37 files changed, 1943 insertions, 1029 deletions

diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 2a77bc25d5af..a43d07e7b924 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -90,13 +90,12 @@ config ROOT_NFS
           If you want your system to mount its root file system via NFS,
           choose Y here.  This is common practice for managing systems
           without local permanent storage.  For details, read
-          <file:Documentation/filesystems/nfsroot.txt>.
+          <file:Documentation/filesystems/nfs/nfsroot.txt>.
 
           Most people say N here.
 
 config NFS_FSCACHE
-        bool "Provide NFS client caching support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        bool "Provide NFS client caching support"
         depends on NFS_FS=m && FSCACHE || NFS_FS=y && FSCACHE=y
         help
           Say Y here if you want NFS data to be cached locally on disc through
diff --git a/fs/nfs/cache_lib.c b/fs/nfs/cache_lib.c
index b4ffd0146ea6..84690319e625 100644
--- a/fs/nfs/cache_lib.c
+++ b/fs/nfs/cache_lib.c
@@ -10,6 +10,7 @@
 #include <linux/moduleparam.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/cache.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 293fa0528a6e..36dfdae95123 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -78,11 +78,6 @@ nfs4_callback_svc(void *vrqstp)
 
         set_freezable();
 
-        /*
-         * FIXME: do we really need to run this under the BKL? If so, please
-         * add a comment about what it's intended to protect.
-         */
-        lock_kernel();
         while (!kthread_should_stop()) {
                 /*
                  * Listen for a request on the socket
@@ -104,7 +99,6 @@ nfs4_callback_svc(void *vrqstp)
                 preverr = err;
                 svc_process(rqstp);
         }
-        unlock_kernel();
         return 0;
 }
 
@@ -124,7 +118,6 @@ nfs4_callback_up(struct svc_serv *serv)
         dprintk("NFS: Callback listener port = %u (af %u)\n",
                         nfs_callback_tcpport, PF_INET);
 
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         ret = svc_create_xprt(serv, "tcp", PF_INET6,
                                 nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
         if (ret > 0) {
@@ -135,7 +128,6 @@ nfs4_callback_up(struct svc_serv *serv)
                 ret = 0;
         else
                 goto out_err;
-#endif  /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
 
         return svc_prepare_thread(serv, &serv->sv_pools[0]);
 
@@ -160,11 +152,6 @@ nfs41_callback_svc(void *vrqstp)
 
         set_freezable();
 
-        /*
-         * FIXME: do we really need to run this under the BKL? If so, please
-         * add a comment about what it's intended to protect.
-         */
-        lock_kernel();
         while (!kthread_should_stop()) {
                 prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
                 spin_lock_bh(&serv->sv_cb_lock);
@@ -183,7 +170,6 @@ nfs41_callback_svc(void *vrqstp)
                 }
                 finish_wait(&serv->sv_cb_waitq, &wq);
         }
-        unlock_kernel();
         return 0;
 }
 
@@ -397,6 +383,7 @@ static int nfs_callback_authenticate(struct svc_rqst *rqstp)
  */
 static struct svc_version *nfs4_callback_version[] = {
         [1] = &nfs4_callback_version1,
+        [4] = &nfs4_callback_version4,
 };
 
 static struct svc_stat nfs4_callback_stats;
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index 07baa8254ca1..85a7cfd1b8dd 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -106,6 +106,27 @@ struct cb_sequenceres {
 extern unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
                                        struct cb_sequenceres *res);
 
+extern int nfs41_validate_delegation_stateid(struct nfs_delegation *delegation,
+                                             const nfs4_stateid *stateid);
+
+#define RCA4_TYPE_MASK_RDATA_DLG        0
+#define RCA4_TYPE_MASK_WDATA_DLG        1
+
+struct cb_recallanyargs {
+        struct sockaddr *craa_addr;
+        uint32_t        craa_objs_to_keep;
+        uint32_t        craa_type_mask;
+};
+
+extern unsigned nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy);
+
+struct cb_recallslotargs {
+        struct sockaddr *crsa_addr;
+        uint32_t        crsa_target_max_slots;
+};
+extern unsigned nfs4_callback_recallslot(struct cb_recallslotargs *args,
+                                          void *dummy);
+
 #endif /* CONFIG_NFS_V4_1 */
 
 extern __be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res);
@@ -114,8 +135,9 @@ extern __be32 nfs4_callback_recall(struct cb_recallargs *args, void *dummy);
 #ifdef CONFIG_NFS_V4
 extern int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt);
 extern void nfs_callback_down(int minorversion);
+extern int nfs4_validate_delegation_stateid(struct nfs_delegation *delegation,
+                                            const nfs4_stateid *stateid);
 #endif /* CONFIG_NFS_V4 */
-
 /*
  * nfs41: Callbacks are expected to not cause substantial latency,
  * so we limit their concurrency to 1 by setting up the maximum number
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index b7da1f54da68..a08770a7e857 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -7,6 +7,7 @@
  */
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include "nfs4_fs.h"
 #include "callback.h"
 #include "delegation.h"
@@ -61,6 +62,16 @@ out:
         return res->status;
 }
 
+static int (*nfs_validate_delegation_stateid(struct nfs_client *clp))(struct nfs_delegation *, const nfs4_stateid *)
+{
+#if defined(CONFIG_NFS_V4_1)
+        if (clp->cl_minorversion > 0)
+                return nfs41_validate_delegation_stateid;
+#endif
+        return nfs4_validate_delegation_stateid;
+}
+
+
 __be32 nfs4_callback_recall(struct cb_recallargs *args, void *dummy)
 {
         struct nfs_client *clp;
@@ -81,7 +92,8 @@ __be32 nfs4_callback_recall(struct cb_recallargs *args, void *dummy)
                 inode = nfs_delegation_find_inode(clp, &args->fh);
                 if (inode != NULL) {
                         /* Set up a helper thread to actually return the delegation */
-                        switch(nfs_async_inode_return_delegation(inode, &args->stateid)) {
+                        switch (nfs_async_inode_return_delegation(inode, &args->stateid,
+                                                                  nfs_validate_delegation_stateid(clp))) {
                                 case 0:
                                         res = 0;
                                         break;
@@ -102,51 +114,79 @@ out:
         return res;
 }
 
+int nfs4_validate_delegation_stateid(struct nfs_delegation *delegation, const nfs4_stateid *stateid)
+{
+        if (delegation == NULL || memcmp(delegation->stateid.data, stateid->data,
+                                         sizeof(delegation->stateid.data)) != 0)
+                return 0;
+        return 1;
+}
+
 #if defined(CONFIG_NFS_V4_1)
 
+int nfs41_validate_delegation_stateid(struct nfs_delegation *delegation, const nfs4_stateid *stateid)
+{
+        if (delegation == NULL)
+                return 0;
+
+        /* seqid is 4-bytes long */
+        if (((u32 *) &stateid->data)[0] != 0)
+                return 0;
+        if (memcmp(&delegation->stateid.data[4], &stateid->data[4],
+                   sizeof(stateid->data)-4))
+                return 0;
+
+        return 1;
+}
+
 /*
  * Validate the sequenceID sent by the server.
  * Return success if the sequenceID is one more than what we last saw on
  * this slot, accounting for wraparound.  Increments the slot's sequence.
  *
- * We don't yet implement a duplicate request cache, so at this time
- * we will log replays, and process them as if we had not seen them before,
- * but we don't bump the sequence in the slot.  Not too worried about it,
+ * We don't yet implement a duplicate request cache, instead we set the
+ * back channel ca_maxresponsesize_cached to zero. This is OK for now
  * since we only currently implement idempotent callbacks anyway.
  *
  * We have a single slot backchannel at this time, so we don't bother
  * checking the used_slots bit array on the table.  The lower layer guarantees
  * a single outstanding callback request at a time.
  */
-static int
-validate_seqid(struct nfs4_slot_table *tbl, u32 slotid, u32 seqid)
+static __be32
+validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
 {
         struct nfs4_slot *slot;
 
         dprintk("%s enter. slotid %d seqid %d\n",
-                __func__, slotid, seqid);
+                __func__, args->csa_slotid, args->csa_sequenceid);
 
-        if (slotid > NFS41_BC_MAX_CALLBACKS)
+        if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
                 return htonl(NFS4ERR_BADSLOT);
 
-        slot = tbl->slots + slotid;
+        slot = tbl->slots + args->csa_slotid;
         dprintk("%s slot table seqid: %d\n", __func__, slot->seq_nr);
 
         /* Normal */
-        if (likely(seqid == slot->seq_nr + 1)) {
+        if (likely(args->csa_sequenceid == slot->seq_nr + 1)) {
                 slot->seq_nr++;
                 return htonl(NFS4_OK);
         }
 
         /* Replay */
-        if (seqid == slot->seq_nr) {
-                dprintk("%s seqid %d is a replay - no DRC available\n",
-                        __func__, seqid);
-                return htonl(NFS4_OK);
+        if (args->csa_sequenceid == slot->seq_nr) {
+                dprintk("%s seqid %d is a replay\n",
+                        __func__, args->csa_sequenceid);
+                /* Signal process_op to set this error on next op */
+                if (args->csa_cachethis == 0)
+                        return htonl(NFS4ERR_RETRY_UNCACHED_REP);
+
+                /* The ca_maxresponsesize_cached is 0 with no DRC */
+                else if (args->csa_cachethis == 1)
+                        return htonl(NFS4ERR_REP_TOO_BIG_TO_CACHE);
         }
 
         /* Wraparound */
-        if (seqid == 1 && (slot->seq_nr + 1) == 0) {
+        if (args->csa_sequenceid == 1 && (slot->seq_nr + 1) == 0) {
                 slot->seq_nr = 1;
                 return htonl(NFS4_OK);
         }
@@ -191,27 +231,87 @@ validate_seqid(struct nfs4_slot_table *tbl, u32 slotid, u32 seqid)
         return NULL;
 }
 
-/* FIXME: referring calls should be processed */
-unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
+/*
+ * For each referring call triple, check the session's slot table for
+ * a match.  If the slot is in use and the sequence numbers match, the
+ * client is still waiting for a response to the original request.
+ */
+static bool referring_call_exists(struct nfs_client *clp,
+                                  uint32_t nrclists,
+                                  struct referring_call_list *rclists)
+{
+        bool status = 0;
+        int i, j;
+        struct nfs4_session *session;
+        struct nfs4_slot_table *tbl;
+        struct referring_call_list *rclist;
+        struct referring_call *ref;
+
+        /*
+         * XXX When client trunking is implemented, this becomes
+         * a session lookup from within the loop
+         */
+        session = clp->cl_session;
+        tbl = &session->fc_slot_table;
+
+        for (i = 0; i < nrclists; i++) {
+                rclist = &rclists[i];
+                if (memcmp(session->sess_id.data,
+                           rclist->rcl_sessionid.data,
+                           NFS4_MAX_SESSIONID_LEN) != 0)
+                        continue;
+
+                for (j = 0; j < rclist->rcl_nrefcalls; j++) {
+                        ref = &rclist->rcl_refcalls[j];
+
+                        dprintk("%s: sessionid %x:%x:%x:%x sequenceid %u "
+                                "slotid %u\n", __func__,
+                                ((u32 *)&rclist->rcl_sessionid.data)[0],
+                                ((u32 *)&rclist->rcl_sessionid.data)[1],
+                                ((u32 *)&rclist->rcl_sessionid.data)[2],
+                                ((u32 *)&rclist->rcl_sessionid.data)[3],
+                                ref->rc_sequenceid, ref->rc_slotid);
+
+                        spin_lock(&tbl->slot_tbl_lock);
+                        status = (test_bit(ref->rc_slotid, tbl->used_slots) &&
+                                  tbl->slots[ref->rc_slotid].seq_nr ==
+                                        ref->rc_sequenceid);
+                        spin_unlock(&tbl->slot_tbl_lock);
+                        if (status)
+                                goto out;
+                }
+        }
+
+out:
+        return status;
+}
+
+__be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                                 struct cb_sequenceres *res)
 {
         struct nfs_client *clp;
-        int i, status;
-
-        for (i = 0; i < args->csa_nrclists; i++)
-                kfree(args->csa_rclists[i].rcl_refcalls);
-        kfree(args->csa_rclists);
+        int i;
+        __be32 status;
 
         status = htonl(NFS4ERR_BADSESSION);
         clp = find_client_with_session(args->csa_addr, 4, &args->csa_sessionid);
         if (clp == NULL)
                 goto out;
 
-        status = validate_seqid(&clp->cl_session->bc_slot_table,
-                                args->csa_slotid, args->csa_sequenceid);
+        status = validate_seqid(&clp->cl_session->bc_slot_table, args);
         if (status)
                 goto out_putclient;
 
+        /*
+         * Check for pending referring calls.  If a match is found, a
+         * related callback was received before the response to the original
+         * call.
+         */
+        if (referring_call_exists(clp, args->csa_nrclists, args->csa_rclists)) {
+                status = htonl(NFS4ERR_DELAY);
+                goto out_putclient;
+        }
+
         memcpy(&res->csr_sessionid, &args->csa_sessionid,
                sizeof(res->csr_sessionid));
         res->csr_sequenceid = args->csa_sequenceid;
@@ -222,9 +322,81 @@ unsigned nfs4_callback_sequence(struct cb_sequenceargs *args,
 out_putclient:
         nfs_put_client(clp);
 out:
+        for (i = 0; i < args->csa_nrclists; i++)
+                kfree(args->csa_rclists[i].rcl_refcalls);
+        kfree(args->csa_rclists);
+
+        if (status == htonl(NFS4ERR_RETRY_UNCACHED_REP))
+                res->csr_status = 0;
+        else
+                res->csr_status = status;
+        dprintk("%s: exit with status = %d res->csr_status %d\n", __func__,
+                ntohl(status), ntohl(res->csr_status));
+        return status;
+}
+
+__be32 nfs4_callback_recallany(struct cb_recallanyargs *args, void *dummy)
+{
+        struct nfs_client *clp;
+        __be32 status;
+        fmode_t flags = 0;
+
+        status = htonl(NFS4ERR_OP_NOT_IN_SESSION);
+        clp = nfs_find_client(args->craa_addr, 4);
+        if (clp == NULL)
+                goto out;
+
+        dprintk("NFS: RECALL_ANY callback request from %s\n",
+                rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR));
+
+        if (test_bit(RCA4_TYPE_MASK_RDATA_DLG, (const unsigned long *)
+                     &args->craa_type_mask))
+                flags = FMODE_READ;
+        if (test_bit(RCA4_TYPE_MASK_WDATA_DLG, (const unsigned long *)
+                     &args->craa_type_mask))
+                flags |= FMODE_WRITE;
+
+        if (flags)
+                nfs_expire_all_delegation_types(clp, flags);
+        status = htonl(NFS4_OK);
+out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
-        res->csr_status = status;
-        return res->csr_status;
+        return status;
 }
 
+/* Reduce the fore channel's max_slots to the target value */
+__be32 nfs4_callback_recallslot(struct cb_recallslotargs *args, void *dummy)
+{
+        struct nfs_client *clp;
+        struct nfs4_slot_table *fc_tbl;
+        __be32 status;
+
+        status = htonl(NFS4ERR_OP_NOT_IN_SESSION);
+        clp = nfs_find_client(args->crsa_addr, 4);
+        if (clp == NULL)
+                goto out;
+
+        dprintk("NFS: CB_RECALL_SLOT request from %s target max slots %d\n",
+                rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR),
+                args->crsa_target_max_slots);
+
+        fc_tbl = &clp->cl_session->fc_slot_table;
+
+        status = htonl(NFS4ERR_BAD_HIGH_SLOT);
+        if (args->crsa_target_max_slots > fc_tbl->max_slots ||
+            args->crsa_target_max_slots < 1)
+                goto out_putclient;
+
+        status = htonl(NFS4_OK);
+        if (args->crsa_target_max_slots == fc_tbl->max_slots)
+                goto out_putclient;
+
+        fc_tbl->target_max_slots = args->crsa_target_max_slots;
+        nfs41_handle_recall_slot(clp);
+out_putclient:
+        nfs_put_client(clp);    /* balance nfs_find_client */
+out:
+        dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
+        return status;
+}
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 76b0aa0f73bf..05af212f0edf 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -9,6 +9,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include "nfs4_fs.h"
 #include "callback.h"
 
@@ -23,10 +24,15 @@
 #if defined(CONFIG_NFS_V4_1)
 #define CB_OP_SEQUENCE_RES_MAXSZ        (CB_OP_HDR_RES_MAXSZ + \
                                         4 + 1 + 3)
+#define CB_OP_RECALLANY_RES_MAXSZ       (CB_OP_HDR_RES_MAXSZ)
+#define CB_OP_RECALLSLOT_RES_MAXSZ      (CB_OP_HDR_RES_MAXSZ)
 #endif /* CONFIG_NFS_V4_1 */
 
 #define NFSDBG_FACILITY NFSDBG_CALLBACK
 
+/* Internal error code */
+#define NFS4ERR_RESOURCE_HDR    11050
+
 typedef __be32 (*callback_process_op_t)(void *, void *);
 typedef __be32 (*callback_decode_arg_t)(struct svc_rqst *, struct xdr_stream *, void *);
 typedef __be32 (*callback_encode_res_t)(struct svc_rqst *, struct xdr_stream *, void *);
@@ -172,7 +178,7 @@ static __be32 decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
         __be32 *p;
         p = read_buf(xdr, 4);
         if (unlikely(p == NULL))
-                return htonl(NFS4ERR_RESOURCE);
+                return htonl(NFS4ERR_RESOURCE_HDR);
         *op = ntohl(*p);
         return 0;
 }
@@ -214,10 +220,10 @@ out:
 
 #if defined(CONFIG_NFS_V4_1)
 
-static unsigned decode_sessionid(struct xdr_stream *xdr,
+static __be32 decode_sessionid(struct xdr_stream *xdr,
                                  struct nfs4_sessionid *sid)
 {
-        uint32_t *p;
+        __be32 *p;
         int len = NFS4_MAX_SESSIONID_LEN;
 
         p = read_buf(xdr, len);
@@ -228,12 +234,12 @@ static unsigned decode_sessionid(struct xdr_stream *xdr,
         return 0;
 }
 
-static unsigned decode_rc_list(struct xdr_stream *xdr,
+static __be32 decode_rc_list(struct xdr_stream *xdr,
                                struct referring_call_list *rc_list)
 {
-        uint32_t *p;
+        __be32 *p;
         int i;
-        unsigned status;
+        __be32 status;
 
         status = decode_sessionid(xdr, &rc_list->rcl_sessionid);
         if (status)
@@ -266,13 +272,13 @@ out:
         return status;
 }
 
-static unsigned decode_cb_sequence_args(struct svc_rqst *rqstp,
+static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
                                         struct xdr_stream *xdr,
                                         struct cb_sequenceargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
         int i;
-        unsigned status;
+        __be32 status;
 
         status = decode_sessionid(xdr, &args->csa_sessionid);
         if (status)
@@ -326,6 +332,39 @@ out_free:
         goto out;
 }
 
+static __be32 decode_recallany_args(struct svc_rqst *rqstp,
+                                      struct xdr_stream *xdr,
+                                      struct cb_recallanyargs *args)
+{
+        __be32 *p;
+
+        args->craa_addr = svc_addr(rqstp);
+        p = read_buf(xdr, 4);
+        if (unlikely(p == NULL))
+                return htonl(NFS4ERR_BADXDR);
+        args->craa_objs_to_keep = ntohl(*p++);
+        p = read_buf(xdr, 4);
+        if (unlikely(p == NULL))
+                return htonl(NFS4ERR_BADXDR);
+        args->craa_type_mask = ntohl(*p);
+
+        return 0;
+}
+
+static __be32 decode_recallslot_args(struct svc_rqst *rqstp,
+                                        struct xdr_stream *xdr,
+                                        struct cb_recallslotargs *args)
+{
+        __be32 *p;
+
+        args->crsa_addr = svc_addr(rqstp);
+        p = read_buf(xdr, 4);
+        if (unlikely(p == NULL))
+                return htonl(NFS4ERR_BADXDR);
+        args->crsa_target_max_slots = ntohl(*p++);
+        return 0;
+}
+
 #endif /* CONFIG_NFS_V4_1 */
 
 static __be32 encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
@@ -445,7 +484,7 @@ static __be32 encode_op_hdr(struct xdr_stream *xdr, uint32_t op, __be32 res)
         
         p = xdr_reserve_space(xdr, 8);
         if (unlikely(p == NULL))
-                return htonl(NFS4ERR_RESOURCE);
+                return htonl(NFS4ERR_RESOURCE_HDR);
         *p++ = htonl(op);
         *p = res;
         return 0;
@@ -479,10 +518,10 @@ out:
 
 #if defined(CONFIG_NFS_V4_1)
 
-static unsigned encode_sessionid(struct xdr_stream *xdr,
+static __be32 encode_sessionid(struct xdr_stream *xdr,
                                  const struct nfs4_sessionid *sid)
 {
-        uint32_t *p;
+        __be32 *p;
         int len = NFS4_MAX_SESSIONID_LEN;
 
         p = xdr_reserve_space(xdr, len);
@@ -493,11 +532,11 @@ static unsigned encode_sessionid(struct xdr_stream *xdr,
         return 0;
 }
 
-static unsigned encode_cb_sequence_res(struct svc_rqst *rqstp,
+static __be32 encode_cb_sequence_res(struct svc_rqst *rqstp,
                                        struct xdr_stream *xdr,
                                        const struct cb_sequenceres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         unsigned status = res->csr_status;
 
         if (unlikely(status != 0))
@@ -533,6 +572,8 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
         case OP_CB_GETATTR:
         case OP_CB_RECALL:
         case OP_CB_SEQUENCE:
+        case OP_CB_RECALL_ANY:
+        case OP_CB_RECALL_SLOT:
                 *op = &callback_ops[op_nr];
                 break;
 
@@ -540,9 +581,7 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
         case OP_CB_NOTIFY_DEVICEID:
         case OP_CB_NOTIFY:
         case OP_CB_PUSH_DELEG:
-        case OP_CB_RECALL_ANY:
         case OP_CB_RECALLABLE_OBJ_AVAIL:
-        case OP_CB_RECALL_SLOT:
         case OP_CB_WANTS_CANCELLED:
         case OP_CB_NOTIFY_LOCK:
                 return htonl(NFS4ERR_NOTSUPP);
@@ -582,20 +621,18 @@ preprocess_nfs4_op(unsigned int op_nr, struct callback_op **op)
 static __be32 process_op(uint32_t minorversion, int nop,
                 struct svc_rqst *rqstp,
                 struct xdr_stream *xdr_in, void *argp,
-                struct xdr_stream *xdr_out, void *resp)
+                struct xdr_stream *xdr_out, void *resp, int* drc_status)
 {
         struct callback_op *op = &callback_ops[0];
-        unsigned int op_nr = OP_CB_ILLEGAL;
+        unsigned int op_nr;
         __be32 status;
         long maxlen;
         __be32 res;
 
         dprintk("%s: start\n", __func__);
         status = decode_op_hdr(xdr_in, &op_nr);
-        if (unlikely(status)) {
-                status = htonl(NFS4ERR_OP_ILLEGAL);
-                goto out;
-        }
+        if (unlikely(status))
+                return status;
 
         dprintk("%s: minorversion=%d nop=%d op_nr=%u\n",
                 __func__, minorversion, nop, op_nr);
@@ -604,19 +641,32 @@ static __be32 process_op(uint32_t minorversion, int nop,
                                 preprocess_nfs4_op(op_nr, &op);
         if (status == htonl(NFS4ERR_OP_ILLEGAL))
                 op_nr = OP_CB_ILLEGAL;
-out:
+        if (status)
+                goto encode_hdr;
+
+        if (*drc_status) {
+                status = *drc_status;
+                goto encode_hdr;
+        }
+
         maxlen = xdr_out->end - xdr_out->p;
         if (maxlen > 0 && maxlen < PAGE_SIZE) {
-                if (likely(status == 0 && op->decode_args != NULL))
-                        status = op->decode_args(rqstp, xdr_in, argp);
-                if (likely(status == 0 && op->process_op != NULL))
+                status = op->decode_args(rqstp, xdr_in, argp);
+                if (likely(status == 0))
                         status = op->process_op(argp, resp);
         } else
                 status = htonl(NFS4ERR_RESOURCE);
 
+        /* Only set by OP_CB_SEQUENCE processing */
+        if (status == htonl(NFS4ERR_RETRY_UNCACHED_REP)) {
+                *drc_status = status;
+                status = 0;
+        }
+
+encode_hdr:
         res = encode_op_hdr(xdr_out, op_nr, status);
-        if (status == 0)
-                status = res;
+        if (unlikely(res))
+                return res;
         if (op->encode_res != NULL && status == 0)
                 status = op->encode_res(rqstp, xdr_out, resp);
         dprintk("%s: done, status = %d\n", __func__, ntohl(status));
@@ -632,7 +682,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
         struct cb_compound_hdr_res hdr_res = { NULL };
         struct xdr_stream xdr_in, xdr_out;
         __be32 *p;
-        __be32 status;
+        __be32 status, drc_status = 0;
         unsigned int nops = 0;
 
         dprintk("%s: start\n", __func__);
@@ -652,11 +702,18 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
                 return rpc_system_err;
 
         while (status == 0 && nops != hdr_arg.nops) {
-                status = process_op(hdr_arg.minorversion, nops,
-                                    rqstp, &xdr_in, argp, &xdr_out, resp);
+                status = process_op(hdr_arg.minorversion, nops, rqstp,
+                                    &xdr_in, argp, &xdr_out, resp, &drc_status);
                 nops++;
         }
 
+        /* Buffer overflow in decode_ops_hdr or encode_ops_hdr. Return
+        * resource error in cb_compound status without returning op */
+        if (unlikely(status == htonl(NFS4ERR_RESOURCE_HDR))) {
+                status = htonl(NFS4ERR_RESOURCE);
+                nops--;
+        }
+
         *hdr_res.status = status;
         *hdr_res.nops = htonl(nops);
         dprintk("%s: done, status = %u\n", __func__, ntohl(status));
@@ -688,6 +745,16 @@ static struct callback_op callback_ops[] = {
                 .encode_res = (callback_encode_res_t)encode_cb_sequence_res,
                 .res_maxsize = CB_OP_SEQUENCE_RES_MAXSZ,
         },
+        [OP_CB_RECALL_ANY] = {
+                .process_op = (callback_process_op_t)nfs4_callback_recallany,
+                .decode_args = (callback_decode_arg_t)decode_recallany_args,
+                .res_maxsize = CB_OP_RECALLANY_RES_MAXSZ,
+        },
+        [OP_CB_RECALL_SLOT] = {
+                .process_op = (callback_process_op_t)nfs4_callback_recallslot,
+                .decode_args = (callback_decode_arg_t)decode_recallslot_args,
+                .res_maxsize = CB_OP_RECALLSLOT_RES_MAXSZ,
+        },
 #endif /* CONFIG_NFS_V4_1 */
 };
 
@@ -716,5 +783,13 @@ struct svc_version nfs4_callback_version1 = {
         .vs_proc = nfs4_callback_procedures1,
         .vs_xdrsize = NFS4_CALLBACK_XDRSIZE,
         .vs_dispatch = NULL,
+        .vs_hidden = 1,
 };
 
+struct svc_version nfs4_callback_version4 = {
+        .vs_vers = 4,
+        .vs_nproc = ARRAY_SIZE(nfs4_callback_procedures1),
+        .vs_proc = nfs4_callback_procedures1,
+        .vs_xdrsize = NFS4_CALLBACK_XDRSIZE,
+        .vs_dispatch = NULL,
+};
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 99ea196f071f..acc9c4943b84 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -35,6 +35,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/nfs_xdr.h>
 #include <linux/sunrpc/bc_xprt.h>
@@ -164,30 +165,7 @@ error_0:
         return ERR_PTR(err);
 }
 
-static void nfs4_shutdown_client(struct nfs_client *clp)
-{
 #ifdef CONFIG_NFS_V4
-        if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
-                nfs4_kill_renewd(clp);
-        BUG_ON(!RB_EMPTY_ROOT(&clp->cl_state_owners));
-        if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
-                nfs_idmap_delete(clp);
-
-        rpc_destroy_wait_queue(&clp->cl_rpcwaitq);
-#endif
-}
-
-/*
- * Destroy the NFS4 callback service
- */
-static void nfs4_destroy_callback(struct nfs_client *clp)
-{
-#ifdef CONFIG_NFS_V4
-        if (__test_and_clear_bit(NFS_CS_CALLBACK, &clp->cl_res_state))
-                nfs_callback_down(clp->cl_minorversion);
-#endif /* CONFIG_NFS_V4 */
-}
-
 /*
  * Clears/puts all minor version specific parts from an nfs_client struct
  * reverting it to minorversion 0.
@@ -202,9 +180,33 @@ static void nfs4_clear_client_minor_version(struct nfs_client *clp)
 
         clp->cl_call_sync = _nfs4_call_sync;
 #endif /* CONFIG_NFS_V4_1 */
+}
 
+/*
+ * Destroy the NFS4 callback service
+ */
+static void nfs4_destroy_callback(struct nfs_client *clp)
+{
+        if (__test_and_clear_bit(NFS_CS_CALLBACK, &clp->cl_res_state))
+                nfs_callback_down(clp->cl_minorversion);
+}
+
+static void nfs4_shutdown_client(struct nfs_client *clp)
+{
+        if (__test_and_clear_bit(NFS_CS_RENEWD, &clp->cl_res_state))
+                nfs4_kill_renewd(clp);
+        nfs4_clear_client_minor_version(clp);
         nfs4_destroy_callback(clp);
+        if (__test_and_clear_bit(NFS_CS_IDMAP, &clp->cl_res_state))
+                nfs_idmap_delete(clp);
+
+        rpc_destroy_wait_queue(&clp->cl_rpcwaitq);
+}
+#else
+static void nfs4_shutdown_client(struct nfs_client *clp)
+{
 }
+#endif /* CONFIG_NFS_V4 */
 
 /*
  * Destroy a shared client record
@@ -213,7 +215,6 @@ static void nfs_free_client(struct nfs_client *clp)
 {
         dprintk("--> nfs_free_client(%u)\n", clp->rpc_ops->version);
 
-        nfs4_clear_client_minor_version(clp);
         nfs4_shutdown_client(clp);
 
         nfs_fscache_release_client_cookie(clp);
@@ -965,6 +966,8 @@ out_error:
 static void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source)
 {
         target->flags = source->flags;
+        target->rsize = source->rsize;
+        target->wsize = source->wsize;
         target->acregmin = source->acregmin;
         target->acregmax = source->acregmax;
         target->acdirmin = source->acdirmin;
@@ -1260,10 +1263,20 @@ error:
 static void nfs4_session_set_rwsize(struct nfs_server *server)
 {
 #ifdef CONFIG_NFS_V4_1
+        struct nfs4_session *sess;
+        u32 server_resp_sz;
+        u32 server_rqst_sz;
+
         if (!nfs4_has_session(server->nfs_client))
                 return;
-        server->rsize = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        server->wsize = server->nfs_client->cl_session->fc_attrs.max_rqst_sz;
+        sess = server->nfs_client->cl_session;
+        server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
+        server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
+
+        if (server->rsize > server_resp_sz)
+                server->rsize = server_resp_sz;
+        if (server->wsize > server_rqst_sz)
+                server->wsize = server_rqst_sz;
 #endif /* CONFIG_NFS_V4_1 */
 }
 
@@ -1283,7 +1296,8 @@ static int nfs4_init_server(struct nfs_server *server,
 
         /* Initialise the client representation from the mount data */
         server->flags = data->flags;
-        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR;
+        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR|
+                NFS_CAP_POSIX_LOCK;
         server->options = data->options;
 
         /* Get a client record */
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 6dd48a4405b4..ea61d26e7871 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -10,6 +10,7 @@
 #include <linux/kthread.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 
@@ -23,6 +24,8 @@
 
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
+        if (delegation->cred)
+                put_rpccred(delegation->cred);
         kfree(delegation);
 }
 
@@ -35,13 +38,7 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
-        struct rpc_cred *cred;
-
-        cred = rcu_dereference(delegation->cred);
-        rcu_assign_pointer(delegation->cred, NULL);
         call_rcu(&delegation->rcu, nfs_free_delegation_callback);
-        if (cred)
-                put_rpccred(cred);
 }
 
 void nfs_mark_delegation_referenced(struct nfs_delegation *delegation)
@@ -92,7 +89,7 @@ out:
         return status;
 }
 
-static void nfs_delegation_claim_opens(struct inode *inode, const nfs4_stateid *stateid)
+static int nfs_delegation_claim_opens(struct inode *inode, const nfs4_stateid *stateid)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_open_context *ctx;
@@ -116,10 +113,11 @@ again:
                         err = nfs_delegation_claim_locks(ctx, state);
                 put_nfs_open_context(ctx);
                 if (err != 0)
-                        return;
+                        return err;
                 goto again;
         }
         spin_unlock(&inode->i_lock);
+        return 0;
 }
 
 /*
@@ -127,21 +125,35 @@ again:
  */
 void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res)
 {
-        struct nfs_delegation *delegation = NFS_I(inode)->delegation;
-        struct rpc_cred *oldcred;
+        struct nfs_delegation *delegation;
+        struct rpc_cred *oldcred = NULL;
 
-        if (delegation == NULL)
-                return;
-        memcpy(delegation->stateid.data, res->delegation.data,
-                        sizeof(delegation->stateid.data));
-        delegation->type = res->delegation_type;
-        delegation->maxsize = res->maxsize;
-        oldcred = delegation->cred;
-        delegation->cred = get_rpccred(cred);
-        clear_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags);
-        NFS_I(inode)->delegation_state = delegation->type;
-        smp_wmb();
-        put_rpccred(oldcred);
+        rcu_read_lock();
+        delegation = rcu_dereference(NFS_I(inode)->delegation);
+        if (delegation != NULL) {
+                spin_lock(&delegation->lock);
+                if (delegation->inode != NULL) {
+                        memcpy(delegation->stateid.data, res->delegation.data,
+                               sizeof(delegation->stateid.data));
+                        delegation->type = res->delegation_type;
+                        delegation->maxsize = res->maxsize;
+                        oldcred = delegation->cred;
+                        delegation->cred = get_rpccred(cred);
+                        clear_bit(NFS_DELEGATION_NEED_RECLAIM,
+                                  &delegation->flags);
+                        NFS_I(inode)->delegation_state = delegation->type;
+                        spin_unlock(&delegation->lock);
+                        put_rpccred(oldcred);
+                        rcu_read_unlock();
+                } else {
+                        /* We appear to have raced with a delegation return. */
+                        spin_unlock(&delegation->lock);
+                        rcu_read_unlock();
+                        nfs_inode_set_delegation(inode, cred, res);
+                }
+        } else {
+                rcu_read_unlock();
+        }
 }
 
 static int nfs_do_return_delegation(struct inode *inode, struct nfs_delegation *delegation, int issync)
@@ -164,9 +176,13 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
         return inode;
 }
 
-static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi, const nfs4_stateid *stateid)
+static struct nfs_delegation *nfs_detach_delegation_locked(struct nfs_inode *nfsi,
+                                                           const nfs4_stateid *stateid,
+                                                           struct nfs_client *clp)
 {
-        struct nfs_delegation *delegation = rcu_dereference(nfsi->delegation);
+        struct nfs_delegation *delegation =
+                rcu_dereference_protected(nfsi->delegation,
+                                          lockdep_is_held(&clp->cl_lock));
 
         if (delegation == NULL)
                 goto nomatch;
@@ -193,7 +209,7 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
 {
         struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
         struct nfs_inode *nfsi = NFS_I(inode);
-        struct nfs_delegation *delegation;
+        struct nfs_delegation *delegation, *old_delegation;
         struct nfs_delegation *freeme = NULL;
         int status = 0;
 
@@ -211,10 +227,12 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
         spin_lock_init(&delegation->lock);
 
         spin_lock(&clp->cl_lock);
-        if (rcu_dereference(nfsi->delegation) != NULL) {
-                if (memcmp(&delegation->stateid, &nfsi->delegation->stateid,
-                                        sizeof(delegation->stateid)) == 0 &&
-                                delegation->type == nfsi->delegation->type) {
+        old_delegation = rcu_dereference_protected(nfsi->delegation,
+                                                   lockdep_is_held(&clp->cl_lock));
+        if (old_delegation != NULL) {
+                if (memcmp(&delegation->stateid, &old_delegation->stateid,
+                                        sizeof(old_delegation->stateid)) == 0 &&
+                                delegation->type == old_delegation->type) {
                         goto out;
                 }
                 /*
@@ -224,12 +242,12 @@ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct
                 dfprintk(FILE, "%s: server %s handed out "
                                 "a duplicate delegation!\n",
                                 __func__, clp->cl_hostname);
-                if (delegation->type <= nfsi->delegation->type) {
+                if (delegation->type <= old_delegation->type) {
                         freeme = delegation;
                         delegation = NULL;
                         goto out;
                 }
-                freeme = nfs_detach_delegation_locked(nfsi, NULL);
+                freeme = nfs_detach_delegation_locked(nfsi, NULL, clp);
         }
         list_add_rcu(&delegation->super_list, &clp->cl_delegations);
         nfsi->delegation_state = delegation->type;
@@ -261,30 +279,34 @@ static void nfs_msync_inode(struct inode *inode)
 /*
  * Basic procedure for returning a delegation to the server
  */
-static int __nfs_inode_return_delegation(struct inode *inode, struct nfs_delegation *delegation)
+static int __nfs_inode_return_delegation(struct inode *inode, struct nfs_delegation *delegation, int issync)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
+        int err;
 
-        nfs_msync_inode(inode);
         /*
          * Guard against new delegated open/lock/unlock calls and against
          * state recovery
          */
         down_write(&nfsi->rwsem);
-        nfs_delegation_claim_opens(inode, &delegation->stateid);
+        err = nfs_delegation_claim_opens(inode, &delegation->stateid);
         up_write(&nfsi->rwsem);
-        nfs_msync_inode(inode);
+        if (err)
+                goto out;
 
-        return nfs_do_return_delegation(inode, delegation, 1);
+        err = nfs_do_return_delegation(inode, delegation, issync);
+out:
+        return err;
 }
 
 /*
  * Return all delegations that have been marked for return
  */
-void nfs_client_return_marked_delegations(struct nfs_client *clp)
+int nfs_client_return_marked_delegations(struct nfs_client *clp)
 {
         struct nfs_delegation *delegation;
         struct inode *inode;
+        int err = 0;
 
 restart:
         rcu_read_lock();
@@ -295,15 +317,21 @@ restart:
                 if (inode == NULL)
                         continue;
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL);
+                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 rcu_read_unlock();
-                if (delegation != NULL)
-                        __nfs_inode_return_delegation(inode, delegation);
+                if (delegation != NULL) {
+                        filemap_flush(inode->i_mapping);
+                        err = __nfs_inode_return_delegation(inode, delegation, 0);
+                }
                 iput(inode);
-                goto restart;
+                if (!err)
+                        goto restart;
+                set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
+                return err;
         }
         rcu_read_unlock();
+        return 0;
 }
 
 /*
@@ -318,9 +346,9 @@ void nfs_inode_return_delegation_noreclaim(struct inode *inode)
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_delegation *delegation;
 
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        if (rcu_access_pointer(nfsi->delegation) != NULL) {
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 if (delegation != NULL)
                         nfs_do_return_delegation(inode, delegation, 0);
@@ -334,12 +362,14 @@ int nfs_inode_return_delegation(struct inode *inode)
         struct nfs_delegation *delegation;
         int err = 0;
 
-        if (rcu_dereference(nfsi->delegation) != NULL) {
+        if (rcu_access_pointer(nfsi->delegation) != NULL) {
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(nfsi, NULL);
+                delegation = nfs_detach_delegation_locked(nfsi, NULL, clp);
                 spin_unlock(&clp->cl_lock);
-                if (delegation != NULL)
-                        err = __nfs_inode_return_delegation(inode, delegation);
+                if (delegation != NULL) {
+                        nfs_msync_inode(inode);
+                        err = __nfs_inode_return_delegation(inode, delegation, 1);
+                }
         }
         return err;
 }
@@ -368,33 +398,47 @@ void nfs_super_return_all_delegations(struct super_block *sb)
                 spin_unlock(&delegation->lock);
         }
         rcu_read_unlock();
-        nfs_client_return_marked_delegations(clp);
+        if (nfs_client_return_marked_delegations(clp) != 0)
+                nfs4_schedule_state_manager(clp);
 }
 
-static void nfs_client_mark_return_all_delegations(struct nfs_client *clp)
+static
+void nfs_client_mark_return_all_delegation_types(struct nfs_client *clp, fmode_t flags)
 {
         struct nfs_delegation *delegation;
 
         rcu_read_lock();
         list_for_each_entry_rcu(delegation, &clp->cl_delegations, super_list) {
-                set_bit(NFS_DELEGATION_RETURN, &delegation->flags);
-                set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
+                if ((delegation->type == (FMODE_READ|FMODE_WRITE)) && !(flags & FMODE_WRITE))
+                        continue;
+                if (delegation->type & flags)
+                        nfs_mark_return_delegation(clp, delegation);
         }
         rcu_read_unlock();
 }
 
+static void nfs_client_mark_return_all_delegations(struct nfs_client *clp)
+{
+        nfs_client_mark_return_all_delegation_types(clp, FMODE_READ|FMODE_WRITE);
+}
+
 static void nfs_delegation_run_state_manager(struct nfs_client *clp)
 {
         if (test_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state))
                 nfs4_schedule_state_manager(clp);
 }
 
-void nfs_expire_all_delegations(struct nfs_client *clp)
+void nfs_expire_all_delegation_types(struct nfs_client *clp, fmode_t flags)
 {
-        nfs_client_mark_return_all_delegations(clp);
+        nfs_client_mark_return_all_delegation_types(clp, flags);
         nfs_delegation_run_state_manager(clp);
 }
 
+void nfs_expire_all_delegations(struct nfs_client *clp)
+{
+        nfs_expire_all_delegation_types(clp, FMODE_READ|FMODE_WRITE);
+}
+
 /*
  * Return all delegations following an NFS4ERR_CB_PATH_DOWN error.
  */
@@ -413,8 +457,7 @@ static void nfs_client_mark_return_unreferenced_delegations(struct nfs_client *c
         list_for_each_entry_rcu(delegation, &clp->cl_delegations, super_list) {
                 if (test_and_clear_bit(NFS_DELEGATION_REFERENCED, &delegation->flags))
                         continue;
-                set_bit(NFS_DELEGATION_RETURN, &delegation->flags);
-                set_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state);
+                nfs_mark_return_delegation(clp, delegation);
         }
         rcu_read_unlock();
 }
@@ -428,18 +471,21 @@ void nfs_expire_unreferenced_delegations(struct nfs_client *clp)
 /*
  * Asynchronous delegation recall!
  */
-int nfs_async_inode_return_delegation(struct inode *inode, const nfs4_stateid *stateid)
+int nfs_async_inode_return_delegation(struct inode *inode, const nfs4_stateid *stateid,
+                                      int (*validate_stateid)(struct nfs_delegation *delegation,
+                                                              const nfs4_stateid *stateid))
 {
         struct nfs_client *clp = NFS_SERVER(inode)->nfs_client;
         struct nfs_delegation *delegation;
 
         rcu_read_lock();
         delegation = rcu_dereference(NFS_I(inode)->delegation);
-        if (delegation == NULL || memcmp(delegation->stateid.data, stateid->data,
-                                sizeof(delegation->stateid.data)) != 0) {
+
+        if (!validate_stateid(delegation, stateid)) {
                 rcu_read_unlock();
                 return -ENOENT;
         }
+
         nfs_mark_return_delegation(clp, delegation);
         rcu_read_unlock();
         nfs_delegation_run_state_manager(clp);
@@ -496,7 +542,7 @@ restart:
                 if (inode == NULL)
                         continue;
                 spin_lock(&clp->cl_lock);
-                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL);
+                delegation = nfs_detach_delegation_locked(NFS_I(inode), NULL, clp);
                 spin_unlock(&clp->cl_lock);
                 rcu_read_unlock();
                 if (delegation != NULL)
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index 09f383795174..69e7b8140122 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -34,15 +34,18 @@ enum {
 int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
 void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
 int nfs_inode_return_delegation(struct inode *inode);
-int nfs_async_inode_return_delegation(struct inode *inode, const nfs4_stateid *stateid);
+int nfs_async_inode_return_delegation(struct inode *inode, const nfs4_stateid *stateid,
+                                      int (*validate_stateid)(struct nfs_delegation *delegation,
+                                                              const nfs4_stateid *stateid));
 void nfs_inode_return_delegation_noreclaim(struct inode *inode);
 
 struct inode *nfs_delegation_find_inode(struct nfs_client *clp, const struct nfs_fh *fhandle);
 void nfs_super_return_all_delegations(struct super_block *sb);
 void nfs_expire_all_delegations(struct nfs_client *clp);
+void nfs_expire_all_delegation_types(struct nfs_client *clp, fmode_t flags);
 void nfs_expire_unreferenced_delegations(struct nfs_client *clp);
 void nfs_handle_cb_pathdown(struct nfs_client *clp);
-void nfs_client_return_marked_delegations(struct nfs_client *clp);
+int nfs_client_return_marked_delegations(struct nfs_client *clp);
 
 void nfs_delegation_mark_reclaim(struct nfs_client *clp);
 void nfs_delegation_reap_unclaimed(struct nfs_client *clp);
@@ -68,4 +71,10 @@ static inline int nfs_inode_return_delegation(struct inode *inode)
 }
 #endif
 
+static inline int nfs_have_delegated_attributes(struct inode *inode)
+{
+        return nfs_have_delegation(inode, FMODE_READ) &&
+                !(NFS_I(inode)->cache_validity & NFS_INO_REVAL_FORCED);
+}
+
 #endif
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 7cb298525eef..a7bb5c694aa3 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -560,7 +560,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
         desc->entry = &my_entry;
 
         nfs_block_sillyrename(dentry);
-        res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
+        res = nfs_revalidate_mapping(inode, filp->f_mapping);
         if (res < 0)
                 goto out;
 
@@ -837,6 +837,8 @@ out_zap_parent:
                 /* If we have submounts, don't unhash ! */
                 if (have_submounts(dentry))
                         goto out_valid;
+                if (dentry->d_flags & DCACHE_DISCONNECTED)
+                        goto out_valid;
                 shrink_dcache_parent(dentry);
         }
         d_drop(dentry);
@@ -1025,12 +1027,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
+                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
-                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 goto out;
@@ -1050,7 +1052,7 @@ static int nfs_open_revalidate(struct dentry *dentry, struct nameidata *nd)
         struct inode *dir;
         int openflags, ret = 0;
 
-        if (!is_atomic_open(nd))
+        if (!is_atomic_open(nd) || d_mountpoint(dentry))
                 goto no_open;
         parent = dget_parent(dentry);
         dir = parent->d_inode;
@@ -1579,55 +1581,47 @@ static int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         struct dentry *dentry = NULL, *rehash = NULL;
         int error = -EBUSY;
 
-        /*
-         * To prevent any new references to the target during the rename,
-         * we unhash the dentry and free the inode in advance.
-         */
-        if (!d_unhashed(new_dentry)) {
-                d_drop(new_dentry);
-                rehash = new_dentry;
-        }
-
         dfprintk(VFS, "NFS: rename(%s/%s -> %s/%s, ct=%d)\n",
                  old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
                  new_dentry->d_parent->d_name.name, new_dentry->d_name.name,
                  atomic_read(&new_dentry->d_count));
 
         /*
-         * First check whether the target is busy ... we can't
-         * safely do _any_ rename if the target is in use.
-         *
-         * For files, make a copy of the dentry and then do a 
-         * silly-rename. If the silly-rename succeeds, the
-         * copied dentry is hashed and becomes the new target.
+         * For non-directories, check whether the target is busy and if so,
+         * make a copy of the dentry and then do a silly-rename. If the
+         * silly-rename succeeds, the copied dentry is hashed and becomes
+         * the new target.
          */
-        if (!new_inode)
-                goto go_ahead;
-        if (S_ISDIR(new_inode->i_mode)) {
-                error = -EISDIR;
-                if (!S_ISDIR(old_inode->i_mode))
-                        goto out;
-        } else if (atomic_read(&new_dentry->d_count) > 2) {
-                int err;
-                /* copy the target dentry's name */
-                dentry = d_alloc(new_dentry->d_parent,
-                                 &new_dentry->d_name);
-                if (!dentry)
-                        goto out;
+        if (new_inode && !S_ISDIR(new_inode->i_mode)) {
+                /*
+                 * To prevent any new references to the target during the
+                 * rename, we unhash the dentry in advance.
+                 */
+                if (!d_unhashed(new_dentry)) {
+                        d_drop(new_dentry);
+                        rehash = new_dentry;
+                }
+
+                if (atomic_read(&new_dentry->d_count) > 2) {
+                        int err;
+
+                        /* copy the target dentry's name */
+                        dentry = d_alloc(new_dentry->d_parent,
+                                         &new_dentry->d_name);
+                        if (!dentry)
+                                goto out;
 
-                /* silly-rename the existing target ... */
-                err = nfs_sillyrename(new_dir, new_dentry);
-                if (!err) {
-                        new_dentry = rehash = dentry;
+                        /* silly-rename the existing target ... */
+                        err = nfs_sillyrename(new_dir, new_dentry);
+                        if (err)
+                                goto out;
+
+                        new_dentry = dentry;
+                        rehash = NULL;
                         new_inode = NULL;
-                        /* instantiate the replacement target */
-                        d_instantiate(new_dentry, NULL);
-                } else if (atomic_read(&new_dentry->d_count) > 1)
-                        /* dentry still busy? */
-                        goto out;
+                }
         }
 
-go_ahead:
         /*
          * ... prune child dentries and writebacks if needed.
          */
@@ -1797,7 +1791,7 @@ static int nfs_access_get_cached(struct inode *inode, struct rpc_cred *cred, str
         cache = nfs_access_search_rbtree(inode, cred);
         if (cache == NULL)
                 goto out;
-        if (!nfs_have_delegation(inode, FMODE_READ) &&
+        if (!nfs_have_delegated_attributes(inode) &&
             !time_in_range_open(jiffies, cache->jiffies, cache->jiffies + nfsi->attrtimeo))
                 goto out_stale;
         res->jiffies = cache->jiffies;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index e1d415e97849..ad4cd31d6050 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -44,6 +44,7 @@
 #include <linux/file.h>
 #include <linux/pagemap.h>
 #include <linux/kref.h>
+#include <linux/slab.h>
 
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
@@ -342,6 +343,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.eof = 0;
                 data->res.count = bytes;
+                nfs_fattr_init(&data->fattr);
                 msg.rpc_argp = &data->args;
                 msg.rpc_resp = &data->res;
 
@@ -575,6 +577,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
         data->res.count = 0;
         data->res.fattr = &data->fattr;
         data->res.verf = &data->verf;
+        nfs_fattr_init(&data->fattr);
 
         NFS_PROTO(data->inode)->commit_setup(data, &msg);
 
@@ -766,6 +769,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.count = bytes;
                 data->res.verf = &data->verf;
+                nfs_fattr_init(&data->fattr);
 
                 task_setup_data.task = &data->task;
                 task_setup_data.callback_data = data;
diff --git a/fs/nfs/dns_resolve.c b/fs/nfs/dns_resolve.c
index f4d54ba97cc6..76fd235d0024 100644
--- a/fs/nfs/dns_resolve.c
+++ b/fs/nfs/dns_resolve.c
@@ -9,6 +9,7 @@
 #include <linux/hash.h>
 #include <linux/string.h>
 #include <linux/kmod.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/socket.h>
 #include <linux/seq_file.h>
@@ -36,6 +37,19 @@ struct nfs_dns_ent {
 };
 
 
+static void nfs_dns_ent_update(struct cache_head *cnew,
+                struct cache_head *ckey)
+{
+        struct nfs_dns_ent *new;
+        struct nfs_dns_ent *key;
+
+        new = container_of(cnew, struct nfs_dns_ent, h);
+        key = container_of(ckey, struct nfs_dns_ent, h);
+
+        memcpy(&new->addr, &key->addr, key->addrlen);
+        new->addrlen = key->addrlen;
+}
+
 static void nfs_dns_ent_init(struct cache_head *cnew,
                 struct cache_head *ckey)
 {
@@ -49,8 +63,7 @@ static void nfs_dns_ent_init(struct cache_head *cnew,
         new->hostname = kstrndup(key->hostname, key->namelen, GFP_KERNEL);
         if (new->hostname) {
                 new->namelen = key->namelen;
-                memcpy(&new->addr, &key->addr, key->addrlen);
-                new->addrlen = key->addrlen;
+                nfs_dns_ent_update(cnew, ckey);
         } else {
                 new->namelen = 0;
                 new->addrlen = 0;
@@ -146,7 +159,7 @@ static int nfs_dns_show(struct seq_file *m, struct cache_detail *cd,
         return 0;
 }
 
-struct nfs_dns_ent *nfs_dns_lookup(struct cache_detail *cd,
+static struct nfs_dns_ent *nfs_dns_lookup(struct cache_detail *cd,
                 struct nfs_dns_ent *key)
 {
         struct cache_head *ch;
@@ -159,7 +172,7 @@ struct nfs_dns_ent *nfs_dns_lookup(struct cache_detail *cd,
         return container_of(ch, struct nfs_dns_ent, h);
 }
 
-struct nfs_dns_ent *nfs_dns_update(struct cache_detail *cd,
+static struct nfs_dns_ent *nfs_dns_update(struct cache_detail *cd,
                 struct nfs_dns_ent *new,
                 struct nfs_dns_ent *key)
 {
@@ -234,7 +247,7 @@ static struct cache_detail nfs_dns_resolve = {
         .cache_show = nfs_dns_show,
         .match = nfs_dns_match,
         .init = nfs_dns_ent_init,
-        .update = nfs_dns_ent_init,
+        .update = nfs_dns_ent_update,
         .alloc = nfs_dns_ent_alloc,
 };
 
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index f5fdd39e037a..8d965bddb87e 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -24,9 +24,9 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/pagemap.h>
 #include <linux/aio.h>
+#include <linux/gfp.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -123,11 +123,11 @@ nfs_file_open(struct inode *inode, struct file *filp)
                         filp->f_path.dentry->d_parent->d_name.name,
                         filp->f_path.dentry->d_name.name);
 
+        nfs_inc_stats(inode, NFSIOS_VFSOPEN);
         res = nfs_check_flags(filp->f_flags);
         if (res)
                 return res;
 
-        nfs_inc_stats(inode, NFSIOS_VFSOPEN);
         res = nfs_open(inode, filp);
         return res;
 }
@@ -237,9 +237,9 @@ nfs_file_flush(struct file *file, fl_owner_t id)
                         dentry->d_parent->d_name.name,
                         dentry->d_name.name);
 
+        nfs_inc_stats(inode, NFSIOS_VFSFLUSH);
         if ((file->f_mode & FMODE_WRITE) == 0)
                 return 0;
-        nfs_inc_stats(inode, NFSIOS_VFSFLUSH);
 
         /* Flush writes to the server and return any errors */
         return nfs_do_fsync(ctx, inode);
@@ -262,9 +262,11 @@ nfs_file_read(struct kiocb *iocb, const struct iovec *iov,
                 (unsigned long) count, (unsigned long) pos);
 
         result = nfs_revalidate_mapping(inode, iocb->ki_filp->f_mapping);
-        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, count);
-        if (!result)
+        if (!result) {
                 result = generic_file_aio_read(iocb, iov, nr_segs, pos);
+                if (result > 0)
+                        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, result);
+        }
         return result;
 }
 
@@ -282,8 +284,11 @@ nfs_file_splice_read(struct file *filp, loff_t *ppos,
                 (unsigned long) count, (unsigned long long) *ppos);
 
         res = nfs_revalidate_mapping(inode, filp->f_mapping);
-        if (!res)
+        if (!res) {
                 res = generic_file_splice_read(filp, ppos, pipe, count, flags);
+                if (res > 0)
+                        nfs_add_stats(inode, NFSIOS_NORMALREADBYTES, res);
+        }
         return res;
 }
 
@@ -486,6 +491,9 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
 {
         dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
 
+        /* Only do I/O if gfp is a superset of GFP_KERNEL */
+        if ((gfp & GFP_KERNEL) == GFP_KERNEL)
+                nfs_wb_page(page->mapping->host, page);
         /* If PagePrivate() is set, then the page is not freeable */
         if (PagePrivate(page))
                 return 0;
@@ -581,7 +589,7 @@ static int nfs_need_sync_write(struct file *filp, struct inode *inode)
 {
         struct nfs_open_context *ctx;
 
-        if (IS_SYNC(inode) || (filp->f_flags & O_SYNC))
+        if (IS_SYNC(inode) || (filp->f_flags & O_DSYNC))
                 return 1;
         ctx = nfs_file_open_context(filp);
         if (test_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags))
@@ -594,6 +602,7 @@ static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
 {
         struct dentry * dentry = iocb->ki_filp->f_path.dentry;
         struct inode * inode = dentry->d_inode;
+        unsigned long written = 0;
         ssize_t result;
         size_t count = iov_length(iov, nr_segs);
 
@@ -620,14 +629,18 @@ static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
         if (!count)
                 goto out;
 
-        nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, count);
         result = generic_file_aio_write(iocb, iov, nr_segs, pos);
-        /* Return error values for O_SYNC and IS_SYNC() */
+        if (result > 0)
+                written = result;
+
+        /* Return error values for O_DSYNC and IS_SYNC() */
         if (result >= 0 && nfs_need_sync_write(iocb->ki_filp, inode)) {
                 int err = nfs_do_fsync(nfs_file_open_context(iocb->ki_filp), inode);
                 if (err < 0)
                         result = err;
         }
+        if (result > 0)
+                nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
 out:
         return result;
 
@@ -642,6 +655,7 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
 {
         struct dentry *dentry = filp->f_path.dentry;
         struct inode *inode = dentry->d_inode;
+        unsigned long written = 0;
         ssize_t ret;
 
         dprintk("NFS splice_write(%s/%s, %lu@%llu)\n",
@@ -652,14 +666,17 @@ static ssize_t nfs_file_splice_write(struct pipe_inode_info *pipe,
          * The combination of splice and an O_APPEND destination is disallowed.
          */
 
-        nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, count);
-
         ret = generic_file_splice_write(pipe, filp, ppos, count, flags);
+        if (ret > 0)
+                written = ret;
+
         if (ret >= 0 && nfs_need_sync_write(filp, inode)) {
                 int err = nfs_do_fsync(nfs_file_open_context(filp), inode);
                 if (err < 0)
                         ret = err;
         }
+        if (ret > 0)
+                nfs_add_stats(inode, NFSIOS_NORMALWRITTENBYTES, written);
         return ret;
 }
 
diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
index fa588006588d..a6b16ed93229 100644
--- a/fs/nfs/fscache.c
+++ b/fs/nfs/fscache.c
@@ -17,6 +17,7 @@
 #include <linux/nfs_fs_sb.h>
 #include <linux/in6.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 
 #include "internal.h"
 #include "iostat.h"
@@ -354,12 +355,11 @@ void nfs_fscache_reset_inode_cookie(struct inode *inode)
  */
 int nfs_fscache_release_page(struct page *page, gfp_t gfp)
 {
-        struct nfs_inode *nfsi = NFS_I(page->mapping->host);
-        struct fscache_cookie *cookie = nfsi->fscache;
-
-        BUG_ON(!cookie);
-
         if (PageFsCache(page)) {
+                struct nfs_inode *nfsi = NFS_I(page->mapping->host);
+                struct fscache_cookie *cookie = nfsi->fscache;
+
+                BUG_ON(!cookie);
                 dfprintk(FSCACHE, "NFS: fscache releasepage (0x%p/0x%p/0x%p)\n",
                          cookie, page, nfsi);
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index faa091865ad0..50a56edca0b5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -36,6 +36,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/nfs_xdr.h>
+#include <linux/slab.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -97,22 +98,6 @@ u64 nfs_compat_user_ino64(u64 fileid)
         return ino;
 }
 
-int nfs_write_inode(struct inode *inode, int sync)
-{
-        int ret;
-
-        if (sync) {
-                ret = filemap_fdatawait(inode->i_mapping);
-                if (ret == 0)
-                        ret = nfs_commit_inode(inode, FLUSH_SYNC);
-        } else
-                ret = nfs_commit_inode(inode, 0);
-        if (ret >= 0)
-                return 0;
-        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
-        return ret;
-}
-
 void nfs_clear_inode(struct inode *inode)
 {
         /*
@@ -130,16 +115,12 @@ void nfs_clear_inode(struct inode *inode)
  */
 int nfs_sync_mapping(struct address_space *mapping)
 {
-        int ret;
+        int ret = 0;
 
-        if (mapping->nrpages == 0)
-                return 0;
-        unmap_mapping_range(mapping, 0, 0, 0);
-        ret = filemap_write_and_wait(mapping);
-        if (ret != 0)
-                goto out;
-        ret = nfs_wb_all(mapping->host);
-out:
+        if (mapping->nrpages != 0) {
+                unmap_mapping_range(mapping, 0, 0, 0);
+                ret = nfs_wb_all(mapping->host);
+        }
         return ret;
 }
 
@@ -511,17 +492,11 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
         int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
         int err;
 
-        /*
-         * Flush out writes to the server in order to update c/mtime.
-         *
-         * Hold the i_mutex to suspend application writes temporarily;
-         * this prevents long-running writing applications from blocking
-         * nfs_wb_nocommit.
-         */
+        /* Flush out writes to the server in order to update c/mtime.  */
         if (S_ISREG(inode->i_mode)) {
-                mutex_lock(&inode->i_mutex);
-                nfs_wb_nocommit(inode);
-                mutex_unlock(&inode->i_mutex);
+                err = filemap_write_and_wait(inode->i_mapping);
+                if (err)
+                        goto out;
         }
 
         /*
@@ -545,6 +520,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
                 generic_fillattr(inode, stat);
                 stat->ino = nfs_compat_user_ino64(NFS_FILEID(inode));
         }
+out:
         return err;
 }
 
@@ -574,14 +550,14 @@ void nfs_close_context(struct nfs_open_context *ctx, int is_sync)
         nfs_revalidate_inode(server, inode);
 }
 
-static struct nfs_open_context *alloc_nfs_open_context(struct vfsmount *mnt, struct dentry *dentry, struct rpc_cred *cred)
+static struct nfs_open_context *alloc_nfs_open_context(struct path *path, struct rpc_cred *cred)
 {
         struct nfs_open_context *ctx;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (ctx != NULL) {
-                ctx->path.dentry = dget(dentry);
-                ctx->path.mnt = mntget(mnt);
+                ctx->path = *path;
+                path_get(&ctx->path);
                 ctx->cred = get_rpccred(cred);
                 ctx->state = NULL;
                 ctx->lockowner = current->files;
@@ -620,11 +596,6 @@ void put_nfs_open_context(struct nfs_open_context *ctx)
         __put_nfs_open_context(ctx, 0);
 }
 
-static void put_nfs_open_context_sync(struct nfs_open_context *ctx)
-{
-        __put_nfs_open_context(ctx, 1);
-}
-
 /*
  * Ensure that mmap has a recent RPC credential for use when writing out
  * shared pages
@@ -652,10 +623,10 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c
         list_for_each_entry(pos, &nfsi->open_files, list) {
                 if (cred != NULL && pos->cred != cred)
                         continue;
-                if ((pos->mode & mode) == mode) {
-                        ctx = get_nfs_open_context(pos);
-                        break;
-                }
+                if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode)
+                        continue;
+                ctx = get_nfs_open_context(pos);
+                break;
         }
         spin_unlock(&inode->i_lock);
         return ctx;
@@ -671,7 +642,7 @@ static void nfs_file_clear_open_context(struct file *filp)
                 spin_lock(&inode->i_lock);
                 list_move_tail(&ctx->list, &NFS_I(inode)->open_files);
                 spin_unlock(&inode->i_lock);
-                put_nfs_open_context_sync(ctx);
+                __put_nfs_open_context(ctx, filp->f_flags & O_DIRECT ? 0 : 1);
         }
 }
 
@@ -686,7 +657,7 @@ int nfs_open(struct inode *inode, struct file *filp)
         cred = rpc_lookup_cred();
         if (IS_ERR(cred))
                 return PTR_ERR(cred);
-        ctx = alloc_nfs_open_context(filp->f_path.mnt, filp->f_path.dentry, cred);
+        ctx = alloc_nfs_open_context(&filp->f_path, cred);
         put_rpccred(cred);
         if (ctx == NULL)
                 return -ENOMEM;
@@ -759,7 +730,7 @@ int nfs_attribute_timeout(struct inode *inode)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
 
-        if (nfs_have_delegation(inode, FMODE_READ))
+        if (nfs_have_delegated_attributes(inode))
                 return 0;
         return !time_in_range_open(jiffies, nfsi->read_cache_jiffies, nfsi->read_cache_jiffies + nfsi->attrtimeo);
 }
@@ -779,7 +750,7 @@ int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
         return __nfs_revalidate_inode(server, inode);
 }
 
-static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
+static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         
@@ -800,49 +771,10 @@ static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_spa
         return 0;
 }
 
-static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
-{
-        int ret = 0;
-
-        mutex_lock(&inode->i_mutex);
-        if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_DATA) {
-                ret = nfs_sync_mapping(mapping);
-                if (ret == 0)
-                        ret = nfs_invalidate_mapping_nolock(inode, mapping);
-        }
-        mutex_unlock(&inode->i_mutex);
-        return ret;
-}
-
-/**
- * nfs_revalidate_mapping_nolock - Revalidate the pagecache
- * @inode - pointer to host inode
- * @mapping - pointer to mapping
- */
-int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
-{
-        struct nfs_inode *nfsi = NFS_I(inode);
-        int ret = 0;
-
-        if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-                        || nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
-                ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-                if (ret < 0)
-                        goto out;
-        }
-        if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-                ret = nfs_invalidate_mapping_nolock(inode, mapping);
-out:
-        return ret;
-}
-
 /**
  * nfs_revalidate_mapping - Revalidate the pagecache
  * @inode - pointer to host inode
  * @mapping - pointer to mapping
- *
- * This version of the function will take the inode->i_mutex and attempt to
- * flush out all dirty data if it needs to invalidate the page cache.
  */
 int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
@@ -1261,8 +1193,10 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 
         if (fattr->valid & NFS_ATTR_FATTR_MODE) {
                 if ((inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO)) {
+                        umode_t newmode = inode->i_mode & S_IFMT;
+                        newmode |= fattr->mode & S_IALLUGO;
+                        inode->i_mode = newmode;
                         invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-                        inode->i_mode = fattr->mode;
                 }
         } else if (server->caps & NFS_CAP_MODE)
                 invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
@@ -1418,6 +1352,7 @@ static void init_once(void *foo)
         INIT_LIST_HEAD(&nfsi->access_cache_inode_lru);
         INIT_RADIX_TREE(&nfsi->nfs_page_tree, GFP_ATOMIC);
         nfsi->npages = 0;
+        nfsi->ncommit = 0;
         atomic_set(&nfsi->silly_count, 1);
         INIT_HLIST_HEAD(&nfsi->silly_list);
         init_waitqueue_head(&nfsi->waitqueue);
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index e21b1bb9972f..11f82f03c5de 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -30,6 +30,15 @@ static inline int nfs4_has_session(const struct nfs_client *clp)
         return 0;
 }
 
+static inline int nfs4_has_persistent_session(const struct nfs_client *clp)
+{
+#ifdef CONFIG_NFS_V4_1
+        if (nfs4_has_session(clp))
+                return (clp->cl_session->flags & SESSION4_PERSIST);
+#endif /* CONFIG_NFS_V4_1 */
+        return 0;
+}
+
 struct nfs_clone_mount {
         const struct super_block *sb;
         const struct dentry *dentry;
@@ -156,6 +165,7 @@ struct vfsmount *nfs_do_refmount(const struct vfsmount *mnt_parent, struct dentr
 
 /* callback_xdr.c */
 extern struct svc_version nfs4_callback_version1;
+extern struct svc_version nfs4_callback_version4;
 
 /* pagelist.c */
 extern int __init nfs_init_nfspagecache(void);
@@ -177,24 +187,14 @@ extern __be32 * nfs_decode_dirent(__be32 *, struct nfs_entry *, int);
 extern struct rpc_procinfo nfs3_procedures[];
 extern __be32 *nfs3_decode_dirent(__be32 *, struct nfs_entry *, int);
 
-/* nfs4proc.c */
-static inline void nfs4_restart_rpc(struct rpc_task *task,
-                                    const struct nfs_client *clp)
-{
-#ifdef CONFIG_NFS_V4_1
-        if (nfs4_has_session(clp) &&
-            test_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state)) {
-                rpc_restart_call_prepare(task);
-                return;
-        }
-#endif /* CONFIG_NFS_V4_1 */
-        rpc_restart_call(task);
-}
-
 /* nfs4xdr.c */
 #ifdef CONFIG_NFS_V4
 extern __be32 *nfs4_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus);
 #endif
+#ifdef CONFIG_NFS_V4_1
+extern const u32 nfs41_maxread_overhead;
+extern const u32 nfs41_maxwrite_overhead;
+#endif
 
 /* nfs4proc.c */
 #ifdef CONFIG_NFS_V4
@@ -211,7 +211,7 @@ extern int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask);
 extern struct workqueue_struct *nfsiod_workqueue;
 extern struct inode *nfs_alloc_inode(struct super_block *sb);
 extern void nfs_destroy_inode(struct inode *);
-extern int nfs_write_inode(struct inode *,int);
+extern int nfs_write_inode(struct inode *, struct writeback_control *);
 extern void nfs_clear_inode(struct inode *);
 #ifdef CONFIG_NFS_V4
 extern void nfs4_clear_inode(struct inode *);
@@ -273,20 +273,6 @@ extern int _nfs4_call_sync_session(struct nfs_server *server,
                                    struct nfs4_sequence_res *res,
                                    int cache_reply);
 
-#ifdef CONFIG_NFS_V4_1
-extern void nfs41_sequence_free_slot(const struct nfs_client *,
-                                     struct nfs4_sequence_res *res);
-#endif /* CONFIG_NFS_V4_1 */
-
-static inline void nfs4_sequence_free_slot(const struct nfs_client *clp,
-                                           struct nfs4_sequence_res *res)
-{
-#ifdef CONFIG_NFS_V4_1
-        if (nfs4_has_session(clp))
-                nfs41_sequence_free_slot(clp, res);
-#endif /* CONFIG_NFS_V4_1 */
-}
-
 /*
  * Determine the device name as a string
  */
@@ -380,3 +366,15 @@ unsigned int nfs_page_array_len(unsigned int base, size_t len)
         return ((unsigned long)len + (unsigned long)base +
                 PAGE_SIZE - 1) >> PAGE_SHIFT;
 }
+
+/*
+ * Helper for restarting RPC calls in the possible presence of NFSv4.1
+ * sessions.
+ */
+static inline void nfs_restart_rpc(struct rpc_task *task, const struct nfs_client *clp)
+{
+        if (nfs4_has_session(clp))
+                rpc_restart_call_prepare(task);
+        else
+                rpc_restart_call(task);
+}
diff --git a/fs/nfs/iostat.h b/fs/nfs/iostat.h
index ceda50aad73c..1d8d5c813b01 100644
--- a/fs/nfs/iostat.h
+++ b/fs/nfs/iostat.h
@@ -25,13 +25,7 @@ struct nfs_iostats {
 static inline void nfs_inc_server_stats(const struct nfs_server *server,
                                         enum nfs_stat_eventcounters stat)
 {
-        struct nfs_iostats *iostats;
-        int cpu;
-
-        cpu = get_cpu();
-        iostats = per_cpu_ptr(server->io_stats, cpu);
-        iostats->events[stat]++;
-        put_cpu();
+        this_cpu_inc(server->io_stats->events[stat]);
 }
 
 static inline void nfs_inc_stats(const struct inode *inode,
@@ -44,13 +38,7 @@ static inline void nfs_add_server_stats(const struct nfs_server *server,
                                         enum nfs_stat_bytecounters stat,
                                         unsigned long addend)
 {
-        struct nfs_iostats *iostats;
-        int cpu;
-
-        cpu = get_cpu();
-        iostats = per_cpu_ptr(server->io_stats, cpu);
-        iostats->bytes[stat] += addend;
-        put_cpu();
+        this_cpu_add(server->io_stats->bytes[stat], addend);
 }
 
 static inline void nfs_add_stats(const struct inode *inode,
@@ -65,22 +53,16 @@ static inline void nfs_add_fscache_stats(struct inode *inode,
                                          enum nfs_stat_fscachecounters stat,
                                          unsigned long addend)
 {
-        struct nfs_iostats *iostats;
-        int cpu;
-
-        cpu = get_cpu();
-        iostats = per_cpu_ptr(NFS_SERVER(inode)->io_stats, cpu);
-        iostats->fscache[stat] += addend;
-        put_cpu();
+        this_cpu_add(NFS_SERVER(inode)->io_stats->fscache[stat], addend);
 }
 #endif
 
-static inline struct nfs_iostats *nfs_alloc_iostats(void)
+static inline struct nfs_iostats __percpu *nfs_alloc_iostats(void)
 {
         return alloc_percpu(struct nfs_iostats);
 }
 
-static inline void nfs_free_iostats(struct nfs_iostats *stats)
+static inline void nfs_free_iostats(struct nfs_iostats __percpu *stats)
 {
         if (stats != NULL)
                 free_percpu(stats);
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 0adefc40cc89..59047f8d7d72 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -120,7 +120,7 @@ static struct {
         { .status = MNT3ERR_INVAL,              .errno = -EINVAL,       },
         { .status = MNT3ERR_NAMETOOLONG,        .errno = -ENAMETOOLONG, },
         { .status = MNT3ERR_NOTSUPP,            .errno = -ENOTSUPP,     },
-        { .status = MNT3ERR_SERVERFAULT,        .errno = -ESERVERFAULT, },
+        { .status = MNT3ERR_SERVERFAULT,        .errno = -EREMOTEIO,    },
 };
 
 struct mountres {
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 40c766782891..7888cf36022d 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/dcache.h>
+#include <linux/gfp.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nfs_fs.h>
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index 5e078b222b4e..81cf14257916 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -12,7 +12,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -699,7 +698,7 @@ static struct {
         { NFSERR_BAD_COOKIE,    -EBADCOOKIE     },
         { NFSERR_NOTSUPP,       -ENOTSUPP       },
         { NFSERR_TOOSMALL,      -ETOOSMALL      },
-        { NFSERR_SERVERFAULT,   -ESERVERFAULT   },
+        { NFSERR_SERVERFAULT,   -EREMOTEIO      },
         { NFSERR_BADTYPE,       -EBADTYPE       },
         { NFSERR_JUKEBOX,       -EJUKEBOX       },
         { -1,                   -EIO            }
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index bac60515a4b3..d150ae0c5ecd 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -1,4 +1,5 @@
 #include <linux/fs.h>
+#include <linux/gfp.h>
 #include <linux/nfs.h>
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 3f8881d1a050..e701002694e5 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
+#include <linux/slab.h>
 #include <linux/nfs.h>
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
@@ -22,14 +23,14 @@
 
 #define NFSDBG_FACILITY         NFSDBG_PROC
 
-/* A wrapper to handle the EJUKEBOX error message */
+/* A wrapper to handle the EJUKEBOX and EKEYEXPIRED error messages */
 static int
 nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 {
         int res;
         do {
                 res = rpc_call_sync(clnt, msg, flags);
-                if (res != -EJUKEBOX)
+                if (res != -EJUKEBOX && res != -EKEYEXPIRED)
                         break;
                 schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
                 res = -ERESTARTSYS;
@@ -42,9 +43,10 @@ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 static int
 nfs3_async_handle_jukebox(struct rpc_task *task, struct inode *inode)
 {
-        if (task->tk_status != -EJUKEBOX)
+        if (task->tk_status != -EJUKEBOX && task->tk_status != -EKEYEXPIRED)
                 return 0;
-        nfs_inc_stats(inode, NFSIOS_DELAY);
+        if (task->tk_status == -EJUKEBOX)
+                nfs_inc_stats(inode, NFSIOS_DELAY);
         task->tk_status = 0;
         rpc_restart_call(task);
         rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 5fe5492fbd29..56a86f6ac8b5 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -9,7 +9,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 6ea07a3c75d4..a187200a7aac 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -44,7 +44,9 @@ enum nfs4_client_state {
         NFS4CLNT_RECLAIM_REBOOT,
         NFS4CLNT_RECLAIM_NOGRACE,
         NFS4CLNT_DELEGRETURN,
-        NFS4CLNT_SESSION_SETUP,
+        NFS4CLNT_SESSION_RESET,
+        NFS4CLNT_SESSION_DRAINING,
+        NFS4CLNT_RECALL_SLOT,
 };
 
 /*
@@ -107,6 +109,10 @@ enum {
         NFS_OWNER_RECLAIM_NOGRACE
 };
 
+#define NFS_LOCK_NEW            0
+#define NFS_LOCK_RECLAIM        1
+#define NFS_LOCK_EXPIRED        2
+
 /*
  * struct nfs4_state maintains the client-side state for a given
  * (state_owner,inode) tuple (OPEN) or state_owner (LOCK).
@@ -141,6 +147,7 @@ enum {
         NFS_O_RDWR_STATE,               /* OPEN stateid has read/write state */
         NFS_STATE_RECLAIM_REBOOT,       /* OPEN stateid server rebooted */
         NFS_STATE_RECLAIM_NOGRACE,      /* OPEN stateid needs to recover state */
+        NFS_STATE_POSIX_LOCKS,          /* Posix locks are supported */
 };
 
 struct nfs4_state {
@@ -180,6 +187,7 @@ struct nfs4_state_recovery_ops {
         int (*recover_lock)(struct nfs4_state *, struct file_lock *);
         int (*establish_clid)(struct nfs_client *, struct rpc_cred *);
         struct rpc_cred * (*get_clid_cred)(struct nfs_client *);
+        int (*reclaim_complete)(struct nfs_client *);
 };
 
 struct nfs4_state_maintenance_ops {
@@ -200,9 +208,11 @@ extern ssize_t nfs4_listxattr(struct dentry *, char *, size_t);
 /* nfs4proc.c */
 extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *);
 extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct rpc_cred *);
+extern int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred);
 extern int nfs4_proc_async_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_proc_renew(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_init_clientid(struct nfs_client *, struct rpc_cred *);
+extern int nfs41_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait);
 extern struct dentry *nfs4_atomic_open(struct inode *, struct dentry *, struct nameidata *);
 extern int nfs4_open_revalidate(struct inode *, struct dentry *, int, struct nameidata *);
@@ -218,9 +228,11 @@ extern int nfs4_setup_sequence(struct nfs_client *clp,
                 int cache_reply, struct rpc_task *task);
 extern void nfs4_destroy_session(struct nfs4_session *session);
 extern struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp);
-extern int nfs4_proc_create_session(struct nfs_client *, int reset);
+extern int nfs4_proc_create_session(struct nfs_client *);
 extern int nfs4_proc_destroy_session(struct nfs4_session *);
 extern int nfs4_init_session(struct nfs_server *server);
+extern int nfs4_proc_get_lease_time(struct nfs_client *clp,
+                struct nfs_fsinfo *fsinfo);
 #else /* CONFIG_NFS_v4_1 */
 static inline int nfs4_setup_sequence(struct nfs_client *clp,
                 struct nfs4_sequence_args *args, struct nfs4_sequence_res *res,
@@ -267,6 +279,9 @@ extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
 extern void nfs4_schedule_state_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
 extern int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state);
+extern int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state);
+extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
+extern void nfs41_handle_recall_slot(struct nfs_client *clp);
 extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
 extern int nfs4_set_lock_state(struct nfs4_state *state, struct file_lock *fl);
 extern void nfs4_copy_stateid(nfs4_stateid *, struct nfs4_state *, fl_owner_t);
@@ -275,6 +290,7 @@ extern struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter);
 extern int nfs_wait_on_sequence(struct nfs_seqid *seqid, struct rpc_task *task);
 extern void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid);
 extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid);
+extern void nfs_release_seqid(struct nfs_seqid *seqid);
 extern void nfs_free_seqid(struct nfs_seqid *seqid);
 
 extern const nfs4_stateid zero_stateid;
@@ -287,6 +303,7 @@ struct nfs4_mount_data;
 
 /* callback_xdr.c */
 extern struct svc_version nfs4_callback_version1;
+extern struct svc_version nfs4_callback_version4;
 
 #else
 
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index fa3408f20112..f071d12c613b 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -11,6 +11,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/vfs.h>
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 741a562177fc..071fcedd517c 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -39,6 +39,7 @@
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/string.h>
+#include <linux/slab.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs.h>
 #include <linux/nfs4.h>
@@ -64,6 +65,7 @@
 
 struct nfs4_opendata;
 static int _nfs4_proc_open(struct nfs4_opendata *data);
+static int _nfs4_recover_proc_open(struct nfs4_opendata *data);
 static int nfs4_do_fsinfo(struct nfs_server *, struct nfs_fh *, struct nfs_fsinfo *);
 static int nfs4_async_handle_error(struct rpc_task *, const struct nfs_server *, struct nfs4_state *);
 static int _nfs4_proc_lookup(struct inode *dir, const struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr);
@@ -248,19 +250,15 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                         if (state == NULL)
                                 break;
                         nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                 case -NFS4ERR_STALE_STATEID:
-                case -NFS4ERR_EXPIRED:
-                        nfs4_schedule_state_recovery(clp);
-                        ret = nfs4_wait_clnt_recover(clp);
-                        if (ret == 0)
-                                exception->retry = 1;
-#if !defined(CONFIG_NFS_V4_1)
-                        break;
-#else /* !defined(CONFIG_NFS_V4_1) */
-                        if (!nfs4_has_session(server->nfs_client))
+                        if (state == NULL)
                                 break;
-                        /* FALLTHROUGH */
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
+                case -NFS4ERR_EXPIRED:
+                        goto do_state_recovery;
+#if defined(CONFIG_NFS_V4_1)
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
                 case -NFS4ERR_BAD_HIGH_SLOT:
@@ -270,13 +268,21 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                 case -NFS4ERR_SEQ_MISORDERED:
                         dprintk("%s ERROR: %d Reset session\n", __func__,
                                 errorcode);
-                        set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
+                        nfs4_schedule_state_recovery(clp);
                         exception->retry = 1;
-                        /* FALLTHROUGH */
-#endif /* !defined(CONFIG_NFS_V4_1) */
+                        break;
+#endif /* defined(CONFIG_NFS_V4_1) */
                 case -NFS4ERR_FILE_OPEN:
+                        if (exception->timeout > HZ) {
+                                /* We have retried a decent amount, time to
+                                 * fail
+                                 */
+                                ret = -EBUSY;
+                                break;
+                        }
                 case -NFS4ERR_GRACE:
                 case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
                         ret = nfs4_delay(server->client, &exception->timeout);
                         if (ret != 0)
                                 break;
@@ -285,6 +291,12 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
         }
         /* We failed to handle the error */
         return nfs4_map_errors(ret);
+do_state_recovery:
+        nfs4_schedule_state_recovery(clp);
+        ret = nfs4_wait_clnt_recover(clp);
+        if (ret == 0)
+                exception->retry = 1;
+        return ret;
 }
 
 
@@ -311,48 +323,67 @@ static void renew_lease(const struct nfs_server *server, unsigned long timestamp
  * so we need to scan down from highest_used_slotid to 0 looking for the now
  * highest slotid in use.
  * If none found, highest_used_slotid is set to -1.
+ *
+ * Must be called while holding tbl->slot_tbl_lock
  */
 static void
 nfs4_free_slot(struct nfs4_slot_table *tbl, u8 free_slotid)
 {
         int slotid = free_slotid;
 
-        spin_lock(&tbl->slot_tbl_lock);
         /* clear used bit in bitmap */
         __clear_bit(slotid, tbl->used_slots);
 
         /* update highest_used_slotid when it is freed */
         if (slotid == tbl->highest_used_slotid) {
                 slotid = find_last_bit(tbl->used_slots, tbl->max_slots);
-                if (slotid >= 0 && slotid < tbl->max_slots)
+                if (slotid < tbl->max_slots)
                         tbl->highest_used_slotid = slotid;
                 else
                         tbl->highest_used_slotid = -1;
         }
-        rpc_wake_up_next(&tbl->slot_tbl_waitq);
-        spin_unlock(&tbl->slot_tbl_lock);
         dprintk("%s: free_slotid %u highest_used_slotid %d\n", __func__,
                 free_slotid, tbl->highest_used_slotid);
 }
 
-void nfs41_sequence_free_slot(const struct nfs_client *clp,
-                              struct nfs4_sequence_res *res)
+/*
+ * Signal state manager thread if session is drained
+ */
+static void nfs41_check_drain_session_complete(struct nfs4_session *ses)
 {
-        struct nfs4_slot_table *tbl;
+        struct rpc_task *task;
 
-        if (!nfs4_has_session(clp)) {
-                dprintk("%s: No session\n", __func__);
+        if (!test_bit(NFS4CLNT_SESSION_DRAINING, &ses->clp->cl_state)) {
+                task = rpc_wake_up_next(&ses->fc_slot_table.slot_tbl_waitq);
+                if (task)
+                        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
                 return;
         }
+
+        if (ses->fc_slot_table.highest_used_slotid != -1)
+                return;
+
+        dprintk("%s COMPLETE: Session Drained\n", __func__);
+        complete(&ses->complete);
+}
+
+static void nfs41_sequence_free_slot(const struct nfs_client *clp,
+                              struct nfs4_sequence_res *res)
+{
+        struct nfs4_slot_table *tbl;
+
         tbl = &clp->cl_session->fc_slot_table;
         if (res->sr_slotid == NFS4_MAX_SLOT_TABLE) {
-                dprintk("%s: No slot\n", __func__);
                 /* just wake up the next guy waiting since
                  * we may have not consumed a slot after all */
-                rpc_wake_up_next(&tbl->slot_tbl_waitq);
+                dprintk("%s: No slot\n", __func__);
                 return;
         }
+
+        spin_lock(&tbl->slot_tbl_lock);
         nfs4_free_slot(tbl, res->sr_slotid);
+        nfs41_check_drain_session_complete(clp->cl_session);
+        spin_unlock(&tbl->slot_tbl_lock);
         res->sr_slotid = NFS4_MAX_SLOT_TABLE;
 }
 
@@ -377,10 +408,10 @@ static void nfs41_sequence_done(struct nfs_client *clp,
         if (res->sr_slotid == NFS4_MAX_SLOT_TABLE)
                 goto out;
 
-        tbl = &clp->cl_session->fc_slot_table;
-        slot = tbl->slots + res->sr_slotid;
-
+        /* Check the SEQUENCE operation status */
         if (res->sr_status == 0) {
+                tbl = &clp->cl_session->fc_slot_table;
+                slot = tbl->slots + res->sr_slotid;
                 /* Update the slot's sequence and clientid lease timer */
                 ++slot->seq_nr;
                 timestamp = res->sr_renewal_time;
@@ -388,7 +419,9 @@ static void nfs41_sequence_done(struct nfs_client *clp,
                 if (time_before(clp->cl_last_renewal, timestamp))
                         clp->cl_last_renewal = timestamp;
                 spin_unlock(&clp->cl_lock);
-                return;
+                /* Check sequence flags */
+                if (atomic_read(&clp->cl_count) > 1)
+                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
         }
 out:
         /* The session may be reset by one of the error handlers. */
@@ -407,7 +440,7 @@ out:
  * Note: must be called with under the slot_tbl_lock.
  */
 static u8
-nfs4_find_slot(struct nfs4_slot_table *tbl, struct rpc_task *task)
+nfs4_find_slot(struct nfs4_slot_table *tbl)
 {
         int slotid;
         u8 ret_id = NFS4_MAX_SLOT_TABLE;
@@ -429,24 +462,6 @@ out:
         return ret_id;
 }
 
-static int nfs4_recover_session(struct nfs4_session *session)
-{
-        struct nfs_client *clp = session->clp;
-        unsigned int loop;
-        int ret;
-
-        for (loop = NFS4_MAX_LOOP_ON_RECOVER; loop != 0; loop--) {
-                ret = nfs4_wait_clnt_recover(clp);
-                if (ret != 0)
-                        break;
-                if (!test_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state))
-                        break;
-                nfs4_schedule_state_manager(clp);
-                ret = -EIO;
-        }
-        return ret;
-}
-
 static int nfs41_setup_sequence(struct nfs4_session *session,
                                 struct nfs4_sequence_args *args,
                                 struct nfs4_sequence_res *res,
@@ -455,7 +470,6 @@ static int nfs41_setup_sequence(struct nfs4_session *session,
 {
         struct nfs4_slot *slot;
         struct nfs4_slot_table *tbl;
-        int status = 0;
         u8 slotid;
 
         dprintk("--> %s\n", __func__);
@@ -468,24 +482,27 @@ static int nfs41_setup_sequence(struct nfs4_session *session,
         tbl = &session->fc_slot_table;
 
         spin_lock(&tbl->slot_tbl_lock);
-        if (test_bit(NFS4CLNT_SESSION_SETUP, &session->clp->cl_state)) {
-                if (tbl->highest_used_slotid != -1) {
-                        rpc_sleep_on(&tbl->slot_tbl_waitq, task, NULL);
-                        spin_unlock(&tbl->slot_tbl_lock);
-                        dprintk("<-- %s: Session reset: draining\n", __func__);
-                        return -EAGAIN;
-                }
+        if (test_bit(NFS4CLNT_SESSION_DRAINING, &session->clp->cl_state) &&
+            !rpc_task_has_priority(task, RPC_PRIORITY_PRIVILEGED)) {
+                /*
+                 * The state manager will wait until the slot table is empty.
+                 * Schedule the reset thread
+                 */
+                rpc_sleep_on(&tbl->slot_tbl_waitq, task, NULL);
+                spin_unlock(&tbl->slot_tbl_lock);
+                dprintk("%s Schedule Session Reset\n", __func__);
+                return -EAGAIN;
+        }
 
-                /* The slot table is empty; start the reset thread */
-                dprintk("%s Session Reset\n", __func__);
+        if (!rpc_queue_empty(&tbl->slot_tbl_waitq) &&
+            !rpc_task_has_priority(task, RPC_PRIORITY_PRIVILEGED)) {
+                rpc_sleep_on(&tbl->slot_tbl_waitq, task, NULL);
                 spin_unlock(&tbl->slot_tbl_lock);
-                status = nfs4_recover_session(session);
-                if (status)
-                        return status;
-                spin_lock(&tbl->slot_tbl_lock);
+                dprintk("%s enforce FIFO order\n", __func__);
+                return -EAGAIN;
         }
 
-        slotid = nfs4_find_slot(tbl, task);
+        slotid = nfs4_find_slot(tbl);
         if (slotid == NFS4_MAX_SLOT_TABLE) {
                 rpc_sleep_on(&tbl->slot_tbl_waitq, task, NULL);
                 spin_unlock(&tbl->slot_tbl_lock);
@@ -494,6 +511,7 @@ static int nfs41_setup_sequence(struct nfs4_session *session,
         }
         spin_unlock(&tbl->slot_tbl_lock);
 
+        rpc_task_set_priority(task, RPC_PRIORITY_NORMAL);
         slot = tbl->slots + slotid;
         args->sa_session = session;
         args->sa_slotid = slotid;
@@ -527,7 +545,7 @@ int nfs4_setup_sequence(struct nfs_client *clp,
                 goto out;
         ret = nfs41_setup_sequence(clp->cl_session, args, res, cache_reply,
                                    task);
-        if (ret != -EAGAIN) {
+        if (ret && ret != -EAGAIN) {
                 /* terminate rpc task */
                 task->tk_status = ret;
                 task->tk_action = NULL;
@@ -556,12 +574,17 @@ static void nfs41_call_sync_prepare(struct rpc_task *task, void *calldata)
         rpc_call_start(task);
 }
 
+static void nfs41_call_priv_sync_prepare(struct rpc_task *task, void *calldata)
+{
+        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
+        nfs41_call_sync_prepare(task, calldata);
+}
+
 static void nfs41_call_sync_done(struct rpc_task *task, void *calldata)
 {
         struct nfs41_call_sync_data *data = calldata;
 
         nfs41_sequence_done(data->clp, data->seq_res, task->tk_status);
-        nfs41_sequence_free_slot(data->clp, data->seq_res);
 }
 
 struct rpc_call_ops nfs41_call_sync_ops = {
@@ -569,12 +592,18 @@ struct rpc_call_ops nfs41_call_sync_ops = {
         .rpc_call_done = nfs41_call_sync_done,
 };
 
+struct rpc_call_ops nfs41_call_priv_sync_ops = {
+        .rpc_call_prepare = nfs41_call_priv_sync_prepare,
+        .rpc_call_done = nfs41_call_sync_done,
+};
+
 static int nfs4_call_sync_sequence(struct nfs_client *clp,
                                    struct rpc_clnt *clnt,
                                    struct rpc_message *msg,
                                    struct nfs4_sequence_args *args,
                                    struct nfs4_sequence_res *res,
-                                   int cache_reply)
+                                   int cache_reply,
+                                   int privileged)
 {
         int ret;
         struct rpc_task *task;
@@ -592,6 +621,8 @@ static int nfs4_call_sync_sequence(struct nfs_client *clp,
         };
 
         res->sr_slotid = NFS4_MAX_SLOT_TABLE;
+        if (privileged)
+                task_setup.callback_ops = &nfs41_call_priv_sync_ops;
         task = rpc_run_task(&task_setup);
         if (IS_ERR(task))
                 ret = PTR_ERR(task);
@@ -609,7 +640,7 @@ int _nfs4_call_sync_session(struct nfs_server *server,
                             int cache_reply)
 {
         return nfs4_call_sync_sequence(server->nfs_client, server->client,
-                                       msg, args, res, cache_reply);
+                                       msg, args, res, cache_reply, 0);
 }
 
 #endif /* CONFIG_NFS_V4_1 */
@@ -637,15 +668,6 @@ static void nfs4_sequence_done(const struct nfs_server *server,
 #endif /* CONFIG_NFS_V4_1 */
 }
 
-/* no restart, therefore free slot here */
-static void nfs4_sequence_done_free_slot(const struct nfs_server *server,
-                                         struct nfs4_sequence_res *res,
-                                         int rpc_status)
-{
-        nfs4_sequence_done(server, res, rpc_status);
-        nfs4_sequence_free_slot(server->nfs_client, res);
-}
-
 static void update_changeattr(struct inode *dir, struct nfs4_change_info *cinfo)
 {
         struct nfs_inode *nfsi = NFS_I(dir);
@@ -705,8 +727,8 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct path *path,
         p->o_arg.seqid = nfs_alloc_seqid(&sp->so_seqid);
         if (p->o_arg.seqid == NULL)
                 goto err_free;
-        p->path.mnt = mntget(path->mnt);
-        p->path.dentry = dget(path->dentry);
+        path_get(path);
+        p->path = *path;
         p->dir = parent;
         p->owner = sp;
         atomic_inc(&sp->so_count);
@@ -720,9 +742,15 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct path *path,
         p->o_arg.bitmask = server->attr_bitmask;
         p->o_arg.claim = NFS4_OPEN_CLAIM_NULL;
         if (flags & O_EXCL) {
-                u32 *s = (u32 *) p->o_arg.u.verifier.data;
-                s[0] = jiffies;
-                s[1] = current->pid;
+                if (nfs4_has_persistent_session(server->nfs_client)) {
+                        /* GUARDED */
+                        p->o_arg.u.attrs = &p->attrs;
+                        memcpy(&p->attrs, attrs, sizeof(p->attrs));
+                } else { /* EXCLUSIVE4_1 */
+                        u32 *s = (u32 *) p->o_arg.u.verifier.data;
+                        s[0] = jiffies;
+                        s[1] = current->pid;
+                }
         } else if (flags & O_CREAT) {
                 p->o_arg.u.attrs = &p->attrs;
                 memcpy(&p->attrs, attrs, sizeof(p->attrs));
@@ -776,13 +804,16 @@ static int can_open_cached(struct nfs4_state *state, fmode_t mode, int open_mode
                 goto out;
         switch (mode & (FMODE_READ|FMODE_WRITE)) {
                 case FMODE_READ:
-                        ret |= test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0;
+                        ret |= test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0
+                                && state->n_rdonly != 0;
                         break;
                 case FMODE_WRITE:
-                        ret |= test_bit(NFS_O_WRONLY_STATE, &state->flags) != 0;
+                        ret |= test_bit(NFS_O_WRONLY_STATE, &state->flags) != 0
+                                && state->n_wronly != 0;
                         break;
                 case FMODE_READ|FMODE_WRITE:
-                        ret |= test_bit(NFS_O_RDWR_STATE, &state->flags) != 0;
+                        ret |= test_bit(NFS_O_RDWR_STATE, &state->flags) != 0
+                                && state->n_rdwr != 0;
         }
 out:
         return ret;
@@ -1047,7 +1078,7 @@ static int nfs4_open_recover_helper(struct nfs4_opendata *opendata, fmode_t fmod
         memset(&opendata->o_res, 0, sizeof(opendata->o_res));
         memset(&opendata->c_res, 0, sizeof(opendata->c_res));
         nfs4_init_opendata_res(opendata);
-        ret = _nfs4_proc_open(opendata);
+        ret = _nfs4_recover_proc_open(opendata);
         if (ret != 0)
                 return ret; 
         newstate = nfs4_opendata_to_nfs4_state(opendata);
@@ -1135,7 +1166,7 @@ static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state
         int err;
         do {
                 err = _nfs4_do_open_reclaim(ctx, state);
-                if (err != -NFS4ERR_DELAY)
+                if (err != -NFS4ERR_DELAY && err != -EKEYEXPIRED)
                         break;
                 nfs4_handle_exception(server, err, &exception);
         } while (exception.retry);
@@ -1183,6 +1214,14 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
                         case -ENOENT:
                         case -ESTALE:
                                 goto out;
+                        case -NFS4ERR_BADSESSION:
+                        case -NFS4ERR_BADSLOT:
+                        case -NFS4ERR_BAD_HIGH_SLOT:
+                        case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
+                        case -NFS4ERR_DEADSESSION:
+                                nfs4_schedule_state_recovery(
+                                        server->nfs_client);
+                                goto out;
                         case -NFS4ERR_STALE_CLIENTID:
                         case -NFS4ERR_STALE_STATEID:
                         case -NFS4ERR_EXPIRED:
@@ -1330,14 +1369,20 @@ out_no_action:
 
 }
 
+static void nfs4_recover_open_prepare(struct rpc_task *task, void *calldata)
+{
+        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
+        nfs4_open_prepare(task, calldata);
+}
+
 static void nfs4_open_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_opendata *data = calldata;
 
         data->rpc_status = task->tk_status;
 
-        nfs4_sequence_done_free_slot(data->o_arg.server, &data->o_res.seq_res,
-                                     task->tk_status);
+        nfs4_sequence_done(data->o_arg.server, &data->o_res.seq_res,
+                        task->tk_status);
 
         if (RPC_ASSASSINATED(task))
                 return;
@@ -1388,10 +1433,13 @@ static const struct rpc_call_ops nfs4_open_ops = {
         .rpc_release = nfs4_open_release,
 };
 
-/*
- * Note: On error, nfs4_proc_open will free the struct nfs4_opendata
- */
-static int _nfs4_proc_open(struct nfs4_opendata *data)
+static const struct rpc_call_ops nfs4_recover_open_ops = {
+        .rpc_call_prepare = nfs4_recover_open_prepare,
+        .rpc_call_done = nfs4_open_done,
+        .rpc_release = nfs4_open_release,
+};
+
+static int nfs4_run_open_task(struct nfs4_opendata *data, int isrecover)
 {
         struct inode *dir = data->dir->d_inode;
         struct nfs_server *server = NFS_SERVER(dir);
@@ -1418,27 +1466,65 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
         data->rpc_done = 0;
         data->rpc_status = 0;
         data->cancelled = 0;
+        if (isrecover)
+                task_setup_data.callback_ops = &nfs4_recover_open_ops;
         task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task))
-                return PTR_ERR(task);
-        status = nfs4_wait_for_completion_rpc_task(task);
-        if (status != 0) {
-                data->cancelled = 1;
-                smp_wmb();
-        } else
-                status = data->rpc_status;
-        rpc_put_task(task);
+        if (IS_ERR(task))
+                return PTR_ERR(task);
+        status = nfs4_wait_for_completion_rpc_task(task);
+        if (status != 0) {
+                data->cancelled = 1;
+                smp_wmb();
+        } else
+                status = data->rpc_status;
+        rpc_put_task(task);
+
+        return status;
+}
+
+static int _nfs4_recover_proc_open(struct nfs4_opendata *data)
+{
+        struct inode *dir = data->dir->d_inode;
+        struct nfs_openres *o_res = &data->o_res;
+        int status;
+
+        status = nfs4_run_open_task(data, 1);
         if (status != 0 || !data->rpc_done)
                 return status;
 
-        if (o_res->fh.size == 0)
-                _nfs4_proc_lookup(dir, o_arg->name, &o_res->fh, o_res->f_attr);
+        nfs_refresh_inode(dir, o_res->dir_attr);
+
+        if (o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
+                status = _nfs4_proc_open_confirm(data);
+                if (status != 0)
+                        return status;
+        }
+
+        return status;
+}
+
+/*
+ * Note: On error, nfs4_proc_open will free the struct nfs4_opendata
+ */
+static int _nfs4_proc_open(struct nfs4_opendata *data)
+{
+        struct inode *dir = data->dir->d_inode;
+        struct nfs_server *server = NFS_SERVER(dir);
+        struct nfs_openargs *o_arg = &data->o_arg;
+        struct nfs_openres *o_res = &data->o_res;
+        int status;
+
+        status = nfs4_run_open_task(data, 0);
+        if (status != 0 || !data->rpc_done)
+                return status;
 
         if (o_arg->open_flags & O_CREAT) {
                 update_changeattr(dir, &o_res->cinfo);
                 nfs_post_op_update_inode(dir, o_res->dir_attr);
         } else
                 nfs_refresh_inode(dir, o_res->dir_attr);
+        if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
+                server->caps &= ~NFS_CAP_POSIX_LOCK;
         if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
                 status = _nfs4_proc_open_confirm(data);
                 if (status != 0)
@@ -1488,7 +1574,7 @@ static int _nfs4_open_expired(struct nfs_open_context *ctx, struct nfs4_state *s
         return ret;
 }
 
-static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
+static int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
         struct nfs4_exception exception = { };
@@ -1496,10 +1582,17 @@ static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4
 
         do {
                 err = _nfs4_open_expired(ctx, state);
-                if (err != -NFS4ERR_DELAY)
-                        break;
-                nfs4_handle_exception(server, err, &exception);
+                switch (err) {
+                default:
+                        goto out;
+                case -NFS4ERR_GRACE:
+                case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
+                        nfs4_handle_exception(server, err, &exception);
+                        err = 0;
+                }
         } while (exception.retry);
+out:
         return err;
 }
 
@@ -1573,6 +1666,8 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
         status = PTR_ERR(state);
         if (IS_ERR(state))
                 goto err_opendata_put;
+        if (server->caps & NFS_CAP_POSIX_LOCK)
+                set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
         nfs4_opendata_put(opendata);
         nfs4_put_state_owner(sp);
         *res = state;
@@ -1712,6 +1807,18 @@ static void nfs4_free_closedata(void *data)
         kfree(calldata);
 }
 
+static void nfs4_close_clear_stateid_flags(struct nfs4_state *state,
+                fmode_t fmode)
+{
+        spin_lock(&state->owner->so_lock);
+        if (!(fmode & FMODE_READ))
+                clear_bit(NFS_O_RDONLY_STATE, &state->flags);
+        if (!(fmode & FMODE_WRITE))
+                clear_bit(NFS_O_WRONLY_STATE, &state->flags);
+        clear_bit(NFS_O_RDWR_STATE, &state->flags);
+        spin_unlock(&state->owner->so_lock);
+}
+
 static void nfs4_close_done(struct rpc_task *task, void *data)
 {
         struct nfs4_closedata *calldata = data;
@@ -1728,6 +1835,8 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                 case 0:
                         nfs_set_open_stateid(state, &calldata->res.stateid, 0);
                         renew_lease(server, calldata->timestamp);
+                        nfs4_close_clear_stateid_flags(state,
+                                        calldata->arg.fmode);
                         break;
                 case -NFS4ERR_STALE_STATEID:
                 case -NFS4ERR_OLD_STATEID:
@@ -1736,12 +1845,10 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                         if (calldata->arg.fmode == 0)
                                 break;
                 default:
-                        if (nfs4_async_handle_error(task, server, state) == -EAGAIN) {
-                                nfs4_restart_rpc(task, server->nfs_client);
-                                return;
-                        }
+                        if (nfs4_async_handle_error(task, server, state) == -EAGAIN)
+                                rpc_restart_call_prepare(task);
         }
-        nfs4_sequence_free_slot(server->nfs_client, &calldata->res.seq_res);
+        nfs_release_seqid(calldata->arg.seqid);
         nfs_refresh_inode(calldata->inode, calldata->res.fattr);
 }
 
@@ -1749,38 +1856,39 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
 {
         struct nfs4_closedata *calldata = data;
         struct nfs4_state *state = calldata->state;
-        int clear_rd, clear_wr, clear_rdwr;
+        int call_close = 0;
 
         if (nfs_wait_on_sequence(calldata->arg.seqid, task) != 0)
                 return;
 
-        clear_rd = clear_wr = clear_rdwr = 0;
+        task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+        calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
         spin_lock(&state->owner->so_lock);
         /* Calculate the change in open mode */
         if (state->n_rdwr == 0) {
                 if (state->n_rdonly == 0) {
-                        clear_rd |= test_and_clear_bit(NFS_O_RDONLY_STATE, &state->flags);
-                        clear_rdwr |= test_and_clear_bit(NFS_O_RDWR_STATE, &state->flags);
+                        call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
+                        call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+                        calldata->arg.fmode &= ~FMODE_READ;
                 }
                 if (state->n_wronly == 0) {
-                        clear_wr |= test_and_clear_bit(NFS_O_WRONLY_STATE, &state->flags);
-                        clear_rdwr |= test_and_clear_bit(NFS_O_RDWR_STATE, &state->flags);
+                        call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
+                        call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+                        calldata->arg.fmode &= ~FMODE_WRITE;
                 }
         }
         spin_unlock(&state->owner->so_lock);
-        if (!clear_rd && !clear_wr && !clear_rdwr) {
+
+        if (!call_close) {
                 /* Note: exit _without_ calling nfs4_close_done */
                 task->tk_action = NULL;
                 return;
         }
+
+        if (calldata->arg.fmode == 0)
+                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CLOSE];
+
         nfs_fattr_init(calldata->res.fattr);
-        if (test_bit(NFS_O_RDONLY_STATE, &state->flags) != 0) {
-                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
-                calldata->arg.fmode = FMODE_READ;
-        } else if (test_bit(NFS_O_WRONLY_STATE, &state->flags) != 0) {
-                task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
-                calldata->arg.fmode = FMODE_WRITE;
-        }
         calldata->timestamp = jiffies;
         if (nfs4_setup_sequence((NFS_SERVER(calldata->inode))->nfs_client,
                                 &calldata->arg.seq_args, &calldata->res.seq_res,
@@ -1832,8 +1940,6 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
         calldata->state = state;
         calldata->arg.fh = NFS_FH(state->inode);
         calldata->arg.stateid = &state->open_stateid;
-        if (nfs4_has_session(server->nfs_client))
-                memset(calldata->arg.stateid->data, 0, 4);    /* clear seqid */
         /* Serialization for the sequence id */
         calldata->arg.seqid = nfs_alloc_seqid(&state->owner->so_seqid);
         if (calldata->arg.seqid == NULL)
@@ -1844,8 +1950,8 @@ int nfs4_do_close(struct path *path, struct nfs4_state *state, int wait)
         calldata->res.seqid = calldata->arg.seqid;
         calldata->res.server = server;
         calldata->res.seq_res.sr_slotid = NFS4_MAX_SLOT_TABLE;
-        calldata->path.mnt = mntget(path->mnt);
-        calldata->path.dentry = dget(path->dentry);
+        path_get(path);
+        calldata->path = *path;
 
         msg.rpc_argp = &calldata->arg,
         msg.rpc_resp = &calldata->res,
@@ -1964,8 +2070,7 @@ nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags, st
                         case -EDQUOT:
                         case -ENOSPC:
                         case -EROFS:
-                                lookup_instantiate_filp(nd, (struct dentry *)state, NULL);
-                                return 1;
+                                return PTR_ERR(state);
                         default:
                                 goto out_drop;
                 }
@@ -1981,7 +2086,7 @@ out_drop:
         return 0;
 }
 
-void nfs4_close_context(struct nfs_open_context *ctx, int is_sync)
+static void nfs4_close_context(struct nfs_open_context *ctx, int is_sync)
 {
         if (ctx->state == NULL)
                 return;
@@ -2532,7 +2637,6 @@ static int nfs4_proc_unlink_done(struct rpc_task *task, struct inode *dir)
         nfs4_sequence_done(res->server, &res->seq_res, task->tk_status);
         if (nfs4_async_handle_error(task, res->server, NULL) == -EAGAIN)
                 return 0;
-        nfs4_sequence_free_slot(res->server->nfs_client, &res->seq_res);
         update_changeattr(dir, &res->cinfo);
         nfs_post_op_update_inode(dir, &res->dir_attr);
         return 1;
@@ -2971,11 +3075,10 @@ static int nfs4_read_done(struct rpc_task *task, struct nfs_read_data *data)
 
         dprintk("--> %s\n", __func__);
 
-        /* nfs4_sequence_free_slot called in the read rpc_call_done */
         nfs4_sequence_done(server, &data->res.seq_res, task->tk_status);
 
         if (nfs4_async_handle_error(task, server, data->args.context->state) == -EAGAIN) {
-                nfs4_restart_rpc(task, server->nfs_client);
+                nfs_restart_rpc(task, server->nfs_client);
                 return -EAGAIN;
         }
 
@@ -2995,12 +3098,11 @@ static int nfs4_write_done(struct rpc_task *task, struct nfs_write_data *data)
 {
         struct inode *inode = data->inode;
         
-        /* slot is freed in nfs_writeback_done */
         nfs4_sequence_done(NFS_SERVER(inode), &data->res.seq_res,
                            task->tk_status);
 
         if (nfs4_async_handle_error(task, NFS_SERVER(inode), data->args.context->state) == -EAGAIN) {
-                nfs4_restart_rpc(task, NFS_SERVER(inode)->nfs_client);
+                nfs_restart_rpc(task, NFS_SERVER(inode)->nfs_client);
                 return -EAGAIN;
         }
         if (task->tk_status >= 0) {
@@ -3028,11 +3130,9 @@ static int nfs4_commit_done(struct rpc_task *task, struct nfs_write_data *data)
         nfs4_sequence_done(NFS_SERVER(inode), &data->res.seq_res,
                            task->tk_status);
         if (nfs4_async_handle_error(task, NFS_SERVER(inode), NULL) == -EAGAIN) {
-                nfs4_restart_rpc(task, NFS_SERVER(inode)->nfs_client);
+                nfs_restart_rpc(task, NFS_SERVER(inode)->nfs_client);
                 return -EAGAIN;
         }
-        nfs4_sequence_free_slot(NFS_SERVER(inode)->nfs_client,
-                                &data->res.seq_res);
         nfs_refresh_inode(inode, data->res.fattr);
         return 0;
 }
@@ -3050,10 +3150,19 @@ static void nfs4_proc_commit_setup(struct nfs_write_data *data, struct rpc_messa
  * nfs4_proc_async_renew(): This is not one of the nfs_rpc_ops; it is a special
  * standalone procedure for queueing an asynchronous RENEW.
  */
+static void nfs4_renew_release(void *data)
+{
+        struct nfs_client *clp = data;
+
+        if (atomic_read(&clp->cl_count) > 1)
+                nfs4_schedule_state_renewal(clp);
+        nfs_put_client(clp);
+}
+
 static void nfs4_renew_done(struct rpc_task *task, void *data)
 {
-        struct nfs_client *clp = (struct nfs_client *)task->tk_msg.rpc_argp;
-        unsigned long timestamp = (unsigned long)data;
+        struct nfs_client *clp = data;
+        unsigned long timestamp = task->tk_start;
 
         if (task->tk_status < 0) {
                 /* Unless we're shutting down, schedule state recovery! */
@@ -3069,6 +3178,7 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
 
 static const struct rpc_call_ops nfs4_renew_ops = {
         .rpc_call_done = nfs4_renew_done,
+        .rpc_release = nfs4_renew_release,
 };
 
 int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
@@ -3079,8 +3189,10 @@ int nfs4_proc_async_renew(struct nfs_client *clp, struct rpc_cred *cred)
                 .rpc_cred       = cred,
         };
 
+        if (!atomic_inc_not_zero(&clp->cl_count))
+                return -EIO;
         return rpc_call_async(clp->cl_rpcclient, &msg, RPC_TASK_SOFT,
-                        &nfs4_renew_ops, (void *)jiffies);
+                        &nfs4_renew_ops, clp);
 }
 
 int nfs4_proc_renew(struct nfs_client *clp, struct rpc_cred *cred)
@@ -3331,15 +3443,14 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                         if (state == NULL)
                                 break;
                         nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                 case -NFS4ERR_STALE_STATEID:
+                        if (state == NULL)
+                                break;
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_EXPIRED:
-                        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
-                        nfs4_schedule_state_recovery(clp);
-                        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
-                                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
-                        task->tk_status = 0;
-                        return -EAGAIN;
+                        goto do_state_recovery;
 #if defined(CONFIG_NFS_V4_1)
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
@@ -3350,7 +3461,7 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                 case -NFS4ERR_SEQ_MISORDERED:
                         dprintk("%s ERROR %d, Reset session\n", __func__,
                                 task->tk_status);
-                        set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
+                        nfs4_schedule_state_recovery(clp);
                         task->tk_status = 0;
                         return -EAGAIN;
 #endif /* CONFIG_NFS_V4_1 */
@@ -3358,6 +3469,7 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                         if (server)
                                 nfs_inc_server_stats(server, NFSIOS_DELAY);
                 case -NFS4ERR_GRACE:
+                case -EKEYEXPIRED:
                         rpc_delay(task, NFS4_POLL_RETRY_MAX);
                         task->tk_status = 0;
                         return -EAGAIN;
@@ -3367,6 +3479,13 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
         }
         task->tk_status = nfs4_map_errors(task->tk_status);
         return 0;
+do_state_recovery:
+        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+        nfs4_schedule_state_recovery(clp);
+        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
+                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
+        task->tk_status = 0;
+        return -EAGAIN;
 }
 
 static int
@@ -3463,6 +3582,7 @@ int nfs4_proc_setclientid_confirm(struct nfs_client *clp, struct rpc_cred *cred)
                         case -NFS4ERR_RESOURCE:
                                 /* The IBM lawyers misread another document! */
                         case -NFS4ERR_DELAY:
+                        case -EKEYEXPIRED:
                                 err = nfs4_delay(clp->cl_rpcclient, &timeout);
                 }
         } while (err == 0);
@@ -3483,12 +3603,23 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_delegreturndata *data = calldata;
 
-        nfs4_sequence_done_free_slot(data->res.server, &data->res.seq_res,
-                                     task->tk_status);
+        nfs4_sequence_done(data->res.server, &data->res.seq_res,
+                        task->tk_status);
 
-        data->rpc_status = task->tk_status;
-        if (data->rpc_status == 0)
+        switch (task->tk_status) {
+        case -NFS4ERR_STALE_STATEID:
+        case -NFS4ERR_EXPIRED:
+        case 0:
                 renew_lease(data->res.server, data->timestamp);
+                break;
+        default:
+                if (nfs4_async_handle_error(task, data->res.server, NULL) ==
+                                -EAGAIN) {
+                        nfs_restart_rpc(task, data->res.server->nfs_client);
+                        return;
+                }
+        }
+        data->rpc_status = task->tk_status;
 }
 
 static void nfs4_delegreturn_release(void *calldata)
@@ -3741,11 +3872,9 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
                         break;
                 default:
                         if (nfs4_async_handle_error(task, calldata->server, NULL) == -EAGAIN)
-                                nfs4_restart_rpc(task,
-                                                calldata->server->nfs_client);
+                                nfs_restart_rpc(task,
+                                                 calldata->server->nfs_client);
         }
-        nfs4_sequence_free_slot(calldata->server->nfs_client,
-                                &calldata->res.seq_res);
 }
 
 static void nfs4_locku_prepare(struct rpc_task *task, void *data)
@@ -3921,14 +4050,20 @@ static void nfs4_lock_prepare(struct rpc_task *task, void *calldata)
         dprintk("%s: done!, ret = %d\n", __func__, data->rpc_status);
 }
 
+static void nfs4_recover_lock_prepare(struct rpc_task *task, void *calldata)
+{
+        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
+        nfs4_lock_prepare(task, calldata);
+}
+
 static void nfs4_lock_done(struct rpc_task *task, void *calldata)
 {
         struct nfs4_lockdata *data = calldata;
 
         dprintk("%s: begin!\n", __func__);
 
-        nfs4_sequence_done_free_slot(data->server, &data->res.seq_res,
-                                     task->tk_status);
+        nfs4_sequence_done(data->server, &data->res.seq_res,
+                        task->tk_status);
 
         data->rpc_status = task->tk_status;
         if (RPC_ASSASSINATED(task))
@@ -3976,7 +4111,35 @@ static const struct rpc_call_ops nfs4_lock_ops = {
         .rpc_release = nfs4_lock_release,
 };
 
-static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *fl, int reclaim)
+static const struct rpc_call_ops nfs4_recover_lock_ops = {
+        .rpc_call_prepare = nfs4_recover_lock_prepare,
+        .rpc_call_done = nfs4_lock_done,
+        .rpc_release = nfs4_lock_release,
+};
+
+static void nfs4_handle_setlk_error(struct nfs_server *server, struct nfs4_lock_state *lsp, int new_lock_owner, int error)
+{
+        struct nfs_client *clp = server->nfs_client;
+        struct nfs4_state *state = lsp->ls_state;
+
+        switch (error) {
+        case -NFS4ERR_ADMIN_REVOKED:
+        case -NFS4ERR_BAD_STATEID:
+        case -NFS4ERR_EXPIRED:
+                if (new_lock_owner != 0 ||
+                   (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_nograce(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+                break;
+        case -NFS4ERR_STALE_STATEID:
+                if (new_lock_owner != 0 ||
+                    (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+        };
+}
+
+static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *fl, int recovery_type)
 {
         struct nfs4_lockdata *data;
         struct rpc_task *task;
@@ -4000,8 +4163,11 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
                 return -ENOMEM;
         if (IS_SETLKW(cmd))
                 data->arg.block = 1;
-        if (reclaim != 0)
-                data->arg.reclaim = 1;
+        if (recovery_type > NFS_LOCK_NEW) {
+                if (recovery_type == NFS_LOCK_RECLAIM)
+                        data->arg.reclaim = NFS_LOCK_RECLAIM;
+                task_setup_data.callback_ops = &nfs4_recover_lock_ops;
+        }
         msg.rpc_argp = &data->arg,
         msg.rpc_resp = &data->res,
         task_setup_data.callback_data = data;
@@ -4011,6 +4177,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
         ret = nfs4_wait_for_completion_rpc_task(task);
         if (ret == 0) {
                 ret = data->rpc_status;
+                if (ret)
+                        nfs4_handle_setlk_error(data->server, data->lsp,
+                                        data->arg.new_lock_owner, ret);
         } else
                 data->cancelled = 1;
         rpc_put_task(task);
@@ -4028,8 +4197,8 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
                 /* Cache the lock if possible... */
                 if (test_bit(NFS_DELEGATED_STATE, &state->flags) != 0)
                         return 0;
-                err = _nfs4_do_setlk(state, F_SETLK, request, 1);
-                if (err != -NFS4ERR_DELAY)
+                err = _nfs4_do_setlk(state, F_SETLK, request, NFS_LOCK_RECLAIM);
+                if (err != -NFS4ERR_DELAY && err != -EKEYEXPIRED)
                         break;
                 nfs4_handle_exception(server, err, &exception);
         } while (exception.retry);
@@ -4048,11 +4217,18 @@ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request
         do {
                 if (test_bit(NFS_DELEGATED_STATE, &state->flags) != 0)
                         return 0;
-                err = _nfs4_do_setlk(state, F_SETLK, request, 0);
-                if (err != -NFS4ERR_DELAY)
-                        break;
-                nfs4_handle_exception(server, err, &exception);
+                err = _nfs4_do_setlk(state, F_SETLK, request, NFS_LOCK_EXPIRED);
+                switch (err) {
+                default:
+                        goto out;
+                case -NFS4ERR_GRACE:
+                case -NFS4ERR_DELAY:
+                case -EKEYEXPIRED:
+                        nfs4_handle_exception(server, err, &exception);
+                        err = 0;
+                }
         } while (exception.retry);
+out:
         return err;
 }
 
@@ -4060,8 +4236,11 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
 {
         struct nfs_inode *nfsi = NFS_I(state->inode);
         unsigned char fl_flags = request->fl_flags;
-        int status;
+        int status = -ENOLCK;
 
+        if ((fl_flags & FL_POSIX) &&
+                        !test_bit(NFS_STATE_POSIX_LOCKS, &state->flags))
+                goto out;
         /* Is this a delegated open? */
         status = nfs4_set_lock_state(state, request);
         if (status != 0)
@@ -4078,7 +4257,7 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
                 status = do_vfs_lock(request->fl_file, request);
                 goto out_unlock;
         }
-        status = _nfs4_do_setlk(state, cmd, request, 0);
+        status = _nfs4_do_setlk(state, cmd, request, NFS_LOCK_NEW);
         if (status != 0)
                 goto out_unlock;
         /* Note: we always want to sleep here! */
@@ -4161,7 +4340,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
         if (err != 0)
                 goto out;
         do {
-                err = _nfs4_do_setlk(state, F_SETLK, fl, 0);
+                err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
                 switch (err) {
                         default:
                                 printk(KERN_ERR "%s: unhandled error %d.\n",
@@ -4172,6 +4351,11 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                         case -NFS4ERR_EXPIRED:
                         case -NFS4ERR_STALE_CLIENTID:
                         case -NFS4ERR_STALE_STATEID:
+                        case -NFS4ERR_BADSESSION:
+                        case -NFS4ERR_BADSLOT:
+                        case -NFS4ERR_BAD_HIGH_SLOT:
+                        case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
+                        case -NFS4ERR_DEADSESSION:
                                 nfs4_schedule_state_recovery(server->nfs_client);
                                 goto out;
                         case -ERESTARTSYS:
@@ -4191,6 +4375,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                                 err = 0;
                                 goto out;
                         case -NFS4ERR_DELAY:
+                        case -EKEYEXPIRED:
                                 break;
                 }
                 err = nfs4_handle_exception(server, err, &exception);
@@ -4296,7 +4481,7 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
  * NFS4ERR_BADSESSION in the sequence operation, and will therefore
  * be in some phase of session reset.
  */
-static int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
+int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
 {
         nfs4_verifier verifier;
         struct nfs41_exchange_id_args args = {
@@ -4318,6 +4503,9 @@ static int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
         dprintk("--> %s\n", __func__);
         BUG_ON(clp == NULL);
 
+        /* Remove server-only flags */
+        args.flags &= ~EXCHGID4_FLAG_CONFIRMED_R;
+
         p = (u32 *)verifier.data;
         *p++ = htonl((u32)clp->cl_boot_time.tv_sec);
         *p = htonl((u32)clp->cl_boot_time.tv_nsec);
@@ -4333,7 +4521,7 @@ static int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
 
                 status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
 
-                if (status != NFS4ERR_CLID_INUSE)
+                if (status != -NFS4ERR_CLID_INUSE)
                         break;
 
                 if (signalled())
@@ -4361,11 +4549,12 @@ static void nfs4_get_lease_time_prepare(struct rpc_task *task,
                         (struct nfs4_get_lease_time_data *)calldata;
 
         dprintk("--> %s\n", __func__);
+        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
         /* just setup sequence, do not trigger session recovery
            since we're invoked within one */
         ret = nfs41_setup_sequence(data->clp->cl_session,
-                                        &data->args->la_seq_args,
-                                        &data->res->lr_seq_res, 0, task);
+                                   &data->args->la_seq_args,
+                                   &data->res->lr_seq_res, 0, task);
 
         BUG_ON(ret == -EAGAIN);
         rpc_call_start(task);
@@ -4386,13 +4575,13 @@ static void nfs4_get_lease_time_done(struct rpc_task *task, void *calldata)
         switch (task->tk_status) {
         case -NFS4ERR_DELAY:
         case -NFS4ERR_GRACE:
+        case -EKEYEXPIRED:
                 dprintk("%s Retry: tk_status %d\n", __func__, task->tk_status);
                 rpc_delay(task, NFS4_POLL_RETRY_MIN);
                 task->tk_status = 0;
-                nfs4_restart_rpc(task, data->clp);
+                nfs_restart_rpc(task, data->clp);
                 return;
         }
-        nfs41_sequence_free_slot(data->clp, &data->res->lr_seq_res);
         dprintk("<-- %s\n", __func__);
 }
 
@@ -4444,28 +4633,33 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
 /*
  * Reset a slot table
  */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, int max_slots,
-                int old_max_slots, int ivalue)
+static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
+                                 int ivalue)
 {
+        struct nfs4_slot *new = NULL;
         int i;
         int ret = 0;
 
-        dprintk("--> %s: max_reqs=%u, tbl %p\n", __func__, max_slots, tbl);
+        dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
+                max_reqs, tbl->max_slots);
 
-        /*
-         * Until we have dynamic slot table adjustment, insist
-         * upon the same slot table size
-         */
-        if (max_slots != old_max_slots) {
-                dprintk("%s reset slot table does't match old\n",
-                        __func__);
-                ret = -EINVAL; /*XXX NFS4ERR_REQ_TOO_BIG ? */
-                goto out;
+        /* Does the newly negotiated max_reqs match the existing slot table? */
+        if (max_reqs != tbl->max_slots) {
+                ret = -ENOMEM;
+                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
+                              GFP_KERNEL);
+                if (!new)
+                        goto out;
+                ret = 0;
+                kfree(tbl->slots);
         }
         spin_lock(&tbl->slot_tbl_lock);
-        for (i = 0; i < max_slots; ++i)
+        if (new) {
+                tbl->slots = new;
+                tbl->max_slots = max_reqs;
+        }
+        for (i = 0; i < tbl->max_slots; ++i)
                 tbl->slots[i].seq_nr = ivalue;
-        tbl->highest_used_slotid = -1;
         spin_unlock(&tbl->slot_tbl_lock);
         dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
                 tbl, tbl->slots, tbl->max_slots);
@@ -4482,16 +4676,12 @@ static int nfs4_reset_slot_tables(struct nfs4_session *session)
         int status;
 
         status = nfs4_reset_slot_table(&session->fc_slot_table,
-                        session->fc_attrs.max_reqs,
-                        session->fc_slot_table.max_slots,
-                        1);
+                        session->fc_attrs.max_reqs, 1);
         if (status)
                 return status;
 
         status = nfs4_reset_slot_table(&session->bc_slot_table,
-                        session->bc_attrs.max_reqs,
-                        session->bc_slot_table.max_slots,
-                        0);
+                        session->bc_attrs.max_reqs, 0);
         return status;
 }
 
@@ -4515,7 +4705,6 @@ static void nfs4_destroy_slot_tables(struct nfs4_session *session)
 static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
                 int max_slots, int ivalue)
 {
-        int i;
         struct nfs4_slot *slot;
         int ret = -ENOMEM;
 
@@ -4526,18 +4715,9 @@ static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
         slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_KERNEL);
         if (!slot)
                 goto out;
-        for (i = 0; i < max_slots; ++i)
-                slot[i].seq_nr = ivalue;
         ret = 0;
 
         spin_lock(&tbl->slot_tbl_lock);
-        if (tbl->slots != NULL) {
-                spin_unlock(&tbl->slot_tbl_lock);
-                dprintk("%s: slot table already initialized. tbl=%p slots=%p\n",
-                        __func__, tbl, tbl->slots);
-                WARN_ON(1);
-                goto out_free;
-        }
         tbl->max_slots = max_slots;
         tbl->slots = slot;
         tbl->highest_used_slotid = -1;  /* no slot is currently used */
@@ -4547,10 +4727,6 @@ static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
 out:
         dprintk("<-- %s: return %d\n", __func__, ret);
         return ret;
-
-out_free:
-        kfree(slot);
-        goto out;
 }
 
 /*
@@ -4558,17 +4734,24 @@ out_free:
  */
 static int nfs4_init_slot_tables(struct nfs4_session *session)
 {
-        int status;
+        struct nfs4_slot_table *tbl;
+        int status = 0;
 
-        status = nfs4_init_slot_table(&session->fc_slot_table,
-                        session->fc_attrs.max_reqs, 1);
-        if (status)
-                return status;
+        tbl = &session->fc_slot_table;
+        if (tbl->slots == NULL) {
+                status = nfs4_init_slot_table(tbl,
+                                session->fc_attrs.max_reqs, 1);
+                if (status)
+                        return status;
+        }
 
-        status = nfs4_init_slot_table(&session->bc_slot_table,
-                        session->bc_attrs.max_reqs, 0);
-        if (status)
-                nfs4_destroy_slot_tables(session);
+        tbl = &session->bc_slot_table;
+        if (tbl->slots == NULL) {
+                status = nfs4_init_slot_table(tbl,
+                                session->bc_attrs.max_reqs, 0);
+                if (status)
+                        nfs4_destroy_slot_tables(session);
+        }
 
         return status;
 }
@@ -4582,7 +4765,6 @@ struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp)
         if (!session)
                 return NULL;
 
-        set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
         /*
          * The create session reply races with the server back
          * channel probe. Mark the client NFS_CS_SESSION_INITING
@@ -4590,12 +4772,15 @@ struct nfs4_session *nfs4_alloc_session(struct nfs_client *clp)
          * nfs_client struct
          */
         clp->cl_cons_state = NFS_CS_SESSION_INITING;
+        init_completion(&session->complete);
 
         tbl = &session->fc_slot_table;
+        tbl->highest_used_slotid = -1;
         spin_lock_init(&tbl->slot_tbl_lock);
-        rpc_init_wait_queue(&tbl->slot_tbl_waitq, "ForeChannel Slot table");
+        rpc_init_priority_wait_queue(&tbl->slot_tbl_waitq, "ForeChannel Slot table");
 
         tbl = &session->bc_slot_table;
+        tbl->highest_used_slotid = -1;
         spin_lock_init(&tbl->slot_tbl_lock);
         rpc_init_wait_queue(&tbl->slot_tbl_waitq, "BackChannel Slot table");
 
@@ -4637,16 +4822,14 @@ static void nfs4_init_channel_attrs(struct nfs41_create_session_args *args)
         args->fc_attrs.headerpadsz = 0;
         args->fc_attrs.max_rqst_sz = mxrqst_sz;
         args->fc_attrs.max_resp_sz = mxresp_sz;
-        args->fc_attrs.max_resp_sz_cached = mxresp_sz;
         args->fc_attrs.max_ops = NFS4_MAX_OPS;
         args->fc_attrs.max_reqs = session->clp->cl_rpcclient->cl_xprt->max_reqs;
 
         dprintk("%s: Fore Channel : max_rqst_sz=%u max_resp_sz=%u "
-                "max_resp_sz_cached=%u max_ops=%u max_reqs=%u\n",
+                "max_ops=%u max_reqs=%u\n",
                 __func__,
                 args->fc_attrs.max_rqst_sz, args->fc_attrs.max_resp_sz,
-                args->fc_attrs.max_resp_sz_cached, args->fc_attrs.max_ops,
-                args->fc_attrs.max_reqs);
+                args->fc_attrs.max_ops, args->fc_attrs.max_reqs);
 
         /* Back channel attributes */
         args->bc_attrs.headerpadsz = 0;
@@ -4747,11 +4930,10 @@ static int _nfs4_proc_create_session(struct nfs_client *clp)
  * It is the responsibility of the caller to verify the session is
  * expired before calling this routine.
  */
-int nfs4_proc_create_session(struct nfs_client *clp, int reset)
+int nfs4_proc_create_session(struct nfs_client *clp)
 {
         int status;
         unsigned *ptr;
-        struct nfs_fsinfo fsinfo;
         struct nfs4_session *session = clp->cl_session;
 
         dprintk("--> %s clp=%p session=%p\n", __func__, clp, session);
@@ -4760,35 +4942,19 @@ int nfs4_proc_create_session(struct nfs_client *clp, int reset)
         if (status)
                 goto out;
 
-        /* Init or reset the fore channel */
-        if (reset)
-                status = nfs4_reset_slot_tables(session);
-        else
-                status = nfs4_init_slot_tables(session);
-        dprintk("fore channel slot table initialization returned %d\n", status);
+        /* Init and reset the fore channel */
+        status = nfs4_init_slot_tables(session);
+        dprintk("slot table initialization returned %d\n", status);
+        if (status)
+                goto out;
+        status = nfs4_reset_slot_tables(session);
+        dprintk("slot table reset returned %d\n", status);
         if (status)
                 goto out;
 
         ptr = (unsigned *)&session->sess_id.data[0];
         dprintk("%s client>seqid %d sessionid %u:%u:%u:%u\n", __func__,
                 clp->cl_seqid, ptr[0], ptr[1], ptr[2], ptr[3]);
-
-        if (reset)
-                /* Lease time is aleady set */
-                goto out;
-
-        /* Get the lease time */
-        status = nfs4_proc_get_lease_time(clp, &fsinfo);
-        if (status == 0) {
-                /* Update lease time and schedule renewal */
-                spin_lock(&clp->cl_lock);
-                clp->cl_lease_time = fsinfo.lease_time * HZ;
-                clp->cl_last_renewal = jiffies;
-                clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                spin_unlock(&clp->cl_lock);
-
-                nfs4_schedule_state_renewal(clp);
-        }
 out:
         dprintk("<-- %s\n", __func__);
         return status;
@@ -4827,13 +4993,24 @@ int nfs4_proc_destroy_session(struct nfs4_session *session)
 int nfs4_init_session(struct nfs_server *server)
 {
         struct nfs_client *clp = server->nfs_client;
+        struct nfs4_session *session;
+        unsigned int rsize, wsize;
         int ret;
 
         if (!nfs4_has_session(clp))
                 return 0;
 
-        clp->cl_session->fc_attrs.max_rqst_sz = server->wsize;
-        clp->cl_session->fc_attrs.max_resp_sz = server->rsize;
+        rsize = server->rsize;
+        if (rsize == 0)
+                rsize = NFS_MAX_FILE_IO_SIZE;
+        wsize = server->wsize;
+        if (wsize == 0)
+                wsize = NFS_MAX_FILE_IO_SIZE;
+
+        session = clp->cl_session;
+        session->fc_attrs.max_rqst_sz = wsize + nfs41_maxwrite_overhead;
+        session->fc_attrs.max_resp_sz = rsize + nfs41_maxread_overhead;
+
         ret = nfs4_recover_expired_lease(server);
         if (!ret)
                 ret = nfs4_check_client_ready(clp);
@@ -4858,10 +5035,19 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
         args.sa_cache_this = 0;
 
         return nfs4_call_sync_sequence(clp, clp->cl_rpcclient, &msg, &args,
-                                       &res, 0);
+                                       &res, args.sa_cache_this, 1);
+}
+
+static void nfs41_sequence_release(void *data)
+{
+        struct nfs_client *clp = (struct nfs_client *)data;
+
+        if (atomic_read(&clp->cl_count) > 1)
+                nfs4_schedule_state_renewal(clp);
+        nfs_put_client(clp);
 }
 
-void nfs41_sequence_call_done(struct rpc_task *task, void *data)
+static void nfs41_sequence_call_done(struct rpc_task *task, void *data)
 {
         struct nfs_client *clp = (struct nfs_client *)data;
 
@@ -4869,16 +5055,17 @@ void nfs41_sequence_call_done(struct rpc_task *task, void *data)
 
         if (task->tk_status < 0) {
                 dprintk("%s ERROR %d\n", __func__, task->tk_status);
+                if (atomic_read(&clp->cl_count) == 1)
+                        goto out;
 
                 if (_nfs4_async_handle_error(task, NULL, clp, NULL)
                                                                 == -EAGAIN) {
-                        nfs4_restart_rpc(task, clp);
+                        nfs_restart_rpc(task, clp);
                         return;
                 }
         }
-        nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp);
         dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
-
+out:
         kfree(task->tk_msg.rpc_argp);
         kfree(task->tk_msg.rpc_resp);
 
@@ -4903,6 +5090,7 @@ static void nfs41_sequence_prepare(struct rpc_task *task, void *data)
 static const struct rpc_call_ops nfs41_sequence_ops = {
         .rpc_call_done = nfs41_sequence_call_done,
         .rpc_call_prepare = nfs41_sequence_prepare,
+        .rpc_release = nfs41_sequence_release,
 };
 
 static int nfs41_proc_async_sequence(struct nfs_client *clp,
@@ -4915,12 +5103,14 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp,
                 .rpc_cred = cred,
         };
 
+        if (!atomic_inc_not_zero(&clp->cl_count))
+                return -EIO;
         args = kzalloc(sizeof(*args), GFP_KERNEL);
-        if (!args)
-                return -ENOMEM;
         res = kzalloc(sizeof(*res), GFP_KERNEL);
-        if (!res) {
+        if (!args || !res) {
                 kfree(args);
+                kfree(res);
+                nfs_put_client(clp);
                 return -ENOMEM;
         }
         res->sr_slotid = NFS4_MAX_SLOT_TABLE;
@@ -4931,6 +5121,113 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp,
                               &nfs41_sequence_ops, (void *)clp);
 }
 
+struct nfs4_reclaim_complete_data {
+        struct nfs_client *clp;
+        struct nfs41_reclaim_complete_args arg;
+        struct nfs41_reclaim_complete_res res;
+};
+
+static void nfs4_reclaim_complete_prepare(struct rpc_task *task, void *data)
+{
+        struct nfs4_reclaim_complete_data *calldata = data;
+
+        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
+        if (nfs4_setup_sequence(calldata->clp, &calldata->arg.seq_args,
+                                &calldata->res.seq_res, 0, task))
+                return;
+
+        rpc_call_start(task);
+}
+
+static void nfs4_reclaim_complete_done(struct rpc_task *task, void *data)
+{
+        struct nfs4_reclaim_complete_data *calldata = data;
+        struct nfs_client *clp = calldata->clp;
+        struct nfs4_sequence_res *res = &calldata->res.seq_res;
+
+        dprintk("--> %s\n", __func__);
+        nfs41_sequence_done(clp, res, task->tk_status);
+        switch (task->tk_status) {
+        case 0:
+        case -NFS4ERR_COMPLETE_ALREADY:
+                break;
+        case -NFS4ERR_BADSESSION:
+        case -NFS4ERR_DEADSESSION:
+                /*
+                 * Handle the session error, but do not retry the operation, as
+                 * we have no way of telling whether the clientid had to be
+                 * reset before we got our reply.  If reset, a new wave of
+                 * reclaim operations will follow, containing their own reclaim
+                 * complete.  We don't want our retry to get on the way of
+                 * recovery by incorrectly indicating to the server that we're
+                 * done reclaiming state since the process had to be restarted.
+                 */
+                _nfs4_async_handle_error(task, NULL, clp, NULL);
+                break;
+        default:
+                if (_nfs4_async_handle_error(
+                                task, NULL, clp, NULL) == -EAGAIN) {
+                        rpc_restart_call_prepare(task);
+                        return;
+                }
+        }
+
+        dprintk("<-- %s\n", __func__);
+}
+
+static void nfs4_free_reclaim_complete_data(void *data)
+{
+        struct nfs4_reclaim_complete_data *calldata = data;
+
+        kfree(calldata);
+}
+
+static const struct rpc_call_ops nfs4_reclaim_complete_call_ops = {
+        .rpc_call_prepare = nfs4_reclaim_complete_prepare,
+        .rpc_call_done = nfs4_reclaim_complete_done,
+        .rpc_release = nfs4_free_reclaim_complete_data,
+};
+
+/*
+ * Issue a global reclaim complete.
+ */
+static int nfs41_proc_reclaim_complete(struct nfs_client *clp)
+{
+        struct nfs4_reclaim_complete_data *calldata;
+        struct rpc_task *task;
+        struct rpc_message msg = {
+                .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_RECLAIM_COMPLETE],
+        };
+        struct rpc_task_setup task_setup_data = {
+                .rpc_client = clp->cl_rpcclient,
+                .rpc_message = &msg,
+                .callback_ops = &nfs4_reclaim_complete_call_ops,
+                .flags = RPC_TASK_ASYNC,
+        };
+        int status = -ENOMEM;
+
+        dprintk("--> %s\n", __func__);
+        calldata = kzalloc(sizeof(*calldata), GFP_KERNEL);
+        if (calldata == NULL)
+                goto out;
+        calldata->clp = clp;
+        calldata->arg.one_fs = 0;
+        calldata->res.seq_res.sr_slotid = NFS4_MAX_SLOT_TABLE;
+
+        msg.rpc_argp = &calldata->arg;
+        msg.rpc_resp = &calldata->res;
+        task_setup_data.callback_data = calldata;
+        task = rpc_run_task(&task_setup_data);
+        if (IS_ERR(task)) {
+                status = PTR_ERR(task);
+                goto out;
+        }
+        rpc_put_task(task);
+        return 0;
+out:
+        dprintk("<-- %s status=%d\n", __func__, status);
+        return status;
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 struct nfs4_state_recovery_ops nfs40_reboot_recovery_ops = {
@@ -4948,8 +5245,9 @@ struct nfs4_state_recovery_ops nfs41_reboot_recovery_ops = {
         .state_flag_bit = NFS_STATE_RECLAIM_REBOOT,
         .recover_open   = nfs4_open_reclaim,
         .recover_lock   = nfs4_lock_reclaim,
-        .establish_clid = nfs4_proc_exchange_id,
+        .establish_clid = nfs41_init_clientid,
         .get_clid_cred  = nfs4_get_exchange_id_cred,
+        .reclaim_complete = nfs41_proc_reclaim_complete,
 };
 #endif /* CONFIG_NFS_V4_1 */
 
@@ -4968,7 +5266,7 @@ struct nfs4_state_recovery_ops nfs41_nograce_recovery_ops = {
         .state_flag_bit = NFS_STATE_RECLAIM_NOGRACE,
         .recover_open   = nfs4_open_expired,
         .recover_lock   = nfs4_lock_expired,
-        .establish_clid = nfs4_proc_exchange_id,
+        .establish_clid = nfs41_init_clientid,
         .get_clid_cred  = nfs4_get_exchange_id_cred,
 };
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index 0156c01c212c..d87f10327b72 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -36,11 +36,6 @@
  * as an rpc_task, not a real kernel thread, so it always runs in rpciod's
  * context.  There is one renewd per nfs_server.
  *
- * TODO: If the send queue gets backlogged (e.g., if the server goes down),
- * we will keep filling the queue with periodic RENEW requests.  We need a
- * mechanism for ensuring that if renewd successfully sends off a request,
- * then it only wakes up when the request is finished.  Maybe use the
- * child task framework of the RPC layer?
  */
 
 #include <linux/mm.h>
@@ -63,7 +58,7 @@ nfs4_renew_state(struct work_struct *work)
         struct nfs_client *clp =
                 container_of(work, struct nfs_client, cl_renewd.work);
         struct rpc_cred *cred;
-        long lease, timeout;
+        long lease;
         unsigned long last, now;
 
         ops = nfs4_state_renewal_ops[clp->cl_minorversion];
@@ -75,7 +70,6 @@ nfs4_renew_state(struct work_struct *work)
         lease = clp->cl_lease_time;
         last = clp->cl_last_renewal;
         now = jiffies;
-        timeout = (2 * lease) / 3 + (long)last - (long)now;
         /* Are we close to a lease timeout? */
         if (time_after(now, last + lease/3)) {
                 cred = ops->get_state_renewal_cred_locked(clp);
@@ -90,19 +84,15 @@ nfs4_renew_state(struct work_struct *work)
                         /* Queue an asynchronous RENEW. */
                         ops->sched_state_renewal(clp, cred);
                         put_rpccred(cred);
+                        goto out_exp;
                 }
-                timeout = (2 * lease) / 3;
-                spin_lock(&clp->cl_lock);
-        } else
+        } else {
                 dprintk("%s: failed to call renewd. Reason: lease not expired \n",
                                 __func__);
-        if (timeout < 5 * HZ)    /* safeguard */
-                timeout = 5 * HZ;
-        dprintk("%s: requeueing work. Lease period = %ld\n",
-                        __func__, (timeout + HZ - 1) / HZ);
-        cancel_delayed_work(&clp->cl_renewd);
-        schedule_delayed_work(&clp->cl_renewd, timeout);
-        spin_unlock(&clp->cl_lock);
+                spin_unlock(&clp->cl_lock);
+        }
+        nfs4_schedule_state_renewal(clp);
+out_exp:
         nfs_expire_unreferenced_delegations(clp);
 out:
         dprintk("%s: done\n", __func__);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 2ef4fecf3984..6c5ed51f105e 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -116,6 +116,79 @@ struct rpc_cred *nfs4_get_renew_cred_locked(struct nfs_client *clp)
 
 #if defined(CONFIG_NFS_V4_1)
 
+static int nfs41_setup_state_renewal(struct nfs_client *clp)
+{
+        int status;
+        struct nfs_fsinfo fsinfo;
+
+        status = nfs4_proc_get_lease_time(clp, &fsinfo);
+        if (status == 0) {
+                /* Update lease time and schedule renewal */
+                spin_lock(&clp->cl_lock);
+                clp->cl_lease_time = fsinfo.lease_time * HZ;
+                clp->cl_last_renewal = jiffies;
+                spin_unlock(&clp->cl_lock);
+
+                nfs4_schedule_state_renewal(clp);
+        }
+
+        return status;
+}
+
+static void nfs4_end_drain_session(struct nfs_client *clp)
+{
+        struct nfs4_session *ses = clp->cl_session;
+        int max_slots;
+
+        if (test_and_clear_bit(NFS4CLNT_SESSION_DRAINING, &clp->cl_state)) {
+                spin_lock(&ses->fc_slot_table.slot_tbl_lock);
+                max_slots = ses->fc_slot_table.max_slots;
+                while (max_slots--) {
+                        struct rpc_task *task;
+
+                        task = rpc_wake_up_next(&ses->fc_slot_table.
+                                                slot_tbl_waitq);
+                        if (!task)
+                                break;
+                        rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
+                }
+                spin_unlock(&ses->fc_slot_table.slot_tbl_lock);
+        }
+}
+
+static int nfs4_begin_drain_session(struct nfs_client *clp)
+{
+        struct nfs4_session *ses = clp->cl_session;
+        struct nfs4_slot_table *tbl = &ses->fc_slot_table;
+
+        spin_lock(&tbl->slot_tbl_lock);
+        set_bit(NFS4CLNT_SESSION_DRAINING, &clp->cl_state);
+        if (tbl->highest_used_slotid != -1) {
+                INIT_COMPLETION(ses->complete);
+                spin_unlock(&tbl->slot_tbl_lock);
+                return wait_for_completion_interruptible(&ses->complete);
+        }
+        spin_unlock(&tbl->slot_tbl_lock);
+        return 0;
+}
+
+int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
+{
+        int status;
+
+        nfs4_begin_drain_session(clp);
+        status = nfs4_proc_exchange_id(clp, cred);
+        if (status != 0)
+                goto out;
+        status = nfs4_proc_create_session(clp);
+        if (status != 0)
+                goto out;
+        nfs41_setup_state_renewal(clp);
+        nfs_mark_client_ready(clp, NFS_CS_READY);
+out:
+        return status;
+}
+
 struct rpc_cred *nfs4_get_exchange_id_cred(struct nfs_client *clp)
 {
         struct rpc_cred *cred;
@@ -693,16 +766,21 @@ struct nfs_seqid *nfs_alloc_seqid(struct nfs_seqid_counter *counter)
         return new;
 }
 
-void nfs_free_seqid(struct nfs_seqid *seqid)
+void nfs_release_seqid(struct nfs_seqid *seqid)
 {
         if (!list_empty(&seqid->list)) {
                 struct rpc_sequence *sequence = seqid->sequence->sequence;
 
                 spin_lock(&sequence->lock);
-                list_del(&seqid->list);
+                list_del_init(&seqid->list);
                 spin_unlock(&sequence->lock);
                 rpc_wake_up(&sequence->wait);
         }
+}
+
+void nfs_free_seqid(struct nfs_seqid *seqid)
+{
+        nfs_release_seqid(seqid);
         kfree(seqid);
 }
 
@@ -823,7 +901,7 @@ void nfs4_schedule_state_recovery(struct nfs_client *clp)
         nfs4_schedule_state_manager(clp);
 }
 
-static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
+int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
 
         set_bit(NFS_STATE_RECLAIM_REBOOT, &state->flags);
@@ -877,6 +955,10 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_
                         case -NFS4ERR_EXPIRED:
                         case -NFS4ERR_NO_GRACE:
                         case -NFS4ERR_STALE_CLIENTID:
+                        case -NFS4ERR_BADSESSION:
+                        case -NFS4ERR_BADSLOT:
+                        case -NFS4ERR_BAD_HIGH_SLOT:
+                        case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
                                 goto out;
                         default:
                                 printk(KERN_ERR "%s: unhandled error %d. Zeroing state\n",
@@ -959,6 +1041,10 @@ restart:
                         case -NFS4ERR_NO_GRACE:
                                 nfs4_state_mark_reclaim_nograce(sp->so_client, state);
                         case -NFS4ERR_STALE_CLIENTID:
+                        case -NFS4ERR_BADSESSION:
+                        case -NFS4ERR_BADSLOT:
+                        case -NFS4ERR_BAD_HIGH_SLOT:
+                        case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
                                 goto out_err;
                 }
                 nfs4_put_open_state(state);
@@ -1011,6 +1097,14 @@ static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp)
         nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_reboot);
 }
 
+static void nfs4_reclaim_complete(struct nfs_client *clp,
+                                 const struct nfs4_state_recovery_ops *ops)
+{
+        /* Notify the server we're done reclaiming our state */
+        if (ops->reclaim_complete)
+                (void)ops->reclaim_complete(clp);
+}
+
 static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp)
 {
         struct nfs4_state_owner *sp;
@@ -1020,6 +1114,9 @@ static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp)
         if (!test_and_clear_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
                 return;
 
+        nfs4_reclaim_complete(clp,
+                nfs4_reboot_recovery_ops[clp->cl_minorversion]);
+
         for (pos = rb_first(&clp->cl_state_owners); pos != NULL; pos = rb_next(pos)) {
                 sp = rb_entry(pos, struct nfs4_state_owner, so_client_node);
                 spin_lock(&sp->so_lock);
@@ -1046,25 +1143,25 @@ static void nfs4_state_start_reclaim_nograce(struct nfs_client *clp)
         nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_nograce);
 }
 
-static void nfs4_state_end_reclaim_nograce(struct nfs_client *clp)
-{
-        clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state);
-}
-
-static void nfs4_recovery_handle_error(struct nfs_client *clp, int error)
+static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
 {
         switch (error) {
                 case -NFS4ERR_CB_PATH_DOWN:
                         nfs_handle_cb_pathdown(clp);
-                        break;
+                        return 0;
+                case -NFS4ERR_NO_GRACE:
+                        nfs4_state_end_reclaim_reboot(clp);
+                        return 0;
                 case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_LEASE_MOVED:
                         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
+                        nfs4_state_end_reclaim_reboot(clp);
                         nfs4_state_start_reclaim_reboot(clp);
                         break;
                 case -NFS4ERR_EXPIRED:
                         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
                         nfs4_state_start_reclaim_nograce(clp);
+                        break;
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
                 case -NFS4ERR_BAD_HIGH_SLOT:
@@ -1072,8 +1169,11 @@ static void nfs4_recovery_handle_error(struct nfs_client *clp, int error)
                 case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
                 case -NFS4ERR_SEQ_FALSE_RETRY:
                 case -NFS4ERR_SEQ_MISORDERED:
-                        set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
+                        set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+                        /* Zero session reset errors */
+                        return 0;
         }
+        return error;
 }
 
 static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recovery_ops *ops)
@@ -1093,8 +1193,7 @@ restart:
                 if (status < 0) {
                         set_bit(ops->owner_flag_bit, &sp->so_flags);
                         nfs4_put_state_owner(sp);
-                        nfs4_recovery_handle_error(clp, status);
-                        return status;
+                        return nfs4_recovery_handle_error(clp, status);
                 }
                 nfs4_put_state_owner(sp);
                 goto restart;
@@ -1124,8 +1223,7 @@ static int nfs4_check_lease(struct nfs_client *clp)
         status = ops->renew_lease(clp, cred);
         put_rpccred(cred);
 out:
-        nfs4_recovery_handle_error(clp, status);
-        return status;
+        return nfs4_recovery_handle_error(clp, status);
 }
 
 static int nfs4_reclaim_lease(struct nfs_client *clp)
@@ -1151,55 +1249,127 @@ static int nfs4_reclaim_lease(struct nfs_client *clp)
 }
 
 #ifdef CONFIG_NFS_V4_1
-static void nfs4_session_recovery_handle_error(struct nfs_client *clp, int err)
+void nfs41_handle_recall_slot(struct nfs_client *clp)
 {
-        switch (err) {
-        case -NFS4ERR_STALE_CLIENTID:
-                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
+        set_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+        nfs4_schedule_state_recovery(clp);
+}
+
+static void nfs4_reset_all_state(struct nfs_client *clp)
+{
+        if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
+                clp->cl_boot_time = CURRENT_TIME;
+                nfs4_state_start_reclaim_nograce(clp);
+                nfs4_schedule_state_recovery(clp);
         }
 }
 
+static void nfs41_handle_server_reboot(struct nfs_client *clp)
+{
+        if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
+                nfs4_state_start_reclaim_reboot(clp);
+                nfs4_schedule_state_recovery(clp);
+        }
+}
+
+static void nfs41_handle_state_revoked(struct nfs_client *clp)
+{
+        /* Temporary */
+        nfs4_reset_all_state(clp);
+}
+
+static void nfs41_handle_recallable_state_revoked(struct nfs_client *clp)
+{
+        /* This will need to handle layouts too */
+        nfs_expire_all_delegations(clp);
+}
+
+static void nfs41_handle_cb_path_down(struct nfs_client *clp)
+{
+        nfs_expire_all_delegations(clp);
+        if (test_and_set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) == 0)
+                nfs4_schedule_state_recovery(clp);
+}
+
+void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
+{
+        if (!flags)
+                return;
+        else if (flags & SEQ4_STATUS_RESTART_RECLAIM_NEEDED)
+                nfs41_handle_server_reboot(clp);
+        else if (flags & (SEQ4_STATUS_EXPIRED_ALL_STATE_REVOKED |
+                            SEQ4_STATUS_EXPIRED_SOME_STATE_REVOKED |
+                            SEQ4_STATUS_ADMIN_STATE_REVOKED |
+                            SEQ4_STATUS_LEASE_MOVED))
+                nfs41_handle_state_revoked(clp);
+        else if (flags & SEQ4_STATUS_RECALLABLE_STATE_REVOKED)
+                nfs41_handle_recallable_state_revoked(clp);
+        else if (flags & (SEQ4_STATUS_CB_PATH_DOWN |
+                            SEQ4_STATUS_BACKCHANNEL_FAULT |
+                            SEQ4_STATUS_CB_PATH_DOWN_SESSION))
+                nfs41_handle_cb_path_down(clp);
+}
+
 static int nfs4_reset_session(struct nfs_client *clp)
 {
         int status;
 
+        nfs4_begin_drain_session(clp);
         status = nfs4_proc_destroy_session(clp->cl_session);
         if (status && status != -NFS4ERR_BADSESSION &&
             status != -NFS4ERR_DEADSESSION) {
-                nfs4_session_recovery_handle_error(clp, status);
+                status = nfs4_recovery_handle_error(clp, status);
                 goto out;
         }
 
         memset(clp->cl_session->sess_id.data, 0, NFS4_MAX_SESSIONID_LEN);
-        status = nfs4_proc_create_session(clp, 1);
-        if (status)
-                nfs4_session_recovery_handle_error(clp, status);
-                /* fall through*/
+        status = nfs4_proc_create_session(clp);
+        if (status) {
+                status = nfs4_recovery_handle_error(clp, status);
+                goto out;
+        }
+        /* create_session negotiated new slot table */
+        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+
+         /* Let the state manager reestablish state */
+        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
+                nfs41_setup_state_renewal(clp);
 out:
-        /* Wake up the next rpc task even on error */
-        rpc_wake_up_next(&clp->cl_session->fc_slot_table.slot_tbl_waitq);
         return status;
 }
 
-static int nfs4_initialize_session(struct nfs_client *clp)
+static int nfs4_recall_slot(struct nfs_client *clp)
 {
-        int status;
+        struct nfs4_slot_table *fc_tbl = &clp->cl_session->fc_slot_table;
+        struct nfs4_channel_attrs *fc_attrs = &clp->cl_session->fc_attrs;
+        struct nfs4_slot *new, *old;
+        int i;
+
+        nfs4_begin_drain_session(clp);
+        new = kmalloc(fc_tbl->target_max_slots * sizeof(struct nfs4_slot),
+                      GFP_KERNEL);
+        if (!new)
+                return -ENOMEM;
 
-        status = nfs4_proc_create_session(clp, 0);
-        if (!status) {
-                nfs_mark_client_ready(clp, NFS_CS_READY);
-        } else if (status == -NFS4ERR_STALE_CLIENTID) {
-                set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
-                set_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state);
-        } else {
-                nfs_mark_client_ready(clp, status);
-        }
-        return status;
+        spin_lock(&fc_tbl->slot_tbl_lock);
+        for (i = 0; i < fc_tbl->target_max_slots; i++)
+                new[i].seq_nr = fc_tbl->slots[i].seq_nr;
+        old = fc_tbl->slots;
+        fc_tbl->slots = new;
+        fc_tbl->max_slots = fc_tbl->target_max_slots;
+        fc_tbl->target_max_slots = 0;
+        fc_attrs->max_reqs = fc_tbl->max_slots;
+        spin_unlock(&fc_tbl->slot_tbl_lock);
+
+        kfree(old);
+        nfs4_end_drain_session(clp);
+        return 0;
 }
+
 #else /* CONFIG_NFS_V4_1 */
 static int nfs4_reset_session(struct nfs_client *clp) { return 0; }
-static int nfs4_initialize_session(struct nfs_client *clp) { return 0; }
+static int nfs4_end_drain_session(struct nfs_client *clp) { return 0; }
+static int nfs4_recall_slot(struct nfs_client *clp) { return 0; }
 #endif /* CONFIG_NFS_V4_1 */
 
 /* Set NFS4CLNT_LEASE_EXPIRED for all v4.0 errors and for recoverable errors
@@ -1212,6 +1382,7 @@ static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
                 case -NFS4ERR_DELAY:
                 case -NFS4ERR_CLID_INUSE:
                 case -EAGAIN:
+                case -EKEYEXPIRED:
                         break;
 
                 case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
@@ -1234,7 +1405,8 @@ static void nfs4_state_manager(struct nfs_client *clp)
                         status = nfs4_reclaim_lease(clp);
                         if (status) {
                                 nfs4_set_lease_expired(clp, status);
-                                if (status == -EAGAIN)
+                                if (test_bit(NFS4CLNT_LEASE_EXPIRED,
+                                                        &clp->cl_state))
                                         continue;
                                 if (clp->cl_cons_state ==
                                                         NFS_CS_SESSION_INITING)
@@ -1242,61 +1414,67 @@ static void nfs4_state_manager(struct nfs_client *clp)
                                 goto out_error;
                         }
                         clear_bit(NFS4CLNT_CHECK_LEASE, &clp->cl_state);
+                        set_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state);
                 }
 
                 if (test_and_clear_bit(NFS4CLNT_CHECK_LEASE, &clp->cl_state)) {
                         status = nfs4_check_lease(clp);
-                        if (status != 0)
+                        if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
                                 continue;
+                        if (status < 0 && status != -NFS4ERR_CB_PATH_DOWN)
+                                goto out_error;
                 }
+
                 /* Initialize or reset the session */
-                if (test_and_clear_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state)
+                if (test_and_clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state)
                    && nfs4_has_session(clp)) {
-                        if (clp->cl_cons_state == NFS_CS_SESSION_INITING)
-                                status = nfs4_initialize_session(clp);
-                        else
-                                status = nfs4_reset_session(clp);
-                        if (status) {
-                                if (status == -NFS4ERR_STALE_CLIENTID)
-                                        continue;
+                        status = nfs4_reset_session(clp);
+                        if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
+                                continue;
+                        if (status < 0)
                                 goto out_error;
-                        }
                 }
+
                 /* First recover reboot state... */
-                if (test_and_clear_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) {
+                if (test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) {
                         status = nfs4_do_reclaim(clp,
                                 nfs4_reboot_recovery_ops[clp->cl_minorversion]);
-                        if (status == -NFS4ERR_STALE_CLIENTID)
-                                continue;
-                        if (test_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state))
+                        if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
+                            test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
                                 continue;
                         nfs4_state_end_reclaim_reboot(clp);
-                        continue;
+                        if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state))
+                                continue;
+                        if (status < 0)
+                                goto out_error;
                 }
 
                 /* Now recover expired state... */
                 if (test_and_clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) {
                         status = nfs4_do_reclaim(clp,
                                 nfs4_nograce_recovery_ops[clp->cl_minorversion]);
-                        if (status < 0) {
-                                set_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state);
-                                if (status == -NFS4ERR_STALE_CLIENTID)
-                                        continue;
-                                if (status == -NFS4ERR_EXPIRED)
-                                        continue;
-                                if (test_bit(NFS4CLNT_SESSION_SETUP,
-                                                                &clp->cl_state))
-                                        continue;
+                        if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
+                            test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) ||
+                            test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
+                                continue;
+                        if (status < 0)
                                 goto out_error;
-                        } else
-                                nfs4_state_end_reclaim_nograce(clp);
-                        continue;
                 }
 
+                nfs4_end_drain_session(clp);
                 if (test_and_clear_bit(NFS4CLNT_DELEGRETURN, &clp->cl_state)) {
                         nfs_client_return_marked_delegations(clp);
                         continue;
                 }
+                /* Recall session slots */
+                if (test_and_clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state)
+                   && nfs4_has_session(clp)) {
+                        status = nfs4_recall_slot(clp);
+                        if (status < 0)
+                                goto out_error;
+                        continue;
+                }
+
 
                 nfs4_clear_state_manager_bit(clp);
                 /* Did we race with an attempt to give us more work? */
@@ -1309,8 +1487,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
 out_error:
         printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
                         " with error %d\n", clp->cl_hostname, -status);
-        if (test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
-                nfs4_state_end_reclaim_reboot(clp);
+        nfs4_end_drain_session(clp);
         nfs4_clear_state_manager_bit(clp);
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 20b4e30e6c82..38f3b582e7c2 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -38,7 +38,6 @@
 #include <linux/param.h>
 #include <linux/time.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/in.h>
@@ -46,11 +45,13 @@
 #include <linux/proc_fs.h>
 #include <linux/kdev_t.h>
 #include <linux/sunrpc/clnt.h>
+#include <linux/sunrpc/msg_prot.h>
 #include <linux/nfs.h>
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_idmap.h>
 #include "nfs4_fs.h"
+#include "internal.h"
 
 #define NFSDBG_FACILITY         NFSDBG_XDR
 
@@ -134,7 +135,7 @@ static int nfs4_stat_to_errno(int);
 #define decode_lookup_maxsz     (op_decode_hdr_maxsz)
 #define encode_share_access_maxsz \
                                 (2)
-#define encode_createmode_maxsz (1 + encode_attrs_maxsz)
+#define encode_createmode_maxsz (1 + encode_attrs_maxsz + encode_verifier_maxsz)
 #define encode_opentype_maxsz   (1 + encode_createmode_maxsz)
 #define encode_claim_null_maxsz (1 + nfs4_name_maxsz)
 #define encode_open_maxsz       (op_encode_hdr_maxsz + \
@@ -299,6 +300,8 @@ static int nfs4_stat_to_errno(int);
                                 XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + 4)
 #define decode_sequence_maxsz   (op_decode_hdr_maxsz + \
                                 XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + 5)
+#define encode_reclaim_complete_maxsz   (op_encode_hdr_maxsz + 4)
+#define decode_reclaim_complete_maxsz   (op_decode_hdr_maxsz + 4)
 #else /* CONFIG_NFS_V4_1 */
 #define encode_sequence_maxsz   0
 #define decode_sequence_maxsz   0
@@ -676,6 +679,25 @@ static int nfs4_stat_to_errno(int);
                                          decode_sequence_maxsz + \
                                          decode_putrootfh_maxsz + \
                                          decode_fsinfo_maxsz)
+#define NFS4_enc_reclaim_complete_sz    (compound_encode_hdr_maxsz + \
+                                         encode_sequence_maxsz + \
+                                         encode_reclaim_complete_maxsz)
+#define NFS4_dec_reclaim_complete_sz    (compound_decode_hdr_maxsz + \
+                                         decode_sequence_maxsz + \
+                                         decode_reclaim_complete_maxsz)
+
+const u32 nfs41_maxwrite_overhead = ((RPC_MAX_HEADER_WITH_AUTH +
+                                      compound_encode_hdr_maxsz +
+                                      encode_sequence_maxsz +
+                                      encode_putfh_maxsz +
+                                      encode_getattr_maxsz) *
+                                     XDR_UNIT);
+
+const u32 nfs41_maxread_overhead = ((RPC_MAX_HEADER_WITH_AUTH +
+                                     compound_decode_hdr_maxsz +
+                                     decode_sequence_maxsz +
+                                     decode_putfh_maxsz) *
+                                    XDR_UNIT);
 #endif /* CONFIG_NFS_V4_1 */
 
 static const umode_t nfs_type2fmt[] = {
@@ -1140,6 +1162,7 @@ static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_opena
 static inline void encode_createmode(struct xdr_stream *xdr, const struct nfs_openargs *arg)
 {
         __be32 *p;
+        struct nfs_client *clp;
 
         p = reserve_space(xdr, 4);
         switch(arg->open_flags & O_EXCL) {
@@ -1148,8 +1171,23 @@ static inline void encode_createmode(struct xdr_stream *xdr, const struct nfs_op
                 encode_attrs(xdr, arg->u.attrs, arg->server);
                 break;
         default:
-                *p = cpu_to_be32(NFS4_CREATE_EXCLUSIVE);
-                encode_nfs4_verifier(xdr, &arg->u.verifier);
+                clp = arg->server->nfs_client;
+                if (clp->cl_minorversion > 0) {
+                        if (nfs4_has_persistent_session(clp)) {
+                                *p = cpu_to_be32(NFS4_CREATE_GUARDED);
+                                encode_attrs(xdr, arg->u.attrs, arg->server);
+                        } else {
+                                struct iattr dummy;
+
+                                *p = cpu_to_be32(NFS4_CREATE_EXCLUSIVE4_1);
+                                encode_nfs4_verifier(xdr, &arg->u.verifier);
+                                dummy.ia_valid = 0;
+                                encode_attrs(xdr, &dummy, arg->server);
+                        }
+                } else {
+                        *p = cpu_to_be32(NFS4_CREATE_EXCLUSIVE);
+                        encode_nfs4_verifier(xdr, &arg->u.verifier);
+                }
         }
 }
 
@@ -1539,6 +1577,14 @@ static void encode_create_session(struct xdr_stream *xdr,
         char machine_name[NFS4_MAX_MACHINE_NAME_LEN];
         uint32_t len;
         struct nfs_client *clp = args->client;
+        u32 max_resp_sz_cached;
+
+        /*
+         * Assumes OPEN is the biggest non-idempotent compound.
+         * 2 is the verifier.
+         */
+        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE +
+                              RPC_MAX_AUTH_SIZE + 2) * XDR_UNIT;
 
         len = scnprintf(machine_name, sizeof(machine_name), "%s",
                         clp->cl_ipaddr);
@@ -1553,7 +1599,7 @@ static void encode_create_session(struct xdr_stream *xdr,
         *p++ = cpu_to_be32(args->fc_attrs.headerpadsz); /* header padding size */
         *p++ = cpu_to_be32(args->fc_attrs.max_rqst_sz); /* max req size */
         *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz); /* max resp size */
-        *p++ = cpu_to_be32(args->fc_attrs.max_resp_sz_cached);  /* Max resp sz cached */
+        *p++ = cpu_to_be32(max_resp_sz_cached);         /* Max resp sz cached */
         *p++ = cpu_to_be32(args->fc_attrs.max_ops);     /* max operations */
         *p++ = cpu_to_be32(args->fc_attrs.max_reqs);    /* max requests */
         *p++ = cpu_to_be32(0);                          /* rdmachannel_attrs */
@@ -1592,6 +1638,19 @@ static void encode_destroy_session(struct xdr_stream *xdr,
         hdr->nops++;
         hdr->replen += decode_destroy_session_maxsz;
 }
+
+static void encode_reclaim_complete(struct xdr_stream *xdr,
+                                    struct nfs41_reclaim_complete_args *args,
+                                    struct compound_hdr *hdr)
+{
+        __be32 *p;
+
+        p = reserve_space(xdr, 8);
+        *p++ = cpu_to_be32(OP_RECLAIM_COMPLETE);
+        *p++ = cpu_to_be32(args->one_fs);
+        hdr->nops++;
+        hdr->replen += decode_reclaim_complete_maxsz;
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 static void encode_sequence(struct xdr_stream *xdr,
@@ -2096,7 +2155,7 @@ nfs4_xdr_enc_getacl(struct rpc_rqst *req, __be32 *p,
         encode_compound_hdr(&xdr, req, &hdr);
         encode_sequence(&xdr, &args->seq_args, &hdr);
         encode_putfh(&xdr, args->fh, &hdr);
-        replen = hdr.replen + nfs4_fattr_bitmap_maxsz + 1;
+        replen = hdr.replen + op_decode_hdr_maxsz + nfs4_fattr_bitmap_maxsz + 1;
         encode_getattr_two(&xdr, FATTR4_WORD0_ACL, 0, &hdr);
 
         xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
@@ -2420,6 +2479,26 @@ static int nfs4_xdr_enc_get_lease_time(struct rpc_rqst *req, uint32_t *p,
         encode_nops(&hdr);
         return 0;
 }
+
+/*
+ * a RECLAIM_COMPLETE request
+ */
+static int nfs4_xdr_enc_reclaim_complete(struct rpc_rqst *req, uint32_t *p,
+                                     struct nfs41_reclaim_complete_args *args)
+{
+        struct xdr_stream xdr;
+        struct compound_hdr hdr = {
+                .minorversion = nfs4_xdr_minorversion(&args->seq_args)
+        };
+
+        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
+        encode_compound_hdr(&xdr, req, &hdr);
+        encode_sequence(&xdr, &args->seq_args, &hdr);
+        encode_reclaim_complete(&xdr, args, &hdr);
+        encode_nops(&hdr);
+        return 0;
+}
+
 #endif /* CONFIG_NFS_V4_1 */
 
 static void print_overflow_msg(const char *func, const struct xdr_stream *xdr)
@@ -4528,6 +4607,11 @@ static int decode_destroy_session(struct xdr_stream *xdr, void *dummy)
 {
         return decode_op_hdr(xdr, OP_DESTROY_SESSION);
 }
+
+static int decode_reclaim_complete(struct xdr_stream *xdr, void *dummy)
+{
+        return decode_op_hdr(xdr, OP_RECLAIM_COMPLETE);
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 static int decode_sequence(struct xdr_stream *xdr,
@@ -4554,7 +4638,7 @@ static int decode_sequence(struct xdr_stream *xdr,
          * If the server returns different values for sessionID, slotID or
          * sequence number, the server is looney tunes.
          */
-        status = -ESERVERFAULT;
+        status = -EREMOTEIO;
 
         if (memcmp(id.data, res->sr_session->sess_id.data,
                    NFS4_MAX_SESSIONID_LEN)) {
@@ -4583,8 +4667,8 @@ static int decode_sequence(struct xdr_stream *xdr,
         dummy = be32_to_cpup(p++);
         /* target highest slot id - currently not processed */
         dummy = be32_to_cpup(p++);
-        /* result flags - currently not processed */
-        dummy = be32_to_cpup(p);
+        /* result flags */
+        res->sr_status_flags = be32_to_cpup(p);
         status = 0;
 out_err:
         res->sr_status = status;
@@ -5309,7 +5393,7 @@ out:
 }
 
 /*
- * FSINFO request
+ * Decode FSINFO response
  */
 static int nfs4_xdr_dec_fsinfo(struct rpc_rqst *req, __be32 *p,
                                struct nfs4_fsinfo_res *res)
@@ -5330,7 +5414,7 @@ static int nfs4_xdr_dec_fsinfo(struct rpc_rqst *req, __be32 *p,
 }
 
 /*
- * PATHCONF request
+ * Decode PATHCONF response
  */
 static int nfs4_xdr_dec_pathconf(struct rpc_rqst *req, __be32 *p,
                                  struct nfs4_pathconf_res *res)
@@ -5351,7 +5435,7 @@ static int nfs4_xdr_dec_pathconf(struct rpc_rqst *req, __be32 *p,
 }
 
 /*
- * STATFS request
+ * Decode STATFS response
  */
 static int nfs4_xdr_dec_statfs(struct rpc_rqst *req, __be32 *p,
                                struct nfs4_statfs_res *res)
@@ -5372,7 +5456,7 @@ static int nfs4_xdr_dec_statfs(struct rpc_rqst *req, __be32 *p,
 }
 
 /*
- * GETATTR_BITMAP request
+ * Decode GETATTR_BITMAP response
  */
 static int nfs4_xdr_dec_server_caps(struct rpc_rqst *req, __be32 *p, struct nfs4_server_caps_res *res)
 {
@@ -5411,7 +5495,7 @@ static int nfs4_xdr_dec_renew(struct rpc_rqst *rqstp, __be32 *p, void *dummy)
 }
 
 /*
- * a SETCLIENTID request
+ * Decode SETCLIENTID response
  */
 static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, __be32 *p,
                 struct nfs_client *clp)
@@ -5428,7 +5512,7 @@ static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, __be32 *p,
 }
 
 /*
- * a SETCLIENTID_CONFIRM request
+ * Decode SETCLIENTID_CONFIRM response
  */
 static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req, __be32 *p, struct nfs_fsinfo *fsinfo)
 {
@@ -5448,7 +5532,7 @@ static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req, __be32 *p, str
 }
 
 /*
- * DELEGRETURN request
+ * Decode DELEGRETURN response
  */
 static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_delegreturnres *res)
 {
@@ -5467,6 +5551,8 @@ static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, __be32 *p, struct nf
         if (status != 0)
                 goto out;
         status = decode_delegreturn(&xdr);
+        if (status != 0)
+                goto out;
         decode_getfattr(&xdr, res->fattr, res->server,
                         !RPC_IS_ASYNC(rqstp->rq_task));
 out:
@@ -5474,7 +5560,7 @@ out:
 }
 
 /*
- * FS_LOCATIONS request
+ * Decode FS_LOCATIONS response
  */
 static int nfs4_xdr_dec_fs_locations(struct rpc_rqst *req, __be32 *p,
                                      struct nfs4_fs_locations_res *res)
@@ -5504,7 +5590,7 @@ out:
 
 #if defined(CONFIG_NFS_V4_1)
 /*
- * EXCHANGE_ID request
+ * Decode EXCHANGE_ID response
  */
 static int nfs4_xdr_dec_exchange_id(struct rpc_rqst *rqstp, uint32_t *p,
                                     void *res)
@@ -5521,7 +5607,7 @@ static int nfs4_xdr_dec_exchange_id(struct rpc_rqst *rqstp, uint32_t *p,
 }
 
 /*
- * a CREATE_SESSION request
+ * Decode CREATE_SESSION response
  */
 static int nfs4_xdr_dec_create_session(struct rpc_rqst *rqstp, uint32_t *p,
                                        struct nfs41_create_session_res *res)
@@ -5538,7 +5624,7 @@ static int nfs4_xdr_dec_create_session(struct rpc_rqst *rqstp, uint32_t *p,
 }
 
 /*
- * a DESTROY_SESSION request
+ * Decode DESTROY_SESSION response
  */
 static int nfs4_xdr_dec_destroy_session(struct rpc_rqst *rqstp, uint32_t *p,
                                         void *dummy)
@@ -5555,7 +5641,7 @@ static int nfs4_xdr_dec_destroy_session(struct rpc_rqst *rqstp, uint32_t *p,
 }
 
 /*
- * a SEQUENCE request
+ * Decode SEQUENCE response
  */
 static int nfs4_xdr_dec_sequence(struct rpc_rqst *rqstp, uint32_t *p,
                                  struct nfs4_sequence_res *res)
@@ -5572,7 +5658,7 @@ static int nfs4_xdr_dec_sequence(struct rpc_rqst *rqstp, uint32_t *p,
 }
 
 /*
- * a GET_LEASE_TIME request
+ * Decode GET_LEASE_TIME response
  */
 static int nfs4_xdr_dec_get_lease_time(struct rpc_rqst *rqstp, uint32_t *p,
                                        struct nfs4_get_lease_time_res *res)
@@ -5591,6 +5677,25 @@ static int nfs4_xdr_dec_get_lease_time(struct rpc_rqst *rqstp, uint32_t *p,
                 status = decode_fsinfo(&xdr, res->lr_fsinfo);
         return status;
 }
+
+/*
+ * Decode RECLAIM_COMPLETE response
+ */
+static int nfs4_xdr_dec_reclaim_complete(struct rpc_rqst *rqstp, uint32_t *p,
+                                         struct nfs41_reclaim_complete_res *res)
+{
+        struct xdr_stream xdr;
+        struct compound_hdr hdr;
+        int status;
+
+        xdr_init_decode(&xdr, &rqstp->rq_rcv_buf, p);
+        status = decode_compound_hdr(&xdr, &hdr);
+        if (!status)
+                status = decode_sequence(&xdr, &res->seq_res, rqstp);
+        if (!status)
+                status = decode_reclaim_complete(&xdr, (void *)NULL);
+        return status;
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 __be32 *nfs4_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus)
@@ -5678,7 +5783,7 @@ static struct {
         { NFS4ERR_BAD_COOKIE,   -EBADCOOKIE     },
         { NFS4ERR_NOTSUPP,      -ENOTSUPP       },
         { NFS4ERR_TOOSMALL,     -ETOOSMALL      },
-        { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
+        { NFS4ERR_SERVERFAULT,  -EREMOTEIO      },
         { NFS4ERR_BADTYPE,      -EBADTYPE       },
         { NFS4ERR_LOCKED,       -EAGAIN         },
         { NFS4ERR_SYMLINK,      -ELOOP          },
@@ -5705,7 +5810,7 @@ nfs4_stat_to_errno(int stat)
         }
         if (stat <= 10000 || stat > 10100) {
                 /* The server is looney tunes. */
-                return -ESERVERFAULT;
+                return -EREMOTEIO;
         }
         /* If we cannot translate the error, the recovery routines should
          * handle it.
@@ -5767,6 +5872,7 @@ struct rpc_procinfo	nfs4_procedures[] = {
   PROC(DESTROY_SESSION, enc_destroy_session,    dec_destroy_session),
   PROC(SEQUENCE,        enc_sequence,   dec_sequence),
   PROC(GET_LEASE_TIME,  enc_get_lease_time,     dec_get_lease_time),
+  PROC(RECLAIM_COMPLETE, enc_reclaim_complete,  dec_reclaim_complete),
 #endif /* CONFIG_NFS_V4_1 */
 };
 
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index e2975939126a..29d9d36cd5f4 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -112,12 +112,10 @@ void nfs_unlock_request(struct nfs_page *req)
  */
 int nfs_set_page_tag_locked(struct nfs_page *req)
 {
-        struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
-
         if (!nfs_lock_request_dontget(req))
                 return 0;
         if (req->wb_page != NULL)
-                radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
+                radix_tree_tag_set(&NFS_I(req->wb_context->path.dentry->d_inode)->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
         return 1;
 }
 
@@ -126,10 +124,10 @@ int nfs_set_page_tag_locked(struct nfs_page *req)
  */
 void nfs_clear_page_tag_locked(struct nfs_page *req)
 {
-        struct inode *inode = req->wb_context->path.dentry->d_inode;
-        struct nfs_inode *nfsi = NFS_I(inode);
-
         if (req->wb_page != NULL) {
+                struct inode *inode = req->wb_context->path.dentry->d_inode;
+                struct nfs_inode *nfsi = NFS_I(inode);
+
                 spin_lock(&inode->i_lock);
                 radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
                 nfs_unlock_request(req);
@@ -142,16 +140,22 @@ void nfs_clear_page_tag_locked(struct nfs_page *req)
  * nfs_clear_request - Free up all resources allocated to the request
  * @req:
  *
- * Release page resources associated with a write request after it
- * has completed.
+ * Release page and open context resources associated with a read/write
+ * request after it has completed.
  */
 void nfs_clear_request(struct nfs_page *req)
 {
         struct page *page = req->wb_page;
+        struct nfs_open_context *ctx = req->wb_context;
+
         if (page != NULL) {
                 page_cache_release(page);
                 req->wb_page = NULL;
         }
+        if (ctx != NULL) {
+                put_nfs_open_context(ctx);
+                req->wb_context = NULL;
+        }
 }
 
 
@@ -165,9 +169,8 @@ static void nfs_free_request(struct kref *kref)
 {
         struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
 
-        /* Release struct file or cached credential */
+        /* Release struct file and open context */
         nfs_clear_request(req);
-        put_nfs_open_context(req->wb_context);
         nfs_page_free(req);
 }
 
@@ -176,6 +179,12 @@ void nfs_release_request(struct nfs_page *req)
         kref_put(&req->wb_kref, nfs_free_request);
 }
 
+static int nfs_wait_bit_uninterruptible(void *word)
+{
+        io_schedule();
+        return 0;
+}
+
 /**
  * nfs_wait_on_request - Wait for a request to complete.
  * @req: request to wait upon.
@@ -186,14 +195,9 @@ void nfs_release_request(struct nfs_page *req)
 int
 nfs_wait_on_request(struct nfs_page *req)
 {
-        int ret = 0;
-
-        if (!test_bit(PG_BUSY, &req->wb_flags))
-                goto out;
-        ret = out_of_line_wait_on_bit(&req->wb_flags, PG_BUSY,
-                        nfs_wait_bit_killable, TASK_KILLABLE);
-out:
-        return ret;
+        return wait_on_bit(&req->wb_flags, PG_BUSY,
+                        nfs_wait_bit_uninterruptible,
+                        TASK_UNINTERRUPTIBLE);
 }
 
 /**
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index ef583854d8d0..0288be80444f 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -29,7 +29,6 @@
 
 #include <linux/types.h>
 #include <linux/param.h>
-#include <linux/slab.h>
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/errno.h>
@@ -47,6 +46,39 @@
 #define NFSDBG_FACILITY         NFSDBG_PROC
 
 /*
+ * wrapper to handle the -EKEYEXPIRED error message. This should generally
+ * only happen if using krb5 auth and a user's TGT expires. NFSv2 doesn't
+ * support the NFSERR_JUKEBOX error code, but we handle this situation in the
+ * same way that we handle that error with NFSv3.
+ */
+static int
+nfs_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
+{
+        int res;
+        do {
+                res = rpc_call_sync(clnt, msg, flags);
+                if (res != -EKEYEXPIRED)
+                        break;
+                schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
+                res = -ERESTARTSYS;
+        } while (!fatal_signal_pending(current));
+        return res;
+}
+
+#define rpc_call_sync(clnt, msg, flags) nfs_rpc_wrapper(clnt, msg, flags)
+
+static int
+nfs_async_handle_expired_key(struct rpc_task *task)
+{
+        if (task->tk_status != -EKEYEXPIRED)
+                return 0;
+        task->tk_status = 0;
+        rpc_restart_call(task);
+        rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
+        return 1;
+}
+
+/*
  * Bare-bones access to getattr: this is for nfs_read_super.
  */
 static int
@@ -307,6 +339,8 @@ nfs_proc_unlink_setup(struct rpc_message *msg, struct inode *dir)
 
 static int nfs_proc_unlink_done(struct rpc_task *task, struct inode *dir)
 {
+        if (nfs_async_handle_expired_key(task))
+                return 0;
         nfs_mark_for_revalidate(dir);
         return 1;
 }
@@ -560,6 +594,9 @@ nfs_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
 
 static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
 {
+        if (nfs_async_handle_expired_key(task))
+                return -EAGAIN;
+
         nfs_invalidate_atime(data->inode);
         if (task->tk_status >= 0) {
                 nfs_refresh_inode(data->inode, data->res.fattr);
@@ -579,6 +616,9 @@ static void nfs_proc_read_setup(struct nfs_read_data *data, struct rpc_message *
 
 static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
 {
+        if (nfs_async_handle_expired_key(task))
+                return -EAGAIN;
+
         if (task->tk_status >= 0)
                 nfs_post_op_update_inode_force_wcc(data->inode, data->res.fattr);
         return 0;
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 12c9e66d3f1d..db9b360ae19d 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -356,25 +356,19 @@ static void nfs_readpage_retry(struct rpc_task *task, struct nfs_read_data *data
         struct nfs_readres *resp = &data->res;
 
         if (resp->eof || resp->count == argp->count)
-                goto out;
+                return;
 
         /* This is a short read! */
         nfs_inc_stats(data->inode, NFSIOS_SHORTREAD);
         /* Has the server at least made some progress? */
         if (resp->count == 0)
-                goto out;
+                return;
 
         /* Yes, so retry the read at the end of the data */
         argp->offset += resp->count;
         argp->pgbase += resp->count;
         argp->count -= resp->count;
-        nfs4_restart_rpc(task, NFS_SERVER(data->inode)->nfs_client);
-        return;
-out:
-        nfs4_sequence_free_slot(NFS_SERVER(data->inode)->nfs_client,
-                                &data->res.seq_res);
-        return;
-
+        nfs_restart_rpc(task, NFS_SERVER(data->inode)->nfs_client);
 }
 
 /*
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 90be551b80c1..b4148fc00f9f 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -48,6 +48,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <linux/netdevice.h>
 #include <linux/nfs_xdr.h>
@@ -175,14 +176,16 @@ static const match_table_t nfs_mount_option_tokens = {
 };
 
 enum {
-        Opt_xprt_udp, Opt_xprt_tcp, Opt_xprt_rdma,
+        Opt_xprt_udp, Opt_xprt_udp6, Opt_xprt_tcp, Opt_xprt_tcp6, Opt_xprt_rdma,
 
         Opt_xprt_err
 };
 
 static const match_table_t nfs_xprt_protocol_tokens = {
         { Opt_xprt_udp, "udp" },
+        { Opt_xprt_udp6, "udp6" },
         { Opt_xprt_tcp, "tcp" },
+        { Opt_xprt_tcp6, "tcp6" },
         { Opt_xprt_rdma, "rdma" },
 
         { Opt_xprt_err, NULL }
@@ -241,6 +244,7 @@ static int  nfs_show_stats(struct seq_file *, struct vfsmount *);
 static int nfs_get_sb(struct file_system_type *, int, const char *, void *, struct vfsmount *);
 static int nfs_xdev_get_sb(struct file_system_type *fs_type,
                 int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt);
+static void nfs_put_super(struct super_block *);
 static void nfs_kill_super(struct super_block *);
 static int nfs_remount(struct super_block *sb, int *flags, char *raw_data);
 
@@ -264,6 +268,7 @@ static const struct super_operations nfs_sops = {
         .alloc_inode    = nfs_alloc_inode,
         .destroy_inode  = nfs_destroy_inode,
         .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
         .statfs         = nfs_statfs,
         .clear_inode    = nfs_clear_inode,
         .umount_begin   = nfs_umount_begin,
@@ -333,6 +338,7 @@ static const struct super_operations nfs4_sops = {
         .alloc_inode    = nfs_alloc_inode,
         .destroy_inode  = nfs_destroy_inode,
         .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
         .statfs         = nfs_statfs,
         .clear_inode    = nfs4_clear_inode,
         .umount_begin   = nfs_umount_begin,
@@ -492,6 +498,45 @@ static const char *nfs_pseudoflavour_to_name(rpc_authflavor_t flavour)
         return sec_flavours[i].str;
 }
 
+static void nfs_show_mountd_netid(struct seq_file *m, struct nfs_server *nfss,
+                                  int showdefaults)
+{
+        struct sockaddr *sap = (struct sockaddr *) &nfss->mountd_address;
+
+        seq_printf(m, ",mountproto=");
+        switch (sap->sa_family) {
+        case AF_INET:
+                switch (nfss->mountd_protocol) {
+                case IPPROTO_UDP:
+                        seq_printf(m, RPCBIND_NETID_UDP);
+                        break;
+                case IPPROTO_TCP:
+                        seq_printf(m, RPCBIND_NETID_TCP);
+                        break;
+                default:
+                        if (showdefaults)
+                                seq_printf(m, "auto");
+                }
+                break;
+        case AF_INET6:
+                switch (nfss->mountd_protocol) {
+                case IPPROTO_UDP:
+                        seq_printf(m, RPCBIND_NETID_UDP6);
+                        break;
+                case IPPROTO_TCP:
+                        seq_printf(m, RPCBIND_NETID_TCP6);
+                        break;
+                default:
+                        if (showdefaults)
+                                seq_printf(m, "auto");
+                }
+                break;
+        default:
+                if (showdefaults)
+                        seq_printf(m, "auto");
+        }
+}
+
 static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
                                     int showdefaults)
 {
@@ -505,7 +550,7 @@ static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
         }
         case AF_INET6: {
                 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sap;
-                seq_printf(m, ",mountaddr=%pI6", &sin6->sin6_addr);
+                seq_printf(m, ",mountaddr=%pI6c", &sin6->sin6_addr);
                 break;
         }
         default:
@@ -518,17 +563,7 @@ static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
         if (nfss->mountd_port || showdefaults)
                 seq_printf(m, ",mountport=%u", nfss->mountd_port);
 
-        switch (nfss->mountd_protocol) {
-        case IPPROTO_UDP:
-                seq_printf(m, ",mountproto=udp");
-                break;
-        case IPPROTO_TCP:
-                seq_printf(m, ",mountproto=tcp");
-                break;
-        default:
-                if (showdefaults)
-                        seq_printf(m, ",mountproto=auto");
-        }
+        nfs_show_mountd_netid(m, nfss, showdefaults);
 }
 
 /*
@@ -578,7 +613,7 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,
                         seq_puts(m, nfs_infop->nostr);
         }
         seq_printf(m, ",proto=%s",
-                   rpc_peeraddr2str(nfss->client, RPC_DISPLAY_PROTO));
+                   rpc_peeraddr2str(nfss->client, RPC_DISPLAY_NETID));
         if (version == 4) {
                 if (nfss->port != NFS_PORT)
                         seq_printf(m, ",port=%u", nfss->port);
@@ -714,8 +749,6 @@ static void nfs_umount_begin(struct super_block *sb)
         struct nfs_server *server;
         struct rpc_clnt *rpc;
 
-        lock_kernel();
-
         server = NFS_SB(sb);
         /* -EIO all pending I/O */
         rpc = server->client_acl;
@@ -724,8 +757,6 @@ static void nfs_umount_begin(struct super_block *sb)
         rpc = server->client;
         if (!IS_ERR(rpc))
                 rpc_killall_tasks(rpc);
-
-        unlock_kernel();
 }
 
 static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int version)
@@ -734,8 +765,6 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int ve
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data) {
-                data->rsize             = NFS_MAX_FILE_IO_SIZE;
-                data->wsize             = NFS_MAX_FILE_IO_SIZE;
                 data->acregmin          = NFS_DEF_ACREGMIN;
                 data->acregmax          = NFS_DEF_ACREGMAX;
                 data->acdirmin          = NFS_DEF_ACDIRMIN;
@@ -887,6 +916,8 @@ static int nfs_parse_mount_options(char *raw,
 {
         char *p, *string, *secdata;
         int rc, sloppy = 0, invalid_option = 0;
+        unsigned short protofamily = AF_UNSPEC;
+        unsigned short mountfamily = AF_UNSPEC;
 
         if (!raw) {
                 dfprintk(MOUNT, "NFS: mount options string was NULL.\n");
@@ -1232,12 +1263,17 @@ static int nfs_parse_mount_options(char *raw,
                         token = match_token(string,
                                             nfs_xprt_protocol_tokens, args);
 
+                        protofamily = AF_INET;
                         switch (token) {
+                        case Opt_xprt_udp6:
+                                protofamily = AF_INET6;
                         case Opt_xprt_udp:
                                 mnt->flags &= ~NFS_MOUNT_TCP;
                                 mnt->nfs_server.protocol = XPRT_TRANSPORT_UDP;
                                 kfree(string);
                                 break;
+                        case Opt_xprt_tcp6:
+                                protofamily = AF_INET6;
                         case Opt_xprt_tcp:
                                 mnt->flags |= NFS_MOUNT_TCP;
                                 mnt->nfs_server.protocol = XPRT_TRANSPORT_TCP;
@@ -1265,10 +1301,15 @@ static int nfs_parse_mount_options(char *raw,
                                             nfs_xprt_protocol_tokens, args);
                         kfree(string);
 
+                        mountfamily = AF_INET;
                         switch (token) {
+                        case Opt_xprt_udp6:
+                                mountfamily = AF_INET6;
                         case Opt_xprt_udp:
                                 mnt->mount_server.protocol = XPRT_TRANSPORT_UDP;
                                 break;
+                        case Opt_xprt_tcp6:
+                                mountfamily = AF_INET6;
                         case Opt_xprt_tcp:
                                 mnt->mount_server.protocol = XPRT_TRANSPORT_TCP;
                                 break;
@@ -1367,8 +1408,33 @@ static int nfs_parse_mount_options(char *raw,
         if (!sloppy && invalid_option)
                 return 0;
 
+        /*
+         * verify that any proto=/mountproto= options match the address
+         * familiies in the addr=/mountaddr= options.
+         */
+        if (protofamily != AF_UNSPEC &&
+            protofamily != mnt->nfs_server.address.ss_family)
+                goto out_proto_mismatch;
+
+        if (mountfamily != AF_UNSPEC) {
+                if (mnt->mount_server.addrlen) {
+                        if (mountfamily != mnt->mount_server.address.ss_family)
+                                goto out_mountproto_mismatch;
+                } else {
+                        if (mountfamily != mnt->nfs_server.address.ss_family)
+                                goto out_mountproto_mismatch;
+                }
+        }
+
         return 1;
 
+out_mountproto_mismatch:
+        printk(KERN_INFO "NFS: mount server address does not match mountproto= "
+                         "option\n");
+        return 0;
+out_proto_mismatch:
+        printk(KERN_INFO "NFS: server address does not match proto= option\n");
+        return 0;
 out_invalid_address:
         printk(KERN_INFO "NFS: bad IP address specified: %s\n", p);
         return 0;
@@ -1881,7 +1947,6 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
         if (data == NULL)
                 return -ENOMEM;
 
-        lock_kernel();
         /* fill out struct with values from existing mount */
         data->flags = nfss->flags;
         data->rsize = nfss->rsize;
@@ -1907,7 +1972,6 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
         error = nfs_compare_remount_data(nfss, data);
 out:
         kfree(data);
-        unlock_kernel();
         return error;
 }
 
@@ -2123,6 +2187,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         if (data->version == 4) {
                 error = nfs4_try_mount(flags, dev_name, data, mnt);
                 kfree(data->client_address);
+                kfree(data->nfs_server.export_path);
                 goto out;
         }
 #endif  /* CONFIG_NFS_V4 */
@@ -2151,7 +2216,7 @@ static int nfs_get_sb(struct file_system_type *fs_type,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2193,11 +2258,25 @@ out_err_nosb:
 error_splat_root:
         dput(mntroot);
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         goto out;
 }
 
 /*
+ * Ensure that we unregister the bdi before kill_anon_super
+ * releases the device name
+ */
+static void nfs_put_super(struct super_block *s)
+{
+        struct nfs_server *server = NFS_SB(s);
+
+        bdi_unregister(&server->backing_dev_info);
+}
+
+/*
  * Destroy an NFS2/3 superblock
  */
 static void nfs_kill_super(struct super_block *s)
@@ -2205,7 +2284,6 @@ static void nfs_kill_super(struct super_block *s)
         struct nfs_server *server = NFS_SB(s);
 
         kill_anon_super(s);
-        bdi_unregister(&server->backing_dev_info);
         nfs_fscache_release_super_cookie(s);
         nfs_free_server(server);
 }
@@ -2253,7 +2331,7 @@ static int nfs_xdev_get_sb(struct file_system_type *fs_type, int flags,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2290,6 +2368,9 @@ out_err_noserver:
         return error;
 
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         dprintk("<-- nfs_xdev_get_sb() = %d [splat]\n", error);
         return error;
@@ -2505,7 +2586,7 @@ static int nfs4_remote_get_sb(struct file_system_type *fs_type,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2543,6 +2624,9 @@ out_free:
 error_splat_root:
         dput(mntroot);
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         goto out;
 }
@@ -2574,7 +2658,7 @@ static void nfs_fix_devname(const struct path *path, struct vfsmount *mnt)
         devname = nfs_path(path->mnt->mnt_devname,
                         path->mnt->mnt_root, path->dentry,
                         page, PAGE_SIZE);
-        if (devname == NULL)
+        if (IS_ERR(devname))
                 goto out_freepage;
         tmp = kstrdup(devname, GFP_KERNEL);
         if (tmp == NULL)
@@ -2738,7 +2822,7 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2774,6 +2858,9 @@ out_err_noserver:
         return error;
 
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         dprintk("<-- nfs4_xdev_get_sb() = %d [splat]\n", error);
         return error;
@@ -2820,7 +2907,7 @@ static int nfs4_remote_referral_get_sb(struct file_system_type *fs_type,
         } else {
                 error = nfs_bdi_register(server);
                 if (error)
-                        goto error_splat_super;
+                        goto error_splat_bdi;
         }
 
         if (!s->s_root) {
@@ -2856,6 +2943,9 @@ out_err_noserver:
         return error;
 
 error_splat_super:
+        if (server && !s->s_root)
+                bdi_unregister(&server->backing_dev_info);
+error_splat_bdi:
         deactivate_locked_super(s);
         dprintk("<-- nfs4_referral_get_sb() = %d [splat]\n", error);
         return error;
diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c
index 412738dbfbc7..05c9e02f4153 100644
--- a/fs/nfs/symlink.c
+++ b/fs/nfs/symlink.c
@@ -19,7 +19,6 @@
 #include <linux/pagemap.h>
 #include <linux/stat.h>
 #include <linux/mm.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/namei.h>
 
@@ -50,7 +49,7 @@ static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         struct page *page;
         void *err;
 
-        err = ERR_PTR(nfs_revalidate_mapping_nolock(inode, inode->i_mapping));
+        err = ERR_PTR(nfs_revalidate_mapping(inode, inode->i_mapping));
         if (err)
                 goto read_failed;
         page = read_cache_page(&inode->i_data, 0,
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index b62481dabae9..ad4d2e787b20 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -15,70 +15,64 @@
 
 #include "callback.h"
 
+#ifdef CONFIG_NFS_V4
 static const int nfs_set_port_min = 0;
 static const int nfs_set_port_max = 65535;
+#endif
 static struct ctl_table_header *nfs_callback_sysctl_table;
 
 static ctl_table nfs_cb_sysctls[] = {
 #ifdef CONFIG_NFS_V4
         {
-                .ctl_name = CTL_UNNUMBERED,
                 .procname = "nfs_callback_tcpport",
                 .data = &nfs_callback_set_tcpport,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_minmax,
+                .proc_handler = proc_dointvec_minmax,
                 .extra1 = (int *)&nfs_set_port_min,
                 .extra2 = (int *)&nfs_set_port_max,
         },
         {
-                .ctl_name = CTL_UNNUMBERED,
                 .procname = "idmap_cache_timeout",
                 .data = &nfs_idmap_cache_timeout,
                 .maxlen = sizeof(int),
                 .mode = 0644,
-                .proc_handler = &proc_dointvec_jiffies,
-                .strategy = &sysctl_jiffies,
+                .proc_handler = proc_dointvec_jiffies,
         },
 #endif
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nfs_mountpoint_timeout",
                 .data           = &nfs_mountpoint_expiry_timeout,
                 .maxlen         = sizeof(nfs_mountpoint_expiry_timeout),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = proc_dointvec_jiffies,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "nfs_congestion_kb",
                 .data           = &nfs_congestion_kb,
                 .maxlen         = sizeof(nfs_congestion_kb),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = proc_dointvec,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static ctl_table nfs_cb_sysctl_dir[] = {
         {
-                .ctl_name = CTL_UNNUMBERED,
                 .procname = "nfs",
                 .mode = 0555,
                 .child = nfs_cb_sysctls,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static ctl_table nfs_cb_sysctl_root[] = {
         {
-                .ctl_name = CTL_FS,
                 .procname = "fs",
                 .mode = 0555,
                 .child = nfs_cb_sysctl_dir,
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 int nfs_register_sysctl(void)
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 1064c91ae810..6da3d3ff6edd 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -83,7 +83,7 @@ static void nfs_async_unlink_done(struct rpc_task *task, void *calldata)
         struct inode *dir = data->dir;
 
         if (!NFS_PROTO(dir)->unlink_done(task, dir))
-                nfs4_restart_rpc(task, NFS_SERVER(dir)->nfs_client);
+                nfs_restart_rpc(task, NFS_SERVER(dir)->nfs_client);
 }
 
 /**
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 53eb26c16b50..3aea3ca98ab7 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -178,7 +178,7 @@ static int wb_priority(struct writeback_control *wbc)
 {
         if (wbc->for_reclaim)
                 return FLUSH_HIGHPRI | FLUSH_STABLE;
-        if (wbc->for_kupdate)
+        if (wbc->for_kupdate || wbc->for_background)
                 return FLUSH_LOWPRI;
         return 0;
 }
@@ -201,6 +201,7 @@ static int nfs_set_page_writeback(struct page *page)
                 struct inode *inode = page->mapping->host;
                 struct nfs_server *nfss = NFS_SERVER(inode);
 
+                page_cache_get(page);
                 if (atomic_long_inc_return(&nfss->writeback) >
                                 NFS_CONGESTION_ON_THRESH) {
                         set_bdi_congested(&nfss->backing_dev_info,
@@ -216,6 +217,7 @@ static void nfs_end_page_writeback(struct page *page)
         struct nfs_server *nfss = NFS_SERVER(inode);
 
         end_page_writeback(page);
+        page_cache_release(page);
         if (atomic_long_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH)
                 clear_bdi_congested(&nfss->backing_dev_info, BLK_RW_ASYNC);
 }
@@ -421,6 +423,7 @@ static void
 nfs_mark_request_dirty(struct nfs_page *req)
 {
         __set_page_dirty_nobuffers(req->wb_page);
+        __mark_inode_dirty(req->wb_page->mapping->host, I_DIRTY_DATASYNC);
 }
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
@@ -438,6 +441,7 @@ nfs_mark_request_commit(struct nfs_page *req)
         radix_tree_tag_set(&nfsi->nfs_page_tree,
                         req->wb_index,
                         NFS_PAGE_TAG_COMMIT);
+        nfsi->ncommit++;
         spin_unlock(&inode->i_lock);
         inc_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
         inc_bdi_stat(req->wb_page->mapping->backing_dev_info, BDI_RECLAIMABLE);
@@ -501,57 +505,6 @@ int nfs_reschedule_unstable_write(struct nfs_page *req)
 }
 #endif
 
-/*
- * Wait for a request to complete.
- *
- * Interruptible by fatal signals only.
- */
-static int nfs_wait_on_requests_locked(struct inode *inode, pgoff_t idx_start, unsigned int npages)
-{
-        struct nfs_inode *nfsi = NFS_I(inode);
-        struct nfs_page *req;
-        pgoff_t idx_end, next;
-        unsigned int            res = 0;
-        int                     error;
-
-        if (npages == 0)
-                idx_end = ~0;
-        else
-                idx_end = idx_start + npages - 1;
-
-        next = idx_start;
-        while (radix_tree_gang_lookup_tag(&nfsi->nfs_page_tree, (void **)&req, next, 1, NFS_PAGE_TAG_LOCKED)) {
-                if (req->wb_index > idx_end)
-                        break;
-
-                next = req->wb_index + 1;
-                BUG_ON(!NFS_WBACK_BUSY(req));
-
-                kref_get(&req->wb_kref);
-                spin_unlock(&inode->i_lock);
-                error = nfs_wait_on_request(req);
-                nfs_release_request(req);
-                spin_lock(&inode->i_lock);
-                if (error < 0)
-                        return error;
-                res++;
-        }
-        return res;
-}
-
-static void nfs_cancel_commit_list(struct list_head *head)
-{
-        struct nfs_page *req;
-
-        while(!list_empty(head)) {
-                req = nfs_list_entry(head->next);
-                nfs_list_remove_request(req);
-                nfs_clear_request_commit(req);
-                nfs_inode_remove_request(req);
-                nfs_unlock_request(req);
-        }
-}
-
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
 static int
 nfs_need_commit(struct nfs_inode *nfsi)
@@ -573,11 +526,17 @@ static int
 nfs_scan_commit(struct inode *inode, struct list_head *dst, pgoff_t idx_start, unsigned int npages)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
+        int ret;
 
         if (!nfs_need_commit(nfsi))
                 return 0;
 
-        return nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
+        ret = nfs_scan_list(nfsi, dst, idx_start, npages, NFS_PAGE_TAG_COMMIT);
+        if (ret > 0)
+                nfsi->ncommit -= ret;
+        if (nfs_need_commit(NFS_I(inode)))
+                __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
+        return ret;
 }
 #else
 static inline int nfs_need_commit(struct nfs_inode *nfsi)
@@ -642,9 +601,10 @@ static struct nfs_page *nfs_try_to_update_request(struct inode *inode,
                 spin_lock(&inode->i_lock);
         }
 
-        if (nfs_clear_request_commit(req))
-                radix_tree_tag_clear(&NFS_I(inode)->nfs_page_tree,
-                                req->wb_index, NFS_PAGE_TAG_COMMIT);
+        if (nfs_clear_request_commit(req) &&
+                        radix_tree_tag_clear(&NFS_I(inode)->nfs_page_tree,
+                                req->wb_index, NFS_PAGE_TAG_COMMIT) != NULL)
+                NFS_I(inode)->ncommit--;
 
         /* Okay, the request matches. Update the region */
         if (offset < req->wb_offset) {
@@ -703,9 +663,11 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
         req = nfs_setup_write_request(ctx, page, offset, count);
         if (IS_ERR(req))
                 return PTR_ERR(req);
+        nfs_mark_request_dirty(req);
         /* Update file length */
         nfs_grow_file(page, offset, count);
         nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
+        nfs_mark_request_dirty(req);
         nfs_clear_page_tag_locked(req);
         return 0;
 }
@@ -774,7 +736,7 @@ int nfs_updatepage(struct file *file, struct page *page,
          */
         if (nfs_write_pageuptodate(page, inode) &&
                         inode->i_flock == NULL &&
-                        !(file->f_flags & O_SYNC)) {
+                        !(file->f_flags & O_DSYNC)) {
                 count = max(count + offset, nfs_page_length(page));
                 offset = 0;
         }
@@ -782,8 +744,6 @@ int nfs_updatepage(struct file *file, struct page *page,
         status = nfs_writepage_setup(ctx, page, offset, count);
         if (status < 0)
                 nfs_set_pageerror(page);
-        else
-                __set_page_dirty_nobuffers(page);
 
         dprintk("NFS:       nfs_updatepage returns %d (isize %lld)\n",
                         status, (long long)i_size_read(inode));
@@ -792,13 +752,12 @@ int nfs_updatepage(struct file *file, struct page *page,
 
 static void nfs_writepage_release(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
 
-        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req)) {
-                nfs_end_page_writeback(req->wb_page);
+        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req))
                 nfs_inode_remove_request(req);
-        } else
-                nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 
 static int flush_task_priority(int how)
@@ -822,7 +781,6 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 int how)
 {
         struct inode *inode = req->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
         int priority = flush_task_priority(how);
         struct rpc_task *task;
         struct rpc_message msg = {
@@ -837,9 +795,10 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 .callback_ops = call_ops,
                 .callback_data = data,
                 .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                 .priority = priority,
         };
+        int ret = 0;
 
         /* Set up the RPC argument and reply structs
          * NB: take care not to mess about with data->commit et al. */
@@ -878,10 +837,18 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 (unsigned long long)data->args.offset);
 
         task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task))
-                return PTR_ERR(task);
+        if (IS_ERR(task)) {
+                ret = PTR_ERR(task);
+                goto out;
+        }
+        if (how & FLUSH_SYNC) {
+                ret = rpc_wait_for_completion_task(task);
+                if (ret == 0)
+                        ret = task->tk_status;
+        }
         rpc_put_task(task);
-        return 0;
+out:
+        return ret;
 }
 
 /* If a nfs_flush_* function fails, it should remove reqs from @head and
@@ -890,9 +857,11 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
  */
 static void nfs_redirty_request(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
+
         nfs_mark_request_dirty(req);
-        nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 
 /*
@@ -1127,16 +1096,15 @@ static void nfs_writeback_release_full(void *calldata)
                 if (nfs_write_need_commit(data)) {
                         memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
                         nfs_mark_request_commit(req);
-                        nfs_end_page_writeback(page);
                         dprintk(" marked for commit\n");
                         goto next;
                 }
                 dprintk(" OK\n");
 remove_request:
-                nfs_end_page_writeback(page);
                 nfs_inode_remove_request(req);
         next:
                 nfs_clear_page_tag_locked(req);
+                nfs_end_page_writeback(page);
         }
         nfs_writedata_release(calldata);
 }
@@ -1216,7 +1184,7 @@ int nfs_writeback_done(struct rpc_task *task, struct nfs_write_data *data)
                                  */
                                 argp->stable = NFS_FILE_SYNC;
                         }
-                        nfs4_restart_rpc(task, server->nfs_client);
+                        nfs_restart_rpc(task, server->nfs_client);
                         return -EAGAIN;
                 }
                 if (time_before(complain, jiffies)) {
@@ -1228,13 +1196,31 @@ int nfs_writeback_done(struct rpc_task *task, struct nfs_write_data *data)
                 /* Can't do anything about it except throw an error. */
                 task->tk_status = -EIO;
         }
-        nfs4_sequence_free_slot(server->nfs_client, &data->res.seq_res);
         return 0;
 }
 
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-void nfs_commitdata_release(void *data)
+static int nfs_commit_set_lock(struct nfs_inode *nfsi, int may_wait)
+{
+        if (!test_and_set_bit(NFS_INO_COMMIT, &nfsi->flags))
+                return 1;
+        if (may_wait && !out_of_line_wait_on_bit_lock(&nfsi->flags,
+                                NFS_INO_COMMIT, nfs_wait_bit_killable,
+                                TASK_KILLABLE))
+                return 1;
+        return 0;
+}
+
+static void nfs_commit_clear_lock(struct nfs_inode *nfsi)
+{
+        clear_bit(NFS_INO_COMMIT, &nfsi->flags);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&nfsi->flags, NFS_INO_COMMIT);
+}
+
+
+static void nfs_commitdata_release(void *data)
 {
         struct nfs_write_data *wdata = data;
 
@@ -1251,7 +1237,6 @@ static int nfs_commit_rpcsetup(struct list_head *head,
 {
         struct nfs_page *first = nfs_list_entry(head->next);
         struct inode *inode = first->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
         int priority = flush_task_priority(how);
         struct rpc_task *task;
         struct rpc_message msg = {
@@ -1266,7 +1251,7 @@ static int nfs_commit_rpcsetup(struct list_head *head,
                 .callback_ops = &nfs_commit_ops,
                 .callback_data = data,
                 .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                 .priority = priority,
         };
 
@@ -1326,6 +1311,7 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how)
                                 BDI_RECLAIMABLE);
                 nfs_clear_page_tag_locked(req);
         }
+        nfs_commit_clear_lock(NFS_I(inode));
         return -ENOMEM;
 }
 
@@ -1381,6 +1367,7 @@ static void nfs_commit_release(void *calldata)
         next:
                 nfs_clear_page_tag_locked(req);
         }
+        nfs_commit_clear_lock(NFS_I(data->inode));
         nfs_commitdata_release(calldata);
 }
 
@@ -1392,11 +1379,14 @@ static const struct rpc_call_ops nfs_commit_ops = {
         .rpc_release = nfs_commit_release,
 };
 
-int nfs_commit_inode(struct inode *inode, int how)
+static int nfs_commit_inode(struct inode *inode, int how)
 {
         LIST_HEAD(head);
-        int res;
+        int may_wait = how & FLUSH_SYNC;
+        int res = 0;
 
+        if (!nfs_commit_set_lock(NFS_I(inode), may_wait))
+                goto out;
         spin_lock(&inode->i_lock);
         res = nfs_scan_commit(inode, &head, 0, 0);
         spin_unlock(&inode->i_lock);
@@ -1404,95 +1394,60 @@ int nfs_commit_inode(struct inode *inode, int how)
                 int error = nfs_commit_list(inode, &head, how);
                 if (error < 0)
                         return error;
-        }
+                if (may_wait)
+                        wait_on_bit(&NFS_I(inode)->flags, NFS_INO_COMMIT,
+                                        nfs_wait_bit_killable,
+                                        TASK_KILLABLE);
+        } else
+                nfs_commit_clear_lock(NFS_I(inode));
+out:
         return res;
 }
-#else
-static inline int nfs_commit_list(struct inode *inode, struct list_head *head, int how)
-{
-        return 0;
-}
-#endif
 
-long nfs_sync_mapping_wait(struct address_space *mapping, struct writeback_control *wbc, int how)
+static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
-        struct inode *inode = mapping->host;
-        pgoff_t idx_start, idx_end;
-        unsigned int npages = 0;
-        LIST_HEAD(head);
-        int nocommit = how & FLUSH_NOCOMMIT;
-        long pages, ret;
-
-        /* FIXME */
-        if (wbc->range_cyclic)
-                idx_start = 0;
-        else {
-                idx_start = wbc->range_start >> PAGE_CACHE_SHIFT;
-                idx_end = wbc->range_end >> PAGE_CACHE_SHIFT;
-                if (idx_end > idx_start) {
-                        pgoff_t l_npages = 1 + idx_end - idx_start;
-                        npages = l_npages;
-                        if (sizeof(npages) != sizeof(l_npages) &&
-                                        (pgoff_t)npages != l_npages)
-                                npages = 0;
+        struct nfs_inode *nfsi = NFS_I(inode);
+        int flags = FLUSH_SYNC;
+        int ret = 0;
+
+        /* Don't commit yet if this is a non-blocking flush and there are
+         * lots of outstanding writes for this mapping.
+         */
+        if (wbc->sync_mode == WB_SYNC_NONE &&
+            nfsi->ncommit <= (nfsi->npages >> 1))
+                goto out_mark_dirty;
+
+        if (wbc->nonblocking || wbc->for_background)
+                flags = 0;
+        ret = nfs_commit_inode(inode, flags);
+        if (ret >= 0) {
+                if (wbc->sync_mode == WB_SYNC_NONE) {
+                        if (ret < wbc->nr_to_write)
+                                wbc->nr_to_write -= ret;
+                        else
+                                wbc->nr_to_write = 0;
                 }
+                return 0;
         }
-        how &= ~FLUSH_NOCOMMIT;
-        spin_lock(&inode->i_lock);
-        do {
-                ret = nfs_wait_on_requests_locked(inode, idx_start, npages);
-                if (ret != 0)
-                        continue;
-                if (nocommit)
-                        break;
-                pages = nfs_scan_commit(inode, &head, idx_start, npages);
-                if (pages == 0)
-                        break;
-                if (how & FLUSH_INVALIDATE) {
-                        spin_unlock(&inode->i_lock);
-                        nfs_cancel_commit_list(&head);
-                        ret = pages;
-                        spin_lock(&inode->i_lock);
-                        continue;
-                }
-                pages += nfs_scan_commit(inode, &head, 0, 0);
-                spin_unlock(&inode->i_lock);
-                ret = nfs_commit_list(inode, &head, how);
-                spin_lock(&inode->i_lock);
-
-        } while (ret >= 0);
-        spin_unlock(&inode->i_lock);
+out_mark_dirty:
+        __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
         return ret;
 }
-
-static int __nfs_write_mapping(struct address_space *mapping, struct writeback_control *wbc, int how)
+#else
+static int nfs_commit_inode(struct inode *inode, int how)
 {
-        int ret;
-
-        ret = nfs_writepages(mapping, wbc);
-        if (ret < 0)
-                goto out;
-        ret = nfs_sync_mapping_wait(mapping, wbc, how);
-        if (ret < 0)
-                goto out;
         return 0;
-out:
-        __mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
-        return ret;
 }
 
-/* Two pass sync: first using WB_SYNC_NONE, then WB_SYNC_ALL */
-static int nfs_write_mapping(struct address_space *mapping, int how)
+static int nfs_commit_unstable_pages(struct inode *inode, struct writeback_control *wbc)
 {
-        struct writeback_control wbc = {
-                .bdi = mapping->backing_dev_info,
-                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
-                .range_start = 0,
-                .range_end = LLONG_MAX,
-        };
+        return 0;
+}
+#endif
 
-        return __nfs_write_mapping(mapping, &wbc, how);
+int nfs_write_inode(struct inode *inode, struct writeback_control *wbc)
+{
+        return nfs_commit_unstable_pages(inode, wbc);
 }
 
 /*
@@ -1500,37 +1455,27 @@ static int nfs_write_mapping(struct address_space *mapping, int how)
  */
 int nfs_wb_all(struct inode *inode)
 {
-        return nfs_write_mapping(inode->i_mapping, 0);
-}
+        struct writeback_control wbc = {
+                .sync_mode = WB_SYNC_ALL,
+                .nr_to_write = LONG_MAX,
+                .range_start = 0,
+                .range_end = LLONG_MAX,
+        };
 
-int nfs_wb_nocommit(struct inode *inode)
-{
-        return nfs_write_mapping(inode->i_mapping, FLUSH_NOCOMMIT);
+        return sync_inode(inode, &wbc);
 }
 
 int nfs_wb_page_cancel(struct inode *inode, struct page *page)
 {
         struct nfs_page *req;
-        loff_t range_start = page_offset(page);
-        loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
-        struct writeback_control wbc = {
-                .bdi = page->mapping->backing_dev_info,
-                .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
-                .range_start = range_start,
-                .range_end = range_end,
-        };
         int ret = 0;
 
         BUG_ON(!PageLocked(page));
         for (;;) {
+                wait_on_page_writeback(page);
                 req = nfs_page_find_request(page);
                 if (req == NULL)
-                        goto out;
-                if (test_bit(PG_CLEAN, &req->wb_flags)) {
-                        nfs_release_request(req);
                         break;
-                }
                 if (nfs_lock_request_dontget(req)) {
                         nfs_inode_remove_request(req);
                         /*
@@ -1542,55 +1487,44 @@ int nfs_wb_page_cancel(struct inode *inode, struct page *page)
                         break;
                 }
                 ret = nfs_wait_on_request(req);
+                nfs_release_request(req);
                 if (ret < 0)
-                        goto out;
+                        break;
         }
-        if (!PagePrivate(page))
-                return 0;
-        ret = nfs_sync_mapping_wait(page->mapping, &wbc, FLUSH_INVALIDATE);
-out:
         return ret;
 }
 
-static int nfs_wb_page_priority(struct inode *inode, struct page *page,
-                                int how)
+/*
+ * Write back all requests on one page - we do this before reading it.
+ */
+int nfs_wb_page(struct inode *inode, struct page *page)
 {
         loff_t range_start = page_offset(page);
         loff_t range_end = range_start + (loff_t)(PAGE_CACHE_SIZE - 1);
         struct writeback_control wbc = {
-                .bdi = page->mapping->backing_dev_info,
                 .sync_mode = WB_SYNC_ALL,
-                .nr_to_write = LONG_MAX,
+                .nr_to_write = 0,
                 .range_start = range_start,
                 .range_end = range_end,
         };
         int ret;
 
-        do {
+        while(PagePrivate(page)) {
+                wait_on_page_writeback(page);
                 if (clear_page_dirty_for_io(page)) {
                         ret = nfs_writepage_locked(page, &wbc);
                         if (ret < 0)
                                 goto out_error;
-                } else if (!PagePrivate(page))
-                        break;
-                ret = nfs_sync_mapping_wait(page->mapping, &wbc, how);
+                }
+                ret = sync_inode(inode, &wbc);
                 if (ret < 0)
                         goto out_error;
-        } while (PagePrivate(page));
+        }
         return 0;
 out_error:
-        __mark_inode_dirty(inode, I_DIRTY_PAGES);
         return ret;
 }
 
-/*
- * Write back all requests on one page - we do this before reading it.
- */
-int nfs_wb_page(struct inode *inode, struct page* page)
-{
-        return nfs_wb_page_priority(inode, page, FLUSH_STABLE);
-}
-
 #ifdef CONFIG_MIGRATION
 int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
                 struct page *page)
@@ -1598,8 +1532,7 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
         struct nfs_page *req;
         int ret;
 
-        if (PageFsCache(page))
-                nfs_fscache_release_page(page, GFP_KERNEL);
+        nfs_fscache_release_page(page, GFP_KERNEL);
 
         req = nfs_find_and_lock_request(page);
         ret = PTR_ERR(req);
@@ -1612,15 +1545,16 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage,
         if (ret)
                 goto out_unlock;
         page_cache_get(newpage);
+        spin_lock(&mapping->host->i_lock);
         req->wb_page = newpage;
         SetPagePrivate(newpage);
-        set_page_private(newpage, page_private(page));
+        set_page_private(newpage, (unsigned long)req);
         ClearPagePrivate(page);
         set_page_private(page, 0);
+        spin_unlock(&mapping->host->i_lock);
         page_cache_release(page);
 out_unlock:
         nfs_clear_page_tag_locked(req);
-        nfs_release_request(req);
 out:
         return ret;
 }