Merge branch 'master' of ssh://rsync.linux-nfs.org/home/trondmy/www_sites/rsync.linux-nfs.org/pub/linux/nfs-2.6

15 files changed, 825 insertions, 184 deletions

diff --git a/net/sunrpc/auth_gss/Makefile b/net/sunrpc/auth_gss/Makefile
index fe1b874084bc..f3431a7e33da 100644
--- a/net/sunrpc/auth_gss/Makefile
+++ b/net/sunrpc/auth_gss/Makefile
@@ -10,7 +10,7 @@ auth_rpcgss-objs := auth_gss.o gss_generic_token.o \
 obj-$(CONFIG_RPCSEC_GSS_KRB5) += rpcsec_gss_krb5.o
 
 rpcsec_gss_krb5-objs := gss_krb5_mech.o gss_krb5_seal.o gss_krb5_unseal.o \
-        gss_krb5_seqnum.o
+        gss_krb5_seqnum.o gss_krb5_wrap.o
 
 obj-$(CONFIG_RPCSEC_GSS_SPKM3) += rpcsec_gss_spkm3.o
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index d2b08f16c257..f44f46f1d8e0 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -43,6 +43,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/pagemap.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/auth.h>
 #include <linux/sunrpc/auth_gss.h>
@@ -853,9 +854,7 @@ gss_marshal(struct rpc_task *task, u32 *p)
         *p++ = htonl(RPC_AUTH_GSS);
 
         mic.data = (u8 *)(p + 1);
-        maj_stat = gss_get_mic(ctx->gc_gss_ctx,
-                               GSS_C_QOP_DEFAULT, 
-                               &verf_buf, &mic);
+        maj_stat = gss_get_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED) {
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
         } else if (maj_stat != 0) {
@@ -886,10 +885,8 @@ static u32 *
 gss_validate(struct rpc_task *task, u32 *p)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
-        struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
-                                                gc_base);
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
-        u32             seq, qop_state;
+        u32             seq;
         struct kvec     iov;
         struct xdr_buf  verf_buf;
         struct xdr_netobj mic;
@@ -910,23 +907,14 @@ gss_validate(struct rpc_task *task, u32 *p)
         mic.data = (u8 *)p;
         mic.len = len;
 
-        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic, &qop_state);
+        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &verf_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
         if (maj_stat)
                 goto out_bad;
-       switch (gss_cred->gc_service) {
-       case RPC_GSS_SVC_NONE:
-               /* verifier data, flavor, length: */
-               task->tk_auth->au_rslack = XDR_QUADLEN(len) + 2;
-               break;
-       case RPC_GSS_SVC_INTEGRITY:
-               /* verifier data, flavor, length, length, sequence number: */
-               task->tk_auth->au_rslack = XDR_QUADLEN(len) + 4;
-               break;
-       case RPC_GSS_SVC_PRIVACY:
-               goto out_bad;
-       }
+        /* We leave it to unwrap to calculate au_rslack. For now we just
+         * calculate the length of the verifier: */
+        task->tk_auth->au_verfsize = XDR_QUADLEN(len) + 2;
         gss_put_ctx(ctx);
         dprintk("RPC: %4u GSS gss_validate: gss_verify_mic succeeded.\n",
                         task->tk_pid);
@@ -971,8 +959,7 @@ gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         p = iov->iov_base + iov->iov_len;
         mic.data = (u8 *)(p + 1);
 
-        maj_stat = gss_get_mic(ctx->gc_gss_ctx,
-                        GSS_C_QOP_DEFAULT, &integ_buf, &mic);
+        maj_stat = gss_get_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
         status = -EIO; /* XXX? */
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
@@ -986,6 +973,113 @@ gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         return 0;
 }
 
+static void
+priv_release_snd_buf(struct rpc_rqst *rqstp)
+{
+        int i;
+
+        for (i=0; i < rqstp->rq_enc_pages_num; i++)
+                __free_page(rqstp->rq_enc_pages[i]);
+        kfree(rqstp->rq_enc_pages);
+}
+
+static int
+alloc_enc_pages(struct rpc_rqst *rqstp)
+{
+        struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
+        int first, last, i;
+
+        if (snd_buf->page_len == 0) {
+                rqstp->rq_enc_pages_num = 0;
+                return 0;
+        }
+
+        first = snd_buf->page_base >> PAGE_CACHE_SHIFT;
+        last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_CACHE_SHIFT;
+        rqstp->rq_enc_pages_num = last - first + 1 + 1;
+        rqstp->rq_enc_pages
+                = kmalloc(rqstp->rq_enc_pages_num * sizeof(struct page *),
+                                GFP_NOFS);
+        if (!rqstp->rq_enc_pages)
+                goto out;
+        for (i=0; i < rqstp->rq_enc_pages_num; i++) {
+                rqstp->rq_enc_pages[i] = alloc_page(GFP_NOFS);
+                if (rqstp->rq_enc_pages[i] == NULL)
+                        goto out_free;
+        }
+        rqstp->rq_release_snd_buf = priv_release_snd_buf;
+        return 0;
+out_free:
+        for (i--; i >= 0; i--) {
+                __free_page(rqstp->rq_enc_pages[i]);
+        }
+out:
+        return -EAGAIN;
+}
+
+static inline int
+gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
+                kxdrproc_t encode, struct rpc_rqst *rqstp, u32 *p, void *obj)
+{
+        struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
+        u32             offset;
+        u32             maj_stat;
+        int             status;
+        u32             *opaque_len;
+        struct page     **inpages;
+        int             first;
+        int             pad;
+        struct kvec     *iov;
+        char            *tmp;
+
+        opaque_len = p++;
+        offset = (u8 *)p - (u8 *)snd_buf->head[0].iov_base;
+        *p++ = htonl(rqstp->rq_seqno);
+
+        status = encode(rqstp, p, obj);
+        if (status)
+                return status;
+
+        status = alloc_enc_pages(rqstp);
+        if (status)
+                return status;
+        first = snd_buf->page_base >> PAGE_CACHE_SHIFT;
+        inpages = snd_buf->pages + first;
+        snd_buf->pages = rqstp->rq_enc_pages;
+        snd_buf->page_base -= first << PAGE_CACHE_SHIFT;
+        /* Give the tail its own page, in case we need extra space in the
+         * head when wrapping: */
+        if (snd_buf->page_len || snd_buf->tail[0].iov_len) {
+                tmp = page_address(rqstp->rq_enc_pages[rqstp->rq_enc_pages_num - 1]);
+                memcpy(tmp, snd_buf->tail[0].iov_base, snd_buf->tail[0].iov_len);
+                snd_buf->tail[0].iov_base = tmp;
+        }
+        maj_stat = gss_wrap(ctx->gc_gss_ctx, offset, snd_buf, inpages);
+        /* RPC_SLACK_SPACE should prevent this ever happening: */
+        BUG_ON(snd_buf->len > snd_buf->buflen);
+        status = -EIO;
+        /* We're assuming that when GSS_S_CONTEXT_EXPIRED, the encryption was
+         * done anyway, so it's safe to put the request on the wire: */
+        if (maj_stat == GSS_S_CONTEXT_EXPIRED)
+                cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
+        else if (maj_stat)
+                return status;
+
+        *opaque_len = htonl(snd_buf->len - offset);
+        /* guess whether we're in the head or the tail: */
+        if (snd_buf->page_len || snd_buf->tail[0].iov_len)
+                iov = snd_buf->tail;
+        else
+                iov = snd_buf->head;
+        p = iov->iov_base + iov->iov_len;
+        pad = 3 - ((snd_buf->len - offset - 1) & 3);
+        memset(p, 0, pad);
+        iov->iov_len += pad;
+        snd_buf->len += pad;
+
+        return 0;
+}
+
 static int
 gss_wrap_req(struct rpc_task *task,
              kxdrproc_t encode, void *rqstp, u32 *p, void *obj)
@@ -1013,6 +1107,8 @@ gss_wrap_req(struct rpc_task *task,
                                                                 rqstp, p, obj);
                         break;
                 case RPC_GSS_SVC_PRIVACY:
+                        status = gss_wrap_req_priv(cred, ctx, encode,
+                                        rqstp, p, obj);
                         break;
         }
 out:
@@ -1050,8 +1146,7 @@ gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         if (xdr_buf_read_netobj(rcv_buf, &mic, mic_offset))
                 return status;
 
-        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf,
-                        &mic, NULL);
+        maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
         if (maj_stat == GSS_S_CONTEXT_EXPIRED)
                 cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
         if (maj_stat != GSS_S_COMPLETE)
@@ -1059,6 +1154,35 @@ gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
         return 0;
 }
 
+static inline int
+gss_unwrap_resp_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
+                struct rpc_rqst *rqstp, u32 **p)
+{
+        struct xdr_buf  *rcv_buf = &rqstp->rq_rcv_buf;
+        u32 offset;
+        u32 opaque_len;
+        u32 maj_stat;
+        int status = -EIO;
+
+        opaque_len = ntohl(*(*p)++);
+        offset = (u8 *)(*p) - (u8 *)rcv_buf->head[0].iov_base;
+        if (offset + opaque_len > rcv_buf->len)
+                return status;
+        /* remove padding: */
+        rcv_buf->len = offset + opaque_len;
+
+        maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf);
+        if (maj_stat == GSS_S_CONTEXT_EXPIRED)
+                cred->cr_flags &= ~RPCAUTH_CRED_UPTODATE;
+        if (maj_stat != GSS_S_COMPLETE)
+                return status;
+        if (ntohl(*(*p)++) != rqstp->rq_seqno)
+                return status;
+
+        return 0;
+}
+
+
 static int
 gss_unwrap_resp(struct rpc_task *task,
                 kxdrproc_t decode, void *rqstp, u32 *p, void *obj)
@@ -1067,6 +1191,9 @@ gss_unwrap_resp(struct rpc_task *task,
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
                         gc_base);
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
+        u32             *savedp = p;
+        struct kvec     *head = ((struct rpc_rqst *)rqstp)->rq_rcv_buf.head;
+        int             savedlen = head->iov_len;
         int             status = -EIO;
 
         if (ctx->gc_proc != RPC_GSS_PROC_DATA)
@@ -1080,8 +1207,14 @@ gss_unwrap_resp(struct rpc_task *task,
                                 goto out;
                         break;
                 case RPC_GSS_SVC_PRIVACY:
+                        status = gss_unwrap_resp_priv(cred, ctx, rqstp, &p);
+                        if (status)
+                                goto out;
                         break;
         }
+        /* take into account extra slack for integrity and privacy cases: */
+        task->tk_auth->au_rslack = task->tk_auth->au_verfsize + (p - savedp)
+                                                + (savedlen - head->iov_len);
 out_decode:
         status = decode(rqstp, p, obj);
 out:
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index ee6ae74cd1b2..3f3d5437f02d 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -139,17 +139,91 @@ buf_to_sg(struct scatterlist *sg, char *ptr, int len) {
         sg->length = len;
 }
 
+static int
+process_xdr_buf(struct xdr_buf *buf, int offset, int len,
+                int (*actor)(struct scatterlist *, void *), void *data)
+{
+        int i, page_len, thislen, page_offset, ret = 0;
+        struct scatterlist      sg[1];
+
+        if (offset >= buf->head[0].iov_len) {
+                offset -= buf->head[0].iov_len;
+        } else {
+                thislen = buf->head[0].iov_len - offset;
+                if (thislen > len)
+                        thislen = len;
+                buf_to_sg(sg, buf->head[0].iov_base + offset, thislen);
+                ret = actor(sg, data);
+                if (ret)
+                        goto out;
+                offset = 0;
+                len -= thislen;
+        }
+        if (len == 0)
+                goto out;
+
+        if (offset >= buf->page_len) {
+                offset -= buf->page_len;
+        } else {
+                page_len = buf->page_len - offset;
+                if (page_len > len)
+                        page_len = len;
+                len -= page_len;
+                page_offset = (offset + buf->page_base) & (PAGE_CACHE_SIZE - 1);
+                i = (offset + buf->page_base) >> PAGE_CACHE_SHIFT;
+                thislen = PAGE_CACHE_SIZE - page_offset;
+                do {
+                        if (thislen > page_len)
+                                thislen = page_len;
+                        sg->page = buf->pages[i];
+                        sg->offset = page_offset;
+                        sg->length = thislen;
+                        ret = actor(sg, data);
+                        if (ret)
+                                goto out;
+                        page_len -= thislen;
+                        i++;
+                        page_offset = 0;
+                        thislen = PAGE_CACHE_SIZE;
+                } while (page_len != 0);
+                offset = 0;
+        }
+        if (len == 0)
+                goto out;
+
+        if (offset < buf->tail[0].iov_len) {
+                thislen = buf->tail[0].iov_len - offset;
+                if (thislen > len)
+                        thislen = len;
+                buf_to_sg(sg, buf->tail[0].iov_base + offset, thislen);
+                ret = actor(sg, data);
+                len -= thislen;
+        }
+        if (len != 0)
+                ret = -EINVAL;
+out:
+        return ret;
+}
+
+static int
+checksummer(struct scatterlist *sg, void *data)
+{
+        struct crypto_tfm *tfm = (struct crypto_tfm *)data;
+
+        crypto_digest_update(tfm, sg, 1);
+
+        return 0;
+}
+
 /* checksum the plaintext data and hdrlen bytes of the token header */
 s32
 make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
-                   struct xdr_netobj *cksum)
+                   int body_offset, struct xdr_netobj *cksum)
 {
         char                            *cksumname;
         struct crypto_tfm               *tfm = NULL; /* XXX add to ctx? */
         struct scatterlist              sg[1];
         u32                             code = GSS_S_FAILURE;
-        int                             len, thislen, offset;
-        int                             i;
 
         switch (cksumtype) {
                 case CKSUMTYPE_RSA_MD5:
@@ -169,33 +243,8 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
         crypto_digest_init(tfm);
         buf_to_sg(sg, header, hdrlen);
         crypto_digest_update(tfm, sg, 1);
-        if (body->head[0].iov_len) {
-                buf_to_sg(sg, body->head[0].iov_base, body->head[0].iov_len);
-                crypto_digest_update(tfm, sg, 1);
-        }
-
-        len = body->page_len;
-        if (len != 0) {
-                offset = body->page_base & (PAGE_CACHE_SIZE - 1);
-                i = body->page_base >> PAGE_CACHE_SHIFT;
-                thislen = PAGE_CACHE_SIZE - offset;
-                do {
-                        if (thislen > len)
-                                thislen = len;
-                        sg->page = body->pages[i];
-                        sg->offset = offset;
-                        sg->length = thislen;
-                        crypto_digest_update(tfm, sg, 1);
-                        len -= thislen;
-                        i++;
-                        offset = 0;
-                        thislen = PAGE_CACHE_SIZE;
-                } while(len != 0);
-        }
-        if (body->tail[0].iov_len) {
-                buf_to_sg(sg, body->tail[0].iov_base, body->tail[0].iov_len);
-                crypto_digest_update(tfm, sg, 1);
-        }
+        process_xdr_buf(body, body_offset, body->len - body_offset,
+                        checksummer, tfm);
         crypto_digest_final(tfm, cksum->data);
         code = 0;
 out:
@@ -204,3 +253,154 @@ out:
 }
 
 EXPORT_SYMBOL(make_checksum);
+
+struct encryptor_desc {
+        u8 iv[8]; /* XXX hard-coded blocksize */
+        struct crypto_tfm *tfm;
+        int pos;
+        struct xdr_buf *outbuf;
+        struct page **pages;
+        struct scatterlist infrags[4];
+        struct scatterlist outfrags[4];
+        int fragno;
+        int fraglen;
+};
+
+static int
+encryptor(struct scatterlist *sg, void *data)
+{
+        struct encryptor_desc *desc = data;
+        struct xdr_buf *outbuf = desc->outbuf;
+        struct page *in_page;
+        int thislen = desc->fraglen + sg->length;
+        int fraglen, ret;
+        int page_pos;
+
+        /* Worst case is 4 fragments: head, end of page 1, start
+         * of page 2, tail.  Anything more is a bug. */
+        BUG_ON(desc->fragno > 3);
+        desc->infrags[desc->fragno] = *sg;
+        desc->outfrags[desc->fragno] = *sg;
+
+        page_pos = desc->pos - outbuf->head[0].iov_len;
+        if (page_pos >= 0 && page_pos < outbuf->page_len) {
+                /* pages are not in place: */
+                int i = (page_pos + outbuf->page_base) >> PAGE_CACHE_SHIFT;
+                in_page = desc->pages[i];
+        } else {
+                in_page = sg->page;
+        }
+        desc->infrags[desc->fragno].page = in_page;
+        desc->fragno++;
+        desc->fraglen += sg->length;
+        desc->pos += sg->length;
+
+        fraglen = thislen & 7; /* XXX hardcoded blocksize */
+        thislen -= fraglen;
+
+        if (thislen == 0)
+                return 0;
+
+        ret = crypto_cipher_encrypt_iv(desc->tfm, desc->outfrags, desc->infrags,
+                                        thislen, desc->iv);
+        if (ret)
+                return ret;
+        if (fraglen) {
+                desc->outfrags[0].page = sg->page;
+                desc->outfrags[0].offset = sg->offset + sg->length - fraglen;
+                desc->outfrags[0].length = fraglen;
+                desc->infrags[0] = desc->outfrags[0];
+                desc->infrags[0].page = in_page;
+                desc->fragno = 1;
+                desc->fraglen = fraglen;
+        } else {
+                desc->fragno = 0;
+                desc->fraglen = 0;
+        }
+        return 0;
+}
+
+int
+gss_encrypt_xdr_buf(struct crypto_tfm *tfm, struct xdr_buf *buf, int offset,
+                struct page **pages)
+{
+        int ret;
+        struct encryptor_desc desc;
+
+        BUG_ON((buf->len - offset) % crypto_tfm_alg_blocksize(tfm) != 0);
+
+        memset(desc.iv, 0, sizeof(desc.iv));
+        desc.tfm = tfm;
+        desc.pos = offset;
+        desc.outbuf = buf;
+        desc.pages = pages;
+        desc.fragno = 0;
+        desc.fraglen = 0;
+
+        ret = process_xdr_buf(buf, offset, buf->len - offset, encryptor, &desc);
+        return ret;
+}
+
+EXPORT_SYMBOL(gss_encrypt_xdr_buf);
+
+struct decryptor_desc {
+        u8 iv[8]; /* XXX hard-coded blocksize */
+        struct crypto_tfm *tfm;
+        struct scatterlist frags[4];
+        int fragno;
+        int fraglen;
+};
+
+static int
+decryptor(struct scatterlist *sg, void *data)
+{
+        struct decryptor_desc *desc = data;
+        int thislen = desc->fraglen + sg->length;
+        int fraglen, ret;
+
+        /* Worst case is 4 fragments: head, end of page 1, start
+         * of page 2, tail.  Anything more is a bug. */
+        BUG_ON(desc->fragno > 3);
+        desc->frags[desc->fragno] = *sg;
+        desc->fragno++;
+        desc->fraglen += sg->length;
+
+        fraglen = thislen & 7; /* XXX hardcoded blocksize */
+        thislen -= fraglen;
+
+        if (thislen == 0)
+                return 0;
+
+        ret = crypto_cipher_decrypt_iv(desc->tfm, desc->frags, desc->frags,
+                                        thislen, desc->iv);
+        if (ret)
+                return ret;
+        if (fraglen) {
+                desc->frags[0].page = sg->page;
+                desc->frags[0].offset = sg->offset + sg->length - fraglen;
+                desc->frags[0].length = fraglen;
+                desc->fragno = 1;
+                desc->fraglen = fraglen;
+        } else {
+                desc->fragno = 0;
+                desc->fraglen = 0;
+        }
+        return 0;
+}
+
+int
+gss_decrypt_xdr_buf(struct crypto_tfm *tfm, struct xdr_buf *buf, int offset)
+{
+        struct decryptor_desc desc;
+
+        /* XXXJBF: */
+        BUG_ON((buf->len - offset) % crypto_tfm_alg_blocksize(tfm) != 0);
+
+        memset(desc.iv, 0, sizeof(desc.iv));
+        desc.tfm = tfm;
+        desc.fragno = 0;
+        desc.fraglen = 0;
+        return process_xdr_buf(buf, offset, buf->len - offset, decryptor, &desc);
+}
+
+EXPORT_SYMBOL(gss_decrypt_xdr_buf);
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 462c5b86b073..5f1f806a0b11 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -190,43 +190,12 @@ gss_delete_sec_context_kerberos(void *internal_ctx) {
         kfree(kctx);
 }
 
-static u32
-gss_verify_mic_kerberos(struct gss_ctx          *ctx,
-                        struct xdr_buf          *message,
-                        struct xdr_netobj       *mic_token,
-                        u32                     *qstate) {
-        u32 maj_stat = 0;
-        int qop_state;
-        struct krb5_ctx *kctx = ctx->internal_ctx_id;
-
-        maj_stat = krb5_read_token(kctx, mic_token, message, &qop_state,
-                                   KG_TOK_MIC_MSG);
-        if (!maj_stat && qop_state)
-            *qstate = qop_state;
-
-        dprintk("RPC:      gss_verify_mic_kerberos returning %d\n", maj_stat);
-        return maj_stat;
-}
-
-static u32
-gss_get_mic_kerberos(struct gss_ctx     *ctx,
-                     u32                qop,
-                     struct xdr_buf     *message,
-                     struct xdr_netobj  *mic_token) {
-        u32 err = 0;
-        struct krb5_ctx *kctx = ctx->internal_ctx_id;
-
-        err = krb5_make_token(kctx, qop, message, mic_token, KG_TOK_MIC_MSG);
-
-        dprintk("RPC:      gss_get_mic_kerberos returning %d\n",err);
-
-        return err;
-}
-
 static struct gss_api_ops gss_kerberos_ops = {
         .gss_import_sec_context = gss_import_sec_context_kerberos,
         .gss_get_mic            = gss_get_mic_kerberos,
         .gss_verify_mic         = gss_verify_mic_kerberos,
+        .gss_wrap               = gss_wrap_kerberos,
+        .gss_unwrap             = gss_unwrap_kerberos,
         .gss_delete_sec_context = gss_delete_sec_context_kerberos,
 };
 
@@ -241,6 +210,11 @@ static struct pf_desc gss_kerberos_pfs[] = {
                 .service = RPC_GSS_SVC_INTEGRITY,
                 .name = "krb5i",
         },
+        [2] = {
+                .pseudoflavor = RPC_AUTH_GSS_KRB5P,
+                .service = RPC_GSS_SVC_PRIVACY,
+                .name = "krb5p",
+        },
 };
 
 static struct gss_api_mech gss_kerberos_mech = {
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index afeeb8715a77..13f8ae979454 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -70,22 +70,13 @@
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
-static inline int
-gss_krb5_padding(int blocksize, int length) {
-        /* Most of the code is block-size independent but in practice we
-         * use only 8: */
-        BUG_ON(blocksize != 8);
-        return 8 - (length & 7);
-}
-
 u32
-krb5_make_token(struct krb5_ctx *ctx, int qop_req,
-                   struct xdr_buf *text, struct xdr_netobj *token,
-                   int toktype)
+gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
+                struct xdr_netobj *token)
 {
+        struct krb5_ctx         *ctx = gss_ctx->internal_ctx_id;
         s32                     checksum_type;
         struct xdr_netobj       md5cksum = {.len = 0, .data = NULL};
-        int                     blocksize = 0, tmsglen;
         unsigned char           *ptr, *krb5_hdr, *msg_start;
         s32                     now;
 
@@ -93,9 +84,6 @@ krb5_make_token(struct krb5_ctx *ctx, int qop_req,
 
         now = get_seconds();
 
-        if (qop_req != 0)
-                goto out_err;
-
         switch (ctx->signalg) {
                 case SGN_ALG_DES_MAC_MD5:
                         checksum_type = CKSUMTYPE_RSA_MD5;
@@ -111,21 +99,13 @@ krb5_make_token(struct krb5_ctx *ctx, int qop_req,
                 goto out_err;
         }
 
-        if (toktype == KG_TOK_WRAP_MSG) {
-                blocksize = crypto_tfm_alg_blocksize(ctx->enc);
-                tmsglen = blocksize + text->len
-                        + gss_krb5_padding(blocksize, blocksize + text->len);
-        } else {
-                tmsglen = 0;
-        }
-
-        token->len = g_token_size(&ctx->mech_used, 22 + tmsglen);
+        token->len = g_token_size(&ctx->mech_used, 22);
 
         ptr = token->data;
-        g_make_token_header(&ctx->mech_used, 22 + tmsglen, &ptr);
+        g_make_token_header(&ctx->mech_used, 22, &ptr);
 
-        *ptr++ = (unsigned char) ((toktype>>8)&0xff);
-        *ptr++ = (unsigned char) (toktype&0xff);
+        *ptr++ = (unsigned char) ((KG_TOK_MIC_MSG>>8)&0xff);
+        *ptr++ = (unsigned char) (KG_TOK_MIC_MSG&0xff);
 
         /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
         krb5_hdr = ptr - 2;
@@ -133,17 +113,9 @@ krb5_make_token(struct krb5_ctx *ctx, int qop_req,
 
         *(u16 *)(krb5_hdr + 2) = htons(ctx->signalg);
         memset(krb5_hdr + 4, 0xff, 4);
-        if (toktype == KG_TOK_WRAP_MSG)
-                *(u16 *)(krb5_hdr + 4) = htons(ctx->sealalg);
 
-        if (toktype == KG_TOK_WRAP_MSG) {
-                /* XXX removing support for now */
-                goto out_err;
-        } else { /* Sign only.  */
-                if (make_checksum(checksum_type, krb5_hdr, 8, text,
-                                       &md5cksum))
+        if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum))
                         goto out_err;
-        }
 
         switch (ctx->signalg) {
         case SGN_ALG_DES_MAC_MD5:
diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index 8767fc53183d..2030475d98ed 100644
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -68,21 +68,14 @@
 #endif
 
 
-/* message_buffer is an input if toktype is MIC and an output if it is WRAP:
- * If toktype is MIC: read_token is a mic token, and message_buffer is the
- *   data that the mic was supposedly taken over.
- * If toktype is WRAP: read_token is a wrap token, and message_buffer is used
- *   to return the decrypted data.
- */
+/* read_token is a mic token, and message_buffer is the data that the mic was
+ * supposedly taken over. */
 
-/* XXX will need to change prototype and/or just split into a separate function
- * when we add privacy (because read_token will be in pages too). */
 u32
-krb5_read_token(struct krb5_ctx *ctx,
-                struct xdr_netobj *read_token,
-                struct xdr_buf *message_buffer,
-                int *qop_state, int toktype)
+gss_verify_mic_kerberos(struct gss_ctx *gss_ctx,
+                struct xdr_buf *message_buffer, struct xdr_netobj *read_token)
 {
+        struct krb5_ctx         *ctx = gss_ctx->internal_ctx_id;
         int                     signalg;
         int                     sealalg;
         s32                     checksum_type;
@@ -100,16 +93,12 @@ krb5_read_token(struct krb5_ctx *ctx,
                                         read_token->len))
                 goto out;
 
-        if ((*ptr++ != ((toktype>>8)&0xff)) || (*ptr++ != (toktype&0xff)))
+        if ((*ptr++ != ((KG_TOK_MIC_MSG>>8)&0xff)) ||
+            (*ptr++ != ( KG_TOK_MIC_MSG    &0xff))   )
                 goto out;
 
         /* XXX sanity-check bodysize?? */
 
-        if (toktype == KG_TOK_WRAP_MSG) {
-                /* XXX gone */
-                goto out;
-        }
-
         /* get the sign and seal algorithms */
 
         signalg = ptr[0] + (ptr[1] << 8);
@@ -120,14 +109,7 @@ krb5_read_token(struct krb5_ctx *ctx,
         if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
                 goto out;
 
-        if (((toktype != KG_TOK_WRAP_MSG) && (sealalg != 0xffff)) ||
-            ((toktype == KG_TOK_WRAP_MSG) && (sealalg == 0xffff)))
-                goto out;
-
-        /* in the current spec, there is only one valid seal algorithm per
-           key type, so a simple comparison is ok */
-
-        if ((toktype == KG_TOK_WRAP_MSG) && !(sealalg == ctx->sealalg))
+        if (sealalg != 0xffff)
                 goto out;
 
         /* there are several mappings of seal algorithms to sign algorithms,
@@ -154,7 +136,7 @@ krb5_read_token(struct krb5_ctx *ctx,
         switch (signalg) {
         case SGN_ALG_DES_MAC_MD5:
                 ret = make_checksum(checksum_type, ptr - 2, 8,
-                                         message_buffer, &md5cksum);
+                                         message_buffer, 0, &md5cksum);
                 if (ret)
                         goto out;
 
@@ -175,9 +157,6 @@ krb5_read_token(struct krb5_ctx *ctx,
 
         /* it got through unscathed.  Make sure the context is unexpired */
 
-        if (qop_state)
-                *qop_state = GSS_C_QOP_DEFAULT;
-
         now = get_seconds();
 
         ret = GSS_S_CONTEXT_EXPIRED;
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
new file mode 100644
index 000000000000..af777cf9f251
--- /dev/null
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -0,0 +1,363 @@
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/sunrpc/gss_krb5.h>
+#include <linux/random.h>
+#include <linux/pagemap.h>
+#include <asm/scatterlist.h>
+#include <linux/crypto.h>
+
+#ifdef RPC_DEBUG
+# define RPCDBG_FACILITY        RPCDBG_AUTH
+#endif
+
+static inline int
+gss_krb5_padding(int blocksize, int length)
+{
+        /* Most of the code is block-size independent but currently we
+         * use only 8: */
+        BUG_ON(blocksize != 8);
+        return 8 - (length & 7);
+}
+
+static inline void
+gss_krb5_add_padding(struct xdr_buf *buf, int offset, int blocksize)
+{
+        int padding = gss_krb5_padding(blocksize, buf->len - offset);
+        char *p;
+        struct kvec *iov;
+
+        if (buf->page_len || buf->tail[0].iov_len)
+                iov = &buf->tail[0];
+        else
+                iov = &buf->head[0];
+        p = iov->iov_base + iov->iov_len;
+        iov->iov_len += padding;
+        buf->len += padding;
+        memset(p, padding, padding);
+}
+
+static inline int
+gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize)
+{
+        u8 *ptr;
+        u8 pad;
+        int len = buf->len;
+
+        if (len <= buf->head[0].iov_len) {
+                pad = *(u8 *)(buf->head[0].iov_base + len - 1);
+                if (pad > buf->head[0].iov_len)
+                        return -EINVAL;
+                buf->head[0].iov_len -= pad;
+                goto out;
+        } else
+                len -= buf->head[0].iov_len;
+        if (len <= buf->page_len) {
+                int last = (buf->page_base + len - 1)
+                                        >>PAGE_CACHE_SHIFT;
+                int offset = (buf->page_base + len - 1)
+                                        & (PAGE_CACHE_SIZE - 1);
+                ptr = kmap_atomic(buf->pages[last], KM_SKB_SUNRPC_DATA);
+                pad = *(ptr + offset);
+                kunmap_atomic(ptr, KM_SKB_SUNRPC_DATA);
+                goto out;
+        } else
+                len -= buf->page_len;
+        BUG_ON(len > buf->tail[0].iov_len);
+        pad = *(u8 *)(buf->tail[0].iov_base + len - 1);
+out:
+        /* XXX: NOTE: we do not adjust the page lengths--they represent
+         * a range of data in the real filesystem page cache, and we need
+         * to know that range so the xdr code can properly place read data.
+         * However adjusting the head length, as we do above, is harmless.
+         * In the case of a request that fits into a single page, the server
+         * also uses length and head length together to determine the original
+         * start of the request to copy the request for deferal; so it's
+         * easier on the server if we adjust head and tail length in tandem.
+         * It's not really a problem that we don't fool with the page and
+         * tail lengths, though--at worst badly formed xdr might lead the
+         * server to attempt to parse the padding.
+         * XXX: Document all these weird requirements for gss mechanism
+         * wrap/unwrap functions. */
+        if (pad > blocksize)
+                return -EINVAL;
+        if (buf->len > pad)
+                buf->len -= pad;
+        else
+                return -EINVAL;
+        return 0;
+}
+
+static inline void
+make_confounder(char *p, int blocksize)
+{
+        static u64 i = 0;
+        u64 *q = (u64 *)p;
+
+        /* rfc1964 claims this should be "random".  But all that's really
+         * necessary is that it be unique.  And not even that is necessary in
+         * our case since our "gssapi" implementation exists only to support
+         * rpcsec_gss, so we know that the only buffers we will ever encrypt
+         * already begin with a unique sequence number.  Just to hedge my bets
+         * I'll make a half-hearted attempt at something unique, but ensuring
+         * uniqueness would mean worrying about atomicity and rollover, and I
+         * don't care enough. */
+
+        BUG_ON(blocksize != 8);
+        *q = i++;
+}
+
+/* Assumptions: the head and tail of inbuf are ours to play with.
+ * The pages, however, may be real pages in the page cache and we replace
+ * them with scratch pages from **pages before writing to them. */
+/* XXX: obviously the above should be documentation of wrap interface,
+ * and shouldn't be in this kerberos-specific file. */
+
+/* XXX factor out common code with seal/unseal. */
+
+u32
+gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
+                struct xdr_buf *buf, struct page **pages)
+{
+        struct krb5_ctx         *kctx = ctx->internal_ctx_id;
+        s32                     checksum_type;
+        struct xdr_netobj       md5cksum = {.len = 0, .data = NULL};
+        int                     blocksize = 0, plainlen;
+        unsigned char           *ptr, *krb5_hdr, *msg_start;
+        s32                     now;
+        int                     headlen;
+        struct page             **tmp_pages;
+
+        dprintk("RPC:     gss_wrap_kerberos\n");
+
+        now = get_seconds();
+
+        switch (kctx->signalg) {
+                case SGN_ALG_DES_MAC_MD5:
+                        checksum_type = CKSUMTYPE_RSA_MD5;
+                        break;
+                default:
+                        dprintk("RPC:      gss_krb5_seal: kctx->signalg %d not"
+                                " supported\n", kctx->signalg);
+                        goto out_err;
+        }
+        if (kctx->sealalg != SEAL_ALG_NONE && kctx->sealalg != SEAL_ALG_DES) {
+                dprintk("RPC:      gss_krb5_seal: kctx->sealalg %d not supported\n",
+                        kctx->sealalg);
+                goto out_err;
+        }
+
+        blocksize = crypto_tfm_alg_blocksize(kctx->enc);
+        gss_krb5_add_padding(buf, offset, blocksize);
+        BUG_ON((buf->len - offset) % blocksize);
+        plainlen = blocksize + buf->len - offset;
+
+        headlen = g_token_size(&kctx->mech_used, 22 + plainlen) -
+                                                (buf->len - offset);
+
+        ptr = buf->head[0].iov_base + offset;
+        /* shift data to make room for header. */
+        /* XXX Would be cleverer to encrypt while copying. */
+        /* XXX bounds checking, slack, etc. */
+        memmove(ptr + headlen, ptr, buf->head[0].iov_len - offset);
+        buf->head[0].iov_len += headlen;
+        buf->len += headlen;
+        BUG_ON((buf->len - offset - headlen) % blocksize);
+
+        g_make_token_header(&kctx->mech_used, 22 + plainlen, &ptr);
+
+
+        *ptr++ = (unsigned char) ((KG_TOK_WRAP_MSG>>8)&0xff);
+        *ptr++ = (unsigned char) (KG_TOK_WRAP_MSG&0xff);
+
+        /* ptr now at byte 2 of header described in rfc 1964, section 1.2.1: */
+        krb5_hdr = ptr - 2;
+        msg_start = krb5_hdr + 24;
+        /* XXXJBF: */ BUG_ON(buf->head[0].iov_base + offset + headlen != msg_start + blocksize);
+
+        *(u16 *)(krb5_hdr + 2) = htons(kctx->signalg);
+        memset(krb5_hdr + 4, 0xff, 4);
+        *(u16 *)(krb5_hdr + 4) = htons(kctx->sealalg);
+
+        make_confounder(msg_start, blocksize);
+
+        /* XXXJBF: UGH!: */
+        tmp_pages = buf->pages;
+        buf->pages = pages;
+        if (make_checksum(checksum_type, krb5_hdr, 8, buf,
+                                offset + headlen - blocksize, &md5cksum))
+                goto out_err;
+        buf->pages = tmp_pages;
+
+        switch (kctx->signalg) {
+        case SGN_ALG_DES_MAC_MD5:
+                if (krb5_encrypt(kctx->seq, NULL, md5cksum.data,
+                                  md5cksum.data, md5cksum.len))
+                        goto out_err;
+                memcpy(krb5_hdr + 16,
+                       md5cksum.data + md5cksum.len - KRB5_CKSUM_LENGTH,
+                       KRB5_CKSUM_LENGTH);
+
+                dprintk("RPC:      make_seal_token: cksum data: \n");
+                print_hexl((u32 *) (krb5_hdr + 16), KRB5_CKSUM_LENGTH, 0);
+                break;
+        default:
+                BUG();
+        }
+
+        kfree(md5cksum.data);
+
+        /* XXX would probably be more efficient to compute checksum
+         * and encrypt at the same time: */
+        if ((krb5_make_seq_num(kctx->seq, kctx->initiate ? 0 : 0xff,
+                               kctx->seq_send, krb5_hdr + 16, krb5_hdr + 8)))
+                goto out_err;
+
+        if (gss_encrypt_xdr_buf(kctx->enc, buf, offset + headlen - blocksize,
+                                                                        pages))
+                goto out_err;
+
+        kctx->seq_send++;
+
+        return ((kctx->endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE);
+out_err:
+        if (md5cksum.data) kfree(md5cksum.data);
+        return GSS_S_FAILURE;
+}
+
+u32
+gss_unwrap_kerberos(struct gss_ctx *ctx, int offset, struct xdr_buf *buf)
+{
+        struct krb5_ctx         *kctx = ctx->internal_ctx_id;
+        int                     signalg;
+        int                     sealalg;
+        s32                     checksum_type;
+        struct xdr_netobj       md5cksum = {.len = 0, .data = NULL};
+        s32                     now;
+        int                     direction;
+        s32                     seqnum;
+        unsigned char           *ptr;
+        int                     bodysize;
+        u32                     ret = GSS_S_DEFECTIVE_TOKEN;
+        void                    *data_start, *orig_start;
+        int                     data_len;
+        int                     blocksize;
+
+        dprintk("RPC:      gss_unwrap_kerberos\n");
+
+        ptr = (u8 *)buf->head[0].iov_base + offset;
+        if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr,
+                                        buf->len - offset))
+                goto out;
+
+        if ((*ptr++ != ((KG_TOK_WRAP_MSG>>8)&0xff)) ||
+            (*ptr++ !=  (KG_TOK_WRAP_MSG    &0xff))   )
+                goto out;
+
+        /* XXX sanity-check bodysize?? */
+
+        /* get the sign and seal algorithms */
+
+        signalg = ptr[0] + (ptr[1] << 8);
+        sealalg = ptr[2] + (ptr[3] << 8);
+
+        /* Sanity checks */
+
+        if ((ptr[4] != 0xff) || (ptr[5] != 0xff))
+                goto out;
+
+        if (sealalg == 0xffff)
+                goto out;
+
+        /* in the current spec, there is only one valid seal algorithm per
+           key type, so a simple comparison is ok */
+
+        if (sealalg != kctx->sealalg)
+                goto out;
+
+        /* there are several mappings of seal algorithms to sign algorithms,
+           but few enough that we can try them all. */
+
+        if ((kctx->sealalg == SEAL_ALG_NONE && signalg > 1) ||
+            (kctx->sealalg == SEAL_ALG_1 && signalg != SGN_ALG_3) ||
+            (kctx->sealalg == SEAL_ALG_DES3KD &&
+             signalg != SGN_ALG_HMAC_SHA1_DES3_KD))
+                goto out;
+
+        if (gss_decrypt_xdr_buf(kctx->enc, buf,
+                        ptr + 22 - (unsigned char *)buf->head[0].iov_base))
+                goto out;
+
+        /* compute the checksum of the message */
+
+        /* initialize the the cksum */
+        switch (signalg) {
+        case SGN_ALG_DES_MAC_MD5:
+                checksum_type = CKSUMTYPE_RSA_MD5;
+                break;
+        default:
+                ret = GSS_S_DEFECTIVE_TOKEN;
+                goto out;
+        }
+
+        switch (signalg) {
+        case SGN_ALG_DES_MAC_MD5:
+                ret = make_checksum(checksum_type, ptr - 2, 8, buf,
+                         ptr + 22 - (unsigned char *)buf->head[0].iov_base, &md5cksum);
+                if (ret)
+                        goto out;
+
+                ret = krb5_encrypt(kctx->seq, NULL, md5cksum.data,
+                                   md5cksum.data, md5cksum.len);
+                if (ret)
+                        goto out;
+
+                if (memcmp(md5cksum.data + 8, ptr + 14, 8)) {
+                        ret = GSS_S_BAD_SIG;
+                        goto out;
+                }
+                break;
+        default:
+                ret = GSS_S_DEFECTIVE_TOKEN;
+                goto out;
+        }
+
+        /* it got through unscathed.  Make sure the context is unexpired */
+
+        now = get_seconds();
+
+        ret = GSS_S_CONTEXT_EXPIRED;
+        if (now > kctx->endtime)
+                goto out;
+
+        /* do sequencing checks */
+
+        ret = GSS_S_BAD_SIG;
+        if ((ret = krb5_get_seq_num(kctx->seq, ptr + 14, ptr + 6, &direction,
+                                    &seqnum)))
+                goto out;
+
+        if ((kctx->initiate && direction != 0xff) ||
+            (!kctx->initiate && direction != 0))
+                goto out;
+
+        /* Copy the data back to the right position.  XXX: Would probably be
+         * better to copy and encrypt at the same time. */
+
+        blocksize = crypto_tfm_alg_blocksize(kctx->enc);
+        data_start = ptr + 22 + blocksize;
+        orig_start = buf->head[0].iov_base + offset;
+        data_len = (buf->head[0].iov_base + buf->head[0].iov_len) - data_start;
+        memmove(orig_start, data_start, data_len);
+        buf->head[0].iov_len -= (data_start - orig_start);
+        buf->len -= (data_start - orig_start);
+
+        ret = GSS_S_DEFECTIVE_TOKEN;
+        if (gss_krb5_remove_padding(buf, blocksize))
+                goto out;
+
+        ret = GSS_S_COMPLETE;
+out:
+        if (md5cksum.data) kfree(md5cksum.data);
+        return ret;
+}
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index 58aeaddd8c79..b048bf672da2 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -250,13 +250,11 @@ gss_import_sec_context(const void *input_token, size_t bufsize,
 
 u32
 gss_get_mic(struct gss_ctx      *context_handle,
-            u32                 qop,
             struct xdr_buf      *message,
             struct xdr_netobj   *mic_token)
 {
          return context_handle->mech_type->gm_ops
                 ->gss_get_mic(context_handle,
-                              qop,
                               message,
                               mic_token);
 }
@@ -266,16 +264,34 @@ gss_get_mic(struct gss_ctx	*context_handle,
 u32
 gss_verify_mic(struct gss_ctx           *context_handle,
                struct xdr_buf           *message,
-               struct xdr_netobj        *mic_token,
-               u32                      *qstate)
+               struct xdr_netobj        *mic_token)
 {
         return context_handle->mech_type->gm_ops
                 ->gss_verify_mic(context_handle,
                                  message,
-                                 mic_token,
-                                 qstate);
+                                 mic_token);
 }
 
+u32
+gss_wrap(struct gss_ctx *ctx_id,
+         int            offset,
+         struct xdr_buf *buf,
+         struct page    **inpages)
+{
+        return ctx_id->mech_type->gm_ops
+                ->gss_wrap(ctx_id, offset, buf, inpages);
+}
+
+u32
+gss_unwrap(struct gss_ctx       *ctx_id,
+           int                  offset,
+           struct xdr_buf       *buf)
+{
+        return ctx_id->mech_type->gm_ops
+                ->gss_unwrap(ctx_id, offset, buf);
+}
+
+
 /* gss_delete_sec_context: free all resources associated with context_handle.
  * Note this differs from the RFC 2744-specified prototype in that we don't
  * bother returning an output token, since it would never be used anyway. */
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index 6c97d61baa9b..39b3edc14694 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -224,18 +224,13 @@ gss_delete_sec_context_spkm3(void *internal_ctx) {
 static u32
 gss_verify_mic_spkm3(struct gss_ctx             *ctx,
                         struct xdr_buf          *signbuf,
-                        struct xdr_netobj       *checksum,
-                        u32             *qstate) {
+                        struct xdr_netobj       *checksum)
+{
         u32 maj_stat = 0;
-        int qop_state = 0;
         struct spkm3_ctx *sctx = ctx->internal_ctx_id;
 
         dprintk("RPC: gss_verify_mic_spkm3 calling spkm3_read_token\n");
-        maj_stat = spkm3_read_token(sctx, checksum, signbuf, &qop_state,
-                                   SPKM_MIC_TOK);
-
-        if (!maj_stat && qop_state)
-            *qstate = qop_state;
+        maj_stat = spkm3_read_token(sctx, checksum, signbuf, SPKM_MIC_TOK);
 
         dprintk("RPC: gss_verify_mic_spkm3 returning %d\n", maj_stat);
         return maj_stat;
@@ -243,15 +238,15 @@ gss_verify_mic_spkm3(struct gss_ctx		*ctx,
 
 static u32
 gss_get_mic_spkm3(struct gss_ctx        *ctx,
-                     u32                qop,
                      struct xdr_buf     *message_buffer,
-                     struct xdr_netobj  *message_token) {
+                     struct xdr_netobj  *message_token)
+{
         u32 err = 0;
         struct spkm3_ctx *sctx = ctx->internal_ctx_id;
 
         dprintk("RPC: gss_get_mic_spkm3\n");
 
-        err = spkm3_make_token(sctx, qop, message_buffer,
+        err = spkm3_make_token(sctx, message_buffer,
                               message_token, SPKM_MIC_TOK);
         return err;
 }
@@ -264,8 +259,8 @@ static struct gss_api_ops gss_spkm3_ops = {
 };
 
 static struct pf_desc gss_spkm3_pfs[] = {
-        {RPC_AUTH_GSS_SPKM, 0, RPC_GSS_SVC_NONE, "spkm3"},
-        {RPC_AUTH_GSS_SPKMI, 0, RPC_GSS_SVC_INTEGRITY, "spkm3i"},
+        {RPC_AUTH_GSS_SPKM, RPC_GSS_SVC_NONE, "spkm3"},
+        {RPC_AUTH_GSS_SPKMI, RPC_GSS_SVC_INTEGRITY, "spkm3i"},
 };
 
 static struct gss_api_mech gss_spkm3_mech = {
diff --git a/net/sunrpc/auth_gss/gss_spkm3_seal.c b/net/sunrpc/auth_gss/gss_spkm3_seal.c
index 25339868d462..148201e929d0 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_seal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_seal.c
@@ -51,7 +51,7 @@
  */
 
 u32
-spkm3_make_token(struct spkm3_ctx *ctx, int qop_req,
+spkm3_make_token(struct spkm3_ctx *ctx,
                    struct xdr_buf * text, struct xdr_netobj * token,
                    int toktype)
 {
@@ -68,8 +68,6 @@ spkm3_make_token(struct spkm3_ctx *ctx, int qop_req,
         dprintk("RPC: spkm3_make_token\n");
 
         now = jiffies;
-        if (qop_req != 0)
-                goto out_err;
 
         if (ctx->ctx_id.len != 16) {
                 dprintk("RPC: spkm3_make_token BAD ctx_id.len %d\n",
diff --git a/net/sunrpc/auth_gss/gss_spkm3_unseal.c b/net/sunrpc/auth_gss/gss_spkm3_unseal.c
index 65ce81bf0bc4..c3c0d9586103 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_unseal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_unseal.c
@@ -52,7 +52,7 @@ u32
 spkm3_read_token(struct spkm3_ctx *ctx,
                 struct xdr_netobj *read_token,    /* checksum */
                 struct xdr_buf *message_buffer, /* signbuf */
-                int *qop_state, int toktype)
+                int toktype)
 {
         s32                     code;
         struct xdr_netobj       wire_cksum = {.len =0, .data = NULL};
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index e3308195374e..e4ada15ed856 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -566,8 +566,7 @@ gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
 
         if (rqstp->rq_deferred) /* skip verification of revisited request */
                 return SVC_OK;
-        if (gss_verify_mic(ctx_id, &rpchdr, &checksum, NULL)
-                                                        != GSS_S_COMPLETE) {
+        if (gss_verify_mic(ctx_id, &rpchdr, &checksum) != GSS_S_COMPLETE) {
                 *authp = rpcsec_gsserr_credproblem;
                 return SVC_DENIED;
         }
@@ -604,7 +603,7 @@ gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
         xdr_buf_from_iov(&iov, &verf_data);
         p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
         mic.data = (u8 *)(p + 1);
-        maj_stat = gss_get_mic(ctx_id, 0, &verf_data, &mic);
+        maj_stat = gss_get_mic(ctx_id, &verf_data, &mic);
         if (maj_stat != GSS_S_COMPLETE)
                 return -1;
         *p++ = htonl(mic.len);
@@ -710,7 +709,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
                 goto out;
         if (read_bytes_from_xdr_buf(buf, integ_len + 4, mic.data, mic.len))
                 goto out;
-        maj_stat = gss_verify_mic(ctx, &integ_buf, &mic, NULL);
+        maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
         if (maj_stat != GSS_S_COMPLETE)
                 goto out;
         if (ntohl(svc_getu32(&buf->head[0])) != seq)
@@ -1012,7 +1011,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
                         resv = &resbuf->tail[0];
                 }
                 mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
-                if (gss_get_mic(gsd->rsci->mechctx, 0, &integ_buf, &mic))
+                if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
                         goto out_err;
                 svc_putu32(resv, htonl(mic.len));
                 memset(mic.data + mic.len, 0,
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 534274056329..702ede309b06 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -710,9 +710,16 @@ call_encode(struct rpc_task *task)
                 rpc_exit(task, -EIO);
                 return;
         }
-        if (encode != NULL)
-                task->tk_status = rpcauth_wrap_req(task, encode, req, p,
-                                task->tk_msg.rpc_argp);
+        if (encode == NULL)
+                return;
+
+        task->tk_status = rpcauth_wrap_req(task, encode, req, p,
+                        task->tk_msg.rpc_argp);
+        if (task->tk_status == -ENOMEM) {
+                /* XXX: Is this sane? */
+                rpc_delay(task, 3*HZ);
+                task->tk_status = -EAGAIN;
+        }
 }
 
 /*
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index ded6c63f11ec..649d609e7d94 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -177,6 +177,8 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
                 __rpc_purge_upcall(inode, -EPIPE);
         if (rpci->ops->release_pipe)
                 rpci->ops->release_pipe(inode);
+        if (!rpci->nreaders && !rpci->nwriters)
+                rpci->ops = NULL;
 out:
         up(&inode->i_sem);
         return 0;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 1ba55dc38b7a..6dda3860351f 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -839,6 +839,7 @@ static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
         req->rq_task    = task;
         req->rq_xprt    = xprt;
         req->rq_xid     = xprt_alloc_xid(xprt);
+        req->rq_release_snd_buf = NULL;
         dprintk("RPC: %4d reserved req %p xid %08x\n", task->tk_pid,
                         req, ntohl(req->rq_xid));
 }
@@ -867,6 +868,8 @@ void xprt_release(struct rpc_task *task)
                                 xprt->last_used + xprt->idle_timeout);
         spin_unlock_bh(&xprt->transport_lock);
         task->tk_rqstp = NULL;
+        if (req->rq_release_snd_buf)
+                req->rq_release_snd_buf(req);
         memset(req, 0, sizeof(*req));   /* mark unused */
 
         dprintk("RPC: %4d release request %p\n", task->tk_pid, req);