Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6
[safe/jmp/linux-2.6] / net / sunrpc / xprtsock.c
index 3bc9c92..b7cd8cc 100644 (file)
@@ -3,8 +3,8 @@
  *
  * Client-side transport implementation for sockets.
  *
- * TCP callback races fixes (C) 1998 Red Hat Software <alan@redhat.com>
- * TCP send fixes (C) 1998 Red Hat Software <alan@redhat.com>
+ * TCP callback races fixes (C) 1998 Red Hat
+ * TCP send fixes (C) 1998 Red Hat
  * TCP NFS related read + write fixes
  *  (C) 1999 Dave Airlie, University of Limerick, Ireland <airlied@linux.ie>
  *
 #include <linux/tcp.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/sched.h>
+#include <linux/sunrpc/svcsock.h>
+#include <linux/sunrpc/xprtsock.h>
 #include <linux/file.h>
+#ifdef CONFIG_NFS_V4_1
+#include <linux/sunrpc/bc_xprt.h>
+#endif
 
 #include <net/sock.h>
 #include <net/checksum.h>
 #include <net/udp.h>
 #include <net/tcp.h>
 
+#include "sunrpc.h"
 /*
  * xprtsock tunables
  */
@@ -48,6 +54,9 @@ unsigned int xprt_tcp_slot_table_entries = RPC_DEF_SLOT_TABLE;
 unsigned int xprt_min_resvport = RPC_DEF_MIN_RESVPORT;
 unsigned int xprt_max_resvport = RPC_DEF_MAX_RESVPORT;
 
+#define XS_TCP_LINGER_TO       (15U * HZ)
+static unsigned int xs_tcp_fin_timeout __read_mostly = XS_TCP_LINGER_TO;
+
 /*
  * We can register our own files under /proc/sys/sunrpc by
  * calling register_sysctl_table() again.  The files in that
@@ -72,89 +81,63 @@ static struct ctl_table_header *sunrpc_table_header;
  */
 static ctl_table xs_tunables_table[] = {
        {
-               .ctl_name       = CTL_SLOTTABLE_UDP,
                .procname       = "udp_slot_table_entries",
                .data           = &xprt_udp_slot_table_entries,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
-               .strategy       = &sysctl_intvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = &min_slot_table_size,
                .extra2         = &max_slot_table_size
        },
        {
-               .ctl_name       = CTL_SLOTTABLE_TCP,
                .procname       = "tcp_slot_table_entries",
                .data           = &xprt_tcp_slot_table_entries,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
-               .strategy       = &sysctl_intvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = &min_slot_table_size,
                .extra2         = &max_slot_table_size
        },
        {
-               .ctl_name       = CTL_MIN_RESVPORT,
                .procname       = "min_resvport",
                .data           = &xprt_min_resvport,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
-               .strategy       = &sysctl_intvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = &xprt_min_resvport_limit,
                .extra2         = &xprt_max_resvport_limit
        },
        {
-               .ctl_name       = CTL_MAX_RESVPORT,
                .procname       = "max_resvport",
                .data           = &xprt_max_resvport,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-               .proc_handler   = &proc_dointvec_minmax,
-               .strategy       = &sysctl_intvec,
+               .proc_handler   = proc_dointvec_minmax,
                .extra1         = &xprt_min_resvport_limit,
                .extra2         = &xprt_max_resvport_limit
        },
        {
-               .ctl_name = 0,
+               .procname       = "tcp_fin_timeout",
+               .data           = &xs_tcp_fin_timeout,
+               .maxlen         = sizeof(xs_tcp_fin_timeout),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_jiffies,
        },
+       { },
 };
 
 static ctl_table sunrpc_table[] = {
        {
-               .ctl_name       = CTL_SUNRPC,
                .procname       = "sunrpc",
                .mode           = 0555,
                .child          = xs_tunables_table
        },
-       {
-               .ctl_name = 0,
-       },
+       { },
 };
 
 #endif
 
 /*
- * How many times to try sending a request on a socket before waiting
- * for the socket buffer to clear.
- */
-#define XS_SENDMSG_RETRY       (10U)
-
-/*
- * Time out for an RPC UDP socket connect.  UDP socket connects are
- * synchronous, but we set a timeout anyway in case of resource
- * exhaustion on the local host.
- */
-#define XS_UDP_CONN_TO         (5U * HZ)
-
-/*
- * Wait duration for an RPC TCP connection to be established.  Solaris
- * NFS over TCP uses 60 seconds, for example, which is in line with how
- * long a server takes to reboot.
- */
-#define XS_TCP_CONN_TO         (60U * HZ)
-
-/*
  * Wait duration for a reply from the RPC portmapper.
  */
 #define XS_BIND_TO             (60U * HZ)
@@ -239,8 +222,8 @@ struct sock_xprt {
         * Connection of transports
         */
        struct delayed_work     connect_worker;
-       struct sockaddr_storage addr;
-       unsigned short          port;
+       struct sockaddr_storage srcaddr;
+       unsigned short          srcport;
 
        /*
         * UDP socket buffer size parameters
@@ -254,6 +237,7 @@ struct sock_xprt {
        void                    (*old_data_ready)(struct sock *, int);
        void                    (*old_state_change)(struct sock *);
        void                    (*old_write_space)(struct sock *);
+       void                    (*old_error_report)(struct sock *);
 };
 
 /*
@@ -263,6 +247,13 @@ struct sock_xprt {
 #define TCP_RCV_COPY_FRAGHDR   (1UL << 1)
 #define TCP_RCV_COPY_XID       (1UL << 2)
 #define TCP_RCV_COPY_DATA      (1UL << 3)
+#define TCP_RCV_READ_CALLDIR   (1UL << 4)
+#define TCP_RCV_COPY_CALLDIR   (1UL << 5)
+
+/*
+ * TCP RPC flags
+ */
+#define TCP_RPC_REPLY          (1UL << 6)
 
 static inline struct sockaddr *xs_addr(struct rpc_xprt *xprt)
 {
@@ -279,142 +270,73 @@ static inline struct sockaddr_in6 *xs_addr_in6(struct rpc_xprt *xprt)
        return (struct sockaddr_in6 *) &xprt->addr;
 }
 
-static void xs_format_ipv4_peer_addresses(struct rpc_xprt *xprt)
+static void xs_format_common_peer_addresses(struct rpc_xprt *xprt)
 {
-       struct sockaddr_in *addr = xs_addr_in(xprt);
-       char *buf;
-
-       buf = kzalloc(20, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 20, NIPQUAD_FMT,
-                               NIPQUAD(addr->sin_addr.s_addr));
-       }
-       xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
-
-       buf = kzalloc(8, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 8, "%u",
-                               ntohs(addr->sin_port));
-       }
-       xprt->address_strings[RPC_DISPLAY_PORT] = buf;
-
-       buf = kzalloc(8, GFP_KERNEL);
-       if (buf) {
-               if (xprt->prot == IPPROTO_UDP)
-                       snprintf(buf, 8, "udp");
-               else
-                       snprintf(buf, 8, "tcp");
-       }
-       xprt->address_strings[RPC_DISPLAY_PROTO] = buf;
-
-       buf = kzalloc(48, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 48, "addr="NIPQUAD_FMT" port=%u proto=%s",
-                       NIPQUAD(addr->sin_addr.s_addr),
-                       ntohs(addr->sin_port),
-                       xprt->prot == IPPROTO_UDP ? "udp" : "tcp");
-       }
-       xprt->address_strings[RPC_DISPLAY_ALL] = buf;
+       struct sockaddr *sap = xs_addr(xprt);
+       struct sockaddr_in6 *sin6;
+       struct sockaddr_in *sin;
+       char buf[128];
 
-       buf = kzalloc(10, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 10, "%02x%02x%02x%02x",
-                               NIPQUAD(addr->sin_addr.s_addr));
-       }
-       xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = buf;
+       (void)rpc_ntop(sap, buf, sizeof(buf));
+       xprt->address_strings[RPC_DISPLAY_ADDR] = kstrdup(buf, GFP_KERNEL);
 
-       buf = kzalloc(8, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 8, "%4hx",
-                               ntohs(addr->sin_port));
-       }
-       xprt->address_strings[RPC_DISPLAY_HEX_PORT] = buf;
-
-       buf = kzalloc(30, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 30, NIPQUAD_FMT".%u.%u",
-                               NIPQUAD(addr->sin_addr.s_addr),
-                               ntohs(addr->sin_port) >> 8,
-                               ntohs(addr->sin_port) & 0xff);
+       switch (sap->sa_family) {
+       case AF_INET:
+               sin = xs_addr_in(xprt);
+               snprintf(buf, sizeof(buf), "%08x", ntohl(sin->sin_addr.s_addr));
+               break;
+       case AF_INET6:
+               sin6 = xs_addr_in6(xprt);
+               snprintf(buf, sizeof(buf), "%pi6", &sin6->sin6_addr);
+               break;
+       default:
+               BUG();
        }
-       xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
-
-       xprt->address_strings[RPC_DISPLAY_NETID] =
-               kstrdup(xprt->prot == IPPROTO_UDP ?
-                       RPCBIND_NETID_UDP : RPCBIND_NETID_TCP, GFP_KERNEL);
+       xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = kstrdup(buf, GFP_KERNEL);
 }
 
-static void xs_format_ipv6_peer_addresses(struct rpc_xprt *xprt)
+static void xs_format_common_peer_ports(struct rpc_xprt *xprt)
 {
-       struct sockaddr_in6 *addr = xs_addr_in6(xprt);
-       char *buf;
+       struct sockaddr *sap = xs_addr(xprt);
+       char buf[128];
 
-       buf = kzalloc(40, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 40, NIP6_FMT,
-                               NIP6(addr->sin6_addr));
-       }
-       xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
+       snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
+       xprt->address_strings[RPC_DISPLAY_PORT] = kstrdup(buf, GFP_KERNEL);
 
-       buf = kzalloc(8, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 8, "%u",
-                               ntohs(addr->sin6_port));
-       }
-       xprt->address_strings[RPC_DISPLAY_PORT] = buf;
-
-       buf = kzalloc(8, GFP_KERNEL);
-       if (buf) {
-               if (xprt->prot == IPPROTO_UDP)
-                       snprintf(buf, 8, "udp");
-               else
-                       snprintf(buf, 8, "tcp");
-       }
-       xprt->address_strings[RPC_DISPLAY_PROTO] = buf;
-
-       buf = kzalloc(64, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 64, "addr="NIP6_FMT" port=%u proto=%s",
-                               NIP6(addr->sin6_addr),
-                               ntohs(addr->sin6_port),
-                               xprt->prot == IPPROTO_UDP ? "udp" : "tcp");
-       }
-       xprt->address_strings[RPC_DISPLAY_ALL] = buf;
+       snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
+       xprt->address_strings[RPC_DISPLAY_HEX_PORT] = kstrdup(buf, GFP_KERNEL);
+}
 
-       buf = kzalloc(36, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 36, NIP6_SEQFMT,
-                               NIP6(addr->sin6_addr));
-       }
-       xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = buf;
+static void xs_format_peer_addresses(struct rpc_xprt *xprt,
+                                    const char *protocol,
+                                    const char *netid)
+{
+       xprt->address_strings[RPC_DISPLAY_PROTO] = protocol;
+       xprt->address_strings[RPC_DISPLAY_NETID] = netid;
+       xs_format_common_peer_addresses(xprt);
+       xs_format_common_peer_ports(xprt);
+}
 
-       buf = kzalloc(8, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 8, "%4hx",
-                               ntohs(addr->sin6_port));
-       }
-       xprt->address_strings[RPC_DISPLAY_HEX_PORT] = buf;
-
-       buf = kzalloc(50, GFP_KERNEL);
-       if (buf) {
-               snprintf(buf, 50, NIP6_FMT".%u.%u",
-                               NIP6(addr->sin6_addr),
-                               ntohs(addr->sin6_port) >> 8,
-                               ntohs(addr->sin6_port) & 0xff);
-       }
-       xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
+static void xs_update_peer_port(struct rpc_xprt *xprt)
+{
+       kfree(xprt->address_strings[RPC_DISPLAY_HEX_PORT]);
+       kfree(xprt->address_strings[RPC_DISPLAY_PORT]);
 
-       xprt->address_strings[RPC_DISPLAY_NETID] =
-               kstrdup(xprt->prot == IPPROTO_UDP ?
-                       RPCBIND_NETID_UDP6 : RPCBIND_NETID_TCP6, GFP_KERNEL);
+       xs_format_common_peer_ports(xprt);
 }
 
 static void xs_free_peer_addresses(struct rpc_xprt *xprt)
 {
-       int i;
+       unsigned int i;
 
        for (i = 0; i < RPC_DISPLAY_MAX; i++)
-               kfree(xprt->address_strings[i]);
+               switch (i) {
+               case RPC_DISPLAY_PROTO:
+               case RPC_DISPLAY_NETID:
+                       continue;
+               default:
+                       kfree(xprt->address_strings[i]);
+               }
 }
 
 #define XS_SENDMSG_FLAGS       (MSG_DONTWAIT | MSG_NOSIGNAL)
@@ -482,7 +404,7 @@ static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen,
        int err, sent = 0;
 
        if (unlikely(!sock))
-               return -ENOTCONN;
+               return -ENOTSOCK;
 
        clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags);
        if (base != 0) {
@@ -523,35 +445,53 @@ out:
        return sent;
 }
 
+static void xs_nospace_callback(struct rpc_task *task)
+{
+       struct sock_xprt *transport = container_of(task->tk_rqstp->rq_xprt, struct sock_xprt, xprt);
+
+       transport->inet->sk_write_pending--;
+       clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
+}
+
 /**
  * xs_nospace - place task on wait queue if transmit was incomplete
  * @task: task to put to sleep
  *
  */
-static void xs_nospace(struct rpc_task *task)
+static int xs_nospace(struct rpc_task *task)
 {
        struct rpc_rqst *req = task->tk_rqstp;
        struct rpc_xprt *xprt = req->rq_xprt;
        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+       int ret = 0;
 
        dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
                        task->tk_pid, req->rq_slen - req->rq_bytes_sent,
                        req->rq_slen);
 
-       if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) {
-               /* Protect against races with write_space */
-               spin_lock_bh(&xprt->transport_lock);
-
-               /* Don't race with disconnect */
-               if (!xprt_connected(xprt))
-                       task->tk_status = -ENOTCONN;
-               else if (test_bit(SOCK_NOSPACE, &transport->sock->flags))
-                       xprt_wait_for_buffer_space(task);
+       /* Protect against races with write_space */
+       spin_lock_bh(&xprt->transport_lock);
+
+       /* Don't race with disconnect */
+       if (xprt_connected(xprt)) {
+               if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) {
+                       ret = -EAGAIN;
+                       /*
+                        * Notify TCP that we're limited by the application
+                        * window size
+                        */
+                       set_bit(SOCK_NOSPACE, &transport->sock->flags);
+                       transport->inet->sk_write_pending++;
+                       /* ...and wait for more buffer space */
+                       xprt_wait_for_buffer_space(task, xs_nospace_callback);
+               }
+       } else {
+               clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
+               ret = -ENOTCONN;
+       }
 
-               spin_unlock_bh(&xprt->transport_lock);
-       } else
-               /* Keep holding the socket if it is blocked */
-               rpc_delay(task, HZ>>4);
+       spin_unlock_bh(&xprt->transport_lock);
+       return ret;
 }
 
 /**
@@ -577,7 +517,8 @@ static int xs_udp_send_request(struct rpc_task *task)
                                req->rq_svec->iov_base,
                                req->rq_svec->iov_len);
 
-       req->rq_xtime = jiffies;
+       if (!xprt_bound(xprt))
+               return -ENOTCONN;
        status = xs_sendpages(transport->sock,
                              xs_addr(xprt),
                              xprt->addrlen, xdr,
@@ -586,32 +527,52 @@ static int xs_udp_send_request(struct rpc_task *task)
        dprintk("RPC:       xs_udp_send_request(%u) = %d\n",
                        xdr->len - req->rq_bytes_sent, status);
 
-       if (likely(status >= (int) req->rq_slen))
-               return 0;
-
-       /* Still some bytes left; set up for a retry later. */
-       if (status > 0)
+       if (status >= 0) {
+               req->rq_xmit_bytes_sent += status;
+               if (status >= req->rq_slen)
+                       return 0;
+               /* Still some bytes left; set up for a retry later. */
                status = -EAGAIN;
+       }
 
        switch (status) {
-       case -ENETUNREACH:
-       case -EPIPE:
-       case -ECONNREFUSED:
-               /* When the server has died, an ICMP port unreachable message
-                * prompts ECONNREFUSED. */
+       case -ENOTSOCK:
+               status = -ENOTCONN;
+               /* Should we call xs_close() here? */
                break;
        case -EAGAIN:
-               xs_nospace(task);
+               status = xs_nospace(task);
                break;
        default:
                dprintk("RPC:       sendmsg returned unrecognized error %d\n",
                        -status);
-               break;
+       case -ENETUNREACH:
+       case -EPIPE:
+       case -ECONNREFUSED:
+               /* When the server has died, an ICMP port unreachable message
+                * prompts ECONNREFUSED. */
+               clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
        }
 
        return status;
 }
 
+/**
+ * xs_tcp_shutdown - gracefully shut down a TCP socket
+ * @xprt: transport
+ *
+ * Initiates a graceful shutdown of the TCP socket by calling the
+ * equivalent of shutdown(SHUT_WR);
+ */
+static void xs_tcp_shutdown(struct rpc_xprt *xprt)
+{
+       struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+       struct socket *sock = transport->sock;
+
+       if (sock != NULL)
+               kernel_sock_shutdown(sock, SHUT_WR);
+}
+
 static inline void xs_encode_tcp_record_marker(struct xdr_buf *buf)
 {
        u32 reclen = buf->len - sizeof(rpc_fraghdr);
@@ -640,7 +601,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
        struct xdr_buf *xdr = &req->rq_snd_buf;
        int status;
-       unsigned int retry = 0;
 
        xs_encode_tcp_record_marker(&req->rq_snd_buf);
 
@@ -652,7 +612,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
         * to cope with writespace callbacks arriving _after_ we have
         * called sendmsg(). */
        while (1) {
-               req->rq_xtime = jiffies;
                status = xs_sendpages(transport->sock,
                                        NULL, 0, xdr, req->rq_bytes_sent);
 
@@ -665,32 +624,35 @@ static int xs_tcp_send_request(struct rpc_task *task)
                /* If we've sent the entire packet, immediately
                 * reset the count of bytes sent. */
                req->rq_bytes_sent += status;
-               task->tk_bytes_sent += status;
+               req->rq_xmit_bytes_sent += status;
                if (likely(req->rq_bytes_sent >= req->rq_slen)) {
                        req->rq_bytes_sent = 0;
                        return 0;
                }
 
+               if (status != 0)
+                       continue;
                status = -EAGAIN;
-               if (retry++ > XS_SENDMSG_RETRY)
-                       break;
+               break;
        }
 
        switch (status) {
-       case -EAGAIN:
-               xs_nospace(task);
-               break;
-       case -ECONNREFUSED:
-       case -ECONNRESET:
-       case -ENOTCONN:
-       case -EPIPE:
+       case -ENOTSOCK:
                status = -ENOTCONN;
+               /* Should we call xs_close() here? */
+               break;
+       case -EAGAIN:
+               status = xs_nospace(task);
                break;
        default:
                dprintk("RPC:       sendmsg returned unrecognized error %d\n",
                        -status);
-               xprt_disconnect(xprt);
-               break;
+       case -ECONNRESET:
+       case -EPIPE:
+               xs_tcp_shutdown(xprt);
+       case -ECONNREFUSED:
+       case -ENOTCONN:
+               clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
        }
 
        return status;
@@ -723,41 +685,77 @@ out_release:
        xprt_release_xprt(xprt, task);
 }
 
-/**
- * xs_close - close a socket
- * @xprt: transport
- *
- * This is used when all requests are complete; ie, no DRC state remains
- * on the server we want to save.
- */
-static void xs_close(struct rpc_xprt *xprt)
+static void xs_save_old_callbacks(struct sock_xprt *transport, struct sock *sk)
+{
+       transport->old_data_ready = sk->sk_data_ready;
+       transport->old_state_change = sk->sk_state_change;
+       transport->old_write_space = sk->sk_write_space;
+       transport->old_error_report = sk->sk_error_report;
+}
+
+static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *sk)
+{
+       sk->sk_data_ready = transport->old_data_ready;
+       sk->sk_state_change = transport->old_state_change;
+       sk->sk_write_space = transport->old_write_space;
+       sk->sk_error_report = transport->old_error_report;
+}
+
+static void xs_reset_transport(struct sock_xprt *transport)
 {
-       struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
        struct socket *sock = transport->sock;
        struct sock *sk = transport->inet;
 
-       if (!sk)
-               goto clear_close_wait;
-
-       dprintk("RPC:       xs_close xprt %p\n", xprt);
+       if (sk == NULL)
+               return;
 
        write_lock_bh(&sk->sk_callback_lock);
        transport->inet = NULL;
        transport->sock = NULL;
 
        sk->sk_user_data = NULL;
-       sk->sk_data_ready = transport->old_data_ready;
-       sk->sk_state_change = transport->old_state_change;
-       sk->sk_write_space = transport->old_write_space;
+
+       xs_restore_old_callbacks(transport, sk);
        write_unlock_bh(&sk->sk_callback_lock);
 
        sk->sk_no_check = 0;
 
        sock_release(sock);
-clear_close_wait:
+}
+
+/**
+ * xs_close - close a socket
+ * @xprt: transport
+ *
+ * This is used when all requests are complete; ie, no DRC state remains
+ * on the server we want to save.
+ *
+ * The caller _must_ be holding XPRT_LOCKED in order to avoid issues with
+ * xs_reset_transport() zeroing the socket from underneath a writer.
+ */
+static void xs_close(struct rpc_xprt *xprt)
+{
+       struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+
+       dprintk("RPC:       xs_close xprt %p\n", xprt);
+
+       xs_reset_transport(transport);
+       xprt->reestablish_timeout = 0;
+
        smp_mb__before_clear_bit();
+       clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
        clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
+       clear_bit(XPRT_CLOSING, &xprt->state);
        smp_mb__after_clear_bit();
+       xprt_disconnect_done(xprt);
+}
+
+static void xs_tcp_close(struct rpc_xprt *xprt)
+{
+       if (test_and_clear_bit(XPRT_CONNECTION_CLOSE, &xprt->state))
+               xs_close(xprt);
+       else
+               xs_tcp_shutdown(xprt);
 }
 
 /**
@@ -773,7 +771,6 @@ static void xs_destroy(struct rpc_xprt *xprt)
 
        cancel_rearming_delayed_work(&transport->connect_worker);
 
-       xprt_disconnect(xprt);
        xs_close(xprt);
        xs_free_peer_addresses(xprt);
        kfree(xprt->slot);
@@ -836,14 +833,17 @@ static void xs_udp_data_ready(struct sock *sk, int len)
                copied = repsize;
 
        /* Suck it into the iovec, verify checksum if not done by hw. */
-       if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb))
+       if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb)) {
+               UDPX_INC_STATS_BH(sk, UDP_MIB_INERRORS);
                goto out_unlock;
+       }
+
+       UDPX_INC_STATS_BH(sk, UDP_MIB_INDATAGRAMS);
 
        /* Something worked... */
-       dst_confirm(skb->dst);
+       dst_confirm(skb_dst(skb));
 
        xprt_adjust_cwnd(task, copied);
-       xprt_update_rtt(task);
        xprt_complete_rqst(task, copied);
 
  out_unlock:
@@ -878,9 +878,9 @@ static inline void xs_tcp_read_fraghdr(struct rpc_xprt *xprt, struct xdr_skb_rea
        transport->tcp_offset = 0;
 
        /* Sanity check of the record length */
-       if (unlikely(transport->tcp_reclen < 4)) {
+       if (unlikely(transport->tcp_reclen < 8)) {
                dprintk("RPC:       invalid TCP record fragment length\n");
-               xprt_disconnect(xprt);
+               xprt_force_disconnect(xprt);
                return;
        }
        dprintk("RPC:       reading TCP record fragment of length %d\n",
@@ -913,33 +913,77 @@ static inline void xs_tcp_read_xid(struct sock_xprt *transport, struct xdr_skb_r
        if (used != len)
                return;
        transport->tcp_flags &= ~TCP_RCV_COPY_XID;
-       transport->tcp_flags |= TCP_RCV_COPY_DATA;
+       transport->tcp_flags |= TCP_RCV_READ_CALLDIR;
        transport->tcp_copied = 4;
-       dprintk("RPC:       reading reply for XID %08x\n",
+       dprintk("RPC:       reading %s XID %08x\n",
+                       (transport->tcp_flags & TCP_RPC_REPLY) ? "reply for"
+                                                             : "request with",
                        ntohl(transport->tcp_xid));
        xs_tcp_check_fraghdr(transport);
 }
 
-static inline void xs_tcp_read_request(struct rpc_xprt *xprt, struct xdr_skb_reader *desc)
+static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
+                                      struct xdr_skb_reader *desc)
 {
-       struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
-       struct rpc_rqst *req;
+       size_t len, used;
+       u32 offset;
+       __be32  calldir;
+
+       /*
+        * We want transport->tcp_offset to be 8 at the end of this routine
+        * (4 bytes for the xid and 4 bytes for the call/reply flag).
+        * When this function is called for the first time,
+        * transport->tcp_offset is 4 (after having already read the xid).
+        */
+       offset = transport->tcp_offset - sizeof(transport->tcp_xid);
+       len = sizeof(calldir) - offset;
+       dprintk("RPC:       reading CALL/REPLY flag (%Zu bytes)\n", len);
+       used = xdr_skb_read_bits(desc, &calldir, len);
+       transport->tcp_offset += used;
+       if (used != len)
+               return;
+       transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR;
+       transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
+       transport->tcp_flags |= TCP_RCV_COPY_DATA;
+       /*
+        * We don't yet have the XDR buffer, so we will write the calldir
+        * out after we get the buffer from the 'struct rpc_rqst'
+        */
+       if (ntohl(calldir) == RPC_REPLY)
+               transport->tcp_flags |= TCP_RPC_REPLY;
+       else
+               transport->tcp_flags &= ~TCP_RPC_REPLY;
+       dprintk("RPC:       reading %s CALL/REPLY flag %08x\n",
+                       (transport->tcp_flags & TCP_RPC_REPLY) ?
+                               "reply for" : "request with", calldir);
+       xs_tcp_check_fraghdr(transport);
+}
+
+static inline void xs_tcp_read_common(struct rpc_xprt *xprt,
+                                    struct xdr_skb_reader *desc,
+                                    struct rpc_rqst *req)
+{
+       struct sock_xprt *transport =
+                               container_of(xprt, struct sock_xprt, xprt);
        struct xdr_buf *rcvbuf;
        size_t len;
        ssize_t r;
 
-       /* Find and lock the request corresponding to this xid */
-       spin_lock(&xprt->transport_lock);
-       req = xprt_lookup_rqst(xprt, transport->tcp_xid);
-       if (!req) {
-               transport->tcp_flags &= ~TCP_RCV_COPY_DATA;
-               dprintk("RPC:       XID %08x request not found!\n",
-                               ntohl(transport->tcp_xid));
-               spin_unlock(&xprt->transport_lock);
-               return;
+       rcvbuf = &req->rq_private_buf;
+
+       if (transport->tcp_flags & TCP_RCV_COPY_CALLDIR) {
+               /*
+                * Save the RPC direction in the XDR buffer
+                */
+               __be32  calldir = transport->tcp_flags & TCP_RPC_REPLY ?
+                                       htonl(RPC_REPLY) : 0;
+
+               memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied,
+                       &calldir, sizeof(calldir));
+               transport->tcp_copied += sizeof(calldir);
+               transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR;
        }
 
-       rcvbuf = &req->rq_private_buf;
        len = desc->count;
        if (len > transport->tcp_reclen - transport->tcp_offset) {
                struct xdr_skb_reader my_desc;
@@ -976,7 +1020,7 @@ static inline void xs_tcp_read_request(struct rpc_xprt *xprt, struct xdr_skb_rea
                                "tcp_offset = %u, tcp_reclen = %u\n",
                                xprt, transport->tcp_copied,
                                transport->tcp_offset, transport->tcp_reclen);
-               goto out;
+               return;
        }
 
        dprintk("RPC:       XID %08x read %Zd bytes\n",
@@ -991,12 +1035,124 @@ static inline void xs_tcp_read_request(struct rpc_xprt *xprt, struct xdr_skb_rea
                if (transport->tcp_flags & TCP_RCV_LAST_FRAG)
                        transport->tcp_flags &= ~TCP_RCV_COPY_DATA;
        }
+}
+
+/*
+ * Finds the request corresponding to the RPC xid and invokes the common
+ * tcp read code to read the data.
+ */
+static inline int xs_tcp_read_reply(struct rpc_xprt *xprt,
+                                   struct xdr_skb_reader *desc)
+{
+       struct sock_xprt *transport =
+                               container_of(xprt, struct sock_xprt, xprt);
+       struct rpc_rqst *req;
+
+       dprintk("RPC:       read reply XID %08x\n", ntohl(transport->tcp_xid));
+
+       /* Find and lock the request corresponding to this xid */
+       spin_lock(&xprt->transport_lock);
+       req = xprt_lookup_rqst(xprt, transport->tcp_xid);
+       if (!req) {
+               dprintk("RPC:       XID %08x request not found!\n",
+                               ntohl(transport->tcp_xid));
+               spin_unlock(&xprt->transport_lock);
+               return -1;
+       }
+
+       xs_tcp_read_common(xprt, desc, req);
 
-out:
        if (!(transport->tcp_flags & TCP_RCV_COPY_DATA))
                xprt_complete_rqst(req->rq_task, transport->tcp_copied);
+
        spin_unlock(&xprt->transport_lock);
-       xs_tcp_check_fraghdr(transport);
+       return 0;
+}
+
+#if defined(CONFIG_NFS_V4_1)
+/*
+ * Obtains an rpc_rqst previously allocated and invokes the common
+ * tcp read code to read the data.  The result is placed in the callback
+ * queue.
+ * If we're unable to obtain the rpc_rqst we schedule the closing of the
+ * connection and return -1.
+ */
+static inline int xs_tcp_read_callback(struct rpc_xprt *xprt,
+                                      struct xdr_skb_reader *desc)
+{
+       struct sock_xprt *transport =
+                               container_of(xprt, struct sock_xprt, xprt);
+       struct rpc_rqst *req;
+
+       req = xprt_alloc_bc_request(xprt);
+       if (req == NULL) {
+               printk(KERN_WARNING "Callback slot table overflowed\n");
+               xprt_force_disconnect(xprt);
+               return -1;
+       }
+
+       req->rq_xid = transport->tcp_xid;
+       dprintk("RPC:       read callback  XID %08x\n", ntohl(req->rq_xid));
+       xs_tcp_read_common(xprt, desc, req);
+
+       if (!(transport->tcp_flags & TCP_RCV_COPY_DATA)) {
+               struct svc_serv *bc_serv = xprt->bc_serv;
+
+               /*
+                * Add callback request to callback list.  The callback
+                * service sleeps on the sv_cb_waitq waiting for new
+                * requests.  Wake it up after adding enqueing the
+                * request.
+                */
+               dprintk("RPC:       add callback request to list\n");
+               spin_lock(&bc_serv->sv_cb_lock);
+               list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
+               spin_unlock(&bc_serv->sv_cb_lock);
+               wake_up(&bc_serv->sv_cb_waitq);
+       }
+
+       req->rq_private_buf.len = transport->tcp_copied;
+
+       return 0;
+}
+
+static inline int _xs_tcp_read_data(struct rpc_xprt *xprt,
+                                       struct xdr_skb_reader *desc)
+{
+       struct sock_xprt *transport =
+                               container_of(xprt, struct sock_xprt, xprt);
+
+       return (transport->tcp_flags & TCP_RPC_REPLY) ?
+               xs_tcp_read_reply(xprt, desc) :
+               xs_tcp_read_callback(xprt, desc);
+}
+#else
+static inline int _xs_tcp_read_data(struct rpc_xprt *xprt,
+                                       struct xdr_skb_reader *desc)
+{
+       return xs_tcp_read_reply(xprt, desc);
+}
+#endif /* CONFIG_NFS_V4_1 */
+
+/*
+ * Read data off the transport.  This can be either an RPC_CALL or an
+ * RPC_REPLY.  Relay the processing to helper functions.
+ */
+static void xs_tcp_read_data(struct rpc_xprt *xprt,
+                                   struct xdr_skb_reader *desc)
+{
+       struct sock_xprt *transport =
+                               container_of(xprt, struct sock_xprt, xprt);
+
+       if (_xs_tcp_read_data(xprt, desc) == 0)
+               xs_tcp_check_fraghdr(transport);
+       else {
+               /*
+                * The transport_lock protects the request handling.
+                * There's no need to hold it to update the tcp_flags.
+                */
+               transport->tcp_flags &= ~TCP_RCV_COPY_DATA;
+       }
 }
 
 static inline void xs_tcp_read_discard(struct sock_xprt *transport, struct xdr_skb_reader *desc)
@@ -1036,9 +1192,14 @@ static int xs_tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb, uns
                        xs_tcp_read_xid(transport, &desc);
                        continue;
                }
+               /* Read in the call/reply flag */
+               if (transport->tcp_flags & TCP_RCV_READ_CALLDIR) {
+                       xs_tcp_read_calldir(transport, &desc);
+                       continue;
+               }
                /* Read in the request data */
                if (transport->tcp_flags & TCP_RCV_COPY_DATA) {
-                       xs_tcp_read_request(xprt, &desc);
+                       xs_tcp_read_data(xprt, &desc);
                        continue;
                }
                /* Skip over any trailing bytes on short reads */
@@ -1058,6 +1219,7 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
 {
        struct rpc_xprt *xprt;
        read_descriptor_t rd_desc;
+       int read;
 
        dprintk("RPC:       xs_tcp_data_ready...\n");
 
@@ -1067,27 +1229,76 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
        if (xprt->shutdown)
                goto out;
 
+       /* Any data means we had a useful conversation, so
+        * the we don't need to delay the next reconnect
+        */
+       if (xprt->reestablish_timeout)
+               xprt->reestablish_timeout = 0;
+
        /* We use rd_desc to pass struct xprt to xs_tcp_data_recv */
        rd_desc.arg.data = xprt;
-       rd_desc.count = 65536;
-       tcp_read_sock(sk, &rd_desc, xs_tcp_data_recv);
+       do {
+               rd_desc.count = 65536;
+               read = tcp_read_sock(sk, &rd_desc, xs_tcp_data_recv);
+       } while (read > 0);
 out:
        read_unlock(&sk->sk_callback_lock);
 }
 
-/**
- * xs_tcp_state_change - callback to handle TCP socket state changes
- * @sk: socket whose state has changed
- *
+/*
+ * Do the equivalent of linger/linger2 handling for dealing with
+ * broken servers that don't close the socket in a timely
+ * fashion
  */
-static void xs_tcp_state_change(struct sock *sk)
+static void xs_tcp_schedule_linger_timeout(struct rpc_xprt *xprt,
+               unsigned long timeout)
 {
-       struct rpc_xprt *xprt;
+       struct sock_xprt *transport;
 
-       read_lock(&sk->sk_callback_lock);
-       if (!(xprt = xprt_from_sock(sk)))
-               goto out;
-       dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
+       if (xprt_test_and_set_connecting(xprt))
+               return;
+       set_bit(XPRT_CONNECTION_ABORT, &xprt->state);
+       transport = container_of(xprt, struct sock_xprt, xprt);
+       queue_delayed_work(rpciod_workqueue, &transport->connect_worker,
+                          timeout);
+}
+
+static void xs_tcp_cancel_linger_timeout(struct rpc_xprt *xprt)
+{
+       struct sock_xprt *transport;
+
+       transport = container_of(xprt, struct sock_xprt, xprt);
+
+       if (!test_bit(XPRT_CONNECTION_ABORT, &xprt->state) ||
+           !cancel_delayed_work(&transport->connect_worker))
+               return;
+       clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
+       xprt_clear_connecting(xprt);
+}
+
+static void xs_sock_mark_closed(struct rpc_xprt *xprt)
+{
+       smp_mb__before_clear_bit();
+       clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
+       clear_bit(XPRT_CLOSING, &xprt->state);
+       smp_mb__after_clear_bit();
+       /* Mark transport as closed and wake up all pending tasks */
+       xprt_disconnect_done(xprt);
+}
+
+/**
+ * xs_tcp_state_change - callback to handle TCP socket state changes
+ * @sk: socket whose state has changed
+ *
+ */
+static void xs_tcp_state_change(struct sock *sk)
+{
+       struct rpc_xprt *xprt;
+
+       read_lock(&sk->sk_callback_lock);
+       if (!(xprt = xprt_from_sock(sk)))
+               goto out;
+       dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
        dprintk("RPC:       state %x conn %d dead %d zapped %d\n",
                        sk->sk_state, xprt_connected(xprt),
                        sock_flag(sk, SOCK_DEAD),
@@ -1107,27 +1318,86 @@ static void xs_tcp_state_change(struct sock *sk)
                        transport->tcp_flags =
                                TCP_RCV_COPY_FRAGHDR | TCP_RCV_COPY_XID;
 
-                       xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
-                       xprt_wake_pending_tasks(xprt, 0);
+                       xprt_wake_pending_tasks(xprt, -EAGAIN);
                }
                spin_unlock_bh(&xprt->transport_lock);
                break;
-       case TCP_SYN_SENT:
-       case TCP_SYN_RECV:
+       case TCP_FIN_WAIT1:
+               /* The client initiated a shutdown of the socket */
+               xprt->connect_cookie++;
+               xprt->reestablish_timeout = 0;
+               set_bit(XPRT_CLOSING, &xprt->state);
+               smp_mb__before_clear_bit();
+               clear_bit(XPRT_CONNECTED, &xprt->state);
+               clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
+               smp_mb__after_clear_bit();
+               xs_tcp_schedule_linger_timeout(xprt, xs_tcp_fin_timeout);
                break;
        case TCP_CLOSE_WAIT:
-               /* Try to schedule an autoclose RPC calls */
-               set_bit(XPRT_CLOSE_WAIT, &xprt->state);
-               if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
-                       queue_work(rpciod_workqueue, &xprt->task_cleanup);
-       default:
-               xprt_disconnect(xprt);
+               /* The server initiated a shutdown of the socket */
+               xprt_force_disconnect(xprt);
+       case TCP_SYN_SENT:
+               xprt->connect_cookie++;
+       case TCP_CLOSING:
+               /*
+                * If the server closed down the connection, make sure that
+                * we back off before reconnecting
+                */
+               if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+                       xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+               break;
+       case TCP_LAST_ACK:
+               set_bit(XPRT_CLOSING, &xprt->state);
+               xs_tcp_schedule_linger_timeout(xprt, xs_tcp_fin_timeout);
+               smp_mb__before_clear_bit();
+               clear_bit(XPRT_CONNECTED, &xprt->state);
+               smp_mb__after_clear_bit();
+               break;
+       case TCP_CLOSE:
+               xs_tcp_cancel_linger_timeout(xprt);
+               xs_sock_mark_closed(xprt);
        }
  out:
        read_unlock(&sk->sk_callback_lock);
 }
 
 /**
+ * xs_error_report - callback mainly for catching socket errors
+ * @sk: socket
+ */
+static void xs_error_report(struct sock *sk)
+{
+       struct rpc_xprt *xprt;
+
+       read_lock(&sk->sk_callback_lock);
+       if (!(xprt = xprt_from_sock(sk)))
+               goto out;
+       dprintk("RPC:       %s client %p...\n"
+                       "RPC:       error %d\n",
+                       __func__, xprt, sk->sk_err);
+       xprt_wake_pending_tasks(xprt, -EAGAIN);
+out:
+       read_unlock(&sk->sk_callback_lock);
+}
+
+static void xs_write_space(struct sock *sk)
+{
+       struct socket *sock;
+       struct rpc_xprt *xprt;
+
+       if (unlikely(!(sock = sk->sk_socket)))
+               return;
+       clear_bit(SOCK_NOSPACE, &sock->flags);
+
+       if (unlikely(!(xprt = xprt_from_sock(sk))))
+               return;
+       if (test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags) == 0)
+               return;
+
+       xprt_write_space(xprt);
+}
+
+/**
  * xs_udp_write_space - callback invoked when socket buffer space
  *                             becomes available
  * @sk: socket whose state has changed
@@ -1142,21 +1412,9 @@ static void xs_udp_write_space(struct sock *sk)
        read_lock(&sk->sk_callback_lock);
 
        /* from net/core/sock.c:sock_def_write_space */
-       if (sock_writeable(sk)) {
-               struct socket *sock;
-               struct rpc_xprt *xprt;
-
-               if (unlikely(!(sock = sk->sk_socket)))
-                       goto out;
-               if (unlikely(!(xprt = xprt_from_sock(sk))))
-                       goto out;
-               if (unlikely(!test_and_clear_bit(SOCK_NOSPACE, &sock->flags)))
-                       goto out;
-
-               xprt_write_space(xprt);
-       }
+       if (sock_writeable(sk))
+               xs_write_space(sk);
 
- out:
        read_unlock(&sk->sk_callback_lock);
 }
 
@@ -1175,21 +1433,9 @@ static void xs_tcp_write_space(struct sock *sk)
        read_lock(&sk->sk_callback_lock);
 
        /* from net/core/stream.c:sk_stream_write_space */
-       if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk)) {
-               struct socket *sock;
-               struct rpc_xprt *xprt;
+       if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
+               xs_write_space(sk);
 
-               if (unlikely(!(sock = sk->sk_socket)))
-                       goto out;
-               if (unlikely(!(xprt = xprt_from_sock(sk))))
-                       goto out;
-               if (unlikely(!test_and_clear_bit(SOCK_NOSPACE, &sock->flags)))
-                       goto out;
-
-               xprt_write_space(xprt);
-       }
-
- out:
        read_unlock(&sk->sk_callback_lock);
 }
 
@@ -1257,20 +1503,30 @@ static unsigned short xs_get_random_port(void)
  */
 static void xs_set_port(struct rpc_xprt *xprt, unsigned short port)
 {
-       struct sockaddr *addr = xs_addr(xprt);
-
        dprintk("RPC:       setting port for xprt %p to %u\n", xprt, port);
 
-       switch (addr->sa_family) {
-       case AF_INET:
-               ((struct sockaddr_in *)addr)->sin_port = htons(port);
-               break;
-       case AF_INET6:
-               ((struct sockaddr_in6 *)addr)->sin6_port = htons(port);
-               break;
-       default:
-               BUG();
-       }
+       rpc_set_port(xs_addr(xprt), port);
+       xs_update_peer_port(xprt);
+}
+
+static unsigned short xs_get_srcport(struct sock_xprt *transport, struct socket *sock)
+{
+       unsigned short port = transport->srcport;
+
+       if (port == 0 && transport->xprt.resvport)
+               port = xs_get_random_port();
+       return port;
+}
+
+static unsigned short xs_next_srcport(struct sock_xprt *transport, struct socket *sock, unsigned short port)
+{
+       if (transport->srcport != 0)
+               transport->srcport = 0;
+       if (!transport->xprt.resvport)
+               return 0;
+       if (port <= xprt_min_resvport || port > xprt_max_resvport)
+               return xprt_max_resvport;
+       return --port;
 }
 
 static int xs_bind4(struct sock_xprt *transport, struct socket *sock)
@@ -1279,30 +1535,29 @@ static int xs_bind4(struct sock_xprt *transport, struct socket *sock)
                .sin_family = AF_INET,
        };
        struct sockaddr_in *sa;
-       int err;
-       unsigned short port = transport->port;
+       int err, nloop = 0;
+       unsigned short port = xs_get_srcport(transport, sock);
+       unsigned short last;
 
-       if (!transport->xprt.resvport)
-               port = 0;
-       sa = (struct sockaddr_in *)&transport->addr;
+       sa = (struct sockaddr_in *)&transport->srcaddr;
        myaddr.sin_addr = sa->sin_addr;
        do {
                myaddr.sin_port = htons(port);
                err = kernel_bind(sock, (struct sockaddr *) &myaddr,
                                                sizeof(myaddr));
-               if (!transport->xprt.resvport)
+               if (port == 0)
                        break;
                if (err == 0) {
-                       transport->port = port;
+                       transport->srcport = port;
                        break;
                }
-               if (port <= xprt_min_resvport)
-                       port = xprt_max_resvport;
-               else
-                       port--;
-       } while (err == -EADDRINUSE && port != transport->port);
-       dprintk("RPC:       %s "NIPQUAD_FMT":%u: %s (%d)\n",
-                       __FUNCTION__, NIPQUAD(myaddr.sin_addr),
+               last = port;
+               port = xs_next_srcport(transport, sock, port);
+               if (port > last)
+                       nloop++;
+       } while (err == -EADDRINUSE && nloop != 2);
+       dprintk("RPC:       %s %pI4:%u: %s (%d)\n",
+                       __func__, &myaddr.sin_addr,
                        port, err ? "failed" : "ok", err);
        return err;
 }
@@ -1313,30 +1568,29 @@ static int xs_bind6(struct sock_xprt *transport, struct socket *sock)
                .sin6_family = AF_INET6,
        };
        struct sockaddr_in6 *sa;
-       int err;
-       unsigned short port = transport->port;
+       int err, nloop = 0;
+       unsigned short port = xs_get_srcport(transport, sock);
+       unsigned short last;
 
-       if (!transport->xprt.resvport)
-               port = 0;
-       sa = (struct sockaddr_in6 *)&transport->addr;
+       sa = (struct sockaddr_in6 *)&transport->srcaddr;
        myaddr.sin6_addr = sa->sin6_addr;
        do {
                myaddr.sin6_port = htons(port);
                err = kernel_bind(sock, (struct sockaddr *) &myaddr,
                                                sizeof(myaddr));
-               if (!transport->xprt.resvport)
+               if (port == 0)
                        break;
                if (err == 0) {
-                       transport->port = port;
+                       transport->srcport = port;
                        break;
                }
-               if (port <= xprt_min_resvport)
-                       port = xprt_max_resvport;
-               else
-                       port--;
-       } while (err == -EADDRINUSE && port != transport->port);
-       dprintk("RPC:       xs_bind6 "NIP6_FMT":%u: %s (%d)\n",
-               NIP6(myaddr.sin6_addr), port, err ? "failed" : "ok", err);
+               last = port;
+               port = xs_next_srcport(transport, sock, port);
+               if (port > last)
+                       nloop++;
+       } while (err == -EADDRINUSE && nloop != 2);
+       dprintk("RPC:       xs_bind6 %pI6:%u: %s (%d)\n",
+               &myaddr.sin6_addr, port, err ? "failed" : "ok", err);
        return err;
 }
 
@@ -1348,7 +1602,7 @@ static inline void xs_reclassify_socket4(struct socket *sock)
 {
        struct sock *sk = sock->sk;
 
-       BUG_ON(sk->sk_lock.owner != NULL);
+       BUG_ON(sock_owned_by_user(sk));
        sock_lock_init_class_and_name(sk, "slock-AF_INET-RPC",
                &xs_slock_key[0], "sk_lock-AF_INET-RPC", &xs_key[0]);
 }
@@ -1357,7 +1611,7 @@ static inline void xs_reclassify_socket6(struct socket *sock)
 {
        struct sock *sk = sock->sk;
 
-       BUG_ON(sk->sk_lock.owner != NULL);
+       BUG_ON(sock_owned_by_user(sk));
        sock_lock_init_class_and_name(sk, "slock-AF_INET6-RPC",
                &xs_slock_key[1], "sk_lock-AF_INET6-RPC", &xs_key[1]);
 }
@@ -1380,12 +1634,12 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 
                write_lock_bh(&sk->sk_callback_lock);
 
+               xs_save_old_callbacks(transport, sk);
+
                sk->sk_user_data = xprt;
-               transport->old_data_ready = sk->sk_data_ready;
-               transport->old_state_change = sk->sk_state_change;
-               transport->old_write_space = sk->sk_write_space;
                sk->sk_data_ready = xs_udp_data_ready;
                sk->sk_write_space = xs_udp_write_space;
+               sk->sk_error_report = xs_error_report;
                sk->sk_no_check = UDP_CSUM_NORCV;
                sk->sk_allocation = GFP_ATOMIC;
 
@@ -1414,13 +1668,14 @@ static void xs_udp_connect_worker4(struct work_struct *work)
        struct socket *sock = transport->sock;
        int err, status = -EIO;
 
-       if (xprt->shutdown || !xprt_bound(xprt))
+       if (xprt->shutdown)
                goto out;
 
        /* Start by resetting any existing state */
-       xs_close(xprt);
+       xs_reset_transport(transport);
 
-       if ((err = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock)) < 0) {
+       err = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
+       if (err < 0) {
                dprintk("RPC:       can't create UDP transport socket (%d).\n", -err);
                goto out;
        }
@@ -1431,14 +1686,17 @@ static void xs_udp_connect_worker4(struct work_struct *work)
                goto out;
        }
 
-       dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                       xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+       dprintk("RPC:       worker connecting xprt %p via %s to "
+                               "%s (port %s)\n", xprt,
+                       xprt->address_strings[RPC_DISPLAY_PROTO],
+                       xprt->address_strings[RPC_DISPLAY_ADDR],
+                       xprt->address_strings[RPC_DISPLAY_PORT]);
 
        xs_udp_finish_connecting(xprt, sock);
        status = 0;
 out:
-       xprt_wake_pending_tasks(xprt, status);
        xprt_clear_connecting(xprt);
+       xprt_wake_pending_tasks(xprt, status);
 }
 
 /**
@@ -1455,13 +1713,14 @@ static void xs_udp_connect_worker6(struct work_struct *work)
        struct socket *sock = transport->sock;
        int err, status = -EIO;
 
-       if (xprt->shutdown || !xprt_bound(xprt))
+       if (xprt->shutdown)
                goto out;
 
        /* Start by resetting any existing state */
-       xs_close(xprt);
+       xs_reset_transport(transport);
 
-       if ((err = sock_create_kern(PF_INET6, SOCK_DGRAM, IPPROTO_UDP, &sock)) < 0) {
+       err = sock_create_kern(PF_INET6, SOCK_DGRAM, IPPROTO_UDP, &sock);
+       if (err < 0) {
                dprintk("RPC:       can't create UDP transport socket (%d).\n", -err);
                goto out;
        }
@@ -1472,24 +1731,26 @@ static void xs_udp_connect_worker6(struct work_struct *work)
                goto out;
        }
 
-       dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                       xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+       dprintk("RPC:       worker connecting xprt %p via %s to "
+                               "%s (port %s)\n", xprt,
+                       xprt->address_strings[RPC_DISPLAY_PROTO],
+                       xprt->address_strings[RPC_DISPLAY_ADDR],
+                       xprt->address_strings[RPC_DISPLAY_PORT]);
 
        xs_udp_finish_connecting(xprt, sock);
        status = 0;
 out:
-       xprt_wake_pending_tasks(xprt, status);
        xprt_clear_connecting(xprt);
+       xprt_wake_pending_tasks(xprt, status);
 }
 
 /*
  * We need to preserve the port number so the reply cache on the server can
  * find our cached RPC replies when we get around to reconnecting.
  */
-static void xs_tcp_reuse_connection(struct rpc_xprt *xprt)
+static void xs_abort_connection(struct rpc_xprt *xprt, struct sock_xprt *transport)
 {
        int result;
-       struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
        struct sockaddr any;
 
        dprintk("RPC:       disconnecting xprt %p to reuse port\n", xprt);
@@ -1501,11 +1762,24 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt)
        memset(&any, 0, sizeof(any));
        any.sa_family = AF_UNSPEC;
        result = kernel_connect(transport->sock, &any, sizeof(any), 0);
-       if (result)
+       if (!result)
+               xs_sock_mark_closed(xprt);
+       else
                dprintk("RPC:       AF_UNSPEC connect return code %d\n",
                                result);
 }
 
+static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *transport)
+{
+       unsigned int state = transport->inet->sk_state;
+
+       if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
+               return;
+       if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
+               return;
+       xs_abort_connection(xprt, transport);
+}
+
 static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 {
        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
@@ -1515,13 +1789,13 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 
                write_lock_bh(&sk->sk_callback_lock);
 
+               xs_save_old_callbacks(transport, sk);
+
                sk->sk_user_data = xprt;
-               transport->old_data_ready = sk->sk_data_ready;
-               transport->old_state_change = sk->sk_state_change;
-               transport->old_write_space = sk->sk_write_space;
                sk->sk_data_ready = xs_tcp_data_ready;
                sk->sk_state_change = xs_tcp_state_change;
                sk->sk_write_space = xs_tcp_write_space;
+               sk->sk_error_report = xs_error_report;
                sk->sk_allocation = GFP_ATOMIC;
 
                /* socket options */
@@ -1539,6 +1813,9 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                write_unlock_bh(&sk->sk_callback_lock);
        }
 
+       if (!xprt_bound(xprt))
+               return -ENOTCONN;
+
        /* Tell the socket layer to start connecting... */
        xprt->stat.connect_count++;
        xprt->stat.connect_start = jiffies;
@@ -1546,124 +1823,162 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 }
 
 /**
- * xs_tcp_connect_worker4 - connect a TCP socket to a remote endpoint
- * @work: RPC transport to connect
+ * xs_tcp_setup_socket - create a TCP socket and connect to a remote endpoint
+ * @xprt: RPC transport to connect
+ * @transport: socket transport to connect
+ * @create_sock: function to create a socket of the correct type
  *
  * Invoked by a work queue tasklet.
  */
-static void xs_tcp_connect_worker4(struct work_struct *work)
+static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
+               struct sock_xprt *transport,
+               struct socket *(*create_sock)(struct rpc_xprt *,
+                       struct sock_xprt *))
 {
-       struct sock_xprt *transport =
-               container_of(work, struct sock_xprt, connect_worker.work);
-       struct rpc_xprt *xprt = &transport->xprt;
        struct socket *sock = transport->sock;
-       int err, status = -EIO;
+       int status = -EIO;
 
-       if (xprt->shutdown || !xprt_bound(xprt))
+       if (xprt->shutdown)
                goto out;
 
        if (!sock) {
-               /* start from scratch */
-               if ((err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &sock)) < 0) {
-                       dprintk("RPC:       can't create TCP transport socket (%d).\n", -err);
+               clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
+               sock = create_sock(xprt, transport);
+               if (IS_ERR(sock)) {
+                       status = PTR_ERR(sock);
                        goto out;
                }
-               xs_reclassify_socket4(sock);
+       } else {
+               int abort_and_exit;
 
-               if (xs_bind4(transport, sock) < 0) {
-                       sock_release(sock);
-                       goto out;
-               }
-       } else
+               abort_and_exit = test_and_clear_bit(XPRT_CONNECTION_ABORT,
+                               &xprt->state);
                /* "close" the socket, preserving the local port */
-               xs_tcp_reuse_connection(xprt);
+               xs_tcp_reuse_connection(xprt, transport);
+
+               if (abort_and_exit)
+                       goto out_eagain;
+       }
 
-       dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                       xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+       dprintk("RPC:       worker connecting xprt %p via %s to "
+                               "%s (port %s)\n", xprt,
+                       xprt->address_strings[RPC_DISPLAY_PROTO],
+                       xprt->address_strings[RPC_DISPLAY_ADDR],
+                       xprt->address_strings[RPC_DISPLAY_PORT]);
 
        status = xs_tcp_finish_connecting(xprt, sock);
        dprintk("RPC:       %p connect status %d connected %d sock state %d\n",
                        xprt, -status, xprt_connected(xprt),
                        sock->sk->sk_state);
-       if (status < 0) {
-               switch (status) {
-                       case -EINPROGRESS:
-                       case -EALREADY:
-                               goto out_clear;
-                       case -ECONNREFUSED:
-                       case -ECONNRESET:
-                               /* retry with existing socket, after a delay */
-                               break;
-                       default:
-                               /* get rid of existing socket, and retry */
-                               xs_close(xprt);
-                               break;
-               }
+       switch (status) {
+       default:
+               printk("%s: connect returned unhandled error %d\n",
+                       __func__, status);
+       case -EADDRNOTAVAIL:
+               /* We're probably in TIME_WAIT. Get rid of existing socket,
+                * and retry
+                */
+               set_bit(XPRT_CONNECTION_CLOSE, &xprt->state);
+               xprt_force_disconnect(xprt);
+               break;
+       case -ECONNREFUSED:
+       case -ECONNRESET:
+       case -ENETUNREACH:
+               /* retry with existing socket, after a delay */
+       case 0:
+       case -EINPROGRESS:
+       case -EALREADY:
+               xprt_clear_connecting(xprt);
+               return;
+       case -EINVAL:
+               /* Happens, for instance, if the user specified a link
+                * local IPv6 address without a scope-id.
+                */
+               goto out;
        }
+out_eagain:
+       status = -EAGAIN;
 out:
-       xprt_wake_pending_tasks(xprt, status);
-out_clear:
        xprt_clear_connecting(xprt);
+       xprt_wake_pending_tasks(xprt, status);
+}
+
+static struct socket *xs_create_tcp_sock4(struct rpc_xprt *xprt,
+               struct sock_xprt *transport)
+{
+       struct socket *sock;
+       int err;
+
+       /* start from scratch */
+       err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &sock);
+       if (err < 0) {
+               dprintk("RPC:       can't create TCP transport socket (%d).\n",
+                               -err);
+               goto out_err;
+       }
+       xs_reclassify_socket4(sock);
+
+       if (xs_bind4(transport, sock) < 0) {
+               sock_release(sock);
+               goto out_err;
+       }
+       return sock;
+out_err:
+       return ERR_PTR(-EIO);
 }
 
 /**
- * xs_tcp_connect_worker6 - connect a TCP socket to a remote endpoint
+ * xs_tcp_connect_worker4 - connect a TCP socket to a remote endpoint
  * @work: RPC transport to connect
  *
  * Invoked by a work queue tasklet.
  */
-static void xs_tcp_connect_worker6(struct work_struct *work)
+static void xs_tcp_connect_worker4(struct work_struct *work)
 {
        struct sock_xprt *transport =
                container_of(work, struct sock_xprt, connect_worker.work);
        struct rpc_xprt *xprt = &transport->xprt;
-       struct socket *sock = transport->sock;
-       int err, status = -EIO;
 
-       if (xprt->shutdown || !xprt_bound(xprt))
-               goto out;
-
-       if (!sock) {
-               /* start from scratch */
-               if ((err = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &sock)) < 0) {
-                       dprintk("RPC:       can't create TCP transport socket (%d).\n", -err);
-                       goto out;
-               }
-               xs_reclassify_socket6(sock);
+       xs_tcp_setup_socket(xprt, transport, xs_create_tcp_sock4);
+}
 
-               if (xs_bind6(transport, sock) < 0) {
-                       sock_release(sock);
-                       goto out;
-               }
-       } else
-               /* "close" the socket, preserving the local port */
-               xs_tcp_reuse_connection(xprt);
+static struct socket *xs_create_tcp_sock6(struct rpc_xprt *xprt,
+               struct sock_xprt *transport)
+{
+       struct socket *sock;
+       int err;
 
-       dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                       xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+       /* start from scratch */
+       err = sock_create_kern(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &sock);
+       if (err < 0) {
+               dprintk("RPC:       can't create TCP transport socket (%d).\n",
+                               -err);
+               goto out_err;
+       }
+       xs_reclassify_socket6(sock);
 
-       status = xs_tcp_finish_connecting(xprt, sock);
-       dprintk("RPC:       %p connect status %d connected %d sock state %d\n",
-                       xprt, -status, xprt_connected(xprt), sock->sk->sk_state);
-       if (status < 0) {
-               switch (status) {
-                       case -EINPROGRESS:
-                       case -EALREADY:
-                               goto out_clear;
-                       case -ECONNREFUSED:
-                       case -ECONNRESET:
-                               /* retry with existing socket, after a delay */
-                               break;
-                       default:
-                               /* get rid of existing socket, and retry */
-                               xs_close(xprt);
-                               break;
-               }
+       if (xs_bind6(transport, sock) < 0) {
+               sock_release(sock);
+               goto out_err;
        }
-out:
-       xprt_wake_pending_tasks(xprt, status);
-out_clear:
-       xprt_clear_connecting(xprt);
+       return sock;
+out_err:
+       return ERR_PTR(-EIO);
+}
+
+/**
+ * xs_tcp_connect_worker6 - connect a TCP socket to a remote endpoint
+ * @work: RPC transport to connect
+ *
+ * Invoked by a work queue tasklet.
+ */
+static void xs_tcp_connect_worker6(struct work_struct *work)
+{
+       struct sock_xprt *transport =
+               container_of(work, struct sock_xprt, connect_worker.work);
+       struct rpc_xprt *xprt = &transport->xprt;
+
+       xs_tcp_setup_socket(xprt, transport, xs_create_tcp_sock6);
 }
 
 /**
@@ -1684,10 +1999,7 @@ static void xs_connect(struct rpc_task *task)
        struct rpc_xprt *xprt = task->tk_xprt;
        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
 
-       if (xprt_test_and_set_connecting(xprt))
-               return;
-
-       if (transport->sock != NULL) {
+       if (transport->sock != NULL && !RPC_IS_SOFTCONN(task)) {
                dprintk("RPC:       xs_connect delayed xprt %p for %lu "
                                "seconds\n",
                                xprt, xprt->reestablish_timeout / HZ);
@@ -1695,6 +2007,8 @@ static void xs_connect(struct rpc_task *task)
                                   &transport->connect_worker,
                                   xprt->reestablish_timeout);
                xprt->reestablish_timeout <<= 1;
+               if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+                       xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
                if (xprt->reestablish_timeout > XS_TCP_MAX_REEST_TO)
                        xprt->reestablish_timeout = XS_TCP_MAX_REEST_TO;
        } else {
@@ -1715,7 +2029,7 @@ static void xs_udp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
 
        seq_printf(seq, "\txprt:\tudp %u %lu %lu %lu %lu %Lu %Lu\n",
-                       transport->port,
+                       transport->srcport,
                        xprt->stat.bind_count,
                        xprt->stat.sends,
                        xprt->stat.recvs,
@@ -1739,7 +2053,7 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                idle_time = (long)(jiffies - xprt->last_used) / HZ;
 
        seq_printf(seq, "\txprt:\ttcp %u %lu %lu %lu %ld %lu %lu %lu %Lu %Lu\n",
-                       transport->port,
+                       transport->srcport,
                        xprt->stat.bind_count,
                        xprt->stat.connect_count,
                        xprt->stat.connect_time,
@@ -1751,6 +2065,132 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                        xprt->stat.bklog_u);
 }
 
+/*
+ * Allocate a bunch of pages for a scratch buffer for the rpc code. The reason
+ * we allocate pages instead doing a kmalloc like rpc_malloc is because we want
+ * to use the server side send routines.
+ */
+static void *bc_malloc(struct rpc_task *task, size_t size)
+{
+       struct page *page;
+       struct rpc_buffer *buf;
+
+       BUG_ON(size > PAGE_SIZE - sizeof(struct rpc_buffer));
+       page = alloc_page(GFP_KERNEL);
+
+       if (!page)
+               return NULL;
+
+       buf = page_address(page);
+       buf->len = PAGE_SIZE;
+
+       return buf->data;
+}
+
+/*
+ * Free the space allocated in the bc_alloc routine
+ */
+static void bc_free(void *buffer)
+{
+       struct rpc_buffer *buf;
+
+       if (!buffer)
+               return;
+
+       buf = container_of(buffer, struct rpc_buffer, data);
+       free_page((unsigned long)buf);
+}
+
+/*
+ * Use the svc_sock to send the callback. Must be called with svsk->sk_mutex
+ * held. Borrows heavily from svc_tcp_sendto and xs_tcp_send_request.
+ */
+static int bc_sendto(struct rpc_rqst *req)
+{
+       int len;
+       struct xdr_buf *xbufp = &req->rq_snd_buf;
+       struct rpc_xprt *xprt = req->rq_xprt;
+       struct sock_xprt *transport =
+                               container_of(xprt, struct sock_xprt, xprt);
+       struct socket *sock = transport->sock;
+       unsigned long headoff;
+       unsigned long tailoff;
+
+       /*
+        * Set up the rpc header and record marker stuff
+        */
+       xs_encode_tcp_record_marker(xbufp);
+
+       tailoff = (unsigned long)xbufp->tail[0].iov_base & ~PAGE_MASK;
+       headoff = (unsigned long)xbufp->head[0].iov_base & ~PAGE_MASK;
+       len = svc_send_common(sock, xbufp,
+                             virt_to_page(xbufp->head[0].iov_base), headoff,
+                             xbufp->tail[0].iov_base, tailoff);
+
+       if (len != xbufp->len) {
+               printk(KERN_NOTICE "Error sending entire callback!\n");
+               len = -EAGAIN;
+       }
+
+       return len;
+}
+
+/*
+ * The send routine. Borrows from svc_send
+ */
+static int bc_send_request(struct rpc_task *task)
+{
+       struct rpc_rqst *req = task->tk_rqstp;
+       struct svc_xprt *xprt;
+       struct svc_sock         *svsk;
+       u32                     len;
+
+       dprintk("sending request with xid: %08x\n", ntohl(req->rq_xid));
+       /*
+        * Get the server socket associated with this callback xprt
+        */
+       xprt = req->rq_xprt->bc_xprt;
+       svsk = container_of(xprt, struct svc_sock, sk_xprt);
+
+       /*
+        * Grab the mutex to serialize data as the connection is shared
+        * with the fore channel
+        */
+       if (!mutex_trylock(&xprt->xpt_mutex)) {
+               rpc_sleep_on(&xprt->xpt_bc_pending, task, NULL);
+               if (!mutex_trylock(&xprt->xpt_mutex))
+                       return -EAGAIN;
+               rpc_wake_up_queued_task(&xprt->xpt_bc_pending, task);
+       }
+       if (test_bit(XPT_DEAD, &xprt->xpt_flags))
+               len = -ENOTCONN;
+       else
+               len = bc_sendto(req);
+       mutex_unlock(&xprt->xpt_mutex);
+
+       if (len > 0)
+               len = 0;
+
+       return len;
+}
+
+/*
+ * The close routine. Since this is client initiated, we do nothing
+ */
+
+static void bc_close(struct rpc_xprt *xprt)
+{
+}
+
+/*
+ * The xprt destroy routine. Again, because this connection is client
+ * initiated, we do nothing
+ */
+
+static void bc_destroy(struct rpc_xprt *xprt)
+{
+}
+
 static struct rpc_xprt_ops xs_udp_ops = {
        .set_buffer_size        = xs_udp_set_buffer_size,
        .reserve_xprt           = xprt_reserve_xprt_cong,
@@ -1779,12 +2219,28 @@ static struct rpc_xprt_ops xs_tcp_ops = {
        .buf_free               = rpc_free,
        .send_request           = xs_tcp_send_request,
        .set_retrans_timeout    = xprt_set_retrans_timeout_def,
-       .close                  = xs_close,
+       .close                  = xs_tcp_close,
        .destroy                = xs_destroy,
        .print_stats            = xs_tcp_print_stats,
 };
 
-static struct rpc_xprt *xs_setup_xprt(struct rpc_xprtsock_create *args,
+/*
+ * The rpc_xprt_ops for the server backchannel
+ */
+
+static struct rpc_xprt_ops bc_tcp_ops = {
+       .reserve_xprt           = xprt_reserve_xprt,
+       .release_xprt           = xprt_release_xprt,
+       .buf_alloc              = bc_malloc,
+       .buf_free               = bc_free,
+       .send_request           = bc_send_request,
+       .set_retrans_timeout    = xprt_set_retrans_timeout_def,
+       .close                  = bc_close,
+       .destroy                = bc_destroy,
+       .print_stats            = xs_tcp_print_stats,
+};
+
+static struct rpc_xprt *xs_setup_xprt(struct xprt_create *args,
                                      unsigned int slot_table_size)
 {
        struct rpc_xprt *xprt;
@@ -1815,18 +2271,24 @@ static struct rpc_xprt *xs_setup_xprt(struct rpc_xprtsock_create *args,
        memcpy(&xprt->addr, args->dstaddr, args->addrlen);
        xprt->addrlen = args->addrlen;
        if (args->srcaddr)
-               memcpy(&new->addr, args->srcaddr, args->addrlen);
-       new->port = xs_get_random_port();
+               memcpy(&new->srcaddr, args->srcaddr, args->addrlen);
 
        return xprt;
 }
 
+static const struct rpc_timeout xs_udp_default_timeout = {
+       .to_initval = 5 * HZ,
+       .to_maxval = 30 * HZ,
+       .to_increment = 5 * HZ,
+       .to_retries = 5,
+};
+
 /**
  * xs_setup_udp - Set up transport to use a UDP socket
  * @args: rpc transport creation arguments
  *
  */
-struct rpc_xprt *xs_setup_udp(struct rpc_xprtsock_create *args)
+static struct rpc_xprt *xs_setup_udp(struct xprt_create *args)
 {
        struct sockaddr *addr = args->dstaddr;
        struct rpc_xprt *xprt;
@@ -1843,16 +2305,12 @@ struct rpc_xprt *xs_setup_udp(struct rpc_xprtsock_create *args)
        xprt->max_payload = (1U << 16) - (MAX_HEADER << 3);
 
        xprt->bind_timeout = XS_BIND_TO;
-       xprt->connect_timeout = XS_UDP_CONN_TO;
        xprt->reestablish_timeout = XS_UDP_REEST_TO;
        xprt->idle_timeout = XS_IDLE_DISC_TO;
 
        xprt->ops = &xs_udp_ops;
 
-       if (args->timeout)
-               xprt->timeout = *args->timeout;
-       else
-               xprt_set_timeout(&xprt->timeout, 5, 5 * HZ);
+       xprt->timeout = &xs_udp_default_timeout;
 
        switch (addr->sa_family) {
        case AF_INET:
@@ -1861,7 +2319,7 @@ struct rpc_xprt *xs_setup_udp(struct rpc_xprtsock_create *args)
 
                INIT_DELAYED_WORK(&transport->connect_worker,
                                        xs_udp_connect_worker4);
-               xs_format_ipv4_peer_addresses(xprt);
+               xs_format_peer_addresses(xprt, "udp", RPCBIND_NETID_UDP);
                break;
        case AF_INET6:
                if (((struct sockaddr_in6 *)addr)->sin6_port != htons(0))
@@ -1869,15 +2327,22 @@ struct rpc_xprt *xs_setup_udp(struct rpc_xprtsock_create *args)
 
                INIT_DELAYED_WORK(&transport->connect_worker,
                                        xs_udp_connect_worker6);
-               xs_format_ipv6_peer_addresses(xprt);
+               xs_format_peer_addresses(xprt, "udp", RPCBIND_NETID_UDP6);
                break;
        default:
                kfree(xprt);
                return ERR_PTR(-EAFNOSUPPORT);
        }
 
-       dprintk("RPC:       set up transport to address %s\n",
-                       xprt->address_strings[RPC_DISPLAY_ALL]);
+       if (xprt_bound(xprt))
+               dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                               xprt->address_strings[RPC_DISPLAY_ADDR],
+                               xprt->address_strings[RPC_DISPLAY_PORT],
+                               xprt->address_strings[RPC_DISPLAY_PROTO]);
+       else
+               dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                               xprt->address_strings[RPC_DISPLAY_ADDR],
+                               xprt->address_strings[RPC_DISPLAY_PROTO]);
 
        if (try_module_get(THIS_MODULE))
                return xprt;
@@ -1887,12 +2352,18 @@ struct rpc_xprt *xs_setup_udp(struct rpc_xprtsock_create *args)
        return ERR_PTR(-EINVAL);
 }
 
+static const struct rpc_timeout xs_tcp_default_timeout = {
+       .to_initval = 60 * HZ,
+       .to_maxval = 60 * HZ,
+       .to_retries = 2,
+};
+
 /**
  * xs_setup_tcp - Set up transport to use a TCP socket
  * @args: rpc transport creation arguments
  *
  */
-struct rpc_xprt *xs_setup_tcp(struct rpc_xprtsock_create *args)
+static struct rpc_xprt *xs_setup_tcp(struct xprt_create *args)
 {
        struct sockaddr *addr = args->dstaddr;
        struct rpc_xprt *xprt;
@@ -1908,39 +2379,44 @@ struct rpc_xprt *xs_setup_tcp(struct rpc_xprtsock_create *args)
        xprt->max_payload = RPC_MAX_FRAGMENT_SIZE;
 
        xprt->bind_timeout = XS_BIND_TO;
-       xprt->connect_timeout = XS_TCP_CONN_TO;
        xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
        xprt->idle_timeout = XS_IDLE_DISC_TO;
 
        xprt->ops = &xs_tcp_ops;
-
-       if (args->timeout)
-               xprt->timeout = *args->timeout;
-       else
-               xprt_set_timeout(&xprt->timeout, 2, 60 * HZ);
+       xprt->timeout = &xs_tcp_default_timeout;
 
        switch (addr->sa_family) {
        case AF_INET:
                if (((struct sockaddr_in *)addr)->sin_port != htons(0))
                        xprt_set_bound(xprt);
 
-               INIT_DELAYED_WORK(&transport->connect_worker, xs_tcp_connect_worker4);
-               xs_format_ipv4_peer_addresses(xprt);
+               INIT_DELAYED_WORK(&transport->connect_worker,
+                                       xs_tcp_connect_worker4);
+               xs_format_peer_addresses(xprt, "tcp", RPCBIND_NETID_TCP);
                break;
        case AF_INET6:
                if (((struct sockaddr_in6 *)addr)->sin6_port != htons(0))
                        xprt_set_bound(xprt);
 
-               INIT_DELAYED_WORK(&transport->connect_worker, xs_tcp_connect_worker6);
-               xs_format_ipv6_peer_addresses(xprt);
+               INIT_DELAYED_WORK(&transport->connect_worker,
+                                       xs_tcp_connect_worker6);
+               xs_format_peer_addresses(xprt, "tcp", RPCBIND_NETID_TCP6);
                break;
        default:
                kfree(xprt);
                return ERR_PTR(-EAFNOSUPPORT);
        }
 
-       dprintk("RPC:       set up transport to address %s\n",
-                       xprt->address_strings[RPC_DISPLAY_ALL]);
+       if (xprt_bound(xprt))
+               dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                               xprt->address_strings[RPC_DISPLAY_ADDR],
+                               xprt->address_strings[RPC_DISPLAY_PORT],
+                               xprt->address_strings[RPC_DISPLAY_PROTO]);
+       else
+               dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                               xprt->address_strings[RPC_DISPLAY_ADDR],
+                               xprt->address_strings[RPC_DISPLAY_PROTO]);
+
 
        if (try_module_get(THIS_MODULE))
                return xprt;
@@ -1950,12 +2426,89 @@ struct rpc_xprt *xs_setup_tcp(struct rpc_xprtsock_create *args)
        return ERR_PTR(-EINVAL);
 }
 
+/**
+ * xs_setup_bc_tcp - Set up transport to use a TCP backchannel socket
+ * @args: rpc transport creation arguments
+ *
+ */
+static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
+{
+       struct sockaddr *addr = args->dstaddr;
+       struct rpc_xprt *xprt;
+       struct sock_xprt *transport;
+       struct svc_sock *bc_sock;
+
+       xprt = xs_setup_xprt(args, xprt_tcp_slot_table_entries);
+       if (IS_ERR(xprt))
+               return xprt;
+       transport = container_of(xprt, struct sock_xprt, xprt);
+
+       xprt->prot = IPPROTO_TCP;
+       xprt->tsh_size = sizeof(rpc_fraghdr) / sizeof(u32);
+       xprt->max_payload = RPC_MAX_FRAGMENT_SIZE;
+       xprt->timeout = &xs_tcp_default_timeout;
+
+       /* backchannel */
+       xprt_set_bound(xprt);
+       xprt->bind_timeout = 0;
+       xprt->reestablish_timeout = 0;
+       xprt->idle_timeout = 0;
+
+       /*
+        * The backchannel uses the same socket connection as the
+        * forechannel
+        */
+       xprt->bc_xprt = args->bc_xprt;
+       bc_sock = container_of(args->bc_xprt, struct svc_sock, sk_xprt);
+       bc_sock->sk_bc_xprt = xprt;
+       transport->sock = bc_sock->sk_sock;
+       transport->inet = bc_sock->sk_sk;
+
+       xprt->ops = &bc_tcp_ops;
+
+       switch (addr->sa_family) {
+       case AF_INET:
+               xs_format_peer_addresses(xprt, "tcp",
+                                        RPCBIND_NETID_TCP);
+               break;
+       case AF_INET6:
+               xs_format_peer_addresses(xprt, "tcp",
+                                  RPCBIND_NETID_TCP6);
+               break;
+       default:
+               kfree(xprt);
+               return ERR_PTR(-EAFNOSUPPORT);
+       }
+
+       if (xprt_bound(xprt))
+               dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                               xprt->address_strings[RPC_DISPLAY_ADDR],
+                               xprt->address_strings[RPC_DISPLAY_PORT],
+                               xprt->address_strings[RPC_DISPLAY_PROTO]);
+       else
+               dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                               xprt->address_strings[RPC_DISPLAY_ADDR],
+                               xprt->address_strings[RPC_DISPLAY_PROTO]);
+
+       /*
+        * Since we don't want connections for the backchannel, we set
+        * the xprt status to connected
+        */
+       xprt_set_connected(xprt);
+
+
+       if (try_module_get(THIS_MODULE))
+               return xprt;
+       kfree(xprt->slot);
+       kfree(xprt);
+       return ERR_PTR(-EINVAL);
+}
+
 static struct xprt_class       xs_udp_transport = {
        .list           = LIST_HEAD_INIT(xs_udp_transport.list),
        .name           = "udp",
        .owner          = THIS_MODULE,
-       .family         = AF_INET,
-       .protocol       = IPPROTO_UDP,
+       .ident          = XPRT_TRANSPORT_UDP,
        .setup          = xs_setup_udp,
 };
 
@@ -1963,11 +2516,18 @@ static struct xprt_class        xs_tcp_transport = {
        .list           = LIST_HEAD_INIT(xs_tcp_transport.list),
        .name           = "tcp",
        .owner          = THIS_MODULE,
-       .family         = AF_INET,
-       .protocol       = IPPROTO_TCP,
+       .ident          = XPRT_TRANSPORT_TCP,
        .setup          = xs_setup_tcp,
 };
 
+static struct xprt_class       xs_bc_tcp_transport = {
+       .list           = LIST_HEAD_INIT(xs_bc_tcp_transport.list),
+       .name           = "tcp NFSv4.1 backchannel",
+       .owner          = THIS_MODULE,
+       .ident          = XPRT_TRANSPORT_BC_TCP,
+       .setup          = xs_setup_bc_tcp,
+};
+
 /**
  * init_socket_xprt - set up xprtsock's sysctls, register with RPC client
  *
@@ -1981,6 +2541,7 @@ int init_socket_xprt(void)
 
        xprt_register_transport(&xs_udp_transport);
        xprt_register_transport(&xs_tcp_transport);
+       xprt_register_transport(&xs_bc_tcp_transport);
 
        return 0;
 }
@@ -2000,4 +2561,57 @@ void cleanup_socket_xprt(void)
 
        xprt_unregister_transport(&xs_udp_transport);
        xprt_unregister_transport(&xs_tcp_transport);
+       xprt_unregister_transport(&xs_bc_tcp_transport);
+}
+
+static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
+               unsigned int min, unsigned int max)
+{
+       unsigned long num;
+       int ret;
+
+       if (!val)
+               return -EINVAL;
+       ret = strict_strtoul(val, 0, &num);
+       if (ret == -EINVAL || num < min || num > max)
+               return -EINVAL;
+       *((unsigned int *)kp->arg) = num;
+       return 0;
 }
+
+static int param_set_portnr(const char *val, struct kernel_param *kp)
+{
+       return param_set_uint_minmax(val, kp,
+                       RPC_MIN_RESVPORT,
+                       RPC_MAX_RESVPORT);
+}
+
+static int param_get_portnr(char *buffer, struct kernel_param *kp)
+{
+       return param_get_uint(buffer, kp);
+}
+#define param_check_portnr(name, p) \
+       __param_check(name, p, unsigned int);
+
+module_param_named(min_resvport, xprt_min_resvport, portnr, 0644);
+module_param_named(max_resvport, xprt_max_resvport, portnr, 0644);
+
+static int param_set_slot_table_size(const char *val, struct kernel_param *kp)
+{
+       return param_set_uint_minmax(val, kp,
+                       RPC_MIN_SLOT_TABLE,
+                       RPC_MAX_SLOT_TABLE);
+}
+
+static int param_get_slot_table_size(char *buffer, struct kernel_param *kp)
+{
+       return param_get_uint(buffer, kp);
+}
+#define param_check_slot_table_size(name, p) \
+       __param_check(name, p, unsigned int);
+
+module_param_named(tcp_slot_table_entries, xprt_tcp_slot_table_entries,
+                  slot_table_size, 0644);
+module_param_named(udp_slot_table_entries, xprt_udp_slot_table_entries,
+                  slot_table_size, 0644);
+