94 files changed, 2245 insertions, 1077 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index dd43a8289b0d..787ccddb85ea 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -117,9 +117,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                 }
         }
 
-        if (!clnt->trans_mod)
-                clnt->trans_mod = v9fs_get_default_trans();
-
         kfree(options);
         return ret;
 }
@@ -689,6 +686,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         if (err < 0)
                 goto error;
 
+        if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_default_trans();
+
         if (clnt->trans_mod == NULL) {
                 err = -EPROTONOSUPPORT;
                 P9_DPRINTK(P9_DEBUG_ERROR,
@@ -1098,7 +1098,6 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
 
         if (data) {
                 memmove(data, dataptr, count);
-                data += count;
         }
 
         if (udata) {
@@ -1192,9 +1191,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
 
         err = p9pdu_readf(req->rc, clnt->dotu, "wS", &ignored, ret);
         if (err) {
-                ret = ERR_PTR(err);
                 p9pdu_dump(1, req->rc);
-                goto free_and_error;
+                p9_free_req(clnt, req);
+                goto error;
         }
 
         P9_DPRINTK(P9_DEBUG_9P,
@@ -1211,8 +1210,6 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
         p9_free_req(clnt, req);
         return ret;
 
-free_and_error:
-        p9_free_req(clnt, req);
 error:
         kfree(ret);
         return ERR_PTR(err);
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index a2a1814c7a8d..8c2588e4edc0 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -735,12 +735,14 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                 if (!*p)
                         continue;
                 token = match_token(p, tokens, args);
-                r = match_int(&args[0], &option);
-                if (r < 0) {
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                         "integer field, but no integer?\n");
-                        ret = r;
-                        continue;
+                if (token != Opt_err) {
+                        r = match_int(&args[0], &option);
+                        if (r < 0) {
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                "integer field, but no integer?\n");
+                                ret = r;
+                                continue;
+                        }
                 }
                 switch (token) {
                 case Opt_port:
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 590b83963622..bfbe13786bb4 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -54,6 +54,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/if_arp.h>
+#include <linux/smp_lock.h>
 #include <linux/termios.h>      /* For TIOCOUTQ/INQ */
 #include <net/datalink.h>
 #include <net/psnap.h>
diff --git a/net/atm/common.c b/net/atm/common.c
index c1c97936192c..8c4d843eb17f 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -92,7 +92,7 @@ static void vcc_sock_destruct(struct sock *sk)
 static void vcc_def_wakeup(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up(sk->sk_sleep);
         read_unlock(&sk->sk_callback_lock);
 }
@@ -110,7 +110,7 @@ static void vcc_write_space(struct sock *sk)
         read_lock(&sk->sk_callback_lock);
 
         if (vcc_writable(sk)) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible(sk->sk_sleep);
 
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
@@ -594,7 +594,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct atm_vcc *vcc;
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         vcc = ATM_SD(sock);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..94b3388c188b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
 {
+        int ret;
+
         l2cap_load();
 
         hci_register_cb(&rfcomm_cb);
 
         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
         if (IS_ERR(rfcomm_thread)) {
-                hci_unregister_cb(&rfcomm_cb);
-                return PTR_ERR(rfcomm_thread);
+                ret = PTR_ERR(rfcomm_thread);
+                goto out_thread;
         }
 
         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                 BT_ERR("Failed to create RFCOMM info file");
 
-        rfcomm_init_sockets();
+        ret = rfcomm_init_ttys();
+        if (ret)
+                goto out_tty;
 
-#ifdef CONFIG_BT_RFCOMM_TTY
-        rfcomm_init_ttys();
-#endif
+        ret = rfcomm_init_sockets();
+        if (ret)
+                goto out_sock;
 
         BT_INFO("RFCOMM ver %s", VERSION);
 
         return 0;
+
+out_sock:
+        rfcomm_cleanup_ttys();
+out_tty:
+        kthread_stop(rfcomm_thread);
+out_thread:
+        hci_unregister_cb(&rfcomm_cb);
+
+        return ret;
 }
 
 static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
 
         kthread_stop(rfcomm_thread);
 
-#ifdef CONFIG_BT_RFCOMM_TTY
         rfcomm_cleanup_ttys();
-#endif
 
         rfcomm_cleanup_sockets();
 }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
         return err;
 }
 
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
 {
         class_remove_file(bt_class, &class_attr_rfcomm);
 
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 9aac5213105a..e1241c76239a 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -93,7 +93,7 @@ static void __exit br_deinit(void)
 
         unregister_pernet_subsys(&br_net_ops);
 
-        synchronize_net();
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
         br_netfilter_fini();
 #if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5c..eb404dc3ed6e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 err2:
         br_fdb_delete_by_port(br, p, 1);
 err1:
-        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 err0:
         dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 95d7f32643ae..72720c710351 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -75,6 +75,7 @@ static __initdata const char banner[] = KERN_INFO
 MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
+MODULE_ALIAS("can-proto-2");
 
 /* easy access to can_frame payload */
 static inline u64 GET_U64(const struct can_frame *cp)
@@ -1469,6 +1470,9 @@ static int bcm_release(struct socket *sock)
                 bo->ifindex = 0;
         }
 
+        sock_orphan(sk);
+        sock->sk = NULL;
+
         release_sock(sk);
         sock_put(sk);
 
diff --git a/net/can/raw.c b/net/can/raw.c
index 6aa154e806ae..f4cc44548bda 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -62,6 +62,7 @@ static __initdata const char banner[] =
 MODULE_DESCRIPTION("PF_CAN raw protocol");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>");
+MODULE_ALIAS("can-proto-1");
 
 #define MASK_ALL 0
 
@@ -306,6 +307,9 @@ static int raw_release(struct socket *sock)
         ro->bound   = 0;
         ro->count   = 0;
 
+        sock_orphan(sk);
+        sock->sk = NULL;
+
         release_sock(sk);
         sock_put(sk);
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 58abee1f1df1..b0fe69211eef 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -712,7 +712,7 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* exceptional events? */
diff --git a/net/core/dev.c b/net/core/dev.c
index 60b572812278..6a94475aee85 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2823,9 +2823,11 @@ static void net_rx_action(struct softirq_action *h)
                  * move the instance around on the list at-will.
                  */
                 if (unlikely(work == weight)) {
-                        if (unlikely(napi_disable_pending(n)))
-                                __napi_complete(n);
-                        else
+                        if (unlikely(napi_disable_pending(n))) {
+                                local_irq_enable();
+                                napi_complete(n);
+                                local_irq_disable();
+                        } else
                                 list_move_tail(&n->poll_list, list);
                 }
 
@@ -3863,10 +3865,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
 
         ASSERT_RTNL();
 
+        netif_addr_lock_bh(dev);
         err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
                             NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3887,10 +3891,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
 
         ASSERT_RTNL();
 
+        netif_addr_lock_bh(dev);
         err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
                             NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3947,7 +3953,8 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
  *      @from: source device
  *
  *      Add newly added addresses to the destination device and release
- *      addresses that have no users left.
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
  *
  *      This function is intended to be called from the dev->set_rx_mode
  *      function of layered software devices.
@@ -3956,14 +3963,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
         int err = 0;
 
-        ASSERT_RTNL();
-
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
+        netif_addr_lock_bh(to);
         err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
+        netif_addr_unlock_bh(to);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -3979,27 +3986,27 @@ EXPORT_SYMBOL(dev_unicast_sync);
  */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        ASSERT_RTNL();
-
         if (to->addr_len != from->addr_len)
                 return;
 
+        netif_addr_lock_bh(from);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
         __dev_set_rx_mode(to);
+        netif_addr_unlock(to);
+        netif_addr_unlock_bh(from);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 
 static void dev_unicast_flush(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
-
+        netif_addr_lock_bh(dev);
         __hw_addr_flush(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 
 static void dev_unicast_init(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
-
         __hw_addr_init(&dev->uc);
 }
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..197283072cc8 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -488,7 +488,7 @@ int net_assign_generic(struct net *net, int id, void *data)
          */
 
         ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 
         rcu_assign_pointer(net->gen, ng);
         call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9675f312830d..df30feb2fc72 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -740,7 +740,7 @@ int netpoll_setup(struct netpoll *np)
                                        np->name);
                                 break;
                         }
-                        cond_resched();
+                        msleep(1);
                 }
 
                 /* If carrier appears to come up instantly, we don't
diff --git a/net/core/sock.c b/net/core/sock.c
index b0ba569bc973..bbb25be7ddfe 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -631,7 +631,7 @@ set_rcvbuf:
 
         case SO_TIMESTAMPING:
                 if (val & ~SOF_TIMESTAMPING_MASK) {
-                        ret = EINVAL;
+                        ret = -EINVAL;
                         break;
                 }
                 sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE,
@@ -919,13 +919,19 @@ static inline void sock_lock_init(struct sock *sk)
                         af_family_keys + sk->sk_family);
 }
 
+/*
+ * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
+ * even temporarly, because of RCU lookups. sk_node should also be left as is.
+ */
 static void sock_copy(struct sock *nsk, const struct sock *osk)
 {
 #ifdef CONFIG_SECURITY_NETWORK
         void *sptr = nsk->sk_security;
 #endif
-
-        memcpy(nsk, osk, osk->sk_prot->obj_size);
+        BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
+                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
+        memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
+               osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
 #ifdef CONFIG_SECURITY_NETWORK
         nsk->sk_security = sptr;
         security_sk_clone(osk, nsk);
@@ -939,8 +945,23 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
         struct kmem_cache *slab;
 
         slab = prot->slab;
-        if (slab != NULL)
-                sk = kmem_cache_alloc(slab, priority);
+        if (slab != NULL) {
+                sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
+                if (!sk)
+                        return sk;
+                if (priority & __GFP_ZERO) {
+                        /*
+                         * caches using SLAB_DESTROY_BY_RCU should let
+                         * sk_node.next un-modified. Special care is taken
+                         * when initializing object to zero.
+                         */
+                        if (offsetof(struct sock, sk_node.next) != 0)
+                                memset(sk, 0, offsetof(struct sock, sk_node.next));
+                        memset(&sk->sk_node.pprev, 0,
+                               prot->obj_size - offsetof(struct sock,
+                                                         sk_node.pprev));
+                }
+        }
         else
                 sk = kmalloc(prot->obj_size, priority);
 
@@ -1125,6 +1146,11 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 
                 newsk->sk_err      = 0;
                 newsk->sk_priority = 0;
+                /*
+                 * Before updating sk_refcnt, we must commit prior changes to memory
+                 * (Documentation/RCU/rculist_nulls.txt for details)
+                 */
+                smp_wmb();
                 atomic_set(&newsk->sk_refcnt, 2);
 
                 /*
@@ -1715,7 +1741,7 @@ EXPORT_SYMBOL(sock_no_sendpage);
 static void sock_def_wakeup(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_all(sk->sk_sleep);
         read_unlock(&sk->sk_callback_lock);
 }
@@ -1723,7 +1749,7 @@ static void sock_def_wakeup(struct sock *sk)
 static void sock_def_error_report(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_poll(sk->sk_sleep, POLLERR);
         sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
         read_unlock(&sk->sk_callback_lock);
@@ -1732,7 +1758,7 @@ static void sock_def_error_report(struct sock *sk)
 static void sock_def_readable(struct sock *sk, int len)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
                                                 POLLRDNORM | POLLRDBAND);
         sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
@@ -1747,7 +1773,7 @@ static void sock_def_write_space(struct sock *sk)
          * progress.  --DaveM
          */
         if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible_sync_poll(sk->sk_sleep, POLLOUT |
                                                 POLLWRNORM | POLLWRBAND);
 
@@ -1840,6 +1866,11 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
+        /*
+         * Before updating sk_refcnt, we must commit prior changes to memory
+         * (Documentation/RCU/rculist_nulls.txt for details)
+         */
+        smp_wmb();
         atomic_set(&sk->sk_refcnt, 1);
         atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_drops, 0);
diff --git a/net/dccp/output.c b/net/dccp/output.c
index c0e88c16d088..c96119fda688 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -196,7 +196,7 @@ void dccp_write_space(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible(sk->sk_sleep);
         /* Should agree with poll, otherwise some programs break */
         if (sock_writeable(sk))
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 314a1b5c033c..3281013ce038 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -311,7 +311,7 @@ unsigned int dccp_poll(struct file *file, struct socket *sock,
         unsigned int mask;
         struct sock *sk = sock->sk;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         if (sk->sk_state == DCCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
@@ -1066,7 +1066,7 @@ static int __init dccp_init(void)
                        (dccp_hashinfo.ehash_size - 1))
                         dccp_hashinfo.ehash_size--;
                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
-                        __get_free_pages(GFP_ATOMIC, ehash_order);
+                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
 
         if (!dccp_hashinfo.ehash) {
@@ -1091,7 +1091,7 @@ static int __init dccp_init(void)
                     bhash_order > 0)
                         continue;
                 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
-                        __get_free_pages(GFP_ATOMIC, bhash_order);
+                        __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
         } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
 
         if (!dccp_hashinfo.bhash) {
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index d351b8db0df5..77d40289653c 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -2413,6 +2413,8 @@ static void __exit decnet_exit(void)
         proc_net_remove(&init_net, "decnet");
 
         proto_unregister(&dn_proto);
+
+        rcu_barrier_bh(); /* Wait for completion of call_rcu_bh()'s */
 }
 module_exit(decnet_exit);
 #endif
diff --git a/net/dsa/mv88e6xxx.c b/net/dsa/mv88e6xxx.c
index 4e4d8b5ad03d..efe661a9def4 100644
--- a/net/dsa/mv88e6xxx.c
+++ b/net/dsa/mv88e6xxx.c
@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct dsa_switch *ds)
         int i;
 
         for (i = 0; i < 10; i++) {
-                ret = REG_READ(REG_GLOBAL2, 0x1d);
+                ret = REG_READ(REG_GLOBAL, 0x1d);
                 if ((ret & 0x8000) == 0)
                         return 0;
         }
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 105ad10876af..27eda9fdf3c2 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -276,6 +276,9 @@ static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
         else
                 return NULL;
 
+        if (!dev)
+                return NULL;
+
         if (dev->type != ARPHRD_IEEE802154) {
                 dev_put(dev);
                 return NULL;
@@ -521,3 +524,6 @@ static void __exit ieee802154_nl_exit(void)
 }
 module_exit(ieee802154_nl_exit);
 
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ieee 802.15.4 configuration interface");
+
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 8a3881e28aca..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -801,11 +801,8 @@ static int arp_process(struct sk_buff *skb)
  *  cache.
  */
 
-        /*
-         *  Special case: IPv4 duplicate address detection packet (RFC2131)
-         *  and Gratuitous ARP/ARP Announce. (RFC3927, Section 2.4)
-         */
-        if (sip == 0 || tip == sip) {
+        /* Special case: IPv4 duplicate address detection packet (RFC2131) */
+        if (sip == 0) {
                 if (arp->ar_op == htons(ARPOP_REQUEST) &&
                     inet_addr_type(net, tip) == RTN_LOCAL &&
                     !arp_ignore(in_dev, sip, tip))
@@ -1307,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                 hbuffer[k++] = hex_asc_lo(n->ha[j]);
                 hbuffer[k++] = ':';
         }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
         }
 #endif
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 012cf5a68581..63c2fa7b68c4 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -316,8 +316,8 @@ static inline void check_tnode(const struct tnode *tn)
 
 static const int halve_threshold = 25;
 static const int inflate_threshold = 50;
-static const int halve_threshold_root = 8;
-static const int inflate_threshold_root = 15;
+static const int halve_threshold_root = 15;
+static const int inflate_threshold_root = 25;
 
 
 static void __alias_free_mem(struct rcu_head *head)
@@ -1021,6 +1021,9 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
                                       (struct node *)tn, wasfull);
 
                 tp = node_parent((struct node *) tn);
+                if (!tp)
+                        rcu_assign_pointer(t->trie, (struct node *)tn);
+
                 tnode_free_flush();
                 if (!tp)
                         break;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 44e2a3d2359a..cb4a0f4bd5e5 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -735,10 +735,10 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         tos = tiph->tos;
-        if (tos&1) {
+        if (tos == 1) {
+                tos = 0;
                 if (skb->protocol == htons(ETH_P_IP))
                         tos = old_iph->tos;
-                tos &= ~1;
         }
 
         {
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 490ce20faf38..db46b4b5b2b9 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -440,6 +440,9 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         /* Remove any debris in the socket control block */
         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 
+        /* Must drop socket now because of tproxy. */
+        skb_orphan(skb);
+
         return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL,
                        ip_rcv_finish);
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 247026282669..7d0821054729 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1243,7 +1243,6 @@ int ip_push_pending_frames(struct sock *sk)
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
                 skb->truesize += tmp_skb->truesize;
-                __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
         }
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 155c008626c8..09172a65d9b6 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -191,7 +191,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                                     ct, ctinfo);
                 /* Tell TCP window tracking about seq change */
                 nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo));
+                                        ct, CTINFO2DIR(ctinfo),
+                                        (int)rep_len - (int)match_len);
 
                 nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
         }
@@ -377,6 +378,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         struct tcphdr *tcph;
         int dir;
         __be32 newseq, newack;
+        s16 seqoff, ackoff;
         struct nf_conn_nat *nat = nfct_nat(ct);
         struct nf_nat_seq *this_way, *other_way;
 
@@ -390,15 +392,18 @@ nf_nat_seq_adjust(struct sk_buff *skb,
 
         tcph = (void *)skb->data + ip_hdrlen(skb);
         if (after(ntohl(tcph->seq), this_way->correction_pos))
-                newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
+                seqoff = this_way->offset_after;
         else
-                newseq = htonl(ntohl(tcph->seq) + this_way->offset_before);
+                seqoff = this_way->offset_before;
 
         if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
                   other_way->correction_pos))
-                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after);
+                ackoff = other_way->offset_after;
         else
-                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
+                ackoff = other_way->offset_before;
+
+        newseq = htonl(ntohl(tcph->seq) + seqoff);
+        newack = htonl(ntohl(tcph->ack_seq) - ackoff);
 
         inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
         inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
@@ -413,7 +418,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
                 return 0;
 
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir);
+        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
 
         return 1;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 17b89c523f9d..91145244ea63 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -339,7 +339,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sock *sk = sock->sk;
         struct tcp_sock *tp = tcp_sk(sk);
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         if (sk->sk_state == TCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
@@ -903,13 +903,17 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 iov++;
 
                 while (seglen > 0) {
-                        int copy;
+                        int copy = 0;
+                        int max = size_goal;
 
                         skb = tcp_write_queue_tail(sk);
+                        if (tcp_send_head(sk)) {
+                                if (skb->ip_summed == CHECKSUM_NONE)
+                                        max = mss_now;
+                                copy = max - skb->len;
+                        }
 
-                        if (!tcp_send_head(sk) ||
-                            (copy = size_goal - skb->len) <= 0) {
-
+                        if (copy <= 0) {
 new_segment:
                                 /* Allocate new segment. If the interface is SG,
                                  * allocate skb fitting to single page.
@@ -930,6 +934,7 @@ new_segment:
 
                                 skb_entail(sk, skb);
                                 copy = size_goal;
+                                max = size_goal;
                         }
 
                         /* Try to append data to the end of skb. */
@@ -1028,7 +1033,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len < size_goal || (flags & MSG_OOB))
+                        if (skb->len < max || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a1ca2698c88..6d88219c5e22 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1160,6 +1160,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
 #endif
 
@@ -1373,7 +1374,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 43bbba7926ee..f8d67ccc64f3 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -128,7 +128,8 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                         goto kill_with_rst;
 
                 /* Dup ACK? */
-                if (!after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
+                if (!th->ack ||
+                    !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
                     TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
                         inet_twsk_put(tw);
                         return TCP_TW_SUCCESS;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 416fc4c2e7eb..bd62712848fa 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -725,7 +725,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk)) {
+        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+            skb->ip_summed == CHECKSUM_NONE) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
@@ -2260,7 +2261,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
         if (md5) {
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                tcp_rsk(req)->af_specific->calc_md5_hash(md5_hash_location,
                                                md5, NULL, req, skb);
         }
 #endif
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c96a4f..0071ee6f441f 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
+                        if (xprth + 4 < skb->data ||
+                            pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                 __be16 *ports = (__be16 *)xprth;
 
                                 fl->fl_ip_sport = ports[!!reverse];
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8c1e86afbbf5..43b3c9f89c12 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1916,8 +1916,32 @@ ok:
                                         update_lft = 1;
                                 else if (stored_lft <= MIN_VALID_LIFETIME) {
                                         /* valid_lft <= stored_lft is always true */
-                                        /* XXX: IPsec */
-                                        update_lft = 0;
+                                        /*
+                                         * RFC 4862 Section 5.5.3e:
+                                         * "Note that the preferred lifetime of
+                                         *  the corresponding address is always
+                                         *  reset to the Preferred Lifetime in
+                                         *  the received Prefix Information
+                                         *  option, regardless of whether the
+                                         *  valid lifetime is also reset or
+                                         *  ignored."
+                                         *
+                                         *  So if the preferred lifetime in
+                                         *  this advertisement is different
+                                         *  than what we have stored, but the
+                                         *  valid lifetime is invalid, just
+                                         *  reset prefered_lft.
+                                         *
+                                         *  We must set the valid lifetime
+                                         *  to the stored lifetime since we'll
+                                         *  be updating the timestamp below,
+                                         *  else we'll set it back to the
+                                         *  minumum.
+                                         */
+                                        if (prefered_lft != ifp->prefered_lft) {
+                                                valid_lft = stored_lft;
+                                                update_lft = 1;
+                                        }
                                 } else {
                                         valid_lft = MIN_VALID_LIFETIME;
                                         if (valid_lft < prefered_lft)
@@ -3085,7 +3109,7 @@ restart:
                                 spin_unlock(&ifp->lock);
                                 continue;
                         } else if (age >= ifp->prefered_lft) {
-                                /* jiffies - ifp->tsamp > age >= ifp->prefered_lft */
+                                /* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
                                 int deprecate = 0;
 
                                 if (!(ifp->flags&IFA_F_DEPRECATED)) {
@@ -3362,7 +3386,10 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
                 valid = ifa->valid_lft;
                 if (preferred != INFINITY_LIFE_TIME) {
                         long tval = (jiffies - ifa->tstamp)/HZ;
-                        preferred -= tval;
+                        if (preferred > tval)
+                                preferred -= tval;
+                        else
+                                preferred = 0;
                         if (valid != INFINITY_LIFE_TIME)
                                 valid -= tval;
                 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 85b3d0036afd..caa0278d30a9 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -1284,6 +1284,8 @@ static void __exit inet6_exit(void)
         proto_unregister(&udplitev6_prot);
         proto_unregister(&udpv6_prot);
         proto_unregister(&tcpv6_prot);
+
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 module_exit(inet6_exit);
 
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index c3a07d75b5f5..6d6a4277c677 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -139,6 +139,9 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         rcu_read_unlock();
 
+        /* Must drop socket now because of tproxy. */
+        skb_orphan(skb);
+
         return NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, dev, NULL,
                        ip6_rcv_finish);
 err:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7c76e3d18215..87f8419a68fd 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1484,7 +1484,6 @@ int ip6_push_pending_frames(struct sock *sk)
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
                 skb->truesize += tmp_skb->truesize;
-                __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
         }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 68e52308e552..98b7327d0949 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1018,6 +1018,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr);
         dev->flags              = IFF_NOARP;
+        dev->priv_flags        &= ~IFF_XMIT_DST_RELEASE;
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_NETNS_LOCAL;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 58810c65b635..d849dd53b788 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -896,6 +896,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 };
 #endif
 
@@ -1441,7 +1442,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
+                        tcp_v6_md5_do_add(newsk, &newnp->daddr,
                                           newkey, key->keylen);
         }
 #endif
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b4b16a43f277..3a3c677bc0f2 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
 
-        while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
+        while (nh + offset + 1 < skb->data ||
+               pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
                 nh = skb_network_header(skb);
                 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
 
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
+                        if (!onlyproto && (nh + offset + 4 < skb->data ||
+                             pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
                                 __be16 *ports = (__be16 *)exthdr;
 
                                 fl->fl_ip_sport = ports[!!reverse];
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 417b0e309495..f1118d92a191 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -41,6 +41,7 @@
 #include <linux/netdevice.h>
 #include <linux/uio.h>
 #include <linux/skbuff.h>
+#include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/string.h>
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index cb762c8723ea..80cf29aae096 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -45,6 +45,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/smp_lock.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/init.h>
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index bccf4d0059f0..b001c361ad30 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -241,7 +241,6 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/smp_lock.h>
 #include <linux/skbuff.h>
 #include <linux/tty.h>
 #include <linux/proc_fs.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 6d8ae03c14f5..68cbcb19cbd8 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -13,6 +13,7 @@
  *      2) as a control channel (write commands, read events)
  */
 
+#include <linux/smp_lock.h>
 #include "irnet_ppp.h"          /* Private header */
 /* Please put other headers in irnet.h - Thanks */
 
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717cb..9cb79f95bf63 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
         }
         /* Dup */
         memcpy(new, orig, sizeof(struct tsap_cb));
+        spin_lock_init(&new->lock);
 
         /* We don't need the old instance any more */
         spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 6be5f92d1094..49c15b48408e 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -306,7 +306,7 @@ static inline int iucv_below_msglim(struct sock *sk)
 static void iucv_sock_wake_msglim(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+        if (sk_has_sleeper(sk))
                 wake_up_interruptible_all(sk->sk_sleep);
         sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         read_unlock(&sk->sk_callback_lock);
@@ -1256,7 +1256,7 @@ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         unsigned int mask = 0;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
 
         if (sk->sk_state == IUCV_LISTEN)
                 return iucv_accept_poll(sk);
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c73..7836ee928983 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
+        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
          The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index fc712e60705d..11cf45bce38a 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -494,7 +494,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
          * should it be using the interface and enqueuing
          * frames at this very time on another CPU.
          */
-        synchronize_rcu();
+        rcu_barrier(); /* Wait for RX path and call_rcu()'s */
         skb_queue_purge(&sdata->u.mesh.skb_queue);
 }
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 003cb470ac84..f49ef288e2e2 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -637,7 +637,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_preq_queue *preq_node;
 
-        preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_KERNEL);
+        preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
         if (!preq_node) {
                 printk(KERN_DEBUG "Mesh HWMP: could not allocate PREQ node\n");
                 return;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45a..479597e88583 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
+
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
 
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
  * @skb: frame to discard
  * @sdata: network subif the frame was to be sent through
  *
- * If the frame was beign forwarded from another MP, a PERR frame will be sent
- * to the precursor.
+ * If the frame was being forwarded from another MP, a PERR frame will be sent
+ * to the precursor.  The precursor's address (i.e. the previous hop) was saved
+ * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
+ * the destination is successfully resolved.
  *
  * Locking: the function must me called within a rcu_read_lock region
  */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 u8 *ra, *da;
 
                 da = hdr->addr3;
-                ra = hdr->addr2;
+                ra = hdr->addr1;
                 mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
                         dsn = ++mpath->dsn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
         struct ieee80211_local *local = (void *) data;
 
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                 return;
 
         queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         rcu_read_unlock();
 
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
-
         /* remove STAs */
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                 drv_remove_interface(local, &conf);
         }
 
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
+
         local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
         local->quiescing = false;
 
         return 0;
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index b218b98fba7f..37771abd8f5a 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -66,7 +66,7 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
         for (i = rix; i >= 0; i--)
                 if (mi->r[i].rix == rix)
                         break;
-        WARN_ON(mi->r[i].rix != rix);
+        WARN_ON(i < 0);
         return i;
 }
 
@@ -181,6 +181,9 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
                         break;
 
                 ndx = rix_to_ndx(mi, ar[i].idx);
+                if (ndx < 0)
+                        continue;
+
                 mi->r[ndx].attempts += ar[i].count;
 
                 if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
+
         if (status->flag & RX_FLAG_HT) {
                 /* rate_idx is MCS index */
                 if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a09..3a8922cd1038 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 monitor_iface = UNKNOWN_ADDRESS;
 
                 len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
                 /* check the header is complete in the frame */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7508f11c5b39..b5869b9574b0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -561,23 +561,38 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
                 }
         }
 
-        ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
+        /*
+         * Do not use kmem_cache_zalloc(), as this cache uses
+         * SLAB_DESTROY_BY_RCU.
+         */
+        ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
         if (ct == NULL) {
                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                 atomic_dec(&net->ct.count);
                 return ERR_PTR(-ENOMEM);
         }
-
+        /*
+         * Let ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.next
+         * and ct->tuplehash[IP_CT_DIR_REPLY].hnnode.next unchanged.
+         */
+        memset(&ct->tuplehash[IP_CT_DIR_MAX], 0,
+               sizeof(*ct) - offsetof(struct nf_conn, tuplehash[IP_CT_DIR_MAX]));
         spin_lock_init(&ct->lock);
-        atomic_set(&ct->ct_general.use, 1);
         ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
+        ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.pprev = NULL;
         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
+        ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev = NULL;
         /* Don't set timer yet: wait for confirmation */
         setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
 #ifdef CONFIG_NET_NS
         ct->ct_net = net;
 #endif
 
+        /*
+         * changes to lookup keys must be done before setting refcnt to 1
+         */
+        smp_wmb();
+        atomic_set(&ct->ct_general.use, 1);
         return ct;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index afde8f991646..2032dfe25ca8 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -617,8 +617,10 @@ err1:
 void nf_conntrack_expect_fini(struct net *net)
 {
         exp_proc_remove(net);
-        if (net_eq(net, &init_net))
+        if (net_eq(net, &init_net)) {
+                rcu_barrier(); /* Wait for call_rcu() before destroy */
                 kmem_cache_destroy(nf_ct_expect_cachep);
+        }
         nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
                              nf_ct_expect_hsize);
 }
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 4b2c769d555f..fef95be334bd 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -186,6 +186,6 @@ void nf_ct_extend_unregister(struct nf_ct_ext_type *type)
         rcu_assign_pointer(nf_ct_ext_types[type->id], NULL);
         update_alloc_size(type);
         mutex_unlock(&nf_ct_ext_type_mutex);
-        synchronize_rcu();
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 EXPORT_SYMBOL_GPL(nf_ct_extend_unregister);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 33fc0a443f3d..97a82ba75376 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -720,8 +720,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 /* Caller must linearize skb at tcp header. */
 void nf_conntrack_tcp_update(const struct sk_buff *skb,
                              unsigned int dataoff,
-                             struct nf_conn *ct,
-                             int dir)
+                             struct nf_conn *ct, int dir,
+                             s16 offset)
 {
         const struct tcphdr *tcph = (const void *)skb->data + dataoff;
         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
@@ -734,7 +734,7 @@ void nf_conntrack_tcp_update(const struct sk_buff *skb,
         /*
          * We have to worry for the ack in the reply packet only...
          */
-        if (after(end, ct->proto.tcp.seen[dir].td_end))
+        if (ct->proto.tcp.seen[dir].td_end + offset == end)
                 ct->proto.tcp.seen[dir].td_end = end;
         ct->proto.tcp.last_end = end;
         spin_unlock_bh(&ct->lock);
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 0b7139f3dd78..fc581800698e 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -129,7 +129,7 @@ conntrack_addrcmp(const union nf_inet_addr *kaddr,
 
 static inline bool
 conntrack_mt_origsrc(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
@@ -138,7 +138,7 @@ conntrack_mt_origsrc(const struct nf_conn *ct,
 
 static inline bool
 conntrack_mt_origdst(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
@@ -147,7 +147,7 @@ conntrack_mt_origdst(const struct nf_conn *ct,
 
 static inline bool
 conntrack_mt_replsrc(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
@@ -156,7 +156,7 @@ conntrack_mt_replsrc(const struct nf_conn *ct,
 
 static inline bool
 conntrack_mt_repldst(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
@@ -164,7 +164,7 @@ conntrack_mt_repldst(const struct nf_conn *ct,
 }
 
 static inline bool
-ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
+ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
                     const struct nf_conn *ct)
 {
         const struct nf_conntrack_tuple *tuple;
@@ -204,7 +204,7 @@ ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
 static bool
 conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
+        const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
         enum ip_conntrack_info ctinfo;
         const struct nf_conn *ct;
         unsigned int statebit;
@@ -278,6 +278,16 @@ conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
         return true;
 }
 
+static bool
+conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+        const struct xt_conntrack_mtinfo2 *const *info = par->matchinfo;
+        struct xt_match_param newpar = *par;
+
+        newpar.matchinfo = *info;
+        return conntrack_mt(skb, &newpar);
+}
+
 static bool conntrack_mt_check(const struct xt_mtchk_param *par)
 {
         if (nf_ct_l3proto_try_module_get(par->family) < 0) {
@@ -288,11 +298,45 @@ static bool conntrack_mt_check(const struct xt_mtchk_param *par)
         return true;
 }
 
+static bool conntrack_mt_check_v1(const struct xt_mtchk_param *par)
+{
+        struct xt_conntrack_mtinfo1 *info = par->matchinfo;
+        struct xt_conntrack_mtinfo2 *up;
+        int ret = conntrack_mt_check(par);
+
+        if (ret < 0)
+                return ret;
+
+        up = kmalloc(sizeof(*up), GFP_KERNEL);
+        if (up == NULL) {
+                nf_ct_l3proto_module_put(par->family);
+                return -ENOMEM;
+        }
+
+        /*
+         * The strategy here is to minimize the overhead of v1 matching,
+         * by prebuilding a v2 struct and putting the pointer into the
+         * v1 dataspace.
+         */
+        memcpy(up, info, offsetof(typeof(*info), state_mask));
+        up->state_mask  = info->state_mask;
+        up->status_mask = info->status_mask;
+        *(void **)info  = up;
+        return true;
+}
+
 static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
 {
         nf_ct_l3proto_module_put(par->family);
 }
 
+static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par)
+{
+        struct xt_conntrack_mtinfo2 **info = par->matchinfo;
+        kfree(*info);
+        conntrack_mt_destroy(par);
+}
+
 #ifdef CONFIG_COMPAT
 struct compat_xt_conntrack_info
 {
@@ -363,6 +407,16 @@ static struct xt_match conntrack_mt_reg[] __read_mostly = {
                 .revision   = 1,
                 .family     = NFPROTO_UNSPEC,
                 .matchsize  = sizeof(struct xt_conntrack_mtinfo1),
+                .match      = conntrack_mt_v1,
+                .checkentry = conntrack_mt_check_v1,
+                .destroy    = conntrack_mt_destroy_v1,
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "conntrack",
+                .revision   = 2,
+                .family     = NFPROTO_UNSPEC,
+                .matchsize  = sizeof(struct xt_conntrack_mtinfo2),
                 .match      = conntrack_mt,
                 .checkentry = conntrack_mt_check,
                 .destroy    = conntrack_mt_destroy,
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 863e40977a4d..0f482e2440b4 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -330,7 +330,8 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
                         fcount++;
 
                         if (info->flags & XT_OSF_LOG)
-                                nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL,
+                                nf_log_packet(p->family, p->hooknum, skb,
+                                        p->in, p->out, NULL,
                                         "%s [%s:%s] : %pi4:%d -> %pi4:%d hops=%d\n",
                                         f->genre, f->version, f->subtype,
                                         &ip->saddr, ntohs(tcp->source),
@@ -345,7 +346,7 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
         rcu_read_unlock();
 
         if (!fcount && (info->flags & XT_OSF_LOG))
-                nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL,
+                nf_log_packet(p->family, p->hooknum, skb, p->in, p->out, NULL,
                         "Remote OS is not known: %pi4:%u -> %pi4:%u\n",
                                 &ip->saddr, ntohs(tcp->source),
                                 &ip->daddr, ntohs(tcp->dest));
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b0e582f2d37a..16e6c4378ff1 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         addr6 = addr;
                         mask6 = mask;
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
-                        if (map4 == NULL)
+                        if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
                         map6->type = NETLBL_NLTYPE_UNLABELED;
                         ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 80a322d77909..b0d6ddd82a9d 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -69,10 +69,27 @@ static struct phonet_device *__phonet_get(struct net_device *dev)
         return NULL;
 }
 
-static void __phonet_device_free(struct phonet_device *pnd)
+static void phonet_device_destroy(struct net_device *dev)
 {
-        list_del(&pnd->list);
-        kfree(pnd);
+        struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
+        struct phonet_device *pnd;
+
+        ASSERT_RTNL();
+
+        spin_lock_bh(&pndevs->lock);
+        pnd = __phonet_get(dev);
+        if (pnd)
+                list_del(&pnd->list);
+        spin_unlock_bh(&pndevs->lock);
+
+        if (pnd) {
+                u8 addr;
+
+                for (addr = find_first_bit(pnd->addrs, 64); addr < 64;
+                        addr = find_next_bit(pnd->addrs, 64, 1+addr))
+                        phonet_address_notify(RTM_DELADDR, dev, addr);
+                kfree(pnd);
+        }
 }
 
 struct net_device *phonet_device_get(struct net *net)
@@ -126,8 +143,10 @@ int phonet_address_del(struct net_device *dev, u8 addr)
         pnd = __phonet_get(dev);
         if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
                 err = -EADDRNOTAVAIL;
-        else if (bitmap_empty(pnd->addrs, 64))
-                __phonet_device_free(pnd);
+        else if (bitmap_empty(pnd->addrs, 64)) {
+                list_del(&pnd->list);
+                kfree(pnd);
+        }
         spin_unlock_bh(&pndevs->lock);
         return err;
 }
@@ -181,18 +200,8 @@ static int phonet_device_notify(struct notifier_block *me, unsigned long what,
 {
         struct net_device *dev = arg;
 
-        if (what == NETDEV_UNREGISTER) {
-                struct phonet_device_list *pndevs;
-                struct phonet_device *pnd;
-
-                /* Destroy phonet-specific device data */
-                pndevs = phonet_device_list(dev_net(dev));
-                spin_lock_bh(&pndevs->lock);
-                pnd = __phonet_get(dev);
-                if (pnd)
-                        __phonet_device_free(pnd);
-                spin_unlock_bh(&pndevs->lock);
-        }
+        if (what == NETDEV_UNREGISTER)
+                phonet_device_destroy(dev);
         return 0;
 
 }
@@ -218,11 +227,12 @@ static int phonet_init_net(struct net *net)
 static void phonet_exit_net(struct net *net)
 {
         struct phonet_net *pnn = net_generic(net, phonet_net_id);
-        struct phonet_device *pnd, *n;
-
-        list_for_each_entry_safe(pnd, n, &pnn->pndevs.list, list)
-                __phonet_device_free(pnd);
+        struct net_device *dev;
 
+        rtnl_lock();
+        for_each_netdev(net, dev)
+                phonet_device_destroy(dev);
+        rtnl_unlock();
         kfree(pnn);
 }
 
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index cec4e5951681..f8b4cee434c2 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -32,7 +32,7 @@
 static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
                      u32 pid, u32 seq, int event);
 
-static void rtmsg_notify(int event, struct net_device *dev, u8 addr)
+void phonet_address_notify(int event, struct net_device *dev, u8 addr)
 {
         struct sk_buff *skb;
         int err = -ENOBUFS;
@@ -94,7 +94,7 @@ static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *attr)
         else
                 err = phonet_address_del(dev, pnaddr);
         if (!err)
-                rtmsg_notify(nlh->nlmsg_type, dev, pnaddr);
+                phonet_address_notify(nlh->nlmsg_type, dev, pnaddr);
         return err;
 }
 
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001e..2fc4a1724eb8 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -549,6 +549,10 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
         swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
         hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
         __rfkill_set_sw_state(rfkill, sw);
+        if (hw)
+                rfkill->state |= RFKILL_BLOCK_HW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_HW;
 
         spin_unlock_irqrestore(&rfkill->lock, flags);
 
@@ -648,15 +652,26 @@ static ssize_t rfkill_state_store(struct device *dev,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        /*
-         * The intention was that userspace can only take control over
-         * a given device when/if rfkill-input doesn't control it due
-         * to user_claim. Since user_claim is currently unsupported,
-         * we never support changing the state from userspace -- this
-         * can be implemented again later.
-         */
+        struct rfkill *rfkill = to_rfkill(dev);
+        unsigned long state;
+        int err;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        err = strict_strtoul(buf, 0, &state);
+        if (err)
+                return err;
+
+        if (state != RFKILL_USER_STATE_SOFT_BLOCKED &&
+            state != RFKILL_USER_STATE_UNBLOCKED)
+                return -EINVAL;
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_set_block(rfkill, state == RFKILL_USER_STATE_SOFT_BLOCKED);
+        mutex_unlock(&rfkill_global_mutex);
 
-        return -EPERM;
+        return err ?: count;
 }
 
 static ssize_t rfkill_claim_show(struct device *dev,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869ed..f0a76f6bca71 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
 /*
  *      Convert a ROSE address into text.
  */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-        static char buffer[11];
-
         if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
             addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
             addr->rose_addr[4] == 0x00) {
-                strcpy(buffer, "*");
+                strcpy(buf, "*");
         } else {
-                sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+                sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                 addr->rose_addr[1] & 0xFF,
                                                 addr->rose_addr[2] & 0xFF,
                                                 addr->rose_addr[3] & 0xFF,
                                                 addr->rose_addr[4] & 0xFF);
         }
 
-        return buffer;
+        return buf;
 }
 
 /*
@@ -1437,7 +1435,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
 
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1455,8 +1453,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                         devname = dev->name;
 
                 seq_printf(seq, "%-10s %-9s ",
-                        rose2asc(&rose->dest_addr),
-                        ax2asc(buf, &rose->dest_call));
+                           rose2asc(rsbuf, &rose->dest_addr),
+                           ax2asc(buf, &rose->dest_call));
 
                 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                         callsign = "??????-?";
@@ -1465,7 +1463,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq,
                            "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                        rose2asc(&rose->source_addr),
+                        rose2asc(rsbuf, &rose->source_addr),
                         callsign,
                         devname,
                         rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010a..9478d9b3d977 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
 
 static int rose_node_show(struct seq_file *seq, void *v)
 {
+        char rsbuf[11];
         int i;
 
         if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
                 const struct rose_node *rose_node = v;
                 /* if (rose_node->loopback) {
                         seq_printf(seq, "%-10s %04d 1 loopback\n",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask);
                 } else { */
                         seq_printf(seq, "%-10s %04d %d",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask,
-                                rose_node->count);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask,
+                                   rose_node->count);
 
                         for (i = 0; i < rose_node->count; i++)
                                 seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
 
 static int rose_route_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d      ",
                                    rose_route->lci1,
-                                   rose2asc(&rose_route->src_addr),
+                                   rose2asc(rsbuf, &rose_route->src_addr),
                                    ax2asc(buf, &rose_route->src_call),
                                    rose_route->neigh1->number);
                 else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
                 if (rose_route->neigh2)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d\n",
-                                rose_route->lci2,
-                                rose2asc(&rose_route->dest_addr),
-                                ax2asc(buf, &rose_route->dest_call),
-                                rose_route->neigh2->number);
+                                   rose_route->lci2,
+                                   rose2asc(rsbuf, &rose_route->dest_addr),
+                                   ax2asc(buf, &rose_route->dest_call),
+                                   rose_route->neigh2->number);
                  else
                          seq_puts(seq,
                                   "000  *           *          00000\n");
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index eac5e7bb7365..bfe493ebf27c 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -63,7 +63,7 @@ static void rxrpc_write_space(struct sock *sk)
         _enter("%p", sk);
         read_lock(&sk->sk_callback_lock);
         if (rxrpc_writable(sk)) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible(sk->sk_sleep);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
@@ -588,7 +588,7 @@ static unsigned int rxrpc_poll(struct file *file, struct socket *sock,
         unsigned int mask;
         struct sock *sk = sock->sk;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* the socket is readable if there are any messages waiting on the Rx
diff --git a/net/sctp/output.c b/net/sctp/output.c
index b76411444515..b94c21190566 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -407,7 +407,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         }
         dst = dst_clone(tp->dst);
         skb_dst_set(nskb, dst);
-        if (dst)
+        if (!dst)
                 goto no_route;
 
         /* Build the SCTP header.  */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 35ba035970a2..971890dbfea0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6652,21 +6652,6 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
         finish_wait(sk->sk_sleep, &wait);
 }
 
-static void sctp_sock_rfree_frag(struct sk_buff *skb)
-{
-        struct sk_buff *frag;
-
-        if (!skb->data_len)
-                goto done;
-
-        /* Don't forget the fragments. */
-        skb_walk_frags(skb, frag)
-                sctp_sock_rfree_frag(frag);
-
-done:
-        sctp_sock_rfree(skb);
-}
-
 static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
 {
         struct sk_buff *frag;
@@ -6776,7 +6761,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
                 event = sctp_skb2event(skb);
                 if (event->asoc == assoc) {
-                        sctp_sock_rfree_frag(skb);
                         __skb_unlink(skb, &oldsk->sk_receive_queue);
                         __skb_queue_tail(&newsk->sk_receive_queue, skb);
                         sctp_skb_set_owner_r_frag(skb, newsk);
@@ -6807,7 +6791,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
                         event = sctp_skb2event(skb);
                         if (event->asoc == assoc) {
-                                sctp_sock_rfree_frag(skb);
                                 __skb_unlink(skb, &oldsp->pd_lobby);
                                 __skb_queue_tail(queue, skb);
                                 sctp_skb_set_owner_r_frag(skb, newsk);
@@ -6822,15 +6805,11 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 
         }
 
-        sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp) {
-                sctp_sock_rfree_frag(skb);
+        sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
                 sctp_skb_set_owner_r_frag(skb, newsk);
-        }
 
-        sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp) {
-                sctp_sock_rfree_frag(skb);
+        sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
                 sctp_skb_set_owner_r_frag(skb, newsk);
-        }
 
         /* Set the type of socket to indicate that it is peeled off from the
          * original UDP-style socket or created with the accept() call on a
diff --git a/net/socket.c b/net/socket.c
index 791d71a36a93..6d4716559047 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
         if (more)
                 flags |= MSG_MORE;
 
-        return sock->ops->sendpage(sock, page, offset, size, flags);
+        return kernel_sendpage(sock, page, offset, size, flags);
 }
 
 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
diff --git a/net/sunrpc/Makefile b/net/sunrpc/Makefile
index db73fd2a3f0e..9d2fca5ad14a 100644
--- a/net/sunrpc/Makefile
+++ b/net/sunrpc/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_SUNRPC_XPRT_RDMA) += xprtrdma/
 sunrpc-y := clnt.o xprt.o socklib.o xprtsock.o sched.o \
             auth.o auth_null.o auth_unix.o auth_generic.o \
             svc.o svcsock.o svcauth.o svcauth_unix.o \
-            rpcb_clnt.o timer.o xdr.o \
+            addr.o rpcb_clnt.o timer.o xdr.o \
             sunrpc_syms.o cache.o rpc_pipe.o \
             svc_xprt.o
 sunrpc-$(CONFIG_NFS_V4_1) += backchannel_rqst.o bc_svc.o
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
new file mode 100644
index 000000000000..22e8fd89477f
--- /dev/null
+++ b/net/sunrpc/addr.c
@@ -0,0 +1,364 @@
+/*
+ * Copyright 2009, Oracle.  All rights reserved.
+ *
+ * Convert socket addresses to presentation addresses and universal
+ * addresses, and vice versa.
+ *
+ * Universal addresses are introduced by RFC 1833 and further refined by
+ * recent RFCs describing NFSv4.  The universal address format is part
+ * of the external (network) interface provided by rpcbind version 3
+ * and 4, and by NFSv4.  Such an address is a string containing a
+ * presentation format IP address followed by a port number in
+ * "hibyte.lobyte" format.
+ *
+ * IPv6 addresses can also include a scope ID, typically denoted by
+ * a '%' followed by a device name or a non-negative integer.  Refer to
+ * RFC 4291, Section 2.2 for details on IPv6 presentation formats.
+ */
+
+#include <net/ipv6.h>
+#include <linux/sunrpc/clnt.h>
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+
+static size_t rpc_ntop6_noscopeid(const struct sockaddr *sap,
+                                  char *buf, const int buflen)
+{
+        const struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sap;
+        const struct in6_addr *addr = &sin6->sin6_addr;
+
+        /*
+         * RFC 4291, Section 2.2.2
+         *
+         * Shorthanded ANY address
+         */
+        if (ipv6_addr_any(addr))
+                return snprintf(buf, buflen, "::");
+
+        /*
+         * RFC 4291, Section 2.2.2
+         *
+         * Shorthanded loopback address
+         */
+        if (ipv6_addr_loopback(addr))
+                return snprintf(buf, buflen, "::1");
+
+        /*
+         * RFC 4291, Section 2.2.3
+         *
+         * Special presentation address format for mapped v4
+         * addresses.
+         */
+        if (ipv6_addr_v4mapped(addr))
+                return snprintf(buf, buflen, "::ffff:%pI4",
+                                        &addr->s6_addr32[3]);
+
+        /*
+         * RFC 4291, Section 2.2.1
+         *
+         * To keep the result as short as possible, especially
+         * since we don't shorthand, we don't want leading zeros
+         * in each halfword, so avoid %pI6.
+         */
+        return snprintf(buf, buflen, "%x:%x:%x:%x:%x:%x:%x:%x",
+                ntohs(addr->s6_addr16[0]), ntohs(addr->s6_addr16[1]),
+                ntohs(addr->s6_addr16[2]), ntohs(addr->s6_addr16[3]),
+                ntohs(addr->s6_addr16[4]), ntohs(addr->s6_addr16[5]),
+                ntohs(addr->s6_addr16[6]), ntohs(addr->s6_addr16[7]));
+}
+
+static size_t rpc_ntop6(const struct sockaddr *sap,
+                        char *buf, const size_t buflen)
+{
+        const struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sap;
+        char scopebuf[IPV6_SCOPE_ID_LEN];
+        size_t len;
+        int rc;
+
+        len = rpc_ntop6_noscopeid(sap, buf, buflen);
+        if (unlikely(len == 0))
+                return len;
+
+        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
+            !(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_SITELOCAL))
+                return len;
+
+        rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u",
+                        IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id);
+        if (unlikely((size_t)rc > sizeof(scopebuf)))
+                return 0;
+
+        len += rc;
+        if (unlikely(len > buflen))
+                return 0;
+
+        strcat(buf, scopebuf);
+        return len;
+}
+
+#else   /* !(defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)) */
+
+static size_t rpc_ntop6_noscopeid(const struct sockaddr *sap,
+                                  char *buf, const int buflen)
+{
+        return 0;
+}
+
+static size_t rpc_ntop6(const struct sockaddr *sap,
+                        char *buf, const size_t buflen)
+{
+        return 0;
+}
+
+#endif  /* !(defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)) */
+
+static int rpc_ntop4(const struct sockaddr *sap,
+                     char *buf, const size_t buflen)
+{
+        const struct sockaddr_in *sin = (struct sockaddr_in *)sap;
+
+        return snprintf(buf, buflen, "%pI4", &sin->sin_addr);
+}
+
+/**
+ * rpc_ntop - construct a presentation address in @buf
+ * @sap: socket address
+ * @buf: construction area
+ * @buflen: size of @buf, in bytes
+ *
+ * Plants a %NUL-terminated string in @buf and returns the length
+ * of the string, excluding the %NUL.  Otherwise zero is returned.
+ */
+size_t rpc_ntop(const struct sockaddr *sap, char *buf, const size_t buflen)
+{
+        switch (sap->sa_family) {
+        case AF_INET:
+                return rpc_ntop4(sap, buf, buflen);
+        case AF_INET6:
+                return rpc_ntop6(sap, buf, buflen);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rpc_ntop);
+
+static size_t rpc_pton4(const char *buf, const size_t buflen,
+                        struct sockaddr *sap, const size_t salen)
+{
+        struct sockaddr_in *sin = (struct sockaddr_in *)sap;
+        u8 *addr = (u8 *)&sin->sin_addr.s_addr;
+
+        if (buflen > INET_ADDRSTRLEN || salen < sizeof(struct sockaddr_in))
+                return 0;
+
+        memset(sap, 0, sizeof(struct sockaddr_in));
+
+        if (in4_pton(buf, buflen, addr, '\0', NULL) == 0)
+                return 0;
+
+        sin->sin_family = AF_INET;
+        return sizeof(struct sockaddr_in);;
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int rpc_parse_scope_id(const char *buf, const size_t buflen,
+                              const char *delim, struct sockaddr_in6 *sin6)
+{
+        char *p;
+        size_t len;
+
+        if ((buf + buflen) == delim)
+                return 1;
+
+        if (*delim != IPV6_SCOPE_DELIMITER)
+                return 0;
+
+        if (!(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
+            !(ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_SITELOCAL))
+                return 0;
+
+        len = (buf + buflen) - delim - 1;
+        p = kstrndup(delim + 1, len, GFP_KERNEL);
+        if (p) {
+                unsigned long scope_id = 0;
+                struct net_device *dev;
+
+                dev = dev_get_by_name(&init_net, p);
+                if (dev != NULL) {
+                        scope_id = dev->ifindex;
+                        dev_put(dev);
+                } else {
+                        if (strict_strtoul(p, 10, &scope_id) == 0) {
+                                kfree(p);
+                                return 0;
+                        }
+                }
+
+                kfree(p);
+
+                sin6->sin6_scope_id = scope_id;
+                return 1;
+        }
+
+        return 0;
+}
+
+static size_t rpc_pton6(const char *buf, const size_t buflen,
+                        struct sockaddr *sap, const size_t salen)
+{
+        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sap;
+        u8 *addr = (u8 *)&sin6->sin6_addr.in6_u;
+        const char *delim;
+
+        if (buflen > (INET6_ADDRSTRLEN + IPV6_SCOPE_ID_LEN) ||
+            salen < sizeof(struct sockaddr_in6))
+                return 0;
+
+        memset(sap, 0, sizeof(struct sockaddr_in6));
+
+        if (in6_pton(buf, buflen, addr, IPV6_SCOPE_DELIMITER, &delim) == 0)
+                return 0;
+
+        if (!rpc_parse_scope_id(buf, buflen, delim, sin6))
+                return 0;
+
+        sin6->sin6_family = AF_INET6;
+        return sizeof(struct sockaddr_in6);
+}
+#else
+static size_t rpc_pton6(const char *buf, const size_t buflen,
+                        struct sockaddr *sap, const size_t salen)
+{
+        return 0;
+}
+#endif
+
+/**
+ * rpc_pton - Construct a sockaddr in @sap
+ * @buf: C string containing presentation format IP address
+ * @buflen: length of presentation address in bytes
+ * @sap: buffer into which to plant socket address
+ * @salen: size of buffer in bytes
+ *
+ * Returns the size of the socket address if successful; otherwise
+ * zero is returned.
+ *
+ * Plants a socket address in @sap and returns the size of the
+ * socket address, if successful.  Returns zero if an error
+ * occurred.
+ */
+size_t rpc_pton(const char *buf, const size_t buflen,
+                struct sockaddr *sap, const size_t salen)
+{
+        unsigned int i;
+
+        for (i = 0; i < buflen; i++)
+                if (buf[i] == ':')
+                        return rpc_pton6(buf, buflen, sap, salen);
+        return rpc_pton4(buf, buflen, sap, salen);
+}
+EXPORT_SYMBOL_GPL(rpc_pton);
+
+/**
+ * rpc_sockaddr2uaddr - Construct a universal address string from @sap.
+ * @sap: socket address
+ *
+ * Returns a %NUL-terminated string in dynamically allocated memory;
+ * otherwise NULL is returned if an error occurred.  Caller must
+ * free the returned string.
+ */
+char *rpc_sockaddr2uaddr(const struct sockaddr *sap)
+{
+        char portbuf[RPCBIND_MAXUADDRPLEN];
+        char addrbuf[RPCBIND_MAXUADDRLEN];
+        unsigned short port;
+
+        switch (sap->sa_family) {
+        case AF_INET:
+                if (rpc_ntop4(sap, addrbuf, sizeof(addrbuf)) == 0)
+                        return NULL;
+                port = ntohs(((struct sockaddr_in *)sap)->sin_port);
+                break;
+        case AF_INET6:
+                if (rpc_ntop6_noscopeid(sap, addrbuf, sizeof(addrbuf)) == 0)
+                        return NULL;
+                port = ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
+                break;
+        default:
+                return NULL;
+        }
+
+        if (snprintf(portbuf, sizeof(portbuf),
+                     ".%u.%u", port >> 8, port & 0xff) > (int)sizeof(portbuf))
+                return NULL;
+
+        if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) > sizeof(addrbuf))
+                return NULL;
+
+        return kstrdup(addrbuf, GFP_KERNEL);
+}
+EXPORT_SYMBOL_GPL(rpc_sockaddr2uaddr);
+
+/**
+ * rpc_uaddr2sockaddr - convert a universal address to a socket address.
+ * @uaddr: C string containing universal address to convert
+ * @uaddr_len: length of universal address string
+ * @sap: buffer into which to plant socket address
+ * @salen: size of buffer
+ *
+ * Returns the size of the socket address if successful; otherwise
+ * zero is returned.
+ */
+size_t rpc_uaddr2sockaddr(const char *uaddr, const size_t uaddr_len,
+                          struct sockaddr *sap, const size_t salen)
+{
+        char *c, buf[RPCBIND_MAXUADDRLEN];
+        unsigned long portlo, porthi;
+        unsigned short port;
+
+        if (uaddr_len > sizeof(buf))
+                return 0;
+
+        memcpy(buf, uaddr, uaddr_len);
+
+        buf[uaddr_len] = '\n';
+        buf[uaddr_len + 1] = '\0';
+
+        c = strrchr(buf, '.');
+        if (unlikely(c == NULL))
+                return 0;
+        if (unlikely(strict_strtoul(c + 1, 10, &portlo) != 0))
+                return 0;
+        if (unlikely(portlo > 255))
+                return 0;
+
+        c[0] = '\n';
+        c[1] = '\0';
+
+        c = strrchr(buf, '.');
+        if (unlikely(c == NULL))
+                return 0;
+        if (unlikely(strict_strtoul(c + 1, 10, &porthi) != 0))
+                return 0;
+        if (unlikely(porthi > 255))
+                return 0;
+
+        port = (unsigned short)((porthi << 8) | portlo);
+
+        c[0] = '\0';
+
+        if (rpc_pton(buf, strlen(buf), sap, salen) == 0)
+                return 0;
+
+        switch (sap->sa_family) {
+        case AF_INET:
+                ((struct sockaddr_in *)sap)->sin_port = htons(port);
+                return sizeof(struct sockaddr_in);
+        case AF_INET6:
+                ((struct sockaddr_in6 *)sap)->sin6_port = htons(port);
+                return sizeof(struct sockaddr_in6);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rpc_uaddr2sockaddr);
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 66d458fc6920..fc6a43ccd950 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -89,8 +89,8 @@ static struct rpc_wait_queue pipe_version_rpc_waitqueue;
 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
 
 static void gss_free_ctx(struct gss_cl_ctx *);
-static struct rpc_pipe_ops gss_upcall_ops_v0;
-static struct rpc_pipe_ops gss_upcall_ops_v1;
+static const struct rpc_pipe_ops gss_upcall_ops_v0;
+static const struct rpc_pipe_ops gss_upcall_ops_v1;
 
 static inline struct gss_cl_ctx *
 gss_get_ctx(struct gss_cl_ctx *ctx)
@@ -777,7 +777,7 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
          * that we supported only the old pipe.  So we instead create
          * the new pipe first.
          */
-        gss_auth->dentry[1] = rpc_mkpipe(clnt->cl_dentry,
+        gss_auth->dentry[1] = rpc_mkpipe(clnt->cl_path.dentry,
                                          "gssd",
                                          clnt, &gss_upcall_ops_v1,
                                          RPC_PIPE_WAIT_FOR_OPEN);
@@ -786,7 +786,7 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
                 goto err_put_mech;
         }
 
-        gss_auth->dentry[0] = rpc_mkpipe(clnt->cl_dentry,
+        gss_auth->dentry[0] = rpc_mkpipe(clnt->cl_path.dentry,
                                          gss_auth->mech->gm_name,
                                          clnt, &gss_upcall_ops_v0,
                                          RPC_PIPE_WAIT_FOR_OPEN);
@@ -1507,7 +1507,7 @@ static const struct rpc_credops gss_nullops = {
         .crunwrap_resp  = gss_unwrap_resp,
 };
 
-static struct rpc_pipe_ops gss_upcall_ops_v0 = {
+static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
         .upcall         = gss_pipe_upcall,
         .downcall       = gss_pipe_downcall,
         .destroy_msg    = gss_pipe_destroy_msg,
@@ -1515,7 +1515,7 @@ static struct rpc_pipe_ops gss_upcall_ops_v0 = {
         .release_pipe   = gss_pipe_release,
 };
 
-static struct rpc_pipe_ops gss_upcall_ops_v1 = {
+static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
         .upcall         = gss_pipe_upcall,
         .downcall       = gss_pipe_downcall,
         .destroy_msg    = gss_pipe_destroy_msg,
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 2278a50c6444..2e6a148d277c 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -181,6 +181,11 @@ static void rsi_request(struct cache_detail *cd,
         (*bpp)[-1] = '\n';
 }
 
+static int rsi_upcall(struct cache_detail *cd, struct cache_head *h)
+{
+        return sunrpc_cache_pipe_upcall(cd, h, rsi_request);
+}
+
 
 static int rsi_parse(struct cache_detail *cd,
                     char *mesg, int mlen)
@@ -270,7 +275,7 @@ static struct cache_detail rsi_cache = {
         .hash_table     = rsi_table,
         .name           = "auth.rpcsec.init",
         .cache_put      = rsi_put,
-        .cache_request  = rsi_request,
+        .cache_upcall   = rsi_upcall,
         .cache_parse    = rsi_parse,
         .match          = rsi_match,
         .init           = rsi_init,
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index bbd31f1215e7..ade8a7e99cd3 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -27,10 +27,12 @@
 #include <linux/net.h>
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
+#include <linux/pagemap.h>
 #include <asm/ioctls.h>
 #include <linux/sunrpc/types.h>
 #include <linux/sunrpc/cache.h>
 #include <linux/sunrpc/stats.h>
+#include <linux/sunrpc/rpc_pipe_fs.h>
 
 #define  RPCDBG_FACILITY RPCDBG_CACHE
 
@@ -175,7 +177,12 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
 }
 EXPORT_SYMBOL_GPL(sunrpc_cache_update);
 
-static int cache_make_upcall(struct cache_detail *detail, struct cache_head *h);
+static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
+{
+        if (!cd->cache_upcall)
+                return -EINVAL;
+        return cd->cache_upcall(cd, h);
+}
 
 static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
 {
@@ -192,6 +199,7 @@ static inline int cache_is_valid(struct cache_detail *detail, struct cache_head
                         return 0;
         }
 }
+
 /*
  * This is the generic cache management routine for all
  * the authentication caches.
@@ -297,76 +305,11 @@ static DEFINE_SPINLOCK(cache_list_lock);
 static struct cache_detail *current_detail;
 static int current_index;
 
-static const struct file_operations cache_file_operations;
-static const struct file_operations content_file_operations;
-static const struct file_operations cache_flush_operations;
-
 static void do_cache_clean(struct work_struct *work);
 static DECLARE_DELAYED_WORK(cache_cleaner, do_cache_clean);
 
-static void remove_cache_proc_entries(struct cache_detail *cd)
-{
-        if (cd->proc_ent == NULL)
-                return;
-        if (cd->flush_ent)
-                remove_proc_entry("flush", cd->proc_ent);
-        if (cd->channel_ent)
-                remove_proc_entry("channel", cd->proc_ent);
-        if (cd->content_ent)
-                remove_proc_entry("content", cd->proc_ent);
-        cd->proc_ent = NULL;
-        remove_proc_entry(cd->name, proc_net_rpc);
-}
-
-#ifdef CONFIG_PROC_FS
-static int create_cache_proc_entries(struct cache_detail *cd)
-{
-        struct proc_dir_entry *p;
-
-        cd->proc_ent = proc_mkdir(cd->name, proc_net_rpc);
-        if (cd->proc_ent == NULL)
-                goto out_nomem;
-        cd->channel_ent = cd->content_ent = NULL;
-
-        p = proc_create_data("flush", S_IFREG|S_IRUSR|S_IWUSR,
-                             cd->proc_ent, &cache_flush_operations, cd);
-        cd->flush_ent = p;
-        if (p == NULL)
-                goto out_nomem;
-
-        if (cd->cache_request || cd->cache_parse) {
-                p = proc_create_data("channel", S_IFREG|S_IRUSR|S_IWUSR,
-                                     cd->proc_ent, &cache_file_operations, cd);
-                cd->channel_ent = p;
-                if (p == NULL)
-                        goto out_nomem;
-        }
-        if (cd->cache_show) {
-                p = proc_create_data("content", S_IFREG|S_IRUSR|S_IWUSR,
-                                cd->proc_ent, &content_file_operations, cd);
-                cd->content_ent = p;
-                if (p == NULL)
-                        goto out_nomem;
-        }
-        return 0;
-out_nomem:
-        remove_cache_proc_entries(cd);
-        return -ENOMEM;
-}
-#else /* CONFIG_PROC_FS */
-static int create_cache_proc_entries(struct cache_detail *cd)
-{
-        return 0;
-}
-#endif
-
-int cache_register(struct cache_detail *cd)
+static void sunrpc_init_cache_detail(struct cache_detail *cd)
 {
-        int ret;
-
-        ret = create_cache_proc_entries(cd);
-        if (ret)
-                return ret;
         rwlock_init(&cd->hash_lock);
         INIT_LIST_HEAD(&cd->queue);
         spin_lock(&cache_list_lock);
@@ -380,11 +323,9 @@ int cache_register(struct cache_detail *cd)
 
         /* start the cleaning process */
         schedule_delayed_work(&cache_cleaner, 0);
-        return 0;
 }
-EXPORT_SYMBOL_GPL(cache_register);
 
-void cache_unregister(struct cache_detail *cd)
+static void sunrpc_destroy_cache_detail(struct cache_detail *cd)
 {
         cache_purge(cd);
         spin_lock(&cache_list_lock);
@@ -399,7 +340,6 @@ void cache_unregister(struct cache_detail *cd)
         list_del_init(&cd->others);
         write_unlock(&cd->hash_lock);
         spin_unlock(&cache_list_lock);
-        remove_cache_proc_entries(cd);
         if (list_empty(&cache_list)) {
                 /* module must be being unloaded so its safe to kill the worker */
                 cancel_delayed_work_sync(&cache_cleaner);
@@ -408,7 +348,6 @@ void cache_unregister(struct cache_detail *cd)
 out:
         printk(KERN_ERR "nfsd: failed to unregister %s cache\n", cd->name);
 }
-EXPORT_SYMBOL_GPL(cache_unregister);
 
 /* clean cache tries to find something to clean
  * and cleans it.
@@ -703,18 +642,18 @@ struct cache_reader {
         int                     offset; /* if non-0, we have a refcnt on next request */
 };
 
-static ssize_t
-cache_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
+static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
+                          loff_t *ppos, struct cache_detail *cd)
 {
         struct cache_reader *rp = filp->private_data;
         struct cache_request *rq;
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        struct inode *inode = filp->f_path.dentry->d_inode;
         int err;
 
         if (count == 0)
                 return 0;
 
-        mutex_lock(&queue_io_mutex); /* protect against multiple concurrent
+        mutex_lock(&inode->i_mutex); /* protect against multiple concurrent
                               * readers on this file */
  again:
         spin_lock(&queue_lock);
@@ -727,7 +666,7 @@ cache_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
         }
         if (rp->q.list.next == &cd->queue) {
                 spin_unlock(&queue_lock);
-                mutex_unlock(&queue_io_mutex);
+                mutex_unlock(&inode->i_mutex);
                 BUG_ON(rp->offset);
                 return 0;
         }
@@ -774,49 +713,90 @@ cache_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
         }
         if (err == -EAGAIN)
                 goto again;
-        mutex_unlock(&queue_io_mutex);
+        mutex_unlock(&inode->i_mutex);
         return err ? err :  count;
 }
 
-static char write_buf[8192]; /* protected by queue_io_mutex */
+static ssize_t cache_do_downcall(char *kaddr, const char __user *buf,
+                                 size_t count, struct cache_detail *cd)
+{
+        ssize_t ret;
 
-static ssize_t
-cache_write(struct file *filp, const char __user *buf, size_t count,
-            loff_t *ppos)
+        if (copy_from_user(kaddr, buf, count))
+                return -EFAULT;
+        kaddr[count] = '\0';
+        ret = cd->cache_parse(cd, kaddr, count);
+        if (!ret)
+                ret = count;
+        return ret;
+}
+
+static ssize_t cache_slow_downcall(const char __user *buf,
+                                   size_t count, struct cache_detail *cd)
 {
-        int err;
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+        static char write_buf[8192]; /* protected by queue_io_mutex */
+        ssize_t ret = -EINVAL;
 
-        if (count == 0)
-                return 0;
         if (count >= sizeof(write_buf))
-                return -EINVAL;
-
+                goto out;
         mutex_lock(&queue_io_mutex);
+        ret = cache_do_downcall(write_buf, buf, count, cd);
+        mutex_unlock(&queue_io_mutex);
+out:
+        return ret;
+}
 
-        if (copy_from_user(write_buf, buf, count)) {
-                mutex_unlock(&queue_io_mutex);
-                return -EFAULT;
-        }
-        write_buf[count] = '\0';
-        if (cd->cache_parse)
-                err = cd->cache_parse(cd, write_buf, count);
-        else
-                err = -EINVAL;
+static ssize_t cache_downcall(struct address_space *mapping,
+                              const char __user *buf,
+                              size_t count, struct cache_detail *cd)
+{
+        struct page *page;
+        char *kaddr;
+        ssize_t ret = -ENOMEM;
+
+        if (count >= PAGE_CACHE_SIZE)
+                goto out_slow;
+
+        page = find_or_create_page(mapping, 0, GFP_KERNEL);
+        if (!page)
+                goto out_slow;
+
+        kaddr = kmap(page);
+        ret = cache_do_downcall(kaddr, buf, count, cd);
+        kunmap(page);
+        unlock_page(page);
+        page_cache_release(page);
+        return ret;
+out_slow:
+        return cache_slow_downcall(buf, count, cd);
+}
 
-        mutex_unlock(&queue_io_mutex);
-        return err ? err : count;
+static ssize_t cache_write(struct file *filp, const char __user *buf,
+                           size_t count, loff_t *ppos,
+                           struct cache_detail *cd)
+{
+        struct address_space *mapping = filp->f_mapping;
+        struct inode *inode = filp->f_path.dentry->d_inode;
+        ssize_t ret = -EINVAL;
+
+        if (!cd->cache_parse)
+                goto out;
+
+        mutex_lock(&inode->i_mutex);
+        ret = cache_downcall(mapping, buf, count, cd);
+        mutex_unlock(&inode->i_mutex);
+out:
+        return ret;
 }
 
 static DECLARE_WAIT_QUEUE_HEAD(queue_wait);
 
-static unsigned int
-cache_poll(struct file *filp, poll_table *wait)
+static unsigned int cache_poll(struct file *filp, poll_table *wait,
+                               struct cache_detail *cd)
 {
         unsigned int mask;
         struct cache_reader *rp = filp->private_data;
         struct cache_queue *cq;
-        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
 
         poll_wait(filp, &queue_wait, wait);
 
@@ -838,14 +818,13 @@ cache_poll(struct file *filp, poll_table *wait)
         return mask;
 }
 
-static int
-cache_ioctl(struct inode *ino, struct file *filp,
-            unsigned int cmd, unsigned long arg)
+static int cache_ioctl(struct inode *ino, struct file *filp,
+                       unsigned int cmd, unsigned long arg,
+                       struct cache_detail *cd)
 {
         int len = 0;
         struct cache_reader *rp = filp->private_data;
         struct cache_queue *cq;
-        struct cache_detail *cd = PDE(ino)->data;
 
         if (cmd != FIONREAD || !rp)
                 return -EINVAL;
@@ -868,15 +847,15 @@ cache_ioctl(struct inode *ino, struct file *filp,
         return put_user(len, (int __user *)arg);
 }
 
-static int
-cache_open(struct inode *inode, struct file *filp)
+static int cache_open(struct inode *inode, struct file *filp,
+                      struct cache_detail *cd)
 {
         struct cache_reader *rp = NULL;
 
+        if (!cd || !try_module_get(cd->owner))
+                return -EACCES;
         nonseekable_open(inode, filp);
         if (filp->f_mode & FMODE_READ) {
-                struct cache_detail *cd = PDE(inode)->data;
-
                 rp = kmalloc(sizeof(*rp), GFP_KERNEL);
                 if (!rp)
                         return -ENOMEM;
@@ -891,11 +870,10 @@ cache_open(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static int
-cache_release(struct inode *inode, struct file *filp)
+static int cache_release(struct inode *inode, struct file *filp,
+                         struct cache_detail *cd)
 {
         struct cache_reader *rp = filp->private_data;
-        struct cache_detail *cd = PDE(inode)->data;
 
         if (rp) {
                 spin_lock(&queue_lock);
@@ -919,23 +897,12 @@ cache_release(struct inode *inode, struct file *filp)
                 cd->last_close = get_seconds();
                 atomic_dec(&cd->readers);
         }
+        module_put(cd->owner);
         return 0;
 }
 
 
 
-static const struct file_operations cache_file_operations = {
-        .owner          = THIS_MODULE,
-        .llseek         = no_llseek,
-        .read           = cache_read,
-        .write          = cache_write,
-        .poll           = cache_poll,
-        .ioctl          = cache_ioctl, /* for FIONREAD */
-        .open           = cache_open,
-        .release        = cache_release,
-};
-
-
 static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch)
 {
         struct cache_queue *cq;
@@ -1036,15 +1003,21 @@ static void warn_no_listener(struct cache_detail *detail)
         if (detail->last_warn != detail->last_close) {
                 detail->last_warn = detail->last_close;
                 if (detail->warn_no_listener)
-                        detail->warn_no_listener(detail);
+                        detail->warn_no_listener(detail, detail->last_close != 0);
         }
 }
 
 /*
- * register an upcall request to user-space.
+ * register an upcall request to user-space and queue it up for read() by the
+ * upcall daemon.
+ *
  * Each request is at most one page long.
  */
-static int cache_make_upcall(struct cache_detail *detail, struct cache_head *h)
+int sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h,
+                void (*cache_request)(struct cache_detail *,
+                                      struct cache_head *,
+                                      char **,
+                                      int *))
 {
 
         char *buf;
@@ -1052,9 +1025,6 @@ static int cache_make_upcall(struct cache_detail *detail, struct cache_head *h)
         char *bp;
         int len;
 
-        if (detail->cache_request == NULL)
-                return -EINVAL;
-
         if (atomic_read(&detail->readers) == 0 &&
             detail->last_close < get_seconds() - 30) {
                         warn_no_listener(detail);
@@ -1073,7 +1043,7 @@ static int cache_make_upcall(struct cache_detail *detail, struct cache_head *h)
 
         bp = buf; len = PAGE_SIZE;
 
-        detail->cache_request(detail, h, &bp, &len);
+        cache_request(detail, h, &bp, &len);
 
         if (len < 0) {
                 kfree(buf);
@@ -1091,6 +1061,7 @@ static int cache_make_upcall(struct cache_detail *detail, struct cache_head *h)
         wake_up(&queue_wait);
         return 0;
 }
+EXPORT_SYMBOL_GPL(sunrpc_cache_pipe_upcall);
 
 /*
  * parse a message from user-space and pass it
@@ -1258,11 +1229,13 @@ static const struct seq_operations cache_content_op = {
         .show   = c_show,
 };
 
-static int content_open(struct inode *inode, struct file *file)
+static int content_open(struct inode *inode, struct file *file,
+                        struct cache_detail *cd)
 {
         struct handle *han;
-        struct cache_detail *cd = PDE(inode)->data;
 
+        if (!cd || !try_module_get(cd->owner))
+                return -EACCES;
         han = __seq_open_private(file, &cache_content_op, sizeof(*han));
         if (han == NULL)
                 return -ENOMEM;
@@ -1271,17 +1244,33 @@ static int content_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static const struct file_operations content_file_operations = {
-        .open           = content_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = seq_release_private,
-};
+static int content_release(struct inode *inode, struct file *file,
+                struct cache_detail *cd)
+{
+        int ret = seq_release_private(inode, file);
+        module_put(cd->owner);
+        return ret;
+}
+
+static int open_flush(struct inode *inode, struct file *file,
+                        struct cache_detail *cd)
+{
+        if (!cd || !try_module_get(cd->owner))
+                return -EACCES;
+        return nonseekable_open(inode, file);
+}
+
+static int release_flush(struct inode *inode, struct file *file,
+                        struct cache_detail *cd)
+{
+        module_put(cd->owner);
+        return 0;
+}
 
 static ssize_t read_flush(struct file *file, char __user *buf,
-                            size_t count, loff_t *ppos)
+                          size_t count, loff_t *ppos,
+                          struct cache_detail *cd)
 {
-        struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
         char tbuf[20];
         unsigned long p = *ppos;
         size_t len;
@@ -1299,10 +1288,10 @@ static ssize_t read_flush(struct file *file, char __user *buf,
         return len;
 }
 
-static ssize_t write_flush(struct file * file, const char __user * buf,
-                             size_t count, loff_t *ppos)
+static ssize_t write_flush(struct file *file, const char __user *buf,
+                           size_t count, loff_t *ppos,
+                           struct cache_detail *cd)
 {
-        struct cache_detail *cd = PDE(file->f_path.dentry->d_inode)->data;
         char tbuf[20];
         char *ep;
         long flushtime;
@@ -1323,8 +1312,343 @@ static ssize_t write_flush(struct file * file, const char __user * buf,
         return count;
 }
 
-static const struct file_operations cache_flush_operations = {
-        .open           = nonseekable_open,
-        .read           = read_flush,
-        .write          = write_flush,
+static ssize_t cache_read_procfs(struct file *filp, char __user *buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+
+        return cache_read(filp, buf, count, ppos, cd);
+}
+
+static ssize_t cache_write_procfs(struct file *filp, const char __user *buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+
+        return cache_write(filp, buf, count, ppos, cd);
+}
+
+static unsigned int cache_poll_procfs(struct file *filp, poll_table *wait)
+{
+        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+
+        return cache_poll(filp, wait, cd);
+}
+
+static int cache_ioctl_procfs(struct inode *inode, struct file *filp,
+                              unsigned int cmd, unsigned long arg)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return cache_ioctl(inode, filp, cmd, arg, cd);
+}
+
+static int cache_open_procfs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return cache_open(inode, filp, cd);
+}
+
+static int cache_release_procfs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return cache_release(inode, filp, cd);
+}
+
+static const struct file_operations cache_file_operations_procfs = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .read           = cache_read_procfs,
+        .write          = cache_write_procfs,
+        .poll           = cache_poll_procfs,
+        .ioctl          = cache_ioctl_procfs, /* for FIONREAD */
+        .open           = cache_open_procfs,
+        .release        = cache_release_procfs,
 };
+
+static int content_open_procfs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return content_open(inode, filp, cd);
+}
+
+static int content_release_procfs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return content_release(inode, filp, cd);
+}
+
+static const struct file_operations content_file_operations_procfs = {
+        .open           = content_open_procfs,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = content_release_procfs,
+};
+
+static int open_flush_procfs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return open_flush(inode, filp, cd);
+}
+
+static int release_flush_procfs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = PDE(inode)->data;
+
+        return release_flush(inode, filp, cd);
+}
+
+static ssize_t read_flush_procfs(struct file *filp, char __user *buf,
+                            size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+
+        return read_flush(filp, buf, count, ppos, cd);
+}
+
+static ssize_t write_flush_procfs(struct file *filp,
+                                  const char __user *buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = PDE(filp->f_path.dentry->d_inode)->data;
+
+        return write_flush(filp, buf, count, ppos, cd);
+}
+
+static const struct file_operations cache_flush_operations_procfs = {
+        .open           = open_flush_procfs,
+        .read           = read_flush_procfs,
+        .write          = write_flush_procfs,
+        .release        = release_flush_procfs,
+};
+
+static void remove_cache_proc_entries(struct cache_detail *cd)
+{
+        if (cd->u.procfs.proc_ent == NULL)
+                return;
+        if (cd->u.procfs.flush_ent)
+                remove_proc_entry("flush", cd->u.procfs.proc_ent);
+        if (cd->u.procfs.channel_ent)
+                remove_proc_entry("channel", cd->u.procfs.proc_ent);
+        if (cd->u.procfs.content_ent)
+                remove_proc_entry("content", cd->u.procfs.proc_ent);
+        cd->u.procfs.proc_ent = NULL;
+        remove_proc_entry(cd->name, proc_net_rpc);
+}
+
+#ifdef CONFIG_PROC_FS
+static int create_cache_proc_entries(struct cache_detail *cd)
+{
+        struct proc_dir_entry *p;
+
+        cd->u.procfs.proc_ent = proc_mkdir(cd->name, proc_net_rpc);
+        if (cd->u.procfs.proc_ent == NULL)
+                goto out_nomem;
+        cd->u.procfs.channel_ent = NULL;
+        cd->u.procfs.content_ent = NULL;
+
+        p = proc_create_data("flush", S_IFREG|S_IRUSR|S_IWUSR,
+                             cd->u.procfs.proc_ent,
+                             &cache_flush_operations_procfs, cd);
+        cd->u.procfs.flush_ent = p;
+        if (p == NULL)
+                goto out_nomem;
+
+        if (cd->cache_upcall || cd->cache_parse) {
+                p = proc_create_data("channel", S_IFREG|S_IRUSR|S_IWUSR,
+                                     cd->u.procfs.proc_ent,
+                                     &cache_file_operations_procfs, cd);
+                cd->u.procfs.channel_ent = p;
+                if (p == NULL)
+                        goto out_nomem;
+        }
+        if (cd->cache_show) {
+                p = proc_create_data("content", S_IFREG|S_IRUSR|S_IWUSR,
+                                cd->u.procfs.proc_ent,
+                                &content_file_operations_procfs, cd);
+                cd->u.procfs.content_ent = p;
+                if (p == NULL)
+                        goto out_nomem;
+        }
+        return 0;
+out_nomem:
+        remove_cache_proc_entries(cd);
+        return -ENOMEM;
+}
+#else /* CONFIG_PROC_FS */
+static int create_cache_proc_entries(struct cache_detail *cd)
+{
+        return 0;
+}
+#endif
+
+int cache_register(struct cache_detail *cd)
+{
+        int ret;
+
+        sunrpc_init_cache_detail(cd);
+        ret = create_cache_proc_entries(cd);
+        if (ret)
+                sunrpc_destroy_cache_detail(cd);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(cache_register);
+
+void cache_unregister(struct cache_detail *cd)
+{
+        remove_cache_proc_entries(cd);
+        sunrpc_destroy_cache_detail(cd);
+}
+EXPORT_SYMBOL_GPL(cache_unregister);
+
+static ssize_t cache_read_pipefs(struct file *filp, char __user *buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+
+        return cache_read(filp, buf, count, ppos, cd);
+}
+
+static ssize_t cache_write_pipefs(struct file *filp, const char __user *buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+
+        return cache_write(filp, buf, count, ppos, cd);
+}
+
+static unsigned int cache_poll_pipefs(struct file *filp, poll_table *wait)
+{
+        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+
+        return cache_poll(filp, wait, cd);
+}
+
+static int cache_ioctl_pipefs(struct inode *inode, struct file *filp,
+                              unsigned int cmd, unsigned long arg)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return cache_ioctl(inode, filp, cmd, arg, cd);
+}
+
+static int cache_open_pipefs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return cache_open(inode, filp, cd);
+}
+
+static int cache_release_pipefs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return cache_release(inode, filp, cd);
+}
+
+const struct file_operations cache_file_operations_pipefs = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .read           = cache_read_pipefs,
+        .write          = cache_write_pipefs,
+        .poll           = cache_poll_pipefs,
+        .ioctl          = cache_ioctl_pipefs, /* for FIONREAD */
+        .open           = cache_open_pipefs,
+        .release        = cache_release_pipefs,
+};
+
+static int content_open_pipefs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return content_open(inode, filp, cd);
+}
+
+static int content_release_pipefs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return content_release(inode, filp, cd);
+}
+
+const struct file_operations content_file_operations_pipefs = {
+        .open           = content_open_pipefs,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = content_release_pipefs,
+};
+
+static int open_flush_pipefs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return open_flush(inode, filp, cd);
+}
+
+static int release_flush_pipefs(struct inode *inode, struct file *filp)
+{
+        struct cache_detail *cd = RPC_I(inode)->private;
+
+        return release_flush(inode, filp, cd);
+}
+
+static ssize_t read_flush_pipefs(struct file *filp, char __user *buf,
+                            size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+
+        return read_flush(filp, buf, count, ppos, cd);
+}
+
+static ssize_t write_flush_pipefs(struct file *filp,
+                                  const char __user *buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct cache_detail *cd = RPC_I(filp->f_path.dentry->d_inode)->private;
+
+        return write_flush(filp, buf, count, ppos, cd);
+}
+
+const struct file_operations cache_flush_operations_pipefs = {
+        .open           = open_flush_pipefs,
+        .read           = read_flush_pipefs,
+        .write          = write_flush_pipefs,
+        .release        = release_flush_pipefs,
+};
+
+int sunrpc_cache_register_pipefs(struct dentry *parent,
+                                 const char *name, mode_t umode,
+                                 struct cache_detail *cd)
+{
+        struct qstr q;
+        struct dentry *dir;
+        int ret = 0;
+
+        sunrpc_init_cache_detail(cd);
+        q.name = name;
+        q.len = strlen(name);
+        q.hash = full_name_hash(q.name, q.len);
+        dir = rpc_create_cache_dir(parent, &q, umode, cd);
+        if (!IS_ERR(dir))
+                cd->u.pipefs.dir = dir;
+        else {
+                sunrpc_destroy_cache_detail(cd);
+                ret = PTR_ERR(dir);
+        }
+        return ret;
+}
+EXPORT_SYMBOL_GPL(sunrpc_cache_register_pipefs);
+
+void sunrpc_cache_unregister_pipefs(struct cache_detail *cd)
+{
+        rpc_remove_cache_dir(cd->u.pipefs.dir);
+        cd->u.pipefs.dir = NULL;
+        sunrpc_destroy_cache_detail(cd);
+}
+EXPORT_SYMBOL_GPL(sunrpc_cache_unregister_pipefs);
+
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 5bc2f45bddf0..c1e467e1b07d 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -27,8 +27,9 @@
 #include <linux/types.h>
 #include <linux/kallsyms.h>
 #include <linux/mm.h>
+#include <linux/namei.h>
+#include <linux/mount.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/utsname.h>
 #include <linux/workqueue.h>
 #include <linux/in6.h>
@@ -98,33 +99,49 @@ static int
 rpc_setup_pipedir(struct rpc_clnt *clnt, char *dir_name)
 {
         static uint32_t clntid;
+        struct nameidata nd;
+        struct path path;
+        char name[15];
+        struct qstr q = {
+                .name = name,
+        };
         int error;
 
-        clnt->cl_vfsmnt = ERR_PTR(-ENOENT);
-        clnt->cl_dentry = ERR_PTR(-ENOENT);
+        clnt->cl_path.mnt = ERR_PTR(-ENOENT);
+        clnt->cl_path.dentry = ERR_PTR(-ENOENT);
         if (dir_name == NULL)
                 return 0;
 
-        clnt->cl_vfsmnt = rpc_get_mount();
-        if (IS_ERR(clnt->cl_vfsmnt))
-                return PTR_ERR(clnt->cl_vfsmnt);
+        path.mnt = rpc_get_mount();
+        if (IS_ERR(path.mnt))
+                return PTR_ERR(path.mnt);
+        error = vfs_path_lookup(path.mnt->mnt_root, path.mnt, dir_name, 0, &nd);
+        if (error)
+                goto err;
 
         for (;;) {
-                snprintf(clnt->cl_pathname, sizeof(clnt->cl_pathname),
-                                "%s/clnt%x", dir_name,
-                                (unsigned int)clntid++);
-                clnt->cl_pathname[sizeof(clnt->cl_pathname) - 1] = '\0';
-                clnt->cl_dentry = rpc_mkdir(clnt->cl_pathname, clnt);
-                if (!IS_ERR(clnt->cl_dentry))
-                        return 0;
-                error = PTR_ERR(clnt->cl_dentry);
+                q.len = snprintf(name, sizeof(name), "clnt%x", (unsigned int)clntid++);
+                name[sizeof(name) - 1] = '\0';
+                q.hash = full_name_hash(q.name, q.len);
+                path.dentry = rpc_create_client_dir(nd.path.dentry, &q, clnt);
+                if (!IS_ERR(path.dentry))
+                        break;
+                error = PTR_ERR(path.dentry);
                 if (error != -EEXIST) {
-                        printk(KERN_INFO "RPC: Couldn't create pipefs entry %s, error %d\n",
-                                        clnt->cl_pathname, error);
-                        rpc_put_mount();
-                        return error;
+                        printk(KERN_INFO "RPC: Couldn't create pipefs entry"
+                                        " %s/%s, error %d\n",
+                                        dir_name, name, error);
+                        goto err_path_put;
                 }
         }
+        path_put(&nd.path);
+        clnt->cl_path = path;
+        return 0;
+err_path_put:
+        path_put(&nd.path);
+err:
+        rpc_put_mount();
+        return error;
 }
 
 static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, struct rpc_xprt *xprt)
@@ -232,8 +249,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         return clnt;
 
 out_no_auth:
-        if (!IS_ERR(clnt->cl_dentry)) {
-                rpc_rmdir(clnt->cl_dentry);
+        if (!IS_ERR(clnt->cl_path.dentry)) {
+                rpc_remove_client_dir(clnt->cl_path.dentry);
                 rpc_put_mount();
         }
 out_no_path:
@@ -424,8 +441,8 @@ rpc_free_client(struct kref *kref)
 
         dprintk("RPC:       destroying %s client for %s\n",
                         clnt->cl_protname, clnt->cl_server);
-        if (!IS_ERR(clnt->cl_dentry)) {
-                rpc_rmdir(clnt->cl_dentry);
+        if (!IS_ERR(clnt->cl_path.dentry)) {
+                rpc_remove_client_dir(clnt->cl_path.dentry);
                 rpc_put_mount();
         }
         if (clnt->cl_parent != clnt) {
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 9ced0628d69c..7f676bdf70d3 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -26,6 +26,7 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/workqueue.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
+#include <linux/sunrpc/cache.h>
 
 static struct vfsmount *rpc_mount __read_mostly;
 static int rpc_mount_count;
@@ -125,7 +126,7 @@ static void
 rpc_close_pipes(struct inode *inode)
 {
         struct rpc_inode *rpci = RPC_I(inode);
-        struct rpc_pipe_ops *ops;
+        const struct rpc_pipe_ops *ops;
         int need_release;
 
         mutex_lock(&inode->i_mutex);
@@ -398,66 +399,12 @@ static const struct file_operations rpc_info_operations = {
 
 
 /*
- * We have a single directory with 1 node in it.
- */
-enum {
-        RPCAUTH_Root = 1,
-        RPCAUTH_lockd,
-        RPCAUTH_mount,
-        RPCAUTH_nfs,
-        RPCAUTH_portmap,
-        RPCAUTH_statd,
-        RPCAUTH_nfsd4_cb,
-        RPCAUTH_RootEOF
-};
-
-/*
  * Description of fs contents.
  */
 struct rpc_filelist {
-        char *name;
+        const char *name;
         const struct file_operations *i_fop;
-        int mode;
-};
-
-static struct rpc_filelist files[] = {
-        [RPCAUTH_lockd] = {
-                .name = "lockd",
-                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
-        },
-        [RPCAUTH_mount] = {
-                .name = "mount",
-                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
-        },
-        [RPCAUTH_nfs] = {
-                .name = "nfs",
-                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
-        },
-        [RPCAUTH_portmap] = {
-                .name = "portmap",
-                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
-        },
-        [RPCAUTH_statd] = {
-                .name = "statd",
-                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
-        },
-        [RPCAUTH_nfsd4_cb] = {
-                .name = "nfsd4_cb",
-                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
-        },
-};
-
-enum {
-        RPCAUTH_info = 2,
-        RPCAUTH_EOF
-};
-
-static struct rpc_filelist authfiles[] = {
-        [RPCAUTH_info] = {
-                .name = "info",
-                .i_fop = &rpc_info_operations,
-                .mode = S_IFREG | S_IRUSR,
-        },
+        umode_t mode;
 };
 
 struct vfsmount *rpc_get_mount(void)
@@ -469,11 +416,13 @@ struct vfsmount *rpc_get_mount(void)
                 return ERR_PTR(err);
         return rpc_mount;
 }
+EXPORT_SYMBOL_GPL(rpc_get_mount);
 
 void rpc_put_mount(void)
 {
         simple_release_fs(&rpc_mount, &rpc_mount_count);
 }
+EXPORT_SYMBOL_GPL(rpc_put_mount);
 
 static int rpc_delete_dentry(struct dentry *dentry)
 {
@@ -484,39 +433,8 @@ static const struct dentry_operations rpc_dentry_operations = {
         .d_delete = rpc_delete_dentry,
 };
 
-static int
-rpc_lookup_parent(char *path, struct nameidata *nd)
-{
-        struct vfsmount *mnt;
-
-        if (path[0] == '\0')
-                return -ENOENT;
-
-        mnt = rpc_get_mount();
-        if (IS_ERR(mnt)) {
-                printk(KERN_WARNING "%s: %s failed to mount "
-                               "pseudofilesystem \n", __FILE__, __func__);
-                return PTR_ERR(mnt);
-        }
-
-        if (vfs_path_lookup(mnt->mnt_root, mnt, path, LOOKUP_PARENT, nd)) {
-                printk(KERN_WARNING "%s: %s failed to find path %s\n",
-                                __FILE__, __func__, path);
-                rpc_put_mount();
-                return -ENOENT;
-        }
-        return 0;
-}
-
-static void
-rpc_release_path(struct nameidata *nd)
-{
-        path_put(&nd->path);
-        rpc_put_mount();
-}
-
 static struct inode *
-rpc_get_inode(struct super_block *sb, int mode)
+rpc_get_inode(struct super_block *sb, umode_t mode)
 {
         struct inode *inode = new_inode(sb);
         if (!inode)
@@ -534,212 +452,274 @@ rpc_get_inode(struct super_block *sb, int mode)
         return inode;
 }
 
-/*
- * FIXME: This probably has races.
- */
-static void rpc_depopulate(struct dentry *parent,
-                           unsigned long start, unsigned long eof)
+static int __rpc_create_common(struct inode *dir, struct dentry *dentry,
+                               umode_t mode,
+                               const struct file_operations *i_fop,
+                               void *private)
 {
-        struct inode *dir = parent->d_inode;
-        struct list_head *pos, *next;
-        struct dentry *dentry, *dvec[10];
-        int n = 0;
+        struct inode *inode;
 
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_CHILD);
-repeat:
-        spin_lock(&dcache_lock);
-        list_for_each_safe(pos, next, &parent->d_subdirs) {
-                dentry = list_entry(pos, struct dentry, d_u.d_child);
-                if (!dentry->d_inode ||
-                                dentry->d_inode->i_ino < start ||
-                                dentry->d_inode->i_ino >= eof)
-                        continue;
-                spin_lock(&dentry->d_lock);
-                if (!d_unhashed(dentry)) {
-                        dget_locked(dentry);
-                        __d_drop(dentry);
-                        spin_unlock(&dentry->d_lock);
-                        dvec[n++] = dentry;
-                        if (n == ARRAY_SIZE(dvec))
-                                break;
-                } else
-                        spin_unlock(&dentry->d_lock);
-        }
-        spin_unlock(&dcache_lock);
-        if (n) {
-                do {
-                        dentry = dvec[--n];
-                        if (S_ISREG(dentry->d_inode->i_mode))
-                                simple_unlink(dir, dentry);
-                        else if (S_ISDIR(dentry->d_inode->i_mode))
-                                simple_rmdir(dir, dentry);
-                        d_delete(dentry);
-                        dput(dentry);
-                } while (n);
-                goto repeat;
-        }
-        mutex_unlock(&dir->i_mutex);
+        BUG_ON(!d_unhashed(dentry));
+        inode = rpc_get_inode(dir->i_sb, mode);
+        if (!inode)
+                goto out_err;
+        inode->i_ino = iunique(dir->i_sb, 100);
+        if (i_fop)
+                inode->i_fop = i_fop;
+        if (private)
+                rpc_inode_setowner(inode, private);
+        d_add(dentry, inode);
+        return 0;
+out_err:
+        printk(KERN_WARNING "%s: %s failed to allocate inode for dentry %s\n",
+                        __FILE__, __func__, dentry->d_name.name);
+        dput(dentry);
+        return -ENOMEM;
 }
 
-static int
-rpc_populate(struct dentry *parent,
-                struct rpc_filelist *files,
-                int start, int eof)
+static int __rpc_create(struct inode *dir, struct dentry *dentry,
+                        umode_t mode,
+                        const struct file_operations *i_fop,
+                        void *private)
 {
-        struct inode *inode, *dir = parent->d_inode;
-        void *private = RPC_I(dir)->private;
-        struct dentry *dentry;
-        int mode, i;
+        int err;
 
-        mutex_lock(&dir->i_mutex);
-        for (i = start; i < eof; i++) {
-                dentry = d_alloc_name(parent, files[i].name);
-                if (!dentry)
-                        goto out_bad;
-                dentry->d_op = &rpc_dentry_operations;
-                mode = files[i].mode;
-                inode = rpc_get_inode(dir->i_sb, mode);
-                if (!inode) {
-                        dput(dentry);
-                        goto out_bad;
-                }
-                inode->i_ino = i;
-                if (files[i].i_fop)
-                        inode->i_fop = files[i].i_fop;
-                if (private)
-                        rpc_inode_setowner(inode, private);
-                if (S_ISDIR(mode))
-                        inc_nlink(dir);
-                d_add(dentry, inode);
-                fsnotify_create(dir, dentry);
-        }
-        mutex_unlock(&dir->i_mutex);
+        err = __rpc_create_common(dir, dentry, S_IFREG | mode, i_fop, private);
+        if (err)
+                return err;
+        fsnotify_create(dir, dentry);
         return 0;
-out_bad:
-        mutex_unlock(&dir->i_mutex);
-        printk(KERN_WARNING "%s: %s failed to populate directory %s\n",
-                        __FILE__, __func__, parent->d_name.name);
-        return -ENOMEM;
 }
 
-static int
-__rpc_mkdir(struct inode *dir, struct dentry *dentry)
+static int __rpc_mkdir(struct inode *dir, struct dentry *dentry,
+                       umode_t mode,
+                       const struct file_operations *i_fop,
+                       void *private)
 {
-        struct inode *inode;
+        int err;
 
-        inode = rpc_get_inode(dir->i_sb, S_IFDIR | S_IRUGO | S_IXUGO);
-        if (!inode)
-                goto out_err;
-        inode->i_ino = iunique(dir->i_sb, 100);
-        d_instantiate(dentry, inode);
+        err = __rpc_create_common(dir, dentry, S_IFDIR | mode, i_fop, private);
+        if (err)
+                return err;
         inc_nlink(dir);
         fsnotify_mkdir(dir, dentry);
         return 0;
-out_err:
-        printk(KERN_WARNING "%s: %s failed to allocate inode for dentry %s\n",
-                        __FILE__, __func__, dentry->d_name.name);
-        return -ENOMEM;
 }
 
-static int
-__rpc_rmdir(struct inode *dir, struct dentry *dentry)
+static int __rpc_mkpipe(struct inode *dir, struct dentry *dentry,
+                        umode_t mode,
+                        const struct file_operations *i_fop,
+                        void *private,
+                        const struct rpc_pipe_ops *ops,
+                        int flags)
 {
-        int error;
-        error = simple_rmdir(dir, dentry);
-        if (!error)
-                d_delete(dentry);
-        return error;
+        struct rpc_inode *rpci;
+        int err;
+
+        err = __rpc_create_common(dir, dentry, S_IFIFO | mode, i_fop, private);
+        if (err)
+                return err;
+        rpci = RPC_I(dentry->d_inode);
+        rpci->nkern_readwriters = 1;
+        rpci->private = private;
+        rpci->flags = flags;
+        rpci->ops = ops;
+        fsnotify_create(dir, dentry);
+        return 0;
 }
 
-static struct dentry *
-rpc_lookup_create(struct dentry *parent, const char *name, int len, int exclusive)
+static int __rpc_rmdir(struct inode *dir, struct dentry *dentry)
+{
+        int ret;
+
+        dget(dentry);
+        ret = simple_rmdir(dir, dentry);
+        d_delete(dentry);
+        dput(dentry);
+        return ret;
+}
+
+static int __rpc_unlink(struct inode *dir, struct dentry *dentry)
+{
+        int ret;
+
+        dget(dentry);
+        ret = simple_unlink(dir, dentry);
+        d_delete(dentry);
+        dput(dentry);
+        return ret;
+}
+
+static int __rpc_rmpipe(struct inode *dir, struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+        struct rpc_inode *rpci = RPC_I(inode);
+
+        rpci->nkern_readwriters--;
+        if (rpci->nkern_readwriters != 0)
+                return 0;
+        rpc_close_pipes(inode);
+        return __rpc_unlink(dir, dentry);
+}
+
+static struct dentry *__rpc_lookup_create(struct dentry *parent,
+                                          struct qstr *name)
 {
-        struct inode *dir = parent->d_inode;
         struct dentry *dentry;
 
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        dentry = lookup_one_len(name, parent, len);
-        if (IS_ERR(dentry))
-                goto out_err;
+        dentry = d_lookup(parent, name);
+        if (!dentry) {
+                dentry = d_alloc(parent, name);
+                if (!dentry) {
+                        dentry = ERR_PTR(-ENOMEM);
+                        goto out_err;
+                }
+        }
         if (!dentry->d_inode)
                 dentry->d_op = &rpc_dentry_operations;
-        else if (exclusive) {
-                dput(dentry);
-                dentry = ERR_PTR(-EEXIST);
-                goto out_err;
-        }
-        return dentry;
 out_err:
-        mutex_unlock(&dir->i_mutex);
         return dentry;
 }
 
-static struct dentry *
-rpc_lookup_negative(char *path, struct nameidata *nd)
+static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
+                                          struct qstr *name)
 {
         struct dentry *dentry;
-        int error;
 
-        if ((error = rpc_lookup_parent(path, nd)) != 0)
-                return ERR_PTR(error);
-        dentry = rpc_lookup_create(nd->path.dentry, nd->last.name, nd->last.len,
-                                   1);
-        if (IS_ERR(dentry))
-                rpc_release_path(nd);
-        return dentry;
+        dentry = __rpc_lookup_create(parent, name);
+        if (dentry->d_inode == NULL)
+                return dentry;
+        dput(dentry);
+        return ERR_PTR(-EEXIST);
 }
 
-/**
- * rpc_mkdir - Create a new directory in rpc_pipefs
- * @path: path from the rpc_pipefs root to the new directory
- * @rpc_client: rpc client to associate with this directory
- *
- * This creates a directory at the given @path associated with
- * @rpc_clnt, which will contain a file named "info" with some basic
- * information about the client, together with any "pipes" that may
- * later be created using rpc_mkpipe().
+/*
+ * FIXME: This probably has races.
  */
-struct dentry *
-rpc_mkdir(char *path, struct rpc_clnt *rpc_client)
+static void __rpc_depopulate(struct dentry *parent,
+                             const struct rpc_filelist *files,
+                             int start, int eof)
 {
-        struct nameidata nd;
+        struct inode *dir = parent->d_inode;
         struct dentry *dentry;
-        struct inode *dir;
+        struct qstr name;
+        int i;
+
+        for (i = start; i < eof; i++) {
+                name.name = files[i].name;
+                name.len = strlen(files[i].name);
+                name.hash = full_name_hash(name.name, name.len);
+                dentry = d_lookup(parent, &name);
+
+                if (dentry == NULL)
+                        continue;
+                if (dentry->d_inode == NULL)
+                        goto next;
+                switch (dentry->d_inode->i_mode & S_IFMT) {
+                        default:
+                                BUG();
+                        case S_IFREG:
+                                __rpc_unlink(dir, dentry);
+                                break;
+                        case S_IFDIR:
+                                __rpc_rmdir(dir, dentry);
+                }
+next:
+                dput(dentry);
+        }
+}
+
+static void rpc_depopulate(struct dentry *parent,
+                           const struct rpc_filelist *files,
+                           int start, int eof)
+{
+        struct inode *dir = parent->d_inode;
+
+        mutex_lock_nested(&dir->i_mutex, I_MUTEX_CHILD);
+        __rpc_depopulate(parent, files, start, eof);
+        mutex_unlock(&dir->i_mutex);
+}
+
+static int rpc_populate(struct dentry *parent,
+                        const struct rpc_filelist *files,
+                        int start, int eof,
+                        void *private)
+{
+        struct inode *dir = parent->d_inode;
+        struct dentry *dentry;
+        int i, err;
+
+        mutex_lock(&dir->i_mutex);
+        for (i = start; i < eof; i++) {
+                struct qstr q;
+
+                q.name = files[i].name;
+                q.len = strlen(files[i].name);
+                q.hash = full_name_hash(q.name, q.len);
+                dentry = __rpc_lookup_create_exclusive(parent, &q);
+                err = PTR_ERR(dentry);
+                if (IS_ERR(dentry))
+                        goto out_bad;
+                switch (files[i].mode & S_IFMT) {
+                        default:
+                                BUG();
+                        case S_IFREG:
+                                err = __rpc_create(dir, dentry,
+                                                files[i].mode,
+                                                files[i].i_fop,
+                                                private);
+                                break;
+                        case S_IFDIR:
+                                err = __rpc_mkdir(dir, dentry,
+                                                files[i].mode,
+                                                NULL,
+                                                private);
+                }
+                if (err != 0)
+                        goto out_bad;
+        }
+        mutex_unlock(&dir->i_mutex);
+        return 0;
+out_bad:
+        __rpc_depopulate(parent, files, start, eof);
+        mutex_unlock(&dir->i_mutex);
+        printk(KERN_WARNING "%s: %s failed to populate directory %s\n",
+                        __FILE__, __func__, parent->d_name.name);
+        return err;
+}
+
+static struct dentry *rpc_mkdir_populate(struct dentry *parent,
+                struct qstr *name, umode_t mode, void *private,
+                int (*populate)(struct dentry *, void *), void *args_populate)
+{
+        struct dentry *dentry;
+        struct inode *dir = parent->d_inode;
         int error;
 
-        dentry = rpc_lookup_negative(path, &nd);
+        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        dentry = __rpc_lookup_create_exclusive(parent, name);
         if (IS_ERR(dentry))
-                return dentry;
-        dir = nd.path.dentry->d_inode;
-        if ((error = __rpc_mkdir(dir, dentry)) != 0)
-                goto err_dput;
-        RPC_I(dentry->d_inode)->private = rpc_client;
-        error = rpc_populate(dentry, authfiles,
-                        RPCAUTH_info, RPCAUTH_EOF);
-        if (error)
-                goto err_depopulate;
-        dget(dentry);
+                goto out;
+        error = __rpc_mkdir(dir, dentry, mode, NULL, private);
+        if (error != 0)
+                goto out_err;
+        if (populate != NULL) {
+                error = populate(dentry, args_populate);
+                if (error)
+                        goto err_rmdir;
+        }
 out:
         mutex_unlock(&dir->i_mutex);
-        rpc_release_path(&nd);
         return dentry;
-err_depopulate:
-        rpc_depopulate(dentry, RPCAUTH_info, RPCAUTH_EOF);
+err_rmdir:
         __rpc_rmdir(dir, dentry);
-err_dput:
-        dput(dentry);
-        printk(KERN_WARNING "%s: %s() failed to create directory %s (errno = %d)\n",
-                        __FILE__, __func__, path, error);
+out_err:
         dentry = ERR_PTR(error);
         goto out;
 }
 
-/**
- * rpc_rmdir - Remove a directory created with rpc_mkdir()
- * @dentry: directory to remove
- */
-int
-rpc_rmdir(struct dentry *dentry)
+static int rpc_rmdir_depopulate(struct dentry *dentry,
+                void (*depopulate)(struct dentry *))
 {
         struct dentry *parent;
         struct inode *dir;
@@ -748,9 +728,9 @@ rpc_rmdir(struct dentry *dentry)
         parent = dget_parent(dentry);
         dir = parent->d_inode;
         mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        rpc_depopulate(dentry, RPCAUTH_info, RPCAUTH_EOF);
+        if (depopulate != NULL)
+                depopulate(dentry);
         error = __rpc_rmdir(dir, dentry);
-        dput(dentry);
         mutex_unlock(&dir->i_mutex);
         dput(parent);
         return error;
@@ -776,50 +756,54 @@ rpc_rmdir(struct dentry *dentry)
  * The @private argument passed here will be available to all these methods
  * from the file pointer, via RPC_I(file->f_dentry->d_inode)->private.
  */
-struct dentry *
-rpc_mkpipe(struct dentry *parent, const char *name, void *private, struct rpc_pipe_ops *ops, int flags)
+struct dentry *rpc_mkpipe(struct dentry *parent, const char *name,
+                          void *private, const struct rpc_pipe_ops *ops,
+                          int flags)
 {
         struct dentry *dentry;
-        struct inode *dir, *inode;
-        struct rpc_inode *rpci;
+        struct inode *dir = parent->d_inode;
+        umode_t umode = S_IFIFO | S_IRUSR | S_IWUSR;
+        struct qstr q;
+        int err;
+
+        if (ops->upcall == NULL)
+                umode &= ~S_IRUGO;
+        if (ops->downcall == NULL)
+                umode &= ~S_IWUGO;
+
+        q.name = name;
+        q.len = strlen(name);
+        q.hash = full_name_hash(q.name, q.len),
 
-        dentry = rpc_lookup_create(parent, name, strlen(name), 0);
+        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        dentry = __rpc_lookup_create(parent, &q);
         if (IS_ERR(dentry))
-                return dentry;
-        dir = parent->d_inode;
+                goto out;
         if (dentry->d_inode) {
-                rpci = RPC_I(dentry->d_inode);
+                struct rpc_inode *rpci = RPC_I(dentry->d_inode);
                 if (rpci->private != private ||
                                 rpci->ops != ops ||
                                 rpci->flags != flags) {
                         dput (dentry);
-                        dentry = ERR_PTR(-EBUSY);
+                        err = -EBUSY;
+                        goto out_err;
                 }
                 rpci->nkern_readwriters++;
                 goto out;
         }
-        inode = rpc_get_inode(dir->i_sb, S_IFIFO | S_IRUSR | S_IWUSR);
-        if (!inode)
-                goto err_dput;
-        inode->i_ino = iunique(dir->i_sb, 100);
-        inode->i_fop = &rpc_pipe_fops;
-        d_instantiate(dentry, inode);
-        rpci = RPC_I(inode);
-        rpci->private = private;
-        rpci->flags = flags;
-        rpci->ops = ops;
-        rpci->nkern_readwriters = 1;
-        fsnotify_create(dir, dentry);
-        dget(dentry);
+
+        err = __rpc_mkpipe(dir, dentry, umode, &rpc_pipe_fops,
+                           private, ops, flags);
+        if (err)
+                goto out_err;
 out:
         mutex_unlock(&dir->i_mutex);
         return dentry;
-err_dput:
-        dput(dentry);
-        dentry = ERR_PTR(-ENOMEM);
+out_err:
+        dentry = ERR_PTR(err);
         printk(KERN_WARNING "%s: %s() failed to create pipe %s/%s (errno = %d)\n",
                         __FILE__, __func__, parent->d_name.name, name,
-                        -ENOMEM);
+                        err);
         goto out;
 }
 EXPORT_SYMBOL_GPL(rpc_mkpipe);
@@ -842,19 +826,107 @@ rpc_unlink(struct dentry *dentry)
         parent = dget_parent(dentry);
         dir = parent->d_inode;
         mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
-        if (--RPC_I(dentry->d_inode)->nkern_readwriters == 0) {
-                rpc_close_pipes(dentry->d_inode);
-                error = simple_unlink(dir, dentry);
-                if (!error)
-                        d_delete(dentry);
-        }
-        dput(dentry);
+        error = __rpc_rmpipe(dir, dentry);
         mutex_unlock(&dir->i_mutex);
         dput(parent);
         return error;
 }
 EXPORT_SYMBOL_GPL(rpc_unlink);
 
+enum {
+        RPCAUTH_info,
+        RPCAUTH_EOF
+};
+
+static const struct rpc_filelist authfiles[] = {
+        [RPCAUTH_info] = {
+                .name = "info",
+                .i_fop = &rpc_info_operations,
+                .mode = S_IFREG | S_IRUSR,
+        },
+};
+
+static int rpc_clntdir_populate(struct dentry *dentry, void *private)
+{
+        return rpc_populate(dentry,
+                            authfiles, RPCAUTH_info, RPCAUTH_EOF,
+                            private);
+}
+
+static void rpc_clntdir_depopulate(struct dentry *dentry)
+{
+        rpc_depopulate(dentry, authfiles, RPCAUTH_info, RPCAUTH_EOF);
+}
+
+/**
+ * rpc_create_client_dir - Create a new rpc_client directory in rpc_pipefs
+ * @path: path from the rpc_pipefs root to the new directory
+ * @rpc_client: rpc client to associate with this directory
+ *
+ * This creates a directory at the given @path associated with
+ * @rpc_clnt, which will contain a file named "info" with some basic
+ * information about the client, together with any "pipes" that may
+ * later be created using rpc_mkpipe().
+ */
+struct dentry *rpc_create_client_dir(struct dentry *dentry,
+                                   struct qstr *name,
+                                   struct rpc_clnt *rpc_client)
+{
+        return rpc_mkdir_populate(dentry, name, S_IRUGO | S_IXUGO, NULL,
+                        rpc_clntdir_populate, rpc_client);
+}
+
+/**
+ * rpc_remove_client_dir - Remove a directory created with rpc_create_client_dir()
+ * @dentry: directory to remove
+ */
+int rpc_remove_client_dir(struct dentry *dentry)
+{
+        return rpc_rmdir_depopulate(dentry, rpc_clntdir_depopulate);
+}
+
+static const struct rpc_filelist cache_pipefs_files[3] = {
+        [0] = {
+                .name = "channel",
+                .i_fop = &cache_file_operations_pipefs,
+                .mode = S_IFREG|S_IRUSR|S_IWUSR,
+        },
+        [1] = {
+                .name = "content",
+                .i_fop = &content_file_operations_pipefs,
+                .mode = S_IFREG|S_IRUSR,
+        },
+        [2] = {
+                .name = "flush",
+                .i_fop = &cache_flush_operations_pipefs,
+                .mode = S_IFREG|S_IRUSR|S_IWUSR,
+        },
+};
+
+static int rpc_cachedir_populate(struct dentry *dentry, void *private)
+{
+        return rpc_populate(dentry,
+                            cache_pipefs_files, 0, 3,
+                            private);
+}
+
+static void rpc_cachedir_depopulate(struct dentry *dentry)
+{
+        rpc_depopulate(dentry, cache_pipefs_files, 0, 3);
+}
+
+struct dentry *rpc_create_cache_dir(struct dentry *parent, struct qstr *name,
+                                    mode_t umode, struct cache_detail *cd)
+{
+        return rpc_mkdir_populate(parent, name, umode, NULL,
+                        rpc_cachedir_populate, cd);
+}
+
+void rpc_remove_cache_dir(struct dentry *dentry)
+{
+        rpc_rmdir_depopulate(dentry, rpc_cachedir_depopulate);
+}
+
 /*
  * populate the filesystem
  */
@@ -866,6 +938,51 @@ static struct super_operations s_ops = {
 
 #define RPCAUTH_GSSMAGIC 0x67596969
 
+/*
+ * We have a single directory with 1 node in it.
+ */
+enum {
+        RPCAUTH_lockd,
+        RPCAUTH_mount,
+        RPCAUTH_nfs,
+        RPCAUTH_portmap,
+        RPCAUTH_statd,
+        RPCAUTH_nfsd4_cb,
+        RPCAUTH_cache,
+        RPCAUTH_RootEOF
+};
+
+static const struct rpc_filelist files[] = {
+        [RPCAUTH_lockd] = {
+                .name = "lockd",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+        [RPCAUTH_mount] = {
+                .name = "mount",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+        [RPCAUTH_nfs] = {
+                .name = "nfs",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+        [RPCAUTH_portmap] = {
+                .name = "portmap",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+        [RPCAUTH_statd] = {
+                .name = "statd",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+        [RPCAUTH_nfsd4_cb] = {
+                .name = "nfsd4_cb",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+        [RPCAUTH_cache] = {
+                .name = "cache",
+                .mode = S_IFDIR | S_IRUGO | S_IXUGO,
+        },
+};
+
 static int
 rpc_fill_super(struct super_block *sb, void *data, int silent)
 {
@@ -886,7 +1003,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
                 iput(inode);
                 return -ENOMEM;
         }
-        if (rpc_populate(root, files, RPCAUTH_Root + 1, RPCAUTH_RootEOF))
+        if (rpc_populate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF, NULL))
                 goto out;
         sb->s_root = root;
         return 0;
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index beee6da33035..830faf4d9997 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -75,6 +75,37 @@ enum {
 #define RPCB_OWNER_STRING       "0"
 #define RPCB_MAXOWNERLEN        sizeof(RPCB_OWNER_STRING)
 
+/*
+ * XDR data type sizes
+ */
+#define RPCB_program_sz         (1)
+#define RPCB_version_sz         (1)
+#define RPCB_protocol_sz        (1)
+#define RPCB_port_sz            (1)
+#define RPCB_boolean_sz         (1)
+
+#define RPCB_netid_sz           (1 + XDR_QUADLEN(RPCBIND_MAXNETIDLEN))
+#define RPCB_addr_sz            (1 + XDR_QUADLEN(RPCBIND_MAXUADDRLEN))
+#define RPCB_ownerstring_sz     (1 + XDR_QUADLEN(RPCB_MAXOWNERLEN))
+
+/*
+ * XDR argument and result sizes
+ */
+#define RPCB_mappingargs_sz     (RPCB_program_sz + RPCB_version_sz + \
+                                RPCB_protocol_sz + RPCB_port_sz)
+#define RPCB_getaddrargs_sz     (RPCB_program_sz + RPCB_version_sz + \
+                                RPCB_netid_sz + RPCB_addr_sz + \
+                                RPCB_ownerstring_sz)
+
+#define RPCB_getportres_sz      RPCB_port_sz
+#define RPCB_setres_sz          RPCB_boolean_sz
+
+/*
+ * Note that RFC 1833 does not put any size restrictions on the
+ * address string returned by the remote rpcbind database.
+ */
+#define RPCB_getaddrres_sz      RPCB_addr_sz
+
 static void                     rpcb_getport_done(struct rpc_task *, void *);
 static void                     rpcb_map_release(void *data);
 static struct rpc_program       rpcb_program;
@@ -122,6 +153,7 @@ static void rpcb_map_release(void *data)
 
         rpcb_wake_rpcbind_waiters(map->r_xprt, map->r_status);
         xprt_put(map->r_xprt);
+        kfree(map->r_addr);
         kfree(map);
 }
 
@@ -268,12 +300,9 @@ static int rpcb_register_inet4(const struct sockaddr *sap,
         const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
         struct rpcbind_args *map = msg->rpc_argp;
         unsigned short port = ntohs(sin->sin_port);
-        char buf[32];
+        int result;
 
-        /* Construct AF_INET universal address */
-        snprintf(buf, sizeof(buf), "%pI4.%u.%u",
-                 &sin->sin_addr.s_addr, port >> 8, port & 0xff);
-        map->r_addr = buf;
+        map->r_addr = rpc_sockaddr2uaddr(sap);
 
         dprintk("RPC:       %sregistering [%u, %u, %s, '%s'] with "
                 "local rpcbind\n", (port ? "" : "un"),
@@ -284,7 +313,9 @@ static int rpcb_register_inet4(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        return rpcb_register_call(RPCBVERS_4, msg);
+        result = rpcb_register_call(RPCBVERS_4, msg);
+        kfree(map->r_addr);
+        return result;
 }
 
 /*
@@ -296,16 +327,9 @@ static int rpcb_register_inet6(const struct sockaddr *sap,
         const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)sap;
         struct rpcbind_args *map = msg->rpc_argp;
         unsigned short port = ntohs(sin6->sin6_port);
-        char buf[64];
+        int result;
 
-        /* Construct AF_INET6 universal address */
-        if (ipv6_addr_any(&sin6->sin6_addr))
-                snprintf(buf, sizeof(buf), "::.%u.%u",
-                                port >> 8, port & 0xff);
-        else
-                snprintf(buf, sizeof(buf), "%pI6.%u.%u",
-                         &sin6->sin6_addr, port >> 8, port & 0xff);
-        map->r_addr = buf;
+        map->r_addr = rpc_sockaddr2uaddr(sap);
 
         dprintk("RPC:       %sregistering [%u, %u, %s, '%s'] with "
                 "local rpcbind\n", (port ? "" : "un"),
@@ -316,7 +340,9 @@ static int rpcb_register_inet6(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        return rpcb_register_call(RPCBVERS_4, msg);
+        result = rpcb_register_call(RPCBVERS_4, msg);
+        kfree(map->r_addr);
+        return result;
 }
 
 static int rpcb_unregister_all_protofamilies(struct rpc_message *msg)
@@ -428,7 +454,7 @@ int rpcb_getport_sync(struct sockaddr_in *sin, u32 prog, u32 vers, int prot)
         struct rpc_message msg = {
                 .rpc_proc       = &rpcb_procedures2[RPCBPROC_GETPORT],
                 .rpc_argp       = &map,
-                .rpc_resp       = &map.r_port,
+                .rpc_resp       = &map,
         };
         struct rpc_clnt *rpcb_clnt;
         int status;
@@ -458,7 +484,7 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
         struct rpc_message msg = {
                 .rpc_proc = proc,
                 .rpc_argp = map,
-                .rpc_resp = &map->r_port,
+                .rpc_resp = map,
         };
         struct rpc_task_setup task_setup_data = {
                 .rpc_client = rpcb_clnt,
@@ -539,6 +565,7 @@ void rpcb_getport_async(struct rpc_task *task)
                 goto bailout_nofree;
         }
 
+        /* Parent transport's destination address */
         salen = rpc_peeraddr(clnt, sap, sizeof(addr));
 
         /* Don't ever use rpcbind v2 for AF_INET6 requests */
@@ -589,11 +616,22 @@ void rpcb_getport_async(struct rpc_task *task)
         map->r_prot = xprt->prot;
         map->r_port = 0;
         map->r_xprt = xprt_get(xprt);
-        map->r_netid = rpc_peeraddr2str(clnt, RPC_DISPLAY_NETID);
-        map->r_addr = rpc_peeraddr2str(rpcb_clnt, RPC_DISPLAY_UNIVERSAL_ADDR);
-        map->r_owner = "";
         map->r_status = -EIO;
 
+        switch (bind_version) {
+        case RPCBVERS_4:
+        case RPCBVERS_3:
+                map->r_netid = rpc_peeraddr2str(clnt, RPC_DISPLAY_NETID);
+                map->r_addr = rpc_sockaddr2uaddr(sap);
+                map->r_owner = "";
+                break;
+        case RPCBVERS_2:
+                map->r_addr = NULL;
+                break;
+        default:
+                BUG();
+        }
+
         child = rpcb_call_async(rpcb_clnt, map, proc);
         rpc_release_client(rpcb_clnt);
         if (IS_ERR(child)) {
@@ -656,176 +694,278 @@ static void rpcb_getport_done(struct rpc_task *child, void *data)
  * XDR functions for rpcbind
  */
 
-static int rpcb_encode_mapping(struct rpc_rqst *req, __be32 *p,
-                               struct rpcbind_args *rpcb)
+static int rpcb_enc_mapping(struct rpc_rqst *req, __be32 *p,
+                            const struct rpcbind_args *rpcb)
 {
-        dprintk("RPC:       encoding rpcb request (%u, %u, %d, %u)\n",
+        struct rpc_task *task = req->rq_task;
+        struct xdr_stream xdr;
+
+        dprintk("RPC: %5u encoding PMAP_%s call (%u, %u, %d, %u)\n",
+                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
                         rpcb->r_prog, rpcb->r_vers, rpcb->r_prot, rpcb->r_port);
+
+        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
+
+        p = xdr_reserve_space(&xdr, sizeof(__be32) * RPCB_mappingargs_sz);
+        if (unlikely(p == NULL))
+                return -EIO;
+
         *p++ = htonl(rpcb->r_prog);
         *p++ = htonl(rpcb->r_vers);
         *p++ = htonl(rpcb->r_prot);
-        *p++ = htonl(rpcb->r_port);
+        *p   = htonl(rpcb->r_port);
 
-        req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
         return 0;
 }
 
-static int rpcb_decode_getport(struct rpc_rqst *req, __be32 *p,
-                               unsigned short *portp)
+static int rpcb_dec_getport(struct rpc_rqst *req, __be32 *p,
+                            struct rpcbind_args *rpcb)
 {
-        *portp = (unsigned short) ntohl(*p++);
-        dprintk("RPC:       rpcb getport result: %u\n",
-                        *portp);
+        struct rpc_task *task = req->rq_task;
+        struct xdr_stream xdr;
+        unsigned long port;
+
+        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
+
+        rpcb->r_port = 0;
+
+        p = xdr_inline_decode(&xdr, sizeof(__be32));
+        if (unlikely(p == NULL))
+                return -EIO;
+
+        port = ntohl(*p);
+        dprintk("RPC: %5u PMAP_%s result: %lu\n", task->tk_pid,
+                        task->tk_msg.rpc_proc->p_name, port);
+        if (unlikely(port > USHORT_MAX))
+                return -EIO;
+
+        rpcb->r_port = port;
         return 0;
 }
 
-static int rpcb_decode_set(struct rpc_rqst *req, __be32 *p,
-                           unsigned int *boolp)
+static int rpcb_dec_set(struct rpc_rqst *req, __be32 *p,
+                        unsigned int *boolp)
 {
-        *boolp = (unsigned int) ntohl(*p++);
-        dprintk("RPC:       rpcb set/unset call %s\n",
+        struct rpc_task *task = req->rq_task;
+        struct xdr_stream xdr;
+
+        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
+
+        p = xdr_inline_decode(&xdr, sizeof(__be32));
+        if (unlikely(p == NULL))
+                return -EIO;
+
+        *boolp = 0;
+        if (*p)
+                *boolp = 1;
+
+        dprintk("RPC: %5u RPCB_%s call %s\n",
+                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
                         (*boolp ? "succeeded" : "failed"));
         return 0;
 }
 
-static int rpcb_encode_getaddr(struct rpc_rqst *req, __be32 *p,
-                               struct rpcbind_args *rpcb)
+static int encode_rpcb_string(struct xdr_stream *xdr, const char *string,
+                                const u32 maxstrlen)
 {
-        dprintk("RPC:       encoding rpcb request (%u, %u, %s)\n",
-                        rpcb->r_prog, rpcb->r_vers, rpcb->r_addr);
-        *p++ = htonl(rpcb->r_prog);
-        *p++ = htonl(rpcb->r_vers);
+        u32 len;
+        __be32 *p;
 
-        p = xdr_encode_string(p, rpcb->r_netid);
-        p = xdr_encode_string(p, rpcb->r_addr);
-        p = xdr_encode_string(p, rpcb->r_owner);
+        if (unlikely(string == NULL))
+                return -EIO;
+        len = strlen(string);
+        if (unlikely(len > maxstrlen))
+                return -EIO;
 
-        req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
+        p = xdr_reserve_space(xdr, sizeof(__be32) + len);
+        if (unlikely(p == NULL))
+                return -EIO;
+        xdr_encode_opaque(p, string, len);
 
         return 0;
 }
 
-static int rpcb_decode_getaddr(struct rpc_rqst *req, __be32 *p,
-                               unsigned short *portp)
+static int rpcb_enc_getaddr(struct rpc_rqst *req, __be32 *p,
+                            const struct rpcbind_args *rpcb)
 {
-        char *addr;
-        u32 addr_len;
-        int c, i, f, first, val;
+        struct rpc_task *task = req->rq_task;
+        struct xdr_stream xdr;
 
-        *portp = 0;
-        addr_len = ntohl(*p++);
+        dprintk("RPC: %5u encoding RPCB_%s call (%u, %u, '%s', '%s')\n",
+                        task->tk_pid, task->tk_msg.rpc_proc->p_name,
+                        rpcb->r_prog, rpcb->r_vers,
+                        rpcb->r_netid, rpcb->r_addr);
 
-        if (addr_len == 0) {
-                dprintk("RPC:       rpcb_decode_getaddr: "
-                                        "service is not registered\n");
-                return 0;
-        }
+        xdr_init_encode(&xdr, &req->rq_snd_buf, p);
 
-        /*
-         * Simple sanity check.
-         */
-        if (addr_len > RPCBIND_MAXUADDRLEN)
-                goto out_err;
-
-        /*
-         * Start at the end and walk backwards until the first dot
-         * is encountered.  When the second dot is found, we have
-         * both parts of the port number.
-         */
-        addr = (char *)p;
-        val = 0;
-        first = 1;
-        f = 1;
-        for (i = addr_len - 1; i > 0; i--) {
-                c = addr[i];
-                if (c >= '0' && c <= '9') {
-                        val += (c - '0') * f;
-                        f *= 10;
-                } else if (c == '.') {
-                        if (first) {
-                                *portp = val;
-                                val = first = 0;
-                                f = 1;
-                        } else {
-                                *portp |= (val << 8);
-                                break;
-                        }
-                }
-        }
+        p = xdr_reserve_space(&xdr,
+                        sizeof(__be32) * (RPCB_program_sz + RPCB_version_sz));
+        if (unlikely(p == NULL))
+                return -EIO;
+        *p++ = htonl(rpcb->r_prog);
+        *p = htonl(rpcb->r_vers);
 
-        /*
-         * Simple sanity check.  If we never saw a dot in the reply,
-         * then this was probably just garbage.
-         */
-        if (first)
-                goto out_err;
+        if (encode_rpcb_string(&xdr, rpcb->r_netid, RPCBIND_MAXNETIDLEN))
+                return -EIO;
+        if (encode_rpcb_string(&xdr, rpcb->r_addr, RPCBIND_MAXUADDRLEN))
+                return -EIO;
+        if (encode_rpcb_string(&xdr, rpcb->r_owner, RPCB_MAXOWNERLEN))
+                return -EIO;
 
-        dprintk("RPC:       rpcb_decode_getaddr port=%u\n", *portp);
         return 0;
-
-out_err:
-        dprintk("RPC:       rpcbind server returned malformed reply\n");
-        return -EIO;
 }
 
-#define RPCB_program_sz         (1u)
-#define RPCB_version_sz         (1u)
-#define RPCB_protocol_sz        (1u)
-#define RPCB_port_sz            (1u)
-#define RPCB_boolean_sz         (1u)
+static int rpcb_dec_getaddr(struct rpc_rqst *req, __be32 *p,
+                            struct rpcbind_args *rpcb)
+{
+        struct sockaddr_storage address;
+        struct sockaddr *sap = (struct sockaddr *)&address;
+        struct rpc_task *task = req->rq_task;
+        struct xdr_stream xdr;
+        u32 len;
 
-#define RPCB_netid_sz           (1+XDR_QUADLEN(RPCBIND_MAXNETIDLEN))
-#define RPCB_addr_sz            (1+XDR_QUADLEN(RPCBIND_MAXUADDRLEN))
-#define RPCB_ownerstring_sz     (1+XDR_QUADLEN(RPCB_MAXOWNERLEN))
+        rpcb->r_port = 0;
 
-#define RPCB_mappingargs_sz     RPCB_program_sz+RPCB_version_sz+        \
-                                RPCB_protocol_sz+RPCB_port_sz
-#define RPCB_getaddrargs_sz     RPCB_program_sz+RPCB_version_sz+        \
-                                RPCB_netid_sz+RPCB_addr_sz+             \
-                                RPCB_ownerstring_sz
+        xdr_init_decode(&xdr, &req->rq_rcv_buf, p);
 
-#define RPCB_setres_sz          RPCB_boolean_sz
-#define RPCB_getportres_sz      RPCB_port_sz
-
-/*
- * Note that RFC 1833 does not put any size restrictions on the
- * address string returned by the remote rpcbind database.
- */
-#define RPCB_getaddrres_sz      RPCB_addr_sz
+        p = xdr_inline_decode(&xdr, sizeof(__be32));
+        if (unlikely(p == NULL))
+                goto out_fail;
+        len = ntohl(*p);
 
-#define PROC(proc, argtype, restype)                                    \
-        [RPCBPROC_##proc] = {                                           \
-                .p_proc         = RPCBPROC_##proc,                      \
-                .p_encode       = (kxdrproc_t) rpcb_encode_##argtype,   \
-                .p_decode       = (kxdrproc_t) rpcb_decode_##restype,   \
-                .p_arglen       = RPCB_##argtype##args_sz,              \
-                .p_replen       = RPCB_##restype##res_sz,               \
-                .p_statidx      = RPCBPROC_##proc,                      \
-                .p_timer        = 0,                                    \
-                .p_name         = #proc,                                \
+        /*
+         * If the returned universal address is a null string,
+         * the requested RPC service was not registered.
+         */
+        if (len == 0) {
+                dprintk("RPC: %5u RPCB reply: program not registered\n",
+                                task->tk_pid);
+                return 0;
         }
 
+        if (unlikely(len > RPCBIND_MAXUADDRLEN))
+                goto out_fail;
+
+        p = xdr_inline_decode(&xdr, len);
+        if (unlikely(p == NULL))
+                goto out_fail;
+        dprintk("RPC: %5u RPCB_%s reply: %s\n", task->tk_pid,
+                        task->tk_msg.rpc_proc->p_name, (char *)p);
+
+        if (rpc_uaddr2sockaddr((char *)p, len, sap, sizeof(address)) == 0)
+                goto out_fail;
+        rpcb->r_port = rpc_get_port(sap);
+
+        return 0;
+
+out_fail:
+        dprintk("RPC: %5u malformed RPCB_%s reply\n",
+                        task->tk_pid, task->tk_msg.rpc_proc->p_name);
+        return -EIO;
+}
+
 /*
  * Not all rpcbind procedures described in RFC 1833 are implemented
  * since the Linux kernel RPC code requires only these.
  */
+
 static struct rpc_procinfo rpcb_procedures2[] = {
-        PROC(SET,               mapping,        set),
-        PROC(UNSET,             mapping,        set),
-        PROC(GETPORT,           mapping,        getport),
+        [RPCBPROC_SET] = {
+                .p_proc         = RPCBPROC_SET,
+                .p_encode       = (kxdrproc_t)rpcb_enc_mapping,
+                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_arglen       = RPCB_mappingargs_sz,
+                .p_replen       = RPCB_setres_sz,
+                .p_statidx      = RPCBPROC_SET,
+                .p_timer        = 0,
+                .p_name         = "SET",
+        },
+        [RPCBPROC_UNSET] = {
+                .p_proc         = RPCBPROC_UNSET,
+                .p_encode       = (kxdrproc_t)rpcb_enc_mapping,
+                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_arglen       = RPCB_mappingargs_sz,
+                .p_replen       = RPCB_setres_sz,
+                .p_statidx      = RPCBPROC_UNSET,
+                .p_timer        = 0,
+                .p_name         = "UNSET",
+        },
+        [RPCBPROC_GETPORT] = {
+                .p_proc         = RPCBPROC_GETPORT,
+                .p_encode       = (kxdrproc_t)rpcb_enc_mapping,
+                .p_decode       = (kxdrproc_t)rpcb_dec_getport,
+                .p_arglen       = RPCB_mappingargs_sz,
+                .p_replen       = RPCB_getportres_sz,
+                .p_statidx      = RPCBPROC_GETPORT,
+                .p_timer        = 0,
+                .p_name         = "GETPORT",
+        },
 };
 
 static struct rpc_procinfo rpcb_procedures3[] = {
-        PROC(SET,               getaddr,        set),
-        PROC(UNSET,             getaddr,        set),
-        PROC(GETADDR,           getaddr,        getaddr),
+        [RPCBPROC_SET] = {
+                .p_proc         = RPCBPROC_SET,
+                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_arglen       = RPCB_getaddrargs_sz,
+                .p_replen       = RPCB_setres_sz,
+                .p_statidx      = RPCBPROC_SET,
+                .p_timer        = 0,
+                .p_name         = "SET",
+        },
+        [RPCBPROC_UNSET] = {
+                .p_proc         = RPCBPROC_UNSET,
+                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_arglen       = RPCB_getaddrargs_sz,
+                .p_replen       = RPCB_setres_sz,
+                .p_statidx      = RPCBPROC_UNSET,
+                .p_timer        = 0,
+                .p_name         = "UNSET",
+        },
+        [RPCBPROC_GETADDR] = {
+                .p_proc         = RPCBPROC_GETADDR,
+                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_decode       = (kxdrproc_t)rpcb_dec_getaddr,
+                .p_arglen       = RPCB_getaddrargs_sz,
+                .p_replen       = RPCB_getaddrres_sz,
+                .p_statidx      = RPCBPROC_GETADDR,
+                .p_timer        = 0,
+                .p_name         = "GETADDR",
+        },
 };
 
 static struct rpc_procinfo rpcb_procedures4[] = {
-        PROC(SET,               getaddr,        set),
-        PROC(UNSET,             getaddr,        set),
-        PROC(GETADDR,           getaddr,        getaddr),
-        PROC(GETVERSADDR,       getaddr,        getaddr),
+        [RPCBPROC_SET] = {
+                .p_proc         = RPCBPROC_SET,
+                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_arglen       = RPCB_getaddrargs_sz,
+                .p_replen       = RPCB_setres_sz,
+                .p_statidx      = RPCBPROC_SET,
+                .p_timer        = 0,
+                .p_name         = "SET",
+        },
+        [RPCBPROC_UNSET] = {
+                .p_proc         = RPCBPROC_UNSET,
+                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_decode       = (kxdrproc_t)rpcb_dec_set,
+                .p_arglen       = RPCB_getaddrargs_sz,
+                .p_replen       = RPCB_setres_sz,
+                .p_statidx      = RPCBPROC_UNSET,
+                .p_timer        = 0,
+                .p_name         = "UNSET",
+        },
+        [RPCBPROC_GETADDR] = {
+                .p_proc         = RPCBPROC_GETADDR,
+                .p_encode       = (kxdrproc_t)rpcb_enc_getaddr,
+                .p_decode       = (kxdrproc_t)rpcb_dec_getaddr,
+                .p_arglen       = RPCB_getaddrargs_sz,
+                .p_replen       = RPCB_getaddrres_sz,
+                .p_statidx      = RPCBPROC_GETADDR,
+                .p_timer        = 0,
+                .p_name         = "GETADDR",
+        },
 };
 
 static struct rpcb_info rpcb_next_version[] = {
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 1102ce1251f7..8f459abe97cf 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -16,7 +16,6 @@
 #include <linux/slab.h>
 #include <linux/mempool.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 843629f55763..8cce92189019 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -66,7 +66,8 @@ cleanup_sunrpc(void)
 #ifdef CONFIG_PROC_FS
         rpc_proc_exit();
 #endif
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 MODULE_LICENSE("GPL");
-module_init(init_sunrpc);
+fs_initcall(init_sunrpc); /* Ensure we're initialised before nfs */
 module_exit(cleanup_sunrpc);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 6f33d33cc064..27d44332f017 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -5,6 +5,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/freezer.h>
 #include <linux/kthread.h>
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 799ff6ef28b8..117f68a8aa40 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -171,6 +171,11 @@ static void ip_map_request(struct cache_detail *cd,
         (*bpp)[-1] = '\n';
 }
 
+static int ip_map_upcall(struct cache_detail *cd, struct cache_head *h)
+{
+        return sunrpc_cache_pipe_upcall(cd, h, ip_map_request);
+}
+
 static struct ip_map *ip_map_lookup(char *class, struct in6_addr *addr);
 static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t expiry);
 
@@ -289,7 +294,7 @@ struct cache_detail ip_map_cache = {
         .hash_table     = ip_table,
         .name           = "auth.unix.ip",
         .cache_put      = ip_map_put,
-        .cache_request  = ip_map_request,
+        .cache_upcall   = ip_map_upcall,
         .cache_parse    = ip_map_parse,
         .cache_show     = ip_map_show,
         .match          = ip_map_match,
@@ -523,6 +528,11 @@ static void unix_gid_request(struct cache_detail *cd,
         (*bpp)[-1] = '\n';
 }
 
+static int unix_gid_upcall(struct cache_detail *cd, struct cache_head *h)
+{
+        return sunrpc_cache_pipe_upcall(cd, h, unix_gid_request);
+}
+
 static struct unix_gid *unix_gid_lookup(uid_t uid);
 extern struct cache_detail unix_gid_cache;
 
@@ -622,7 +632,7 @@ struct cache_detail unix_gid_cache = {
         .hash_table     = gid_table,
         .name           = "auth.unix.gid",
         .cache_put      = unix_gid_put,
-        .cache_request  = unix_gid_request,
+        .cache_upcall   = unix_gid_upcall,
         .cache_parse    = unix_gid_parse,
         .cache_show     = unix_gid_show,
         .match          = unix_gid_match,
diff --git a/net/sunrpc/timer.c b/net/sunrpc/timer.c
index 31becbf09263..dd824341c349 100644
--- a/net/sunrpc/timer.c
+++ b/net/sunrpc/timer.c
@@ -25,8 +25,13 @@
 #define RPC_RTO_INIT (HZ/5)
 #define RPC_RTO_MIN (HZ/10)
 
-void
-rpc_init_rtt(struct rpc_rtt *rt, unsigned long timeo)
+/**
+ * rpc_init_rtt - Initialize an RPC RTT estimator context
+ * @rt: context to initialize
+ * @timeo: initial timeout value, in jiffies
+ *
+ */
+void rpc_init_rtt(struct rpc_rtt *rt, unsigned long timeo)
 {
         unsigned long init = 0;
         unsigned i;
@@ -43,12 +48,16 @@ rpc_init_rtt(struct rpc_rtt *rt, unsigned long timeo)
 }
 EXPORT_SYMBOL_GPL(rpc_init_rtt);
 
-/*
+/**
+ * rpc_update_rtt - Update an RPC RTT estimator context
+ * @rt: context to update
+ * @timer: timer array index (request type)
+ * @m: recent actual RTT, in jiffies
+ *
  * NB: When computing the smoothed RTT and standard deviation,
  *     be careful not to produce negative intermediate results.
  */
-void
-rpc_update_rtt(struct rpc_rtt *rt, unsigned timer, long m)
+void rpc_update_rtt(struct rpc_rtt *rt, unsigned timer, long m)
 {
         long *srtt, *sdrtt;
 
@@ -79,21 +88,25 @@ rpc_update_rtt(struct rpc_rtt *rt, unsigned timer, long m)
 }
 EXPORT_SYMBOL_GPL(rpc_update_rtt);
 
-/*
- * Estimate rto for an nfs rpc sent via. an unreliable datagram.
- * Use the mean and mean deviation of rtt for the appropriate type of rpc
- * for the frequent rpcs and a default for the others.
- * The justification for doing "other" this way is that these rpcs
- * happen so infrequently that timer est. would probably be stale.
- * Also, since many of these rpcs are
- * non-idempotent, a conservative timeout is desired.
+/**
+ * rpc_calc_rto - Provide an estimated timeout value
+ * @rt: context to use for calculation
+ * @timer: timer array index (request type)
+ *
+ * Estimate RTO for an NFS RPC sent via an unreliable datagram.  Use
+ * the mean and mean deviation of RTT for the appropriate type of RPC
+ * for frequently issued RPCs, and a fixed default for the others.
+ *
+ * The justification for doing "other" this way is that these RPCs
+ * happen so infrequently that timer estimation would probably be
+ * stale.  Also, since many of these RPCs are non-idempotent, a
+ * conservative timeout is desired.
+ *
  * getattr, lookup,
  * read, write, commit     - A+4D
  * other                   - timeo
  */
-
-unsigned long
-rpc_calc_rto(struct rpc_rtt *rt, unsigned timer)
+unsigned long rpc_calc_rto(struct rpc_rtt *rt, unsigned timer)
 {
         unsigned long res;
 
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 406e26de584e..8bd690c48b69 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -24,7 +24,7 @@ xdr_encode_netobj(__be32 *p, const struct xdr_netobj *obj)
         unsigned int    quadlen = XDR_QUADLEN(obj->len);
 
         p[quadlen] = 0;         /* zero trailing bytes */
-        *p++ = htonl(obj->len);
+        *p++ = cpu_to_be32(obj->len);
         memcpy(p, obj->data, obj->len);
         return p + XDR_QUADLEN(obj->len);
 }
@@ -35,7 +35,7 @@ xdr_decode_netobj(__be32 *p, struct xdr_netobj *obj)
 {
         unsigned int    len;
 
-        if ((len = ntohl(*p++)) > XDR_MAX_NETOBJ)
+        if ((len = be32_to_cpu(*p++)) > XDR_MAX_NETOBJ)
                 return NULL;
         obj->len  = len;
         obj->data = (u8 *) p;
@@ -83,7 +83,7 @@ EXPORT_SYMBOL_GPL(xdr_encode_opaque_fixed);
  */
 __be32 *xdr_encode_opaque(__be32 *p, const void *ptr, unsigned int nbytes)
 {
-        *p++ = htonl(nbytes);
+        *p++ = cpu_to_be32(nbytes);
         return xdr_encode_opaque_fixed(p, ptr, nbytes);
 }
 EXPORT_SYMBOL_GPL(xdr_encode_opaque);
@@ -101,7 +101,7 @@ xdr_decode_string_inplace(__be32 *p, char **sp,
 {
         u32 len;
 
-        len = ntohl(*p++);
+        len = be32_to_cpu(*p++);
         if (len > maxlen)
                 return NULL;
         *lenp = len;
@@ -771,7 +771,7 @@ xdr_decode_word(struct xdr_buf *buf, unsigned int base, u32 *obj)
         status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
         if (status)
                 return status;
-        *obj = ntohl(raw);
+        *obj = be32_to_cpu(raw);
         return 0;
 }
 EXPORT_SYMBOL_GPL(xdr_decode_word);
@@ -779,7 +779,7 @@ EXPORT_SYMBOL_GPL(xdr_decode_word);
 int
 xdr_encode_word(struct xdr_buf *buf, unsigned int base, u32 obj)
 {
-        __be32  raw = htonl(obj);
+        __be32  raw = cpu_to_be32(obj);
 
         return write_bytes_to_xdr_buf(buf, base, &raw, sizeof(obj));
 }
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 1dd6123070e9..9a63f669ece4 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -168,47 +168,25 @@ static struct rpc_xprt_ops xprt_rdma_procs;	/* forward reference */
 static void
 xprt_rdma_format_addresses(struct rpc_xprt *xprt)
 {
-        struct sockaddr_in *addr = (struct sockaddr_in *)
+        struct sockaddr *sap = (struct sockaddr *)
                                         &rpcx_to_rdmad(xprt).addr;
-        char *buf;
+        struct sockaddr_in *sin = (struct sockaddr_in *)sap;
+        char buf[64];
 
-        buf = kzalloc(20, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 20, "%pI4", &addr->sin_addr.s_addr);
-        xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
+        (void)rpc_ntop(sap, buf, sizeof(buf));
+        xprt->address_strings[RPC_DISPLAY_ADDR] = kstrdup(buf, GFP_KERNEL);
 
-        buf = kzalloc(8, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 8, "%u", ntohs(addr->sin_port));
-        xprt->address_strings[RPC_DISPLAY_PORT] = buf;
+        (void)snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
+        xprt->address_strings[RPC_DISPLAY_PORT] = kstrdup(buf, GFP_KERNEL);
 
         xprt->address_strings[RPC_DISPLAY_PROTO] = "rdma";
 
-        buf = kzalloc(48, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 48, "addr=%pI4 port=%u proto=%s",
-                        &addr->sin_addr.s_addr,
-                        ntohs(addr->sin_port), "rdma");
-        xprt->address_strings[RPC_DISPLAY_ALL] = buf;
-
-        buf = kzalloc(10, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 10, "%02x%02x%02x%02x",
-                        NIPQUAD(addr->sin_addr.s_addr));
-        xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = buf;
-
-        buf = kzalloc(8, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 8, "%4hx", ntohs(addr->sin_port));
-        xprt->address_strings[RPC_DISPLAY_HEX_PORT] = buf;
-
-        buf = kzalloc(30, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 30, "%pI4.%u.%u",
-                        &addr->sin_addr.s_addr,
-                        ntohs(addr->sin_port) >> 8,
-                        ntohs(addr->sin_port) & 0xff);
-        xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
+        (void)snprintf(buf, sizeof(buf), "%02x%02x%02x%02x",
+                                NIPQUAD(sin->sin_addr.s_addr));
+        xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = kstrdup(buf, GFP_KERNEL);
+
+        (void)snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
+        xprt->address_strings[RPC_DISPLAY_HEX_PORT] = kstrdup(buf, GFP_KERNEL);
 
         /* netid */
         xprt->address_strings[RPC_DISPLAY_NETID] = "rdma";
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 83c73c4d017a..62438f3a914d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -248,8 +248,8 @@ struct sock_xprt {
          * Connection of transports
          */
         struct delayed_work     connect_worker;
-        struct sockaddr_storage addr;
-        unsigned short          port;
+        struct sockaddr_storage srcaddr;
+        unsigned short          srcport;
 
         /*
          * UDP socket buffer size parameters
@@ -296,117 +296,60 @@ static inline struct sockaddr_in6 *xs_addr_in6(struct rpc_xprt *xprt)
         return (struct sockaddr_in6 *) &xprt->addr;
 }
 
-static void xs_format_ipv4_peer_addresses(struct rpc_xprt *xprt,
-                                          const char *protocol,
-                                          const char *netid)
+static void xs_format_common_peer_addresses(struct rpc_xprt *xprt)
 {
-        struct sockaddr_in *addr = xs_addr_in(xprt);
-        char *buf;
+        struct sockaddr *sap = xs_addr(xprt);
+        struct sockaddr_in6 *sin6;
+        struct sockaddr_in *sin;
+        char buf[128];
 
-        buf = kzalloc(20, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 20, "%pI4", &addr->sin_addr.s_addr);
-        }
-        xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
-
-        buf = kzalloc(8, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 8, "%u",
-                                ntohs(addr->sin_port));
-        }
-        xprt->address_strings[RPC_DISPLAY_PORT] = buf;
-
-        xprt->address_strings[RPC_DISPLAY_PROTO] = protocol;
-
-        buf = kzalloc(48, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 48, "addr=%pI4 port=%u proto=%s",
-                        &addr->sin_addr.s_addr,
-                        ntohs(addr->sin_port),
-                        protocol);
-        }
-        xprt->address_strings[RPC_DISPLAY_ALL] = buf;
-
-        buf = kzalloc(10, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 10, "%02x%02x%02x%02x",
-                                NIPQUAD(addr->sin_addr.s_addr));
-        }
-        xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = buf;
+        (void)rpc_ntop(sap, buf, sizeof(buf));
+        xprt->address_strings[RPC_DISPLAY_ADDR] = kstrdup(buf, GFP_KERNEL);
 
-        buf = kzalloc(8, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 8, "%4hx",
-                                ntohs(addr->sin_port));
-        }
-        xprt->address_strings[RPC_DISPLAY_HEX_PORT] = buf;
-
-        buf = kzalloc(30, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 30, "%pI4.%u.%u",
-                                &addr->sin_addr.s_addr,
-                                ntohs(addr->sin_port) >> 8,
-                                ntohs(addr->sin_port) & 0xff);
+        switch (sap->sa_family) {
+        case AF_INET:
+                sin = xs_addr_in(xprt);
+                (void)snprintf(buf, sizeof(buf), "%02x%02x%02x%02x",
+                                        NIPQUAD(sin->sin_addr.s_addr));
+                break;
+        case AF_INET6:
+                sin6 = xs_addr_in6(xprt);
+                (void)snprintf(buf, sizeof(buf), "%pi6", &sin6->sin6_addr);
+                break;
+        default:
+                BUG();
         }
-        xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
-
-        xprt->address_strings[RPC_DISPLAY_NETID] = netid;
+        xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = kstrdup(buf, GFP_KERNEL);
 }
 
-static void xs_format_ipv6_peer_addresses(struct rpc_xprt *xprt,
-                                          const char *protocol,
-                                          const char *netid)
+static void xs_format_common_peer_ports(struct rpc_xprt *xprt)
 {
-        struct sockaddr_in6 *addr = xs_addr_in6(xprt);
-        char *buf;
+        struct sockaddr *sap = xs_addr(xprt);
+        char buf[128];
 
-        buf = kzalloc(40, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 40, "%pI6",&addr->sin6_addr);
-        }
-        xprt->address_strings[RPC_DISPLAY_ADDR] = buf;
+        (void)snprintf(buf, sizeof(buf), "%u", rpc_get_port(sap));
+        xprt->address_strings[RPC_DISPLAY_PORT] = kstrdup(buf, GFP_KERNEL);
 
-        buf = kzalloc(8, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 8, "%u",
-                                ntohs(addr->sin6_port));
-        }
-        xprt->address_strings[RPC_DISPLAY_PORT] = buf;
+        (void)snprintf(buf, sizeof(buf), "%4hx", rpc_get_port(sap));
+        xprt->address_strings[RPC_DISPLAY_HEX_PORT] = kstrdup(buf, GFP_KERNEL);
+}
 
+static void xs_format_peer_addresses(struct rpc_xprt *xprt,
+                                     const char *protocol,
+                                     const char *netid)
+{
         xprt->address_strings[RPC_DISPLAY_PROTO] = protocol;
+        xprt->address_strings[RPC_DISPLAY_NETID] = netid;
+        xs_format_common_peer_addresses(xprt);
+        xs_format_common_peer_ports(xprt);
+}
 
-        buf = kzalloc(64, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 64, "addr=%pI6 port=%u proto=%s",
-                                &addr->sin6_addr,
-                                ntohs(addr->sin6_port),
-                                protocol);
-        }
-        xprt->address_strings[RPC_DISPLAY_ALL] = buf;
-
-        buf = kzalloc(36, GFP_KERNEL);
-        if (buf)
-                snprintf(buf, 36, "%pi6", &addr->sin6_addr);
-
-        xprt->address_strings[RPC_DISPLAY_HEX_ADDR] = buf;
-
-        buf = kzalloc(8, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 8, "%4hx",
-                                ntohs(addr->sin6_port));
-        }
-        xprt->address_strings[RPC_DISPLAY_HEX_PORT] = buf;
-
-        buf = kzalloc(50, GFP_KERNEL);
-        if (buf) {
-                snprintf(buf, 50, "%pI6.%u.%u",
-                         &addr->sin6_addr,
-                         ntohs(addr->sin6_port) >> 8,
-                         ntohs(addr->sin6_port) & 0xff);
-        }
-        xprt->address_strings[RPC_DISPLAY_UNIVERSAL_ADDR] = buf;
+static void xs_update_peer_port(struct rpc_xprt *xprt)
+{
+        kfree(xprt->address_strings[RPC_DISPLAY_HEX_PORT]);
+        kfree(xprt->address_strings[RPC_DISPLAY_PORT]);
 
-        xprt->address_strings[RPC_DISPLAY_NETID] = netid;
+        xs_format_common_peer_ports(xprt);
 }
 
 static void xs_free_peer_addresses(struct rpc_xprt *xprt)
@@ -1587,25 +1530,15 @@ static unsigned short xs_get_random_port(void)
  */
 static void xs_set_port(struct rpc_xprt *xprt, unsigned short port)
 {
-        struct sockaddr *addr = xs_addr(xprt);
-
         dprintk("RPC:       setting port for xprt %p to %u\n", xprt, port);
 
-        switch (addr->sa_family) {
-        case AF_INET:
-                ((struct sockaddr_in *)addr)->sin_port = htons(port);
-                break;
-        case AF_INET6:
-                ((struct sockaddr_in6 *)addr)->sin6_port = htons(port);
-                break;
-        default:
-                BUG();
-        }
+        rpc_set_port(xs_addr(xprt), port);
+        xs_update_peer_port(xprt);
 }
 
 static unsigned short xs_get_srcport(struct sock_xprt *transport, struct socket *sock)
 {
-        unsigned short port = transport->port;
+        unsigned short port = transport->srcport;
 
         if (port == 0 && transport->xprt.resvport)
                 port = xs_get_random_port();
@@ -1614,8 +1547,8 @@ static unsigned short xs_get_srcport(struct sock_xprt *transport, struct socket
 
 static unsigned short xs_next_srcport(struct sock_xprt *transport, struct socket *sock, unsigned short port)
 {
-        if (transport->port != 0)
-                transport->port = 0;
+        if (transport->srcport != 0)
+                transport->srcport = 0;
         if (!transport->xprt.resvport)
                 return 0;
         if (port <= xprt_min_resvport || port > xprt_max_resvport)
@@ -1633,7 +1566,7 @@ static int xs_bind4(struct sock_xprt *transport, struct socket *sock)
         unsigned short port = xs_get_srcport(transport, sock);
         unsigned short last;
 
-        sa = (struct sockaddr_in *)&transport->addr;
+        sa = (struct sockaddr_in *)&transport->srcaddr;
         myaddr.sin_addr = sa->sin_addr;
         do {
                 myaddr.sin_port = htons(port);
@@ -1642,7 +1575,7 @@ static int xs_bind4(struct sock_xprt *transport, struct socket *sock)
                 if (port == 0)
                         break;
                 if (err == 0) {
-                        transport->port = port;
+                        transport->srcport = port;
                         break;
                 }
                 last = port;
@@ -1666,7 +1599,7 @@ static int xs_bind6(struct sock_xprt *transport, struct socket *sock)
         unsigned short port = xs_get_srcport(transport, sock);
         unsigned short last;
 
-        sa = (struct sockaddr_in6 *)&transport->addr;
+        sa = (struct sockaddr_in6 *)&transport->srcaddr;
         myaddr.sin6_addr = sa->sin6_addr;
         do {
                 myaddr.sin6_port = htons(port);
@@ -1675,7 +1608,7 @@ static int xs_bind6(struct sock_xprt *transport, struct socket *sock)
                 if (port == 0)
                         break;
                 if (err == 0) {
-                        transport->port = port;
+                        transport->srcport = port;
                         break;
                 }
                 last = port;
@@ -1780,8 +1713,11 @@ static void xs_udp_connect_worker4(struct work_struct *work)
                 goto out;
         }
 
-        dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                        xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+        dprintk("RPC:       worker connecting xprt %p via %s to "
+                                "%s (port %s)\n", xprt,
+                        xprt->address_strings[RPC_DISPLAY_PROTO],
+                        xprt->address_strings[RPC_DISPLAY_ADDR],
+                        xprt->address_strings[RPC_DISPLAY_PORT]);
 
         xs_udp_finish_connecting(xprt, sock);
         status = 0;
@@ -1822,8 +1758,11 @@ static void xs_udp_connect_worker6(struct work_struct *work)
                 goto out;
         }
 
-        dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                        xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+        dprintk("RPC:       worker connecting xprt %p via %s to "
+                                "%s (port %s)\n", xprt,
+                        xprt->address_strings[RPC_DISPLAY_PROTO],
+                        xprt->address_strings[RPC_DISPLAY_ADDR],
+                        xprt->address_strings[RPC_DISPLAY_PORT]);
 
         xs_udp_finish_connecting(xprt, sock);
         status = 0;
@@ -1948,8 +1887,11 @@ static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
                         goto out_eagain;
         }
 
-        dprintk("RPC:       worker connecting xprt %p to address: %s\n",
-                        xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
+        dprintk("RPC:       worker connecting xprt %p via %s to "
+                                "%s (port %s)\n", xprt,
+                        xprt->address_strings[RPC_DISPLAY_PROTO],
+                        xprt->address_strings[RPC_DISPLAY_ADDR],
+                        xprt->address_strings[RPC_DISPLAY_PORT]);
 
         status = xs_tcp_finish_connecting(xprt, sock);
         dprintk("RPC:       %p connect status %d connected %d sock state %d\n",
@@ -2120,7 +2062,7 @@ static void xs_udp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
 
         seq_printf(seq, "\txprt:\tudp %u %lu %lu %lu %lu %Lu %Lu\n",
-                        transport->port,
+                        transport->srcport,
                         xprt->stat.bind_count,
                         xprt->stat.sends,
                         xprt->stat.recvs,
@@ -2144,7 +2086,7 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                 idle_time = (long)(jiffies - xprt->last_used) / HZ;
 
         seq_printf(seq, "\txprt:\ttcp %u %lu %lu %lu %ld %lu %lu %lu %Lu %Lu\n",
-                        transport->port,
+                        transport->srcport,
                         xprt->stat.bind_count,
                         xprt->stat.connect_count,
                         xprt->stat.connect_time,
@@ -2223,7 +2165,7 @@ static struct rpc_xprt *xs_setup_xprt(struct xprt_create *args,
         memcpy(&xprt->addr, args->dstaddr, args->addrlen);
         xprt->addrlen = args->addrlen;
         if (args->srcaddr)
-                memcpy(&new->addr, args->srcaddr, args->addrlen);
+                memcpy(&new->srcaddr, args->srcaddr, args->addrlen);
 
         return xprt;
 }
@@ -2272,7 +2214,7 @@ static struct rpc_xprt *xs_setup_udp(struct xprt_create *args)
 
                 INIT_DELAYED_WORK(&transport->connect_worker,
                                         xs_udp_connect_worker4);
-                xs_format_ipv4_peer_addresses(xprt, "udp", RPCBIND_NETID_UDP);
+                xs_format_peer_addresses(xprt, "udp", RPCBIND_NETID_UDP);
                 break;
         case AF_INET6:
                 if (((struct sockaddr_in6 *)addr)->sin6_port != htons(0))
@@ -2280,15 +2222,22 @@ static struct rpc_xprt *xs_setup_udp(struct xprt_create *args)
 
                 INIT_DELAYED_WORK(&transport->connect_worker,
                                         xs_udp_connect_worker6);
-                xs_format_ipv6_peer_addresses(xprt, "udp", RPCBIND_NETID_UDP6);
+                xs_format_peer_addresses(xprt, "udp", RPCBIND_NETID_UDP6);
                 break;
         default:
                 kfree(xprt);
                 return ERR_PTR(-EAFNOSUPPORT);
         }
 
-        dprintk("RPC:       set up transport to address %s\n",
-                        xprt->address_strings[RPC_DISPLAY_ALL]);
+        if (xprt_bound(xprt))
+                dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PORT],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+        else
+                dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
 
         if (try_module_get(THIS_MODULE))
                 return xprt;
@@ -2337,23 +2286,33 @@ static struct rpc_xprt *xs_setup_tcp(struct xprt_create *args)
                 if (((struct sockaddr_in *)addr)->sin_port != htons(0))
                         xprt_set_bound(xprt);
 
-                INIT_DELAYED_WORK(&transport->connect_worker, xs_tcp_connect_worker4);
-                xs_format_ipv4_peer_addresses(xprt, "tcp", RPCBIND_NETID_TCP);
+                INIT_DELAYED_WORK(&transport->connect_worker,
+                                        xs_tcp_connect_worker4);
+                xs_format_peer_addresses(xprt, "tcp", RPCBIND_NETID_TCP);
                 break;
         case AF_INET6:
                 if (((struct sockaddr_in6 *)addr)->sin6_port != htons(0))
                         xprt_set_bound(xprt);
 
-                INIT_DELAYED_WORK(&transport->connect_worker, xs_tcp_connect_worker6);
-                xs_format_ipv6_peer_addresses(xprt, "tcp", RPCBIND_NETID_TCP6);
+                INIT_DELAYED_WORK(&transport->connect_worker,
+                                        xs_tcp_connect_worker6);
+                xs_format_peer_addresses(xprt, "tcp", RPCBIND_NETID_TCP6);
                 break;
         default:
                 kfree(xprt);
                 return ERR_PTR(-EAFNOSUPPORT);
         }
 
-        dprintk("RPC:       set up transport to address %s\n",
-                        xprt->address_strings[RPC_DISPLAY_ALL]);
+        if (xprt_bound(xprt))
+                dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PORT],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+        else
+                dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+
 
         if (try_module_get(THIS_MODULE))
                 return xprt;
@@ -2412,3 +2371,55 @@ void cleanup_socket_xprt(void)
         xprt_unregister_transport(&xs_udp_transport);
         xprt_unregister_transport(&xs_tcp_transport);
 }
+
+static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
+                unsigned int min, unsigned int max)
+{
+        unsigned long num;
+        int ret;
+
+        if (!val)
+                return -EINVAL;
+        ret = strict_strtoul(val, 0, &num);
+        if (ret == -EINVAL || num < min || num > max)
+                return -EINVAL;
+        *((unsigned int *)kp->arg) = num;
+        return 0;
+}
+
+static int param_set_portnr(const char *val, struct kernel_param *kp)
+{
+        return param_set_uint_minmax(val, kp,
+                        RPC_MIN_RESVPORT,
+                        RPC_MAX_RESVPORT);
+}
+
+static int param_get_portnr(char *buffer, struct kernel_param *kp)
+{
+        return param_get_uint(buffer, kp);
+}
+#define param_check_portnr(name, p) \
+        __param_check(name, p, unsigned int);
+
+module_param_named(min_resvport, xprt_min_resvport, portnr, 0644);
+module_param_named(max_resvport, xprt_max_resvport, portnr, 0644);
+
+static int param_set_slot_table_size(const char *val, struct kernel_param *kp)
+{
+        return param_set_uint_minmax(val, kp,
+                        RPC_MIN_SLOT_TABLE,
+                        RPC_MAX_SLOT_TABLE);
+}
+
+static int param_get_slot_table_size(char *buffer, struct kernel_param *kp)
+{
+        return param_get_uint(buffer, kp);
+}
+#define param_check_slot_table_size(name, p) \
+        __param_check(name, p, unsigned int);
+
+module_param_named(tcp_slot_table_entries, xprt_tcp_slot_table_entries,
+                   slot_table_size, 0644);
+module_param_named(udp_slot_table_entries, xprt_udp_slot_table_entries,
+                   slot_table_size, 0644);
+
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 36d4e44d6233..fc3ebb906911 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -315,7 +315,7 @@ static void unix_write_space(struct sock *sk)
 {
         read_lock(&sk->sk_callback_lock);
         if (unix_writable(sk)) {
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
+                if (sk_has_sleeper(sk))
                         wake_up_interruptible_sync(sk->sk_sleep);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
@@ -1985,7 +1985,7 @@ static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table
         struct sock *sk = sock->sk;
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* exceptional events? */
@@ -2022,7 +2022,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk, *other;
         unsigned int mask, writable;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk->sk_sleep, wait);
         mask = 0;
 
         /* exceptional events? */
@@ -2053,7 +2053,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
                 other = unix_peer_get(sk);
                 if (other) {
                         if (unix_peer(other) != sk) {
-                                poll_wait(file, &unix_sk(other)->peer_wait,
+                                sock_poll_wait(file, &unix_sk(other)->peer_wait,
                                           wait);
                                 if (unix_recvq_full(other))
                                         writable = 0;
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 466e2d22d256..258daa80ad92 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -48,6 +48,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>       /* support for loadable modules */
 #include <linux/slab.h>         /* kmalloc(), kfree() */
+#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/string.h>       /* inline mem*, str* functions */
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 241bddd0b4f1..634496b3ed77 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -447,6 +447,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         rdev = __cfg80211_drv_from_info(info);
         if (IS_ERR(rdev)) {
+                mutex_unlock(&cfg80211_mutex);
                 result = PTR_ERR(rdev);
                 goto unlock;
         }
@@ -996,7 +997,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
         if (IS_ERR(hdr)) {
                 err = PTR_ERR(hdr);
-                goto out;
+                goto free_msg;
         }
 
         cookie.msg = msg;
@@ -1010,7 +1011,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                                 &cookie, get_key_callback);
 
         if (err)
-                goto out;
+                goto free_msg;
 
         if (cookie.error)
                 goto nla_put_failure;
@@ -1021,6 +1022,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 
  nla_put_failure:
         err = -ENOBUFS;
+ free_msg:
         nlmsg_free(msg);
  out:
         cfg80211_put_dev(drv);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..75a406d33619 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1089,17 +1089,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
 
         chan->beacon_found = true;
 
+        if (wiphy->disable_beacon_hints)
+                return;
+
         chan_before.center_freq = chan->center_freq;
         chan_before.flags = chan->flags;
 
-        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
-            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
                 chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
                 channel_changed = true;
         }
 
-        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
-            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
                 chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
                 channel_changed = true;
         }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..4e167a8e11be 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
  * non-radar 5 GHz channels.
  *
  * Drivers do not need to call this, cfg80211 will do it for after a scan
- * on a newly found BSS.
+ * on a newly found BSS. If you cannot make use of this feature you can
+ * set the wiphy->disable_beacon_hints to true.
  */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                         struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e95b638b919f..7e595ce24eeb 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -35,8 +35,6 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         else
                 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
 
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
-
 #ifdef CONFIG_WIRELESS_EXT
         if (!aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
@@ -48,6 +46,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         dev_put(dev);
 
  out:
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
         kfree(request);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
@@ -119,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 
         if (!ie1 && !ie2)
                 return 0;
-        if (!ie1)
+        if (!ie1 || !ie2)
                 return -1;
 
         r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -172,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
         ie = find_ie(WLAN_EID_MESH_CONFIG,
                      a->information_elements,
                      a->len_information_elements);
+        if (!ie)
+                return false;
         if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
                 return false;
 
@@ -366,7 +367,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         found = rb_find_bss(dev, res);
 
         if (found) {
-                kref_get(&found->ref);
                 found->pub.beacon_interval = res->pub.beacon_interval;
                 found->pub.tsf = res->pub.tsf;
                 found->pub.signal = res->pub.signal;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 21cdc872004e..5e6c072c64d3 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -40,6 +40,7 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
+#include <linux/smp_lock.h>
 #include <linux/timer.h>
 #include <linux/string.h>
 #include <linux/net.h>
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index d31ccb487730..faf54c6bf96b 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -292,8 +292,8 @@ static struct xfrm_algo_desc ealg_list[] = {
         }
 },
 {
-        .name = "cbc(cast128)",
-        .compat = "cast128",
+        .name = "cbc(cast5)",
+        .compat = "cast5",
 
         .uinfo = {
                 .encr = {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5f1f86565f16..f2f7c638083e 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -668,22 +668,10 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *d
         hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
                 if (x->props.family != family ||
                     x->id.spi       != spi ||
-                    x->id.proto     != proto)
+                    x->id.proto     != proto ||
+                    xfrm_addr_cmp(&x->id.daddr, daddr, family))
                         continue;
 
-                switch (family) {
-                case AF_INET:
-                        if (x->id.daddr.a4 != daddr->a4)
-                                continue;
-                        break;
-                case AF_INET6:
-                        if (!ipv6_addr_equal((struct in6_addr *)daddr,
-                                             (struct in6_addr *)
-                                             x->id.daddr.a6))
-                                continue;
-                        break;
-                }
-
                 xfrm_state_hold(x);
                 return x;
         }
@@ -699,26 +687,11 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, xfrm_addre
 
         hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
                 if (x->props.family != family ||
-                    x->id.proto     != proto)
+                    x->id.proto     != proto ||
+                    xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
+                    xfrm_addr_cmp(&x->props.saddr, saddr, family))
                         continue;
 
-                switch (family) {
-                case AF_INET:
-                        if (x->id.daddr.a4 != daddr->a4 ||
-                            x->props.saddr.a4 != saddr->a4)
-                                continue;
-                        break;
-                case AF_INET6:
-                        if (!ipv6_addr_equal((struct in6_addr *)daddr,
-                                             (struct in6_addr *)
-                                             x->id.daddr.a6) ||
-                            !ipv6_addr_equal((struct in6_addr *)saddr,
-                                             (struct in6_addr *)
-                                             x->props.saddr.a6))
-                                continue;
-                        break;
-                }
-
                 xfrm_state_hold(x);
                 return x;
         }
@@ -1001,25 +974,11 @@ static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family
                     x->props.family != family ||
                     x->km.state     != XFRM_STATE_ACQ ||
                     x->id.spi       != 0 ||
-                    x->id.proto     != proto)
+                    x->id.proto     != proto ||
+                    xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
+                    xfrm_addr_cmp(&x->props.saddr, saddr, family))
                         continue;
 
-                switch (family) {
-                case AF_INET:
-                        if (x->id.daddr.a4    != daddr->a4 ||
-                            x->props.saddr.a4 != saddr->a4)
-                                continue;
-                        break;
-                case AF_INET6:
-                        if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
-                                             (struct in6_addr *)daddr) ||
-                            !ipv6_addr_equal((struct in6_addr *)
-                                             x->props.saddr.a6,
-                                             (struct in6_addr *)saddr))
-                                continue;
-                        break;
-                }
-
                 xfrm_state_hold(x);
                 return x;
         }