89 files changed, 1227 insertions, 817 deletions
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index f2668390e8f7..42008395534d 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -62,8 +62,8 @@ typedef uint8_t u8;
 #endif
 /* We can have up to 256 pages for devices. */
 #define DEVICE_PAGES 256
-/* This fits nicely in a single 4096-byte page. */
+/* This will occupy 2 pages: it must be a power of 2. */
-#define VIRTQUEUE_NUM 127
+#define VIRTQUEUE_NUM 128
 /*L:120 verbose is both a global flag and a macro.  The C preprocessor allows
 * this, and although I wouldn't recommend it, it works quite nicely here. */
@@ -1036,7 +1036,8 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
        void *p;
        /* First we need some pages for this virtqueue. */
-        pages = (vring_size(num_descs) + getpagesize() - 1) / getpagesize();
+        pages = (vring_size(num_descs, getpagesize()) + getpagesize() - 1)
+                / getpagesize();
        p = get_pages(pages);
        /* Initialize the configuration. */
@@ -1045,7 +1046,7 @@ static void add_virtqueue(struct device *dev, unsigned int num_descs,
        vq->config.pfn = to_guest_phys(p) / getpagesize();
        /* Initialize the vring. */
-        vring_init(&vq->vring, num_descs, p);
+        vring_init(&vq->vring, num_descs, p, getpagesize());
        /* Add the configuration information to this device's descriptor. */
        add_desc_field(dev, VIRTIO_CONFIG_F_VIRTQUEUE,
@@ -1342,7 +1343,7 @@ static bool service_io(struct device *dev)
        if (out->type & VIRTIO_BLK_T_SCSI_CMD) {
                fprintf(stderr, "Scsi commands unsupported\n");
                in->status = VIRTIO_BLK_S_UNSUPP;
-                wlen = sizeof(in);
+                wlen = sizeof(*in);
        } else if (out->type & VIRTIO_BLK_T_OUT) {
                /* Write */
@@ -1363,7 +1364,7 @@ static bool service_io(struct device *dev)
                        /* Die, bad Guest, die. */
                        errx(1, "Write past end %llu+%u", off, ret);
                }
-                wlen = sizeof(in);
+                wlen = sizeof(*in);
                in->status = (ret >= 0 ? VIRTIO_BLK_S_OK : VIRTIO_BLK_S_IOERR);
        } else {
                /* Read */
@@ -1376,10 +1377,10 @@ static bool service_io(struct device *dev)
                ret = readv(vblk->fd, iov+1, in_num-1);
                verbose("READ from sector %llu: %i\n", out->sector, ret);
                if (ret >= 0) {
-                        wlen = sizeof(in) + ret;
+                        wlen = sizeof(*in) + ret;
                        in->status = VIRTIO_BLK_S_OK;
                } else {
-                        wlen = sizeof(in);
+                        wlen = sizeof(*in);
                        in->status = VIRTIO_BLK_S_IOERR;
                }
        }
diff --git a/MAINTAINERS b/MAINTAINERS
index 6a9702726239..cad0882754a6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3454,15 +3454,10 @@ L:	lm-sensors@lm-sensors.org
 S:      Maintained
 SOFTMAC LAYER (IEEE 802.11)
-P:      Johannes Berg
-M:      johannes@sipsolutions.net
-P:      Joe Jezak
-M:      josejx@gentoo.org
 P:      Daniel Drake
 M:      dsd@gentoo.org
-W:      http://softmac.sipsolutions.net/
 L:      linux-wireless@vger.kernel.org
-S:      Maintained
+S:      Obsolete
 SOFTWARE RAID (Multiple Disks) SUPPORT
 P:      Ingo Molnar
diff --git a/arch/x86/kernel/i387_64.c b/arch/x86/kernel/i387_64.c
index 56c1f1147109..bfaff28fb134 100644
--- a/arch/x86/kernel/i387_64.c
+++ b/arch/x86/kernel/i387_64.c
@@ -92,13 +92,14 @@ int save_i387(struct _fpstate __user *buf)
        if (task_thread_info(tsk)->status & TS_USEDFPU) {
                err = save_i387_checking((struct i387_fxsave_struct __user *)buf);
                if (err) return err;
+                task_thread_info(tsk)->status &= ~TS_USEDFPU;
                stts();
-                } else {
+        } else {
-                if (__copy_to_user(buf, &tsk->thread.i387.fxsave, 
+                if (__copy_to_user(buf, &tsk->thread.i387.fxsave,
                                   sizeof(struct i387_fxsave_struct)))
                        return -1;
-        } 
+        }
-                return 1;
+        return 1;
 }
 /*
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index c2ce0ad21693..192c244f6190 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -132,7 +132,7 @@ static int acpi_battery_technology(struct acpi_battery *battery)
        return POWER_SUPPLY_TECHNOLOGY_UNKNOWN;
 }
-static int acpi_battery_update(struct acpi_battery *battery);
+static int acpi_battery_get_state(struct acpi_battery *battery);
 static int acpi_battery_get_property(struct power_supply *psy,
                                     enum power_supply_property psp,
@@ -140,10 +140,11 @@ static int acpi_battery_get_property(struct power_supply *psy,
 {
        struct acpi_battery *battery = to_acpi_battery(psy);
-        if ((!acpi_battery_present(battery)) &&
+        if (acpi_battery_present(battery)) {
-             psp != POWER_SUPPLY_PROP_PRESENT)
+                /* run battery update only if it is present */
+                acpi_battery_get_state(battery);
+        } else if (psp != POWER_SUPPLY_PROP_PRESENT)
                return -ENODEV;
-        acpi_battery_update(battery);
        switch (psp) {
        case POWER_SUPPLY_PROP_STATUS:
                if (battery->state & 0x01)
@@ -457,6 +458,7 @@ static void sysfs_remove_battery(struct acpi_battery *battery)
                return;
        device_remove_file(battery->bat.dev, &alarm_attr);
        power_supply_unregister(&battery->bat);
+        battery->bat.dev = NULL;
 }
 static int acpi_battery_update(struct acpi_battery *battery)
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index 729f1cd93606..7a6eead63a6b 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -494,6 +494,7 @@ static void init_vmcb(struct vmcb *vmcb)
                 */
                /*              (1ULL << INTERCEPT_SELECTIVE_CR0) | */
                                (1ULL << INTERCEPT_CPUID) |
+                                (1ULL << INTERCEPT_INVD) |
                                (1ULL << INTERCEPT_HLT) |
                                (1ULL << INTERCEPT_INVLPGA) |
                                (1ULL << INTERCEPT_IOIO_PROT) |
@@ -507,6 +508,7 @@ static void init_vmcb(struct vmcb *vmcb)
                                (1ULL << INTERCEPT_STGI) |
                                (1ULL << INTERCEPT_CLGI) |
                                (1ULL << INTERCEPT_SKINIT) |
+                                (1ULL << INTERCEPT_WBINVD) |
                                (1ULL << INTERCEPT_MONITOR) |
                                (1ULL << INTERCEPT_MWAIT);
@@ -561,6 +563,12 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu)
        struct vcpu_svm *svm = to_svm(vcpu);
        init_vmcb(svm->vmcb);
+        if (vcpu->vcpu_id != 0) {
+                svm->vmcb->save.rip = 0;
+                svm->vmcb->save.cs.base = svm->vcpu.sipi_vector << 12;
+                svm->vmcb->save.cs.selector = svm->vcpu.sipi_vector << 8;
+        }
 }
 static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
@@ -1241,6 +1249,7 @@ static int (*svm_exit_handlers[])(struct vcpu_svm *svm,
        [SVM_EXIT_VINTR]                        = interrupt_window_interception,
        /* [SVM_EXIT_CR0_SEL_WRITE]             = emulate_on_interception, */
        [SVM_EXIT_CPUID]                        = cpuid_interception,
+        [SVM_EXIT_INVD]                         = emulate_on_interception,
        [SVM_EXIT_HLT]                          = halt_interception,
        [SVM_EXIT_INVLPG]                       = emulate_on_interception,
        [SVM_EXIT_INVLPGA]                      = invalid_op_interception,
@@ -1255,6 +1264,7 @@ static int (*svm_exit_handlers[])(struct vcpu_svm *svm,
        [SVM_EXIT_STGI]                         = invalid_op_interception,
        [SVM_EXIT_CLGI]                         = invalid_op_interception,
        [SVM_EXIT_SKINIT]                       = invalid_op_interception,
+        [SVM_EXIT_WBINVD]                       = emulate_on_interception,
        [SVM_EXIT_MONITOR]                      = invalid_op_interception,
        [SVM_EXIT_MWAIT]                        = invalid_op_interception,
 };
@@ -1579,10 +1589,6 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 #endif
                : "cc", "memory" );
-        local_irq_disable();
-        stgi();
        if ((svm->vmcb->save.dr7 & 0xff))
                load_db_regs(svm->host_db_regs);
@@ -1599,6 +1605,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
        reload_tss(vcpu);
+        local_irq_disable();
+        stgi();
        svm->next_rip = 0;
 }
diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
index a6ace302e0cd..33b181451557 100644
--- a/drivers/kvm/x86_emulate.c
+++ b/drivers/kvm/x86_emulate.c
@@ -167,7 +167,7 @@ static u8 opcode_table[256] = {
 static u16 twobyte_table[256] = {
        /* 0x00 - 0x0F */
        0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
-        0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
+        ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
        /* 0x10 - 0x1F */
        0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
        /* 0x20 - 0x2F */
@@ -980,17 +980,6 @@ done_prefixes:
                        goto cannot_emulate;
                dst.val = (s32) src.val;
                break;
-        case 0x6a: /* push imm8 */
-                src.val = 0L;
-                src.val = insn_fetch(s8, 1, _eip);
-push:
-                dst.type  = OP_MEM;
-                dst.bytes = op_bytes;
-                dst.val = src.val;
-                register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
-                dst.ptr = (void *) register_address(ctxt->ss_base,
-                                                        _regs[VCPU_REGS_RSP]);
-                break;
        case 0x80 ... 0x83:     /* Grp1 */
                switch (modrm_reg) {
                case 0:
@@ -1243,6 +1232,17 @@ special_insn:
                register_address_increment(_regs[VCPU_REGS_RSP], op_bytes);
                no_wb = 1; /* Disable writeback. */
                break;
+        case 0x6a: /* push imm8 */
+                src.val = 0L;
+                src.val = insn_fetch(s8, 1, _eip);
+        push:
+                dst.type  = OP_MEM;
+                dst.bytes = op_bytes;
+                dst.val = src.val;
+                register_address_increment(_regs[VCPU_REGS_RSP], -op_bytes);
+                dst.ptr = (void *) register_address(ctxt->ss_base,
+                                                        _regs[VCPU_REGS_RSP]);
+                break;
        case 0x6c:              /* insb */
        case 0x6d:              /* insw/insd */
                 if (kvm_emulate_pio_string(ctxt->vcpu, NULL,
@@ -1532,6 +1532,8 @@ twobyte_special_insn:
        case 0x06:
                emulate_clts(ctxt->vcpu);
                break;
+        case 0x08:              /* invd */
+                break;
        case 0x09:              /* wbinvd */
                break;
        case 0x0d:              /* GrpP (prefetch) */
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 8904f72f97c6..66f38722253a 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -200,7 +200,8 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
        /* Figure out how many pages the ring will take, and map that memory */
        lvq->pages = lguest_map((unsigned long)lvq->config.pfn << PAGE_SHIFT,
-                                DIV_ROUND_UP(vring_size(lvq->config.num),
+                                DIV_ROUND_UP(vring_size(lvq->config.num,
+                                                        PAGE_SIZE),
                                             PAGE_SIZE));
        if (!lvq->pages) {
                err = -ENOMEM;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index e396c9d2af8d..a75be57fb209 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -146,6 +146,7 @@ static void try_fill_recv(struct virtnet_info *vi)
        struct scatterlist sg[1+MAX_SKB_FRAGS];
        int num, err;
+        sg_init_table(sg, 1+MAX_SKB_FRAGS);
        for (;;) {
                skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN);
                if (unlikely(!skb))
@@ -231,6 +232,8 @@ static int start_xmit(struct sk_buff *skb, struct net_device *dev)
        const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
        DECLARE_MAC_BUF(mac);
+        sg_init_table(sg, 1+MAX_SKB_FRAGS);
        pr_debug("%s: xmit %p %s\n", dev->name, skb, print_mac(mac, dest));
        free_old_xmit_skbs(vi);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 4f22a7174caf..be7c9f42a340 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -8354,6 +8354,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        SET_IEEE80211_DEV(hw, &pdev->dev);
+        hw->rate_control_algorithm = "iwl-3945-rs";
        IWL_DEBUG_INFO("*** LOAD DRIVER ***\n");
        priv = hw->priv;
        priv->hw = hw;
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index d60adcb9bd4a..6757c6c1b25a 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -8955,6 +8955,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        SET_IEEE80211_DEV(hw, &pdev->dev);
+        hw->rate_control_algorithm = "iwl-4965-rs";
        IWL_DEBUG_INFO("*** LOAD DRIVER ***\n");
        priv = hw->priv;
        priv->hw = hw;
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index c12a741b5574..85a20546e827 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -440,6 +440,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
                        break;
                case SSB_BUSTYPE_PCMCIA:
 #ifdef CONFIG_SSB_PCMCIAHOST
+                        sdev->irq = bus->host_pcmcia->irq.AssignedIRQ;
                        dev->parent = &bus->host_pcmcia->dev;
 #endif
                        break;
@@ -1147,7 +1148,10 @@ static int __init ssb_modinit(void)
        return err;
 }
-subsys_initcall(ssb_modinit);
+/* ssb must be initialized after PCI but before the ssb drivers.
+ * That means we must use some initcall between subsys_initcall
+ * and device_initcall. */
+fs_initcall(ssb_modinit);
 static void __exit ssb_modexit(void)
 {
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index b6abee846f02..bb44a76b3eb5 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -63,17 +63,17 @@ int ssb_pcmcia_switch_coreidx(struct ssb_bus *bus,
                err = pcmcia_access_configuration_register(pdev, &reg);
                if (err != CS_SUCCESS)
                        goto error;
-                read_addr |= (reg.Value & 0xF) << 12;
+                read_addr |= ((u32)(reg.Value & 0x0F)) << 12;
                reg.Offset = 0x30;
                err = pcmcia_access_configuration_register(pdev, &reg);
                if (err != CS_SUCCESS)
                        goto error;
-                read_addr |= reg.Value << 16;
+                read_addr |= ((u32)reg.Value) << 16;
                reg.Offset = 0x32;
                err = pcmcia_access_configuration_register(pdev, &reg);
                if (err != CS_SUCCESS)
                        goto error;
-                read_addr |= reg.Value << 24;
+                read_addr |= ((u32)reg.Value) << 24;
                cur_core = (read_addr - SSB_ENUM_BASE) / SSB_CORE_SIZE;
                if (cur_core == coreidx)
@@ -152,28 +152,29 @@ error:
        goto out_unlock;
 }
-/* These are the main device register access functions.
+static int select_core_and_segment(struct ssb_device *dev,
- * do_select_core is inline to have the likely hotpath inline.
+                                   u16 *offset)
- * All unlikely codepaths are out-of-line. */
-static inline int do_select_core(struct ssb_bus *bus,
-                                 struct ssb_device *dev,
-                                 u16 *offset)
 {
+        struct ssb_bus *bus = dev->bus;
        int err;
-        u8 need_seg = (*offset >= 0x800) ? 1 : 0;
+        u8 need_segment;
+        if (*offset >= 0x800) {
+                *offset -= 0x800;
+                need_segment = 1;
+        } else
+                need_segment = 0;
        if (unlikely(dev != bus->mapped_device)) {
                err = ssb_pcmcia_switch_core(bus, dev);
                if (unlikely(err))
                        return err;
        }
-        if (unlikely(need_seg != bus->mapped_pcmcia_seg)) {
+        if (unlikely(need_segment != bus->mapped_pcmcia_seg)) {
-                err = ssb_pcmcia_switch_segment(bus, need_seg);
+                err = ssb_pcmcia_switch_segment(bus, need_segment);
                if (unlikely(err))
                        return err;
        }
-        if (need_seg == 1)
-                *offset -= 0x800;
        return 0;
 }
@@ -181,32 +182,31 @@ static inline int do_select_core(struct ssb_bus *bus,
 static u16 ssb_pcmcia_read16(struct ssb_device *dev, u16 offset)
 {
        struct ssb_bus *bus = dev->bus;
-        u16 x;
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                return 0xFFFF;
-        x = readw(bus->mmio + offset);
-        return x;
+        return readw(bus->mmio + offset);
 }
 static u32 ssb_pcmcia_read32(struct ssb_device *dev, u16 offset)
 {
        struct ssb_bus *bus = dev->bus;
-        u32 x;
+        u32 lo, hi;
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                return 0xFFFFFFFF;
-        x = readl(bus->mmio + offset);
+        lo = readw(bus->mmio + offset);
+        hi = readw(bus->mmio + offset + 2);
-        return x;
+        return (lo | (hi << 16));
 }
 static void ssb_pcmcia_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
        struct ssb_bus *bus = dev->bus;
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                return;
        writew(value, bus->mmio + offset);
 }
@@ -215,12 +215,12 @@ static void ssb_pcmcia_write32(struct ssb_device *dev, u16 offset, u32 value)
 {
        struct ssb_bus *bus = dev->bus;
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                return;
-        readw(bus->mmio + offset);
+        writeb((value & 0xFF000000) >> 24, bus->mmio + offset + 3);
-        writew(value >> 16, bus->mmio + offset + 2);
+        writeb((value & 0x00FF0000) >> 16, bus->mmio + offset + 2);
-        readw(bus->mmio + offset);
+        writeb((value & 0x0000FF00) >> 8, bus->mmio + offset + 1);
-        writew(value, bus->mmio + offset);
+        writeb((value & 0x000000FF) >> 0, bus->mmio + offset + 0);
 }
 /* Not "static", as it's used in main.c */
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 0e4baca21b8f..1dc04b6684e6 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -53,7 +53,7 @@ struct vring_virtqueue
        unsigned int num_added;
        /* Last used index we've seen. */
-        unsigned int last_used_idx;
+        u16 last_used_idx;
        /* How to notify other side. FIXME: commonalize hcalls! */
        void (*notify)(struct virtqueue *vq);
@@ -277,11 +277,17 @@ struct virtqueue *vring_new_virtqueue(unsigned int num,
        struct vring_virtqueue *vq;
        unsigned int i;
+        /* We assume num is a power of 2. */
+        if (num & (num - 1)) {
+                dev_warn(&vdev->dev, "Bad virtqueue length %u\n", num);
+                return NULL;
+        }
        vq = kmalloc(sizeof(*vq) + sizeof(void *)*num, GFP_KERNEL);
        if (!vq)
                return NULL;
-        vring_init(&vq->vring, num, pages);
+        vring_init(&vq->vring, num, pages, PAGE_SIZE);
        vq->vq.callback = callback;
        vq->vq.vdev = vdev;
        vq->vq.vq_ops = &vring_vq_ops;
diff --git a/fs/Kconfig b/fs/Kconfig
index c75c95406497..429a00228507 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -2007,7 +2007,7 @@ config CIFS_EXPERIMENTAL
 config CIFS_UPCALL
          bool "Kerberos/SPNEGO advanced session setup (EXPERIMENTAL)"
          depends on CIFS_EXPERIMENTAL
-          depends on CONNECTOR
+          depends on KEYS
          help
            Enables an upcall mechanism for CIFS which will be used to contact
            userspace helper utilities to provide SPNEGO packaged Kerberos
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 3d419163c3d3..64dd22239b21 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,7 @@
+Version 1.52
+------------
+Fix oops on second mount to server when null auth is used.
 Version 1.51
 ------------
 Fix memory leak in statfs when mounted to very old servers (e.g.
@@ -12,7 +16,12 @@ leak that causes cifsd not to stop and rmmod to fail to cleanup
 cifs_request_buffers pool. Fix problem with POSIX Open/Mkdir on
 bigendian architectures. Fix possible memory corruption when
 EAGAIN returned on kern_recvmsg. Return better error if server
-requires packet signing but client has disabled it.
+requires packet signing but client has disabled it. When mounted
+with cifsacl mount option - mode bits are approximated based
+on the contents of the ACL of the file or directory. When cifs
+mount helper is missing convert make sure that UNC name 
+has backslash (not forward slash) between ip address of server
+and the share name.
 Version 1.50
 ------------
diff --git a/fs/cifs/Makefile b/fs/cifs/Makefile
index ff6ba8d823f0..45e42fb97c19 100644
--- a/fs/cifs/Makefile
+++ b/fs/cifs/Makefile
@@ -3,4 +3,9 @@
 #
 obj-$(CONFIG_CIFS) += cifs.o
-cifs-objs := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o readdir.o ioctl.o sess.o export.o cifsacl.o
+cifs-y := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o \
+          link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o \
+          md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o \
+          readdir.o ioctl.o sess.o export.o cifsacl.o
+cifs-$(CONFIG_CIFS_UPCALL) += cifs_spnego.o
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index 2a01f3ef96a0..bcda2c6b6a04 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -77,8 +77,12 @@
 #define SPNEGO_OID_LEN 7
 #define NTLMSSP_OID_LEN  10
+#define KRB5_OID_LEN  7
+#define MSKRB5_OID_LEN  7
 static unsigned long SPNEGO_OID[7] = { 1, 3, 6, 1, 5, 5, 2 };
 static unsigned long NTLMSSP_OID[10] = { 1, 3, 6, 1, 4, 1, 311, 2, 2, 10 };
+static unsigned long KRB5_OID[7] = { 1, 2, 840, 113554, 1, 2, 2 };
+static unsigned long MSKRB5_OID[7] = { 1, 2, 840, 48018, 1, 2, 2 };
 /*
 * ASN.1 context.
@@ -457,6 +461,7 @@ decode_negTokenInit(unsigned char *security_blob, int length,
        unsigned long *oid = NULL;
        unsigned int cls, con, tag, oidlen, rc;
        int use_ntlmssp = FALSE;
+        int use_kerberos = FALSE;
        *secType = NTLM; /* BB eventually make Kerberos or NLTMSSP the default*/
@@ -545,18 +550,28 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                                return 0;
                        }
                        if ((tag == ASN1_OJI) && (con == ASN1_PRI)) {
-                                rc = asn1_oid_decode(&ctx, end, &oid, &oidlen);
+                                if (asn1_oid_decode(&ctx, end, &oid, &oidlen)) {
-                                if (rc) {
                                        cFYI(1,
                                          ("OID len = %d oid = 0x%lx 0x%lx "
                                           "0x%lx 0x%lx",
                                           oidlen, *oid, *(oid + 1),
                                           *(oid + 2), *(oid + 3)));
-                                        rc = compare_oid(oid, oidlen,
-                                                 NTLMSSP_OID, NTLMSSP_OID_LEN);
+                                        if (compare_oid(oid, oidlen,
-                                        kfree(oid);
+                                                        MSKRB5_OID,
-                                        if (rc)
+                                                        MSKRB5_OID_LEN))
+                                                use_kerberos = TRUE;
+                                        else if (compare_oid(oid, oidlen,
+                                                             KRB5_OID,
+                                                             KRB5_OID_LEN))
+                                                use_kerberos = TRUE;
+                                        else if (compare_oid(oid, oidlen,
+                                                             NTLMSSP_OID,
+                                                             NTLMSSP_OID_LEN))
                                                use_ntlmssp = TRUE;
+                                        kfree(oid);
                                }
                        } else {
                                cFYI(1, ("Should be an oid what is going on?"));
@@ -609,12 +624,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                         ctx.pointer)); /* is this UTF-8 or ASCII? */
        }
-        /* if (use_kerberos)
+        if (use_kerberos)
-           *secType = Kerberos
+                *secType = Kerberos;
-           else */
+        else if (use_ntlmssp)
-        if (use_ntlmssp) {
                *secType = NTLMSSP;
-        }
        return 1;
 }
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
new file mode 100644
index 000000000000..ad54a3a6e434
--- /dev/null
+++ b/fs/cifs/cifs_spnego.c
@@ -0,0 +1,128 @@
+/*
+ *   fs/cifs/cifs_spnego.c -- SPNEGO upcall management for CIFS
+ *
+ *   Copyright (c) 2007 Red Hat, Inc.
+ *   Author(s): Jeff Layton (jlayton@redhat.com)
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <linux/list.h>
+#include <linux/string.h>
+#include <keys/user-type.h>
+#include <linux/key-type.h>
+#include "cifsglob.h"
+#include "cifs_spnego.h"
+#include "cifs_debug.h"
+/* create a new cifs key */
+static int
+cifs_spnego_key_instantiate(struct key *key, const void *data, size_t datalen)
+{
+        char *payload;
+        int ret;
+        ret = -ENOMEM;
+        payload = kmalloc(datalen, GFP_KERNEL);
+        if (!payload)
+                goto error;
+        /* attach the data */
+        memcpy(payload, data, datalen);
+        rcu_assign_pointer(key->payload.data, payload);
+        ret = 0;
+error:
+        return ret;
+}
+static void
+cifs_spnego_key_destroy(struct key *key)
+{
+        kfree(key->payload.data);
+}
+/*
+ * keytype for CIFS spnego keys
+ */
+struct key_type cifs_spnego_key_type = {
+        .name           = "cifs.spnego",
+        .instantiate    = cifs_spnego_key_instantiate,
+        .match          = user_match,
+        .destroy        = cifs_spnego_key_destroy,
+        .describe       = user_describe,
+};
+/* get a key struct with a SPNEGO security blob, suitable for session setup */
+struct key *
+cifs_get_spnego_key(struct cifsSesInfo *sesInfo, const char *hostname)
+{
+        struct TCP_Server_Info *server = sesInfo->server;
+        char *description, *dp;
+        size_t desc_len;
+        struct key *spnego_key;
+        /* version + ;ip{4|6}= + address + ;host=hostname +
+                ;sec= + ;uid= + NULL */
+        desc_len = 4 + 5 + 32 + 1 + 5 + strlen(hostname) +
+                   strlen(";sec=krb5") + 7 + sizeof(uid_t)*2 + 1;
+        spnego_key = ERR_PTR(-ENOMEM);
+        description = kzalloc(desc_len, GFP_KERNEL);
+        if (description == NULL)
+                goto out;
+        dp = description;
+        /* start with version and hostname portion of UNC string */
+        spnego_key = ERR_PTR(-EINVAL);
+        sprintf(dp, "0x%2.2x;host=%s;", CIFS_SPNEGO_UPCALL_VERSION,
+                hostname);
+        dp = description + strlen(description);
+        /* add the server address */
+        if (server->addr.sockAddr.sin_family == AF_INET)
+                sprintf(dp, "ip4=" NIPQUAD_FMT,
+                        NIPQUAD(server->addr.sockAddr.sin_addr));
+        else if (server->addr.sockAddr.sin_family == AF_INET6)
+                sprintf(dp, "ip6=" NIP6_SEQFMT,
+                        NIP6(server->addr.sockAddr6.sin6_addr));
+        else
+                goto out;
+        dp = description + strlen(description);
+        /* for now, only sec=krb5 is valid */
+        if (server->secType == Kerberos)
+                sprintf(dp, ";sec=krb5");
+        else
+                goto out;
+        dp = description + strlen(description);
+        sprintf(dp, ";uid=0x%x", sesInfo->linux_uid);
+        cFYI(1, ("key description = %s", description));
+        spnego_key = request_key(&cifs_spnego_key_type, description, "");
+        if (cifsFYI && !IS_ERR(spnego_key)) {
+                struct cifs_spnego_msg *msg = spnego_key->payload.data;
+                cifs_dump_mem("SPNEGO reply blob:", msg->data,
+                                msg->secblob_len + msg->sesskey_len);
+        }
+out:
+        kfree(description);
+        return spnego_key;
+}
diff --git a/fs/cifs/cifs_spnego.h b/fs/cifs/cifs_spnego.h
new file mode 100644
index 000000000000..f443f3b35134
--- /dev/null
+++ b/fs/cifs/cifs_spnego.h
@@ -0,0 +1,46 @@
+/*
+ *   fs/cifs/cifs_spnego.h -- SPNEGO upcall management for CIFS
+ *
+ *   Copyright (c) 2007 Red Hat, Inc.
+ *   Author(s): Jeff Layton (jlayton@redhat.com)
+ *              Steve French (sfrench@us.ibm.com)
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#ifndef _CIFS_SPNEGO_H
+#define _CIFS_SPNEGO_H
+#define CIFS_SPNEGO_UPCALL_VERSION 1
+/*
+ * The version field should always be set to CIFS_SPNEGO_UPCALL_VERSION.
+ * The flags field is for future use. The request-key callout should set
+ * sesskey_len and secblob_len, and then concatenate the SessKey+SecBlob
+ * and stuff it in the data field.
+ */
+struct cifs_spnego_msg {
+        uint32_t        version;
+        uint32_t        flags;
+        uint32_t        sesskey_len;
+        uint32_t        secblob_len;
+        uint8_t         data[1];
+};
+#ifdef __KERNEL__
+extern struct key_type cifs_spnego_key_type;
+#endif /* KERNEL */
+#endif /* _CIFS_SPNEGO_H */
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index e8e56353f5a1..dabbce00712b 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -38,13 +38,13 @@ static struct cifs_wksid wksidarr[NUM_WK_SIDS] = {
        {{1, 1, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(18), 0, 0, 0, 0} }, "sys"},
        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(544), 0, 0, 0} }, "root"},
        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(545), 0, 0, 0} }, "users"},
-        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"}
+        {{1, 2, {0, 0, 0, 0, 0, 5}, {cpu_to_le32(32), cpu_to_le32(546), 0, 0, 0} }, "guest"} }
-};
+;
 /* security id for everyone */
-static const struct cifs_sid sid_everyone =
+static const struct cifs_sid sid_everyone = {
-                {1, 1, {0, 0, 0, 0, 0, 0}, {} };
+        1, 1, {0, 0, 0, 0, 0, 1}, {0} };
 /* group users */
 static const struct cifs_sid sid_user =
                {1, 2 , {0, 0, 0, 0, 0, 5}, {} };
@@ -97,7 +97,7 @@ int match_sid(struct cifs_sid *ctsid)
 /* if the two SIDs (roughly equivalent to a UUID for a user or group) are
   the same returns 1, if they do not match returns 0 */
-int compare_sids(struct cifs_sid *ctsid, struct cifs_sid *cwsid)
+int compare_sids(const struct cifs_sid *ctsid, const struct cifs_sid *cwsid)
 {
        int i;
        int num_subauth, num_sat, num_saw;
@@ -129,66 +129,142 @@ int compare_sids(struct cifs_sid *ctsid, struct cifs_sid *cwsid)
        return (1); /* sids compare/match */
 }
+/*
+   change posix mode to reflect permissions
+   pmode is the existing mode (we only want to overwrite part of this
+   bits to set can be: S_IRWXU, S_IRWXG or S_IRWXO ie 00700 or 00070 or 00007
+*/
+static void access_flags_to_mode(__u32 ace_flags, int type, umode_t *pmode,
+                                 umode_t *pbits_to_set)
+{
+        /* the order of ACEs is important.  The canonical order is to begin with
+           DENY entries followed by ALLOW, otherwise an allow entry could be
+           encountered first, making the subsequent deny entry like "dead code"
+           which would be superflous since Windows stops when a match is made
+           for the operation you are trying to perform for your user */
+        /* For deny ACEs we change the mask so that subsequent allow access
+           control entries do not turn on the bits we are denying */
+        if (type == ACCESS_DENIED) {
+                if (ace_flags & GENERIC_ALL) {
+                        *pbits_to_set &= ~S_IRWXUGO;
+                }
+                if ((ace_flags & GENERIC_WRITE) ||
+                        ((ace_flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
+                        *pbits_to_set &= ~S_IWUGO;
+                if ((ace_flags & GENERIC_READ) ||
+                        ((ace_flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
+                        *pbits_to_set &= ~S_IRUGO;
+                if ((ace_flags & GENERIC_EXECUTE) ||
+                        ((ace_flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
+                        *pbits_to_set &= ~S_IXUGO;
+                return;
+        } else if (type != ACCESS_ALLOWED) {
+                cERROR(1, ("unknown access control type %d", type));
+                return;
+        }
+        /* else ACCESS_ALLOWED type */
+        if (ace_flags & GENERIC_ALL) {
+                *pmode |= (S_IRWXUGO & (*pbits_to_set));
+#ifdef CONFIG_CIFS_DEBUG2
+                cFYI(1, ("all perms"));
+#endif
+                return;
+        }
+        if ((ace_flags & GENERIC_WRITE) ||
+                        ((ace_flags & FILE_WRITE_RIGHTS) == FILE_WRITE_RIGHTS))
+                *pmode |= (S_IWUGO & (*pbits_to_set));
+        if ((ace_flags & GENERIC_READ) ||
+                        ((ace_flags & FILE_READ_RIGHTS) == FILE_READ_RIGHTS))
+                *pmode |= (S_IRUGO & (*pbits_to_set));
+        if ((ace_flags & GENERIC_EXECUTE) ||
+                        ((ace_flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS))
+                *pmode |= (S_IXUGO & (*pbits_to_set));
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("access flags 0x%x mode now 0x%x", ace_flags, *pmode));
+#endif
+        return;
+}
+/*
+   Generate access flags to reflect permissions mode is the existing mode.
+   This function is called for every ACE in the DACL whose SID matches
+   with either owner or group or everyone.
+*/
+static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,
+                                __u32 *pace_flags)
+{
+        /* reset access mask */
+        *pace_flags = 0x0;
+        /* bits to use are either S_IRWXU or S_IRWXG or S_IRWXO */
+        mode &= bits_to_use;
+        /* check for R/W/X UGO since we do not know whose flags
+           is this but we have cleared all the bits sans RWX for
+           either user or group or other as per bits_to_use */
+        if (mode & S_IRUGO)
+                *pace_flags |= SET_FILE_READ_RIGHTS;
+        if (mode & S_IWUGO)
+                *pace_flags |= SET_FILE_WRITE_RIGHTS;
+        if (mode & S_IXUGO)
+                *pace_flags |= SET_FILE_EXEC_RIGHTS;
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("mode: 0x%x, access flags now 0x%x", mode, *pace_flags));
+#endif
+        return;
+}
-static void parse_ace(struct cifs_ace *pace, char *end_of_acl)
+#ifdef CONFIG_CIFS_DEBUG2
+static void dump_ace(struct cifs_ace *pace, char *end_of_acl)
 {
        int num_subauth;
        /* validate that we do not go past end of acl */
-        /* XXX this if statement can be removed
+        if (le16_to_cpu(pace->size) < 16) {
-        if (end_of_acl < (char *)pace + sizeof(struct cifs_ace)) {
+                cERROR(1, ("ACE too small, %d", le16_to_cpu(pace->size)));
+                return;
+        }
+        if (end_of_acl < (char *)pace + le16_to_cpu(pace->size)) {
                cERROR(1, ("ACL too small to parse ACE"));
                return;
-        } */
+        }
-        num_subauth = pace->num_subauth;
+        num_subauth = pace->sid.num_subauth;
        if (num_subauth) {
-#ifdef CONFIG_CIFS_DEBUG2
                int i;
-                cFYI(1, ("ACE revision %d num_subauth %d",
+                cFYI(1, ("ACE revision %d num_auth %d type %d flags %d size %d",
-                        pace->revision, pace->num_subauth));
+                        pace->sid.revision, pace->sid.num_subauth, pace->type,
+                        pace->flags, pace->size));
                for (i = 0; i < num_subauth; ++i) {
                        cFYI(1, ("ACE sub_auth[%d]: 0x%x", i,
-                                le32_to_cpu(pace->sub_auth[i])));
+                                le32_to_cpu(pace->sid.sub_auth[i])));
                }
                /* BB add length check to make sure that we do not have huge
                        num auths and therefore go off the end */
-                cFYI(1, ("RID %d", le32_to_cpu(pace->sub_auth[num_subauth-1])));
-#endif
        }
        return;
 }
-static void parse_ntace(struct cifs_ntace *pntace, char *end_of_acl)
-{
-        /* validate that we do not go past end of acl */
-        if (end_of_acl < (char *)pntace + sizeof(struct cifs_ntace)) {
-                cERROR(1, ("ACL too small to parse NT ACE"));
-                return;
-        }
-#ifdef CONFIG_CIFS_DEBUG2
-        cFYI(1, ("NTACE type %d flags 0x%x size %d, access Req 0x%x",
-                pntace->type, pntace->flags, pntace->size,
-                pntace->access_req));
 #endif
-        return;
-}
 static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
-                       struct cifs_sid *pownersid, struct cifs_sid *pgrpsid)
+                       struct cifs_sid *pownersid, struct cifs_sid *pgrpsid,
+                       struct inode *inode)
 {
        int i;
        int num_aces = 0;
        int acl_size;
        char *acl_base;
-        struct cifs_ntace **ppntace;
        struct cifs_ace **ppace;
        /* BB need to add parm so we can store the SID BB */
@@ -205,50 +281,63 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
                le32_to_cpu(pdacl->num_aces)));
 #endif
+        /* reset rwx permissions for user/group/other.
+           Also, if num_aces is 0 i.e. DACL has no ACEs,
+           user/group/other have no permissions */
+        inode->i_mode &= ~(S_IRWXUGO);
+        if (!pdacl) {
+                /* no DACL in the security descriptor, set
+                   all the permissions for user/group/other */
+                inode->i_mode |= S_IRWXUGO;
+                return;
+        }
        acl_base = (char *)pdacl;
        acl_size = sizeof(struct cifs_acl);
        num_aces = le32_to_cpu(pdacl->num_aces);
        if (num_aces  > 0) {
-                ppntace = kmalloc(num_aces * sizeof(struct cifs_ntace *),
+                umode_t user_mask = S_IRWXU;
-                                GFP_KERNEL);
+                umode_t group_mask = S_IRWXG;
+                umode_t other_mask = S_IRWXO;
                ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
                                GFP_KERNEL);
 /*              cifscred->cecount = pdacl->num_aces;
-                cifscred->ntaces = kmalloc(num_aces *
-                        sizeof(struct cifs_ntace *), GFP_KERNEL);
                cifscred->aces = kmalloc(num_aces *
                        sizeof(struct cifs_ace *), GFP_KERNEL);*/
                for (i = 0; i < num_aces; ++i) {
-                        ppntace[i] = (struct cifs_ntace *)
+                        ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
-                                        (acl_base + acl_size);
+#ifdef CONFIG_CIFS_DEBUG2
-                        ppace[i] = (struct cifs_ace *) ((char *)ppntace[i] +
+                        dump_ace(ppace[i], end_of_acl);
-                                        sizeof(struct cifs_ntace));
+#endif
+                        if (compare_sids(&(ppace[i]->sid), pownersid))
-                        parse_ntace(ppntace[i], end_of_acl);
+                                access_flags_to_mode(ppace[i]->access_req,
-                        if (end_of_acl < ((char *)ppace[i] +
+                                                     ppace[i]->type,
-                                        (le16_to_cpu(ppntace[i]->size) -
+                                                     &(inode->i_mode),
-                                        sizeof(struct cifs_ntace)))) {
+                                                     &user_mask);
-                                cERROR(1, ("ACL too small to parse ACE"));
+                        if (compare_sids(&(ppace[i]->sid), pgrpsid))
-                                break;
+                                access_flags_to_mode(ppace[i]->access_req,
-                        } else
+                                                     ppace[i]->type,
-                                parse_ace(ppace[i], end_of_acl);
+                                                     &(inode->i_mode),
+                                                     &group_mask);
-/*                      memcpy((void *)(&(cifscred->ntaces[i])),
+                        if (compare_sids(&(ppace[i]->sid), &sid_everyone))
-                                (void *)ppntace[i],
+                                access_flags_to_mode(ppace[i]->access_req,
-                                sizeof(struct cifs_ntace));
+                                                     ppace[i]->type,
-                        memcpy((void *)(&(cifscred->aces[i])),
+                                                     &(inode->i_mode),
+                                                     &other_mask);
+/*                      memcpy((void *)(&(cifscred->aces[i])),
                                (void *)ppace[i],
                                sizeof(struct cifs_ace)); */
-                        acl_base = (char *)ppntace[i];
+                        acl_base = (char *)ppace[i];
-                        acl_size = le16_to_cpu(ppntace[i]->size);
+                        acl_size = le16_to_cpu(ppace[i]->size);
                }
                kfree(ppace);
-                kfree(ppntace);
        }
        return;
@@ -257,20 +346,20 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
 static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
 {
        /* BB need to add parm so we can store the SID BB */
-        /* validate that we do not go past end of acl */
+        /* validate that we do not go past end of ACL - sid must be at least 8
-        if (end_of_acl < (char *)psid + sizeof(struct cifs_sid)) {
+           bytes long (assuming no sub-auths - e.g. the null SID */
-                cERROR(1, ("ACL too small to parse SID"));
+        if (end_of_acl < (char *)psid + 8) {
+                cERROR(1, ("ACL too small to parse SID %p", psid));
                return -EINVAL;
        }
        if (psid->num_subauth) {
 #ifdef CONFIG_CIFS_DEBUG2
                int i;
-                cFYI(1, ("SID revision %d num_auth %d First subauth 0x%x",
+                cFYI(1, ("SID revision %d num_auth %d",
-                        psid->revision, psid->num_subauth, psid->sub_auth[0]));
+                        psid->revision, psid->num_subauth));
                for (i = 0; i < psid->num_subauth; i++) {
                        cFYI(1, ("SID sub_auth[%d]: 0x%x ", i,
@@ -289,27 +378,32 @@ static int parse_sid(struct cifs_sid *psid, char *end_of_acl)
 /* Convert CIFS ACL to POSIX form */
-int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len)
+static int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len,
+                          struct inode *inode)
 {
        int rc;
        struct cifs_sid *owner_sid_ptr, *group_sid_ptr;
        struct cifs_acl *dacl_ptr; /* no need for SACL ptr */
        char *end_of_acl = ((char *)pntsd) + acl_len;
+        __u32 dacloffset;
+        if ((inode == NULL) || (pntsd == NULL))
+                return -EIO;
        owner_sid_ptr = (struct cifs_sid *)((char *)pntsd +
                                le32_to_cpu(pntsd->osidoffset));
        group_sid_ptr = (struct cifs_sid *)((char *)pntsd +
                                le32_to_cpu(pntsd->gsidoffset));
-        dacl_ptr = (struct cifs_acl *)((char *)pntsd +
+        dacloffset = le32_to_cpu(pntsd->dacloffset);
-                                le32_to_cpu(pntsd->dacloffset));
+        dacl_ptr = (struct cifs_acl *)((char *)pntsd + dacloffset);
 #ifdef CONFIG_CIFS_DEBUG2
        cFYI(1, ("revision %d type 0x%x ooffset 0x%x goffset 0x%x "
                 "sacloffset 0x%x dacloffset 0x%x",
                 pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset),
                 le32_to_cpu(pntsd->gsidoffset),
-                 le32_to_cpu(pntsd->sacloffset),
+                 le32_to_cpu(pntsd->sacloffset), dacloffset));
-                 le32_to_cpu(pntsd->dacloffset)));
 #endif
+/*      cifs_dump_mem("owner_sid: ", owner_sid_ptr, 64); */
        rc = parse_sid(owner_sid_ptr, end_of_acl);
        if (rc)
                return rc;
@@ -318,16 +412,120 @@ int parse_sec_desc(struct cifs_ntsd *pntsd, int acl_len)
        if (rc)
                return rc;
-        parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr, group_sid_ptr);
+        if (dacloffset)
+                parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr,
+                           group_sid_ptr, inode);
+        else
+                cFYI(1, ("no ACL")); /* BB grant all or default perms? */
 /*      cifscred->uid = owner_sid_ptr->rid;
        cifscred->gid = group_sid_ptr->rid;
        memcpy((void *)(&(cifscred->osid)), (void *)owner_sid_ptr,
-                        sizeof (struct cifs_sid));
+                        sizeof(struct cifs_sid));
        memcpy((void *)(&(cifscred->gsid)), (void *)group_sid_ptr,
-                        sizeof (struct cifs_sid)); */
+                        sizeof(struct cifs_sid)); */
        return (0);
 }
+/* Retrieve an ACL from the server */
+static struct cifs_ntsd *get_cifs_acl(u32 *pacllen, struct inode *inode,
+                                       const char *path)
+{
+        struct cifsFileInfo *open_file;
+        int unlock_file = FALSE;
+        int xid;
+        int rc = -EIO;
+        __u16 fid;
+        struct super_block *sb;
+        struct cifs_sb_info *cifs_sb;
+        struct cifs_ntsd *pntsd = NULL;
+        cFYI(1, ("get mode from ACL for %s", path));
+        if (inode == NULL)
+                return NULL;
+        xid = GetXid();
+        open_file = find_readable_file(CIFS_I(inode));
+        sb = inode->i_sb;
+        if (sb == NULL) {
+                FreeXid(xid);
+                return NULL;
+        }
+        cifs_sb = CIFS_SB(sb);
+        if (open_file) {
+                unlock_file = TRUE;
+                fid = open_file->netfid;
+        } else {
+                int oplock = FALSE;
+                /* open file */
+                rc = CIFSSMBOpen(xid, cifs_sb->tcon, path, FILE_OPEN,
+                                READ_CONTROL, 0, &fid, &oplock, NULL,
+                                cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                if (rc != 0) {
+                        cERROR(1, ("Unable to open file to get ACL"));
+                        FreeXid(xid);
+                        return NULL;
+                }
+        }
+        rc = CIFSSMBGetCIFSACL(xid, cifs_sb->tcon, fid, &pntsd, pacllen);
+        cFYI(1, ("GetCIFSACL rc = %d ACL len %d", rc, *pacllen));
+        if (unlock_file == TRUE)
+                atomic_dec(&open_file->wrtPending);
+        else
+                CIFSSMBClose(xid, cifs_sb->tcon, fid);
+        FreeXid(xid);
+        return pntsd;
+}
+/* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
+void acl_to_uid_mode(struct inode *inode, const char *path)
+{
+        struct cifs_ntsd *pntsd = NULL;
+        u32 acllen = 0;
+        int rc = 0;
+#ifdef CONFIG_CIFS_DEBUG2
+        cFYI(1, ("converting ACL to mode for %s", path));
+#endif
+        pntsd = get_cifs_acl(&acllen, inode, path);
+        /* if we can retrieve the ACL, now parse Access Control Entries, ACEs */
+        if (pntsd)
+                rc = parse_sec_desc(pntsd, acllen, inode);
+        if (rc)
+                cFYI(1, ("parse sec desc failed rc = %d", rc));
+        kfree(pntsd);
+        return;
+}
+/* Convert mode bits to an ACL so we can update the ACL on the server */
+int mode_to_acl(struct inode *inode, const char *path)
+{
+        int rc = 0;
+        __u32 acllen = 0;
+        struct cifs_ntsd *pntsd = NULL;
+        cFYI(1, ("set ACL from mode for %s", path));
+        /* Get the security descriptor */
+        pntsd = get_cifs_acl(&acllen, inode, path);
+        /* Add/Modify the three ACEs for owner, group, everyone
+           while retaining the other ACEs */
+        /* Set the security descriptor */
+        kfree(pntsd);
+        return rc;
+}
 #endif /* CONFIG_CIFS_EXPERIMENTAL */
diff --git a/fs/cifs/cifsacl.h b/fs/cifs/cifsacl.h
index 420f87813647..93a7c3462ea2 100644
--- a/fs/cifs/cifsacl.h
+++ b/fs/cifs/cifsacl.h
@@ -35,6 +35,9 @@
 #define UBITSHIFT       6
 #define GBITSHIFT       3
+#define ACCESS_ALLOWED  0
+#define ACCESS_DENIED   1
 struct cifs_ntsd {
        __le16 revision; /* revision level */
        __le16 type;
@@ -48,7 +51,7 @@ struct cifs_sid {
        __u8 revision; /* revision level */
        __u8 num_subauth;
        __u8 authority[6];
-        __le32 sub_auth[5]; /* sub_auth[num_subauth] */ /* BB FIXME endianness BB */
+        __le32 sub_auth[5]; /* sub_auth[num_subauth] */
 } __attribute__((packed));
 struct cifs_acl {
@@ -57,18 +60,12 @@ struct cifs_acl {
        __le32 num_aces;
 } __attribute__((packed));
-struct cifs_ntace { /* first part of ACE which contains perms */
+struct cifs_ace {
        __u8 type;
        __u8 flags;
        __le16 size;
        __le32 access_req;
-} __attribute__((packed));
+        struct cifs_sid sid; /* ie UUID of user or group who gets these perms */
-struct cifs_ace { /* last part of ACE which includes user info */
-        __u8 revision; /* revision level */
-        __u8 num_subauth;
-        __u8 authority[6];
-        __le32 sub_auth[5];
 } __attribute__((packed));
 struct cifs_wksid {
@@ -79,7 +76,7 @@ struct cifs_wksid {
 #ifdef CONFIG_CIFS_EXPERIMENTAL
 extern int match_sid(struct cifs_sid *);
-extern int compare_sids(struct cifs_sid *, struct cifs_sid *);
+extern int compare_sids(const struct cifs_sid *, const struct cifs_sid *);
 #endif /*  CONFIG_CIFS_EXPERIMENTAL */
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 632070b4275d..4ff8939c6cc7 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -99,15 +99,16 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
        MD5Init(&context);
        MD5Update(&context, (char *)&key->data, key->len);
        for (i = 0; i < n_vec; i++) {
+                if (iov[i].iov_len == 0)
+                        continue;
                if (iov[i].iov_base == NULL) {
                        cERROR(1, ("null iovec entry"));
                        return -EIO;
-                } else if (iov[i].iov_len == 0)
+                }
-                        break; /* bail out if we are sent nothing to sign */
                /* The first entry includes a length field (which does not get
                   signed that occupies the first 4 bytes before the header */
                if (i == 0) {
-                        if (iov[0].iov_len <= 8 ) /* cmd field at offset 9 */
+                        if (iov[0].iov_len <= 8) /* cmd field at offset 9 */
                                break; /* nothing to sign or corrupt header */
                        MD5Update(&context, iov[0].iov_base+4,
                                  iov[0].iov_len-4);
@@ -122,7 +123,7 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
 int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
-                   __u32 * pexpected_response_sequence_number)
+                   __u32 *pexpected_response_sequence_number)
 {
        int rc = 0;
        char smb_signature[20];
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index a6fbea57c4b1..416dc9fe8961 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -43,6 +43,8 @@
 #include "cifs_debug.h"
 #include "cifs_fs_sb.h"
 #include <linux/mm.h>
+#include <linux/key-type.h>
+#include "cifs_spnego.h"
 #define CIFS_MAGIC_NUMBER 0xFF534D42    /* the first four bytes of SMB PDUs */
 #ifdef CONFIG_CIFS_QUOTA
@@ -1005,12 +1007,16 @@ init_cifs(void)
        rc = register_filesystem(&cifs_fs_type);
        if (rc)
                goto out_destroy_request_bufs;
+#ifdef CONFIG_CIFS_UPCALL
+        rc = register_key_type(&cifs_spnego_key_type);
+        if (rc)
+                goto out_unregister_filesystem;
+#endif
        oplockThread = kthread_run(cifs_oplock_thread, NULL, "cifsoplockd");
        if (IS_ERR(oplockThread)) {
                rc = PTR_ERR(oplockThread);
                cERROR(1, ("error %d create oplock thread", rc));
-                goto out_unregister_filesystem;
+                goto out_unregister_key_type;
        }
        dnotifyThread = kthread_run(cifs_dnotify_thread, NULL, "cifsdnotifyd");
@@ -1024,7 +1030,11 @@ init_cifs(void)
 out_stop_oplock_thread:
        kthread_stop(oplockThread);
+ out_unregister_key_type:
+#ifdef CONFIG_CIFS_UPCALL
+        unregister_key_type(&cifs_spnego_key_type);
 out_unregister_filesystem:
+#endif
        unregister_filesystem(&cifs_fs_type);
 out_destroy_request_bufs:
        cifs_destroy_request_bufs();
@@ -1046,6 +1056,9 @@ exit_cifs(void)
 #ifdef CONFIG_PROC_FS
        cifs_proc_clean();
 #endif
+#ifdef CONFIG_CIFS_UPCALL
+        unregister_key_type(&cifs_spnego_key_type);
+#endif
        unregister_filesystem(&cifs_fs_type);
        cifs_destroy_inodecache();
        cifs_destroy_mids();
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 5574ba3ab1f9..2a21dc66f0de 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -106,5 +106,5 @@ extern int cifs_ioctl(struct inode *inode, struct file *filep,
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
-#define CIFS_VERSION   "1.51"
+#define CIFS_VERSION   "1.52"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index c41ff74e9128..dbe6b846f37f 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -220,6 +220,23 @@
                                | FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES)
 #define FILE_EXEC_RIGHTS (FILE_EXECUTE)
+#define SET_FILE_READ_RIGHTS (FILE_READ_DATA | FILE_READ_EA | FILE_WRITE_EA \
+                                | FILE_READ_ATTRIBUTES \
+                                | FILE_WRITE_ATTRIBUTES \
+                                | DELETE | READ_CONTROL | WRITE_DAC \
+                                | WRITE_OWNER | SYNCHRONIZE)
+#define SET_FILE_WRITE_RIGHTS (FILE_WRITE_DATA | FILE_APPEND_DATA \
+                                | FILE_READ_EA | FILE_WRITE_EA \
+                                | FILE_DELETE_CHILD | FILE_READ_ATTRIBUTES \
+                                | FILE_WRITE_ATTRIBUTES \
+                                | DELETE | READ_CONTROL | WRITE_DAC \
+                                | WRITE_OWNER | SYNCHRONIZE)
+#define SET_FILE_EXEC_RIGHTS (FILE_READ_EA | FILE_WRITE_EA | FILE_EXECUTE \
+                                | FILE_READ_ATTRIBUTES \
+                                | FILE_WRITE_ATTRIBUTES \
+                                | DELETE | READ_CONTROL | WRITE_DAC \
+                                | WRITE_OWNER | SYNCHRONIZE)
 /*
 * Invalid readdir handle
@@ -1211,6 +1228,29 @@ typedef struct smb_com_transaction_qsec_req {
        __le32 AclFlags;
 } __attribute__((packed)) QUERY_SEC_DESC_REQ;
+typedef struct smb_com_transaction_ssec_req {
+        struct smb_hdr hdr;     /* wct = 19 */
+        __u8 MaxSetupCount;
+        __u16 Reserved;
+        __le32 TotalParameterCount;
+        __le32 TotalDataCount;
+        __le32 MaxParameterCount;
+        __le32 MaxDataCount;
+        __le32 ParameterCount;
+        __le32 ParameterOffset;
+        __le32 DataCount;
+        __le32 DataOffset;
+        __u8 SetupCount; /* no setup words follow subcommand */
+        /* SNIA spec incorrectly included spurious pad here */
+        __le16 SubCommand; /* 3 = SET_SECURITY_DESC */
+        __le16 ByteCount; /* bcc = 3 + 8 */
+        __u8 Pad[3];
+        __u16 Fid;
+        __u16 Reserved2;
+        __le32 AclFlags;
+} __attribute__((packed)) SET_SEC_DESC_REQ;
 typedef struct smb_com_transaction_change_notify_req {
        struct smb_hdr hdr;     /* wct = 23 */
        __u8 MaxSetupCount;
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1a883663b22d..dd1d7c200ee6 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -61,6 +61,9 @@ extern int checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length);
 extern int is_valid_oplock_break(struct smb_hdr *smb, struct TCP_Server_Info *);
 extern int is_size_safe_to_change(struct cifsInodeInfo *, __u64 eof);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *);
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *);
+#endif
 extern unsigned int smbCalcSize(struct smb_hdr *ptr);
 extern unsigned int smbCalcSize_LE(struct smb_hdr *ptr);
 extern int decode_negTokenInit(unsigned char *security_blob, int length,
@@ -73,6 +76,8 @@ extern void header_assemble(struct smb_hdr *, char /* command */ ,
 extern int small_smb_init_no_tc(const int smb_cmd, const int wct,
                                struct cifsSesInfo *ses,
                                void **request_buf);
+extern struct key *cifs_get_spnego_key(struct cifsSesInfo *sesInfo,
+                                        const char *hostname);
 extern int CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses,
                             const int stage,
                             const struct nls_table *nls_cp);
@@ -92,6 +97,8 @@ extern int cifs_get_inode_info(struct inode **pinode,
 extern int cifs_get_inode_info_unix(struct inode **pinode,
                        const unsigned char *search_path,
                        struct super_block *sb, int xid);
+extern void acl_to_uid_mode(struct inode *inode, const char *search_path);
+extern int mode_to_acl(struct inode *inode, const char *path);
 extern int cifs_mount(struct super_block *, struct cifs_sb_info *, char *,
                        const char *);
@@ -311,7 +318,6 @@ extern void setup_ntlmv2_rsp(struct cifsSesInfo *, char *,
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 extern void calc_lanman_hash(struct cifsSesInfo *ses, char *lnm_session_key);
 #endif /* CIFS_WEAK_PW_HASH */
-extern int parse_sec_desc(struct cifs_ntsd *, int);
 extern int CIFSSMBCopy(int xid,
                        struct cifsTconInfo *source_tcon,
                        const char *fromName,
@@ -336,8 +342,7 @@ extern int CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon,
                const void *ea_value, const __u16 ea_value_len,
                const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon,
-                        __u16 fid, char *acl_inf, const int buflen,
+                        __u16 fid, struct cifs_ntsd **acl_inf, __u32 *buflen);
-                        const int acl_type /* ACCESS vs. DEFAULT */);
 extern int CIFSSMBGetPosixACL(const int xid, struct cifsTconInfo *tcon,
                const unsigned char *searchName,
                char *acl_inf, const int buflen, const int acl_type,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index f0d9a485d095..59d7b7c037ad 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -647,8 +647,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                                                 count - 16,
                                                 &server->secType);
                        if (rc == 1) {
-                        /* BB Need to fill struct for sessetup here */
+                                rc = 0;
-                                rc = -EOPNOTSUPP;
                        } else {
                                rc = -EINVAL;
                        }
@@ -2486,6 +2485,7 @@ querySymLinkRetry:
        return rc;
 }
+#ifdef CONFIG_CIFS_EXPERIMENTAL
 /* Initialize NT TRANSACT SMB into small smb request buffer.
   This assumes that all NT TRANSACTS that we init here have
   total parm and data under about 400 bytes (to fit in small cifs
@@ -2494,7 +2494,7 @@ querySymLinkRetry:
        MaxSetupCount (size of returned setup area) and
        MaxParameterCount (returned parms size) must be set by caller */
 static int
-smb_init_ntransact(const __u16 sub_command, const int setup_count,
+smb_init_nttransact(const __u16 sub_command, const int setup_count,
                   const int parm_len, struct cifsTconInfo *tcon,
                   void **ret_buf)
 {
@@ -2525,12 +2525,15 @@ smb_init_ntransact(const __u16 sub_command, const int setup_count,
 static int
 validate_ntransact(char *buf, char **ppparm, char **ppdata,
-                   int *pdatalen, int *pparmlen)
+                   __u32 *pparmlen, __u32 *pdatalen)
 {
        char *end_of_smb;
        __u32 data_count, data_offset, parm_count, parm_offset;
        struct smb_com_ntransact_rsp *pSMBr;
+        *pdatalen = 0;
+        *pparmlen = 0;
        if (buf == NULL)
                return -EINVAL;
@@ -2567,8 +2570,11 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata,
                cFYI(1, ("parm count and data count larger than SMB"));
                return -EINVAL;
        }
+        *pdatalen = data_count;
+        *pparmlen = parm_count;
        return 0;
 }
+#endif /* CIFS_EXPERIMENTAL */
 int
 CIFSSMBQueryReparseLinkInfo(const int xid, struct cifsTconInfo *tcon,
@@ -3067,8 +3073,7 @@ GetExtAttrOut:
 /* Get Security Descriptor (by handle) from remote server for a file or dir */
 int
 CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
-                /* BB fix up return info */ char *acl_inf, const int buflen,
+                  struct cifs_ntsd **acl_inf, __u32 *pbuflen)
-                  const int acl_type)
 {
        int rc = 0;
        int buf_type = 0;
@@ -3077,7 +3082,10 @@ CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
        cFYI(1, ("GetCifsACL"));
-        rc = smb_init_ntransact(NT_TRANSACT_QUERY_SECURITY_DESC, 0,
+        *pbuflen = 0;
+        *acl_inf = NULL;
+        rc = smb_init_nttransact(NT_TRANSACT_QUERY_SECURITY_DESC, 0,
                        8 /* parm len */, tcon, (void **) &pSMB);
        if (rc)
                return rc;
@@ -3099,34 +3107,52 @@ CIFSSMBGetCIFSACL(const int xid, struct cifsTconInfo *tcon, __u16 fid,
        if (rc) {
                cFYI(1, ("Send error in QuerySecDesc = %d", rc));
        } else {                /* decode response */
-                struct cifs_ntsd *psec_desc;
                __le32 * parm;
-                int parm_len;
+                __u32 parm_len;
-                int data_len;
+                __u32 acl_len;
-                int acl_len;
                struct smb_com_ntransact_rsp *pSMBr;
+                char *pdata;
 /* validate_nttransact */
                rc = validate_ntransact(iov[0].iov_base, (char **)&parm,
-                                        (char **)&psec_desc,
+                                        &pdata, &parm_len, pbuflen);
-                                        &parm_len, &data_len);
                if (rc)
                        goto qsec_out;
                pSMBr = (struct smb_com_ntransact_rsp *)iov[0].iov_base;
-                cFYI(1, ("smb %p parm %p data %p", pSMBr, parm, psec_desc));
+                cFYI(1, ("smb %p parm %p data %p", pSMBr, parm, *acl_inf));
                if (le32_to_cpu(pSMBr->ParameterCount) != 4) {
                        rc = -EIO;      /* bad smb */
+                        *pbuflen = 0;
                        goto qsec_out;
                }
 /* BB check that data area is minimum length and as big as acl_len */
                acl_len = le32_to_cpu(*parm);
-                /* BB check if (acl_len > bufsize) */
+                if (acl_len != *pbuflen) {
+                        cERROR(1, ("acl length %d does not match %d",
+                                   acl_len, *pbuflen));
+                        if (*pbuflen > acl_len)
+                                *pbuflen = acl_len;
+                }
-                parse_sec_desc(psec_desc, acl_len);
+                /* check if buffer is big enough for the acl
+                   header followed by the smallest SID */
+                if ((*pbuflen < sizeof(struct cifs_ntsd) + 8) ||
+                    (*pbuflen >= 64 * 1024)) {
+                        cERROR(1, ("bad acl length %d", *pbuflen));
+                        rc = -EINVAL;
+                        *pbuflen = 0;
+                } else {
+                        *acl_inf = kmalloc(*pbuflen, GFP_KERNEL);
+                        if (*acl_inf == NULL) {
+                                *pbuflen = 0;
+                                rc = -ENOMEM;
+                        }
+                        memcpy(*acl_inf, pdata, *pbuflen);
+                }
        }
 qsec_out:
        if (buf_type == CIFS_SMALL_BUFFER)
@@ -3381,7 +3407,7 @@ UnixQPathInfoRetry:
                        memcpy((char *) pFindData,
                               (char *) &pSMBr->hdr.Protocol +
                               data_offset,
-                               sizeof (FILE_UNIX_BASIC_INFO));
+                               sizeof(FILE_UNIX_BASIC_INFO));
                }
        }
        cifs_buf_release(pSMB);
@@ -3649,7 +3675,7 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
        pSMB->SubCommand = cpu_to_le16(TRANS2_FIND_NEXT);
        pSMB->SearchHandle = searchHandle;      /* always kept as le */
        pSMB->SearchCount =
-                cpu_to_le16(CIFSMaxBufSize / sizeof (FILE_UNIX_INFO));
+                cpu_to_le16(CIFSMaxBufSize / sizeof(FILE_UNIX_INFO));
        pSMB->InformationLevel = cpu_to_le16(psrch_inf->info_level);
        pSMB->ResumeKey = psrch_inf->resume_key;
        pSMB->SearchFlags =
@@ -4331,7 +4357,7 @@ QFSDeviceRetry:
        } else {                /* decode response */
                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
-                if (rc || (pSMBr->ByteCount < sizeof (FILE_SYSTEM_DEVICE_INFO)))
+                if (rc || (pSMBr->ByteCount < sizeof(FILE_SYSTEM_DEVICE_INFO)))
                        rc = -EIO;      /* bad smb */
                else {
                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 19ee11f7f35a..1102160f6661 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -793,7 +793,7 @@ cifs_parse_mount_options(char *options, const char *devname,
        vol->linux_gid = current->gid;
        vol->dir_mode = S_IRWXUGO;
        /* 2767 perms indicate mandatory locking support */
-        vol->file_mode = S_IALLUGO & ~(S_ISUID | S_IXGRP);
+        vol->file_mode = (S_IRWXUGO | S_ISGID) & (~S_IXGRP);
        /* vol->retry default is 0 (i.e. "soft" limited retry not hard retry) */
        vol->rw = TRUE;
@@ -1790,7 +1790,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
        if (volume_info.nullauth) {
                cFYI(1, ("null user"));
-                volume_info.username = NULL;
+                volume_info.username = "";
        } else if (volume_info.username) {
                /* BB fixme parse for domain name here */
                cFYI(1, ("Username: %s", volume_info.username));
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 793404b10925..37dc97af1487 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -593,7 +593,7 @@ static int cifs_ci_compare(struct dentry *dentry, struct qstr *a,
                 * case take precedence.  If a is not a negative dentry, this
                 * should have no side effects
                 */
-                memcpy((unsigned char *)a->name, b->name, a->len);
+                memcpy(a->name, b->name, a->len);
                return 0;
        }
        return 1;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 1e7e4c06d9e3..68ad4ca0cfa3 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1026,6 +1026,37 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
        return total_written;
 }
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *cifs_inode)
+{
+        struct cifsFileInfo *open_file = NULL;
+        read_lock(&GlobalSMBSeslock);
+        /* we could simply get the first_list_entry since write-only entries
+           are always at the end of the list but since the first entry might
+           have a close pending, we go through the whole list */
+        list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+                if (open_file->closePend)
+                        continue;
+                if (open_file->pfile && ((open_file->pfile->f_flags & O_RDWR) ||
+                    (open_file->pfile->f_flags & O_RDONLY))) {
+                        if (!open_file->invalidHandle) {
+                                /* found a good file */
+                                /* lock it so it will not be closed on us */
+                                atomic_inc(&open_file->wrtPending);
+                                read_unlock(&GlobalSMBSeslock);
+                                return open_file;
+                        } /* else might as well continue, and look for
+                             another, or simply have the caller reopen it
+                             again rather than trying to fix this handle */
+                } else /* write only file */
+                        break; /* write only files are last so must be done */
+        }
+        read_unlock(&GlobalSMBSeslock);
+        return NULL;
+}
+#endif
 struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode)
 {
        struct cifsFileInfo *open_file;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 5e8b388be3b6..7d907e84e032 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -289,7 +289,7 @@ static int decode_sfu_inode(struct inode *inode, __u64 size,
 #define SFBITS_MASK (S_ISVTX | S_ISGID | S_ISUID)  /* SETFILEBITS valid bits */
-static int get_sfu_uid_mode(struct inode *inode,
+static int get_sfu_mode(struct inode *inode,
                        const unsigned char *path,
                        struct cifs_sb_info *cifs_sb, int xid)
 {
@@ -527,11 +527,16 @@ int cifs_get_inode_info(struct inode **pinode,
                /* BB fill in uid and gid here? with help from winbind?
                   or retrieve from NTFS stream extended attribute */
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+                /* fill in 0777 bits from ACL */
+                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+                        cFYI(1, ("Getting mode bits from ACL"));
+                        acl_to_uid_mode(inode, search_path);
+                }
+#endif
                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
-                        /* fill in uid, gid, mode from server ACL */
+                        /* fill in remaining high mode bits e.g. SUID, VTX */
-                        /* BB FIXME this should also take into account the
+                        get_sfu_mode(inode, search_path, cifs_sb, xid);
-                         * default uid specified on mount if present */
-                        get_sfu_uid_mode(inode, search_path, cifs_sb, xid);
                } else if (atomic_read(&cifsInfo->inUse) == 0) {
                        inode->i_uid = cifs_sb->mnt_uid;
                        inode->i_gid = cifs_sb->mnt_gid;
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
index e5c3e1212697..f13f96d42fcf 100644
--- a/fs/cifs/md5.c
+++ b/fs/cifs/md5.c
@@ -276,8 +276,8 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
        }
        /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof (ctx->k_ipad));
+        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof (ctx->k_opad));
+        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
        memcpy(ctx->k_ipad, key, key_len);
        memcpy(ctx->k_opad, key, key_len);
@@ -307,8 +307,8 @@ hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
        }
        /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof (ctx->k_ipad));
+        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof (ctx->k_opad));
+        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
        memcpy(ctx->k_ipad, key, key_len);
        memcpy(ctx->k_opad, key, key_len);
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 51ec681fe74a..15546c2354c5 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -73,7 +73,7 @@ sesInfoAlloc(void)
 {
        struct cifsSesInfo *ret_buf;
-        ret_buf = kzalloc(sizeof (struct cifsSesInfo), GFP_KERNEL);
+        ret_buf = kzalloc(sizeof(struct cifsSesInfo), GFP_KERNEL);
        if (ret_buf) {
                write_lock(&GlobalSMBSeslock);
                atomic_inc(&sesInfoAllocCount);
@@ -109,7 +109,7 @@ struct cifsTconInfo *
 tconInfoAlloc(void)
 {
        struct cifsTconInfo *ret_buf;
-        ret_buf = kzalloc(sizeof (struct cifsTconInfo), GFP_KERNEL);
+        ret_buf = kzalloc(sizeof(struct cifsTconInfo), GFP_KERNEL);
        if (ret_buf) {
                write_lock(&GlobalSMBSeslock);
                atomic_inc(&tconInfoAllocCount);
@@ -298,7 +298,7 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
        memset(temp, 0, 256); /* bigger than MAX_CIFS_HDR_SIZE */
        buffer->smb_buf_length =
-            (2 * word_count) + sizeof (struct smb_hdr) -
+            (2 * word_count) + sizeof(struct smb_hdr) -
            4 /*  RFC 1001 length field does not count */  +
            2 /* for bcc field itself */ ;
        /* Note that this is the only network field that has to be converted
@@ -422,8 +422,8 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
        __u32 clc_len;  /* calculated length */
        cFYI(0, ("checkSMB Length: 0x%x, smb_buf_length: 0x%x", length, len));
-        if (length < 2 + sizeof (struct smb_hdr)) {
+        if (length < 2 + sizeof(struct smb_hdr)) {
-                if ((length >= sizeof (struct smb_hdr) - 1)
+                if ((length >= sizeof(struct smb_hdr) - 1)
                            && (smb->Status.CifsError != 0)) {
                        smb->WordCount = 0;
                        /* some error cases do not return wct and bcc */
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index f06359cb22ee..646e1f06941b 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -132,6 +132,34 @@ static const struct smb_to_posix_error mapping_table_ERRHRD[] = {
        {0, 0}
 };
+/* if the mount helper is missing we need to reverse the 1st slash
+   from '/' to backslash in order to format the UNC properly for
+   ip address parsing and for tree connect (unless the user
+   remembered to put the UNC name in properly). Fortunately we do
+   not have to call this twice (we check for IPv4 addresses
+   first, so it is already converted by the time we
+   try IPv6 addresses */
+static int canonicalize_unc(char *cp)
+{
+        int i;
+        for (i = 0; i <= 46 /* INET6_ADDRSTRLEN */ ; i++) {
+                if (cp[i] == 0)
+                        break;
+                if (cp[i] == '\\')
+                        break;
+                if (cp[i] == '/') {
+#ifdef CONFIG_CIFS_DEBUG2
+                        cFYI(1, ("change slash to backslash in malformed UNC"));
+#endif
+                        cp[i] = '\\';
+                        return 1;
+                }
+        }
+        return 0;
+}
 /* Convert string containing dotted ip address to binary form */
 /* returns 0 if invalid address */
@@ -141,11 +169,13 @@ cifs_inet_pton(int address_family, char *cp, void *dst)
        int ret = 0;
        /* calculate length by finding first slash or NULL */
-        /* BB Should we convert '/' slash to '\' here since it seems already
+        if (address_family == AF_INET) {
-         * done before this */
+                ret = in4_pton(cp, -1 /* len */, dst, '\\', NULL);
-        if ( address_family == AF_INET ) {
+                if (ret == 0) {
-                ret = in4_pton(cp, -1 /* len */, dst , '\\', NULL);
+                        if (canonicalize_unc(cp))
-        } else if ( address_family == AF_INET6 ) {
+                                ret = in4_pton(cp, -1, dst, '\\', NULL);
+                }
+        } else if (address_family == AF_INET6) {
                ret = in6_pton(cp, -1 /* len */, dst , '\\', NULL);
        }
 #ifdef CONFIG_CIFS_DEBUG2
@@ -740,7 +770,7 @@ cifs_print_status(__u32 status_code)
 static void
-ntstatus_to_dos(__u32 ntstatus, __u8 * eclass, __u16 * ecode)
+ntstatus_to_dos(__u32 ntstatus, __u8 *eclass, __u16 *ecode)
 {
        int i;
        if (ntstatus == 0) {
@@ -793,8 +823,8 @@ map_smb_to_linux_error(struct smb_hdr *smb, int logErr)
        if (smberrclass == ERRDOS) {  /* 1 byte field no need to byte reverse */
                for (i = 0;
                     i <
-                     sizeof (mapping_table_ERRDOS) /
+                     sizeof(mapping_table_ERRDOS) /
-                     sizeof (struct smb_to_posix_error); i++) {
+                     sizeof(struct smb_to_posix_error); i++) {
                        if (mapping_table_ERRDOS[i].smb_err == 0)
                                break;
                        else if (mapping_table_ERRDOS[i].smb_err ==
@@ -807,8 +837,8 @@ map_smb_to_linux_error(struct smb_hdr *smb, int logErr)
        } else if (smberrclass == ERRSRV) {   /* server class of error codes */
                for (i = 0;
                     i <
-                     sizeof (mapping_table_ERRSRV) /
+                     sizeof(mapping_table_ERRSRV) /
-                     sizeof (struct smb_to_posix_error); i++) {
+                     sizeof(struct smb_to_posix_error); i++) {
                        if (mapping_table_ERRSRV[i].smb_err == 0)
                                break;
                        else if (mapping_table_ERRSRV[i].smb_err ==
@@ -837,14 +867,14 @@ map_smb_to_linux_error(struct smb_hdr *smb, int logErr)
 unsigned int
 smbCalcSize(struct smb_hdr *ptr)
 {
-        return (sizeof (struct smb_hdr) + (2 * ptr->WordCount) +
+        return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
                2 /* size of the bcc field */ + BCC(ptr));
 }
 unsigned int
 smbCalcSize_LE(struct smb_hdr *ptr)
 {
-        return (sizeof (struct smb_hdr) + (2 * ptr->WordCount) +
+        return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
                2 /* size of the bcc field */ + le16_to_cpu(BCC_LE(ptr)));
 }
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 3746580e9701..0f22def4bdff 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -171,7 +171,13 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
        /* Linux can not store file creation time unfortunately so ignore it */
        cifsInfo->cifsAttrs = attr;
-        cifsInfo->time = jiffies;
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
+                /* get more accurate mode via ACL - so force inode refresh */
+                cifsInfo->time = 0;
+        } else
+#endif /* CONFIG_CIFS_EXPERIMENTAL */
+                cifsInfo->time = jiffies;
        /* treat dos attribute of read-only as read-only mode bit e.g. 555? */
        /* 2767 perms - indicate mandatory locking */
@@ -495,7 +501,7 @@ ffirst_retry:
 static int cifs_unicode_bytelen(char *str)
 {
        int len;
-        __le16 * ustr = (__le16 *)str;
+        __le16 *ustr = (__le16 *)str;
        for (len = 0; len <= PATH_MAX; len++) {
                if (ustr[len] == 0)
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 90542a39be17..58bbfd992cc0 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -80,7 +80,7 @@ SMBencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 /* Routines for Windows NT MD4 Hash functions. */
 static int
-_my_wcslen(__u16 * str)
+_my_wcslen(__u16 *str)
 {
        int len = 0;
        while (*str++ != 0)
@@ -96,7 +96,7 @@ _my_wcslen(__u16 * str)
 */
 static int
-_my_mbstowcs(__u16 * dst, const unsigned char *src, int len)
+_my_mbstowcs(__u16 *dst, const unsigned char *src, int len)
 {       /* BB not a very good conversion routine - change/fix */
        int i;
        __u16 val;
@@ -125,9 +125,9 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
        /* Password cannot be longer than 128 characters */
        if (passwd) {
                len = strlen((char *) passwd);
-                if (len > 128) {
+                if (len > 128)
                        len = 128;
-                }
                /* Password must be converted to NT unicode */
                _my_mbstowcs(wpwd, passwd, len);
        } else
@@ -135,7 +135,7 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
        wpwd[len] = 0;  /* Ensure string is null terminated */
        /* Calculate length in bytes */
-        len = _my_wcslen(wpwd) * sizeof (__u16);
+        len = _my_wcslen(wpwd) * sizeof(__u16);
        mdfour(p16, (unsigned char *) wpwd, len);
        memset(wpwd, 0, 129 * 2);
@@ -167,7 +167,7 @@ nt_lm_owf_gen(char *pwd, unsigned char nt_p16[16], unsigned char p16[16])
        E_P16((unsigned char *) passwd, (unsigned char *) p16);
        /* clear out local copy of user's password (just being paranoid). */
-        memset(passwd, '\0', sizeof (passwd));
+        memset(passwd, '\0', sizeof(passwd));
 }
 #endif
@@ -189,8 +189,10 @@ ntv2_owf_gen(const unsigned char owf[16], const char *user_n,
                return;
        dom_u = user_u + 1024;
-        /* push_ucs2(NULL, user_u, user_n, (user_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
+        /* push_ucs2(NULL, user_u, user_n, (user_l+1)*2,
-           push_ucs2(NULL, dom_u, domain_n, (domain_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER); */
+                        STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
+           push_ucs2(NULL, dom_u, domain_n, (domain_l+1)*2,
+                        STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER); */
        /* BB user and domain may need to be uppercased */
        user_l = cifs_strtoUCS(user_u, user_n, 511, nls_codepage);
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 369e838bebd3..54e8ef96cb79 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -265,7 +265,9 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                else if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) {
                        __u16 fid;
                        int oplock = FALSE;
-                        if (experimEnabled) 
+                        struct cifs_ntsd *pacl = NULL;
+                        __u32 buflen = 0;
+                        if (experimEnabled)
                                rc = CIFSSMBOpen(xid, pTcon, full_path,
                                        FILE_OPEN, GENERIC_READ, 0, &fid,
                                        &oplock, NULL, cifs_sb->local_nls,
@@ -273,10 +275,9 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                        /* else rc is EOPNOTSUPP from above */
-                        if(rc == 0) {
+                        if (rc == 0) {
-                                rc = CIFSSMBGetCIFSACL(xid, pTcon, fid,
+                                rc = CIFSSMBGetCIFSACL(xid, pTcon, fid, &pacl,
-                                        ea_value, buf_size,
+                                                      &buflen);
-                                        ACL_TYPE_ACCESS);
                                CIFSSMBClose(xid, pTcon, fid);
                        }
                }
diff --git a/fs/exec.c b/fs/exec.c
index 2c942e2d14ea..4ccaaa4b13b2 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1692,7 +1692,10 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
        if (!binfmt || !binfmt->core_dump)
                goto fail;
        down_write(&mm->mmap_sem);
-        if (!get_dumpable(mm)) {
+        /*
+         * If another thread got here first, or we are not dumpable, bail out.
+         */
+        if (mm->core_waiters || !get_dumpable(mm)) {
                up_write(&mm->mmap_sem);
                goto fail;
        }
@@ -1706,7 +1709,6 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
                flag = O_EXCL;          /* Stop rewrite attacks */
                current->fsuid = 0;     /* Dump root private */
        }
-        set_dumpable(mm, 0);
        retval = coredump_wait(exit_code);
        if (retval < 0)
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 18a42de25b55..377ad172d74b 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -69,14 +69,6 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
        return desc + offset;
 }
-static inline int
-block_in_use(unsigned long block, struct super_block *sb, unsigned char *map)
-{
-        return ext2_test_bit ((block -
-                le32_to_cpu(EXT2_SB(sb)->s_es->s_first_data_block)) %
-                         EXT2_BLOCKS_PER_GROUP(sb), map);
-}
 /*
 * Read the bitmap for a given block_group, reading into the specified 
 * slot in the superblock's bitmap cache.
@@ -86,51 +78,20 @@ block_in_use(unsigned long block, struct super_block *sb, unsigned char *map)
 static struct buffer_head *
 read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
-        int i;
        struct ext2_group_desc * desc;
        struct buffer_head * bh = NULL;
-        unsigned int bitmap_blk;
+        
        desc = ext2_get_group_desc (sb, block_group, NULL);
        if (!desc)
-                return NULL;
+                goto error_out;
-        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
+        bh = sb_bread(sb, le32_to_cpu(desc->bg_block_bitmap));
-        bh = sb_bread(sb, bitmap_blk);
        if (!bh)
-                ext2_error (sb, __FUNCTION__,
+                ext2_error (sb, "read_block_bitmap",
                            "Cannot read block bitmap - "
                            "block_group = %d, block_bitmap = %u",
                            block_group, le32_to_cpu(desc->bg_block_bitmap));
-        /* check whether block bitmap block number is set */
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode bitmap block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode table block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_table);
-        for (i = 0; i < EXT2_SB(sb)->s_itb_per_group; i++, bitmap_blk++) {
-                if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                        /* bad block bitmap */
-                        goto error_out;
-                }
-        }
-        return bh;
 error_out:
-        brelse(bh);
+        return bh;
-        ext2_error(sb, __FUNCTION__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %u",
-                        block_group, bitmap_blk);
-        return NULL;
 }
 static void release_blocks(struct super_block *sb, int count)
@@ -1461,7 +1422,6 @@ unsigned long ext2_count_free_blocks (struct super_block * sb)
 #endif
 }
 static inline int test_root(int a, int b)
 {
        int num = b;
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index 7a87d15523be..a8ba7e831278 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -80,14 +80,6 @@ struct ext3_group_desc * ext3_get_group_desc(struct super_block * sb,
        return desc + offset;
 }
-static inline int
-block_in_use(ext3_fsblk_t block, struct super_block *sb, unsigned char *map)
-{
-        return ext3_test_bit ((block -
-                le32_to_cpu(EXT3_SB(sb)->s_es->s_first_data_block)) %
-                         EXT3_BLOCKS_PER_GROUP(sb), map);
-}
 /**
 * read_block_bitmap()
 * @sb:                 super block
@@ -101,51 +93,20 @@ block_in_use(ext3_fsblk_t block, struct super_block *sb, unsigned char *map)
 static struct buffer_head *
 read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
-        int i;
        struct ext3_group_desc * desc;
        struct buffer_head * bh = NULL;
-        ext3_fsblk_t bitmap_blk;
        desc = ext3_get_group_desc (sb, block_group, NULL);
        if (!desc)
-                return NULL;
+                goto error_out;
-        bitmap_blk = le32_to_cpu(desc->bg_block_bitmap);
+        bh = sb_bread(sb, le32_to_cpu(desc->bg_block_bitmap));
-        bh = sb_bread(sb, bitmap_blk);
        if (!bh)
-                ext3_error (sb, __FUNCTION__,
+                ext3_error (sb, "read_block_bitmap",
                            "Cannot read block bitmap - "
                            "block_group = %d, block_bitmap = %u",
                            block_group, le32_to_cpu(desc->bg_block_bitmap));
-        /* check whether block bitmap block number is set */
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode bitmap block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_bitmap);
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode table block number is set */
-        bitmap_blk = le32_to_cpu(desc->bg_inode_table);
-        for (i = 0; i < EXT3_SB(sb)->s_itb_per_group; i++, bitmap_blk++) {
-                if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                        /* bad block bitmap */
-                        goto error_out;
-                }
-        }
-        return bh;
 error_out:
-        brelse(bh);
+        return bh;
-        ext3_error(sb, __FUNCTION__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %lu",
-                        block_group, bitmap_blk);
-        return NULL;
 }
 /*
 * The reservation window structure operations
@@ -1772,7 +1733,6 @@ ext3_fsblk_t ext3_count_free_blocks(struct super_block *sb)
 #endif
 }
 static inline int test_root(int a, int b)
 {
        int num = b;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index e906b65448e2..71ee95e534fd 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -189,15 +189,6 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
        return desc;
 }
-static inline int
-block_in_use(ext4_fsblk_t block, struct super_block *sb, unsigned char *map)
-{
-        ext4_grpblk_t offset;
-        ext4_get_group_no_and_offset(sb, block, NULL, &offset);
-        return ext4_test_bit (offset, map);
-}
 /**
 * read_block_bitmap()
 * @sb:                 super block
@@ -211,7 +202,6 @@ block_in_use(ext4_fsblk_t block, struct super_block *sb, unsigned char *map)
 struct buffer_head *
 read_block_bitmap(struct super_block *sb, unsigned int block_group)
 {
-        int i;
        struct ext4_group_desc * desc;
        struct buffer_head * bh = NULL;
        ext4_fsblk_t bitmap_blk;
@@ -239,38 +229,7 @@ read_block_bitmap(struct super_block *sb, unsigned int block_group)
                            "Cannot read block bitmap - "
                            "block_group = %d, block_bitmap = %llu",
                            block_group, bitmap_blk);
-        /* check whether block bitmap block number is set */
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode bitmap block number is set */
-        bitmap_blk = ext4_inode_bitmap(sb, desc);
-        if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                /* bad block bitmap */
-                goto error_out;
-        }
-        /* check whether the inode table block number is set */
-        bitmap_blk = ext4_inode_table(sb, desc);
-        for (i = 0; i < EXT4_SB(sb)->s_itb_per_group; i++, bitmap_blk++) {
-                if (!block_in_use(bitmap_blk, sb, bh->b_data)) {
-                        /* bad block bitmap */
-                        goto error_out;
-                }
-        }
        return bh;
-error_out:
-        brelse(bh);
-        ext4_error(sb, __FUNCTION__,
-                        "Invalid block bitmap - "
-                        "block_group = %d, block = %llu",
-                        block_group, bitmap_blk);
-        return NULL;
 }
 /*
 * The reservation window structure operations
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index b61742885011..0e5fa11e6b44 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -41,7 +41,7 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst * rqstp,
        fh = fh_copy(&resp->fh, &argp->fh);
        if ((nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP)))
-                RETURN_STATUS(nfserr_inval);
+                RETURN_STATUS(nfserr);
        if (argp->mask & ~(NFS_ACL|NFS_ACLCNT|NFS_DFACL|NFS_DFACLCNT))
                RETURN_STATUS(nfserr_inval);
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index 3e3f2de82c36..b647f2f872dc 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -37,7 +37,7 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst * rqstp,
        fh = fh_copy(&resp->fh, &argp->fh);
        if ((nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP)))
-                RETURN_STATUS(nfserr_inval);
+                RETURN_STATUS(nfserr);
        if (argp->mask & ~(NFS_ACL|NFS_ACLCNT|NFS_DFACL|NFS_DFACLCNT))
                RETURN_STATUS(nfserr_inval);
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 4f712e970584..468f17a78441 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -95,6 +95,22 @@ nfsd_mode_check(struct svc_rqst *rqstp, umode_t mode, int type)
        return 0;
 }
+static __be32 nfsd_setuser_and_check_port(struct svc_rqst *rqstp,
+                                          struct svc_export *exp)
+{
+        /* Check if the request originated from a secure port. */
+        if (!rqstp->rq_secure && EX_SECURE(exp)) {
+                char buf[RPC_MAX_ADDRBUFLEN];
+                dprintk(KERN_WARNING
+                       "nfsd: request from insecure port %s!\n",
+                       svc_print_addr(rqstp, buf, sizeof(buf)));
+                return nfserr_perm;
+        }
+        /* Set user creds for this exportpoint */
+        return nfserrno(nfsd_setuser(rqstp, exp));
+}
 /*
 * Perform sanity checks on the dentry in a client's file handle.
 *
@@ -167,18 +183,7 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                        goto out;
                }
-                /* Check if the request originated from a secure port. */
+                error = nfsd_setuser_and_check_port(rqstp, exp);
-                error = nfserr_perm;
-                if (!rqstp->rq_secure && EX_SECURE(exp)) {
-                        char buf[RPC_MAX_ADDRBUFLEN];
-                        printk(KERN_WARNING
-                               "nfsd: request from insecure port %s!\n",
-                               svc_print_addr(rqstp, buf, sizeof(buf)));
-                        goto out;
-                }
-                /* Set user creds for this exportpoint */
-                error = nfserrno(nfsd_setuser(rqstp, exp));
                if (error)
                        goto out;
@@ -227,18 +232,22 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                fhp->fh_export = exp;
                nfsd_nr_verified++;
        } else {
-                /* just rechecking permissions
+                /*
-                 * (e.g. nfsproc_create calls fh_verify, then nfsd_create does as well)
+                 * just rechecking permissions
+                 * (e.g. nfsproc_create calls fh_verify, then nfsd_create
+                 * does as well)
                 */
                dprintk("nfsd: fh_verify - just checking\n");
                dentry = fhp->fh_dentry;
                exp = fhp->fh_export;
-                /* Set user creds for this exportpoint; necessary even
+                /*
+                 * Set user creds for this exportpoint; necessary even
                 * in the "just checking" case because this may be a
                 * filehandle that was created by fh_compose, and that
                 * is about to be used in another nfsv4 compound
-                 * operation */
+                 * operation.
-                error = nfserrno(nfsd_setuser(rqstp, exp));
+                 */
+                error = nfsd_setuser_and_check_port(rqstp, exp);
                if (error)
                        goto out;
        }
diff --git a/include/asm-x86/i387_64.h b/include/asm-x86/i387_64.h
index 0217b74cc9fc..3a4ffba3d6bc 100644
--- a/include/asm-x86/i387_64.h
+++ b/include/asm-x86/i387_64.h
@@ -203,6 +203,11 @@ static inline void save_init_fpu(struct task_struct *tsk)
 */
 static inline int restore_i387(struct _fpstate __user *buf)
 {
+        set_used_math();
+        if (!(task_thread_info(current)->status & TS_USEDFPU)) {
+                clts();
+                task_thread_info(current)->status |= TS_USEDFPU;
+        }
        return restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 94e49915a8c0..91140fe8c119 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -387,7 +387,9 @@ extern void	      skb_truesize_bug(struct sk_buff *skb);
 static inline void skb_truesize_check(struct sk_buff *skb)
 {
-        if (unlikely((int)skb->truesize < sizeof(struct sk_buff) + skb->len))
+        int len = sizeof(struct sk_buff) + skb->len;
+        if (unlikely((int)skb->truesize < len))
                skb_truesize_bug(skb);
 }
diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
index ac69e7bb5a14..1a4ed49f6478 100644
--- a/include/linux/virtio_ring.h
+++ b/include/linux/virtio_ring.h
@@ -67,7 +67,7 @@ struct vring {
 };
 /* The standard layout for the ring is a continuous chunk of memory which looks
- * like this.  The used fields will be aligned to a "num+1" boundary.
+ * like this.  We assume num is a power of 2.
 *
 * struct vring
 * {
@@ -79,8 +79,8 @@ struct vring {
 *      __u16 avail_idx;
 *      __u16 available[num];
 *
- *      // Padding so a correctly-chosen num value will cache-align used_idx.
+ *      // Padding to the next page boundary.
- *      char pad[sizeof(struct vring_desc) - sizeof(avail_flags)];
+ *      char pad[];
 *
 *      // A ring of used descriptor heads with free-running index.
 *      __u16 used_flags;
@@ -88,18 +88,21 @@ struct vring {
 *      struct vring_used_elem used[num];
 * };
 */
-static inline void vring_init(struct vring *vr, unsigned int num, void *p)
+static inline void vring_init(struct vring *vr, unsigned int num, void *p,
+                              unsigned int pagesize)
 {
        vr->num = num;
        vr->desc = p;
-        vr->avail = p + num*sizeof(struct vring);
+        vr->avail = p + num*sizeof(struct vring_desc);
-        vr->used = p + (num+1)*(sizeof(struct vring) + sizeof(__u16));
+        vr->used = (void *)(((unsigned long)&vr->avail->ring[num] + pagesize-1)
+                            & ~(pagesize - 1));
 }
-static inline unsigned vring_size(unsigned int num)
+static inline unsigned vring_size(unsigned int num, unsigned int pagesize)
 {
-        return (num + 1) * (sizeof(struct vring_desc) + sizeof(__u16))
+        return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (2 + num)
-                + sizeof(__u32) + num * sizeof(struct vring_used_elem);
+                 + pagesize - 1) & ~(pagesize - 1))
+                + sizeof(__u16) * 2 + sizeof(struct vring_used_elem) * num;
 }
 #ifdef __KERNEL__
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 0864a775de24..a1c805d7f488 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -12,7 +12,7 @@ extern void unix_gc(void);
 #define UNIX_HASH_SIZE  256
-extern atomic_t unix_tot_inflight;
+extern unsigned int unix_tot_inflight;
 struct unix_address {
        atomic_t        refcnt;
diff --git a/include/net/dst.h b/include/net/dst.h
index e9ff4a4caef9..2f65e894b829 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -143,6 +143,13 @@ static inline void dst_hold(struct dst_entry * dst)
        atomic_inc(&dst->__refcnt);
 }
+static inline void dst_use(struct dst_entry *dst, unsigned long time)
+{
+        dst_hold(dst);
+        dst->__use++;
+        dst->lastuse = time;
+}
 static inline
 struct dst_entry * dst_clone(struct dst_entry * dst)
 {
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 017aebd90683..41a301e38643 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -107,4 +107,7 @@ extern int			fib_rules_unregister(struct fib_rules_ops *);
 extern int                      fib_rules_lookup(struct fib_rules_ops *,
                                                 struct flowi *, int flags,
                                                 struct fib_lookup_arg *);
+extern int                      fib_default_rule_add(struct fib_rules_ops *,
+                                                     u32 pref, u32 table,
+                                                     u32 flags);
 #endif
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 8461cda37490..469216d93663 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -23,6 +23,7 @@
 #include <linux/spinlock.h>
 #include <linux/types.h>
 #include <linux/wait.h>
+#include <linux/vmalloc.h>
 #include <net/inet_connection_sock.h>
 #include <net/inet_sock.h>
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 5fcc4c104340..17b60391fcd6 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -706,11 +706,16 @@ enum ieee80211_hw_flags {
 *
 * @queues: number of available hardware transmit queues for
 *      data packets. WMM/QoS requires at least four.
+ *
+ * @rate_control_algorithm: rate control algorithm for this hardware.
+ *      If unset (NULL), the default algorithm will be used. Must be
+ *      set before calling ieee80211_register_hw().
 */
 struct ieee80211_hw {
        struct ieee80211_conf conf;
        struct wiphy *wiphy;
        struct workqueue_struct *workqueue;
+        const char *rate_control_algorithm;
        void *priv;
        u32 flags;
        unsigned int extra_tx_headroom;
@@ -936,27 +941,11 @@ enum ieee80211_erp_change_flags {
 *      and remove_interface calls, i.e. while the interface with the
 *      given local_address is enabled.
 *
- * @set_ieee8021x: Enable/disable IEEE 802.1X. This item requests wlan card
- *      to pass unencrypted EAPOL-Key frames even when encryption is
- *      configured. If the wlan card does not require such a configuration,
- *      this function pointer can be set to NULL.
- *
- * @set_port_auth: Set port authorization state (IEEE 802.1X PAE) to be
- *      authorized (@authorized=1) or unauthorized (=0). This function can be
- *      used if the wlan hardware or low-level driver implements PAE.
- *      mac80211 will filter frames based on authorization state in any case,
- *      so this function pointer can be NULL if low-level driver does not
- *      require event notification about port state changes.
- *
 * @hw_scan: Ask the hardware to service the scan request, no need to start
 *      the scan state machine in stack.
 *
 * @get_stats: return low-level statistics
 *
- * @set_privacy_invoked: For devices that generate their own beacons and probe
- *      response or association responses this updates the state of privacy_invoked
- *      returns 0 for success or an error number.
- *
 * @get_sequence_counter: For devices that have internal sequence counters this
 *      callback allows mac80211 to access the current value of a counter.
 *      This callback seems not well-defined, tell us if you need it.
@@ -1029,14 +1018,9 @@ struct ieee80211_ops {
        int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                       const u8 *local_address, const u8 *address,
                       struct ieee80211_key_conf *key);
-        int (*set_ieee8021x)(struct ieee80211_hw *hw, int use_ieee8021x);
-        int (*set_port_auth)(struct ieee80211_hw *hw, u8 *addr,
-                             int authorized);
        int (*hw_scan)(struct ieee80211_hw *hw, u8 *ssid, size_t len);
        int (*get_stats)(struct ieee80211_hw *hw,
                         struct ieee80211_low_level_stats *stats);
-        int (*set_privacy_invoked)(struct ieee80211_hw *hw,
-                                   int privacy_invoked);
        int (*get_sequence_counter)(struct ieee80211_hw *hw,
                                    u8* addr, u8 keyidx, u8 txrx,
                                    u32* iv32, u16* iv16);
diff --git a/kernel/signal.c b/kernel/signal.c
index 909a0cc6bc70..afa4f781f924 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -55,7 +55,7 @@ static int sig_ignored(struct task_struct *t, int sig)
         * signal handler may change by the time it is
         * unblocked.
         */
-        if (sigismember(&t->blocked, sig))
+        if (sigismember(&t->blocked, sig) || sigismember(&t->real_blocked, sig))
                return 0;
        /* Is it explicitly or implicitly ignored? */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index da69d833e067..12376ae3f733 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -749,23 +749,6 @@ int move_freepages_block(struct zone *zone, struct page *page, int migratetype)
        return move_freepages(zone, start_page, end_page, migratetype);
 }
-/* Return the page with the lowest PFN in the list */
-static struct page *min_page(struct list_head *list)
-{
-        unsigned long min_pfn = -1UL;
-        struct page *min_page = NULL, *page;;
-        list_for_each_entry(page, list, lru) {
-                unsigned long pfn = page_to_pfn(page);
-                if (pfn < min_pfn) {
-                        min_pfn = pfn;
-                        min_page = page;
-                }
-        }
-        return min_page;
-}
 /* Remove an element from the buddy allocator from the fallback list */
 static struct page *__rmqueue_fallback(struct zone *zone, int order,
                                                int start_migratetype)
@@ -789,11 +772,8 @@ static struct page *__rmqueue_fallback(struct zone *zone, int order,
                        if (list_empty(&area->free_list[migratetype]))
                                continue;
-                        /* Bias kernel allocations towards low pfns */
                        page = list_entry(area->free_list[migratetype].next,
                                        struct page, lru);
-                        if (unlikely(start_migratetype != MIGRATE_MOVABLE))
-                                page = min_page(&area->free_list[migratetype]);
                        area->nr_free--;
                        /*
diff --git a/mm/slub.c b/mm/slub.c
index 84f59fde1a10..9acb413858ac 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1080,7 +1080,6 @@ static struct page *new_slab(struct kmem_cache *s, gfp_t flags, int node)
        struct page *page;
        struct kmem_cache_node *n;
        void *start;
-        void *end;
        void *last;
        void *p;
@@ -1101,7 +1100,6 @@ static struct page *new_slab(struct kmem_cache *s, gfp_t flags, int node)
                SetSlabDebug(page);
        start = page_address(page);
-        end = start + s->objects * s->size;
        if (unlikely(s->flags & SLAB_POISON))
                memset(start, POISON_INUSE, PAGE_SIZE << s->order);
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 1037748c14db..6567213959cb 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -376,6 +376,7 @@ void vlan_setup(struct net_device *new_dev)
        new_dev->init = vlan_dev_init;
        new_dev->open = vlan_dev_open;
        new_dev->stop = vlan_dev_stop;
+        new_dev->set_mac_address = vlan_set_mac_address;
        new_dev->set_multicast_list = vlan_dev_set_multicast_list;
        new_dev->change_rx_flags = vlan_change_rx_flags;
        new_dev->destructor = free_netdev;
@@ -636,6 +637,10 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                        if (!vlandev)
                                continue;
+                        flgs = vlandev->flags;
+                        if (!(flgs & IFF_UP))
+                                continue;
                        vlan_sync_address(dev, vlandev);
                }
                break;
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index cf4a80d06b35..2cd1393073ec 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -60,6 +60,7 @@ int vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb, struct net_device *dev
 int vlan_dev_change_mtu(struct net_device *dev, int new_mtu);
 int vlan_dev_open(struct net_device* dev);
 int vlan_dev_stop(struct net_device* dev);
+int vlan_set_mac_address(struct net_device *dev, void *p);
 int vlan_dev_ioctl(struct net_device* dev, struct ifreq *ifr, int cmd);
 void vlan_dev_set_ingress_priority(const struct net_device *dev,
                                   u32 skb_prio, short vlan_prio);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 1a1740aa9a8b..7a36878241da 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -665,6 +665,32 @@ int vlan_dev_stop(struct net_device *dev)
        return 0;
 }
+int vlan_set_mac_address(struct net_device *dev, void *p)
+{
+        struct net_device *real_dev = VLAN_DEV_INFO(dev)->real_dev;
+        struct sockaddr *addr = p;
+        int err;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        if (!(dev->flags & IFF_UP))
+                goto out;
+        if (compare_ether_addr(addr->sa_data, real_dev->dev_addr)) {
+                err = dev_unicast_add(real_dev, addr->sa_data, ETH_ALEN);
+                if (err < 0)
+                        return err;
+        }
+        if (compare_ether_addr(dev->dev_addr, real_dev->dev_addr))
+                dev_unicast_delete(real_dev, dev->dev_addr, ETH_ALEN);
+out:
+        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+        return 0;
+}
 int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
        struct net_device *real_dev = VLAN_DEV_INFO(dev)->real_dev;
diff --git a/net/core/dev.c b/net/core/dev.c
index be6cedab5aa8..dd7e30754cbc 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4330,7 +4330,6 @@ static struct hlist_head *netdev_create_hash(void)
 static int __net_init netdev_init(struct net *net)
 {
        INIT_LIST_HEAD(&net->dev_base_head);
-        rwlock_init(&dev_base_lock);
        net->dev_name_head = netdev_create_hash();
        if (net->dev_name_head == NULL)
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index ae354057d84c..647973daca2b 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -168,13 +168,13 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
        da = from->mc_list;
        while (da != NULL) {
                next = da->next;
-                if (!da->da_synced)
+                if (da->da_synced) {
-                        continue;
+                        __dev_addr_delete(&to->mc_list, &to->mc_count,
-                __dev_addr_delete(&to->mc_list, &to->mc_count,
+                                          da->da_addr, da->da_addrlen, 0);
-                                  da->da_addr, da->da_addrlen, 0);
+                        da->da_synced = 0;
-                da->da_synced = 0;
+                        __dev_addr_delete(&from->mc_list, &from->mc_count,
-                __dev_addr_delete(&from->mc_list, &from->mc_count,
+                                          da->da_addr, da->da_addrlen, 0);
-                                  da->da_addr, da->da_addrlen, 0);
+                }
                da = next;
        }
        __dev_set_rx_mode(to);
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 13de6f53f098..848132b6cb73 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -18,6 +18,28 @@
 static LIST_HEAD(rules_ops);
 static DEFINE_SPINLOCK(rules_mod_lock);
+int fib_default_rule_add(struct fib_rules_ops *ops,
+                         u32 pref, u32 table, u32 flags)
+{
+        struct fib_rule *r;
+        r = kzalloc(ops->rule_size, GFP_KERNEL);
+        if (r == NULL)
+                return -ENOMEM;
+        atomic_set(&r->refcnt, 1);
+        r->action = FR_ACT_TO_TBL;
+        r->pref = pref;
+        r->table = table;
+        r->flags = flags;
+        /* The lock is not required here, the list in unreacheable
+         * at the moment this function is called */
+        list_add_tail(&r->list, &ops->rules_list);
+        return 0;
+}
+EXPORT_SYMBOL(fib_default_rule_add);
 static void notify_rule_change(int event, struct fib_rule *rule,
                               struct fib_rules_ops *ops, struct nlmsghdr *nlh,
                               u32 pid);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 97eee5e8fbbe..66663e5d7acd 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -293,9 +293,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route *
                                           dn_rt_hash_table[hash].chain);
                        rcu_assign_pointer(dn_rt_hash_table[hash].chain, rth);
-                        rth->u.dst.__use++;
+                        dst_use(&rth->u.dst, now);
-                        dst_hold(&rth->u.dst);
-                        rth->u.dst.lastuse = now;
                        spin_unlock_bh(&dn_rt_hash_table[hash].lock);
                        dnrt_drop(rt);
@@ -308,9 +306,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route *
        rcu_assign_pointer(rt->u.dst.dn_next, dn_rt_hash_table[hash].chain);
        rcu_assign_pointer(dn_rt_hash_table[hash].chain, rt);
-        dst_hold(&rt->u.dst);
+        dst_use(&rt->u.dst, now);
-        rt->u.dst.__use++;
-        rt->u.dst.lastuse = now;
        spin_unlock_bh(&dn_rt_hash_table[hash].lock);
        *rp = rt;
        return 0;
@@ -1182,9 +1178,7 @@ static int __dn_route_output_key(struct dst_entry **pprt, const struct flowi *fl
                            (flp->mark == rt->fl.mark) &&
                            (rt->fl.iif == 0) &&
                            (rt->fl.oif == flp->oif)) {
-                                rt->u.dst.lastuse = jiffies;
+                                dst_use(&rt->u.dst, jiffies);
-                                dst_hold(&rt->u.dst);
-                                rt->u.dst.__use++;
                                rcu_read_unlock_bh();
                                *pprt = &rt->u.dst;
                                return 0;
@@ -1456,9 +1450,7 @@ int dn_route_input(struct sk_buff *skb)
                    (rt->fl.oif == 0) &&
                    (rt->fl.mark == skb->mark) &&
                    (rt->fl.iif == cb->iif)) {
-                        rt->u.dst.lastuse = jiffies;
+                        dst_use(&rt->u.dst, jiffies);
-                        dst_hold(&rt->u.dst);
-                        rt->u.dst.__use++;
                        rcu_read_unlock();
                        skb->dst = (struct dst_entry *)rt;
                        return 0;
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index ddd3f04f0919..ffebea04cc99 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -48,15 +48,6 @@ struct dn_fib_rule
        u8                      flags;
 };
-static struct dn_fib_rule default_rule = {
-        .common = {
-                .refcnt =               ATOMIC_INIT(2),
-                .pref =                 0x7fff,
-                .table =                RT_TABLE_MAIN,
-                .action =               FR_ACT_TO_TBL,
-        },
-};
 int dn_fib_lookup(struct flowi *flp, struct dn_fib_res *res)
 {
@@ -262,8 +253,8 @@ static struct fib_rules_ops dn_fib_rules_ops = {
 void __init dn_fib_rules_init(void)
 {
-        list_add_tail(&default_rule.common.list,
+        BUG_ON(fib_default_rule_add(&dn_fib_rules_ops, 0x7fff,
-                        &dn_fib_rules_ops.rules_list);
+                                    RT_TABLE_MAIN, 0));
        fib_rules_register(&dn_fib_rules_ops);
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index ac36767b56e8..e01b59aedc54 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -470,7 +470,7 @@ ieee80211softmac_wx_set_mlme(struct net_device *dev,
 {
        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
        struct iw_mlme *mlme = (struct iw_mlme *)extra;
-        u16 reason = cpu_to_le16(mlme->reason_code);
+        u16 reason = mlme->reason_code;
        struct ieee80211softmac_network *net;
        int err = -EINVAL;
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index f16839c6a721..a0ada3a8d8dd 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -49,33 +49,6 @@ struct fib4_rule
 #endif
 };
-static struct fib4_rule default_rule = {
-        .common = {
-                .refcnt =       ATOMIC_INIT(2),
-                .pref =         0x7FFF,
-                .table =        RT_TABLE_DEFAULT,
-                .action =       FR_ACT_TO_TBL,
-        },
-};
-static struct fib4_rule main_rule = {
-        .common = {
-                .refcnt =       ATOMIC_INIT(2),
-                .pref =         0x7FFE,
-                .table =        RT_TABLE_MAIN,
-                .action =       FR_ACT_TO_TBL,
-        },
-};
-static struct fib4_rule local_rule = {
-        .common = {
-                .refcnt =       ATOMIC_INIT(2),
-                .table =        RT_TABLE_LOCAL,
-                .action =       FR_ACT_TO_TBL,
-                .flags =        FIB_RULE_PERMANENT,
-        },
-};
 #ifdef CONFIG_NET_CLS_ROUTE
 u32 fib_rules_tclass(struct fib_result *res)
 {
@@ -319,11 +292,27 @@ static struct fib_rules_ops fib4_rules_ops = {
        .owner          = THIS_MODULE,
 };
-void __init fib4_rules_init(void)
+static int __init fib_default_rules_init(void)
 {
-        list_add_tail(&local_rule.common.list, &fib4_rules_ops.rules_list);
+        int err;
-        list_add_tail(&main_rule.common.list, &fib4_rules_ops.rules_list);
-        list_add_tail(&default_rule.common.list, &fib4_rules_ops.rules_list);
+        err = fib_default_rule_add(&fib4_rules_ops, 0,
+                                   RT_TABLE_LOCAL, FIB_RULE_PERMANENT);
+        if (err < 0)
+                return err;
+        err = fib_default_rule_add(&fib4_rules_ops, 0x7FFE,
+                                   RT_TABLE_MAIN, 0);
+        if (err < 0)
+                return err;
+        err = fib_default_rule_add(&fib4_rules_ops, 0x7FFF,
+                                   RT_TABLE_DEFAULT, 0);
+        if (err < 0)
+                return err;
+        return 0;
+}
+void __init fib4_rules_init(void)
+{
+        BUG_ON(fib_default_rules_init());
        fib_rules_register(&fib4_rules_ops);
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 21b12de9e653..45651834e1e2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -851,9 +851,7 @@ restart:
                         */
                        rcu_assign_pointer(rt_hash_table[hash].chain, rth);
-                        rth->u.dst.__use++;
+                        dst_use(&rth->u.dst, now);
-                        dst_hold(&rth->u.dst);
-                        rth->u.dst.lastuse = now;
                        spin_unlock_bh(rt_hash_lock_addr(hash));
                        rt_drop(rt);
@@ -1813,11 +1811,6 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                goto martian_destination;
        err = ip_mkroute_input(skb, &res, &fl, in_dev, daddr, saddr, tos);
-        if (err == -ENOBUFS)
-                goto e_nobufs;
-        if (err == -EINVAL)
-                goto e_inval;
 done:
        in_dev_put(in_dev);
        if (free_res)
@@ -1935,9 +1928,7 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                    rth->fl.oif == 0 &&
                    rth->fl.mark == skb->mark &&
                    rth->fl.fl4_tos == tos) {
-                        rth->u.dst.lastuse = jiffies;
+                        dst_use(&rth->u.dst, jiffies);
-                        dst_hold(&rth->u.dst);
-                        rth->u.dst.__use++;
                        RT_CACHE_STAT_INC(in_hit);
                        rcu_read_unlock();
                        skb->dst = (struct dst_entry*)rth;
@@ -2331,9 +2322,7 @@ int __ip_route_output_key(struct rtable **rp, const struct flowi *flp)
                    rth->fl.mark == flp->mark &&
                    !((rth->fl.fl4_tos ^ flp->fl4_tos) &
                            (IPTOS_RT_MASK | RTO_ONLINK))) {
-                        rth->u.dst.lastuse = jiffies;
+                        dst_use(&rth->u.dst, jiffies);
-                        dst_hold(&rth->u.dst);
-                        rth->u.dst.__use++;
                        RT_CACHE_STAT_INC(out_hit);
                        rcu_read_unlock_bh();
                        *rp = rth;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ca9590f4f520..20c9440ab85e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1400,11 +1400,9 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                        /* DSACK info lost if out-of-mem, try SACK still */
                        if (in_sack <= 0)
                                in_sack = tcp_match_skb_to_sack(sk, skb, start_seq, end_seq);
-                        if (in_sack < 0)
+                        if (unlikely(in_sack < 0))
                                break;
-                        fack_count += tcp_skb_pcount(skb);
                        sacked = TCP_SKB_CB(skb)->sacked;
                        /* Account D-SACK for retransmitted packet. */
@@ -1419,19 +1417,17 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                                        if ((dup_sack && in_sack) &&
                                            (sacked&TCPCB_SACKED_ACKED))
                                                reord = min(fack_count, reord);
-                                } else {
-                                        /* If it was in a hole, we detected reordering. */
-                                        if (fack_count < prior_fackets &&
-                                            !(sacked&TCPCB_SACKED_ACKED))
-                                                reord = min(fack_count, reord);
                                }
                                /* Nothing to do; acked frame is about to be dropped. */
+                                fack_count += tcp_skb_pcount(skb);
                                continue;
                        }
-                        if (!in_sack)
+                        if (!in_sack) {
+                                fack_count += tcp_skb_pcount(skb);
                                continue;
+                        }
                        if (!(sacked&TCPCB_SACKED_ACKED)) {
                                if (sacked & TCPCB_SACKED_RETRANS) {
@@ -1448,12 +1444,17 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                                                tp->retransmit_skb_hint = NULL;
                                        }
                                } else {
-                                        /* New sack for not retransmitted frame,
+                                        if (!(sacked & TCPCB_RETRANS)) {
-                                         * which was in hole. It is reordering.
+                                                /* New sack for not retransmitted frame,
-                                         */
+                                                 * which was in hole. It is reordering.
-                                        if (!(sacked & TCPCB_RETRANS) &&
+                                                 */
-                                            fack_count < prior_fackets)
+                                                if (fack_count < prior_fackets)
-                                                reord = min(fack_count, reord);
+                                                        reord = min(fack_count, reord);
+                                                /* SACK enhanced F-RTO (RFC4138; Appendix B) */
+                                                if (!after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark))
+                                                        flag |= FLAG_ONLY_ORIG_SACKED;
+                                        }
                                        if (sacked & TCPCB_LOST) {
                                                TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
@@ -1462,24 +1463,13 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                                                /* clear lost hint */
                                                tp->retransmit_skb_hint = NULL;
                                        }
-                                        /* SACK enhanced F-RTO detection.
-                                         * Set flag if and only if non-rexmitted
-                                         * segments below frto_highmark are
-                                         * SACKed (RFC4138; Appendix B).
-                                         * Clearing correct due to in-order walk
-                                         */
-                                        if (after(end_seq, tp->frto_highmark)) {
-                                                flag &= ~FLAG_ONLY_ORIG_SACKED;
-                                        } else {
-                                                if (!(sacked & TCPCB_RETRANS))
-                                                        flag |= FLAG_ONLY_ORIG_SACKED;
-                                        }
                                }
                                TCP_SKB_CB(skb)->sacked |= TCPCB_SACKED_ACKED;
                                flag |= FLAG_DATA_SACKED;
                                tp->sacked_out += tcp_skb_pcount(skb);
+                                fack_count += tcp_skb_pcount(skb);
                                if (fack_count > tp->fackets_out)
                                        tp->fackets_out = fack_count;
@@ -1490,6 +1480,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                        } else {
                                if (dup_sack && (sacked&TCPCB_RETRANS))
                                        reord = min(fack_count, reord);
+                                fack_count += tcp_skb_pcount(skb);
                        }
                        /* D-SACK. We can detect redundant retransmission
@@ -1504,6 +1496,12 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                                tp->retransmit_skb_hint = NULL;
                        }
                }
+                /* SACK enhanced FRTO (RFC4138, Appendix B): Clearing correct
+                 * due to in-order walk
+                 */
+                if (after(end_seq, tp->frto_highmark))
+                        flag &= ~FLAG_ONLY_ORIG_SACKED;
        }
        if (tp->retrans_out &&
@@ -1515,7 +1513,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
        if ((reord < tp->fackets_out) && icsk->icsk_ca_state != TCP_CA_Loss &&
            (!tp->frto_highmark || after(tp->snd_una, tp->frto_highmark)))
-                tcp_update_reordering(sk, ((tp->fackets_out + 1) - reord), 0);
+                tcp_update_reordering(sk, tp->fackets_out - reord, 0);
 #if FASTRETRANS_DEBUG > 0
        BUG_TRAP((int)tp->sacked_out >= 0);
@@ -2630,7 +2628,8 @@ static u32 tcp_tso_acked(struct sock *sk, struct sk_buff *skb)
 * is before the ack sequence we can discard it as it's confirmed to have
 * arrived at the other end.
 */
-static int tcp_clean_rtx_queue(struct sock *sk, s32 *seq_rtt_p)
+static int tcp_clean_rtx_queue(struct sock *sk, s32 *seq_rtt_p,
+                               int prior_fackets)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2639,6 +2638,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, s32 *seq_rtt_p)
        int fully_acked = 1;
        int flag = 0;
        int prior_packets = tp->packets_out;
+        u32 cnt = 0;
+        u32 reord = tp->packets_out;
        s32 seq_rtt = -1;
        ktime_t last_ackt = net_invalid_timestamp();
@@ -2679,10 +2680,14 @@ static int tcp_clean_rtx_queue(struct sock *sk, s32 *seq_rtt_p)
                                if ((flag & FLAG_DATA_ACKED) ||
                                    (packets_acked > 1))
                                        flag |= FLAG_NONHEAD_RETRANS_ACKED;
-                        } else if (seq_rtt < 0) {
+                        } else {
-                                seq_rtt = now - scb->when;
+                                if (seq_rtt < 0) {
-                                if (fully_acked)
+                                        seq_rtt = now - scb->when;
-                                        last_ackt = skb->tstamp;
+                                        if (fully_acked)
+                                                last_ackt = skb->tstamp;
+                                }
+                                if (!(sacked & TCPCB_SACKED_ACKED))
+                                        reord = min(cnt, reord);
                        }
                        if (sacked & TCPCB_SACKED_ACKED)
@@ -2693,12 +2698,16 @@ static int tcp_clean_rtx_queue(struct sock *sk, s32 *seq_rtt_p)
                        if ((sacked & TCPCB_URG) && tp->urg_mode &&
                            !before(end_seq, tp->snd_up))
                                tp->urg_mode = 0;
-                } else if (seq_rtt < 0) {
+                } else {
-                        seq_rtt = now - scb->when;
+                        if (seq_rtt < 0) {
-                        if (fully_acked)
+                                seq_rtt = now - scb->when;
-                                last_ackt = skb->tstamp;
+                                if (fully_acked)
+                                        last_ackt = skb->tstamp;
+                        }
+                        reord = min(cnt, reord);
                }
                tp->packets_out -= packets_acked;
+                cnt += packets_acked;
                /* Initial outgoing SYN's get put onto the write_queue
                 * just like anything else we transmit.  It is not
@@ -2730,13 +2739,18 @@ static int tcp_clean_rtx_queue(struct sock *sk, s32 *seq_rtt_p)
                tcp_ack_update_rtt(sk, flag, seq_rtt);
                tcp_rearm_rto(sk);
+                if (tcp_is_reno(tp)) {
+                        tcp_remove_reno_sacks(sk, pkts_acked);
+                } else {
+                        /* Non-retransmitted hole got filled? That's reordering */
+                        if (reord < prior_fackets)
+                                tcp_update_reordering(sk, tp->fackets_out - reord, 0);
+                }
                tp->fackets_out -= min(pkts_acked, tp->fackets_out);
                /* hint's skb might be NULL but we don't need to care */
                tp->fastpath_cnt_hint -= min_t(u32, pkts_acked,
                                               tp->fastpath_cnt_hint);
-                if (tcp_is_reno(tp))
-                        tcp_remove_reno_sacks(sk, pkts_acked);
                if (ca_ops->pkts_acked) {
                        s32 rtt_us = -1;
@@ -3019,6 +3033,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
        u32 ack_seq = TCP_SKB_CB(skb)->seq;
        u32 ack = TCP_SKB_CB(skb)->ack_seq;
        u32 prior_in_flight;
+        u32 prior_fackets;
        s32 seq_rtt;
        int prior_packets;
        int frto_cwnd = 0;
@@ -3043,6 +3058,8 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
                        tp->bytes_acked += min(ack - prior_snd_una, tp->mss_cache);
        }
+        prior_fackets = tp->fackets_out;
        if (!(flag&FLAG_SLOWPATH) && after(ack, prior_snd_una)) {
                /* Window is constant, pure forward advance.
                 * No more checks are required.
@@ -3084,7 +3101,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
        prior_in_flight = tcp_packets_in_flight(tp);
        /* See if we can take anything off of the retransmit queue. */
-        flag |= tcp_clean_rtx_queue(sk, &seq_rtt);
+        flag |= tcp_clean_rtx_queue(sk, &seq_rtt, prior_fackets);
        /* Guarantee sacktag reordering detection against wrap-arounds */
        if (before(tp->frto_highmark, tp->snd_una))
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index a794a8ca8b4f..978b3fd61e65 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -17,6 +17,11 @@ static struct xfrm_tunnel *tunnel4_handlers;
 static struct xfrm_tunnel *tunnel64_handlers;
 static DEFINE_MUTEX(tunnel4_mutex);
+static inline struct xfrm_tunnel **fam_handlers(unsigned short family)
+{
+        return (family == AF_INET) ? &tunnel4_handlers : &tunnel64_handlers;
+}
 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family)
 {
        struct xfrm_tunnel **pprev;
@@ -25,8 +30,7 @@ int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family)
        mutex_lock(&tunnel4_mutex);
-        for (pprev = (family == AF_INET) ? &tunnel4_handlers : &tunnel64_handlers;
+        for (pprev = fam_handlers(family); *pprev; pprev = &(*pprev)->next) {
-             *pprev; pprev = &(*pprev)->next) {
                if ((*pprev)->priority > priority)
                        break;
                if ((*pprev)->priority == priority)
@@ -53,8 +57,7 @@ int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family)
        mutex_lock(&tunnel4_mutex);
-        for (pprev = (family == AF_INET) ? &tunnel4_handlers : &tunnel64_handlers;
+        for (pprev = fam_handlers(family); *pprev; pprev = &(*pprev)->next) {
-             *pprev; pprev = &(*pprev)->next) {
                if (*pprev == handler) {
                        *pprev = handler->next;
                        ret = 0;
@@ -118,6 +121,17 @@ static void tunnel4_err(struct sk_buff *skb, u32 info)
                        break;
 }
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static void tunnel64_err(struct sk_buff *skb, u32 info)
+{
+        struct xfrm_tunnel *handler;
+        for (handler = tunnel64_handlers; handler; handler = handler->next)
+                if (!handler->err_handler(skb, info))
+                        break;
+}
+#endif
 static struct net_protocol tunnel4_protocol = {
        .handler        =       tunnel4_rcv,
        .err_handler    =       tunnel4_err,
@@ -127,7 +141,7 @@ static struct net_protocol tunnel4_protocol = {
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 static struct net_protocol tunnel64_protocol = {
        .handler        =       tunnel64_rcv,
-        .err_handler    =       tunnel4_err,
+        .err_handler    =       tunnel64_err,
        .no_policy      =       1,
 };
 #endif
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 706622af206f..428c6b0e26d8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -31,25 +31,6 @@ struct fib6_rule
 static struct fib_rules_ops fib6_rules_ops;
-static struct fib6_rule main_rule = {
-        .common = {
-                .refcnt =       ATOMIC_INIT(2),
-                .pref =         0x7FFE,
-                .action =       FR_ACT_TO_TBL,
-                .table =        RT6_TABLE_MAIN,
-        },
-};
-static struct fib6_rule local_rule = {
-        .common = {
-                .refcnt =       ATOMIC_INIT(2),
-                .pref =         0,
-                .action =       FR_ACT_TO_TBL,
-                .table =        RT6_TABLE_LOCAL,
-                .flags =        FIB_RULE_PERMANENT,
-        },
-};
 struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
                                   pol_lookup_t lookup)
 {
@@ -270,11 +251,23 @@ static struct fib_rules_ops fib6_rules_ops = {
        .owner                  = THIS_MODULE,
 };
-void __init fib6_rules_init(void)
+static int __init fib6_default_rules_init(void)
 {
-        list_add_tail(&local_rule.common.list, &fib6_rules_ops.rules_list);
+        int err;
-        list_add_tail(&main_rule.common.list, &fib6_rules_ops.rules_list);
+        err = fib_default_rule_add(&fib6_rules_ops, 0,
+                                   RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
+        if (err < 0)
+                return err;
+        err = fib_default_rule_add(&fib6_rules_ops, 0x7FFE, RT6_TABLE_MAIN, 0);
+        if (err < 0)
+                return err;
+        return 0;
+}
+void __init fib6_rules_init(void)
+{
+        BUG_ON(fib6_default_rules_init());
        fib_rules_register(&fib6_rules_ops);
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 973a97abc446..6ecb5e6fae2e 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -544,12 +544,8 @@ restart:
        rt = rt6_device_match(rt, fl->oif, flags);
        BACKTRACK(&fl->fl6_src);
 out:
-        dst_hold(&rt->u.dst);
+        dst_use(&rt->u.dst, jiffies);
        read_unlock_bh(&table->tb6_lock);
-        rt->u.dst.lastuse = jiffies;
-        rt->u.dst.__use++;
        return rt;
 }
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index a195a66e0cc7..c76a9523091b 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -92,11 +92,6 @@ extern int ipxrtr_route_skb(struct sk_buff *skb);
 extern struct ipx_route *ipxrtr_lookup(__be32 net);
 extern int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
-#undef IPX_REFCNT_DEBUG
-#ifdef IPX_REFCNT_DEBUG
-atomic_t ipx_sock_nr;
-#endif
 struct ipx_interface *ipx_interfaces_head(void)
 {
        struct ipx_interface *rc = NULL;
@@ -151,14 +146,7 @@ static void ipx_destroy_socket(struct sock *sk)
 {
        ipx_remove_socket(sk);
        skb_queue_purge(&sk->sk_receive_queue);
-#ifdef IPX_REFCNT_DEBUG
+        sk_refcnt_debug_dec(sk);
-        atomic_dec(&ipx_sock_nr);
-        printk(KERN_DEBUG "IPX socket %p released, %d are still alive\n", sk,
-                        atomic_read(&ipx_sock_nr));
-        if (atomic_read(&sk->sk_refcnt) != 1)
-                printk(KERN_DEBUG "Destruction sock ipx %p delayed, cnt=%d\n",
-                                sk, atomic_read(&sk->sk_refcnt));
-#endif
        sock_put(sk);
 }
@@ -1384,11 +1372,8 @@ static int ipx_create(struct net *net, struct socket *sock, int protocol)
        sk = sk_alloc(net, PF_IPX, GFP_KERNEL, &ipx_proto);
        if (!sk)
                goto out;
-#ifdef IPX_REFCNT_DEBUG
-        atomic_inc(&ipx_sock_nr);
+        sk_refcnt_debug_inc(sk);
-        printk(KERN_DEBUG "IPX socket %p created, now we have %d alive\n", sk,
-                        atomic_read(&ipx_sock_nr));
-#endif
        sock_init_data(sock, sk);
        sk->sk_no_check = 1;            /* Checksum off by default */
        sock->ops = &ipx_dgram_ops;
@@ -1409,6 +1394,7 @@ static int ipx_release(struct socket *sock)
        sock_set_flag(sk, SOCK_DEAD);
        sock->sk = NULL;
+        sk_refcnt_debug_release(sk);
        ipx_destroy_socket(sk);
 out:
        return 0;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 6fffb3845ab6..ce176e691afe 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -13,6 +13,18 @@ config MAC80211
        This option enables the hardware independent IEEE 802.11
        networking stack.
+config MAC80211_RCSIMPLE
+        bool "'simple' rate control algorithm" if EMBEDDED
+        default y
+        depends on MAC80211
+        help
+          This option allows you to turn off the 'simple' rate
+          control algorithm in mac80211. If you do turn it off,
+          you absolutely need another rate control algorithm.
+          Say Y unless you know you will have another algorithm
+          available.
 config MAC80211_LEDS
        bool "Enable LED triggers"
        depends on MAC80211 && LEDS_TRIGGERS
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 219cd9f9341f..1e6237b34846 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -1,8 +1,9 @@
-obj-$(CONFIG_MAC80211) += mac80211.o rc80211_simple.o
+obj-$(CONFIG_MAC80211) += mac80211.o
 mac80211-objs-$(CONFIG_MAC80211_LEDS) += ieee80211_led.o
 mac80211-objs-$(CONFIG_MAC80211_DEBUGFS) += debugfs.o debugfs_sta.o debugfs_netdev.o debugfs_key.o
 mac80211-objs-$(CONFIG_NET_SCHED) += wme.o
+mac80211-objs-$(CONFIG_MAC80211_RCSIMPLE) += rc80211_simple.o
 mac80211-objs := \
        ieee80211.o \
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index f484ca7ade9c..e0ee65a969bc 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -1072,7 +1072,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        ieee80211_debugfs_add_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev));
        ieee80211_if_set_type(local->mdev, IEEE80211_IF_TYPE_AP);
-        result = ieee80211_init_rate_ctrl_alg(local, NULL);
+        result = ieee80211_init_rate_ctrl_alg(local,
+                                              hw->rate_control_algorithm);
        if (result < 0) {
                printk(KERN_DEBUG "%s: Failed to initialize rate control "
                       "algorithm\n", wiphy_name(local->hw.wiphy));
@@ -1233,8 +1234,17 @@ static int __init ieee80211_init(void)
        BUILD_BUG_ON(sizeof(struct ieee80211_tx_packet_data) > sizeof(skb->cb));
+#ifdef CONFIG_MAC80211_RCSIMPLE
+        ret = ieee80211_rate_control_register(&mac80211_rcsimple);
+        if (ret)
+                return ret;
+#endif
        ret = ieee80211_wme_register();
        if (ret) {
+#ifdef CONFIG_MAC80211_RCSIMPLE
+                ieee80211_rate_control_unregister(&mac80211_rcsimple);
+#endif
                printk(KERN_DEBUG "ieee80211_init: failed to "
                       "initialize WME (err=%d)\n", ret);
                return ret;
@@ -1248,6 +1258,10 @@ static int __init ieee80211_init(void)
 static void __exit ieee80211_exit(void)
 {
+#ifdef CONFIG_MAC80211_RCSIMPLE
+        ieee80211_rate_control_unregister(&mac80211_rcsimple);
+#endif
        ieee80211_wme_unregister();
        ieee80211_debugfs_netdev_exit();
 }
diff --git a/net/mac80211/ieee80211_common.h b/net/mac80211/ieee80211_common.h
deleted file mode 100644
index c15295d43d87..000000000000
--- a/net/mac80211/ieee80211_common.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * IEEE 802.11 driver (80211.o) -- hostapd interface
- * Copyright 2002-2004, Instant802 Networks, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#ifndef IEEE80211_COMMON_H
-#define IEEE80211_COMMON_H
-#include <linux/types.h>
-/*
- * This is common header information with user space. It is used on all
- * frames sent to wlan#ap interface.
- */
-#define IEEE80211_FI_VERSION 0x80211001
-struct ieee80211_frame_info {
-        __be32 version;
-        __be32 length;
-        __be64 mactime;
-        __be64 hosttime;
-        __be32 phytype;
-        __be32 channel;
-        __be32 datarate;
-        __be32 antenna;
-        __be32 priority;
-        __be32 ssi_type;
-        __be32 ssi_signal;
-        __be32 ssi_noise;
-        __be32 preamble;
-        __be32 encoding;
-        /* Note: this structure is otherwise identical to capture format used
-         * in linux-wlan-ng, but this additional field is used to provide meta
-         * data about the frame to hostapd. This was the easiest method for
-         * providing this information, but this might change in the future. */
-        __be32 msg_type;
-} __attribute__ ((packed));
-enum ieee80211_msg_type {
-        ieee80211_msg_normal = 0,
-        ieee80211_msg_tx_callback_ack = 1,
-        ieee80211_msg_tx_callback_fail = 2,
-        /* hole at 3, was ieee80211_msg_passive_scan but unused */
-        /* hole at 4, was ieee80211_msg_wep_frame_unknown_key but now unused */
-        ieee80211_msg_michael_mic_failure = 5,
-        /* hole at 6, was monitor but never sent to userspace */
-        ieee80211_msg_sta_not_assoc = 7,
-        /* 8 was ieee80211_msg_set_aid_for_sta */
-        /* 9 was ieee80211_msg_key_threshold_notification */
-        /* 11 was ieee80211_msg_radar */
-};
-struct ieee80211_msg_key_notification {
-        int tx_rx_count;
-        char ifname[IFNAMSIZ];
-        u8 addr[ETH_ALEN]; /* ff:ff:ff:ff:ff:ff for broadcast keys */
-};
-enum ieee80211_phytype {
-        ieee80211_phytype_fhss_dot11_97  = 1,
-        ieee80211_phytype_dsss_dot11_97  = 2,
-        ieee80211_phytype_irbaseband     = 3,
-        ieee80211_phytype_dsss_dot11_b   = 4,
-        ieee80211_phytype_pbcc_dot11_b   = 5,
-        ieee80211_phytype_ofdm_dot11_g   = 6,
-        ieee80211_phytype_pbcc_dot11_g   = 7,
-        ieee80211_phytype_ofdm_dot11_a   = 8,
-};
-enum ieee80211_ssi_type {
-        ieee80211_ssi_none = 0,
-        ieee80211_ssi_norm = 1, /* normalized, 0-1000 */
-        ieee80211_ssi_dbm = 2,
-        ieee80211_ssi_raw = 3, /* raw SSI */
-};
-struct ieee80211_radar_info {
-                int channel;
-                int radar;
-                int radar_type;
-};
-#endif /* IEEE80211_COMMON_H */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 4b4ed2a5803c..b4e32ab3664d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -230,6 +230,7 @@ struct ieee80211_if_vlan {
 #define IEEE80211_STA_AUTO_SSID_SEL     BIT(10)
 #define IEEE80211_STA_AUTO_BSSID_SEL    BIT(11)
 #define IEEE80211_STA_AUTO_CHANNEL_SEL  BIT(12)
+#define IEEE80211_STA_PRIVACY_INVOKED   BIT(13)
 struct ieee80211_if_sta {
        enum {
                IEEE80211_DISABLED, IEEE80211_AUTHENTICATE,
@@ -259,7 +260,6 @@ struct ieee80211_if_sta {
        unsigned long request;
        struct sk_buff_head skb_queue;
-        int key_management_enabled;
        unsigned long last_probe;
 #define IEEE80211_AUTH_ALG_OPEN BIT(0)
diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index 6caa3ec2cff7..7027eed4d4ae 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -917,7 +917,6 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                                   struct iw_request_info *info,
                                   struct iw_param *data, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        int ret = 0;
@@ -927,18 +926,21 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
        case IW_AUTH_CIPHER_GROUP:
        case IW_AUTH_WPA_ENABLED:
        case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-                break;
        case IW_AUTH_KEY_MGMT:
+                break;
+        case IW_AUTH_PRIVACY_INVOKED:
                if (sdata->type != IEEE80211_IF_TYPE_STA)
                        ret = -EINVAL;
                else {
+                        sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
                        /*
-                         * Key management was set by wpa_supplicant,
+                         * Privacy invoked by wpa_supplicant, store the
-                         * we only need this to associate to a network
+                         * value and allow associating to a protected
-                         * that has privacy enabled regardless of not
+                         * network without having a key up front.
-                         * having a key.
                         */
-                        sdata->u.sta.key_management_enabled = !!data->value;
+                        if (data->value)
+                                sdata->u.sta.flags |=
+                                        IEEE80211_STA_PRIVACY_INVOKED;
                }
                break;
        case IW_AUTH_80211_AUTH_ALG:
@@ -948,11 +950,6 @@ static int ieee80211_ioctl_siwauth(struct net_device *dev,
                else
                        ret = -EOPNOTSUPP;
                break;
-        case IW_AUTH_PRIVACY_INVOKED:
-                if (local->ops->set_privacy_invoked)
-                        ret = local->ops->set_privacy_invoked(
-                                        local_to_hw(local), data->value);
-                break;
        default:
                ret = -EOPNOTSUPP;
                break;
diff --git a/net/mac80211/ieee80211_rate.c b/net/mac80211/ieee80211_rate.c
index 93abb8fff141..7254bd609839 100644
--- a/net/mac80211/ieee80211_rate.c
+++ b/net/mac80211/ieee80211_rate.c
@@ -25,13 +25,25 @@ int ieee80211_rate_control_register(struct rate_control_ops *ops)
 {
        struct rate_control_alg *alg;
+        if (!ops->name)
+                return -EINVAL;
+        mutex_lock(&rate_ctrl_mutex);
+        list_for_each_entry(alg, &rate_ctrl_algs, list) {
+                if (!strcmp(alg->ops->name, ops->name)) {
+                        /* don't register an algorithm twice */
+                        WARN_ON(1);
+                        return -EALREADY;
+                }
+        }
        alg = kzalloc(sizeof(*alg), GFP_KERNEL);
        if (alg == NULL) {
+                mutex_unlock(&rate_ctrl_mutex);
                return -ENOMEM;
        }
        alg->ops = ops;
-        mutex_lock(&rate_ctrl_mutex);
        list_add_tail(&alg->list, &rate_ctrl_algs);
        mutex_unlock(&rate_ctrl_mutex);
@@ -61,9 +73,12 @@ ieee80211_try_rate_control_ops_get(const char *name)
        struct rate_control_alg *alg;
        struct rate_control_ops *ops = NULL;
+        if (!name)
+                return NULL;
        mutex_lock(&rate_ctrl_mutex);
        list_for_each_entry(alg, &rate_ctrl_algs, list) {
-                if (!name || !strcmp(alg->ops->name, name))
+                if (!strcmp(alg->ops->name, name))
                        if (try_module_get(alg->ops->module)) {
                                ops = alg->ops;
                                break;
@@ -80,9 +95,12 @@ ieee80211_rate_control_ops_get(const char *name)
 {
        struct rate_control_ops *ops;
+        if (!name)
+                name = "simple";
        ops = ieee80211_try_rate_control_ops_get(name);
        if (!ops) {
-                request_module("rc80211_%s", name ? name : "default");
+                request_module("rc80211_%s", name);
                ops = ieee80211_try_rate_control_ops_get(name);
        }
        return ops;
diff --git a/net/mac80211/ieee80211_rate.h b/net/mac80211/ieee80211_rate.h
index 7cd1ebab4f83..23688139ffb3 100644
--- a/net/mac80211/ieee80211_rate.h
+++ b/net/mac80211/ieee80211_rate.h
@@ -65,6 +65,9 @@ struct rate_control_ref {
        struct kref kref;
 };
+/* default 'simple' algorithm */
+extern struct rate_control_ops mac80211_rcsimple;
 int ieee80211_rate_control_register(struct rate_control_ops *ops);
 void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index fda0e06453e8..2079e988fc56 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -704,10 +704,11 @@ static int ieee80211_privacy_mismatch(struct net_device *dev,
 {
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        struct ieee80211_sta_bss *bss;
-        int res = 0;
+        int bss_privacy;
+        int wep_privacy;
+        int privacy_invoked;
-        if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL) ||
+        if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
-            ifsta->key_management_enabled)
                return 0;
        bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
@@ -715,13 +716,16 @@ static int ieee80211_privacy_mismatch(struct net_device *dev,
        if (!bss)
                return 0;
-        if (ieee80211_sta_wep_configured(dev) !=
+        bss_privacy = !!(bss->capability & WLAN_CAPABILITY_PRIVACY);
-            !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
+        wep_privacy = !!ieee80211_sta_wep_configured(dev);
-                res = 1;
+        privacy_invoked = !!(ifsta->flags & IEEE80211_STA_PRIVACY_INVOKED);
        ieee80211_rx_bss_put(dev, bss);
-        return res;
+        if ((bss_privacy == wep_privacy) || (bss_privacy == privacy_invoked))
+                return 0;
+        return 1;
 }
diff --git a/net/mac80211/rc80211_simple.c b/net/mac80211/rc80211_simple.c
index 314b8de88862..da72737364e4 100644
--- a/net/mac80211/rc80211_simple.c
+++ b/net/mac80211/rc80211_simple.c
@@ -7,7 +7,6 @@
 * published by the Free Software Foundation.
 */
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/types.h>
@@ -29,8 +28,6 @@
 #define RATE_CONTROL_INTERVAL (HZ / 20)
 #define RATE_CONTROL_MIN_TX 10
-MODULE_ALIAS("rc80211_default");
 static void rate_control_rate_inc(struct ieee80211_local *local,
                                  struct sta_info *sta)
 {
@@ -394,8 +391,7 @@ static void rate_control_simple_remove_sta_debugfs(void *priv, void *priv_sta)
 }
 #endif
-static struct rate_control_ops rate_control_simple = {
+struct rate_control_ops mac80211_rcsimple = {
-        .module = THIS_MODULE,
        .name = "simple",
        .tx_status = rate_control_simple_tx_status,
        .get_rate = rate_control_simple_get_rate,
@@ -410,22 +406,3 @@ static struct rate_control_ops rate_control_simple = {
        .remove_sta_debugfs = rate_control_simple_remove_sta_debugfs,
 #endif
 };
-static int __init rate_control_simple_init(void)
-{
-        return ieee80211_rate_control_register(&rate_control_simple);
-}
-static void __exit rate_control_simple_exit(void)
-{
-        ieee80211_rate_control_unregister(&rate_control_simple);
-}
-subsys_initcall(rate_control_simple_init);
-module_exit(rate_control_simple_exit);
-MODULE_DESCRIPTION("Simple rate control algorithm for ieee80211");
-MODULE_LICENSE("GPL");
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ece77766ea2b..428a9fcf57d6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -509,9 +509,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
                rx->key->tx_rx_count++;
                /* TODO: add threshold stuff again */
        } else {
+#ifdef CONFIG_MAC80211_DEBUG
                if (net_ratelimit())
                        printk(KERN_DEBUG "%s: RX protected frame,"
                               " but have no key\n", rx->dev->name);
+#endif /* CONFIG_MAC80211_DEBUG */
                return TXRX_DROP;
        }
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index a84a23310ff4..9bf0e1cc530a 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -314,9 +314,11 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
        if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
                if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
+#ifdef CONFIG_MAC80211_DEBUG
                        if (net_ratelimit())
                                printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
                                       "failed\n", rx->dev->name);
+#endif /* CONFIG_MAC80211_DEBUG */
                        return TXRX_DROP;
                }
        } else if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) {
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 6695efba57ec..20cec1cb956f 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -323,9 +323,12 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
                                          &rx->u.rx.tkip_iv32,
                                          &rx->u.rx.tkip_iv16);
        if (res != TKIP_DECRYPT_OK || wpa_test) {
-                printk(KERN_DEBUG "%s: TKIP decrypt failed for RX frame from "
+#ifdef CONFIG_MAC80211_DEBUG
-                       "%s (res=%d)\n",
+                if (net_ratelimit())
-                       rx->dev->name, print_mac(mac, rx->sta->addr), res);
+                        printk(KERN_DEBUG "%s: TKIP decrypt failed for RX "
+                               "frame from %s (res=%d)\n", rx->dev->name,
+                               print_mac(mac, rx->sta->addr), res);
+#endif /* CONFIG_MAC80211_DEBUG */
                return TXRX_DROP;
        }
@@ -594,9 +597,12 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
                            skb->data + hdrlen + CCMP_HDR_LEN, data_len,
                            skb->data + skb->len - CCMP_MIC_LEN,
                            skb->data + hdrlen + CCMP_HDR_LEN)) {
-                        printk(KERN_DEBUG "%s: CCMP decrypt failed for RX "
+#ifdef CONFIG_MAC80211_DEBUG
-                               "frame from %s\n", rx->dev->name,
+                        if (net_ratelimit())
-                               print_mac(mac, rx->sta->addr));
+                                printk(KERN_DEBUG "%s: CCMP decrypt failed "
+                                       "for RX frame from %s\n", rx->dev->name,
+                                       print_mac(mac, rx->sta->addr));
+#endif /* CONFIG_MAC80211_DEBUG */
                        return TXRX_DROP;
                }
        }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4cb2dfba0993..eb6be5030c70 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -139,9 +139,6 @@ dev->hard_header == NULL (ll header is added by device, we cannot control it)
 static HLIST_HEAD(packet_sklist);
 static DEFINE_RWLOCK(packet_sklist_lock);
-static atomic_t packet_socks_nr;
 /* Private packet socket structures. */
 struct packet_mclist
@@ -236,10 +233,7 @@ static void packet_sock_destruct(struct sock *sk)
                return;
        }
-        atomic_dec(&packet_socks_nr);
+        sk_refcnt_debug_dec(sk);
-#ifdef PACKET_REFCNT_DEBUG
-        printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr));
-#endif
 }
@@ -515,7 +509,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
        sll->sll_hatype = dev->type;
        sll->sll_protocol = skb->protocol;
        sll->sll_pkttype = skb->pkt_type;
-        if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
+        if (unlikely(po->origdev))
                sll->sll_ifindex = orig_dev->ifindex;
        else
                sll->sll_ifindex = dev->ifindex;
@@ -661,7 +655,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
        sll->sll_hatype = dev->type;
        sll->sll_protocol = skb->protocol;
        sll->sll_pkttype = skb->pkt_type;
-        if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST)
+        if (unlikely(po->origdev))
                sll->sll_ifindex = orig_dev->ifindex;
        else
                sll->sll_ifindex = dev->ifindex;
@@ -849,6 +843,7 @@ static int packet_release(struct socket *sock)
        /* Purge queues */
        skb_queue_purge(&sk->sk_receive_queue);
+        sk_refcnt_debug_release(sk);
        sock_put(sk);
        return 0;
@@ -1010,7 +1005,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
        po->num = proto;
        sk->sk_destruct = packet_sock_destruct;
-        atomic_inc(&packet_socks_nr);
+        sk_refcnt_debug_inc(sk);
        /*
         *      Attach a protocol block
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 51d151c0e962..73d60a307129 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -27,6 +27,10 @@
 #include <linux/mutex.h>
 #include <linux/rfkill.h>
+/* Get declaration of rfkill_switch_all() to shut up sparse. */
+#include "rfkill-input.h"
 MODULE_AUTHOR("Ivo van Doorn <IvDoorn@gmail.com>");
 MODULE_VERSION("1.0");
 MODULE_DESCRIPTION("RF switch support");
@@ -276,21 +280,17 @@ static struct class rfkill_class = {
 static int rfkill_add_switch(struct rfkill *rfkill)
 {
-        int retval;
+        int error;
-        retval = mutex_lock_interruptible(&rfkill_mutex);
-        if (retval)
-                return retval;
-        retval = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
+        mutex_lock(&rfkill_mutex);
-        if (retval)
-                goto out;
-        list_add_tail(&rfkill->node, &rfkill_list);
+        error = rfkill_toggle_radio(rfkill, rfkill_states[rfkill->type]);
+        if (!error)
+                list_add_tail(&rfkill->node, &rfkill_list);
- out:
        mutex_unlock(&rfkill_mutex);
-        return retval;
+        return error;
 }
 static void rfkill_remove_switch(struct rfkill *rfkill)
@@ -387,20 +387,23 @@ int rfkill_register(struct rfkill *rfkill)
        if (!rfkill->toggle_radio)
                return -EINVAL;
+        if (rfkill->type >= RFKILL_TYPE_MAX)
+                return -EINVAL;
+        snprintf(dev->bus_id, sizeof(dev->bus_id),
+                 "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
+        rfkill_led_trigger_register(rfkill);
        error = rfkill_add_switch(rfkill);
        if (error)
                return error;
-        snprintf(dev->bus_id, sizeof(dev->bus_id),
-                 "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
        error = device_add(dev);
        if (error) {
                rfkill_remove_switch(rfkill);
                return error;
        }
-        rfkill_led_trigger_register(rfkill);
        return 0;
 }
@@ -416,9 +419,9 @@ EXPORT_SYMBOL(rfkill_register);
 */
 void rfkill_unregister(struct rfkill *rfkill)
 {
-        rfkill_led_trigger_unregister(rfkill);
        device_del(&rfkill->dev);
        rfkill_remove_switch(rfkill);
+        rfkill_led_trigger_unregister(rfkill);
        put_device(&rfkill->dev);
 }
 EXPORT_SYMBOL(rfkill_unregister);
@@ -448,5 +451,5 @@ static void __exit rfkill_exit(void)
        class_unregister(&rfkill_class);
 }
-module_init(rfkill_init);
+subsys_initcall(rfkill_init);
 module_exit(rfkill_exit);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 53171029439f..c39008209164 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -613,17 +613,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
        memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
        n->ht_up = ht;
        n->handle = handle;
-{
+        n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
-        u8 i = 0;
-        u32 mask = ntohl(s->hmask);
-        if (mask) {
-                while (!(mask & 1)) {
-                        i++;
-                        mask>>=1;
-                }
-        }
-        n->fshift = i;
-}
 #ifdef CONFIG_CLS_U32_MARK
        if (tb[TCA_U32_MARK-1]) {
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 515e7a692f9b..e835da8fc091 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -457,7 +457,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         *        What the above comment does talk about? --ANK(980817)
         */
-        if (atomic_read(&unix_tot_inflight))
+        if (unix_tot_inflight)
                unix_gc();              /* Garbage collect fds */
        return 0;
@@ -599,15 +599,14 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
        struct sock *sk = NULL;
        struct unix_sock *u;
-        if (atomic_read(&unix_nr_socks) >= 2*get_max_files())
+        atomic_inc(&unix_nr_socks);
+        if (atomic_read(&unix_nr_socks) > 2 * get_max_files())
                goto out;
        sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto);
        if (!sk)
                goto out;
-        atomic_inc(&unix_nr_socks);
        sock_init_data(sock,sk);
        lockdep_set_class(&sk->sk_receive_queue.lock,
                                &af_unix_sk_receive_queue_lock_key);
@@ -625,6 +624,8 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
        init_waitqueue_head(&u->peer_wait);
        unix_insert_socket(unix_sockets_unbound, sk);
 out:
+        if (sk == NULL)
+                atomic_dec(&unix_nr_socks);
        return sk;
 }
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 406b6433e467..ebdff3d877a1 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -92,7 +92,7 @@ static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
 static DEFINE_SPINLOCK(unix_gc_lock);
-atomic_t unix_tot_inflight = ATOMIC_INIT(0);
+unsigned int unix_tot_inflight;
 static struct sock *unix_get_socket(struct file *filp)
@@ -133,7 +133,7 @@ void unix_inflight(struct file *fp)
                } else {
                        BUG_ON(list_empty(&u->link));
                }
-                atomic_inc(&unix_tot_inflight);
+                unix_tot_inflight++;
                spin_unlock(&unix_gc_lock);
        }
 }
@@ -147,7 +147,7 @@ void unix_notinflight(struct file *fp)
                BUG_ON(list_empty(&u->link));
                if (atomic_dec_and_test(&u->inflight))
                        list_del_init(&u->link);
-                atomic_dec(&unix_tot_inflight);
+                unix_tot_inflight--;
                spin_unlock(&unix_gc_lock);
        }
 }
@@ -161,7 +161,7 @@ static inline struct sk_buff *sock_queue_head(struct sock *sk)
        for (skb = sock_queue_head(sk)->next, next = skb->next; \
             skb != sock_queue_head(sk); skb = next, next = skb->next)
-static void scan_inflight(struct sock *x, void (*func)(struct sock *),
+static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
                          struct sk_buff_head *hitlist)
 {
        struct sk_buff *skb;
@@ -185,9 +185,9 @@ static void scan_inflight(struct sock *x, void (*func)(struct sock *),
                                 *      if it indeed does so
                                 */
                                struct sock *sk = unix_get_socket(*fp++);
-                                if(sk) {
+                                if (sk) {
                                        hit = true;
-                                        func(sk);
+                                        func(unix_sk(sk));
                                }
                        }
                        if (hit && hitlist != NULL) {
@@ -199,7 +199,7 @@ static void scan_inflight(struct sock *x, void (*func)(struct sock *),
        spin_unlock(&x->sk_receive_queue.lock);
 }
-static void scan_children(struct sock *x, void (*func)(struct sock *),
+static void scan_children(struct sock *x, void (*func)(struct unix_sock *),
                          struct sk_buff_head *hitlist)
 {
        if (x->sk_state != TCP_LISTEN)
@@ -235,20 +235,18 @@ static void scan_children(struct sock *x, void (*func)(struct sock *),
        }
 }
-static void dec_inflight(struct sock *sk)
+static void dec_inflight(struct unix_sock *usk)
 {
-        atomic_dec(&unix_sk(sk)->inflight);
+        atomic_dec(&usk->inflight);
 }
-static void inc_inflight(struct sock *sk)
+static void inc_inflight(struct unix_sock *usk)
 {
-        atomic_inc(&unix_sk(sk)->inflight);
+        atomic_inc(&usk->inflight);
 }
-static void inc_inflight_move_tail(struct sock *sk)
+static void inc_inflight_move_tail(struct unix_sock *u)
 {
-        struct unix_sock *u = unix_sk(sk);
        atomic_inc(&u->inflight);
        /*
         * If this is still a candidate, move it to the end of the