30 files changed, 1189 insertions, 764 deletions

diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index a796be5051bf..9b6bbf1b9787 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -73,8 +73,6 @@ static void nfs_callback_svc(struct svc_rqst *rqstp)
         complete(&nfs_callback_info.started);
 
         for(;;) {
-                char buf[RPC_MAX_ADDRBUFLEN];
-
                 if (signalled()) {
                         if (nfs_callback_info.users == 0)
                                 break;
@@ -92,8 +90,6 @@ static void nfs_callback_svc(struct svc_rqst *rqstp)
                                         __FUNCTION__, -err);
                         break;
                 }
-                dprintk("%s: request from %s\n", __FUNCTION__,
-                                svc_print_addr(rqstp, buf, sizeof(buf)));
                 svc_process(rqstp);
         }
 
@@ -168,12 +164,11 @@ void nfs_callback_down(void)
 
 static int nfs_callback_authenticate(struct svc_rqst *rqstp)
 {
-        struct sockaddr_in *addr = svc_addr_in(rqstp);
         struct nfs_client *clp;
         char buf[RPC_MAX_ADDRBUFLEN];
 
         /* Don't talk to strangers */
-        clp = nfs_find_client(addr, 4);
+        clp = nfs_find_client(svc_addr(rqstp), 4);
         if (clp == NULL)
                 return SVC_DROP;
 
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index c2bb14e053e1..bb25d2135ff1 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -38,7 +38,7 @@ struct cb_compound_hdr_res {
 };
 
 struct cb_getattrargs {
-        struct sockaddr_in *addr;
+        struct sockaddr *addr;
         struct nfs_fh fh;
         uint32_t bitmap[2];
 };
@@ -53,7 +53,7 @@ struct cb_getattrres {
 };
 
 struct cb_recallargs {
-        struct sockaddr_in *addr;
+        struct sockaddr *addr;
         struct nfs_fh fh;
         nfs4_stateid stateid;
         uint32_t truncate;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 72e55d83756d..15f7785048d3 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -12,7 +12,9 @@
 #include "delegation.h"
 #include "internal.h"
 
+#ifdef NFS_DEBUG
 #define NFSDBG_FACILITY NFSDBG_CALLBACK
+#endif
  
 __be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res)
 {
@@ -20,12 +22,16 @@ __be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *
         struct nfs_delegation *delegation;
         struct nfs_inode *nfsi;
         struct inode *inode;
-        
+
         res->bitmap[0] = res->bitmap[1] = 0;
         res->status = htonl(NFS4ERR_BADHANDLE);
         clp = nfs_find_client(args->addr, 4);
         if (clp == NULL)
                 goto out;
+
+        dprintk("NFS: GETATTR callback request from %s\n",
+                rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR));
+
         inode = nfs_delegation_find_inode(clp, &args->fh);
         if (inode == NULL)
                 goto out_putclient;
@@ -65,23 +71,32 @@ __be32 nfs4_callback_recall(struct cb_recallargs *args, void *dummy)
         clp = nfs_find_client(args->addr, 4);
         if (clp == NULL)
                 goto out;
-        inode = nfs_delegation_find_inode(clp, &args->fh);
-        if (inode == NULL)
-                goto out_putclient;
-        /* Set up a helper thread to actually return the delegation */
-        switch(nfs_async_inode_return_delegation(inode, &args->stateid)) {
-                case 0:
-                        res = 0;
-                        break;
-                case -ENOENT:
-                        res = htonl(NFS4ERR_BAD_STATEID);
-                        break;
-                default:
-                        res = htonl(NFS4ERR_RESOURCE);
-        }
-        iput(inode);
-out_putclient:
-        nfs_put_client(clp);
+
+        dprintk("NFS: RECALL callback request from %s\n",
+                rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR));
+
+        do {
+                struct nfs_client *prev = clp;
+
+                inode = nfs_delegation_find_inode(clp, &args->fh);
+                if (inode != NULL) {
+                        /* Set up a helper thread to actually return the delegation */
+                        switch(nfs_async_inode_return_delegation(inode, &args->stateid)) {
+                                case 0:
+                                        res = 0;
+                                        break;
+                                case -ENOENT:
+                                        if (res != 0)
+                                                res = htonl(NFS4ERR_BAD_STATEID);
+                                        break;
+                                default:
+                                        res = htonl(NFS4ERR_RESOURCE);
+                        }
+                        iput(inode);
+                }
+                clp = nfs_find_client_next(prev);
+                nfs_put_client(prev);
+        } while (clp != NULL);
 out:
         dprintk("%s: exit with status = %d\n", __FUNCTION__, ntohl(res));
         return res;
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 058ade7efe79..c63eb720b68b 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -139,7 +139,7 @@ static __be32 decode_compound_hdr_arg(struct xdr_stream *xdr, struct cb_compound
         if (unlikely(status != 0))
                 return status;
         /* We do not like overly long tags! */
-        if (hdr->taglen > CB_OP_TAGLEN_MAXSZ-12 || hdr->taglen < 0) {
+        if (hdr->taglen > CB_OP_TAGLEN_MAXSZ - 12) {
                 printk("NFSv4 CALLBACK %s: client sent tag of length %u\n",
                                 __FUNCTION__, hdr->taglen);
                 return htonl(NFS4ERR_RESOURCE);
@@ -176,7 +176,7 @@ static __be32 decode_getattr_args(struct svc_rqst *rqstp, struct xdr_stream *xdr
         status = decode_fh(xdr, &args->fh);
         if (unlikely(status != 0))
                 goto out;
-        args->addr = svc_addr_in(rqstp);
+        args->addr = svc_addr(rqstp);
         status = decode_bitmap(xdr, args->bitmap);
 out:
         dprintk("%s: exit with status = %d\n", __FUNCTION__, ntohl(status));
@@ -188,7 +188,7 @@ static __be32 decode_recall_args(struct svc_rqst *rqstp, struct xdr_stream *xdr,
         __be32 *p;
         __be32 status;
 
-        args->addr = svc_addr_in(rqstp);
+        args->addr = svc_addr(rqstp);
         status = decode_stateid(xdr, &args->stateid);
         if (unlikely(status != 0))
                 goto out;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 310fa2f4cbb8..c5c0175898f6 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -34,6 +34,8 @@
 #include <linux/nfs_idmap.h>
 #include <linux/vfs.h>
 #include <linux/inet.h>
+#include <linux/in6.h>
+#include <net/ipv6.h>
 #include <linux/nfs_xdr.h>
 
 #include <asm/system.h>
@@ -93,22 +95,30 @@ struct rpc_program		nfsacl_program = {
 };
 #endif  /* CONFIG_NFS_V3_ACL */
 
+struct nfs_client_initdata {
+        const char *hostname;
+        const struct sockaddr *addr;
+        size_t addrlen;
+        const struct nfs_rpc_ops *rpc_ops;
+        int proto;
+};
+
 /*
  * Allocate a shared client record
  *
  * Since these are allocated/deallocated very rarely, we don't
  * bother putting them in a slab cache...
  */
-static struct nfs_client *nfs_alloc_client(const char *hostname,
-                                           const struct sockaddr_in *addr,
-                                           int nfsversion)
+static struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
 {
         struct nfs_client *clp;
 
         if ((clp = kzalloc(sizeof(*clp), GFP_KERNEL)) == NULL)
                 goto error_0;
 
-        if (nfsversion == 4) {
+        clp->rpc_ops = cl_init->rpc_ops;
+
+        if (cl_init->rpc_ops->version == 4) {
                 if (nfs_callback_up() < 0)
                         goto error_2;
                 __set_bit(NFS_CS_CALLBACK, &clp->cl_res_state);
@@ -117,11 +127,11 @@ static struct nfs_client *nfs_alloc_client(const char *hostname,
         atomic_set(&clp->cl_count, 1);
         clp->cl_cons_state = NFS_CS_INITING;
 
-        clp->cl_nfsversion = nfsversion;
-        memcpy(&clp->cl_addr, addr, sizeof(clp->cl_addr));
+        memcpy(&clp->cl_addr, cl_init->addr, cl_init->addrlen);
+        clp->cl_addrlen = cl_init->addrlen;
 
-        if (hostname) {
-                clp->cl_hostname = kstrdup(hostname, GFP_KERNEL);
+        if (cl_init->hostname) {
+                clp->cl_hostname = kstrdup(cl_init->hostname, GFP_KERNEL);
                 if (!clp->cl_hostname)
                         goto error_3;
         }
@@ -129,6 +139,8 @@ static struct nfs_client *nfs_alloc_client(const char *hostname,
         INIT_LIST_HEAD(&clp->cl_superblocks);
         clp->cl_rpcclient = ERR_PTR(-EINVAL);
 
+        clp->cl_proto = cl_init->proto;
+
 #ifdef CONFIG_NFS_V4
         init_rwsem(&clp->cl_sem);
         INIT_LIST_HEAD(&clp->cl_delegations);
@@ -166,7 +178,7 @@ static void nfs4_shutdown_client(struct nfs_client *clp)
  */
 static void nfs_free_client(struct nfs_client *clp)
 {
-        dprintk("--> nfs_free_client(%d)\n", clp->cl_nfsversion);
+        dprintk("--> nfs_free_client(%u)\n", clp->rpc_ops->version);
 
         nfs4_shutdown_client(clp);
 
@@ -203,76 +215,148 @@ void nfs_put_client(struct nfs_client *clp)
         }
 }
 
+static int nfs_sockaddr_match_ipaddr4(const struct sockaddr_in *sa1,
+                                 const struct sockaddr_in *sa2)
+{
+        return sa1->sin_addr.s_addr == sa2->sin_addr.s_addr;
+}
+
+static int nfs_sockaddr_match_ipaddr6(const struct sockaddr_in6 *sa1,
+                                 const struct sockaddr_in6 *sa2)
+{
+        return ipv6_addr_equal(&sa1->sin6_addr, &sa2->sin6_addr);
+}
+
+static int nfs_sockaddr_match_ipaddr(const struct sockaddr *sa1,
+                                 const struct sockaddr *sa2)
+{
+        switch (sa1->sa_family) {
+        case AF_INET:
+                return nfs_sockaddr_match_ipaddr4((const struct sockaddr_in *)sa1,
+                                (const struct sockaddr_in *)sa2);
+        case AF_INET6:
+                return nfs_sockaddr_match_ipaddr6((const struct sockaddr_in6 *)sa1,
+                                (const struct sockaddr_in6 *)sa2);
+        }
+        BUG();
+}
+
 /*
- * Find a client by address
- * - caller must hold nfs_client_lock
+ * Find a client by IP address and protocol version
+ * - returns NULL if no such client
  */
-static struct nfs_client *__nfs_find_client(const struct sockaddr_in *addr, int nfsversion, int match_port)
+struct nfs_client *nfs_find_client(const struct sockaddr *addr, u32 nfsversion)
 {
         struct nfs_client *clp;
 
+        spin_lock(&nfs_client_lock);
         list_for_each_entry(clp, &nfs_client_list, cl_share_link) {
+                struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
+
                 /* Don't match clients that failed to initialise properly */
-                if (clp->cl_cons_state < 0)
+                if (clp->cl_cons_state != NFS_CS_READY)
                         continue;
 
                 /* Different NFS versions cannot share the same nfs_client */
-                if (clp->cl_nfsversion != nfsversion)
+                if (clp->rpc_ops->version != nfsversion)
                         continue;
 
-                if (memcmp(&clp->cl_addr.sin_addr, &addr->sin_addr,
-                           sizeof(clp->cl_addr.sin_addr)) != 0)
+                if (addr->sa_family != clap->sa_family)
+                        continue;
+                /* Match only the IP address, not the port number */
+                if (!nfs_sockaddr_match_ipaddr(addr, clap))
                         continue;
 
-                if (!match_port || clp->cl_addr.sin_port == addr->sin_port)
-                        goto found;
+                atomic_inc(&clp->cl_count);
+                spin_unlock(&nfs_client_lock);
+                return clp;
         }
-
+        spin_unlock(&nfs_client_lock);
         return NULL;
-
-found:
-        atomic_inc(&clp->cl_count);
-        return clp;
 }
 
 /*
  * Find a client by IP address and protocol version
  * - returns NULL if no such client
  */
-struct nfs_client *nfs_find_client(const struct sockaddr_in *addr, int nfsversion)
+struct nfs_client *nfs_find_client_next(struct nfs_client *clp)
 {
-        struct nfs_client *clp;
+        struct sockaddr *sap = (struct sockaddr *)&clp->cl_addr;
+        u32 nfsvers = clp->rpc_ops->version;
 
         spin_lock(&nfs_client_lock);
-        clp = __nfs_find_client(addr, nfsversion, 0);
+        list_for_each_entry_continue(clp, &nfs_client_list, cl_share_link) {
+                struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
+
+                /* Don't match clients that failed to initialise properly */
+                if (clp->cl_cons_state != NFS_CS_READY)
+                        continue;
+
+                /* Different NFS versions cannot share the same nfs_client */
+                if (clp->rpc_ops->version != nfsvers)
+                        continue;
+
+                if (sap->sa_family != clap->sa_family)
+                        continue;
+                /* Match only the IP address, not the port number */
+                if (!nfs_sockaddr_match_ipaddr(sap, clap))
+                        continue;
+
+                atomic_inc(&clp->cl_count);
+                spin_unlock(&nfs_client_lock);
+                return clp;
+        }
         spin_unlock(&nfs_client_lock);
-        if (clp != NULL && clp->cl_cons_state != NFS_CS_READY) {
-                nfs_put_client(clp);
-                clp = NULL;
+        return NULL;
+}
+
+/*
+ * Find an nfs_client on the list that matches the initialisation data
+ * that is supplied.
+ */
+static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *data)
+{
+        struct nfs_client *clp;
+
+        list_for_each_entry(clp, &nfs_client_list, cl_share_link) {
+                /* Don't match clients that failed to initialise properly */
+                if (clp->cl_cons_state < 0)
+                        continue;
+
+                /* Different NFS versions cannot share the same nfs_client */
+                if (clp->rpc_ops != data->rpc_ops)
+                        continue;
+
+                if (clp->cl_proto != data->proto)
+                        continue;
+
+                /* Match the full socket address */
+                if (memcmp(&clp->cl_addr, data->addr, sizeof(clp->cl_addr)) != 0)
+                        continue;
+
+                atomic_inc(&clp->cl_count);
+                return clp;
         }
-        return clp;
+        return NULL;
 }
 
 /*
  * Look up a client by IP address and protocol version
  * - creates a new record if one doesn't yet exist
  */
-static struct nfs_client *nfs_get_client(const char *hostname,
-                                         const struct sockaddr_in *addr,
-                                         int nfsversion)
+static struct nfs_client *nfs_get_client(const struct nfs_client_initdata *cl_init)
 {
         struct nfs_client *clp, *new = NULL;
         int error;
 
-        dprintk("--> nfs_get_client(%s,"NIPQUAD_FMT":%d,%d)\n",
-                hostname ?: "", NIPQUAD(addr->sin_addr),
-                addr->sin_port, nfsversion);
+        dprintk("--> nfs_get_client(%s,v%u)\n",
+                cl_init->hostname ?: "", cl_init->rpc_ops->version);
 
         /* see if the client already exists */
         do {
                 spin_lock(&nfs_client_lock);
 
-                clp = __nfs_find_client(addr, nfsversion, 1);
+                clp = nfs_match_client(cl_init);
                 if (clp)
                         goto found_client;
                 if (new)
@@ -280,7 +364,7 @@ static struct nfs_client *nfs_get_client(const char *hostname,
 
                 spin_unlock(&nfs_client_lock);
 
-                new = nfs_alloc_client(hostname, addr, nfsversion);
+                new = nfs_alloc_client(cl_init);
         } while (new);
 
         return ERR_PTR(-ENOMEM);
@@ -344,12 +428,16 @@ static void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
         switch (proto) {
         case XPRT_TRANSPORT_TCP:
         case XPRT_TRANSPORT_RDMA:
-                if (!to->to_initval)
+                if (to->to_initval == 0)
                         to->to_initval = 60 * HZ;
                 if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
                         to->to_initval = NFS_MAX_TCP_TIMEOUT;
                 to->to_increment = to->to_initval;
                 to->to_maxval = to->to_initval + (to->to_increment * to->to_retries);
+                if (to->to_maxval > NFS_MAX_TCP_TIMEOUT)
+                        to->to_maxval = NFS_MAX_TCP_TIMEOUT;
+                if (to->to_maxval < to->to_initval)
+                        to->to_maxval = to->to_initval;
                 to->to_exponential = 0;
                 break;
         case XPRT_TRANSPORT_UDP:
@@ -367,19 +455,17 @@ static void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
 /*
  * Create an RPC client handle
  */
-static int nfs_create_rpc_client(struct nfs_client *clp, int proto,
-                                                unsigned int timeo,
-                                                unsigned int retrans,
-                                                rpc_authflavor_t flavor,
-                                                int flags)
+static int nfs_create_rpc_client(struct nfs_client *clp,
+                                 const struct rpc_timeout *timeparms,
+                                 rpc_authflavor_t flavor,
+                                 int flags)
 {
-        struct rpc_timeout      timeparms;
         struct rpc_clnt         *clnt = NULL;
         struct rpc_create_args args = {
-                .protocol       = proto,
+                .protocol       = clp->cl_proto,
                 .address        = (struct sockaddr *)&clp->cl_addr,
-                .addrsize       = sizeof(clp->cl_addr),
-                .timeout        = &timeparms,
+                .addrsize       = clp->cl_addrlen,
+                .timeout        = timeparms,
                 .servername     = clp->cl_hostname,
                 .program        = &nfs_program,
                 .version        = clp->rpc_ops->version,
@@ -390,10 +476,6 @@ static int nfs_create_rpc_client(struct nfs_client *clp, int proto,
         if (!IS_ERR(clp->cl_rpcclient))
                 return 0;
 
-        nfs_init_timeout_values(&timeparms, proto, timeo, retrans);
-        clp->retrans_timeo = timeparms.to_initval;
-        clp->retrans_count = timeparms.to_retries;
-
         clnt = rpc_create(&args);
         if (IS_ERR(clnt)) {
                 dprintk("%s: cannot create RPC client. Error = %ld\n",
@@ -410,11 +492,8 @@ static int nfs_create_rpc_client(struct nfs_client *clp, int proto,
  */
 static void nfs_destroy_server(struct nfs_server *server)
 {
-        if (!IS_ERR(server->client_acl))
-                rpc_shutdown_client(server->client_acl);
-
         if (!(server->flags & NFS_MOUNT_NONLM))
-                lockd_down();   /* release rpc.lockd */
+                nlmclnt_done(server->nlm_host);
 }
 
 /*
@@ -422,20 +501,29 @@ static void nfs_destroy_server(struct nfs_server *server)
  */
 static int nfs_start_lockd(struct nfs_server *server)
 {
-        int error = 0;
+        struct nlm_host *host;
+        struct nfs_client *clp = server->nfs_client;
+        struct nlmclnt_initdata nlm_init = {
+                .hostname       = clp->cl_hostname,
+                .address        = (struct sockaddr *)&clp->cl_addr,
+                .addrlen        = clp->cl_addrlen,
+                .protocol       = server->flags & NFS_MOUNT_TCP ?
+                                                IPPROTO_TCP : IPPROTO_UDP,
+                .nfs_version    = clp->rpc_ops->version,
+        };
 
-        if (server->nfs_client->cl_nfsversion > 3)
-                goto out;
+        if (nlm_init.nfs_version > 3)
+                return 0;
         if (server->flags & NFS_MOUNT_NONLM)
-                goto out;
-        error = lockd_up((server->flags & NFS_MOUNT_TCP) ?
-                        IPPROTO_TCP : IPPROTO_UDP);
-        if (error < 0)
-                server->flags |= NFS_MOUNT_NONLM;
-        else
-                server->destroy = nfs_destroy_server;
-out:
-        return error;
+                return 0;
+
+        host = nlmclnt_init(&nlm_init);
+        if (IS_ERR(host))
+                return PTR_ERR(host);
+
+        server->nlm_host = host;
+        server->destroy = nfs_destroy_server;
+        return 0;
 }
 
 /*
@@ -444,7 +532,7 @@ out:
 #ifdef CONFIG_NFS_V3_ACL
 static void nfs_init_server_aclclient(struct nfs_server *server)
 {
-        if (server->nfs_client->cl_nfsversion != 3)
+        if (server->nfs_client->rpc_ops->version != 3)
                 goto out_noacl;
         if (server->flags & NFS_MOUNT_NOACL)
                 goto out_noacl;
@@ -471,7 +559,9 @@ static inline void nfs_init_server_aclclient(struct nfs_server *server)
 /*
  * Create a general RPC client
  */
-static int nfs_init_server_rpcclient(struct nfs_server *server, rpc_authflavor_t pseudoflavour)
+static int nfs_init_server_rpcclient(struct nfs_server *server,
+                const struct rpc_timeout *timeo,
+                rpc_authflavor_t pseudoflavour)
 {
         struct nfs_client *clp = server->nfs_client;
 
@@ -481,6 +571,11 @@ static int nfs_init_server_rpcclient(struct nfs_server *server, rpc_authflavor_t
                 return PTR_ERR(server->client);
         }
 
+        memcpy(&server->client->cl_timeout_default,
+                        timeo,
+                        sizeof(server->client->cl_timeout_default));
+        server->client->cl_timeout = &server->client->cl_timeout_default;
+
         if (pseudoflavour != clp->cl_rpcclient->cl_auth->au_flavor) {
                 struct rpc_auth *auth;
 
@@ -501,6 +596,7 @@ static int nfs_init_server_rpcclient(struct nfs_server *server, rpc_authflavor_t
  * Initialise an NFS2 or NFS3 client
  */
 static int nfs_init_client(struct nfs_client *clp,
+                           const struct rpc_timeout *timeparms,
                            const struct nfs_parsed_mount_data *data)
 {
         int error;
@@ -511,18 +607,11 @@ static int nfs_init_client(struct nfs_client *clp,
                 return 0;
         }
 
-        /* Check NFS protocol revision and initialize RPC op vector */
-        clp->rpc_ops = &nfs_v2_clientops;
-#ifdef CONFIG_NFS_V3
-        if (clp->cl_nfsversion == 3)
-                clp->rpc_ops = &nfs_v3_clientops;
-#endif
         /*
          * Create a client RPC handle for doing FSSTAT with UNIX auth only
          * - RFC 2623, sec 2.3.2
          */
-        error = nfs_create_rpc_client(clp, data->nfs_server.protocol,
-                                data->timeo, data->retrans, RPC_AUTH_UNIX, 0);
+        error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_UNIX, 0);
         if (error < 0)
                 goto error;
         nfs_mark_client_ready(clp, NFS_CS_READY);
@@ -540,25 +629,34 @@ error:
 static int nfs_init_server(struct nfs_server *server,
                            const struct nfs_parsed_mount_data *data)
 {
+        struct nfs_client_initdata cl_init = {
+                .hostname = data->nfs_server.hostname,
+                .addr = (const struct sockaddr *)&data->nfs_server.address,
+                .addrlen = data->nfs_server.addrlen,
+                .rpc_ops = &nfs_v2_clientops,
+                .proto = data->nfs_server.protocol,
+        };
+        struct rpc_timeout timeparms;
         struct nfs_client *clp;
-        int error, nfsvers = 2;
+        int error;
 
         dprintk("--> nfs_init_server()\n");
 
 #ifdef CONFIG_NFS_V3
         if (data->flags & NFS_MOUNT_VER3)
-                nfsvers = 3;
+                cl_init.rpc_ops = &nfs_v3_clientops;
 #endif
 
         /* Allocate or find a client reference we can use */
-        clp = nfs_get_client(data->nfs_server.hostname,
-                                &data->nfs_server.address, nfsvers);
+        clp = nfs_get_client(&cl_init);
         if (IS_ERR(clp)) {
                 dprintk("<-- nfs_init_server() = error %ld\n", PTR_ERR(clp));
                 return PTR_ERR(clp);
         }
 
-        error = nfs_init_client(clp, data);
+        nfs_init_timeout_values(&timeparms, data->nfs_server.protocol,
+                        data->timeo, data->retrans);
+        error = nfs_init_client(clp, &timeparms, data);
         if (error < 0)
                 goto error;
 
@@ -582,7 +680,7 @@ static int nfs_init_server(struct nfs_server *server,
         if (error < 0)
                 goto error;
 
-        error = nfs_init_server_rpcclient(server, data->auth_flavors[0]);
+        error = nfs_init_server_rpcclient(server, &timeparms, data->auth_flavors[0]);
         if (error < 0)
                 goto error;
 
@@ -728,6 +826,9 @@ static struct nfs_server *nfs_alloc_server(void)
         INIT_LIST_HEAD(&server->client_link);
         INIT_LIST_HEAD(&server->master_link);
 
+        init_waitqueue_head(&server->active_wq);
+        atomic_set(&server->active, 0);
+
         server->io_stats = nfs_alloc_iostats();
         if (!server->io_stats) {
                 kfree(server);
@@ -751,6 +852,9 @@ void nfs_free_server(struct nfs_server *server)
 
         if (server->destroy != NULL)
                 server->destroy(server);
+
+        if (!IS_ERR(server->client_acl))
+                rpc_shutdown_client(server->client_acl);
         if (!IS_ERR(server->client))
                 rpc_shutdown_client(server->client);
 
@@ -836,7 +940,7 @@ error:
  * Initialise an NFS4 client record
  */
 static int nfs4_init_client(struct nfs_client *clp,
-                int proto, int timeo, int retrans,
+                const struct rpc_timeout *timeparms,
                 const char *ip_addr,
                 rpc_authflavor_t authflavour)
 {
@@ -851,7 +955,7 @@ static int nfs4_init_client(struct nfs_client *clp,
         /* Check NFS protocol revision and initialize RPC op vector */
         clp->rpc_ops = &nfs_v4_clientops;
 
-        error = nfs_create_rpc_client(clp, proto, timeo, retrans, authflavour,
+        error = nfs_create_rpc_client(clp, timeparms, authflavour,
                                         RPC_CLNT_CREATE_DISCRTRY);
         if (error < 0)
                 goto error;
@@ -878,23 +982,32 @@ error:
  * Set up an NFS4 client
  */
 static int nfs4_set_client(struct nfs_server *server,
-                const char *hostname, const struct sockaddr_in *addr,
+                const char *hostname,
+                const struct sockaddr *addr,
+                const size_t addrlen,
                 const char *ip_addr,
                 rpc_authflavor_t authflavour,
-                int proto, int timeo, int retrans)
+                int proto, const struct rpc_timeout *timeparms)
 {
+        struct nfs_client_initdata cl_init = {
+                .hostname = hostname,
+                .addr = addr,
+                .addrlen = addrlen,
+                .rpc_ops = &nfs_v4_clientops,
+                .proto = proto,
+        };
         struct nfs_client *clp;
         int error;
 
         dprintk("--> nfs4_set_client()\n");
 
         /* Allocate or find a client reference we can use */
-        clp = nfs_get_client(hostname, addr, 4);
+        clp = nfs_get_client(&cl_init);
         if (IS_ERR(clp)) {
                 error = PTR_ERR(clp);
                 goto error;
         }
-        error = nfs4_init_client(clp, proto, timeo, retrans, ip_addr, authflavour);
+        error = nfs4_init_client(clp, timeparms, ip_addr, authflavour);
         if (error < 0)
                 goto error_put;
 
@@ -915,10 +1028,26 @@ error:
 static int nfs4_init_server(struct nfs_server *server,
                 const struct nfs_parsed_mount_data *data)
 {
+        struct rpc_timeout timeparms;
         int error;
 
         dprintk("--> nfs4_init_server()\n");
 
+        nfs_init_timeout_values(&timeparms, data->nfs_server.protocol,
+                        data->timeo, data->retrans);
+
+        /* Get a client record */
+        error = nfs4_set_client(server,
+                        data->nfs_server.hostname,
+                        (const struct sockaddr *)&data->nfs_server.address,
+                        data->nfs_server.addrlen,
+                        data->client_address,
+                        data->auth_flavors[0],
+                        data->nfs_server.protocol,
+                        &timeparms);
+        if (error < 0)
+                goto error;
+
         /* Initialise the client representation from the mount data */
         server->flags = data->flags & NFS_MOUNT_FLAGMASK;
         server->caps |= NFS_CAP_ATOMIC_OPEN;
@@ -933,8 +1062,9 @@ static int nfs4_init_server(struct nfs_server *server,
         server->acdirmin = data->acdirmin * HZ;
         server->acdirmax = data->acdirmax * HZ;
 
-        error = nfs_init_server_rpcclient(server, data->auth_flavors[0]);
+        error = nfs_init_server_rpcclient(server, &timeparms, data->auth_flavors[0]);
 
+error:
         /* Done */
         dprintk("<-- nfs4_init_server() = %d\n", error);
         return error;
@@ -957,17 +1087,6 @@ struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
         if (!server)
                 return ERR_PTR(-ENOMEM);
 
-        /* Get a client record */
-        error = nfs4_set_client(server,
-                        data->nfs_server.hostname,
-                        &data->nfs_server.address,
-                        data->client_address,
-                        data->auth_flavors[0],
-                        data->nfs_server.protocol,
-                        data->timeo, data->retrans);
-        if (error < 0)
-                goto error;
-
         /* set up the general RPC client */
         error = nfs4_init_server(server, data);
         if (error < 0)
@@ -1035,12 +1154,13 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
 
         /* Get a client representation.
          * Note: NFSv4 always uses TCP, */
-        error = nfs4_set_client(server, data->hostname, data->addr,
-                        parent_client->cl_ipaddr,
-                        data->authflavor,
-                        parent_server->client->cl_xprt->prot,
-                        parent_client->retrans_timeo,
-                        parent_client->retrans_count);
+        error = nfs4_set_client(server, data->hostname,
+                                data->addr,
+                                data->addrlen,
+                                parent_client->cl_ipaddr,
+                                data->authflavor,
+                                parent_server->client->cl_xprt->prot,
+                                parent_server->client->cl_timeout);
         if (error < 0)
                 goto error;
 
@@ -1048,7 +1168,7 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
         nfs_server_copy_userdata(server, parent_server);
         server->caps |= NFS_CAP_ATOMIC_OPEN;
 
-        error = nfs_init_server_rpcclient(server, data->authflavor);
+        error = nfs_init_server_rpcclient(server, parent_server->client->cl_timeout, data->authflavor);
         if (error < 0)
                 goto error;
 
@@ -1117,7 +1237,9 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
 
         server->fsid = fattr->fsid;
 
-        error = nfs_init_server_rpcclient(server, source->client->cl_auth->au_flavor);
+        error = nfs_init_server_rpcclient(server,
+                        source->client->cl_timeout,
+                        source->client->cl_auth->au_flavor);
         if (error < 0)
                 goto out_free_server;
         if (!IS_ERR(source->client_acl))
@@ -1259,10 +1381,10 @@ static int nfs_server_list_show(struct seq_file *m, void *v)
         /* display one transport per line on subsequent lines */
         clp = list_entry(v, struct nfs_client, cl_share_link);
 
-        seq_printf(m, "v%d %02x%02x%02x%02x %4hx %3d %s\n",
-                   clp->cl_nfsversion,
-                   NIPQUAD(clp->cl_addr.sin_addr),
-                   ntohs(clp->cl_addr.sin_port),
+        seq_printf(m, "v%u %s %s %3d %s\n",
+                   clp->rpc_ops->version,
+                   rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_HEX_ADDR),
+                   rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_HEX_PORT),
                    atomic_read(&clp->cl_count),
                    clp->cl_hostname);
 
@@ -1338,10 +1460,10 @@ static int nfs_volume_list_show(struct seq_file *m, void *v)
                  (unsigned long long) server->fsid.major,
                  (unsigned long long) server->fsid.minor);
 
-        seq_printf(m, "v%d %02x%02x%02x%02x %4hx %-7s %-17s\n",
-                   clp->cl_nfsversion,
-                   NIPQUAD(clp->cl_addr.sin_addr),
-                   ntohs(clp->cl_addr.sin_port),
+        seq_printf(m, "v%u %s %s %-7s %-17s\n",
+                   clp->rpc_ops->version,
+                   rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_HEX_ADDR),
+                   rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_HEX_PORT),
                    dev,
                    fsid);
 
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 11833f4caeaa..b9eadd18ba70 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -125,6 +125,32 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, st
         put_rpccred(oldcred);
 }
 
+static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *delegation, int issync)
+{
+        int res = 0;
+
+        res = nfs4_proc_delegreturn(inode, delegation->cred, &delegation->stateid, issync);
+        nfs_free_delegation(delegation);
+        return res;
+}
+
+static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi, const nfs4_stateid *stateid)
+{
+        struct nfs_delegation *delegation = rcu_dereference(nfsi->delegation);
+
+        if (delegation == NULL)
+                goto nomatch;
+        if (stateid != NULL && memcmp(delegation->stateid.data, stateid->data,
+                                sizeof(delegation->stateid.data)) != 0)
+                goto nomatch;
+        list_del_rcu(&delegation->super_list);
+        nfsi->delegation_state = 0;
+        rcu_assign_pointer(nfsi->delegation, NULL);
+        return delegation;
+nomatch:
+        return NULL;
+}
+
 /*
  * Set up a delegation on an inode
  */
@@ -133,6 +159,7 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
         struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_delegation *delegation;
+        struct nfs_delegation *freeme = NULL;
         int status = 0;
 
         delegation = kmalloc(sizeof(*delegation), GFP_KERNEL);
@@ -147,41 +174,45 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
         delegation->inode = inode;
 
         spin_lock(&clp->cl_lock);
-        if (rcu_dereference(nfsi->delegation) == NULL) {
-                list_add_rcu(&delegation->super_list, &clp->cl_delegations);
-                nfsi->delegation_state = delegation->type;
-                rcu_assign_pointer(nfsi->delegation, delegation);
-                delegation = NULL;
-        } else {
+        if (rcu_dereference(nfsi->delegation) != NULL) {
                 if (memcmp(&delegation->stateid, &nfsi->delegation->stateid,
-                                        sizeof(delegation->stateid)) != 0 ||
-                                delegation->type != nfsi->delegation->type) {
-                        printk("%s: server %u.%u.%u.%u, handed out a duplicate delegation!\n",
-                                        __FUNCTION__, NIPQUAD(clp->cl_addr.sin_addr));
-                        status = -EIO;
+                                        sizeof(delegation->stateid)) == 0 &&
+                                delegation->type == nfsi->delegation->type) {
+                        goto out;
+                }
+                /*
+                 * Deal with broken servers that hand out two
+                 * delegations for the same file.
+                 */
+                dfprintk(FILE, "%s: server %s handed out "
+                                "a duplicate delegation!\n",
+                                __FUNCTION__, clp->cl_hostname);
+                if (delegation->type <= nfsi->delegation->type) {
+                        freeme = delegation;
+                        delegation = NULL;
+                        goto out;
                 }
+                freeme = nfs_detach_delegation_locked(nfsi, NULL);
         }
+        list_add_rcu(&delegation->super_list, &clp->cl_delegations);
+        nfsi->delegation_state = delegation->type;
+        rcu_assign_pointer(nfsi->delegation, delegation);
+        delegation = NULL;
 
         /* Ensure we revalidate the attributes and page cache! */
         spin_lock(&inode->i_lock);
         nfsi->cache_validity |= NFS_INO_REVAL_FORCED;
         spin_unlock(&inode->i_lock);
 
+out:
         spin_unlock(&clp->cl_lock);
         if (delegation != NULL)
                 nfs_free_delegation(delegation);
+        if (freeme != NULL)
+                nfs_do_return_delegation(inode, freeme, 0);
         return status;
 }
 
-static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *delegation)
-{
-        int res = 0;
-
-        res = nfs4_proc_delegreturn(inode, delegation->cred, &delegation->stateid);
-        nfs_free_delegation(delegation);
-        return res;
-}
-
 /* Sync all data to disk upon delegation return */
 static void nfs_msync_inode(struct inode *inode)
 {
@@ -207,24 +238,28 @@ static int __nfs_inode_return_delegation(struct inode *inode, struct nfs_delegat
         up_read(&clp->cl_sem);
         nfs_msync_inode(inode);
 
-        return nfs_do_return_delegation(inode, delegation);
+        return nfs_do_return_delegation(inode, delegation, 1);
 }
 
-static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi, const nfs4_stateid *stateid)
+/*
+ * This function returns the delegation without reclaiming opens
+ * or protecting against delegation reclaims.
+ * It is therefore really only safe to be called from
+ * nfs4_clear_inode()
+ */
+void nfs_inode_return_delegation_noreclaim(struct inode *inode)
 {
-        struct nfs_delegation *delegation = rcu_dereference(nfsi->delegation);
+        struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
+        struct nfs_inode *nfsi = NFS_I(inode);
+        struct nfs_delegation *delegation;
 
-        if (delegation == NULL)
-                goto nomatch;
-        if (stateid != NULL && memcmp(delegation->stateid.data, stateid->data,
-                                sizeof(delegation->stateid.data)) != 0)
-                goto nomatch;
-        list_del_rcu(&delegation->super_list);
-        nfsi->delegation_state = 0;
-        rcu_assign_pointer(nfsi->delegation, NULL);
-        return delegation;
-nomatch:
-        return NULL;
+        if (rcu_dereference(nfsi->delegation) != NULL) {
+                spin_lock(&clp->cl_lock);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                spin_unlock(&clp->cl_lock);
+                if (delegation != NULL)
+                        nfs_do_return_delegation(inode, delegation, 0);
+        }
 }
 
 int nfs_inode_return_delegation(struct inode *inode)
@@ -314,8 +349,9 @@ void nfs_expire_all_delegations(struct nfs_client *clp)
         __module_get(THIS_MODULE);
         atomic_inc(&clp->cl_count);
         task = kthread_run(nfs_do_expire_all_delegations, clp,
-                        "%u.%u.%u.%u-delegreturn",
-                        NIPQUAD(clp->cl_addr.sin_addr));
+                                "%s-delegreturn",
+                                rpc_peeraddr2str(clp->cl_rpcclient,
+                                                        RPC_DISPLAY_ADDR));
         if (!IS_ERR(task))
                 return;
         nfs_put_client(clp);
@@ -386,7 +422,7 @@ static int recall_thread(void *data)
         nfs_msync_inode(inode);
 
         if (delegation != NULL)
-                nfs_do_return_delegation(inode, delegation);
+                nfs_do_return_delegation(inode, delegation, 1);
         iput(inode);
         module_put_and_exit(0);
 }
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 5874ce7fdbae..f1c5e2a5d88e 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -29,6 +29,7 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
 void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
 int nfs_inode_return_delegation(struct inode *inode);
 int nfs_async_inode_return_delegation(struct inode *inode, const nfs4_stateid *stateid);
+void nfs_inode_return_delegation_noreclaim(struct inode *inode);
 
 struct inode *nfs_delegation_find_inode(struct nfs_client *clp, const struct nfs_fh *fhandle);
 void nfs_return_all_delegations(struct super_block *sb);
@@ -39,7 +40,7 @@ void nfs_delegation_mark_reclaim(struct nfs_client *clp);
 void nfs_delegation_reap_unclaimed(struct nfs_client *clp);
 
 /* NFSv4 delegation-related procedures */
-int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid);
+int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync);
 int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid);
 int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl);
 int nfs4_copy_delegation_stateid(nfs4_stateid *dst, struct inode *inode);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index f697b5c74b7c..476cb0f837fd 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -192,7 +192,7 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page *page)
                 /* We requested READDIRPLUS, but the server doesn't grok it */
                 if (error == -ENOTSUPP && desc->plus) {
                         NFS_SERVER(inode)->caps &= ~NFS_CAP_READDIRPLUS;
-                        clear_bit(NFS_INO_ADVISE_RDPLUS, &NFS_FLAGS(inode));
+                        clear_bit(NFS_INO_ADVISE_RDPLUS, &NFS_I(inode)->flags);
                         desc->plus = 0;
                         goto again;
                 }
@@ -537,12 +537,6 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 
         lock_kernel();
 
-        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
-        if (res < 0) {
-                unlock_kernel();
-                return res;
-        }
-
         /*
          * filp->f_pos points to the dirent entry number.
          * *desc->dir_cookie has the cookie for the next entry. We have
@@ -564,6 +558,10 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         desc->entry = &my_entry;
 
         nfs_block_sillyrename(dentry);
+        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
+        if (res < 0)
+                goto out;
+
         while(!desc->entry->eof) {
                 res = readdir_search_pagecache(desc);
 
@@ -579,7 +577,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         break;
                 }
                 if (res == -ETOOSMALL && desc->plus) {
-                        clear_bit(NFS_INO_ADVISE_RDPLUS, &NFS_FLAGS(inode));
+                        clear_bit(NFS_INO_ADVISE_RDPLUS, &NFS_I(inode)->flags);
                         nfs_zap_caches(inode);
                         desc->plus = 0;
                         desc->entry->eof = 0;
@@ -594,6 +592,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         break;
                 }
         }
+out:
         nfs_unblock_sillyrename(dentry);
         unlock_kernel();
         if (res > 0)
@@ -639,6 +638,21 @@ static int nfs_fsync_dir(struct file *filp, struct dentry *dentry, int datasync)
         return 0;
 }
 
+/**
+ * nfs_force_lookup_revalidate - Mark the directory as having changed
+ * @dir - pointer to directory inode
+ *
+ * This forces the revalidation code in nfs_lookup_revalidate() to do a
+ * full lookup on all child dentries of 'dir' whenever a change occurs
+ * on the server that might have invalidated our dcache.
+ *
+ * The caller should be holding dir->i_lock
+ */
+void nfs_force_lookup_revalidate(struct inode *dir)
+{
+        NFS_I(dir)->cache_change_attribute = jiffies;
+}
+
 /*
  * A check for whether or not the parent directory has changed.
  * In the case it has, we assume that the dentries are untrustworthy
@@ -827,6 +841,10 @@ static int nfs_dentry_delete(struct dentry *dentry)
                 dentry->d_parent->d_name.name, dentry->d_name.name,
                 dentry->d_flags);
 
+        /* Unhash any dentry with a stale inode */
+        if (dentry->d_inode != NULL && NFS_STALE(dentry->d_inode))
+                return 1;
+
         if (dentry->d_flags & DCACHE_NFSFS_RENAMED) {
                 /* Unhash it, so that ->d_iput() would be called */
                 return 1;
@@ -846,7 +864,6 @@ static int nfs_dentry_delete(struct dentry *dentry)
  */
 static void nfs_dentry_iput(struct dentry *dentry, struct inode *inode)
 {
-        nfs_inode_return_delegation(inode);
         if (S_ISDIR(inode->i_mode))
                 /* drop any readdir cache as it could easily be old */
                 NFS_I(inode)->cache_validity |= NFS_INO_INVALID_DATA;
@@ -1268,6 +1285,12 @@ out_err:
         return error;
 }
 
+static void nfs_dentry_handle_enoent(struct dentry *dentry)
+{
+        if (dentry->d_inode != NULL && !d_unhashed(dentry))
+                d_delete(dentry);
+}
+
 static int nfs_rmdir(struct inode *dir, struct dentry *dentry)
 {
         int error;
@@ -1280,6 +1303,8 @@ static int nfs_rmdir(struct inode *dir, struct dentry *dentry)
         /* Ensure the VFS deletes this inode */
         if (error == 0 && dentry->d_inode != NULL)
                 clear_nlink(dentry->d_inode);
+        else if (error == -ENOENT)
+                nfs_dentry_handle_enoent(dentry);
         unlock_kernel();
 
         return error;
@@ -1386,6 +1411,8 @@ static int nfs_safe_remove(struct dentry *dentry)
                 nfs_mark_for_revalidate(inode);
         } else
                 error = NFS_PROTO(dir)->remove(dir, &dentry->d_name);
+        if (error == -ENOENT)
+                nfs_dentry_handle_enoent(dentry);
 out:
         return error;
 }
@@ -1422,7 +1449,7 @@ static int nfs_unlink(struct inode *dir, struct dentry *dentry)
         spin_unlock(&dentry->d_lock);
         spin_unlock(&dcache_lock);
         error = nfs_safe_remove(dentry);
-        if (!error) {
+        if (!error || error == -ENOENT) {
                 nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
         } else if (need_rehash)
                 d_rehash(dentry);
@@ -1635,7 +1662,8 @@ out:
                 d_move(old_dentry, new_dentry);
                 nfs_set_verifier(new_dentry,
                                         nfs_save_change_attribute(new_dir));
-        }
+        } else if (error == -ENOENT)
+                nfs_dentry_handle_enoent(old_dentry);
 
         /* new dentry created? */
         if (dentry)
@@ -1666,13 +1694,19 @@ int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask)
 restart:
         spin_lock(&nfs_access_lru_lock);
         list_for_each_entry(nfsi, &nfs_access_lru_list, access_cache_inode_lru) {
+                struct rw_semaphore *s_umount;
                 struct inode *inode;
 
                 if (nr_to_scan-- == 0)
                         break;
+                s_umount = &nfsi->vfs_inode.i_sb->s_umount;
+                if (!down_read_trylock(s_umount))
+                        continue;
                 inode = igrab(&nfsi->vfs_inode);
-                if (inode == NULL)
+                if (inode == NULL) {
+                        up_read(s_umount);
                         continue;
+                }
                 spin_lock(&inode->i_lock);
                 if (list_empty(&nfsi->access_cache_entry_lru))
                         goto remove_lru_entry;
@@ -1691,6 +1725,7 @@ remove_lru_entry:
                 spin_unlock(&inode->i_lock);
                 spin_unlock(&nfs_access_lru_lock);
                 iput(inode);
+                up_read(s_umount);
                 goto restart;
         }
         spin_unlock(&nfs_access_lru_lock);
@@ -1731,7 +1766,7 @@ static void __nfs_access_zap_cache(struct inode *inode)
 void nfs_access_zap_cache(struct inode *inode)
 {
         /* Remove from global LRU init */
-        if (test_and_clear_bit(NFS_INO_ACL_LRU_SET, &NFS_FLAGS(inode))) {
+        if (test_and_clear_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags)) {
                 spin_lock(&nfs_access_lru_lock);
                 list_del_init(&NFS_I(inode)->access_cache_inode_lru);
                 spin_unlock(&nfs_access_lru_lock);
@@ -1845,7 +1880,7 @@ static void nfs_access_add_cache(struct inode *inode, struct nfs_access_entry *s
         smp_mb__after_atomic_inc();
 
         /* Add inode to global LRU list */
-        if (!test_and_set_bit(NFS_INO_ACL_LRU_SET, &NFS_FLAGS(inode))) {
+        if (!test_and_set_bit(NFS_INO_ACL_LRU_SET, &NFS_I(inode)->flags)) {
                 spin_lock(&nfs_access_lru_lock);
                 list_add_tail(&NFS_I(inode)->access_cache_inode_lru, &nfs_access_lru_list);
                 spin_unlock(&nfs_access_lru_lock);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 7b994b2fa593..16844f98f50e 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -272,6 +272,16 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
         unsigned long user_addr = (unsigned long)iov->iov_base;
         size_t count = iov->iov_len;
         size_t rsize = NFS_SERVER(inode)->rsize;
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_cred = ctx->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
+                .callback_ops = &nfs_read_direct_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
         unsigned int pgbase;
         int result;
         ssize_t started = 0;
@@ -311,7 +321,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
 
                 data->req = (struct nfs_page *) dreq;
                 data->inode = inode;
-                data->cred = ctx->cred;
+                data->cred = msg.rpc_cred;
                 data->args.fh = NFS_FH(inode);
                 data->args.context = ctx;
                 data->args.offset = pos;
@@ -321,14 +331,16 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.eof = 0;
                 data->res.count = bytes;
+                msg.rpc_argp = &data->args;
+                msg.rpc_resp = &data->res;
 
-                rpc_init_task(&data->task, NFS_CLIENT(inode), RPC_TASK_ASYNC,
-                                &nfs_read_direct_ops, data);
-                NFS_PROTO(inode)->read_setup(data);
+                task_setup_data.task = &data->task;
+                task_setup_data.callback_data = data;
+                NFS_PROTO(inode)->read_setup(data, &msg);
 
-                data->task.tk_cookie = (unsigned long) inode;
-
-                rpc_execute(&data->task);
+                task = rpc_run_task(&task_setup_data);
+                if (!IS_ERR(task))
+                        rpc_put_task(task);
 
                 dprintk("NFS: %5u initiated direct read call "
                         "(req %s/%Ld, %zu bytes @ offset %Lu)\n",
@@ -427,6 +439,15 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
         struct inode *inode = dreq->inode;
         struct list_head *p;
         struct nfs_write_data *data;
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_cred = dreq->ctx->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = NFS_CLIENT(inode),
+                .callback_ops = &nfs_write_direct_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
 
         dreq->count = 0;
         get_dreq(dreq);
@@ -436,6 +457,9 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
 
                 get_dreq(dreq);
 
+                /* Use stable writes */
+                data->args.stable = NFS_FILE_SYNC;
+
                 /*
                  * Reset data->res.
                  */
@@ -447,17 +471,18 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
                  * Reuse data->task; data->args should not have changed
                  * since the original request was sent.
                  */
-                rpc_init_task(&data->task, NFS_CLIENT(inode), RPC_TASK_ASYNC,
-                                &nfs_write_direct_ops, data);
-                NFS_PROTO(inode)->write_setup(data, FLUSH_STABLE);
-
-                data->task.tk_priority = RPC_PRIORITY_NORMAL;
-                data->task.tk_cookie = (unsigned long) inode;
+                task_setup_data.task = &data->task;
+                task_setup_data.callback_data = data;
+                msg.rpc_argp = &data->args;
+                msg.rpc_resp = &data->res;
+                NFS_PROTO(inode)->write_setup(data, &msg);
 
                 /*
                  * We're called via an RPC callback, so BKL is already held.
                  */
-                rpc_execute(&data->task);
+                task = rpc_run_task(&task_setup_data);
+                if (!IS_ERR(task))
+                        rpc_put_task(task);
 
                 dprintk("NFS: %5u rescheduled direct write call (req %s/%Ld, %u bytes @ offset %Lu)\n",
                                 data->task.tk_pid,
@@ -500,9 +525,23 @@ static const struct rpc_call_ops nfs_commit_direct_ops = {
 static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
 {
         struct nfs_write_data *data = dreq->commit_data;
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_argp = &data->args,
+                .rpc_resp = &data->res,
+                .rpc_cred = dreq->ctx->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .task = &data->task,
+                .rpc_client = NFS_CLIENT(dreq->inode),
+                .rpc_message = &msg,
+                .callback_ops = &nfs_commit_direct_ops,
+                .callback_data = data,
+                .flags = RPC_TASK_ASYNC,
+        };
 
         data->inode = dreq->inode;
-        data->cred = dreq->ctx->cred;
+        data->cred = msg.rpc_cred;
 
         data->args.fh = NFS_FH(data->inode);
         data->args.offset = 0;
@@ -511,18 +550,16 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
         data->res.fattr = &data->fattr;
         data->res.verf = &data->verf;
 
-        rpc_init_task(&data->task, NFS_CLIENT(dreq->inode), RPC_TASK_ASYNC,
-                                &nfs_commit_direct_ops, data);
-        NFS_PROTO(data->inode)->commit_setup(data, 0);
+        NFS_PROTO(data->inode)->commit_setup(data, &msg);
 
-        data->task.tk_priority = RPC_PRIORITY_NORMAL;
-        data->task.tk_cookie = (unsigned long)data->inode;
         /* Note: task.tk_ops->rpc_release will free dreq->commit_data */
         dreq->commit_data = NULL;
 
         dprintk("NFS: %5u initiated commit call\n", data->task.tk_pid);
 
-        rpc_execute(&data->task);
+        task = rpc_run_task(&task_setup_data);
+        if (!IS_ERR(task))
+                rpc_put_task(task);
 }
 
 static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode *inode)
@@ -637,6 +674,16 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
         struct inode *inode = ctx->path.dentry->d_inode;
         unsigned long user_addr = (unsigned long)iov->iov_base;
         size_t count = iov->iov_len;
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_cred = ctx->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
+                .callback_ops = &nfs_write_direct_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
         size_t wsize = NFS_SERVER(inode)->wsize;
         unsigned int pgbase;
         int result;
@@ -679,25 +726,27 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
 
                 data->req = (struct nfs_page *) dreq;
                 data->inode = inode;
-                data->cred = ctx->cred;
+                data->cred = msg.rpc_cred;
                 data->args.fh = NFS_FH(inode);
                 data->args.context = ctx;
                 data->args.offset = pos;
                 data->args.pgbase = pgbase;
                 data->args.pages = data->pagevec;
                 data->args.count = bytes;
+                data->args.stable = sync;
                 data->res.fattr = &data->fattr;
                 data->res.count = bytes;
                 data->res.verf = &data->verf;
 
-                rpc_init_task(&data->task, NFS_CLIENT(inode), RPC_TASK_ASYNC,
-                                &nfs_write_direct_ops, data);
-                NFS_PROTO(inode)->write_setup(data, sync);
+                task_setup_data.task = &data->task;
+                task_setup_data.callback_data = data;
+                msg.rpc_argp = &data->args;
+                msg.rpc_resp = &data->res;
+                NFS_PROTO(inode)->write_setup(data, &msg);
 
-                data->task.tk_priority = RPC_PRIORITY_NORMAL;
-                data->task.tk_cookie = (unsigned long) inode;
-
-                rpc_execute(&data->task);
+                task = rpc_run_task(&task_setup_data);
+                if (!IS_ERR(task))
+                        rpc_put_task(task);
 
                 dprintk("NFS: %5u initiated direct write call "
                         "(req %s/%Ld, %zu bytes @ offset %Lu)\n",
@@ -766,7 +815,7 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
         struct inode *inode = iocb->ki_filp->f_mapping->host;
         struct nfs_direct_req *dreq;
         size_t wsize = NFS_SERVER(inode)->wsize;
-        int sync = 0;
+        int sync = NFS_UNSTABLE;
 
         dreq = nfs_direct_req_alloc();
         if (!dreq)
@@ -774,7 +823,7 @@ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
         nfs_alloc_commit_data(dreq);
 
         if (dreq->commit_data == NULL || count < wsize)
-                sync = FLUSH_STABLE;
+                sync = NFS_FILE_SYNC;
 
         dreq->inode = inode;
         dreq->ctx = get_nfs_open_context(nfs_file_open_context(iocb->ki_filp));
@@ -886,8 +935,6 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
         retval = generic_write_checks(file, &pos, &count, 0);
         if (retval)
                 goto out;
-        if (!count)
-                goto out;       /* return 0 */
 
         retval = -EINVAL;
         if ((ssize_t) count < 0)
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index b3bb89f7d5d2..ef57a5ae5904 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -349,7 +349,9 @@ static int nfs_write_end(struct file *file, struct address_space *mapping,
         unlock_page(page);
         page_cache_release(page);
 
-        return status < 0 ? status : copied;
+        if (status < 0)
+                return status;
+        return copied;
 }
 
 static void nfs_invalidate_page(struct page *page, unsigned long offset)
@@ -392,35 +394,27 @@ static int nfs_vm_page_mkwrite(struct vm_area_struct *vma, struct page *page)
         struct file *filp = vma->vm_file;
         unsigned pagelen;
         int ret = -EINVAL;
-        void *fsdata;
         struct address_space *mapping;
-        loff_t offset;
 
         lock_page(page);
         mapping = page->mapping;
-        if (mapping != vma->vm_file->f_path.dentry->d_inode->i_mapping) {
-                unlock_page(page);
-                return -EINVAL;
-        }
+        if (mapping != vma->vm_file->f_path.dentry->d_inode->i_mapping)
+                goto out_unlock;
+
+        ret = 0;
         pagelen = nfs_page_length(page);
-        offset = (loff_t)page->index << PAGE_CACHE_SHIFT;
-        unlock_page(page);
+        if (pagelen == 0)
+                goto out_unlock;
 
-        /*
-         * we can use mapping after releasing the page lock, because:
-         * we hold mmap_sem on the fault path, which should pin the vma
-         * which should pin the file, which pins the dentry which should
-         * hold a reference on inode.
-         */
+        ret = nfs_flush_incompatible(filp, page);
+        if (ret != 0)
+                goto out_unlock;
 
-        if (pagelen) {
-                struct page *page2 = NULL;
-                ret = nfs_write_begin(filp, mapping, offset, pagelen,
-                                0, &page2, &fsdata);
-                if (!ret)
-                        ret = nfs_write_end(filp, mapping, offset, pagelen,
-                                        pagelen, page2, fsdata);
-        }
+        ret = nfs_updatepage(filp, page, 0, pagelen);
+        if (ret == 0)
+                ret = pagelen;
+out_unlock:
+        unlock_page(page);
         return ret;
 }
 
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 0ee43843f4ec..e6242cdbaf91 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -57,6 +57,17 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
                 }
                 /* Circumvent igrab(): we know the inode is not being freed */
                 atomic_inc(&inode->i_count);
+                /*
+                 * Ensure that this dentry is invisible to d_find_alias().
+                 * Otherwise, it may be spliced into the tree by
+                 * d_materialise_unique if a parent directory from the same
+                 * filesystem gets mounted at a later time.
+                 * This again causes shrink_dcache_for_umount_subtree() to
+                 * Oops, since the test for IS_ROOT() will fail.
+                 */
+                spin_lock(&dcache_lock);
+                list_del_init(&sb->s_root->d_alias);
+                spin_unlock(&dcache_lock);
         }
         return 0;
 }
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index d11eb055265c..8ae5dba2d4e5 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -72,39 +72,39 @@ module_param_call(idmap_cache_timeout, param_set_idmap_timeout, param_get_int,
                  &nfs_idmap_cache_timeout, 0644);
 
 struct idmap_hashent {
-        unsigned long ih_expires;
-        __u32 ih_id;
-        int ih_namelen;
-        char ih_name[IDMAP_NAMESZ];
+        unsigned long           ih_expires;
+        __u32                   ih_id;
+        size_t                  ih_namelen;
+        char                    ih_name[IDMAP_NAMESZ];
 };
 
 struct idmap_hashtable {
-        __u8 h_type;
-        struct idmap_hashent h_entries[IDMAP_HASH_SZ];
+        __u8                    h_type;
+        struct idmap_hashent    h_entries[IDMAP_HASH_SZ];
 };
 
 struct idmap {
-        struct dentry        *idmap_dentry;
-        wait_queue_head_t     idmap_wq;
-        struct idmap_msg      idmap_im;
-        struct mutex          idmap_lock;    /* Serializes upcalls */
-        struct mutex          idmap_im_lock; /* Protects the hashtable */
-        struct idmap_hashtable idmap_user_hash;
-        struct idmap_hashtable idmap_group_hash;
+        struct dentry           *idmap_dentry;
+        wait_queue_head_t       idmap_wq;
+        struct idmap_msg        idmap_im;
+        struct mutex            idmap_lock;     /* Serializes upcalls */
+        struct mutex            idmap_im_lock;  /* Protects the hashtable */
+        struct idmap_hashtable  idmap_user_hash;
+        struct idmap_hashtable  idmap_group_hash;
 };
 
-static ssize_t   idmap_pipe_upcall(struct file *, struct rpc_pipe_msg *,
-                     char __user *, size_t);
-static ssize_t   idmap_pipe_downcall(struct file *, const char __user *,
-                     size_t);
-static void      idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
+static ssize_t idmap_pipe_upcall(struct file *, struct rpc_pipe_msg *,
+                                 char __user *, size_t);
+static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
+                                   size_t);
+static void idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
 
 static unsigned int fnvhash32(const void *, size_t);
 
 static struct rpc_pipe_ops idmap_upcall_ops = {
-        .upcall         = idmap_pipe_upcall,
-        .downcall       = idmap_pipe_downcall,
-        .destroy_msg    = idmap_pipe_destroy_msg,
+        .upcall         = idmap_pipe_upcall,
+        .downcall       = idmap_pipe_downcall,
+        .destroy_msg    = idmap_pipe_destroy_msg,
 };
 
 int
@@ -115,19 +115,20 @@ nfs_idmap_new(struct nfs_client *clp)
 
         BUG_ON(clp->cl_idmap != NULL);
 
-        if ((idmap = kzalloc(sizeof(*idmap), GFP_KERNEL)) == NULL)
-                return -ENOMEM;
+        idmap = kzalloc(sizeof(*idmap), GFP_KERNEL);
+        if (idmap == NULL)
+                return -ENOMEM;
 
-        idmap->idmap_dentry = rpc_mkpipe(clp->cl_rpcclient->cl_dentry, "idmap",
-            idmap, &idmap_upcall_ops, 0);
-        if (IS_ERR(idmap->idmap_dentry)) {
+        idmap->idmap_dentry = rpc_mkpipe(clp->cl_rpcclient->cl_dentry, "idmap",
+                                         idmap, &idmap_upcall_ops, 0);
+        if (IS_ERR(idmap->idmap_dentry)) {
                 error = PTR_ERR(idmap->idmap_dentry);
                 kfree(idmap);
                 return error;
         }
 
-        mutex_init(&idmap->idmap_lock);
-        mutex_init(&idmap->idmap_im_lock);
+        mutex_init(&idmap->idmap_lock);
+        mutex_init(&idmap->idmap_im_lock);
         init_waitqueue_head(&idmap->idmap_wq);
         idmap->idmap_user_hash.h_type = IDMAP_TYPE_USER;
         idmap->idmap_group_hash.h_type = IDMAP_TYPE_GROUP;
@@ -192,7 +193,7 @@ idmap_lookup_id(struct idmap_hashtable *h, __u32 id)
  * pretty trivial.
  */
 static inline struct idmap_hashent *
-idmap_alloc_name(struct idmap_hashtable *h, char *name, unsigned len)
+idmap_alloc_name(struct idmap_hashtable *h, char *name, size_t len)
 {
         return idmap_name_hash(h, name, len);
 }
@@ -285,7 +286,7 @@ nfs_idmap_id(struct idmap *idmap, struct idmap_hashtable *h,
         memset(im, 0, sizeof(*im));
         mutex_unlock(&idmap->idmap_im_lock);
         mutex_unlock(&idmap->idmap_lock);
-        return (ret);
+        return ret;
 }
 
 /*
@@ -354,42 +355,40 @@ nfs_idmap_name(struct idmap *idmap, struct idmap_hashtable *h,
 /* RPC pipefs upcall/downcall routines */
 static ssize_t
 idmap_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
-    char __user *dst, size_t buflen)
+                  char __user *dst, size_t buflen)
 {
-        char *data = (char *)msg->data + msg->copied;
-        ssize_t mlen = msg->len - msg->copied;
-        ssize_t left;
-
-        if (mlen > buflen)
-                mlen = buflen;
-
-        left = copy_to_user(dst, data, mlen);
-        if (left < 0) {
-                msg->errno = left;
-                return left;
+        char *data = (char *)msg->data + msg->copied;
+        size_t mlen = min(msg->len, buflen);
+        unsigned long left;
+
+        left = copy_to_user(dst, data, mlen);
+        if (left == mlen) {
+                msg->errno = -EFAULT;
+                return -EFAULT;
         }
+
         mlen -= left;
         msg->copied += mlen;
         msg->errno = 0;
-        return mlen;
+        return mlen;
 }
 
 static ssize_t
 idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 {
-        struct rpc_inode *rpci = RPC_I(filp->f_path.dentry->d_inode);
+        struct rpc_inode *rpci = RPC_I(filp->f_path.dentry->d_inode);
         struct idmap *idmap = (struct idmap *)rpci->private;
         struct idmap_msg im_in, *im = &idmap->idmap_im;
         struct idmap_hashtable *h;
         struct idmap_hashent *he = NULL;
-        int namelen_in;
+        size_t namelen_in;
         int ret;
 
-        if (mlen != sizeof(im_in))
-                return (-ENOSPC);
+        if (mlen != sizeof(im_in))
+                return -ENOSPC;
 
-        if (copy_from_user(&im_in, src, mlen) != 0)
-                return (-EFAULT);
+        if (copy_from_user(&im_in, src, mlen) != 0)
+                return -EFAULT;
 
         mutex_lock(&idmap->idmap_im_lock);
 
@@ -487,7 +486,7 @@ static unsigned int fnvhash32(const void *buf, size_t buflen)
                 hash ^= (unsigned int)*p;
         }
 
-        return (hash);
+        return hash;
 }
 
 int nfs_map_name_to_uid(struct nfs_client *clp, const char *name, size_t namelen, __u32 *uid)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index f68c22215b14..966a8850aa30 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -192,7 +192,7 @@ void nfs_invalidate_atime(struct inode *inode)
  */
 static void nfs_invalidate_inode(struct inode *inode)
 {
-        set_bit(NFS_INO_STALE, &NFS_FLAGS(inode));
+        set_bit(NFS_INO_STALE, &NFS_I(inode)->flags);
         nfs_zap_caches_locked(inode);
 }
 
@@ -229,7 +229,7 @@ nfs_init_locked(struct inode *inode, void *opaque)
         struct nfs_find_desc    *desc = (struct nfs_find_desc *)opaque;
         struct nfs_fattr        *fattr = desc->fattr;
 
-        NFS_FILEID(inode) = fattr->fileid;
+        set_nfs_fileid(inode, fattr->fileid);
         nfs_copy_fh(NFS_FH(inode), desc->fh);
         return 0;
 }
@@ -291,7 +291,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr)
                         inode->i_fop = &nfs_dir_operations;
                         if (nfs_server_capable(inode, NFS_CAP_READDIRPLUS)
                             && fattr->size <= NFS_LIMIT_READDIRPLUS)
-                                set_bit(NFS_INO_ADVISE_RDPLUS, &NFS_FLAGS(inode));
+                                set_bit(NFS_INO_ADVISE_RDPLUS, &NFS_I(inode)->flags);
                         /* Deal with crossing mountpoints */
                         if (!nfs_fsid_equal(&NFS_SB(sb)->fsid, &fattr->fsid)) {
                                 if (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)
@@ -457,9 +457,18 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
         int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
         int err;
 
-        /* Flush out writes to the server in order to update c/mtime */
-        if (S_ISREG(inode->i_mode))
+        /*
+         * Flush out writes to the server in order to update c/mtime.
+         *
+         * Hold the i_mutex to suspend application writes temporarily;
+         * this prevents long-running writing applications from blocking
+         * nfs_wb_nocommit.
+         */
+        if (S_ISREG(inode->i_mode)) {
+                mutex_lock(&inode->i_mutex);
                 nfs_wb_nocommit(inode);
+                mutex_unlock(&inode->i_mutex);
+        }
 
         /*
          * We may force a getattr if the user cares about atime.
@@ -655,7 +664,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
                 if (status == -ESTALE) {
                         nfs_zap_caches(inode);
                         if (!S_ISDIR(inode->i_mode))
-                                set_bit(NFS_INO_STALE, &NFS_FLAGS(inode));
+                                set_bit(NFS_INO_STALE, &NFS_I(inode)->flags);
                 }
                 goto out;
         }
@@ -810,8 +819,9 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         if (S_ISDIR(inode->i_mode))
                                 nfsi->cache_validity |= NFS_INO_INVALID_DATA;
                 }
-                if (inode->i_size == fattr->pre_size && nfsi->npages == 0)
-                        inode->i_size = fattr->size;
+                if (inode->i_size == nfs_size_to_loff_t(fattr->pre_size) &&
+                    nfsi->npages == 0)
+                        inode->i_size = nfs_size_to_loff_t(fattr->size);
         }
 }
 
@@ -1015,7 +1025,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         dprintk("NFS: mtime change on server for file %s/%ld\n",
                                         inode->i_sb->s_id, inode->i_ino);
                         invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
-                        nfsi->cache_change_attribute = now;
+                        if (S_ISDIR(inode->i_mode))
+                                nfs_force_lookup_revalidate(inode);
                 }
                 /* If ctime has changed we should definitely clear access+acl caches */
                 if (!timespec_equal(&inode->i_ctime, &fattr->ctime))
@@ -1024,7 +1035,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 dprintk("NFS: change_attr change on server for file %s/%ld\n",
                                 inode->i_sb->s_id, inode->i_ino);
                 invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-                nfsi->cache_change_attribute = now;
+                if (S_ISDIR(inode->i_mode))
+                        nfs_force_lookup_revalidate(inode);
         }
 
         /* Check if our cached file size is stale */
@@ -1129,7 +1141,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 void nfs4_clear_inode(struct inode *inode)
 {
         /* If we are holding a delegation, return it! */
-        nfs_inode_return_delegation(inode);
+        nfs_inode_return_delegation_noreclaim(inode);
         /* First call standard NFS clear_inode() code */
         nfs_clear_inode(inode);
 }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index f3acf48412be..0f5619611b8d 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -21,7 +21,8 @@ struct nfs_clone_mount {
         struct nfs_fattr *fattr;
         char *hostname;
         char *mnt_path;
-        struct sockaddr_in *addr;
+        struct sockaddr *addr;
+        size_t addrlen;
         rpc_authflavor_t authflavor;
 };
 
@@ -41,19 +42,19 @@ struct nfs_parsed_mount_data {
         char                    *client_address;
 
         struct {
-                struct sockaddr_in      address;
+                struct sockaddr_storage address;
+                size_t                  addrlen;
                 char                    *hostname;
-                unsigned int            program;
                 unsigned int            version;
                 unsigned short          port;
                 int                     protocol;
         } mount_server;
 
         struct {
-                struct sockaddr_in      address;
+                struct sockaddr_storage address;
+                size_t                  addrlen;
                 char                    *hostname;
                 char                    *export_path;
-                unsigned int            program;
                 int                     protocol;
         } nfs_server;
 };
@@ -62,7 +63,8 @@ struct nfs_parsed_mount_data {
 extern struct rpc_program nfs_program;
 
 extern void nfs_put_client(struct nfs_client *);
-extern struct nfs_client *nfs_find_client(const struct sockaddr_in *, int);
+extern struct nfs_client *nfs_find_client(const struct sockaddr *, u32);
+extern struct nfs_client *nfs_find_client_next(struct nfs_client *);
 extern struct nfs_server *nfs_create_server(
                                         const struct nfs_parsed_mount_data *,
                                         struct nfs_fh *);
@@ -160,6 +162,8 @@ extern struct rpc_stat nfs_rpcstat;
 
 extern int __init register_nfs_fs(void);
 extern void __exit unregister_nfs_fs(void);
+extern void nfs_sb_active(struct nfs_server *server);
+extern void nfs_sb_deactive(struct nfs_server *server);
 
 /* namespace.c */
 extern char *nfs_path(const char *base,
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index acfc56f9edc0..be4ce1c3a3d8 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -188,7 +188,7 @@ static struct vfsmount *nfs_do_clone_mount(struct nfs_server *server,
 {
 #ifdef CONFIG_NFS_V4
         struct vfsmount *mnt = NULL;
-        switch (server->nfs_client->cl_nfsversion) {
+        switch (server->nfs_client->rpc_ops->version) {
                 case 2:
                 case 3:
                         mnt = vfs_kern_mount(&nfs_xdev_fs_type, 0, devname, mountdata);
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index 668ab96c7b59..1f7ea675e0c5 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -262,7 +262,9 @@ static int
 nfs_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
 {
         struct kvec *iov = req->rq_rcv_buf.head;
-        int     status, count, recvd, hdrlen;
+        size_t hdrlen;
+        u32 count, recvd;
+        int status;
 
         if ((status = ntohl(*p++)))
                 return -nfs_stat_to_errno(status);
@@ -273,7 +275,7 @@ nfs_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
         hdrlen = (u8 *) p - (u8 *) iov->iov_base;
         if (iov->iov_len < hdrlen) {
                 dprintk("NFS: READ reply header overflowed:"
-                                "length %d > %Zu\n", hdrlen, iov->iov_len);
+                                "length %Zu > %Zu\n", hdrlen, iov->iov_len);
                 return -errno_NFSERR_IO;
         } else if (iov->iov_len != hdrlen) {
                 dprintk("NFS: READ header is short. iovec will be shifted.\n");
@@ -283,11 +285,11 @@ nfs_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
         recvd = req->rq_rcv_buf.len - hdrlen;
         if (count > recvd) {
                 dprintk("NFS: server cheating in read reply: "
-                        "count %d > recvd %d\n", count, recvd);
+                        "count %u > recvd %u\n", count, recvd);
                 count = recvd;
         }
 
-        dprintk("RPC:      readres OK count %d\n", count);
+        dprintk("RPC:      readres OK count %u\n", count);
         if (count < res->count)
                 res->count = count;
 
@@ -423,9 +425,10 @@ nfs_xdr_readdirres(struct rpc_rqst *req, __be32 *p, void *dummy)
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
         struct page **page;
-        int hdrlen, recvd;
+        size_t hdrlen;
+        unsigned int pglen, recvd;
+        u32 len;
         int status, nr;
-        unsigned int len, pglen;
         __be32 *end, *entry, *kaddr;
 
         if ((status = ntohl(*p++)))
@@ -434,7 +437,7 @@ nfs_xdr_readdirres(struct rpc_rqst *req, __be32 *p, void *dummy)
         hdrlen = (u8 *) p - (u8 *) iov->iov_base;
         if (iov->iov_len < hdrlen) {
                 dprintk("NFS: READDIR reply header overflowed:"
-                                "length %d > %Zu\n", hdrlen, iov->iov_len);
+                                "length %Zu > %Zu\n", hdrlen, iov->iov_len);
                 return -errno_NFSERR_IO;
         } else if (iov->iov_len != hdrlen) {
                 dprintk("NFS: READDIR header is short. iovec will be shifted.\n");
@@ -576,7 +579,8 @@ nfs_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, void *dummy)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
-        int hdrlen, len, recvd;
+        size_t hdrlen;
+        u32 len, recvd;
         char    *kaddr;
         int     status;
 
@@ -584,14 +588,14 @@ nfs_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, void *dummy)
                 return -nfs_stat_to_errno(status);
         /* Convert length of symlink */
         len = ntohl(*p++);
-        if (len >= rcvbuf->page_len || len <= 0) {
+        if (len >= rcvbuf->page_len) {
                 dprintk("nfs: server returned giant symlink!\n");
                 return -ENAMETOOLONG;
         }
         hdrlen = (u8 *) p - (u8 *) iov->iov_base;
         if (iov->iov_len < hdrlen) {
                 dprintk("NFS: READLINK reply header overflowed:"
-                                "length %d > %Zu\n", hdrlen, iov->iov_len);
+                                "length %Zu > %Zu\n", hdrlen, iov->iov_len);
                 return -errno_NFSERR_IO;
         } else if (iov->iov_len != hdrlen) {
                 dprintk("NFS: READLINK header is short. iovec will be shifted.\n");
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 5ae96340f2c2..549dbce714a4 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -729,16 +729,9 @@ static int nfs3_read_done(struct rpc_task *task, struct nfs_read_data *data)
         return 0;
 }
 
-static void nfs3_proc_read_setup(struct nfs_read_data *data)
+static void nfs3_proc_read_setup(struct nfs_read_data *data, struct rpc_message *msg)
 {
-        struct rpc_message      msg = {
-                .rpc_proc       = &nfs3_procedures[NFS3PROC_READ],
-                .rpc_argp       = &data->args,
-                .rpc_resp       = &data->res,
-                .rpc_cred       = data->cred,
-        };
-
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs3_procedures[NFS3PROC_READ];
 }
 
 static int nfs3_write_done(struct rpc_task *task, struct nfs_write_data *data)
@@ -750,24 +743,9 @@ static int nfs3_write_done(struct rpc_task *task, struct nfs_write_data *data)
         return 0;
 }
 
-static void nfs3_proc_write_setup(struct nfs_write_data *data, int how)
+static void nfs3_proc_write_setup(struct nfs_write_data *data, struct rpc_message *msg)
 {
-        struct rpc_message      msg = {
-                .rpc_proc       = &nfs3_procedures[NFS3PROC_WRITE],
-                .rpc_argp       = &data->args,
-                .rpc_resp       = &data->res,
-                .rpc_cred       = data->cred,
-        };
-
-        data->args.stable = NFS_UNSTABLE;
-        if (how & FLUSH_STABLE) {
-                data->args.stable = NFS_FILE_SYNC;
-                if (NFS_I(data->inode)->ncommit)
-                        data->args.stable = NFS_DATA_SYNC;
-        }
-
-        /* Finalize the task. */
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs3_procedures[NFS3PROC_WRITE];
 }
 
 static int nfs3_commit_done(struct rpc_task *task, struct nfs_write_data *data)
@@ -778,22 +756,17 @@ static int nfs3_commit_done(struct rpc_task *task, struct nfs_write_data *data)
         return 0;
 }
 
-static void nfs3_proc_commit_setup(struct nfs_write_data *data, int how)
+static void nfs3_proc_commit_setup(struct nfs_write_data *data, struct rpc_message *msg)
 {
-        struct rpc_message      msg = {
-                .rpc_proc       = &nfs3_procedures[NFS3PROC_COMMIT],
-                .rpc_argp       = &data->args,
-                .rpc_resp       = &data->res,
-                .rpc_cred       = data->cred,
-        };
-
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs3_procedures[NFS3PROC_COMMIT];
 }
 
 static int
 nfs3_proc_lock(struct file *filp, int cmd, struct file_lock *fl)
 {
-        return nlmclnt_proc(filp->f_path.dentry->d_inode, cmd, fl);
+        struct inode *inode = filp->f_path.dentry->d_inode;
+
+        return nlmclnt_proc(NFS_SERVER(inode)->nlm_host, cmd, fl);
 }
 
 const struct nfs_rpc_ops nfs_v3_clientops = {
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 616d3267b7e7..3917e2fa4e40 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -506,9 +506,9 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
         struct page **page;
-        int hdrlen, recvd;
+        size_t hdrlen;
+        u32 len, recvd, pglen;
         int status, nr;
-        unsigned int len, pglen;
         __be32 *entry, *end, *kaddr;
 
         status = ntohl(*p++);
@@ -527,7 +527,7 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res
         hdrlen = (u8 *) p - (u8 *) iov->iov_base;
         if (iov->iov_len < hdrlen) {
                 dprintk("NFS: READDIR reply header overflowed:"
-                                "length %d > %Zu\n", hdrlen, iov->iov_len);
+                                "length %Zu > %Zu\n", hdrlen, iov->iov_len);
                 return -errno_NFSERR_IO;
         } else if (iov->iov_len != hdrlen) {
                 dprintk("NFS: READDIR header is short. iovec will be shifted.\n");
@@ -549,7 +549,7 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res
                 len = ntohl(*p++);              /* string length */
                 p += XDR_QUADLEN(len) + 2;      /* name + cookie */
                 if (len > NFS3_MAXNAMLEN) {
-                        dprintk("NFS: giant filename in readdir (len %x)!\n",
+                        dprintk("NFS: giant filename in readdir (len 0x%x)!\n",
                                                 len);
                         goto err_unmap;
                 }
@@ -570,7 +570,7 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res
                                 len = ntohl(*p++);
                                 if (len > NFS3_FHSIZE) {
                                         dprintk("NFS: giant filehandle in "
-                                                "readdir (len %x)!\n", len);
+                                                "readdir (len 0x%x)!\n", len);
                                         goto err_unmap;
                                 }
                                 p += XDR_QUADLEN(len);
@@ -815,7 +815,8 @@ nfs3_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
-        int hdrlen, len, recvd;
+        size_t hdrlen;
+        u32 len, recvd;
         char    *kaddr;
         int     status;
 
@@ -827,7 +828,7 @@ nfs3_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 
         /* Convert length of symlink */
         len = ntohl(*p++);
-        if (len >= rcvbuf->page_len || len <= 0) {
+        if (len >= rcvbuf->page_len) {
                 dprintk("nfs: server returned giant symlink!\n");
                 return -ENAMETOOLONG;
         }
@@ -835,7 +836,7 @@ nfs3_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
         hdrlen = (u8 *) p - (u8 *) iov->iov_base;
         if (iov->iov_len < hdrlen) {
                 dprintk("NFS: READLINK reply header overflowed:"
-                                "length %d > %Zu\n", hdrlen, iov->iov_len);
+                                "length %Zu > %Zu\n", hdrlen, iov->iov_len);
                 return -errno_NFSERR_IO;
         } else if (iov->iov_len != hdrlen) {
                 dprintk("NFS: READLINK header is short. "
@@ -863,7 +864,9 @@ static int
 nfs3_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
 {
         struct kvec *iov = req->rq_rcv_buf.head;
-        int     status, count, ocount, recvd, hdrlen;
+        size_t hdrlen;
+        u32 count, ocount, recvd;
+        int status;
 
         status = ntohl(*p++);
         p = xdr_decode_post_op_attr(p, res->fattr);
@@ -871,7 +874,7 @@ nfs3_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
         if (status != 0)
                 return -nfs_stat_to_errno(status);
 
-        /* Decode reply could and EOF flag. NFSv3 is somewhat redundant
+        /* Decode reply count and EOF flag. NFSv3 is somewhat redundant
          * in that it puts the count both in the res struct and in the
          * opaque data count. */
         count    = ntohl(*p++);
@@ -886,7 +889,7 @@ nfs3_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
         hdrlen = (u8 *) p - (u8 *) iov->iov_base;
         if (iov->iov_len < hdrlen) {
                 dprintk("NFS: READ reply header overflowed:"
-                                "length %d > %Zu\n", hdrlen, iov->iov_len);
+                                "length %Zu > %Zu\n", hdrlen, iov->iov_len);
                 return -errno_NFSERR_IO;
         } else if (iov->iov_len != hdrlen) {
                 dprintk("NFS: READ header is short. iovec will be shifted.\n");
@@ -896,7 +899,7 @@ nfs3_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
         recvd = req->rq_rcv_buf.len - hdrlen;
         if (count > recvd) {
                 dprintk("NFS: server cheating in read reply: "
-                        "count %d > recvd %d\n", count, recvd);
+                        "count %u > recvd %u\n", count, recvd);
                 count = recvd;
                 res->eof = 0;
         }
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index b35069a2aa9e..bd1b9d663fb9 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -115,6 +115,7 @@ struct nfs4_lock_state {
 #define NFS_LOCK_INITIALIZED 1
         int                     ls_flags;
         struct nfs_seqid_counter        ls_seqid;
+        struct rpc_sequence     ls_sequence;
         struct nfs_unique_id    ls_id;
         nfs4_stateid            ls_stateid;
         atomic_t                ls_count;
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index dd5fef20c702..5f9ba41ed5bf 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -114,10 +114,7 @@ static inline int valid_ipaddr4(const char *buf)
  * nfs_follow_referral - set up mountpoint when hitting a referral on moved error
  * @mnt_parent - mountpoint of parent directory
  * @dentry - parent directory
- * @fspath - fs path returned in fs_locations
- * @mntpath - mount path to new server
- * @hostname - hostname of new server
- * @addr - host addr of new server
+ * @locations - array of NFSv4 server location information
  *
  */
 static struct vfsmount *nfs_follow_referral(const struct vfsmount *mnt_parent,
@@ -131,7 +128,8 @@ static struct vfsmount *nfs_follow_referral(const struct vfsmount *mnt_parent,
                 .authflavor = NFS_SB(mnt_parent->mnt_sb)->client->cl_auth->au_flavor,
         };
         char *page = NULL, *page2 = NULL;
-        int loc, s, error;
+        unsigned int s;
+        int loc, error;
 
         if (locations == NULL || locations->nlocations <= 0)
                 goto out;
@@ -174,7 +172,10 @@ static struct vfsmount *nfs_follow_referral(const struct vfsmount *mnt_parent,
 
                 s = 0;
                 while (s < location->nservers) {
-                        struct sockaddr_in addr = {};
+                        struct sockaddr_in addr = {
+                                .sin_family     = AF_INET,
+                                .sin_port       = htons(NFS_PORT),
+                        };
 
                         if (location->servers[s].len <= 0 ||
                             valid_ipaddr4(location->servers[s].data) < 0) {
@@ -183,10 +184,9 @@ static struct vfsmount *nfs_follow_referral(const struct vfsmount *mnt_parent,
                         }
 
                         mountdata.hostname = location->servers[s].data;
-                        addr.sin_addr.s_addr = in_aton(mountdata.hostname);
-                        addr.sin_family = AF_INET;
-                        addr.sin_port = htons(NFS_PORT);
-                        mountdata.addr = &addr;
+                        addr.sin_addr.s_addr = in_aton(mountdata.hostname),
+                        mountdata.addr = (struct sockaddr *)&addr;
+                        mountdata.addrlen = sizeof(addr);
 
                         snprintf(page, PAGE_SIZE, "%s:%s",
                                         mountdata.hostname,
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index c4faa43b36de..027e1095256e 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -210,7 +210,7 @@ static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo)
         spin_lock(&dir->i_lock);
         nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE|NFS_INO_INVALID_DATA;
         if (!cinfo->atomic || cinfo->before != nfsi->change_attr)
-                nfsi->cache_change_attribute = jiffies;
+                nfs_force_lookup_revalidate(dir);
         nfsi->change_attr = cinfo->after;
         spin_unlock(&dir->i_lock);
 }
@@ -715,19 +715,6 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
         return err;
 }
 
-static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata)
-{
-        struct nfs4_opendata *data = calldata;
-        struct  rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_CONFIRM],
-                .rpc_argp = &data->c_arg,
-                .rpc_resp = &data->c_res,
-                .rpc_cred = data->owner->so_cred,
-        };
-        data->timestamp = jiffies;
-        rpc_call_setup(task, &msg, 0);
-}
-
 static void nfs4_open_confirm_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_opendata *data = calldata;
@@ -738,10 +725,10 @@ static void nfs4_open_confirm_done(struct rpc_task *task, void *calldata)
         if (data->rpc_status == 0) {
                 memcpy(data->o_res.stateid.data, data->c_res.stateid.data,
                                 sizeof(data->o_res.stateid.data));
+                nfs_confirm_seqid(&data->owner->so_seqid, 0);
                 renew_lease(data->o_res.server, data->timestamp);
                 data->rpc_done = 1;
         }
-        nfs_confirm_seqid(&data->owner->so_seqid, data->rpc_status);
         nfs_increment_open_seqid(data->rpc_status, data->c_arg.seqid);
 }
 
@@ -756,7 +743,6 @@ static void nfs4_open_confirm_release(void *calldata)
         /* In case of error, no cleanup! */
         if (!data->rpc_done)
                 goto out_free;
-        nfs_confirm_seqid(&data->owner->so_seqid, 0);
         state = nfs4_opendata_to_nfs4_state(data);
         if (!IS_ERR(state))
                 nfs4_close_state(&data->path, state, data->o_arg.open_flags);
@@ -765,7 +751,6 @@ out_free:
 }
 
 static const struct rpc_call_ops nfs4_open_confirm_ops = {
-        .rpc_call_prepare = nfs4_open_confirm_prepare,
         .rpc_call_done = nfs4_open_confirm_done,
         .rpc_release = nfs4_open_confirm_release,
 };
@@ -777,12 +762,26 @@ static int _nfs4_proc_open_confirm(struct nfs4_opendata *data)
 {
         struct nfs_server *server = NFS_SERVER(data->dir->d_inode);
         struct rpc_task *task;
+        struct  rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_CONFIRM],
+                .rpc_argp = &data->c_arg,
+                .rpc_resp = &data->c_res,
+                .rpc_cred = data->owner->so_cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = server->client,
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_open_confirm_ops,
+                .callback_data = data,
+                .flags = RPC_TASK_ASYNC,
+        };
         int status;
 
         kref_get(&data->kref);
         data->rpc_done = 0;
         data->rpc_status = 0;
-        task = rpc_run_task(server->client, RPC_TASK_ASYNC, &nfs4_open_confirm_ops, data);
+        data->timestamp = jiffies;
+        task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
         status = nfs4_wait_for_completion_rpc_task(task);
@@ -799,13 +798,7 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
 {
         struct nfs4_opendata *data = calldata;
         struct nfs4_state_owner *sp = data->owner;
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN],
-                .rpc_argp = &data->o_arg,
-                .rpc_resp = &data->o_res,
-                .rpc_cred = sp->so_cred,
-        };
-        
+
         if (nfs_wait_on_sequence(data->o_arg.seqid, task) != 0)
                 return;
         /*
@@ -830,11 +823,11 @@ static void nfs4_open_prepare(struct rpc_task *task, void *calldata)
         data->o_arg.id = sp->so_owner_id.id;
         data->o_arg.clientid = sp->so_client->cl_clientid;
         if (data->o_arg.claim == NFS4_OPEN_CLAIM_PREVIOUS) {
-                msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_NOATTR];
+                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_NOATTR];
                 nfs_copy_fh(&data->o_res.fh, data->o_arg.fh);
         }
         data->timestamp = jiffies;
-        rpc_call_setup(task, &msg, 0);
+        rpc_call_start(task);
         return;
 out_no_action:
         task->tk_action = NULL;
@@ -883,7 +876,6 @@ static void nfs4_open_release(void *calldata)
         /* In case we need an open_confirm, no cleanup! */
         if (data->o_res.rflags & NFS4_OPEN_RESULT_CONFIRM)
                 goto out_free;
-        nfs_confirm_seqid(&data->owner->so_seqid, 0);
         state = nfs4_opendata_to_nfs4_state(data);
         if (!IS_ERR(state))
                 nfs4_close_state(&data->path, state, data->o_arg.open_flags);
@@ -907,13 +899,26 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
         struct nfs_openargs *o_arg = &data->o_arg;
         struct nfs_openres *o_res = &data->o_res;
         struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN],
+                .rpc_argp = o_arg,
+                .rpc_resp = o_res,
+                .rpc_cred = data->owner->so_cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = server->client,
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_open_ops,
+                .callback_data = data,
+                .flags = RPC_TASK_ASYNC,
+        };
         int status;
 
         kref_get(&data->kref);
         data->rpc_done = 0;
         data->rpc_status = 0;
         data->cancelled = 0;
-        task = rpc_run_task(server->client, RPC_TASK_ASYNC, &nfs4_open_ops, data);
+        task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
         status = nfs4_wait_for_completion_rpc_task(task);
@@ -1243,12 +1248,6 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
 {
         struct nfs4_closedata *calldata = data;
         struct nfs4_state *state = calldata->state;
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CLOSE],
-                .rpc_argp = &calldata->arg,
-                .rpc_resp = &calldata->res,
-                .rpc_cred = state->owner->so_cred,
-        };
         int clear_rd, clear_wr, clear_rdwr;
 
         if (nfs_wait_on_sequence(calldata->arg.seqid, task) != 0)
@@ -1275,14 +1274,14 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
         }
         nfs_fattr_init(calldata->res.fattr);
         if (test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0) {
-                msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
                 calldata->arg.open_flags = FMODE_READ;
         } else if (test_bit(NFS_O_WRONLY_STATE, &state->flags) != 0) {
-                msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
                 calldata->arg.open_flags = FMODE_WRITE;
         }
         calldata->timestamp = jiffies;
-        rpc_call_setup(task, &msg, 0);
+        rpc_call_start(task);
 }
 
 static const struct rpc_call_ops nfs4_close_ops = {
@@ -1308,6 +1307,16 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
         struct nfs4_closedata *calldata;
         struct nfs4_state_owner *sp = state->owner;
         struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CLOSE],
+                .rpc_cred = state->owner->so_cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = server->client,
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_close_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
         int status = -ENOMEM;
 
         calldata = kmalloc(sizeof(*calldata), GFP_KERNEL);
@@ -1327,7 +1336,10 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
         calldata->path.mnt = mntget(path->mnt);
         calldata->path.dentry = dget(path->dentry);
 
-        task = rpc_run_task(server->client, RPC_TASK_ASYNC, &nfs4_close_ops, calldata);
+        msg.rpc_argp = &calldata->arg,
+        msg.rpc_resp = &calldata->res,
+        task_setup_data.callback_data = calldata;
+        task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
         status = 0;
@@ -2413,18 +2425,10 @@ static int nfs4_read_done(struct rpc_task *task, struct nfs_read_data *data)
         return 0;
 }
 
-static void nfs4_proc_read_setup(struct nfs_read_data *data)
+static void nfs4_proc_read_setup(struct nfs_read_data *data, struct rpc_message *msg)
 {
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ],
-                .rpc_argp = &data->args,
-                .rpc_resp = &data->res,
-                .rpc_cred = data->cred,
-        };
-
         data->timestamp   = jiffies;
-
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ];
 }
 
 static int nfs4_write_done(struct rpc_task *task, struct nfs_write_data *data)
@@ -2442,33 +2446,15 @@ static int nfs4_write_done(struct rpc_task *task, struct nfs_write_data *data)
         return 0;
 }
 
-static void nfs4_proc_write_setup(struct nfs_write_data *data, int how)
+static void nfs4_proc_write_setup(struct nfs_write_data *data, struct rpc_message *msg)
 {
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_WRITE],
-                .rpc_argp = &data->args,
-                .rpc_resp = &data->res,
-                .rpc_cred = data->cred,
-        };
-        struct inode *inode = data->inode;
-        struct nfs_server *server = NFS_SERVER(inode);
-        int stable;
-        
-        if (how & FLUSH_STABLE) {
-                if (!NFS_I(inode)->ncommit)
-                        stable = NFS_FILE_SYNC;
-                else
-                        stable = NFS_DATA_SYNC;
-        } else
-                stable = NFS_UNSTABLE;
-        data->args.stable = stable;
+        struct nfs_server *server = NFS_SERVER(data->inode);
+
         data->args.bitmask = server->attr_bitmask;
         data->res.server = server;
-
         data->timestamp   = jiffies;
 
-        /* Finalize the task. */
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_WRITE];
 }
 
 static int nfs4_commit_done(struct rpc_task *task, struct nfs_write_data *data)
@@ -2483,20 +2469,13 @@ static int nfs4_commit_done(struct rpc_task *task, struct nfs_write_data *data)
         return 0;
 }
 
-static void nfs4_proc_commit_setup(struct nfs_write_data *data, int how)
+static void nfs4_proc_commit_setup(struct nfs_write_data *data, struct rpc_message *msg)
 {
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COMMIT],
-                .rpc_argp = &data->args,
-                .rpc_resp = &data->res,
-                .rpc_cred = data->cred,
-        };      
         struct nfs_server *server = NFS_SERVER(data->inode);
         
         data->args.bitmask = server->attr_bitmask;
         data->res.server = server;
-
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COMMIT];
 }
 
 /*
@@ -2899,14 +2878,20 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, unsigned short po
 
         for(;;) {
                 setclientid.sc_name_len = scnprintf(setclientid.sc_name,
-                                sizeof(setclientid.sc_name), "%s/%u.%u.%u.%u %s %u",
-                                clp->cl_ipaddr, NIPQUAD(clp->cl_addr.sin_addr),
+                                sizeof(setclientid.sc_name), "%s/%s %s %s %u",
+                                clp->cl_ipaddr,
+                                rpc_peeraddr2str(clp->cl_rpcclient,
+                                                        RPC_DISPLAY_ADDR),
+                                rpc_peeraddr2str(clp->cl_rpcclient,
+                                                        RPC_DISPLAY_PROTO),
                                 cred->cr_ops->cr_name,
                                 clp->cl_id_uniquifier);
                 setclientid.sc_netid_len = scnprintf(setclientid.sc_netid,
-                                sizeof(setclientid.sc_netid), "tcp");
+                                sizeof(setclientid.sc_netid),
+                                rpc_peeraddr2str(clp->cl_rpcclient,
+                                                        RPC_DISPLAY_NETID));
                 setclientid.sc_uaddr_len = scnprintf(setclientid.sc_uaddr,
-                                sizeof(setclientid.sc_uaddr), "%s.%d.%d",
+                                sizeof(setclientid.sc_uaddr), "%s.%u.%u",
                                 clp->cl_ipaddr, port >> 8, port & 255);
 
                 status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
@@ -2970,25 +2955,11 @@ struct nfs4_delegreturndata {
         struct nfs4_delegreturnres res;
         struct nfs_fh fh;
         nfs4_stateid stateid;
-        struct rpc_cred *cred;
         unsigned long timestamp;
         struct nfs_fattr fattr;
         int rpc_status;
 };
 
-static void nfs4_delegreturn_prepare(struct rpc_task *task, void *calldata)
-{
-        struct nfs4_delegreturndata *data = calldata;
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_DELEGRETURN],
-                .rpc_argp = &data->args,
-                .rpc_resp = &data->res,
-                .rpc_cred = data->cred,
-        };
-        nfs_fattr_init(data->res.fattr);
-        rpc_call_setup(task, &msg, 0);
-}
-
 static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_delegreturndata *data = calldata;
@@ -2999,24 +2970,30 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
 
 static void nfs4_delegreturn_release(void *calldata)
 {
-        struct nfs4_delegreturndata *data = calldata;
-
-        put_rpccred(data->cred);
         kfree(calldata);
 }
 
 static const struct rpc_call_ops nfs4_delegreturn_ops = {
-        .rpc_call_prepare = nfs4_delegreturn_prepare,
         .rpc_call_done = nfs4_delegreturn_done,
         .rpc_release = nfs4_delegreturn_release,
 };
 
-static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid)
+static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
 {
         struct nfs4_delegreturndata *data;
         struct nfs_server *server = NFS_SERVER(inode);
         struct rpc_task *task;
-        int status;
+        struct rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_DELEGRETURN],
+                .rpc_cred = cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = server->client,
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_delegreturn_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
+        int status = 0;
 
         data = kmalloc(sizeof(*data), GFP_KERNEL);
         if (data == NULL)
@@ -3028,30 +3005,37 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co
         memcpy(&data->stateid, stateid, sizeof(data->stateid));
         data->res.fattr = &data->fattr;
         data->res.server = server;
-        data->cred = get_rpccred(cred);
+        nfs_fattr_init(data->res.fattr);
         data->timestamp = jiffies;
         data->rpc_status = 0;
 
-        task = rpc_run_task(NFS_CLIENT(inode), RPC_TASK_ASYNC, &nfs4_delegreturn_ops, data);
+        task_setup_data.callback_data = data;
+        msg.rpc_argp = &data->args,
+        msg.rpc_resp = &data->res,
+        task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
+        if (!issync)
+                goto out;
         status = nfs4_wait_for_completion_rpc_task(task);
-        if (status == 0) {
-                status = data->rpc_status;
-                if (status == 0)
-                        nfs_refresh_inode(inode, &data->fattr);
-        }
+        if (status != 0)
+                goto out;
+        status = data->rpc_status;
+        if (status != 0)
+                goto out;
+        nfs_refresh_inode(inode, &data->fattr);
+out:
         rpc_put_task(task);
         return status;
 }
 
-int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid)
+int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
 {
         struct nfs_server *server = NFS_SERVER(inode);
         struct nfs4_exception exception = { };
         int err;
         do {
-                err = _nfs4_proc_delegreturn(inode, cred, stateid);
+                err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
                 switch (err) {
                         case -NFS4ERR_STALE_STATEID:
                         case -NFS4ERR_EXPIRED:
@@ -3219,12 +3203,6 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
 static void nfs4_locku_prepare(struct rpc_task *task, void *data)
 {
         struct nfs4_unlockdata *calldata = data;
-        struct rpc_message msg = {
-                .rpc_proc       = &nfs4_procedures[NFSPROC4_CLNT_LOCKU],
-                .rpc_argp       = &calldata->arg,
-                .rpc_resp       = &calldata->res,
-                .rpc_cred       = calldata->lsp->ls_state->owner->so_cred,
-        };
 
         if (nfs_wait_on_sequence(calldata->arg.seqid, task) != 0)
                 return;
@@ -3234,7 +3212,7 @@ static void nfs4_locku_prepare(struct rpc_task *task, void *data)
                 return;
         }
         calldata->timestamp = jiffies;
-        rpc_call_setup(task, &msg, 0);
+        rpc_call_start(task);
 }
 
 static const struct rpc_call_ops nfs4_locku_ops = {
@@ -3249,6 +3227,16 @@ static struct rpc_task *nfs4_do_unlck(struct file_lock *fl,
                 struct nfs_seqid *seqid)
 {
         struct nfs4_unlockdata *data;
+        struct rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LOCKU],
+                .rpc_cred = ctx->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = NFS_CLIENT(lsp->ls_state->inode),
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_locku_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
 
         /* Ensure this is an unlock - when canceling a lock, the
          * canceled lock is passed in, and it won't be an unlock.
@@ -3261,7 +3249,10 @@ static struct rpc_task *nfs4_do_unlck(struct file_lock *fl,
                 return ERR_PTR(-ENOMEM);
         }
 
-        return rpc_run_task(NFS_CLIENT(lsp->ls_state->inode), RPC_TASK_ASYNC, &nfs4_locku_ops, data);
+        msg.rpc_argp = &data->arg,
+        msg.rpc_resp = &data->res,
+        task_setup_data.callback_data = data;
+        return rpc_run_task(&task_setup_data);
 }
 
 static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *request)
@@ -3320,9 +3311,12 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
 
         p->arg.fh = NFS_FH(inode);
         p->arg.fl = &p->fl;
+        p->arg.open_seqid = nfs_alloc_seqid(&lsp->ls_state->owner->so_seqid);
+        if (p->arg.open_seqid == NULL)
+                goto out_free;
         p->arg.lock_seqid = nfs_alloc_seqid(&lsp->ls_seqid);
         if (p->arg.lock_seqid == NULL)
-                goto out_free;
+                goto out_free_seqid;
         p->arg.lock_stateid = &lsp->ls_stateid;
         p->arg.lock_owner.clientid = server->nfs_client->cl_clientid;
         p->arg.lock_owner.id = lsp->ls_id.id;
@@ -3331,6 +3325,8 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl,
         p->ctx = get_nfs_open_context(ctx);
         memcpy(&p->fl, fl, sizeof(p->fl));
         return p;
+out_free_seqid:
+        nfs_free_seqid(p->arg.open_seqid);
 out_free:
         kfree(p);
         return NULL;
@@ -3340,31 +3336,20 @@ static void nfs4_lock_prepare(struct rpc_task *task, void *calldata)
 {
         struct nfs4_lockdata *data = calldata;
         struct nfs4_state *state = data->lsp->ls_state;
-        struct nfs4_state_owner *sp = state->owner;
-        struct rpc_message msg = {
-                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LOCK],
-                .rpc_argp = &data->arg,
-                .rpc_resp = &data->res,
-                .rpc_cred = sp->so_cred,
-        };
 
+        dprintk("%s: begin!\n", __FUNCTION__);
         if (nfs_wait_on_sequence(data->arg.lock_seqid, task) != 0)
                 return;
-        dprintk("%s: begin!\n", __FUNCTION__);
         /* Do we need to do an open_to_lock_owner? */
         if (!(data->arg.lock_seqid->sequence->flags & NFS_SEQID_CONFIRMED)) {
-                data->arg.open_seqid = nfs_alloc_seqid(&sp->so_seqid);
-                if (data->arg.open_seqid == NULL) {
-                        data->rpc_status = -ENOMEM;
-                        task->tk_action = NULL;
-                        goto out;
-                }
+                if (nfs_wait_on_sequence(data->arg.open_seqid, task) != 0)
+                        return;
                 data->arg.open_stateid = &state->stateid;
                 data->arg.new_lock_owner = 1;
-        }
+        } else
+                data->arg.new_lock_owner = 0;
         data->timestamp = jiffies;
-        rpc_call_setup(task, &msg, 0);
-out:
+        rpc_call_start(task);
         dprintk("%s: done!, ret = %d\n", __FUNCTION__, data->rpc_status);
 }
 
@@ -3400,8 +3385,7 @@ static void nfs4_lock_release(void *calldata)
         struct nfs4_lockdata *data = calldata;
 
         dprintk("%s: begin!\n", __FUNCTION__);
-        if (data->arg.open_seqid != NULL)
-                nfs_free_seqid(data->arg.open_seqid);
+        nfs_free_seqid(data->arg.open_seqid);
         if (data->cancelled != 0) {
                 struct rpc_task *task;
                 task = nfs4_do_unlck(&data->fl, data->ctx, data->lsp,
@@ -3427,6 +3411,16 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
 {
         struct nfs4_lockdata *data;
         struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_LOCK],
+                .rpc_cred = state->owner->so_cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = NFS_CLIENT(state->inode),
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_lock_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
         int ret;
 
         dprintk("%s: begin!\n", __FUNCTION__);
@@ -3438,8 +3432,10 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
                 data->arg.block = 1;
         if (reclaim != 0)
                 data->arg.reclaim = 1;
-        task = rpc_run_task(NFS_CLIENT(state->inode), RPC_TASK_ASYNC,
-                        &nfs4_lock_ops, data);
+        msg.rpc_argp = &data->arg,
+        msg.rpc_resp = &data->res,
+        task_setup_data.callback_data = data;
+        task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
         ret = nfs4_wait_for_completion_rpc_task(task);
@@ -3612,10 +3608,6 @@ int nfs4_setxattr(struct dentry *dentry, const char *key, const void *buf,
         if (strcmp(key, XATTR_NAME_NFSV4_ACL) != 0)
                 return -EOPNOTSUPP;
 
-        if (!S_ISREG(inode->i_mode) &&
-            (!S_ISDIR(inode->i_mode) || inode->i_mode & S_ISVTX))
-                return -EPERM;
-
         return nfs4_proc_set_acl(inode, buf, buflen);
 }
 
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index 3ea352d82eba..5e2e4af1a0e6 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -133,9 +133,7 @@ nfs4_renewd_prepare_shutdown(struct nfs_server *server)
 void
 nfs4_kill_renewd(struct nfs_client *clp)
 {
-        down_read(&clp->cl_sem);
         cancel_delayed_work_sync(&clp->cl_renewd);
-        up_read(&clp->cl_sem);
 }
 
 /*
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 23a9a36556bf..f9c7432471dc 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -509,7 +509,10 @@ static struct nfs4_lock_state *nfs4_alloc_lock_state(struct nfs4_state *state, f
         lsp = kzalloc(sizeof(*lsp), GFP_KERNEL);
         if (lsp == NULL)
                 return NULL;
-        lsp->ls_seqid.sequence = &state->owner->so_sequence;
+        rpc_init_wait_queue(&lsp->ls_sequence.wait, "lock_seqid_waitqueue");
+        spin_lock_init(&lsp->ls_sequence.lock);
+        INIT_LIST_HEAD(&lsp->ls_sequence.list);
+        lsp->ls_seqid.sequence = &lsp->ls_sequence;
         atomic_set(&lsp->ls_count, 1);
         lsp->ls_owner = fl_owner;
         spin_lock(&clp->cl_lock);
@@ -641,27 +644,26 @@ void nfs4_copy_stateid(nfs4_stateid *dst, struct nfs4_state *state, fl_owner_t f
 
 struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter)
 {
-        struct rpc_sequence *sequence = counter->sequence;
         struct nfs_seqid *new;
 
         new = kmalloc(sizeof(*new), GFP_KERNEL);
         if (new != NULL) {
                 new->sequence = counter;
-                spin_lock(&sequence->lock);
-                list_add_tail(&new->list, &sequence->list);
-                spin_unlock(&sequence->lock);
+                INIT_LIST_HEAD(&new->list);
         }
         return new;
 }
 
 void nfs_free_seqid(struct nfs_seqid *seqid)
 {
-        struct rpc_sequence *sequence = seqid->sequence->sequence;
+        if (!list_empty(&seqid->list)) {
+                struct rpc_sequence *sequence = seqid->sequence->sequence;
 
-        spin_lock(&sequence->lock);
-        list_del(&seqid->list);
-        spin_unlock(&sequence->lock);
-        rpc_wake_up(&sequence->wait);
+                spin_lock(&sequence->lock);
+                list_del(&seqid->list);
+                spin_unlock(&sequence->lock);
+                rpc_wake_up(&sequence->wait);
+        }
         kfree(seqid);
 }
 
@@ -672,6 +674,7 @@ void nfs_free_seqid(struct nfs_seqid *seqid)
  */
 static void nfs_increment_seqid(int status, struct nfs_seqid *seqid)
 {
+        BUG_ON(list_first_entry(&seqid->sequence->sequence->list, struct nfs_seqid, list) != seqid);
         switch (status) {
                 case 0:
                         break;
@@ -723,15 +726,15 @@ int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task)
         struct rpc_sequence *sequence = seqid->sequence->sequence;
         int status = 0;
 
-        if (sequence->list.next == &seqid->list)
-                goto out;
         spin_lock(&sequence->lock);
-        if (sequence->list.next != &seqid->list) {
-                rpc_sleep_on(&sequence->wait, task, NULL, NULL);
-                status = -EAGAIN;
-        }
+        if (list_empty(&seqid->list))
+                list_add_tail(&seqid->list, &sequence->list);
+        if (list_first_entry(&sequence->list, struct nfs_seqid, list) == seqid)
+                goto unlock;
+        rpc_sleep_on(&sequence->wait, task, NULL, NULL);
+        status = -EAGAIN;
+unlock:
         spin_unlock(&sequence->lock);
-out:
         return status;
 }
 
@@ -755,8 +758,9 @@ static void nfs4_recover_state(struct nfs_client *clp)
 
         __module_get(THIS_MODULE);
         atomic_inc(&clp->cl_count);
-        task = kthread_run(reclaimer, clp, "%u.%u.%u.%u-reclaim",
-                        NIPQUAD(clp->cl_addr.sin_addr));
+        task = kthread_run(reclaimer, clp, "%s-reclaim",
+                                rpc_peeraddr2str(clp->cl_rpcclient,
+                                                        RPC_DISPLAY_ADDR));
         if (!IS_ERR(task))
                 return;
         nfs4_clear_recover_bit(clp);
@@ -967,8 +971,8 @@ out:
         module_put_and_exit(0);
         return 0;
 out_error:
-        printk(KERN_WARNING "Error: state recovery failed on NFSv4 server %u.%u.%u.%u with error %d\n",
-                                NIPQUAD(clp->cl_addr.sin_addr), -status);
+        printk(KERN_WARNING "Error: state recovery failed on NFSv4 server %s"
+                        " with error %d\n", clp->cl_hostname, -status);
         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
         goto out;
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 51dd3804866f..db1ed9c46ede 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -116,10 +116,12 @@ static int nfs4_stat_to_errno(int);
 #define decode_renew_maxsz      (op_decode_hdr_maxsz)
 #define encode_setclientid_maxsz \
                                 (op_encode_hdr_maxsz + \
-                                4 /*server->ip_addr*/ + \
-                                1 /*Netid*/ + \
-                                6 /*uaddr*/ + \
-                                6 + (NFS4_VERIFIER_SIZE >> 2))
+                                XDR_QUADLEN(NFS4_VERIFIER_SIZE) + \
+                                XDR_QUADLEN(NFS4_SETCLIENTID_NAMELEN) + \
+                                1 /* sc_prog */ + \
+                                XDR_QUADLEN(RPCBIND_MAXNETIDLEN) + \
+                                XDR_QUADLEN(RPCBIND_MAXUADDRLEN) + \
+                                1) /* sc_cb_ident */
 #define decode_setclientid_maxsz \
                                 (op_decode_hdr_maxsz + \
                                 2 + \
@@ -2515,14 +2517,12 @@ static int decode_attr_files_total(struct xdr_stream *xdr, uint32_t *bitmap, uin
 
 static int decode_pathname(struct xdr_stream *xdr, struct nfs4_pathname *path)
 {
-        int n;
+        u32 n;
         __be32 *p;
         int status = 0;
 
         READ_BUF(4);
         READ32(n);
-        if (n < 0)
-                goto out_eio;
         if (n == 0)
                 goto root_path;
         dprintk("path ");
@@ -2579,13 +2579,11 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
                 goto out_eio;
         res->nlocations = 0;
         while (res->nlocations < n) {
-                int m;
+                u32 m;
                 struct nfs4_fs_location *loc = &res->locations[res->nlocations];
 
                 READ_BUF(4);
                 READ32(m);
-                if (m <= 0)
-                        goto out_eio;
 
                 loc->nservers = 0;
                 dprintk("%s: servers ", __FUNCTION__);
@@ -2598,8 +2596,12 @@ static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, st
                         if (loc->nservers < NFS4_FS_LOCATION_MAXSERVERS)
                                 loc->nservers++;
                         else {
-                                int i;
-                                dprintk("%s: using first %d of %d servers returned for location %d\n", __FUNCTION__, NFS4_FS_LOCATION_MAXSERVERS, m, res->nlocations);
+                                unsigned int i;
+                                dprintk("%s: using first %u of %u servers "
+                                        "returned for location %u\n",
+                                                __FUNCTION__,
+                                                NFS4_FS_LOCATION_MAXSERVERS,
+                                                m, res->nlocations);
                                 for (i = loc->nservers; i < m; i++) {
                                         unsigned int len;
                                         char *data;
@@ -3476,10 +3478,11 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         struct xdr_buf  *rcvbuf = &req->rq_rcv_buf;
         struct page     *page = *rcvbuf->pages;
         struct kvec     *iov = rcvbuf->head;
-        unsigned int    nr, pglen = rcvbuf->page_len;
+        size_t          hdrlen;
+        u32             recvd, pglen = rcvbuf->page_len;
         __be32          *end, *entry, *p, *kaddr;
-        uint32_t        len, attrlen, xlen;
-        int             hdrlen, recvd, status;
+        unsigned int    nr;
+        int             status;
 
         status = decode_op_hdr(xdr, OP_READDIR);
         if (status)
@@ -3503,6 +3506,7 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         end = p + ((pglen + readdir->pgbase) >> 2);
         entry = p;
         for (nr = 0; *p++; nr++) {
+                u32 len, attrlen, xlen;
                 if (end - p < 3)
                         goto short_pkt;
                 dprintk("cookie = %Lu, ", *((unsigned long long *)p));
@@ -3551,7 +3555,8 @@ static int decode_readlink(struct xdr_stream *xdr, struct rpc_rqst *req)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
-        int hdrlen, len, recvd;
+        size_t hdrlen;
+        u32 len, recvd;
         __be32 *p;
         char *kaddr;
         int status;
@@ -3646,7 +3651,8 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
         if (unlikely(bitmap[0] & (FATTR4_WORD0_ACL - 1U)))
                 return -EIO;
         if (likely(bitmap[0] & FATTR4_WORD0_ACL)) {
-                int hdrlen, recvd;
+                size_t hdrlen;
+                u32 recvd;
 
                 /* We ignore &savep and don't do consistency checks on
                  * the attr length.  Let userspace figure it out.... */
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 2dff469f04fe..7f079209d70a 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -58,7 +58,6 @@ nfs_create_request(struct nfs_open_context *ctx, struct inode *inode,
                    struct page *page,
                    unsigned int offset, unsigned int count)
 {
-        struct nfs_server *server = NFS_SERVER(inode);
         struct nfs_page         *req;
 
         for (;;) {
@@ -111,13 +110,14 @@ void nfs_unlock_request(struct nfs_page *req)
  * nfs_set_page_tag_locked - Tag a request as locked
  * @req:
  */
-static int nfs_set_page_tag_locked(struct nfs_page *req)
+int nfs_set_page_tag_locked(struct nfs_page *req)
 {
         struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
 
-        if (!nfs_lock_request(req))
+        if (!nfs_lock_request_dontget(req))
                 return 0;
-        radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+        if (req->wb_page != NULL)
+                radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
         return 1;
 }
 
@@ -132,9 +132,10 @@ void nfs_clear_page_tag_locked(struct nfs_page *req)
         if (req->wb_page != NULL) {
                 spin_lock(&inode->i_lock);
                 radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+                nfs_unlock_request(req);
                 spin_unlock(&inode->i_lock);
-        }
-        nfs_unlock_request(req);
+        } else
+                nfs_unlock_request(req);
 }
 
 /**
@@ -413,6 +414,7 @@ int nfs_scan_list(struct nfs_inode *nfsi,
                                 goto out;
                         idx_start = req->wb_index + 1;
                         if (nfs_set_page_tag_locked(req)) {
+                                kref_get(&req->wb_kref);
                                 nfs_list_remove_request(req);
                                 radix_tree_tag_clear(&nfsi->nfs_page_tree,
                                                 req->wb_index, tag);
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index 4f80d88e9fee..5ccf7faee19c 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -565,16 +565,9 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
         return 0;
 }
 
-static void nfs_proc_read_setup(struct nfs_read_data *data)
+static void nfs_proc_read_setup(struct nfs_read_data *data, struct rpc_message *msg)
 {
-        struct rpc_message      msg = {
-                .rpc_proc       = &nfs_procedures[NFSPROC_READ],
-                .rpc_argp       = &data->args,
-                .rpc_resp       = &data->res,
-                .rpc_cred       = data->cred,
-        };
-
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs_procedures[NFSPROC_READ];
 }
 
 static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
@@ -584,24 +577,15 @@ static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
         return 0;
 }
 
-static void nfs_proc_write_setup(struct nfs_write_data *data, int how)
+static void nfs_proc_write_setup(struct nfs_write_data *data, struct rpc_message *msg)
 {
-        struct rpc_message      msg = {
-                .rpc_proc       = &nfs_procedures[NFSPROC_WRITE],
-                .rpc_argp       = &data->args,
-                .rpc_resp       = &data->res,
-                .rpc_cred       = data->cred,
-        };
-
         /* Note: NFSv2 ignores @stable and always uses NFS_FILE_SYNC */
         data->args.stable = NFS_FILE_SYNC;
-
-        /* Finalize the task. */
-        rpc_call_setup(&data->task, &msg, 0);
+        msg->rpc_proc = &nfs_procedures[NFSPROC_WRITE];
 }
 
 static void
-nfs_proc_commit_setup(struct nfs_write_data *data, int how)
+nfs_proc_commit_setup(struct nfs_write_data *data, struct rpc_message *msg)
 {
         BUG();
 }
@@ -609,7 +593,9 @@ nfs_proc_commit_setup(struct nfs_write_data *data, int how)
 static int
 nfs_proc_lock(struct file *filp, int cmd, struct file_lock *fl)
 {
-        return nlmclnt_proc(filp->f_path.dentry->d_inode, cmd, fl);
+        struct inode *inode = filp->f_path.dentry->d_inode;
+
+        return nlmclnt_proc(NFS_SERVER(inode)->nlm_host, cmd, fl);
 }
 
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 3dcaa6a73261..8fd6dfbe1bc3 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -160,12 +160,26 @@ static void nfs_read_rpcsetup(struct nfs_page *req, struct nfs_read_data *data,
                 const struct rpc_call_ops *call_ops,
                 unsigned int count, unsigned int offset)
 {
-        struct inode            *inode;
-        int flags;
+        struct inode *inode = req->wb_context->path.dentry->d_inode;
+        int swap_flags = IS_SWAPFILE(inode) ? NFS_RPC_SWAPFLAGS : 0;
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_argp = &data->args,
+                .rpc_resp = &data->res,
+                .rpc_cred = req->wb_context->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .task = &data->task,
+                .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
+                .callback_ops = call_ops,
+                .callback_data = data,
+                .flags = RPC_TASK_ASYNC | swap_flags,
+        };
 
         data->req         = req;
-        data->inode       = inode = req->wb_context->path.dentry->d_inode;
-        data->cred        = req->wb_context->cred;
+        data->inode       = inode;
+        data->cred        = msg.rpc_cred;
 
         data->args.fh     = NFS_FH(inode);
         data->args.offset = req_offset(req) + offset;
@@ -180,11 +194,7 @@ static void nfs_read_rpcsetup(struct nfs_page *req, struct nfs_read_data *data,
         nfs_fattr_init(&data->fattr);
 
         /* Set up the initial task struct. */
-        flags = RPC_TASK_ASYNC | (IS_SWAPFILE(inode)? NFS_RPC_SWAPFLAGS : 0);
-        rpc_init_task(&data->task, NFS_CLIENT(inode), flags, call_ops, data);
-        NFS_PROTO(inode)->read_setup(data);
-
-        data->task.tk_cookie = (unsigned long)inode;
+        NFS_PROTO(inode)->read_setup(data, &msg);
 
         dprintk("NFS: %5u initiated read call (req %s/%Ld, %u bytes @ offset %Lu)\n",
                         data->task.tk_pid,
@@ -192,6 +202,10 @@ static void nfs_read_rpcsetup(struct nfs_page *req, struct nfs_read_data *data,
                         (long long)NFS_FILEID(inode),
                         count,
                         (unsigned long long)data->args.offset);
+
+        task = rpc_run_task(&task_setup_data);
+        if (!IS_ERR(task))
+                rpc_put_task(task);
 }
 
 static void
@@ -208,14 +222,6 @@ nfs_async_read_error(struct list_head *head)
 }
 
 /*
- * Start an async read operation
- */
-static void nfs_execute_read(struct nfs_read_data *data)
-{
-        rpc_execute(&data->task);
-}
-
-/*
  * Generate multiple requests to fill a single page.
  *
  * We optimize to reduce the number of read operations on the wire.  If we
@@ -269,7 +275,6 @@ static int nfs_pagein_multi(struct inode *inode, struct list_head *head, unsigne
                                   rsize, offset);
                 offset += rsize;
                 nbytes -= rsize;
-                nfs_execute_read(data);
         } while (nbytes != 0);
 
         return 0;
@@ -307,8 +312,6 @@ static int nfs_pagein_one(struct inode *inode, struct list_head *head, unsigned
         req = nfs_list_entry(data->pages.next);
 
         nfs_read_rpcsetup(req, data, &nfs_read_full_ops, count, 0);
-
-        nfs_execute_read(data);
         return 0;
 out_bad:
         nfs_async_read_error(head);
@@ -333,7 +336,7 @@ int nfs_readpage_result(struct rpc_task *task, struct nfs_read_data *data)
         nfs_add_stats(data->inode, NFSIOS_SERVERREADBYTES, data->res.count);
 
         if (task->tk_status == -ESTALE) {
-                set_bit(NFS_INO_STALE, &NFS_FLAGS(data->inode));
+                set_bit(NFS_INO_STALE, &NFS_I(data->inode)->flags);
                 nfs_mark_for_revalidate(data->inode);
         }
         return 0;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 5b6339f70a4c..7f4505f6ac6f 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -45,6 +45,8 @@
 #include <linux/nfs_idmap.h>
 #include <linux/vfs.h>
 #include <linux/inet.h>
+#include <linux/in6.h>
+#include <net/ipv6.h>
 #include <linux/nfs_xdr.h>
 #include <linux/magic.h>
 #include <linux/parser.h>
@@ -83,11 +85,11 @@ enum {
         Opt_actimeo,
         Opt_namelen,
         Opt_mountport,
-        Opt_mountprog, Opt_mountvers,
-        Opt_nfsprog, Opt_nfsvers,
+        Opt_mountvers,
+        Opt_nfsvers,
 
         /* Mount options that take string arguments */
-        Opt_sec, Opt_proto, Opt_mountproto,
+        Opt_sec, Opt_proto, Opt_mountproto, Opt_mounthost,
         Opt_addr, Opt_mountaddr, Opt_clientaddr,
 
         /* Mount options that are ignored */
@@ -137,9 +139,7 @@ static match_table_t nfs_mount_option_tokens = {
         { Opt_userspace, "retry=%u" },
         { Opt_namelen, "namlen=%u" },
         { Opt_mountport, "mountport=%u" },
-        { Opt_mountprog, "mountprog=%u" },
         { Opt_mountvers, "mountvers=%u" },
-        { Opt_nfsprog, "nfsprog=%u" },
         { Opt_nfsvers, "nfsvers=%u" },
         { Opt_nfsvers, "vers=%u" },
 
@@ -148,7 +148,7 @@ static match_table_t nfs_mount_option_tokens = {
         { Opt_mountproto, "mountproto=%s" },
         { Opt_addr, "addr=%s" },
         { Opt_clientaddr, "clientaddr=%s" },
-        { Opt_userspace, "mounthost=%s" },
+        { Opt_mounthost, "mounthost=%s" },
         { Opt_mountaddr, "mountaddr=%s" },
 
         { Opt_err, NULL }
@@ -202,6 +202,7 @@ static int nfs_get_sb(struct file_system_type *, int, const char *, void *, stru
 static int nfs_xdev_get_sb(struct file_system_type *fs_type,
                 int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt);
 static void nfs_kill_super(struct super_block *);
+static void nfs_put_super(struct super_block *);
 
 static struct file_system_type nfs_fs_type = {
         .owner          = THIS_MODULE,
@@ -223,6 +224,7 @@ static const struct super_operations nfs_sops = {
         .alloc_inode    = nfs_alloc_inode,
         .destroy_inode  = nfs_destroy_inode,
         .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
         .statfs         = nfs_statfs,
         .clear_inode    = nfs_clear_inode,
         .umount_begin   = nfs_umount_begin,
@@ -325,6 +327,28 @@ void __exit unregister_nfs_fs(void)
         unregister_filesystem(&nfs_fs_type);
 }
 
+void nfs_sb_active(struct nfs_server *server)
+{
+        atomic_inc(&server->active);
+}
+
+void nfs_sb_deactive(struct nfs_server *server)
+{
+        if (atomic_dec_and_test(&server->active))
+                wake_up(&server->active_wq);
+}
+
+static void nfs_put_super(struct super_block *sb)
+{
+        struct nfs_server *server = NFS_SB(sb);
+        /*
+         * Make sure there are no outstanding ops to this server.
+         * If so, wait for them to finish before allowing the
+         * unmount to continue.
+         */
+        wait_event(server->active_wq, atomic_read(&server->active) == 0);
+}
+
 /*
  * Deliver file system statistics to userspace
  */
@@ -454,8 +478,8 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,
         }
         seq_printf(m, ",proto=%s",
                    rpc_peeraddr2str(nfss->client, RPC_DISPLAY_PROTO));
-        seq_printf(m, ",timeo=%lu", 10U * clp->retrans_timeo / HZ);
-        seq_printf(m, ",retrans=%u", clp->retrans_count);
+        seq_printf(m, ",timeo=%lu", 10U * nfss->client->cl_timeout->to_initval / HZ);
+        seq_printf(m, ",retrans=%u", nfss->client->cl_timeout->to_retries);
         seq_printf(m, ",sec=%s", nfs_pseudoflavour_to_name(nfss->client->cl_auth->au_flavor));
 }
 
@@ -468,8 +492,9 @@ static int nfs_show_options(struct seq_file *m, struct vfsmount *mnt)
 
         nfs_show_mount_options(m, nfss, 0);
 
-        seq_printf(m, ",addr="NIPQUAD_FMT,
-                NIPQUAD(nfss->nfs_client->cl_addr.sin_addr));
+        seq_printf(m, ",addr=%s",
+                        rpc_peeraddr2str(nfss->nfs_client->cl_rpcclient,
+                                                        RPC_DISPLAY_ADDR));
 
         return 0;
 }
@@ -506,7 +531,7 @@ static int nfs_show_stats(struct seq_file *m, struct vfsmount *mnt)
         seq_printf(m, ",namelen=%d", nfss->namelen);
 
 #ifdef CONFIG_NFS_V4
-        if (nfss->nfs_client->cl_nfsversion == 4) {
+        if (nfss->nfs_client->rpc_ops->version == 4) {
                 seq_printf(m, "\n\tnfsv4:\t");
                 seq_printf(m, "bm0=0x%x", nfss->attr_bitmask[0]);
                 seq_printf(m, ",bm1=0x%x", nfss->attr_bitmask[1]);
@@ -574,16 +599,40 @@ static void nfs_umount_begin(struct vfsmount *vfsmnt, int flags)
 }
 
 /*
- * Sanity-check a server address provided by the mount command
+ * Set the port number in an address.  Be agnostic about the address family.
+ */
+static void nfs_set_port(struct sockaddr *sap, unsigned short port)
+{
+        switch (sap->sa_family) {
+        case AF_INET: {
+                struct sockaddr_in *ap = (struct sockaddr_in *)sap;
+                ap->sin_port = htons(port);
+                break;
+        }
+        case AF_INET6: {
+                struct sockaddr_in6 *ap = (struct sockaddr_in6 *)sap;
+                ap->sin6_port = htons(port);
+                break;
+        }
+        }
+}
+
+/*
+ * Sanity-check a server address provided by the mount command.
+ *
+ * Address family must be initialized, and address must not be
+ * the ANY address for that family.
  */
 static int nfs_verify_server_address(struct sockaddr *addr)
 {
         switch (addr->sa_family) {
         case AF_INET: {
-                struct sockaddr_in *sa = (struct sockaddr_in *) addr;
-                if (sa->sin_addr.s_addr != INADDR_ANY)
-                        return 1;
-                break;
+                struct sockaddr_in *sa = (struct sockaddr_in *)addr;
+                return sa->sin_addr.s_addr != INADDR_ANY;
+        }
+        case AF_INET6: {
+                struct in6_addr *sa = &((struct sockaddr_in6 *)addr)->sin6_addr;
+                return !ipv6_addr_any(sa);
         }
         }
 
@@ -591,6 +640,40 @@ static int nfs_verify_server_address(struct sockaddr *addr)
 }
 
 /*
+ * Parse string addresses passed in via a mount option,
+ * and construct a sockaddr based on the result.
+ *
+ * If address parsing fails, set the sockaddr's address
+ * family to AF_UNSPEC to force nfs_verify_server_address()
+ * to punt the mount.
+ */
+static void nfs_parse_server_address(char *value,
+                                     struct sockaddr *sap,
+                                     size_t *len)
+{
+        if (strchr(value, ':')) {
+                struct sockaddr_in6 *ap = (struct sockaddr_in6 *)sap;
+                u8 *addr = (u8 *)&ap->sin6_addr.in6_u;
+
+                ap->sin6_family = AF_INET6;
+                *len = sizeof(*ap);
+                if (in6_pton(value, -1, addr, '\0', NULL))
+                        return;
+        } else {
+                struct sockaddr_in *ap = (struct sockaddr_in *)sap;
+                u8 *addr = (u8 *)&ap->sin_addr.s_addr;
+
+                ap->sin_family = AF_INET;
+                *len = sizeof(*ap);
+                if (in4_pton(value, -1, addr, '\0', NULL))
+                        return;
+        }
+
+        sap->sa_family = AF_UNSPEC;
+        *len = 0;
+}
+
+/*
  * Error-check and convert a string of mount options from user space into
  * a data structure
  */
@@ -598,6 +681,7 @@ static int nfs_parse_mount_options(char *raw,
                                    struct nfs_parsed_mount_data *mnt)
 {
         char *p, *string;
+        unsigned short port = 0;
 
         if (!raw) {
                 dfprintk(MOUNT, "NFS: mount options string was NULL.\n");
@@ -697,7 +781,7 @@ static int nfs_parse_mount_options(char *raw,
                                 return 0;
                         if (option < 0 || option > 65535)
                                 return 0;
-                        mnt->nfs_server.address.sin_port = htons(option);
+                        port = option;
                         break;
                 case Opt_rsize:
                         if (match_int(args, &mnt->rsize))
@@ -759,13 +843,6 @@ static int nfs_parse_mount_options(char *raw,
                                 return 0;
                         mnt->mount_server.port = option;
                         break;
-                case Opt_mountprog:
-                        if (match_int(args, &option))
-                                return 0;
-                        if (option < 0)
-                                return 0;
-                        mnt->mount_server.program = option;
-                        break;
                 case Opt_mountvers:
                         if (match_int(args, &option))
                                 return 0;
@@ -773,13 +850,6 @@ static int nfs_parse_mount_options(char *raw,
                                 return 0;
                         mnt->mount_server.version = option;
                         break;
-                case Opt_nfsprog:
-                        if (match_int(args, &option))
-                                return 0;
-                        if (option < 0)
-                                return 0;
-                        mnt->nfs_server.program = option;
-                        break;
                 case Opt_nfsvers:
                         if (match_int(args, &option))
                                 return 0;
@@ -923,24 +993,32 @@ static int nfs_parse_mount_options(char *raw,
                         string = match_strdup(args);
                         if (string == NULL)
                                 goto out_nomem;
-                        mnt->nfs_server.address.sin_family = AF_INET;
-                        mnt->nfs_server.address.sin_addr.s_addr =
-                                                        in_aton(string);
+                        nfs_parse_server_address(string, (struct sockaddr *)
+                                                 &mnt->nfs_server.address,
+                                                 &mnt->nfs_server.addrlen);
                         kfree(string);
                         break;
                 case Opt_clientaddr:
                         string = match_strdup(args);
                         if (string == NULL)
                                 goto out_nomem;
+                        kfree(mnt->client_address);
                         mnt->client_address = string;
                         break;
+                case Opt_mounthost:
+                        string = match_strdup(args);
+                        if (string == NULL)
+                                goto out_nomem;
+                        kfree(mnt->mount_server.hostname);
+                        mnt->mount_server.hostname = string;
+                        break;
                 case Opt_mountaddr:
                         string = match_strdup(args);
                         if (string == NULL)
                                 goto out_nomem;
-                        mnt->mount_server.address.sin_family = AF_INET;
-                        mnt->mount_server.address.sin_addr.s_addr =
-                                                        in_aton(string);
+                        nfs_parse_server_address(string, (struct sockaddr *)
+                                                 &mnt->mount_server.address,
+                                                 &mnt->mount_server.addrlen);
                         kfree(string);
                         break;
 
@@ -953,6 +1031,8 @@ static int nfs_parse_mount_options(char *raw,
                 }
         }
 
+        nfs_set_port((struct sockaddr *)&mnt->nfs_server.address, port);
+
         return 1;
 
 out_nomem:
@@ -983,7 +1063,8 @@ out_unknown:
 static int nfs_try_mount(struct nfs_parsed_mount_data *args,
                          struct nfs_fh *root_fh)
 {
-        struct sockaddr_in sin;
+        struct sockaddr *sap = (struct sockaddr *)&args->mount_server.address;
+        char *hostname;
         int status;
 
         if (args->mount_server.version == 0) {
@@ -993,25 +1074,32 @@ static int nfs_try_mount(struct nfs_parsed_mount_data *args,
                         args->mount_server.version = NFS_MNT_VERSION;
         }
 
+        if (args->mount_server.hostname)
+                hostname = args->mount_server.hostname;
+        else
+                hostname = args->nfs_server.hostname;
+
         /*
          * Construct the mount server's address.
          */
-        if (args->mount_server.address.sin_addr.s_addr != INADDR_ANY)
-                sin = args->mount_server.address;
-        else
-                sin = args->nfs_server.address;
+        if (args->mount_server.address.ss_family == AF_UNSPEC) {
+                memcpy(sap, &args->nfs_server.address,
+                       args->nfs_server.addrlen);
+                args->mount_server.addrlen = args->nfs_server.addrlen;
+        }
+
         /*
          * autobind will be used if mount_server.port == 0
          */
-        sin.sin_port = htons(args->mount_server.port);
+        nfs_set_port(sap, args->mount_server.port);
 
         /*
          * Now ask the mount server to map our export path
          * to a file handle.
          */
-        status = nfs_mount((struct sockaddr *) &sin,
-                           sizeof(sin),
-                           args->nfs_server.hostname,
+        status = nfs_mount(sap,
+                           args->mount_server.addrlen,
+                           hostname,
                            args->nfs_server.export_path,
                            args->mount_server.version,
                            args->mount_server.protocol,
@@ -1019,8 +1107,8 @@ static int nfs_try_mount(struct nfs_parsed_mount_data *args,
         if (status == 0)
                 return 0;
 
-        dfprintk(MOUNT, "NFS: unable to mount server " NIPQUAD_FMT
-                        ", error %d\n", NIPQUAD(sin.sin_addr.s_addr), status);
+        dfprintk(MOUNT, "NFS: unable to mount server %s, error %d",
+                        hostname, status);
         return status;
 }
 
@@ -1039,9 +1127,6 @@ static int nfs_try_mount(struct nfs_parsed_mount_data *args,
  *
  * + breaking back: trying proto=udp after proto=tcp, v2 after v3,
  *   mountproto=tcp after mountproto=udp, and so on
- *
- * XXX: as far as I can tell, changing the NFS program number is not
- *      supported in the NFS client.
  */
 static int nfs_validate_mount_data(void *options,
                                    struct nfs_parsed_mount_data *args,
@@ -1065,9 +1150,7 @@ static int nfs_validate_mount_data(void *options,
         args->acdirmin          = 30;
         args->acdirmax          = 60;
         args->mount_server.protocol = XPRT_TRANSPORT_UDP;
-        args->mount_server.program = NFS_MNT_PROGRAM;
         args->nfs_server.protocol = XPRT_TRANSPORT_TCP;
-        args->nfs_server.program = NFS_PROGRAM;
 
         switch (data->version) {
         case 1:
@@ -1098,9 +1181,6 @@ static int nfs_validate_mount_data(void *options,
                         memset(mntfh->data + mntfh->size, 0,
                                sizeof(mntfh->data) - mntfh->size);
 
-                if (!nfs_verify_server_address((struct sockaddr *) &data->addr))
-                        goto out_no_address;
-
                 /*
                  * Translate to nfs_parsed_mount_data, which nfs_fill_super
                  * can deal with.
@@ -1115,7 +1195,14 @@ static int nfs_validate_mount_data(void *options,
                 args->acregmax          = data->acregmax;
                 args->acdirmin          = data->acdirmin;
                 args->acdirmax          = data->acdirmax;
-                args->nfs_server.address = data->addr;
+
+                memcpy(&args->nfs_server.address, &data->addr,
+                       sizeof(data->addr));
+                args->nfs_server.addrlen = sizeof(data->addr);
+                if (!nfs_verify_server_address((struct sockaddr *)
+                                                &args->nfs_server.address))
+                        goto out_no_address;
+
                 if (!(data->flags & NFS_MOUNT_TCP))
                         args->nfs_server.protocol = XPRT_TRANSPORT_UDP;
                 /* N.B. caller will free nfs_server.hostname in all cases */
@@ -1318,15 +1405,50 @@ static int nfs_set_super(struct super_block *s, void *data)
         return ret;
 }
 
+static int nfs_compare_super_address(struct nfs_server *server1,
+                                     struct nfs_server *server2)
+{
+        struct sockaddr *sap1, *sap2;
+
+        sap1 = (struct sockaddr *)&server1->nfs_client->cl_addr;
+        sap2 = (struct sockaddr *)&server2->nfs_client->cl_addr;
+
+        if (sap1->sa_family != sap2->sa_family)
+                return 0;
+
+        switch (sap1->sa_family) {
+        case AF_INET: {
+                struct sockaddr_in *sin1 = (struct sockaddr_in *)sap1;
+                struct sockaddr_in *sin2 = (struct sockaddr_in *)sap2;
+                if (sin1->sin_addr.s_addr != sin2->sin_addr.s_addr)
+                        return 0;
+                if (sin1->sin_port != sin2->sin_port)
+                        return 0;
+                break;
+        }
+        case AF_INET6: {
+                struct sockaddr_in6 *sin1 = (struct sockaddr_in6 *)sap1;
+                struct sockaddr_in6 *sin2 = (struct sockaddr_in6 *)sap2;
+                if (!ipv6_addr_equal(&sin1->sin6_addr, &sin2->sin6_addr))
+                        return 0;
+                if (sin1->sin6_port != sin2->sin6_port)
+                        return 0;
+                break;
+        }
+        default:
+                return 0;
+        }
+
+        return 1;
+}
+
 static int nfs_compare_super(struct super_block *sb, void *data)
 {
         struct nfs_sb_mountdata *sb_mntdata = data;
         struct nfs_server *server = sb_mntdata->server, *old = NFS_SB(sb);
         int mntflags = sb_mntdata->mntflags;
 
-        if (memcmp(&old->nfs_client->cl_addr,
-                                &server->nfs_client->cl_addr,
-                                sizeof(old->nfs_client->cl_addr)) != 0)
+        if (!nfs_compare_super_address(old, server))
                 return 0;
         /* Note: NFS_MOUNT_UNSHARED == NFS4_MOUNT_UNSHARED */
         if (old->flags & NFS_MOUNT_UNSHARED)
@@ -1396,6 +1518,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 
 out:
         kfree(data.nfs_server.hostname);
+        kfree(data.mount_server.hostname);
         return error;
 
 out_err_nosb:
@@ -1471,7 +1594,7 @@ static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
-        if (mntroot->d_inode->i_op != &nfs_dir_inode_operations) {
+        if (mntroot->d_inode->i_op != NFS_SB(s)->nfs_client->rpc_ops->dir_inode_ops) {
                 dput(mntroot);
                 error = -ESTALE;
                 goto error_splat_super;
@@ -1524,12 +1647,35 @@ static void nfs4_fill_super(struct super_block *sb)
 }
 
 /*
+ * If the user didn't specify a port, set the port number to
+ * the NFS version 4 default port.
+ */
+static void nfs4_default_port(struct sockaddr *sap)
+{
+        switch (sap->sa_family) {
+        case AF_INET: {
+                struct sockaddr_in *ap = (struct sockaddr_in *)sap;
+                if (ap->sin_port == 0)
+                        ap->sin_port = htons(NFS_PORT);
+                break;
+        }
+        case AF_INET6: {
+                struct sockaddr_in6 *ap = (struct sockaddr_in6 *)sap;
+                if (ap->sin6_port == 0)
+                        ap->sin6_port = htons(NFS_PORT);
+                break;
+        }
+        }
+}
+
+/*
  * Validate NFSv4 mount options
  */
 static int nfs4_validate_mount_data(void *options,
                                     struct nfs_parsed_mount_data *args,
                                     const char *dev_name)
 {
+        struct sockaddr_in *ap;
         struct nfs4_mount_data *data = (struct nfs4_mount_data *)options;
         char *c;
 
@@ -1550,18 +1696,21 @@ static int nfs4_validate_mount_data(void *options,
 
         switch (data->version) {
         case 1:
-                if (data->host_addrlen != sizeof(args->nfs_server.address))
+                ap = (struct sockaddr_in *)&args->nfs_server.address;
+                if (data->host_addrlen > sizeof(args->nfs_server.address))
+                        goto out_no_address;
+                if (data->host_addrlen == 0)
                         goto out_no_address;
-                if (copy_from_user(&args->nfs_server.address,
-                                   data->host_addr,
-                                   sizeof(args->nfs_server.address)))
+                args->nfs_server.addrlen = data->host_addrlen;
+                if (copy_from_user(ap, data->host_addr, data->host_addrlen))
                         return -EFAULT;
-                if (args->nfs_server.address.sin_port == 0)
-                        args->nfs_server.address.sin_port = htons(NFS_PORT);
                 if (!nfs_verify_server_address((struct sockaddr *)
                                                 &args->nfs_server.address))
                         goto out_no_address;
 
+                nfs4_default_port((struct sockaddr *)
+                                  &args->nfs_server.address);
+
                 switch (data->auth_flavourlen) {
                 case 0:
                         args->auth_flavors[0] = RPC_AUTH_UNIX;
@@ -1619,6 +1768,9 @@ static int nfs4_validate_mount_data(void *options,
                                                 &args->nfs_server.address))
                         return -EINVAL;
 
+                nfs4_default_port((struct sockaddr *)
+                                  &args->nfs_server.address);
+
                 switch (args->auth_flavor_len) {
                 case 0:
                         args->auth_flavors[0] = RPC_AUTH_UNIX;
@@ -1639,21 +1791,16 @@ static int nfs4_validate_mount_data(void *options,
                 len = c - dev_name;
                 if (len > NFS4_MAXNAMLEN)
                         return -ENAMETOOLONG;
-                args->nfs_server.hostname = kzalloc(len, GFP_KERNEL);
-                if (args->nfs_server.hostname == NULL)
-                        return -ENOMEM;
-                strncpy(args->nfs_server.hostname, dev_name, len - 1);
+                /* N.B. caller will free nfs_server.hostname in all cases */
+                args->nfs_server.hostname = kstrndup(dev_name, len, GFP_KERNEL);
 
                 c++;                    /* step over the ':' */
                 len = strlen(c);
                 if (len > NFS4_MAXPATHLEN)
                         return -ENAMETOOLONG;
-                args->nfs_server.export_path = kzalloc(len + 1, GFP_KERNEL);
-                if (args->nfs_server.export_path == NULL)
-                        return -ENOMEM;
-                strncpy(args->nfs_server.export_path, c, len);
+                args->nfs_server.export_path = kstrndup(c, len, GFP_KERNEL);
 
-                dprintk("MNTPATH: %s\n", args->nfs_server.export_path);
+                dprintk("NFS: MNTPATH: '%s'\n", args->nfs_server.export_path);
 
                 if (args->client_address == NULL)
                         goto out_no_client_address;
@@ -1822,6 +1969,11 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
+        if (mntroot->d_inode->i_op != NFS_SB(s)->nfs_client->rpc_ops->dir_inode_ops) {
+                dput(mntroot);
+                error = -ESTALE;
+                goto error_splat_super;
+        }
 
         s->s_flags |= MS_ACTIVE;
         mnt->mnt_sb = s;
@@ -1896,6 +2048,11 @@ static int nfs4_referral_get_sb(struct file_system_type *fs_type, int flags,
                 error = PTR_ERR(mntroot);
                 goto error_splat_super;
         }
+        if (mntroot->d_inode->i_op != NFS_SB(s)->nfs_client->rpc_ops->dir_inode_ops) {
+                dput(mntroot);
+                error = -ESTALE;
+                goto error_splat_super;
+        }
 
         s->s_flags |= MS_ACTIVE;
         mnt->mnt_sb = s;
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 233ad38161f9..757415363422 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -14,6 +14,8 @@
 #include <linux/sched.h>
 #include <linux/wait.h>
 
+#include "internal.h"
+
 struct nfs_unlinkdata {
         struct hlist_node list;
         struct nfs_removeargs args;
@@ -69,24 +71,6 @@ static void nfs_dec_sillycount(struct inode *dir)
 }
 
 /**
- * nfs_async_unlink_init - Initialize the RPC info
- * task: rpc_task of the sillydelete
- */
-static void nfs_async_unlink_init(struct rpc_task *task, void *calldata)
-{
-        struct nfs_unlinkdata *data = calldata;
-        struct inode *dir = data->dir;
-        struct rpc_message msg = {
-                .rpc_argp = &data->args,
-                .rpc_resp = &data->res,
-                .rpc_cred = data->cred,
-        };
-
-        NFS_PROTO(dir)->unlink_setup(&msg, dir);
-        rpc_call_setup(task, &msg, 0);
-}
-
-/**
  * nfs_async_unlink_done - Sillydelete post-processing
  * @task: rpc_task of the sillydelete
  *
@@ -113,32 +97,45 @@ static void nfs_async_unlink_release(void *calldata)
         struct nfs_unlinkdata   *data = calldata;
 
         nfs_dec_sillycount(data->dir);
+        nfs_sb_deactive(NFS_SERVER(data->dir));
         nfs_free_unlinkdata(data);
 }
 
 static const struct rpc_call_ops nfs_unlink_ops = {
-        .rpc_call_prepare = nfs_async_unlink_init,
         .rpc_call_done = nfs_async_unlink_done,
         .rpc_release = nfs_async_unlink_release,
 };
 
 static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct nfs_unlinkdata *data)
 {
+        struct rpc_message msg = {
+                .rpc_argp = &data->args,
+                .rpc_resp = &data->res,
+                .rpc_cred = data->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_message = &msg,
+                .callback_ops = &nfs_unlink_ops,
+                .callback_data = data,
+                .flags = RPC_TASK_ASYNC,
+        };
         struct rpc_task *task;
         struct dentry *alias;
 
         alias = d_lookup(parent, &data->args.name);
         if (alias != NULL) {
                 int ret = 0;
+
                 /*
                  * Hey, we raced with lookup... See if we need to transfer
                  * the sillyrename information to the aliased dentry.
                  */
                 nfs_free_dname(data);
                 spin_lock(&alias->d_lock);
-                if (!(alias->d_flags & DCACHE_NFSFS_RENAMED)) {
+                if (alias->d_inode != NULL &&
+                    !(alias->d_flags & DCACHE_NFSFS_RENAMED)) {
                         alias->d_fsdata = data;
-                        alias->d_flags ^= DCACHE_NFSFS_RENAMED;
+                        alias->d_flags |= DCACHE_NFSFS_RENAMED;
                         ret = 1;
                 }
                 spin_unlock(&alias->d_lock);
@@ -151,10 +148,14 @@ static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct n
                 nfs_dec_sillycount(dir);
                 return 0;
         }
+        nfs_sb_active(NFS_SERVER(dir));
         data->args.fh = NFS_FH(dir);
         nfs_fattr_init(&data->res.dir_attr);
 
-        task = rpc_run_task(NFS_CLIENT(dir), RPC_TASK_ASYNC, &nfs_unlink_ops, data);
+        NFS_PROTO(dir)->unlink_setup(&msg, dir);
+
+        task_setup_data.rpc_client = NFS_CLIENT(dir);
+        task = rpc_run_task(&task_setup_data);
         if (!IS_ERR(task))
                 rpc_put_task(task);
         return 1;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 60e3e870ada4..522efff3e2c5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -196,7 +196,7 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
         }
         /* Update file length */
         nfs_grow_file(page, offset, count);
-        nfs_unlock_request(req);
+        nfs_clear_page_tag_locked(req);
         return 0;
 }
 
@@ -252,7 +252,6 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                                 struct page *page)
 {
         struct inode *inode = page->mapping->host;
-        struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_page *req;
         int ret;
 
@@ -263,10 +262,10 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                         spin_unlock(&inode->i_lock);
                         return 0;
                 }
-                if (nfs_lock_request_dontget(req))
+                if (nfs_set_page_tag_locked(req))
                         break;
                 /* Note: If we hold the page lock, as is the case in nfs_writepage,
-                 *       then the call to nfs_lock_request_dontget() will always
+                 *       then the call to nfs_set_page_tag_locked() will always
                  *       succeed provided that someone hasn't already marked the
                  *       request as dirty (in which case we don't care).
                  */
@@ -280,7 +279,7 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
         if (test_bit(PG_NEED_COMMIT, &req->wb_flags)) {
                 /* This request is marked for commit */
                 spin_unlock(&inode->i_lock);
-                nfs_unlock_request(req);
+                nfs_clear_page_tag_locked(req);
                 nfs_pageio_complete(pgio);
                 return 0;
         }
@@ -288,8 +287,6 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                 spin_unlock(&inode->i_lock);
                 BUG();
         }
-        radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index,
-                        NFS_PAGE_TAG_LOCKED);
         spin_unlock(&inode->i_lock);
         nfs_pageio_add_request(pgio, req);
         return 0;
@@ -381,6 +378,7 @@ static int nfs_inode_add_request(struct inode *inode, struct nfs_page *req)
         set_page_private(req->wb_page, (unsigned long)req);
         nfsi->npages++;
         kref_get(&req->wb_kref);
+        radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
         return 0;
 }
 
@@ -596,7 +594,7 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
                 spin_lock(&inode->i_lock);
                 req = nfs_page_find_request_locked(page);
                 if (req) {
-                        if (!nfs_lock_request_dontget(req)) {
+                        if (!nfs_set_page_tag_locked(req)) {
                                 int error;
 
                                 spin_unlock(&inode->i_lock);
@@ -646,7 +644,7 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
             || req->wb_page != page
             || !nfs_dirty_request(req)
             || offset > rqend || end < req->wb_offset) {
-                nfs_unlock_request(req);
+                nfs_clear_page_tag_locked(req);
                 return ERR_PTR(-EBUSY);
         }
 
@@ -755,7 +753,7 @@ static void nfs_writepage_release(struct nfs_page *req)
         nfs_clear_page_tag_locked(req);
 }
 
-static inline int flush_task_priority(int how)
+static int flush_task_priority(int how)
 {
         switch (how & (FLUSH_HIGHPRI|FLUSH_LOWPRI)) {
                 case FLUSH_HIGHPRI:
@@ -775,15 +773,31 @@ static void nfs_write_rpcsetup(struct nfs_page *req,
                 unsigned int count, unsigned int offset,
                 int how)
 {
-        struct inode            *inode;
-        int flags;
+        struct inode *inode = req->wb_context->path.dentry->d_inode;
+        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
+        int priority = flush_task_priority(how);
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_argp = &data->args,
+                .rpc_resp = &data->res,
+                .rpc_cred = req->wb_context->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = NFS_CLIENT(inode),
+                .task = &data->task,
+                .rpc_message = &msg,
+                .callback_ops = call_ops,
+                .callback_data = data,
+                .flags = flags,
+                .priority = priority,
+        };
 
         /* Set up the RPC argument and reply structs
          * NB: take care not to mess about with data->commit et al. */
 
         data->req = req;
         data->inode = inode = req->wb_context->path.dentry->d_inode;
-        data->cred = req->wb_context->cred;
+        data->cred = msg.rpc_cred;
 
         data->args.fh     = NFS_FH(inode);
         data->args.offset = req_offset(req) + offset;
@@ -791,6 +805,12 @@ static void nfs_write_rpcsetup(struct nfs_page *req,
         data->args.pages  = data->pagevec;
         data->args.count  = count;
         data->args.context = req->wb_context;
+        data->args.stable  = NFS_UNSTABLE;
+        if (how & FLUSH_STABLE) {
+                data->args.stable = NFS_DATA_SYNC;
+                if (!NFS_I(inode)->ncommit)
+                        data->args.stable = NFS_FILE_SYNC;
+        }
 
         data->res.fattr   = &data->fattr;
         data->res.count   = count;
@@ -798,12 +818,7 @@ static void nfs_write_rpcsetup(struct nfs_page *req,
         nfs_fattr_init(&data->fattr);
 
         /* Set up the initial task struct.  */
-        flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
-        rpc_init_task(&data->task, NFS_CLIENT(inode), flags, call_ops, data);
-        NFS_PROTO(inode)->write_setup(data, how);
-
-        data->task.tk_priority = flush_task_priority(how);
-        data->task.tk_cookie = (unsigned long)inode;
+        NFS_PROTO(inode)->write_setup(data, &msg);
 
         dprintk("NFS: %5u initiated write call "
                 "(req %s/%Ld, %u bytes @ offset %Lu)\n",
@@ -812,11 +827,10 @@ static void nfs_write_rpcsetup(struct nfs_page *req,
                 (long long)NFS_FILEID(inode),
                 count,
                 (unsigned long long)data->args.offset);
-}
 
-static void nfs_execute_write(struct nfs_write_data *data)
-{
-        rpc_execute(&data->task);
+        task = rpc_run_task(&task_setup_data);
+        if (!IS_ERR(task))
+                rpc_put_task(task);
 }
 
 /*
@@ -863,7 +877,6 @@ static int nfs_flush_multi(struct inode *inode, struct list_head *head, unsigned
                                    wsize, offset, how);
                 offset += wsize;
                 nbytes -= wsize;
-                nfs_execute_write(data);
         } while (nbytes != 0);
 
         return 0;
@@ -911,7 +924,6 @@ static int nfs_flush_one(struct inode *inode, struct list_head *head, unsigned i
         /* Set up the argument struct */
         nfs_write_rpcsetup(req, data, &nfs_write_full_ops, count, 0, how);
 
-        nfs_execute_write(data);
         return 0;
  out_bad:
         while (!list_empty(head)) {
@@ -927,7 +939,7 @@ static int nfs_flush_one(struct inode *inode, struct list_head *head, unsigned i
 static void nfs_pageio_init_write(struct nfs_pageio_descriptor *pgio,
                                   struct inode *inode, int ioflags)
 {
-        int wsize = NFS_SERVER(inode)->wsize;
+        size_t wsize = NFS_SERVER(inode)->wsize;
 
         if (wsize < PAGE_CACHE_SIZE)
                 nfs_pageio_init(pgio, inode, nfs_flush_multi, wsize, ioflags);
@@ -1141,19 +1153,33 @@ static void nfs_commit_rpcsetup(struct list_head *head,
                 struct nfs_write_data *data,
                 int how)
 {
-        struct nfs_page         *first;
-        struct inode            *inode;
-        int flags;
+        struct nfs_page *first = nfs_list_entry(head->next);
+        struct inode *inode = first->wb_context->path.dentry->d_inode;
+        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
+        int priority = flush_task_priority(how);
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_argp = &data->args,
+                .rpc_resp = &data->res,
+                .rpc_cred = first->wb_context->cred,
+        };
+        struct rpc_task_setup task_setup_data = {
+                .task = &data->task,
+                .rpc_client = NFS_CLIENT(inode),
+                .rpc_message = &msg,
+                .callback_ops = &nfs_commit_ops,
+                .callback_data = data,
+                .flags = flags,
+                .priority = priority,
+        };
 
         /* Set up the RPC argument and reply structs
          * NB: take care not to mess about with data->commit et al. */
 
         list_splice_init(head, &data->pages);
-        first = nfs_list_entry(data->pages.next);
-        inode = first->wb_context->path.dentry->d_inode;
 
         data->inode       = inode;
-        data->cred        = first->wb_context->cred;
+        data->cred        = msg.rpc_cred;
 
         data->args.fh     = NFS_FH(data->inode);
         /* Note: we always request a commit of the entire inode */
@@ -1165,14 +1191,13 @@ static void nfs_commit_rpcsetup(struct list_head *head,
         nfs_fattr_init(&data->fattr);
 
         /* Set up the initial task struct.  */
-        flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
-        rpc_init_task(&data->task, NFS_CLIENT(inode), flags, &nfs_commit_ops, data);
-        NFS_PROTO(inode)->commit_setup(data, how);
+        NFS_PROTO(inode)->commit_setup(data, &msg);
 
-        data->task.tk_priority = flush_task_priority(how);
-        data->task.tk_cookie = (unsigned long)inode;
-        
         dprintk("NFS: %5u initiated commit call\n", data->task.tk_pid);
+
+        task = rpc_run_task(&task_setup_data);
+        if (!IS_ERR(task))
+                rpc_put_task(task);
 }
 
 /*
@@ -1192,7 +1217,6 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how)
         /* Set up the argument struct */
         nfs_commit_rpcsetup(head, data, how);
 
-        nfs_execute_write(data);
         return 0;
  out_bad:
         while (!list_empty(head)) {