport
- * name, and it's port number.
- */
-static ssize_t __write_ports_delxprt(char *buf)
-{
-        struct svc_xprt *xprt;
-        char transport[16];
-        int port;
-
-        if (sscanf(&buf[1], "%15s %4u", transport, &port) != 2)
-                return -EINVAL;
-
-        if (port < 1 || port > USHRT_MAX || nfsd_serv == NULL)
-                return -EINVAL;
-
-        xprt = svc_find_xprt(nfsd_serv, transport, &init_net, AF_UNSPEC, port);
-        if (xprt == NULL)
-                return -ENOTCONN;
-
-        svc_close_xprt(xprt);
-        svc_xprt_put(xprt);
-        return 0;
-}
-
 static ssize_t __write_ports(struct file *file, char *buf, size_t size)
 {
         if (size == 0)
@@ -779,15 +735,9 @@ static ssize_t __write_ports(struct file *file, char *buf, size_t size)
         if (isdigit(buf[0]))
                 return __write_ports_addfd(buf);
 
-        if (buf[0] == '-' && isdigit(buf[1]))
-                return __write_ports_delfd(buf);
-
         if (isalpha(buf[0]))
                 return __write_ports_addxprt(buf);
 
-        if (buf[0] == '-' && isalpha(buf[1]))
-                return __write_ports_delxprt(buf);
-
         return -EINVAL;
 }
 
@@ -825,21 +775,6 @@ static ssize_t __write_ports(struct file *file, char *buf, size_t size)
  * OR
  *
  * Input:
- *                      buf:            C string containing a "-" followed
- *                                      by an integer value representing a
- *                                      previously passed in socket file
- *                                      descriptor
- *                      size:           non-zero length of C string in @buf
- * Output:
- *      On success:     NFS service no longer listens on that socket;
- *                      passed-in buffer filled with a '\n'-terminated C
- *                      string containing a unique name of the listener;
- *                      return code is the size in bytes of the string
- *      On error:       return code is a negative errno value
- *
- * OR
- *
- * Input:
  *                      buf:            C string containing a transport
  *                                      name and an unsigned integer value
  *                                      representing the port to listen on,
@@ -848,19 +783,6 @@ static ssize_t __write_ports(struct file *file, char *buf, size_t size)
  * Output:
  *      On success:     returns zero; NFS service is started
  *      On error:       return code is a negative errno value
- *
- * OR
- *
- * Input:
- *                      buf:            C string containing a "-" followed
- *                                      by a transport name and an unsigned
- *                                      integer value representing the port
- *                                      to listen on, separated by whitespace
- *                      size:           non-zero length of C string in @buf
- * Output:
- *      On success:     returns zero; NFS service no longer listens
- *                      on that transport
- *      On error:       return code is a negative errno value
  */
 static ssize_t write_ports(struct file *file, char *buf, size_t size)
 {
@@ -1008,8 +930,6 @@ static ssize_t write_gracetime(struct file *file, char *buf, size_t size)
         return nfsd4_write_time(file, buf, size, &nfsd4_grace);
 }
 
-extern char *nfs4_recoverydir(void);
-
 static ssize_t __write_recoverydir(struct file *file, char *buf, size_t size)
 {
         char *mesg = buf;
diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
index 2244222368ab..80d5ce40aadb 100644
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -65,7 +65,7 @@ extern const struct seq_operations nfs_exports_op;
 /*
  * Function prototypes.
  */
-int             nfsd_svc(unsigned short port, int nrservs);
+int             nfsd_svc(int nrservs);
 int             nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp);
 
 int             nfsd_nrthreads(void);
@@ -124,6 +124,7 @@ int nfs4_state_start(void);
 void nfs4_state_shutdown(void);
 void nfs4_reset_lease(time_t leasetime);
 int nfs4_reset_recoverydir(char *recdir);
+char * nfs4_recoverydir(void);
 #else
 static inline void nfs4_state_init(void) { }
 static inline int nfsd4_init_slabs(void) { return 0; }
@@ -132,6 +133,7 @@ static inline int nfs4_state_start(void) { return 0; }
 static inline void nfs4_state_shutdown(void) { }
 static inline void nfs4_reset_lease(time_t leasetime) { }
 static inline int nfs4_reset_recoverydir(char *recdir) { return 0; }
+static inline char * nfs4_recoverydir(void) {return NULL; }
 #endif
 
 /*
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 240473cb708f..2013aa001dab 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -183,18 +183,18 @@ int nfsd_nrthreads(void)
         return rv;
 }
 
-static int nfsd_init_socks(int port)
+static int nfsd_init_socks(void)
 {
         int error;
         if (!list_empty(&nfsd_serv->sv_permsocks))
                 return 0;
 
-        error = svc_create_xprt(nfsd_serv, "udp", &init_net, PF_INET, port,
+        error = svc_create_xprt(nfsd_serv, "udp", &init_net, PF_INET, NFS_PORT,
                                         SVC_SOCK_DEFAULTS);
         if (error < 0)
                 return error;
 
-        error = svc_create_xprt(nfsd_serv, "tcp", &init_net, PF_INET, port,
+        error = svc_create_xprt(nfsd_serv, "tcp", &init_net, PF_INET, NFS_PORT,
                                         SVC_SOCK_DEFAULTS);
         if (error < 0)
                 return error;
@@ -204,7 +204,7 @@ static int nfsd_init_socks(int port)
 
 static bool nfsd_up = false;
 
-static int nfsd_startup(unsigned short port, int nrservs)
+static int nfsd_startup(int nrservs)
 {
         int ret;
 
@@ -218,7 +218,7 @@ static int nfsd_startup(unsigned short port, int nrservs)
         ret = nfsd_racache_init(2*nrservs);
         if (ret)
                 return ret;
-        ret = nfsd_init_socks(port);
+        ret = nfsd_init_socks();
         if (ret)
                 goto out_racache;
         ret = lockd_up(&init_net);
@@ -436,7 +436,7 @@ int nfsd_set_nrthreads(int n, int *nthreads)
  * this is the first time nrservs is nonzero.
  */
 int
-nfsd_svc(unsigned short port, int nrservs)
+nfsd_svc(int nrservs)
 {
         int     error;
         bool    nfsd_up_before;
@@ -458,7 +458,7 @@ nfsd_svc(unsigned short port, int nrservs)
 
         nfsd_up_before = nfsd_up;
 
-        error = nfsd_startup(port, nrservs);
+        error = nfsd_startup(nrservs);
         if (error)
                 goto out_destroy;
         error = svc_set_num_threads(nfsd_serv, NULL, nrservs);
@@ -487,7 +487,7 @@ static int
 nfsd(void *vrqstp)
 {
         struct svc_rqst *rqstp = (struct svc_rqst *) vrqstp;
-        int err, preverr = 0;
+        int err;
 
         /* Lock module and set up kernel thread */
         mutex_lock(&nfsd_mutex);
@@ -534,16 +534,6 @@ nfsd(void *vrqstp)
                         ;
                 if (err == -EINTR)
                         break;
-                else if (err < 0) {
-                        if (err != preverr) {
-                                printk(KERN_WARNING "%s: unexpected error "
-                                        "from svc_recv (%d)\n", __func__, -err);
-                                preverr = err;
-                        }
-                        schedule_timeout_uninterruptible(HZ);
-                        continue;
-                }
-
                 validate_process_creds();
                 svc_process(rqstp);
                 validate_process_creds();
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 22bd0a66c356..e036894bce57 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -373,11 +373,7 @@ static inline struct nfs4_lockowner * lockowner(struct nfs4_stateowner *so)
         return container_of(so, struct nfs4_lockowner, lo_owner);
 }
 
-/*
-*  nfs4_file: a file opened by some number of (open) nfs4_stateowners.
-*    o fi_perfile list is used to search for conflicting 
-*      share_acces, share_deny on the file.
-*/
+/* nfs4_file: a file opened by some number of (open) nfs4_stateowners. */
 struct nfs4_file {
         atomic_t                fi_ref;
         struct list_head        fi_hash;    /* hash by "struct inode *" */
@@ -459,7 +455,7 @@ extern void nfs4_unlock_state(void);
 extern int nfs4_in_grace(void);
 extern void nfs4_release_reclaim(void);
 extern struct nfs4_client_reclaim *nfsd4_find_reclaim_client(struct nfs4_client *crp);
-extern __be32 nfs4_check_open_reclaim(clientid_t *clid);
+extern __be32 nfs4_check_open_reclaim(clientid_t *clid, bool sessions);
 extern void nfs4_free_openowner(struct nfs4_openowner *);
 extern void nfs4_free_lockowner(struct nfs4_lockowner *);
 extern int set_callback_cred(void);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 3f67b8e12251..c120b48ec305 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1581,7 +1581,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
          */
 
         oldfs = get_fs(); set_fs(KERNEL_DS);
-        host_err = inode->i_op->readlink(path.dentry, buf, *lenp);
+        host_err = inode->i_op->readlink(path.dentry, (char __user *)buf, *lenp);
         set_fs(oldfs);
 
         if (host_err < 0)