33 files changed, 413 insertions, 218 deletions

diff --git a/net/802/fddi.c b/net/802/fddi.c
index f1611a1e06a7..539e6064e6d4 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -215,3 +215,5 @@ struct net_device *alloc_fddidev(int sizeof_priv)
         return alloc_netdev(sizeof_priv, "fddi%d", fddi_setup);
 }
 EXPORT_SYMBOL(alloc_fddidev);
+
+MODULE_LICENSE("GPL");
diff --git a/net/Kconfig b/net/Kconfig
index ec93e7e38b38..ce77db4fcec8 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -140,7 +140,7 @@ config NETFILTER_ADVANCED
         default y
         help
           If you say Y here you can select between all the netfilter modules.
-          If you say N the more ununsual ones will not be shown and the
+          If you say N the more unusual ones will not be shown and the
           basic ones needed by most people will default to 'M'.
 
           If unsure, say Y.
diff --git a/net/core/dev.c b/net/core/dev.c
index 52fea5b28ca6..91d792d17e09 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2472,8 +2472,9 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
                 return GRO_NORMAL;
 
         for (p = napi->gro_list; p; p = p->next) {
-                NAPI_GRO_CB(p)->same_flow = !compare_ether_header(
-                        skb_mac_header(p), skb_gro_mac_header(skb));
+                NAPI_GRO_CB(p)->same_flow = (p->dev == skb->dev)
+                        && !compare_ether_header(skb_mac_header(p),
+                                                 skb_gro_mac_header(skb));
                 NAPI_GRO_CB(p)->flush = 0;
         }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 244ca56dffac..d9d5160610d5 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -261,8 +261,7 @@ static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
         ret = 0;
 
 err_out:
-        if (rule_buf)
-                kfree(rule_buf);
+        kfree(rule_buf);
 
         return ret;
 }
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 35c5f6a5cb7c..5ba533d234db 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -253,7 +253,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
 
-        rcu_read_lock();
+        rcu_read_lock_bh();
         private = rcu_dereference(table->private);
         table_base = rcu_dereference(private->entries[smp_processor_id()]);
 
@@ -329,7 +329,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                 }
         } while (!hotdrop);
 
-        rcu_read_unlock();
+        rcu_read_unlock_bh();
 
         if (hotdrop)
                 return NF_DROP;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 82ee7c9049ff..810c0b62c7d4 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -339,7 +339,7 @@ ipt_do_table(struct sk_buff *skb,
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 
-        rcu_read_lock();
+        rcu_read_lock_bh();
         private = rcu_dereference(table->private);
         table_base = rcu_dereference(private->entries[smp_processor_id()]);
 
@@ -437,7 +437,7 @@ ipt_do_table(struct sk_buff *skb,
                 }
         } while (!hotdrop);
 
-        rcu_read_unlock();
+        rcu_read_unlock_bh();
 
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2451aeb5ac23..fafbec8b073e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1081,8 +1081,7 @@ out_err:
  *      this, no blocking and very strange errors 8)
  */
 
-static int tcp_recv_urg(struct sock *sk, long timeo,
-                        struct msghdr *msg, int len, int flags)
+static int tcp_recv_urg(struct sock *sk, struct msghdr *msg, int len, int flags)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -1697,7 +1696,7 @@ out:
         return err;
 
 recv_urg:
-        err = tcp_recv_urg(sk, timeo, msg, len, flags);
+        err = tcp_recv_urg(sk, msg, len, flags);
         goto out;
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index c1f259d2d33b..53300fa2359f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -754,6 +754,36 @@ static void tcp_adjust_fackets_out(struct sock *sk, struct sk_buff *skb,
                 tp->fackets_out -= decr;
 }
 
+/* Pcount in the middle of the write queue got changed, we need to do various
+ * tweaks to fix counters
+ */
+static void tcp_adjust_pcount(struct sock *sk, struct sk_buff *skb, int decr)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        tp->packets_out -= decr;
+
+        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
+                tp->sacked_out -= decr;
+        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
+                tp->retrans_out -= decr;
+        if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
+                tp->lost_out -= decr;
+
+        /* Reno case is special. Sigh... */
+        if (tcp_is_reno(tp) && decr > 0)
+                tp->sacked_out -= min_t(u32, tp->sacked_out, decr);
+
+        tcp_adjust_fackets_out(sk, skb, decr);
+
+        if (tp->lost_skb_hint &&
+            before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
+            (tcp_is_fack(tp) || TCP_SKB_CB(skb)->sacked))
+                tp->lost_cnt_hint -= decr;
+
+        tcp_verify_left_out(tp);
+}
+
 /* Function to create two new TCP segments.  Shrinks the given segment
  * to the specified size and appends a new segment with the rest of the
  * packet to the list.  This won't be called frequently, I hope.
@@ -836,28 +866,8 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
                 int diff = old_factor - tcp_skb_pcount(skb) -
                         tcp_skb_pcount(buff);
 
-                tp->packets_out -= diff;
-
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
-                        tp->sacked_out -= diff;
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
-                        tp->retrans_out -= diff;
-
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST)
-                        tp->lost_out -= diff;
-
-                /* Adjust Reno SACK estimate. */
-                if (tcp_is_reno(tp) && diff > 0) {
-                        tcp_dec_pcount_approx_int(&tp->sacked_out, diff);
-                        tcp_verify_left_out(tp);
-                }
-                tcp_adjust_fackets_out(sk, skb, diff);
-
-                if (tp->lost_skb_hint &&
-                    before(TCP_SKB_CB(skb)->seq,
-                           TCP_SKB_CB(tp->lost_skb_hint)->seq) &&
-                    (tcp_is_fack(tp) || TCP_SKB_CB(skb)->sacked))
-                        tp->lost_cnt_hint -= diff;
+                if (diff)
+                        tcp_adjust_pcount(sk, skb, diff);
         }
 
         /* Link BUFF into the send queue. */
@@ -1768,22 +1778,14 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
          * packet counting does not break.
          */
         TCP_SKB_CB(skb)->sacked |= TCP_SKB_CB(next_skb)->sacked & TCPCB_EVER_RETRANS;
-        if (TCP_SKB_CB(next_skb)->sacked & TCPCB_SACKED_RETRANS)
-                tp->retrans_out -= tcp_skb_pcount(next_skb);
-        if (TCP_SKB_CB(next_skb)->sacked & TCPCB_LOST)
-                tp->lost_out -= tcp_skb_pcount(next_skb);
-        /* Reno case is special. Sigh... */
-        if (tcp_is_reno(tp) && tp->sacked_out)
-                tcp_dec_pcount_approx(&tp->sacked_out, next_skb);
-
-        tcp_adjust_fackets_out(sk, next_skb, tcp_skb_pcount(next_skb));
-        tp->packets_out -= tcp_skb_pcount(next_skb);
 
         /* changed transmit queue under us so clear hints */
         tcp_clear_retrans_hints_partial(tp);
         if (next_skb == tp->retransmit_skb_hint)
                 tp->retransmit_skb_hint = skb;
 
+        tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));
+
         sk_wmem_free_skb(sk, next_skb);
 }
 
@@ -1891,7 +1893,12 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                         return -ENOMEM; /* We'll try again later. */
         } else {
-                tcp_init_tso_segs(sk, skb, cur_mss);
+                int oldpcount = tcp_skb_pcount(skb);
+
+                if (unlikely(oldpcount > 1)) {
+                        tcp_init_tso_segs(sk, skb, cur_mss);
+                        tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
+                }
         }
 
         tcp_retrans_try_collapse(sk, skb, cur_mss);
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index ec992159b5f8..ca8cb326d1d2 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -22,17 +22,17 @@ menuconfig IPV6
 if IPV6
 
 config IPV6_PRIVACY
-        bool "IPv6: Privacy Extensions support"
+        bool "IPv6: Privacy Extensions (RFC 3041) support"
         ---help---
           Privacy Extensions for Stateless Address Autoconfiguration in IPv6
-          support.  With this option, additional periodically-alter 
-          pseudo-random global-scope unicast address(es) will assigned to
+          support.  With this option, additional periodically-altered
+          pseudo-random global-scope unicast address(es) will be assigned to
           your interface(s).
         
-          We use our standard pseudo random algorithm to generate randomized
-          interface identifier, instead of one described in RFC 3041.
+          We use our standard pseudo-random algorithm to generate the
+          randomized interface identifier, instead of one described in RFC 3041.
 
-          By default, kernel do not generate temporary addresses.
+          By default the kernel does not generate temporary addresses.
           To use temporary addresses, do
         
                 echo 2 >/proc/sys/net/ipv6/conf/all/use_tempaddr 
@@ -43,9 +43,9 @@ config IPV6_ROUTER_PREF
         bool "IPv6: Router Preference (RFC 4191) support"
         ---help---
           Router Preference is an optional extension to the Router
-          Advertisement message to improve the ability of hosts
-          to pick more appropriate router, especially when the hosts
-          is placed in a multi-homed network.
+          Advertisement message which improves the ability of hosts
+          to pick an appropriate router, especially when the hosts
+          are placed in a multi-homed network.
 
           If unsure, say N.
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e89cfa3a8f25..dfed176aed37 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -365,7 +365,7 @@ ip6t_do_table(struct sk_buff *skb,
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 
-        rcu_read_lock();
+        rcu_read_lock_bh();
         private = rcu_dereference(table->private);
         table_base = rcu_dereference(private->entries[smp_processor_id()]);
 
@@ -466,7 +466,7 @@ ip6t_do_table(struct sk_buff *skb,
 #ifdef CONFIG_NETFILTER_DEBUG
         ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;
 #endif
-        rcu_read_unlock();
+        rcu_read_unlock_bh();
 
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 0af823cf7f1f..5ee5a031bc93 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -72,6 +72,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
 #endif
 
         skb->protocol = htons(ETH_P_IPV6);
+        skb->local_df = 1;
 
         return x->outer_mode->output2(x, skb);
 }
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 60c16162474c..f3d9ae350fb6 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -33,7 +33,7 @@ choice
         ---help---
           This option selects the default rate control algorithm
           mac80211 will use. Note that this default can still be
-          overriden through the ieee80211_default_rc_algo module
+          overridden through the ieee80211_default_rc_algo module
           parameter if different algorithms are available.
 
 config MAC80211_RC_DEFAULT_PID
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 2c967e4f706c..bb279bf59a1b 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -52,7 +52,7 @@ config NF_CT_ACCT
 
           Please note that currently this option only sets a default state.
           You may change it at boot time with nf_conntrack.acct=0/1 kernel
-          paramater or by loading the nf_conntrack module with acct=0/1.
+          parameter or by loading the nf_conntrack module with acct=0/1.
 
           You may also disable/enable it on a running system with:
            sysctl net.netfilter.nf_conntrack_acct=0/1
diff --git a/net/phonet/Kconfig b/net/phonet/Kconfig
index 51a5669573f2..6ec7d55b1769 100644
--- a/net/phonet/Kconfig
+++ b/net/phonet/Kconfig
@@ -6,7 +6,7 @@ config PHONET
         tristate "Phonet protocols family"
         help
           The Phone Network protocol (PhoNet) is a packet-oriented
-          communication protocol developped by Nokia for use with its modems.
+          communication protocol developed by Nokia for use with its modems.
 
           This is required for Maemo to use cellular data connectivity (if
           supported). It can also be used to control Nokia phones
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 06a7b798d9a7..4933b380985e 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -51,6 +51,7 @@ MODULE_PARM_DESC(fmr_message_size, " Max size of a RDMA transfer");
 
 struct list_head rds_ib_devices;
 
+/* NOTE: if also grabbing ibdev lock, grab this first */
 DEFINE_SPINLOCK(ib_nodev_conns_lock);
 LIST_HEAD(ib_nodev_conns);
 
@@ -137,7 +138,7 @@ void rds_ib_remove_one(struct ib_device *device)
                 kfree(i_ipaddr);
         }
 
-        rds_ib_remove_conns(rds_ibdev);
+        rds_ib_destroy_conns(rds_ibdev);
 
         if (rds_ibdev->mr_pool)
                 rds_ib_destroy_mr_pool(rds_ibdev->mr_pool);
@@ -249,7 +250,7 @@ static int rds_ib_laddr_check(__be32 addr)
 void rds_ib_exit(void)
 {
         rds_info_deregister_func(RDS_INFO_IB_CONNECTIONS, rds_ib_ic_info);
-        rds_ib_remove_nodev_conns();
+        rds_ib_destroy_nodev_conns();
         ib_unregister_client(&rds_ib_client);
         rds_ib_sysctl_exit();
         rds_ib_recv_exit();
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 8be563a1363a..069206cae733 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -108,7 +108,12 @@ struct rds_ib_connection {
 
         /* sending acks */
         unsigned long           i_ack_flags;
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_t              i_ack_next;     /* next ACK to send */
+#else
+        spinlock_t              i_ack_lock;     /* protect i_ack_next */
         u64                     i_ack_next;     /* next ACK to send */
+#endif
         struct rds_header       *i_ack;
         struct ib_send_wr       i_ack_wr;
         struct ib_sge           i_ack_sge;
@@ -267,9 +272,17 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn,
 
 /* ib_rdma.c */
 int rds_ib_update_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr);
-int rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn);
-void rds_ib_remove_nodev_conns(void);
-void rds_ib_remove_conns(struct rds_ib_device *rds_ibdev);
+void rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn);
+void rds_ib_remove_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn);
+void __rds_ib_destroy_conns(struct list_head *list, spinlock_t *list_lock);
+static inline void rds_ib_destroy_nodev_conns(void)
+{
+        __rds_ib_destroy_conns(&ib_nodev_conns, &ib_nodev_conns_lock);
+}
+static inline void rds_ib_destroy_conns(struct rds_ib_device *rds_ibdev)
+{
+        __rds_ib_destroy_conns(&rds_ibdev->conn_list, &rds_ibdev->spinlock);
+}
 struct rds_ib_mr_pool *rds_ib_create_mr_pool(struct rds_ib_device *);
 void rds_ib_get_mr_info(struct rds_ib_device *rds_ibdev, struct rds_info_rdma_connection *iinfo);
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *);
@@ -355,13 +368,4 @@ rds_ib_data_sge(struct rds_ib_connection *ic, struct ib_sge *sge)
         return &sge[1];
 }
 
-static inline void rds_ib_set_64bit(u64 *ptr, u64 val)
-{
-#if BITS_PER_LONG == 64
-        *ptr = val;
-#else
-        set_64bit(ptr, val);
-#endif
-}
-
 #endif
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 0532237bd128..f8e40e1a6038 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -126,9 +126,7 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
         err = rds_ib_update_ipaddr(rds_ibdev, conn->c_laddr);
         if (err)
                 printk(KERN_ERR "rds_ib_update_ipaddr failed (%d)\n", err);
-        err = rds_ib_add_conn(rds_ibdev, conn);
-        if (err)
-                printk(KERN_ERR "rds_ib_add_conn failed (%d)\n", err);
+        rds_ib_add_conn(rds_ibdev, conn);
 
         /* If the peer gave us the last packet it saw, process this as if
          * we had received a regular ACK. */
@@ -616,18 +614,8 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
                 /*
                  * Move connection back to the nodev list.
                  */
-                if (ic->rds_ibdev) {
-
-                        spin_lock_irq(&ic->rds_ibdev->spinlock);
-                        BUG_ON(list_empty(&ic->ib_node));
-                        list_del(&ic->ib_node);
-                        spin_unlock_irq(&ic->rds_ibdev->spinlock);
-
-                        spin_lock_irq(&ib_nodev_conns_lock);
-                        list_add_tail(&ic->ib_node, &ib_nodev_conns);
-                        spin_unlock_irq(&ib_nodev_conns_lock);
-                        ic->rds_ibdev = NULL;
-                }
+                if (ic->rds_ibdev)
+                        rds_ib_remove_conn(ic->rds_ibdev, conn);
 
                 ic->i_cm_id = NULL;
                 ic->i_pd = NULL;
@@ -648,7 +636,11 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
 
         /* Clear the ACK state */
         clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
-        rds_ib_set_64bit(&ic->i_ack_next, 0);
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_set(&ic->i_ack_next, 0);
+#else
+        ic->i_ack_next = 0;
+#endif
         ic->i_ack_recv = 0;
 
         /* Clear flow control state */
@@ -681,6 +673,9 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 
         INIT_LIST_HEAD(&ic->ib_node);
         mutex_init(&ic->i_recv_mutex);
+#ifndef KERNEL_HAS_ATOMIC64
+        spin_lock_init(&ic->i_ack_lock);
+#endif
 
         /*
          * rds_ib_conn_shutdown() waits for these to be emptied so they
@@ -701,11 +696,27 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         return 0;
 }
 
+/*
+ * Free a connection. Connection must be shut down and not set for reconnect.
+ */
 void rds_ib_conn_free(void *arg)
 {
         struct rds_ib_connection *ic = arg;
+        spinlock_t      *lock_ptr;
+
         rdsdebug("ic %p\n", ic);
+
+        /*
+         * Conn is either on a dev's list or on the nodev list.
+         * A race with shutdown() or connect() would cause problems
+         * (since rds_ibdev would change) but that should never happen.
+         */
+        lock_ptr = ic->rds_ibdev ? &ic->rds_ibdev->spinlock : &ib_nodev_conns_lock;
+
+        spin_lock_irq(lock_ptr);
         list_del(&ic->ib_node);
+        spin_unlock_irq(lock_ptr);
+
         kfree(ic);
 }
 
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 69a6289ed672..81033af93020 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -139,7 +139,7 @@ int rds_ib_update_ipaddr(struct rds_ib_device *rds_ibdev, __be32 ipaddr)
         return rds_ib_add_ipaddr(rds_ibdev, ipaddr);
 }
 
-int rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn)
+void rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn)
 {
         struct rds_ib_connection *ic = conn->c_transport_data;
 
@@ -148,45 +148,44 @@ int rds_ib_add_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn
         BUG_ON(list_empty(&ib_nodev_conns));
         BUG_ON(list_empty(&ic->ib_node));
         list_del(&ic->ib_node);
-        spin_unlock_irq(&ib_nodev_conns_lock);
 
         spin_lock_irq(&rds_ibdev->spinlock);
         list_add_tail(&ic->ib_node, &rds_ibdev->conn_list);
         spin_unlock_irq(&rds_ibdev->spinlock);
+        spin_unlock_irq(&ib_nodev_conns_lock);
 
         ic->rds_ibdev = rds_ibdev;
-
-        return 0;
 }
 
-void rds_ib_remove_nodev_conns(void)
+void rds_ib_remove_conn(struct rds_ib_device *rds_ibdev, struct rds_connection *conn)
 {
-        struct rds_ib_connection *ic, *_ic;
-        LIST_HEAD(tmp_list);
+        struct rds_ib_connection *ic = conn->c_transport_data;
 
-        /* avoid calling conn_destroy with irqs off */
-        spin_lock_irq(&ib_nodev_conns_lock);
-        list_splice(&ib_nodev_conns, &tmp_list);
-        INIT_LIST_HEAD(&ib_nodev_conns);
-        spin_unlock_irq(&ib_nodev_conns_lock);
+        /* place conn on nodev_conns_list */
+        spin_lock(&ib_nodev_conns_lock);
 
-        list_for_each_entry_safe(ic, _ic, &tmp_list, ib_node) {
-                if (ic->conn->c_passive)
-                        rds_conn_destroy(ic->conn->c_passive);
-                rds_conn_destroy(ic->conn);
-        }
+        spin_lock_irq(&rds_ibdev->spinlock);
+        BUG_ON(list_empty(&ic->ib_node));
+        list_del(&ic->ib_node);
+        spin_unlock_irq(&rds_ibdev->spinlock);
+
+        list_add_tail(&ic->ib_node, &ib_nodev_conns);
+
+        spin_unlock(&ib_nodev_conns_lock);
+
+        ic->rds_ibdev = NULL;
 }
 
-void rds_ib_remove_conns(struct rds_ib_device *rds_ibdev)
+void __rds_ib_destroy_conns(struct list_head *list, spinlock_t *list_lock)
 {
         struct rds_ib_connection *ic, *_ic;
         LIST_HEAD(tmp_list);
 
         /* avoid calling conn_destroy with irqs off */
-        spin_lock_irq(&rds_ibdev->spinlock);
-        list_splice(&rds_ibdev->conn_list, &tmp_list);
-        INIT_LIST_HEAD(&rds_ibdev->conn_list);
-        spin_unlock_irq(&rds_ibdev->spinlock);
+        spin_lock_irq(list_lock);
+        list_splice(list, &tmp_list);
+        INIT_LIST_HEAD(list);
+        spin_unlock_irq(list_lock);
 
         list_for_each_entry_safe(ic, _ic, &tmp_list, ib_node) {
                 if (ic->conn->c_passive)
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 5061b5502162..36d931573ff4 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -395,10 +395,37 @@ void rds_ib_recv_init_ack(struct rds_ib_connection *ic)
  * room for it beyond the ring size.  Send completion notices its special
  * wr_id and avoids working with the ring in that case.
  */
+#ifndef KERNEL_HAS_ATOMIC64
 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
                                 int ack_required)
 {
-        rds_ib_set_64bit(&ic->i_ack_next, seq);
+        unsigned long flags;
+
+        spin_lock_irqsave(&ic->i_ack_lock, flags);
+        ic->i_ack_next = seq;
+        if (ack_required)
+                set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+        spin_unlock_irqrestore(&ic->i_ack_lock, flags);
+}
+
+static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
+{
+        unsigned long flags;
+        u64 seq;
+
+        clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+
+        spin_lock_irqsave(&ic->i_ack_lock, flags);
+        seq = ic->i_ack_next;
+        spin_unlock_irqrestore(&ic->i_ack_lock, flags);
+
+        return seq;
+}
+#else
+static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
+                                int ack_required)
+{
+        atomic64_set(&ic->i_ack_next, seq);
         if (ack_required) {
                 smp_mb__before_clear_bit();
                 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
@@ -410,8 +437,10 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
         clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
         smp_mb__after_clear_bit();
 
-        return ic->i_ack_next;
+        return atomic64_read(&ic->i_ack_next);
 }
+#endif
+
 
 static void rds_ib_send_ack(struct rds_ib_connection *ic, unsigned int adv_credits)
 {
@@ -464,6 +493,10 @@ static void rds_ib_send_ack(struct rds_ib_connection *ic, unsigned int adv_credi
  *  -   i_ack_next, which is the last sequence number we received
  *
  * Potentially, send queue and receive queue handlers can run concurrently.
+ * It would be nice to not have to use a spinlock to synchronize things,
+ * but the one problem that rules this out is that 64bit updates are
+ * not atomic on all platforms. Things would be a lot simpler if
+ * we had atomic64 or maybe cmpxchg64 everywhere.
  *
  * Reconnecting complicates this picture just slightly. When we
  * reconnect, we may be seeing duplicate packets. The peer
diff --git a/net/rds/iw.c b/net/rds/iw.c
index 1b56905c4c08..b732efb5b634 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -51,6 +51,7 @@ MODULE_PARM_DESC(fastreg_message_size, " Max size of a RDMA transfer (fastreg MR
 
 struct list_head rds_iw_devices;
 
+/* NOTE: if also grabbing iwdev lock, grab this first */
 DEFINE_SPINLOCK(iw_nodev_conns_lock);
 LIST_HEAD(iw_nodev_conns);
 
@@ -145,7 +146,7 @@ void rds_iw_remove_one(struct ib_device *device)
         }
         spin_unlock_irq(&rds_iwdev->spinlock);
 
-        rds_iw_remove_conns(rds_iwdev);
+        rds_iw_destroy_conns(rds_iwdev);
 
         if (rds_iwdev->mr_pool)
                 rds_iw_destroy_mr_pool(rds_iwdev->mr_pool);
@@ -258,7 +259,7 @@ static int rds_iw_laddr_check(__be32 addr)
 void rds_iw_exit(void)
 {
         rds_info_deregister_func(RDS_INFO_IWARP_CONNECTIONS, rds_iw_ic_info);
-        rds_iw_remove_nodev_conns();
+        rds_iw_destroy_nodev_conns();
         ib_unregister_client(&rds_iw_client);
         rds_iw_sysctl_exit();
         rds_iw_recv_exit();
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 0ddda34f2a1c..b4fb27252895 100644
--- a/net/rds/iw.h
+++ b/net/rds/iw.h
@@ -131,7 +131,12 @@ struct rds_iw_connection {
 
         /* sending acks */
         unsigned long           i_ack_flags;
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_t              i_ack_next;     /* next ACK to send */
+#else
+        spinlock_t              i_ack_lock;     /* protect i_ack_next */
         u64                     i_ack_next;     /* next ACK to send */
+#endif
         struct rds_header       *i_ack;
         struct ib_send_wr       i_ack_wr;
         struct ib_sge           i_ack_sge;
@@ -294,9 +299,17 @@ void rds_iw_cm_connect_complete(struct rds_connection *conn,
 
 /* ib_rdma.c */
 int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_id);
-int rds_iw_add_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn);
-void rds_iw_remove_nodev_conns(void);
-void rds_iw_remove_conns(struct rds_iw_device *rds_iwdev);
+void rds_iw_add_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn);
+void rds_iw_remove_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn);
+void __rds_iw_destroy_conns(struct list_head *list, spinlock_t *list_lock);
+static inline void rds_iw_destroy_nodev_conns(void)
+{
+        __rds_iw_destroy_conns(&iw_nodev_conns, &iw_nodev_conns_lock);
+}
+static inline void rds_iw_destroy_conns(struct rds_iw_device *rds_iwdev)
+{
+        __rds_iw_destroy_conns(&rds_iwdev->conn_list, &rds_iwdev->spinlock);
+}
 struct rds_iw_mr_pool *rds_iw_create_mr_pool(struct rds_iw_device *);
 void rds_iw_get_mr_info(struct rds_iw_device *rds_iwdev, struct rds_info_rdma_connection *iinfo);
 void rds_iw_destroy_mr_pool(struct rds_iw_mr_pool *);
@@ -383,13 +396,4 @@ rds_iw_data_sge(struct rds_iw_connection *ic, struct ib_sge *sge)
         return &sge[1];
 }
 
-static inline void rds_iw_set_64bit(u64 *ptr, u64 val)
-{
-#if BITS_PER_LONG == 64
-        *ptr = val;
-#else
-        set_64bit(ptr, val);
-#endif
-}
-
 #endif
diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
index 57ecb3d4b8a5..a416b0d492b1 100644
--- a/net/rds/iw_cm.c
+++ b/net/rds/iw_cm.c
@@ -86,9 +86,7 @@ void rds_iw_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
         err = rds_iw_update_cm_id(rds_iwdev, ic->i_cm_id);
         if (err)
                 printk(KERN_ERR "rds_iw_update_ipaddr failed (%d)\n", err);
-        err = rds_iw_add_conn(rds_iwdev, conn);
-        if (err)
-                printk(KERN_ERR "rds_iw_add_conn failed (%d)\n", err);
+        rds_iw_add_conn(rds_iwdev, conn);
 
         /* If the peer gave us the last packet it saw, process this as if
          * we had received a regular ACK. */
@@ -637,19 +635,8 @@ void rds_iw_conn_shutdown(struct rds_connection *conn)
                  *      Move connection back to the nodev list.
                  *      Remove cm_id from the device cm_id list.
                  */
-                if (ic->rds_iwdev) {
-
-                        spin_lock_irq(&ic->rds_iwdev->spinlock);
-                        BUG_ON(list_empty(&ic->iw_node));
-                        list_del(&ic->iw_node);
-                        spin_unlock_irq(&ic->rds_iwdev->spinlock);
-
-                        spin_lock_irq(&iw_nodev_conns_lock);
-                        list_add_tail(&ic->iw_node, &iw_nodev_conns);
-                        spin_unlock_irq(&iw_nodev_conns_lock);
-                        rds_iw_remove_cm_id(ic->rds_iwdev, ic->i_cm_id);
-                        ic->rds_iwdev = NULL;
-                }
+                if (ic->rds_iwdev)
+                        rds_iw_remove_conn(ic->rds_iwdev, conn);
 
                 rdma_destroy_id(ic->i_cm_id);
 
@@ -672,7 +659,11 @@ void rds_iw_conn_shutdown(struct rds_connection *conn)
 
         /* Clear the ACK state */
         clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
-        rds_iw_set_64bit(&ic->i_ack_next, 0);
+#ifdef KERNEL_HAS_ATOMIC64
+        atomic64_set(&ic->i_ack_next, 0);
+#else
+        ic->i_ack_next = 0;
+#endif
         ic->i_ack_recv = 0;
 
         /* Clear flow control state */
@@ -706,6 +697,9 @@ int rds_iw_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 
         INIT_LIST_HEAD(&ic->iw_node);
         mutex_init(&ic->i_recv_mutex);
+#ifndef KERNEL_HAS_ATOMIC64
+        spin_lock_init(&ic->i_ack_lock);
+#endif
 
         /*
          * rds_iw_conn_shutdown() waits for these to be emptied so they
@@ -726,11 +720,27 @@ int rds_iw_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         return 0;
 }
 
+/*
+ * Free a connection. Connection must be shut down and not set for reconnect.
+ */
 void rds_iw_conn_free(void *arg)
 {
         struct rds_iw_connection *ic = arg;
+        spinlock_t      *lock_ptr;
+
         rdsdebug("ic %p\n", ic);
+
+        /*
+         * Conn is either on a dev's list or on the nodev list.
+         * A race with shutdown() or connect() would cause problems
+         * (since rds_iwdev would change) but that should never happen.
+         */
+        lock_ptr = ic->rds_iwdev ? &ic->rds_iwdev->spinlock : &iw_nodev_conns_lock;
+
+        spin_lock_irq(lock_ptr);
         list_del(&ic->iw_node);
+        spin_unlock_irq(lock_ptr);
+
         kfree(ic);
 }
 
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index 1c02a8f952d0..dcdb37da80f2 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -196,7 +196,7 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
         return rds_iw_add_cm_id(rds_iwdev, cm_id);
 }
 
-int rds_iw_add_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn)
+void rds_iw_add_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn)
 {
         struct rds_iw_connection *ic = conn->c_transport_data;
 
@@ -205,45 +205,45 @@ int rds_iw_add_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn
         BUG_ON(list_empty(&iw_nodev_conns));
         BUG_ON(list_empty(&ic->iw_node));
         list_del(&ic->iw_node);
-        spin_unlock_irq(&iw_nodev_conns_lock);
 
         spin_lock_irq(&rds_iwdev->spinlock);
         list_add_tail(&ic->iw_node, &rds_iwdev->conn_list);
         spin_unlock_irq(&rds_iwdev->spinlock);
+        spin_unlock_irq(&iw_nodev_conns_lock);
 
         ic->rds_iwdev = rds_iwdev;
-
-        return 0;
 }
 
-void rds_iw_remove_nodev_conns(void)
+void rds_iw_remove_conn(struct rds_iw_device *rds_iwdev, struct rds_connection *conn)
 {
-        struct rds_iw_connection *ic, *_ic;
-        LIST_HEAD(tmp_list);
+        struct rds_iw_connection *ic = conn->c_transport_data;
 
-        /* avoid calling conn_destroy with irqs off */
-        spin_lock_irq(&iw_nodev_conns_lock);
-        list_splice(&iw_nodev_conns, &tmp_list);
-        INIT_LIST_HEAD(&iw_nodev_conns);
-        spin_unlock_irq(&iw_nodev_conns_lock);
+        /* place conn on nodev_conns_list */
+        spin_lock(&iw_nodev_conns_lock);
 
-        list_for_each_entry_safe(ic, _ic, &tmp_list, iw_node) {
-                if (ic->conn->c_passive)
-                        rds_conn_destroy(ic->conn->c_passive);
-                rds_conn_destroy(ic->conn);
-        }
+        spin_lock_irq(&rds_iwdev->spinlock);
+        BUG_ON(list_empty(&ic->iw_node));
+        list_del(&ic->iw_node);
+        spin_unlock_irq(&rds_iwdev->spinlock);
+
+        list_add_tail(&ic->iw_node, &iw_nodev_conns);
+
+        spin_unlock(&iw_nodev_conns_lock);
+
+        rds_iw_remove_cm_id(ic->rds_iwdev, ic->i_cm_id);
+        ic->rds_iwdev = NULL;
 }
 
-void rds_iw_remove_conns(struct rds_iw_device *rds_iwdev)
+void __rds_iw_destroy_conns(struct list_head *list, spinlock_t *list_lock)
 {
         struct rds_iw_connection *ic, *_ic;
         LIST_HEAD(tmp_list);
 
         /* avoid calling conn_destroy with irqs off */
-        spin_lock_irq(&rds_iwdev->spinlock);
-        list_splice(&rds_iwdev->conn_list, &tmp_list);
-        INIT_LIST_HEAD(&rds_iwdev->conn_list);
-        spin_unlock_irq(&rds_iwdev->spinlock);
+        spin_lock_irq(list_lock);
+        list_splice(list, &tmp_list);
+        INIT_LIST_HEAD(list);
+        spin_unlock_irq(list_lock);
 
         list_for_each_entry_safe(ic, _ic, &tmp_list, iw_node) {
                 if (ic->conn->c_passive)
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index a1931f0027a2..fde470fa50d5 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -395,10 +395,37 @@ void rds_iw_recv_init_ack(struct rds_iw_connection *ic)
  * room for it beyond the ring size.  Send completion notices its special
  * wr_id and avoids working with the ring in that case.
  */
+#ifndef KERNEL_HAS_ATOMIC64
 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
                                 int ack_required)
 {
-        rds_iw_set_64bit(&ic->i_ack_next, seq);
+        unsigned long flags;
+
+        spin_lock_irqsave(&ic->i_ack_lock, flags);
+        ic->i_ack_next = seq;
+        if (ack_required)
+                set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+        spin_unlock_irqrestore(&ic->i_ack_lock, flags);
+}
+
+static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
+{
+        unsigned long flags;
+        u64 seq;
+
+        clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+
+        spin_lock_irqsave(&ic->i_ack_lock, flags);
+        seq = ic->i_ack_next;
+        spin_unlock_irqrestore(&ic->i_ack_lock, flags);
+
+        return seq;
+}
+#else
+static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
+                                int ack_required)
+{
+        atomic64_set(&ic->i_ack_next, seq);
         if (ack_required) {
                 smp_mb__before_clear_bit();
                 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
@@ -410,8 +437,10 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
         clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
         smp_mb__after_clear_bit();
 
-        return ic->i_ack_next;
+        return atomic64_read(&ic->i_ack_next);
 }
+#endif
+
 
 static void rds_iw_send_ack(struct rds_iw_connection *ic, unsigned int adv_credits)
 {
@@ -464,6 +493,10 @@ static void rds_iw_send_ack(struct rds_iw_connection *ic, unsigned int adv_credi
  *  -   i_ack_next, which is the last sequence number we received
  *
  * Potentially, send queue and receive queue handlers can run concurrently.
+ * It would be nice to not have to use a spinlock to synchronize things,
+ * but the one problem that rules this out is that 64bit updates are
+ * not atomic on all platforms. Things would be a lot simpler if
+ * we had atomic64 or maybe cmpxchg64 everywhere.
  *
  * Reconnecting complicates this picture just slightly. When we
  * reconnect, we may be seeing duplicate packets. The peer
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 060400704979..619f0a30a4e5 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -28,6 +28,10 @@
  */
 #define RDS_PORT        18634
 
+#ifdef ATOMIC64_INIT
+#define KERNEL_HAS_ATOMIC64
+#endif
+
 #ifdef DEBUG
 #define rdsdebug(fmt, args...) pr_debug("%s(): " fmt, __func__ , ##args)
 #else
diff --git a/net/rds/send.c b/net/rds/send.c
index 1b37364656f0..104fe033203d 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -615,7 +615,7 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
 {
         struct rds_message *rm, *tmp;
         struct rds_connection *conn;
-        unsigned long flags;
+        unsigned long flags, flags2;
         LIST_HEAD(list);
         int wake = 0;
 
@@ -651,9 +651,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
         list_for_each_entry(rm, &list, m_sock_item) {
                 /* We do this here rather than in the loop above, so that
                  * we don't have to nest m_rs_lock under rs->rs_lock */
-                spin_lock(&rm->m_rs_lock);
+                spin_lock_irqsave(&rm->m_rs_lock, flags2);
                 rm->m_rs = NULL;
-                spin_unlock(&rm->m_rs_lock);
+                spin_unlock_irqrestore(&rm->m_rs_lock, flags2);
 
                 /*
                  * If we see this flag cleared then we're *sure* that someone
diff --git a/net/socket.c b/net/socket.c
index 91d0c0254ffe..791d71a36a93 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -493,8 +493,7 @@ static struct socket *sock_alloc(void)
         inode->i_uid = current_fsuid();
         inode->i_gid = current_fsgid();
 
-        get_cpu_var(sockets_in_use)++;
-        put_cpu_var(sockets_in_use);
+        percpu_add(sockets_in_use, 1);
         return sock;
 }
 
@@ -536,8 +535,7 @@ void sock_release(struct socket *sock)
         if (sock->fasync_list)
                 printk(KERN_ERR "sock_release: fasync list not empty!\n");
 
-        get_cpu_var(sockets_in_use)--;
-        put_cpu_var(sockets_in_use);
+        percpu_sub(sockets_in_use, 1);
         if (!sock->file) {
                 iput(SOCK_INODE(sock));
                 return;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index afd91c78ce8e..443c161eb8bd 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -47,7 +47,7 @@ config RPCSEC_GSS_SPKM3
         select CRYPTO_CBC
         help
           Choose Y here to enable Secure RPC using the SPKM3 public key
-          GSS-API mechansim (RFC 2025).
+          GSS-API mechanism (RFC 2025).
 
           Secure RPC calls with SPKM3 require an auxiliary userspace
           daemon which may be found in the Linux nfs-utils package
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 9f2f2412a2f3..8847add6ca16 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -317,8 +317,7 @@ svc_pool_map_set_cpumask(struct task_struct *task, unsigned int pidx)
         }
         case SVC_POOL_PERNODE:
         {
-                node_to_cpumask_ptr(nodecpumask, node);
-                set_cpus_allowed_ptr(task, nodecpumask);
+                set_cpus_allowed_ptr(task, cpumask_of_node(node));
                 break;
         }
         }
@@ -1009,6 +1008,8 @@ svc_process(struct svc_rqst *rqstp)
         rqstp->rq_res.tail[0].iov_len = 0;
         /* Will be turned off only in gss privacy case: */
         rqstp->rq_splice_ok = 1;
+        /* Will be turned off only when NFSv4 Sessions are used */
+        rqstp->rq_usedeferral = 1;
 
         /* Setup reply header */
         rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
@@ -1079,7 +1080,6 @@ svc_process(struct svc_rqst *rqstp)
         procp = versp->vs_proc + proc;
         if (proc >= versp->vs_nproc || !procp->pc_func)
                 goto err_bad_proc;
-        rqstp->rq_server   = serv;
         rqstp->rq_procinfo = procp;
 
         /* Syntactic check complete */
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 2819ee093f36..c200d92e57e4 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -14,6 +14,8 @@
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
+#define SVC_MAX_WAKING 5
+
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
 static struct cache_deferred_req *svc_defer(struct cache_req *req);
@@ -301,6 +303,7 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
         struct svc_pool *pool;
         struct svc_rqst *rqstp;
         int cpu;
+        int thread_avail;
 
         if (!(xprt->xpt_flags &
               ((1<<XPT_CONN)|(1<<XPT_DATA)|(1<<XPT_CLOSE)|(1<<XPT_DEFERRED))))
@@ -312,18 +315,14 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
 
         spin_lock_bh(&pool->sp_lock);
 
-        if (!list_empty(&pool->sp_threads) &&
-            !list_empty(&pool->sp_sockets))
-                printk(KERN_ERR
-                       "svc_xprt_enqueue: "
-                       "threads and transports both waiting??\n");
-
         if (test_bit(XPT_DEAD, &xprt->xpt_flags)) {
                 /* Don't enqueue dead transports */
                 dprintk("svc: transport %p is dead, not enqueued\n", xprt);
                 goto out_unlock;
         }
 
+        pool->sp_stats.packets++;
+
         /* Mark transport as busy. It will remain in this state until
          * the provider calls svc_xprt_received. We update XPT_BUSY
          * atomically because it also guards against trying to enqueue
@@ -356,7 +355,15 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
         }
 
  process:
-        if (!list_empty(&pool->sp_threads)) {
+        /* Work out whether threads are available */
+        thread_avail = !list_empty(&pool->sp_threads);  /* threads are asleep */
+        if (pool->sp_nwaking >= SVC_MAX_WAKING) {
+                /* too many threads are runnable and trying to wake up */
+                thread_avail = 0;
+                pool->sp_stats.overloads_avoided++;
+        }
+
+        if (thread_avail) {
                 rqstp = list_entry(pool->sp_threads.next,
                                    struct svc_rqst,
                                    rq_list);
@@ -371,11 +378,15 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
                 svc_xprt_get(xprt);
                 rqstp->rq_reserved = serv->sv_max_mesg;
                 atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+                rqstp->rq_waking = 1;
+                pool->sp_nwaking++;
+                pool->sp_stats.threads_woken++;
                 BUG_ON(xprt->xpt_pool != pool);
                 wake_up(&rqstp->rq_wait);
         } else {
                 dprintk("svc: transport %p put into queue\n", xprt);
                 list_add_tail(&xprt->xpt_ready, &pool->sp_sockets);
+                pool->sp_stats.sockets_queued++;
                 BUG_ON(xprt->xpt_pool != pool);
         }
 
@@ -588,6 +599,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
         int                     pages;
         struct xdr_buf          *arg;
         DECLARE_WAITQUEUE(wait, current);
+        long                    time_left;
 
         dprintk("svc: server %p waiting for data (to = %ld)\n",
                 rqstp, timeout);
@@ -636,6 +648,11 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 return -EINTR;
 
         spin_lock_bh(&pool->sp_lock);
+        if (rqstp->rq_waking) {
+                rqstp->rq_waking = 0;
+                pool->sp_nwaking--;
+                BUG_ON(pool->sp_nwaking < 0);
+        }
         xprt = svc_xprt_dequeue(pool);
         if (xprt) {
                 rqstp->rq_xprt = xprt;
@@ -668,12 +685,14 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 add_wait_queue(&rqstp->rq_wait, &wait);
                 spin_unlock_bh(&pool->sp_lock);
 
-                schedule_timeout(timeout);
+                time_left = schedule_timeout(timeout);
 
                 try_to_freeze();
 
                 spin_lock_bh(&pool->sp_lock);
                 remove_wait_queue(&rqstp->rq_wait, &wait);
+                if (!time_left)
+                        pool->sp_stats.threads_timedout++;
 
                 xprt = rqstp->rq_xprt;
                 if (!xprt) {
@@ -958,7 +977,7 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req)
         struct svc_rqst *rqstp = container_of(req, struct svc_rqst, rq_chandle);
         struct svc_deferred_req *dr;
 
-        if (rqstp->rq_arg.page_len)
+        if (rqstp->rq_arg.page_len || !rqstp->rq_usedeferral)
                 return NULL; /* if more than a page, give up FIXME */
         if (rqstp->rq_deferred) {
                 dr = rqstp->rq_deferred;
@@ -1112,3 +1131,93 @@ int svc_xprt_names(struct svc_serv *serv, char *buf, int buflen)
         return totlen;
 }
 EXPORT_SYMBOL_GPL(svc_xprt_names);
+
+
+/*----------------------------------------------------------------------------*/
+
+static void *svc_pool_stats_start(struct seq_file *m, loff_t *pos)
+{
+        unsigned int pidx = (unsigned int)*pos;
+        struct svc_serv *serv = m->private;
+
+        dprintk("svc_pool_stats_start, *pidx=%u\n", pidx);
+
+        lock_kernel();
+        /* bump up the pseudo refcount while traversing */
+        svc_get(serv);
+        unlock_kernel();
+
+        if (!pidx)
+                return SEQ_START_TOKEN;
+        return (pidx > serv->sv_nrpools ? NULL : &serv->sv_pools[pidx-1]);
+}
+
+static void *svc_pool_stats_next(struct seq_file *m, void *p, loff_t *pos)
+{
+        struct svc_pool *pool = p;
+        struct svc_serv *serv = m->private;
+
+        dprintk("svc_pool_stats_next, *pos=%llu\n", *pos);
+
+        if (p == SEQ_START_TOKEN) {
+                pool = &serv->sv_pools[0];
+        } else {
+                unsigned int pidx = (pool - &serv->sv_pools[0]);
+                if (pidx < serv->sv_nrpools-1)
+                        pool = &serv->sv_pools[pidx+1];
+                else
+                        pool = NULL;
+        }
+        ++*pos;
+        return pool;
+}
+
+static void svc_pool_stats_stop(struct seq_file *m, void *p)
+{
+        struct svc_serv *serv = m->private;
+
+        lock_kernel();
+        /* this function really, really should have been called svc_put() */
+        svc_destroy(serv);
+        unlock_kernel();
+}
+
+static int svc_pool_stats_show(struct seq_file *m, void *p)
+{
+        struct svc_pool *pool = p;
+
+        if (p == SEQ_START_TOKEN) {
+                seq_puts(m, "# pool packets-arrived sockets-enqueued threads-woken overloads-avoided threads-timedout\n");
+                return 0;
+        }
+
+        seq_printf(m, "%u %lu %lu %lu %lu %lu\n",
+                pool->sp_id,
+                pool->sp_stats.packets,
+                pool->sp_stats.sockets_queued,
+                pool->sp_stats.threads_woken,
+                pool->sp_stats.overloads_avoided,
+                pool->sp_stats.threads_timedout);
+
+        return 0;
+}
+
+static const struct seq_operations svc_pool_stats_seq_ops = {
+        .start  = svc_pool_stats_start,
+        .next   = svc_pool_stats_next,
+        .stop   = svc_pool_stats_stop,
+        .show   = svc_pool_stats_show,
+};
+
+int svc_pool_stats_open(struct svc_serv *serv, struct file *file)
+{
+        int err;
+
+        err = seq_open(file, &svc_pool_stats_seq_ops);
+        if (!err)
+                ((struct seq_file *) file->private_data)->private = serv;
+        return err;
+}
+EXPORT_SYMBOL(svc_pool_stats_open);
+
+/*----------------------------------------------------------------------------*/
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 9d504234af4a..af3198814c15 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -345,7 +345,6 @@ static void svc_sock_setbufsize(struct socket *sock, unsigned int snd,
         lock_sock(sock->sk);
         sock->sk->sk_sndbuf = snd * 2;
         sock->sk->sk_rcvbuf = rcv * 2;
-        sock->sk->sk_userlocks |= SOCK_SNDBUF_LOCK|SOCK_RCVBUF_LOCK;
         release_sock(sock->sk);
 #endif
 }
@@ -797,23 +796,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
                 test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
 
-        if (test_and_clear_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags))
-                /* sndbuf needs to have room for one request
-                 * per thread, otherwise we can stall even when the
-                 * network isn't a bottleneck.
-                 *
-                 * We count all threads rather than threads in a
-                 * particular pool, which provides an upper bound
-                 * on the number of threads which will access the socket.
-                 *
-                 * rcvbuf just needs to be able to hold a few requests.
-                 * Normally they will be removed from the queue
-                 * as soon a a complete request arrives.
-                 */
-                svc_sock_setbufsize(svsk->sk_sock,
-                                    (serv->sv_nrthreads+3) * serv->sv_max_mesg,
-                                    3 * serv->sv_max_mesg);
-
         clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
 
         /* Receive data. If we haven't got the record length yet, get
@@ -1061,15 +1043,6 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
 
                 tcp_sk(sk)->nonagle |= TCP_NAGLE_OFF;
 
-                /* initialise setting must have enough space to
-                 * receive and respond to one request.
-                 * svc_tcp_recvfrom will re-adjust if necessary
-                 */
-                svc_sock_setbufsize(svsk->sk_sock,
-                                    3 * svsk->sk_xprt.xpt_server->sv_max_mesg,
-                                    3 * svsk->sk_xprt.xpt_server->sv_max_mesg);
-
-                set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 if (sk->sk_state != TCP_ESTABLISHED)
                         set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
@@ -1139,8 +1112,14 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
         /* Initialize the socket */
         if (sock->type == SOCK_DGRAM)
                 svc_udp_init(svsk, serv);
-        else
+        else {
+                /* initialise setting must have enough space to
+                 * receive and respond to one request.
+                 */
+                svc_sock_setbufsize(svsk->sk_sock, 4 * serv->sv_max_mesg,
+                                        4 * serv->sv_max_mesg);
                 svc_tcp_init(svsk, serv);
+        }
 
         dprintk("svc: svc_setup_socket created %p (inet %p)\n",
                                 svsk, svsk->sk_sk);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index baac91049b0e..9dcc6e7f96ec 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -832,7 +832,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                  * All right, let's create it.
                  */
                 mode = S_IFSOCK |
-                       (SOCK_INODE(sock)->i_mode & ~current->fs->umask);
+                       (SOCK_INODE(sock)->i_mode & ~current_umask());
                 err = mnt_want_write(nd.path.mnt);
                 if (err)
                         goto out_mknod_dput;
diff --git a/net/wimax/Kconfig b/net/wimax/Kconfig
index 18495cdcd10d..1b46747a5f5a 100644
--- a/net/wimax/Kconfig
+++ b/net/wimax/Kconfig
@@ -8,7 +8,7 @@
 #
 # As well, enablement of the RFKILL code means we need the INPUT layer
 # support to inject events coming from hw rfkill switches. That
-# dependency could be killed if input.h provided appropiate means to
+# dependency could be killed if input.h provided appropriate means to
 # work when input is disabled.
 
 comment "WiMAX Wireless Broadband support requires CONFIG_INPUT enabled"